Merge with git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git

1536 files changed, 23398 insertions, 17435 deletions

diff --git a/CREDITS b/CREDITS
index 8e577ce4abeb..1f171f1033bd 100644
--- a/CREDITS
+++ b/CREDITS
@@ -120,7 +120,6 @@ D: Author of lil (Linux Interrupt Latency benchmark)
 D: Fixed the shm swap deallocation at swapoff time (try_to_unuse message)
 D: VM hacker
 D: Various other kernel hacks
-S: Via Cicalini 26
 S: Imola 40026
 S: Italy
 
@@ -3101,7 +3100,7 @@ S: Minto, NSW, 2566
 S: Australia
 
 N: Stephen Smalley
-E: sds@epoch.ncsc.mil
+E: sds@tycho.nsa.gov
 D: portions of the Linux Security Module (LSM) framework and security modules
 
 N: Chris Smith
@@ -3643,11 +3642,9 @@ S: Cambridge. CB1 7EG
 S: England
 
 N: Chris Wright
-E: chrisw@osdl.org
+E: chrisw@sous-sol.org
 D: hacking on LSM framework and security modules.
-S: c/o OSDL
-S: 12725 SW Millikan Way, Suite 400
-S: Beaverton, OR 97005
+S: Portland, OR
 S: USA
 
 N: Michal Wronski
diff --git a/Documentation/cpu-hotplug.txt b/Documentation/cpu-hotplug.txt
index 08c5d04f3086..57a09f99ecb0 100644
--- a/Documentation/cpu-hotplug.txt
+++ b/Documentation/cpu-hotplug.txt
@@ -11,6 +11,8 @@
                         Joel Schopp <jschopp@austin.ibm.com>
                 ia64/x86_64:
                         Ashok Raj <ashok.raj@intel.com>
+                s390:
+                        Heiko Carstens <heiko.carstens@de.ibm.com>
 
 Authors: Ashok Raj <ashok.raj@intel.com>
 Lots of feedback: Nathan Lynch <nathanl@austin.ibm.com>,
@@ -44,9 +46,28 @@ maxcpus=n    Restrict boot time cpus to n. Say if you have 4 cpus, using
              maxcpus=2 will only boot 2. You can choose to bring the
              other cpus later online, read FAQ's for more info.
 
-additional_cpus=n       [x86_64 only] use this to limit hotpluggable cpus.
-                        This option sets
-                        cpu_possible_map = cpu_present_map + additional_cpus
+additional_cpus*=n      Use this to limit hotpluggable cpus. This option sets
+                        cpu_possible_map = cpu_present_map + additional_cpus
+
+(*) Option valid only for following architectures
+- x86_64, ia64, s390
+
+ia64 and x86_64 use the number of disabled local apics in ACPI tables MADT
+to determine the number of potentially hot-pluggable cpus. The implementation
+should only rely on this to count the #of cpus, but *MUST* not rely on the
+apicid values in those tables for disabled apics. In the event BIOS doesnt
+mark such hot-pluggable cpus as disabled entries, one could use this
+parameter "additional_cpus=x" to represent those cpus in the cpu_possible_map.
+
+s390 uses the number of cpus it detects at IPL time to also the number of bits
+in cpu_possible_map. If it is desired to add additional cpus at a later time
+the number should be specified using this option or the possible_cpus option.
+
+possible_cpus=n         [s390 only] use this to set hotpluggable cpus.
+                        This option sets possible_cpus bits in
+                        cpu_possible_map. Thus keeping the numbers of bits set
+                        constant even if the machine gets rebooted.
+                        This option overrides additional_cpus.
 
 CPU maps and such
 -----------------
diff --git a/Documentation/cpusets.txt b/Documentation/cpusets.txt
index 990998ee10b6..30c41459953c 100644
--- a/Documentation/cpusets.txt
+++ b/Documentation/cpusets.txt
@@ -4,8 +4,9 @@
 Copyright (C) 2004 BULL SA.
 Written by Simon.Derr@bull.net
 
-Portions Copyright (c) 2004 Silicon Graphics, Inc.
+Portions Copyright (c) 2004-2006 Silicon Graphics, Inc.
 Modified by Paul Jackson <pj@sgi.com>
+Modified by Christoph Lameter <clameter@sgi.com>
 
 CONTENTS:
 =========
@@ -90,7 +91,8 @@ This can be especially valuable on:
 
 These subsets, or "soft partitions" must be able to be dynamically
 adjusted, as the job mix changes, without impacting other concurrently
-executing jobs.
+executing jobs. The location of the running jobs pages may also be moved
+when the memory locations are changed.
 
 The kernel cpuset patch provides the minimum essential kernel
 mechanisms required to efficiently implement such subsets.  It
@@ -102,8 +104,8 @@ memory allocator code.
 1.3 How are cpusets implemented ?
 ---------------------------------
 
-Cpusets provide a Linux kernel (2.6.7 and above) mechanism to constrain
-which CPUs and Memory Nodes are used by a process or set of processes.
+Cpusets provide a Linux kernel mechanism to constrain which CPUs and
+Memory Nodes are used by a process or set of processes.
 
 The Linux kernel already has a pair of mechanisms to specify on which
 CPUs a task may be scheduled (sched_setaffinity) and on which Memory
@@ -371,22 +373,17 @@ cpusets memory placement policy 'mems' subsequently changes.
 If the cpuset flag file 'memory_migrate' is set true, then when
 tasks are attached to that cpuset, any pages that task had
 allocated to it on nodes in its previous cpuset are migrated
-to the tasks new cpuset.  Depending on the implementation,
-this migration may either be done by swapping the page out,
-so that the next time the page is referenced, it will be paged
-into the tasks new cpuset, usually on the node where it was
-referenced, or this migration may be done by directly copying
-the pages from the tasks previous cpuset to the new cpuset,
-where possible to the same node, relative to the new cpuset,
-as the node that held the page, relative to the old cpuset.
+to the tasks new cpuset. The relative placement of the page within
+the cpuset is preserved during these migration operations if possible.
+For example if the page was on the second valid node of the prior cpuset
+then the page will be placed on the second valid node of the new cpuset.
+
 Also if 'memory_migrate' is set true, then if that cpusets
 'mems' file is modified, pages allocated to tasks in that
 cpuset, that were on nodes in the previous setting of 'mems',
-will be moved to nodes in the new setting of 'mems.'  Again,
-depending on the implementation, this might be done by swapping,
-or by direct copying.  In either case, pages that were not in
-the tasks prior cpuset, or in the cpusets prior 'mems' setting,
-will not be moved.
+will be moved to nodes in the new setting of 'mems.'
+Pages that were not in the tasks prior cpuset, or in the cpusets
+prior 'mems' setting, will not be moved.
 
 There is an exception to the above.  If hotplug functionality is used
 to remove all the CPUs that are currently assigned to a cpuset,
@@ -434,16 +431,6 @@ and then start a subshell 'sh' in that cpuset:
   # The next line should display '/Charlie'
   cat /proc/self/cpuset
 
-In the case that a change of cpuset includes wanting to move already
-allocated memory pages, consider further the work of IWAMOTO
-Toshihiro <iwamoto@valinux.co.jp> for page remapping and memory
-hotremoval, which can be found at:
-
-  http://people.valinux.co.jp/~iwamoto/mh.html
-
-The integration of cpusets with such memory migration is not yet
-available.
-
 In the future, a C library interface to cpusets will likely be
 available.  For now, the only way to query or modify cpusets is
 via the cpuset file system, using the various cd, mkdir, echo, cat,
diff --git a/Documentation/dvb/bt8xx.txt b/Documentation/dvb/bt8xx.txt
index df6c05453cb5..52ed462061df 100644
--- a/Documentation/dvb/bt8xx.txt
+++ b/Documentation/dvb/bt8xx.txt
@@ -111,4 +111,8 @@ source:  linux/Documentation/video4linux/CARDLIST.bttv
 If you have problems with this please do ask on the mailing list.
 
 --
-Authors: Richard Walker, Jamie Honan, Michael Hunold, Manu Abraham
+Authors: Richard Walker,
+         Jamie Honan,
+         Michael Hunold,
+         Manu Abraham,
+         Michael Krufky
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 4d4897c8ef96..81bc51369f59 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -162,3 +162,30 @@ What:	pci_module_init(driver)
 When:   January 2007
 Why:    Is replaced by pci_register_driver(pci_driver).
 Who:    Richard Knutsson <ricknu-0@student.ltu.se> and Greg Kroah-Hartman <gregkh@suse.de>
+
+---------------------------
+
+What:   I2C interface of the it87 driver
+When:   January 2007
+Why:    The ISA interface is faster and should be always available. The I2C
+        probing is also known to cause trouble in at least one case (see
+        bug #5889.)
+Who:    Jean Delvare <khali@linux-fr.org>
+
+---------------------------
+
+What:   mount/umount uevents
+When:   February 2007
+Why:    These events are not correct, and do not properly let userspace know
+        when a file system has been mounted or unmounted.  Userspace should
+        poll the /proc/mounts file instead to detect this properly.
+Who:    Greg Kroah-Hartman <gregkh@suse.de>
+
+---------------------------
+
+What:   Support for NEC DDB5074 and DDB5476 evaluation boards.
+When:   June 2006
+Why:    Board specific code doesn't build anymore since ~2.6.0 and no
+        users have complained indicating there is no more need for these
+        boards.  This should really be considered a last call.
+Who:    Ralf Baechle <ralf@linux-mips.org>
diff --git a/Documentation/filesystems/configfs/configfs_example.c b/Documentation/filesystems/configfs/configfs_example.c
index f3c6e4946f98..3d4713a6c207 100644
--- a/Documentation/filesystems/configfs/configfs_example.c
+++ b/Documentation/filesystems/configfs/configfs_example.c
@@ -320,6 +320,7 @@ static struct config_item_type simple_children_type = {
         .ct_item_ops    = &simple_children_item_ops,
         .ct_group_ops   = &simple_children_group_ops,
         .ct_attrs       = simple_children_attrs,
+        .ct_owner       = THIS_MODULE,
 };
 
 static struct configfs_subsystem simple_children_subsys = {
@@ -403,6 +404,7 @@ static struct config_item_type group_children_type = {
         .ct_item_ops    = &group_children_item_ops,
         .ct_group_ops   = &group_children_group_ops,
         .ct_attrs       = group_children_attrs,
+        .ct_owner       = THIS_MODULE,
 };
 
 static struct configfs_subsystem group_children_subsys = {
diff --git a/Documentation/filesystems/ntfs.txt b/Documentation/filesystems/ntfs.txt
index 614de3124901..251168587899 100644
--- a/Documentation/filesystems/ntfs.txt
+++ b/Documentation/filesystems/ntfs.txt
@@ -457,6 +457,12 @@ ChangeLog
 
 Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
 
+2.1.26:
+        - Implement support for sector sizes above 512 bytes (up to the maximum
+          supported by NTFS which is 4096 bytes).
+        - Enhance support for NTFS volumes which were supported by Windows but
+          not by Linux due to invalid attribute list attribute flags.
+        - A few minor updates and bug fixes.
 2.1.25:
         - Write support is now extended with write(2) being able to both
           overwrite existing file data and to extend files.  Also, if a write
diff --git a/Documentation/filesystems/ocfs2.txt b/Documentation/filesystems/ocfs2.txt
index f2595caf052e..4389c684a80a 100644
--- a/Documentation/filesystems/ocfs2.txt
+++ b/Documentation/filesystems/ocfs2.txt
@@ -35,6 +35,7 @@ Features which OCFS2 does not support yet:
           be cluster coherent.
         - quotas
         - cluster aware flock
+        - cluster aware lockf
         - Directory change notification (F_NOTIFY)
         - Distributed Caching (F_SETLEASE/F_GETLEASE/break_lease)
         - POSIX ACLs
diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
index dbe4d87d2615..1773106976a2 100644
--- a/Documentation/filesystems/tmpfs.txt
+++ b/Documentation/filesystems/tmpfs.txt
@@ -79,15 +79,27 @@ that instance in a system with many cpus making intensive use of it.
 
 
 tmpfs has a mount option to set the NUMA memory allocation policy for
-all files in that instance:
-mpol=interleave         prefers to allocate memory from each node in turn
-mpol=default            prefers to allocate memory from the local node
-mpol=bind               prefers to allocate from mpol_nodelist
-mpol=preferred          prefers to allocate from first node in mpol_nodelist
+all files in that instance (if CONFIG_NUMA is enabled) - which can be
+adjusted on the fly via 'mount -o remount ...'
 
-The following mount option is used in conjunction with mpol=interleave,
-mpol=bind or mpol=preferred:
-mpol_nodelist:  nodelist suitable for parsing with nodelist_parse.
+mpol=default             prefers to allocate memory from the local node
+mpol=prefer:Node         prefers to allocate memory from the given Node
+mpol=bind:NodeList       allocates memory only from nodes in NodeList
+mpol=interleave          prefers to allocate from each node in turn
+mpol=interleave:NodeList allocates from each node of NodeList in turn
+
+NodeList format is a comma-separated list of decimal numbers and ranges,
+a range being two hyphen-separated decimal numbers, the smallest and
+largest node numbers in the range.  For example, mpol=bind:0-3,5,7,9-15
+
+Note that trying to mount a tmpfs with an mpol option will fail if the
+running kernel does not support NUMA; and will fail if its nodelist
+specifies a node >= MAX_NUMNODES.  If your system relies on that tmpfs
+being mounted, but from time to time runs a kernel built without NUMA
+capability (perhaps a safe recovery kernel), or configured to support
+fewer nodes, then it is advisable to omit the mpol option from automatic
+mount options.  It can be added later, when the tmpfs is already mounted
+on MountPoint, by 'mount -o remount,mpol=Policy:NodeList MountPoint'.
 
 
 To specify the initial root directory you can use the following mount
@@ -109,4 +121,4 @@ RAM/SWAP in 10240 inodes and it is only accessible by root.
 Author:
    Christoph Rohland <cr@sap.com>, 1.12.01
 Updated:
-   Hugh Dickins <hugh@veritas.com>, 13 March 2005
+   Hugh Dickins <hugh@veritas.com>, 19 February 2006
diff --git a/Documentation/filesystems/v9fs.txt b/Documentation/filesystems/v9fs.txt
index 4e92feb6b507..24c7a9c41f0d 100644
--- a/Documentation/filesystems/v9fs.txt
+++ b/Documentation/filesystems/v9fs.txt
@@ -57,8 +57,6 @@ OPTIONS
 
   port=n        port to connect to on the remote server
 
-  timeout=n     request timeouts (in ms) (default 60000ms)
-
   noextend      force legacy mode (no 9P2000.u semantics)
 
   uid           attempt to mount as a particular uid
@@ -74,10 +72,16 @@ OPTIONS
 RESOURCES
 =========
 
-The Linux version of the 9P server, along with some client-side utilities
-can be found at http://v9fs.sf.net (along with a CVS repository of the
-development branch of this module).  There are user and developer mailing
-lists here, as well as a bug-tracker.
+The Linux version of the 9P server is now maintained under the npfs project
+on sourceforge (http://sourceforge.net/projects/npfs).
+
+There are user and developer mailing lists available through the v9fs project
+on sourceforge (http://sourceforge.net/projects/v9fs).
+
+News and other information is maintained on SWiK (http://swik.net/v9fs).
+
+Bug reports may be issued through the kernel.org bugzilla 
+(http://bugzilla.kernel.org)
 
 For more information on the Plan 9 Operating System check out
 http://plan9.bell-labs.com/plan9
diff --git a/Documentation/fujitsu/frv/kernel-ABI.txt b/Documentation/fujitsu/frv/kernel-ABI.txt
new file mode 100644
index 000000000000..0ed9b0a779bc
--- /dev/null
+++ b/Documentation/fujitsu/frv/kernel-ABI.txt
@@ -0,0 +1,234 @@
+                                 =================================
+                                 INTERNAL KERNEL ABI FOR FR-V ARCH
+                                 =================================
+
+The internal FRV kernel ABI is not quite the same as the userspace ABI. A number of the registers
+are used for special purposed, and the ABI is not consistent between modules vs core, and MMU vs
+no-MMU.
+
+This partly stems from the fact that FRV CPUs do not have a separate supervisor stack pointer, and
+most of them do not have any scratch registers, thus requiring at least one general purpose
+register to be clobbered in such an event. Also, within the kernel core, it is possible to simply
+jump or call directly between functions using a relative offset. This cannot be extended to modules
+for the displacement is likely to be too far. Thus in modules the address of a function to call
+must be calculated in a register and then used, requiring two extra instructions.
+
+This document has the following sections:
+
+ (*) System call register ABI
+ (*) CPU operating modes
+ (*) Internal kernel-mode register ABI
+ (*) Internal debug-mode register ABI
+ (*) Virtual interrupt handling
+
+
+========================
+SYSTEM CALL REGISTER ABI
+========================
+
+When a system call is made, the following registers are effective:
+
+        REGISTERS       CALL                    RETURN
+        =============== ======================= =======================
+        GR7             System call number      Preserved
+        GR8             Syscall arg #1          Return value
+        GR9-GR13        Syscall arg #2-6        Preserved
+
+
+===================
+CPU OPERATING MODES
+===================
+
+The FR-V CPU has three basic operating modes. In order of increasing capability:
+
+  (1) User mode.
+
+      Basic userspace running mode.
+
+  (2) Kernel mode.
+
+      Normal kernel mode. There are many additional control registers available that may be
+      accessed in this mode, in addition to all the stuff available to user mode. This has two
+      submodes:
+
+      (a) Exceptions enabled (PSR.T == 1).
+
+          Exceptions will invoke the appropriate normal kernel mode handler. On entry to the
+          handler, the PSR.T bit will be cleared.
+
+      (b) Exceptions disabled (PSR.T == 0).
+
+          No exceptions or interrupts may happen. Any mandatory exceptions will cause the CPU to
+          halt unless the CPU is told to jump into debug mode instead.
+
+  (3) Debug mode.
+
+      No exceptions may happen in this mode. Memory protection and management exceptions will be
+      flagged for later consideration, but the exception handler won't be invoked. Debugging traps
+      such as hardware breakpoints and watchpoints will be ignored. This mode is entered only by
+      debugging events obtained from the other two modes.
+
+      All kernel mode registers may be accessed, plus a few extra debugging specific registers.
+
+
+=================================
+INTERNAL KERNEL-MODE REGISTER ABI
+=================================
+
+There are a number of permanent register assignments that are set up by entry.S in the exception
+prologue. Note that there is a complete set of exception prologues for each of user->kernel
+transition and kernel->kernel transition. There are also user->debug and kernel->debug mode
+transition prologues.
+
+
+        REGISTER        FLAVOUR USE
+        =============== ======= ====================================================
+        GR1                     Supervisor stack pointer
+        GR15                    Current thread info pointer
+        GR16                    GP-Rel base register for small data
+        GR28                    Current exception frame pointer (__frame)
+        GR29                    Current task pointer (current)
+        GR30                    Destroyed by kernel mode entry
+        GR31            NOMMU   Destroyed by debug mode entry
+        GR31            MMU     Destroyed by TLB miss kernel mode entry
+        CCR.ICC2                Virtual interrupt disablement tracking
+        CCCR.CC3                Cleared by exception prologue (atomic op emulation)
+        SCR0            MMU     See mmu-layout.txt.
+        SCR1            MMU     See mmu-layout.txt.
+        SCR2            MMU     Save for EAR0 (destroyed by icache insns in debug mode)
+        SCR3            MMU     Save for GR31 during debug exceptions
+        DAMR/IAMR       NOMMU   Fixed memory protection layout.
+        DAMR/IAMR       MMU     See mmu-layout.txt.
+
+
+Certain registers are also used or modified across function calls:
+
+        REGISTER        CALL                            RETURN
+        =============== =============================== ===============================
+        GR0             Fixed Zero                      -
+        GR2             Function call frame pointer
+        GR3             Special                         Preserved
+        GR3-GR7         -                               Clobbered
+        GR8             Function call arg #1            Return value (or clobbered)
+        GR9             Function call arg #2            Return value MSW (or clobbered)
+        GR10-GR13       Function call arg #3-#6         Clobbered
+        GR14            -                               Clobbered
+        GR15-GR16       Special                         Preserved
+        GR17-GR27       -                               Preserved
+        GR28-GR31       Special                         Only accessed explicitly
+        LR              Return address after CALL       Clobbered
+        CCR/CCCR        -                               Mostly Clobbered
+
+
+================================
+INTERNAL DEBUG-MODE REGISTER ABI
+================================
+
+This is the same as the kernel-mode register ABI for functions calls. The difference is that in
+debug-mode there's a different stack and a different exception frame. Almost all the global
+registers from kernel-mode (including the stack pointer) may be changed.
+
+        REGISTER        FLAVOUR USE
+        =============== ======= ====================================================
+        GR1                     Debug stack pointer
+        GR16                    GP-Rel base register for small data
+        GR31                    Current debug exception frame pointer (__debug_frame)
+        SCR3            MMU     Saved value of GR31
+
+
+Note that debug mode is able to interfere with the kernel's emulated atomic ops, so it must be
+exceedingly careful not to do any that would interact with the main kernel in this regard. Hence
+the debug mode code (gdbstub) is almost completely self-contained. The only external code used is
+the sprintf family of functions.
+
+Futhermore, break.S is so complicated because single-step mode does not switch off on entry to an
+exception. That means unless manually disabled, single-stepping will blithely go on stepping into
+things like interrupts. See gdbstub.txt for more information.
+
+
+==========================
+VIRTUAL INTERRUPT HANDLING
+==========================
+
+Because accesses to the PSR is so slow, and to disable interrupts we have to access it twice (once
+to read and once to write), we don't actually disable interrupts at all if we don't have to. What
+we do instead is use the ICC2 condition code flags to note virtual disablement, such that if we
+then do take an interrupt, we note the flag, really disable interrupts, set another flag and resume
+execution at the point the interrupt happened. Setting condition flags as a side effect of an
+arithmetic or logical instruction is really fast. This use of the ICC2 only occurs within the
+kernel - it does not affect userspace.
+
+The flags we use are:
+
+ (*) CCR.ICC2.Z [Zero flag]
+
+     Set to virtually disable interrupts, clear when interrupts are virtually enabled. Can be
+     modified by logical instructions without affecting the Carry flag.
+
+ (*) CCR.ICC2.C [Carry flag]
+
+     Clear to indicate hardware interrupts are really disabled, set otherwise.
+
+
+What happens is this:
+
+ (1) Normal kernel-mode operation.
+
+        ICC2.Z is 0, ICC2.C is 1.
+
+ (2) An interrupt occurs. The exception prologue examines ICC2.Z and determines that nothing needs
+     doing. This is done simply with an unlikely BEQ instruction.
+
+ (3) The interrupts are disabled (local_irq_disable)
+
+        ICC2.Z is set to 1.
+
+ (4) If interrupts were then re-enabled (local_irq_enable):
+
+        ICC2.Z would be set to 0.
+
+     A TIHI #2 instruction (trap #2 if condition HI - Z==0 && C==0) would be used to trap if
+     interrupts were now virtually enabled, but physically disabled - which they're not, so the
+     trap isn't taken. The kernel would then be back to state (1).
+
+ (5) An interrupt occurs. The exception prologue examines ICC2.Z and determines that the interrupt
+     shouldn't actually have happened. It jumps aside, and there disabled interrupts by setting
+     PSR.PIL to 14 and then it clears ICC2.C.
+
+ (6) If interrupts were then saved and disabled again (local_irq_save):
+
+        ICC2.Z would be shifted into the save variable and masked off (giving a 1).
+
+        ICC2.Z would then be set to 1 (thus unchanged), and ICC2.C would be unaffected (ie: 0).
+
+ (7) If interrupts were then restored from state (6) (local_irq_restore):
+
+        ICC2.Z would be set to indicate the result of XOR'ing the saved value (ie: 1) with 1, which
+        gives a result of 0 - thus leaving ICC2.Z set.
+
+        ICC2.C would remain unaffected (ie: 0).
+
+     A TIHI #2 instruction would be used to again assay the current state, but this would do
+     nothing as Z==1.
+
+ (8) If interrupts were then enabled (local_irq_enable):
+
+        ICC2.Z would be cleared. ICC2.C would be left unaffected. Both flags would now be 0.
+
+     A TIHI #2 instruction again issued to assay the current state would then trap as both Z==0
+     [interrupts virtually enabled] and C==0 [interrupts really disabled] would then be true.
+
+ (9) The trap #2 handler would simply enable hardware interrupts (set PSR.PIL to 0), set ICC2.C to
+     1 and return.
+
+(10) Immediately upon returning, the pending interrupt would be taken.
+
+(11) The interrupt handler would take the path of actually processing the interrupt (ICC2.Z is
+     clear, BEQ fails as per step (2)).
+
+(12) The interrupt handler would then set ICC2.C to 1 since hardware interrupts are definitely
+     enabled - or else the kernel wouldn't be here.
+
+(13) On return from the interrupt handler, things would be back to state (1).
+
+This trap (#2) is only available in kernel mode. In user mode it will result in SIGILL.
diff --git a/Documentation/hwmon/f71805f b/Documentation/hwmon/f71805f
new file mode 100644
index 000000000000..28c5b7d1eb90
--- /dev/null
+++ b/Documentation/hwmon/f71805f
@@ -0,0 +1,105 @@
+Kernel driver f71805f
+=====================
+
+Supported chips:
+  * Fintek F71805F/FG
+    Prefix: 'f71805f'
+    Addresses scanned: none, address read from Super I/O config space
+    Datasheet: Provided by Fintek on request
+
+Author: Jean Delvare <khali@linux-fr.org>
+
+Thanks to Denis Kieft from Barracuda Networks for the donation of a
+test system (custom Jetway K8M8MS motherboard, with CPU and RAM) and
+for providing initial documentation.
+
+Thanks to Kris Chen from Fintek for answering technical questions and
+providing additional documentation.
+
+Thanks to Chris Lin from Jetway for providing wiring schematics and
+anwsering technical questions.
+
+
+Description
+-----------
+
+The Fintek F71805F/FG Super I/O chip includes complete hardware monitoring
+capabilities. It can monitor up to 9 voltages (counting its own power
+source), 3 fans and 3 temperature sensors.
+
+This chip also has fan controlling features, using either DC or PWM, in
+three different modes (one manual, two automatic). The driver doesn't
+support these features yet.
+
+The driver assumes that no more than one chip is present, which seems
+reasonable.
+
+
+Voltage Monitoring
+------------------
+
+Voltages are sampled by an 8-bit ADC with a LSB of 8 mV. The supported
+range is thus from 0 to 2.040 V. Voltage values outside of this range
+need external resistors. An exception is in0, which is used to monitor
+the chip's own power source (+3.3V), and is divided internally by a
+factor 2.
+
+The two LSB of the voltage limit registers are not used (always 0), so
+you can only set the limits in steps of 32 mV (before scaling).
+
+The wirings and resistor values suggested by Fintek are as follow:
+
+        pin                                           expected
+        name    use           R1      R2     divider  raw val.
+
+in0     VCC     VCC3.3V     int.    int.        2.00    1.65 V
+in1     VIN1    VTT1.2V      10K       -        1.00    1.20 V
+in2     VIN2    VRAM        100K    100K        2.00   ~1.25 V (1)
+in3     VIN3    VCHIPSET     47K    100K        1.47    2.24 V (2)
+in4     VIN4    VCC5V       200K     47K        5.25    0.95 V
+in5     VIN5    +12V        200K     20K       11.00    1.05 V
+in6     VIN6    VCC1.5V      10K       -        1.00    1.50 V
+in7     VIN7    VCORE        10K       -        1.00   ~1.40 V (1)
+in8     VIN8    VSB5V       200K     47K        1.00    0.95 V
+
+(1) Depends on your hardware setup.
+(2) Obviously not correct, swapping R1 and R2 would make more sense.
+
+These values can be used as hints at best, as motherboard manufacturers
+are free to use a completely different setup. As a matter of fact, the
+Jetway K8M8MS uses a significantly different setup. You will have to
+find out documentation about your own motherboard, and edit sensors.conf
+accordingly.
+
+Each voltage measured has associated low and high limits, each of which
+triggers an alarm when crossed.
+
+
+Fan Monitoring
+--------------
+
+Fan rotation speeds are reported as 12-bit values from a gated clock
+signal. Speeds down to 366 RPM can be measured. There is no theoretical
+high limit, but values over 6000 RPM seem to cause problem. The effective
+resolution is much lower than you would expect, the step between different
+register values being 10 rather than 1.
+
+The chip assumes 2 pulse-per-revolution fans.
+
+An alarm is triggered if the rotation speed drops below a programmable
+limit or is too low to be measured.
+
+
+Temperature Monitoring
+----------------------
+
+Temperatures are reported in degrees Celsius. Each temperature measured
+has a high limit, those crossing triggers an alarm. There is an associated
+hysteresis value, below which the temperature has to drop before the
+alarm is cleared.
+
+All temperature channels are external, there is no embedded temperature
+sensor. Each channel can be used for connecting either a thermal diode
+or a thermistor. The driver reports the currently selected mode, but
+doesn't allow changing it. In theory, the BIOS should have configured
+everything properly.
diff --git a/Documentation/hwmon/it87 b/Documentation/hwmon/it87
index 7f42e441c645..9555be1ed999 100644
--- a/Documentation/hwmon/it87
+++ b/Documentation/hwmon/it87
@@ -9,7 +9,7 @@ Supported chips:
                http://www.ite.com.tw/
   * IT8712F
     Prefix: 'it8712'
-    Addresses scanned: I2C 0x28 - 0x2f
+    Addresses scanned: I2C 0x2d
                        from Super I/O config space (8 I/O ports)
     Datasheet: Publicly available at the ITE website
                http://www.ite.com.tw/
diff --git a/Documentation/hwmon/sysfs-interface b/Documentation/hwmon/sysfs-interface
index 764cdc5480e7..a0d0ab24288e 100644
--- a/Documentation/hwmon/sysfs-interface
+++ b/Documentation/hwmon/sysfs-interface
@@ -179,11 +179,12 @@ temp[1-*]_auto_point[1-*]_temp_hyst
 ****************
 
 temp[1-3]_type  Sensor type selection.
-                Integers 1, 2, 3 or thermistor Beta value (3435)
+                Integers 1 to 4 or thermistor Beta value (typically 3435)
                 Read/Write.
                 1: PII/Celeron Diode
                 2: 3904 transistor
                 3: thermal diode
+                4: thermistor (default/unknown Beta)
                 Not all types are supported by all chips
 
 temp[1-4]_max   Temperature max value.
@@ -261,6 +262,21 @@ alarms		Alarm bitmask.
                 of individual bits.
                 Bits are defined in kernel/include/sensors.h.
 
+alarms_in       Alarm bitmask relative to in (voltage) channels
+                Read only
+                A '1' bit means an alarm, LSB corresponds to in0 and so on
+                Prefered to 'alarms' for newer chips
+
+alarms_fan      Alarm bitmask relative to fan channels
+                Read only
+                A '1' bit means an alarm, LSB corresponds to fan1 and so on
+                Prefered to 'alarms' for newer chips
+
+alarms_temp     Alarm bitmask relative to temp (temperature) channels
+                Read only
+                A '1' bit means an alarm, LSB corresponds to temp1 and so on
+                Prefered to 'alarms' for newer chips
+
 beep_enable     Beep/interrupt enable
                 0 to disable.
                 1 to enable.
diff --git a/Documentation/hwmon/w83627hf b/Documentation/hwmon/w83627hf
index 5d23776e9907..bbeaba680443 100644
--- a/Documentation/hwmon/w83627hf
+++ b/Documentation/hwmon/w83627hf
@@ -36,6 +36,10 @@ Module Parameters
   (default is 1)
   Use 'init=0' to bypass initializing the chip.
   Try this if your computer crashes when you load the module.
+* reset: int
+  (default is 0)
+  The driver used to reset the chip on load, but does no more. Use
+  'reset=1' to restore the old behavior. Report if you need to do this.
 
 Description
 -----------
diff --git a/Documentation/i2c/busses/i2c-sis69x b/Documentation/i2c/busses/i2c-sis96x
index b88953dfd580..00a009b977e9 100644
--- a/Documentation/i2c/busses/i2c-sis69x
+++ b/Documentation/i2c/busses/i2c-sis96x
@@ -7,7 +7,7 @@ Supported adapters:
     Any combination of these host bridges:
         645, 645DX (aka 646), 648, 650, 651, 655, 735, 745, 746
     and these south bridges:
-        961, 962, 963(L) 
+        961, 962, 963(L)
 
 Author: Mark M. Hoffman <mhoffman@lightlink.com>
 
@@ -29,7 +29,7 @@ The command "lspci" as root should produce something like these lines:
 
 or perhaps this...
 
-00:00.0 Host bridge: Silicon Integrated Systems [SiS]: Unknown device 0645 
+00:00.0 Host bridge: Silicon Integrated Systems [SiS]: Unknown device 0645
 00:02.0 ISA bridge: Silicon Integrated Systems [SiS]: Unknown device 0961
 00:02.1 SMBus: Silicon Integrated Systems [SiS]: Unknown device 0016
 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 84370363da80..fc99075e0af4 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -335,6 +335,12 @@ running once the system is up.
                         timesource is not avalible, it defaults to PIT.
                         Format: { pit | tsc | cyclone | pmtmr }
 
+        disable_8254_timer
+        enable_8254_timer
+                        [IA32/X86_64] Disable/Enable interrupt 0 timer routing
+                        over the 8254 in addition to over the IO-APIC. The
+                        kernel tries to set a sensible default.
+
         hpet=           [IA-32,HPET] option to disable HPET and use PIT.
                         Format: disable
 
@@ -1034,6 +1040,8 @@ running once the system is up.
 
         nomce           [IA-32] Machine Check Exception
 
+        nomca           [IA-64] Disable machine check abort handling
+
         noresidual      [PPC] Don't use residual data on PReP machines.
 
         noresume        [SWSUSP] Disables resume and restores original swap
@@ -1133,6 +1141,8 @@ running once the system is up.
                                 Mechanism 1.
                 conf2           [IA-32] Force use of PCI Configuration
                                 Mechanism 2.
+                nommconf        [IA-32,X86_64] Disable use of MMCONFIG for PCI
+                                Configuration
                 nosort          [IA-32] Don't sort PCI devices according to
                                 order given by the PCI BIOS. This sorting is
                                 done to get a device order compatible with
@@ -1280,6 +1290,19 @@ running once the system is up.
                         New name for the ramdisk parameter.
                         See Documentation/ramdisk.txt.
 
+        rcu.blimit=     [KNL,BOOT] Set maximum number of finished
+                        RCU callbacks to process in one batch.
+
+        rcu.qhimark=    [KNL,BOOT] Set threshold of queued
+                        RCU callbacks over which batch limiting is disabled.
+
+        rcu.qlowmark=   [KNL,BOOT] Set threshold of queued
+                        RCU callbacks below which batch limiting is re-enabled.
+
+        rcu.rsinterval= [KNL,BOOT,SMP] Set the number of additional
+                        RCU callbacks to queued before forcing reschedule
+                        on all cpus.
+
         rdinit=         [KNL]
                         Format: <full_path>
                         Run specified binary instead of /init from the ramdisk,
@@ -1636,6 +1659,9 @@ running once the system is up.
                         Format:
                         <irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]
 
+        norandmaps      Don't use address space randomization
+                        Equivalent to echo 0 > /proc/sys/kernel/randomize_va_space
+
 
 ______________________________________________________________________
 Changelog:
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt
index 0ea5a0c6e827..2c3b1eae4280 100644
--- a/Documentation/kprobes.txt
+++ b/Documentation/kprobes.txt
@@ -136,17 +136,20 @@ Kprobes, jprobes, and return probes are implemented on the following
 architectures:
 
 - i386
-- x86_64 (AMD-64, E64MT)
+- x86_64 (AMD-64, EM64T)
 - ppc64
-- ia64 (Support for probes on certain instruction types is still in progress.)
+- ia64 (Does not support probes on instruction slot1.)
 - sparc64 (Return probes not yet implemented.)
 
 3. Configuring Kprobes
 
 When configuring the kernel using make menuconfig/xconfig/oldconfig,
-ensure that CONFIG_KPROBES is set to "y".  Under "Kernel hacking",
-look for "Kprobes".  You may have to enable "Kernel debugging"
-(CONFIG_DEBUG_KERNEL) before you can enable Kprobes.
+ensure that CONFIG_KPROBES is set to "y".  Under "Instrumentation
+Support", look for "Kprobes".
+
+So that you can load and unload Kprobes-based instrumentation modules,
+make sure "Loadable module support" (CONFIG_MODULES) and "Module
+unloading" (CONFIG_MODULE_UNLOAD) are set to "y".
 
 You may also want to ensure that CONFIG_KALLSYMS and perhaps even
 CONFIG_KALLSYMS_ALL are set to "y", since kallsyms_lookup_name()
@@ -262,18 +265,18 @@ at any time after the probe has been registered.
 
 5. Kprobes Features and Limitations
 
-As of Linux v2.6.12, Kprobes allows multiple probes at the same
-address.  Currently, however, there cannot be multiple jprobes on
-the same function at the same time.
+Kprobes allows multiple probes at the same address.  Currently,
+however, there cannot be multiple jprobes on the same function at
+the same time.
 
 In general, you can install a probe anywhere in the kernel.
 In particular, you can probe interrupt handlers.  Known exceptions
 are discussed in this section.
 
-For obvious reasons, it's a bad idea to install a probe in
-the code that implements Kprobes (mostly kernel/kprobes.c and
-arch/*/kernel/kprobes.c).  A patch in the v2.6.13 timeframe instructs
-Kprobes to reject such requests.
+The register_*probe functions will return -EINVAL if you attempt
+to install a probe in the code that implements Kprobes (mostly
+kernel/kprobes.c and arch/*/kernel/kprobes.c, but also functions such
+as do_page_fault and notifier_call_chain).
 
 If you install a probe in an inline-able function, Kprobes makes
 no attempt to chase down all inline instances of the function and
@@ -290,18 +293,14 @@ from the accidental ones.  Don't drink and probe.
 
 Kprobes makes no attempt to prevent probe handlers from stepping on
 each other -- e.g., probing printk() and then calling printk() from a
-probe handler.  As of Linux v2.6.12, if a probe handler hits a probe,
-that second probe's handlers won't be run in that instance.
-
-In Linux v2.6.12 and previous versions, Kprobes' data structures are
-protected by a single lock that is held during probe registration and
-unregistration and while handlers are run.  Thus, no two handlers
-can run simultaneously.  To improve scalability on SMP systems,
-this restriction will probably be removed soon, in which case
-multiple handlers (or multiple instances of the same handler) may
-run concurrently on different CPUs.  Code your handlers accordingly.
-
-Kprobes does not use semaphores or allocate memory except during
+probe handler.  If a probe handler hits a probe, that second probe's
+handlers won't be run in that instance, and the kprobe.nmissed member
+of the second probe will be incremented.
+
+As of Linux v2.6.15-rc1, multiple handlers (or multiple instances of
+the same handler) may run concurrently on different CPUs.
+
+Kprobes does not use mutexes or allocate memory except during
 registration and unregistration.
 
 Probe handlers are run with preemption disabled.  Depending on the
@@ -316,11 +315,18 @@ address instead of the real return address for kretprobed functions.
 (As far as we can tell, __builtin_return_address() is used only
 for instrumentation and error reporting.)
 
-If the number of times a function is called does not match the
-number of times it returns, registering a return probe on that
-function may produce undesirable results.  We have the do_exit()
-and do_execve() cases covered.  do_fork() is not an issue.  We're
-unaware of other specific cases where this could be a problem.
+If the number of times a function is called does not match the number
+of times it returns, registering a return probe on that function may
+produce undesirable results.  We have the do_exit() case covered.
+do_execve() and do_fork() are not an issue.  We're unaware of other
+specific cases where this could be a problem.
+
+If, upon entry to or exit from a function, the CPU is running on
+a stack other than that of the current task, registering a return
+probe on that function may produce undesirable results.  For this
+reason, Kprobes doesn't support return probes (or kprobes or jprobes)
+on the x86_64 version of __switch_to(); the registration functions
+return -EINVAL.
 
 6. Probe Overhead
 
@@ -347,14 +353,12 @@ k = 0.77 usec; j = 1.31; r = 1.26; kr = 1.45; jr = 1.99
 
 7. TODO
 
-a. SystemTap (http://sourceware.org/systemtap): Work in progress
-to provide a simplified programming interface for probe-based
-instrumentation.
-b. Improved SMP scalability: Currently, work is in progress to handle
-multiple kprobes in parallel.
-c. Kernel return probes for sparc64.
-d. Support for other architectures.
-e. User-space probes.
+a. SystemTap (http://sourceware.org/systemtap): Provides a simplified
+programming interface for probe-based instrumentation.  Try it out.
+b. Kernel return probes for sparc64.
+c. Support for other architectures.
+d. User-space probes.
+e. Watchpoint probes (which fire on data references).
 
 8. Kprobes Example
 
@@ -411,8 +415,7 @@ int init_module(void)
                 printk("Couldn't find %s to plant kprobe\n", "do_fork");
                 return -1;
         }
-        ret = register_kprobe(&kp);
-        if (ret < 0) {
+        if ((ret = register_kprobe(&kp) < 0)) {
                 printk("register_kprobe failed, returned %d\n", ret);
                 return -1;
         }
diff --git a/Documentation/mips/AU1xxx_IDE.README b/Documentation/mips/AU1xxx_IDE.README
index a7e4c4ea3560..afb31c141d9d 100644
--- a/Documentation/mips/AU1xxx_IDE.README
+++ b/Documentation/mips/AU1xxx_IDE.README
@@ -95,11 +95,13 @@ CONFIG_BLK_DEV_IDEDMA_PCI=y
 CONFIG_IDEDMA_PCI_AUTO=y
 CONFIG_BLK_DEV_IDE_AU1XXX=y
 CONFIG_BLK_DEV_IDE_AU1XXX_MDMA2_DBDMA=y
-CONFIG_BLK_DEV_IDE_AU1XXX_BURSTABLE_ON=y
 CONFIG_BLK_DEV_IDE_AU1XXX_SEQTS_PER_RQ=128
 CONFIG_BLK_DEV_IDEDMA=y
 CONFIG_IDEDMA_AUTO=y
 
+Also define 'IDE_AU1XXX_BURSTMODE' in 'drivers/ide/mips/au1xxx-ide.c' to enable
+the burst support on DBDMA controller.
+
 If the used system need the USB support enable the following kernel configs for
 high IDE to USB throughput.
 
@@ -115,6 +117,8 @@ CONFIG_BLK_DEV_IDE_AU1XXX_SEQTS_PER_RQ=128
 CONFIG_BLK_DEV_IDEDMA=y
 CONFIG_IDEDMA_AUTO=y
 
+Also undefine 'IDE_AU1XXX_BURSTMODE' in 'drivers/ide/mips/au1xxx-ide.c' to
+disable the burst support on DBDMA controller.
 
 ADD NEW HARD DISC TO WHITE OR BLACK LIST
 ----------------------------------------
diff --git a/Documentation/powerpc/booting-without-of.txt b/Documentation/powerpc/booting-without-of.txt
index 1284498e847c..d02c64953dcd 100644
--- a/Documentation/powerpc/booting-without-of.txt
+++ b/Documentation/powerpc/booting-without-of.txt
@@ -44,7 +44,6 @@
                            compiler and the textural representation of
                            the tree that can be "compiled" by dtc.
 
-
    November 21, 2005: Rev 0.5
                          - Additions/generalizations for 32-bit
                          - Changed to reflect the new arch/powerpc
@@ -880,6 +879,10 @@ address which can extend beyond that limit.
     - device_type : Should be "soc"
     - ranges : Should be defined as specified in 1) to describe the
       translation of SOC addresses for memory mapped SOC registers.
+    - bus-frequency: Contains the bus frequency for the SOC node.
+      Typically, the value of this field is filled in by the boot
+      loader. 
+
 
   Recommended properties:
 
@@ -919,6 +922,7 @@ SOC.
                 device_type = "soc";
                 ranges = <00000000 e0000000 00100000>
                 reg = <e0000000 00003000>;
+                bus-frequency = <0>;
         }
 
 
@@ -1170,6 +1174,8 @@ platforms are moved over to use the flattened-device-tree model.
 
         mdio@24520 {
                 reg = <24520 20>;
+                device_type = "mdio"; 
+                compatible = "gianfar";
 
                 ethernet-phy@0 {
                         ......
@@ -1300,6 +1306,65 @@ platforms are moved over to use the flattened-device-tree model.
         };
 
 
+   f) Freescale SOC USB controllers
+
+   The device node for a USB controller that is part of a Freescale
+   SOC is as described in the document "Open Firmware Recommended
+   Practice : Universal Serial Bus" with the following modifications
+   and additions :  
+
+   Required properties :
+    - compatible : Should be "fsl-usb2-mph" for multi port host usb
+      controllers, or "fsl-usb2-dr" for dual role usb controllers
+    - phy_type : For multi port host usb controllers, should be one of
+      "ulpi", or "serial". For dual role usb controllers, should be
+      one of "ulpi", "utmi", "utmi_wide", or "serial".
+    - reg : Offset and length of the register set for the device
+    - port0 : boolean; if defined, indicates port0 is connected for
+      fsl-usb2-mph compatible controllers.  Either this property or
+      "port1" (or both) must be defined for "fsl-usb2-mph" compatible 
+      controllers.
+    - port1 : boolean; if defined, indicates port1 is connected for
+      fsl-usb2-mph compatible controllers.  Either this property or
+      "port0" (or both) must be defined for "fsl-usb2-mph" compatible 
+      controllers.
+
+   Recommended properties :
+    - interrupts : <a b> where a is the interrupt number and b is a
+      field that represents an encoding of the sense and level
+      information for the interrupt.  This should be encoded based on
+      the information in section 2) depending on the type of interrupt
+      controller you have.
+    - interrupt-parent : the phandle for the interrupt controller that
+      services interrupts for this device.
+
+   Example multi port host usb controller device node : 
+        usb@22000 {
+                device_type = "usb";
+                compatible = "fsl-usb2-mph";
+                reg = <22000 1000>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+                interrupt-parent = <700>;
+                interrupts = <27 1>;
+                phy_type = "ulpi";
+                port0;
+                port1;
+        };
+
+   Example dual role usb controller device node : 
+        usb@23000 {
+                device_type = "usb";
+                compatible = "fsl-usb2-dr";
+                reg = <23000 1000>;
+                #address-cells = <1>;
+                #size-cells = <0>;
+                interrupt-parent = <700>;
+                interrupts = <26 1>;
+                phy = "ulpi";
+        };
+
+
    More devices will be defined as this spec matures.
 
 
@@ -1317,6 +1382,7 @@ not necessary as they are usually the same as the root node.
                 device_type = "soc";
                 ranges = <00000000 e0000000 00100000>
                 reg = <e0000000 00003000>;
+                bus-frequency = <0>;
 
                 mdio@24520 {
                         reg = <24520 20>;
diff --git a/Documentation/scsi/ChangeLog.megaraid_sas b/Documentation/scsi/ChangeLog.megaraid_sas
index f8c16cbf56ba..2dafa63bd370 100644
--- a/Documentation/scsi/ChangeLog.megaraid_sas
+++ b/Documentation/scsi/ChangeLog.megaraid_sas
@@ -1,3 +1,26 @@
+1 Release Date    : Wed Feb 03 14:31:44 PST 2006 - Sumant Patro <Sumant.Patro@lsil.com>
+2 Current Version : 00.00.02.04
+3 Older Version   : 00.00.02.04 
+
+i.      Support for 1078 type (ppc IOP) controller, device id : 0x60 added.
+        During initialization, depending on the device id, the template members 
+        are initialized with function pointers specific to the ppc or 
+        xscale controllers.  
+
+                -Sumant Patro <Sumant.Patro@lsil.com>
+                
+1 Release Date    : Fri Feb 03 14:16:25 PST 2006 - Sumant Patro 
+                                                        <Sumant.Patro@lsil.com>
+2 Current Version : 00.00.02.04
+3 Older Version   : 00.00.02.02 
+i.      Register 16 byte CDB capability with scsi midlayer 
+
+        "Ths patch properly registers the 16 byte command length capability of the 
+        megaraid_sas controlled hardware with the scsi midlayer. All megaraid_sas 
+        hardware supports 16 byte CDB's."
+
+                -Joshua Giles <joshua_giles@dell.com> 
+
 1 Release Date    : Mon Jan 23 14:09:01 PST 2006 - Sumant Patro <Sumant.Patro@lsil.com>
 2 Current Version : 00.00.02.02
 3 Older Version   : 00.00.02.01 
diff --git a/Documentation/spi/butterfly b/Documentation/spi/butterfly
index a2e8c8d90e35..9927af7a629c 100644
--- a/Documentation/spi/butterfly
+++ b/Documentation/spi/butterfly
@@ -12,13 +12,20 @@ You can make this adapter from an old printer cable and solder things
 directly to the Butterfly.  Or (if you have the parts and skills) you
 can come up with something fancier, providing ciruit protection to the
 Butterfly and the printer port, or with a better power supply than two
-signal pins from the printer port.
+signal pins from the printer port.  Or for that matter, you can use
+similar cables to talk to many AVR boards, even a breadboard.
+
+This is more powerful than "ISP programming" cables since it lets kernel
+SPI protocol drivers interact with the AVR, and could even let the AVR
+issue interrupts to them.  Later, your protocol driver should work
+easily with a "real SPI controller", instead of this bitbanger.
 
 
 The first cable connections will hook Linux up to one SPI bus, with the
 AVR and a DataFlash chip; and to the AVR reset line.  This is all you
 need to reflash the firmware, and the pins are the standard Atmel "ISP"
-connector pins (used also on non-Butterfly AVR boards).
+connector pins (used also on non-Butterfly AVR boards).  On the parport
+side this is like "sp12" programming cables.
 
         Signal    Butterfly       Parport (DB-25)
         ------    ---------       ---------------
@@ -40,10 +47,14 @@ by clearing PORTB.[0-3]); (b) configure the mtd_dataflash driver; and
         SELECT  = J400.PB0/nSS  = pin 17/C3,nSELECT
         GND     = J400.GND      = pin 24/GND
 
-The "USI" controller, using J405, can be used for a second SPI bus.  That
-would let you talk to the AVR over SPI, running firmware that makes it act
-as an SPI slave, while letting either Linux or the AVR use the DataFlash.
-There are plenty of spare parport pins to wire this one up, such as:
+Or you could flash firmware making the AVR into an SPI slave (keeping the
+DataFlash in reset) and tweak the spi_butterfly driver to make it bind to
+the driver for your custom SPI-based protocol.
+
+The "USI" controller, using J405, can also be used for a second SPI bus.
+That would let you talk to the AVR using custom SPI-with-USI firmware,
+while letting either Linux or the AVR use the DataFlash.  There are plenty
+of spare parport pins to wire this one up, such as:
 
         Signal    Butterfly       Parport (DB-25)
         ------    ---------       ---------------
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 9f11d36a8c10..b0c7ab93dcb9 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -16,6 +16,7 @@ before actually making adjustments.
 
 Currently, these files might (depending on your configuration)
 show up in /proc/sys/kernel:
+- acpi_video_flags
 - acct
 - core_pattern
 - core_uses_pid
@@ -57,6 +58,15 @@ show up in /proc/sys/kernel:
 
 ==============================================================
 
+acpi_video_flags:
+
+flags
+
+See Doc*/kernel/power/video.txt, it allows mode of video boot to be
+set during run time.
+
+==============================================================
+
 acct:
 
 highwater lowwater frequency
diff --git a/Documentation/unshare.txt b/Documentation/unshare.txt
new file mode 100644
index 000000000000..90a5e9e5bef1
--- /dev/null
+++ b/Documentation/unshare.txt
@@ -0,0 +1,295 @@
+
+unshare system call:
+--------------------
+This document describes the new system call, unshare. The document
+provides an overview of the feature, why it is needed, how it can
+be used, its interface specification, design, implementation and
+how it can be tested.
+
+Change Log:
+-----------
+version 0.1  Initial document, Janak Desai (janak@us.ibm.com), Jan 11, 2006
+
+Contents:
+---------
+        1) Overview
+        2) Benefits
+        3) Cost
+        4) Requirements
+        5) Functional Specification
+        6) High Level Design
+        7) Low Level Design
+        8) Test Specification
+        9) Future Work
+
+1) Overview
+-----------
+Most legacy operating system kernels support an abstraction of threads
+as multiple execution contexts within a process. These kernels provide
+special resources and mechanisms to maintain these "threads". The Linux
+kernel, in a clever and simple manner, does not make distinction
+between processes and "threads". The kernel allows processes to share
+resources and thus they can achieve legacy "threads" behavior without
+requiring additional data structures and mechanisms in the kernel. The
+power of implementing threads in this manner comes not only from
+its simplicity but also from allowing application programmers to work
+outside the confinement of all-or-nothing shared resources of legacy
+threads. On Linux, at the time of thread creation using the clone system
+call, applications can selectively choose which resources to share
+between threads.
+
+unshare system call adds a primitive to the Linux thread model that
+allows threads to selectively 'unshare' any resources that were being
+shared at the time of their creation. unshare was conceptualized by
+Al Viro in the August of 2000, on the Linux-Kernel mailing list, as part
+of the discussion on POSIX threads on Linux.  unshare augments the
+usefulness of Linux threads for applications that would like to control
+shared resources without creating a new process. unshare is a natural
+addition to the set of available primitives on Linux that implement
+the concept of process/thread as a virtual machine.
+
+2) Benefits
+-----------
+unshare would be useful to large application frameworks such as PAM
+where creating a new process to control sharing/unsharing of process
+resources is not possible. Since namespaces are shared by default
+when creating a new process using fork or clone, unshare can benefit
+even non-threaded applications if they have a need to disassociate
+from default shared namespace. The following lists two use-cases
+where unshare can be used.
+
+2.1 Per-security context namespaces
+-----------------------------------
+unshare can be used to implement polyinstantiated directories using
+the kernel's per-process namespace mechanism. Polyinstantiated directories,
+such as per-user and/or per-security context instance of /tmp, /var/tmp or
+per-security context instance of a user's home directory, isolate user
+processes when working with these directories. Using unshare, a PAM
+module can easily setup a private namespace for a user at login.
+Polyinstantiated directories are required for Common Criteria certification
+with Labeled System Protection Profile, however, with the availability
+of shared-tree feature in the Linux kernel, even regular Linux systems
+can benefit from setting up private namespaces at login and
+polyinstantiating /tmp, /var/tmp and other directories deemed
+appropriate by system administrators.
+
+2.2 unsharing of virtual memory and/or open files
+-------------------------------------------------
+Consider a client/server application where the server is processing
+client requests by creating processes that share resources such as
+virtual memory and open files. Without unshare, the server has to
+decide what needs to be shared at the time of creating the process
+which services the request. unshare allows the server an ability to
+disassociate parts of the context during the servicing of the
+request. For large and complex middleware application frameworks, this
+ability to unshare after the process was created can be very
+useful.
+
+3) Cost
+-------
+In order to not duplicate code and to handle the fact that unshare
+works on an active task (as opposed to clone/fork working on a newly
+allocated inactive task) unshare had to make minor reorganizational
+changes to copy_* functions utilized by clone/fork system call.
+There is a cost associated with altering existing, well tested and
+stable code to implement a new feature that may not get exercised
+extensively in the beginning. However, with proper design and code
+review of the changes and creation of an unshare test for the LTP
+the benefits of this new feature can exceed its cost.
+
+4) Requirements
+---------------
+unshare reverses sharing that was done using clone(2) system call,
+so unshare should have a similar interface as clone(2). That is,
+since flags in clone(int flags, void *stack) specifies what should
+be shared, similar flags in unshare(int flags) should specify
+what should be unshared. Unfortunately, this may appear to invert
+the meaning of the flags from the way they are used in clone(2).
+However, there was no easy solution that was less confusing and that
+allowed incremental context unsharing in future without an ABI change.
+
+unshare interface should accommodate possible future addition of
+new context flags without requiring a rebuild of old applications.
+If and when new context flags are added, unshare design should allow
+incremental unsharing of those resources on an as needed basis.
+
+5) Functional Specification
+---------------------------
+NAME
+        unshare - disassociate parts of the process execution context
+
+SYNOPSIS
+        #include <sched.h>
+
+        int unshare(int flags);
+
+DESCRIPTION
+        unshare allows a process to disassociate parts of its execution
+        context that are currently being shared with other processes. Part
+        of execution context, such as the namespace, is shared by default
+        when a new process is created using fork(2), while other parts,
+        such as the virtual memory, open file descriptors, etc, may be
+        shared by explicit request to share them when creating a process
+        using clone(2).
+
+        The main use of unshare is to allow a process to control its
+        shared execution context without creating a new process.
+
+        The flags argument specifies one or bitwise-or'ed of several of
+        the following constants.
+
+        CLONE_FS
+                If CLONE_FS is set, file system information of the caller
+                is disassociated from the shared file system information.
+
+        CLONE_FILES
+                If CLONE_FILES is set, the file descriptor table of the
+                caller is disassociated from the shared file descriptor
+                table.
+
+        CLONE_NEWNS
+                If CLONE_NEWNS is set, the namespace of the caller is
+                disassociated from the shared namespace.
+
+        CLONE_VM
+                If CLONE_VM is set, the virtual memory of the caller is
+                disassociated from the shared virtual memory.
+
+RETURN VALUE
+        On success, zero returned. On failure, -1 is returned and errno is
+
+ERRORS
+        EPERM   CLONE_NEWNS was specified by a non-root process (process
+                without CAP_SYS_ADMIN).
+
+        ENOMEM  Cannot allocate sufficient memory to copy parts of caller's
+                context that need to be unshared.
+
+        EINVAL  Invalid flag was specified as an argument.
+
+CONFORMING TO
+        The unshare() call is Linux-specific and  should  not be used
+        in programs intended to be portable.
+
+SEE ALSO
+        clone(2), fork(2)
+
+6) High Level Design
+--------------------
+Depending on the flags argument, the unshare system call allocates
+appropriate process context structures, populates it with values from
+the current shared version, associates newly duplicated structures
+with the current task structure and releases corresponding shared
+versions. Helper functions of clone (copy_*) could not be used
+directly by unshare because of the following two reasons.
+  1) clone operates on a newly allocated not-yet-active task
+     structure, where as unshare operates on the current active
+     task. Therefore unshare has to take appropriate task_lock()
+     before associating newly duplicated context structures
+  2) unshare has to allocate and duplicate all context structures
+     that are being unshared, before associating them with the
+     current task and releasing older shared structures. Failure
+     do so will create race conditions and/or oops when trying
+     to backout due to an error. Consider the case of unsharing
+     both virtual memory and namespace. After successfully unsharing
+     vm, if the system call encounters an error while allocating
+     new namespace structure, the error return code will have to
+     reverse the unsharing of vm. As part of the reversal the
+     system call will have to go back to older, shared, vm
+     structure, which may not exist anymore.
+
+Therefore code from copy_* functions that allocated and duplicated
+current context structure was moved into new dup_* functions. Now,
+copy_* functions call dup_* functions to allocate and duplicate
+appropriate context structures and then associate them with the
+task structure that is being constructed. unshare system call on
+the other hand performs the following:
+  1) Check flags to force missing, but implied, flags
+  2) For each context structure, call the corresponding unshare
+     helper function to allocate and duplicate a new context
+     structure, if the appropriate bit is set in the flags argument.
+  3) If there is no error in allocation and duplication and there
+     are new context structures then lock the current task structure,
+     associate new context structures with the current task structure,
+     and release the lock on the current task structure.
+  4) Appropriately release older, shared, context structures.
+
+7) Low Level Design
+-------------------
+Implementation of unshare can be grouped in the following 4 different
+items:
+  a) Reorganization of existing copy_* functions
+  b) unshare system call service function
+  c) unshare helper functions for each different process context
+  d) Registration of system call number for different architectures
+
+  7.1) Reorganization of copy_* functions
+       Each copy function such as copy_mm, copy_namespace, copy_files,
+       etc, had roughly two components. The first component allocated
+       and duplicated the appropriate structure and the second component
+       linked it to the task structure passed in as an argument to the copy
+       function. The first component was split into its own function.
+       These dup_* functions allocated and duplicated the appropriate
+       context structure. The reorganized copy_* functions invoked
+       their corresponding dup_* functions and then linked the newly
+       duplicated structures to the task structure with which the
+       copy function was called.
+
+  7.2) unshare system call service function
+       * Check flags
+         Force implied flags. If CLONE_THREAD is set force CLONE_VM.
+         If CLONE_VM is set, force CLONE_SIGHAND. If CLONE_SIGHAND is
+         set and signals are also being shared, force CLONE_THREAD. If
+         CLONE_NEWNS is set, force CLONE_FS.
+       * For each context flag, invoke the corresponding unshare_*
+         helper routine with flags passed into the system call and a
+         reference to pointer pointing the new unshared structure
+       * If any new structures are created by unshare_* helper
+         functions, take the task_lock() on the current task,
+         modify appropriate context pointers, and release the
+         task lock.
+       * For all newly unshared structures, release the corresponding
+         older, shared, structures.
+
+  7.3) unshare_* helper functions
+       For unshare_* helpers corresponding to CLONE_SYSVSEM, CLONE_SIGHAND,
+       and CLONE_THREAD, return -EINVAL since they are not implemented yet.
+       For others, check the flag value to see if the unsharing is
+       required for that structure. If it is, invoke the corresponding
+       dup_* function to allocate and duplicate the structure and return
+       a pointer to it.
+
+  7.4) Appropriately modify architecture specific code to register the
+       the new system call.
+
+8) Test Specification
+---------------------
+The test for unshare should test the following:
+  1) Valid flags: Test to check that clone flags for signal and
+        signal handlers, for which unsharing is not implemented
+        yet, return -EINVAL.
+  2) Missing/implied flags: Test to make sure that if unsharing
+        namespace without specifying unsharing of filesystem, correctly
+        unshares both namespace and filesystem information.
+  3) For each of the four (namespace, filesystem, files and vm)
+        supported unsharing, verify that the system call correctly
+        unshares the appropriate structure. Verify that unsharing
+        them individually as well as in combination with each
+        other works as expected.
+  4) Concurrent execution: Use shared memory segments and futex on
+        an address in the shm segment to synchronize execution of
+        about 10 threads. Have a couple of threads execute execve,
+        a couple _exit and the rest unshare with different combination
+        of flags. Verify that unsharing is performed as expected and
+        that there are no oops or hangs.
+
+9) Future Work
+--------------
+The current implementation of unshare does not allow unsharing of
+signals and signal handlers. Signals are complex to begin with and
+to unshare signals and/or signal handlers of a currently running
+process is even more complex. If in the future there is a specific
+need to allow unsharing of signals and/or signal handlers, it can
+be incrementally added to unshare without affecting legacy
+applications using unshare.
+
diff --git a/Documentation/video4linux/CARDLIST.cx88 b/Documentation/video4linux/CARDLIST.cx88
index 56e194f1a0b0..8bea3fbd0548 100644
--- a/Documentation/video4linux/CARDLIST.cx88
+++ b/Documentation/video4linux/CARDLIST.cx88
@@ -42,4 +42,4 @@
  41 -> Hauppauge WinTV-HVR1100 DVB-T/Hybrid (Low Profile)  [0070:9800,0070:9802]
  42 -> digitalnow DNTV Live! DVB-T Pro                     [1822:0025]
  43 -> KWorld/VStream XPert DVB-T with cx22702             [17de:08a1]
- 44 -> DViCO FusionHDTV DVB-T Dual Digital                 [18ac:db50]
+ 44 -> DViCO FusionHDTV DVB-T Dual Digital                 [18ac:db50,18ac:db54]
diff --git a/Documentation/video4linux/CARDLIST.saa7134 b/Documentation/video4linux/CARDLIST.saa7134
index cb3a59bbeb17..da4fb890165f 100644
--- a/Documentation/video4linux/CARDLIST.saa7134
+++ b/Documentation/video4linux/CARDLIST.saa7134
@@ -1,7 +1,7 @@
   0 -> UNKNOWN/GENERIC
   1 -> Proteus Pro [philips reference design]   [1131:2001,1131:2001]
   2 -> LifeView FlyVIDEO3000                    [5168:0138,4e42:0138]
-  3 -> LifeView FlyVIDEO2000                    [5168:0138]
+  3 -> LifeView/Typhoon FlyVIDEO2000            [5168:0138,4e42:0138]
   4 -> EMPRESS                                  [1131:6752]
   5 -> SKNet Monster TV                         [1131:4e85]
   6 -> Tevion MD 9717
@@ -13,7 +13,7 @@
  12 -> Medion 7134                              [16be:0003]
  13 -> Typhoon TV+Radio 90031
  14 -> ELSA EX-VISION 300TV                     [1048:226b]
- 15 -> ELSA EX-VISION 500TV                     [1048:226b]
+ 15 -> ELSA EX-VISION 500TV                     [1048:226a]
  16 -> ASUS TV-FM 7134                          [1043:4842,1043:4830,1043:4840]
  17 -> AOPEN VA1000 POWER                       [1131:7133]
  18 -> BMK MPEX No Tuner
@@ -53,12 +53,12 @@
  52 -> AverMedia AverTV/305                     [1461:2108]
  53 -> ASUS TV-FM 7135                          [1043:4845]
  54 -> LifeView FlyTV Platinum FM               [5168:0214,1489:0214]
- 55 -> LifeView FlyDVB-T DUO                    [5168:0502,5168:0306]
+ 55 -> LifeView FlyDVB-T DUO                    [5168:0306]
  56 -> Avermedia AVerTV 307                     [1461:a70a]
  57 -> Avermedia AVerTV GO 007 FM               [1461:f31f]
  58 -> ADS Tech Instant TV (saa7135)            [1421:0350,1421:0351,1421:0370,1421:1370]
  59 -> Kworld/Tevion V-Stream Xpert TV PVR7134
- 60 -> Typhoon DVB-T Duo Digital/Analog Cardbus [4e42:0502]
+ 60 -> LifeView/Typhoon FlyDVB-T Duo Cardbus    [5168:0502,4e42:0502]
  61 -> Philips TOUGH DVB-T reference design     [1131:2004]
  62 -> Compro VideoMate TV Gold+II
  63 -> Kworld Xpert TV PVR7134
@@ -75,7 +75,7 @@
  74 -> LifeView FlyTV Platinum Mini2            [14c0:1212]
  75 -> AVerMedia AVerTVHD MCE A180              [1461:1044]
  76 -> SKNet MonsterTV Mobile                   [1131:4ee9]
- 77 -> Pinnacle PCTV 110i (saa7133)             [11bd:002e]
+ 77 -> Pinnacle PCTV 40i/50i/110i (saa7133)     [11bd:002e]
  78 -> ASUSTeK P7131 Dual                       [1043:4862]
  79 -> Sedna/MuchTV PC TV Cardbus TV/Radio (ITO25 Rev:2B)
  80 -> ASUS Digimatrix TV                       [1043:0210]
diff --git a/Documentation/vm/page_migration b/Documentation/vm/page_migration
index c52820fcf500..0dd4ef30c361 100644
--- a/Documentation/vm/page_migration
+++ b/Documentation/vm/page_migration
@@ -12,12 +12,18 @@ is running.
 
 Page migration allows a process to manually relocate the node on which its
 pages are located through the MF_MOVE and MF_MOVE_ALL options while setting
-a new memory policy. The pages of process can also be relocated
+a new memory policy via mbind(). The pages of process can also be relocated
 from another process using the sys_migrate_pages() function call. The
 migrate_pages function call takes two sets of nodes and moves pages of a
 process that are located on the from nodes to the destination nodes.
-
-Manual migration is very useful if for example the scheduler has relocated
+Page migration functions are provided by the numactl package by Andi Kleen
+(a version later than 0.9.3 is required. Get it from
+ftp://ftp.suse.com/pub/people/ak). numactl provided libnuma which
+provides an interface similar to other numa functionality for page migration.
+cat /proc/<pid>/numa_maps allows an easy review of where the pages of
+a process are located. See also the numa_maps manpage in the numactl package.
+
+Manual migration is useful if for example the scheduler has relocated
 a process to a processor on a distant node. A batch scheduler or an
 administrator may detect the situation and move the pages of the process
 nearer to the new processor. At some point in the future we may have
@@ -25,10 +31,12 @@ some mechanism in the scheduler that will automatically move the pages.
 
 Larger installations usually partition the system using cpusets into
 sections of nodes. Paul Jackson has equipped cpusets with the ability to
-move pages when a task is moved to another cpuset. This allows automatic
-control over locality of a process. If a task is moved to a new cpuset
-then also all its pages are moved with it so that the performance of the
-process does not sink dramatically (as is the case today).
+move pages when a task is moved to another cpuset (See ../cpusets.txt).
+Cpusets allows the automation of process locality. If a task is moved to
+a new cpuset then also all its pages are moved with it so that the
+performance of the process does not sink dramatically. Also the pages
+of processes in a cpuset are moved if the allowed memory nodes of a
+cpuset are changed.
 
 Page migration allows the preservation of the relative location of pages
 within a group of nodes for all migration techniques which will preserve a
@@ -37,22 +45,26 @@ process. This is necessary in order to preserve the memory latencies.
 Processes will run with similar performance after migration.
 
 Page migration occurs in several steps. First a high level
-description for those trying to use migrate_pages() and then
-a low level description of how the low level details work.
+description for those trying to use migrate_pages() from the kernel
+(for userspace usage see the Andi Kleen's numactl package mentioned above)
+and then a low level description of how the low level details work.
 
-A. Use of migrate_pages()
--------------------------
+A. In kernel use of migrate_pages()
+-----------------------------------
 
 1. Remove pages from the LRU.
 
    Lists of pages to be migrated are generated by scanning over
    pages and moving them into lists. This is done by
-   calling isolate_lru_page() or __isolate_lru_page().
+   calling isolate_lru_page().
    Calling isolate_lru_page increases the references to the page
-   so that it cannot vanish under us.
+   so that it cannot vanish while the page migration occurs.
+   It also prevents the swapper or other scans to encounter
+   the page.
 
-2. Generate a list of newly allocates page to move the contents
-   of the first list to.
+2. Generate a list of newly allocates page. These pages will contain the
+   contents of the pages from the first list after page migration is
+   complete.
 
 3. The migrate_pages() function is called which attempts
    to do the migration. It returns the moved pages in the
@@ -63,13 +75,17 @@ A. Use of migrate_pages()
 4. The leftover pages of various types are returned
    to the LRU using putback_to_lru_pages() or otherwise
    disposed of. The pages will still have the refcount as
-   increased by isolate_lru_pages()!
+   increased by isolate_lru_pages() if putback_to_lru_pages() is not
+   used! The kernel may want to handle the various cases of failures in
+   different ways.
 
-B. Operation of migrate_pages()
---------------------------------
+B. How migrate_pages() works
+----------------------------
 
-migrate_pages does several passes over its list of pages. A page is moved
-if all references to a page are removable at the time.
+migrate_pages() does several passes over its list of pages. A page is moved
+if all references to a page are removable at the time. The page has
+already been removed from the LRU via isolate_lru_page() and the refcount
+is increased so that the page cannot be freed while page migration occurs.
 
 Steps:
 
@@ -79,36 +95,40 @@ Steps:
 
 3. Make sure that the page has assigned swap cache entry if
    it is an anonyous page. The swap cache reference is necessary
-   to preserve the information contain in the page table maps.
+   to preserve the information contain in the page table maps while
+   page migration occurs.
 
 4. Prep the new page that we want to move to. It is locked
    and set to not being uptodate so that all accesses to the new
-   page immediately lock while we are moving references.
+   page immediately lock while the move is in progress.
 
-5. All the page table references to the page are either dropped (file backed)
-   or converted to swap references (anonymous pages). This should decrease the
-   reference count.
+5. All the page table references to the page are either dropped (file
+   backed pages) or converted to swap references (anonymous pages).
+   This should decrease the reference count.
 
-6. The radix tree lock is taken
+6. The radix tree lock is taken. This will cause all processes trying
+   to reestablish a pte to block on the radix tree spinlock.
 
 7. The refcount of the page is examined and we back out if references remain
    otherwise we know that we are the only one referencing this page.
 
 8. The radix tree is checked and if it does not contain the pointer to this
-   page then we back out.
+   page then we back out because someone else modified the mapping first.
 
 9. The mapping is checked. If the mapping is gone then a truncate action may
    be in progress and we back out.
 
-10. The new page is prepped with some settings from the old page so that accesses
-   to the new page will be discovered to have the correct settings.
+10. The new page is prepped with some settings from the old page so that
+   accesses to the new page will be discovered to have the correct settings.
 
 11. The radix tree is changed to point to the new page.
 
-12. The reference count of the old page is dropped because the reference has now
-    been removed.
+12. The reference count of the old page is dropped because the radix tree
+    reference is gone.
 
-13. The radix tree lock is dropped.
+13. The radix tree lock is dropped. With that lookups become possible again
+    and other processes will move from spinning on the tree lock to sleeping on
+    the locked new page.
 
 14. The page contents are copied to the new page.
 
@@ -119,11 +139,37 @@ Steps:
 
 17. Queued up writeback on the new page is triggered.
 
-18. If swap pte's were generated for the page then remove them again.
+18. If swap pte's were generated for the page then replace them with real
+    ptes. This will reenable access for processes not blocked by the page lock.
+
+19. The page locks are dropped from the old and new page.
+    Processes waiting on the page lock can continue.
+
+20. The new page is moved to the LRU and can be scanned by the swapper
+    etc again.
+
+TODO list
+---------
+
+- Page migration requires the use of swap handles to preserve the
+  information of the anonymous page table entries. This means that swap
+  space is reserved but never used. The maximum number of swap handles used
+  is determined by CHUNK_SIZE (see mm/mempolicy.c) per ongoing migration.
+  Reservation of pages could be avoided by having a special type of swap
+  handle that does not require swap space and that would only track the page
+  references. Something like that was proposed by Marcelo Tosatti in the
+  past (search for migration cache on lkml or linux-mm@kvack.org).
 
-19. The locks are dropped from the old and new page.
+- Page migration unmaps ptes for file backed pages and requires page
+  faults to reestablish these ptes. This could be optimized by somehow
+  recording the references before migration and then reestablish them later.
+  However, there are several locking challenges that have to be overcome
+  before this is possible.
 
-20. The new page is moved to the LRU.
+- Page migration generates read ptes for anonymous pages. Dirty page
+  faults are required to make the pages writable again. It may be possible
+  to generate a pte marked dirty if it is known that the page is dirty and
+  that this process has the only reference to that page.
 
-Christoph Lameter, December 19, 2005.
+Christoph Lameter, March 8, 2006.
 
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 9c5fc15d03d1..1921353259ae 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -40,6 +40,22 @@ APICs
    no_timer_check Don't check the IO-APIC timer. This can work around
                  problems with incorrect timer initialization on some boards.
 
+   apicmaintimer Run time keeping from the local APIC timer instead
+                 of using the PIT/HPET interrupt for this. This is useful
+                 when the PIT/HPET interrupts are unreliable.
+
+   noapicmaintimer  Don't do time keeping using the APIC timer.
+                 Useful when this option was auto selected, but doesn't work.
+
+   apicpmtimer
+                 Do APIC timer calibration using the pmtimer. Implies
+                 apicmaintimer. Useful when your PIT timer is totally
+                 broken.
+
+   disable_8254_timer / enable_8254_timer
+                 Enable interrupt 0 timer routing over the 8254 in addition to over
+                 the IO-APIC. The kernel tries to set a sensible default.
+
 Early Console
 
    syntax: earlyprintk=vga
diff --git a/MAINTAINERS b/MAINTAINERS
index e384eb7ef862..8db5c339845d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -540,7 +540,8 @@ S:	Supported
 
 BTTV VIDEO4LINUX DRIVER
 P:      Mauro Carvalho Chehab
-M:      mchehab@brturbo.com.br
+M:      mchehab@infradead.org
+M:      v4l-dvb-maintainer@linuxtv.org
 L:      video4linux-list@redhat.com
 W:      http://linuxtv.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
@@ -557,7 +558,8 @@ S:	Supported
 
 CONFIGFS
 P:      Joel Becker
-M:      Joel Becker <joel.becker@oracle.com>
+M:      joel.becker@oracle.com
+L:      linux-kernel@vger.kernel.org
 S:      Supported
 
 CIRRUS LOGIC GENERIC FBDEV DRIVER
@@ -836,11 +838,11 @@ S:	Maintained
 
 DVB SUBSYSTEM AND DRIVERS
 P:      LinuxTV.org Project
-M:      linux-dvb-maintainer@linuxtv.org
+M:      v4l-dvb-maintainer@linuxtv.org
 L:      linux-dvb@linuxtv.org (subscription required)
 W:      http://linuxtv.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
-S:      Supported
+S:      Maintained
 
 EATA-DMA SCSI DRIVER
 P:      Michael Neuffer
@@ -928,6 +930,12 @@ M:	sct@redhat.com, akpm@osdl.org, adilger@clusterfs.com
 L:      ext3-users@redhat.com
 S:      Maintained
 
+F71805F HARDWARE MONITORING DRIVER
+P:      Jean Delvare
+M:      khali@linux-fr.org
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+
 FARSYNC SYNCHRONOUS DRIVER
 P:      Kevin Curtis
 M:      kevin.curtis@farsite.co.uk
@@ -1623,8 +1631,8 @@ S:	Supported
 
 LINUX SECURITY MODULE (LSM) FRAMEWORK
 P:      Chris Wright
-M:      chrisw@osdl.org
-L:      linux-security-module@wirex.com
+M:      chrisw@sous-sol.org
+L:      linux-security-module@vger.kernel.org
 W:      http://lsm.immunix.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/chrisw/lsm-2.6.git
 S:      Supported
@@ -1744,7 +1752,8 @@ P:	Ralf Baechle
 M:      ralf@linux-mips.org
 W:      http://www.linux-mips.org/
 L:      linux-mips@linux-mips.org
-S:      Maintained
+T:      git www.linux-mips.org:/pub/scm/linux.git
+S:      Supported
 
 MISCELLANEOUS MCA-SUPPORT
 P:      James Bottomley
@@ -2223,7 +2232,23 @@ P:	Martin Schwidefsky
 M:      schwidefsky@de.ibm.com
 M:      linux390@de.ibm.com
 L:      linux-390@vm.marist.edu
-W:      http://oss.software.ibm.com/developerworks/opensource/linux390
+W:      http://www.ibm.com/developerworks/linux/linux390/
+S:      Supported
+
+S390 NETWORK DRIVERS
+P:      Frank Pavlic
+M:      fpavlic@de.ibm.com
+M:      linux390@de.ibm.com
+L:      linux-390@vm.marist.edu
+W:      http://www.ibm.com/developerworks/linux/linux390/
+S:      Supported
+
+S390 ZFCP DRIVER
+P:      Andreas Herrmann
+M:      aherrman@de.ibm.com
+M:      linux390@de.ibm.com
+L:      linux-390@vm.marist.edu
+W:      http://www.ibm.com/developerworks/linux/linux390/
 S:      Supported
 
 SAA7146 VIDEO4LINUX-2 DRIVER
@@ -2297,7 +2322,7 @@ S:	Supported
 
 SELINUX SECURITY MODULE
 P:      Stephen Smalley
-M:      sds@epoch.ncsc.mil
+M:      sds@tycho.nsa.gov
 P:      James Morris
 M:      jmorris@namei.org
 L:      linux-kernel@vger.kernel.org (kernel issues)
@@ -2955,7 +2980,8 @@ S:      Maintained
 
 VIDEO FOR LINUX
 P:      Mauro Carvalho Chehab
-M:      mchehab@brturbo.com.br
+M:      mchehab@infradead.org
+M:      v4l-dvb-maintainer@linuxtv.org
 L:      video4linux-list@redhat.com
 W:      http://linuxtv.org
 T:      git kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb.git
diff --git a/Makefile b/Makefile
index cd5b619db9d8..cb5790580fca 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION =-rc2
+EXTRAVERSION =
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
@@ -106,13 +106,12 @@ KBUILD_OUTPUT := $(shell cd $(KBUILD_OUTPUT) && /bin/pwd)
 $(if $(KBUILD_OUTPUT),, \
      $(error output directory "$(saved-output)" does not exist))
 
-.PHONY: $(MAKECMDGOALS) cdbuilddir
-$(MAKECMDGOALS) _all: cdbuilddir
+.PHONY: $(MAKECMDGOALS)
 
-cdbuilddir:
+$(filter-out _all,$(MAKECMDGOALS)) _all:
         $(if $(KBUILD_VERBOSE:1=),@)$(MAKE) -C $(KBUILD_OUTPUT) \
         KBUILD_SRC=$(CURDIR) \
-        KBUILD_EXTMOD="$(KBUILD_EXTMOD)" -f $(CURDIR)/Makefile $(MAKECMDGOALS)
+        KBUILD_EXTMOD="$(KBUILD_EXTMOD)" -f $(CURDIR)/Makefile $@
 
 # Leave processing to above invocation of make
 skip-makefile := 1
@@ -442,7 +441,7 @@ export KBUILD_DEFCONFIG
 config %config: scripts_basic outputmakefile FORCE
         $(Q)mkdir -p include/linux
         $(Q)$(MAKE) $(build)=scripts/kconfig $@
-        $(Q)$(MAKE) .kernelrelease
+        $(Q)$(MAKE) -C $(srctree) KBUILD_SRC= .kernelrelease
 
 else
 # ===========================================================================
@@ -906,7 +905,7 @@ define filechk_version.h
         )
 endef
 
-include/linux/version.h: $(srctree)/Makefile .config FORCE
+include/linux/version.h: $(srctree)/Makefile .config .kernelrelease FORCE
         $(call filechk,version.h)
 
 # ---------------------------------------------------------------------------
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 9006063e7369..da677f829f76 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -151,8 +151,13 @@ handle_irq(int irq, struct pt_regs * regs)
         }
 
         irq_enter();
+        /*
+         * __do_IRQ() must be called with IPL_MAX. Note that we do not
+         * explicitly enable interrupts afterwards - some MILO PALcode
+         * (namely LX164 one) seems to have severe problems with RTI
+         * at IPL 0.
+         */
         local_irq_disable();
         __do_IRQ(irq, regs);
-        local_irq_enable();
         irq_exit();
 }
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 4b873527ce1c..02c2db08114a 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -73,9 +73,6 @@ cpumask_t cpu_online_map;
 
 EXPORT_SYMBOL(cpu_online_map);
 
-/* cpus reported in the hwrpb */
-static unsigned long hwrpb_cpu_present_mask __initdata = 0;
-
 int smp_num_probed;             /* Internal processor count */
 int smp_num_cpus = 1;           /* Number that came online.  */
 
@@ -442,7 +439,7 @@ setup_smp(void)
                         if ((cpu->flags & 0x1cc) == 0x1cc) {
                                 smp_num_probed++;
                                 /* Assume here that "whami" == index */
-                                hwrpb_cpu_present_mask |= (1UL << i);
+                                cpu_set(i, cpu_possible_map);
                                 cpu->pal_revision = boot_cpu_palrev;
                         }
 
@@ -453,12 +450,12 @@ setup_smp(void)
                 }
         } else {
                 smp_num_probed = 1;
-                hwrpb_cpu_present_mask = (1UL << boot_cpuid);
+                cpu_set(boot_cpuid, cpu_possible_map);
         }
         cpu_present_mask = cpumask_of_cpu(boot_cpuid);
 
         printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
-               smp_num_probed, hwrpb_cpu_present_mask);
+               smp_num_probed, cpu_possible_map.bits[0]);
 }
 
 /*
@@ -467,8 +464,6 @@ setup_smp(void)
 void __init
 smp_prepare_cpus(unsigned int max_cpus)
 {
-        int cpu_count, i;
-
         /* Take care of some initial bookkeeping.  */
         memset(ipi_data, 0, sizeof(ipi_data));
 
@@ -486,19 +481,7 @@ smp_prepare_cpus(unsigned int max_cpus)
 
         printk(KERN_INFO "SMP starting up secondaries.\n");
 
-        cpu_count = 1;
-        for (i = 0; (i < NR_CPUS) && (cpu_count < max_cpus); i++) {
-                if (i == boot_cpuid)
-                        continue;
-
-                if (((hwrpb_cpu_present_mask >> i) & 1) == 0)
-                        continue;
-
-                cpu_set(i, cpu_possible_map);
-                cpu_count++;
-        }
-
-        smp_num_cpus = cpu_count;
+        smp_num_cpus = smp_num_probed;
 }
 
 void __devinit
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 5959e36c3b4c..32ba00bd0a2f 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -10,9 +10,9 @@ config ARM
         default y
         help
           The ARM series is a line of low-power-consumption RISC chip designs
-          licensed by ARM ltd and targeted at embedded applications and
+          licensed by ARM Ltd and targeted at embedded applications and
           handhelds such as the Compaq IPAQ.  ARM-based PCs are no longer
-          manufactured, but  legacy ARM-based PC hardware remains popular in
+          manufactured, but legacy ARM-based PC hardware remains popular in
           Europe.  There is an ARM Linux project with a web page at
           <http://www.arm.linux.org.uk/>.
 
@@ -69,57 +69,77 @@ config GENERIC_ISA_DMA
 config FIQ
         bool
 
+config ARCH_MTD_XIP
+        bool
+
 source "init/Kconfig"
 
 menu "System Type"
 
 choice
         prompt "ARM system type"
-        default ARCH_RPC
+        default ARCH_VERSATILE
 
 config ARCH_CLPS7500
         bool "Cirrus-CL-PS7500FE"
         select TIMER_ACORN
         select ISA
+        help
+          Support for the Cirrus Logic PS7500FE system-on-a-chip.
 
 config ARCH_CLPS711X
         bool "CLPS711x/EP721x-based"
+        help
+          Support for Cirrus Logic 711x/721x based boards.
 
 config ARCH_CO285
         bool "Co-EBSA285"
         select FOOTBRIDGE
         select FOOTBRIDGE_ADDIN
+        help
+          Support for Intel's EBSA285 companion chip.
 
 config ARCH_EBSA110
         bool "EBSA-110"
         select ISA
         help
           This is an evaluation board for the StrongARM processor available
-          from Digital. It has limited hardware on-board, including an onboard
+          from Digital. It has limited hardware on-board, including an
           Ethernet interface, two PCMCIA sockets, two serial ports and a
           parallel port.
 
 config ARCH_FOOTBRIDGE
         bool "FootBridge"
         select FOOTBRIDGE
+        help
+          Support for systems based on the DC21285 companion chip
+          ("FootBridge"), such as the Simtec CATS and the Rebel NetWinder.
 
 config ARCH_INTEGRATOR
         bool "Integrator"
         select ARM_AMBA
         select ICST525
+        help
+          Support for ARM's Integrator platform.
 
 config ARCH_IOP3XX
         bool "IOP3xx-based"
         select PCI
+        help
+          Support for Intel's IOP3XX (XScale) family of processors.
 
 config ARCH_IXP4XX
         bool "IXP4xx-based"
         select DMABOUNCE
         select PCI
+        help
+          Support for Intel's IXP4XX (XScale) family of processors.
 
 config ARCH_IXP2000
         bool "IXP2400/2800-based"
         select PCI
+        help
+          Support for Intel's IXP2400/2800 (XScale) family of processors.
 
 config ARCH_L7200
         bool "LinkUp-L7200"
@@ -136,6 +156,9 @@ config ARCH_L7200
 
 config ARCH_PXA
         bool "PXA2xx-based"
+        select ARCH_MTD_XIP
+        help
+          Support for Intel's PXA2XX processor line.
 
 config ARCH_RPC
         bool "RiscPC"
@@ -152,19 +175,25 @@ config ARCH_SA1100
         bool "SA1100-based"
         select ISA
         select ARCH_DISCONTIGMEM_ENABLE
+        select ARCH_MTD_XIP
+        help
+          Support for StrongARM 11x0 based boards.
 
 config ARCH_S3C2410
         bool "Samsung S3C2410"
         help
           Samsung S3C2410X CPU based systems, such as the Simtec Electronics
           BAST (<http://www.simtec.co.uk/products/EB110ITX/>), the IPAQ 1940 or
-          the Samsung SMDK2410 development board (and derviatives).
+          the Samsung SMDK2410 development board (and derivatives).
 
 config ARCH_SHARK
         bool "Shark"
         select ISA
         select ISA_DMA
         select PCI
+        help
+          Support for the StrongARM based Digital DNARD machine, also known
+          as "Shark" (<http://www.shark-linux.de/shark.html>).
 
 config ARCH_LH7A40X
         bool "Sharp LH7A40X"
@@ -176,6 +205,8 @@ config ARCH_LH7A40X
 
 config ARCH_OMAP
         bool "TI OMAP"
+        help
+          Support for TI's OMAP platform (OMAP1 and OMAP2).
 
 config ARCH_VERSATILE
         bool "Versatile"
@@ -194,6 +225,8 @@ config ARCH_REALVIEW
 
 config ARCH_IMX
         bool "IMX"
+        help
+          Support for Motorola's i.MX family of processors (MX1, MXL).
 
 config ARCH_H720X
         bool "Hynix-HMS720x-based"
@@ -210,8 +243,8 @@ config ARCH_AAEC2000
 config ARCH_AT91RM9200
         bool "AT91RM9200"
         help
-          Say Y here if you intend to run this kernel on an AT91RM9200-based
-          board.
+          Say Y here if you intend to run this kernel on an Atmel
+          AT91RM9200-based board.
 
 endchoice
 
@@ -417,8 +450,8 @@ config AEABI
           To use this you need GCC version 4.0.0 or later.
 
 config OABI_COMPAT
-        bool "Allow old ABI binaries to run with this kernel"
-        depends on AEABI
+        bool "Allow old ABI binaries to run with this kernel (EXPERIMENTAL)"
+        depends on AEABI && EXPERIMENTAL
         default y
         help
           This option preserves the old syscall interface along with the
@@ -766,6 +799,8 @@ source "drivers/i2c/Kconfig"
 
 source "drivers/spi/Kconfig"
 
+source "drivers/w1/Kconfig"
+
 source "drivers/hwmon/Kconfig"
 
 #source "drivers/l3/Kconfig"
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 159ad7ed7a40..d31b1cb7eea0 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -629,6 +629,22 @@ static int locomo_resume(struct platform_device *dev)
 }
 #endif
 
+
+#define LCM_ALC_EN      0x8000
+
+void frontlight_set(struct locomo *lchip, int duty, int vr, int bpwf)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&lchip->lock, flags);
+        locomo_writel(bpwf, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALS);
+        udelay(100);
+        locomo_writel(duty, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALD);
+        locomo_writel(bpwf | LCM_ALC_EN, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALS);
+        spin_unlock_irqrestore(&lchip->lock, flags);
+}
+
+
 /**
  *      locomo_probe - probe for a single LoCoMo chip.
  *      @phys_addr: physical address of device.
@@ -688,6 +704,11 @@ __locomo_probe(struct device *me, struct resource *mem, int irq)
         /* FrontLight */
         locomo_writel(0, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALS);
         locomo_writel(0, lchip->base + LOCOMO_FRONTLIGHT + LOCOMO_ALD);
+
+        /* Same constants can be used for collie and poodle
+           (depending on CONFIG options in original sharp code)? */
+        frontlight_set(lchip, 163, 0, 148);
+
         /* Longtime timer */
         locomo_writel(0, lchip->base + LOCOMO_LTINT);
         /* SPI */
diff --git a/arch/arm/common/rtctime.c b/arch/arm/common/rtctime.c
index 48b1e19b131f..e851d86c212c 100644
--- a/arch/arm/common/rtctime.c
+++ b/arch/arm/common/rtctime.c
@@ -128,19 +128,27 @@ EXPORT_SYMBOL(rtc_tm_to_time);
 /*
  * Calculate the next alarm time given the requested alarm time mask
  * and the current time.
- *
- * FIXME: for now, we just copy the alarm time because we're lazy (and
- * is therefore buggy - setting a 10am alarm at 8pm will not result in
- * the alarm triggering.)
  */
 void rtc_next_alarm_time(struct rtc_time *next, struct rtc_time *now, struct rtc_time *alrm)
 {
+        unsigned long next_time;
+        unsigned long now_time;
+
         next->tm_year = now->tm_year;
         next->tm_mon = now->tm_mon;
         next->tm_mday = now->tm_mday;
         next->tm_hour = alrm->tm_hour;
         next->tm_min = alrm->tm_min;
         next->tm_sec = alrm->tm_sec;
+
+        rtc_tm_to_time(now, &now_time);
+        rtc_tm_to_time(next, &next_time);
+
+        if (next_time < now_time) {
+                /* Advance one day */
+                next_time += 60 * 60 * 24;
+                rtc_time_to_tm(next_time, next);
+        }
 }
 
 static inline int rtc_read_time(struct rtc_ops *ops, struct rtc_time *tm)
diff --git a/arch/arm/configs/at91rm9200dk_defconfig b/arch/arm/configs/at91rm9200dk_defconfig
index 5cdd13acf8ff..1fe73d198888 100644
--- a/arch/arm/configs/at91rm9200dk_defconfig
+++ b/arch/arm/configs/at91rm9200dk_defconfig
@@ -85,7 +85,6 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
-# CONFIG_ARCH_CAMELOT is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
 # CONFIG_ARCH_INTEGRATOR is not set
 # CONFIG_ARCH_IOP3XX is not set
diff --git a/arch/arm/configs/at91rm9200ek_defconfig b/arch/arm/configs/at91rm9200ek_defconfig
index 20838ccf1da7..b7d934cdb1b7 100644
--- a/arch/arm/configs/at91rm9200ek_defconfig
+++ b/arch/arm/configs/at91rm9200ek_defconfig
@@ -85,7 +85,6 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
-# CONFIG_ARCH_CAMELOT is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
 # CONFIG_ARCH_INTEGRATOR is not set
 # CONFIG_ARCH_IOP3XX is not set
diff --git a/arch/arm/configs/csb337_defconfig b/arch/arm/configs/csb337_defconfig
index 885a3184830a..94bd9932a402 100644
--- a/arch/arm/configs/csb337_defconfig
+++ b/arch/arm/configs/csb337_defconfig
@@ -85,7 +85,6 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
-# CONFIG_ARCH_CAMELOT is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
 # CONFIG_ARCH_INTEGRATOR is not set
 # CONFIG_ARCH_IOP3XX is not set
diff --git a/arch/arm/configs/csb637_defconfig b/arch/arm/configs/csb637_defconfig
index 95a96a5462a0..1519124c5501 100644
--- a/arch/arm/configs/csb637_defconfig
+++ b/arch/arm/configs/csb637_defconfig
@@ -85,7 +85,6 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
-# CONFIG_ARCH_CAMELOT is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
 # CONFIG_ARCH_INTEGRATOR is not set
 # CONFIG_ARCH_IOP3XX is not set
diff --git a/arch/arm/configs/enp2611_defconfig b/arch/arm/configs/enp2611_defconfig
index 9592e3925c79..5fdaf3ce9d56 100644
--- a/arch/arm/configs/enp2611_defconfig
+++ b/arch/arm/configs/enp2611_defconfig
@@ -171,7 +171,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=ttyS0,57600 root=/dev/nfs ip=bootp mem=64M@0x0 pci=firmware"
+CONFIG_CMDLINE="console=ttyS0,57600 root=/dev/nfs ip=bootp mem=64M@0x0"
 # CONFIG_XIP_KERNEL is not set
 
 #
diff --git a/arch/arm/configs/ixdp2400_defconfig b/arch/arm/configs/ixdp2400_defconfig
index d9d6bb86a6fa..c67fc449a11f 100644
--- a/arch/arm/configs/ixdp2400_defconfig
+++ b/arch/arm/configs/ixdp2400_defconfig
@@ -172,7 +172,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=ttyS0,57600 root=/dev/nfs ip=bootp mem=64M@0x0 pci=firmware"
+CONFIG_CMDLINE="console=ttyS0,57600 root=/dev/nfs ip=bootp mem=64M@0x0"
 # CONFIG_XIP_KERNEL is not set
 
 #
diff --git a/arch/arm/configs/ixdp2401_defconfig b/arch/arm/configs/ixdp2401_defconfig
index 2dc9d499c7d7..60d66e82c51f 100644
--- a/arch/arm/configs/ixdp2401_defconfig
+++ b/arch/arm/configs/ixdp2401_defconfig
@@ -172,7 +172,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=ttyS0,115200 root=/dev/nfs ip=bootp mem=64M@0x0 pci=firmware"
+CONFIG_CMDLINE="console=ttyS0,115200 root=/dev/nfs ip=bootp mem=64M@0x0"
 # CONFIG_XIP_KERNEL is not set
 
 #
diff --git a/arch/arm/configs/ixdp2801_defconfig b/arch/arm/configs/ixdp2801_defconfig
index ea8f4b478fa3..f54f3dcc5b33 100644
--- a/arch/arm/configs/ixdp2801_defconfig
+++ b/arch/arm/configs/ixdp2801_defconfig
@@ -172,7 +172,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=ttyS0,115200 root=/dev/nfs ip=bootp mem=64M@0x0 pci=firmware ixdp2x01_clock=50000000"
+CONFIG_CMDLINE="console=ttyS0,115200 root=/dev/nfs ip=bootp mem=64M@0x0"
 # CONFIG_XIP_KERNEL is not set
 
 #
diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
index 1964ccd8a71f..6695b07cf1ba 100644
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -1,11 +1,10 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc1
-# Sun Nov 13 17:41:24 2005
+# Linux kernel version: 2.6.16-rc2
+# Mon Feb  6 11:17:23 2006
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
-CONFIG_UID16=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 
@@ -28,27 +27,31 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_UID16=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
-CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SHMEM=y
 CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
+CONFIG_OBSOLETE_INTERMODULE=y
 
 #
 # Loadable module support
@@ -102,6 +105,7 @@ CONFIG_ARCH_S3C2410=y
 # CONFIG_ARCH_IMX is not set
 # CONFIG_ARCH_H720X is not set
 # CONFIG_ARCH_AAEC2000 is not set
+# CONFIG_ARCH_AT91RM9200 is not set
 
 #
 # S3C24XX Implementations
@@ -160,7 +164,6 @@ CONFIG_CPU_TLB_V4WBI=y
 # Bus support
 #
 CONFIG_ISA=y
-CONFIG_ISA_DMA_API=y
 
 #
 # PCCARD (PCMCIA/CardBus) support
@@ -172,6 +175,7 @@ CONFIG_ISA_DMA_API=y
 #
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
+# CONFIG_AEABI is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
@@ -214,6 +218,8 @@ CONFIG_BINFMT_AOUT=y
 # Power management options
 #
 CONFIG_PM=y
+CONFIG_PM_LEGACY=y
+# CONFIG_PM_DEBUG is not set
 CONFIG_APM=y
 
 #
@@ -259,6 +265,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -276,7 +287,6 @@ CONFIG_TCP_CONG_BIC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -300,6 +310,11 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_DEBUG_DRIVER is not set
 
 #
+# Connector - unified userspace <-> kernelspace linker
+#
+# CONFIG_CONNECTOR is not set
+
+#
 # Memory Technology Devices (MTD)
 #
 CONFIG_MTD=y
@@ -412,8 +427,6 @@ CONFIG_PARPORT_1284=y
 #
 # Block devices
 #
-# CONFIG_BLK_DEV_XD is not set
-# CONFIG_PARIDE is not set
 # CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
 # CONFIG_BLK_DEV_CRYPTOLOOP is not set
@@ -502,7 +515,6 @@ CONFIG_NETDEVICES=y
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
 # CONFIG_NET_VENDOR_3COM is not set
-# CONFIG_LANCE is not set
 # CONFIG_NET_VENDOR_SMC is not set
 # CONFIG_SMC91X is not set
 CONFIG_DM9000=y
@@ -607,11 +619,11 @@ CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
-# CONFIG_ESPSERIAL is not set
 # CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_RISCOM8 is not set
 # CONFIG_SPECIALIX is not set
@@ -625,6 +637,7 @@ CONFIG_SERIAL_NONSTANDARD=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=8
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
@@ -687,6 +700,7 @@ CONFIG_S3C2410_RTC=y
 #
 # TPM devices
 #
+# CONFIG_TCG_TPM is not set
 # CONFIG_TELCLOCK is not set
 
 #
@@ -731,6 +745,12 @@ CONFIG_SENSORS_EEPROM=m
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Hardware Monitoring support
 #
 CONFIG_HWMON=y
@@ -863,6 +883,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 CONFIG_ROMFS_FS=y
 CONFIG_INOTIFY=y
@@ -897,6 +918,7 @@ CONFIG_SYSFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -965,6 +987,7 @@ CONFIG_SOLARIS_X86_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1020,12 +1043,13 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
@@ -1034,6 +1058,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
 CONFIG_FRAME_POINTER=y
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
 # CONFIG_DEBUG_WAITQ is not set
diff --git a/arch/arm/kernel/asm-offsets.c b/arch/arm/kernel/asm-offsets.c
index 0abbce8c70bc..b324dcac1c56 100644
--- a/arch/arm/kernel/asm-offsets.c
+++ b/arch/arm/kernel/asm-offsets.c
@@ -57,7 +57,9 @@ int main(void)
   DEFINE(TI_TP_VALUE,           offsetof(struct thread_info, tp_value));
   DEFINE(TI_FPSTATE,            offsetof(struct thread_info, fpstate));
   DEFINE(TI_VFPSTATE,           offsetof(struct thread_info, vfpstate));
-  DEFINE(TI_IWMMXT_STATE,       (offsetof(struct thread_info, fpstate)+4)&~7);
+#ifdef CONFIG_IWMMXT
+  DEFINE(TI_IWMMXT_STATE,       offsetof(struct thread_info, fpstate.iwmmxt));
+#endif
   BLANK();
   DEFINE(S_R0,                  offsetof(struct pt_regs, ARM_r0));
   DEFINE(S_R1,                  offsetof(struct pt_regs, ARM_r1));
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index d058e7c12568..3173924a9b60 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -111,7 +111,7 @@
                 CALL(sys_statfs)
 /* 100 */       CALL(sys_fstatfs)
                 CALL(sys_ni_syscall)
-                CALL(OBSOLETE(sys_socketcall))
+                CALL(OBSOLETE(ABI(sys_socketcall, sys_oabi_socketcall)))
                 CALL(sys_syslog)
                 CALL(sys_setitimer)
 /* 105 */       CALL(sys_getitimer)
@@ -291,21 +291,21 @@
                 CALL(sys_mq_getsetattr)
 /* 280 */       CALL(sys_waitid)
                 CALL(sys_socket)
-                CALL(sys_bind)
-                CALL(sys_connect)
+                CALL(ABI(sys_bind, sys_oabi_bind))
+                CALL(ABI(sys_connect, sys_oabi_connect))
                 CALL(sys_listen)
 /* 285 */       CALL(sys_accept)
                 CALL(sys_getsockname)
                 CALL(sys_getpeername)
                 CALL(sys_socketpair)
                 CALL(sys_send)
-/* 290 */       CALL(sys_sendto)
+/* 290 */       CALL(ABI(sys_sendto, sys_oabi_sendto))
                 CALL(sys_recv)
                 CALL(sys_recvfrom)
                 CALL(sys_shutdown)
                 CALL(sys_setsockopt)
 /* 295 */       CALL(sys_getsockopt)
-                CALL(sys_sendmsg)
+                CALL(ABI(sys_sendmsg, sys_oabi_sendmsg))
                 CALL(sys_recvmsg)
                 CALL(ABI(sys_semop, sys_oabi_semop))
                 CALL(sys_semget)
diff --git a/arch/arm/kernel/compat.c b/arch/arm/kernel/compat.c
index 7195add42e74..60cfa7f3226c 100644
--- a/arch/arm/kernel/compat.c
+++ b/arch/arm/kernel/compat.c
@@ -27,6 +27,8 @@
 
 #include <asm/mach/arch.h>
 
+#include "compat.h"
+
 /*
  * Usage:
  *  - do not go blindly adding fields, add them at the end
diff --git a/arch/arm/kernel/compat.h b/arch/arm/kernel/compat.h
new file mode 100644
index 000000000000..27e61a68bd1c
--- /dev/null
+++ b/arch/arm/kernel/compat.h
@@ -0,0 +1,13 @@
+/*
+ *  linux/arch/arm/kernel/compat.h
+ *
+ *  Copyright (C) 2001 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+extern void convert_to_tag_list(struct tag *tags);
+
+extern void squash_mem_tags(struct tag *tag);
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index d401d908c463..ec48d70c6d8b 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -333,10 +333,14 @@ __pabt_svc:
                                         @ from the exception stack
 
 #if __LINUX_ARM_ARCH__ < 6 && !defined(CONFIG_NEEDS_SYSCALL_FOR_CMPXCHG)
+#ifndef CONFIG_MMU
+#warning "NPTL on non MMU needs fixing"
+#else
         @ make sure our user space atomic helper is aborted
         cmp     r2, #TASK_SIZE
         bichs   r3, r3, #PSR_Z_BIT
 #endif
+#endif
 
         @
         @ We are now ready to fill in the remaining blanks on the stack:
@@ -562,7 +566,7 @@ ENTRY(__switch_to)
         ldr     r6, [r2, #TI_CPU_DOMAIN]!
 #endif
 #if __LINUX_ARM_ARCH__ >= 6
-#ifdef CONFIG_CPU_MPCORE
+#ifdef CONFIG_CPU_32v6K
         clrex
 #else
         strex   r5, r4, [ip]                    @ Clear exclusive monitor
@@ -705,7 +709,12 @@ __kuser_memory_barrier:				@ 0xffff0fa0
  * The C flag is also set if *ptr was changed to allow for assembly
  * optimization in the calling code.
  *
- * Note: this routine already includes memory barriers as needed.
+ * Notes:
+ *
+ *    - This routine already includes memory barriers as needed.
+ *
+ *    - A failure might be transient, i.e. it is possible, although unlikely,
+ *      that "failure" be returned even if *ptr == oldval.
  *
  * For example, a user space atomic_add implementation could look like this:
  *
@@ -756,12 +765,18 @@ __kuser_cmpxchg:				@ 0xffff0fc0
          * exception happening just after the str instruction which would
          * clear the Z flag although the exchange was done.
          */
+#ifdef CONFIG_MMU
         teq     ip, ip                  @ set Z flag
         ldr     ip, [r2]                @ load current val
         add     r3, r2, #1              @ prepare store ptr
         teqeq   ip, r0                  @ compare with oldval if still allowed
         streq   r1, [r3, #-1]!          @ store newval if still allowed
         subs    r0, r2, r3              @ if r2 == r3 the str occured
+#else
+#warning "NPTL on non MMU needs fixing"
+        mov     r0, #-1
+        adds    r0, r0, #0
+#endif
         mov     pc, lr
 
 #else
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 4b4e4cf79c80..489c069e5c3e 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -27,6 +27,7 @@
 #include <linux/kallsyms.h>
 #include <linux/init.h>
 #include <linux/cpu.h>
+#include <linux/elfcore.h>
 
 #include <asm/leds.h>
 #include <asm/processor.h>
@@ -83,7 +84,7 @@ EXPORT_SYMBOL(pm_power_off);
  * This is our default idle handler.  We need to disable
  * interrupts here to ensure we don't miss a wakeup call.
  */
-void default_idle(void)
+static void default_idle(void)
 {
         if (hlt_counter)
                 cpu_relax();
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 7b6256bb590e..a1d1b2906e8d 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -610,15 +610,12 @@ static int ptrace_setfpregs(struct task_struct *tsk, void __user *ufp)
 static int ptrace_getwmmxregs(struct task_struct *tsk, void __user *ufp)
 {
         struct thread_info *thread = task_thread_info(tsk);
-        void *ptr = &thread->fpstate;
 
         if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
                 return -ENODATA;
         iwmmxt_task_disable(thread);  /* force it to ram */
-        /* The iWMMXt state is stored doubleword-aligned.  */
-        if (((long) ptr) & 4)
-                ptr += 4;
-        return copy_to_user(ufp, ptr, 0x98) ? -EFAULT : 0;
+        return copy_to_user(ufp, &thread->fpstate.iwmmxt, IWMMXT_SIZE)
+                ? -EFAULT : 0;
 }
 
 /*
@@ -627,15 +624,12 @@ static int ptrace_getwmmxregs(struct task_struct *tsk, void __user *ufp)
 static int ptrace_setwmmxregs(struct task_struct *tsk, void __user *ufp)
 {
         struct thread_info *thread = task_thread_info(tsk);
-        void *ptr = &thread->fpstate;
 
         if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
                 return -EACCES;
         iwmmxt_task_release(thread);  /* force a reload */
-        /* The iWMMXt state is stored doubleword-aligned.  */
-        if (((long) ptr) & 4)
-                ptr += 4;
-        return copy_from_user(ptr, ufp, 0x98) ? -EFAULT : 0;
+        return copy_from_user(&thread->fpstate.iwmmxt, ufp, IWMMXT_SIZE)
+                ? -EFAULT : 0;
 }
 
 #endif
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index c45d10d07bde..08974cbe9824 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -23,6 +23,7 @@
 #include <linux/root_dev.h>
 #include <linux/cpu.h>
 #include <linux/interrupt.h>
+#include <linux/smp.h>
 
 #include <asm/cpu.h>
 #include <asm/elf.h>
@@ -36,6 +37,8 @@
 #include <asm/mach/irq.h>
 #include <asm/mach/time.h>
 
+#include "compat.h"
+
 #ifndef MEM_SIZE
 #define MEM_SIZE        (16*1024*1024)
 #endif
@@ -52,10 +55,7 @@ static int __init fpe_setup(char *line)
 __setup("fpe=", fpe_setup);
 #endif
 
-extern unsigned int mem_fclk_21285;
 extern void paging_init(struct meminfo *, struct machine_desc *desc);
-extern void convert_to_tag_list(struct tag *tags);
-extern void squash_mem_tags(struct tag *tag);
 extern void reboot_setup(char *str);
 extern int root_mountflags;
 extern void _stext, _text, _etext, __data_start, _edata, _end;
@@ -771,6 +771,10 @@ void __init setup_arch(char **cmdline_p)
         paging_init(&meminfo, mdesc);
         request_standard_resources(&meminfo, mdesc);
 
+#ifdef CONFIG_SMP
+        smp_init_cpus();
+#endif
+
         cpu_init();
 
         /*
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 7338948bd7d3..02aa300c4633 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -338,7 +338,6 @@ void __init smp_prepare_boot_cpu(void)
 
         per_cpu(cpu_data, cpu).idle = current;
 
-        cpu_set(cpu, cpu_possible_map);
         cpu_set(cpu, cpu_present_map);
         cpu_set(cpu, cpu_online_map);
 }
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index eafa8e5284af..8e2f9bc3368b 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -59,6 +59,17 @@
  *   struct sembuf loses its padding with EABI.  Since arrays of them are
  *   used they have to be copyed to remove the padding. Compatibility wrappers
  *   provided below.
+ *
+ * sys_bind:
+ * sys_connect:
+ * sys_sendmsg:
+ * sys_sendto:
+ * sys_socketcall:
+ *
+ *   struct sockaddr_un loses its padding with EABI.  Since the size of the
+ *   structure is used as a validation test in unix_mkname(), we need to
+ *   change the length argument to 110 whenever it is 112.  Compatibility
+ *   wrappers provided below.
  */
 
 #include <linux/syscalls.h>
@@ -67,6 +78,8 @@
 #include <linux/fcntl.h>
 #include <linux/eventpoll.h>
 #include <linux/sem.h>
+#include <linux/socket.h>
+#include <linux/net.h>
 #include <asm/ipc.h>
 #include <asm/uaccess.h>
 
@@ -337,3 +350,91 @@ asmlinkage int sys_oabi_ipc(uint call, int first, int second, int third,
                 return sys_ipc(call, first, second, third, ptr, fifth);
         }
 }
+
+asmlinkage long sys_oabi_bind(int fd, struct sockaddr __user *addr, int addrlen)
+{
+        sa_family_t sa_family;
+        if (addrlen == 112 &&
+            get_user(sa_family, &addr->sa_family) == 0 &&
+            sa_family == AF_UNIX)
+                        addrlen = 110;
+        return sys_bind(fd, addr, addrlen);
+}
+
+asmlinkage long sys_oabi_connect(int fd, struct sockaddr __user *addr, int addrlen)
+{
+        sa_family_t sa_family;
+        if (addrlen == 112 &&
+            get_user(sa_family, &addr->sa_family) == 0 &&
+            sa_family == AF_UNIX)
+                        addrlen = 110;
+        return sys_connect(fd, addr, addrlen);
+}
+
+asmlinkage long sys_oabi_sendto(int fd, void __user *buff,
+                                size_t len, unsigned flags,
+                                struct sockaddr __user *addr,
+                                int addrlen)
+{
+        sa_family_t sa_family;
+        if (addrlen == 112 &&
+            get_user(sa_family, &addr->sa_family) == 0 &&
+            sa_family == AF_UNIX)
+                        addrlen = 110;
+        return sys_sendto(fd, buff, len, flags, addr, addrlen);
+}
+
+asmlinkage long sys_oabi_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
+{
+        struct sockaddr __user *addr;
+        int msg_namelen;
+        sa_family_t sa_family;
+        if (msg &&
+            get_user(msg_namelen, &msg->msg_namelen) == 0 &&
+            msg_namelen == 112 &&
+            get_user(addr, &msg->msg_name) == 0 &&
+            get_user(sa_family, &addr->sa_family) == 0 &&
+            sa_family == AF_UNIX)
+        {
+                /*
+                 * HACK ALERT: there is a limit to how much backward bending
+                 * we should do for what is actually a transitional
+                 * compatibility layer.  This already has known flaws with
+                 * a few ioctls that we don't intend to fix.  Therefore
+                 * consider this blatent hack as another one... and take care
+                 * to run for cover.  In most cases it will "just work fine".
+                 * If it doesn't, well, tough.
+                 */
+                put_user(110, &msg->msg_namelen);
+        }
+        return sys_sendmsg(fd, msg, flags);
+}
+
+asmlinkage long sys_oabi_socketcall(int call, unsigned long __user *args)
+{
+        unsigned long r = -EFAULT, a[6];
+
+        switch (call) {
+        case SYS_BIND:
+                if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
+                        r = sys_oabi_bind(a[0], (struct sockaddr __user *)a[1], a[2]);
+                break;
+        case SYS_CONNECT:
+                if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
+                        r = sys_oabi_connect(a[0], (struct sockaddr __user *)a[1], a[2]);
+                break;
+        case SYS_SENDTO:
+                if (copy_from_user(a, args, 6 * sizeof(long)) == 0)
+                        r = sys_oabi_sendto(a[0], (void __user *)a[1], a[2], a[3],
+                                            (struct sockaddr __user *)a[4], a[5]);
+                break;
+        case SYS_SENDMSG:
+                if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
+                        r = sys_oabi_sendmsg(a[0], (struct msghdr __user *)a[1], a[2]);
+                break;
+        default:
+                r = sys_socketcall(call, args);
+        }
+
+        return r;
+}
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index d7d932c02866..d6bd435a6857 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -422,12 +422,14 @@ static int timer_dyn_tick_disable(void)
 void timer_dyn_reprogram(void)
 {
         struct dyn_tick_timer *dyn_tick = system_timer->dyn_tick;
+        unsigned long next, seq;
 
-        if (dyn_tick) {
-                write_seqlock(&xtime_lock);
-                if (dyn_tick->state & DYN_TICK_ENABLED)
+        if (dyn_tick && (dyn_tick->state & DYN_TICK_ENABLED)) {
+                next = next_timer_interrupt();
+                do {
+                        seq = read_seqbegin(&xtime_lock);
                         dyn_tick->reprogram(next_timer_interrupt() - jiffies);
-                write_sequnlock(&xtime_lock);
+                } while (read_seqretry(&xtime_lock, seq));
         }
 }
 
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 10235b01582e..03924bcc6129 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -19,6 +19,7 @@
 #include <linux/personality.h>
 #include <linux/ptrace.h>
 #include <linux/kallsyms.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 
 #include <asm/atomic.h>
@@ -231,6 +232,13 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
         __die(str, err, thread, regs);
         bust_spinlocks(0);
         spin_unlock_irq(&die_lock);
+
+        if (panic_on_oops) {
+                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
+                ssleep(5);
+                panic("Fatal exception");
+        }
+
         do_exit(SIGSEGV);
 }
 
diff --git a/arch/arm/lib/muldi3.S b/arch/arm/lib/muldi3.S
index 72d594184b8a..d89c60615794 100644
--- a/arch/arm/lib/muldi3.S
+++ b/arch/arm/lib/muldi3.S
@@ -29,8 +29,8 @@ ENTRY(__aeabi_lmul)
 
         mul     xh, yl, xh
         mla     xh, xl, yh, xh
-        mov     ip, xl, asr #16
-        mov     yh, yl, asr #16
+        mov     ip, xl, lsr #16
+        mov     yh, yl, lsr #16
         bic     xl, xl, ip, lsl #16
         bic     yl, yl, yh, lsl #16
         mla     xh, yh, ip, xh
diff --git a/arch/arm/mach-at91rm9200/devices.c b/arch/arm/mach-at91rm9200/devices.c
index 8df3e5245651..57eedd5beaf6 100644
--- a/arch/arm/mach-at91rm9200/devices.c
+++ b/arch/arm/mach-at91rm9200/devices.c
@@ -100,8 +100,10 @@ void __init at91_add_device_udc(struct at91_udc_data *data)
                 at91_set_gpio_input(data->vbus_pin, 0);
                 at91_set_deglitch(data->vbus_pin, 1);
         }
-        if (data->pullup_pin)
+        if (data->pullup_pin) {
                 at91_set_gpio_output(data->pullup_pin, 0);
+                at91_set_multi_drive(data->pullup_pin, 1);
+        }
 
         udc_data = *data;
         platform_device_register(&at91rm9200_udc_device);
diff --git a/arch/arm/mach-at91rm9200/gpio.c b/arch/arm/mach-at91rm9200/gpio.c
index 2fd2ef583e4d..0e396feec468 100644
--- a/arch/arm/mach-at91rm9200/gpio.c
+++ b/arch/arm/mach-at91rm9200/gpio.c
@@ -159,6 +159,23 @@ int __init_or_module at91_set_deglitch(unsigned pin, int is_on)
 }
 EXPORT_SYMBOL(at91_set_deglitch);
 
+/*
+ * enable/disable the multi-driver; This is only valid for output and
+ * allows the output pin to run as an open collector output.
+ */
+int __init_or_module at91_set_multi_drive(unsigned pin, int is_on)
+{
+        void __iomem    *pio = pin_to_controller(pin);
+        unsigned        mask = pin_to_mask(pin);
+
+        if (!pio)
+                return -EINVAL;
+
+        __raw_writel(mask, pio + (is_on ? PIO_MDER : PIO_MDDR));
+        return 0;
+}
+EXPORT_SYMBOL(at91_set_multi_drive);
+
 /*--------------------------------------------------------------------------*/
 
 
@@ -257,8 +274,18 @@ static void gpio_irq_handler(unsigned irq, struct irqdesc *desc, struct pt_regs
                 gpio = &irq_desc[pin];
 
                 while (isr) {
-                        if (isr & 1)
-                                gpio->handle(pin, gpio, regs);
+                        if (isr & 1) {
+                                if (unlikely(gpio->disable_depth)) {
+                                        /*
+                                         * The core ARM interrupt handler lazily disables IRQs so
+                                         * another IRQ must be generated before it actually gets
+                                         * here to be disabled on the GPIO controller.
+                                         */
+                                        gpio_irq_mask(pin);
+                                }
+                                else
+                                        gpio->handle(pin, gpio, regs);
+                        }
                         pin++;
                         gpio++;
                         isr >>= 1;
diff --git a/arch/arm/mach-clps711x/Kconfig b/arch/arm/mach-clps711x/Kconfig
index 0793dcf54f2e..0e2b641268ad 100644
--- a/arch/arm/mach-clps711x/Kconfig
+++ b/arch/arm/mach-clps711x/Kconfig
@@ -24,6 +24,8 @@ config ARCH_CEIVA
 
 config ARCH_CLEP7312
         bool "CLEP7312"
+        help
+          Boards based on the Cirrus Logic 7212/7312 chips.
 
 config ARCH_EDB7211
         bool "EDB7211"
diff --git a/arch/arm/mach-imx/mx1ads.c b/arch/arm/mach-imx/mx1ads.c
index dc31e3fd6c57..8ab1b040288c 100644
--- a/arch/arm/mach-imx/mx1ads.c
+++ b/arch/arm/mach-imx/mx1ads.c
@@ -27,7 +27,6 @@
 #include <asm/mach/arch.h>
 #include <linux/interrupt.h>
 #include "generic.h"
-#include <asm/serial.h>
 
 static struct resource cs89x0_resources[] = {
         [0] = {
diff --git a/arch/arm/mach-integrator/platsmp.c b/arch/arm/mach-integrator/platsmp.c
index ea10bd8c972c..1bc8534ef0c6 100644
--- a/arch/arm/mach-integrator/platsmp.c
+++ b/arch/arm/mach-integrator/platsmp.c
@@ -140,6 +140,18 @@ static void __init poke_milo(void)
         mb();
 }
 
+/*
+ * Initialise the CPU possible map early - this describes the CPUs
+ * which may be present or become present in the system.
+ */
+void __init smp_init_cpus(void)
+{
+        unsigned int i, ncores = get_core_count();
+
+        for (i = 0; i < ncores; i++)
+                cpu_set(i, cpu_possible_map);
+}
+
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned int ncores = get_core_count();
@@ -176,14 +188,11 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
                 max_cpus = ncores;
 
         /*
-         * Initialise the possible/present maps.
-         * cpu_possible_map describes the set of CPUs which may be present
-         * cpu_present_map describes the set of CPUs populated
+         * Initialise the present map, which describes the set of CPUs
+         * actually populated at the present time.
          */
-        for (i = 0; i < max_cpus; i++) {
-                cpu_set(i, cpu_possible_map);
+        for (i = 0; i < max_cpus; i++)
                 cpu_set(i, cpu_present_map);
-        }
 
         /*
          * Do we need any more CPUs? If so, then let them know where
diff --git a/arch/arm/mach-iop3xx/iop321-setup.c b/arch/arm/mach-iop3xx/iop321-setup.c
index e4f4c52d93d4..0ebbcb20c6ae 100644
--- a/arch/arm/mach-iop3xx/iop321-setup.c
+++ b/arch/arm/mach-iop3xx/iop321-setup.c
@@ -13,7 +13,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/config.h>
-#include <linux/init.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
diff --git a/arch/arm/mach-iop3xx/iop331-setup.c b/arch/arm/mach-iop3xx/iop331-setup.c
index 63585485123e..2d6abe5be14d 100644
--- a/arch/arm/mach-iop3xx/iop331-setup.c
+++ b/arch/arm/mach-iop3xx/iop331-setup.c
@@ -12,7 +12,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/config.h>
-#include <linux/init.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
diff --git a/arch/arm/mach-ixp2000/enp2611.c b/arch/arm/mach-ixp2000/enp2611.c
index 9e5a13bb39d0..52fac89e95b5 100644
--- a/arch/arm/mach-ixp2000/enp2611.c
+++ b/arch/arm/mach-ixp2000/enp2611.c
@@ -106,6 +106,7 @@ static void __init enp2611_pci_preinit(void)
 {
         ixp2000_reg_write(IXP2000_PCI_ADDR_EXT, 0x00100000);
         ixp2000_pci_preinit();
+        pcibios_setup("firmware");
 }
 
 static inline int enp2611_pci_valid_device(struct pci_bus *bus,
diff --git a/arch/arm/mach-ixp2000/ixdp2400.c b/arch/arm/mach-ixp2000/ixdp2400.c
index 7c782403042a..09101271298e 100644
--- a/arch/arm/mach-ixp2000/ixdp2400.c
+++ b/arch/arm/mach-ixp2000/ixdp2400.c
@@ -68,6 +68,7 @@ void __init ixdp2400_pci_preinit(void)
 {
         ixp2000_reg_write(IXP2000_PCI_ADDR_EXT, 0x00100000);
         ixp2000_pci_preinit();
+        pcibios_setup("firmware");
 }
 
 int ixdp2400_pci_setup(int nr, struct pci_sys_data *sys)
diff --git a/arch/arm/mach-ixp2000/ixdp2x01.c b/arch/arm/mach-ixp2000/ixdp2x01.c
index 10f06606d460..150519fb38ec 100644
--- a/arch/arm/mach-ixp2000/ixdp2x01.c
+++ b/arch/arm/mach-ixp2000/ixdp2x01.c
@@ -212,6 +212,7 @@ void __init ixdp2x01_pci_preinit(void)
 {
         ixp2000_reg_write(IXP2000_PCI_ADDR_EXT, 0x00000000);
         ixp2000_pci_preinit();
+        pcibios_setup("firmware");
 }
 
 #define DEVPIN(dev, pin) ((pin) | ((dev) << 3))
@@ -299,7 +300,9 @@ struct hw_pci ixdp2x01_pci __initdata = {
 
 int __init ixdp2x01_pci_init(void)
 {
-        pci_common_init(&ixdp2x01_pci);
+        if (machine_is_ixdp2401() || machine_is_ixdp2801())
+                pci_common_init(&ixdp2x01_pci);
+
         return 0;
 }
 
diff --git a/arch/arm/mach-ixp4xx/Kconfig b/arch/arm/mach-ixp4xx/Kconfig
index daadc78e271b..5bf50a2a737d 100644
--- a/arch/arm/mach-ixp4xx/Kconfig
+++ b/arch/arm/mach-ixp4xx/Kconfig
@@ -8,11 +8,9 @@ menu "Intel IXP4xx Implementation Options"
 
 comment "IXP4xx Platforms"
 
-# This entry is placed on top because otherwise it would have
-# been shown as a submenu.
 config MACH_NSLU2
         bool
-        prompt "NSLU2" if !(MACH_IXDP465 || MACH_IXDPG425 || ARCH_IXDP425 || ARCH_ADI_COYOTE || ARCH_AVILA || ARCH_IXCDP1100 || ARCH_PRPMC1100 || MACH_GTWX5715)
+        prompt "Linksys NSLU2"
         help
           Say 'Y' here if you want your kernel to support Linksys's
           NSLU2 NAS device. For more information on this platform,
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 4bdc9d4526cd..fbadf3021b9e 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -111,24 +111,30 @@ static int ixp4xx_set_irq_type(unsigned int irq, unsigned int type)
         if (line < 0)
                 return -EINVAL;
 
-        if (type & IRQT_BOTHEDGE) {
+        switch (type){
+        case IRQT_BOTHEDGE:
                 int_style = IXP4XX_GPIO_STYLE_TRANSITIONAL;
                 irq_type = IXP4XX_IRQ_EDGE;
-        } else  if (type & IRQT_RISING) {
+                break;
+        case IRQT_RISING:
                 int_style = IXP4XX_GPIO_STYLE_RISING_EDGE;
                 irq_type = IXP4XX_IRQ_EDGE;
-        } else if (type & IRQT_FALLING) {
+                break;
+        case IRQT_FALLING:
                 int_style = IXP4XX_GPIO_STYLE_FALLING_EDGE;
                 irq_type = IXP4XX_IRQ_EDGE;
-        } else if (type & IRQT_HIGH) {
+                break;
+        case IRQT_HIGH:
                 int_style = IXP4XX_GPIO_STYLE_ACTIVE_HIGH;
                 irq_type = IXP4XX_IRQ_LEVEL;
-        } else if (type & IRQT_LOW) {
+                break;
+        case IRQT_LOW:
                 int_style = IXP4XX_GPIO_STYLE_ACTIVE_LOW;
                 irq_type = IXP4XX_IRQ_LEVEL;
-        } else
+                break;
+        default:
                 return -EINVAL;
-
+        }
         ixp4xx_config_irq(irq, irq_type);
 
         if (line >= 8) {        /* pins 8-15 */
diff --git a/arch/arm/mach-ixp4xx/nas100d-power.c b/arch/arm/mach-ixp4xx/nas100d-power.c
index 2bec69bfa715..99d333d7ebdd 100644
--- a/arch/arm/mach-ixp4xx/nas100d-power.c
+++ b/arch/arm/mach-ixp4xx/nas100d-power.c
@@ -56,6 +56,9 @@ static int __init nas100d_power_init(void)
 
 static void __exit nas100d_power_exit(void)
 {
+        if (!(machine_is_nas100d()))
+                return;
+
         free_irq(NAS100D_RB_IRQ, NULL);
 }
 
diff --git a/arch/arm/mach-ixp4xx/nas100d-setup.c b/arch/arm/mach-ixp4xx/nas100d-setup.c
index 856d56f3b2ae..a3b4c6ac5708 100644
--- a/arch/arm/mach-ixp4xx/nas100d-setup.c
+++ b/arch/arm/mach-ixp4xx/nas100d-setup.c
@@ -113,6 +113,9 @@ static void __init nas100d_init(void)
 {
         ixp4xx_sys_init();
 
+        /* gpio 14 and 15 are _not_ clocks */
+        *IXP4XX_GPIO_GPCLKR = 0;
+
         nas100d_flash_resource.start = IXP4XX_EXP_BUS_BASE(0);
         nas100d_flash_resource.end =
                 IXP4XX_EXP_BUS_BASE(0) + ixp4xx_exp_bus_size - 1;
diff --git a/arch/arm/mach-ixp4xx/nslu2-power.c b/arch/arm/mach-ixp4xx/nslu2-power.c
index b0ad9e901f6e..d80c362bc539 100644
--- a/arch/arm/mach-ixp4xx/nslu2-power.c
+++ b/arch/arm/mach-ixp4xx/nslu2-power.c
@@ -77,6 +77,9 @@ static int __init nslu2_power_init(void)
 
 static void __exit nslu2_power_exit(void)
 {
+        if (!(machine_is_nslu2()))
+                return;
+
         free_irq(NSLU2_RB_IRQ, NULL);
         free_irq(NSLU2_PB_IRQ, NULL);
 }
diff --git a/arch/arm/mach-ixp4xx/nslu2-setup.c b/arch/arm/mach-ixp4xx/nslu2-setup.c
index da9340a53434..55411f21d838 100644
--- a/arch/arm/mach-ixp4xx/nslu2-setup.c
+++ b/arch/arm/mach-ixp4xx/nslu2-setup.c
@@ -27,8 +27,6 @@ static struct flash_platform_data nslu2_flash_data = {
 };
 
 static struct resource nslu2_flash_resource = {
-        .start                  = NSLU2_FLASH_BASE,
-        .end                    = NSLU2_FLASH_BASE + NSLU2_FLASH_SIZE,
         .flags                  = IORESOURCE_MEM,
 };
 
@@ -52,6 +50,12 @@ static struct platform_device nslu2_i2c_controller = {
         .num_resources          = 0,
 };
 
+static struct platform_device nslu2_beeper = {
+        .name                   = "ixp4xx-beeper",
+        .id                     = NSLU2_GPIO_BUZZ,
+        .num_resources          = 0,
+};
+
 static struct resource nslu2_uart_resources[] = {
         {
                 .start          = IXP4XX_UART1_BASE_PHYS,
@@ -99,6 +103,7 @@ static struct platform_device *nslu2_devices[] __initdata = {
         &nslu2_i2c_controller,
         &nslu2_flash,
         &nslu2_uart,
+        &nslu2_beeper,
 };
 
 static void nslu2_power_off(void)
@@ -116,6 +121,10 @@ static void __init nslu2_init(void)
 {
         ixp4xx_sys_init();
 
+        nslu2_flash_resource.start = IXP4XX_EXP_BUS_BASE(0);
+        nslu2_flash_resource.end =
+                IXP4XX_EXP_BUS_BASE(0) + ixp4xx_exp_bus_size - 1;
+
         pm_power_off = nslu2_power_off;
 
         platform_add_devices(nslu2_devices, ARRAY_SIZE(nslu2_devices));
diff --git a/arch/arm/mach-omap1/board-generic.c b/arch/arm/mach-omap1/board-generic.c
index bdc20b51b076..a177e78b2b87 100644
--- a/arch/arm/mach-omap1/board-generic.c
+++ b/arch/arm/mach-omap1/board-generic.c
@@ -30,6 +30,7 @@
 
 static void __init omap_generic_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
 }
 
@@ -104,7 +105,7 @@ static void __init omap_generic_init(void)
 
 static void __init omap_generic_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 MACHINE_START(OMAP_GENERIC, "Generic OMAP1510/1610/1710")
diff --git a/arch/arm/mach-omap1/board-h2.c b/arch/arm/mach-omap1/board-h2.c
index 9533c36a92df..89f0cc74a519 100644
--- a/arch/arm/mach-omap1/board-h2.c
+++ b/arch/arm/mach-omap1/board-h2.c
@@ -128,6 +128,7 @@ static void __init h2_init_smc91x(void)
 
 static void __init h2_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
         h2_init_smc91x();
@@ -194,7 +195,7 @@ static void __init h2_init(void)
 
 static void __init h2_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 MACHINE_START(OMAP_H2, "TI-H2")
diff --git a/arch/arm/mach-omap1/board-h3.c b/arch/arm/mach-omap1/board-h3.c
index d665efc1c344..d9f386265996 100644
--- a/arch/arm/mach-omap1/board-h3.c
+++ b/arch/arm/mach-omap1/board-h3.c
@@ -203,6 +203,7 @@ static void __init h3_init_smc91x(void)
 
 void h3_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
         h3_init_smc91x();
@@ -210,7 +211,7 @@ void h3_init_irq(void)
 
 static void __init h3_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 MACHINE_START(OMAP_H3, "TI OMAP1710 H3 board")
diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c
index 652f37c7f906..a04e4332915e 100644
--- a/arch/arm/mach-omap1/board-innovator.c
+++ b/arch/arm/mach-omap1/board-innovator.c
@@ -181,6 +181,7 @@ static void __init innovator_init_smc91x(void)
 
 void innovator_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
 #ifdef CONFIG_ARCH_OMAP15XX
@@ -285,7 +286,7 @@ static void __init innovator_init(void)
 
 static void __init innovator_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 
 #ifdef CONFIG_ARCH_OMAP15XX
         if (cpu_is_omap1510()) {
diff --git a/arch/arm/mach-omap1/board-netstar.c b/arch/arm/mach-omap1/board-netstar.c
index 58f783930d45..60d5f8a3339c 100644
--- a/arch/arm/mach-omap1/board-netstar.c
+++ b/arch/arm/mach-omap1/board-netstar.c
@@ -65,6 +65,7 @@ static struct omap_board_config_kernel netstar_config[] = {
 
 static void __init netstar_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
 }
@@ -108,7 +109,7 @@ static void __init netstar_init(void)
 
 static void __init netstar_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 #define MACHINE_PANICED         1
diff --git a/arch/arm/mach-omap1/board-osk.c b/arch/arm/mach-omap1/board-osk.c
index e5d126e8f276..543fa136106d 100644
--- a/arch/arm/mach-omap1/board-osk.c
+++ b/arch/arm/mach-omap1/board-osk.c
@@ -169,6 +169,7 @@ static void __init osk_init_cf(void)
 
 static void __init osk_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
         osk_init_smc91x();
@@ -269,7 +270,7 @@ static void __init osk_init(void)
 
 static void __init osk_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 MACHINE_START(OMAP_OSK, "TI-OSK")
diff --git a/arch/arm/mach-omap1/board-palmte.c b/arch/arm/mach-omap1/board-palmte.c
index 67fada207622..e488f7236775 100644
--- a/arch/arm/mach-omap1/board-palmte.c
+++ b/arch/arm/mach-omap1/board-palmte.c
@@ -34,6 +34,7 @@
 
 static void __init omap_generic_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
 }
 
@@ -72,7 +73,7 @@ static void __init omap_generic_init(void)
 
 static void __init omap_generic_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 MACHINE_START(OMAP_PALMTE, "OMAP310 based Palm Tungsten E")
diff --git a/arch/arm/mach-omap1/board-perseus2.c b/arch/arm/mach-omap1/board-perseus2.c
index 88708a0c52a2..3913a3cc0ce6 100644
--- a/arch/arm/mach-omap1/board-perseus2.c
+++ b/arch/arm/mach-omap1/board-perseus2.c
@@ -144,6 +144,7 @@ static void __init perseus2_init_smc91x(void)
 
 void omap_perseus2_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
         perseus2_init_smc91x();
@@ -160,7 +161,7 @@ static struct map_desc omap_perseus2_io_desc[] __initdata = {
 
 static void __init omap_perseus2_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
         iotable_init(omap_perseus2_io_desc,
                      ARRAY_SIZE(omap_perseus2_io_desc));
 
diff --git a/arch/arm/mach-omap1/board-voiceblue.c b/arch/arm/mach-omap1/board-voiceblue.c
index 959b4b847c87..bfd5fdd1a875 100644
--- a/arch/arm/mach-omap1/board-voiceblue.c
+++ b/arch/arm/mach-omap1/board-voiceblue.c
@@ -162,6 +162,7 @@ static struct omap_board_config_kernel voiceblue_config[] = {
 
 static void __init voiceblue_init_irq(void)
 {
+        omap1_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
 }
@@ -206,7 +207,7 @@ static void __init voiceblue_init(void)
 
 static void __init voiceblue_map_io(void)
 {
-        omap_map_common_io();
+        omap1_map_common_io();
 }
 
 #define MACHINE_PANICED         1
diff --git a/arch/arm/mach-omap1/io.c b/arch/arm/mach-omap1/io.c
index a7a19f75b9e1..82d556be79c5 100644
--- a/arch/arm/mach-omap1/io.c
+++ b/arch/arm/mach-omap1/io.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 
+#include <asm/tlb.h>
 #include <asm/mach/map.h>
 #include <asm/io.h>
 #include <asm/arch/mux.h>
@@ -83,15 +84,24 @@ static struct map_desc omap16xx_io_desc[] __initdata = {
 };
 #endif
 
-static int initialized = 0;
-
-static void __init _omap_map_io(void)
+/*
+ * Maps common IO regions for omap1. This should only get called from
+ * board specific init.
+ */
+void __init omap1_map_common_io(void)
 {
-        initialized = 1;
-
-        /* We have to initialize the IO space mapping before we can run
-         * cpu_is_omapxxx() macros. */
         iotable_init(omap_io_desc, ARRAY_SIZE(omap_io_desc));
+
+        /* Normally devicemaps_init() would flush caches and tlb after
+         * mdesc->map_io(), but we must also do it here because of the CPU
+         * revision check below.
+         */
+        local_flush_tlb_all();
+        flush_cache_all();
+
+        /* We want to check CPU revision early for cpu_is_omapxxxx() macros.
+         * IO space mapping must be initialized before we can do that.
+         */
         omap_check_revision();
 
 #ifdef CONFIG_ARCH_OMAP730
@@ -111,7 +121,14 @@ static void __init _omap_map_io(void)
 #endif
 
         omap_sram_init();
+}
 
+/*
+ * Common low-level hardware init for omap1. This should only get called from
+ * board specific init.
+ */
+void __init omap1_init_common_hw()
+{
         /* REVISIT: Refer to OMAP5910 Errata, Advisory SYS_1: "Timeout Abort
          * on a Posted Write in the TIPB Bridge".
          */
@@ -121,16 +138,7 @@ static void __init _omap_map_io(void)
         /* Must init clocks early to assure that timer interrupt works
          */
         omap1_clk_init();
-}
 
-/*
- * This should only get called from board specific init
- */
-void __init omap_map_common_io(void)
-{
-        if (!initialized) {
-                _omap_map_io();
-                omap1_mux_init();
-        }
+        omap1_mux_init();
 }
 
diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c
index b937123e5c65..eaecbf422d8c 100644
--- a/arch/arm/mach-omap2/board-generic.c
+++ b/arch/arm/mach-omap2/board-generic.c
@@ -33,6 +33,7 @@
 
 static void __init omap_generic_init_irq(void)
 {
+        omap2_init_common_hw();
         omap_init_irq();
 }
 
@@ -64,7 +65,7 @@ static void __init omap_generic_init(void)
 
 static void __init omap_generic_map_io(void)
 {
-        omap_map_common_io();
+        omap2_map_common_io();
 }
 
 MACHINE_START(OMAP_GENERIC, "Generic OMAP24xx")
diff --git a/arch/arm/mach-omap2/board-h4.c b/arch/arm/mach-omap2/board-h4.c
index c3c35d40378a..a300d634d8a5 100644
--- a/arch/arm/mach-omap2/board-h4.c
+++ b/arch/arm/mach-omap2/board-h4.c
@@ -136,6 +136,7 @@ static inline void __init h4_init_smc91x(void)
 
 static void __init omap_h4_init_irq(void)
 {
+        omap2_init_common_hw();
         omap_init_irq();
         omap_gpio_init();
         h4_init_smc91x();
@@ -181,7 +182,7 @@ static void __init omap_h4_init(void)
 
 static void __init omap_h4_map_io(void)
 {
-        omap_map_common_io();
+        omap2_map_common_io();
 }
 
 MACHINE_START(OMAP_H4, "OMAP2420 H4 board")
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index b41b1efaa2cf..3baa70819f24 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -44,7 +44,7 @@ unsigned int get_clk_frequency_khz( int info)
 
         /* Read clkcfg register: it has turbo, b, half-turbo (and f) */
         asm( "mrc\tp14, 0, %0, c6, c0, 0" : "=r" (clkcfg) );
-        t  = clkcfg & (1 << 1);
+        t  = clkcfg & (1 << 0);
         ht = clkcfg & (1 << 2);
         b  = clkcfg & (1 << 3);
 
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index 4a222f59f2cf..4303d988c4bf 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -182,7 +182,7 @@ static const struct icst307_params realview_oscvco_params = {
 static void realview_oscvco_set(struct clk *clk, struct icst307_vco vco)
 {
         void __iomem *sys_lock = __io_address(REALVIEW_SYS_BASE) + REALVIEW_SYS_LOCK_OFFSET;
-        void __iomem *sys_osc = __io_address(REALVIEW_SYS_BASE) + REALVIEW_SYS_OSC1_OFFSET;
+        void __iomem *sys_osc = __io_address(REALVIEW_SYS_BASE) + REALVIEW_SYS_OSC4_OFFSET;
         u32 val;
 
         val = readl(sys_osc) & ~0x7ffff;
diff --git a/arch/arm/mach-realview/platsmp.c b/arch/arm/mach-realview/platsmp.c
index a8fbd76d8be5..b8484e15dacb 100644
--- a/arch/arm/mach-realview/platsmp.c
+++ b/arch/arm/mach-realview/platsmp.c
@@ -143,6 +143,18 @@ static void __init poke_milo(void)
         mb();
 }
 
+/*
+ * Initialise the CPU possible map early - this describes the CPUs
+ * which may be present or become present in the system.
+ */
+void __init smp_init_cpus(void)
+{
+        unsigned int i, ncores = get_core_count();
+
+        for (i = 0; i < ncores; i++)
+                cpu_set(i, cpu_possible_map);
+}
+
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned int ncores = get_core_count();
@@ -179,14 +191,11 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         local_timer_setup(cpu);
 
         /*
-         * Initialise the possible/present maps.
-         * cpu_possible_map describes the set of CPUs which may be present
-         * cpu_present_map describes the set of CPUs populated
+         * Initialise the present map, which describes the set of CPUs
+         * actually populated at the present time.
          */
-        for (i = 0; i < max_cpus; i++) {
-                cpu_set(i, cpu_possible_map);
+        for (i = 0; i < max_cpus; i++)
                 cpu_set(i, cpu_present_map);
-        }
 
         /*
          * Do we need any more CPUs? If so, then let them know where
diff --git a/arch/arm/mach-s3c2410/Makefile b/arch/arm/mach-s3c2410/Makefile
index b4f1e051c768..1217bf00309c 100644
--- a/arch/arm/mach-s3c2410/Makefile
+++ b/arch/arm/mach-s3c2410/Makefile
@@ -10,9 +10,13 @@ obj-m			:=
 obj-n                   :=
 obj-                    :=
 
+# S3C2400 support files
+obj-$(CONFIG_CPU_S3C2400)  += s3c2400-gpio.o
+
 # S3C2410 support files
 
 obj-$(CONFIG_CPU_S3C2410)  += s3c2410.o
+obj-$(CONFIG_CPU_S3C2410)  += s3c2410-gpio.o
 obj-$(CONFIG_S3C2410_DMA)  += dma.o
 
 # Power Management support
@@ -25,6 +29,7 @@ obj-$(CONFIG_PM_SIMTEC)	   += pm-simtec.o
 obj-$(CONFIG_CPU_S3C2440)  += s3c2440.o s3c2440-dsc.o
 obj-$(CONFIG_CPU_S3C2440)  += s3c2440-irq.o
 obj-$(CONFIG_CPU_S3C2440)  += s3c2440-clock.o
+obj-$(CONFIG_CPU_S3C2440)  += s3c2410-gpio.o
 
 # bast extras
 
diff --git a/arch/arm/mach-s3c2410/clock.c b/arch/arm/mach-s3c2410/clock.c
index af2f3d52b61b..08489efdaf06 100644
--- a/arch/arm/mach-s3c2410/clock.c
+++ b/arch/arm/mach-s3c2410/clock.c
@@ -40,7 +40,6 @@
 #include <linux/mutex.h>
 
 #include <asm/hardware.h>
-#include <asm/atomic.h>
 #include <asm/irq.h>
 #include <asm/io.h>
 
@@ -59,22 +58,18 @@ static DEFINE_MUTEX(clocks_mutex);
 void inline s3c24xx_clk_enable(unsigned int clocks, unsigned int enable)
 {
         unsigned long clkcon;
-        unsigned long flags;
-
-        local_irq_save(flags);
 
         clkcon = __raw_readl(S3C2410_CLKCON);
-        clkcon &= ~clocks;
 
         if (enable)
                 clkcon |= clocks;
+        else
+                clkcon &= ~clocks;
 
         /* ensure none of the special function bits set */
         clkcon &= ~(S3C2410_CLKCON_IDLE|S3C2410_CLKCON_POWER);
 
         __raw_writel(clkcon, S3C2410_CLKCON);
-
-        local_irq_restore(flags);
 }
 
 /* enable and disable calls for use with the clk struct */
@@ -138,16 +133,32 @@ void clk_put(struct clk *clk)
 
 int clk_enable(struct clk *clk)
 {
-        if (IS_ERR(clk))
+        if (IS_ERR(clk) || clk == NULL)
                 return -EINVAL;
 
-        return (clk->enable)(clk, 1);
+        clk_enable(clk->parent);
+
+        mutex_lock(&clocks_mutex);
+
+        if ((clk->usage++) == 0)
+                (clk->enable)(clk, 1);
+
+        mutex_unlock(&clocks_mutex);
+        return 0;
 }
 
 void clk_disable(struct clk *clk)
 {
-        if (!IS_ERR(clk))
+        if (IS_ERR(clk) || clk == NULL)
+                return;
+
+        mutex_lock(&clocks_mutex);
+
+        if ((--clk->usage) == 0)
                 (clk->enable)(clk, 0);
+
+        mutex_unlock(&clocks_mutex);
+        clk_disable(clk->parent);
 }
 
 
@@ -361,6 +372,14 @@ int s3c24xx_register_clock(struct clk *clk)
         if (clk->enable == NULL)
                 clk->enable = clk_null_enable;
 
+        /* if this is a standard clock, set the usage state */
+
+        if (clk->ctrlbit) {
+                unsigned long clkcon = __raw_readl(S3C2410_CLKCON);
+
+                clk->usage = (clkcon & clk->ctrlbit) ? 1 : 0;
+        }
+
         /* add to the list of available clocks */
 
         mutex_lock(&clocks_mutex);
@@ -402,6 +421,8 @@ int __init s3c24xx_setup_clocks(unsigned long xtal,
          * the LCD clock if it is not needed.
         */
 
+        mutex_lock(&clocks_mutex);
+
         s3c24xx_clk_enable(S3C2410_CLKCON_NAND, 0);
         s3c24xx_clk_enable(S3C2410_CLKCON_USBH, 0);
         s3c24xx_clk_enable(S3C2410_CLKCON_USBD, 0);
@@ -409,6 +430,8 @@ int __init s3c24xx_setup_clocks(unsigned long xtal,
         s3c24xx_clk_enable(S3C2410_CLKCON_IIC, 0);
         s3c24xx_clk_enable(S3C2410_CLKCON_SPI, 0);
 
+        mutex_unlock(&clocks_mutex);
+
         /* assume uart clocks are correctly setup */
 
         /* register our clocks */
diff --git a/arch/arm/mach-s3c2410/clock.h b/arch/arm/mach-s3c2410/clock.h
index 177d5c8decf7..eb5c95d1e7f2 100644
--- a/arch/arm/mach-s3c2410/clock.h
+++ b/arch/arm/mach-s3c2410/clock.h
@@ -16,6 +16,7 @@ struct clk {
         struct clk           *parent;
         const char           *name;
         int                   id;
+        int                   usage;
         unsigned long         rate;
         unsigned long         ctrlbit;
         int                 (*enable)(struct clk *, int enable);
diff --git a/arch/arm/mach-s3c2410/cpu.c b/arch/arm/mach-s3c2410/cpu.c
index 687fe371369d..00a379334b60 100644
--- a/arch/arm/mach-s3c2410/cpu.c
+++ b/arch/arm/mach-s3c2410/cpu.c
@@ -40,6 +40,7 @@
 
 #include "cpu.h"
 #include "clock.h"
+#include "s3c2400.h"
 #include "s3c2410.h"
 #include "s3c2440.h"
 
@@ -55,6 +56,7 @@ struct cpu_table {
 
 /* table of supported CPUs */
 
+static const char name_s3c2400[]  = "S3C2400";
 static const char name_s3c2410[]  = "S3C2410";
 static const char name_s3c2440[]  = "S3C2440";
 static const char name_s3c2410a[] = "S3C2410A";
@@ -96,7 +98,16 @@ static struct cpu_table cpu_ids[] __initdata = {
                 .init_uarts     = s3c2440_init_uarts,
                 .init           = s3c2440_init,
                 .name           = name_s3c2440a
-        }
+        },
+        {
+                .idcode         = 0x0,   /* S3C2400 doesn't have an idcode */
+                .idmask         = 0xffffffff,
+                .map_io         = s3c2400_map_io,
+                .init_clocks    = s3c2400_init_clocks,
+                .init_uarts     = s3c2400_init_uarts,
+                .init           = s3c2400_init,
+                .name           = name_s3c2400
+        },
 };
 
 /* minimal IO mapping */
@@ -148,12 +159,15 @@ static struct cpu_table *cpu;
 
 void __init s3c24xx_init_io(struct map_desc *mach_desc, int size)
 {
-        unsigned long idcode;
+        unsigned long idcode = 0x0;
 
         /* initialise the io descriptors we need for initialisation */
         iotable_init(s3c_iodesc, ARRAY_SIZE(s3c_iodesc));
 
+#ifndef CONFIG_CPU_S3C2400
         idcode = __raw_readl(S3C2410_GSTATUS1);
+#endif
+
         cpu = s3c_lookup_cpu(idcode);
 
         if (cpu == NULL) {
diff --git a/arch/arm/mach-s3c2410/devs.c b/arch/arm/mach-s3c2410/devs.c
index b8d994a24d1c..ca09ba516e4c 100644
--- a/arch/arm/mach-s3c2410/devs.c
+++ b/arch/arm/mach-s3c2410/devs.c
@@ -275,6 +275,11 @@ static struct resource s3c_adc_resource[] = {
         },
         [1] = {
                 .start = IRQ_TC,
+                .end   = IRQ_TC,
+                .flags = IORESOURCE_IRQ,
+        },
+        [2] = {
+                .start = IRQ_ADC,
                 .end   = IRQ_ADC,
                 .flags = IORESOURCE_IRQ,
         }
@@ -329,11 +334,17 @@ static struct resource s3c_spi0_resource[] = {
 
 };
 
+static u64 s3c_device_spi0_dmamask = 0xffffffffUL;
+
 struct platform_device s3c_device_spi0 = {
         .name             = "s3c2410-spi",
         .id               = 0,
         .num_resources    = ARRAY_SIZE(s3c_spi0_resource),
         .resource         = s3c_spi0_resource,
+        .dev              = {
+                .dma_mask = &s3c_device_spi0_dmamask,
+                .coherent_dma_mask = 0xffffffffUL
+        }
 };
 
 EXPORT_SYMBOL(s3c_device_spi0);
@@ -354,11 +365,17 @@ static struct resource s3c_spi1_resource[] = {
 
 };
 
+static u64 s3c_device_spi1_dmamask = 0xffffffffUL;
+
 struct platform_device s3c_device_spi1 = {
         .name             = "s3c2410-spi",
         .id               = 1,
         .num_resources    = ARRAY_SIZE(s3c_spi1_resource),
         .resource         = s3c_spi1_resource,
+        .dev              = {
+                .dma_mask = &s3c_device_spi1_dmamask,
+                .coherent_dma_mask = 0xffffffffUL
+        }
 };
 
 EXPORT_SYMBOL(s3c_device_spi1);
diff --git a/arch/arm/mach-s3c2410/gpio.c b/arch/arm/mach-s3c2410/gpio.c
index 23ea3d5fa09c..cd39e8684584 100644
--- a/arch/arm/mach-s3c2410/gpio.c
+++ b/arch/arm/mach-s3c2410/gpio.c
@@ -31,6 +31,7 @@
  *      05-Nov-2004  BJD  EXPORT_SYMBOL() added for all code
  *      13-Mar-2005  BJD  Updates for __iomem
  *      26-Oct-2005  BJD  Added generic configuration types
+ *      15-Jan-2006  LCVR Added support for the S3C2400
  */
 
 
@@ -48,7 +49,7 @@
 
 void s3c2410_gpio_cfgpin(unsigned int pin, unsigned int function)
 {
-        void __iomem *base = S3C2410_GPIO_BASE(pin);
+        void __iomem *base = S3C24XX_GPIO_BASE(pin);
         unsigned long mask;
         unsigned long con;
         unsigned long flags;
@@ -95,7 +96,7 @@ EXPORT_SYMBOL(s3c2410_gpio_cfgpin);
 
 unsigned int s3c2410_gpio_getcfg(unsigned int pin)
 {
-        void __iomem *base = S3C2410_GPIO_BASE(pin);
+        void __iomem *base = S3C24XX_GPIO_BASE(pin);
         unsigned long mask;
 
         if (pin < S3C2410_GPIO_BANKB) {
@@ -111,7 +112,7 @@ EXPORT_SYMBOL(s3c2410_gpio_getcfg);
 
 void s3c2410_gpio_pullup(unsigned int pin, unsigned int to)
 {
-        void __iomem *base = S3C2410_GPIO_BASE(pin);
+        void __iomem *base = S3C24XX_GPIO_BASE(pin);
         unsigned long offs = S3C2410_GPIO_OFFSET(pin);
         unsigned long flags;
         unsigned long up;
@@ -133,7 +134,7 @@ EXPORT_SYMBOL(s3c2410_gpio_pullup);
 
 void s3c2410_gpio_setpin(unsigned int pin, unsigned int to)
 {
-        void __iomem *base = S3C2410_GPIO_BASE(pin);
+        void __iomem *base = S3C24XX_GPIO_BASE(pin);
         unsigned long offs = S3C2410_GPIO_OFFSET(pin);
         unsigned long flags;
         unsigned long dat;
@@ -152,7 +153,7 @@ EXPORT_SYMBOL(s3c2410_gpio_setpin);
 
 unsigned int s3c2410_gpio_getpin(unsigned int pin)
 {
-        void __iomem *base = S3C2410_GPIO_BASE(pin);
+        void __iomem *base = S3C24XX_GPIO_BASE(pin);
         unsigned long offs = S3C2410_GPIO_OFFSET(pin);
 
         return __raw_readl(base + 0x04) & (1<< offs);
@@ -166,70 +167,13 @@ unsigned int s3c2410_modify_misccr(unsigned int clear, unsigned int change)
         unsigned long misccr;
 
         local_irq_save(flags);
-        misccr = __raw_readl(S3C2410_MISCCR);
+        misccr = __raw_readl(S3C24XX_MISCCR);
         misccr &= ~clear;
         misccr ^= change;
-        __raw_writel(misccr, S3C2410_MISCCR);
+        __raw_writel(misccr, S3C24XX_MISCCR);
         local_irq_restore(flags);
 
         return misccr;
 }
 
 EXPORT_SYMBOL(s3c2410_modify_misccr);
-
-int s3c2410_gpio_getirq(unsigned int pin)
-{
-        if (pin < S3C2410_GPF0 || pin > S3C2410_GPG15_EINT23)
-                return -1;      /* not valid interrupts */
-
-        if (pin < S3C2410_GPG0 && pin > S3C2410_GPF7)
-                return -1;      /* not valid pin */
-
-        if (pin < S3C2410_GPF4)
-                return (pin - S3C2410_GPF0) + IRQ_EINT0;
-
-        if (pin < S3C2410_GPG0)
-                return (pin - S3C2410_GPF4) + IRQ_EINT4;
-
-        return (pin - S3C2410_GPG0) + IRQ_EINT8;
-}
-
-EXPORT_SYMBOL(s3c2410_gpio_getirq);
-
-int s3c2410_gpio_irqfilter(unsigned int pin, unsigned int on,
-                           unsigned int config)
-{
-        void __iomem *reg = S3C2410_EINFLT0;
-        unsigned long flags;
-        unsigned long val;
-
-        if (pin < S3C2410_GPG8 || pin > S3C2410_GPG15)
-                return -1;
-
-        config &= 0xff;
-
-        pin -= S3C2410_GPG8_EINT16;
-        reg += pin & ~3;
-
-        local_irq_save(flags);
-
-        /* update filter width and clock source */
-
-        val = __raw_readl(reg);
-        val &= ~(0xff << ((pin & 3) * 8));
-        val |= config << ((pin & 3) * 8);
-        __raw_writel(val, reg);
-
-        /* update filter enable */
-
-        val = __raw_readl(S3C2410_EXTINT2);
-        val &= ~(1 << ((pin * 4) + 3));
-        val |= on << ((pin * 4) + 3);
-        __raw_writel(val, S3C2410_EXTINT2);
-
-        local_irq_restore(flags);
-
-        return 0;
-}
-
-EXPORT_SYMBOL(s3c2410_gpio_irqfilter);
diff --git a/arch/arm/mach-s3c2410/mach-h1940.c b/arch/arm/mach-s3c2410/mach-h1940.c
index 1c316f14ed94..646a3a5d33a5 100644
--- a/arch/arm/mach-s3c2410/mach-h1940.c
+++ b/arch/arm/mach-s3c2410/mach-h1940.c
@@ -46,10 +46,11 @@
 #include <asm/irq.h>
 #include <asm/mach-types.h>
 
-//#include <asm/debug-ll.h>
+
 #include <asm/arch/regs-serial.h>
 #include <asm/arch/regs-lcd.h>
 
+#include <asm/arch/h1940-latch.h>
 #include <asm/arch/fb.h>
 
 #include <linux/serial_core.h>
@@ -59,7 +60,12 @@
 #include "cpu.h"
 
 static struct map_desc h1940_iodesc[] __initdata = {
-        /* nothing here yet */
+        [0] = {
+                .virtual        = (unsigned long)H1940_LATCH,
+                .pfn            = __phys_to_pfn(H1940_PA_LATCH),
+                .length         = SZ_16K,
+                .type           = MT_DEVICE
+        },
 };
 
 #define UCON S3C2410_UCON_DEFAULT | S3C2410_UCON_UCLK
@@ -92,6 +98,25 @@ static struct s3c2410_uartcfg h1940_uartcfgs[] = {
         }
 };
 
+/* Board control latch control */
+
+static unsigned int latch_state = H1940_LATCH_DEFAULT;
+
+void h1940_latch_control(unsigned int clear, unsigned int set)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        latch_state &= ~clear;
+        latch_state |= set;
+
+        __raw_writel(latch_state, H1940_LATCH);
+
+        local_irq_restore(flags);
+}
+
+EXPORT_SYMBOL_GPL(h1940_latch_control);
 
 
 /**
diff --git a/arch/arm/mach-s3c2410/s3c2400-gpio.c b/arch/arm/mach-s3c2410/s3c2400-gpio.c
new file mode 100644
index 000000000000..5127f39fa9bf
--- /dev/null
+++ b/arch/arm/mach-s3c2410/s3c2400-gpio.c
@@ -0,0 +1,45 @@
+/* linux/arch/arm/mach-s3c2410/gpio.c
+ *
+ * Copyright (c) 2006 Lucas Correia Villa Real <lucasvr@gobolinux.org>
+ *
+ * S3C2400 GPIO support
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Changelog
+ *      15-Jan-2006  LCVR  Splitted from gpio.c, adding support for the S3C2400
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+
+#include <asm/hardware.h>
+#include <asm/irq.h>
+#include <asm/io.h>
+
+#include <asm/arch/regs-gpio.h>
+
+int s3c2400_gpio_getirq(unsigned int pin)
+{
+        if (pin < S3C2410_GPE0 || pin > S3C2400_GPE7_EINT7)
+                return -1;  /* not valid interrupts */
+
+        return (pin - S3C2410_GPE0) + IRQ_EINT0;
+}
+
+EXPORT_SYMBOL(s3c2400_gpio_getirq);
diff --git a/arch/arm/mach-s3c2410/s3c2400.h b/arch/arm/mach-s3c2410/s3c2400.h
new file mode 100644
index 000000000000..8b2394e1ed40
--- /dev/null
+++ b/arch/arm/mach-s3c2410/s3c2400.h
@@ -0,0 +1,31 @@
+/* arch/arm/mach-s3c2410/s3c2400.h
+ *
+ * Copyright (c) 2004 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * Header file for S3C2400 cpu support
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Modifications:
+ *     09-Fev-2006 LCVR  First version, based on s3c2410.h
+*/
+
+#ifdef CONFIG_CPU_S3C2400
+
+extern  int s3c2400_init(void);
+
+extern void s3c2400_map_io(struct map_desc *mach_desc, int size);
+
+extern void s3c2400_init_uarts(struct s3c2410_uartcfg *cfg, int no);
+
+extern void s3c2400_init_clocks(int xtal);
+
+#else
+#define s3c2400_init_clocks NULL
+#define s3c2400_init_uarts NULL
+#define s3c2400_map_io NULL
+#define s3c2400_init NULL
+#endif
diff --git a/arch/arm/mach-s3c2410/s3c2410-gpio.c b/arch/arm/mach-s3c2410/s3c2410-gpio.c
new file mode 100644
index 000000000000..d5e1caea1d23
--- /dev/null
+++ b/arch/arm/mach-s3c2410/s3c2410-gpio.c
@@ -0,0 +1,93 @@
+/* linux/arch/arm/mach-s3c2410/gpio.c
+ *
+ * Copyright (c) 2004-2006 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * S3C2410 GPIO support
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Changelog
+ *      15-Jan-2006  LCVR  Splitted from gpio.c
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/ioport.h>
+
+#include <asm/hardware.h>
+#include <asm/irq.h>
+#include <asm/io.h>
+
+#include <asm/arch/regs-gpio.h>
+
+int s3c2410_gpio_irqfilter(unsigned int pin, unsigned int on,
+                           unsigned int config)
+{
+        void __iomem *reg = S3C2410_EINFLT0;
+        unsigned long flags;
+        unsigned long val;
+
+        if (pin < S3C2410_GPG8 || pin > S3C2410_GPG15)
+                return -1;
+
+        config &= 0xff;
+
+        pin -= S3C2410_GPG8_EINT16;
+        reg += pin & ~3;
+
+        local_irq_save(flags);
+
+        /* update filter width and clock source */
+
+        val = __raw_readl(reg);
+        val &= ~(0xff << ((pin & 3) * 8));
+        val |= config << ((pin & 3) * 8);
+        __raw_writel(val, reg);
+
+        /* update filter enable */
+
+        val = __raw_readl(S3C2410_EXTINT2);
+        val &= ~(1 << ((pin * 4) + 3));
+        val |= on << ((pin * 4) + 3);
+        __raw_writel(val, S3C2410_EXTINT2);
+
+        local_irq_restore(flags);
+
+        return 0;
+}
+
+EXPORT_SYMBOL(s3c2410_gpio_irqfilter);
+
+int s3c2410_gpio_getirq(unsigned int pin)
+{
+        if (pin < S3C2410_GPF0 || pin > S3C2410_GPG15_EINT23)
+                return -1;      /* not valid interrupts */
+
+        if (pin < S3C2410_GPG0 && pin > S3C2410_GPF7)
+                return -1;      /* not valid pin */
+
+        if (pin < S3C2410_GPF4)
+                return (pin - S3C2410_GPF0) + IRQ_EINT0;
+
+        if (pin < S3C2410_GPG0)
+                return (pin - S3C2410_GPF4) + IRQ_EINT4;
+
+        return (pin - S3C2410_GPG0) + IRQ_EINT8;
+}
+
+EXPORT_SYMBOL(s3c2410_gpio_getirq);
diff --git a/arch/arm/mach-s3c2410/sleep.S b/arch/arm/mach-s3c2410/sleep.S
index e9a055b779b7..832fb86a03b4 100644
--- a/arch/arm/mach-s3c2410/sleep.S
+++ b/arch/arm/mach-s3c2410/sleep.S
@@ -72,7 +72,7 @@ ENTRY(s3c2410_cpu_suspend)
         @@ prepare cpu to sleep
 
         ldr     r4, =S3C2410_REFRESH
-        ldr     r5, =S3C2410_MISCCR
+        ldr     r5, =S3C24XX_MISCCR
         ldr     r6, =S3C2410_CLKCON
         ldr     r7, [ r4 ]              @ get REFRESH (and ensure in TLB)
         ldr     r8, [ r5 ]              @ get MISCCR (and ensure in TLB)
diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
index b80d57d51699..722fbabc9cfb 100644
--- a/arch/arm/mach-versatile/pci.c
+++ b/arch/arm/mach-versatile/pci.c
@@ -240,6 +240,14 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
         int i;
         int myslot = -1;
         unsigned long val;
+        void __iomem *local_pci_cfg_base;
+
+        val = __raw_readl(SYS_PCICTL);
+        if (!(val & 1)) {
+                printk("Not plugged into PCI backplane!\n");
+                ret = -EIO;
+                goto out;
+        }
 
         if (nr == 0) {
                 sys->mem_offset = 0;
@@ -253,48 +261,45 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
                 goto out;
         }
 
-        __raw_writel(VERSATILE_PCI_MEM_BASE0 >> 28,PCI_IMAP0);
-        __raw_writel(VERSATILE_PCI_MEM_BASE1 >> 28,PCI_IMAP1);
-        __raw_writel(VERSATILE_PCI_MEM_BASE2 >> 28,PCI_IMAP2);
-
-        __raw_writel(1, SYS_PCICTL);
-
-        val = __raw_readl(SYS_PCICTL);
-        if (!(val & 1)) {
-                printk("Not plugged into PCI backplane!\n");
-                ret = -EIO;
-                goto out;
-        }
-
         /*
          *  We need to discover the PCI core first to configure itself
          *  before the main PCI probing is performed
          */
-        for (i=0; i<32; i++) {
+        for (i=0; i<32; i++)
                 if ((__raw_readl(VERSATILE_PCI_VIRT_BASE+(i<<11)+DEVICE_ID_OFFSET) == VP_PCI_DEVICE_ID) &&
                     (__raw_readl(VERSATILE_PCI_VIRT_BASE+(i<<11)+CLASS_ID_OFFSET) == VP_PCI_CLASS_ID)) {
                         myslot = i;
-
-                        __raw_writel(myslot, PCI_SELFID);
-                        val = __raw_readl(VERSATILE_PCI_CFG_VIRT_BASE+(myslot<<11)+CSR_OFFSET);
-                        val |= (1<<2);
-                        __raw_writel(val, VERSATILE_PCI_CFG_VIRT_BASE+(myslot<<11)+CSR_OFFSET);
                         break;
                 }
-        }
 
         if (myslot == -1) {
                 printk("Cannot find PCI core!\n");
                 ret = -EIO;
-        } else {
-                printk("PCI core found (slot %d)\n",myslot);
-                /* Do not to map Versatile FPGA PCI device
-                   into memory space as we are short of
-                   mappable memory */
-                pci_slot_ignore |= (1 << myslot);
-                ret = 1;
+                goto out;
         }
 
+        printk("PCI core found (slot %d)\n",myslot);
+
+        __raw_writel(myslot, PCI_SELFID);
+        local_pci_cfg_base = (void *) VERSATILE_PCI_CFG_VIRT_BASE + (myslot << 11);
+
+        val = __raw_readl(local_pci_cfg_base + CSR_OFFSET);
+        val |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER | PCI_COMMAND_INVALIDATE;
+        __raw_writel(val, local_pci_cfg_base + CSR_OFFSET);
+
+        /*
+         * Configure the PCI inbound memory windows to be 1:1 mapped to SDRAM
+         */
+        __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_0);
+        __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_1);
+        __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_2);
+
+        /*
+         * Do not to map Versatile FPGA PCI device into memory space
+         */
+        pci_slot_ignore |= (1 << myslot);
+        ret = 1;
+
  out:
         return ret;
 }
@@ -305,18 +310,18 @@ struct pci_bus *pci_versatile_scan_bus(int nr, struct pci_sys_data *sys)
         return pci_scan_bus(sys->busnr, &pci_versatile_ops, sys);
 }
 
-/*
- * V3_LB_BASE? - local bus address
- * V3_LB_MAP?  - pci bus address
- */
 void __init pci_versatile_preinit(void)
 {
-}
+        __raw_writel(VERSATILE_PCI_MEM_BASE0 >> 28, PCI_IMAP0);
+        __raw_writel(VERSATILE_PCI_MEM_BASE1 >> 28, PCI_IMAP1);
+        __raw_writel(VERSATILE_PCI_MEM_BASE2 >> 28, PCI_IMAP2);
 
-void __init pci_versatile_postinit(void)
-{
-}
+        __raw_writel(PHYS_OFFSET >> 28, PCI_SMAP0);
+        __raw_writel(PHYS_OFFSET >> 28, PCI_SMAP1);
+        __raw_writel(PHYS_OFFSET >> 28, PCI_SMAP2);
 
+        __raw_writel(1, SYS_PCICTL);
+}
 
 /*
  * map the specified device/slot/pin to an IRQ.   Different backplanes may need to modify this.
@@ -326,16 +331,15 @@ static int __init versatile_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
         int irq;
         int devslot = PCI_SLOT(dev->devfn);
 
-        /* slot,  pin,  irq
-            24    1     27
-            25    1     28      untested
-            26    1     29
-            27    1     30      untested
-        */
-
-        irq = 27 + ((slot + pin + 2) % 3);      /* Fudged */
+        /* slot,  pin,  irq
+         *  24     1     27
+         *  25     1     28
+         *  26     1     29
+         *  27     1     30
+         */
+        irq = 27 + ((slot + pin - 1) & 3);
 
-        printk("map irq: slot %d, pin %d, devslot %d, irq: %d\n",slot,pin,devslot,irq);
+        printk("PCI map irq: slot %d, pin %d, devslot %d, irq: %d\n",slot,pin,devslot,irq);
 
         return irq;
 }
@@ -347,7 +351,6 @@ static struct hw_pci versatile_pci __initdata = {
         .setup                  = pci_versatile_setup,
         .scan                   = pci_versatile_scan_bus,
         .preinit                = pci_versatile_preinit,
-        .postinit               = pci_versatile_postinit,
 };
 
 static int __init versatile_pci_init(void)
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index dbd346033122..8a7f65ba14b7 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -20,7 +20,7 @@
  */
         .align  5
 ENTRY(v6_early_abort)
-#ifdef CONFIG_CPU_MPCORE
+#ifdef CONFIG_CPU_32v6K
         clrex
 #else
         strex   r0, r1, [sp]                    @ Clear the exclusive monitor
diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S
index 72966d90e956..2c6c2a7c05a0 100644
--- a/arch/arm/mm/cache-v6.S
+++ b/arch/arm/mm/cache-v6.S
@@ -92,25 +92,20 @@ ENTRY(v6_coherent_kern_range)
  *      - the Icache does not read data from the write buffer
  */
 ENTRY(v6_coherent_user_range)
-        bic     r0, r0, #CACHE_LINE_SIZE - 1
-1:
+
 #ifdef HARVARD_CACHE
-        mcr     p15, 0, r0, c7, c10, 1          @ clean D line
-        mcr     p15, 0, r0, c7, c5, 1           @ invalidate I line
-#endif
-        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
-        add     r0, r0, #BTB_FLUSH_SIZE
-        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
-        add     r0, r0, #BTB_FLUSH_SIZE
-        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
-        add     r0, r0, #BTB_FLUSH_SIZE
-        mcr     p15, 0, r0, c7, c5, 7           @ invalidate BTB entry
-        add     r0, r0, #BTB_FLUSH_SIZE
+        bic     r0, r0, #CACHE_LINE_SIZE - 1
+1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D line
+        add     r0, r0, #CACHE_LINE_SIZE
         cmp     r0, r1
         blo     1b
-#ifdef HARVARD_CACHE
+#endif
         mov     r0, #0
+#ifdef HARVARD_CACHE
         mcr     p15, 0, r0, c7, c10, 4          @ drain write buffer
+        mcr     p15, 0, r0, c7, c5, 0           @ I+BTB cache invalidate
+#else
+        mcr     p15, 0, r0, c7, c5, 6           @ invalidate BTB
 #endif
         mov     pc, lr
 
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 330695b6b19d..b103e56806bd 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -24,14 +24,16 @@
 static void flush_pfn_alias(unsigned long pfn, unsigned long vaddr)
 {
         unsigned long to = ALIAS_FLUSH_START + (CACHE_COLOUR(vaddr) << PAGE_SHIFT);
+        const int zero = 0;
 
         set_pte(TOP_PTE(to), pfn_pte(pfn, PAGE_KERNEL));
         flush_tlb_kernel_page(to);
 
         asm(    "mcrr   p15, 0, %1, %0, c14\n"
-        "       mcrr    p15, 0, %1, %0, c5\n"
+        "       mcr     p15, 0, %2, c7, c10, 4\n"
+        "       mcr     p15, 0, %2, c7, c5, 0\n"
             :
-            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES)
+            : "r" (to), "r" (to + PAGE_SIZE - L1_CACHE_BYTES), "r" (zero)
             : "cc");
 }
 
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 861b35947280..2d3823ec3153 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -241,7 +241,15 @@ ENTRY(xscale_flush_user_cache_range)
  *      it also trashes the mini I-cache used by JTAG debuggers.
  */
 ENTRY(xscale_coherent_kern_range)
-        /* FALLTHROUGH */
+        bic     r0, r0, #CACHELINESIZE - 1
+1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
+        add     r0, r0, #CACHELINESIZE
+        cmp     r0, r1
+        blo     1b
+        mov     r0, #0
+        mcr     p15, 0, r0, c7, c5, 0           @ Invalidate I cache & BTB
+        mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
+        mov     pc, lr
 
 /*
  *      coherent_user_range(start, end)
@@ -252,18 +260,16 @@ ENTRY(xscale_coherent_kern_range)
  *
  *      - start  - virtual start address
  *      - end    - virtual end address
- *
- *      Note: single I-cache line invalidation isn't used here since
- *      it also trashes the mini I-cache used by JTAG debuggers.
  */
 ENTRY(xscale_coherent_user_range)
         bic     r0, r0, #CACHELINESIZE - 1
 1:      mcr     p15, 0, r0, c7, c10, 1          @ clean D entry
+        mcr     p15, 0, r0, c7, c5, 1           @ Invalidate I cache entry
         add     r0, r0, #CACHELINESIZE
         cmp     r0, r1
         blo     1b
         mov     r0, #0
-        mcr     p15, 0, r0, c7, c5, 0           @ Invalidate I cache & BTB
+        mcr     p15, 0, r0, c7, c5, 6           @ Invalidate BTB
         mcr     p15, 0, r0, c7, c10, 4          @ Drain Write (& Fill) Buffer
         mov     pc, lr
 
diff --git a/arch/arm/mm/tlb-v6.S b/arch/arm/mm/tlb-v6.S
index 6f76b89ef46e..fd6adde39091 100644
--- a/arch/arm/mm/tlb-v6.S
+++ b/arch/arm/mm/tlb-v6.S
@@ -80,6 +80,7 @@ ENTRY(v6wbi_flush_kern_tlb_range)
         add     r0, r0, #PAGE_SZ
         cmp     r0, r1
         blo     1b
+        mcr     p15, 0, r2, c7, c10, 4          @ data synchronization barrier
         mov     pc, lr
 
         .section ".text.init", #alloc, #execinstr
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index 1415930ceee1..6f8bc1f0e6a1 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -137,8 +137,9 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         if (spec) {
                 init_MUTEX(&op_arm_sem);
 
-                if (spec->init() < 0)
-                        return -ENODEV;
+                ret = spec->init();
+                if (ret < 0)
+                        return ret;
 
                 op_arm_model = spec;
                 init_driverfs();
diff --git a/arch/arm/plat-omap/pm.c b/arch/arm/plat-omap/pm.c
index 1a24e2c10714..093efd786f21 100644
--- a/arch/arm/plat-omap/pm.c
+++ b/arch/arm/plat-omap/pm.c
@@ -38,7 +38,6 @@
 #include <linux/pm.h>
 #include <linux/sched.h>
 #include <linux/proc_fs.h>
-#include <linux/pm.h>
 #include <linux/interrupt.h>
 
 #include <asm/io.h>
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 792f66375830..ee82763b02b8 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 
 #include <asm/mach/map.h>
+#include <asm/tlb.h>
 #include <asm/io.h>
 #include <asm/cacheflush.h>
 
@@ -96,6 +97,14 @@ void __init omap_map_sram(void)
                omap_sram_io_desc[0].length);
 
         /*
+         * Normally devicemaps_init() would flush caches and tlb after
+         * mdesc->map_io(), but since we're called from map_io(), we
+         * must do it here.
+         */
+        local_flush_tlb_all();
+        flush_cache_all();
+
+        /*
          * Looks like we need to preserve some bootloader code at the
          * beginning of SRAM for jumping to flash for reboot to work...
          */
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index d0f9bb5e9023..8ab5300dcb94 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Mon Jan 9 12:56:42 2006
+# Last update: Mon Feb 20 10:18:02 2006
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -904,7 +904,7 @@ wg302v2			MACH_WG302V2		WG302V2			890
 eb42x                   MACH_EB42X              EB42X                   891
 iq331es                 MACH_IQ331ES            IQ331ES                 892
 cosydsp                 MACH_COSYDSP            COSYDSP                 893
-uplat7d                 MACH_UPLAT7D            UPLAT7D                 894
+uplat7d_proto           MACH_UPLAT7D            UPLAT7D                 894
 ptdavinci               MACH_PTDAVINCI          PTDAVINCI               895
 mbus                    MACH_MBUS               MBUS                    896
 nadia2vb                MACH_NADIA2VB           NADIA2VB                897
@@ -938,3 +938,34 @@ auckland		MACH_AUCKLAND		AUCKLAND		924
 ak3220m                 MACH_AK3320M            AK3320M                 925
 duramax                 MACH_DURAMAX            DURAMAX                 926
 n35                     MACH_N35                N35                     927
+pronghorn               MACH_PRONGHORN          PRONGHORN               928
+fundy                   MACH_FUNDY              FUNDY                   929
+logicpd_pxa270          MACH_LOGICPD_PXA270     LOGICPD_PXA270          930
+cpu777                  MACH_CPU777             CPU777                  931
+simicon9201             MACH_SIMICON9201        SIMICON9201             932
+leap2_hpm               MACH_LEAP2_HPM          LEAP2_HPM               933
+cm922txa10              MACH_CM922TXA10         CM922TXA10              934
+sandgate                MACH_PXA                PXA                     935
+sandgate2               MACH_SANDGATE2          SANDGATE2               936
+sandgate2g              MACH_SANDGATE2G         SANDGATE2G              937
+sandgate2p              MACH_SANDGATE2P         SANDGATE2P              938
+fred_jack               MACH_FRED_JACK          FRED_JACK               939
+ttg_color1              MACH_TTG_COLOR1         TTG_COLOR1              940
+nxeb500hmi              MACH_NXEB500HMI         NXEB500HMI              941
+netdcu8                 MACH_NETDCU8            NETDCU8                 942
+ml675050_cpu_boa        MACH_ML675050_CPU_BOA   ML675050_CPU_BOA        943
+ng_fvx538               MACH_NG_FVX538          NG_FVX538               944
+ng_fvs338               MACH_NG_FVS338          NG_FVS338               945
+pnx4103                 MACH_PNX4103            PNX4103                 946
+hesdb                   MACH_HESDB              HESDB                   947
+xsilo                   MACH_XSILO              XSILO                   948
+espresso                MACH_ESPRESSO           ESPRESSO                949
+emlc                    MACH_EMLC               EMLC                    950
+sisteron                MACH_SISTERON           SISTERON                951
+rx1950                  MACH_RX1950             RX1950                  952
+tsc_venus               MACH_TSC_VENUS          TSC_VENUS               953
+ds101j                  MACH_DS101J             DS101J                  954
+mxc300_30ads            MACH_MXC30030ADS        MXC30030ADS             955
+fujitsu_wimaxsoc        MACH_FUJITSU_WIMAXSOC   FUJITSU_WIMAXSOC        956
+dualpcmodem             MACH_DUALPCMODEM        DUALPCMODEM             957
+gesbc9312               MACH_GESBC9312          GESBC9312               958
diff --git a/arch/cris/Makefile b/arch/cris/Makefile
index ea65d585cf5e..ee114699ef8e 100644
--- a/arch/cris/Makefile
+++ b/arch/cris/Makefile
@@ -119,7 +119,7 @@ $(SRC_ARCH)/.links:
         @ln -sfn $(SRC_ARCH)/$(SARCH)/lib $(SRC_ARCH)/lib
         @ln -sfn $(SRC_ARCH)/$(SARCH) $(SRC_ARCH)/arch
         @ln -sfn $(SRC_ARCH)/$(SARCH)/vmlinux.lds.S $(SRC_ARCH)/kernel/vmlinux.lds.S
-        @ln -sfn $(SRC_ARCH)/$(SARCH)/asm-offsets.c $(SRC_ARCH)/kernel/asm-offsets.c
+        @ln -sfn $(SRC_ARCH)/$(SARCH)/kernel/asm-offsets.c $(SRC_ARCH)/kernel/asm-offsets.c
         @touch $@
 
 # Create link to sub arch includes
diff --git a/arch/cris/arch-v10/kernel/ptrace.c b/arch/cris/arch-v10/kernel/ptrace.c
index f214f74f264e..961c0d58ded4 100644
--- a/arch/cris/arch-v10/kernel/ptrace.c
+++ b/arch/cris/arch-v10/kernel/ptrace.c
@@ -202,18 +202,18 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                         int i;
                         unsigned long tmp;
                         
+                        ret = 0;
                         for (i = 0; i <= PT_MAX; i++) {
                                 tmp = get_reg(child, i);
                                 
                                 if (put_user(tmp, datap)) {
                                         ret = -EFAULT;
-                                        goto out_tsk;
+                                        break;
                                 }
                                 
                                 data += sizeof(long);
                         }
 
-                        ret = 0;
                         break;
                 }
 
@@ -222,10 +222,11 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                         int i;
                         unsigned long tmp;
                         
+                        ret = 0;
                         for (i = 0; i <= PT_MAX; i++) {
                                 if (get_user(tmp, datap)) {
                                         ret = -EFAULT;
-                                        goto out_tsk;
+                                        break;
                                 }
                                 
                                 if (i == PT_DCCR) {
@@ -237,7 +238,6 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                                 data += sizeof(long);
                         }
                         
-                        ret = 0;
                         break;
                 }
 
diff --git a/arch/cris/kernel/setup.c b/arch/cris/kernel/setup.c
index d11206e467ab..1ba57efff60d 100644
--- a/arch/cris/kernel/setup.c
+++ b/arch/cris/kernel/setup.c
@@ -24,7 +24,6 @@
 /*
  * Setup options
  */
-struct drive_info_struct { char dummy[32]; } drive_info;
 struct screen_info screen_info;
 
 extern int root_mountflags;
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index 60a617aff8ba..e08383712370 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -25,6 +25,10 @@ config GENERIC_HARDIRQS
         bool
         default n
 
+config TIME_LOW_RES
+        bool
+        default y
+
 mainmenu "Fujitsu FR-V Kernel Configuration"
 
 source "init/Kconfig"
diff --git a/arch/frv/Makefile b/arch/frv/Makefile
index 90c0fb8d9dc3..d163747d17c0 100644
--- a/arch/frv/Makefile
+++ b/arch/frv/Makefile
@@ -81,7 +81,7 @@ endif
 # - reserve CC3 for use with atomic ops
 # - all the extra registers are dealt with only at context switch time
 CFLAGS          += -mno-fdpic -mgpr-32 -msoft-float -mno-media
-CFLAGS          += -ffixed-fcc3 -ffixed-cc3 -ffixed-gr15
+CFLAGS          += -ffixed-fcc3 -ffixed-cc3 -ffixed-gr15 -ffixed-icc2
 AFLAGS          += -mno-fdpic
 ASFLAGS         += -mno-fdpic
 
diff --git a/arch/frv/kernel/break.S b/arch/frv/kernel/break.S
index 33233dc23e29..687c48d62dde 100644
--- a/arch/frv/kernel/break.S
+++ b/arch/frv/kernel/break.S
@@ -200,12 +200,20 @@ __break_step:
         movsg           bpcsr,gr2
         sethi.p         %hi(__entry_kernel_external_interrupt),gr3
         setlo           %lo(__entry_kernel_external_interrupt),gr3
-        subcc           gr2,gr3,gr0,icc0
+        subcc.p         gr2,gr3,gr0,icc0
+        sethi           %hi(__entry_uspace_external_interrupt),gr3
+        setlo.p         %lo(__entry_uspace_external_interrupt),gr3
         beq             icc0,#2,__break_step_kernel_external_interrupt
-        sethi.p         %hi(__entry_uspace_external_interrupt),gr3
-        setlo           %lo(__entry_uspace_external_interrupt),gr3
-        subcc           gr2,gr3,gr0,icc0
+        subcc.p         gr2,gr3,gr0,icc0
+        sethi           %hi(__entry_kernel_external_interrupt_virtually_disabled),gr3
+        setlo.p         %lo(__entry_kernel_external_interrupt_virtually_disabled),gr3
         beq             icc0,#2,__break_step_uspace_external_interrupt
+        subcc.p         gr2,gr3,gr0,icc0
+        sethi           %hi(__entry_kernel_external_interrupt_virtual_reenable),gr3
+        setlo.p         %lo(__entry_kernel_external_interrupt_virtual_reenable),gr3
+        beq             icc0,#2,__break_step_kernel_external_interrupt_virtually_disabled
+        subcc           gr2,gr3,gr0,icc0
+        beq             icc0,#2,__break_step_kernel_external_interrupt_virtual_reenable
 
         LEDS            0x2007,gr2
 
@@ -254,6 +262,9 @@ __break_step_kernel_softprog_interrupt:
 # step through an external interrupt from kernel mode
         .globl          __break_step_kernel_external_interrupt
 __break_step_kernel_external_interrupt:
+        # deal with virtual interrupt disablement
+        beq             icc2,#0,__break_step_kernel_external_interrupt_virtually_disabled
+
         sethi.p         %hi(__entry_kernel_external_interrupt_reentry),gr3
         setlo           %lo(__entry_kernel_external_interrupt_reentry),gr3
 
@@ -294,6 +305,64 @@ __break_return_as_kernel_prologue:
 #endif
         rett            #1
 
+# we single-stepped into an interrupt handler whilst interrupts were merely virtually disabled
+# need to really disable interrupts, set flag, fix up and return
+__break_step_kernel_external_interrupt_virtually_disabled:
+        movsg           psr,gr2
+        andi            gr2,#~PSR_PIL,gr2
+        ori             gr2,#PSR_PIL_14,gr2     /* debugging interrupts only */
+        movgs           gr2,psr
+
+        ldi             @(gr31,#REG_CCR),gr3
+        movgs           gr3,ccr
+        subcc.p         gr0,gr0,gr0,icc2        /* leave Z set, clear C */
+
+        # exceptions must've been enabled and we must've been in supervisor mode
+        setlos          BPSR_BET|BPSR_BS,gr3
+        movgs           gr3,bpsr
+
+        # return to where the interrupt happened
+        movsg           pcsr,gr2
+        movgs           gr2,bpcsr
+
+        lddi.p          @(gr31,#REG_GR(2)),gr2
+
+        xor             gr31,gr31,gr31
+        movgs           gr0,brr
+#ifdef CONFIG_MMU
+        movsg           scr3,gr31
+#endif
+        rett            #1
+
+# we stepped through into the virtual interrupt reenablement trap
+#
+# we also want to single step anyway, but after fixing up so that we get an event on the
+# instruction after the broken-into exception returns
+        .globl          __break_step_kernel_external_interrupt_virtual_reenable
+__break_step_kernel_external_interrupt_virtual_reenable:
+        movsg           psr,gr2
+        andi            gr2,#~PSR_PIL,gr2
+        movgs           gr2,psr
+
+        ldi             @(gr31,#REG_CCR),gr3
+        movgs           gr3,ccr
+        subicc          gr0,#1,gr0,icc2         /* clear Z, set C */
+
+        # save the adjusted ICC2
+        movsg           ccr,gr3
+        sti             gr3,@(gr31,#REG_CCR)
+
+        # exceptions must've been enabled and we must've been in supervisor mode
+        setlos          BPSR_BET|BPSR_BS,gr3
+        movgs           gr3,bpsr
+
+        # return to where the trap happened
+        movsg           pcsr,gr2
+        movgs           gr2,bpcsr
+
+        # and then process the single step
+        bra             __break_continue
+
 # step through an internal exception from uspace mode
         .globl          __break_step_uspace_softprog_interrupt
 __break_step_uspace_softprog_interrupt:
diff --git a/arch/frv/kernel/entry-table.S b/arch/frv/kernel/entry-table.S
index 9b9243e2103c..81568acea9cd 100644
--- a/arch/frv/kernel/entry-table.S
+++ b/arch/frv/kernel/entry-table.S
@@ -116,6 +116,8 @@ __break_kerneltrap_fixup_table:
         .long           __break_step_uspace_external_interrupt
         .section .trap.kernel
         .org            \tbr_tt
+        # deal with virtual interrupt disablement
+        beq             icc2,#0,__entry_kernel_external_interrupt_virtually_disabled
         bra             __entry_kernel_external_interrupt
         .section .trap.fixup.kernel
         .org            \tbr_tt >> 2
@@ -259,25 +261,52 @@ __trap_fixup_kernel_data_tlb_miss:
         .org            TBR_TT_TRAP0
         .rept           127
         bra             __entry_uspace_softprog_interrupt
-        bra             __break_step_uspace_softprog_interrupt
-        .long           0,0
+        .long           0,0,0
         .endr
         .org            TBR_TT_BREAK
         bra             __entry_break
         .long           0,0,0
 
+        .section        .trap.fixup.user
+        .org            TBR_TT_TRAP0 >> 2
+        .rept           127
+        .long           __break_step_uspace_softprog_interrupt
+        .endr
+        .org            TBR_TT_BREAK >> 2
+        .long           0
+
         # miscellaneous kernel mode entry points
         .section        .trap.kernel
         .org            TBR_TT_TRAP0
-        .rept           127
         bra             __entry_kernel_softprog_interrupt
-        bra             __break_step_kernel_softprog_interrupt
-        .long           0,0
+        .org            TBR_TT_TRAP1
+        bra             __entry_kernel_softprog_interrupt
+
+        # trap #2 in kernel - reenable interrupts
+        .org            TBR_TT_TRAP2
+        bra             __entry_kernel_external_interrupt_virtual_reenable
+
+        # miscellaneous kernel traps
+        .org            TBR_TT_TRAP3
+        .rept           124
+        bra             __entry_kernel_softprog_interrupt
+        .long           0,0,0
         .endr
         .org            TBR_TT_BREAK
         bra             __entry_break
         .long           0,0,0
 
+        .section        .trap.fixup.kernel
+        .org            TBR_TT_TRAP0 >> 2
+        .long           __break_step_kernel_softprog_interrupt
+        .long           __break_step_kernel_softprog_interrupt
+        .long           __break_step_kernel_external_interrupt_virtual_reenable
+        .rept           124
+        .long           __break_step_kernel_softprog_interrupt
+        .endr
+        .org            TBR_TT_BREAK >> 2
+        .long           0
+
         # miscellaneous debug mode entry points
         .section        .trap.break
         .org            TBR_TT_BREAK
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index 5f6548388b74..1d21c8d34d8a 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -141,7 +141,10 @@ __entry_uspace_external_interrupt_reentry:
 
         movsg           gner0,gr4
         movsg           gner1,gr5
-        stdi            gr4,@(gr28,#REG_GNER0)
+        stdi.p          gr4,@(gr28,#REG_GNER0)
+
+        # interrupts start off fully disabled in the interrupt handler
+        subcc           gr0,gr0,gr0,icc2                /* set Z and clear C */
 
         # set up kernel global registers
         sethi.p         %hi(__kernel_current_task),gr5
@@ -193,9 +196,8 @@ __entry_uspace_external_interrupt_reentry:
         .type           __entry_kernel_external_interrupt,@function
 __entry_kernel_external_interrupt:
         LEDS            0x6210
-
-        sub             sp,gr15,gr31
-        LEDS32
+//      sub             sp,gr15,gr31
+//      LEDS32
 
         # set up the stack pointer
         or.p            sp,gr0,gr30
@@ -231,7 +233,10 @@ __entry_kernel_external_interrupt_reentry:
         stdi            gr24,@(gr28,#REG_GR(24))
         stdi            gr26,@(gr28,#REG_GR(26))
         sti             gr29,@(gr28,#REG_GR(29))
-        stdi            gr30,@(gr28,#REG_GR(30))
+        stdi.p          gr30,@(gr28,#REG_GR(30))
+
+        # note virtual interrupts will be fully enabled upon return
+        subicc          gr0,#1,gr0,icc2                 /* clear Z, set C */
 
         movsg           tbr ,gr20
         movsg           psr ,gr22
@@ -267,7 +272,10 @@ __entry_kernel_external_interrupt_reentry:
 
         movsg           gner0,gr4
         movsg           gner1,gr5
-        stdi            gr4,@(gr28,#REG_GNER0)
+        stdi.p          gr4,@(gr28,#REG_GNER0)
+
+        # interrupts start off fully disabled in the interrupt handler
+        subcc           gr0,gr0,gr0,icc2                        /* set Z and clear C */
 
         # set the return address
         sethi.p         %hi(__entry_return_from_kernel_interrupt),gr4
@@ -291,6 +299,45 @@ __entry_kernel_external_interrupt_reentry:
 
         .size           __entry_kernel_external_interrupt,.-__entry_kernel_external_interrupt
 
+###############################################################################
+#
+# deal with interrupts that were actually virtually disabled
+# - we need to really disable them, flag the fact and return immediately
+# - if you change this, you must alter break.S also
+#
+###############################################################################
+        .balign         L1_CACHE_BYTES
+        .globl          __entry_kernel_external_interrupt_virtually_disabled
+        .type           __entry_kernel_external_interrupt_virtually_disabled,@function
+__entry_kernel_external_interrupt_virtually_disabled:
+        movsg           psr,gr30
+        andi            gr30,#~PSR_PIL,gr30
+        ori             gr30,#PSR_PIL_14,gr30           ; debugging interrupts only
+        movgs           gr30,psr
+        subcc           gr0,gr0,gr0,icc2                ; leave Z set, clear C
+        rett            #0
+
+        .size           __entry_kernel_external_interrupt_virtually_disabled,.-__entry_kernel_external_interrupt_virtually_disabled
+
+###############################################################################
+#
+# deal with re-enablement of interrupts that were pending when virtually re-enabled
+# - set ICC2.C, re-enable the real interrupts and return
+# - we can clear ICC2.Z because we shouldn't be here if it's not 0 [due to TIHI]
+# - if you change this, you must alter break.S also
+#
+###############################################################################
+        .balign         L1_CACHE_BYTES
+        .globl          __entry_kernel_external_interrupt_virtual_reenable
+        .type           __entry_kernel_external_interrupt_virtual_reenable,@function
+__entry_kernel_external_interrupt_virtual_reenable:
+        movsg           psr,gr30
+        andi            gr30,#~PSR_PIL,gr30             ; re-enable interrupts
+        movgs           gr30,psr
+        subicc          gr0,#1,gr0,icc2                 ; clear Z, set C
+        rett            #0
+
+        .size           __entry_kernel_external_interrupt_virtual_reenable,.-__entry_kernel_external_interrupt_virtual_reenable
 
 ###############################################################################
 #
@@ -335,6 +382,7 @@ __entry_uspace_softprog_interrupt_reentry:
 
         sethi.p         %hi(__entry_return_from_user_exception),gr23
         setlo           %lo(__entry_return_from_user_exception),gr23
+
         bra             __entry_common
 
         .size           __entry_uspace_softprog_interrupt,.-__entry_uspace_softprog_interrupt
@@ -495,7 +543,10 @@ __entry_common:
 
         movsg           gner0,gr4
         movsg           gner1,gr5
-        stdi            gr4,@(gr28,#REG_GNER0)
+        stdi.p          gr4,@(gr28,#REG_GNER0)
+
+        # set up virtual interrupt disablement
+        subicc          gr0,#1,gr0,icc2                 /* clear Z flag, set C flag */
 
         # set up kernel global registers
         sethi.p         %hi(__kernel_current_task),gr5
@@ -1418,11 +1469,27 @@ sys_call_table:
         .long sys_add_key
         .long sys_request_key
         .long sys_keyctl
-        .long sys_ni_syscall // sys_vperfctr_open
-        .long sys_ni_syscall // sys_vperfctr_control    /* 290 */
-        .long sys_ni_syscall // sys_vperfctr_unlink
-        .long sys_ni_syscall // sys_vperfctr_iresume
-        .long sys_ni_syscall // sys_vperfctr_read
+        .long sys_ioprio_set
+        .long sys_ioprio_get            /* 290 */
+        .long sys_inotify_init
+        .long sys_inotify_add_watch
+        .long sys_inotify_rm_watch
+        .long sys_migrate_pages
+        .long sys_openat                /* 295 */
+        .long sys_mkdirat
+        .long sys_mknodat
+        .long sys_fchownat
+        .long sys_futimesat
+        .long sys_newfstatat            /* 300 */
+        .long sys_unlinkat
+        .long sys_renameat
+        .long sys_linkat
+        .long sys_symlinkat
+        .long sys_readlinkat            /* 305 */
+        .long sys_fchmodat
+        .long sys_faccessat
+        .long sys_pselect6
+        .long sys_ppoll
 
 
 syscall_table_size = (. - sys_call_table)
diff --git a/arch/frv/kernel/head.S b/arch/frv/kernel/head.S
index c73b4fe9f6ca..29a5265489b7 100644
--- a/arch/frv/kernel/head.S
+++ b/arch/frv/kernel/head.S
@@ -513,6 +513,9 @@ __head_mmu_enabled:
         movgs           gr0,ccr
         movgs           gr0,cccr
 
+        # initialise the virtual interrupt handling
+        subcc           gr0,gr0,gr0,icc2                /* set Z, clear C */
+
 #ifdef CONFIG_MMU
         movgs           gr3,scr2
         movgs           gr3,scr3
diff --git a/arch/frv/kernel/irq.c b/arch/frv/kernel/irq.c
index 59580c59c62c..27ab4c30aac6 100644
--- a/arch/frv/kernel/irq.c
+++ b/arch/frv/kernel/irq.c
@@ -287,18 +287,11 @@ asmlinkage void do_IRQ(void)
         struct irq_source *source;
         int level, cpu;
 
+        irq_enter();
+
         level = (__frame->tbr >> 4) & 0xf;
         cpu = smp_processor_id();
 
-#if 0
-        {
-                static u32 irqcount;
-                *(volatile u32 *) 0xe1200004 = ~((irqcount++ << 8) | level);
-                *(volatile u16 *) 0xffc00100 = (u16) ~0x9999;
-                mb();
-        }
-#endif
-
         if ((unsigned long) __frame - (unsigned long) (current + 1) < 512)
                 BUG();
 
@@ -308,40 +301,12 @@ asmlinkage void do_IRQ(void)
 
         kstat_this_cpu.irqs[level]++;
 
-        irq_enter();
-
         for (source = frv_irq_levels[level].sources; source; source = source->next)
                 source->doirq(source);
 
-        irq_exit();
-
         __clr_MASK(level);
 
-        /* only process softirqs if we didn't interrupt another interrupt handler */
-        if ((__frame->psr & PSR_PIL) == PSR_PIL_0)
-                if (local_softirq_pending())
-                        do_softirq();
-
-#ifdef CONFIG_PREEMPT
-        local_irq_disable();
-        while (--current->preempt_count == 0) {
-                if (!(__frame->psr & PSR_S) ||
-                    current->need_resched == 0 ||
-                    in_interrupt())
-                        break;
-                current->preempt_count++;
-                local_irq_enable();
-                preempt_schedule();
-                local_irq_disable();
-        }
-#endif
-
-#if 0
-        {
-                *(volatile u16 *) 0xffc00100 = (u16) ~0x6666;
-                mb();
-        }
-#endif
+        irq_exit();
 
 } /* end do_IRQ() */
 
diff --git a/arch/frv/mm/kmap.c b/arch/frv/mm/kmap.c
index 539f45e6d15e..c54f18e65ea6 100644
--- a/arch/frv/mm/kmap.c
+++ b/arch/frv/mm/kmap.c
@@ -44,15 +44,6 @@ void iounmap(void *addr)
 }
 
 /*
- * __iounmap unmaps nearly everything, so be careful
- * it doesn't free currently pointer/page tables anymore but it
- * wans't used anyway and might be added later.
- */
-void __iounmap(void *addr, unsigned long size)
-{
-}
-
-/*
  * Set new cache mode for some kernel address space.
  * The caller must push data for that range itself, if such data may already
  * be in the cache.
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index 80940d712acf..98308b018a35 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -33,6 +33,10 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default y
 
+config TIME_LOW_RES
+        bool
+        default y
+
 config ISA
         bool
         default y
diff --git a/arch/h8300/Kconfig.cpu b/arch/h8300/Kconfig.cpu
index a380167a13cf..582797db9603 100644
--- a/arch/h8300/Kconfig.cpu
+++ b/arch/h8300/Kconfig.cpu
@@ -169,7 +169,7 @@ endif
 
 config CPU_H8300H
         bool
-        depends on (H8002 || H83007 || H83048 || H83068)
+        depends on (H83002 || H83007 || H83048 || H83068)
         default y
 
 config CPU_H8S
diff --git a/arch/h8300/Kconfig.debug b/arch/h8300/Kconfig.debug
index 55034d08abff..e0e9bcb015a9 100644
--- a/arch/h8300/Kconfig.debug
+++ b/arch/h8300/Kconfig.debug
@@ -34,7 +34,7 @@ config GDB_DEBUG
         help
           gdb stub exception support
 
-config CONFIG_SH_STANDARD_BIOS
+config SH_STANDARD_BIOS
         bool "Use gdb protocol serial console"
         depends on (!H8300H_SIM && !H8S_SIM)
         help
diff --git a/arch/h8300/defconfig b/arch/h8300/defconfig
index 9d9b491cfc2c..8f1ec3297150 100644
--- a/arch/h8300/defconfig
+++ b/arch/h8300/defconfig
@@ -328,7 +328,7 @@ CONFIG_FULLDEBUG=y
 CONFIG_NO_KERNEL_MSG=y
 # CONFIG_SYSCALL_PRINT is not set
 # CONFIG_GDB_DEBUG is not set
-# CONFIG_CONFIG_SH_STANDARD_BIOS is not set
+# CONFIG_SH_STANDARD_BIOS is not set
 # CONFIG_DEFAULT_CMDLINE is not set
 # CONFIG_BLKDEV_RESERVE is not set
 
diff --git a/arch/h8300/kernel/process.c b/arch/h8300/kernel/process.c
index ed79ae20e88d..dd344f112cfe 100644
--- a/arch/h8300/kernel/process.c
+++ b/arch/h8300/kernel/process.c
@@ -45,6 +45,9 @@
 #include <asm/setup.h>
 #include <asm/pgtable.h>
 
+void (*pm_power_off)(void) = NULL;
+EXPORT_SYMBOL(pm_power_off);
+
 asmlinkage void ret_from_fork(void);
 
 /*
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index d86c865a7cd2..5b1a7d46d1d9 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -442,6 +442,7 @@ config HIGHMEM4G
 
 config HIGHMEM64G
         bool "64GB"
+        depends on X86_CMPXCHG64
         help
           Select this if you have a 32-bit processor and more than 4
           gigabytes of physical RAM.
@@ -732,7 +733,7 @@ config PHYSICAL_START
 
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
-        depends on SMP && HOTPLUG && EXPERIMENTAL
+        depends on SMP && HOTPLUG && EXPERIMENTAL && !X86_VOYAGER
         ---help---
           Say Y here to experiment with turning CPUs off and on.  CPUs
           can be controlled through /sys/devices/system/cpu.
@@ -1059,6 +1060,7 @@ source "arch/i386/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/i386/boot/.gitignore b/arch/i386/boot/.gitignore
new file mode 100644
index 000000000000..495f20c085de
--- /dev/null
+++ b/arch/i386/boot/.gitignore
@@ -0,0 +1,3 @@
+bootsect
+bzImage
+setup
diff --git a/arch/i386/boot/tools/.gitignore b/arch/i386/boot/tools/.gitignore
new file mode 100644
index 000000000000..378eac25d311
--- /dev/null
+++ b/arch/i386/boot/tools/.gitignore
@@ -0,0 +1 @@
+build
diff --git a/arch/i386/kernel/.gitignore b/arch/i386/kernel/.gitignore
new file mode 100644
index 000000000000..40836ad9079c
--- /dev/null
+++ b/arch/i386/kernel/.gitignore
@@ -0,0 +1 @@
+vsyscall.lds
diff --git a/arch/i386/kernel/Makefile b/arch/i386/kernel/Makefile
index 60c3f76dfca4..65656c033d70 100644
--- a/arch/i386/kernel/Makefile
+++ b/arch/i386/kernel/Makefile
@@ -7,11 +7,11 @@ extra-y := head.o init_task.o vmlinux.lds
 obj-y   := process.o semaphore.o signal.o entry.o traps.o irq.o \
                 ptrace.o time.o ioport.o ldt.o setup.o i8259.o sys_i386.o \
                 pci-dma.o i386_ksyms.o i387.o dmi_scan.o bootflag.o \
-                quirks.o i8237.o
+                quirks.o i8237.o topology.o
 
 obj-y                           += cpu/
 obj-y                           += timers/
-obj-$(CONFIG_ACPI)              += acpi/
+obj-y                           += acpi/
 obj-$(CONFIG_X86_BIOS_REBOOT)   += reboot.o
 obj-$(CONFIG_MCA)               += mca.o
 obj-$(CONFIG_X86_MSR)           += msr.o
diff --git a/arch/i386/kernel/acpi/Makefile b/arch/i386/kernel/acpi/Makefile
index d51c7313cae8..7e9ac99354f4 100644
--- a/arch/i386/kernel/acpi/Makefile
+++ b/arch/i386/kernel/acpi/Makefile
@@ -1,4 +1,4 @@
-obj-y                           := boot.o
+obj-$(CONFIG_ACPI)              += boot.o
 obj-$(CONFIG_X86_IO_APIC)       += earlyquirk.o
 obj-$(CONFIG_ACPI_SLEEP)        += sleep.o wakeup.o
 
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index f21fa0d4482f..f1a21945963d 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -248,10 +248,17 @@ acpi_parse_lapic(acpi_table_entry_header * header, const unsigned long end)
 
         acpi_table_print_madt_entry(header);
 
-        /* Register even disabled CPUs for cpu hotplug */
-
-        x86_acpiid_to_apicid[processor->acpi_id] = processor->id;
+        /* Record local apic id only when enabled */
+        if (processor->flags.enabled)
+                x86_acpiid_to_apicid[processor->acpi_id] = processor->id;
 
+        /*
+         * We need to register disabled CPU as well to permit
+         * counting disabled CPUs. This allows us to size
+         * cpus_possible_map more accurately, to permit
+         * to not preallocating memory for all NR_CPUS
+         * when we use CPU hotplug.
+         */
         mp_register_lapic(processor->id,        /* APIC ID */
                           processor->flags.enabled);    /* Enabled? */
 
@@ -1104,9 +1111,6 @@ int __init acpi_boot_table_init(void)
                 disable_acpi();
                 return error;
         }
-#ifdef __i386__
-        check_acpi_pci();
-#endif
 
         acpi_table_parse(ACPI_BOOT, acpi_parse_sbf);
 
diff --git a/arch/i386/kernel/acpi/earlyquirk.c b/arch/i386/kernel/acpi/earlyquirk.c
index f1b9d2a46dab..2e3b643a4dc4 100644
--- a/arch/i386/kernel/acpi/earlyquirk.c
+++ b/arch/i386/kernel/acpi/earlyquirk.c
@@ -7,14 +7,22 @@
 #include <linux/pci.h>
 #include <asm/pci-direct.h>
 #include <asm/acpi.h>
+#include <asm/apic.h>
 
 static int __init check_bridge(int vendor, int device)
 {
+#ifdef CONFIG_ACPI
         /* According to Nvidia all timer overrides are bogus. Just ignore
            them all. */
         if (vendor == PCI_VENDOR_ID_NVIDIA) {
                 acpi_skip_timer_override = 1;
         }
+#endif
+        if (vendor == PCI_VENDOR_ID_ATI && timer_over_8254 == 1) {
+                timer_over_8254 = 0;
+                printk(KERN_INFO "ATI board detected. Disabling timer routing "
+                                "over 8254.\n");
+        }
         return 0;
 }
 
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index acd3f1e34ca6..776c90989e06 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -75,8 +75,10 @@ void ack_bad_irq(unsigned int irq)
          * holds up an irq slot - in excessive cases (when multiple
          * unexpected vectors occur) that might lock up the APIC
          * completely.
+         * But only ack when the APIC is enabled -AK
          */
-        ack_APIC_irq();
+        if (cpu_has_apic)
+                ack_APIC_irq();
 }
 
 void __init apic_intr_init(void)
@@ -568,16 +570,18 @@ void __devinit setup_local_APIC(void)
  */
 void lapic_shutdown(void)
 {
+        unsigned long flags;
+
         if (!cpu_has_apic)
                 return;
 
-        local_irq_disable();
+        local_irq_save(flags);
         clear_local_APIC();
 
         if (enabled_via_apicbase)
                 disable_local_APIC();
 
-        local_irq_enable();
+        local_irq_restore(flags);
 }
 
 #ifdef CONFIG_PM
@@ -1303,6 +1307,7 @@ int __init APIC_init_uniprocessor (void)
         if (!cpu_has_apic && APIC_INTEGRATED(apic_version[boot_cpu_physical_apicid])) {
                 printk(KERN_ERR "BIOS bug, local APIC #%d not detected!...\n",
                         boot_cpu_physical_apicid);
+                clear_bit(X86_FEATURE_APIC, boot_cpu_data.x86_capability);
                 return -1;
         }
 
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index 333578a4e91a..0810f81f2a05 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -282,3 +282,11 @@ int __init amd_init_cpu(void)
 }
 
 //early_arch_initcall(amd_init_cpu);
+
+static int __init amd_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_AMD] = NULL;
+        return 0;
+}
+
+late_initcall(amd_exit_cpu);
diff --git a/arch/i386/kernel/cpu/centaur.c b/arch/i386/kernel/cpu/centaur.c
index 0dd92a23d622..f52669ecb93f 100644
--- a/arch/i386/kernel/cpu/centaur.c
+++ b/arch/i386/kernel/cpu/centaur.c
@@ -470,3 +470,11 @@ int __init centaur_init_cpu(void)
 }
 
 //early_arch_initcall(centaur_init_cpu);
+
+static int __init centaur_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_CENTAUR] = NULL;
+        return 0;
+}
+
+late_initcall(centaur_exit_cpu);
diff --git a/arch/i386/kernel/cpu/common.c b/arch/i386/kernel/cpu/common.c
index 15aee26ec2b6..e6bd095ae108 100644
--- a/arch/i386/kernel/cpu/common.c
+++ b/arch/i386/kernel/cpu/common.c
@@ -4,6 +4,7 @@
 #include <linux/smp.h>
 #include <linux/module.h>
 #include <linux/percpu.h>
+#include <linux/bootmem.h>
 #include <asm/semaphore.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
@@ -18,6 +19,9 @@
 
 #include "cpu.h"
 
+DEFINE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
+EXPORT_PER_CPU_SYMBOL(cpu_gdt_descr);
+
 DEFINE_PER_CPU(unsigned char, cpu_16bit_stack[CPU_16BIT_STACK_SIZE]);
 EXPORT_PER_CPU_SYMBOL(cpu_16bit_stack);
 
@@ -44,6 +48,7 @@ static void default_init(struct cpuinfo_x86 * c)
 
 static struct cpu_dev default_cpu = {
         .c_init = default_init,
+        .c_vendor = "Unknown",
 };
 static struct cpu_dev * this_cpu = &default_cpu;
 
@@ -150,6 +155,7 @@ static void __devinit get_cpu_vendor(struct cpuinfo_x86 *c, int early)
 {
         char *v = c->x86_vendor_id;
         int i;
+        static int printed;
 
         for (i = 0; i < X86_VENDOR_NUM; i++) {
                 if (cpu_devs[i]) {
@@ -159,10 +165,17 @@ static void __devinit get_cpu_vendor(struct cpuinfo_x86 *c, int early)
                                 c->x86_vendor = i;
                                 if (!early)
                                         this_cpu = cpu_devs[i];
-                                break;
+                                return;
                         }
                 }
         }
+        if (!printed) {
+                printed++;
+                printk(KERN_ERR "CPU: Vendor unknown, using generic init.\n");
+                printk(KERN_ERR "CPU: Your system may be unstable.\n");
+        }
+        c->x86_vendor = X86_VENDOR_UNKNOWN;
+        this_cpu = &default_cpu;
 }
 
 
@@ -265,10 +278,10 @@ void __devinit generic_identify(struct cpuinfo_x86 * c)
                         c->x86_capability[4] = excap;
                         c->x86 = (tfms >> 8) & 15;
                         c->x86_model = (tfms >> 4) & 15;
-                        if (c->x86 == 0xf) {
+                        if (c->x86 == 0xf)
                                 c->x86 += (tfms >> 20) & 0xff;
+                        if (c->x86 >= 0x6)
                                 c->x86_model += ((tfms >> 16) & 0xF) << 4;
-                        } 
                         c->x86_mask = tfms & 15;
                 } else {
                         /* Have CPUID level 0 only - unheard of */
@@ -562,8 +575,9 @@ void __devinit cpu_init(void)
         int cpu = smp_processor_id();
         struct tss_struct * t = &per_cpu(init_tss, cpu);
         struct thread_struct *thread = &current->thread;
-        struct desc_struct *gdt = get_cpu_gdt_table(cpu);
+        struct desc_struct *gdt;
         __u32 stk16_off = (__u32)&per_cpu(cpu_16bit_stack, cpu);
+        struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, cpu);
 
         if (cpu_test_and_set(cpu, cpu_initialized)) {
                 printk(KERN_WARNING "CPU#%d already initialized!\n", cpu);
@@ -581,6 +595,25 @@ void __devinit cpu_init(void)
         }
 
         /*
+         * This is a horrible hack to allocate the GDT.  The problem
+         * is that cpu_init() is called really early for the boot CPU
+         * (and hence needs bootmem) but much later for the secondary
+         * CPUs, when bootmem will have gone away
+         */
+        if (NODE_DATA(0)->bdata->node_bootmem_map) {
+                gdt = (struct desc_struct *)alloc_bootmem_pages(PAGE_SIZE);
+                /* alloc_bootmem_pages panics on failure, so no check */
+                memset(gdt, 0, PAGE_SIZE);
+        } else {
+                gdt = (struct desc_struct *)get_zeroed_page(GFP_KERNEL);
+                if (unlikely(!gdt)) {
+                        printk(KERN_CRIT "CPU%d failed to allocate GDT\n", cpu);
+                        for (;;)
+                                local_irq_enable();
+                }
+        }
+
+        /*
          * Initialize the per-CPU GDT with the boot GDT,
          * and set up the GDT descriptor:
          */
@@ -592,10 +625,10 @@ void __devinit cpu_init(void)
                 ((((__u64)stk16_off) << 32) & 0xff00000000000000ULL) |
                 (CPU_16BIT_STACK_SIZE - 1);
 
-        cpu_gdt_descr[cpu].size = GDT_SIZE - 1;
-        cpu_gdt_descr[cpu].address = (unsigned long)gdt;
+        cpu_gdt_descr->size = GDT_SIZE - 1;
+        cpu_gdt_descr->address = (unsigned long)gdt;
 
-        load_gdt(&cpu_gdt_descr[cpu]);
+        load_gdt(cpu_gdt_descr);
         load_idt(&idt_descr);
 
         /*
diff --git a/arch/i386/kernel/cpu/cyrix.c b/arch/i386/kernel/cpu/cyrix.c
index 75015975d038..00f2e058797c 100644
--- a/arch/i386/kernel/cpu/cyrix.c
+++ b/arch/i386/kernel/cpu/cyrix.c
@@ -345,7 +345,7 @@ static void __init init_cyrix(struct cpuinfo_x86 *c)
 /*
  * Handle National Semiconductor branded processors
  */
-static void __devinit init_nsc(struct cpuinfo_x86 *c)
+static void __init init_nsc(struct cpuinfo_x86 *c)
 {
         /* There may be GX1 processors in the wild that are branded
          * NSC and not Cyrix.
@@ -444,6 +444,14 @@ int __init cyrix_init_cpu(void)
 
 //early_arch_initcall(cyrix_init_cpu);
 
+static int __init cyrix_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_CYRIX] = NULL;
+        return 0;
+}
+
+late_initcall(cyrix_exit_cpu);
+
 static struct cpu_dev nsc_cpu_dev __initdata = {
         .c_vendor       = "NSC",
         .c_ident        = { "Geode by NSC" },
@@ -458,3 +466,11 @@ int __init nsc_init_cpu(void)
 }
 
 //early_arch_initcall(nsc_init_cpu);
+
+static int __init nsc_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_NSC] = NULL;
+        return 0;
+}
+
+late_initcall(nsc_exit_cpu);
diff --git a/arch/i386/kernel/cpu/intel_cacheinfo.c b/arch/i386/kernel/cpu/intel_cacheinfo.c
index af591c73345f..ffe58cee0c48 100644
--- a/arch/i386/kernel/cpu/intel_cacheinfo.c
+++ b/arch/i386/kernel/cpu/intel_cacheinfo.c
@@ -152,6 +152,7 @@ static int __cpuinit cpuid4_cache_lookup(int index, struct _cpuid4_info *this_le
         return 0;
 }
 
+/* will only be called once; __init is safe here */
 static int __init find_num_cache_leaves(void)
 {
         unsigned int            eax, ebx, ecx, edx;
diff --git a/arch/i386/kernel/cpu/nexgen.c b/arch/i386/kernel/cpu/nexgen.c
index 30898a260a5c..ad87fa58058d 100644
--- a/arch/i386/kernel/cpu/nexgen.c
+++ b/arch/i386/kernel/cpu/nexgen.c
@@ -61,3 +61,11 @@ int __init nexgen_init_cpu(void)
 }
 
 //early_arch_initcall(nexgen_init_cpu);
+
+static int __init nexgen_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_NEXGEN] = NULL;
+        return 0;
+}
+
+late_initcall(nexgen_exit_cpu);
diff --git a/arch/i386/kernel/cpu/rise.c b/arch/i386/kernel/cpu/rise.c
index 8602425628ca..d08d5a2811c8 100644
--- a/arch/i386/kernel/cpu/rise.c
+++ b/arch/i386/kernel/cpu/rise.c
@@ -51,3 +51,11 @@ int __init rise_init_cpu(void)
 }
 
 //early_arch_initcall(rise_init_cpu);
+
+static int __init rise_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_RISE] = NULL;
+        return 0;
+}
+
+late_initcall(rise_exit_cpu);
diff --git a/arch/i386/kernel/cpu/transmeta.c b/arch/i386/kernel/cpu/transmeta.c
index fc426380366b..7214c9b577ab 100644
--- a/arch/i386/kernel/cpu/transmeta.c
+++ b/arch/i386/kernel/cpu/transmeta.c
@@ -1,4 +1,5 @@
 #include <linux/kernel.h>
+#include <linux/mm.h>
 #include <linux/init.h>
 #include <asm/processor.h>
 #include <asm/msr.h>
@@ -84,7 +85,7 @@ static void __init init_transmeta(struct cpuinfo_x86 *c)
 #endif
 }
 
-static void transmeta_identify(struct cpuinfo_x86 * c)
+static void __init transmeta_identify(struct cpuinfo_x86 * c)
 {
         u32 xlvl;
         generic_identify(c);
@@ -111,3 +112,11 @@ int __init transmeta_init_cpu(void)
 }
 
 //early_arch_initcall(transmeta_init_cpu);
+
+static int __init transmeta_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_TRANSMETA] = NULL;
+        return 0;
+}
+
+late_initcall(transmeta_exit_cpu);
diff --git a/arch/i386/kernel/cpu/umc.c b/arch/i386/kernel/cpu/umc.c
index 264fcad559d5..2cd988f6dc55 100644
--- a/arch/i386/kernel/cpu/umc.c
+++ b/arch/i386/kernel/cpu/umc.c
@@ -31,3 +31,11 @@ int __init umc_init_cpu(void)
 }
 
 //early_arch_initcall(umc_init_cpu);
+
+static int __init umc_exit_cpu(void)
+{
+        cpu_devs[X86_VENDOR_UMC] = NULL;
+        return 0;
+}
+
+late_initcall(umc_exit_cpu);
diff --git a/arch/i386/kernel/efi.c b/arch/i386/kernel/efi.c
index ecad519fd395..c9cad7ba0d2d 100644
--- a/arch/i386/kernel/efi.c
+++ b/arch/i386/kernel/efi.c
@@ -70,10 +70,13 @@ static void efi_call_phys_prelog(void)
 {
         unsigned long cr4;
         unsigned long temp;
+        struct Xgt_desc_struct *cpu_gdt_descr;
 
         spin_lock(&efi_rt_lock);
         local_irq_save(efi_rt_eflags);
 
+        cpu_gdt_descr = &per_cpu(cpu_gdt_descr, 0);
+
         /*
          * If I don't have PSE, I should just duplicate two entries in page
          * directory. If I have PSE, I just need to duplicate one entry in
@@ -103,17 +106,18 @@ static void efi_call_phys_prelog(void)
          */
         local_flush_tlb();
 
-        cpu_gdt_descr[0].address = __pa(cpu_gdt_descr[0].address);
-        load_gdt((struct Xgt_desc_struct *) __pa(&cpu_gdt_descr[0]));
+        cpu_gdt_descr->address = __pa(cpu_gdt_descr->address);
+        load_gdt(cpu_gdt_descr);
 }
 
 static void efi_call_phys_epilog(void)
 {
         unsigned long cr4;
+        struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, 0);
+
+        cpu_gdt_descr->address = __va(cpu_gdt_descr->address);
+        load_gdt(cpu_gdt_descr);
 
-        cpu_gdt_descr[0].address =
-                (unsigned long) __va(cpu_gdt_descr[0].address);
-        load_gdt(&cpu_gdt_descr[0]);
         cr4 = read_cr4();
 
         if (cr4 & X86_CR4_PSE) {
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index 5884469f6bfe..e0b7c632efbc 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -398,7 +398,11 @@ ignore_int:
         pushl 32(%esp)
         pushl 40(%esp)
         pushl $int_msg
+#ifdef CONFIG_EARLY_PRINTK
+        call early_printk
+#else
         call printk
+#endif
         addl $(5*4),%esp
         popl %ds
         popl %es
@@ -530,5 +534,3 @@ ENTRY(cpu_gdt_table)
         .quad 0x0000000000000000        /* 0xf0 - unused */
         .quad 0x0000000000000000        /* 0xf8 - GDT entry 31: double-fault TSS */
 
-        /* Be sure this is zeroed to avoid false validations in Xen */
-        .fill PAGE_SIZE_asm / 8 - GDT_ENTRIES,8,0
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index 3999bec50c33..055325056a74 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -3,8 +3,6 @@
 #include <asm/checksum.h>
 #include <asm/desc.h>
 
-EXPORT_SYMBOL_GPL(cpu_gdt_descr);
-
 EXPORT_SYMBOL(__down_failed);
 EXPORT_SYMBOL(__down_failed_interruptible);
 EXPORT_SYMBOL(__down_failed_trylock);
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index f2dd218d88cb..39d9a5fa907e 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -51,6 +51,8 @@ static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
 static DEFINE_SPINLOCK(ioapic_lock);
 
+int timer_over_8254 __initdata = 1;
+
 /*
  *      Is the SiS APIC rmw bug present ?
  *      -1 = don't know, 0 = no, 1 = yes
@@ -2267,7 +2269,8 @@ static inline void check_timer(void)
         apic_write_around(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
         init_8259A(1);
         timer_ack = 1;
-        enable_8259A_irq(0);
+        if (timer_over_8254 > 0)
+                enable_8259A_irq(0);
 
         pin1  = find_isa_irq_pin(0, mp_INT);
         apic1 = find_isa_irq_apic(0, mp_INT);
@@ -2392,6 +2395,20 @@ void __init setup_IO_APIC(void)
                 print_IO_APIC();
 }
 
+static int __init setup_disable_8254_timer(char *s)
+{
+        timer_over_8254 = -1;
+        return 1;
+}
+static int __init setup_enable_8254_timer(char *s)
+{
+        timer_over_8254 = 2;
+        return 1;
+}
+
+__setup("disable_8254_timer", setup_disable_8254_timer);
+__setup("enable_8254_timer", setup_enable_8254_timer);
+
 /*
  *      Called after all the initialization is done. If we didnt find any
  *      APIC bugs then we can allow the modify fast path
@@ -2566,8 +2583,10 @@ int __init io_apic_get_unique_id (int ioapic, int apic_id)
                 spin_unlock_irqrestore(&ioapic_lock, flags);
 
                 /* Sanity check */
-                if (reg_00.bits.ID != apic_id)
-                        panic("IOAPIC[%d]: Unable change apic_id!\n", ioapic);
+                if (reg_00.bits.ID != apic_id) {
+                        printk("IOAPIC[%d]: Unable to change apic_id!\n", ioapic);
+                        return -1;
+                }
         }
 
         apic_printk(APIC_VERBOSE, KERN_INFO
diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index 6483eeb1a4e8..694a13997637 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -58,6 +58,11 @@ static inline int is_IF_modifier(kprobe_opcode_t opcode)
 
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 {
+        /* insn: must be on special executable page on i386. */
+        p->ainsn.insn = get_insn_slot();
+        if (!p->ainsn.insn)
+                return -ENOMEM;
+
         memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
         p->opcode = *p->addr;
         return 0;
@@ -77,6 +82,13 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
                            (unsigned long) p->addr + sizeof(kprobe_opcode_t));
 }
 
+void __kprobes arch_remove_kprobe(struct kprobe *p)
+{
+        down(&kprobe_mutex);
+        free_insn_slot(p->ainsn.insn);
+        up(&kprobe_mutex);
+}
+
 static inline void save_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
         kcb->prev_kprobe.kp = kprobe_running();
@@ -111,7 +123,7 @@ static inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
         if (p->opcode == BREAKPOINT_INSTRUCTION)
                 regs->eip = (unsigned long)p->addr;
         else
-                regs->eip = (unsigned long)&p->ainsn.insn;
+                regs->eip = (unsigned long)p->ainsn.insn;
 }
 
 /* Called with kretprobe_lock held */
@@ -351,7 +363,7 @@ static void __kprobes resume_execution(struct kprobe *p,
 {
         unsigned long *tos = (unsigned long *)&regs->esp;
         unsigned long next_eip = 0;
-        unsigned long copy_eip = (unsigned long)&p->ainsn.insn;
+        unsigned long copy_eip = (unsigned long)p->ainsn.insn;
         unsigned long orig_eip = (unsigned long)p->addr;
 
         switch (p->ainsn.insn[0]) {
diff --git a/arch/i386/kernel/machine_kexec.c b/arch/i386/kernel/machine_kexec.c
index a912fed48482..f73d7374a2ba 100644
--- a/arch/i386/kernel/machine_kexec.c
+++ b/arch/i386/kernel/machine_kexec.c
@@ -116,13 +116,13 @@ static void load_segments(void)
         __asm__ __volatile__ (
                 "\tljmp $"STR(__KERNEL_CS)",$1f\n"
                 "\t1:\n"
-                "\tmovl $"STR(__KERNEL_DS)",%eax\n"
-                "\tmovl %eax,%ds\n"
-                "\tmovl %eax,%es\n"
-                "\tmovl %eax,%fs\n"
-                "\tmovl %eax,%gs\n"
-                "\tmovl %eax,%ss\n"
-                );
+                "\tmovl $"STR(__KERNEL_DS)",%%eax\n"
+                "\tmovl %%eax,%%ds\n"
+                "\tmovl %%eax,%%es\n"
+                "\tmovl %%eax,%%fs\n"
+                "\tmovl %%eax,%%gs\n"
+                "\tmovl %%eax,%%ss\n"
+                ::: "eax", "memory");
 #undef STR
 #undef __STR
 }
diff --git a/arch/i386/kernel/microcode.c b/arch/i386/kernel/microcode.c
index d3fdf0057d82..5390b521aca0 100644
--- a/arch/i386/kernel/microcode.c
+++ b/arch/i386/kernel/microcode.c
@@ -74,6 +74,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/sched.h>
+#include <linux/cpumask.h>
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
@@ -250,8 +251,8 @@ static int find_matching_ucodes (void)
                         error = -EINVAL;
                         goto out;
                 }
-                
-                for (cpu_num = 0; cpu_num < num_online_cpus(); cpu_num++) {
+
+                for_each_online_cpu(cpu_num) {
                         struct ucode_cpu_info *uci = ucode_cpu_info + cpu_num;
                         if (uci->err != MC_NOTFOUND) /* already found a match or not an online cpu*/
                                 continue;
@@ -293,7 +294,7 @@ static int find_matching_ucodes (void)
                                         error = -EFAULT;
                                         goto out;
                                 }
-                                for (cpu_num = 0; cpu_num < num_online_cpus(); cpu_num++) {
+                                for_each_online_cpu(cpu_num) {
                                         struct ucode_cpu_info *uci = ucode_cpu_info + cpu_num;
                                         if (uci->err != MC_NOTFOUND) /* already found a match or not an online cpu*/
                                                 continue;
@@ -304,7 +305,9 @@ static int find_matching_ucodes (void)
                         }
                 }
                 /* now check if any cpu has matched */
-                for (cpu_num = 0, allocated_flag = 0, sum = 0; cpu_num < num_online_cpus(); cpu_num++) {
+                allocated_flag = 0;
+                sum = 0;
+                for_each_online_cpu(cpu_num) {
                         if (ucode_cpu_info[cpu_num].err == MC_MARKED) { 
                                 struct ucode_cpu_info *uci = ucode_cpu_info + cpu_num;
                                 if (!allocated_flag) {
@@ -415,12 +418,12 @@ static int do_microcode_update (void)
         }
 
 out_free:
-        for (i = 0; i < num_online_cpus(); i++) {
+        for_each_online_cpu(i) {
                 if (ucode_cpu_info[i].mc) {
                         int j;
                         void *tmp = ucode_cpu_info[i].mc;
                         vfree(tmp);
-                        for (j = i; j < num_online_cpus(); j++) {
+                        for_each_online_cpu(j) {
                                 if (ucode_cpu_info[j].mc == tmp)
                                         ucode_cpu_info[j].mc = NULL;
                         }
diff --git a/arch/i386/kernel/mpparse.c b/arch/i386/kernel/mpparse.c
index 0102f3d50e57..e6e2f43db85e 100644
--- a/arch/i386/kernel/mpparse.c
+++ b/arch/i386/kernel/mpparse.c
@@ -710,7 +710,7 @@ void __init get_smp_config (void)
                  * Read the physical hardware table.  Anything here will
                  * override the defaults.
                  */
-                if (!smp_read_mpc((void *)mpf->mpf_physptr)) {
+                if (!smp_read_mpc(phys_to_virt(mpf->mpf_physptr))) {
                         smp_found_config = 0;
                         printk(KERN_ERR "BIOS bug, MP table errors detected!...\n");
                         printk(KERN_ERR "... disabling SMP support. (tell your hw vendor)\n");
@@ -915,6 +915,7 @@ void __init mp_register_ioapic (
         u32                     gsi_base)
 {
         int                     idx = 0;
+        int                     tmpid;
 
         if (nr_ioapics >= MAX_IO_APICS) {
                 printk(KERN_ERR "ERROR: Max # of I/O APICs (%d) exceeded "
@@ -935,9 +936,14 @@ void __init mp_register_ioapic (
 
         set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
         if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) && (boot_cpu_data.x86 < 15))
-                mp_ioapics[idx].mpc_apicid = io_apic_get_unique_id(idx, id);
+                tmpid = io_apic_get_unique_id(idx, id);
         else
-                mp_ioapics[idx].mpc_apicid = id;
+                tmpid = id;
+        if (tmpid == -1) {
+                nr_ioapics--;
+                return;
+        }
+        mp_ioapics[idx].mpc_apicid = tmpid;
         mp_ioapics[idx].mpc_apicver = io_apic_get_version(idx);
         
         /* 
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index d661703ac1cb..be87c5e2ee95 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -138,7 +138,7 @@ static int __init check_nmi_watchdog(void)
         if (nmi_watchdog == NMI_LOCAL_APIC)
                 smp_call_function(nmi_cpu_busy, (void *)&endflag, 0, 0);
 
-        for (cpu = 0; cpu < NR_CPUS; cpu++)
+        for_each_cpu(cpu)
                 prev_nmi_count[cpu] = per_cpu(irq_stat, cpu).__nmi_count;
         local_irq_enable();
         mdelay((10*1000)/nmi_hz); // wait 10 ticks
@@ -357,7 +357,7 @@ static void clear_msr_range(unsigned int base, unsigned int n)
                 wrmsr(base+i, 0, 0);
 }
 
-static inline void write_watchdog_counter(const char *descr)
+static void write_watchdog_counter(const char *descr)
 {
         u64 count = (u64)cpu_khz * 1000;
 
@@ -544,7 +544,7 @@ void nmi_watchdog_tick (struct pt_regs * regs)
                          * die_nmi will return ONLY if NOTIFY_STOP happens..
                          */
                         die_nmi(regs, "NMI Watchdog detected LOCKUP");
-
+        } else {
                 last_irq_sums[cpu] = sum;
                 alert_counter[cpu] = 0;
         }
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index 2185377fdde1..0480454ebffa 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -297,8 +297,10 @@ void show_regs(struct pt_regs * regs)
 
         if (user_mode(regs))
                 printk(" ESP: %04x:%08lx",0xffff & regs->xss,regs->esp);
-        printk(" EFLAGS: %08lx    %s  (%s)\n",
-               regs->eflags, print_tainted(), system_utsname.release);
+        printk(" EFLAGS: %08lx    %s  (%s %.*s)\n",
+               regs->eflags, print_tainted(), system_utsname.release,
+               (int)strcspn(system_utsname.version, " "),
+               system_utsname.version);
         printk("EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
                 regs->eax,regs->ebx,regs->ecx,regs->edx);
         printk("ESI: %08lx EDI: %08lx EBP: %08lx",
diff --git a/arch/i386/kernel/setup.c b/arch/i386/kernel/setup.c
index 51e513b4f72d..ab62a9f4701e 100644
--- a/arch/i386/kernel/setup.c
+++ b/arch/i386/kernel/setup.c
@@ -1599,6 +1599,10 @@ void __init setup_arch(char **cmdline_p)
         if (efi_enabled)
                 efi_map_memmap();
 
+#ifdef CONFIG_X86_IO_APIC
+        check_acpi_pci();       /* Checks more than just ACPI actually */
+#endif
+
 #ifdef CONFIG_ACPI
         /*
          * Parse the ACPI tables for possible boot-time SMP configuration.
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index 255adb498268..7007e1783797 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -87,11 +87,7 @@ EXPORT_SYMBOL(cpu_online_map);
 cpumask_t cpu_callin_map;
 cpumask_t cpu_callout_map;
 EXPORT_SYMBOL(cpu_callout_map);
-#ifdef CONFIG_HOTPLUG_CPU
-cpumask_t cpu_possible_map = CPU_MASK_ALL;
-#else
 cpumask_t cpu_possible_map;
-#endif
 EXPORT_SYMBOL(cpu_possible_map);
 static cpumask_t smp_commenced_mask;
 
@@ -902,12 +898,6 @@ static int __devinit do_boot_cpu(int apicid, int cpu)
         unsigned long start_eip;
         unsigned short nmi_high = 0, nmi_low = 0;
 
-        if (!cpu_gdt_descr[cpu].address &&
-            !(cpu_gdt_descr[cpu].address = get_zeroed_page(GFP_KERNEL))) {
-                printk("Failed to allocate GDT for CPU %d\n", cpu);
-                return 1;
-        }
-
         ++cpucount;
 
         /*
@@ -1039,6 +1029,16 @@ int __devinit smp_prepare_cpu(int cpu)
         int     apicid, ret;
 
         lock_cpu_hotplug();
+
+        /*
+         * On x86, CPU0 is never offlined.  Trying to bring up an
+         * already-booted CPU will hang.  So check for that case.
+         */
+        if (cpu_online(cpu)) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
         apicid = x86_cpu_to_apicid[cpu];
         if (apicid == BAD_APICID) {
                 ret = -ENODEV;
diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
index 1b665928336b..ac687d00a1ce 100644
--- a/arch/i386/kernel/syscall_table.S
+++ b/arch/i386/kernel/syscall_table.S
@@ -299,7 +299,7 @@ ENTRY(sys_call_table)
         .long sys_mknodat
         .long sys_fchownat
         .long sys_futimesat
-        .long sys_newfstatat            /* 300 */
+        .long sys_fstatat64             /* 300 */
         .long sys_unlinkat
         .long sys_renameat
         .long sys_linkat
@@ -309,3 +309,4 @@ ENTRY(sys_call_table)
         .long sys_faccessat
         .long sys_pselect6
         .long sys_ppoll
+        .long sys_unshare               /* 310 */
diff --git a/arch/i386/kernel/time.c b/arch/i386/kernel/time.c
index a14d594bfbeb..9d3074759856 100644
--- a/arch/i386/kernel/time.c
+++ b/arch/i386/kernel/time.c
@@ -412,9 +412,9 @@ static int timer_resume(struct sys_device *dev)
         write_seqlock_irqsave(&xtime_lock, flags);
         xtime.tv_sec = sec;
         xtime.tv_nsec = 0;
-        write_sequnlock_irqrestore(&xtime_lock, flags);
-        jiffies += sleep_length;
+        jiffies_64 += sleep_length;
         wall_jiffies += sleep_length;
+        write_sequnlock_irqrestore(&xtime_lock, flags);
         if (last_timer->resume)
                 last_timer->resume();
         cur_timer = last_timer;
diff --git a/arch/i386/kernel/timers/timer_tsc.c b/arch/i386/kernel/timers/timer_tsc.c
index 7c86e3c5f1c1..a7f5a2aceba2 100644
--- a/arch/i386/kernel/timers/timer_tsc.c
+++ b/arch/i386/kernel/timers/timer_tsc.c
@@ -282,6 +282,10 @@ time_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
         if (val != CPUFREQ_RESUMECHANGE)
                 write_seqlock_irq(&xtime_lock);
         if (!ref_freq) {
+                if (!freq->old){
+                        ref_freq = freq->new;
+                        goto end;
+                }
                 ref_freq = freq->old;
                 loops_per_jiffy_ref = cpu_data[freq->cpu].loops_per_jiffy;
 #ifndef CONFIG_SMP
@@ -307,6 +311,7 @@ time_cpufreq_notifier(struct notifier_block *nb, unsigned long val,
 #endif
         }
 
+end:
         if (val != CPUFREQ_RESUMECHANGE)
                 write_sequnlock_irq(&xtime_lock);
 
diff --git a/arch/i386/mach-default/topology.c b/arch/i386/kernel/topology.c
index b64314069e78..67a0e1baa28b 100644
--- a/arch/i386/mach-default/topology.c
+++ b/arch/i386/kernel/topology.c
@@ -1,12 +1,12 @@
 /*
- * arch/i386/mach-generic/topology.c - Populate driverfs with topology information
+ * arch/i386/kernel/topology.c - Populate driverfs with topology information
  *
  * Written by: Matthew Dobson, IBM Corporation
  * Original Code: Paul Dorwin, IBM Corporation, Patrick Mochel, OSDL
  *
  * Copyright (C) 2002, IBM Corp.
  *
- * All rights reserved.          
+ * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -34,7 +34,7 @@ static struct i386_cpu cpu_devices[NR_CPUS];
 
 int arch_register_cpu(int num){
         struct node *parent = NULL;
-        
+
 #ifdef CONFIG_NUMA
         int node = cpu_to_node(num);
         if (node_online(node))
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 0aaebf3e1cfa..b814dbdcc91e 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -166,7 +166,8 @@ static void show_trace_log_lvl(struct task_struct *task,
                 stack = (unsigned long*)context->previous_esp;
                 if (!stack)
                         break;
-                printk(KERN_EMERG " =======================\n");
+                printk(log_lvl);
+                printk(" =======================\n");
         }
 }
 
@@ -239,9 +240,11 @@ void show_registers(struct pt_regs *regs)
         }
         print_modules();
         printk(KERN_EMERG "CPU:    %d\nEIP:    %04x:[<%08lx>]    %s VLI\n"
-                        "EFLAGS: %08lx   (%s) \n",
+                        "EFLAGS: %08lx   (%s %.*s) \n",
                 smp_processor_id(), 0xffff & regs->xcs, regs->eip,
-                print_tainted(), regs->eflags, system_utsname.release);
+                print_tainted(), regs->eflags, system_utsname.release,
+                (int)strcspn(system_utsname.version, " "),
+                system_utsname.version);
         print_symbol(KERN_EMERG "EIP is at %s\n", regs->eip);
         printk(KERN_EMERG "eax: %08lx   ebx: %08lx   ecx: %08lx   edx: %08lx\n",
                 regs->eax, regs->ebx, regs->ecx, regs->edx);
diff --git a/arch/i386/kernel/vsyscall-sysenter.S b/arch/i386/kernel/vsyscall-sysenter.S
index 4daefb2ec1b2..76b728159403 100644
--- a/arch/i386/kernel/vsyscall-sysenter.S
+++ b/arch/i386/kernel/vsyscall-sysenter.S
@@ -7,6 +7,21 @@
  *    for details.
  */
 
+/*
+ * The caller puts arg2 in %ecx, which gets pushed. The kernel will use
+ * %ecx itself for arg2. The pushing is because the sysexit instruction
+ * (found in entry.S) requires that we clobber %ecx with the desired %esp.
+ * User code might expect that %ecx is unclobbered though, as it would be
+ * for returning via the iret instruction, so we must push and pop.
+ *
+ * The caller puts arg3 in %edx, which the sysexit instruction requires
+ * for %eip. Thus, exactly as for arg2, we must push and pop.
+ *
+ * Arg6 is different. The caller puts arg6 in %ebp. Since the sysenter
+ * instruction clobbers %esp, the user's %esp won't even survive entry
+ * into the kernel. We store %esp in %ebp. Code in entry.S must fetch
+ * arg6 from the stack.
+ */
         .text
         .globl __kernel_vsyscall
         .type __kernel_vsyscall,@function
diff --git a/arch/i386/mach-default/Makefile b/arch/i386/mach-default/Makefile
index e95bb0237921..012fe34459e6 100644
--- a/arch/i386/mach-default/Makefile
+++ b/arch/i386/mach-default/Makefile
@@ -2,4 +2,4 @@
 # Makefile for the linux kernel.
 #
 
-obj-y                           := setup.o topology.o
+obj-y                           := setup.o
diff --git a/arch/i386/mach-voyager/voyager_basic.c b/arch/i386/mach-voyager/voyager_basic.c
index aa49a33a572c..b584060ec004 100644
--- a/arch/i386/mach-voyager/voyager_basic.c
+++ b/arch/i386/mach-voyager/voyager_basic.c
@@ -23,6 +23,8 @@
 #include <linux/delay.h>
 #include <linux/reboot.h>
 #include <linux/sysrq.h>
+#include <linux/smp.h>
+#include <linux/nodemask.h>
 #include <asm/io.h>
 #include <asm/voyager.h>
 #include <asm/vic.h>
@@ -328,4 +330,3 @@ void machine_power_off(void)
         if (pm_power_off)
                 pm_power_off();
 }
-
diff --git a/arch/i386/mach-voyager/voyager_smp.c b/arch/i386/mach-voyager/voyager_smp.c
index 72a1b9cae2e4..8165626a5c30 100644
--- a/arch/i386/mach-voyager/voyager_smp.c
+++ b/arch/i386/mach-voyager/voyager_smp.c
@@ -240,7 +240,7 @@ static cpumask_t smp_commenced_mask = CPU_MASK_NONE;
 cpumask_t cpu_callin_map = CPU_MASK_NONE;
 cpumask_t cpu_callout_map = CPU_MASK_NONE;
 EXPORT_SYMBOL(cpu_callout_map);
-cpumask_t cpu_possible_map = CPU_MASK_ALL;
+cpumask_t cpu_possible_map = CPU_MASK_NONE;
 EXPORT_SYMBOL(cpu_possible_map);
 
 /* The per processor IRQ masks (these are usually kept in sync) */
@@ -402,6 +402,7 @@ find_smp_config(void)
         cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 1) << 8;
         cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 2) << 16;
         cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 3) << 24;
+        cpu_possible_map = phys_cpu_present_map;
         printk("VOYAGER SMP: phys_cpu_present_map = 0x%lx\n", cpus_addr(phys_cpu_present_map)[0]);
         /* Here we set up the VIC to enable SMP */
         /* enable the CPIs by writing the base vector to their register */
diff --git a/arch/i386/oprofile/backtrace.c b/arch/i386/oprofile/backtrace.c
index acc18138fb22..c049ce414f01 100644
--- a/arch/i386/oprofile/backtrace.c
+++ b/arch/i386/oprofile/backtrace.c
@@ -20,7 +20,20 @@ struct frame_head {
 } __attribute__((packed));
 
 static struct frame_head *
-dump_backtrace(struct frame_head * head)
+dump_kernel_backtrace(struct frame_head * head)
+{
+        oprofile_add_trace(head->ret);
+
+        /* frame pointers should strictly progress back up the stack
+         * (towards higher addresses) */
+        if (head >= head->ebp)
+                return NULL;
+
+        return head->ebp;
+}
+
+static struct frame_head *
+dump_user_backtrace(struct frame_head * head)
 {
         struct frame_head bufhead[2];
 
@@ -105,10 +118,10 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
 
         if (!user_mode_vm(regs)) {
                 while (depth-- && valid_kernel_stack(head, regs))
-                        head = dump_backtrace(head);
+                        head = dump_kernel_backtrace(head);
                 return;
         }
 
         while (depth-- && head)
-                head = dump_backtrace(head);
+                head = dump_user_backtrace(head);
 }
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 199eeaf0f4e3..a85ea9d37f05 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -194,7 +194,6 @@ config IA64_L1_CACHE_SHIFT
         default "7" if MCKINLEY
         default "6" if ITANIUM
 
-# align cache-sensitive data to 64 bytes
 config IA64_CYCLONE
         bool "Cyclone (EXA) Time Source support"
         help
@@ -374,6 +373,9 @@ config IA64_PALINFO
           To use this option, you have to ensure that the "/proc file system
           support" (CONFIG_PROC_FS) is enabled, too.
 
+config SGI_SN
+        def_bool y if (IA64_SGI_SN2 || IA64_GENERIC)
+
 source "drivers/firmware/Kconfig"
 
 source "fs/Kconfig.binfmt"
@@ -451,6 +453,7 @@ source "arch/ia64/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/ia64/configs/bigsur_defconfig b/arch/ia64/configs/bigsur_defconfig
index b40672bb3ab0..90e9c2e61bf4 100644
--- a/arch/ia64/configs/bigsur_defconfig
+++ b/arch/ia64/configs/bigsur_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc1
-# Wed Sep 14 15:18:49 2005
+# Linux kernel version: 2.6.16-rc5
+# Mon Feb 27 16:10:42 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -23,17 +22,18 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -42,8 +42,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -58,17 +60,36 @@ CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 CONFIG_IA64=y
 CONFIG_64BIT=y
 CONFIG_MMU=y
+CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
 CONFIG_IA64_DIG=y
 # CONFIG_IA64_HP_ZX1 is not set
@@ -81,18 +102,17 @@ CONFIG_ITANIUM=y
 # CONFIG_IA64_PAGE_SIZE_8KB is not set
 CONFIG_IA64_PAGE_SIZE_16KB=y
 # CONFIG_IA64_PAGE_SIZE_64KB is not set
+CONFIG_PGTABLE_3=y
+# CONFIG_PGTABLE_4 is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_IA64_BRL_EMU=y
 CONFIG_IA64_L1_CACHE_SHIFT=6
-# CONFIG_NUMA is not set
-# CONFIG_VIRTUAL_MEM_MAP is not set
 # CONFIG_IA64_CYCLONE is not set
 CONFIG_IOSAPIC=y
-# CONFIG_IA64_SGI_SN_XP is not set
-CONFIG_FORCE_MAX_ZONEORDER=18
+CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
 CONFIG_NR_CPUS=2
 # CONFIG_HOTPLUG_CPU is not set
@@ -105,7 +125,12 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_HAVE_DEC_LOCK=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+# CONFIG_VIRTUAL_MEM_MAP is not set
 CONFIG_IA32_SUPPORT=y
 CONFIG_COMPAT=y
 # CONFIG_IA64_MCA_RECOVERY is not set
@@ -117,7 +142,6 @@ CONFIG_IA64_PALINFO=y
 #
 CONFIG_EFI_VARS=y
 CONFIG_EFI_PCDP=y
-# CONFIG_DELL_RBU is not set
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=m
 
@@ -125,6 +149,7 @@ CONFIG_BINFMT_MISC=m
 # Power management and ACPI
 #
 CONFIG_PM=y
+CONFIG_PM_LEGACY=y
 # CONFIG_PM_DEBUG is not set
 
 #
@@ -137,6 +162,7 @@ CONFIG_ACPI_PROCESSOR=m
 CONFIG_ACPI_THERMAL=m
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 # CONFIG_ACPI_CONTAINER is not set
@@ -173,6 +199,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -206,6 +233,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -218,14 +250,16 @@ CONFIG_TCP_CONG_BIC=y
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NETFILTER_NETLINK is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -286,20 +320,13 @@ CONFIG_BLK_DEV_RAM=m
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=m
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=m
 
 #
@@ -390,6 +417,7 @@ CONFIG_SCSI_SPI_ATTRS=m
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -399,6 +427,7 @@ CONFIG_SCSI_SPI_ATTRS=m
 # CONFIG_SCSI_AIC79XX is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_SATA is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
@@ -409,14 +438,7 @@ CONFIG_SCSI_SPI_ATTRS=m
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 CONFIG_SCSI_QLOGIC_1280=y
-# CONFIG_SCSI_QLOGIC_1280_1040 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -448,6 +470,7 @@ CONFIG_DM_ZERO=m
 # CONFIG_FUSION is not set
 # CONFIG_FUSION_SPI is not set
 # CONFIG_FUSION_FC is not set
+# CONFIG_FUSION_SAS is not set
 
 #
 # IEEE 1394 (FireWire) support
@@ -486,6 +509,7 @@ CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
 
 #
@@ -524,6 +548,7 @@ CONFIG_EEPRO100=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
@@ -630,6 +655,7 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_ACPI=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
@@ -681,6 +707,7 @@ CONFIG_DRM_R128=m
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -731,12 +758,19 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_SENSORS_PCF8591 is not set
 # CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -754,6 +788,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_FSCPOS is not set
 # CONFIG_SENSORS_GL518SM is not set
@@ -775,6 +810,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
 # CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT8231 is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83792D is not set
 # CONFIG_SENSORS_W83L785TS is not set
@@ -830,6 +866,8 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 # CONFIG_SND_SEQUENCER_OSS is not set
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -837,17 +875,18 @@ CONFIG_SND_PCM_OSS=m
 # Generic devices
 #
 CONFIG_SND_OPL3_LIB=m
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_AC97_BUS=m
 # CONFIG_SND_DUMMY is not set
 # CONFIG_SND_VIRMIDI is not set
 # CONFIG_SND_MTPAV is not set
 # CONFIG_SND_SERIAL_U16550 is not set
 # CONFIG_SND_MPU401 is not set
-CONFIG_SND_AC97_CODEC=m
-CONFIG_SND_AC97_BUS=m
 
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -856,38 +895,38 @@ CONFIG_SND_AC97_BUS=m
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 CONFIG_SND_CS4281=m
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # USB devices
@@ -929,12 +968,15 @@ CONFIG_USB_UHCI_HCD=m
 # USB Device Class drivers
 #
 # CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
-CONFIG_USB_BLUETOOTH_TTY=m
 CONFIG_USB_ACM=m
 CONFIG_USB_PRINTER=m
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
@@ -946,13 +988,15 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
-# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=m
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 
@@ -972,6 +1016,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1046,7 +1091,7 @@ CONFIG_USB_MON=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS)
 #
 
 #
@@ -1071,6 +1116,7 @@ CONFIG_XFS_QUOTA=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1111,6 +1157,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1153,6 +1200,7 @@ CONFIG_RPCSEC_GSS_KRB5=m
 # CONFIG_SMB_FS is not set
 CONFIG_CIFS=m
 CONFIG_CIFS_STATS=y
+# CONFIG_CIFS_STATS2 is not set
 CONFIG_CIFS_XATTR=y
 CONFIG_CIFS_POSIX=y
 # CONFIG_CIFS_EXPERIMENTAL is not set
@@ -1179,6 +1227,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_SGI_PARTITION=y
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1237,28 +1286,32 @@ CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
 
 #
-# Profiling support
+# Instrumentation Support
 #
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=y
+# CONFIG_KPROBES is not set
 
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 CONFIG_DEBUG_PREEMPT=y
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
-# CONFIG_KPROBES is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_IA64_GRANULE_16MB is not set
 CONFIG_IA64_GRANULE_64MB=y
 # CONFIG_IA64_PRINT_HAZARDS is not set
diff --git a/arch/ia64/configs/gensparse_defconfig b/arch/ia64/configs/gensparse_defconfig
index 991c07b57c24..744fd2f79f61 100644
--- a/arch/ia64/configs/gensparse_defconfig
+++ b/arch/ia64/configs/gensparse_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc2
-# Wed Sep 28 08:27:29 2005
+# Linux kernel version: 2.6.16-rc5
+# Thu Mar  2 16:39:10 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -23,18 +22,19 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -43,8 +43,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -59,17 +61,36 @@ CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 CONFIG_IA64=y
 CONFIG_64BIT=y
 CONFIG_MMU=y
+CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_DMA_IS_DMA32=y
 CONFIG_IA64_GENERIC=y
 # CONFIG_IA64_DIG is not set
 # CONFIG_IA64_HP_ZX1 is not set
@@ -82,6 +103,8 @@ CONFIG_MCKINLEY=y
 # CONFIG_IA64_PAGE_SIZE_8KB is not set
 CONFIG_IA64_PAGE_SIZE_16KB=y
 # CONFIG_IA64_PAGE_SIZE_64KB is not set
+CONFIG_PGTABLE_3=y
+# CONFIG_PGTABLE_4 is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
@@ -105,6 +128,9 @@ CONFIG_NEED_MULTIPLE_NODES=y
 CONFIG_HAVE_MEMORY_PRESENT=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_EXTREME=y
+# CONFIG_MEMORY_HOTPLUG is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
@@ -117,13 +143,13 @@ CONFIG_COMPAT=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_PERFMON=y
 CONFIG_IA64_PALINFO=y
+CONFIG_SGI_SN=y
 
 #
 # Firmware Drivers
 #
 CONFIG_EFI_VARS=y
 CONFIG_EFI_PCDP=y
-# CONFIG_DELL_RBU is not set
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=m
 
@@ -131,6 +157,7 @@ CONFIG_BINFMT_MISC=m
 # Power management and ACPI
 #
 CONFIG_PM=y
+CONFIG_PM_LEGACY=y
 # CONFIG_PM_DEBUG is not set
 
 #
@@ -145,6 +172,7 @@ CONFIG_ACPI_THERMAL=m
 CONFIG_ACPI_NUMA=y
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 CONFIG_ACPI_CONTAINER=m
@@ -187,6 +215,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -221,6 +250,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -233,8 +267,11 @@ CONFIG_TCP_CONG_BIC=y
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -275,7 +312,13 @@ CONFIG_FW_LOADER=m
 #
 # Plug and Play support
 #
-# CONFIG_PNP is not set
+CONFIG_PNP=y
+# CONFIG_PNP_DEBUG is not set
+
+#
+# Protocols
+#
+CONFIG_PNPACPI=y
 
 #
 # Block devices
@@ -295,20 +338,13 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -327,6 +363,7 @@ CONFIG_BLK_DEV_IDESCSI=m
 # IDE chipset support/bugfixes
 #
 CONFIG_IDE_GENERIC=y
+# CONFIG_BLK_DEV_IDEPNP is not set
 CONFIG_BLK_DEV_IDEPCI=y
 # CONFIG_IDEPCI_SHARE_IRQ is not set
 # CONFIG_BLK_DEV_OFFBOARD is not set
@@ -400,6 +437,7 @@ CONFIG_SCSI_FC_ATTRS=y
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -409,16 +447,19 @@ CONFIG_SCSI_FC_ATTRS=y
 # CONFIG_SCSI_AIC79XX is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
 CONFIG_SCSI_SATA=y
 # CONFIG_SCSI_SATA_AHCI is not set
 # CONFIG_SCSI_SATA_SVW is not set
 # CONFIG_SCSI_ATA_PIIX is not set
 # CONFIG_SCSI_SATA_MV is not set
 # CONFIG_SCSI_SATA_NV is not set
-# CONFIG_SCSI_SATA_PROMISE is not set
+# CONFIG_SCSI_PDC_ADMA is not set
 # CONFIG_SCSI_SATA_QSTOR is not set
+# CONFIG_SCSI_SATA_PROMISE is not set
 # CONFIG_SCSI_SATA_SX4 is not set
 # CONFIG_SCSI_SATA_SIL is not set
+# CONFIG_SCSI_SATA_SIL24 is not set
 # CONFIG_SCSI_SATA_SIS is not set
 # CONFIG_SCSI_SATA_ULI is not set
 # CONFIG_SCSI_SATA_VIA is not set
@@ -436,14 +477,7 @@ CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 CONFIG_SCSI_QLOGIC_1280=y
-# CONFIG_SCSI_QLOGIC_1280_1040 is not set
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -476,6 +510,7 @@ CONFIG_DM_MULTIPATH=m
 CONFIG_FUSION=y
 CONFIG_FUSION_SPI=y
 CONFIG_FUSION_FC=m
+# CONFIG_FUSION_SAS is not set
 CONFIG_FUSION_MAX_SGE=128
 # CONFIG_FUSION_CTL is not set
 
@@ -497,6 +532,7 @@ CONFIG_DUMMY=m
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
 # CONFIG_TUN is not set
+# CONFIG_NET_SB1000 is not set
 
 #
 # ARCnet devices
@@ -515,6 +551,7 @@ CONFIG_NET_ETHERNET=y
 CONFIG_MII=m
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
 
 #
@@ -564,6 +601,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -668,12 +706,15 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
+# CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
@@ -689,6 +730,7 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_ACPI=y
 CONFIG_SERIAL_8250_NR_UARTS=6
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
@@ -738,10 +780,10 @@ CONFIG_DRM_SIS=m
 # CONFIG_DRM_VIA is not set
 # CONFIG_DRM_SAVAGE is not set
 CONFIG_RAW_DRIVER=m
+CONFIG_MAX_RAW_DEVS=256
 CONFIG_HPET=y
 # CONFIG_HPET_RTC_IRQ is not set
 CONFIG_HPET_MMAP=y
-CONFIG_MAX_RAW_DEVS=256
 # CONFIG_HANGCHECK_TIMER is not set
 CONFIG_MMTIMER=y
 
@@ -749,6 +791,7 @@ CONFIG_MMTIMER=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -756,6 +799,12 @@ CONFIG_MMTIMER=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -765,6 +814,7 @@ CONFIG_MMTIMER=y
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
@@ -815,26 +865,28 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 CONFIG_SND_VERBOSE_PRINTK=y
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 
 #
 # Generic devices
 #
 CONFIG_SND_MPU401_UART=m
 CONFIG_SND_OPL3_LIB=m
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_AC97_BUS=m
 CONFIG_SND_DUMMY=m
 CONFIG_SND_VIRMIDI=m
 CONFIG_SND_MTPAV=m
 CONFIG_SND_SERIAL_U16550=m
 CONFIG_SND_MPU401=m
-CONFIG_SND_AC97_CODEC=m
-CONFIG_SND_AC97_BUS=m
 
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -843,40 +895,40 @@ CONFIG_SND_AC97_BUS=m
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
+CONFIG_SND_CS4281=m
 CONFIG_SND_CS46XX=m
 CONFIG_SND_CS46XX_NEW_DSP=y
-CONFIG_SND_CS4281=m
 CONFIG_SND_EMU10K1=m
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 CONFIG_SND_FM801=m
 # CONFIG_SND_FM801_TEA575X is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # USB devices
@@ -922,12 +974,15 @@ CONFIG_USB_UHCI_HCD=m
 # USB Device Class drivers
 #
 # CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
-# CONFIG_USB_BLUETOOTH_TTY is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
@@ -939,12 +994,15 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=m
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 
@@ -964,6 +1022,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1043,6 +1102,7 @@ CONFIG_INFINIBAND_MTHCA=m
 # CONFIG_INFINIBAND_MTHCA_DEBUG is not set
 CONFIG_INFINIBAND_IPOIB=m
 # CONFIG_INFINIBAND_IPOIB_DEBUG is not set
+# CONFIG_INFINIBAND_SRP is not set
 
 #
 # SN Devices
@@ -1051,6 +1111,10 @@ CONFIG_SGI_IOC4=y
 CONFIG_SGI_IOC3=y
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1079,6 +1143,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1120,6 +1185,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1189,6 +1255,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_SGI_PARTITION=y
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1254,26 +1321,30 @@ CONFIG_GENERIC_PENDING_IRQ=y
 # CONFIG_HP_SIMSCSI is not set
 
 #
-# Profiling support
+# Instrumentation Support
 #
 # CONFIG_PROFILING is not set
+# CONFIG_KPROBES is not set
 
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
-# CONFIG_KPROBES is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_IA64_GRANULE_16MB=y
 # CONFIG_IA64_GRANULE_64MB is not set
 # CONFIG_IA64_PRINT_HAZARDS is not set
diff --git a/arch/ia64/configs/sim_defconfig b/arch/ia64/configs/sim_defconfig
index a26781cfe8bf..d9146c31ea13 100644
--- a/arch/ia64/configs/sim_defconfig
+++ b/arch/ia64/configs/sim_defconfig
@@ -1,39 +1,52 @@
 #
 # Automatically generated make config: don't edit
+# Linux kernel version: 2.6.16-rc5
+# Mon Feb 27 16:13:41 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-# CONFIG_CLEAN_COMPILE is not set
-# CONFIG_STANDALONE is not set
-CONFIG_BROKEN=y
-CONFIG_BROKEN_ON_SMP=y
+CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
 #
+CONFIG_LOCALVERSION=""
+CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_LOG_BUF_SHIFT=16
-# CONFIG_HOTPLUG is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
+# CONFIG_CPUSETS is not set
+CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
+CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SHMEM=y
+CONFIG_CC_ALIGN_FUNCTIONS=0
+CONFIG_CC_ALIGN_LABELS=0
+CONFIG_CC_ALIGN_LOOPS=0
+CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
+# CONFIG_TINY_SHMEM is not set
+CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -43,21 +56,45 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
+# CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 CONFIG_IA64=y
 CONFIG_64BIT=y
 CONFIG_MMU=y
+CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
 CONFIG_EFI=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
 # CONFIG_IA64_DIG is not set
 # CONFIG_IA64_HP_ZX1 is not set
+# CONFIG_IA64_HP_ZX1_SWIOTLB is not set
 # CONFIG_IA64_SGI_SN2 is not set
 CONFIG_IA64_HP_SIM=y
 # CONFIG_ITANIUM is not set
@@ -66,17 +103,36 @@ CONFIG_MCKINLEY=y
 # CONFIG_IA64_PAGE_SIZE_8KB is not set
 # CONFIG_IA64_PAGE_SIZE_16KB is not set
 CONFIG_IA64_PAGE_SIZE_64KB=y
+CONFIG_PGTABLE_3=y
+# CONFIG_PGTABLE_4 is not set
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
 CONFIG_IA64_L1_CACHE_SHIFT=7
-# CONFIG_MCKINLEY_ASTEP_SPECIFIC is not set
-# CONFIG_VIRTUAL_MEM_MAP is not set
 # CONFIG_IA64_CYCLONE is not set
-CONFIG_FORCE_MAX_ZONEORDER=18
+CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
 CONFIG_NR_CPUS=64
+# CONFIG_HOTPLUG_CPU is not set
+# CONFIG_SCHED_SMT is not set
 CONFIG_PREEMPT=y
-CONFIG_HAVE_DEC_LOCK=y
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_SPARSEMEM_STATIC is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+# CONFIG_VIRTUAL_MEM_MAP is not set
 CONFIG_IA32_SUPPORT=y
 CONFIG_COMPAT=y
+# CONFIG_IA64_MCA_RECOVERY is not set
 # CONFIG_PERFMON is not set
 CONFIG_IA64_PALINFO=m
 
@@ -84,7 +140,6 @@ CONFIG_IA64_PALINFO=m
 # Firmware Drivers
 #
 CONFIG_EFI_VARS=y
-# CONFIG_SMBIOS is not set
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=y
 
@@ -93,15 +148,98 @@ CONFIG_BINFMT_MISC=y
 #
 
 #
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+# CONFIG_NETDEBUG is not set
+CONFIG_PACKET=y
+# CONFIG_PACKET_MMAP is not set
+# CONFIG_UNIX is not set
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+# CONFIG_IP_PNP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_ARPD is not set
+# CONFIG_SYN_COOKIES is not set
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_TUNNEL is not set
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+# CONFIG_IPV6 is not set
+# CONFIG_NETFILTER is not set
+
+#
+# DCCP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
+# CONFIG_NET_SCHED is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_IEEE80211 is not set
+
+#
 # Device Drivers
 #
 
 #
 # Generic Driver Options
 #
+# CONFIG_STANDALONE is not set
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+# CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
 
 #
+# Connector - unified userspace <-> kernelspace linker
+#
+# CONFIG_CONNECTOR is not set
+
+#
 # Memory Technology Devices (MTD)
 #
 # CONFIG_MTD is not set
@@ -118,12 +256,16 @@ CONFIG_BINFMT_MISC=y
 #
 # Block devices
 #
+# CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
 # CONFIG_BLK_DEV_CRYPTOLOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
 CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 # CONFIG_BLK_DEV_INITRD is not set
+# CONFIG_CDROM_PKTCDVD is not set
+# CONFIG_ATA_OVER_ETH is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
@@ -133,6 +275,7 @@ CONFIG_BLK_DEV_RAM_SIZE=4096
 #
 # SCSI device support
 #
+# CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
 CONFIG_SCSI_PROC_FS=y
 
@@ -144,6 +287,7 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_CHR_DEV_OSST is not set
 # CONFIG_BLK_DEV_SR is not set
 # CONFIG_CHR_DEV_SG is not set
+# CONFIG_CHR_DEV_SCH is not set
 
 #
 # Some SCSI devices (e.g. CD jukebox) support multiple LUNs
@@ -157,13 +301,14 @@ CONFIG_SCSI_LOGGING=y
 #
 CONFIG_SCSI_SPI_ATTRS=y
 # CONFIG_SCSI_FC_ATTRS is not set
+# CONFIG_SCSI_ISCSI_ATTRS is not set
+# CONFIG_SCSI_SAS_ATTRS is not set
 
 #
 # SCSI low-level drivers
 #
-# CONFIG_SCSI_AIC7XXX_OLD is not set
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_SCSI_SATA is not set
-# CONFIG_SCSI_EATA_PIO is not set
 # CONFIG_SCSI_DEBUG is not set
 
 #
@@ -174,77 +319,47 @@ CONFIG_SCSI_SPI_ATTRS=y
 #
 # Fusion MPT device support
 #
+# CONFIG_FUSION is not set
 
 #
 # IEEE 1394 (FireWire) support
 #
-# CONFIG_IEEE1394 is not set
 
 #
 # I2O device support
 #
 
 #
-# Networking support
+# Network device support
 #
-CONFIG_NET=y
+# CONFIG_NETDEVICES is not set
+# CONFIG_DUMMY is not set
+# CONFIG_BONDING is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_TUN is not set
 
 #
-# Networking options
+# PHY device support
 #
-CONFIG_PACKET=y
-# CONFIG_PACKET_MMAP is not set
-# CONFIG_NETLINK_DEV is not set
-# CONFIG_UNIX is not set
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-# CONFIG_IP_ADVANCED_ROUTER is not set
-# CONFIG_IP_PNP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_IP_MROUTE is not set
-# CONFIG_ARPD is not set
-# CONFIG_SYN_COOKIES is not set
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
 
 #
-# SCTP Configuration (EXPERIMENTAL)
+# Ethernet (10 or 100Mbit)
 #
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-# CONFIG_NET_HW_FLOWCONTROL is not set
+# CONFIG_NET_ETHERNET is not set
 
 #
-# QoS and/or fair queueing
+# Ethernet (1000 Mbit)
 #
-# CONFIG_NET_SCHED is not set
 
 #
-# Network testing
+# Ethernet (10000 Mbit)
 #
-# CONFIG_NET_PKTGEN is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+# CONFIG_SHAPER is not set
+# CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
-# CONFIG_NETDEVICES is not set
 
 #
 # ISDN subsystem
@@ -274,16 +389,6 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 # CONFIG_INPUT_EVBUG is not set
 
 #
-# Input I/O drivers
-#
-# CONFIG_GAMEPORT is not set
-CONFIG_SOUND_GAMEPORT=y
-CONFIG_SERIO=y
-# CONFIG_SERIO_I8042 is not set
-CONFIG_SERIO_SERPORT=y
-# CONFIG_SERIO_CT82C710 is not set
-
-#
 # Input Device Drivers
 #
 # CONFIG_INPUT_KEYBOARD is not set
@@ -293,6 +398,15 @@ CONFIG_SERIO_SERPORT=y
 # CONFIG_INPUT_MISC is not set
 
 #
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+# CONFIG_SERIO_I8042 is not set
+CONFIG_SERIO_SERPORT=y
+# CONFIG_SERIO_RAW is not set
+# CONFIG_GAMEPORT is not set
+
+#
 # Character devices
 #
 CONFIG_VT=y
@@ -310,7 +424,6 @@ CONFIG_HW_CONSOLE=y
 #
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_QIC02_TAPE is not set
 
 #
 # IPMI
@@ -324,15 +437,19 @@ CONFIG_UNIX98_PTYS=y
 CONFIG_EFI_RTC=y
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
-# CONFIG_APPLICOM is not set
 
 #
 # Ftape, the floppy tape device driver
 #
-# CONFIG_FTAPE is not set
 # CONFIG_AGP is not set
-# CONFIG_DRM is not set
 # CONFIG_RAW_DRIVER is not set
+# CONFIG_HANGCHECK_TIMER is not set
+
+#
+# TPM devices
+#
+# CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -340,10 +457,33 @@ CONFIG_EFI_RTC=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
+# Hardware Monitoring support
+#
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
+
+#
 # Misc devices
 #
 
 #
+# Multimedia Capabilities Port drivers
+#
+
+#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -362,7 +502,6 @@ CONFIG_EFI_RTC=y
 # Console display driver support
 #
 # CONFIG_VGA_CONSOLE is not set
-# CONFIG_MDA_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
 
 #
@@ -373,6 +512,12 @@ CONFIG_DUMMY_CONSOLE=y
 #
 # USB support
 #
+# CONFIG_USB_ARCH_HAS_HCD is not set
+# CONFIG_USB_ARCH_HAS_OHCI is not set
+
+#
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
 
 #
 # USB Gadget Support
@@ -380,22 +525,41 @@ CONFIG_DUMMY_CONSOLE=y
 # CONFIG_USB_GADGET is not set
 
 #
+# MMC/SD Card support
+#
+# CONFIG_MMC is not set
+
+#
+# InfiniBand support
+#
+
+#
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
+# CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
+CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
 
 #
 # CD-ROM/DVD Filesystems
@@ -406,7 +570,8 @@ CONFIG_JBD=y
 #
 # DOS/FAT/NT Filesystems
 #
-# CONFIG_FAT_FS is not set
+# CONFIG_MSDOS_FS is not set
+# CONFIG_VFAT_FS is not set
 # CONFIG_NTFS_FS is not set
 
 #
@@ -415,12 +580,12 @@ CONFIG_JBD=y
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_SYSFS=y
-# CONFIG_DEVFS_FS is not set
-# CONFIG_DEVPTS_FS_XATTR is not set
 # CONFIG_TMPFS is not set
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
+# CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -448,18 +613,22 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_DIRECTIO=y
 CONFIG_NFSD=y
 CONFIG_NFSD_V3=y
+# CONFIG_NFSD_V3_ACL is not set
 # CONFIG_NFSD_V4 is not set
 # CONFIG_NFSD_TCP is not set
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=y
+CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
 
 #
 # Partition Types
@@ -476,10 +645,10 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SOLARIS_X86_PARTITION is not set
 # CONFIG_UNIXWARE_DISKLABEL is not set
 # CONFIG_LDM_PARTITION is not set
-# CONFIG_NEC98_PARTITION is not set
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -490,8 +659,13 @@ CONFIG_EFI_PARTITION=y
 #
 # Library routines
 #
+# CONFIG_CRC_CCITT is not set
+# CONFIG_CRC16 is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_GENERIC_PENDING_IRQ=y
 
 #
 # HP Simulator drivers
@@ -502,33 +676,50 @@ CONFIG_HP_SIMSERIAL_CONSOLE=y
 CONFIG_HP_SIMSCSI=y
 
 #
-# Profiling support
+# Instrumentation Support
 #
 # CONFIG_PROFILING is not set
+# CONFIG_KPROBES is not set
 
 #
 # Kernel hacking
 #
-# CONFIG_IA64_GRANULE_16MB is not set
-CONFIG_IA64_GRANULE_64MB=y
-CONFIG_DEBUG_KERNEL=y
-# CONFIG_IA64_PRINT_HAZARDS is not set
-# CONFIG_DISABLE_VHPT is not set
+# CONFIG_PRINTK_TIME is not set
 # CONFIG_MAGIC_SYSRQ is not set
+CONFIG_DEBUG_KERNEL=y
+CONFIG_LOG_BUF_SHIFT=16
+CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_PREEMPT=y
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_IA64_GRANULE_16MB is not set
+CONFIG_IA64_GRANULE_64MB=y
+# CONFIG_IA64_PRINT_HAZARDS is not set
+# CONFIG_DISABLE_VHPT is not set
 # CONFIG_IA64_DEBUG_CMPXCHG is not set
 # CONFIG_IA64_DEBUG_IRQ is not set
-CONFIG_DEBUG_INFO=y
 CONFIG_SYSVIPC_COMPAT=y
 
 #
 # Security options
 #
+# CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
 
 #
 # Cryptographic options
 #
 # CONFIG_CRYPTO is not set
+
+#
+# Hardware crypto devices
+#
diff --git a/arch/ia64/configs/sn2_defconfig b/arch/ia64/configs/sn2_defconfig
index 3cb503b659e6..8206752161bb 100644
--- a/arch/ia64/configs/sn2_defconfig
+++ b/arch/ia64/configs/sn2_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc4
-# Fri Dec  2 10:33:48 2005
+# Linux kernel version: 2.6.16-rc5
+# Mon Feb 27 16:06:38 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -23,17 +22,18 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 CONFIG_CPUSETS=y
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -42,8 +42,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -88,7 +90,7 @@ CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_IA64_UNCACHED_ALLOCATOR=y
-CONFIG_ZONE_DMA_IS_DMA32=y
+CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
 # CONFIG_IA64_DIG is not set
 # CONFIG_IA64_HP_ZX1 is not set
@@ -126,6 +128,7 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_NEED_MULTIPLE_NODES=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
@@ -140,6 +143,7 @@ CONFIG_COMPAT=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_PERFMON=y
 CONFIG_IA64_PALINFO=y
+CONFIG_SGI_SN=y
 
 #
 # Firmware Drivers
@@ -166,6 +170,7 @@ CONFIG_ACPI=y
 CONFIG_ACPI_NUMA=y
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 # CONFIG_ACPI_CONTAINER is not set
@@ -207,6 +212,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -247,6 +253,11 @@ CONFIG_IPV6=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -330,6 +341,7 @@ CONFIG_ATA_OVER_ETH=m
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -457,13 +469,7 @@ CONFIG_SCSI_SATA_VITESSE=y
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 CONFIG_SCSI_QLOGIC_1280=y
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-CONFIG_SCSI_QLA22XX=y
-CONFIG_SCSI_QLA2300=y
-CONFIG_SCSI_QLA2322=y
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -545,6 +551,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
@@ -632,12 +639,15 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
+# CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
@@ -686,8 +696,8 @@ CONFIG_AGP=y
 CONFIG_AGP_SGI_TIOCA=y
 # CONFIG_DRM is not set
 CONFIG_RAW_DRIVER=m
-# CONFIG_HPET is not set
 CONFIG_MAX_RAW_DEVS=256
+# CONFIG_HPET is not set
 # CONFIG_HANGCHECK_TIMER is not set
 CONFIG_MMTIMER=y
 
@@ -703,6 +713,12 @@ CONFIG_MMTIMER=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -791,12 +807,14 @@ CONFIG_USB_UHCI_HCD=m
 # may also be needed; see USB_STORAGE Help for more information
 #
 # CONFIG_USB_STORAGE is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=m
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 
@@ -816,6 +834,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -903,6 +922,10 @@ CONFIG_SGI_IOC4=y
 CONFIG_SGI_IOC3=y
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -931,6 +954,7 @@ CONFIG_XFS_QUOTA=y
 # CONFIG_XFS_SECURITY is not set
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -973,6 +997,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 CONFIG_RELAYFS_FS=m
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1041,6 +1066,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_SGI_PARTITION=y
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1111,19 +1137,21 @@ CONFIG_GENERIC_PENDING_IRQ=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 CONFIG_DEBUG_PREEMPT=y
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_IA64_GRANULE_16MB=y
 # CONFIG_IA64_GRANULE_64MB is not set
diff --git a/arch/ia64/configs/tiger_defconfig b/arch/ia64/configs/tiger_defconfig
index 6859119bc9dd..125568118b84 100644
--- a/arch/ia64/configs/tiger_defconfig
+++ b/arch/ia64/configs/tiger_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc4
-# Fri Dec  2 16:06:32 2005
+# Linux kernel version: 2.6.16-rc5
+# Mon Feb 27 15:49:18 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -23,18 +22,19 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -43,8 +43,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -88,7 +90,7 @@ CONFIG_TIME_INTERPOLATION=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
-CONFIG_ZONE_DMA_IS_DMA32=y
+CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
 CONFIG_IA64_DIG=y
 # CONFIG_IA64_HP_ZX1 is not set
@@ -162,6 +164,7 @@ CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=m
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 CONFIG_ACPI_CONTAINER=m
@@ -203,6 +206,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -237,6 +241,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -326,6 +335,7 @@ CONFIG_BLK_DEV_INITRD=y
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -443,13 +453,7 @@ CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
 CONFIG_SCSI_QLOGIC_FC=y
 # CONFIG_SCSI_QLOGIC_FC_FIRMWARE is not set
 CONFIG_SCSI_QLOGIC_1280=y
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -572,6 +576,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -676,12 +681,15 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
+# CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
@@ -694,6 +702,7 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_ACPI=y
 CONFIG_SERIAL_8250_NR_UARTS=6
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
@@ -738,10 +747,10 @@ CONFIG_DRM_SIS=m
 # CONFIG_DRM_VIA is not set
 # CONFIG_DRM_SAVAGE is not set
 CONFIG_RAW_DRIVER=m
+CONFIG_MAX_RAW_DEVS=256
 CONFIG_HPET=y
 # CONFIG_HPET_RTC_IRQ is not set
 CONFIG_HPET_MMAP=y
-CONFIG_MAX_RAW_DEVS=256
 # CONFIG_HANGCHECK_TIMER is not set
 
 #
@@ -756,6 +765,12 @@ CONFIG_MAX_RAW_DEVS=256
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -765,6 +780,7 @@ CONFIG_MAX_RAW_DEVS=256
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
@@ -854,12 +870,15 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 # CONFIG_USB_AIPTEK is not set
@@ -873,6 +892,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -948,7 +968,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS)
 #
 
 #
@@ -980,6 +1000,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1021,6 +1042,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1090,6 +1112,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_SGI_PARTITION=y
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1157,18 +1180,20 @@ CONFIG_GENERIC_PENDING_IRQ=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_IA64_GRANULE_16MB=y
 # CONFIG_IA64_GRANULE_64MB is not set
diff --git a/arch/ia64/configs/zx1_defconfig b/arch/ia64/configs/zx1_defconfig
index 53899dc8eb53..949dc4670a0c 100644
--- a/arch/ia64/configs/zx1_defconfig
+++ b/arch/ia64/configs/zx1_defconfig
@@ -1,16 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc1
-# Wed Sep 14 15:15:01 2005
+# Linux kernel version: 2.6.16-rc5
+# Mon Feb 27 15:55:36 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-# CONFIG_CLEAN_COMPILE is not set
-CONFIG_BROKEN=y
-CONFIG_BROKEN_ON_SMP=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -26,17 +23,18 @@ CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_BSD_PROCESS_ACCT_V3 is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -45,8 +43,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -59,17 +59,36 @@ CONFIG_OBSOLETE_MODPARM=y
 # CONFIG_KMOD is not set
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 CONFIG_IA64=y
 CONFIG_64BIT=y
 CONFIG_MMU=y
+CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_DMA_IS_DMA32=y
 # CONFIG_IA64_GENERIC is not set
 # CONFIG_IA64_DIG is not set
 CONFIG_IA64_HP_ZX1=y
@@ -82,18 +101,16 @@ CONFIG_MCKINLEY=y
 # CONFIG_IA64_PAGE_SIZE_8KB is not set
 CONFIG_IA64_PAGE_SIZE_16KB=y
 # CONFIG_IA64_PAGE_SIZE_64KB is not set
+CONFIG_PGTABLE_3=y
+# CONFIG_PGTABLE_4 is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_IA64_L1_CACHE_SHIFT=7
-# CONFIG_NUMA is not set
-CONFIG_VIRTUAL_MEM_MAP=y
-CONFIG_HOLES_IN_ZONE=y
 # CONFIG_IA64_CYCLONE is not set
 CONFIG_IOSAPIC=y
-# CONFIG_IA64_SGI_SN_XP is not set
-CONFIG_FORCE_MAX_ZONEORDER=18
+CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
 CONFIG_NR_CPUS=16
 # CONFIG_HOTPLUG_CPU is not set
@@ -106,7 +123,14 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_HAVE_DEC_LOCK=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_DISCONTIGMEM_DEFAULT=y
+CONFIG_VIRTUAL_MEM_MAP=y
+CONFIG_HOLES_IN_ZONE=y
 CONFIG_IA32_SUPPORT=y
 CONFIG_COMPAT=y
 CONFIG_IA64_MCA_RECOVERY=y
@@ -118,7 +142,6 @@ CONFIG_IA64_PALINFO=y
 #
 CONFIG_EFI_VARS=y
 CONFIG_EFI_PCDP=y
-# CONFIG_DELL_RBU is not set
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=y
 
@@ -126,6 +149,7 @@ CONFIG_BINFMT_MISC=y
 # Power management and ACPI
 #
 CONFIG_PM=y
+CONFIG_PM_LEGACY=y
 # CONFIG_PM_DEBUG is not set
 
 #
@@ -138,6 +162,7 @@ CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_THERMAL=y
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 # CONFIG_ACPI_CONTAINER is not set
@@ -179,6 +204,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -211,14 +237,17 @@ CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 
 #
+# Core Netfilter Configuration
+#
+# CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NF_CONNTRACK is not set
+# CONFIG_NETFILTER_XTABLES is not set
+
+#
 # IP: Netfilter Configuration
 #
 # CONFIG_IP_NF_CONNTRACK is not set
 # CONFIG_IP_NF_QUEUE is not set
-# CONFIG_IP_NF_IPTABLES is not set
-CONFIG_IP_NF_ARPTABLES=y
-# CONFIG_IP_NF_ARPFILTER is not set
-# CONFIG_IP_NF_ARP_MANGLE is not set
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -229,6 +258,11 @@ CONFIG_IP_NF_ARPTABLES=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -241,14 +275,16 @@ CONFIG_IP_NF_ARPTABLES=y
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NETFILTER_NETLINK is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -310,20 +346,13 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -407,13 +436,14 @@ CONFIG_SCSI_LOGGING=y
 # SCSI Transport Attributes
 #
 CONFIG_SCSI_SPI_ATTRS=y
-# CONFIG_SCSI_FC_ATTRS is not set
+CONFIG_SCSI_FC_ATTRS=y
 # CONFIG_SCSI_ISCSI_ATTRS is not set
 # CONFIG_SCSI_SAS_ATTRS is not set
 
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -421,13 +451,11 @@ CONFIG_SCSI_SPI_ATTRS=y
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
-# CONFIG_SCSI_ADVANSYS is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_SATA is not set
-# CONFIG_SCSI_CPQFCTS is not set
 # CONFIG_SCSI_DMX3191D is not set
-# CONFIG_SCSI_EATA_PIO is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
 # CONFIG_SCSI_INITIO is not set
@@ -438,17 +466,9 @@ CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
 # CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
 # CONFIG_SCSI_IPR is not set
-# CONFIG_SCSI_QLOGIC_ISP is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 CONFIG_SCSI_QLOGIC_1280=y
-# CONFIG_SCSI_QLOGIC_1280_1040 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -465,6 +485,7 @@ CONFIG_SCSI_QLA2XXX=y
 CONFIG_FUSION=y
 CONFIG_FUSION_SPI=y
 CONFIG_FUSION_FC=y
+# CONFIG_FUSION_SAS is not set
 CONFIG_FUSION_MAX_SGE=128
 CONFIG_FUSION_CTL=m
 
@@ -505,6 +526,7 @@ CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
 
 #
@@ -555,6 +577,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -652,6 +675,7 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_ACPI=y
 CONFIG_SERIAL_8250_NR_UARTS=8
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
@@ -703,6 +727,7 @@ CONFIG_DRM_RADEON=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -753,12 +778,19 @@ CONFIG_I2C_ALGOPCF=y
 # CONFIG_SENSORS_PCF8591 is not set
 # CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -789,6 +821,7 @@ CONFIG_VIDEO_DEV=y
 #
 # Video Adapters
 #
+# CONFIG_VIDEO_ADV_DEBUG is not set
 # CONFIG_VIDEO_BT848 is not set
 # CONFIG_VIDEO_CPIA is not set
 # CONFIG_VIDEO_SAA5246A is not set
@@ -796,14 +829,16 @@ CONFIG_VIDEO_DEV=y
 # CONFIG_TUNER_3036 is not set
 # CONFIG_VIDEO_STRADIS is not set
 # CONFIG_VIDEO_ZORAN is not set
-# CONFIG_VIDEO_ZR36120 is not set
 # CONFIG_VIDEO_SAA7134 is not set
 # CONFIG_VIDEO_MXB is not set
 # CONFIG_VIDEO_DPC is not set
 # CONFIG_VIDEO_HEXIUM_ORION is not set
 # CONFIG_VIDEO_HEXIUM_GEMINI is not set
 # CONFIG_VIDEO_CX88 is not set
+# CONFIG_VIDEO_EM28XX is not set
 # CONFIG_VIDEO_OVCAMCHIP is not set
+# CONFIG_VIDEO_AUDIO_DECODER is not set
+# CONFIG_VIDEO_DECODER is not set
 
 #
 # Radio Adapters
@@ -824,7 +859,6 @@ CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
-CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_MACMODES is not set
 CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_TILEBLITTING is not set
@@ -833,6 +867,7 @@ CONFIG_FB_MODE_HELPERS=y
 # CONFIG_FB_CYBER2000 is not set
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
+# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
@@ -848,10 +883,7 @@ CONFIG_FB_RADEON_DEBUG=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
-# CONFIG_FB_PM3 is not set
-# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -860,6 +892,7 @@ CONFIG_FB_RADEON_DEBUG=y
 CONFIG_VGA_CONSOLE=y
 CONFIG_DUMMY_CONSOLE=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y
 CONFIG_FONT_8x16=y
@@ -892,6 +925,8 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -900,17 +935,18 @@ CONFIG_SND_SEQUENCER_OSS=y
 #
 CONFIG_SND_MPU401_UART=y
 CONFIG_SND_OPL3_LIB=y
+CONFIG_SND_AC97_CODEC=y
+CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_DUMMY is not set
 # CONFIG_SND_VIRMIDI is not set
 # CONFIG_SND_MTPAV is not set
 # CONFIG_SND_SERIAL_U16550 is not set
 # CONFIG_SND_MPU401 is not set
-CONFIG_SND_AC97_CODEC=y
-CONFIG_SND_AC97_BUS=y
 
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -919,39 +955,39 @@ CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 CONFIG_SND_FM801=y
 CONFIG_SND_FM801_TEA575X=y
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # USB devices
@@ -997,12 +1033,15 @@ CONFIG_USB_UHCI_HCD=y
 # USB Device Class drivers
 #
 # CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
-# CONFIG_USB_BLUETOOTH_TTY is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
@@ -1014,13 +1053,15 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
-# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1034,6 +1075,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1049,6 +1091,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_DABUSB is not set
 # CONFIG_USB_VICAM is not set
 # CONFIG_USB_DSBR is not set
+# CONFIG_USB_ET61X251 is not set
 # CONFIG_USB_IBMCAM is not set
 # CONFIG_USB_KONICAWC is not set
 # CONFIG_USB_OV511 is not set
@@ -1113,7 +1156,7 @@ CONFIG_USB_MON=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS)
 #
 
 #
@@ -1135,6 +1178,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 # CONFIG_INOTIFY is not set
@@ -1174,6 +1218,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1238,6 +1283,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1296,26 +1342,30 @@ CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
 
 #
-# Profiling support
+# Instrumentation Support
 #
 # CONFIG_PROFILING is not set
+CONFIG_KPROBES=y
 
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
-CONFIG_KPROBES=y
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_IA64_GRANULE_16MB=y
 # CONFIG_IA64_GRANULE_64MB is not set
 CONFIG_IA64_PRINT_HAZARDS=y
diff --git a/arch/ia64/defconfig b/arch/ia64/defconfig
index dcbc78a4cfa4..3e767288a745 100644
--- a/arch/ia64/defconfig
+++ b/arch/ia64/defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc1
-# Wed Sep 14 15:13:03 2005
+# Linux kernel version: 2.6.16-rc5
+# Mon Feb 27 16:02:28 2006
 #
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -23,18 +22,19 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -43,8 +43,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -59,17 +61,36 @@ CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 CONFIG_IA64=y
 CONFIG_64BIT=y
 CONFIG_MMU=y
+CONFIG_SWIOTLB=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_TIME_INTERPOLATION=y
 CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_DMA_IS_DMA32=y
 CONFIG_IA64_GENERIC=y
 # CONFIG_IA64_DIG is not set
 # CONFIG_IA64_HP_ZX1 is not set
@@ -89,14 +110,10 @@ CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_IA64_L1_CACHE_SHIFT=7
-CONFIG_NUMA=y
-CONFIG_VIRTUAL_MEM_MAP=y
-CONFIG_HOLES_IN_ZONE=y
-CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_IA64_CYCLONE=y
 CONFIG_IOSAPIC=y
 # CONFIG_IA64_SGI_SN_XP is not set
-CONFIG_FORCE_MAX_ZONEORDER=18
+CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
 CONFIG_NR_CPUS=512
 CONFIG_HOTPLUG_CPU=y
@@ -110,19 +127,29 @@ CONFIG_DISCONTIGMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_NEED_MULTIPLE_NODES=y
 # CONFIG_SPARSEMEM_STATIC is not set
-CONFIG_HAVE_DEC_LOCK=y
+CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_DISCONTIGMEM_DEFAULT=y
+CONFIG_NUMA=y
+CONFIG_VIRTUAL_MEM_MAP=y
+CONFIG_HOLES_IN_ZONE=y
+CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
 CONFIG_IA32_SUPPORT=y
 CONFIG_COMPAT=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_PERFMON=y
 CONFIG_IA64_PALINFO=y
+CONFIG_SGI_SN=y
 
 #
 # Firmware Drivers
 #
 CONFIG_EFI_VARS=y
 CONFIG_EFI_PCDP=y
-# CONFIG_DELL_RBU is not set
 CONFIG_BINFMT_ELF=y
 CONFIG_BINFMT_MISC=m
 
@@ -130,6 +157,7 @@ CONFIG_BINFMT_MISC=m
 # Power management and ACPI
 #
 CONFIG_PM=y
+CONFIG_PM_LEGACY=y
 # CONFIG_PM_DEBUG is not set
 
 #
@@ -144,6 +172,7 @@ CONFIG_ACPI_THERMAL=m
 CONFIG_ACPI_NUMA=y
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
+CONFIG_ACPI_EC=y
 CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 CONFIG_ACPI_CONTAINER=m
@@ -186,6 +215,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -220,6 +250,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -232,14 +267,16 @@ CONFIG_TCP_CONG_BIC=y
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NETFILTER_NETLINK is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -301,20 +338,13 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -407,6 +437,7 @@ CONFIG_SCSI_FC_ATTRS=y
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -416,16 +447,19 @@ CONFIG_SCSI_FC_ATTRS=y
 # CONFIG_SCSI_AIC79XX is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
 CONFIG_SCSI_SATA=y
 # CONFIG_SCSI_SATA_AHCI is not set
 # CONFIG_SCSI_SATA_SVW is not set
 # CONFIG_SCSI_ATA_PIIX is not set
 # CONFIG_SCSI_SATA_MV is not set
 # CONFIG_SCSI_SATA_NV is not set
-# CONFIG_SCSI_SATA_PROMISE is not set
+# CONFIG_SCSI_PDC_ADMA is not set
 # CONFIG_SCSI_SATA_QSTOR is not set
+# CONFIG_SCSI_SATA_PROMISE is not set
 # CONFIG_SCSI_SATA_SX4 is not set
 # CONFIG_SCSI_SATA_SIL is not set
+# CONFIG_SCSI_SATA_SIL24 is not set
 # CONFIG_SCSI_SATA_SIS is not set
 # CONFIG_SCSI_SATA_ULI is not set
 # CONFIG_SCSI_SATA_VIA is not set
@@ -443,14 +477,7 @@ CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 CONFIG_SCSI_QLOGIC_1280=y
-# CONFIG_SCSI_QLOGIC_1280_1040 is not set
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -483,6 +510,7 @@ CONFIG_DM_MULTIPATH=m
 CONFIG_FUSION=y
 CONFIG_FUSION_SPI=y
 CONFIG_FUSION_FC=m
+# CONFIG_FUSION_SAS is not set
 CONFIG_FUSION_MAX_SGE=128
 # CONFIG_FUSION_CTL is not set
 
@@ -523,6 +551,7 @@ CONFIG_NET_ETHERNET=y
 CONFIG_MII=m
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
 
 #
@@ -572,6 +601,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -676,12 +706,15 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
+# CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
@@ -697,6 +730,7 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_ACPI=y
 CONFIG_SERIAL_8250_NR_UARTS=6
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 # CONFIG_SERIAL_8250_DETECT_IRQ is not set
@@ -710,6 +744,7 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 CONFIG_SERIAL_SGI_L1_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
 CONFIG_SERIAL_SGI_IOC4=y
+# CONFIG_SERIAL_SGI_IOC3 is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -745,10 +780,10 @@ CONFIG_DRM_SIS=m
 # CONFIG_DRM_VIA is not set
 # CONFIG_DRM_SAVAGE is not set
 CONFIG_RAW_DRIVER=m
+CONFIG_MAX_RAW_DEVS=256
 CONFIG_HPET=y
 # CONFIG_HPET_RTC_IRQ is not set
 CONFIG_HPET_MMAP=y
-CONFIG_MAX_RAW_DEVS=256
 # CONFIG_HANGCHECK_TIMER is not set
 CONFIG_MMTIMER=y
 
@@ -756,6 +791,7 @@ CONFIG_MMTIMER=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -763,6 +799,12 @@ CONFIG_MMTIMER=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -772,6 +814,7 @@ CONFIG_MMTIMER=y
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
@@ -822,26 +865,28 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 CONFIG_SND_VERBOSE_PRINTK=y
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 
 #
 # Generic devices
 #
 CONFIG_SND_MPU401_UART=m
 CONFIG_SND_OPL3_LIB=m
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_AC97_BUS=m
 CONFIG_SND_DUMMY=m
 CONFIG_SND_VIRMIDI=m
 CONFIG_SND_MTPAV=m
 CONFIG_SND_SERIAL_U16550=m
 CONFIG_SND_MPU401=m
-CONFIG_SND_AC97_CODEC=m
-CONFIG_SND_AC97_BUS=m
 
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -850,40 +895,40 @@ CONFIG_SND_AC97_BUS=m
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
+CONFIG_SND_CS4281=m
 CONFIG_SND_CS46XX=m
 CONFIG_SND_CS46XX_NEW_DSP=y
-CONFIG_SND_CS4281=m
 CONFIG_SND_EMU10K1=m
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 CONFIG_SND_FM801=m
 # CONFIG_SND_FM801_TEA575X is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # USB devices
@@ -929,12 +974,15 @@ CONFIG_USB_UHCI_HCD=m
 # USB Device Class drivers
 #
 # CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
-# CONFIG_USB_BLUETOOTH_TTY is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
@@ -946,12 +994,15 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=m
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 
@@ -971,6 +1022,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1050,11 +1102,17 @@ CONFIG_INFINIBAND_MTHCA=m
 # CONFIG_INFINIBAND_MTHCA_DEBUG is not set
 CONFIG_INFINIBAND_IPOIB=m
 # CONFIG_INFINIBAND_IPOIB_DEBUG is not set
+# CONFIG_INFINIBAND_SRP is not set
 
 #
 # SN Devices
 #
 CONFIG_SGI_IOC4=y
+CONFIG_SGI_IOC3=m
+
+#
+# EDAC - error detection and reporting (RAS)
+#
 
 #
 # File systems
@@ -1085,6 +1143,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1126,6 +1185,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1195,6 +1255,7 @@ CONFIG_MSDOS_PARTITION=y
 CONFIG_SGI_PARTITION=y
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1260,26 +1321,30 @@ CONFIG_GENERIC_PENDING_IRQ=y
 # CONFIG_HP_SIMSCSI is not set
 
 #
-# Profiling support
+# Instrumentation Support
 #
 # CONFIG_PROFILING is not set
+# CONFIG_KPROBES is not set
 
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
-# CONFIG_KPROBES is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_IA64_GRANULE_16MB=y
 # CONFIG_IA64_GRANULE_64MB is not set
 # CONFIG_IA64_PRINT_HAZARDS is not set
diff --git a/arch/ia64/dig/setup.c b/arch/ia64/dig/setup.c
index d58003f1ad02..c9104bfff667 100644
--- a/arch/ia64/dig/setup.c
+++ b/arch/ia64/dig/setup.c
@@ -25,16 +25,6 @@
 #include <asm/machvec.h>
 #include <asm/system.h>
 
-/*
- * This is here so we can use the CMOS detection in ide-probe.c to
- * determine what drives are present.  In theory, we don't need this
- * as the auto-detection could be done via ide-probe.c:do_probe() but
- * in practice that would be much slower, which is painful when
- * running in the simulator.  Note that passing zeroes in DRIVE_INFO
- * is sufficient (the IDE driver will autodetect the drive geometry).
- */
-char drive_info[4*16];
-
 void __init
 dig_setup (char **cmdline_p)
 {
diff --git a/arch/ia64/ia32/ia32_signal.c b/arch/ia64/ia32/ia32_signal.c
index 5856510210fa..b3355a9ca2c3 100644
--- a/arch/ia64/ia32/ia32_signal.c
+++ b/arch/ia64/ia32/ia32_signal.c
@@ -515,6 +515,7 @@ sys32_signal (int sig, unsigned int handler)
 
         sigact_set_handler(&new_sa, handler, 0);
         new_sa.sa.sa_flags = SA_ONESHOT | SA_NOMASK;
+        sigemptyset(&new_sa.sa.sa_mask);
 
         ret = do_sigaction(sig, &new_sa, &old_sa);
 
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index d2702c419cf8..ecd44bdc8394 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -761,6 +761,59 @@ int acpi_map_cpu2node(acpi_handle handle, int cpu, long physid)
         return (0);
 }
 
+int additional_cpus __initdata = -1;
+
+static __init int setup_additional_cpus(char *s)
+{
+        if (s)
+                additional_cpus = simple_strtol(s, NULL, 0);
+
+        return 0;
+}
+
+early_param("additional_cpus", setup_additional_cpus);
+
+/*
+ * cpu_possible_map should be static, it cannot change as cpu's
+ * are onlined, or offlined. The reason is per-cpu data-structures
+ * are allocated by some modules at init time, and dont expect to
+ * do this dynamically on cpu arrival/departure.
+ * cpu_present_map on the other hand can change dynamically.
+ * In case when cpu_hotplug is not compiled, then we resort to current
+ * behaviour, which is cpu_possible == cpu_present.
+ * - Ashok Raj
+ *
+ * Three ways to find out the number of additional hotplug CPUs:
+ * - If the BIOS specified disabled CPUs in ACPI/mptables use that.
+ * - The user can overwrite it with additional_cpus=NUM
+ * - Otherwise don't reserve additional CPUs.
+ */
+__init void prefill_possible_map(void)
+{
+        int i;
+        int possible, disabled_cpus;
+
+        disabled_cpus = total_cpus - available_cpus;
+
+        if (additional_cpus == -1) {
+                if (disabled_cpus > 0)
+                        additional_cpus = disabled_cpus;
+                else
+                        additional_cpus = 0;
+        }
+
+        possible = available_cpus + additional_cpus;
+
+        if (possible > NR_CPUS)
+                possible = NR_CPUS;
+
+        printk(KERN_INFO "SMP: Allowing %d CPUs, %d hotplug CPUs\n",
+                possible, max((possible - available_cpus), 0));
+
+        for (i = 0; i < possible; i++)
+                cpu_set(i, cpu_possible_map);
+}
+
 int acpi_map_lsapic(acpi_handle handle, int *pcpu)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
diff --git a/arch/ia64/kernel/cyclone.c b/arch/ia64/kernel/cyclone.c
index 6ade3790ce07..e00b21514f7c 100644
--- a/arch/ia64/kernel/cyclone.c
+++ b/arch/ia64/kernel/cyclone.c
@@ -36,7 +36,7 @@ int __init init_cyclone_clock(void)
         u32* volatile cyclone_timer;    /* Cyclone MPMC0 register */
 
         if (!use_cyclone)
-                return -ENODEV;
+                return 0;
 
         printk(KERN_INFO "Summit chipset: Starting Cyclone Counter.\n");
 
diff --git a/arch/ia64/kernel/efi.c b/arch/ia64/kernel/efi.c
index c485a3b32ba8..9990320b6f9a 100644
--- a/arch/ia64/kernel/efi.c
+++ b/arch/ia64/kernel/efi.c
@@ -410,24 +410,16 @@ efi_init (void)
         efi_config_table_t *config_tables;
         efi_char16_t *c16;
         u64 efi_desc_size;
-        char *cp, *end, vendor[100] = "unknown";
+        char *cp, vendor[100] = "unknown";
         extern char saved_command_line[];
         int i;
 
         /* it's too early to be able to use the standard kernel command line support... */
         for (cp = saved_command_line; *cp; ) {
                 if (memcmp(cp, "mem=", 4) == 0) {
-                        cp += 4;
-                        mem_limit = memparse(cp, &end);
-                        if (end != cp)
-                                break;
-                        cp = end;
+                        mem_limit = memparse(cp + 4, &cp);
                 } else if (memcmp(cp, "max_addr=", 9) == 0) {
-                        cp += 9;
-                        max_addr = GRANULEROUNDDOWN(memparse(cp, &end));
-                        if (end != cp)
-                                break;
-                        cp = end;
+                        max_addr = GRANULEROUNDDOWN(memparse(cp + 9, &cp));
                 } else {
                         while (*cp != ' ' && *cp)
                                 ++cp;
@@ -458,7 +450,7 @@ efi_init (void)
         /* Show what we know for posterity */
         c16 = __va(efi.systab->fw_vendor);
         if (c16) {
-                for (i = 0;i < (int) sizeof(vendor) && *c16; ++i)
+                for (i = 0;i < (int) sizeof(vendor) - 1 && *c16; ++i)
                         vendor[i] = *c16++;
                 vendor[i] = '\0';
         }
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 7a6ffd613789..930fdfca6ddb 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -569,7 +569,9 @@ GLOBAL_ENTRY(ia64_trace_syscall)
 .mem.offset 0,0; st8.spill [r2]=r8              // store return value in slot for r8
 .mem.offset 8,0; st8.spill [r3]=r10             // clear error indication in slot for r10
         br.call.sptk.many rp=syscall_trace_leave // give parent a chance to catch return value
-.ret3:  br.cond.sptk .work_pending_syscall_end
+.ret3:
+(pUStk) cmp.eq.unc p6,p0=r0,r0                  // p6 <- pUStk
+        br.cond.sptk .work_pending_syscall_end
 
 strace_error:
         ld8 r3=[r2]                             // load pt_regs.r8
@@ -1601,5 +1603,21 @@ sys_call_table:
         data8 sys_inotify_add_watch
         data8 sys_inotify_rm_watch
         data8 sys_migrate_pages                 // 1280
+        data8 sys_openat
+        data8 sys_mkdirat
+        data8 sys_mknodat
+        data8 sys_fchownat
+        data8 sys_futimesat                     // 1285
+        data8 sys_newfstatat
+        data8 sys_unlinkat
+        data8 sys_renameat
+        data8 sys_linkat
+        data8 sys_symlinkat                     // 1290
+        data8 sys_readlinkat
+        data8 sys_fchmodat
+        data8 sys_faccessat
+        data8 sys_ni_syscall                    // reserved for pselect
+        data8 sys_ni_syscall                    // 1295 reserved for ppoll
+        data8 sys_unshare
 
         .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
index ce423910ca97..7a05b1cb2ad5 100644
--- a/arch/ia64/kernel/fsys.S
+++ b/arch/ia64/kernel/fsys.S
@@ -878,31 +878,7 @@ fsyscall_table:
         data8 0                         // timer_delete
         data8 0                         // clock_settime
         data8 fsys_clock_gettime        // clock_gettime
-        data8 0                         // clock_getres         // 1255
-        data8 0                         // clock_nanosleep
-        data8 0                         // fstatfs64
-        data8 0                         // statfs64
-        data8 0
-        data8 0                                                 // 1260
-        data8 0
-        data8 0                         // mq_open
-        data8 0                         // mq_unlink
-        data8 0                         // mq_timedsend
-        data8 0                         // mq_timedreceive      // 1265
-        data8 0                         // mq_notify
-        data8 0                         // mq_getsetattr
-        data8 0                         // kexec_load
-        data8 0
-        data8 0                                                 // 1270
-        data8 0
-        data8 0
-        data8 0
-        data8 0
-        data8 0                                                 // 1275
-        data8 0
-        data8 0
-        data8 0
-        data8 0
-        data8 0                                                 // 1280
 
-        .org fsyscall_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
+        // fill in zeros for the remaining entries
+        .zero:
+        .space fsyscall_table + 8*NR_syscalls - .zero, 0
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index fbc7ea35dd57..f1778a84ea61 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -352,6 +352,7 @@ start_ap:
         mov ar.rsc=0            // place RSE in enforced lazy mode
         ;;
         loadrs                  // clear the dirty partition
+        mov IA64_KR(PER_CPU_DATA)=r0    // clear physical per-CPU base
         ;;
         mov ar.bspstore=r2      // establish the new RSE stack
         ;;
diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c
index e72de580ebbf..bbcfd08378a6 100644
--- a/arch/ia64/kernel/ia64_ksyms.c
+++ b/arch/ia64/kernel/ia64_ksyms.c
@@ -10,23 +10,8 @@
 
 #include <linux/string.h>
 EXPORT_SYMBOL(memset);
-EXPORT_SYMBOL(memchr);
-EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memcpy);
-EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
-EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strncmp);
-EXPORT_SYMBOL(strncpy);
-EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strstr);
-EXPORT_SYMBOL(strpbrk);
 
 #include <asm/checksum.h>
 EXPORT_SYMBOL(ip_fast_csum);            /* hand-coded assembly */
diff --git a/arch/ia64/kernel/ivt.S b/arch/ia64/kernel/ivt.S
index 301f2e9d262e..dcd906fe5749 100644
--- a/arch/ia64/kernel/ivt.S
+++ b/arch/ia64/kernel/ivt.S
@@ -561,11 +561,12 @@ ENTRY(dirty_bit)
         ;;                                      // avoid RAW on r18
         mov ar.ccv=r18                          // set compare value for cmpxchg
         or r25=_PAGE_D|_PAGE_A,r18              // set the dirty and accessed bits
+        tbit.z p7,p6 = r18,_PAGE_P_BIT          // Check present bit
         ;;
-        cmpxchg8.acq r26=[r17],r25,ar.ccv
+(p6)    cmpxchg8.acq r26=[r17],r25,ar.ccv       // Only update if page is present
         mov r24=PAGE_SHIFT<<2
         ;;
-        cmp.eq p6,p7=r26,r18
+(p6)    cmp.eq p6,p7=r26,r18                    // Only compare if page is present
         ;;
 (p6)    itc.d r25                               // install updated PTE
         ;;
@@ -626,11 +627,12 @@ ENTRY(iaccess_bit)
         ;;
         mov ar.ccv=r18                          // set compare value for cmpxchg
         or r25=_PAGE_A,r18                      // set the accessed bit
+        tbit.z p7,p6 = r18,_PAGE_P_BIT          // Check present bit
         ;;
-        cmpxchg8.acq r26=[r17],r25,ar.ccv
+(p6)    cmpxchg8.acq r26=[r17],r25,ar.ccv       // Only if page present
         mov r24=PAGE_SHIFT<<2
         ;;
-        cmp.eq p6,p7=r26,r18
+(p6)    cmp.eq p6,p7=r26,r18                    // Only if page present
         ;;
 (p6)    itc.i r25                               // install updated PTE
         ;;
@@ -680,11 +682,12 @@ ENTRY(daccess_bit)
         ;;                                      // avoid RAW on r18
         mov ar.ccv=r18                          // set compare value for cmpxchg
         or r25=_PAGE_A,r18                      // set the dirty bit
+        tbit.z p7,p6 = r18,_PAGE_P_BIT          // Check present bit
         ;;
-        cmpxchg8.acq r26=[r17],r25,ar.ccv
+(p6)    cmpxchg8.acq r26=[r17],r25,ar.ccv       // Only if page is present
         mov r24=PAGE_SHIFT<<2
         ;;
-        cmp.eq p6,p7=r26,r18
+(p6)    cmp.eq p6,p7=r26,r18                    // Only if page is present
         ;;
 (p6)    itc.d r25                               // install updated PTE
         /*
@@ -1362,7 +1365,6 @@ END(debug_vector)
 // 0x5a00 Entry 30 (size 16 bundles) Unaligned Reference (57)
 ENTRY(unaligned_access)
         DBG_FAULT(30)
-        mov r16=cr.ipsr
         mov r31=pr              // prepare to save predicates
         ;;
         br.sptk.many dispatch_unaligned_handler
diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index 3492e3211a44..e883d85906db 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -123,8 +123,9 @@ mca_page_isolate(unsigned long paddr)
 void
 mca_handler_bh(unsigned long paddr)
 {
-        printk(KERN_DEBUG "OS_MCA: process [pid: %d](%s) encounters MCA.\n",
-                current->pid, current->comm);
+        printk(KERN_ERR
+                "OS_MCA: process [pid: %d](%s) encounters MCA (paddr=%lx)\n",
+                current->pid, current->comm, paddr);
 
         spin_lock(&mca_bh_lock);
         switch (mca_page_isolate(paddr)) {
@@ -132,7 +133,7 @@ mca_handler_bh(unsigned long paddr)
                 printk(KERN_DEBUG "Page isolation: ( %lx ) success.\n", paddr);
                 break;
         case ISOLATE_NG:
-                printk(KERN_DEBUG "Page isolation: ( %lx ) failure.\n", paddr);
+                printk(KERN_CRIT "Page isolation: ( %lx ) failure.\n", paddr);
                 break;
         default:
                 break;
@@ -437,6 +438,9 @@ recover_from_read_error(slidx_table_t *slidx,
          *    the process not have any locks of kernel.
          */
 
+        /* Is minstate valid? */
+        if (!peidx_bottom(peidx) || !(peidx_bottom(peidx)->valid.minstate))
+                return 0;
         psr1 =(struct ia64_psr *)&(peidx_minstate_area(peidx)->pmsa_ipsr);
 
         /*
@@ -564,10 +568,15 @@ recover_from_processor_error(int platform, slidx_table_t *slidx,
                 return 0;
 
         /*
-         * If there is no bus error, record is weird but we need not to recover.
+         * The cache check and bus check bits have four possible states
+         *   cc bc
+         *    0  0      Weird record, not recovered
+         *    1  0      Cache error, not recovered
+         *    0  1      I/O error, attempt recovery
+         *    1  1      Memory error, attempt recovery
          */
         if (psp->bc == 0 || pbci == NULL)
-                return 1;
+                return 0;
 
         /*
          * Sorry, we cannot handle so many.
diff --git a/arch/ia64/kernel/sal.c b/arch/ia64/kernel/sal.c
index acc0f132f86c..056f7a6eedc7 100644
--- a/arch/ia64/kernel/sal.c
+++ b/arch/ia64/kernel/sal.c
@@ -14,6 +14,7 @@
 #include <linux/spinlock.h>
 #include <linux/string.h>
 
+#include <asm/delay.h>
 #include <asm/page.h>
 #include <asm/sal.h>
 #include <asm/pal.h>
@@ -214,6 +215,78 @@ chk_nointroute_opt(void)
 static void __init sal_desc_ap_wakeup(void *p) { }
 #endif
 
+/*
+ * HP rx5670 firmware polls for interrupts during SAL_CACHE_FLUSH by reading
+ * cr.ivr, but it never writes cr.eoi.  This leaves any interrupt marked as
+ * "in-service" and masks other interrupts of equal or lower priority.
+ *
+ * HP internal defect reports: F1859, F2775, F3031.
+ */
+static int sal_cache_flush_drops_interrupts;
+
+static void __init
+check_sal_cache_flush (void)
+{
+        unsigned long flags, itv;
+        int cpu;
+        u64 vector;
+
+        cpu = get_cpu();
+        local_irq_save(flags);
+
+        /*
+         * Schedule a timer interrupt, wait until it's reported, and see if
+         * SAL_CACHE_FLUSH drops it.
+         */
+        itv = ia64_get_itv();
+        BUG_ON((itv & (1 << 16)) == 0);
+
+        ia64_set_itv(IA64_TIMER_VECTOR);
+        ia64_set_itm(ia64_get_itc() + 1000);
+
+        while (!ia64_get_irr(IA64_TIMER_VECTOR))
+                cpu_relax();
+
+        ia64_sal_cache_flush(3);
+
+        if (ia64_get_irr(IA64_TIMER_VECTOR)) {
+                vector = ia64_get_ivr();
+                ia64_eoi();
+                WARN_ON(vector != IA64_TIMER_VECTOR);
+        } else {
+                sal_cache_flush_drops_interrupts = 1;
+                printk(KERN_ERR "SAL: SAL_CACHE_FLUSH drops interrupts; "
+                        "PAL_CACHE_FLUSH will be used instead\n");
+                ia64_eoi();
+        }
+
+        ia64_set_itv(itv);
+        local_irq_restore(flags);
+        put_cpu();
+}
+
+s64
+ia64_sal_cache_flush (u64 cache_type)
+{
+        struct ia64_sal_retval isrv;
+
+        if (sal_cache_flush_drops_interrupts) {
+                unsigned long flags;
+                u64 progress;
+                s64 rc;
+
+                progress = 0;
+                local_irq_save(flags);
+                rc = ia64_pal_cache_flush(cache_type,
+                        PAL_CACHE_FLUSH_INVALIDATE, &progress, NULL);
+                local_irq_restore(flags);
+                return rc;
+        }
+
+        SAL_CALL(isrv, SAL_CACHE_FLUSH, cache_type, 0, 0, 0, 0, 0, 0);
+        return isrv.status;
+}
+
 void __init
 ia64_sal_init (struct ia64_sal_systab *systab)
 {
@@ -262,6 +335,8 @@ ia64_sal_init (struct ia64_sal_systab *systab)
                 }
                 p += SAL_DESC_SIZE(*p);
         }
+
+        check_sal_cache_flush();
 }
 
 int
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index c0766575a3a2..3258e09278d0 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -71,6 +71,8 @@ unsigned long __per_cpu_offset[NR_CPUS];
 EXPORT_SYMBOL(__per_cpu_offset);
 #endif
 
+extern void ia64_setup_printk_clock(void);
+
 DEFINE_PER_CPU(struct cpuinfo_ia64, cpu_info);
 DEFINE_PER_CPU(unsigned long, local_per_cpu_offset);
 DEFINE_PER_CPU(unsigned long, ia64_phys_stacked_size_p8);
@@ -428,6 +430,7 @@ setup_arch (char **cmdline_p)
         if (early_console_setup(*cmdline_p) == 0)
                 mark_bsp_online();
 
+        parse_early_param();
 #ifdef CONFIG_ACPI
         /* Initialize the ACPI boot-time table parser */
         acpi_table_init();
@@ -445,6 +448,8 @@ setup_arch (char **cmdline_p)
         /* process SAL system table: */
         ia64_sal_init(efi.sal_systab);
 
+        ia64_setup_printk_clock();
+
 #ifdef CONFIG_SMP
         cpu_physical_id(0) = hard_smp_processor_id();
 
@@ -684,6 +689,9 @@ void
 setup_per_cpu_areas (void)
 {
         /* start_kernel() requires this... */
+#ifdef CONFIG_ACPI_HOTPLUG_CPU
+        prefill_possible_map();
+#endif
 }
 
 /*
diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c
index 8f44e7d2df66..b681ef34a86e 100644
--- a/arch/ia64/kernel/smpboot.c
+++ b/arch/ia64/kernel/smpboot.c
@@ -129,7 +129,7 @@ DEFINE_PER_CPU(int, cpu_state);
 /* Bitmasks of currently online, and possible CPUs */
 cpumask_t cpu_online_map;
 EXPORT_SYMBOL(cpu_online_map);
-cpumask_t cpu_possible_map;
+cpumask_t cpu_possible_map = CPU_MASK_NONE;
 EXPORT_SYMBOL(cpu_possible_map);
 
 cpumask_t cpu_core_map[NR_CPUS] __cacheline_aligned;
@@ -506,9 +506,6 @@ smp_build_cpu_map (void)
 
         for (cpu = 0; cpu < NR_CPUS; cpu++) {
                 ia64_cpu_to_sapicid[cpu] = -1;
-#ifdef CONFIG_HOTPLUG_CPU
-                cpu_set(cpu, cpu_possible_map);
-#endif
         }
 
         ia64_cpu_to_sapicid[0] = boot_cpu_id;
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index 028a2b95936c..307d01e15b2e 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -250,31 +250,53 @@ time_init (void)
         set_normalized_timespec(&wall_to_monotonic, -xtime.tv_sec, -xtime.tv_nsec);
 }
 
-#define SMALLUSECS 100
+/*
+ * Generic udelay assumes that if preemption is allowed and the thread
+ * migrates to another CPU, that the ITC values are synchronized across
+ * all CPUs.
+ */
+static void
+ia64_itc_udelay (unsigned long usecs)
+{
+        unsigned long start = ia64_get_itc();
+        unsigned long end = start + usecs*local_cpu_data->cyc_per_usec;
+
+        while (time_before(ia64_get_itc(), end))
+                cpu_relax();
+}
+
+void (*ia64_udelay)(unsigned long usecs) = &ia64_itc_udelay;
 
 void
 udelay (unsigned long usecs)
 {
-        unsigned long start;
-        unsigned long cycles;
-        unsigned long smallusecs;
+        (*ia64_udelay)(usecs);
+}
+EXPORT_SYMBOL(udelay);
 
-        /*
-         * Execute the non-preemptible delay loop (because the ITC might
-         * not be synchronized between CPUS) in relatively short time
-         * chunks, allowing preemption between the chunks.
-         */
-        while (usecs > 0) {
-                smallusecs = (usecs > SMALLUSECS) ? SMALLUSECS : usecs;
-                preempt_disable();
-                cycles = smallusecs*local_cpu_data->cyc_per_usec;
-                start = ia64_get_itc();
+static unsigned long long ia64_itc_printk_clock(void)
+{
+        if (ia64_get_kr(IA64_KR_PER_CPU_DATA))
+                return sched_clock();
+        return 0;
+}
+
+static unsigned long long ia64_default_printk_clock(void)
+{
+        return (unsigned long long)(jiffies_64 - INITIAL_JIFFIES) *
+                (1000000000/HZ);
+}
 
-                while (ia64_get_itc() - start < cycles)
-                        cpu_relax();
+unsigned long long (*ia64_printk_clock)(void) = &ia64_default_printk_clock;
 
-                preempt_enable();
-                usecs -= smallusecs;
-        }
+unsigned long long printk_clock(void)
+{
+        return ia64_printk_clock();
+}
+
+void __init
+ia64_setup_printk_clock(void)
+{
+        if (!(sal_platform_features & IA64_SAL_PLATFORM_FEATURE_ITC_DRIFT))
+                ia64_printk_clock = ia64_itc_printk_clock;
 }
-EXPORT_SYMBOL(udelay);
diff --git a/arch/ia64/kernel/traps.c b/arch/ia64/kernel/traps.c
index 55391901b013..dabd6c32641e 100644
--- a/arch/ia64/kernel/traps.c
+++ b/arch/ia64/kernel/traps.c
@@ -16,6 +16,7 @@
 #include <linux/module.h>       /* for EXPORT_SYMBOL */
 #include <linux/hardirq.h>
 #include <linux/kprobes.h>
+#include <linux/delay.h>                /* for ssleep() */
 
 #include <asm/fpswa.h>
 #include <asm/ia32.h>
@@ -116,6 +117,13 @@ die (const char *str, struct pt_regs *regs, long err)
         bust_spinlocks(0);
         die.lock_owner = -1;
         spin_unlock_irq(&die.lock);
+
+        if (panic_on_oops) {
+                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
+                ssleep(5);
+                panic("Fatal exception");
+        }
+
         do_exit(SIGSEGV);
 }
 
diff --git a/arch/ia64/kernel/unaligned.c b/arch/ia64/kernel/unaligned.c
index f9e0ae936d1a..1e357550c776 100644
--- a/arch/ia64/kernel/unaligned.c
+++ b/arch/ia64/kernel/unaligned.c
@@ -24,7 +24,7 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 
-extern void die_if_kernel(char *str, struct pt_regs *regs, long err) __attribute__ ((noreturn));
+extern void die_if_kernel(char *str, struct pt_regs *regs, long err);
 
 #undef DEBUG_UNALIGNED_TRAP
 
@@ -53,6 +53,15 @@ dump (const char *str, void *vp, size_t len)
 #define SIGN_EXT9               0xffffffffffffff00ul
 
 /*
+ *  sysctl settable hook which tells the kernel whether to honor the
+ *  IA64_THREAD_UAC_NOPRINT prctl.  Because this is user settable, we want
+ *  to allow the super user to enable/disable this for security reasons
+ *  (i.e. don't allow attacker to fill up logs with unaligned accesses).
+ */
+int no_unaligned_warning;
+static int noprint_warning;
+
+/*
  * For M-unit:
  *
  *  opcode |   m  |   x6    |
@@ -1324,8 +1333,9 @@ ia64_handle_unaligned (unsigned long ifa, struct pt_regs *regs)
                 if ((current->thread.flags & IA64_THREAD_UAC_SIGBUS) != 0)
                         goto force_sigbus;
 
-                if (!(current->thread.flags & IA64_THREAD_UAC_NOPRINT)
-                    && within_logging_rate_limit())
+                if (!no_unaligned_warning &&
+                    !(current->thread.flags & IA64_THREAD_UAC_NOPRINT) &&
+                    within_logging_rate_limit())
                 {
                         char buf[200];  /* comm[] is at most 16 bytes... */
                         size_t len;
@@ -1340,7 +1350,22 @@ ia64_handle_unaligned (unsigned long ifa, struct pt_regs *regs)
                         if (user_mode(regs))
                                 tty_write_message(current->signal->tty, buf);
                         buf[len-1] = '\0';      /* drop '\r' */
-                        printk(KERN_WARNING "%s", buf); /* watch for command names containing %s */
+                        /* watch for command names containing %s */
+                        printk(KERN_WARNING "%s", buf);
+                } else {
+                        if (no_unaligned_warning && !noprint_warning) {
+                                noprint_warning = 1;
+                                printk(KERN_WARNING "%s(%d) encountered an "
+                                       "unaligned exception which required\n"
+                                       "kernel assistance, which degrades "
+                                       "the performance of the application.\n"
+                                       "Unaligned exception warnings have "
+                                       "been disabled by the system "
+                                       "administrator\n"
+                                       "echo 0 > /proc/sys/kernel/ignore-"
+                                       "unaligned-usertrap to re-enable\n",
+                                       current->comm, current->pid);
+                        }
                 }
         } else {
                 if (within_logging_rate_limit())
diff --git a/arch/ia64/pci/pci.c b/arch/ia64/pci/pci.c
index 0b30ca006286..9ba32b2d96d0 100644
--- a/arch/ia64/pci/pci.c
+++ b/arch/ia64/pci/pci.c
@@ -579,7 +579,7 @@ pcibios_align_resource (void *data, struct resource *res,
 char * __init
 pcibios_setup (char *str)
 {
-        return NULL;
+        return str;
 }
 
 int
diff --git a/arch/ia64/sn/Makefile b/arch/ia64/sn/Makefile
index a269f6d84c29..79a7df02e812 100644
--- a/arch/ia64/sn/Makefile
+++ b/arch/ia64/sn/Makefile
@@ -9,6 +9,4 @@
 # Makefile for the sn ia64 subplatform
 #
 
-CPPFLAGS += -I$(srctree)/arch/ia64/sn/include
-
 obj-y += kernel/ pci/
diff --git a/arch/ia64/sn/kernel/Makefile b/arch/ia64/sn/kernel/Makefile
index 4351c4ff9845..3e9b4eea7418 100644
--- a/arch/ia64/sn/kernel/Makefile
+++ b/arch/ia64/sn/kernel/Makefile
@@ -7,6 +7,8 @@
 # Copyright (C) 1999,2001-2005 Silicon Graphics, Inc.  All Rights Reserved.
 #
 
+CPPFLAGS += -I$(srctree)/arch/ia64/sn/include
+
 obj-y                           += setup.o bte.o bte_error.o irq.o mca.o idle.o \
                                    huberror.o io_init.o iomv.o klconflib.o sn2/
 obj-$(CONFIG_IA64_GENERIC)      += machvec.o
diff --git a/arch/ia64/sn/kernel/bte.c b/arch/ia64/sn/kernel/bte.c
index dd73c0cb754b..1f11db470d90 100644
--- a/arch/ia64/sn/kernel/bte.c
+++ b/arch/ia64/sn/kernel/bte.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2000-2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 #include <linux/config.h>
@@ -186,18 +186,13 @@ retry_bteop:
 
         /* Initialize the notification to a known value. */
         *bte->most_rcnt_na = BTE_WORD_BUSY;
-        notif_phys_addr = TO_PHYS(ia64_tpa((unsigned long)bte->most_rcnt_na));
+        notif_phys_addr = (u64)bte->most_rcnt_na;
 
-        if (is_shub2()) {
-                src = SH2_TIO_PHYS_TO_DMA(src);
-                dest = SH2_TIO_PHYS_TO_DMA(dest);
-                notif_phys_addr = SH2_TIO_PHYS_TO_DMA(notif_phys_addr);
-        }
         /* Set the source and destination registers */
-        BTE_PRINTKV(("IBSA = 0x%lx)\n", (TO_PHYS(src))));
-        BTE_SRC_STORE(bte, TO_PHYS(src));
-        BTE_PRINTKV(("IBDA = 0x%lx)\n", (TO_PHYS(dest))));
-        BTE_DEST_STORE(bte, TO_PHYS(dest));
+        BTE_PRINTKV(("IBSA = 0x%lx)\n", src));
+        BTE_SRC_STORE(bte, src);
+        BTE_PRINTKV(("IBDA = 0x%lx)\n", dest));
+        BTE_DEST_STORE(bte, dest);
 
         /* Set the notification register */
         BTE_PRINTKV(("IBNA = 0x%lx)\n", notif_phys_addr));
diff --git a/arch/ia64/sn/kernel/io_init.c b/arch/ia64/sn/kernel/io_init.c
index a4c78152b336..dfb3f2902379 100644
--- a/arch/ia64/sn/kernel/io_init.c
+++ b/arch/ia64/sn/kernel/io_init.c
@@ -23,6 +23,10 @@
 #include "xtalk/hubdev.h"
 #include "xtalk/xwidgetdev.h"
 
+
+extern void sn_init_cpei_timer(void);
+extern void register_sn_procfs(void);
+
 static struct list_head sn_sysdata_list;
 
 /* sysdata list struct */
@@ -40,12 +44,12 @@ struct brick {
         struct slab_info slab_info[MAX_SLABS + 1];
 };
 
-int sn_ioif_inited = 0;         /* SN I/O infrastructure initialized? */
+int sn_ioif_inited;             /* SN I/O infrastructure initialized? */
 
 struct sn_pcibus_provider *sn_pci_provider[PCIIO_ASIC_MAX_TYPES];       /* indexed by asic type */
 
-static int max_segment_number = 0; /* Default highest segment number */
-static int max_pcibus_number = 255; /* Default highest pci bus number */
+static int max_segment_number;           /* Default highest segment number */
+static int max_pcibus_number = 255;     /* Default highest pci bus number */
 
 /*
  * Hooks and struct for unsupported pci providers
@@ -84,7 +88,6 @@ static inline u64
 sal_get_device_dmaflush_list(u64 nasid, u64 widget_num, u64 device_num,
                              u64 address)
 {
-
         struct ia64_sal_retval ret_stuff;
         ret_stuff.status = 0;
         ret_stuff.v0 = 0;
@@ -94,7 +97,6 @@ sal_get_device_dmaflush_list(u64 nasid, u64 widget_num, u64 device_num,
                         (u64) nasid, (u64) widget_num,
                         (u64) device_num, (u64) address, 0, 0, 0);
         return ret_stuff.status;
-
 }
 
 /*
@@ -102,7 +104,6 @@ sal_get_device_dmaflush_list(u64 nasid, u64 widget_num, u64 device_num,
  */
 static inline u64 sal_get_hubdev_info(u64 handle, u64 address)
 {
-
         struct ia64_sal_retval ret_stuff;
         ret_stuff.status = 0;
         ret_stuff.v0 = 0;
@@ -118,7 +119,6 @@ static inline u64 sal_get_hubdev_info(u64 handle, u64 address)
  */
 static inline u64 sal_get_pcibus_info(u64 segment, u64 busnum, u64 address)
 {
-
         struct ia64_sal_retval ret_stuff;
         ret_stuff.status = 0;
         ret_stuff.v0 = 0;
@@ -208,14 +208,14 @@ static s64 sn_device_fixup_war(u64 nasid, u64 widget, int device,
  * sn_fixup_ionodes() - This routine initializes the HUB data strcuture for
  *      each node in the system.
  */
-static void sn_fixup_ionodes(void)
+static void __init sn_fixup_ionodes(void)
 {
         struct sn_flush_device_kernel *sn_flush_device_kernel;
         struct sn_flush_device_kernel *dev_entry;
         struct hubdev_info *hubdev;
         u64 status;
         u64 nasid;
-        int i, widget, device;
+        int i, widget, device, size;
 
         /*
          * Get SGI Specific HUB chipset information.
@@ -251,48 +251,37 @@ static void sn_fixup_ionodes(void)
                 if (!hubdev->hdi_flush_nasid_list.widget_p)
                         continue;
 
+                size = (HUB_WIDGET_ID_MAX + 1) *
+                        sizeof(struct sn_flush_device_kernel *);
                 hubdev->hdi_flush_nasid_list.widget_p =
-                    kmalloc((HUB_WIDGET_ID_MAX + 1) *
-                            sizeof(struct sn_flush_device_kernel *),
-                            GFP_KERNEL);
-                memset(hubdev->hdi_flush_nasid_list.widget_p, 0x0,
-                       (HUB_WIDGET_ID_MAX + 1) *
-                       sizeof(struct sn_flush_device_kernel *));
+                        kzalloc(size, GFP_KERNEL);
+                if (!hubdev->hdi_flush_nasid_list.widget_p)
+                        BUG();
 
                 for (widget = 0; widget <= HUB_WIDGET_ID_MAX; widget++) {
-                        sn_flush_device_kernel = kmalloc(DEV_PER_WIDGET *
-                                                         sizeof(struct
-                                                        sn_flush_device_kernel),
-                                                        GFP_KERNEL);
+                        size = DEV_PER_WIDGET *
+                                sizeof(struct sn_flush_device_kernel);
+                        sn_flush_device_kernel = kzalloc(size, GFP_KERNEL);
                         if (!sn_flush_device_kernel)
                                 BUG();
-                        memset(sn_flush_device_kernel, 0x0,
-                               DEV_PER_WIDGET *
-                               sizeof(struct sn_flush_device_kernel));
 
                         dev_entry = sn_flush_device_kernel;
                         for (device = 0; device < DEV_PER_WIDGET;
                              device++,dev_entry++) {
-                                dev_entry->common = kmalloc(sizeof(struct
-                                                        sn_flush_device_common),
-                                                            GFP_KERNEL);
+                                size = sizeof(struct sn_flush_device_common);
+                                dev_entry->common = kzalloc(size, GFP_KERNEL);
                                 if (!dev_entry->common)
                                         BUG();
-                                memset(dev_entry->common, 0x0, sizeof(struct
-                                                       sn_flush_device_common));
 
                                 if (sn_prom_feature_available(
                                                        PRF_DEVICE_FLUSH_LIST))
                                         status = sal_get_device_dmaflush_list(
-                                                                          nasid,
-                                                                         widget,
-                                                                         device,
-                                                      (u64)(dev_entry->common));
+                                                     nasid, widget, device,
+                                                     (u64)(dev_entry->common));
                                 else
                                         status = sn_device_fixup_war(nasid,
-                                                                     widget,
-                                                                     device,
-                                                             dev_entry->common);
+                                                     widget, device,
+                                                     dev_entry->common);
                                 if (status != SALRET_OK)
                                         panic("SAL call failed: %s\n",
                                               ia64_sal_strerror(status));
@@ -383,13 +372,12 @@ void sn_pci_fixup_slot(struct pci_dev *dev)
 
         pci_dev_get(dev); /* for the sysdata pointer */
         pcidev_info = kzalloc(sizeof(struct pcidev_info), GFP_KERNEL);
-        if (pcidev_info <= 0)
+        if (!pcidev_info)
                 BUG();          /* Cannot afford to run out of memory */
 
-        sn_irq_info = kmalloc(sizeof(struct sn_irq_info), GFP_KERNEL);
-        if (sn_irq_info <= 0)
+        sn_irq_info = kzalloc(sizeof(struct sn_irq_info), GFP_KERNEL);
+        if (!sn_irq_info)
                 BUG();          /* Cannot afford to run out of memory */
-        memset(sn_irq_info, 0, sizeof(struct sn_irq_info));
 
         /* Call to retrieve pci device information needed by kernel. */
         status = sal_get_pcidev_info((u64) segment, (u64) dev->bus->number, 
@@ -467,6 +455,13 @@ void sn_pci_fixup_slot(struct pci_dev *dev)
                 pcidev_info->pdi_sn_irq_info = NULL;
                 kfree(sn_irq_info);
         }
+
+        /*
+         * MSI currently not supported on altix.  Remove this when
+         * the MSI abstraction patches are integrated into the kernel
+         * (sometime after 2.6.16 releases)
+         */
+        dev->no_msi = 1;
 }
 
 /*
@@ -475,13 +470,13 @@ void sn_pci_fixup_slot(struct pci_dev *dev)
  */
 void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
 {
-        int status = 0;
+        int status;
         int nasid, cnode;
         struct pci_controller *controller;
         struct sn_pci_controller *sn_controller;
         struct pcibus_bussoft *prom_bussoft_ptr;
         struct hubdev_info *hubdev_info;
-        void *provider_soft = NULL;
+        void *provider_soft;
         struct sn_pcibus_provider *provider;
 
         status = sal_get_pcibus_info((u64) segment, (u64) busnum,
@@ -528,6 +523,8 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
         bus->sysdata = controller;
         if (provider->bus_fixup)
                 provider_soft = (*provider->bus_fixup) (prom_bussoft_ptr, controller);
+        else
+                provider_soft = NULL;
 
         if (provider_soft == NULL) {
                 /* fixup failed or not applicable */
@@ -610,15 +607,15 @@ void sn_bus_store_sysdata(struct pci_dev *dev)
 void sn_bus_free_sysdata(void)
 {
         struct sysdata_el *element;
-        struct list_head *list;
+        struct list_head *list, *safe;
 
-sn_sysdata_free_start:
-        list_for_each(list, &sn_sysdata_list) {
+        list_for_each_safe(list, safe, &sn_sysdata_list) {
                 element = list_entry(list, struct sysdata_el, entry);
                 list_del(&element->entry);
+                list_del(&(((struct pcidev_info *)
+                             (element->sysdata))->pdi_list));
                 kfree(element->sysdata);
                 kfree(element);
-                goto sn_sysdata_free_start;
         }
         return;
 }
@@ -631,13 +628,8 @@ sn_sysdata_free_start:
 
 static int __init sn_pci_init(void)
 {
-        int i = 0;
-        int j = 0;
+        int i, j;
         struct pci_dev *pci_dev = NULL;
-        extern void sn_init_cpei_timer(void);
-#ifdef CONFIG_PROC_FS
-        extern void register_sn_procfs(void);
-#endif
 
         if (!ia64_platform_is("sn2") || IS_RUNNING_ON_FAKE_PROM())
                 return 0;
@@ -693,32 +685,29 @@ static int __init sn_pci_init(void)
  */
 void hubdev_init_node(nodepda_t * npda, cnodeid_t node)
 {
-
         struct hubdev_info *hubdev_info;
+        int size;
+        pg_data_t *pg;
+
+        size = sizeof(struct hubdev_info);
 
         if (node >= num_online_nodes()) /* Headless/memless IO nodes */
-                hubdev_info =
-                    (struct hubdev_info *)alloc_bootmem_node(NODE_DATA(0),
-                                                             sizeof(struct
-                                                                    hubdev_info));
+                pg = NODE_DATA(0);
         else
-                hubdev_info =
-                    (struct hubdev_info *)alloc_bootmem_node(NODE_DATA(node),
-                                                             sizeof(struct
-                                                                    hubdev_info));
-        npda->pdinfo = (void *)hubdev_info;
+                pg = NODE_DATA(node);
+
+        hubdev_info = (struct hubdev_info *)alloc_bootmem_node(pg, size);
 
+        npda->pdinfo = (void *)hubdev_info;
 }
 
 geoid_t
 cnodeid_get_geoid(cnodeid_t cnode)
 {
-
         struct hubdev_info *hubdev;
 
         hubdev = (struct hubdev_info *)(NODEPDA(cnode)->pdinfo);
         return hubdev->hdi_geoid;
-
 }
 
 subsys_initcall(sn_pci_init);
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index ec37084bdc17..c373113d073a 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -5,11 +5,12 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2000-2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 #include <linux/irq.h>
 #include <linux/spinlock.h>
+#include <linux/init.h>
 #include <asm/sn/addrs.h>
 #include <asm/sn/arch.h>
 #include <asm/sn/intr.h>
@@ -76,17 +77,15 @@ static void sn_enable_irq(unsigned int irq)
 
 static void sn_ack_irq(unsigned int irq)
 {
-        u64 event_occurred, mask = 0;
+        u64 event_occurred, mask;
 
         irq = irq & 0xff;
-        event_occurred =
-            HUB_L((u64*)LOCAL_MMR_ADDR(SH_EVENT_OCCURRED));
+        event_occurred = HUB_L((u64*)LOCAL_MMR_ADDR(SH_EVENT_OCCURRED));
         mask = event_occurred & SH_ALL_INT_MASK;
-        HUB_S((u64*)LOCAL_MMR_ADDR(SH_EVENT_OCCURRED_ALIAS),
-              mask);
+        HUB_S((u64*)LOCAL_MMR_ADDR(SH_EVENT_OCCURRED_ALIAS), mask);
         __set_bit(irq, (volatile void *)pda->sn_in_service_ivecs);
 
-        move_irq(irq);
+        move_native_irq(irq);
 }
 
 static void sn_end_irq(unsigned int irq)
@@ -219,9 +218,8 @@ static void register_intr_pda(struct sn_irq_info *sn_irq_info)
                 pdacpu(cpu)->sn_last_irq = irq;
         }
 
-        if (pdacpu(cpu)->sn_first_irq == 0 || pdacpu(cpu)->sn_first_irq > irq) {
+        if (pdacpu(cpu)->sn_first_irq == 0 || pdacpu(cpu)->sn_first_irq > irq)
                 pdacpu(cpu)->sn_first_irq = irq;
-        }
 }
 
 static void unregister_intr_pda(struct sn_irq_info *sn_irq_info)
@@ -289,7 +287,7 @@ void sn_irq_fixup(struct pci_dev *pci_dev, struct sn_irq_info *sn_irq_info)
         list_add_rcu(&sn_irq_info->list, sn_irq_lh[sn_irq_info->irq_irq]);
         spin_unlock(&sn_irq_info_lock);
 
-        (void)register_intr_pda(sn_irq_info);
+        register_intr_pda(sn_irq_info);
 }
 
 void sn_irq_unfixup(struct pci_dev *pci_dev)
@@ -301,7 +299,9 @@ void sn_irq_unfixup(struct pci_dev *pci_dev)
                 return;
 
         sn_irq_info = SN_PCIDEV_INFO(pci_dev)->pdi_sn_irq_info;
-        if (!sn_irq_info || !sn_irq_info->irq_irq) {
+        if (!sn_irq_info)
+                return;
+        if (!sn_irq_info->irq_irq) {
                 kfree(sn_irq_info);
                 return;
         }
@@ -419,7 +419,7 @@ void sn_lb_int_war_check(void)
         rcu_read_unlock();
 }
 
-void sn_irq_lh_init(void)
+void __init sn_irq_lh_init(void)
 {
         int i;
 
@@ -434,5 +434,4 @@ void sn_irq_lh_init(void)
 
                 INIT_LIST_HEAD(sn_irq_lh[i]);
         }
-
 }
diff --git a/arch/ia64/sn/kernel/klconflib.c b/arch/ia64/sn/kernel/klconflib.c
index 0f11a3299cd2..87682b48ef83 100644
--- a/arch/ia64/sn/kernel/klconflib.c
+++ b/arch/ia64/sn/kernel/klconflib.c
@@ -78,31 +78,30 @@ format_module_id(char *buffer, moduleid_t m, int fmt)
         position = MODULE_GET_BPOS(m);
 
         if ((fmt == MODULE_FORMAT_BRIEF) || (fmt == MODULE_FORMAT_LCD)) {
-            /* Brief module number format, eg. 002c15 */
+                /* Brief module number format, eg. 002c15 */
 
-            /* Decompress the rack number */
-            *buffer++ = '0' + RACK_GET_CLASS(rack);
-            *buffer++ = '0' + RACK_GET_GROUP(rack);
-            *buffer++ = '0' + RACK_GET_NUM(rack);
+                /* Decompress the rack number */
+                *buffer++ = '0' + RACK_GET_CLASS(rack);
+                *buffer++ = '0' + RACK_GET_GROUP(rack);
+                *buffer++ = '0' + RACK_GET_NUM(rack);
 
-            /* Add the brick type */
-            *buffer++ = brickchar;
+                /* Add the brick type */
+                *buffer++ = brickchar;
         }
         else if (fmt == MODULE_FORMAT_LONG) {
-            /* Fuller hwgraph format, eg. rack/002/bay/15 */
+                /* Fuller hwgraph format, eg. rack/002/bay/15 */
 
-            strcpy(buffer, "rack" "/");  buffer += strlen(buffer);
+                strcpy(buffer, "rack" "/");  buffer += strlen(buffer);
 
-            *buffer++ = '0' + RACK_GET_CLASS(rack);
-            *buffer++ = '0' + RACK_GET_GROUP(rack);
-            *buffer++ = '0' + RACK_GET_NUM(rack);
+                *buffer++ = '0' + RACK_GET_CLASS(rack);
+                *buffer++ = '0' + RACK_GET_GROUP(rack);
+                *buffer++ = '0' + RACK_GET_NUM(rack);
 
-            strcpy(buffer, "/" "bay" "/");  buffer += strlen(buffer);
+                strcpy(buffer, "/" "bay" "/");  buffer += strlen(buffer);
         }
 
         /* Add the bay position, using at least two digits */
         if (position < 10)
-            *buffer++ = '0';
+                *buffer++ = '0';
         sprintf(buffer, "%d", position);
-
 }
diff --git a/arch/ia64/sn/kernel/mca.c b/arch/ia64/sn/kernel/mca.c
index 9ab684d1bb55..3db62f24596c 100644
--- a/arch/ia64/sn/kernel/mca.c
+++ b/arch/ia64/sn/kernel/mca.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2000-2004 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 #include <linux/types.h>
@@ -137,7 +137,8 @@ int sn_salinfo_platform_oemdata(const u8 *sect_header, u8 **oemdata, u64 *oemdat
 
 static int __init sn_salinfo_init(void)
 {
-        salinfo_platform_oemdata = &sn_salinfo_platform_oemdata;
+        if (ia64_platform_is("sn2"))
+                salinfo_platform_oemdata = &sn_salinfo_platform_oemdata;
         return 0;
 }
 
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index e510dce9971f..5b84836c2171 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -67,6 +67,7 @@ extern unsigned long last_time_offset;
 extern void (*ia64_mark_idle) (int);
 extern void snidle(int);
 extern unsigned char acpi_kbd_controller_present;
+extern unsigned long long (*ia64_printk_clock)(void);
 
 unsigned long sn_rtc_cycles_per_second;
 EXPORT_SYMBOL(sn_rtc_cycles_per_second);
@@ -74,7 +75,7 @@ EXPORT_SYMBOL(sn_rtc_cycles_per_second);
 DEFINE_PER_CPU(struct sn_hub_info_s, __sn_hub_info);
 EXPORT_PER_CPU_SYMBOL(__sn_hub_info);
 
-DEFINE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_NUMNODES]);
+DEFINE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_COMPACT_NODES]);
 EXPORT_PER_CPU_SYMBOL(__sn_cnodeid_to_nasid);
 
 DEFINE_PER_CPU(struct nodepda_s *, __sn_nodepda);
@@ -125,20 +126,6 @@ struct screen_info sn_screen_info = {
 };
 
 /*
- * This is here so we can use the CMOS detection in ide-probe.c to
- * determine what drives are present.  In theory, we don't need this
- * as the auto-detection could be done via ide-probe.c:do_probe() but
- * in practice that would be much slower, which is painful when
- * running in the simulator.  Note that passing zeroes in DRIVE_INFO
- * is sufficient (the IDE driver will autodetect the drive geometry).
- */
-#ifdef CONFIG_IA64_GENERIC
-extern char drive_info[4 * 16];
-#else
-char drive_info[4 * 16];
-#endif
-
-/*
  * This routine can only be used during init, since
  * smp_boot_data is an init data structure.
  * We have to use smp_boot_data.cpu_phys_id to find
@@ -209,7 +196,7 @@ void __init early_sn_setup(void)
 }
 
 extern int platform_intr_list[];
-static int __initdata shub_1_1_found = 0;
+static int __initdata shub_1_1_found;
 
 /*
  * sn_check_for_wars
@@ -330,6 +317,7 @@ struct pcdp_vga_device {
 #define PCDP_PCI_TRANS_IOPORT   0x02
 #define PCDP_PCI_TRANS_MMIO     0x01
 
+#if defined(CONFIG_VT) && defined(CONFIG_VGA_CONSOLE)
 static void
 sn_scan_pcdp(void)
 {
@@ -371,6 +359,17 @@ sn_scan_pcdp(void)
                 break; /* once we find the primary, we're done */
         }
 }
+#endif
+
+static unsigned long sn2_rtc_initial;
+
+static unsigned long long ia64_sn2_printk_clock(void)
+{
+        unsigned long rtc_now = rtc_time();
+
+        return (rtc_now - sn2_rtc_initial) *
+                (1000000000 / sn_rtc_cycles_per_second);
+}
 
 /**
  * sn_setup - SN platform setup routine
@@ -386,6 +385,7 @@ void __init sn_setup(char **cmdline_p)
         u32 version = sn_sal_rev();
         extern void sn_cpu_init(void);
 
+        sn2_rtc_initial = rtc_time();
         ia64_sn_plat_set_error_handling_features();     // obsolete
         ia64_sn_set_os_feature(OSF_MCA_SLV_TO_OS_INIT_SLV);
         ia64_sn_set_os_feature(OSF_FEAT_LOG_SBES);
@@ -437,19 +437,6 @@ void __init sn_setup(char **cmdline_p)
          */
         build_cnode_tables();
 
-        /*
-         * Old PROMs do not provide an ACPI FADT. Disable legacy keyboard
-         * support here so we don't have to listen to failed keyboard probe
-         * messages.
-         */
-        if (version <= 0x0209 && acpi_kbd_controller_present) {
-                printk(KERN_INFO "Disabling legacy keyboard support as prom "
-                       "is too old and doesn't provide FADT\n");
-                acpi_kbd_controller_present = 0;
-        }
-
-        printk("SGI SAL version %x.%02x\n", version >> 8, version & 0x00FF);
-
         status =
             ia64_sal_freq_base(SAL_FREQ_BASE_REALTIME_CLOCK, &ticks_per_sec,
                                &drift);
@@ -463,6 +450,21 @@ void __init sn_setup(char **cmdline_p)
 
         platform_intr_list[ACPI_INTERRUPT_CPEI] = IA64_CPE_VECTOR;
 
+        ia64_printk_clock = ia64_sn2_printk_clock;
+
+        /*
+         * Old PROMs do not provide an ACPI FADT. Disable legacy keyboard
+         * support here so we don't have to listen to failed keyboard probe
+         * messages.
+         */
+        if (version <= 0x0209 && acpi_kbd_controller_present) {
+                printk(KERN_INFO "Disabling legacy keyboard support as prom "
+                       "is too old and doesn't provide FADT\n");
+                acpi_kbd_controller_present = 0;
+        }
+
+        printk("SGI SAL version %x.%02x\n", version >> 8, version & 0x00FF);
+
         /*
          * we set the default root device to /dev/hda
          * to make simulation easy
@@ -578,13 +580,17 @@ void __init sn_cpu_init(void)
                         sn_prom_type = 2;
                 else
                         sn_prom_type = 1;
-                printk("Running on medusa with %s PROM\n", (sn_prom_type == 1) ? "real" : "fake");
+                printk(KERN_INFO "Running on medusa with %s PROM\n",
+                       (sn_prom_type == 1) ? "real" : "fake");
         }
 
         memset(pda, 0, sizeof(pda));
-        if (ia64_sn_get_sn_info(0, &sn_hub_info->shub2, &sn_hub_info->nasid_bitmask, &sn_hub_info->nasid_shift,
-                                &sn_system_size, &sn_sharing_domain_size, &sn_partition_id,
-                                &sn_coherency_id, &sn_region_size))
+        if (ia64_sn_get_sn_info(0, &sn_hub_info->shub2,
+                                &sn_hub_info->nasid_bitmask,
+                                &sn_hub_info->nasid_shift,
+                                &sn_system_size, &sn_sharing_domain_size,
+                                &sn_partition_id, &sn_coherency_id,
+                                &sn_region_size))
                 BUG();
         sn_hub_info->as_shift = sn_hub_info->nasid_shift - 2;
 
@@ -716,7 +722,8 @@ void __init build_cnode_tables(void)
         for_each_online_node(node) {
                 kl_config_hdr_t *klgraph_header;
                 nasid = cnodeid_to_nasid(node);
-                if ((klgraph_header = ia64_sn_get_klconfig_addr(nasid)) == NULL)
+                klgraph_header = ia64_sn_get_klconfig_addr(nasid);
+                if (klgraph_header == NULL)
                         BUG();
                 brd = NODE_OFFSET_TO_LBOARD(nasid, klgraph_header->ch_board_info);
                 while (brd) {
@@ -734,7 +741,7 @@ nasid_slice_to_cpuid(int nasid, int slice)
 {
         long cpu;
 
-        for (cpu=0; cpu < NR_CPUS; cpu++)
+        for (cpu = 0; cpu < NR_CPUS; cpu++)
                 if (cpuid_to_nasid(cpu) == nasid &&
                                         cpuid_to_slice(cpu) == slice)
                         return cpu;
diff --git a/arch/ia64/sn/kernel/sn2/Makefile b/arch/ia64/sn/kernel/sn2/Makefile
index 170bde4549da..99e177693234 100644
--- a/arch/ia64/sn/kernel/sn2/Makefile
+++ b/arch/ia64/sn/kernel/sn2/Makefile
@@ -9,5 +9,7 @@
 # sn2 specific kernel files
 #
 
+CPPFLAGS += -I$(srctree)/arch/ia64/sn/include
+
 obj-y += cache.o io.o ptc_deadlock.o sn2_smp.o sn_proc_fs.o \
          prominfo_proc.o timer.o timer_interrupt.o sn_hwperf.o
diff --git a/arch/ia64/sn/kernel/sn2/prominfo_proc.c b/arch/ia64/sn/kernel/sn2/prominfo_proc.c
index 81c63b2f8ae9..6ae276d5d50c 100644
--- a/arch/ia64/sn/kernel/sn2/prominfo_proc.c
+++ b/arch/ia64/sn/kernel/sn2/prominfo_proc.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1999,2001-2004 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (C) 1999,2001-2004, 2006 Silicon Graphics, Inc.  All Rights Reserved.
  *
  * Module to export the system's Firmware Interface Tables, including
  * PROM revision numbers and banners, in /proc
@@ -190,7 +190,7 @@ static int
 read_version_entry(char *page, char **start, off_t off, int count, int *eof,
                    void *data)
 {
-        int len = 0;
+        int len;
 
         /* data holds the NASID of the node */
         len = dump_version(page, (unsigned long)data);
@@ -202,7 +202,7 @@ static int
 read_fit_entry(char *page, char **start, off_t off, int count, int *eof,
                void *data)
 {
-        int len = 0;
+        int len;
 
         /* data holds the NASID of the node */
         len = dump_fit(page, (unsigned long)data);
@@ -229,13 +229,16 @@ int __init prominfo_init(void)
         struct proc_dir_entry *p;
         cnodeid_t cnodeid;
         unsigned long nasid;
+        int size;
         char name[NODE_NAME_LEN];
 
         if (!ia64_platform_is("sn2"))
                 return 0;
 
-        proc_entries = kmalloc(num_online_nodes() * sizeof(struct proc_dir_entry *),
-                               GFP_KERNEL);
+        size = num_online_nodes() * sizeof(struct proc_dir_entry *);
+        proc_entries = kzalloc(size, GFP_KERNEL);
+        if (!proc_entries)
+                return -ENOMEM;
 
         sgi_prominfo_entry = proc_mkdir("sgi_prominfo", NULL);
 
@@ -244,14 +247,12 @@ int __init prominfo_init(void)
                 sprintf(name, "node%d", cnodeid);
                 *entp = proc_mkdir(name, sgi_prominfo_entry);
                 nasid = cnodeid_to_nasid(cnodeid);
-                p = create_proc_read_entry(
-                        "fit", 0, *entp, read_fit_entry,
-                        (void *)nasid);
+                p = create_proc_read_entry("fit", 0, *entp, read_fit_entry,
+                                           (void *)nasid);
                 if (p)
                         p->owner = THIS_MODULE;
-                p = create_proc_read_entry(
-                        "version", 0, *entp, read_version_entry,
-                        (void *)nasid);
+                p = create_proc_read_entry("version", 0, *entp,
+                                           read_version_entry, (void *)nasid);
                 if (p)
                         p->owner = THIS_MODULE;
                 entp++;
@@ -263,7 +264,7 @@ int __init prominfo_init(void)
 void __exit prominfo_exit(void)
 {
         struct proc_dir_entry **entp;
-        unsigned cnodeid;
+        unsigned int cnodeid;
         char name[NODE_NAME_LEN];
 
         entp = proc_entries;
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
index 471bbaa65d1b..b2e1e746b47f 100644
--- a/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -5,7 +5,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2000-2006 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <linux/init.h>
@@ -46,104 +46,24 @@ DECLARE_PER_CPU(struct ptc_stats, ptcstats);
 
 static  __cacheline_aligned DEFINE_SPINLOCK(sn2_global_ptc_lock);
 
-void sn2_ptc_deadlock_recovery(short *, short, int, volatile unsigned long *, unsigned long data0,
-        volatile unsigned long *, unsigned long data1);
+extern unsigned long
+sn2_ptc_deadlock_recovery_core(volatile unsigned long *, unsigned long,
+                               volatile unsigned long *, unsigned long,
+                               volatile unsigned long *, unsigned long);
+void
+sn2_ptc_deadlock_recovery(short *, short, short, int,
+                          volatile unsigned long *, unsigned long,
+                          volatile unsigned long *, unsigned long);
 
-#ifdef DEBUG_PTC
 /*
- * ptctest:
- *
- *      xyz - 3 digit hex number:
- *              x - Force PTC purges to use shub:
- *                      0 - no force
- *                      1 - force
- *              y - interupt enable
- *                      0 - disable interrupts
- *                      1 - leave interuupts enabled
- *              z - type of lock:
- *                      0 - global lock
- *                      1 - node local lock
- *                      2 - no lock
- *
- *      Note: on shub1, only ptctest == 0 is supported. Don't try other values!
+ * Note: some is the following is captured here to make degugging easier
+ * (the macros make more sense if you see the debug patch - not posted)
  */
-
-static unsigned int sn2_ptctest = 0;
-
-static int __init ptc_test(char *str)
-{
-        get_option(&str, &sn2_ptctest);
-        return 1;
-}
-__setup("ptctest=", ptc_test);
-
-static inline int ptc_lock(unsigned long *flagp)
-{
-        unsigned long opt = sn2_ptctest & 255;
-
-        switch (opt) {
-        case 0x00:
-                spin_lock_irqsave(&sn2_global_ptc_lock, *flagp);
-                break;
-        case 0x01:
-                spin_lock_irqsave(&sn_nodepda->ptc_lock, *flagp);
-                break;
-        case 0x02:
-                local_irq_save(*flagp);
-                break;
-        case 0x10:
-                spin_lock(&sn2_global_ptc_lock);
-                break;
-        case 0x11:
-                spin_lock(&sn_nodepda->ptc_lock);
-                break;
-        case 0x12:
-                break;
-        default:
-                BUG();
-        }
-        return opt;
-}
-
-static inline void ptc_unlock(unsigned long flags, int opt)
-{
-        switch (opt) {
-        case 0x00:
-                spin_unlock_irqrestore(&sn2_global_ptc_lock, flags);
-                break;
-        case 0x01:
-                spin_unlock_irqrestore(&sn_nodepda->ptc_lock, flags);
-                break;
-        case 0x02:
-                local_irq_restore(flags);
-                break;
-        case 0x10:
-                spin_unlock(&sn2_global_ptc_lock);
-                break;
-        case 0x11:
-                spin_unlock(&sn_nodepda->ptc_lock);
-                break;
-        case 0x12:
-                break;
-        default:
-                BUG();
-        }
-}
-#else
-
 #define sn2_ptctest     0
-
-static inline int ptc_lock(unsigned long *flagp)
-{
-        spin_lock_irqsave(&sn2_global_ptc_lock, *flagp);
-        return 0;
-}
-
-static inline void ptc_unlock(unsigned long flags, int opt)
-{
-        spin_unlock_irqrestore(&sn2_global_ptc_lock, flags);
-}
-#endif
+#define local_node_uses_ptc_ga(sh1)     ((sh1) ? 1 : 0)
+#define max_active_pio(sh1)             ((sh1) ? 32 : 7)
+#define reset_max_active_on_deadlock()  1
+#define PTC_LOCK(sh1)                   ((sh1) ? &sn2_global_ptc_lock : &sn_nodepda->ptc_lock)
 
 struct ptc_stats {
         unsigned long ptc_l;
@@ -151,27 +71,32 @@ struct ptc_stats {
         unsigned long shub_ptc_flushes;
         unsigned long nodes_flushed;
         unsigned long deadlocks;
+        unsigned long deadlocks2;
         unsigned long lock_itc_clocks;
         unsigned long shub_itc_clocks;
         unsigned long shub_itc_clocks_max;
+        unsigned long shub_ptc_flushes_not_my_mm;
 };
 
+#define sn2_ptctest     0
+
 static inline unsigned long wait_piowc(void)
 {
-        volatile unsigned long *piows, zeroval;
-        unsigned long ws;
+        volatile unsigned long *piows;
+        unsigned long zeroval, ws;
 
         piows = pda->pio_write_status_addr;
         zeroval = pda->pio_write_status_val;
         do {
                 cpu_relax();
         } while (((ws = *piows) & SH_PIO_WRITE_STATUS_PENDING_WRITE_COUNT_MASK) != zeroval);
-        return ws;
+        return (ws & SH_PIO_WRITE_STATUS_WRITE_DEADLOCK_MASK) != 0;
 }
 
 void sn_tlb_migrate_finish(struct mm_struct *mm)
 {
-        if (mm == current->mm)
+        /* flush_tlb_mm is inefficient if more than 1 users of mm */
+        if (mm == current->mm && mm && atomic_read(&mm->mm_users) == 1)
                 flush_tlb_mm(mm);
 }
 
@@ -201,12 +126,14 @@ void
 sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
                      unsigned long end, unsigned long nbits)
 {
-        int i, opt, shub1, cnode, mynasid, cpu, lcpu = 0, nasid, flushed = 0;
-        int mymm = (mm == current->active_mm && current->mm);
+        int i, ibegin, shub1, cnode, mynasid, cpu, lcpu = 0, nasid;
+        int mymm = (mm == current->active_mm && mm == current->mm);
+        int use_cpu_ptcga;
         volatile unsigned long *ptc0, *ptc1;
-        unsigned long itc, itc2, flags, data0 = 0, data1 = 0, rr_value;
+        unsigned long itc, itc2, flags, data0 = 0, data1 = 0, rr_value, old_rr = 0;
         short nasids[MAX_NUMNODES], nix;
         nodemask_t nodes_flushed;
+        int active, max_active, deadlock;
 
         nodes_clear(nodes_flushed);
         i = 0;
@@ -267,41 +194,56 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
         
 
         mynasid = get_nasid();
+        use_cpu_ptcga = local_node_uses_ptc_ga(shub1);
+        max_active = max_active_pio(shub1);
 
         itc = ia64_get_itc();
-        opt = ptc_lock(&flags);
+        spin_lock_irqsave(PTC_LOCK(shub1), flags);
         itc2 = ia64_get_itc();
+
         __get_cpu_var(ptcstats).lock_itc_clocks += itc2 - itc;
         __get_cpu_var(ptcstats).shub_ptc_flushes++;
         __get_cpu_var(ptcstats).nodes_flushed += nix;
+        if (!mymm)
+                 __get_cpu_var(ptcstats).shub_ptc_flushes_not_my_mm++;
 
+        if (use_cpu_ptcga && !mymm) {
+                old_rr = ia64_get_rr(start);
+                ia64_set_rr(start, (old_rr & 0xff) | (rr_value << 8));
+                ia64_srlz_d();
+        }
+
+        wait_piowc();
         do {
                 if (shub1)
                         data1 = start | (1UL << SH1_PTC_1_START_SHFT);
                 else
                         data0 = (data0 & ~SH2_PTC_ADDR_MASK) | (start & SH2_PTC_ADDR_MASK);
-                for (i = 0; i < nix; i++) {
+                deadlock = 0;
+                active = 0;
+                for (ibegin = 0, i = 0; i < nix; i++) {
                         nasid = nasids[i];
-                        if ((!(sn2_ptctest & 3)) && unlikely(nasid == mynasid && mymm)) {
+                        if (use_cpu_ptcga && unlikely(nasid == mynasid)) {
                                 ia64_ptcga(start, nbits << 2);
                                 ia64_srlz_i();
                         } else {
                                 ptc0 = CHANGE_NASID(nasid, ptc0);
                                 if (ptc1)
                                         ptc1 = CHANGE_NASID(nasid, ptc1);
-                                pio_atomic_phys_write_mmrs(ptc0, data0, ptc1,
-                                                           data1);
-                                flushed = 1;
+                                pio_atomic_phys_write_mmrs(ptc0, data0, ptc1, data1);
+                                active++;
+                        }
+                        if (active >= max_active || i == (nix - 1)) {
+                                if ((deadlock = wait_piowc())) {
+                                        sn2_ptc_deadlock_recovery(nasids, ibegin, i, mynasid, ptc0, data0, ptc1, data1);
+                                        if (reset_max_active_on_deadlock())
+                                                max_active = 1;
+                                }
+                                active = 0;
+                                ibegin = i + 1;
                         }
                 }
-                if (flushed
-                    && (wait_piowc() &
-                                (SH_PIO_WRITE_STATUS_WRITE_DEADLOCK_MASK))) {
-                        sn2_ptc_deadlock_recovery(nasids, nix, mynasid, ptc0, data0, ptc1, data1);
-                }
-
                 start += (1UL << nbits);
-
         } while (start < end);
 
         itc2 = ia64_get_itc() - itc2;
@@ -309,7 +251,12 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
         if (itc2 > __get_cpu_var(ptcstats).shub_itc_clocks_max)
                 __get_cpu_var(ptcstats).shub_itc_clocks_max = itc2;
 
-        ptc_unlock(flags, opt);
+        if (old_rr) {
+                ia64_set_rr(start, old_rr);
+                ia64_srlz_d();
+        }
+
+        spin_unlock_irqrestore(PTC_LOCK(shub1), flags);
 
         preempt_enable();
 }
@@ -321,27 +268,31 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
  * TLB flush transaction.  The recovery sequence is somewhat tricky & is
  * coded in assembly language.
  */
-void sn2_ptc_deadlock_recovery(short *nasids, short nix, int mynasid, volatile unsigned long *ptc0, unsigned long data0,
-        volatile unsigned long *ptc1, unsigned long data1)
+
+void
+sn2_ptc_deadlock_recovery(short *nasids, short ib, short ie, int mynasid,
+                          volatile unsigned long *ptc0, unsigned long data0,
+                          volatile unsigned long *ptc1, unsigned long data1)
 {
-        extern void sn2_ptc_deadlock_recovery_core(volatile unsigned long *, unsigned long,
-                volatile unsigned long *, unsigned long, volatile unsigned long *, unsigned long);
         short nasid, i;
-        unsigned long *piows, zeroval;
+        unsigned long *piows, zeroval, n;
 
         __get_cpu_var(ptcstats).deadlocks++;
 
         piows = (unsigned long *) pda->pio_write_status_addr;
         zeroval = pda->pio_write_status_val;
 
-        for (i=0; i < nix; i++) {
+
+        for (i=ib; i <= ie; i++) {
                 nasid = nasids[i];
-                if (!(sn2_ptctest & 3) && nasid == mynasid)
+                if (local_node_uses_ptc_ga(is_shub1()) && nasid == mynasid)
                         continue;
                 ptc0 = CHANGE_NASID(nasid, ptc0);
                 if (ptc1)
                         ptc1 = CHANGE_NASID(nasid, ptc1);
-                sn2_ptc_deadlock_recovery_core(ptc0, data0, ptc1, data1, piows, zeroval);
+
+                n = sn2_ptc_deadlock_recovery_core(ptc0, data0, ptc1, data1, piows, zeroval);
+                __get_cpu_var(ptcstats).deadlocks2 += n;
         }
 
 }
@@ -452,20 +403,22 @@ static int sn2_ptc_seq_show(struct seq_file *file, void *data)
         cpu = *(loff_t *) data;
 
         if (!cpu) {
-                seq_printf(file, "# ptc_l change_rid shub_ptc_flushes shub_nodes_flushed deadlocks lock_nsec shub_nsec shub_nsec_max\n");
+                seq_printf(file,
+                           "# cpu ptc_l newrid ptc_flushes nodes_flushed deadlocks lock_nsec shub_nsec shub_nsec_max not_my_mm deadlock2\n");
                 seq_printf(file, "# ptctest %d\n", sn2_ptctest);
         }
 
         if (cpu < NR_CPUS && cpu_online(cpu)) {
                 stat = &per_cpu(ptcstats, cpu);
-                seq_printf(file, "cpu %d %ld %ld %ld %ld %ld %ld %ld %ld\n", cpu, stat->ptc_l,
+                seq_printf(file, "cpu %d %ld %ld %ld %ld %ld %ld %ld %ld %ld %ld\n", cpu, stat->ptc_l,
                                 stat->change_rid, stat->shub_ptc_flushes, stat->nodes_flushed,
                                 stat->deadlocks,
                                 1000 * stat->lock_itc_clocks / per_cpu(cpu_info, cpu).cyc_per_usec,
                                 1000 * stat->shub_itc_clocks / per_cpu(cpu_info, cpu).cyc_per_usec,
-                                1000 * stat->shub_itc_clocks_max / per_cpu(cpu_info, cpu).cyc_per_usec);
+                                1000 * stat->shub_itc_clocks_max / per_cpu(cpu_info, cpu).cyc_per_usec,
+                                stat->shub_ptc_flushes_not_my_mm,
+                                stat->deadlocks2);
         }
-
         return 0;
 }
 
@@ -476,7 +429,7 @@ static struct seq_operations sn2_ptc_seq_ops = {
         .show = sn2_ptc_seq_show
 };
 
-int sn2_ptc_proc_open(struct inode *inode, struct file *file)
+static int sn2_ptc_proc_open(struct inode *inode, struct file *file)
 {
         return seq_open(file, &sn2_ptc_seq_ops);
 }
@@ -493,7 +446,7 @@ static struct proc_dir_entry *proc_sn2_ptc;
 static int __init sn2_ptc_init(void)
 {
         if (!ia64_platform_is("sn2"))
-                return -ENOSYS;
+                return 0;
 
         if (!(proc_sn2_ptc = create_proc_entry(PTC_BASENAME, 0444, NULL))) {
                 printk(KERN_ERR "unable to create %s proc entry", PTC_BASENAME);
diff --git a/arch/ia64/sn/kernel/sn2/sn_hwperf.c b/arch/ia64/sn/kernel/sn2/sn_hwperf.c
index 19b54fbcd7ea..70db21f3df21 100644
--- a/arch/ia64/sn/kernel/sn2/sn_hwperf.c
+++ b/arch/ia64/sn/kernel/sn2/sn_hwperf.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2004-2005 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2004-2006 Silicon Graphics, Inc. All rights reserved.
  *
  * SGI Altix topology and hardware performance monitoring API.
  * Mark Goodwin <markgw@sgi.com>. 
@@ -973,6 +973,9 @@ static int __devinit sn_hwperf_misc_register_init(void)
 {
         int e;
 
+        if (!ia64_platform_is("sn2"))
+                return 0;
+
         sn_hwperf_init();
 
         /*
diff --git a/arch/ia64/sn/kernel/sn2/sn_proc_fs.c b/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
index a06719d752a0..c686d9c12f7b 100644
--- a/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
+++ b/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
@@ -6,11 +6,11 @@
  * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
  */
 #include <linux/config.h>
-#include <asm/uaccess.h>
 
 #ifdef CONFIG_PROC_FS
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <asm/uaccess.h>
 #include <asm/sn/sn_sal.h>
 
 static int partition_id_show(struct seq_file *s, void *p)
@@ -90,10 +90,10 @@ static int coherence_id_open(struct inode *inode, struct file *file)
         return single_open(file, coherence_id_show, NULL);
 }
 
-static struct proc_dir_entry *sn_procfs_create_entry(
-        const char *name, struct proc_dir_entry *parent,
-        int (*openfunc)(struct inode *, struct file *),
-        int (*releasefunc)(struct inode *, struct file *))
+static struct proc_dir_entry
+*sn_procfs_create_entry(const char *name, struct proc_dir_entry *parent,
+                        int (*openfunc)(struct inode *, struct file *),
+                        int (*releasefunc)(struct inode *, struct file *))
 {
         struct proc_dir_entry *e = create_proc_entry(name, 0444, parent);
 
@@ -126,24 +126,24 @@ void register_sn_procfs(void)
                 return;
 
         sn_procfs_create_entry("partition_id", sgi_proc_dir,
-                partition_id_open, single_release);
+                               partition_id_open, single_release);
 
         sn_procfs_create_entry("system_serial_number", sgi_proc_dir,
-                system_serial_number_open, single_release);
+                               system_serial_number_open, single_release);
 
         sn_procfs_create_entry("licenseID", sgi_proc_dir, 
-                licenseID_open, single_release);
+                               licenseID_open, single_release);
 
         e = sn_procfs_create_entry("sn_force_interrupt", sgi_proc_dir, 
-                sn_force_interrupt_open, single_release);
+                                   sn_force_interrupt_open, single_release);
         if (e) 
                 e->proc_fops->write = sn_force_interrupt_write_proc;
 
         sn_procfs_create_entry("coherence_id", sgi_proc_dir, 
-                coherence_id_open, single_release);
+                               coherence_id_open, single_release);
         
         sn_procfs_create_entry("sn_topology", sgi_proc_dir,
-                sn_topology_open, sn_topology_release);
+                               sn_topology_open, sn_topology_release);
 }
 
 #endif /* CONFIG_PROC_FS */
diff --git a/arch/ia64/sn/kernel/sn2/timer.c b/arch/ia64/sn/kernel/sn2/timer.c
index deb9baf4d473..56a88b6df4b4 100644
--- a/arch/ia64/sn/kernel/sn2/timer.c
+++ b/arch/ia64/sn/kernel/sn2/timer.c
@@ -14,6 +14,7 @@
 
 #include <asm/hw_irq.h>
 #include <asm/system.h>
+#include <asm/timex.h>
 
 #include <asm/sn/leds.h>
 #include <asm/sn/shub_mmr.h>
@@ -28,9 +29,27 @@ static struct time_interpolator sn2_interpolator = {
         .source = TIME_SOURCE_MMIO64
 };
 
+/*
+ * sn udelay uses the RTC instead of the ITC because the ITC is not
+ * synchronized across all CPUs, and the thread may migrate to another CPU
+ * if preemption is enabled.
+ */
+static void
+ia64_sn_udelay (unsigned long usecs)
+{
+        unsigned long start = rtc_time();
+        unsigned long end = start +
+                        usecs * sn_rtc_cycles_per_second / 1000000;
+
+        while (time_before((unsigned long)rtc_time(), end))
+                cpu_relax();
+}
+
 void __init sn_timer_init(void)
 {
         sn2_interpolator.frequency = sn_rtc_cycles_per_second;
         sn2_interpolator.addr = RTC_COUNTER_ADDR;
         register_time_interpolator(&sn2_interpolator);
+
+        ia64_udelay = &ia64_sn_udelay;
 }
diff --git a/arch/ia64/sn/kernel/sn2/timer_interrupt.c b/arch/ia64/sn/kernel/sn2/timer_interrupt.c
index adf5db2e2afe..fa7f69945917 100644
--- a/arch/ia64/sn/kernel/sn2/timer_interrupt.c
+++ b/arch/ia64/sn/kernel/sn2/timer_interrupt.c
@@ -1,7 +1,7 @@
 /*
  *
  *
- * Copyright (c) 2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2005, 2006 Silicon Graphics, Inc.  All Rights Reserved.
  * 
  * This program is free software; you can redistribute it and/or modify it 
  * under the terms of version 2 of the GNU General Public License 
@@ -22,11 +22,6 @@
  * License along with this program; if not, write the Free Software 
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  * 
- * Contact information:  Silicon Graphics, Inc., 1600 Amphitheatre Pkwy, 
- * Mountain View, CA  94043, or:
- * 
- * http://www.sgi.com 
- * 
  * For further information regarding this notice, see: 
  * 
  * http://oss.sgi.com/projects/GenInfo/NoticeExplan
diff --git a/arch/ia64/sn/kernel/tiocx.c b/arch/ia64/sn/kernel/tiocx.c
index d263d3e8fbb9..99cb28e74295 100644
--- a/arch/ia64/sn/kernel/tiocx.c
+++ b/arch/ia64/sn/kernel/tiocx.c
@@ -284,12 +284,10 @@ struct sn_irq_info *tiocx_irq_alloc(nasid_t nasid, int widget, int irq,
         if ((nasid & 1) == 0)
                 return NULL;
 
-        sn_irq_info = kmalloc(sn_irq_size, GFP_KERNEL);
+        sn_irq_info = kzalloc(sn_irq_size, GFP_KERNEL);
         if (sn_irq_info == NULL)
                 return NULL;
 
-        memset(sn_irq_info, 0x0, sn_irq_size);
-
         status = tiocx_intr_alloc(nasid, widget, __pa(sn_irq_info), irq,
                                   req_nasid, slice);
         if (status) {
@@ -486,7 +484,7 @@ static int __init tiocx_init(void)
         int found_tiocx_device = 0;
 
         if (!ia64_platform_is("sn2"))
-                return -ENODEV;
+                return 0;
 
         bus_register(&tiocx_bus_type);
 
diff --git a/arch/ia64/sn/kernel/xpc_channel.c b/arch/ia64/sn/kernel/xpc_channel.c
index 36e5437a0fb6..cdf6856ce089 100644
--- a/arch/ia64/sn/kernel/xpc_channel.c
+++ b/arch/ia64/sn/kernel/xpc_channel.c
@@ -738,7 +738,9 @@ xpc_process_disconnect(struct xpc_channel *ch, unsigned long *irq_flags)
 
         /* make sure all activity has settled down first */
 
-        if (atomic_read(&ch->references) > 0) {
+        if (atomic_read(&ch->references) > 0 ||
+                        ((ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) &&
+                        !(ch->flags & XPC_C_DISCONNECTINGCALLOUT_MADE))) {
                 return;
         }
         DBUG_ON(atomic_read(&ch->kthreads_assigned) != 0);
@@ -775,7 +777,7 @@ xpc_process_disconnect(struct xpc_channel *ch, unsigned long *irq_flags)
 
         /* both sides are disconnected now */
 
-        if (ch->flags & XPC_C_CONNECTCALLOUT) {
+        if (ch->flags & XPC_C_DISCONNECTINGCALLOUT_MADE) {
                 spin_unlock_irqrestore(&ch->lock, *irq_flags);
                 xpc_disconnect_callout(ch, xpcDisconnected);
                 spin_lock_irqsave(&ch->lock, *irq_flags);
@@ -1300,7 +1302,7 @@ xpc_process_msg_IPI(struct xpc_partition *part, int ch_number)
                                 "delivered=%d, partid=%d, channel=%d\n",
                                 nmsgs_sent, ch->partid, ch->number);
 
-                        if (ch->flags & XPC_C_CONNECTCALLOUT) {
+                        if (ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) {
                                 xpc_activate_kthreads(ch, nmsgs_sent);
                         }
                 }
diff --git a/arch/ia64/sn/kernel/xpc_main.c b/arch/ia64/sn/kernel/xpc_main.c
index c75f8aeefc2b..8cbf16432570 100644
--- a/arch/ia64/sn/kernel/xpc_main.c
+++ b/arch/ia64/sn/kernel/xpc_main.c
@@ -575,18 +575,21 @@ xpc_activate_partition(struct xpc_partition *part)
 
         spin_lock_irqsave(&part->act_lock, irq_flags);
 
-        pid = kernel_thread(xpc_activating, (void *) ((u64) partid), 0);
-
         DBUG_ON(part->act_state != XPC_P_INACTIVE);
 
-        if (pid > 0) {
-                part->act_state = XPC_P_ACTIVATION_REQ;
-                XPC_SET_REASON(part, xpcCloneKThread, __LINE__);
-        } else {
-                XPC_SET_REASON(part, xpcCloneKThreadFailed, __LINE__);
-        }
+        part->act_state = XPC_P_ACTIVATION_REQ;
+        XPC_SET_REASON(part, xpcCloneKThread, __LINE__);
 
         spin_unlock_irqrestore(&part->act_lock, irq_flags);
+
+        pid = kernel_thread(xpc_activating, (void *) ((u64) partid), 0);
+
+        if (unlikely(pid <= 0)) {
+                spin_lock_irqsave(&part->act_lock, irq_flags);
+                part->act_state = XPC_P_INACTIVE;
+                XPC_SET_REASON(part, xpcCloneKThreadFailed, __LINE__);
+                spin_unlock_irqrestore(&part->act_lock, irq_flags);
+        }
 }
 
 
@@ -747,12 +750,16 @@ xpc_daemonize_kthread(void *args)
                 /* let registerer know that connection has been established */
 
                 spin_lock_irqsave(&ch->lock, irq_flags);
-                if (!(ch->flags & XPC_C_CONNECTCALLOUT)) {
-                        ch->flags |= XPC_C_CONNECTCALLOUT;
+                if (!(ch->flags & XPC_C_CONNECTEDCALLOUT)) {
+                        ch->flags |= XPC_C_CONNECTEDCALLOUT;
                         spin_unlock_irqrestore(&ch->lock, irq_flags);
 
                         xpc_connected_callout(ch);
 
+                        spin_lock_irqsave(&ch->lock, irq_flags);
+                        ch->flags |= XPC_C_CONNECTEDCALLOUT_MADE;
+                        spin_unlock_irqrestore(&ch->lock, irq_flags);
+
                         /*
                          * It is possible that while the callout was being
                          * made that the remote partition sent some messages.
@@ -774,15 +781,17 @@ xpc_daemonize_kthread(void *args)
 
         if (atomic_dec_return(&ch->kthreads_assigned) == 0) {
                 spin_lock_irqsave(&ch->lock, irq_flags);
-                if ((ch->flags & XPC_C_CONNECTCALLOUT) &&
-                                !(ch->flags & XPC_C_DISCONNECTCALLOUT)) {
-                        ch->flags |= XPC_C_DISCONNECTCALLOUT;
+                if ((ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) &&
+                                !(ch->flags & XPC_C_DISCONNECTINGCALLOUT)) {
+                        ch->flags |= XPC_C_DISCONNECTINGCALLOUT;
                         spin_unlock_irqrestore(&ch->lock, irq_flags);
 
                         xpc_disconnect_callout(ch, xpcDisconnecting);
-                } else {
-                        spin_unlock_irqrestore(&ch->lock, irq_flags);
+
+                        spin_lock_irqsave(&ch->lock, irq_flags);
+                        ch->flags |= XPC_C_DISCONNECTINGCALLOUT_MADE;
                 }
+                spin_unlock_irqrestore(&ch->lock, irq_flags);
                 if (atomic_dec_return(&part->nchannels_engaged) == 0) {
                         xpc_mark_partition_disengaged(part);
                         xpc_IPI_send_disengage(part);
diff --git a/arch/ia64/sn/pci/Makefile b/arch/ia64/sn/pci/Makefile
index 321576b1b425..c6946784a6a8 100644
--- a/arch/ia64/sn/pci/Makefile
+++ b/arch/ia64/sn/pci/Makefile
@@ -7,4 +7,6 @@
 #
 # Makefile for the sn pci general routines.
 
+CPPFLAGS += -I$(srctree)/arch/ia64/sn/include
+
 obj-y := pci_dma.o tioca_provider.o tioce_provider.o pcibr/
diff --git a/arch/ia64/sn/pci/pci_dma.c b/arch/ia64/sn/pci/pci_dma.c
index 5a36292388eb..b4b84c269210 100644
--- a/arch/ia64/sn/pci/pci_dma.c
+++ b/arch/ia64/sn/pci/pci_dma.c
@@ -335,10 +335,10 @@ int sn_pci_legacy_read(struct pci_bus *bus, u16 port, u32 *val, u8 size)
          */
 
         SAL_CALL(isrv, SN_SAL_IOIF_PCI_SAFE,
-                pci_domain_nr(bus), bus->number,
-                0, /* io */
-                0, /* read */
-                port, size, __pa(val));
+                 pci_domain_nr(bus), bus->number,
+                 0, /* io */
+                 0, /* read */
+                 port, size, __pa(val));
 
         if (isrv.status == 0)
                 return size;
@@ -381,10 +381,10 @@ int sn_pci_legacy_write(struct pci_bus *bus, u16 port, u32 val, u8 size)
          */
 
         SAL_CALL(isrv, SN_SAL_IOIF_PCI_SAFE,
-                pci_domain_nr(bus), bus->number,
-                0, /* io */
-                1, /* write */
-                port, size, __pa(&val));
+                 pci_domain_nr(bus), bus->number,
+                 0, /* io */
+                 1, /* write */
+                 port, size, __pa(&val));
 
         if (isrv.status == 0)
                 return size;
diff --git a/arch/ia64/sn/pci/pcibr/Makefile b/arch/ia64/sn/pci/pcibr/Makefile
index 1850c4a94c41..3b403ea456f9 100644
--- a/arch/ia64/sn/pci/pcibr/Makefile
+++ b/arch/ia64/sn/pci/pcibr/Makefile
@@ -7,5 +7,7 @@
 #
 # Makefile for the sn2 io routines.
 
+CPPFLAGS += -I$(srctree)/arch/ia64/sn/include
+
 obj-y                           +=  pcibr_dma.o pcibr_reg.o \
                                     pcibr_ate.o pcibr_provider.o
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_ate.c b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
index aa3fa5152a32..1f0253bfe0a0 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_ate.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2001-2004 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2001-2006 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <linux/types.h>
@@ -12,7 +12,7 @@
 #include <asm/sn/pcibus_provider_defs.h>
 #include <asm/sn/pcidev.h>
 
-int pcibr_invalidate_ate = 0;   /* by default don't invalidate ATE on free */
+int pcibr_invalidate_ate;       /* by default don't invalidate ATE on free */
 
 /*
  * mark_ate: Mark the ate as either free or inuse.
@@ -20,14 +20,12 @@ int pcibr_invalidate_ate = 0;	/* by default don't invalidate ATE on free */
 static void mark_ate(struct ate_resource *ate_resource, int start, int number,
                      u64 value)
 {
-
         u64 *ate = ate_resource->ate;
         int index;
         int length = 0;
 
         for (index = start; length < number; index++, length++)
                 ate[index] = value;
-
 }
 
 /*
@@ -37,7 +35,6 @@ static void mark_ate(struct ate_resource *ate_resource, int start, int number,
 static int find_free_ate(struct ate_resource *ate_resource, int start,
                          int count)
 {
-
         u64 *ate = ate_resource->ate;
         int index;
         int start_free;
@@ -70,12 +67,10 @@ static int find_free_ate(struct ate_resource *ate_resource, int start,
 static inline void free_ate_resource(struct ate_resource *ate_resource,
                                      int start)
 {
-
         mark_ate(ate_resource, start, ate_resource->ate[start], 0);
         if ((ate_resource->lowest_free_index > start) ||
             (ate_resource->lowest_free_index < 0))
                 ate_resource->lowest_free_index = start;
-
 }
 
 /*
@@ -84,7 +79,6 @@ static inline void free_ate_resource(struct ate_resource *ate_resource,
 static inline int alloc_ate_resource(struct ate_resource *ate_resource,
                                      int ate_needed)
 {
-
         int start_index;
 
         /*
@@ -118,19 +112,12 @@ static inline int alloc_ate_resource(struct ate_resource *ate_resource,
  */
 int pcibr_ate_alloc(struct pcibus_info *pcibus_info, int count)
 {
-        int status = 0;
-        u64 flag;
+        int status;
+        unsigned long flags;
 
-        flag = pcibr_lock(pcibus_info);
+        spin_lock_irqsave(&pcibus_info->pbi_lock, flags);
         status = alloc_ate_resource(&pcibus_info->pbi_int_ate_resource, count);
-
-        if (status < 0) {
-                /* Failed to allocate */
-                pcibr_unlock(pcibus_info, flag);
-                return -1;
-        }
-
-        pcibr_unlock(pcibus_info, flag);
+        spin_unlock_irqrestore(&pcibus_info->pbi_lock, flags);
 
         return status;
 }
@@ -182,7 +169,7 @@ void pcibr_ate_free(struct pcibus_info *pcibus_info, int index)
                 ate_write(pcibus_info, index, count, (ate & ~PCI32_ATE_V));
         }
 
-        flags = pcibr_lock(pcibus_info);
+        spin_lock_irqsave(&pcibus_info->pbi_lock, flags);
         free_ate_resource(&pcibus_info->pbi_int_ate_resource, index);
-        pcibr_unlock(pcibus_info, flags);
+        spin_unlock_irqrestore(&pcibus_info->pbi_lock, flags);
 }
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
index 54ce5b7ceed2..9f86bb6519aa 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
@@ -137,14 +137,12 @@ pcibr_dmatrans_direct64(struct pcidev_info * info, u64 paddr,
                 pci_addr |= PCI64_ATTR_VIRTUAL;
 
         return pci_addr;
-
 }
 
 static dma_addr_t
 pcibr_dmatrans_direct32(struct pcidev_info * info,
                         u64 paddr, size_t req_size, u64 flags)
 {
-
         struct pcidev_info *pcidev_info = info->pdi_host_pcidev_info;
         struct pcibus_info *pcibus_info = (struct pcibus_info *)pcidev_info->
             pdi_pcibus_info;
@@ -171,7 +169,6 @@ pcibr_dmatrans_direct32(struct pcidev_info * info,
         }
 
         return PCI32_DIRECT_BASE | offset;
-
 }
 
 /*
@@ -218,9 +215,8 @@ void sn_dma_flush(u64 addr)
         u64 flags;
         u64 itte;
         struct hubdev_info *hubinfo;
-        volatile struct sn_flush_device_kernel *p;
-        volatile struct sn_flush_device_common *common;
-
+        struct sn_flush_device_kernel *p;
+        struct sn_flush_device_common *common;
         struct sn_flush_nasid_entry *flush_nasid_list;
 
         if (!sn_ioif_inited)
@@ -310,8 +306,7 @@ void sn_dma_flush(u64 addr)
                                              (common->sfdl_slot - 1));
                 }
         } else {
-                spin_lock_irqsave((spinlock_t *)&p->sfdl_flush_lock,
-                                  flags);
+                spin_lock_irqsave(&p->sfdl_flush_lock, flags);
                 *common->sfdl_flush_addr = 0;
 
                 /* force an interrupt. */
@@ -322,8 +317,7 @@ void sn_dma_flush(u64 addr)
                         cpu_relax();
 
                 /* okay, everything is synched up. */
-                spin_unlock_irqrestore((spinlock_t *)&p->sfdl_flush_lock,
-                                       flags);
+                spin_unlock_irqrestore(&p->sfdl_flush_lock, flags);
         }
         return;
 }
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_provider.c b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
index 2fac27049bf6..98f716bd92f0 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_provider.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
@@ -163,9 +163,12 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
         /* Setup the PMU ATE map */
         soft->pbi_int_ate_resource.lowest_free_index = 0;
         soft->pbi_int_ate_resource.ate =
-            kmalloc(soft->pbi_int_ate_size * sizeof(u64), GFP_KERNEL);
-        memset(soft->pbi_int_ate_resource.ate, 0,
-               (soft->pbi_int_ate_size * sizeof(u64)));
+            kzalloc(soft->pbi_int_ate_size * sizeof(u64), GFP_KERNEL);
+
+        if (!soft->pbi_int_ate_resource.ate) {
+                kfree(soft);
+                return NULL;
+        }
 
         if (prom_bussoft->bs_asic_type == PCIIO_ASIC_TYPE_TIOCP) {
                 /* TIO PCI Bridge: find nearest node with CPUs */
diff --git a/arch/m32r/Makefile b/arch/m32r/Makefile
index 983d438b14b6..4b3c90ba926c 100644
--- a/arch/m32r/Makefile
+++ b/arch/m32r/Makefile
@@ -12,14 +12,14 @@ CFLAGS_MODULE += -mmodel=large
 
 ifdef CONFIG_CHIP_VDEC2
 cflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -Wa,-bitinst
-aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -Wa,-bitinst
+aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -O2 -Wa,-bitinst -Wa,-no-parallel
 else
 cflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2
-aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2
+aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2 -O2
 endif
 
 cflags-$(CONFIG_ISA_M32R)       += -DNO_FPU
-aflags-$(CONFIG_ISA_M32R)       += -DNO_FPU -Wa,-no-bitinst
+aflags-$(CONFIG_ISA_M32R)       += -DNO_FPU -O2 -Wa,-no-bitinst
 
 CFLAGS += $(cflags-y)
 AFLAGS += $(aflags-y)
diff --git a/arch/m32r/kernel/m32r_ksyms.c b/arch/m32r/kernel/m32r_ksyms.c
index dbc8a392105f..be8b711367ec 100644
--- a/arch/m32r/kernel/m32r_ksyms.c
+++ b/arch/m32r/kernel/m32r_ksyms.c
@@ -18,11 +18,6 @@
 #include <asm/irq.h>
 #include <asm/tlbflush.h>
 
-#if defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_HD) || defined(CONFIG_BLK_DEV_IDE_MODULE) || defined(CONFIG_BLK_DEV_HD_MODULE)
-extern struct drive_info_struct drive_info;
-EXPORT_SYMBOL(drive_info);
-#endif
-
 /* platform dependent support */
 EXPORT_SYMBOL(boot_cpu_data);
 EXPORT_SYMBOL(dump_fpu);
diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
index c2e4dccf0112..d742037a7ccb 100644
--- a/arch/m32r/kernel/setup.c
+++ b/arch/m32r/kernel/setup.c
@@ -37,12 +37,6 @@
 extern void init_mmu(void);
 #endif
 
-#if defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_HD)   \
-        || defined(CONFIG_BLK_DEV_IDE_MODULE)                   \
-        || defined(CONFIG_BLK_DEV_HD_MODULE)
-struct drive_info_struct { char dummy[32]; } drive_info;
-#endif
-
 extern char _end[];
 
 /*
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index 71763f7a1d19..cb33097fefc4 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -36,7 +36,7 @@ int do_signal(struct pt_regs *, sigset_t *);
 asmlinkage int
 sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
                   unsigned long r2, unsigned long r3, unsigned long r4,
-                  unsigned long r5, unsigned long r6, struct pt_regs regs)
+                  unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
         sigset_t saveset, newset;
 
@@ -54,21 +54,21 @@ sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.r0 = -EINTR;
+        regs->r0 = -EINTR;
         while (1) {
                 current->state = TASK_INTERRUPTIBLE;
                 schedule();
-                if (do_signal(&regs, &saveset))
-                        return regs.r0;
+                if (do_signal(regs, &saveset))
+                        return regs->r0;
         }
 }
 
 asmlinkage int
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                 unsigned long r2, unsigned long r3, unsigned long r4,
-                unsigned long r5, unsigned long r6, struct pt_regs regs)
+                unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
-        return do_sigaltstack(uss, uoss, regs.spu);
+        return do_sigaltstack(uss, uoss, regs->spu);
 }
 
 
@@ -140,11 +140,10 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
 asmlinkage int
 sys_rt_sigreturn(unsigned long r0, unsigned long r1,
                  unsigned long r2, unsigned long r3, unsigned long r4,
-                 unsigned long r5, unsigned long r6, struct pt_regs regs)
+                 unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
-        struct rt_sigframe __user *frame = (struct rt_sigframe __user *)regs.spu;
+        struct rt_sigframe __user *frame = (struct rt_sigframe __user *)regs->spu;
         sigset_t set;
-        stack_t st;
         int result;
 
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -158,14 +157,11 @@ sys_rt_sigreturn(unsigned long r0, unsigned long r1,
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->uc.uc_mcontext, &result))
+        if (restore_sigcontext(regs, &frame->uc.uc_mcontext, &result))
                 goto badframe;
 
-        if (__copy_from_user(&st, &frame->uc.uc_stack, sizeof(st)))
+        if (do_sigaltstack(&frame->uc.uc_stack, NULL, regs->spu) == -EFAULT)
                 goto badframe;
-        /* It is more difficult to avoid calling this function than to
-           call it and ignore errors.  */
-        do_sigaltstack(&st, NULL, regs.spu);
 
         return result;
 
diff --git a/arch/m32r/kernel/sys_m32r.c b/arch/m32r/kernel/sys_m32r.c
index fe55b28d3725..670cb49210af 100644
--- a/arch/m32r/kernel/sys_m32r.c
+++ b/arch/m32r/kernel/sys_m32r.c
@@ -29,28 +29,7 @@
 
 /*
  * sys_tas() - test-and-set
- * linuxthreads testing version
  */
-#ifndef CONFIG_SMP
-asmlinkage int sys_tas(int *addr)
-{
-        int oldval;
-        unsigned long flags;
-
-        if (!access_ok(VERIFY_WRITE, addr, sizeof (int)))
-                return -EFAULT;
-        local_irq_save(flags);
-        oldval = *addr;
-        if (!oldval)
-                *addr = 1;
-        local_irq_restore(flags);
-        return oldval;
-}
-#else /* CONFIG_SMP */
-#include <linux/spinlock.h>
-
-static DEFINE_SPINLOCK(tas_lock);
-
 asmlinkage int sys_tas(int *addr)
 {
         int oldval;
@@ -58,15 +37,43 @@ asmlinkage int sys_tas(int *addr)
         if (!access_ok(VERIFY_WRITE, addr, sizeof (int)))
                 return -EFAULT;
 
-        _raw_spin_lock(&tas_lock);
-        oldval = *addr;
-        if (!oldval)
-                *addr = 1;
-        _raw_spin_unlock(&tas_lock);
+        /* atomic operation:
+         *   oldval = *addr; *addr = 1;
+         */
+        __asm__ __volatile__ (
+                DCACHE_CLEAR("%0", "r4", "%1")
+                "       .fillinsn\n"
+                "1:\n"
+                "       lock    %0, @%1     ->  unlock  %2, @%1\n"
+                "2:\n"
+                /* NOTE:
+                 *   The m32r processor can accept interrupts only
+                 *   at the 32-bit instruction boundary.
+                 *   So, in the above code, the "unlock" instruction
+                 *   can be executed continuously after the "lock"
+                 *   instruction execution without any interruptions.
+                 */
+                ".section .fixup,\"ax\"\n"
+                "       .balign 4\n"
+                "3:     ldi     %0, #%3\n"
+                "       seth    r14, #high(2b)\n"
+                "       or3     r14, r14, #low(2b)\n"
+                "       jmp     r14\n"
+                ".previous\n"
+                ".section __ex_table,\"a\"\n"
+                "       .balign 4\n"
+                "       .long 1b,3b\n"
+                ".previous\n"
+                : "=&r" (oldval)
+                : "r" (addr), "r" (1), "i"(-EFAULT)
+                : "r14", "memory"
+#ifdef CONFIG_CHIP_M32700_TS1
+                  , "r4"
+#endif /* CONFIG_CHIP_M32700_TS1 */
+        );
 
         return oldval;
 }
-#endif /* CONFIG_SMP */
 
 /*
  * sys_pipe() is the normal C calling standard for creating
diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
index ce16bbe26a52..2d1dd2106c4d 100644
--- a/arch/m32r/lib/usercopy.c
+++ b/arch/m32r/lib/usercopy.c
@@ -64,7 +64,7 @@ do {									\
                 "       .balign 4\n"                                    \
                 "       .long 0b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(res), "=r"(count), "=&r" (__d0), "=&r" (__d1),   \
+                : "=&r"(res), "=&r"(count), "=&r" (__d0), "=&r" (__d1), \
                   "=&r" (__d2)                                          \
                 : "i"(-EFAULT), "0"(count), "1"(count), "3"(src),       \
                   "4"(dst)                                              \
@@ -101,7 +101,7 @@ do {									\
                 "       .balign 4\n"                                    \
                 "       .long 0b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(res), "=r"(count), "=&r" (__d0), "=&r" (__d1),   \
+                : "=&r"(res), "=&r"(count), "=&r" (__d0), "=&r" (__d1), \
                   "=&r" (__d2)                                          \
                 : "i"(-EFAULT), "0"(count), "1"(count), "3"(src),       \
                   "4"(dst)                                              \
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 96b919828053..8849439e88dd 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -21,6 +21,10 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default y
 
+config TIME_LOW_RES
+        bool
+        default y
+
 config ARCH_MAY_HAVE_PC_FDC
         bool
         depends on Q40 || (BROKEN && SUN3X)
diff --git a/arch/m68k/fpsp040/bindec.S b/arch/m68k/fpsp040/bindec.S
index 3ba446a99a12..72f1159cb804 100644
--- a/arch/m68k/fpsp040/bindec.S
+++ b/arch/m68k/fpsp040/bindec.S
@@ -131,9 +131,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |BINDEC    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/binstr.S b/arch/m68k/fpsp040/binstr.S
index d53555c0a2b6..8a05ba92a8a0 100644
--- a/arch/m68k/fpsp040/binstr.S
+++ b/arch/m68k/fpsp040/binstr.S
@@ -60,9 +60,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |BINSTR    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/bugfix.S b/arch/m68k/fpsp040/bugfix.S
index 942c4f6f4fd1..3bb9c84bb058 100644
--- a/arch/m68k/fpsp040/bugfix.S
+++ b/arch/m68k/fpsp040/bugfix.S
@@ -152,9 +152,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |BUGFIX    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/decbin.S b/arch/m68k/fpsp040/decbin.S
index 2160609e328d..16ed796bad87 100644
--- a/arch/m68k/fpsp040/decbin.S
+++ b/arch/m68k/fpsp040/decbin.S
@@ -69,9 +69,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |DECBIN    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/do_func.S b/arch/m68k/fpsp040/do_func.S
index 81f6a9856dce..3eff99a80413 100644
--- a/arch/m68k/fpsp040/do_func.S
+++ b/arch/m68k/fpsp040/do_func.S
@@ -22,9 +22,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 DO_FUNC:        |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/fpsp.h b/arch/m68k/fpsp040/fpsp.h
index 984a4eb8010a..5df4cd772934 100644
--- a/arch/m68k/fpsp040/fpsp.h
+++ b/arch/m68k/fpsp040/fpsp.h
@@ -5,9 +5,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |       fpsp.h --- stack frame offsets during FPSP exception handling
 |
diff --git a/arch/m68k/fpsp040/gen_except.S b/arch/m68k/fpsp040/gen_except.S
index 401d06f39f73..3642cb7e3641 100644
--- a/arch/m68k/fpsp040/gen_except.S
+++ b/arch/m68k/fpsp040/gen_except.S
@@ -29,9 +29,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 GEN_EXCEPT:    |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/get_op.S b/arch/m68k/fpsp040/get_op.S
index c7c2f3727425..64c36d79ef83 100644
--- a/arch/m68k/fpsp040/get_op.S
+++ b/arch/m68k/fpsp040/get_op.S
@@ -54,9 +54,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 GET_OP:    |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/kernel_ex.S b/arch/m68k/fpsp040/kernel_ex.S
index 476b711967ce..45bcf3455d34 100644
--- a/arch/m68k/fpsp040/kernel_ex.S
+++ b/arch/m68k/fpsp040/kernel_ex.S
@@ -12,9 +12,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 KERNEL_EX:    |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/res_func.S b/arch/m68k/fpsp040/res_func.S
index 8f6b95217865..d9cdf4383545 100644
--- a/arch/m68k/fpsp040/res_func.S
+++ b/arch/m68k/fpsp040/res_func.S
@@ -16,9 +16,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 RES_FUNC:    |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/round.S b/arch/m68k/fpsp040/round.S
index 00f98068783f..f84ae0dd4358 100644
--- a/arch/m68k/fpsp040/round.S
+++ b/arch/m68k/fpsp040/round.S
@@ -8,9 +8,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |ROUND  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/sacos.S b/arch/m68k/fpsp040/sacos.S
index 83b00ab1c48f..513c7cca7318 100644
--- a/arch/m68k/fpsp040/sacos.S
+++ b/arch/m68k/fpsp040/sacos.S
@@ -38,9 +38,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SACOS  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/sasin.S b/arch/m68k/fpsp040/sasin.S
index 5647a6043903..2a269a58ceaa 100644
--- a/arch/m68k/fpsp040/sasin.S
+++ b/arch/m68k/fpsp040/sasin.S
@@ -38,9 +38,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SASIN  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/satan.S b/arch/m68k/fpsp040/satan.S
index 20dae222d51e..c8a664998f92 100644
--- a/arch/m68k/fpsp040/satan.S
+++ b/arch/m68k/fpsp040/satan.S
@@ -43,9 +43,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |satan  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/satanh.S b/arch/m68k/fpsp040/satanh.S
index 20f07810bcda..ba91f77a7571 100644
--- a/arch/m68k/fpsp040/satanh.S
+++ b/arch/m68k/fpsp040/satanh.S
@@ -45,9 +45,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |satanh idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/scale.S b/arch/m68k/fpsp040/scale.S
index 5c9b805265f2..04829dd4f1f4 100644
--- a/arch/m68k/fpsp040/scale.S
+++ b/arch/m68k/fpsp040/scale.S
@@ -21,9 +21,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SCALE    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/scosh.S b/arch/m68k/fpsp040/scosh.S
index e81edbb87642..07d3a4d7c86d 100644
--- a/arch/m68k/fpsp040/scosh.S
+++ b/arch/m68k/fpsp040/scosh.S
@@ -49,9 +49,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SCOSH  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/setox.S b/arch/m68k/fpsp040/setox.S
index 0aa75f9bf7d1..145af5447581 100644
--- a/arch/m68k/fpsp040/setox.S
+++ b/arch/m68k/fpsp040/setox.S
@@ -331,9 +331,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |setox  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/sgetem.S b/arch/m68k/fpsp040/sgetem.S
index 0fcbd045ba75..d9234f4aed57 100644
--- a/arch/m68k/fpsp040/sgetem.S
+++ b/arch/m68k/fpsp040/sgetem.S
@@ -24,9 +24,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SGETEM idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/sint.S b/arch/m68k/fpsp040/sint.S
index 0f9bd28e55a0..0e92d4e5d231 100644
--- a/arch/m68k/fpsp040/sint.S
+++ b/arch/m68k/fpsp040/sint.S
@@ -51,9 +51,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SINT    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/skeleton.S b/arch/m68k/fpsp040/skeleton.S
index a1629194e3fd..a8f41615d94a 100644
--- a/arch/m68k/fpsp040/skeleton.S
+++ b/arch/m68k/fpsp040/skeleton.S
@@ -30,9 +30,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |
 |       Modified for Linux-1.3.x by Jes Sorensen (jds@kom.auc.dk)
diff --git a/arch/m68k/fpsp040/slog2.S b/arch/m68k/fpsp040/slog2.S
index 517fa4563246..fac2c738382e 100644
--- a/arch/m68k/fpsp040/slog2.S
+++ b/arch/m68k/fpsp040/slog2.S
@@ -96,9 +96,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SLOG2    idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/slogn.S b/arch/m68k/fpsp040/slogn.S
index 2aaa0725c035..d98eaf641ec4 100644
--- a/arch/m68k/fpsp040/slogn.S
+++ b/arch/m68k/fpsp040/slogn.S
@@ -63,9 +63,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |slogn  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/smovecr.S b/arch/m68k/fpsp040/smovecr.S
index a0127fa55e9c..73c36512081b 100644
--- a/arch/m68k/fpsp040/smovecr.S
+++ b/arch/m68k/fpsp040/smovecr.S
@@ -15,9 +15,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SMOVECR        idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/srem_mod.S b/arch/m68k/fpsp040/srem_mod.S
index 8c8d7f50cc68..a27e70c9a0eb 100644
--- a/arch/m68k/fpsp040/srem_mod.S
+++ b/arch/m68k/fpsp040/srem_mod.S
@@ -66,9 +66,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 SREM_MOD:    |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/ssin.S b/arch/m68k/fpsp040/ssin.S
index 043c91cdd657..a1ef8e01bf06 100644
--- a/arch/m68k/fpsp040/ssin.S
+++ b/arch/m68k/fpsp040/ssin.S
@@ -83,9 +83,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SSIN   idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/ssinh.S b/arch/m68k/fpsp040/ssinh.S
index c8b3308bb143..8a560edc7653 100644
--- a/arch/m68k/fpsp040/ssinh.S
+++ b/arch/m68k/fpsp040/ssinh.S
@@ -49,9 +49,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |SSINH  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/stan.S b/arch/m68k/fpsp040/stan.S
index b5c2a196e617..f8553aaececb 100644
--- a/arch/m68k/fpsp040/stan.S
+++ b/arch/m68k/fpsp040/stan.S
@@ -50,9 +50,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |STAN   idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/stanh.S b/arch/m68k/fpsp040/stanh.S
index 33b009802243..7e12e59ee8c7 100644
--- a/arch/m68k/fpsp040/stanh.S
+++ b/arch/m68k/fpsp040/stanh.S
@@ -49,9 +49,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |STANH  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/sto_res.S b/arch/m68k/fpsp040/sto_res.S
index 0cdca3b060ad..484b47d4eaad 100644
--- a/arch/m68k/fpsp040/sto_res.S
+++ b/arch/m68k/fpsp040/sto_res.S
@@ -19,9 +19,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 STO_RES:        |idnt   2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/stwotox.S b/arch/m68k/fpsp040/stwotox.S
index 4e3c1407d3df..0d5e6a1436a6 100644
--- a/arch/m68k/fpsp040/stwotox.S
+++ b/arch/m68k/fpsp040/stwotox.S
@@ -76,9 +76,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |STWOTOX        idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/tbldo.S b/arch/m68k/fpsp040/tbldo.S
index fe60cf4d20d7..fd5c37a5a2b9 100644
--- a/arch/m68k/fpsp040/tbldo.S
+++ b/arch/m68k/fpsp040/tbldo.S
@@ -17,9 +17,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |TBLDO  idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/util.S b/arch/m68k/fpsp040/util.S
index 452f3d65857b..65b26fa88c60 100644
--- a/arch/m68k/fpsp040/util.S
+++ b/arch/m68k/fpsp040/util.S
@@ -16,9 +16,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 |UTIL   idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_bsun.S b/arch/m68k/fpsp040/x_bsun.S
index 039247b09c8b..d5a576bfac79 100644
--- a/arch/m68k/fpsp040/x_bsun.S
+++ b/arch/m68k/fpsp040/x_bsun.S
@@ -13,9 +13,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_BSUN: |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_fline.S b/arch/m68k/fpsp040/x_fline.S
index 3917710b0fde..264e126d1db7 100644
--- a/arch/m68k/fpsp040/x_fline.S
+++ b/arch/m68k/fpsp040/x_fline.S
@@ -13,9 +13,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_FLINE:        |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_operr.S b/arch/m68k/fpsp040/x_operr.S
index b0f54bcb49a7..e2c371c3a45d 100644
--- a/arch/m68k/fpsp040/x_operr.S
+++ b/arch/m68k/fpsp040/x_operr.S
@@ -43,9 +43,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_OPERR:        |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_ovfl.S b/arch/m68k/fpsp040/x_ovfl.S
index 22cb8b42c7b6..6fe4989ee31f 100644
--- a/arch/m68k/fpsp040/x_ovfl.S
+++ b/arch/m68k/fpsp040/x_ovfl.S
@@ -35,9 +35,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_OVFL: |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_snan.S b/arch/m68k/fpsp040/x_snan.S
index 039af573312e..4ed766416378 100644
--- a/arch/m68k/fpsp040/x_snan.S
+++ b/arch/m68k/fpsp040/x_snan.S
@@ -22,9 +22,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_SNAN: |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_store.S b/arch/m68k/fpsp040/x_store.S
index 4282fa67d449..402dc0c0ebc0 100644
--- a/arch/m68k/fpsp040/x_store.S
+++ b/arch/m68k/fpsp040/x_store.S
@@ -11,9 +11,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_STORE:        |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_unfl.S b/arch/m68k/fpsp040/x_unfl.S
index 077fcc230fcc..eb772ff3b812 100644
--- a/arch/m68k/fpsp040/x_unfl.S
+++ b/arch/m68k/fpsp040/x_unfl.S
@@ -21,9 +21,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_UNFL: |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_unimp.S b/arch/m68k/fpsp040/x_unimp.S
index 920cb9410e9e..6f382b21228b 100644
--- a/arch/m68k/fpsp040/x_unimp.S
+++ b/arch/m68k/fpsp040/x_unimp.S
@@ -22,9 +22,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_UNIMP:        |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/fpsp040/x_unsupp.S b/arch/m68k/fpsp040/x_unsupp.S
index 4ec57285b683..d7cf46208c62 100644
--- a/arch/m68k/fpsp040/x_unsupp.S
+++ b/arch/m68k/fpsp040/x_unsupp.S
@@ -23,9 +23,8 @@
 |               Copyright (C) Motorola, Inc. 1990
 |                       All Rights Reserved
 |
-|       THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF MOTOROLA
-|       The copyright notice above does not evidence any
-|       actual or intended publication of such source code.
+|       For details on the license for this file, please see the
+|       file, README, in this same directory.
 
 X_UNSUPP:       |idnt    2,1 | Motorola 040 Floating Point Software Package
 
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index 3f9cb55d0356..2d8ad0727b6b 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -129,6 +129,9 @@ void machine_power_off(void)
         for (;;);
 }
 
+void (*pm_power_off)(void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
+
 void show_regs(struct pt_regs * regs)
 {
         printk("\n");
diff --git a/arch/m68knommu/Kconfig b/arch/m68knommu/Kconfig
index e2a6e8648960..e50858dbc237 100644
--- a/arch/m68knommu/Kconfig
+++ b/arch/m68knommu/Kconfig
@@ -29,6 +29,10 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default y
 
+config TIME_LOW_RES
+        bool
+        default y
+
 source "init/Kconfig"
 
 menu "Processor type and features"
diff --git a/arch/m68knommu/kernel/process.c b/arch/m68knommu/kernel/process.c
index 99bf43824795..63c117dae0c3 100644
--- a/arch/m68knommu/kernel/process.c
+++ b/arch/m68knommu/kernel/process.c
@@ -39,6 +39,14 @@
 
 asmlinkage void ret_from_fork(void);
 
+/*
+ * The following aren't currently used.
+ */
+void (*pm_idle)(void);
+EXPORT_SYMBOL(pm_idle);
+
+void (*pm_power_off)(void);
+EXPORT_SYMBOL(pm_power_off);
 
 /*
  * The idle loop on an m68knommu..
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index c3e852e9953e..3a0f89d2c8dc 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -595,6 +595,7 @@ config SGI_IP32
         select SYS_HAS_CPU_R5000
         select SYS_HAS_CPU_R10000 if BROKEN
         select SYS_HAS_CPU_RM7000
+        select SYS_HAS_CPU_NEVADA
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
         help
@@ -1052,6 +1053,7 @@ config CPU_MIPS32_R1
         depends on SYS_HAS_CPU_MIPS32_R1
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 1 or later of the
           MIPS32 architecture.  Most modern embedded systems with a 32-bit
@@ -1068,6 +1070,7 @@ config CPU_MIPS32_R2
         depends on SYS_HAS_CPU_MIPS32_R2
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 2 or later of the
           MIPS32 architecture.  Most modern embedded systems with a 32-bit
@@ -1081,6 +1084,7 @@ config CPU_MIPS64_R1
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
         select CPU_SUPPORTS_64BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 1 or later of the
           MIPS64 architecture.  Many modern embedded systems with a 64-bit
@@ -1098,6 +1102,7 @@ config CPU_MIPS64_R2
         select CPU_HAS_PREFETCH
         select CPU_SUPPORTS_32BIT_KERNEL
         select CPU_SUPPORTS_64BIT_KERNEL
+        select CPU_SUPPORTS_HIGHMEM
         help
           Choose this option to build a kernel for release 2 or later of the
           MIPS64 architecture.  Many modern embedded systems with a 64-bit
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 2a9f2ef27b29..3d8dac681c63 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -53,14 +53,17 @@ CROSS_COMPILE		:= $(tool-prefix)
 endif
 
 CHECKFLAGS-y                            += -D__linux__ -D__mips__ \
+                                           -D_MIPS_SZINT=32 \
                                            -D_ABIO32=1 \
                                            -D_ABIN32=2 \
                                            -D_ABI64=3
 CHECKFLAGS-$(CONFIG_32BIT)              += -D_MIPS_SIM=_ABIO32 \
                                            -D_MIPS_SZLONG=32 \
+                                           -D_MIPS_SZPTR=32 \
                                            -D__PTRDIFF_TYPE__=int
 CHECKFLAGS-$(CONFIG_64BIT)              += -m64 -D_MIPS_SIM=_ABI64 \
                                            -D_MIPS_SZLONG=64 \
+                                           -D_MIPS_SZPTR=64 \
                                            -D__PTRDIFF_TYPE__="long int"
 CHECKFLAGS-$(CONFIG_CPU_BIG_ENDIAN)     += -D__MIPSEB__
 CHECKFLAGS-$(CONFIG_CPU_LITTLE_ENDIAN)  += -D__MIPSEL__
@@ -91,8 +94,8 @@ endif
 # machines may also.  Since BFD is incredibly buggy with respect to
 # crossformat linking we rely on the elf2ecoff tool for format conversion.
 #
-cflags-y                        += -I $(TOPDIR)/include/asm/gcc
 cflags-y                        += -G 0 -mno-abicalls -fno-pic -pipe
+cflags-y                        += -msoft-float
 LDFLAGS_vmlinux                 += -G 0 -static -n -nostdlib
 MODFLAGS                        += -mlong-calls
 
@@ -105,7 +108,8 @@ MODFLAGS			+= -mlong-calls
 cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(shell $(CC) -dumpmachine |grep -q 'mips.*el-.*' && echo -EB)
 cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += $(shell $(CC) -dumpmachine |grep -q 'mips.*el-.*' || echo -EL)
 
-cflags-$(CONFIG_SB1XXX_CORELIS) += -mno-sched-prolog -fno-omit-frame-pointer
+cflags-$(CONFIG_SB1XXX_CORELIS) += $(call cc-option,-mno-sched-prolog) \
+                                   -fno-omit-frame-pointer
 
 #
 # Use: $(call set_gccflags,<cpu0>,<isa0>,<cpu1>,<isa1>,<isa2>)
@@ -166,79 +170,97 @@ echo $$gcc_abi $$gcc_opt$$gcc_cpu $$gcc_isa $$gas_abi $$gas_opt$$gas_cpu $$gas_i
 #
 cflags-$(CONFIG_CPU_R3000)      += \
                         $(call set_gccflags,r3000,mips1,r3000,mips1,mips1)
+CHECKFLAGS-$(CONFIG_CPU_R3000)  += -D_MIPS_ISA=_MIPS_ISA_MIPS1
 
 cflags-$(CONFIG_CPU_TX39XX)     += \
                         $(call set_gccflags,r3900,mips1,r3000,mips1,mips1)
+CHECKFLAGS-$(CONFIG_CPU_TX39XX) += -D_MIPS_ISA=_MIPS_ISA_MIPS1
 
 cflags-$(CONFIG_CPU_R6000)      += \
                         $(call set_gccflags,r6000,mips2,r6000,mips2,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R6000)  += -D_MIPS_ISA=_MIPS_ISA_MIPS2
 
 cflags-$(CONFIG_CPU_R4300)      += \
                         $(call set_gccflags,r4300,mips3,r4300,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R4300)  += -D_MIPS_ISA=_MIPS_ISA_MIPS3
 
 cflags-$(CONFIG_CPU_VR41XX)     += \
                         $(call set_gccflags,r4100,mips3,r4600,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_VR41XX) += -D_MIPS_ISA=_MIPS_ISA_MIPS3
 
 cflags-$(CONFIG_CPU_R4X00)      += \
                         $(call set_gccflags,r4600,mips3,r4600,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R4X00)  += -D_MIPS_ISA=_MIPS_ISA_MIPS3
 
 cflags-$(CONFIG_CPU_TX49XX)     += \
                         $(call set_gccflags,r4600,mips3,r4600,mips3,mips2)  \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_TX49XX) += -D_MIPS_ISA=_MIPS_ISA_MIPS3
 
 cflags-$(CONFIG_CPU_MIPS32_R1)  += \
                         $(call set_gccflags,mips32,mips32,r4600,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_MIPS32_R1)      += -D_MIPS_ISA=_MIPS_ISA_MIPS32
 
 cflags-$(CONFIG_CPU_MIPS32_R2)  += \
                         $(call set_gccflags,mips32r2,mips32r2,r4600,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_MIPS32_R2)      += -D_MIPS_ISA=_MIPS_ISA_MIPS32
 
 cflags-$(CONFIG_CPU_MIPS64_R1)  += \
                         $(call set_gccflags,mips64,mips64,r4600,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_MIPS64_R1)      += -D_MIPS_ISA=_MIPS_ISA_MIPS64
 
 cflags-$(CONFIG_CPU_MIPS64_R2)  += \
                         $(call set_gccflags,mips64r2,mips64r2,r4600,mips3,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_MIPS64_R2)      += -D_MIPS_ISA=_MIPS_ISA_MIPS64
 
 cflags-$(CONFIG_CPU_R5000)      += \
                         $(call set_gccflags,r5000,mips4,r5000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R5000)  += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 cflags-$(CONFIG_CPU_R5432)      += \
                         $(call set_gccflags,r5400,mips4,r5000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R5432)  += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 cflags-$(CONFIG_CPU_NEVADA)     += \
                         $(call set_gccflags,rm5200,mips4,r5000,mips4,mips2) \
                         -Wa,--trap
-#                       $(call cc-option,-mmad)
+CHECKFLAGS-$(CONFIG_CPU_NEVADA) += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 cflags-$(CONFIG_CPU_RM7000)     += \
                         $(call set_gccflags,rm7000,mips4,r5000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_RM7000) += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 cflags-$(CONFIG_CPU_RM9000)     += \
                         $(call set_gccflags,rm9000,mips4,r5000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_RM9000) += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 
 cflags-$(CONFIG_CPU_SB1)        += \
                         $(call set_gccflags,sb1,mips64,r5000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_SB1)    += -D_MIPS_ISA=_MIPS_ISA_MIPS64
 
 cflags-$(CONFIG_CPU_R8000)      += \
                         $(call set_gccflags,r8000,mips4,r8000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R8000)  += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 cflags-$(CONFIG_CPU_R10000)     += \
                         $(call set_gccflags,r10000,mips4,r8000,mips4,mips2) \
                         -Wa,--trap
+CHECKFLAGS-$(CONFIG_CPU_R10000) += -D_MIPS_ISA=_MIPS_ISA_MIPS4
 
 ifdef CONFIG_CPU_SB1
 ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
@@ -369,7 +391,7 @@ load-$(CONFIG_MIPS_XXS1500)	+= 0xffffffff80100000
 # Cobalt Server
 #
 core-$(CONFIG_MIPS_COBALT)      += arch/mips/cobalt/
-cflags-$(CONFIG_MIPS_COBALT)    += -Iinclude/asm-mips/cobalt
+cflags-$(CONFIG_MIPS_COBALT)    += -Iinclude/asm-mips/mach-cobalt
 load-$(CONFIG_MIPS_COBALT)      += 0xffffffff80080000
 
 #
diff --git a/arch/mips/arc/arc_con.c b/arch/mips/arc/arc_con.c
index 51785a6a7328..bc32fe64f42a 100644
--- a/arch/mips/arc/arc_con.c
+++ b/arch/mips/arc/arc_con.c
@@ -24,7 +24,7 @@ static void prom_console_write(struct console *co, const char *s,
         }
 }
 
-static int __init prom_console_setup(struct console *co, char *options)
+static int prom_console_setup(struct console *co, char *options)
 {
         return !(prom_flags & PROM_FLAG_USE_AS_CONSOLE);
 }
diff --git a/arch/mips/arc/misc.c b/arch/mips/arc/misc.c
index 84867de22028..b2e10b9e9452 100644
--- a/arch/mips/arc/misc.c
+++ b/arch/mips/arc/misc.c
@@ -9,7 +9,6 @@
  * Copyright (C) 1999 Ralf Baechle (ralf@gnu.org)
  * Copyright (C) 1999 Silicon Graphics, Inc.
  */
-#include <linux/config.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 
@@ -20,17 +19,11 @@
 #include <asm/bootinfo.h>
 #include <asm/system.h>
 
-extern void *sgiwd93_host;
-extern void reset_wd33c93(void *instance);
-
 VOID
 ArcHalt(VOID)
 {
         bc_disable();
         local_irq_disable();
-#ifdef CONFIG_SCSI_SGIWD93
-        reset_wd33c93(sgiwd93_host);
-#endif
         ARC_CALL0(halt);
 never:  goto never;
 }
@@ -40,9 +33,6 @@ ArcPowerDown(VOID)
 {
         bc_disable();
         local_irq_disable();
-#ifdef CONFIG_SCSI_SGIWD93
-        reset_wd33c93(sgiwd93_host);
-#endif
         ARC_CALL0(pdown);
 never:  goto never;
 }
@@ -53,9 +43,6 @@ ArcRestart(VOID)
 {
         bc_disable();
         local_irq_disable();
-#ifdef CONFIG_SCSI_SGIWD93
-        reset_wd33c93(sgiwd93_host);
-#endif
         ARC_CALL0(restart);
 never:  goto never;
 }
@@ -65,9 +52,6 @@ ArcReboot(VOID)
 {
         bc_disable();
         local_irq_disable();
-#ifdef CONFIG_SCSI_SGIWD93
-        reset_wd33c93(sgiwd93_host);
-#endif
         ARC_CALL0(reboot);
 never:  goto never;
 }
@@ -77,9 +61,6 @@ ArcEnterInteractiveMode(VOID)
 {
         bc_disable();
         local_irq_disable();
-#ifdef CONFIG_SCSI_SGIWD93
-        reset_wd33c93(sgiwd93_host);
-#endif
         ARC_CALL0(imode);
 never:  goto never;
 }
diff --git a/arch/mips/au1000/common/reset.c b/arch/mips/au1000/common/reset.c
index 65b84db800e4..c93af224c1b3 100644
--- a/arch/mips/au1000/common/reset.c
+++ b/arch/mips/au1000/common/reset.c
@@ -151,7 +151,7 @@ void au1000_restart(char *command)
         }
 
         set_c0_status(ST0_BEV | ST0_ERL);
-        set_c0_config(CONF_CM_UNCACHED);
+        change_c0_config(CONF_CM_CMASK, CONF_CM_UNCACHED);
         flush_cache_all();
         write_c0_wired(0);
 
@@ -164,17 +164,20 @@ void au1000_restart(char *command)
 
 void au1000_halt(void)
 {
-#if defined(CONFIG_MIPS_PB1550)
+#if defined(CONFIG_MIPS_PB1550) || defined(CONFIG_MIPS_DB1550)
         /* power off system */
-        printk("\n** Powering off Pb1550\n");
+        printk("\n** Powering off...\n");
         au_writew(au_readw(0xAF00001C) | (3<<14), 0xAF00001C);
         au_sync();
         while(1); /* should not get here */
-#endif
+#else
         printk(KERN_NOTICE "\n** You can safely turn off the power\n");
 #ifdef CONFIG_MIPS_MIRAGE
         au_writel((1 << 26) | (1 << 10), GPIO2_OUTPUT);
 #endif
+#ifdef CONFIG_MIPS_DB1200
+        au_writew(au_readw(0xB980001C) | (1<<14), 0xB980001C);
+#endif
 #ifdef CONFIG_PM
         au_sleep();
 
@@ -187,6 +190,7 @@ void au1000_halt(void)
                         "wait\n\t"
                         ".set\tmips0");
 #endif
+#endif /* defined(CONFIG_MIPS_PB1550) || defined(CONFIG_MIPS_DB1550) */
 }
 
 void au1000_power_off(void)
diff --git a/arch/mips/au1000/common/setup.c b/arch/mips/au1000/common/setup.c
index 08c8c855cc9c..eb155c071aa6 100644
--- a/arch/mips/au1000/common/setup.c
+++ b/arch/mips/au1000/common/setup.c
@@ -33,6 +33,7 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
+#include <linux/pm.h>
 
 #include <asm/cpu.h>
 #include <asm/bootinfo.h>
@@ -125,7 +126,7 @@ void __init plat_setup(void)
 #endif
         _machine_restart = au1000_restart;
         _machine_halt = au1000_halt;
-        _machine_power_off = au1000_power_off;
+        pm_power_off = au1000_power_off;
         board_time_init = au1xxx_time_init;
         board_timer_setup = au1xxx_timer_setup;
 
diff --git a/arch/mips/cobalt/int-handler.S b/arch/mips/cobalt/int-handler.S
index f92608e8d84f..e75d5e3ca868 100644
--- a/arch/mips/cobalt/int-handler.S
+++ b/arch/mips/cobalt/int-handler.S
@@ -8,7 +8,7 @@
  */
 #include <asm/asm.h>
 #include <asm/mipsregs.h>
-#include <asm/cobalt/cobalt.h>
+#include <asm/mach-cobalt/cobalt.h>
 #include <asm/regdef.h>
 #include <asm/stackframe.h>
 
diff --git a/arch/mips/cobalt/irq.c b/arch/mips/cobalt/irq.c
index 0d90851f925e..f9a108820d6e 100644
--- a/arch/mips/cobalt/irq.c
+++ b/arch/mips/cobalt/irq.c
@@ -18,7 +18,7 @@
 #include <asm/gt64120.h>
 #include <asm/ptrace.h>
 
-#include <asm/cobalt/cobalt.h>
+#include <asm/mach-cobalt/cobalt.h>
 
 extern void cobalt_handle_int(void);
 
diff --git a/arch/mips/cobalt/reset.c b/arch/mips/cobalt/reset.c
index 805a0e88507b..753dfccae6fa 100644
--- a/arch/mips/cobalt/reset.c
+++ b/arch/mips/cobalt/reset.c
@@ -16,7 +16,7 @@
 #include <asm/reboot.h>
 #include <asm/system.h>
 #include <asm/mipsregs.h>
-#include <asm/cobalt/cobalt.h>
+#include <asm/mach-cobalt/cobalt.h>
 
 void cobalt_machine_halt(void)
 {
diff --git a/arch/mips/cobalt/setup.c b/arch/mips/cobalt/setup.c
index d358a118fa31..b9713a723053 100644
--- a/arch/mips/cobalt/setup.c
+++ b/arch/mips/cobalt/setup.c
@@ -5,7 +5,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1996, 1997, 2004 by Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 1996, 1997, 2004, 05 by Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2001, 2002, 2003 by Liam Davies (ldavies@agile.tv)
  *
  */
@@ -13,6 +13,7 @@
 #include <linux/interrupt.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/pm.h>
 #include <linux/serial.h>
 #include <linux/serial_core.h>
 
@@ -25,7 +26,7 @@
 #include <asm/gt64120.h>
 #include <asm/serial.h>
 
-#include <asm/cobalt/cobalt.h>
+#include <asm/mach-cobalt/cobalt.h>
 
 extern void cobalt_machine_restart(char *command);
 extern void cobalt_machine_halt(void);
@@ -99,7 +100,7 @@ void __init plat_setup(void)
 
         _machine_restart = cobalt_machine_restart;
         _machine_halt = cobalt_machine_halt;
-        _machine_power_off = cobalt_machine_power_off;
+        pm_power_off = cobalt_machine_power_off;
 
         board_timer_setup = cobalt_timer_setup;
 
@@ -139,7 +140,7 @@ void __init plat_setup(void)
                 uart.type       = PORT_UNKNOWN;
                 uart.uartclk    = 18432000;
                 uart.irq        = COBALT_SERIAL_IRQ;
-                uart.flags      = STD_COM_FLAGS;
+                uart.flags      = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
                 uart.iobase     = 0xc800000;
                 uart.iotype     = UPIO_PORT;
 
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index e17d3adff021..58c22cd344d3 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc2
-# Thu Nov 24 01:06:21 2005
+# Linux kernel version: 2.6.16-rc4
+# Tue Feb 21 13:44:31 2006
 #
 CONFIG_MIPS=y
 
@@ -144,7 +144,6 @@ CONFIG_PREEMPT_BKL=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -250,6 +249,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -289,6 +289,7 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -448,7 +449,7 @@ CONFIG_SCSI_SAS_ATTRS=m
 #
 # SCSI low-level drivers
 #
-CONFIG_ISCSI_TCP=m
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -774,6 +775,10 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
diff --git a/arch/mips/configs/ip32_defconfig b/arch/mips/configs/ip32_defconfig
index 967e7acd8e1f..a34db6e82b27 100644
--- a/arch/mips/configs/ip32_defconfig
+++ b/arch/mips/configs/ip32_defconfig
@@ -102,6 +102,7 @@ CONFIG_CPU_R5000=y
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
 CONFIG_SYS_HAS_CPU_R5000=y
+CONFIG_SYS_HAS_CPU_NEVADA=y
 CONFIG_SYS_HAS_CPU_RM7000=y
 CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
diff --git a/arch/mips/configs/qemu_defconfig b/arch/mips/configs/qemu_defconfig
index dee44606164c..c02becab850b 100644
--- a/arch/mips/configs/qemu_defconfig
+++ b/arch/mips/configs/qemu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc2
-# Thu Nov 24 01:07:00 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb  3 17:14:27 2006
 #
 CONFIG_MIPS=y
 
@@ -147,26 +147,27 @@ CONFIG_LOCALVERSION_AUTO=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_SYSCTL is not set
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_EMBEDDED=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+# CONFIG_HOTPLUG is not set
 CONFIG_PRINTK=y
 # CONFIG_BUG is not set
+CONFIG_ELF_CORE=y
 # CONFIG_BASE_FULL is not set
 # CONFIG_FUTEX is not set
 # CONFIG_EPOLL is not set
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 # CONFIG_SHMEM is not set
 CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 CONFIG_TINY_SHMEM=y
 CONFIG_BASE_SMALL=1
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -266,11 +267,7 @@ CONFIG_TCP_CONG_BIC=y
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
-CONFIG_IEEE80211=y
-# CONFIG_IEEE80211_DEBUG is not set
-CONFIG_IEEE80211_CRYPT_WEP=y
-CONFIG_IEEE80211_CRYPT_CCMP=y
-CONFIG_IEEE80211_CRYPT_TKIP=y
+# CONFIG_IEEE80211 is not set
 
 #
 # Device Drivers
@@ -323,7 +320,7 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 #
 # SCSI device support
 #
-CONFIG_RAID_ATTRS=y
+# CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
 
 #
@@ -366,24 +363,16 @@ CONFIG_NETDEVICES=y
 #
 # PHY device support
 #
-CONFIG_PHYLIB=y
-
-#
-# MII PHY device drivers
-#
-CONFIG_MARVELL_PHY=y
-CONFIG_DAVICOM_PHY=y
-CONFIG_QSEMI_PHY=y
-CONFIG_LXT_PHY=y
-CONFIG_CICADA_PHY=y
+# CONFIG_PHYLIB is not set
 
 #
 # Ethernet (10 or 100Mbit)
 #
 CONFIG_NET_ETHERNET=y
-CONFIG_MII=y
+# CONFIG_MII is not set
 # CONFIG_NET_VENDOR_3COM is not set
 # CONFIG_NET_VENDOR_SMC is not set
+# CONFIG_DM9000 is not set
 # CONFIG_NET_VENDOR_RACAL is not set
 # CONFIG_DEPCA is not set
 # CONFIG_HP100 is not set
@@ -479,6 +468,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -518,6 +508,12 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -592,11 +588,14 @@ CONFIG_DUMMY_CONSOLE=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 # CONFIG_EXT2_FS is not set
 # CONFIG_EXT3_FS is not set
-# CONFIG_JBD is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
@@ -677,6 +676,7 @@ CONFIG_MSDOS_PARTITION=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
+# CONFIG_MAGIC_SYSRQ is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_CROSSCOMPILE=y
@@ -690,31 +690,7 @@ CONFIG_CMDLINE="console=ttyS0 debug ip=172.20.0.2:172.20.0.1::255.255.0.0"
 #
 # Cryptographic options
 #
-CONFIG_CRYPTO=y
-CONFIG_CRYPTO_HMAC=y
-CONFIG_CRYPTO_NULL=y
-CONFIG_CRYPTO_MD4=y
-CONFIG_CRYPTO_MD5=y
-CONFIG_CRYPTO_SHA1=y
-CONFIG_CRYPTO_SHA256=y
-CONFIG_CRYPTO_SHA512=y
-CONFIG_CRYPTO_WP512=y
-CONFIG_CRYPTO_TGR192=y
-CONFIG_CRYPTO_DES=y
-CONFIG_CRYPTO_BLOWFISH=y
-CONFIG_CRYPTO_TWOFISH=y
-CONFIG_CRYPTO_SERPENT=y
-CONFIG_CRYPTO_AES=y
-CONFIG_CRYPTO_CAST5=y
-CONFIG_CRYPTO_CAST6=y
-CONFIG_CRYPTO_TEA=y
-CONFIG_CRYPTO_ARC4=y
-CONFIG_CRYPTO_KHAZAD=y
-CONFIG_CRYPTO_ANUBIS=y
-CONFIG_CRYPTO_DEFLATE=y
-CONFIG_CRYPTO_MICHAEL_MIC=y
-CONFIG_CRYPTO_CRC32C=y
-# CONFIG_CRYPTO_TEST is not set
+# CONFIG_CRYPTO is not set
 
 #
 # Hardware crypto devices
@@ -724,8 +700,6 @@ CONFIG_CRYPTO_CRC32C=y
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
-CONFIG_CRC16=y
+# CONFIG_CRC16 is not set
 CONFIG_CRC32=y
-CONFIG_LIBCRC32C=y
-CONFIG_ZLIB_INFLATE=y
-CONFIG_ZLIB_DEFLATE=y
+# CONFIG_LIBCRC32C is not set
diff --git a/arch/mips/ddb5xxx/ddb5074/setup.c b/arch/mips/ddb5xxx/ddb5074/setup.c
index 11535be265b9..91456b068c2e 100644
--- a/arch/mips/ddb5xxx/ddb5074/setup.c
+++ b/arch/mips/ddb5xxx/ddb5074/setup.c
@@ -14,6 +14,7 @@
 #include <linux/ide.h>
 #include <linux/ioport.h>
 #include <linux/irq.h>
+#include <linux/pm.h>
 
 #include <asm/addrspace.h>
 #include <asm/bcache.h>
@@ -95,7 +96,7 @@ void __init plat_setup(void)
 
         _machine_restart = ddb_machine_restart;
         _machine_halt = ddb_machine_halt;
-        _machine_power_off = ddb_machine_power_off;
+        pm_power_off = ddb_machine_power_off;
 
         ddb_out32(DDB_BAR0, 0);
 
diff --git a/arch/mips/ddb5xxx/ddb5476/setup.c b/arch/mips/ddb5xxx/ddb5476/setup.c
index f4e480a74edf..c902adef5942 100644
--- a/arch/mips/ddb5xxx/ddb5476/setup.c
+++ b/arch/mips/ddb5xxx/ddb5476/setup.c
@@ -11,6 +11,7 @@
 #include <linux/types.h>
 #include <linux/sched.h>
 #include <linux/pci.h>
+#include <linux/pm.h>
 
 #include <asm/addrspace.h>
 #include <asm/bcache.h>
@@ -133,7 +134,7 @@ void __init plat_setup(void)
 
         _machine_restart = ddb_machine_restart;
         _machine_halt = ddb_machine_halt;
-        _machine_power_off = ddb_machine_power_off;
+        pm_power_off = ddb_machine_power_off;
 
         /* request io port/mem resources  */
         if (request_resource(&ioport_resource, &ddb5476_ioport.dma1) ||
diff --git a/arch/mips/ddb5xxx/ddb5477/setup.c b/arch/mips/ddb5xxx/ddb5477/setup.c
index 81163353c4a8..2f566034cc44 100644
--- a/arch/mips/ddb5xxx/ddb5477/setup.c
+++ b/arch/mips/ddb5xxx/ddb5477/setup.c
@@ -26,6 +26,7 @@
 #include <linux/major.h>
 #include <linux/kdev_t.h>
 #include <linux/root_dev.h>
+#include <linux/pm.h>
 
 #include <asm/cpu.h>
 #include <asm/bootinfo.h>
@@ -182,7 +183,7 @@ void __init plat_setup(void)
 
         _machine_restart = ddb_machine_restart;
         _machine_halt = ddb_machine_halt;
-        _machine_power_off = ddb_machine_power_off;
+        pm_power_off = ddb_machine_power_off;
 
         /* setup resource limits */
         ioport_resource.end = DDB_PCI0_IO_SIZE + DDB_PCI1_IO_SIZE - 1;
diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c
index 9ef54fe1feaa..7c1ca8f6330e 100644
--- a/arch/mips/dec/setup.c
+++ b/arch/mips/dec/setup.c
@@ -17,6 +17,7 @@
 #include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
+#include <linux/pm.h>
 
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
@@ -158,7 +159,7 @@ void __init plat_setup(void)
 
         _machine_restart = dec_machine_restart;
         _machine_halt = dec_machine_halt;
-        _machine_power_off = dec_machine_power_off;
+        pm_power_off = dec_machine_power_off;
 
         ioport_resource.start = ~0UL;
         ioport_resource.end = 0UL;
diff --git a/arch/mips/gt64120/ev64120/setup.c b/arch/mips/gt64120/ev64120/setup.c
index 98b5a96cc039..6d859d1e7a2d 100644
--- a/arch/mips/gt64120/ev64120/setup.c
+++ b/arch/mips/gt64120/ev64120/setup.c
@@ -34,6 +34,8 @@
 #include <linux/interrupt.h>
 #include <linux/pci.h>
 #include <linux/timex.h>
+#include <linux/pm.h>
+
 #include <asm/bootinfo.h>
 #include <asm/page.h>
 #include <asm/io.h>
@@ -73,7 +75,7 @@ void __init plat_setup(void)
 {
         _machine_restart = galileo_machine_restart;
         _machine_halt = galileo_machine_halt;
-        _machine_power_off = galileo_machine_power_off;
+        pm_power_off = galileo_machine_power_off;
 
         board_time_init = gt64120_time_init;
         set_io_port_base(KSEG1);
diff --git a/arch/mips/gt64120/momenco_ocelot/setup.c b/arch/mips/gt64120/momenco_ocelot/setup.c
index 0d07c33112d0..20b65d3d2151 100644
--- a/arch/mips/gt64120/momenco_ocelot/setup.c
+++ b/arch/mips/gt64120/momenco_ocelot/setup.c
@@ -4,7 +4,7 @@
  * BRIEF MODULE DESCRIPTION
  * Momentum Computer Ocelot (CP7000) - board dependent boot routines
  *
- * Copyright (C) 1996, 1997, 2001  Ralf Baechle
+ * Copyright (C) 1996, 1997, 2001, 06  Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2000 RidgeRun, Inc.
  * Copyright (C) 2001 Red Hat, Inc.
  * Copyright (C) 2002 Momentum Computer
@@ -47,6 +47,8 @@
 #include <linux/pci.h>
 #include <linux/timex.h>
 #include <linux/vmalloc.h>
+#include <linux/pm.h>
+
 #include <asm/time.h>
 #include <asm/bootinfo.h>
 #include <asm/page.h>
@@ -159,7 +161,7 @@ void __init plat_setup(void)
 
         _machine_restart = momenco_ocelot_restart;
         _machine_halt = momenco_ocelot_halt;
-        _machine_power_off = momenco_ocelot_power_off;
+        pm_power_off = momenco_ocelot_power_off;
 
         /*
          * initrd_start = (ulong)ocelot_initrd_start;
diff --git a/arch/mips/ite-boards/generic/it8172_setup.c b/arch/mips/ite-boards/generic/it8172_setup.c
index 062429dd7ca0..fc73c8d69df7 100644
--- a/arch/mips/ite-boards/generic/it8172_setup.c
+++ b/arch/mips/ite-boards/generic/it8172_setup.c
@@ -34,6 +34,7 @@
 #include <linux/major.h>
 #include <linux/kdev_t.h>
 #include <linux/root_dev.h>
+#include <linux/pm.h>
 
 #include <asm/cpu.h>
 #include <asm/time.h>
@@ -125,7 +126,7 @@ void __init plat_setup(void)
 
         _machine_restart = it8172_restart;
         _machine_halt = it8172_halt;
-        _machine_power_off = it8172_power_off;
+        pm_power_off = it8172_power_off;
 
         /*
          * IO/MEM resources.
diff --git a/arch/mips/jazz/setup.c b/arch/mips/jazz/setup.c
index 044df9d4ab7c..4036dc434551 100644
--- a/arch/mips/jazz/setup.c
+++ b/arch/mips/jazz/setup.c
@@ -19,6 +19,8 @@
 #include <linux/console.h>
 #include <linux/fb.h>
 #include <linux/ide.h>
+#include <linux/pm.h>
+
 #include <asm/bootinfo.h>
 #include <asm/irq.h>
 #include <asm/jazz.h>
@@ -79,7 +81,7 @@ void __init plat_setup(void)
 
         _machine_restart = jazz_machine_restart;
         _machine_halt = jazz_machine_halt;
-        _machine_power_off = jazz_machine_power_off;
+        pm_power_off = jazz_machine_power_off;
 
 #warning "Somebody should check if screen_info is ok for Jazz."
 
diff --git a/arch/mips/jmr3927/rbhma3100/setup.c b/arch/mips/jmr3927/rbhma3100/setup.c
index 4763957df8fc..9359cc413494 100644
--- a/arch/mips/jmr3927/rbhma3100/setup.c
+++ b/arch/mips/jmr3927/rbhma3100/setup.c
@@ -44,6 +44,7 @@
 #include <linux/ioport.h>
 #include <linux/param.h>        /* for HZ */
 #include <linux/delay.h>
+#include <linux/pm.h>
 #ifdef CONFIG_SERIAL_TXX9
 #include <linux/tty.h>
 #include <linux/serial.h>
@@ -211,7 +212,7 @@ void __init plat_setup(void)
 
         _machine_restart = jmr3927_machine_restart;
         _machine_halt = jmr3927_machine_halt;
-        _machine_power_off = jmr3927_machine_power_off;
+        pm_power_off = jmr3927_machine_power_off;
 
         /*
          * IO/MEM resources.
diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
index d8e2674a1543..4a9f1ecefaf2 100644
--- a/arch/mips/kernel/binfmt_elfn32.c
+++ b/arch/mips/kernel/binfmt_elfn32.c
@@ -103,8 +103,9 @@ jiffies_to_compat_timeval(unsigned long jiffies, struct compat_timeval *value)
          * one divide.
          */
         u64 nsec = (u64)jiffies * TICK_NSEC;
-        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &value->tv_usec);
-        value->tv_usec /= NSEC_PER_USEC;
+        long rem;
+        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &rem);
+        value->tv_usec = rem / NSEC_PER_USEC;
 }
 
 #define ELF_CORE_EFLAGS EF_MIPS_ABI2
diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
index cec5f327e360..e31813779895 100644
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -105,8 +105,9 @@ jiffies_to_compat_timeval(unsigned long jiffies, struct compat_timeval *value)
          * one divide.
          */
         u64 nsec = (u64)jiffies * TICK_NSEC;
-        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &value->tv_usec);
-        value->tv_usec /= NSEC_PER_USEC;
+        long rem;
+        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &rem);
+        value->tv_usec = rem / NSEC_PER_USEC;
 }
 
 #undef ELF_CORE_COPY_REGS
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index fac48ad27b34..292f8b243a5e 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -2,8 +2,8 @@
  * Processor capabilities determination functions.
  *
  * Copyright (C) xxxx  the Anonymous
+ * Copyright (C) 1994 - 2006 Ralf Baechle
  * Copyright (C) 2003, 2004  Maciej W. Rozycki
- * Copyright (C) 1994 - 2003 Ralf Baechle
  * Copyright (C) 2001, 2004  MIPS Inc.
  *
  * This program is free software; you can redistribute it and/or
@@ -641,10 +641,9 @@ static inline void cpu_probe_sibyte(struct cpuinfo_mips *c)
         switch (c->processor_id & 0xff00) {
         case PRID_IMP_SB1:
                 c->cputype = CPU_SB1;
-#ifdef CONFIG_SB1_PASS_1_WORKAROUNDS
                 /* FPU in pass1 is known to have issues. */
-                c->options &= ~(MIPS_CPU_FPU | MIPS_CPU_32FPR);
-#endif
+                if ((c->processor_id & 0xff) < 0x20)
+                        c->options &= ~(MIPS_CPU_FPU | MIPS_CPU_32FPR);
                 break;
         case PRID_IMP_SB1A:
                 c->cputype = CPU_SB1A;
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index aa18a8b7b380..13f22d1d0e8b 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -233,11 +233,11 @@ NESTED(except_vec_nmi, 0, sp)
 NESTED(nmi_handler, PT_SIZE, sp)
         .set    push
         .set    noat
-        .set    mips3
         SAVE_ALL
         move    a0, sp
         jal     nmi_exception_handler
         RESTORE_ALL
+        .set    mips3
         eret
         .set    pop
         END(nmi_handler)
diff --git a/arch/mips/kernel/irq-mv6434x.c b/arch/mips/kernel/irq-mv6434x.c
index 0ac067f45cf5..0613f1f36b1b 100644
--- a/arch/mips/kernel/irq-mv6434x.c
+++ b/arch/mips/kernel/irq-mv6434x.c
@@ -11,12 +11,14 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
-#include <asm/ptrace.h>
-#include <linux/sched.h>
 #include <linux/kernel_stat.h>
+#include <linux/mv643xx.h>
+#include <linux/sched.h>
+
+#include <asm/ptrace.h>
 #include <asm/io.h>
 #include <asm/irq.h>
-#include <linux/mv643xx.h>
+#include <asm/marvell.h>
 
 static unsigned int irq_base;
 
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 60353f5acc48..e00e5f6e7fdd 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -161,60 +161,6 @@ out:
         return error;
 }
 
-struct dirent32 {
-        unsigned int    d_ino;
-        unsigned int    d_off;
-        unsigned short  d_reclen;
-        char            d_name[NAME_MAX + 1];
-};
-
-static void
-xlate_dirent(void *dirent64, void *dirent32, long n)
-{
-        long off;
-        struct dirent *dirp;
-        struct dirent32 *dirp32;
-
-        off = 0;
-        while (off < n) {
-                dirp = (struct dirent *)(dirent64 + off);
-                dirp32 = (struct dirent32 *)(dirent32 + off);
-                off += dirp->d_reclen;
-                dirp32->d_ino = dirp->d_ino;
-                dirp32->d_off = (unsigned int)dirp->d_off;
-                dirp32->d_reclen = dirp->d_reclen;
-                strncpy(dirp32->d_name, dirp->d_name, dirp->d_reclen - ((3 * 4) + 2));
-        }
-        return;
-}
-
-asmlinkage long
-sys32_getdents(unsigned int fd, void * dirent32, unsigned int count)
-{
-        long n;
-        void *dirent64;
-
-        dirent64 = (void *)((unsigned long)(dirent32 + (sizeof(long) - 1)) & ~(sizeof(long) - 1));
-        if ((n = sys_getdents(fd, dirent64, count - (dirent64 - dirent32))) < 0)
-                return(n);
-        xlate_dirent(dirent64, dirent32, n);
-        return(n);
-}
-
-asmlinkage int old_readdir(unsigned int fd, void * dirent, unsigned int count);
-
-asmlinkage int
-sys32_readdir(unsigned int fd, void * dirent32, unsigned int count)
-{
-        int n;
-        struct dirent dirent64;
-
-        if ((n = old_readdir(fd, &dirent64, count)) < 0)
-                return(n);
-        xlate_dirent(&dirent64, dirent32, dirent64.d_reclen);
-        return(n);
-}
-
 asmlinkage int
 sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr, int options)
 {
@@ -230,6 +176,9 @@ sysn32_waitid(int which, compat_pid_t pid,
         long ret;
         mm_segment_t old_fs = get_fs();
 
+        if (!access_ok(VERIFY_WRITE, uinfo, sizeof(*uinfo)))
+                return -EFAULT;
+
         set_fs (KERNEL_DS);
         ret = sys_waitid(which, pid, uinfo, options,
                          uru ? (struct rusage __user *) &ru : NULL);
@@ -1450,25 +1399,6 @@ sys32_timer_create(u32 clock, struct sigevent32 __user *se32, timer_t __user *ti
         return sys_timer_create(clock, p, timer_id);
 }
 
-asmlinkage long
-sysn32_rt_sigtimedwait(const sigset_t __user *uthese,
-                       siginfo_t __user *uinfo,
-                       const struct compat_timespec __user *uts32,
-                       size_t sigsetsize)
-{
-        struct timespec __user *uts = NULL;
-
-        if (uts32) {
-                struct timespec ts;
-                uts = compat_alloc_user_space(sizeof(struct timespec));
-                if (get_user(ts.tv_sec, &uts32->tv_sec) ||
-                    get_user(ts.tv_nsec, &uts32->tv_nsec) ||
-                    copy_to_user (uts, &ts, sizeof (ts)))
-                        return -EFAULT;
-        }
-        return sys_rt_sigtimedwait(uthese, uinfo, uts, sigsetsize);
-}
-
 save_static_function(sys32_clone);
 __attribute_used__ noinline static int
 _sys32_clone(nabi_no_regargs struct pt_regs regs)
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index fa98f10d0132..092679c2dca9 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -4,6 +4,7 @@
  * for more details.
  *
  * Copyright (C) 1994 - 1999, 2000 by Ralf Baechle and others.
+ * Copyright (C) 2005, 2006 by Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  * Copyright (C) 2004 Thiemo Seufer
  */
@@ -24,6 +25,7 @@
 #include <linux/a.out.h>
 #include <linux/init.h>
 #include <linux/completion.h>
+#include <linux/kallsyms.h>
 
 #include <asm/abi.h>
 #include <asm/bootinfo.h>
@@ -58,8 +60,8 @@ ATTRIB_NORET void cpu_idle(void)
         }
 }
 
-extern int do_signal(sigset_t *oldset, struct pt_regs *regs);
-extern int do_signal32(sigset_t *oldset, struct pt_regs *regs);
+extern void do_signal(struct pt_regs *regs);
+extern void do_signal32(struct pt_regs *regs);
 
 /*
  * Native o32 and N64 ABI without DSP ASE
@@ -271,46 +273,19 @@ long kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
 
 static struct mips_frame_info {
         void *func;
-        int omit_fp;    /* compiled without fno-omit-frame-pointer */
-        int frame_offset;
+        unsigned long func_size;
+        int frame_size;
         int pc_offset;
-} schedule_frame, mfinfo[] = {
-        { schedule, 0 },        /* must be first */
-        /* arch/mips/kernel/semaphore.c */
-        { __down, 1 },
-        { __down_interruptible, 1 },
-        /* kernel/sched.c */
-#ifdef CONFIG_PREEMPT
-        { preempt_schedule, 0 },
-#endif
-        { wait_for_completion, 0 },
-        { interruptible_sleep_on, 0 },
-        { interruptible_sleep_on_timeout, 0 },
-        { sleep_on, 0 },
-        { sleep_on_timeout, 0 },
-        { yield, 0 },
-        { io_schedule, 0 },
-        { io_schedule_timeout, 0 },
-#if defined(CONFIG_SMP) && defined(CONFIG_PREEMPT)
-        { __preempt_spin_lock, 0 },
-        { __preempt_write_lock, 0 },
-#endif
-        /* kernel/timer.c */
-        { schedule_timeout, 1 },
-/*      { nanosleep_restart, 1 }, */
-        /* lib/rwsem-spinlock.c */
-        { __down_read, 1 },
-        { __down_write, 1 },
-};
+} *schedule_frame, mfinfo[64];
+static int mfinfo_num;
 
-static int mips_frame_info_initialized;
 static int __init get_frame_info(struct mips_frame_info *info)
 {
         int i;
         void *func = info->func;
         union mips_instruction *ip = (union mips_instruction *)func;
         info->pc_offset = -1;
-        info->frame_offset = info->omit_fp ? 0 : -1;
+        info->frame_size = 0;
         for (i = 0; i < 128; i++, ip++) {
                 /* if jal, jalr, jr, stop. */
                 if (ip->j_format.opcode == jal_op ||
@@ -319,6 +294,23 @@ static int __init get_frame_info(struct mips_frame_info *info)
                       ip->r_format.func == jr_op)))
                         break;
 
+                if (info->func_size && i >= info->func_size / 4)
+                        break;
+                if (
+#ifdef CONFIG_32BIT
+                    ip->i_format.opcode == addiu_op &&
+#endif
+#ifdef CONFIG_64BIT
+                    ip->i_format.opcode == daddiu_op &&
+#endif
+                    ip->i_format.rs == 29 &&
+                    ip->i_format.rt == 29) {
+                        /* addiu/daddiu sp,sp,-imm */
+                        if (info->frame_size)
+                                continue;
+                        info->frame_size = - ip->i_format.simmediate;
+                }
+
                 if (
 #ifdef CONFIG_32BIT
                     ip->i_format.opcode == sw_op &&
@@ -326,31 +318,20 @@ static int __init get_frame_info(struct mips_frame_info *info)
 #ifdef CONFIG_64BIT
                     ip->i_format.opcode == sd_op &&
 #endif
-                    ip->i_format.rs == 29)
-                {
+                    ip->i_format.rs == 29 &&
+                    ip->i_format.rt == 31) {
                         /* sw / sd $ra, offset($sp) */
-                        if (ip->i_format.rt == 31) {
-                                if (info->pc_offset != -1)
-                                        continue;
-                                info->pc_offset =
-                                        ip->i_format.simmediate / sizeof(long);
-                        }
-                        /* sw / sd $s8, offset($sp) */
-                        if (ip->i_format.rt == 30) {
-//#if 0 /* gcc 3.4 does aggressive optimization... */
-                                if (info->frame_offset != -1)
-                                        continue;
-//#endif
-                                info->frame_offset =
-                                        ip->i_format.simmediate / sizeof(long);
-                        }
+                        if (info->pc_offset != -1)
+                                continue;
+                        info->pc_offset =
+                                ip->i_format.simmediate / sizeof(long);
                 }
         }
-        if (info->pc_offset == -1 || info->frame_offset == -1) {
-                printk("Can't analyze prologue code at %p\n", func);
+        if (info->pc_offset == -1 || info->frame_size == 0) {
+                if (func == schedule)
+                        printk("Can't analyze prologue code at %p\n", func);
                 info->pc_offset = -1;
-                info->frame_offset = -1;
-                return -1;
+                info->frame_size = 0;
         }
 
         return 0;
@@ -358,25 +339,36 @@ static int __init get_frame_info(struct mips_frame_info *info)
 
 static int __init frame_info_init(void)
 {
-        int i, found;
-        for (i = 0; i < ARRAY_SIZE(mfinfo); i++)
-                if (get_frame_info(&mfinfo[i]))
-                        return -1;
-        schedule_frame = mfinfo[0];
-        /* bubble sort */
-        do {
-                struct mips_frame_info tmp;
-                found = 0;
-                for (i = 1; i < ARRAY_SIZE(mfinfo); i++) {
-                        if (mfinfo[i-1].func > mfinfo[i].func) {
-                                tmp = mfinfo[i];
-                                mfinfo[i] = mfinfo[i-1];
-                                mfinfo[i-1] = tmp;
-                                found = 1;
-                        }
-                }
-        } while (found);
-        mips_frame_info_initialized = 1;
+        int i;
+#ifdef CONFIG_KALLSYMS
+        char *modname;
+        char namebuf[KSYM_NAME_LEN + 1];
+        unsigned long start, size, ofs;
+        extern char __sched_text_start[], __sched_text_end[];
+        extern char __lock_text_start[], __lock_text_end[];
+
+        start = (unsigned long)__sched_text_start;
+        for (i = 0; i < ARRAY_SIZE(mfinfo); i++) {
+                if (start == (unsigned long)schedule)
+                        schedule_frame = &mfinfo[i];
+                if (!kallsyms_lookup(start, &size, &ofs, &modname, namebuf))
+                        break;
+                mfinfo[i].func = (void *)(start + ofs);
+                mfinfo[i].func_size = size;
+                start += size - ofs;
+                if (start >= (unsigned long)__lock_text_end)
+                        break;
+                if (start == (unsigned long)__sched_text_end)
+                        start = (unsigned long)__lock_text_start;
+        }
+#else
+        mfinfo[0].func = schedule;
+        schedule_frame = &mfinfo[0];
+#endif
+        for (i = 0; i < ARRAY_SIZE(mfinfo) && mfinfo[i].func; i++)
+                get_frame_info(&mfinfo[i]);
+
+        mfinfo_num = i;
         return 0;
 }
 
@@ -393,47 +385,52 @@ unsigned long thread_saved_pc(struct task_struct *tsk)
         if (t->reg31 == (unsigned long) ret_from_fork)
                 return t->reg31;
 
-        if (schedule_frame.pc_offset < 0)
+        if (!schedule_frame || schedule_frame->pc_offset < 0)
                 return 0;
-        return ((unsigned long *)t->reg29)[schedule_frame.pc_offset];
+        return ((unsigned long *)t->reg29)[schedule_frame->pc_offset];
 }
 
 /* get_wchan - a maintenance nightmare^W^Wpain in the ass ...  */
 unsigned long get_wchan(struct task_struct *p)
 {
         unsigned long stack_page;
-        unsigned long frame, pc;
+        unsigned long pc;
+#ifdef CONFIG_KALLSYMS
+        unsigned long frame;
+#endif
 
         if (!p || p == current || p->state == TASK_RUNNING)
                 return 0;
 
         stack_page = (unsigned long)task_stack_page(p);
-        if (!stack_page || !mips_frame_info_initialized)
+        if (!stack_page || !mfinfo_num)
                 return 0;
 
         pc = thread_saved_pc(p);
+#ifdef CONFIG_KALLSYMS
         if (!in_sched_functions(pc))
                 return pc;
 
-        frame = ((unsigned long *)p->thread.reg30)[schedule_frame.frame_offset];
+        frame = p->thread.reg29 + schedule_frame->frame_size;
         do {
                 int i;
 
                 if (frame < stack_page || frame > stack_page + THREAD_SIZE - 32)
                         return 0;
 
-                for (i = ARRAY_SIZE(mfinfo) - 1; i >= 0; i--) {
+                for (i = mfinfo_num - 1; i >= 0; i--) {
                         if (pc >= (unsigned long) mfinfo[i].func)
                                 break;
                 }
                 if (i < 0)
                         break;
 
-                if (mfinfo[i].omit_fp)
-                        break;
                 pc = ((unsigned long *)frame)[mfinfo[i].pc_offset];
-                frame = ((unsigned long *)frame)[mfinfo[i].frame_offset];
+                if (!mfinfo[i].frame_size)
+                        break;
+                frame += mfinfo[i].frame_size;
         } while (in_sched_functions(pc));
+#endif
 
         return pc;
 }
diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
index 0c82b25d8c6d..0d5cf97af727 100644
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -88,7 +88,7 @@ asmlinkage int sys32_ptrace(int request, int pid, int addr, int data)
                 ret = -EIO;
                 if (copied != sizeof(tmp))
                         break;
-                ret = put_user(tmp, (unsigned int *) (unsigned long) data);
+                ret = put_user(tmp, (unsigned int __user *) (unsigned long) data);
                 break;
         }
 
@@ -174,8 +174,10 @@ asmlinkage int sys32_ptrace(int request, int pid, int addr, int data)
                 case FPC_EIR: { /* implementation / version register */
                         unsigned int flags;
 
-                        if (!cpu_has_fpu)
+                        if (!cpu_has_fpu) {
+                                tmp = 0;
                                 break;
+                        }
 
                         preempt_disable();
                         if (cpu_has_mipsmt) {
@@ -194,15 +196,18 @@ asmlinkage int sys32_ptrace(int request, int pid, int addr, int data)
                         preempt_enable();
                         break;
                 }
-                case DSP_BASE ... DSP_BASE + 5:
+                case DSP_BASE ... DSP_BASE + 5: {
+                        dspreg_t *dregs;
+
                         if (!cpu_has_dsp) {
                                 tmp = 0;
                                 ret = -EIO;
                                 goto out_tsk;
                         }
-                        dspreg_t *dregs = __get_dsp_regs(child);
+                        dregs = __get_dsp_regs(child);
                         tmp = (unsigned long) (dregs[addr - DSP_BASE]);
                         break;
+                }
                 case DSP_CONTROL:
                         if (!cpu_has_dsp) {
                                 tmp = 0;
@@ -216,7 +221,7 @@ asmlinkage int sys32_ptrace(int request, int pid, int addr, int data)
                         ret = -EIO;
                         goto out_tsk;
                 }
-                ret = put_user(tmp, (unsigned *) (unsigned long) data);
+                ret = put_user(tmp, (unsigned __user *) (unsigned long) data);
                 break;
         }
 
@@ -304,15 +309,18 @@ asmlinkage int sys32_ptrace(int request, int pid, int addr, int data)
                         else
                                 child->thread.fpu.soft.fcr31 = data;
                         break;
-                case DSP_BASE ... DSP_BASE + 5:
+                case DSP_BASE ... DSP_BASE + 5: {
+                        dspreg_t *dregs;
+
                         if (!cpu_has_dsp) {
                                 ret = -EIO;
                                 break;
                         }
 
-                        dspreg_t *dregs = __get_dsp_regs(child);
+                        dregs = __get_dsp_regs(child);
                         dregs[addr - DSP_BASE] = data;
                         break;
+                }
                 case DSP_CONTROL:
                         if (!cpu_has_dsp) {
                                 ret = -EIO;
diff --git a/arch/mips/kernel/reset.c b/arch/mips/kernel/reset.c
index 5e37df3111ad..621037db2290 100644
--- a/arch/mips/kernel/reset.c
+++ b/arch/mips/kernel/reset.c
@@ -3,17 +3,16 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2001 by Ralf Baechle
+ * Copyright (C) 2001, 06 by Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2001 MIPS Technologies, Inc.
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/pm.h>
 #include <linux/types.h>
 #include <linux/reboot.h>
-#include <asm/reboot.h>
 
-void (*pm_power_off)(void);
-EXPORT_SYMBOL(pm_power_off);
+#include <asm/reboot.h>
 
 /*
  * Urgs ...  Too many MIPS machines to handle this in a generic way.
@@ -22,23 +21,22 @@ EXPORT_SYMBOL(pm_power_off);
  */
 void (*_machine_restart)(char *command);
 void (*_machine_halt)(void);
-void (*_machine_power_off)(void);
+void (*pm_power_off)(void);
 
 void machine_restart(char *command)
 {
-        _machine_restart(command);
+        if (_machine_restart)
+                _machine_restart(command);
 }
 
 void machine_halt(void)
 {
-        _machine_halt();
+        if (_machine_halt)
+                _machine_halt();
 }
 
 void machine_power_off(void)
 {
         if (pm_power_off)
                 pm_power_off();
-
-        _machine_power_off();
 }
-
diff --git a/arch/mips/kernel/rtlx.c b/arch/mips/kernel/rtlx.c
index 1d855112bac2..986a9cf23067 100644
--- a/arch/mips/kernel/rtlx.c
+++ b/arch/mips/kernel/rtlx.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2005 MIPS Technologies, Inc.  All rights reserved.
+ * Copyright (C) 2005, 06 Ralf Baechle (ralf@linux-mips.org)
  *
  *  This program is free software; you can distribute it and/or modify it
  *  under the terms of the GNU General Public License (Version 2) as
@@ -20,9 +21,12 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/poll.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
+
 #include <asm/mipsmtregs.h>
 #include <asm/bitops.h>
 #include <asm/cpu.h>
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index a42e0e8caa7b..2f2dc54b2e26 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -617,6 +617,23 @@ einval:	li	v0, -EINVAL
         sys     sys_inotify_init        0
         sys     sys_inotify_add_watch   3       /* 4285 */
         sys     sys_inotify_rm_watch    2
+        sys     sys_migrate_pages       4
+        sys     sys_openat              4
+        sys     sys_mkdirat             3
+        sys     sys_mknodat             4       /* 4290 */
+        sys     sys_fchownat            5
+        sys     sys_futimesat           3
+        sys     sys_fstatat64           4
+        sys     sys_unlinkat            3
+        sys     sys_renameat            4       /* 4295 */
+        sys     sys_linkat              5
+        sys     sys_symlinkat           3
+        sys     sys_readlinkat          4
+        sys     sys_fchmodat            3
+        sys     sys_faccessat           3       /* 4300 */
+        sys     sys_pselect6            6
+        sys     sys_ppoll               5
+        sys     sys_unshare             1
         .endm
 
         /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 47bfbd416709..98bf25df56f3 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -443,3 +443,20 @@ sys_call_table:
         PTR     sys_inotify_init
         PTR     sys_inotify_add_watch
         PTR     sys_inotify_rm_watch            /* 5245 */
+        PTR     sys_migrate_pages
+        PTR     sys_openat
+        PTR     sys_mkdirat
+        PTR     sys_mknodat
+        PTR     sys_fchownat                    /* 5250 */
+        PTR     sys_futimesat
+        PTR     sys_newfstatat
+        PTR     sys_unlinkat
+        PTR     sys_renameat
+        PTR     sys_linkat                      /* 5255 */
+        PTR     sys_symlinkat
+        PTR     sys_readlinkat
+        PTR     sys_fchmodat
+        PTR     sys_faccessat
+        PTR     sys_pselect6                    /* 5260 */
+        PTR     sys_ppoll
+        PTR     sys_unshare
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index b465ced1758f..02c8267e45e7 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -195,7 +195,7 @@ EXPORT(sysn32_call_table)
         PTR     sys_fdatasync
         PTR     sys_truncate
         PTR     sys_ftruncate                   /* 6075 */
-        PTR     sys32_getdents
+        PTR     compat_sys_getdents
         PTR     sys_getcwd
         PTR     sys_chdir
         PTR     sys_fchdir
@@ -245,9 +245,9 @@ EXPORT(sysn32_call_table)
         PTR     sys_capget
         PTR     sys_capset
         PTR     sys32_rt_sigpending             /* 6125 */
-        PTR     sysn32_rt_sigtimedwait
+        PTR     compat_sys_rt_sigtimedwait
         PTR     sys_rt_sigqueueinfo
-        PTR     sys32_rt_sigsuspend
+        PTR     sysn32_rt_sigsuspend
         PTR     sys32_sigaltstack
         PTR     compat_sys_utime                /* 6130 */
         PTR     sys_mknod
@@ -369,3 +369,20 @@ EXPORT(sysn32_call_table)
         PTR     sys_inotify_init
         PTR     sys_inotify_add_watch
         PTR     sys_inotify_rm_watch
+        PTR     sys_migrate_pages               /* 6250 */
+        PTR     sys_openat
+        PTR     sys_mkdirat
+        PTR     sys_mknodat
+        PTR     sys_fchownat
+        PTR     sys_futimesat                   /* 6255 */
+        PTR     sys_newfstatat
+        PTR     sys_unlinkat
+        PTR     sys_renameat
+        PTR     sys_linkat
+        PTR     sys_symlinkat                   /* 6260 */
+        PTR     sys_readlinkat
+        PTR     sys_fchmodat
+        PTR     sys_faccessat
+        PTR     sys_pselect6
+        PTR     sys_ppoll                       /* 6265 */
+        PTR     sys_unshare
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 3d338ca7eeeb..797e0d874889 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -293,7 +293,7 @@ sys_call_table:
         PTR     sys_uselib
         PTR     sys_swapon
         PTR     sys_reboot
-        PTR     sys32_readdir
+        PTR     compat_sys_old_readdir
         PTR     old_mmap                        /* 4090 */
         PTR     sys_munmap
         PTR     sys_truncate
@@ -345,7 +345,7 @@ sys_call_table:
         PTR     sys_setfsuid
         PTR     sys_setfsgid
         PTR     sys32_llseek                    /* 4140 */
-        PTR     sys32_getdents
+        PTR     compat_sys_getdents
         PTR     compat_sys_select
         PTR     sys_flock
         PTR     sys_msync
@@ -491,4 +491,21 @@ sys_call_table:
         PTR     sys_inotify_init
         PTR     sys_inotify_add_watch           /* 4285 */
         PTR     sys_inotify_rm_watch
+        PTR     sys_migrate_pages
+        PTR     compat_sys_openat
+        PTR     sys_mkdirat
+        PTR     sys_mknodat                     /* 4290 */
+        PTR     sys_fchownat
+        PTR     compat_sys_futimesat
+        PTR     compat_sys_newfstatat
+        PTR     sys_unlinkat
+        PTR     sys_renameat                    /* 4295 */
+        PTR     sys_linkat
+        PTR     sys_symlinkat
+        PTR     sys_readlinkat
+        PTR     sys_fchmodat
+        PTR     sys_faccessat                   /* 4300 */
+        PTR     sys_pselect6
+        PTR     sys_ppoll
+        PTR     sys_unshare
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index d86affa21278..d9293c558e41 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -540,6 +540,9 @@ void __init setup_arch(char **cmdline_p)
         sparse_init();
         paging_init();
         resource_init();
+#ifdef CONFIG_SMP
+        plat_smp_setup();
+#endif
 }
 
 int __init fpu_disable(char *s)
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index 0f66ae5838b9..36bfc2588aa3 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -11,7 +11,7 @@
 #include <linux/config.h>
 
 static inline int
-setup_sigcontext(struct pt_regs *regs, struct sigcontext *sc)
+setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         int err = 0;
 
@@ -82,7 +82,7 @@ out:
 }
 
 static inline int
-restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc)
+restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
 {
         unsigned int used_math;
         unsigned long treg;
@@ -157,7 +157,7 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext *sc)
 /*
  * Determine which stack to use..
  */
-static inline void *
+static inline void __user *
 get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size)
 {
         unsigned long sp;
@@ -176,7 +176,7 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size)
         if ((ka->sa.sa_flags & SA_ONSTACK) && (sas_ss_flags (sp) == 0))
                 sp = current->sas_ss_sp + current->sas_ss_size;
 
-        return (void *)((sp - frame_size) & (ICACHE_REFILLS_WORKAROUND_WAR ? 32 : ALMASK));
+        return (void __user *)((sp - frame_size) & (ICACHE_REFILLS_WORKAROUND_WAR ? ~(cpu_icache_line_size()-1) : ALMASK));
 }
 
 static inline int install_sigtramp(unsigned int __user *tramp,
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 7d1800fe7038..c974cc9b30eb 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -39,8 +39,6 @@
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
-int do_signal(sigset_t *oldset, struct pt_regs *regs);
-
 /*
  * Atomically swap in the new signal mask, and wait for a signal.
  */
@@ -50,7 +48,7 @@ save_static_function(sys_sigsuspend);
 __attribute_used__ noinline static int
 _sys_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
-        sigset_t saveset, newset;
+        sigset_t newset;
         sigset_t __user *uset;
 
         uset = (sigset_t __user *) regs.regs[4];
@@ -59,19 +57,15 @@ _sys_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 #endif
 
@@ -79,7 +73,7 @@ save_static_function(sys_rt_sigsuspend);
 __attribute_used__ noinline static int
 _sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
-        sigset_t saveset, newset;
+        sigset_t newset;
         sigset_t __user *unewset;
         size_t sigsetsize;
 
@@ -94,19 +88,15 @@ _sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 
 #ifdef CONFIG_TRAD_SIGNALS
@@ -199,10 +189,10 @@ save_static_function(sys_sigreturn);
 __attribute_used__ noinline static void
 _sys_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
-        struct sigframe *frame;
+        struct sigframe __user *frame;
         sigset_t blocked;
 
-        frame = (struct sigframe *) regs.regs[29];
+        frame = (struct sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
                 goto badframe;
         if (__copy_from_user(&blocked, &frame->sf_mask, sizeof(blocked)))
@@ -236,11 +226,11 @@ save_static_function(sys_rt_sigreturn);
 __attribute_used__ noinline static void
 _sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
-        struct rt_sigframe *frame;
+        struct rt_sigframe __user *frame;
         sigset_t set;
         stack_t st;
 
-        frame = (struct rt_sigframe *) regs.regs[29];
+        frame = (struct rt_sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
                 goto badframe;
         if (__copy_from_user(&set, &frame->rs_uc.uc_sigmask, sizeof(set)))
@@ -259,7 +249,7 @@ _sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
         /* It is more difficult to avoid calling this function than to
            call it and ignore errors.  */
-        do_sigaltstack(&st, NULL, regs.regs[29]);
+        do_sigaltstack((stack_t __user *)&st, NULL, regs.regs[29]);
 
         /*
          * Don't let your children do this ...
@@ -279,7 +269,7 @@ badframe:
 int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
         int signr, sigset_t *set)
 {
-        struct sigframe *frame;
+        struct sigframe __user *frame;
         int err = 0;
 
         frame = get_sigframe(ka, regs, sizeof(*frame));
@@ -315,18 +305,18 @@ int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, frame->regs[31]);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 #endif
 
 int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
         int signr, sigset_t *set, siginfo_t *info)
 {
-        struct rt_sigframe *frame;
+        struct rt_sigframe __user *frame;
         int err = 0;
 
         frame = get_sigframe(ka, regs, sizeof(*frame));
@@ -340,7 +330,7 @@ int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
 
         /* Create the ucontext.  */
         err |= __put_user(0, &frame->rs_uc.uc_flags);
-        err |= __put_user(0, &frame->rs_uc.uc_link);
+        err |= __put_user(NULL, &frame->rs_uc.uc_link);
         err |= __put_user((void *)current->sas_ss_sp,
                           &frame->rs_uc.uc_stack.ss_sp);
         err |= __put_user(sas_ss_flags(regs->regs[29]),
@@ -375,11 +365,11 @@ int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, regs->regs[31]);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 
 static inline int handle_signal(unsigned long sig, siginfo_t *info,
@@ -393,7 +383,7 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
                 regs->regs[2] = EINTR;
                 break;
         case ERESTARTSYS:
-                if(!(ka->sa.sa_flags & SA_RESTART)) {
+                if (!(ka->sa.sa_flags & SA_RESTART)) {
                         regs->regs[2] = EINTR;
                         break;
                 }
@@ -420,9 +410,10 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
         return ret;
 }
 
-int do_signal(sigset_t *oldset, struct pt_regs *regs)
+void do_signal(struct pt_regs *regs)
 {
         struct k_sigaction ka;
+        sigset_t *oldset;
         siginfo_t info;
         int signr;
 
@@ -432,17 +423,31 @@ int do_signal(sigset_t *oldset, struct pt_regs *regs)
          * if so.
          */
         if (!user_mode(regs))
-                return 1;
+                return;
 
         if (try_to_freeze())
                 goto no_signal;
 
-        if (!oldset)
+        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                oldset = &current->saved_sigmask;
+        else
                 oldset = &current->blocked;
 
+
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-        if (signr > 0)
-                return handle_signal(signr, &info, &ka, oldset, regs);
+        if (signr > 0) {
+                /* Whee!  Actually deliver the signal.  */
+                if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
+                        /*
+                         * A signal was successfully delivered; the saved
+                         * sigmask will have been stored in the signal frame,
+                         * and will be restored by sigreturn, so we can simply
+                         * clear the TIF_RESTORE_SIGMASK flag.
+                         */
+                        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                }
+        }
 
 no_signal:
         /*
@@ -463,18 +468,25 @@ no_signal:
                         regs->cp0_epc -= 4;
                 }
         }
-        return 0;
+
+        /*
+         * If there's no signal to deliver, we just put the saved sigmask
+         * back
+         */
+        if (test_thread_flag(TIF_RESTORE_SIGMASK)) {
+                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+        }
 }
 
 /*
  * notification of userspace execution resumption
- * - triggered by current->work.notify_resume
+ * - triggered by the TIF_WORK_MASK flags
  */
-asmlinkage void do_notify_resume(struct pt_regs *regs, sigset_t *oldset,
+asmlinkage void do_notify_resume(struct pt_regs *regs, void *unused,
         __u32 thread_info_flags)
 {
         /* deal with pending signal delivery */
-        if (thread_info_flags & _TIF_SIGPENDING) {
-                current->thread.abi->do_signal(oldset, regs);
-        }
+        if (thread_info_flags & (_TIF_SIGPENDING | _TIF_RESTORE_SIGMASK))
+                current->thread.abi->do_signal(regs);
 }
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 98b185bbc947..237cd8a2cd32 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -4,7 +4,7 @@
  * for more details.
  *
  * Copyright (C) 1991, 1992  Linus Torvalds
- * Copyright (C) 1994 - 2000  Ralf Baechle
+ * Copyright (C) 1994 - 2000, 2006  Ralf Baechle
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  */
 #include <linux/cache.h>
@@ -106,8 +106,6 @@ typedef struct compat_siginfo {
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
-extern int do_signal32(sigset_t *oldset, struct pt_regs *regs);
-
 /* 32-bit compatibility types */
 
 #define _NSIG_BPW32     32
@@ -144,7 +142,7 @@ struct ucontext32 {
 extern void __put_sigset_unknown_nsig(void);
 extern void __get_sigset_unknown_nsig(void);
 
-static inline int put_sigset(const sigset_t *kbuf, compat_sigset_t *ubuf)
+static inline int put_sigset(const sigset_t *kbuf, compat_sigset_t __user *ubuf)
 {
         int err = 0;
 
@@ -198,7 +196,7 @@ __attribute_used__ noinline static int
 _sys32_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
         compat_sigset_t *uset;
-        sigset_t newset, saveset;
+        sigset_t newset;
 
         uset = (compat_sigset_t *) regs.regs[4];
         if (get_sigset(&newset, uset))
@@ -206,19 +204,15 @@ _sys32_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal32(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 
 save_static_function(sys32_rt_sigsuspend);
@@ -226,8 +220,8 @@ __attribute_used__ noinline static int
 _sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
         compat_sigset_t *uset;
-        sigset_t newset, saveset;
-        size_t sigsetsize;
+        sigset_t newset;
+        size_t sigsetsize;
 
         /* XXX Don't preclude handling different sized sigset_t's.  */
         sigsetsize = regs.regs[5];
@@ -240,19 +234,15 @@ _sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal32(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 
 asmlinkage int sys32_sigaction(int sig, const struct sigaction32 *act,
@@ -269,7 +259,7 @@ asmlinkage int sys32_sigaction(int sig, const struct sigaction32 *act,
                 if (!access_ok(VERIFY_READ, act, sizeof(*act)))
                         return -EFAULT;
                 err |= __get_user(handler, &act->sa_handler);
-                new_ka.sa.sa_handler = (void*)(s64)handler;
+                new_ka.sa.sa_handler = (void __user *)(s64)handler;
                 err |= __get_user(new_ka.sa.sa_flags, &act->sa_flags);
                 err |= __get_user(mask, &act->sa_mask.sig[0]);
                 if (err)
@@ -299,8 +289,8 @@ asmlinkage int sys32_sigaction(int sig, const struct sigaction32 *act,
 
 asmlinkage int sys32_sigaltstack(nabi_no_regargs struct pt_regs regs)
 {
-        const stack32_t *uss = (const stack32_t *) regs.regs[4];
-        stack32_t *uoss = (stack32_t *) regs.regs[5];
+        const stack32_t __user *uss = (const stack32_t __user *) regs.regs[4];
+        stack32_t __user *uoss = (stack32_t __user *) regs.regs[5];
         unsigned long usp = regs.regs[29];
         stack_t kss, koss;
         int ret, err = 0;
@@ -319,7 +309,8 @@ asmlinkage int sys32_sigaltstack(nabi_no_regargs struct pt_regs regs)
         }
 
         set_fs (KERNEL_DS);
-        ret = do_sigaltstack(uss ? &kss : NULL , uoss ? &koss : NULL, usp);
+        ret = do_sigaltstack(uss ? (stack_t __user *)&kss : NULL,
+                             uoss ? (stack_t __user *)&koss : NULL, usp);
         set_fs (old_fs);
 
         if (!ret && uoss) {
@@ -335,7 +326,7 @@ asmlinkage int sys32_sigaltstack(nabi_no_regargs struct pt_regs regs)
         return ret;
 }
 
-static int restore_sigcontext32(struct pt_regs *regs, struct sigcontext32 *sc)
+static int restore_sigcontext32(struct pt_regs *regs, struct sigcontext32 __user *sc)
 {
         u32 used_math;
         int err = 0;
@@ -420,7 +411,7 @@ struct rt_sigframe32 {
 #endif
 };
 
-int copy_siginfo_to_user32(compat_siginfo_t *to, siginfo_t *from)
+int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
 {
         int err;
 
@@ -455,7 +446,7 @@ int copy_siginfo_to_user32(compat_siginfo_t *to, siginfo_t *from)
                         err |= __put_user(from->si_uid, &to->si_uid);
                         break;
                 case __SI_FAULT >> 16:
-                        err |= __put_user((long)from->si_addr, &to->si_addr);
+                        err |= __put_user((unsigned long)from->si_addr, &to->si_addr);
                         break;
                 case __SI_POLL >> 16:
                         err |= __put_user(from->si_band, &to->si_band);
@@ -476,10 +467,10 @@ save_static_function(sys32_sigreturn);
 __attribute_used__ noinline static void
 _sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
-        struct sigframe *frame;
+        struct sigframe __user *frame;
         sigset_t blocked;
 
-        frame = (struct sigframe *) regs.regs[29];
+        frame = (struct sigframe __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
                 goto badframe;
         if (__copy_from_user(&blocked, &frame->sf_mask, sizeof(blocked)))
@@ -512,13 +503,13 @@ save_static_function(sys32_rt_sigreturn);
 __attribute_used__ noinline static void
 _sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
-        struct rt_sigframe32 *frame;
+        struct rt_sigframe32 __user *frame;
         mm_segment_t old_fs;
         sigset_t set;
         stack_t st;
         s32 sp;
 
-        frame = (struct rt_sigframe32 *) regs.regs[29];
+        frame = (struct rt_sigframe32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
                 goto badframe;
         if (__copy_from_user(&set, &frame->rs_uc.uc_sigmask, sizeof(set)))
@@ -536,7 +527,7 @@ _sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
                 goto badframe;
-        st.ss_size = (long) sp;
+        st.ss_sp = (void *)(long) sp;
         if (__get_user(st.ss_size, &frame->rs_uc.uc_stack.ss_size))
                 goto badframe;
         if (__get_user(st.ss_flags, &frame->rs_uc.uc_stack.ss_flags))
@@ -546,7 +537,7 @@ _sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
            call it and ignore errors.  */
         old_fs = get_fs();
         set_fs (KERNEL_DS);
-        do_sigaltstack(&st, NULL, regs.regs[29]);
+        do_sigaltstack((stack_t __user *)&st, NULL, regs.regs[29]);
         set_fs (old_fs);
 
         /*
@@ -564,7 +555,7 @@ badframe:
 }
 
 static inline int setup_sigcontext32(struct pt_regs *regs,
-                                     struct sigcontext32 *sc)
+                                     struct sigcontext32 __user *sc)
 {
         int err = 0;
 
@@ -623,8 +614,9 @@ out:
 /*
  * Determine which stack to use..
  */
-static inline void *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
-                                 size_t frame_size)
+static inline void __user *get_sigframe(struct k_sigaction *ka,
+                                        struct pt_regs *regs,
+                                        size_t frame_size)
 {
         unsigned long sp;
 
@@ -642,13 +634,13 @@ static inline void *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
         if ((ka->sa.sa_flags & SA_ONSTACK) && (sas_ss_flags (sp) == 0))
                 sp = current->sas_ss_sp + current->sas_ss_size;
 
-        return (void *)((sp - frame_size) & ALMASK);
+        return (void __user *)((sp - frame_size) & ALMASK);
 }
 
 int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
         int signr, sigset_t *set)
 {
-        struct sigframe *frame;
+        struct sigframe __user *frame;
         int err = 0;
 
         frame = get_sigframe(ka, regs, sizeof(*frame));
@@ -692,17 +684,17 @@ int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, frame->sf_code);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 
 int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
         int signr, sigset_t *set, siginfo_t *info)
 {
-        struct rt_sigframe32 *frame;
+        struct rt_sigframe32 __user *frame;
         int err = 0;
         s32 sp;
 
@@ -763,11 +755,11 @@ int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
                current->comm, current->pid,
                frame, regs->cp0_epc, frame->rs_code);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
 
 static inline int handle_signal(unsigned long sig, siginfo_t *info,
@@ -781,7 +773,7 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
                 regs->regs[2] = EINTR;
                 break;
         case ERESTARTSYS:
-                if(!(ka->sa.sa_flags & SA_RESTART)) {
+                if (!(ka->sa.sa_flags & SA_RESTART)) {
                         regs->regs[2] = EINTR;
                         break;
                 }
@@ -808,9 +800,10 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
         return ret;
 }
 
-int do_signal32(sigset_t *oldset, struct pt_regs *regs)
+void do_signal32(struct pt_regs *regs)
 {
         struct k_sigaction ka;
+        sigset_t *oldset;
         siginfo_t info;
         int signr;
 
@@ -820,17 +813,30 @@ int do_signal32(sigset_t *oldset, struct pt_regs *regs)
          * if so.
          */
         if (!user_mode(regs))
-                return 1;
+                return;
 
         if (try_to_freeze())
                 goto no_signal;
 
-        if (!oldset)
+        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                oldset = &current->saved_sigmask;
+        else
                 oldset = &current->blocked;
 
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-        if (signr > 0)
-                return handle_signal(signr, &info, &ka, oldset, regs);
+        if (signr > 0) {
+                /* Whee! Actually deliver the signal. */
+                if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
+                        /*
+                        * A signal was successfully delivered; the saved
+                        * sigmask will have been stored in the signal frame,
+                        * and will be restored by sigreturn, so we can simply
+                        * clear the TIF_RESTORE_SIGMASK flag.
+                        */
+                        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                }
+        }
 
 no_signal:
         /*
@@ -851,11 +857,19 @@ no_signal:
                         regs->cp0_epc -= 4;
                 }
         }
-        return 0;
+
+        /*
+        * If there's no signal to deliver, we just put the saved sigmask
+        * back
+        */
+        if (test_thread_flag(TIF_RESTORE_SIGMASK)) {
+                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+        }
 }
 
 asmlinkage int sys32_rt_sigaction(int sig, const struct sigaction32 *act,
-                                  struct sigaction32 *oact,
+                                  struct sigaction32 __user *oact,
                                   unsigned int sigsetsize)
 {
         struct k_sigaction new_sa, old_sa;
@@ -872,7 +886,7 @@ asmlinkage int sys32_rt_sigaction(int sig, const struct sigaction32 *act,
                 if (!access_ok(VERIFY_READ, act, sizeof(*act)))
                         return -EFAULT;
                 err |= __get_user(handler, &act->sa_handler);
-                new_sa.sa.sa_handler = (void*)(s64)handler;
+                new_sa.sa.sa_handler = (void __user *)(s64)handler;
                 err |= __get_user(new_sa.sa.sa_flags, &act->sa_flags);
                 err |= get_sigset(&new_sa.sa.sa_mask, &act->sa_mask);
                 if (err)
@@ -899,7 +913,7 @@ out:
 }
 
 asmlinkage int sys32_rt_sigprocmask(int how, compat_sigset_t *set,
-        compat_sigset_t *oset, unsigned int sigsetsize)
+        compat_sigset_t __user *oset, unsigned int sigsetsize)
 {
         sigset_t old_set, new_set;
         int ret;
@@ -909,8 +923,9 @@ asmlinkage int sys32_rt_sigprocmask(int how, compat_sigset_t *set,
                 return -EFAULT;
 
         set_fs (KERNEL_DS);
-        ret = sys_rt_sigprocmask(how, set ? &new_set : NULL,
-                                 oset ? &old_set : NULL, sigsetsize);
+        ret = sys_rt_sigprocmask(how, set ? (sigset_t __user *)&new_set : NULL,
+                                 oset ? (sigset_t __user *)&old_set : NULL,
+                                 sigsetsize);
         set_fs (old_fs);
 
         if (!ret && oset && put_sigset(&old_set, oset))
@@ -919,7 +934,7 @@ asmlinkage int sys32_rt_sigprocmask(int how, compat_sigset_t *set,
         return ret;
 }
 
-asmlinkage int sys32_rt_sigpending(compat_sigset_t *uset,
+asmlinkage int sys32_rt_sigpending(compat_sigset_t __user *uset,
         unsigned int sigsetsize)
 {
         int ret;
@@ -927,7 +942,7 @@ asmlinkage int sys32_rt_sigpending(compat_sigset_t *uset,
         mm_segment_t old_fs = get_fs();
 
         set_fs (KERNEL_DS);
-        ret = sys_rt_sigpending(&set, sigsetsize);
+        ret = sys_rt_sigpending((sigset_t __user *)&set, sigsetsize);
         set_fs (old_fs);
 
         if (!ret && put_sigset(&set, uset))
@@ -936,7 +951,7 @@ asmlinkage int sys32_rt_sigpending(compat_sigset_t *uset,
         return ret;
 }
 
-asmlinkage int sys32_rt_sigqueueinfo(int pid, int sig, compat_siginfo_t *uinfo)
+asmlinkage int sys32_rt_sigqueueinfo(int pid, int sig, compat_siginfo_t __user *uinfo)
 {
         siginfo_t info;
         int ret;
@@ -946,7 +961,7 @@ asmlinkage int sys32_rt_sigqueueinfo(int pid, int sig, compat_siginfo_t *uinfo)
             copy_from_user (info._sifields._pad, uinfo->_sifields._pad, SI_PAD_SIZE))
                 return -EFAULT;
         set_fs (KERNEL_DS);
-        ret = sys_rt_sigqueueinfo(pid, sig, &info);
+        ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info);
         set_fs (old_fs);
         return ret;
 }
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ec61b2670ba6..3e168c08a3a8 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -48,6 +48,8 @@
 #define __NR_N32_rt_sigreturn           6211
 #define __NR_N32_restart_syscall        6214
 
+#define DEBUG_SIG 0
+
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
 /* IRIX compatible stack_t  */
@@ -79,16 +81,49 @@ struct rt_sigframe_n32 {
 #endif
 };
 
+extern void sigset_from_compat (sigset_t *set, compat_sigset_t *compat);
+
+save_static_function(sysn32_rt_sigsuspend);
+__attribute_used__ noinline static int
+_sysn32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
+{
+        compat_sigset_t __user *unewset, uset;
+        size_t sigsetsize;
+        sigset_t newset;
+
+        /* XXX Don't preclude handling different sized sigset_t's.  */
+        sigsetsize = regs.regs[5];
+        if (sigsetsize != sizeof(sigset_t))
+                return -EINVAL;
+
+        unewset = (compat_sigset_t __user *) regs.regs[4];
+        if (copy_from_user(&uset, unewset, sizeof(uset)))
+                return -EFAULT;
+        sigset_from_compat (&newset, &uset);
+        sigdelsetmask(&newset, ~_BLOCKABLE);
+
+        spin_lock_irq(&current->sighand->siglock);
+        current->saved_sigmask = current->blocked;
+        current->blocked = newset;
+        recalc_sigpending();
+        spin_unlock_irq(&current->sighand->siglock);
+
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
+}
+
 save_static_function(sysn32_rt_sigreturn);
 __attribute_used__ noinline static void
 _sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 {
-        struct rt_sigframe_n32 *frame;
+        struct rt_sigframe_n32 __user *frame;
         sigset_t set;
         stack_t st;
         s32 sp;
 
-        frame = (struct rt_sigframe_n32 *) regs.regs[29];
+        frame = (struct rt_sigframe_n32 __user *) regs.regs[29];
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
                 goto badframe;
         if (__copy_from_user(&set, &frame->rs_uc.uc_sigmask, sizeof(set)))
@@ -106,7 +141,7 @@ _sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
         /* The ucontext contains a stack32_t, so we must convert!  */
         if (__get_user(sp, &frame->rs_uc.uc_stack.ss_sp))
                 goto badframe;
-        st.ss_size = (long) sp;
+        st.ss_sp = (void *)(long) sp;
         if (__get_user(st.ss_size, &frame->rs_uc.uc_stack.ss_size))
                 goto badframe;
         if (__get_user(st.ss_flags, &frame->rs_uc.uc_stack.ss_flags))
@@ -114,7 +149,7 @@ _sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
 
         /* It is more difficult to avoid calling this function than to
            call it and ignore errors.  */
-        do_sigaltstack(&st, NULL, regs.regs[29]);
+        do_sigaltstack((stack_t __user *)&st, NULL, regs.regs[29]);
 
         /*
          * Don't let your children do this ...
@@ -133,7 +168,7 @@ badframe:
 int setup_rt_frame_n32(struct k_sigaction * ka,
         struct pt_regs *regs, int signr, sigset_t *set, siginfo_t *info)
 {
-        struct rt_sigframe_n32 *frame;
+        struct rt_sigframe_n32 __user *frame;
         int err = 0;
         s32 sp;
 
@@ -184,9 +219,9 @@ int setup_rt_frame_n32(struct k_sigaction * ka,
                current->comm, current->pid,
                frame, regs->cp0_epc, regs->regs[31]);
 #endif
-        return 1;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(signr, current);
-        return 0;
+        return -EFAULT;
 }
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 25472fcaf715..06ed90752424 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -29,6 +29,7 @@
 #include <linux/timex.h>
 #include <linux/sched.h>
 #include <linux/cpumask.h>
+#include <linux/cpu.h>
 
 #include <asm/atomic.h>
 #include <asm/cpu.h>
@@ -235,7 +236,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         init_new_context(current, &init_mm);
         current_thread_info()->cpu = 0;
         smp_tune_scheduling();
-        prom_prepare_cpus(max_cpus);
+        plat_prepare_cpus(max_cpus);
 }
 
 /* preload SMP state for boot cpu */
@@ -424,6 +425,25 @@ void flush_tlb_one(unsigned long vaddr)
         local_flush_tlb_one(vaddr);
 }
 
+static DEFINE_PER_CPU(struct cpu, cpu_devices);
+
+static int __init topology_init(void)
+{
+        int cpu;
+        int ret;
+
+        for_each_cpu(cpu) {
+                ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu, NULL);
+                if (ret)
+                        printk(KERN_WARNING "topology_init: register_cpu %d "
+                               "failed (%d)\n", cpu, ret);
+        }
+
+        return 0;
+}
+
+subsys_initcall(topology_init);
+
 EXPORT_SYMBOL(flush_tlb_page);
 EXPORT_SYMBOL(flush_tlb_one);
 EXPORT_SYMBOL(cpu_data);
diff --git a/arch/mips/kernel/smp_mt.c b/arch/mips/kernel/smp_mt.c
index 794a1c3de2a4..993b8bf56aaf 100644
--- a/arch/mips/kernel/smp_mt.c
+++ b/arch/mips/kernel/smp_mt.c
@@ -68,6 +68,8 @@ void __init sanitize_tlb_entries(void)
 
         set_c0_mvpcontrol(MVPCONTROL_VPC);
 
+        back_to_back_c0_hazard();
+
         /* Disable TLB sharing */
         clear_c0_mvpcontrol(MVPCONTROL_STLB);
 
@@ -102,35 +104,6 @@ void __init sanitize_tlb_entries(void)
         clear_c0_mvpcontrol(MVPCONTROL_VPC);
 }
 
-#if 0
-/*
- * Use c0_MVPConf0 to find out how many CPUs are available, setting up
- * phys_cpu_present_map and the logical/physical mappings.
- */
-void __init prom_build_cpu_map(void)
-{
-        int i, num, ncpus;
-
-        cpus_clear(phys_cpu_present_map);
-
-        /* assume we boot on cpu 0.... */
-        cpu_set(0, phys_cpu_present_map);
-        __cpu_number_map[0] = 0;
-        __cpu_logical_map[0] = 0;
-
-        if (cpu_has_mipsmt) {
-                ncpus = ((read_c0_mvpconf0() & (MVPCONF0_PVPE)) >> MVPCONF0_PVPE_SHIFT) + 1;
-                for (i=1, num=0; i< NR_CPUS && i<ncpus; i++) {
-                        cpu_set(i, phys_cpu_present_map);
-                        __cpu_number_map[i] = ++num;
-                        __cpu_logical_map[num] = i;
-                }
-
-                printk(KERN_INFO "%i available secondary CPU(s)\n", num);
-        }
-}
-#endif
-
 static void ipi_resched_dispatch (struct pt_regs *regs)
 {
         do_IRQ(MIPS_CPU_IPI_RESCHED_IRQ, regs);
@@ -170,7 +143,7 @@ static struct irqaction irq_call = {
  * Make sure all CPU's are in a sensible state before we boot any of the
  * secondarys
  */
-void prom_prepare_cpus(unsigned int max_cpus)
+void plat_smp_setup(void)
 {
         unsigned long val;
         int i, num;
@@ -206,11 +179,9 @@ void prom_prepare_cpus(unsigned int max_cpus)
                                 write_vpe_c0_vpeconf0(tmp);
 
                                 /* Record this as available CPU */
-                                if (i < max_cpus) {
-                                        cpu_set(i, phys_cpu_present_map);
-                                        __cpu_number_map[i]     = ++num;
-                                        __cpu_logical_map[num]  = i;
-                                }
+                                cpu_set(i, phys_cpu_present_map);
+                                __cpu_number_map[i]     = ++num;
+                                __cpu_logical_map[num]  = i;
                         }
 
                         /* disable multi-threading with TC's */
@@ -222,6 +193,9 @@ void prom_prepare_cpus(unsigned int max_cpus)
 
                                 /* set config to be the same as vpe0, particularly kseg0 coherency alg */
                                 write_vpe_c0_config( read_c0_config());
+
+                                /* Propagate Config7 */
+                                write_vpe_c0_config7(read_c0_config7());
                         }
 
                 }
@@ -265,7 +239,10 @@ void prom_prepare_cpus(unsigned int max_cpus)
                 set_vi_handler (MIPS_CPU_IPI_RESCHED_IRQ, ipi_resched_dispatch);
                 set_vi_handler (MIPS_CPU_IPI_CALL_IRQ, ipi_call_dispatch);
         }
+}
 
+void __init plat_prepare_cpus(unsigned int max_cpus)
+{
         cpu_ipi_resched_irq = MIPSCPU_INT_BASE + MIPS_CPU_IPI_RESCHED_IRQ;
         cpu_ipi_call_irq = MIPSCPU_INT_BASE + MIPS_CPU_IPI_CALL_IRQ;
 
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 332358430ff5..1da2eeb3ef9e 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -212,12 +212,12 @@ asmlinkage int sys_execve(nabi_no_regargs struct pt_regs regs)
         int error;
         char * filename;
 
-        filename = getname((char *) (long)regs.regs[4]);
+        filename = getname((char __user *) (long)regs.regs[4]);
         error = PTR_ERR(filename);
         if (IS_ERR(filename))
                 goto out;
-        error = do_execve(filename, (char **) (long)regs.regs[5],
-                          (char **) (long)regs.regs[6], &regs);
+        error = do_execve(filename, (char __user *__user *) (long)regs.regs[5],
+                          (char __user *__user *) (long)regs.regs[6], &regs);
         putname(filename);
 
 out:
@@ -227,7 +227,7 @@ out:
 /*
  * Compacrapability ...
  */
-asmlinkage int sys_uname(struct old_utsname * name)
+asmlinkage int sys_uname(struct old_utsname __user * name)
 {
         if (name && !copy_to_user(name, &system_utsname, sizeof (*name)))
                 return 0;
@@ -237,7 +237,7 @@ asmlinkage int sys_uname(struct old_utsname * name)
 /*
  * Compacrapability ...
  */
-asmlinkage int sys_olduname(struct oldold_utsname * name)
+asmlinkage int sys_olduname(struct oldold_utsname __user * name)
 {
         int error;
 
@@ -274,7 +274,7 @@ void sys_set_thread_area(unsigned long addr)
 asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
 {
         int     tmp, len;
-        char    *name;
+        char    __user *name;
 
         switch(cmd) {
         case SETNAME: {
@@ -283,7 +283,7 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
 
-                name = (char *) arg1;
+                name = (char __user *) arg1;
 
                 len = strncpy_from_user(nodename, name, __NEW_UTS_LEN);
                 if (len < 0)
@@ -324,7 +324,7 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
  * This is really horribly ugly.
  */
 asmlinkage int sys_ipc (uint call, int first, int second,
-                        unsigned long third, void *ptr, long fifth)
+                        unsigned long third, void __user *ptr, long fifth)
 {
         int version, ret;
 
@@ -333,24 +333,25 @@ asmlinkage int sys_ipc (uint call, int first, int second,
 
         switch (call) {
         case SEMOP:
-                return sys_semtimedop (first, (struct sembuf *)ptr, second,
-                                       NULL);
+                return sys_semtimedop (first, (struct sembuf __user *)ptr,
+                                       second, NULL);
         case SEMTIMEDOP:
-                return sys_semtimedop (first, (struct sembuf *)ptr, second,
-                                       (const struct timespec __user *)fifth);
+                return sys_semtimedop (first, (struct sembuf __user *)ptr,
+                                       second,
+                                       (const struct timespec __user *)fifth);
         case SEMGET:
                 return sys_semget (first, second, third);
         case SEMCTL: {
                 union semun fourth;
                 if (!ptr)
                         return -EINVAL;
-                if (get_user(fourth.__pad, (void **) ptr))
+                if (get_user(fourth.__pad, (void *__user *) ptr))
                         return -EFAULT;
                 return sys_semctl (first, second, third, fourth);
         }
 
         case MSGSND:
-                return sys_msgsnd (first, (struct msgbuf *) ptr,
+                return sys_msgsnd (first, (struct msgbuf __user *) ptr,
                                    second, third);
         case MSGRCV:
                 switch (version) {
@@ -360,7 +361,7 @@ asmlinkage int sys_ipc (uint call, int first, int second,
                                 return -EINVAL;
 
                         if (copy_from_user(&tmp,
-                                           (struct ipc_kludge *) ptr,
+                                           (struct ipc_kludge __user *) ptr,
                                            sizeof (tmp)))
                                 return -EFAULT;
                         return sys_msgrcv (first, tmp.msgp, second,
@@ -368,35 +369,38 @@ asmlinkage int sys_ipc (uint call, int first, int second,
                 }
                 default:
                         return sys_msgrcv (first,
-                                           (struct msgbuf *) ptr,
+                                           (struct msgbuf __user *) ptr,
                                            second, fifth, third);
                 }
         case MSGGET:
                 return sys_msgget ((key_t) first, second);
         case MSGCTL:
-                return sys_msgctl (first, second, (struct msqid_ds *) ptr);
+                return sys_msgctl (first, second,
+                                   (struct msqid_ds __user *) ptr);
 
         case SHMAT:
                 switch (version) {
                 default: {
                         ulong raddr;
-                        ret = do_shmat (first, (char *) ptr, second, &raddr);
+                        ret = do_shmat (first, (char __user *) ptr, second,
+                                        &raddr);
                         if (ret)
                                 return ret;
-                        return put_user (raddr, (ulong *) third);
+                        return put_user (raddr, (ulong __user *) third);
                 }
                 case 1: /* iBCS2 emulator entry point */
                         if (!segment_eq(get_fs(), get_ds()))
                                 return -EINVAL;
-                        return do_shmat (first, (char *) ptr, second, (ulong *) third);
+                        return do_shmat (first, (char __user *) ptr, second,
+                                         (ulong *) third);
                 }
         case SHMDT:
-                return sys_shmdt ((char *)ptr);
+                return sys_shmdt ((char __user *)ptr);
         case SHMGET:
                 return sys_shmget (first, second, third);
         case SHMCTL:
                 return sys_shmctl (first, second,
-                                   (struct shmid_ds *) ptr);
+                                   (struct shmid_ds __user *) ptr);
         default:
                 return -ENOSYS;
         }
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index 7050b4ffffcd..51273b7297a7 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -163,7 +163,7 @@ void do_gettimeofday(struct timeval *tv)
         unsigned long seq;
         unsigned long lost;
         unsigned long usec, sec;
-        unsigned long max_ntp_tick = tick_usec - tickadj;
+        unsigned long max_ntp_tick;
 
         do {
                 seq = read_seqbegin(&xtime_lock);
@@ -178,12 +178,13 @@ void do_gettimeofday(struct timeval *tv)
                  * Better to lose some accuracy than have time go backwards..
                  */
                 if (unlikely(time_adjust < 0)) {
+                        max_ntp_tick = (USEC_PER_SEC / HZ) - tickadj;
                         usec = min(usec, max_ntp_tick);
 
                         if (lost)
                                 usec += lost * max_ntp_tick;
                 } else if (unlikely(lost))
-                        usec += lost * tick_usec;
+                        usec += lost * (USEC_PER_SEC / HZ);
 
                 sec = xtime.tv_sec;
                 usec += (xtime.tv_nsec / 1000);
@@ -423,6 +424,8 @@ irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         unsigned long j;
         unsigned int count;
 
+        write_seqlock(&xtime_lock);
+
         count = mips_hpt_read();
         mips_timer_ack();
 
@@ -440,7 +443,6 @@ irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
          * CMOS clock accordingly every ~11 minutes. rtc_set_time() has to be
          * called as close as possible to 500 ms before the new second starts.
          */
-        write_seqlock(&xtime_lock);
         if (ntp_synced() &&
             xtime.tv_sec > last_rtc_update + 660 &&
             (xtime.tv_nsec / 1000) >= 500000 - ((unsigned) TICK_SIZE) / 2 &&
@@ -452,7 +454,6 @@ irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                         last_rtc_update = xtime.tv_sec - 600;
                 }
         }
-        write_sequnlock(&xtime_lock);
 
         /*
          * If jiffies has overflown in this timer_interrupt, we must
@@ -495,6 +496,8 @@ irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
                 }
         }
 
+        write_sequnlock(&xtime_lock);
+
         /*
          * In UP mode, we call local_timer_interrupt() to do profiling
          * and process accouting.
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 59a187956de0..005debbfbe84 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1994 - 1999, 2000, 01 Ralf Baechle
+ * Copyright (C) 1994 - 1999, 2000, 01, 06 Ralf Baechle
  * Copyright (C) 1995, 1996 Paul M. Antoine
  * Copyright (C) 1998 Ulf Carlsson
  * Copyright (C) 1999 Silicon Graphics, Inc.
@@ -548,6 +548,8 @@ asmlinkage void do_ov(struct pt_regs *regs)
 {
         siginfo_t info;
 
+        die_if_kernel("Integer overflow", regs);
+
         info.si_code = FPE_INTOVF;
         info.si_signo = SIGFPE;
         info.si_errno = 0;
@@ -1168,7 +1170,7 @@ void __init per_cpu_trap_init(void)
 #endif
         if (current_cpu_data.isa_level == MIPS_CPU_ISA_IV)
                 status_set |= ST0_XX;
-        change_c0_status(ST0_CU|ST0_MX|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX,
+        change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX,
                          status_set);
 
         if (cpu_has_dsp)
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 25cc856d8e7e..2ad0cedf29fe 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -1,4 +1,5 @@
 #include <linux/config.h>
+#include <asm/asm-offsets.h>
 #include <asm-generic/vmlinux.lds.h>
 
 #undef mips             /* CPP really sucks for this job  */
@@ -64,10 +65,10 @@ SECTIONS
      we can shorten the on-disk segment size.  */
   .sdata     : { *(.sdata) }
 
-  . = ALIGN(4096);
+  . = ALIGN(_PAGE_SIZE);
   __nosave_begin = .;
   .data_nosave : { *(.data.nosave) }
-  . = ALIGN(4096);
+  . = ALIGN(_PAGE_SIZE);
   __nosave_end = .;
 
   . = ALIGN(32);
@@ -76,7 +77,7 @@ SECTIONS
   _edata =  .;                  /* End of data section */
 
   /* will be freed after init */
-  . = ALIGN(4096);              /* Init code and data */
+  . = ALIGN(_PAGE_SIZE);                /* Init code and data */
   __init_begin = .;
   .init.text : {
         _sinittext = .;
@@ -105,7 +106,10 @@ SECTIONS
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
   SECURITY_INIT
-  . = ALIGN(4096);
+    /* .exit.text is discarded at runtime, not link time, to deal with
+     references from .rodata */
+  .exit.text : { *(.exit.text) }
+  . = ALIGN(_PAGE_SIZE);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
   __initramfs_end = .;
@@ -113,7 +117,7 @@ SECTIONS
   __per_cpu_start = .;
   .data.percpu  : { *(.data.percpu) }
   __per_cpu_end = .;
-  . = ALIGN(4096);
+  . = ALIGN(_PAGE_SIZE);
   __init_end = .;
   /* freed after init ends here */
 
@@ -132,7 +136,6 @@ SECTIONS
 
   /* Sections to be discarded */
   /DISCARD/ : {
-        *(.exit.text)
         *(.exit.data)
         *(.exitcall.exit)
 
diff --git a/arch/mips/lasat/reset.c b/arch/mips/lasat/reset.c
index 8d7d7a454f9a..181bf68175fc 100644
--- a/arch/mips/lasat/reset.c
+++ b/arch/mips/lasat/reset.c
@@ -19,9 +19,12 @@
  */
 #include <linux/config.h>
 #include <linux/kernel.h>
+#include <linux/pm.h>
+
 #include <asm/reboot.h>
 #include <asm/system.h>
 #include <asm/lasat/lasat.h>
+
 #include "picvue.h"
 #include "prom.h"
 
@@ -63,5 +66,5 @@ void lasat_reboot_setup(void)
 {
         _machine_restart = lasat_machine_restart;
         _machine_halt = lasat_machine_halt;
-        _machine_power_off = lasat_machine_halt;
+        pm_power_off = lasat_machine_halt;
 }
diff --git a/arch/mips/lasat/setup.c b/arch/mips/lasat/setup.c
index dcd819d57dae..83eb08b7a072 100644
--- a/arch/mips/lasat/setup.c
+++ b/arch/mips/lasat/setup.c
@@ -134,8 +134,8 @@ void __init serial_init(void)
 
         memset(&s, 0, sizeof(s));
 
-        s.flags = STD_COM_FLAGS;
-        s.iotype = SERIAL_IO_MEM;
+        s.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
+        s.iotype = UPIO_MEM;
 
         if (mips_machtype == MACH_LASAT_100) {
                 s.uartclk = LASAT_BASE_BAUD_100 * 16;
diff --git a/arch/mips/lib-32/dump_tlb.c b/arch/mips/lib-32/dump_tlb.c
index 46519f4331eb..c49a925d0169 100644
--- a/arch/mips/lib-32/dump_tlb.c
+++ b/arch/mips/lib-32/dump_tlb.c
@@ -158,29 +158,26 @@ void dump_list_process(struct task_struct *t, void *address)
         printk("task->mm             == %8p\n", t->mm);
         //printk("tasks->mm.pgd        == %08x\n", (unsigned int) t->mm->pgd);
 
-        if (addr > KSEG0)
+        if (addr > KSEG0) {
                 page_dir = pgd_offset_k(0);
-        else if (t->mm) {
-                page_dir = pgd_offset(t->mm, 0);
-                printk("page_dir == %08x\n", (unsigned int) page_dir);
-        } else
-                printk("Current thread has no mm\n");
-
-        if (addr > KSEG0)
                 pgd = pgd_offset_k(addr);
-        else if (t->mm) {
+        } else if (t->mm) {
+                page_dir = pgd_offset(t->mm, 0);
                 pgd = pgd_offset(t->mm, addr);
-                printk("pgd == %08x, ", (unsigned int) pgd);
-                pud = pud_offset(pgd, addr);
-                printk("pud == %08x, ", (unsigned int) pud);
+        } else {
+                printk("Current thread has no mm\n");
+                return;
+        }
+        printk("page_dir == %08x\n", (unsigned int) page_dir);
+        printk("pgd == %08x, ", (unsigned int) pgd);
+        pud = pud_offset(pgd, addr);
+        printk("pud == %08x, ", (unsigned int) pud);
 
-                pmd = pmd_offset(pud, addr);
-                printk("pmd == %08x, ", (unsigned int) pmd);
+        pmd = pmd_offset(pud, addr);
+        printk("pmd == %08x, ", (unsigned int) pmd);
 
-                pte = pte_offset(pmd, addr);
-                printk("pte == %08x, ", (unsigned int) pte);
-        } else
-                printk("Current thread has no mm\n");
+        pte = pte_offset(pmd, addr);
+        printk("pte == %08x, ", (unsigned int) pte);
 
         page = *pte;
 #ifdef CONFIG_64BIT_PHYS_ADDR
diff --git a/arch/mips/lib/iomap.c b/arch/mips/lib/iomap.c
index 7e2ced715cfb..f4ac5bbcd81f 100644
--- a/arch/mips/lib/iomap.c
+++ b/arch/mips/lib/iomap.c
@@ -63,7 +63,7 @@ void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
                 return ioport_map(start, len);
         if (flags & IORESOURCE_MEM) {
                 if (flags & IORESOURCE_CACHEABLE)
-                        return ioremap_cacheable_cow(start, len);
+                        return ioremap_cachable(start, len);
                 return ioremap_nocache(start, len);
         }
 
diff --git a/arch/mips/math-emu/dp_simple.c b/arch/mips/math-emu/dp_simple.c
index 495c1ac94298..1c555e6c6a9f 100644
--- a/arch/mips/math-emu/dp_simple.c
+++ b/arch/mips/math-emu/dp_simple.c
@@ -48,16 +48,22 @@ ieee754dp ieee754dp_neg(ieee754dp x)
         CLEARCX;
         FLUSHXDP;
 
+        /*
+         * Invert the sign ALWAYS to prevent an endless recursion on
+         * pow() in libc.
+         */
+        /* quick fix up */
+        DPSIGN(x) ^= 1;
+
         if (xc == IEEE754_CLASS_SNAN) {
+                ieee754dp y = ieee754dp_indef();
                 SETCX(IEEE754_INVALID_OPERATION);
-                return ieee754dp_nanxcpt(ieee754dp_indef(), "neg");
+                DPSIGN(y) = DPSIGN(x);
+                return ieee754dp_nanxcpt(y, "neg");
         }
 
         if (ieee754dp_isnan(x)) /* but not infinity */
                 return ieee754dp_nanxcpt(x, "neg", x);
-
-        /* quick fix up */
-        DPSIGN(x) ^= 1;
         return x;
 }
 
diff --git a/arch/mips/math-emu/sp_simple.c b/arch/mips/math-emu/sp_simple.c
index c809830dffb4..770f0f4677cd 100644
--- a/arch/mips/math-emu/sp_simple.c
+++ b/arch/mips/math-emu/sp_simple.c
@@ -48,16 +48,22 @@ ieee754sp ieee754sp_neg(ieee754sp x)
         CLEARCX;
         FLUSHXSP;
 
+        /*
+         * Invert the sign ALWAYS to prevent an endless recursion on
+         * pow() in libc.
+         */
+        /* quick fix up */
+        SPSIGN(x) ^= 1;
+
         if (xc == IEEE754_CLASS_SNAN) {
+                ieee754sp y = ieee754sp_indef();
                 SETCX(IEEE754_INVALID_OPERATION);
-                return ieee754sp_nanxcpt(ieee754sp_indef(), "neg");
+                SPSIGN(y) = SPSIGN(x);
+                return ieee754sp_nanxcpt(y, "neg");
         }
 
         if (ieee754sp_isnan(x)) /* but not infinity */
                 return ieee754sp_nanxcpt(x, "neg", x);
-
-        /* quick fix up */
-        SPSIGN(x) ^= 1;
         return x;
 }
 
diff --git a/arch/mips/mips-boards/atlas/atlas_setup.c b/arch/mips/mips-boards/atlas/atlas_setup.c
index 625843b30bed..873cf3141a31 100644
--- a/arch/mips/mips-boards/atlas/atlas_setup.c
+++ b/arch/mips/mips-boards/atlas/atlas_setup.c
@@ -82,8 +82,8 @@ static void __init serial_init(void)
 #endif
         s.irq = ATLASINT_UART;
         s.uartclk = ATLAS_BASE_BAUD * 16;
-        s.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST | ASYNC_AUTO_IRQ;
-        s.iotype = SERIAL_IO_PORT;
+        s.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_AUTO_IRQ;
+        s.iotype = UPIO_PORT;
         s.regshift = 3;
 
         if (early_serial_setup(&s) != 0) {
diff --git a/arch/mips/mips-boards/generic/reset.c b/arch/mips/mips-boards/generic/reset.c
index 9fdec743bd95..7213c395fb6b 100644
--- a/arch/mips/mips-boards/generic/reset.c
+++ b/arch/mips/mips-boards/generic/reset.c
@@ -23,6 +23,7 @@
  *
  */
 #include <linux/config.h>
+#include <linux/pm.h>
 
 #include <asm/io.h>
 #include <asm/reboot.h>
@@ -65,9 +66,9 @@ void mips_reboot_setup(void)
         _machine_restart = mips_machine_restart;
         _machine_halt = mips_machine_halt;
 #if defined(CONFIG_MIPS_ATLAS)
-        _machine_power_off = atlas_machine_power_off;
+        pm_power_off = atlas_machine_power_off;
 #endif
 #if defined(CONFIG_MIPS_MALTA) || defined(CONFIG_MIPS_SEAD)
-        _machine_power_off = mips_machine_halt;
+        pm_power_off = mips_machine_halt;
 #endif
 }
diff --git a/arch/mips/mips-boards/sead/sead_setup.c b/arch/mips/mips-boards/sead/sead_setup.c
index f966bc161dfa..4266ce445174 100644
--- a/arch/mips/mips-boards/sead/sead_setup.c
+++ b/arch/mips/mips-boards/sead/sead_setup.c
@@ -71,8 +71,8 @@ static void __init serial_init(void)
 #endif
         s.irq = MIPSCPU_INT_BASE + MIPSCPU_INT_UART0;
         s.uartclk = SEAD_BASE_BAUD * 16;
-        s.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST | ASYNC_AUTO_IRQ;
-        s.iotype = 0;
+        s.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | UPF_AUTO_IRQ;
+        s.iotype = UPIO_PORT;
         s.regshift = 3;
 
         if (early_serial_setup(&s) != 0) {
diff --git a/arch/mips/mips-boards/sim/sim_setup.c b/arch/mips/mips-boards/sim/sim_setup.c
index 485d5a58d9cf..a2fd62997ca3 100644
--- a/arch/mips/mips-boards/sim/sim_setup.c
+++ b/arch/mips/mips-boards/sim/sim_setup.c
@@ -88,8 +88,8 @@ static void __init serial_init(void)
          but poll for now */
         s.irq =  0;
         s.uartclk = BASE_BAUD * 16;
-        s.flags = ASYNC_BOOT_AUTOCONF | UPF_SKIP_TEST;
-        s.iotype = SERIAL_IO_PORT | ASYNC_SKIP_TEST;
+        s.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
+        s.iotype = UPIO_PORT;
         s.regshift = 0;
         s.timeout = 4;
 
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 422b55fab07a..9572ed44f0d5 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -235,7 +235,9 @@ static inline void r4k_blast_scache_page_setup(void)
 {
         unsigned long sc_lsize = cpu_scache_line_size();
 
-        if (sc_lsize == 16)
+        if (scache_size == 0)
+                r4k_blast_scache_page = (void *)no_sc_noop;
+        else if (sc_lsize == 16)
                 r4k_blast_scache_page = blast_scache16_page;
         else if (sc_lsize == 32)
                 r4k_blast_scache_page = blast_scache32_page;
@@ -251,7 +253,9 @@ static inline void r4k_blast_scache_page_indexed_setup(void)
 {
         unsigned long sc_lsize = cpu_scache_line_size();
 
-        if (sc_lsize == 16)
+        if (scache_size == 0)
+                r4k_blast_scache_page_indexed = (void *)no_sc_noop;
+        else if (sc_lsize == 16)
                 r4k_blast_scache_page_indexed = blast_scache16_page_indexed;
         else if (sc_lsize == 32)
                 r4k_blast_scache_page_indexed = blast_scache32_page_indexed;
@@ -267,7 +271,9 @@ static inline void r4k_blast_scache_setup(void)
 {
         unsigned long sc_lsize = cpu_scache_line_size();
 
-        if (sc_lsize == 16)
+        if (scache_size == 0)
+                r4k_blast_scache = (void *)no_sc_noop;
+        else if (sc_lsize == 16)
                 r4k_blast_scache = blast_scache16;
         else if (sc_lsize == 32)
                 r4k_blast_scache = blast_scache32;
@@ -369,6 +375,7 @@ static void r4k_flush_cache_mm(struct mm_struct *mm)
 struct flush_cache_page_args {
         struct vm_area_struct *vma;
         unsigned long addr;
+        unsigned long pfn;
 };
 
 static inline void local_r4k_flush_cache_page(void *args)
@@ -376,6 +383,7 @@ static inline void local_r4k_flush_cache_page(void *args)
         struct flush_cache_page_args *fcp_args = args;
         struct vm_area_struct *vma = fcp_args->vma;
         unsigned long addr = fcp_args->addr;
+        unsigned long paddr = fcp_args->pfn << PAGE_SHIFT;
         int exec = vma->vm_flags & VM_EXEC;
         struct mm_struct *mm = vma->vm_mm;
         pgd_t *pgdp;
@@ -425,11 +433,12 @@ static inline void local_r4k_flush_cache_page(void *args)
          * Do indexed flush, too much work to get the (possible) TLB refills
          * to work correctly.
          */
-        addr = INDEX_BASE + (addr & (dcache_size - 1));
         if (cpu_has_dc_aliases || (exec && !cpu_has_ic_fills_f_dc)) {
-                r4k_blast_dcache_page_indexed(addr);
-                if (exec && !cpu_icache_snoops_remote_store)
-                        r4k_blast_scache_page_indexed(addr);
+                r4k_blast_dcache_page_indexed(cpu_has_pindexed_dcache ?
+                                              paddr : addr);
+                if (exec && !cpu_icache_snoops_remote_store) {
+                        r4k_blast_scache_page_indexed(paddr);
+                }
         }
         if (exec) {
                 if (cpu_has_vtag_icache) {
@@ -449,6 +458,7 @@ static void r4k_flush_cache_page(struct vm_area_struct *vma,
 
         args.vma = vma;
         args.addr = addr;
+        args.pfn = pfn;
 
         on_each_cpu(local_r4k_flush_cache_page, &args, 1, 1);
 }
@@ -464,72 +474,39 @@ static void r4k_flush_data_cache_page(unsigned long addr)
 }
 
 struct flush_icache_range_args {
-        unsigned long __user start;
-        unsigned long __user end;
+        unsigned long start;
+        unsigned long end;
 };
 
 static inline void local_r4k_flush_icache_range(void *args)
 {
         struct flush_icache_range_args *fir_args = args;
-        unsigned long dc_lsize = cpu_dcache_line_size();
-        unsigned long ic_lsize = cpu_icache_line_size();
-        unsigned long sc_lsize = cpu_scache_line_size();
         unsigned long start = fir_args->start;
         unsigned long end = fir_args->end;
-        unsigned long addr, aend;
 
         if (!cpu_has_ic_fills_f_dc) {
                 if (end - start > dcache_size) {
                         r4k_blast_dcache();
                 } else {
                         R4600_HIT_CACHEOP_WAR_IMPL;
-                        addr = start & ~(dc_lsize - 1);
-                        aend = (end - 1) & ~(dc_lsize - 1);
-
-                        while (1) {
-                                /* Hit_Writeback_Inv_D */
-                                protected_writeback_dcache_line(addr);
-                                if (addr == aend)
-                                        break;
-                                addr += dc_lsize;
-                        }
+                        protected_blast_dcache_range(start, end);
                 }
 
-                if (!cpu_icache_snoops_remote_store) {
-                        if (end - start > scache_size) {
+                if (!cpu_icache_snoops_remote_store && scache_size) {
+                        if (end - start > scache_size)
                                 r4k_blast_scache();
-                        } else {
-                                addr = start & ~(sc_lsize - 1);
-                                aend = (end - 1) & ~(sc_lsize - 1);
-
-                                while (1) {
-                                        /* Hit_Writeback_Inv_SD */
-                                        protected_writeback_scache_line(addr);
-                                        if (addr == aend)
-                                                break;
-                                        addr += sc_lsize;
-                                }
-                        }
+                        else
+                                protected_blast_scache_range(start, end);
                 }
         }
 
         if (end - start > icache_size)
                 r4k_blast_icache();
-        else {
-                addr = start & ~(ic_lsize - 1);
-                aend = (end - 1) & ~(ic_lsize - 1);
-                while (1) {
-                        /* Hit_Invalidate_I */
-                        protected_flush_icache_line(addr);
-                        if (addr == aend)
-                                break;
-                        addr += ic_lsize;
-                }
-        }
+        else
+                protected_blast_icache_range(start, end);
 }
 
-static void r4k_flush_icache_range(unsigned long __user start,
-        unsigned long __user end)
+static void r4k_flush_icache_range(unsigned long start, unsigned long end)
 {
         struct flush_icache_range_args args;
 
@@ -620,27 +597,14 @@ static void r4k_flush_icache_page(struct vm_area_struct *vma,
 
 static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 {
-        unsigned long end, a;
-
         /* Catch bad driver code */
         BUG_ON(size == 0);
 
         if (cpu_has_subset_pcaches) {
-                unsigned long sc_lsize = cpu_scache_line_size();
-
-                if (size >= scache_size) {
+                if (size >= scache_size)
                         r4k_blast_scache();
-                        return;
-                }
-
-                a = addr & ~(sc_lsize - 1);
-                end = (addr + size - 1) & ~(sc_lsize - 1);
-                while (1) {
-                        flush_scache_line(a);   /* Hit_Writeback_Inv_SD */
-                        if (a == end)
-                                break;
-                        a += sc_lsize;
-                }
+                else
+                        blast_scache_range(addr, addr + size);
                 return;
         }
 
@@ -652,17 +616,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
         if (size >= dcache_size) {
                 r4k_blast_dcache();
         } else {
-                unsigned long dc_lsize = cpu_dcache_line_size();
-
                 R4600_HIT_CACHEOP_WAR_IMPL;
-                a = addr & ~(dc_lsize - 1);
-                end = (addr + size - 1) & ~(dc_lsize - 1);
-                while (1) {
-                        flush_dcache_line(a);   /* Hit_Writeback_Inv_D */
-                        if (a == end)
-                                break;
-                        a += dc_lsize;
-                }
+                blast_dcache_range(addr, addr + size);
         }
 
         bc_wback_inv(addr, size);
@@ -670,44 +625,22 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 
 static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
 {
-        unsigned long end, a;
-
         /* Catch bad driver code */
         BUG_ON(size == 0);
 
         if (cpu_has_subset_pcaches) {
-                unsigned long sc_lsize = cpu_scache_line_size();
-
-                if (size >= scache_size) {
+                if (size >= scache_size)
                         r4k_blast_scache();
-                        return;
-                }
-
-                a = addr & ~(sc_lsize - 1);
-                end = (addr + size - 1) & ~(sc_lsize - 1);
-                while (1) {
-                        flush_scache_line(a);   /* Hit_Writeback_Inv_SD */
-                        if (a == end)
-                                break;
-                        a += sc_lsize;
-                }
+                else
+                        blast_scache_range(addr, addr + size);
                 return;
         }
 
         if (size >= dcache_size) {
                 r4k_blast_dcache();
         } else {
-                unsigned long dc_lsize = cpu_dcache_line_size();
-
                 R4600_HIT_CACHEOP_WAR_IMPL;
-                a = addr & ~(dc_lsize - 1);
-                end = (addr + size - 1) & ~(dc_lsize - 1);
-                while (1) {
-                        flush_dcache_line(a);   /* Hit_Writeback_Inv_D */
-                        if (a == end)
-                                break;
-                        a += dc_lsize;
-                }
+                blast_dcache_range(addr, addr + size);
         }
 
         bc_inv(addr, size);
@@ -728,7 +661,7 @@ static void local_r4k_flush_cache_sigtramp(void * arg)
 
         R4600_HIT_CACHEOP_WAR_IMPL;
         protected_writeback_dcache_line(addr & ~(dc_lsize - 1));
-        if (!cpu_icache_snoops_remote_store)
+        if (!cpu_icache_snoops_remote_store && scache_size)
                 protected_writeback_scache_line(addr & ~(sc_lsize - 1));
         protected_flush_icache_line(addr & ~(ic_lsize - 1));
         if (MIPS4K_ICACHE_REFILL_WAR) {
@@ -1027,6 +960,7 @@ static void __init probe_pcache(void)
         switch (c->cputype) {
         case CPU_20KC:
         case CPU_25KF:
+                c->dcache.flags |= MIPS_CACHE_PINDEX;
         case CPU_R10000:
         case CPU_R12000:
         case CPU_SB1:
diff --git a/arch/mips/mm/c-tx39.c b/arch/mips/mm/c-tx39.c
index 0a97a9434eba..fe232e3988e3 100644
--- a/arch/mips/mm/c-tx39.c
+++ b/arch/mips/mm/c-tx39.c
@@ -44,8 +44,6 @@ __asm__ __volatile__( \
 /* TX39H-style cache flush routines. */
 static void tx39h_flush_icache_all(void)
 {
-        unsigned long start = KSEG0;
-        unsigned long end = (start + icache_size);
         unsigned long flags, config;
 
         /* disable icache (set ICE#) */
@@ -53,33 +51,18 @@ static void tx39h_flush_icache_all(void)
         config = read_c0_conf();
         write_c0_conf(config & ~TX39_CONF_ICE);
         TX39_STOP_STREAMING();
-
-        /* invalidate icache */
-        while (start < end) {
-                cache16_unroll32(start, Index_Invalidate_I);
-                start += 0x200;
-        }
-
+        blast_icache16();
         write_c0_conf(config);
         local_irq_restore(flags);
 }
 
 static void tx39h_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 {
-        unsigned long end, a;
-        unsigned long dc_lsize = current_cpu_data.dcache.linesz;
-
         /* Catch bad driver code */
         BUG_ON(size == 0);
 
         iob();
-        a = addr & ~(dc_lsize - 1);
-        end = (addr + size - 1) & ~(dc_lsize - 1);
-        while (1) {
-                invalidate_dcache_line(a); /* Hit_Invalidate_D */
-                if (a == end) break;
-                a += dc_lsize;
-        }
+        blast_inv_dcache_range(addr, addr + size);
 }
 
 
@@ -227,7 +210,6 @@ static void tx39_flush_cache_page(struct vm_area_struct *vma, unsigned long page
          * Do indexed flush, too much work to get the (possible) TLB refills
          * to work correctly.
          */
-        page = (KSEG0 + (page & (dcache_size - 1)));
         if (cpu_has_dc_aliases || exec)
                 tx39_blast_dcache_page_indexed(page);
         if (exec)
@@ -241,42 +223,21 @@ static void tx39_flush_data_cache_page(unsigned long addr)
 
 static void tx39_flush_icache_range(unsigned long start, unsigned long end)
 {
-        unsigned long dc_lsize = current_cpu_data.dcache.linesz;
-        unsigned long addr, aend;
-
         if (end - start > dcache_size)
                 tx39_blast_dcache();
-        else {
-                addr = start & ~(dc_lsize - 1);
-                aend = (end - 1) & ~(dc_lsize - 1);
-
-                while (1) {
-                        /* Hit_Writeback_Inv_D */
-                        protected_writeback_dcache_line(addr);
-                        if (addr == aend)
-                                break;
-                        addr += dc_lsize;
-                }
-        }
+        else
+                protected_blast_dcache_range(start, end);
 
         if (end - start > icache_size)
                 tx39_blast_icache();
         else {
                 unsigned long flags, config;
-                addr = start & ~(dc_lsize - 1);
-                aend = (end - 1) & ~(dc_lsize - 1);
                 /* disable icache (set ICE#) */
                 local_irq_save(flags);
                 config = read_c0_conf();
                 write_c0_conf(config & ~TX39_CONF_ICE);
                 TX39_STOP_STREAMING();
-                while (1) {
-                        /* Hit_Invalidate_I */
-                        protected_flush_icache_line(addr);
-                        if (addr == aend)
-                                break;
-                        addr += dc_lsize;
-                }
+                protected_blast_icache_range(start, end);
                 write_c0_conf(config);
                 local_irq_restore(flags);
         }
@@ -311,7 +272,7 @@ static void tx39_flush_icache_page(struct vm_area_struct *vma, struct page *page
 
 static void tx39_dma_cache_wback_inv(unsigned long addr, unsigned long size)
 {
-        unsigned long end, a;
+        unsigned long end;
 
         if (((size | addr) & (PAGE_SIZE - 1)) == 0) {
                 end = addr + size;
@@ -322,20 +283,13 @@ static void tx39_dma_cache_wback_inv(unsigned long addr, unsigned long size)
         } else if (size > dcache_size) {
                 tx39_blast_dcache();
         } else {
-                unsigned long dc_lsize = current_cpu_data.dcache.linesz;
-                a = addr & ~(dc_lsize - 1);
-                end = (addr + size - 1) & ~(dc_lsize - 1);
-                while (1) {
-                        flush_dcache_line(a); /* Hit_Writeback_Inv_D */
-                        if (a == end) break;
-                        a += dc_lsize;
-                }
+                blast_dcache_range(addr, addr + size);
         }
 }
 
 static void tx39_dma_cache_inv(unsigned long addr, unsigned long size)
 {
-        unsigned long end, a;
+        unsigned long end;
 
         if (((size | addr) & (PAGE_SIZE - 1)) == 0) {
                 end = addr + size;
@@ -346,14 +300,7 @@ static void tx39_dma_cache_inv(unsigned long addr, unsigned long size)
         } else if (size > dcache_size) {
                 tx39_blast_dcache();
         } else {
-                unsigned long dc_lsize = current_cpu_data.dcache.linesz;
-                a = addr & ~(dc_lsize - 1);
-                end = (addr + size - 1) & ~(dc_lsize - 1);
-                while (1) {
-                        invalidate_dcache_line(a); /* Hit_Invalidate_D */
-                        if (a == end) break;
-                        a += dc_lsize;
-                }
+                blast_inv_dcache_range(addr, addr + size);
         }
 }
 
diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index 314701a66b13..591c22b080e4 100644
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -25,8 +25,7 @@ void (*flush_cache_range)(struct vm_area_struct *vma, unsigned long start,
         unsigned long end);
 void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page,
         unsigned long pfn);
-void (*flush_icache_range)(unsigned long __user start,
-        unsigned long __user end);
+void (*flush_icache_range)(unsigned long start, unsigned long end);
 void (*flush_icache_page)(struct vm_area_struct *vma, struct page *page);
 
 /* MIPS specific cache operations */
@@ -53,7 +52,7 @@ EXPORT_SYMBOL(_dma_cache_inv);
  * We could optimize the case where the cache argument is not BCACHE but
  * that seems very atypical use ...
  */
-asmlinkage int sys_cacheflush(unsigned long __user addr,
+asmlinkage int sys_cacheflush(unsigned long addr,
         unsigned long bytes, unsigned int cache)
 {
         if (bytes == 0)
diff --git a/arch/mips/mm/cex-sb1.S b/arch/mips/mm/cex-sb1.S
index 0e71580774ff..e54a62f2807c 100644
--- a/arch/mips/mm/cex-sb1.S
+++ b/arch/mips/mm/cex-sb1.S
@@ -64,7 +64,7 @@ LEAF(except_vec2_sb1)
         sd      k0,0x170($0)
         sd      k1,0x178($0)
 
-#if CONFIG_SB1_CEX_ALWAYS_FATAL
+#ifdef CONFIG_SB1_CEX_ALWAYS_FATAL
         j       handle_vec2_sb1
          nop
 #else
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 4ee91c9a556f..0ff9a348b843 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -24,6 +24,7 @@
 #include <linux/bootmem.h>
 #include <linux/highmem.h>
 #include <linux/swap.h>
+#include <linux/proc_fs.h>
 
 #include <asm/bootinfo.h>
 #include <asm/cachectl.h>
@@ -200,6 +201,11 @@ static inline int page_is_ram(unsigned long pagenr)
         return 0;
 }
 
+static struct kcore_list kcore_mem, kcore_vmalloc;
+#ifdef CONFIG_64BIT
+static struct kcore_list kcore_kseg0;
+#endif
+
 void __init mem_init(void)
 {
         unsigned long codesize, reservedpages, datasize, initsize;
@@ -249,6 +255,16 @@ void __init mem_init(void)
         datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
         initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
 
+#ifdef CONFIG_64BIT
+        if ((unsigned long) &_text > (unsigned long) CKSEG0)
+                /* The -4 is a hack so that user tools don't have to handle
+                   the overflow.  */
+                kclist_add(&kcore_kseg0, (void *) CKSEG0, 0x80000000 - 4);
+#endif
+        kclist_add(&kcore_mem, __va(0), max_low_pfn << PAGE_SHIFT);
+        kclist_add(&kcore_vmalloc, (void *)VMALLOC_START,
+                   VMALLOC_END-VMALLOC_START);
+
         printk(KERN_INFO "Memory: %luk/%luk available (%ldk kernel code, "
                "%ldk reserved, %ldk data, %ldk init, %ldk highmem)\n",
                (unsigned long) nr_free_pages() << (PAGE_SHIFT-10),
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 0f9485806bac..ac4f4bfaae50 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -280,69 +280,69 @@ static void __init build_insn(u32 **buf, enum opcode opc, ...)
 }
 
 #define I_u1u2u3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, unsigned int c)                 \
         {                                                       \
                 build_insn(buf, insn##op, a, b, c);             \
         }
 
 #define I_u2u1u3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, unsigned int c)                 \
         {                                                       \
                 build_insn(buf, insn##op, b, a, c);             \
         }
 
 #define I_u3u1u2(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, unsigned int c)                 \
         {                                                       \
                 build_insn(buf, insn##op, b, c, a);             \
         }
 
 #define I_u1u2s3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, signed int c)                   \
         {                                                       \
                 build_insn(buf, insn##op, a, b, c);             \
         }
 
 #define I_u2s3u1(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 signed int b, unsigned int c)                   \
         {                                                       \
                 build_insn(buf, insn##op, c, a, b);             \
         }
 
 #define I_u2u1s3(op)                                            \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b, signed int c)                   \
         {                                                       \
                 build_insn(buf, insn##op, b, a, c);             \
         }
 
 #define I_u1u2(op)                                              \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 unsigned int b)                                 \
         {                                                       \
                 build_insn(buf, insn##op, a, b);                \
         }
 
 #define I_u1s2(op)                                              \
-        static inline void i##op(u32 **buf, unsigned int a,     \
+        static inline void __init i##op(u32 **buf, unsigned int a,      \
                 signed int b)                                   \
         {                                                       \
                 build_insn(buf, insn##op, a, b);                \
         }
 
 #define I_u1(op)                                                \
-        static inline void i##op(u32 **buf, unsigned int a)     \
+        static inline void __init i##op(u32 **buf, unsigned int a)      \
         {                                                       \
                 build_insn(buf, insn##op, a);                   \
         }
 
 #define I_0(op)                                                 \
-        static inline void i##op(u32 **buf)                     \
+        static inline void __init i##op(u32 **buf)              \
         {                                                       \
                 build_insn(buf, insn##op);                      \
         }
@@ -623,42 +623,42 @@ static __init int __attribute__((unused)) insn_has_bdelay(struct reloc *rel,
 }
 
 /* convenience functions for labeled branches */
-static void __attribute__((unused)) il_bltz(u32 **p, struct reloc **r,
-                                            unsigned int reg, enum label_id l)
+static void __init __attribute__((unused))
+        il_bltz(u32 **p, struct reloc **r, unsigned int reg, enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_bltz(p, reg, 0);
 }
 
-static void __attribute__((unused)) il_b(u32 **p, struct reloc **r,
+static void __init __attribute__((unused)) il_b(u32 **p, struct reloc **r,
                                          enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_b(p, 0);
 }
 
-static void il_beqz(u32 **p, struct reloc **r, unsigned int reg,
+static void __init il_beqz(u32 **p, struct reloc **r, unsigned int reg,
                     enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_beqz(p, reg, 0);
 }
 
-static void __attribute__((unused))
+static void __init __attribute__((unused))
 il_beqzl(u32 **p, struct reloc **r, unsigned int reg, enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_beqzl(p, reg, 0);
 }
 
-static void il_bnez(u32 **p, struct reloc **r, unsigned int reg,
+static void __init il_bnez(u32 **p, struct reloc **r, unsigned int reg,
                     enum label_id l)
 {
         r_mips_pc16(r, *p, l);
         i_bnez(p, reg, 0);
 }
 
-static void il_bgezl(u32 **p, struct reloc **r, unsigned int reg,
+static void __init il_bgezl(u32 **p, struct reloc **r, unsigned int reg,
                      enum label_id l)
 {
         r_mips_pc16(r, *p, l);
diff --git a/arch/mips/momentum/jaguar_atx/ja-console.c b/arch/mips/momentum/jaguar_atx/ja-console.c
index da6e1ed34db1..2292d0ec47fc 100644
--- a/arch/mips/momentum/jaguar_atx/ja-console.c
+++ b/arch/mips/momentum/jaguar_atx/ja-console.c
@@ -93,7 +93,7 @@ static void inline ja_console_probe(void)
         up.uartclk      = JAGUAR_ATX_UART_CLK;
         up.regshift     = 2;
         up.iotype       = UPIO_MEM;
-        up.flags        = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        up.flags        = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         up.line         = 0;
 
         if (early_serial_setup(&up))
diff --git a/arch/mips/momentum/jaguar_atx/prom.c b/arch/mips/momentum/jaguar_atx/prom.c
index aae7a802767a..1cadaa92946a 100644
--- a/arch/mips/momentum/jaguar_atx/prom.c
+++ b/arch/mips/momentum/jaguar_atx/prom.c
@@ -21,10 +21,10 @@
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/bootmem.h>
+#include <linux/mv643xx.h>
 
 #include <asm/addrspace.h>
 #include <asm/bootinfo.h>
-#include <asm/mv64340.h>
 #include <asm/pmon.h>
 
 #include "jaguar_atx_fpga.h"
diff --git a/arch/mips/momentum/jaguar_atx/setup.c b/arch/mips/momentum/jaguar_atx/setup.c
index bab192ddc185..2699917b640a 100644
--- a/arch/mips/momentum/jaguar_atx/setup.c
+++ b/arch/mips/momentum/jaguar_atx/setup.c
@@ -2,7 +2,7 @@
  * BRIEF MODULE DESCRIPTION
  * Momentum Computer Jaguar-ATX board dependent boot routines
  *
- * Copyright (C) 1996, 1997, 2001, 2004  Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 1996, 1997, 2001, 04, 06  Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2000 RidgeRun, Inc.
  * Copyright (C) 2001 Red Hat, Inc.
  * Copyright (C) 2002 Momentum Computer
@@ -50,10 +50,13 @@
 #include <linux/pci.h>
 #include <linux/swap.h>
 #include <linux/ioport.h>
+#include <linux/pm.h>
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/timex.h>
 #include <linux/vmalloc.h>
+#include <linux/mv643xx.h>
+
 #include <asm/time.h>
 #include <asm/bootinfo.h>
 #include <asm/page.h>
@@ -63,7 +66,6 @@
 #include <asm/ptrace.h>
 #include <asm/reboot.h>
 #include <asm/tlbflush.h>
-#include <asm/mv64340.h>
 
 #include "jaguar_atx_fpga.h"
 
@@ -365,7 +367,7 @@ void __init plat_setup(void)
 
         _machine_restart = momenco_jaguar_restart;
         _machine_halt = momenco_jaguar_halt;
-        _machine_power_off = momenco_jaguar_power_off;
+        pm_power_off = momenco_jaguar_power_off;
 
         /*
          * initrd_start = (ulong)jaguar_initrd_start;
diff --git a/arch/mips/momentum/ocelot_3/setup.c b/arch/mips/momentum/ocelot_3/setup.c
index c9b7ff8148ec..f95677f4f06f 100644
--- a/arch/mips/momentum/ocelot_3/setup.c
+++ b/arch/mips/momentum/ocelot_3/setup.c
@@ -57,6 +57,8 @@
 #include <linux/timex.h>
 #include <linux/bootmem.h>
 #include <linux/mv643xx.h>
+#include <linux/pm.h>
+
 #include <asm/time.h>
 #include <asm/page.h>
 #include <asm/bootinfo.h>
@@ -321,7 +323,7 @@ void __init plat_setup(void)
 
         _machine_restart = momenco_ocelot_restart;
         _machine_halt = momenco_ocelot_halt;
-        _machine_power_off = momenco_ocelot_power_off;
+        pm_power_off = momenco_ocelot_power_off;
 
         /* Wired TLB entries */
         setup_wired_tlb_entries();
diff --git a/arch/mips/momentum/ocelot_c/irq.c b/arch/mips/momentum/ocelot_c/irq.c
index 300fe8e4fbe8..a5764bc20e36 100644
--- a/arch/mips/momentum/ocelot_c/irq.c
+++ b/arch/mips/momentum/ocelot_c/irq.c
@@ -41,11 +41,11 @@
 #include <linux/slab.h>
 #include <linux/random.h>
 #include <linux/bitops.h>
+#include <linux/mv643xx.h>
 #include <asm/bootinfo.h>
 #include <asm/io.h>
 #include <asm/irq_cpu.h>
 #include <asm/mipsregs.h>
-#include <asm/mv64340.h>
 #include <asm/system.h>
 
 extern asmlinkage void ocelot_handle_int(void);
diff --git a/arch/mips/momentum/ocelot_c/prom.c b/arch/mips/momentum/ocelot_c/prom.c
index 5b6809724b15..e92364482c7b 100644
--- a/arch/mips/momentum/ocelot_c/prom.c
+++ b/arch/mips/momentum/ocelot_c/prom.c
@@ -19,10 +19,10 @@
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/bootmem.h>
+#include <linux/mv643xx.h>
 
 #include <asm/addrspace.h>
 #include <asm/bootinfo.h>
-#include <asm/mv64340.h>
 #include <asm/pmon.h>
 
 #include "ocelot_c_fpga.h"
diff --git a/arch/mips/momentum/ocelot_c/setup.c b/arch/mips/momentum/ocelot_c/setup.c
index 2755c1547473..bd02e60d037a 100644
--- a/arch/mips/momentum/ocelot_c/setup.c
+++ b/arch/mips/momentum/ocelot_c/setup.c
@@ -51,8 +51,11 @@
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
+#include <linux/pm.h>
 #include <linux/timex.h>
 #include <linux/vmalloc.h>
+#include <linux/mv643xx.h>
+
 #include <asm/time.h>
 #include <asm/bootinfo.h>
 #include <asm/page.h>
@@ -62,9 +65,9 @@
 #include <asm/processor.h>
 #include <asm/ptrace.h>
 #include <asm/reboot.h>
+#include <asm/marvell.h>
 #include <linux/bootmem.h>
 #include <linux/blkdev.h>
-#include <asm/mv64340.h>
 #include "ocelot_c_fpga.h"
 
 unsigned long marvell_base;
@@ -236,7 +239,7 @@ void __init plat_setup(void)
 
         _machine_restart = momenco_ocelot_restart;
         _machine_halt = momenco_ocelot_halt;
-        _machine_power_off = momenco_ocelot_power_off;
+        pm_power_off = momenco_ocelot_power_off;
 
         /*
          * initrd_start = (ulong)ocelot_initrd_start;
@@ -250,22 +253,22 @@ void __init plat_setup(void)
         /* shut down ethernet ports, just to be sure our memory doesn't get
          * corrupted by random ethernet traffic.
          */
-        MV_WRITE(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(0), 0xff << 8);
-        MV_WRITE(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(1), 0xff << 8);
-        MV_WRITE(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(0), 0xff << 8);
-        MV_WRITE(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(1), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(0), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(1), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(0), 0xff << 8);
+        MV_WRITE(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(1), 0xff << 8);
         do {}
-          while (MV_READ(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(0)) & 0xff);
+          while (MV_READ(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(0)) & 0xff);
         do {}
-          while (MV_READ(MV64340_ETH_RECEIVE_QUEUE_COMMAND_REG(1)) & 0xff);
+          while (MV_READ(MV643XX_ETH_RECEIVE_QUEUE_COMMAND_REG(1)) & 0xff);
         do {}
-          while (MV_READ(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(0)) & 0xff);
+          while (MV_READ(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(0)) & 0xff);
         do {}
-          while (MV_READ(MV64340_ETH_TRANSMIT_QUEUE_COMMAND_REG(1)) & 0xff);
-        MV_WRITE(MV64340_ETH_PORT_SERIAL_CONTROL_REG(0),
-                 MV_READ(MV64340_ETH_PORT_SERIAL_CONTROL_REG(0)) & ~1);
-        MV_WRITE(MV64340_ETH_PORT_SERIAL_CONTROL_REG(1),
-                 MV_READ(MV64340_ETH_PORT_SERIAL_CONTROL_REG(1)) & ~1);
+          while (MV_READ(MV643XX_ETH_TRANSMIT_QUEUE_COMMAND_REG(1)) & 0xff);
+        MV_WRITE(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(0),
+                 MV_READ(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(0)) & ~1);
+        MV_WRITE(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(1),
+                 MV_READ(MV643XX_ETH_PORT_SERIAL_CONTROL_REG(1)) & ~1);
 
         /* Turn off the Bit-Error LED */
         OCELOT_FPGA_WRITE(0x80, CLR);
diff --git a/arch/mips/momentum/ocelot_g/setup.c b/arch/mips/momentum/ocelot_g/setup.c
index 6336751391c3..fed4e8eee116 100644
--- a/arch/mips/momentum/ocelot_g/setup.c
+++ b/arch/mips/momentum/ocelot_g/setup.c
@@ -47,8 +47,10 @@
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
+#include <linux/pm.h>
 #include <linux/timex.h>
 #include <linux/vmalloc.h>
+
 #include <asm/time.h>
 #include <asm/bootinfo.h>
 #include <asm/page.h>
@@ -169,7 +171,7 @@ void __init plat_setup(void)
 
         _machine_restart = momenco_ocelot_restart;
         _machine_halt = momenco_ocelot_halt;
-        _machine_power_off = momenco_ocelot_power_off;
+        pm_power_off = momenco_ocelot_power_off;
 
         /*
          * initrd_start = (ulong)ocelot_initrd_start;
diff --git a/arch/mips/oprofile/Makefile b/arch/mips/oprofile/Makefile
index 354261d37d62..0a50aad5bbe4 100644
--- a/arch/mips/oprofile/Makefile
+++ b/arch/mips/oprofile/Makefile
@@ -12,4 +12,5 @@ oprofile-y				:= $(DRIVER_OBJS) common.o
 
 oprofile-$(CONFIG_CPU_MIPS32)           += op_model_mipsxx.o
 oprofile-$(CONFIG_CPU_MIPS64)           += op_model_mipsxx.o
+oprofile-$(CONFIG_CPU_SB1)              += op_model_mipsxx.o
 oprofile-$(CONFIG_CPU_RM9000)           += op_model_rm9000.o
diff --git a/arch/mips/oprofile/common.c b/arch/mips/oprofile/common.c
index 53f9889b30ed..935dd851f480 100644
--- a/arch/mips/oprofile/common.c
+++ b/arch/mips/oprofile/common.c
@@ -79,6 +79,9 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         case CPU_20KC:
         case CPU_24K:
         case CPU_25KF:
+        case CPU_34K:
+        case CPU_SB1:
+        case CPU_SB1A:
                 lmodel = &op_model_mipsxx;
                 break;
 
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index 1d1eee407faf..95d488ca0754 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -201,10 +201,21 @@ static int __init mipsxx_init(void)
                 op_model_mipsxx.cpu_type = "mips/25K";
                 break;
 
+#ifndef CONFIG_SMP
+        case CPU_34K:
+                op_model_mipsxx.cpu_type = "mips/34K";
+                break;
+#endif
+
         case CPU_5KC:
                 op_model_mipsxx.cpu_type = "mips/5K";
                 break;
 
+        case CPU_SB1:
+        case CPU_SB1A:
+                op_model_mipsxx.cpu_type = "mips/sb1";
+                break;
+
         default:
                 printk(KERN_ERR "Profiling unsupported for this CPU\n");
 
diff --git a/arch/mips/pci/Makefile b/arch/mips/pci/Makefile
index 741e67c9195a..16205b587338 100644
--- a/arch/mips/pci/Makefile
+++ b/arch/mips/pci/Makefile
@@ -46,6 +46,7 @@ obj-$(CONFIG_PMC_YOSEMITE)	+= fixup-yosemite.o ops-titan.o ops-titan-ht.o \
 obj-$(CONFIG_SGI_IP27)          += pci-ip27.o
 obj-$(CONFIG_SGI_IP32)          += fixup-ip32.o ops-mace.o pci-ip32.o
 obj-$(CONFIG_SIBYTE_SB1250)     += fixup-sb1250.o pci-sb1250.o
+obj-$(CONFIG_SIBYTE_BCM112X)    += fixup-sb1250.o pci-sb1250.o
 obj-$(CONFIG_SIBYTE_BCM1x80)    += pci-bcm1480.o pci-bcm1480ht.o
 obj-$(CONFIG_SNI_RM200_PCI)     += fixup-sni.o ops-sni.o
 obj-$(CONFIG_TANBAC_TB0219)     += fixup-tb0219.o
diff --git a/arch/mips/pci/fixup-cobalt.c b/arch/mips/pci/fixup-cobalt.c
index 909292f50d06..75a01e764898 100644
--- a/arch/mips/pci/fixup-cobalt.c
+++ b/arch/mips/pci/fixup-cobalt.c
@@ -17,7 +17,7 @@
 #include <asm/io.h>
 #include <asm/gt64120.h>
 
-#include <asm/cobalt/cobalt.h>
+#include <asm/mach-cobalt/cobalt.h>
 
 extern int cobalt_board_id;
 
@@ -52,7 +52,7 @@ static void qube_raq_via_bmIDE_fixup(struct pci_dev *dev)
         pci_read_config_byte(dev, PCI_LATENCY_TIMER, &lt);
         if (lt < 64)
                 pci_write_config_byte(dev, PCI_LATENCY_TIMER, 64);
-        pci_write_config_byte(dev, PCI_CACHE_LINE_SIZE, 7);
+        pci_write_config_byte(dev, PCI_CACHE_LINE_SIZE, 8);
 }
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_1,
@@ -69,7 +69,7 @@ static void qube_raq_galileo_fixup(struct pci_dev *dev)
          * host bridge.
          */
         pci_write_config_byte(dev, PCI_LATENCY_TIMER, 64);
-        pci_write_config_byte(dev, PCI_CACHE_LINE_SIZE, 7);
+        pci_write_config_byte(dev, PCI_CACHE_LINE_SIZE, 8);
 
         /*
          * The code described by the comment below has been removed
diff --git a/arch/mips/pci/ops-gt64111.c b/arch/mips/pci/ops-gt64111.c
index c1807934768d..13de45940b19 100644
--- a/arch/mips/pci/ops-gt64111.c
+++ b/arch/mips/pci/ops-gt64111.c
@@ -15,7 +15,7 @@
 #include <asm/io.h>
 #include <asm/gt64120.h>
 
-#include <asm/cobalt/cobalt.h>
+#include <asm/mach-cobalt/cobalt.h>
 
 /*
  * Device 31 on the GT64111 is used to generate PCI special
diff --git a/arch/mips/pci/pci-bcm1480.c b/arch/mips/pci/pci-bcm1480.c
index f194b4e4f86a..ca975e7d32ff 100644
--- a/arch/mips/pci/pci-bcm1480.c
+++ b/arch/mips/pci/pci-bcm1480.c
@@ -234,11 +234,9 @@ static int __init bcm1480_pcibios_init(void)
 
         /* turn on ExpMemEn */
         cmdreg = READCFG32(CFGOFFSET(0, PCI_DEVFN(PCI_BRIDGE_DEVICE, 0), 0x40));
-        printk("PCIFeatureCtrl = %x\n", cmdreg);
         WRITECFG32(CFGOFFSET(0, PCI_DEVFN(PCI_BRIDGE_DEVICE, 0), 0x40),
                         cmdreg | 0x10);
         cmdreg = READCFG32(CFGOFFSET(0, PCI_DEVFN(PCI_BRIDGE_DEVICE, 0), 0x40));
-        printk("PCIFeatureCtrl = %x\n", cmdreg);
 
         /*
          * Establish mappings in KSEG2 (kernel virtual) to PCI I/O
diff --git a/arch/mips/pci/pci-ocelot-c.c b/arch/mips/pci/pci-ocelot-c.c
index 1d84d36e034d..027759f7c904 100644
--- a/arch/mips/pci/pci-ocelot-c.c
+++ b/arch/mips/pci/pci-ocelot-c.c
@@ -3,15 +3,17 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2004 by Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 2004, 06 by Ralf Baechle (ralf@linux-mips.org)
  */
 
 #include <linux/types.h>
 #include <linux/pci.h>
-#include <asm/mv64340.h>
+#include <linux/mv643xx.h>
 
 #include <linux/init.h>
 
+#include <asm/marvell.h>
+
 /*
  * We assume the address ranges have already been setup appropriately by
  * the firmware.  PMON in case of the Ocelot C does that.
diff --git a/arch/mips/philips/pnx8550/common/platform.c b/arch/mips/philips/pnx8550/common/platform.c
index 8aa9bd65b45e..a592260fd673 100644
--- a/arch/mips/philips/pnx8550/common/platform.c
+++ b/arch/mips/philips/pnx8550/common/platform.c
@@ -66,28 +66,28 @@ struct ip3106_port ip3106_ports[] = {
         [0] = {
                 .port   = {
                         .type           = PORT_IP3106,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .membase        = (void __iomem *)PNX8550_UART_PORT0,
                         .mapbase        = PNX8550_UART_PORT0,
                         .irq            = PNX8550_UART_INT(0),
                         .uartclk        = 3692300,
                         .fifosize       = 16,
                         .ops            = &ip3106_pops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 0,
                 },
         },
         [1] = {
                 .port   = {
                         .type           = PORT_IP3106,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .membase        = (void __iomem *)PNX8550_UART_PORT1,
                         .mapbase        = PNX8550_UART_PORT1,
                         .irq            = PNX8550_UART_INT(1),
                         .uartclk        = 3692300,
                         .fifosize       = 16,
                         .ops            = &ip3106_pops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 1,
                 },
         },
diff --git a/arch/mips/philips/pnx8550/common/setup.c b/arch/mips/philips/pnx8550/common/setup.c
index ee6bf72094f6..0d8a77619391 100644
--- a/arch/mips/philips/pnx8550/common/setup.c
+++ b/arch/mips/philips/pnx8550/common/setup.c
@@ -25,6 +25,7 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/serial_ip3106.h>
+#include <linux/pm.h>
 
 #include <asm/cpu.h>
 #include <asm/bootinfo.h>
@@ -90,7 +91,7 @@ void __init plat_setup(void)
 
         _machine_restart = pnx8550_machine_restart;
         _machine_halt = pnx8550_machine_halt;
-        _machine_power_off = pnx8550_machine_power_off;
+        pm_power_off = pnx8550_machine_power_off;
 
         board_time_init = pnx8550_time_init;
         board_timer_setup = pnx8550_timer_setup;
diff --git a/arch/mips/pmc-sierra/yosemite/prom.c b/arch/mips/pmc-sierra/yosemite/prom.c
index 555bfacf7647..165275c00cbb 100644
--- a/arch/mips/pmc-sierra/yosemite/prom.c
+++ b/arch/mips/pmc-sierra/yosemite/prom.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/delay.h>
+#include <linux/pm.h>
 #include <linux/smp.h>
 
 #include <asm/io.h>
@@ -92,7 +93,7 @@ void __init prom_init(void)
         /* Callbacks for halt, restart */
         _machine_restart = (void (*)(char *)) prom_exit;
         _machine_halt = prom_halt;
-        _machine_power_off = prom_halt;
+        pm_power_off = prom_halt;
 
         debug_vectors = cv;
         arcs_cmdline[0] = '\0';
diff --git a/arch/mips/pmc-sierra/yosemite/setup.c b/arch/mips/pmc-sierra/yosemite/setup.c
index 059755b5ed57..8bce711575de 100644
--- a/arch/mips/pmc-sierra/yosemite/setup.c
+++ b/arch/mips/pmc-sierra/yosemite/setup.c
@@ -185,7 +185,7 @@ static void __init py_uart_setup(void)
         up.uartclk      = TITAN_UART_CLK;
         up.regshift     = 0;
         up.iotype       = UPIO_MEM;
-        up.flags        = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        up.flags        = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         up.line         = 0;
 
         if (early_serial_setup(&up))
diff --git a/arch/mips/pmc-sierra/yosemite/smp.c b/arch/mips/pmc-sierra/yosemite/smp.c
index f17f575f58f0..c197311e15d3 100644
--- a/arch/mips/pmc-sierra/yosemite/smp.c
+++ b/arch/mips/pmc-sierra/yosemite/smp.c
@@ -50,37 +50,25 @@ void __init prom_grab_secondary(void)
  * We don't want to start the secondary CPU yet nor do we have a nice probing
  * feature in PMON so we just assume presence of the secondary core.
  */
-static char maxcpus_string[] __initdata =
-        KERN_WARNING "max_cpus set to 0; using 1 instead\n";
-
-void __init prom_prepare_cpus(unsigned int max_cpus)
+void __init plat_smp_setup(void)
 {
-        int enabled = 0, i;
-
-        if (max_cpus == 0) {
-                printk(maxcpus_string);
-                max_cpus = 1;
-        }
+        int i;
 
         cpus_clear(phys_cpu_present_map);
 
         for (i = 0; i < 2; i++) {
-                if (i == max_cpus)
-                        break;
-
-                /*
-                 * The boot CPU
-                 */
                 cpu_set(i, phys_cpu_present_map);
                 __cpu_number_map[i]     = i;
                 __cpu_logical_map[i]    = i;
-                enabled++;
         }
+}
 
+void __init plat_prepare_cpus(unsigned int max_cpus)
+{
         /*
          * Be paranoid.  Enable the IPI only if we're really about to go SMP.
          */
-        if (enabled > 1)
+        if (cpus_weight(cpu_possible_map))
                 set_c0_status(STATUSF_IP5);
 }
 
@@ -94,7 +82,7 @@ void __init prom_prepare_cpus(unsigned int max_cpus)
 void prom_boot_secondary(int cpu, struct task_struct *idle)
 {
         unsigned long gp = (unsigned long) task_thread_info(idle);
-        unsigned long sp = __KSTK_TOP(idle);
+        unsigned long sp = __KSTK_TOS(idle);
 
         secondary_sp = sp;
         secondary_gp = gp;
diff --git a/arch/mips/sgi-ip22/ip22-reset.c b/arch/mips/sgi-ip22/ip22-reset.c
index 214ffd2e98a3..92a3b3c15ed3 100644
--- a/arch/mips/sgi-ip22/ip22-reset.c
+++ b/arch/mips/sgi-ip22/ip22-reset.c
@@ -3,8 +3,9 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1997, 1998, 2001, 2003 by Ralf Baechle
+ * Copyright (C) 1997, 1998, 2001, 03, 05, 06 by Ralf Baechle
  */
+#include <linux/linkage.h>
 #include <linux/init.h>
 #include <linux/ds1286.h>
 #include <linux/module.h>
@@ -12,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/notifier.h>
+#include <linux/pm.h>
 #include <linux/timer.h>
 
 #include <asm/io.h>
@@ -41,28 +43,10 @@ static struct timer_list power_timer, blink_timer, debounce_timer, volume_timer;
 
 #define MACHINE_PANICED         1
 #define MACHINE_SHUTTING_DOWN   2
-static int machine_state = 0;
 
-static void sgi_machine_restart(char *command) __attribute__((noreturn));
-static void sgi_machine_halt(void) __attribute__((noreturn));
-static void sgi_machine_power_off(void) __attribute__((noreturn));
+static int machine_state;
 
-static void sgi_machine_restart(char *command)
-{
-        if (machine_state & MACHINE_SHUTTING_DOWN)
-                sgi_machine_power_off();
-        sgimc->cpuctrl0 |= SGIMC_CCTRL0_SYSINIT;
-        while (1);
-}
-
-static void sgi_machine_halt(void)
-{
-        if (machine_state & MACHINE_SHUTTING_DOWN)
-                sgi_machine_power_off();
-        ArcEnterInteractiveMode();
-}
-
-static void sgi_machine_power_off(void)
+static void ATTRIB_NORET sgi_machine_power_off(void)
 {
         unsigned int tmp;
 
@@ -84,6 +68,21 @@ static void sgi_machine_power_off(void)
         }
 }
 
+static void ATTRIB_NORET sgi_machine_restart(char *command)
+{
+        if (machine_state & MACHINE_SHUTTING_DOWN)
+                sgi_machine_power_off();
+        sgimc->cpuctrl0 |= SGIMC_CCTRL0_SYSINIT;
+        while (1);
+}
+
+static void ATTRIB_NORET sgi_machine_halt(void)
+{
+        if (machine_state & MACHINE_SHUTTING_DOWN)
+                sgi_machine_power_off();
+        ArcEnterInteractiveMode();
+}
+
 static void power_timeout(unsigned long data)
 {
         sgi_machine_power_off();
@@ -95,7 +94,7 @@ static void blink_timeout(unsigned long data)
         sgi_ioc_reset ^= (SGIOC_RESET_LC0OFF|SGIOC_RESET_LC1OFF);
         sgioc->reset = sgi_ioc_reset;
 
-        mod_timer(&blink_timer, jiffies+data);
+        mod_timer(&blink_timer, jiffies + data);
 }
 
 static void debounce(unsigned long data)
@@ -103,7 +102,7 @@ static void debounce(unsigned long data)
         del_timer(&debounce_timer);
         if (sgint->istat1 & SGINT_ISTAT1_PWR) {
                 /* Interrupt still being sent. */
-                debounce_timer.expires = jiffies + 5; /* 0.05s  */
+                debounce_timer.expires = jiffies + (HZ / 20); /* 0.05s  */
                 add_timer(&debounce_timer);
 
                 sgioc->panel = SGIOC_PANEL_POWERON | SGIOC_PANEL_POWERINTR |
@@ -151,7 +150,7 @@ static inline void volume_up_button(unsigned long data)
                 indy_volume_button(1);
 
         if (sgint->istat1 & SGINT_ISTAT1_PWR) {
-                volume_timer.expires = jiffies + 1;
+                volume_timer.expires = jiffies + (HZ / 100);
                 add_timer(&volume_timer);
         }
 }
@@ -164,7 +163,7 @@ static inline void volume_down_button(unsigned long data)
                 indy_volume_button(-1);
 
         if (sgint->istat1 & SGINT_ISTAT1_PWR) {
-                volume_timer.expires = jiffies + 1;
+                volume_timer.expires = jiffies + (HZ / 100);
                 add_timer(&volume_timer);
         }
 }
@@ -199,14 +198,14 @@ static irqreturn_t panel_int(int irq, void *dev_id, struct pt_regs *regs)
         if (!(buttons & SGIOC_PANEL_VOLUPINTR)) {
                 init_timer(&volume_timer);
                 volume_timer.function = volume_up_button;
-                volume_timer.expires = jiffies + 1;
+                volume_timer.expires = jiffies + (HZ / 100);
                 add_timer(&volume_timer);
         }
         /* Volume down button was pressed */
         if (!(buttons & SGIOC_PANEL_VOLDNINTR)) {
                 init_timer(&volume_timer);
                 volume_timer.function = volume_down_button;
-                volume_timer.expires = jiffies + 1;
+                volume_timer.expires = jiffies + (HZ / 100);
                 add_timer(&volume_timer);
         }
 
@@ -234,7 +233,7 @@ static int __init reboot_setup(void)
 {
         _machine_restart = sgi_machine_restart;
         _machine_halt = sgi_machine_halt;
-        _machine_power_off = sgi_machine_power_off;
+        pm_power_off = sgi_machine_power_off;
 
         request_irq(SGI_PANEL_IRQ, panel_int, 0, "Front Panel", NULL);
         init_timer(&blink_timer);
diff --git a/arch/mips/sgi-ip22/ip22-setup.c b/arch/mips/sgi-ip22/ip22-setup.c
index 5e59b4c8876b..7018e1833e85 100644
--- a/arch/mips/sgi-ip22/ip22-setup.c
+++ b/arch/mips/sgi-ip22/ip22-setup.c
@@ -56,6 +56,7 @@ extern void ip22_time_init(void) __init;
 void __init plat_setup(void)
 {
         char *ctype;
+        char *cserial;
 
         board_be_init = ip22_be_init;
         ip22_time_init();
@@ -81,9 +82,14 @@ void __init plat_setup(void)
         /* ARCS console environment variable is set to "g?" for
          * graphics console, it is set to "d" for the first serial
          * line and "d2" for the second serial line.
+         *
+         * Need to check if the case is 'g' but no keyboard:
+         * (ConsoleIn/Out = serial)
          */
         ctype = ArcGetEnvironmentVariable("console");
-        if (ctype && *ctype == 'd') {
+        cserial = ArcGetEnvironmentVariable("ConsoleOut");
+
+        if ((ctype && *ctype == 'd') || (cserial && *cserial == 's')) {
                 static char options[8];
                 char *baud = ArcGetEnvironmentVariable("dbaud");
                 if (baud)
@@ -91,7 +97,7 @@ void __init plat_setup(void)
                 add_preferred_console("ttyS", *(ctype + 1) == '2' ? 1 : 0,
                                       baud ? options : NULL);
         } else if (!ctype || *ctype != 'g') {
-                /* Use ARC if we don't want serial ('d') or Newport ('g'). */
+                /* Use ARC if we don't want serial ('d') or graphics ('g'). */
                 prom_flags |= PROM_FLAG_USE_AS_CONSOLE;
                 add_preferred_console("arc", 0, NULL);
         }
diff --git a/arch/mips/sgi-ip27/ip27-reset.c b/arch/mips/sgi-ip27/ip27-reset.c
index 2e16be94c78b..4322db57d3c1 100644
--- a/arch/mips/sgi-ip27/ip27-reset.c
+++ b/arch/mips/sgi-ip27/ip27-reset.c
@@ -5,7 +5,7 @@
  *
  * Reset an IP27.
  *
- * Copyright (C) 1997, 1998, 1999, 2000 by Ralf Baechle
+ * Copyright (C) 1997, 1998, 1999, 2000, 06 by Ralf Baechle
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  */
 #include <linux/config.h>
@@ -15,6 +15,7 @@
 #include <linux/smp.h>
 #include <linux/mmzone.h>
 #include <linux/nodemask.h>
+#include <linux/pm.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -77,5 +78,5 @@ void ip27_reboot_setup(void)
 {
         _machine_restart = ip27_machine_restart;
         _machine_halt = ip27_machine_halt;
-        _machine_power_off = ip27_machine_power_off;
+        pm_power_off = ip27_machine_power_off;
 }
diff --git a/arch/mips/sgi-ip27/ip27-smp.c b/arch/mips/sgi-ip27/ip27-smp.c
index dbef3f6b5650..09fa7f5216f0 100644
--- a/arch/mips/sgi-ip27/ip27-smp.c
+++ b/arch/mips/sgi-ip27/ip27-smp.c
@@ -140,7 +140,7 @@ static __init void intr_clear_all(nasid_t nasid)
                 REMOTE_HUB_CLR_INTR(nasid, i);
 }
 
-void __init prom_prepare_cpus(unsigned int max_cpus)
+void __init plat_smp_setup(void)
 {
         cnodeid_t       cnode;
 
@@ -161,6 +161,11 @@ void __init prom_prepare_cpus(unsigned int max_cpus)
         alloc_cpupda(0, 0);
 }
 
+void __init plat_prepare_cpus(unsigned int max_cpus)
+{
+        /* We already did everything necessary earlier */
+}
+
 /*
  * Launch a slave into smp_bootstrap().  It doesn't take an argument, and we
  * set sp to the kernel stack of the newly created idle process, gp to the proc
diff --git a/arch/mips/sgi-ip32/ip32-reset.c b/arch/mips/sgi-ip32/ip32-reset.c
index 88e1f52059ff..0c948008b023 100644
--- a/arch/mips/sgi-ip32/ip32-reset.c
+++ b/arch/mips/sgi-ip32/ip32-reset.c
@@ -15,6 +15,7 @@
 #include <linux/delay.h>
 #include <linux/ds17287rtc.h>
 #include <linux/interrupt.h>
+#include <linux/pm.h>
 
 #include <asm/addrspace.h>
 #include <asm/irq.h>
@@ -188,7 +189,7 @@ static __init int ip32_reboot_setup(void)
 
         _machine_restart = ip32_machine_restart;
         _machine_halt = ip32_machine_halt;
-        _machine_power_off = ip32_machine_power_off;
+        pm_power_off = ip32_machine_power_off;
 
         init_timer(&blink_timer);
         blink_timer.function = blink_timeout;
diff --git a/arch/mips/sgi-ip32/ip32-setup.c b/arch/mips/sgi-ip32/ip32-setup.c
index d10a269aeae1..2c38770b1e1b 100644
--- a/arch/mips/sgi-ip32/ip32-setup.c
+++ b/arch/mips/sgi-ip32/ip32-setup.c
@@ -66,11 +66,6 @@ static inline void str2eaddr(unsigned char *ea, unsigned char *str)
 #include <linux/tty.h>
 #include <linux/serial.h>
 #include <linux/serial_core.h>
-extern int early_serial_setup(struct uart_port *port);
-
-#define STD_COM_FLAGS (ASYNC_SKIP_TEST)
-#define BASE_BAUD (1843200 / 16)
-
 #endif /* CONFIG_SERIAL_8250 */
 
 /* An arbitrary time; this can be decreased if reliability looks good */
@@ -110,8 +105,8 @@ void __init plat_setup(void)
                 o2_serial[0].type       = PORT_16550A;
                 o2_serial[0].line       = 0;
                 o2_serial[0].irq        = MACEISA_SERIAL1_IRQ;
-                o2_serial[0].flags      = STD_COM_FLAGS;
-                o2_serial[0].uartclk    = BASE_BAUD * 16;
+                o2_serial[0].flags      = UPF_SKIP_TEST;
+                o2_serial[0].uartclk    = 1843200;
                 o2_serial[0].iotype     = UPIO_MEM;
                 o2_serial[0].membase    = (char *)&mace->isa.serial1;
                 o2_serial[0].fifosize   = 14;
@@ -121,8 +116,8 @@ void __init plat_setup(void)
                 o2_serial[1].type       = PORT_16550A;
                 o2_serial[1].line       = 1;
                 o2_serial[1].irq        = MACEISA_SERIAL2_IRQ;
-                o2_serial[1].flags      = STD_COM_FLAGS;
-                o2_serial[1].uartclk    = BASE_BAUD * 16;
+                o2_serial[1].flags      = UPF_SKIP_TEST;
+                o2_serial[1].uartclk    = 1843200;
                 o2_serial[1].iotype     = UPIO_MEM;
                 o2_serial[1].membase    = (char *)&mace->isa.serial2;
                 o2_serial[1].fifosize   = 14;
diff --git a/arch/mips/sibyte/Kconfig b/arch/mips/sibyte/Kconfig
index de46f62ac462..816aee7fcd25 100644
--- a/arch/mips/sibyte/Kconfig
+++ b/arch/mips/sibyte/Kconfig
@@ -102,11 +102,11 @@ config SIMULATION
           Build a kernel suitable for running under the GDB simulator.
           Primarily adjusts the kernel's notion of time.
 
-config CONFIG_SB1_CEX_ALWAYS_FATAL
+config SB1_CEX_ALWAYS_FATAL
         bool "All cache exceptions considered fatal (no recovery attempted)"
         depends on SIBYTE_SB1xxx_SOC
 
-config CONFIG_SB1_CERR_STALL
+config SB1_CERR_STALL
         bool "Stall (rather than panic) on fatal cache error"
         depends on SIBYTE_SB1xxx_SOC
 
diff --git a/arch/mips/sibyte/bcm1480/irq.c b/arch/mips/sibyte/bcm1480/irq.c
index b2a1ba5d23df..9cf7d713b13c 100644
--- a/arch/mips/sibyte/bcm1480/irq.c
+++ b/arch/mips/sibyte/bcm1480/irq.c
@@ -139,7 +139,7 @@ void bcm1480_unmask_irq(int cpu, int irq)
 #ifdef CONFIG_SMP
 static void bcm1480_set_affinity(unsigned int irq, cpumask_t mask)
 {
-        int i = 0, old_cpu, cpu, int_on;
+        int i = 0, old_cpu, cpu, int_on, k;
         u64 cur_ints;
         irq_desc_t *desc = irq_desc + irq;
         unsigned long flags;
@@ -165,7 +165,6 @@ static void bcm1480_set_affinity(unsigned int irq, cpumask_t mask)
                 irq_dirty -= BCM1480_NR_IRQS_HALF;
         }
 
-        int k;
         for (k=0; k<2; k++) { /* Loop through high and low interrupt mask register */
                 cur_ints = ____raw_readq(IOADDR(A_BCM1480_IMR_MAPPER(old_cpu) + R_BCM1480_IMR_INTERRUPT_MASK_H + (k*BCM1480_IMR_HL_SPACING)));
                 int_on = !(cur_ints & (((u64) 1) << irq_dirty));
@@ -216,6 +215,7 @@ static void ack_bcm1480_irq(unsigned int irq)
 {
         u64 pending;
         unsigned int irq_dirty;
+        int k;
 
         /*
          * If the interrupt was an HT interrupt, now is the time to
@@ -227,7 +227,6 @@ static void ack_bcm1480_irq(unsigned int irq)
         if ((irq_dirty >= BCM1480_NR_IRQS_HALF) && (irq_dirty <= BCM1480_NR_IRQS)) {
                 irq_dirty -= BCM1480_NR_IRQS_HALF;
         }
-        int k;
         for (k=0; k<2; k++) { /* Loop through high and low LDT interrupts */
                 pending = __raw_readq(IOADDR(A_BCM1480_IMR_REGISTER(bcm1480_irq_owner[irq],
                                                 R_BCM1480_IMR_LDT_INTERRUPT_H + (k*BCM1480_IMR_HL_SPACING))));
diff --git a/arch/mips/sibyte/cfe/setup.c b/arch/mips/sibyte/cfe/setup.c
index 7a2c7a8510d4..ea308029450e 100644
--- a/arch/mips/sibyte/cfe/setup.c
+++ b/arch/mips/sibyte/cfe/setup.c
@@ -23,6 +23,7 @@
 #include <linux/mm.h>
 #include <linux/blkdev.h>
 #include <linux/bootmem.h>
+#include <linux/pm.h>
 #include <linux/smp.h>
 
 #include <asm/bootinfo.h>
@@ -248,7 +249,7 @@ void __init prom_init(void)
 
         _machine_restart   = cfe_linux_restart;
         _machine_halt      = cfe_linux_halt;
-        _machine_power_off = cfe_linux_halt;
+        pm_power_off = cfe_linux_halt;
 
         /*
          * Check if a loader was used; if NOT, the 4 arguments are
diff --git a/arch/mips/sibyte/cfe/smp.c b/arch/mips/sibyte/cfe/smp.c
index 4477af3d8074..eab20e2db323 100644
--- a/arch/mips/sibyte/cfe/smp.c
+++ b/arch/mips/sibyte/cfe/smp.c
@@ -31,7 +31,7 @@
  *
  * Common setup before any secondaries are started
  */
-void __init prom_prepare_cpus(unsigned int max_cpus)
+void __init plat_smp_setup(void)
 {
         int i, num;
 
@@ -40,14 +40,18 @@ void __init prom_prepare_cpus(unsigned int max_cpus)
         __cpu_number_map[0] = 0;
         __cpu_logical_map[0] = 0;
 
-        for (i=1, num=0; i<NR_CPUS; i++) {
+        for (i = 1, num = 0; i < NR_CPUS; i++) {
                 if (cfe_cpu_stop(i) == 0) {
                         cpu_set(i, phys_cpu_present_map);
                         __cpu_number_map[i] = ++num;
                         __cpu_logical_map[num] = i;
                 }
         }
-        printk("Detected %i available secondary CPU(s)\n", num);
+        printk(KERN_INFO "Detected %i available secondary CPU(s)\n", num);
+}
+
+void __init plat_prepare_cpus(unsigned int max_cpus)
+{
 }
 
 /*
diff --git a/arch/mips/sibyte/sb1250/prom.c b/arch/mips/sibyte/sb1250/prom.c
index de62ab0f55a2..742043f8d755 100644
--- a/arch/mips/sibyte/sb1250/prom.c
+++ b/arch/mips/sibyte/sb1250/prom.c
@@ -24,6 +24,7 @@
 #include <linux/bootmem.h>
 #include <linux/smp.h>
 #include <linux/initrd.h>
+#include <linux/pm.h>
 
 #include <asm/bootinfo.h>
 #include <asm/reboot.h>
@@ -79,7 +80,7 @@ void __init prom_init(void)
 {
         _machine_restart   = (void (*)(char *))prom_linux_exit;
         _machine_halt      = prom_linux_exit;
-        _machine_power_off = prom_linux_exit;
+        pm_power_off = prom_linux_exit;
 
         strcpy(arcs_cmdline, "root=/dev/ram0 ");
 
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index df2e266c700c..fde4751c84fe 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -16,6 +16,7 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 #include <linux/config.h>
+#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/reboot.h>
 #include <linux/string.h>
@@ -42,7 +43,7 @@ static inline int setup_bcm112x(void);
 
 /* Setup code likely to be common to all SiByte platforms */
 
-static inline int sys_rev_decode(void)
+static int __init sys_rev_decode(void)
 {
         int ret = 0;
 
@@ -74,7 +75,7 @@ static inline int sys_rev_decode(void)
         return ret;
 }
 
-static inline int setup_bcm1250(void)
+static int __init setup_bcm1250(void)
 {
         int ret = 0;
 
@@ -120,7 +121,7 @@ static inline int setup_bcm1250(void)
         return ret;
 }
 
-static inline int setup_bcm112x(void)
+static int __init setup_bcm112x(void)
 {
         int ret = 0;
 
@@ -146,7 +147,7 @@ static inline int setup_bcm112x(void)
         return ret;
 }
 
-void sb1250_setup(void)
+void __init sb1250_setup(void)
 {
         uint64_t sys_rev;
         int plldiv;
@@ -169,31 +170,42 @@ void sb1250_setup(void)
                     soc_str, pass_str, zbbus_mhz * 2, sb1_pass);
         prom_printf("Board type: %s\n", get_system_type());
 
-        switch(war_pass) {
+        switch (war_pass) {
         case K_SYS_REVISION_BCM1250_PASS1:
 #ifndef CONFIG_SB1_PASS_1_WORKAROUNDS
-                prom_printf("@@@@ This is a BCM1250 A0-A2 (Pass 1) board, and the kernel doesn't have the proper workarounds compiled in. @@@@\n");
+                prom_printf("@@@@ This is a BCM1250 A0-A2 (Pass 1) board, "
+                            "and the kernel doesn't have the proper "
+                            "workarounds compiled in. @@@@\n");
                 bad_config = 1;
 #endif
                 break;
         case K_SYS_REVISION_BCM1250_PASS2:
                 /* Pass 2 - easiest as default for now - so many numbers */
-#if !defined(CONFIG_SB1_PASS_2_WORKAROUNDS) || !defined(CONFIG_SB1_PASS_2_1_WORKAROUNDS)
-                prom_printf("@@@@ This is a BCM1250 A3-A10 board, and the kernel doesn't have the proper workarounds compiled in. @@@@\n");
+#if !defined(CONFIG_SB1_PASS_2_WORKAROUNDS) || \
+    !defined(CONFIG_SB1_PASS_2_1_WORKAROUNDS)
+                prom_printf("@@@@ This is a BCM1250 A3-A10 board, and the "
+                            "kernel doesn't have the proper workarounds "
+                            "compiled in. @@@@\n");
                 bad_config = 1;
 #endif
 #ifdef CONFIG_CPU_HAS_PREFETCH
-                prom_printf("@@@@ Prefetches may be enabled in this kernel, but are buggy on this board.  @@@@\n");
+                prom_printf("@@@@ Prefetches may be enabled in this kernel, "
+                            "but are buggy on this board.  @@@@\n");
                 bad_config = 1;
 #endif
                 break;
         case K_SYS_REVISION_BCM1250_PASS2_2:
 #ifndef CONFIG_SB1_PASS_2_WORKAROUNDS
-                prom_printf("@@@@ This is a BCM1250 B1/B2. board, and the kernel doesn't have the proper workarounds compiled in. @@@@\n");
+                prom_printf("@@@@ This is a BCM1250 B1/B2. board, and the "
+                            "kernel doesn't have the proper workarounds "
+                            "compiled in. @@@@\n");
                 bad_config = 1;
 #endif
-#if defined(CONFIG_SB1_PASS_2_1_WORKAROUNDS) || !defined(CONFIG_CPU_HAS_PREFETCH)
-                prom_printf("@@@@ This is a BCM1250 B1/B2, but the kernel is conservatively configured for an 'A' stepping. @@@@\n");
+#if defined(CONFIG_SB1_PASS_2_1_WORKAROUNDS) || \
+    !defined(CONFIG_CPU_HAS_PREFETCH)
+                prom_printf("@@@@ This is a BCM1250 B1/B2, but the kernel is "
+                            "conservatively configured for an 'A' stepping. "
+                            "@@@@\n");
 #endif
                 break;
         default:
diff --git a/arch/mips/sibyte/sb1250/time.c b/arch/mips/sibyte/sb1250/time.c
index 511c89d65f38..1588f6debd90 100644
--- a/arch/mips/sibyte/sb1250/time.c
+++ b/arch/mips/sibyte/sb1250/time.c
@@ -47,23 +47,51 @@
 #define IMR_IP3_VAL     K_INT_MAP_I1
 #define IMR_IP4_VAL     K_INT_MAP_I2
 
+#define SB1250_HPT_NUM          3
+#define SB1250_HPT_VALUE        M_SCD_TIMER_CNT /* max value */
+#define SB1250_HPT_SHIFT        ((sizeof(unsigned int)*8)-V_SCD_TIMER_WIDTH)
+
+
 extern int sb1250_steal_irq(int irq);
 
+static unsigned int sb1250_hpt_read(void);
+static void sb1250_hpt_init(unsigned int);
+
+static unsigned int hpt_offset;
+
+void __init sb1250_hpt_setup(void)
+{
+        int cpu = smp_processor_id();
+
+        if (!cpu) {
+                /* Setup hpt using timer #3 but do not enable irq for it */
+                __raw_writeq(0, IOADDR(A_SCD_TIMER_REGISTER(SB1250_HPT_NUM, R_SCD_TIMER_CFG)));
+                __raw_writeq(SB1250_HPT_VALUE,
+                             IOADDR(A_SCD_TIMER_REGISTER(SB1250_HPT_NUM, R_SCD_TIMER_INIT)));
+                __raw_writeq(M_SCD_TIMER_ENABLE | M_SCD_TIMER_MODE_CONTINUOUS,
+                             IOADDR(A_SCD_TIMER_REGISTER(SB1250_HPT_NUM, R_SCD_TIMER_CFG)));
+
+                /*
+                 * we need to fill 32 bits, so just use the upper 23 bits and pretend
+                 * the timer is going 512Mhz instead of 1Mhz
+                 */
+                mips_hpt_frequency = V_SCD_TIMER_FREQ << SB1250_HPT_SHIFT;
+                mips_hpt_init = sb1250_hpt_init;
+                mips_hpt_read = sb1250_hpt_read;
+        }
+}
+
+
 void sb1250_time_init(void)
 {
         int cpu = smp_processor_id();
         int irq = K_INT_TIMER_0+cpu;
 
-        /* Only have 4 general purpose timers */
-        if (cpu > 3) {
+        /* Only have 4 general purpose timers, and we use last one as hpt */
+        if (cpu > 2) {
                 BUG();
         }
 
-        if (!cpu) {
-                /* Use our own gettimeoffset() routine */
-                do_gettimeoffset = sb1250_gettimeoffset;
-        }
-
         sb1250_mask_irq(cpu, irq);
 
         /* Map the timer interrupt to ip[4] of this cpu */
@@ -75,10 +103,10 @@ void sb1250_time_init(void)
         /* Disable the timer and set up the count */
         __raw_writeq(0, IOADDR(A_SCD_TIMER_REGISTER(cpu, R_SCD_TIMER_CFG)));
 #ifdef CONFIG_SIMULATION
-        __raw_writeq(50000 / HZ,
+        __raw_writeq((50000 / HZ) - 1,
                      IOADDR(A_SCD_TIMER_REGISTER(cpu, R_SCD_TIMER_INIT)));
 #else
-        __raw_writeq(1000000 / HZ,
+        __raw_writeq((V_SCD_TIMER_FREQ / HZ) - 1,
                      IOADDR(A_SCD_TIMER_REGISTER(cpu, R_SCD_TIMER_INIT)));
 #endif
 
@@ -103,7 +131,7 @@ void sb1250_timer_interrupt(struct pt_regs *regs)
         int cpu = smp_processor_id();
         int irq = K_INT_TIMER_0 + cpu;
 
-        /* Reset the timer */
+        /* ACK interrupt */
         ____raw_writeq(M_SCD_TIMER_ENABLE | M_SCD_TIMER_MODE_CONTINUOUS,
                        IOADDR(A_SCD_TIMER_REGISTER(cpu, R_SCD_TIMER_CFG)));
 
@@ -122,15 +150,26 @@ void sb1250_timer_interrupt(struct pt_regs *regs)
 }
 
 /*
- * We use our own do_gettimeoffset() instead of the generic one,
- * because the generic one does not work for SMP case.
- * In addition, since we use general timer 0 for system time,
- * we can get accurate intra-jiffy offset without calibration.
+ * The HPT is free running from SB1250_HPT_VALUE down to 0 then starts over
+ * again. There's no easy way to set to a specific value so store init value
+ * in hpt_offset and subtract each time.
+ *
+ * Note: Timer isn't full 32bits so shift it into the upper part making
+ *       it appear to run at a higher frequency.
  */
-unsigned long sb1250_gettimeoffset(void)
+static unsigned int sb1250_hpt_read(void)
 {
-        unsigned long count =
-                __raw_readq(IOADDR(A_SCD_TIMER_REGISTER(0, R_SCD_TIMER_CNT)));
+        unsigned int count;
 
-        return 1000000/HZ - count;
- }
+        count = G_SCD_TIMER_CNT(__raw_readq(IOADDR(A_SCD_TIMER_REGISTER(SB1250_HPT_NUM, R_SCD_TIMER_CNT))));
+
+        count = (SB1250_HPT_VALUE - count) << SB1250_HPT_SHIFT;
+
+        return count - hpt_offset;
+}
+
+static void sb1250_hpt_init(unsigned int count)
+{
+        hpt_offset = count;
+        return;
+}
diff --git a/arch/mips/sibyte/swarm/setup.c b/arch/mips/sibyte/swarm/setup.c
index b614ca0ddb69..b661d2425a36 100644
--- a/arch/mips/sibyte/swarm/setup.c
+++ b/arch/mips/sibyte/swarm/setup.c
@@ -70,6 +70,12 @@ const char *get_system_type(void)
         return "SiByte " SIBYTE_BOARD_NAME;
 }
 
+void __init swarm_time_init(void)
+{
+        /* Setup HPT */
+        sb1250_hpt_setup();
+}
+
 void __init swarm_timer_setup(struct irqaction *irq)
 {
         /*
@@ -109,6 +115,7 @@ void __init plat_setup(void)
 
         panic_timeout = 5;  /* For debug.  */
 
+        board_time_init = swarm_time_init;
         board_timer_setup = swarm_timer_setup;
         board_be_handler = swarm_be_handler;
 
diff --git a/arch/mips/sni/setup.c b/arch/mips/sni/setup.c
index 262c85680709..1141fcd13a59 100644
--- a/arch/mips/sni/setup.c
+++ b/arch/mips/sni/setup.c
@@ -5,7 +5,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1996, 97, 98, 2000, 03, 04 Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (C) 1996, 97, 98, 2000, 03, 04, 06 Ralf Baechle (ralf@linux-mips.org)
  */
 #include <linux/config.h>
 #include <linux/eisa.h>
@@ -15,6 +15,7 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/mc146818rtc.h>
+#include <linux/pm.h>
 #include <linux/pci.h>
 #include <linux/console.h>
 #include <linux/fb.h>
@@ -189,7 +190,7 @@ void __init plat_setup(void)
 
         _machine_restart = sni_machine_restart;
         _machine_halt = sni_machine_halt;
-        _machine_power_off = sni_machine_power_off;
+        pm_power_off = sni_machine_power_off;
 
         sni_display_setup();
 
diff --git a/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_prom.c b/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_prom.c
index e4d095d3e192..e19e2be70f76 100644
--- a/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_prom.c
+++ b/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_prom.c
@@ -60,7 +60,6 @@ void __init prom_init_cmdline(void)
 
 void __init prom_init(void)
 {
-        const char* toshiba_name_list[] = GROUP_TOSHIBA_NAMES;
         extern int tx4927_get_mem_size(void);
         extern char* toshiba_name;
         int msize;
@@ -69,12 +68,13 @@ void __init prom_init(void)
 
         mips_machgroup = MACH_GROUP_TOSHIBA;
 
-        if ((read_c0_prid() & 0xff) == PRID_REV_TX4927)
+        if ((read_c0_prid() & 0xff) == PRID_REV_TX4927) {
                 mips_machtype = MACH_TOSHIBA_RBTX4927;
-        else
+                toshiba_name  = "TX4927";
+        } else {
                 mips_machtype = MACH_TOSHIBA_RBTX4937;
-
-        toshiba_name = toshiba_name_list[mips_machtype];
+                toshiba_name  = "TX4937";
+        }
 
         msize = tx4927_get_mem_size();
         add_memory_region(0, msize << 20, BOOT_MEM_RAM);
diff --git a/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_setup.c b/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_setup.c
index 990fcb294bab..2ad6401d2af4 100644
--- a/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_setup.c
+++ b/arch/mips/tx4927/toshiba_rbtx4927/toshiba_rbtx4927_setup.c
@@ -53,6 +53,8 @@
 #include <linux/interrupt.h>
 #include <linux/pci.h>
 #include <linux/timex.h>
+#include <linux/pm.h>
+
 #include <asm/bootinfo.h>
 #include <asm/page.h>
 #include <asm/io.h>
@@ -537,19 +539,10 @@ void tx4927_pci_setup(void)
         TOSHIBA_RBTX4927_SETUP_DPRINTK(TOSHIBA_RBTX4927_SETUP_PCI2,
                                        "0x%08lx=mips_io_port_base",
                                        mips_io_port_base);
-
-        TOSHIBA_RBTX4927_SETUP_DPRINTK(TOSHIBA_RBTX4927_SETUP_PCI2,
-                                       "setup pci_io_resource  to 0x%08lx 0x%08lx\n",
-                                       pci_io_resource.start,
-                                       pci_io_resource.end);
-        TOSHIBA_RBTX4927_SETUP_DPRINTK(TOSHIBA_RBTX4927_SETUP_PCI2,
-                                       "setup pci_mem_resource to 0x%08lx 0x%08lx\n",
-                                       pci_mem_resource.start,
-                                       pci_mem_resource.end);
-
         if (!called) {
                 printk
-                    ("TX4927 PCIC -- DID:%04x VID:%04x RID:%02x Arbiter:%s\n",
+                    ("%s PCIC -- DID:%04x VID:%04x RID:%02x Arbiter:%s\n",
+                     toshiba_name,
                      (unsigned short) (tx4927_pcicptr->pciid >> 16),
                      (unsigned short) (tx4927_pcicptr->pciid & 0xffff),
                      (unsigned short) (tx4927_pcicptr->pciccrev & 0xff),
@@ -562,21 +555,52 @@ void tx4927_pci_setup(void)
                (tx4927_ccfgptr->ccfg & TX4927_CCFG_PCI66) ? " PCI66" : "");
         if (tx4927_ccfgptr->pcfg & TX4927_PCFG_PCICLKEN_ALL) {
                 int pciclk = 0;
-                switch ((unsigned long) tx4927_ccfgptr->
-                        ccfg & TX4927_CCFG_PCIDIVMODE_MASK) {
-                case TX4927_CCFG_PCIDIVMODE_2_5:
-                        pciclk = tx4927_cpu_clock * 2 / 5;
-                        break;
-                case TX4927_CCFG_PCIDIVMODE_3:
-                        pciclk = tx4927_cpu_clock / 3;
-                        break;
-                case TX4927_CCFG_PCIDIVMODE_5:
-                        pciclk = tx4927_cpu_clock / 5;
-                        break;
-                case TX4927_CCFG_PCIDIVMODE_6:
-                        pciclk = tx4927_cpu_clock / 6;
-                        break;
-                }
+                if (mips_machtype == MACH_TOSHIBA_RBTX4937)
+                        switch ((unsigned long) tx4927_ccfgptr->
+                                ccfg & TX4937_CCFG_PCIDIVMODE_MASK) {
+                        case TX4937_CCFG_PCIDIVMODE_4:
+                                pciclk = tx4927_cpu_clock / 4;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_4_5:
+                                pciclk = tx4927_cpu_clock * 2 / 9;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_5:
+                                pciclk = tx4927_cpu_clock / 5;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_5_5:
+                                pciclk = tx4927_cpu_clock * 2 / 11;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_8:
+                                pciclk = tx4927_cpu_clock / 8;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_9:
+                                pciclk = tx4927_cpu_clock / 9;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_10:
+                                pciclk = tx4927_cpu_clock / 10;
+                                break;
+                        case TX4937_CCFG_PCIDIVMODE_11:
+                                pciclk = tx4927_cpu_clock / 11;
+                                break;
+                        }
+
+                else
+                        switch ((unsigned long) tx4927_ccfgptr->
+                                ccfg & TX4927_CCFG_PCIDIVMODE_MASK) {
+                        case TX4927_CCFG_PCIDIVMODE_2_5:
+                                pciclk = tx4927_cpu_clock * 2 / 5;
+                                break;
+                        case TX4927_CCFG_PCIDIVMODE_3:
+                                pciclk = tx4927_cpu_clock / 3;
+                                break;
+                        case TX4927_CCFG_PCIDIVMODE_5:
+                                pciclk = tx4927_cpu_clock / 5;
+                                break;
+                        case TX4927_CCFG_PCIDIVMODE_6:
+                                pciclk = tx4927_cpu_clock / 6;
+                                break;
+                        }
+
                 printk("Internal(%dMHz)", pciclk / 1000000);
         } else {
                 int pciclk = 0;
@@ -814,24 +838,40 @@ void __init toshiba_rbtx4927_setup(void)
                                        ":ResetRoutines\n");
         _machine_restart = toshiba_rbtx4927_restart;
         _machine_halt = toshiba_rbtx4927_halt;
-        _machine_power_off = toshiba_rbtx4927_power_off;
+        pm_power_off = toshiba_rbtx4927_power_off;
 
 #ifdef CONFIG_PCI
 
         /* PCIC */
         /*
            * ASSUMPTION: PCIDIVMODE is configured for PCI 33MHz or 66MHz.
-           * PCIDIVMODE[12:11]'s initial value are given by S9[4:3] (ON:0, OFF:1).
+           *
+           * For TX4927:
+           * PCIDIVMODE[12:11]'s initial value is given by S9[4:3] (ON:0, OFF:1).
            * CPU 166MHz: PCI 66MHz : PCIDIVMODE: 00 (1/2.5)
            * CPU 200MHz: PCI 66MHz : PCIDIVMODE: 01 (1/3)
            * CPU 166MHz: PCI 33MHz : PCIDIVMODE: 10 (1/5)
            * CPU 200MHz: PCI 33MHz : PCIDIVMODE: 11 (1/6)
            * i.e. S9[3]: ON (83MHz), OFF (100MHz)
+           *
+           * For TX4937:
+           * PCIDIVMODE[12:11]'s initial value is given by S1[5:4] (ON:0, OFF:1)
+           * PCIDIVMODE[10] is 0.
+           * CPU 266MHz: PCI 33MHz : PCIDIVMODE: 000 (1/8)
+           * CPU 266MHz: PCI 66MHz : PCIDIVMODE: 001 (1/4)
+           * CPU 300MHz: PCI 33MHz : PCIDIVMODE: 010 (1/9)
+           * CPU 300MHz: PCI 66MHz : PCIDIVMODE: 011 (1/4.5)
+           * CPU 333MHz: PCI 33MHz : PCIDIVMODE: 100 (1/10)
+           * CPU 333MHz: PCI 66MHz : PCIDIVMODE: 101 (1/5)
+           *
          */
         TOSHIBA_RBTX4927_SETUP_DPRINTK(TOSHIBA_RBTX4927_SETUP_PCI1,
-                                       "ccfg is %lx, DIV is %x\n",
-                                       (unsigned long) tx4927_ccfgptr->
-                                       ccfg, TX4927_CCFG_PCIDIVMODE_MASK);
+                                       "ccfg is %lx, PCIDIVMODE is %x\n",
+                                       (unsigned long) tx4927_ccfgptr->ccfg,
+                                       (unsigned long) tx4927_ccfgptr->ccfg &
+                                       (mips_machtype == MACH_TOSHIBA_RBTX4937 ?
+                                        TX4937_CCFG_PCIDIVMODE_MASK :
+                                        TX4927_CCFG_PCIDIVMODE_MASK));
 
         TOSHIBA_RBTX4927_SETUP_DPRINTK(TOSHIBA_RBTX4927_SETUP_PCI1,
                                        "PCI66 mode is %lx, PCI mode is %lx, pci arb is %lx\n",
@@ -842,20 +882,30 @@ void __init toshiba_rbtx4927_setup(void)
                                        (unsigned long) tx4927_ccfgptr->
                                        ccfg & TX4927_CCFG_PCIXARB);
 
-        TOSHIBA_RBTX4927_SETUP_DPRINTK(TOSHIBA_RBTX4927_SETUP_PCI1,
-                                       "PCIDIVMODE is %lx\n",
-                                       (unsigned long) tx4927_ccfgptr->
-                                       ccfg & TX4927_CCFG_PCIDIVMODE_MASK);
-
-        switch ((unsigned long) tx4927_ccfgptr->
-                ccfg & TX4927_CCFG_PCIDIVMODE_MASK) {
-        case TX4927_CCFG_PCIDIVMODE_2_5:
-        case TX4927_CCFG_PCIDIVMODE_5:
-                tx4927_cpu_clock = 166000000;   /* 166MHz */
-                break;
-        default:
-                tx4927_cpu_clock = 200000000;   /* 200MHz */
-        }
+        if (mips_machtype == MACH_TOSHIBA_RBTX4937)
+                switch ((unsigned long)tx4927_ccfgptr->
+                        ccfg & TX4937_CCFG_PCIDIVMODE_MASK) {
+                case TX4937_CCFG_PCIDIVMODE_8:
+                case TX4937_CCFG_PCIDIVMODE_4:
+                        tx4927_cpu_clock = 266666666;   /* 266MHz */
+                        break;
+                case TX4937_CCFG_PCIDIVMODE_9:
+                case TX4937_CCFG_PCIDIVMODE_4_5:
+                        tx4927_cpu_clock = 300000000;   /* 300MHz */
+                        break;
+                default:
+                        tx4927_cpu_clock = 333333333;   /* 333MHz */
+                }
+        else
+                switch ((unsigned long)tx4927_ccfgptr->
+                        ccfg & TX4927_CCFG_PCIDIVMODE_MASK) {
+                case TX4927_CCFG_PCIDIVMODE_2_5:
+                case TX4927_CCFG_PCIDIVMODE_5:
+                        tx4927_cpu_clock = 166666666;   /* 166MHz */
+                        break;
+                default:
+                        tx4927_cpu_clock = 200000000;   /* 200MHz */
+                }
 
         /* CCFG */
         /* enable Timeout BusError */
diff --git a/arch/mips/tx4938/toshiba_rbtx4938/setup.c b/arch/mips/tx4938/toshiba_rbtx4938/setup.c
index 9f1dcc8ca5a3..5c7ace982a49 100644
--- a/arch/mips/tx4938/toshiba_rbtx4938/setup.c
+++ b/arch/mips/tx4938/toshiba_rbtx4938/setup.c
@@ -20,6 +20,8 @@
 #include <linux/interrupt.h>
 #include <linux/console.h>
 #include <linux/pci.h>
+#include <linux/pm.h>
+
 #include <asm/wbflush.h>
 #include <asm/reboot.h>
 #include <asm/irq.h>
@@ -1003,7 +1005,7 @@ void __init toshiba_rbtx4938_setup(void)
 
         _machine_restart = rbtx4938_machine_restart;
         _machine_halt = rbtx4938_machine_halt;
-        _machine_power_off = rbtx4938_machine_power_off;
+        pm_power_off = rbtx4938_machine_power_off;
 
         *rbtx4938_led_ptr = 0xff;
         printk("RBTX4938 --- FPGA(Rev %02x)", *rbtx4938_fpga_rev_ptr);
diff --git a/arch/mips/vr41xx/common/pmu.c b/arch/mips/vr41xx/common/pmu.c
index 02bf4f7d06ba..5e469796413f 100644
--- a/arch/mips/vr41xx/common/pmu.c
+++ b/arch/mips/vr41xx/common/pmu.c
@@ -21,6 +21,7 @@
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/kernel.h>
+#include <linux/pm.h>
 #include <linux/smp.h>
 #include <linux/types.h>
 
@@ -114,7 +115,7 @@ static int __init vr41xx_pmu_init(void)
 
         _machine_restart = vr41xx_restart;
         _machine_halt = vr41xx_halt;
-        _machine_power_off = vr41xx_power_off;
+        pm_power_off = vr41xx_power_off;
 
         return 0;
 }
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index e77a06e9621e..eca33cfa8a4c 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -29,6 +29,11 @@ config GENERIC_CALIBRATE_DELAY
         bool
         default y
 
+config TIME_LOW_RES
+        bool
+        depends on SMP
+        default y
+
 config GENERIC_ISA_DMA
         bool
 
@@ -149,14 +154,20 @@ config HOTPLUG_CPU
         default y if SMP
         select HOTPLUG
 
+config ARCH_SELECT_MEMORY_MODEL
+        def_bool y
+        depends on 64BIT
+
 config ARCH_DISCONTIGMEM_ENABLE
-        bool "Discontiguous memory support (EXPERIMENTAL)"
-        depends on 64BIT && EXPERIMENTAL
-        help
-          Say Y to support efficient handling of discontiguous physical memory,
-          for architectures which are either NUMA (Non-Uniform Memory Access)
-          or have huge holes in the physical address space for other reasons.
-          See <file:Documentation/vm/numa> for more.
+        def_bool y
+        depends on 64BIT
+
+config ARCH_FLATMEM_ENABLE
+        def_bool y
+
+config ARCH_DISCONTIGMEM_DEFAULT
+        def_bool y
+        depends on ARCH_DISCONTIGMEM_ENABLE
 
 source "kernel/Kconfig.hz"
 source "mm/Kconfig"
diff --git a/arch/parisc/Kconfig.debug b/arch/parisc/Kconfig.debug
index 8caaed187a1f..9166bd117267 100644
--- a/arch/parisc/Kconfig.debug
+++ b/arch/parisc/Kconfig.debug
@@ -11,4 +11,14 @@ config DEBUG_RWLOCK
           too many attempts.  If you suspect a rwlock problem or a kernel
           hacker asks for this option then say Y.  Otherwise say N.
 
+config DEBUG_RODATA
+       bool "Write protect kernel read-only data structures"
+       depends on DEBUG_KERNEL
+       help
+         Mark the kernel read-only data as write-protected in the pagetables,
+         in order to catch accidental (and incorrect) writes to such const
+         data. This option may have a slight performance impact because a
+         portion of the kernel code won't be covered by a TLB anymore.
+         If in doubt, say "N".
+
 endmenu
diff --git a/arch/parisc/configs/b180_defconfig b/arch/parisc/configs/b180_defconfig
index 8819e7e6ae3f..37e98241ce4b 100644
--- a/arch/parisc/configs/b180_defconfig
+++ b/arch/parisc/configs/b180_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc5-pa1
-# Fri Oct 21 23:06:10 2005
+# Linux kernel version: 2.6.16-rc1-pa0
+# Tue Jan 17 08:21:01 2006
 #
 CONFIG_PARISC=y
 CONFIG_MMU=y
@@ -29,8 +29,6 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_INITRAMFS_SOURCE=""
@@ -38,8 +36,10 @@ CONFIG_INITRAMFS_SOURCE=""
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -48,8 +48,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -57,10 +59,28 @@ CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_UNLOAD is not set
 CONFIG_OBSOLETE_MODPARM=y
+CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_KMOD is not set
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_DEFAULT_AS is not set
+# CONFIG_DEFAULT_DEADLINE is not set
+CONFIG_DEFAULT_CFQ=y
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="cfq"
+
+#
 # Processor type and features
 #
 # CONFIG_PA7000 is not set
@@ -77,6 +97,7 @@ CONFIG_HZ=250
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4096
 # CONFIG_PREEMPT is not set
 # CONFIG_HPUX is not set
 
@@ -84,8 +105,8 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 # Bus options (PCI, PCMCIA, EISA, GSC, ISA)
 #
 CONFIG_GSC=y
-# CONFIG_HPPB is not set
-# CONFIG_IOMMU_CCIO is not set
+CONFIG_HPPB=y
+CONFIG_IOMMU_CCIO=y
 CONFIG_GSC_LASI=y
 CONFIG_GSC_WAX=y
 CONFIG_EISA=y
@@ -165,8 +186,11 @@ CONFIG_IPV6=y
 # CONFIG_LLC2 is not set
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -205,6 +229,7 @@ CONFIG_STANDALONE=y
 CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=y
 # CONFIG_PARPORT_SERIAL is not set
+CONFIG_PARPORT_NOT_PC=y
 CONFIG_PARPORT_GSC=y
 # CONFIG_PARPORT_1284 is not set
 
@@ -230,14 +255,6 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
 # CONFIG_CDROM_PKTCDVD_WCACHE is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 CONFIG_ATA_OVER_ETH=y
 
 #
@@ -281,6 +298,7 @@ CONFIG_SCSI_SPI_ATTRS=y
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -313,21 +331,19 @@ CONFIG_SCSI_SYM53C8XX_2=y
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=0
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
-# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+CONFIG_SCSI_SYM53C8XX_MMIO=y
 # CONFIG_SCSI_IPR is not set
-# CONFIG_SCSI_ZALON is not set
+CONFIG_SCSI_ZALON=y
+CONFIG_SCSI_NCR53C8XX_DEFAULT_TAGS=8
+CONFIG_SCSI_NCR53C8XX_MAX_TAGS=32
+CONFIG_SCSI_NCR53C8XX_SYNC=40
+# CONFIG_SCSI_NCR53C8XX_PROFILE is not set
 # CONFIG_SCSI_PAS16 is not set
 # CONFIG_SCSI_PSI240I is not set
 # CONFIG_SCSI_QLOGIC_FAS is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_SIM710 is not set
 # CONFIG_SCSI_SYM53C416 is not set
@@ -397,7 +413,7 @@ CONFIG_NETDEVICES=y
 #
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
-# CONFIG_LASI_82596 is not set
+CONFIG_LASI_82596=y
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
 # CONFIG_CASSINI is not set
@@ -464,6 +480,7 @@ CONFIG_NET_RADIO=y
 # Wireless 802.11b ISA/PCI cards support
 #
 # CONFIG_HERMES is not set
+# CONFIG_ATMEL is not set
 
 #
 # Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support
@@ -527,7 +544,7 @@ CONFIG_KEYBOARD_ATKBD_HP_KEYCODES=y
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
 # CONFIG_KEYBOARD_HIL_OLD is not set
-# CONFIG_KEYBOARD_HIL is not set
+CONFIG_KEYBOARD_HIL=y
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_SERIAL is not set
@@ -535,7 +552,7 @@ CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_LOGIBM is not set
 # CONFIG_MOUSE_PC110PAD is not set
 # CONFIG_MOUSE_VSXXXAA is not set
-# CONFIG_MOUSE_HIL is not set
+CONFIG_MOUSE_HIL=y
 # CONFIG_INPUT_JOYSTICK is not set
 # CONFIG_INPUT_TOUCHSCREEN is not set
 CONFIG_INPUT_MISC=y
@@ -549,7 +566,8 @@ CONFIG_SERIO=y
 # CONFIG_SERIO_SERPORT is not set
 # CONFIG_SERIO_PARKBD is not set
 CONFIG_SERIO_GSCPS2=y
-# CONFIG_HP_SDC is not set
+CONFIG_HP_SDC=y
+CONFIG_HIL_MLC=y
 # CONFIG_SERIO_PCIPS2 is not set
 CONFIG_SERIO_LIBPS2=y
 # CONFIG_SERIO_RAW is not set
@@ -569,6 +587,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=13
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
@@ -582,11 +601,10 @@ CONFIG_SERIAL_8250_SHARE_IRQ=y
 #
 # Non-8250 serial port support
 #
-# CONFIG_SERIAL_MUX is not set
-# CONFIG_PDC_CONSOLE is not set
+CONFIG_SERIAL_MUX=y
+CONFIG_SERIAL_MUX_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
-# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -626,6 +644,12 @@ CONFIG_GEN_RTC=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -661,7 +685,6 @@ CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
-CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_MACMODES is not set
 # CONFIG_FB_MODE_HELPERS is not set
 # CONFIG_FB_TILEBLITTING is not set
@@ -671,6 +694,7 @@ CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
 CONFIG_FB_STI=y
+# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
@@ -683,9 +707,7 @@ CONFIG_FB_STI=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
-# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -695,6 +717,7 @@ CONFIG_DUMMY_CONSOLE=y
 CONFIG_DUMMY_CONSOLE_COLUMNS=160
 CONFIG_DUMMY_CONSOLE_ROWS=64
 CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
 CONFIG_STI_CONSOLE=y
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y
@@ -713,7 +736,85 @@ CONFIG_LOGO_PARISC_CLUT224=y
 #
 # Sound
 #
-# CONFIG_SOUND is not set
+CONFIG_SOUND=y
+
+#
+# Advanced Linux Sound Architecture
+#
+CONFIG_SND=y
+CONFIG_SND_TIMER=y
+CONFIG_SND_PCM=y
+CONFIG_SND_SEQUENCER=y
+# CONFIG_SND_SEQ_DUMMY is not set
+CONFIG_SND_OSSEMUL=y
+CONFIG_SND_MIXER_OSS=y
+CONFIG_SND_PCM_OSS=y
+CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_SUPPORT_OLD_API=y
+# CONFIG_SND_VERBOSE_PRINTK is not set
+# CONFIG_SND_DEBUG is not set
+
+#
+# Generic devices
+#
+# CONFIG_SND_DUMMY is not set
+# CONFIG_SND_VIRMIDI is not set
+# CONFIG_SND_MTPAV is not set
+# CONFIG_SND_SERIAL_U16550 is not set
+# CONFIG_SND_MPU401 is not set
+
+#
+# PCI devices
+#
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALI5451 is not set
+# CONFIG_SND_ATIIXP is not set
+# CONFIG_SND_ATIIXP_MODEM is not set
+# CONFIG_SND_AU8810 is not set
+# CONFIG_SND_AU8820 is not set
+# CONFIG_SND_AU8830 is not set
+# CONFIG_SND_BT87X is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
+# CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_EMU10K1 is not set
+# CONFIG_SND_EMU10K1X is not set
+# CONFIG_SND_ENS1370 is not set
+# CONFIG_SND_ENS1371 is not set
+# CONFIG_SND_ES1938 is not set
+# CONFIG_SND_ES1968 is not set
+# CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
+# CONFIG_SND_ICE1712 is not set
+# CONFIG_SND_ICE1724 is not set
+# CONFIG_SND_INTEL8X0 is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
+# CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
+# CONFIG_SND_VIA82XX is not set
+# CONFIG_SND_VIA82XX_MODEM is not set
+# CONFIG_SND_VX222 is not set
+# CONFIG_SND_YMFPCI is not set
+
+#
+# GSC devices
+#
+CONFIG_SND_HARMONY=y
+
+#
+# Open Sound System
+#
+# CONFIG_SOUND_PRIME is not set
 
 #
 # USB support
@@ -723,6 +824,10 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_USB is not set
 
 #
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
 # USB Gadget Support
 #
 # CONFIG_USB_GADGET is not set
@@ -877,18 +982,23 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_IOREMAP is not set
 # CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_DEBUG_RODATA is not set
 
 #
 # Security options
diff --git a/arch/parisc/hpux/entry_hpux.S b/arch/parisc/hpux/entry_hpux.S
index fa9bf38787e7..31c8cccfba31 100644
--- a/arch/parisc/hpux/entry_hpux.S
+++ b/arch/parisc/hpux/entry_hpux.S
@@ -22,10 +22,9 @@
 #include <linux/linkage.h>
 #include <asm/unistd.h>
 
-        .text
-
 #define ENTRY_NAME(_name_) .word _name_
 
+        .section .rodata,"a"
         .align 4
         .export hpux_call_table
         .import hpux_unimplemented_wrapper
diff --git a/arch/parisc/hpux/sys_hpux.c b/arch/parisc/hpux/sys_hpux.c
index 29b4d61898f2..05273ccced0e 100644
--- a/arch/parisc/hpux/sys_hpux.c
+++ b/arch/parisc/hpux/sys_hpux.c
@@ -468,19 +468,23 @@ int hpux_sysfs(int opcode, unsigned long arg1, unsigned long arg2)
         if ( opcode == 1 ) { /* GETFSIND */     
                 len = strlen_user((char *)arg1);
                 printk(KERN_DEBUG "len of arg1 = %d\n", len);
-
-                fsname = (char *) kmalloc(len+1, GFP_KERNEL);
+                if (len == 0)
+                        return 0;
+                fsname = (char *) kmalloc(len, GFP_KERNEL);
                 if ( !fsname ) {
                         printk(KERN_DEBUG "failed to kmalloc fsname\n");
                         return 0;
                 }
 
-                if ( copy_from_user(fsname, (char *)arg1, len+1) ) {
+                if ( copy_from_user(fsname, (char *)arg1, len) ) {
                         printk(KERN_DEBUG "failed to copy_from_user fsname\n");
                         kfree(fsname);
                         return 0;
                 }
 
+                /* String could be altered by userspace after strlen_user() */
+                fsname[len] = '\0';
+
                 printk(KERN_DEBUG "that is '%s' as (char *)\n", fsname);
                 if ( !strcmp(fsname, "hfs") ) {
                         fstype = 0;
diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
index 2d804e2d16d1..3d569a485a1a 100644
--- a/arch/parisc/kernel/drivers.c
+++ b/arch/parisc/kernel/drivers.c
@@ -408,11 +408,10 @@ static void setup_bus_id(struct parisc_device *padev)
 
 struct parisc_device * create_tree_node(char id, struct device *parent)
 {
-        struct parisc_device *dev = kmalloc(sizeof(*dev), GFP_KERNEL);
+        struct parisc_device *dev = kzalloc(sizeof(*dev), GFP_KERNEL);
         if (!dev)
                 return NULL;
 
-        memset(dev, 0, sizeof(*dev));
         dev->hw_path = id;
         dev->id.hw_type = HPHW_FAULTY;
 
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index f40a777dd388..1d00c365f2b1 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -48,9 +48,6 @@ EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strpbrk);
 
-#include <linux/pm.h>
-EXPORT_SYMBOL(pm_power_off);
-
 #include <asm/atomic.h>
 EXPORT_SYMBOL(__xchg8);
 EXPORT_SYMBOL(__xchg32);
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index 88cba49c5301..79c7db2705fd 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -47,18 +47,17 @@
  * this makes the boot time much longer than necessary.
  * 20ms seems to work for all the HP PCI implementations to date.
  *
- * XXX: turn into a #defined constant in <asm/pci.h> ?
+ * #define pci_post_reset_delay 50
  */
-int pci_post_reset_delay = 50;
 
-struct pci_port_ops *pci_port;
-struct pci_bios_ops *pci_bios;
+struct pci_port_ops *pci_port __read_mostly;
+struct pci_bios_ops *pci_bios __read_mostly;
 
-int pci_hba_count = 0;
+static int pci_hba_count __read_mostly;
 
 /* parisc_pci_hba used by pci_port->in/out() ops to lookup bus data.  */
 #define PCI_HBA_MAX 32
-struct pci_hba_data *parisc_pci_hba[PCI_HBA_MAX];
+static struct pci_hba_data *parisc_pci_hba[PCI_HBA_MAX] __read_mostly;
 
 
 /********************************************************************
@@ -259,8 +258,10 @@ void __devinit pcibios_resource_to_bus(struct pci_dev *dev,
 void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
                               struct pci_bus_region *region)
 {
+#ifdef CONFIG_64BIT
         struct pci_bus *bus = dev->bus;
         struct pci_hba_data *hba = HBA_DATA(bus->bridge->platform_data);
+#endif
 
         if (res->flags & IORESOURCE_MEM) {
                 res->start = PCI_HOST_ADDR(hba, region->start);
diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
index 11d406cd0b3e..53f861c82f93 100644
--- a/arch/parisc/kernel/perf.c
+++ b/arch/parisc/kernel/perf.c
@@ -68,20 +68,20 @@ struct rdr_tbl_ent {
 };
 
 static int perf_processor_interface __read_mostly = UNKNOWN_INTF;
-static int perf_enabled __read_mostly = 0;
+static int perf_enabled __read_mostly;
 static spinlock_t perf_lock;
-struct parisc_device *cpu_device __read_mostly = NULL;
+struct parisc_device *cpu_device __read_mostly;
 
 /* RDRs to write for PCX-W */
-static int perf_rdrs_W[] = 
+static const int perf_rdrs_W[] =
         { 0, 1, 4, 5, 6, 15, 16, 17, 18, 20, 21, 22, 23, 24, 25, -1 };
 
 /* RDRs to write for PCX-U */
-static int perf_rdrs_U[] =
+static const int perf_rdrs_U[] =
         { 0, 1, 4, 5, 6, 7, 16, 17, 18, 20, 21, 22, 23, 24, 25, -1 };
 
 /* RDR register descriptions for PCX-W */
-static struct rdr_tbl_ent perf_rdr_tbl_W[] = {
+static const struct rdr_tbl_ent perf_rdr_tbl_W[] = {
         { 19,   1,      8 },   /* RDR 0 */
         { 16,   1,      16 },  /* RDR 1 */
         { 72,   2,      0 },   /* RDR 2 */
@@ -117,7 +117,7 @@ static struct rdr_tbl_ent perf_rdr_tbl_W[] = {
 };
 
 /* RDR register descriptions for PCX-U */
-static struct rdr_tbl_ent perf_rdr_tbl_U[] = {
+static const struct rdr_tbl_ent perf_rdr_tbl_U[] = {
         { 19,   1,      8 },              /* RDR 0 */
         { 32,   1,      16 },             /* RDR 1 */
         { 20,   1,      0 },              /* RDR 2 */
@@ -156,7 +156,7 @@ static struct rdr_tbl_ent perf_rdr_tbl_U[] = {
  * A non-zero write_control in the above tables is a byte offset into
  * this array.
  */
-static uint64_t perf_bitmasks[] = {
+static const uint64_t perf_bitmasks[] = {
         0x0000000000000000ul,     /* first dbl word must be zero */
         0xfdffe00000000000ul,     /* RDR0 bitmask */
         0x003f000000000000ul,     /* RDR1 bitmask */
@@ -173,7 +173,7 @@ static uint64_t perf_bitmasks[] = {
  * Write control bitmasks for Pa-8700 processor given
  * somethings have changed slightly.
  */
-static uint64_t perf_bitmasks_piranha[] = {
+static const uint64_t perf_bitmasks_piranha[] = {
         0x0000000000000000ul,     /* first dbl word must be zero */
         0xfdffe00000000000ul,     /* RDR0 bitmask */
         0x003f000000000000ul,     /* RDR1 bitmask */
@@ -186,7 +186,7 @@ static uint64_t perf_bitmasks_piranha[] = {
         0xfffc000000000000ul
 };
 
-static uint64_t *bitmask_array;   /* array of bitmasks to use */
+static const uint64_t *bitmask_array;   /* array of bitmasks to use */
 
 /******************************************************************************
  * Function Prototypes
@@ -200,7 +200,7 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
 static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 static void perf_start_counters(void);
 static int perf_stop_counters(uint32_t *raddr);
-static struct rdr_tbl_ent * perf_rdr_get_entry(uint32_t rdr_num);
+static const struct rdr_tbl_ent * perf_rdr_get_entry(uint32_t rdr_num);
 static int perf_rdr_read_ubuf(uint32_t  rdr_num, uint64_t *buffer);
 static int perf_rdr_clear(uint32_t rdr_num);
 static int perf_write_image(uint64_t *memaddr);
@@ -444,7 +444,6 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         uint32_t raddr[4];
         int error = 0;
 
-        lock_kernel();
         switch (cmd) {
 
             case PA_PERF_ON:
@@ -477,8 +476,6 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         error = -ENOTTY;
         }
 
-        unlock_kernel();
-
         return error;
 }
 
@@ -655,7 +652,7 @@ static int perf_stop_counters(uint32_t *raddr)
  * Retrieve a pointer to the description of what this
  * RDR contains.
  */
-static struct rdr_tbl_ent * perf_rdr_get_entry(uint32_t rdr_num)
+static const struct rdr_tbl_ent * perf_rdr_get_entry(uint32_t rdr_num)
 {
         if (perf_processor_interface == ONYX_INTF) {
                 return &perf_rdr_tbl_U[rdr_num];
@@ -673,7 +670,7 @@ static int perf_rdr_read_ubuf(uint32_t	rdr_num, uint64_t *buffer)
 {
         uint64_t        data, data_mask = 0;
         uint32_t        width, xbits, i;
-        struct rdr_tbl_ent *tentry;
+        const struct rdr_tbl_ent *tentry;
 
         tentry = perf_rdr_get_entry(rdr_num);
         if ((width = tentry->width) == 0)
@@ -721,7 +718,7 @@ static int perf_rdr_read_ubuf(uint32_t	rdr_num, uint64_t *buffer)
  */
 static int perf_rdr_clear(uint32_t      rdr_num)
 {
-        struct rdr_tbl_ent *tentry;
+        const struct rdr_tbl_ent *tentry;
         int32_t         i;
 
         tentry = perf_rdr_get_entry(rdr_num);
@@ -753,10 +750,11 @@ static int perf_write_image(uint64_t *memaddr)
         uint64_t buffer[MAX_RDR_WORDS];
         uint64_t *bptr;
         uint32_t dwords;
-        uint32_t *intrigue_rdr;
-        uint64_t *intrigue_bitmask, tmp64;
+        const uint32_t *intrigue_rdr;
+        const uint64_t *intrigue_bitmask;
+        uint64_t tmp64;
         void __iomem *runway;
-        struct rdr_tbl_ent *tentry;
+        const struct rdr_tbl_ent *tentry;
         int i;
 
         /* Clear out counters */
@@ -830,7 +828,7 @@ static int perf_write_image(uint64_t *memaddr)
  */
 static void perf_rdr_write(uint32_t rdr_num, uint64_t *buffer)
 {
-        struct rdr_tbl_ent *tentry;
+        const struct rdr_tbl_ent *tentry;
         int32_t         i;
 
 printk("perf_rdr_write\n");
diff --git a/arch/parisc/kernel/perf_images.h b/arch/parisc/kernel/perf_images.h
index d9562fe3f75c..7fef9644df47 100644
--- a/arch/parisc/kernel/perf_images.h
+++ b/arch/parisc/kernel/perf_images.h
@@ -25,7 +25,7 @@
 
 #define PCXU_IMAGE_SIZE 584
 
-static uint32_t onyx_images[][PCXU_IMAGE_SIZE/sizeof(uint32_t)] = {
+static uint32_t onyx_images[][PCXU_IMAGE_SIZE/sizeof(uint32_t)] __read_mostly = {
 /*
  * CPI:
  *
@@ -2093,7 +2093,7 @@ static uint32_t onyx_images[][PCXU_IMAGE_SIZE/sizeof(uint32_t)] = {
 };
 #define PCXW_IMAGE_SIZE 576
 
-static uint32_t cuda_images[][PCXW_IMAGE_SIZE/sizeof(uint32_t)] = {
+static uint32_t cuda_images[][PCXW_IMAGE_SIZE/sizeof(uint32_t)] __read_mostly = {
 /*
  * CPI:     FROM CPI.IDF (Image 0)
  *
diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
index 5da41677e70b..e8dea4177113 100644
--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -54,27 +54,6 @@
 #include <asm/uaccess.h>
 #include <asm/unwind.h>
 
-static int hlt_counter __read_mostly;
-
-/*
- * Power off function, if any
- */ 
-void (*pm_power_off)(void);
-
-void disable_hlt(void)
-{
-        hlt_counter++;
-}
-
-EXPORT_SYMBOL(disable_hlt);
-
-void enable_hlt(void)
-{
-        hlt_counter--;
-}
-
-EXPORT_SYMBOL(enable_hlt);
-
 void default_idle(void)
 {
         barrier();
@@ -102,12 +81,7 @@ void cpu_idle(void)
 }
 
 
-#ifdef __LP64__
-#define COMMAND_GLOBAL  0xfffffffffffe0030UL
-#else
-#define COMMAND_GLOBAL  0xfffe0030
-#endif
-
+#define COMMAND_GLOBAL  F_EXTEND(0xfffe0030)
 #define CMD_RESET       5       /* reset any module */
 
 /*
@@ -162,6 +136,7 @@ void machine_halt(void)
         */
 }
 
+void (*chassis_power_off)(void);
 
 /*
  * This routine is called from sys_reboot to actually turn off the
@@ -170,8 +145,8 @@ void machine_halt(void)
 void machine_power_off(void)
 {
         /* If there is a registered power off handler, call it. */
-        if(pm_power_off)
-                pm_power_off();
+        if (chassis_power_off)
+                chassis_power_off();
 
         /* Put the soft power button back under hardware control.
          * If the user had already pressed the power button, the
@@ -187,6 +162,8 @@ void machine_power_off(void)
                KERN_EMERG "Please power this system off now.");
 }
 
+void (*pm_power_off)(void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
 
 /*
  * Create a kernel thread
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 27160e8bf15b..413292f1a4a3 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -91,7 +91,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                 int copied;
 
 #ifdef __LP64__
-                if (is_compat_task(child)) {
+                if (personality(child->personality) == PER_LINUX32) {
                         unsigned int tmp;
 
                         addr &= 0xffffffffL;
@@ -123,7 +123,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
         case PTRACE_POKEDATA:
                 ret = 0;
 #ifdef __LP64__
-                if (is_compat_task(child)) {
+                if (personality(child->personality) == PER_LINUX32) {
                         unsigned int tmp = (unsigned int)data;
                         DBG("sys_ptrace(POKE%s, %d, %lx, %lx)\n",
                                 request == PTRACE_POKETEXT ? "TEXT" : "DATA",
@@ -146,7 +146,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
         case PTRACE_PEEKUSR: {
                 ret = -EIO;
 #ifdef __LP64__
-                if (is_compat_task(child)) {
+                if (personality(child->personality) == PER_LINUX32) {
                         unsigned int tmp;
 
                         if (addr & (sizeof(int)-1))
@@ -205,7 +205,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                         goto out_tsk;
                 }
 #ifdef __LP64__
-                if (is_compat_task(child)) {
+                if (personality(child->personality) == PER_LINUX32) {
                         if (addr & (sizeof(int)-1))
                                 goto out_tsk;
                         if ((addr = translate_usr_offset(addr)) < 0)
diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 3a25a7bd673e..05767e83cf2d 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -317,7 +317,7 @@ setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         
         if(personality(current->personality) == PER_LINUX32) {
                 DBG(1,"setup_rt_frame: frame->info = 0x%p\n", &compat_frame->info);
-                err |= compat_copy_siginfo_to_user(&compat_frame->info, info);
+                err |= copy_siginfo_to_user32(&compat_frame->info, info);
                 DBG(1,"SETUP_RT_FRAME: 1\n");
                 compat_val = (compat_int_t)current->sas_ss_sp;
                 err |= __put_user(compat_val, &compat_frame->uc.uc_stack.ss_sp);
diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
index 0792e20efef3..a6b4231cafa1 100644
--- a/arch/parisc/kernel/signal32.c
+++ b/arch/parisc/kernel/signal32.c
@@ -31,7 +31,6 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 
-#include <asm/compat_signal.h>
 #include <asm/uaccess.h>
 
 #include "signal32.h"
@@ -398,3 +397,104 @@ setup_sigcontext32(struct compat_sigcontext __user *sc, struct compat_regfile __
 
         return err;
 }
+
+int
+copy_siginfo_from_user32 (siginfo_t *to, compat_siginfo_t __user *from)
+{
+        unsigned long tmp;
+        int err;
+
+        if (!access_ok(VERIFY_READ, from, sizeof(compat_siginfo_t)))
+                return -EFAULT;
+
+        err = __get_user(to->si_signo, &from->si_signo);
+        err |= __get_user(to->si_errno, &from->si_errno);
+        err |= __get_user(to->si_code, &from->si_code);
+
+        if (to->si_code < 0)
+                err |= __copy_from_user(&to->_sifields._pad, &from->_sifields._pad, SI_PAD_SIZE);
+        else {
+                switch (to->si_code >> 16) {
+                      case __SI_CHLD >> 16:
+                        err |= __get_user(to->si_utime, &from->si_utime);
+                        err |= __get_user(to->si_stime, &from->si_stime);
+                        err |= __get_user(to->si_status, &from->si_status);
+                      default:
+                        err |= __get_user(to->si_pid, &from->si_pid);
+                        err |= __get_user(to->si_uid, &from->si_uid);
+                        break;
+                      case __SI_FAULT >> 16:
+                        err |= __get_user(tmp, &from->si_addr);
+                        to->si_addr = (void __user *) tmp;
+                        break;
+                      case __SI_POLL >> 16:
+                        err |= __get_user(to->si_band, &from->si_band);
+                        err |= __get_user(to->si_fd, &from->si_fd);
+                        break;
+                      case __SI_RT >> 16: /* This is not generated by the kernel as of now.  */
+                      case __SI_MESGQ >> 16:
+                        err |= __get_user(to->si_pid, &from->si_pid);
+                        err |= __get_user(to->si_uid, &from->si_uid);
+                        err |= __get_user(to->si_int, &from->si_int);
+                        break;
+                }
+        }
+        return err;
+}
+
+int
+copy_siginfo_to_user32 (compat_siginfo_t __user *to, siginfo_t *from)
+{
+        unsigned int addr;
+        int err;
+
+        if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
+                return -EFAULT;
+
+        /* If you change siginfo_t structure, please be sure
+           this code is fixed accordingly.
+           It should never copy any pad contained in the structure
+           to avoid security leaks, but must copy the generic
+           3 ints plus the relevant union member.
+           This routine must convert siginfo from 64bit to 32bit as well
+           at the same time.  */
+        err = __put_user(from->si_signo, &to->si_signo);
+        err |= __put_user(from->si_errno, &to->si_errno);
+        err |= __put_user((short)from->si_code, &to->si_code);
+        if (from->si_code < 0)
+                err |= __copy_to_user(&to->_sifields._pad, &from->_sifields._pad, SI_PAD_SIZE);
+        else {
+                switch (from->si_code >> 16) {
+                case __SI_CHLD >> 16:
+                        err |= __put_user(from->si_utime, &to->si_utime);
+                        err |= __put_user(from->si_stime, &to->si_stime);
+                        err |= __put_user(from->si_status, &to->si_status);
+                default:
+                        err |= __put_user(from->si_pid, &to->si_pid);
+                        err |= __put_user(from->si_uid, &to->si_uid);
+                        break;
+                case __SI_FAULT >> 16:
+                        /* avoid type-checking warnings by copying _pad[0] in lieu of si_addr... */
+                        err |= __put_user(from->_sifields._pad[0], &to->si_addr);
+                        break;
+                case __SI_POLL >> 16:
+                        err |= __put_user(from->si_band, &to->si_band);
+                        err |= __put_user(from->si_fd, &to->si_fd);
+                        break;
+                case __SI_TIMER >> 16:
+                        err |= __put_user(from->si_tid, &to->si_tid);
+                        err |= __put_user(from->si_overrun, &to->si_overrun);
+                        addr = (unsigned long) from->si_ptr;
+                        err |= __put_user(addr, &to->si_ptr);
+                        break;
+                case __SI_RT >> 16:     /* Not generated by the kernel as of now.  */
+                case __SI_MESGQ >> 16:
+                        err |= __put_user(from->si_uid, &to->si_uid);
+                        err |= __put_user(from->si_pid, &to->si_pid);
+                        addr = (unsigned long) from->si_ptr;
+                        err |= __put_user(addr, &to->si_ptr);
+                        break;
+                }
+        }
+        return err;
+}
diff --git a/arch/parisc/kernel/signal32.h b/arch/parisc/kernel/signal32.h
index 4d1569e717cc..e39b38a67a87 100644
--- a/arch/parisc/kernel/signal32.h
+++ b/arch/parisc/kernel/signal32.h
@@ -20,8 +20,34 @@
 #define _PARISC64_KERNEL_SIGNAL32_H
 
 #include <linux/compat.h>
-#include <asm/compat_signal.h>
-#include <asm/compat_rt_sigframe.h>
+
+typedef compat_uptr_t compat_sighandler_t;
+
+typedef struct compat_sigaltstack {
+        compat_uptr_t ss_sp;
+        compat_int_t ss_flags;
+        compat_size_t ss_size;
+} compat_stack_t;
+
+/* Most things should be clean enough to redefine this at will, if care
+   is taken to make libc match.  */
+
+struct compat_sigaction {
+        compat_sighandler_t sa_handler;
+        compat_uint_t sa_flags;
+        compat_sigset_t sa_mask;               /* mask last for extensibility */
+};
+
+/* 32-bit ucontext as seen from an 64-bit kernel */
+struct compat_ucontext {
+        compat_uint_t uc_flags;
+        compat_uptr_t uc_link;
+        compat_stack_t uc_stack;        /* struct compat_sigaltstack (12 bytes)*/
+        /* FIXME: Pad out to get uc_mcontext to start at an 8-byte aligned boundary */
+        compat_uint_t pad[1];
+        struct compat_sigcontext uc_mcontext;
+        compat_sigset_t uc_sigmask;     /* mask last for extensibility */
+};
 
 /* ELF32 signal handling */
 
@@ -29,6 +55,103 @@ struct k_sigaction32 {
         struct compat_sigaction sa;
 };
 
+typedef struct compat_siginfo {
+        int si_signo;
+        int si_errno;
+        int si_code;
+
+        union {
+                int _pad[((128/sizeof(int)) - 3)];
+
+                /* kill() */
+                struct {
+                        unsigned int _pid;      /* sender's pid */
+                        unsigned int _uid;      /* sender's uid */
+                } _kill;
+
+                /* POSIX.1b timers */
+                struct {
+                        compat_timer_t _tid;            /* timer id */
+                        int _overrun;           /* overrun count */
+                        char _pad[sizeof(unsigned int) - sizeof(int)];
+                        compat_sigval_t _sigval;        /* same as below */
+                        int _sys_private;       /* not to be passed to user */
+                } _timer;
+
+                /* POSIX.1b signals */
+                struct {
+                        unsigned int _pid;      /* sender's pid */
+                        unsigned int _uid;      /* sender's uid */
+                        compat_sigval_t _sigval;
+                } _rt;
+
+                /* SIGCHLD */
+                struct {
+                        unsigned int _pid;      /* which child */
+                        unsigned int _uid;      /* sender's uid */
+                        int _status;            /* exit code */
+                        compat_clock_t _utime;
+                        compat_clock_t _stime;
+                } _sigchld;
+
+                /* SIGILL, SIGFPE, SIGSEGV, SIGBUS */
+                struct {
+                        unsigned int _addr;     /* faulting insn/memory ref. */
+                } _sigfault;
+
+                /* SIGPOLL */
+                struct {
+                        int _band;      /* POLL_IN, POLL_OUT, POLL_MSG */
+                        int _fd;
+                } _sigpoll;
+        } _sifields;
+} compat_siginfo_t;
+
+int copy_siginfo_to_user32 (compat_siginfo_t __user *to, siginfo_t *from);
+int copy_siginfo_from_user32 (siginfo_t *to, compat_siginfo_t __user *from);
+
+/* In a deft move of uber-hackery, we decide to carry the top half of all
+ * 64-bit registers in a non-portable, non-ABI, hidden structure.
+ * Userspace can read the hidden structure if it *wants* but is never
+ * guaranteed to be in the same place. Infact the uc_sigmask from the
+ * ucontext_t structure may push the hidden register file downards
+ */
+struct compat_regfile {
+        /* Upper half of all the 64-bit registers that were truncated
+           on a copy to a 32-bit userspace */
+        compat_int_t rf_gr[32];
+        compat_int_t rf_iasq[2];
+        compat_int_t rf_iaoq[2];
+        compat_int_t rf_sar;
+};
+
+#define COMPAT_SIGRETURN_TRAMP 4
+#define COMPAT_SIGRESTARTBLOCK_TRAMP 5
+#define COMPAT_TRAMP_SIZE (COMPAT_SIGRETURN_TRAMP + \
+                                COMPAT_SIGRESTARTBLOCK_TRAMP)
+
+struct compat_rt_sigframe {
+        /* XXX: Must match trampoline size in arch/parisc/kernel/signal.c
+                Secondary to that it must protect the ERESTART_RESTARTBLOCK
+                trampoline we left on the stack (we were bad and didn't
+                change sp so we could run really fast.) */
+        compat_uint_t tramp[COMPAT_TRAMP_SIZE];
+        compat_siginfo_t info;
+        struct compat_ucontext uc;
+        /* Hidden location of truncated registers, *must* be last. */
+        struct compat_regfile regs;
+};
+
+/*
+ * The 32-bit ABI wants at least 48 bytes for a function call frame:
+ * 16 bytes for arg0-arg3, and 32 bytes for magic (the only part of
+ * which Linux/parisc uses is sp-20 for the saved return pointer...)
+ * Then, the stack pointer must be rounded to a cache line (64 bytes).
+ */
+#define SIGFRAME32              64
+#define FUNCTIONCALLFRAME32     48
+#define PARISC_RT_SIGFRAME_SIZE32 (((sizeof(struct compat_rt_sigframe) + FUNCTIONCALLFRAME32) + SIGFRAME32) & -SIGFRAME32)
+
 void sigset_32to64(sigset_t *s64, compat_sigset_t *s32);
 void sigset_64to32(compat_sigset_t *s32, sigset_t *s64);
 int do_sigaltstack32 (const compat_stack_t __user *uss32, 
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index d66163492890..af88afef41bd 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -650,6 +650,8 @@ end_linux_gateway_page:
 #define LWS_ENTRY(_name_) .word  (lws_##_name_ - linux_gateway_page)
 #endif
 
+        .section .rodata,"a"
+
         .align 4096
         /* Light-weight-syscall table */
         /* Start of lws table. */
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 32cbc0489324..71011eadb872 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -374,5 +374,24 @@
         ENTRY_SAME(keyctl)
         ENTRY_SAME(ioprio_set)
         ENTRY_SAME(ioprio_get)
+        ENTRY_SAME(inotify_init)
+        ENTRY_SAME(inotify_add_watch)   /* 270 */
+        ENTRY_SAME(inotify_rm_watch)
+        ENTRY_SAME(ni_syscall)          /* 271 ENTRY_COMP(pselect6) */
+        ENTRY_SAME(ni_syscall)          /* 272 ENTRY_COMP(ppoll) */
+        ENTRY_SAME(migrate_pages)
+        ENTRY_COMP(openat)              /* 275 */
+        ENTRY_SAME(mkdirat)
+        ENTRY_SAME(mknodat)
+        ENTRY_SAME(fchownat)
+        ENTRY_COMP(futimesat)
+        ENTRY_SAME(fstatat64)           /* 280 */
+        ENTRY_SAME(unlinkat)
+        ENTRY_SAME(renameat)
+        ENTRY_SAME(linkat)
+        ENTRY_SAME(symlinkat)
+        ENTRY_SAME(readlinkat)          /* 285 */
+        ENTRY_SAME(fchmodat)
+        ENTRY_SAME(faccessat)
         /* Nothing yet */
 
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
index 15914f0235a0..ff200608c851 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -193,10 +193,9 @@ void show_stack(struct task_struct *task, unsigned long *s)
 
 HERE:
                 asm volatile ("copy %%r30, %0" : "=r"(sp));
-                r = (struct pt_regs *)kmalloc(sizeof(struct pt_regs), GFP_KERNEL);
+                r = kzalloc(sizeof(struct pt_regs), GFP_KERNEL);
                 if (!r)
                         return;
-                memset(r, 0, sizeof(struct pt_regs));
                 r->iaoq[0] = (unsigned long)&&HERE;
                 r->gr[2] = (unsigned long)__builtin_return_address(0);
                 r->gr[30] = sp;
diff --git a/arch/parisc/math-emu/decode_exc.c b/arch/parisc/math-emu/decode_exc.c
index f84f2586672b..66c8a9f6a27e 100644
--- a/arch/parisc/math-emu/decode_exc.c
+++ b/arch/parisc/math-emu/decode_exc.c
@@ -337,6 +337,7 @@ decode_fpu(unsigned int Fpu_register[], unsigned int trap_counts[])
                 }
                 break;
           case INVALIDEXCEPTION:
+          case OPC_2E_INVALIDEXCEPTION:
                 update_trap_counts(Fpu_register, aflags, bflags, trap_counts);
                 return SIGNALCODE(SIGFPE, FPE_FLTINV);
           case DIVISIONBYZEROEXCEPTION:
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 720287d46e55..7847ca13d6c2 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -371,17 +371,11 @@ static void __init setup_bootmem(void)
 
 void free_initmem(void)
 {
-        /* FIXME: */
-#if 0
-        printk(KERN_INFO "NOT FREEING INITMEM (%dk)\n",
-                        (&__init_end - &__init_begin) >> 10);
-        return;
-#else
         unsigned long addr;
         
         printk(KERN_INFO "Freeing unused kernel memory: ");
 
-#if 1
+#ifdef CONFIG_DEBUG_KERNEL
         /* Attempt to catch anyone trying to execute code here
          * by filling the page with BRK insns.
          * 
@@ -414,9 +408,21 @@ void free_initmem(void)
         pdc_chassis_send_status(PDC_CHASSIS_DIRECT_BCOMPLETE);
         
         printk("%luk freed\n", (unsigned long)(&__init_end - &__init_begin) >> 10);
-#endif
 }
 
+
+#ifdef CONFIG_DEBUG_RODATA
+void mark_rodata_ro(void)
+{
+        extern char __start_rodata, __end_rodata;
+        /* rodata memory was already mapped with KERNEL_RO access rights by
+           pagetable_init() and map_pages(). No need to do additional stuff here */
+        printk (KERN_INFO "Write protecting the kernel read-only data: %luk\n",
+                (unsigned long)(&__end_rodata - &__start_rodata) >> 10);
+}
+#endif
+
+
 /*
  * Just an arbitrary offset to serve as a "hole" between mapping areas
  * (between top of physical memory and a potential pcxl dma mapping
@@ -477,11 +483,6 @@ void __init mem_init(void)
 
 }
 
-int do_check_pgt_cache(int low, int high)
-{
-        return 0;
-}
-
 unsigned long *empty_zero_page __read_mostly;
 
 void show_mem(void)
@@ -690,7 +691,7 @@ static void __init pagetable_init(void)
 
 #ifdef CONFIG_BLK_DEV_INITRD
         if (initrd_end && initrd_end > mem_limit) {
-                printk("initrd: mapping %08lx-%08lx\n", initrd_start, initrd_end);
+                printk(KERN_INFO "initrd: mapping %08lx-%08lx\n", initrd_start, initrd_end);
                 map_pages(initrd_start, __pa(initrd_start),
                         initrd_end - initrd_start, PAGE_KERNEL);
         }
@@ -792,8 +793,6 @@ map_hpux_gateway_page(struct task_struct *tsk, struct mm_struct *mm)
 EXPORT_SYMBOL(map_hpux_gateway_page);
 #endif
 
-extern void flush_tlb_all_local(void);
-
 void __init paging_init(void)
 {
         int i;
@@ -802,7 +801,7 @@ void __init paging_init(void)
         pagetable_init();
         gateway_init();
         flush_cache_all_local(); /* start with known state */
-        flush_tlb_all_local();
+        flush_tlb_all_local(NULL);
 
         for (i = 0; i < npmem_ranges; i++) {
                 unsigned long zones_size[MAX_NR_ZONES] = { 0, 0, 0 };
@@ -993,7 +992,7 @@ void flush_tlb_all(void)
             do_recycle++;
         }
         spin_unlock(&sid_lock);
-        on_each_cpu((void (*)(void *))flush_tlb_all_local, NULL, 1, 1);
+        on_each_cpu(flush_tlb_all_local, NULL, 1, 1);
         if (do_recycle) {
             spin_lock(&sid_lock);
             recycle_sids(recycle_ndirty,recycle_dirty_array);
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index df338c5cc910..dfba81719dec 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -83,6 +83,12 @@ config GENERIC_TBSYNC
         default y if PPC32 && SMP
         default n
 
+config DEFAULT_UIMAGE
+        bool
+        help
+          Used to allow a board to specify it wants a uImage built by default
+        default n
+
 menu "Processor support"
 choice
         prompt "Processor Type"
@@ -574,7 +580,7 @@ config KEXEC
           strongly in flux, so no good recommendation can be made.
 
 config CRASH_DUMP
-        bool "kernel crash dumps (EXPERIMENTAL)"
+        bool "Build a kdump crash kernel (EXPERIMENTAL)"
         depends on PPC_MULTIPLATFORM && PPC64 && EXPERIMENTAL
         help
           Build a kernel suitable for use as a kdump capture kernel.
@@ -957,7 +963,7 @@ source "arch/powerpc/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
-        depends on PPC64
+        depends on PPC64 && EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 44dd82b791d1..5500ab55d042 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -142,6 +142,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/powerpc/oprofile/
 # Default to zImage, override when needed
 defaultimage-y                  := zImage
 defaultimage-$(CONFIG_PPC_ISERIES) := vmlinux
+defaultimage-$(CONFIG_DEFAULT_UIMAGE) := uImage
 KBUILD_IMAGE := $(defaultimage-y)
 all: $(KBUILD_IMAGE)
 
@@ -167,6 +168,8 @@ endef
 
 archclean:
         $(Q)$(MAKE) $(clean)=$(boot)
+
+archmrproper:
         $(Q)rm -rf arch/$(ARCH)/include
 
 archprepare: checkbin
diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
index e0192c26037b..70e65b13e033 100644
--- a/arch/powerpc/boot/crt0.S
+++ b/arch/powerpc/boot/crt0.S
@@ -45,7 +45,8 @@ _zimage_start:
         bdnz    2b
 
         /* Do a cache flush for our text, in case OF didn't */
-3:      lis     r9,_start@h
+3:      lis     r9,_start@ha
+        addi    r9,r9,_start@l
         add     r9,r0,r9
         lis     r8,_etext@ha
         addi    r8,r8,_etext@l
@@ -53,7 +54,7 @@ _zimage_start:
 4:      dcbf    r0,r9
         icbi    r0,r9
         addi    r9,r9,0x20
-        cmplwi  0,r9,8
+        cmplw   cr0,r9,r8
         blt     4b
         sync
         isync
diff --git a/arch/powerpc/configs/cell_defconfig b/arch/powerpc/configs/cell_defconfig
index 063b84f2cbea..3c2acab63736 100644
--- a/arch/powerpc/configs/cell_defconfig
+++ b/arch/powerpc/configs/cell_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:26 2005
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:48 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=4
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -48,8 +51,6 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
 # CONFIG_CPUSETS is not set
 CONFIG_INITRAMFS_SOURCE=""
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -111,7 +116,6 @@ CONFIG_PPC_MULTIPLATFORM=y
 # CONFIG_PPC_PMAC is not set
 # CONFIG_PPC_MAPLE is not set
 CONFIG_PPC_CELL=y
-CONFIG_PPC_OF=y
 # CONFIG_U3_DART is not set
 CONFIG_PPC_RTAS=y
 # CONFIG_RTAS_ERROR_LOGGING is not set
@@ -120,11 +124,15 @@ CONFIG_RTAS_FLASH=y
 CONFIG_MMIO_NVRAM=y
 CONFIG_CELL_IIC=y
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
 #
+# Cell Broadband Engine options
+#
+CONFIG_SPU_FS=y
+
+#
 # Kernel options
 #
 # CONFIG_HZ_100 is not set
@@ -140,6 +148,7 @@ CONFIG_BINFMT_ELF=y
 CONFIG_FORCE_MAX_ZONEORDER=13
 # CONFIG_IOMMU_VMERGE is not set
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -191,6 +200,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -234,6 +244,25 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
 #
 # IP: Netfilter Configuration
@@ -251,37 +280,23 @@ CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
 CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
 CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
 CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
 CONFIG_IP_NF_MATCH_OWNER=m
 CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
 CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_MATCH_POLICY=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -297,11 +312,8 @@ CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_TOS=m
 CONFIG_IP_NF_TARGET_ECN=m
 CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
 CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -311,7 +323,6 @@ CONFIG_IP_NF_ARP_MANGLE=m
 #
 # CONFIG_IP6_NF_QUEUE is not set
 # CONFIG_IP6_NF_IPTABLES is not set
-# CONFIG_IP6_NF_TARGET_NFQUEUE is not set
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -322,6 +333,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -540,9 +556,11 @@ CONFIG_E1000=m
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 CONFIG_SKGE=m
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_BNX2 is not set
+CONFIG_SPIDER_NET=y
 # CONFIG_MV643XX_ETH is not set
 
 #
@@ -628,13 +646,16 @@ CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
 # CONFIG_CYCLADES is not set
 # CONFIG_DIGIEPCA is not set
+# CONFIG_MOXA_INTELLIO is not set
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINK is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
@@ -646,6 +667,7 @@ CONFIG_SERIAL_NONSTANDARD=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -756,6 +778,12 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -827,7 +855,7 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -847,6 +875,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -886,6 +915,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -951,6 +981,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 CONFIG_EFI_PARTITION=y
 
 #
@@ -1021,18 +1052,20 @@ CONFIG_TEXTSEARCH_FSM=m
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=15
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
@@ -1040,6 +1073,11 @@ CONFIG_DEBUGGER=y
 # CONFIG_XMON is not set
 CONFIG_IRQSTACKS=y
 # CONFIG_BOOTX_TEXT is not set
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index d6fed3f56580..2c3fd2007676 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:30 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb 10 17:33:08 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+# CONFIG_PPC_UDBG_16550 is not set
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -26,13 +30,12 @@ CONFIG_PPC_FPU=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=2
+CONFIG_NR_CPUS=4
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -47,8 +50,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -112,13 +117,12 @@ CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
 # CONFIG_PPC_RTAS is not set
 # CONFIG_MMIO_NVRAM is not set
+CONFIG_MPIC_BROKEN_U3=y
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -151,6 +155,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -202,6 +207,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -239,6 +245,7 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -255,65 +262,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -324,6 +272,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -342,7 +295,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -545,13 +497,7 @@ CONFIG_SCSI_SATA_SVW=y
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -614,7 +560,6 @@ CONFIG_IEEE1394_SBP2=m
 CONFIG_IEEE1394_ETH1394=m
 CONFIG_IEEE1394_DV1394=m
 CONFIG_IEEE1394_RAWIO=y
-# CONFIG_IEEE1394_CMP is not set
 
 #
 # I2O device support
@@ -630,6 +575,7 @@ CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
 
 #
 # Network device support
@@ -682,8 +628,9 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
-CONFIG_TIGON3=m
+CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
 # CONFIG_MV643XX_ETH is not set
 
@@ -861,8 +808,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
-CONFIG_I2C_KEYWEST=y
-CONFIG_I2C_PMAC_SMU=y
+CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -895,6 +841,12 @@ CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -961,7 +913,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
@@ -1008,9 +959,10 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 
 #
 # Generic devices
@@ -1024,6 +976,8 @@ CONFIG_SND_GENERIC_DRIVER=y
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1032,39 +986,38 @@ CONFIG_SND_GENERIC_DRIVER=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_ALS4000 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # ALSA PowerMac devices
@@ -1136,13 +1089,16 @@ CONFIG_USB_STORAGE_DPCM=y
 CONFIG_USB_STORAGE_SDDR09=y
 CONFIG_USB_STORAGE_SDDR55=y
 CONFIG_USB_STORAGE_JUMPSHOT=y
+# CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 CONFIG_HID_FF=y
 CONFIG_HID_PID=y
 CONFIG_LOGITECH_FF=y
@@ -1159,6 +1115,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1207,6 +1164,7 @@ CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
 # CONFIG_USB_SERIAL_ANYDATA is not set
 CONFIG_USB_SERIAL_BELKIN=m
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
 CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
 # CONFIG_USB_SERIAL_CP2101 is not set
 CONFIG_USB_SERIAL_CYPRESS_M8=m
@@ -1288,6 +1246,10 @@ CONFIG_USB_EZUSB=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1317,6 +1279,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1357,6 +1320,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1426,6 +1390,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1481,10 +1446,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 
 #
 # Instrumentation Support
@@ -1497,24 +1458,31 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUGGER is not set
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/iseries_defconfig b/arch/powerpc/configs/iseries_defconfig
index c775027947f9..1816a46742f6 100644
--- a/arch/powerpc/configs/iseries_defconfig
+++ b/arch/powerpc/configs/iseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:32 2005
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:52 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+# CONFIG_PPC_UDBG_16550 is not set
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=32
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -49,8 +52,6 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -60,8 +61,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -70,8 +73,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_ISERIES=y
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_IBMVIO=y
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
@@ -183,6 +187,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -220,6 +225,28 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
 #
 # IP: Netfilter Configuration
@@ -237,39 +264,23 @@ CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
 CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
 CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
 CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
 CONFIG_IP_NF_MATCH_OWNER=m
 CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
 CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_MATCH_POLICY=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -285,13 +296,9 @@ CONFIG_IP_NF_MANGLE=m
 CONFIG_IP_NF_TARGET_TOS=m
 CONFIG_IP_NF_TARGET_ECN=m
 CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
 CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
 CONFIG_IP_NF_TARGET_CLUSTERIP=m
 CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -305,6 +312,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -451,13 +463,7 @@ CONFIG_SCSI_IBMVSCSI=m
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -574,6 +580,7 @@ CONFIG_E1000=m
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
@@ -723,6 +730,12 @@ CONFIG_MAX_RAW_DEVS=256
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -788,7 +801,7 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -825,6 +838,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -865,6 +879,7 @@ CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -993,31 +1008,36 @@ CONFIG_TEXTSEARCH_FSM=m
 #
 # Instrumentation Support
 #
-CONFIG_PROFILING=y
-CONFIG_OPROFILE=y
 # CONFIG_KPROBES is not set
 
 #
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 # CONFIG_DEBUGGER is not set
 CONFIG_IRQSTACKS=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/maple_defconfig b/arch/powerpc/configs/maple_defconfig
index 68194c03f6d1..80a0db43aeb7 100644
--- a/arch/powerpc/configs/maple_defconfig
+++ b/arch/powerpc/configs/maple_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:36 2005
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:54 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -32,7 +36,6 @@ CONFIG_NR_CPUS=2
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -47,8 +50,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -111,14 +116,12 @@ CONFIG_PPC_MULTIPLATFORM=y
 # CONFIG_PPC_PMAC is not set
 CONFIG_PPC_MAPLE=y
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
 # CONFIG_PPC_RTAS is not set
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_MPIC_BROKEN_U3=y
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
@@ -138,6 +141,7 @@ CONFIG_BINFMT_ELF=y
 CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -189,6 +193,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -226,6 +231,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -461,6 +471,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
@@ -553,6 +564,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -651,6 +663,12 @@ CONFIG_I2C_AMD8111=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -738,12 +756,14 @@ CONFIG_USB_UHCI_HCD=y
 # may also be needed; see USB_STORAGE Help for more information
 #
 # CONFIG_USB_STORAGE is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 # CONFIG_USB_AIPTEK is not set
@@ -757,6 +777,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -797,6 +818,7 @@ CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
 # CONFIG_USB_SERIAL_ANYDATA is not set
 # CONFIG_USB_SERIAL_BELKIN is not set
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
 # CONFIG_USB_SERIAL_DIGI_ACCELEPORT is not set
 # CONFIG_USB_SERIAL_CP2101 is not set
 CONFIG_USB_SERIAL_CYPRESS_M8=m
@@ -873,7 +895,7 @@ CONFIG_USB_EZUSB=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -891,6 +913,7 @@ CONFIG_JBD=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -927,6 +950,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -988,6 +1012,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1053,18 +1078,20 @@ CONFIG_ZLIB_INFLATE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 CONFIG_DEBUG_SLAB=y
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1073,6 +1100,11 @@ CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 # CONFIG_IRQSTACKS is not set
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/mpc834x_sys_defconfig b/arch/powerpc/configs/mpc834x_sys_defconfig
index 3bff761965c2..5078b0441d61 100644
--- a/arch/powerpc/configs/mpc834x_sys_defconfig
+++ b/arch/powerpc/configs/mpc834x_sys_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-g461d4edf-dirty
-# Fri Jan 13 11:01:47 2006
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:19:56 2006
 #
 # CONFIG_PPC64 is not set
 CONFIG_PPC32=y
@@ -43,7 +43,6 @@ CONFIG_PPC_STD_MMU_32=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -189,6 +188,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -226,6 +226,11 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -511,6 +516,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -615,6 +621,12 @@ CONFIG_I2C_MPC=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -632,6 +644,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_FSCPOS is not set
 # CONFIG_SENSORS_GL518SM is not set
@@ -716,7 +729,7 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -826,6 +839,7 @@ CONFIG_PARTITION_ADVANCED=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -899,13 +913,3 @@ CONFIG_CRYPTO_DES=y
 #
 # Hardware crypto devices
 #
-
-#
-# SEC2.x Options
-#
-CONFIG_MPC8349E_SEC2x=y
-
-#
-# SEC2.x Test Options
-#
-CONFIG_MPC8349E_SEC2xTEST=y
diff --git a/arch/powerpc/configs/pmac32_defconfig b/arch/powerpc/configs/pmac32_defconfig
index 2ace57d1e333..57a027971d67 100644
--- a/arch/powerpc/configs/pmac32_defconfig
+++ b/arch/powerpc/configs/pmac32_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15
-# Sat Jan 14 16:26:08 2006
+# Linux kernel version: 2.6.16-rc6
+# Wed Mar 15 16:21:32 2006
 #
 # CONFIG_PPC64 is not set
 CONFIG_PPC32=y
@@ -17,8 +17,8 @@ CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 # CONFIG_PPC_UDBG_16550 is not set
-# CONFIG_CRASH_DUMP is not set
 # CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -43,7 +43,6 @@ CONFIG_PPC_STD_MMU_32=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -236,6 +235,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -271,6 +271,25 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
+CONFIG_NETFILTER_XT_TARGET_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+# CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LENGTH=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
+CONFIG_NETFILTER_XT_MATCH_REALM=m
+CONFIG_NETFILTER_XT_MATCH_SCTP=m
+CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_NETFILTER_XT_MATCH_STRING=m
+CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
 #
 # IP: Netfilter Configuration
@@ -288,37 +307,22 @@ CONFIG_IP_NF_AMANDA=m
 CONFIG_IP_NF_PPTP=m
 # CONFIG_IP_NF_QUEUE is not set
 CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
 CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
 CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
 CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
 CONFIG_IP_NF_MATCH_OWNER=m
-# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
-# CONFIG_IP_NF_MATCH_REALM is not set
-# CONFIG_IP_NF_MATCH_SCTP is not set
-CONFIG_IP_NF_MATCH_DCCP=m
-# CONFIG_IP_NF_MATCH_COMMENT is not set
-# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
-CONFIG_IP_NF_MATCH_STRING=m
+CONFIG_IP_NF_MATCH_ADDRTYPE=m
+CONFIG_IP_NF_MATCH_HASHLIMIT=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
-# CONFIG_IP_NF_TARGET_LOG is not set
+CONFIG_IP_NF_TARGET_LOG=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_IP_NF_TARGET_TCPMSS=m
-# CONFIG_IP_NF_TARGET_NFQUEUE is not set
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_NAT_NEEDED=y
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -331,9 +335,12 @@ CONFIG_IP_NF_NAT_FTP=m
 CONFIG_IP_NF_NAT_TFTP=m
 CONFIG_IP_NF_NAT_AMANDA=m
 CONFIG_IP_NF_NAT_PPTP=m
-# CONFIG_IP_NF_MANGLE is not set
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_TOS=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_DSCP=m
+CONFIG_IP_NF_TARGET_TTL=m
 CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
 CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
@@ -360,6 +367,11 @@ CONFIG_IP_DCCP_TFRC_LIB=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -377,6 +389,7 @@ CONFIG_IP_DCCP_TFRC_LIB=m
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
+CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -568,7 +581,6 @@ CONFIG_IDEDMA_PCI_AUTO=y
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
 CONFIG_BLK_DEV_PDC202XX_NEW=y
-# CONFIG_PDC202XX_FORCE is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
 # CONFIG_BLK_DEV_SLC90E66 is not set
@@ -654,8 +666,7 @@ CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA2XXX_EMBEDDED_FIRMWARE is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -991,6 +1002,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=m
 CONFIG_SERIAL_PMACZILOG=m
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -1098,6 +1110,12 @@ CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -1348,6 +1366,7 @@ CONFIG_USB_PRINTER=m
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+CONFIG_USB_HIDINPUT_POWERBOOK=y
 # CONFIG_HID_FF is not set
 # CONFIG_USB_HIDDEV is not set
 # CONFIG_USB_AIPTEK is not set
@@ -1488,7 +1507,7 @@ CONFIG_USB_EZUSB=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -1609,6 +1628,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1692,6 +1712,7 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUGGER=y
 CONFIG_XMON=y
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 6f6c6bed1aa5..395e49847788 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:38 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb 10 17:32:14 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=32
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -48,8 +51,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
@@ -59,8 +60,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -69,8 +72,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 CONFIG_PPC_MAPLE=y
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_XICS=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
@@ -124,8 +128,8 @@ CONFIG_RTAS_FLASH=m
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_MPIC_BROKEN_U3=y
 CONFIG_IBMVIO=y
+# CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -158,6 +162,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_PPC_SPLPAR=y
 CONFIG_EEH=y
@@ -178,6 +183,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
@@ -221,6 +227,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -260,6 +267,7 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -277,65 +285,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-CONFIG_IP_NF_MATCH_DCCP=m
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -346,6 +295,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -364,7 +318,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -454,7 +407,7 @@ CONFIG_IDEPCI_SHARE_IRQ=y
 # CONFIG_BLK_DEV_OFFBOARD is not set
 CONFIG_BLK_DEV_GENERIC=y
 # CONFIG_BLK_DEV_OPTI621 is not set
-# CONFIG_BLK_DEV_SL82C105 is not set
+CONFIG_BLK_DEV_SL82C105=y
 CONFIG_BLK_DEV_IDEDMA_PCI=y
 # CONFIG_BLK_DEV_IDEDMA_FORCED is not set
 CONFIG_IDEDMA_PCI_AUTO=y
@@ -572,13 +525,7 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-CONFIG_SCSI_QLA6312=m
-CONFIG_SCSI_QLA24XX=m
+# CONFIG_SCSI_QLA_FC is not set
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -642,8 +589,6 @@ CONFIG_IEEE1394_SBP2=m
 CONFIG_IEEE1394_ETH1394=m
 CONFIG_IEEE1394_DV1394=m
 CONFIG_IEEE1394_RAWIO=y
-CONFIG_IEEE1394_CMP=m
-CONFIG_IEEE1394_AMDTP=m
 
 #
 # I2O device support
@@ -659,6 +604,7 @@ CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
 
 #
 # Network device support
@@ -731,6 +677,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -853,6 +800,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -880,6 +828,7 @@ CONFIG_HVCS=m
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
 CONFIG_GEN_RTC=y
+# CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -923,8 +872,7 @@ CONFIG_I2C_AMD8111=y
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
-CONFIG_I2C_KEYWEST=y
-CONFIG_I2C_PMAC_SMU=y
+CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -957,6 +905,12 @@ CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -1028,7 +982,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
@@ -1073,9 +1026,10 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 
 #
 # Generic devices
@@ -1089,6 +1043,8 @@ CONFIG_SND_GENERIC_DRIVER=y
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1097,39 +1053,38 @@ CONFIG_SND_GENERIC_DRIVER=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_ALS4000 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # ALSA PowerMac devices
@@ -1201,13 +1156,16 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1221,6 +1179,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1307,6 +1266,10 @@ CONFIG_INFINIBAND_IPOIB=m
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1340,6 +1303,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1379,6 +1343,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1449,6 +1414,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1504,10 +1470,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 
 #
 # Instrumentation Support
@@ -1520,18 +1482,20 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1540,6 +1504,11 @@ CONFIG_XMON=y
 # CONFIG_XMON_DEFAULT is not set
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index aa9893a1f6e8..daaf038a1faa 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:40 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb 10 17:33:32 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=128
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -49,8 +52,6 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
@@ -60,8 +61,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -70,8 +73,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_PSERIES=y
 # CONFIG_PPC_PMAC is not set
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_XICS=y
 # CONFIG_U3_DART is not set
 CONFIG_MPIC=y
@@ -123,8 +127,8 @@ CONFIG_RTAS_PROC=y
 CONFIG_RTAS_FLASH=m
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_IBMVIO=y
+# CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
@@ -145,6 +149,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_PPC_SPLPAR=y
 CONFIG_EEH=y
@@ -165,6 +170,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
@@ -209,6 +215,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -248,6 +255,7 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -265,65 +273,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -334,6 +283,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -352,7 +306,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -550,13 +503,7 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-CONFIG_SCSI_QLA6312=m
-CONFIG_SCSI_QLA24XX=m
+# CONFIG_SCSI_QLA_FC is not set
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -678,6 +625,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -803,6 +751,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -909,6 +858,12 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -976,7 +931,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
@@ -1061,12 +1015,15 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1080,6 +1037,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1167,6 +1125,10 @@ CONFIG_INFINIBAND_IPOIB=m
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1200,6 +1162,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1240,6 +1203,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1351,10 +1315,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 
 #
 # Instrumentation Support
@@ -1367,18 +1327,20 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1387,6 +1349,11 @@ CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_IRQSTACKS=y
 # CONFIG_BOOTX_TEXT is not set
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index c287980b7e65..80e9fe2632b8 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -12,10 +12,10 @@ endif
 
 obj-y                           := semaphore.o cputable.o ptrace.o syscalls.o \
                                    irq.o align.o signal_32.o pmc.o vdso.o \
-                                   init_task.o process.o
+                                   init_task.o process.o systbl.o
 obj-y                           += vdso32/
 obj-$(CONFIG_PPC64)             += setup_64.o binfmt_elf32.o sys_ppc32.o \
-                                   signal_64.o ptrace32.o systbl.o \
+                                   signal_64.o ptrace32.o \
                                    paca.o cpu_setup_power4.o \
                                    firmware.o sysfs.o idle_64.o
 obj-$(CONFIG_PPC64)             += vdso64/
@@ -46,7 +46,7 @@ extra-$(CONFIG_8xx)		:= head_8xx.o
 extra-y                         += vmlinux.lds
 
 obj-y                           += time.o prom.o traps.o setup-common.o udbg.o
-obj-$(CONFIG_PPC32)             += entry_32.o setup_32.o misc_32.o systbl.o
+obj-$(CONFIG_PPC32)             += entry_32.o setup_32.o misc_32.o
 obj-$(CONFIG_PPC64)             += misc_64.o dma_64.o iommu.o
 obj-$(CONFIG_PPC_MULTIPLATFORM) += prom_init.o
 obj-$(CONFIG_MODULES)           += ppc_ksyms.o
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 840aad43a98b..c9a660e4c2db 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -92,7 +92,6 @@ int main(void)
 
         DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));
         DEFINE(TI_PREEMPT, offsetof(struct thread_info, preempt_count));
-        DEFINE(TI_SIGFRAME, offsetof(struct thread_info, nvgprs_frame));
         DEFINE(TI_TASK, offsetof(struct thread_info, task));
 #ifdef CONFIG_PPC32
         DEFINE(TI_EXECDOMAIN, offsetof(struct thread_info, exec_domain));
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 10696456a4c6..e4e81374cb9a 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -53,8 +53,10 @@ extern void __setup_cpu_ppc970(unsigned long offset, struct cpu_spec* spec);
                                  PPC_FEATURE_HAS_MMU)
 #define COMMON_USER_PPC64       (COMMON_USER | PPC_FEATURE_64)
 #define COMMON_USER_POWER4      (COMMON_USER_PPC64 | PPC_FEATURE_POWER4)
-#define COMMON_USER_POWER5      (COMMON_USER_PPC64 | PPC_FEATURE_POWER5)
-#define COMMON_USER_POWER5_PLUS (COMMON_USER_PPC64 | PPC_FEATURE_POWER5_PLUS)
+#define COMMON_USER_POWER5      (COMMON_USER_PPC64 | PPC_FEATURE_POWER5 |\
+                                 PPC_FEATURE_SMT | PPC_FEATURE_ICACHE_SNOOP)
+#define COMMON_USER_POWER5_PLUS (COMMON_USER_PPC64 | PPC_FEATURE_POWER5_PLUS|\
+                                 PPC_FEATURE_SMT | PPC_FEATURE_ICACHE_SNOOP)
 #define COMMON_USER_BOOKE       (PPC_FEATURE_32 | PPC_FEATURE_HAS_MMU | \
                                  PPC_FEATURE_BOOKE)
 
@@ -267,7 +269,8 @@ struct cpu_spec	cpu_specs[] = {
                 .cpu_name               = "Cell Broadband Engine",
                 .cpu_features           = CPU_FTRS_CELL,
                 .cpu_user_features      = COMMON_USER_PPC64 |
-                        PPC_FEATURE_CELL | PPC_FEATURE_HAS_ALTIVEC_COMP,
+                        PPC_FEATURE_CELL | PPC_FEATURE_HAS_ALTIVEC_COMP |
+                        PPC_FEATURE_SMT,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
                 .cpu_setup              = __setup_cpu_be,
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 8c21d378f5d2..778f22fd85d2 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -134,8 +134,10 @@ static void crash_kexec_prepare_cpus(void)
          * the crash CPU will send an IPI and wait for other CPUs to
          * respond. If not, proceed the kexec boot even though we failed to
          * capture other CPU states.
+         * Delay of at least 10 seconds.
          */
-        msecs = 1000000;
+        printk(KERN_ALERT "Sending IPI to other cpus...\n");
+        msecs = 10000;
         while ((atomic_read(&waiting_for_crash_ipi) > 0) && (--msecs > 0)) {
                 barrier();
                 mdelay(1);
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index f20a67261ec7..4827ca1ec89b 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -227,7 +227,7 @@ ret_from_syscall:
         MTMSRD(r10)
         lwz     r9,TI_FLAGS(r12)
         li      r8,-_LAST_ERRNO
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL|_TIF_RESTORE_SIGMASK)
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_USER_WORK_MASK|_TIF_PERSYSCALL_MASK)
         bne-    syscall_exit_work
         cmplw   0,r3,r8
         blt+    syscall_exit_cont
@@ -287,8 +287,10 @@ syscall_dotrace:
 
 syscall_exit_work:
         andi.   r0,r9,_TIF_RESTOREALL
-        bne-    2f
-        cmplw   0,r3,r8
+        beq+    0f
+        REST_NVGPRS(r1)
+        b       2f
+0:      cmplw   0,r3,r8
         blt+    1f
         andi.   r0,r9,_TIF_NOERROR
         bne-    1f
@@ -302,9 +304,7 @@ syscall_exit_work:
 2:      andi.   r0,r9,(_TIF_PERSYSCALL_MASK)
         beq     4f
 
-        /* Clear per-syscall TIF flags if any are set, but _leave_
-        _TIF_SAVE_NVGPRS set in r9 since we haven't dealt with that
-        yet.  */
+        /* Clear per-syscall TIF flags if any are set.  */
 
         li      r11,_TIF_PERSYSCALL_MASK
         addi    r12,r12,TI_FLAGS
@@ -318,8 +318,13 @@ syscall_exit_work:
         subi    r12,r12,TI_FLAGS
         
 4:      /* Anything which requires enabling interrupts? */
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SAVE_NVGPRS)
-        beq     7f
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
+        beq     ret_from_except
+
+        /* Re-enable interrupts */
+        ori     r10,r10,MSR_EE
+        SYNC
+        MTMSRD(r10)
 
         /* Save NVGPRS if they're not saved already */
         lwz     r4,_TRAP(r1)
@@ -328,71 +333,11 @@ syscall_exit_work:
         SAVE_NVGPRS(r1)
         li      r4,0xc00
         stw     r4,_TRAP(r1)
-
-        /* Re-enable interrupts */
-5:      ori     r10,r10,MSR_EE
-        SYNC
-        MTMSRD(r10)
-
-        andi.   r0,r9,_TIF_SAVE_NVGPRS
-        bne     save_user_nvgprs
-
-save_user_nvgprs_cont:
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
-        beq     7f
-
+5:
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      do_syscall_trace_leave
-        REST_NVGPRS(r1)
-
-6:      lwz     r3,GPR3(r1)
-        LOAD_MSR_KERNEL(r10,MSR_KERNEL) /* doesn't include MSR_EE */
-        SYNC
-        MTMSRD(r10)             /* disable interrupts again */
-        rlwinm  r12,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
-        lwz     r9,TI_FLAGS(r12)
-7:
-        andi.   r0,r9,_TIF_NEED_RESCHED
-        bne     8f
-        lwz     r5,_MSR(r1)
-        andi.   r5,r5,MSR_PR
-        beq     ret_from_except
-        andi.   r0,r9,_TIF_SIGPENDING|_TIF_RESTORE_SIGMASK
-        beq     ret_from_except
-        b       do_user_signal
-8:
-        ori     r10,r10,MSR_EE
-        SYNC
-        MTMSRD(r10)             /* re-enable interrupts */
-        bl      schedule
-        b       6b
-
-save_user_nvgprs:
-        lwz     r8,TI_SIGFRAME(r12)
-
-.macro savewords start, end
-  1:    stw \start,4*(\start)(r8)
-        .section __ex_table,"a"
-        .align  2
-        .long   1b,save_user_nvgprs_fault
-        .previous
-        .if \end - \start
-        savewords "(\start+1)",\end
-        .endif
-.endm   
-        savewords 14,31
-        b       save_user_nvgprs_cont
-
-        
-save_user_nvgprs_fault:
-        li      r3,11           /* SIGSEGV */
-        lwz     r4,TI_TASK(r12)
-        bl      force_sigsegv
+        b       ret_from_except_full
 
-        rlwinm  r12,r1,0,0,(31-THREAD_SHIFT)    /* current_thread_info() */
-        lwz     r9,TI_FLAGS(r12)
-        b       save_user_nvgprs_cont
-        
 #ifdef SHOW_SYSCALLS
 do_show_syscall:
 #ifdef SHOW_SYSCALLS_TASK
@@ -490,6 +435,14 @@ ppc_clone:
         stw     r0,_TRAP(r1)            /* register set saved */
         b       sys_clone
 
+        .globl  ppc_swapcontext
+ppc_swapcontext:
+        SAVE_NVGPRS(r1)
+        lwz     r0,_TRAP(r1)
+        rlwinm  r0,r0,0,0,30            /* clear LSB to indicate full */
+        stw     r0,_TRAP(r1)            /* register set saved */
+        b       sys_swapcontext
+
 /*
  * Top-level page fault handling.
  * This is in assembler because if do_page_fault tells us that
@@ -683,7 +636,7 @@ user_exc_return:		/* r10 contains MSR_KERNEL here */
         /* Check current_thread_info()->flags */
         rlwinm  r9,r1,0,0,(31-THREAD_SHIFT)
         lwz     r9,TI_FLAGS(r9)
-        andi.   r0,r9,(_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL|_TIF_RESTORE_SIGMASK)
+        andi.   r0,r9,(_TIF_SIGPENDING|_TIF_RESTORE_SIGMASK|_TIF_NEED_RESCHED)
         bne     do_work
 
 restore_user:
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 388f861b8ed1..24be0cf86d7f 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -160,7 +160,7 @@ syscall_exit:
         mtmsrd  r10,1
         ld      r9,TI_FLAGS(r12)
         li      r11,-_LAST_ERRNO
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL|_TIF_SAVE_NVGPRS|_TIF_NOERROR|_TIF_RESTORE_SIGMASK)
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_USER_WORK_MASK|_TIF_PERSYSCALL_MASK)
         bne-    syscall_exit_work
         cmpld   r3,r11
         ld      r5,_CCR(r1)
@@ -216,8 +216,10 @@ syscall_exit_work:
          If TIF_NOERROR is set, just save r3 as it is. */
 
         andi.   r0,r9,_TIF_RESTOREALL
-        bne-    2f
-        cmpld   r3,r11          /* r10 is -LAST_ERRNO */
+        beq+    0f
+        REST_NVGPRS(r1)
+        b       2f
+0:      cmpld   r3,r11          /* r10 is -LAST_ERRNO */
         blt+    1f
         andi.   r0,r9,_TIF_NOERROR
         bne-    1f
@@ -229,9 +231,7 @@ syscall_exit_work:
 2:      andi.   r0,r9,(_TIF_PERSYSCALL_MASK)
         beq     4f
 
-        /* Clear per-syscall TIF flags if any are set, but _leave_
-        _TIF_SAVE_NVGPRS set in r9 since we haven't dealt with that
-        yet.  */
+        /* Clear per-syscall TIF flags if any are set.  */
 
         li      r11,_TIF_PERSYSCALL_MASK
         addi    r12,r12,TI_FLAGS
@@ -240,10 +240,9 @@ syscall_exit_work:
         stdcx.  r10,0,r12
         bne-    3b
         subi    r12,r12,TI_FLAGS
-        
-4:      bl      .save_nvgprs
-        /* Anything else left to do? */
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SAVE_NVGPRS)
+
+4:      /* Anything else left to do? */
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
         beq     .ret_from_except_lite
 
         /* Re-enable interrupts */
@@ -251,26 +250,10 @@ syscall_exit_work:
         ori     r10,r10,MSR_EE
         mtmsrd  r10,1
 
-        andi.   r0,r9,_TIF_SAVE_NVGPRS
-        bne     save_user_nvgprs
-
-        /* If tracing, re-enable interrupts and do it */
-save_user_nvgprs_cont:  
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
-        beq     5f
-        
+        bl      .save_nvgprs
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      .do_syscall_trace_leave
-        REST_NVGPRS(r1)
-        clrrdi  r12,r1,THREAD_SHIFT
-
-        /* Disable interrupts again and handle other work if any */
-5:      mfmsr   r10
-        rldicl  r10,r10,48,1
-        rotldi  r10,r10,16
-        mtmsrd  r10,1
-
-        b       .ret_from_except_lite
+        b       .ret_from_except
 
 /* Save non-volatile GPRs, if not already saved. */
 _GLOBAL(save_nvgprs)
@@ -282,51 +265,6 @@ _GLOBAL(save_nvgprs)
         std     r0,_TRAP(r1)
         blr
 
-
-save_user_nvgprs:
-        ld      r10,TI_SIGFRAME(r12)
-        andi.   r0,r9,_TIF_32BIT
-        beq-    save_user_nvgprs_64
-
-        /* 32-bit save to userspace */
-
-.macro savewords start, end
-  1:    stw \start,4*(\start)(r10)
-        .section __ex_table,"a"
-        .align  3
-        .llong  1b,save_user_nvgprs_fault
-        .previous
-        .if \end - \start
-        savewords "(\start+1)",\end
-        .endif
-.endm   
-        savewords 14,31
-        b       save_user_nvgprs_cont
-
-save_user_nvgprs_64:
-        /* 64-bit save to userspace */
-
-.macro savelongs start, end
-  1:    std \start,8*(\start)(r10)
-        .section __ex_table,"a"
-        .align  3
-        .llong  1b,save_user_nvgprs_fault
-        .previous
-        .if \end - \start
-        savelongs "(\start+1)",\end
-        .endif
-.endm   
-        savelongs 14,31
-        b       save_user_nvgprs_cont
-
-save_user_nvgprs_fault:
-        li      r3,11           /* SIGSEGV */
-        ld      r4,TI_TASK(r12)
-        bl      .force_sigsegv
-
-        clrrdi  r12,r1,THREAD_SHIFT
-        ld      r9,TI_FLAGS(r12)
-        b       save_user_nvgprs_cont
         
 /*
  * The sigsuspend and rt_sigsuspend system calls can call do_signal
@@ -352,6 +290,16 @@ _GLOBAL(ppc_clone)
         bl      .sys_clone
         b       syscall_exit
 
+_GLOBAL(ppc32_swapcontext)
+        bl      .save_nvgprs
+        bl      .compat_sys_swapcontext
+        b       syscall_exit
+
+_GLOBAL(ppc64_swapcontext)
+        bl      .save_nvgprs
+        bl      .sys_swapcontext
+        b       syscall_exit
+
 _GLOBAL(ret_from_fork)
         bl      .schedule_tail
         REST_NVGPRS(r1)
diff --git a/arch/powerpc/kernel/fpu.S b/arch/powerpc/kernel/fpu.S
index e4362dfa37fb..340730fb8c91 100644
--- a/arch/powerpc/kernel/fpu.S
+++ b/arch/powerpc/kernel/fpu.S
@@ -66,7 +66,7 @@ _GLOBAL(load_up_fpu)
 #else
         ld      r4,PACACURRENT(r13)
         addi    r5,r4,THREAD            /* Get THREAD */
-        ld      r4,THREAD_FPEXC_MODE(r5)
+        lwz     r4,THREAD_FPEXC_MODE(r5)
         ori     r12,r12,MSR_FP
         or      r12,r12,r4
         std     r12,_MSR(r1)
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index 03b25f9359f8..a0579e859b21 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -714,6 +714,7 @@ AltiVecUnavailable:
 #ifdef CONFIG_ALTIVEC
         bne     load_up_altivec         /* if from user, just load it up */
 #endif /* CONFIG_ALTIVEC */
+        addi    r3,r1,STACK_FRAME_OVERHEAD
         EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 
 PerformanceMonitor:
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 308268466342..9b65029dd2a3 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -139,7 +139,7 @@ _GLOBAL(__secondary_hold)
         ori     r24,r24,MSR_RI
         mtmsrd  r24                     /* RI on */
 
-        /* Grab our linux cpu number */
+        /* Grab our physical cpu number */
         mr      r24,r3
 
         /* Tell the master cpu we're here */
@@ -153,12 +153,7 @@ _GLOBAL(__secondary_hold)
         cmpdi   0,r4,1
         bne     100b
 
-#ifdef CONFIG_HMT
-        SET_REG_IMMEDIATE(r4, .hmt_init)
-        mtctr   r4
-        bctr
-#else
-#ifdef CONFIG_SMP
+#if defined(CONFIG_SMP) || defined(CONFIG_KEXEC)
         LOAD_REG_IMMEDIATE(r4, .pSeries_secondary_smp_init)
         mtctr   r4
         mr      r3,r24
@@ -166,7 +161,6 @@ _GLOBAL(__secondary_hold)
 #else
         BUG_OPCODE
 #endif
-#endif
 
 /* This value is used to mark exception frames on the stack. */
         .section ".toc","aw"
@@ -321,7 +315,6 @@ exception_marker:
 label##_pSeries:                                        \
         HMT_MEDIUM;                                     \
         mtspr   SPRN_SPRG1,r13;         /* save r13 */  \
-        RUNLATCH_ON(r13);                               \
         EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, label##_common)
 
 #define STD_EXCEPTION_ISERIES(n, label, area)           \
@@ -329,7 +322,6 @@ label##_pSeries:					\
 label##_iSeries:                                        \
         HMT_MEDIUM;                                     \
         mtspr   SPRN_SPRG1,r13;         /* save r13 */  \
-        RUNLATCH_ON(r13);                               \
         EXCEPTION_PROLOG_ISERIES_1(area);               \
         EXCEPTION_PROLOG_ISERIES_2;                     \
         b       label##_common
@@ -339,7 +331,6 @@ label##_iSeries:					\
 label##_iSeries:                                                        \
         HMT_MEDIUM;                                                     \
         mtspr   SPRN_SPRG1,r13;         /* save r13 */                  \
-        RUNLATCH_ON(r13);                                               \
         EXCEPTION_PROLOG_ISERIES_1(PACA_EXGEN);                         \
         lbz     r10,PACAPROCENABLED(r13);                               \
         cmpwi   0,r10,0;                                                \
@@ -392,6 +383,7 @@ label##_common:						\
 label##_common:                                         \
         EXCEPTION_PROLOG_COMMON(trap, PACA_EXGEN);      \
         DISABLE_INTS;                                   \
+        bl      .ppc64_runlatch_on;                     \
         addi    r3,r1,STACK_FRAME_OVERHEAD;             \
         bl      hdlr;                                   \
         b       .ret_from_except_lite
@@ -409,7 +401,6 @@ __start_interrupts:
 _machine_check_pSeries:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
         EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
 
         . = 0x300
@@ -436,7 +427,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
 data_access_slb_pSeries:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13
-        RUNLATCH_ON(r13)
         mfspr   r13,SPRN_SPRG3          /* get paca address into r13 */
         std     r3,PACA_EXSLB+EX_R3(r13)
         mfspr   r3,SPRN_DAR
@@ -462,7 +452,6 @@ data_access_slb_pSeries:
 instruction_access_slb_pSeries:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13
-        RUNLATCH_ON(r13)
         mfspr   r13,SPRN_SPRG3          /* get paca address into r13 */
         std     r3,PACA_EXSLB+EX_R3(r13)
         mfspr   r3,SPRN_SRR0            /* SRR0 is faulting address */
@@ -493,7 +482,6 @@ instruction_access_slb_pSeries:
         .globl  system_call_pSeries
 system_call_pSeries:
         HMT_MEDIUM
-        RUNLATCH_ON(r9)
         mr      r9,r13
         mfmsr   r10
         mfspr   r13,SPRN_SPRG3
@@ -577,7 +565,6 @@ slb_miss_user_pseries:
 system_reset_fwnmi:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
         EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common)
 
         .globl machine_check_fwnmi
@@ -585,7 +572,6 @@ system_reset_fwnmi:
 machine_check_fwnmi:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
         EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
 
 #ifdef CONFIG_PPC_ISERIES
@@ -749,11 +735,12 @@ iSeries_secondary_smp_loop:
 
         .globl decrementer_iSeries_masked
 decrementer_iSeries_masked:
+        /* We may not have a valid TOC pointer in here. */
         li      r11,1
         ld      r12,PACALPPACAPTR(r13)
         stb     r11,LPPACADECRINT(r12)
-        LOAD_REG_ADDRBASE(r12,tb_ticks_per_jiffy)
-        lwz     r12,ADDROFF(tb_ticks_per_jiffy)(r12)
+        LOAD_REG_IMMEDIATE(r12, tb_ticks_per_jiffy)
+        lwz     r12,0(r12)
         mtspr   SPRN_DEC,r12
         /* fall through */
 
@@ -895,7 +882,6 @@ unrecov_fer:
         .align  7
         .globl data_access_common
 data_access_common:
-        RUNLATCH_ON(r10)                /* It wont fit in the 0x300 handler */
         mfspr   r10,SPRN_DAR
         std     r10,PACA_EXGEN+EX_DAR(r13)
         mfspr   r10,SPRN_DSISR
@@ -1043,6 +1029,7 @@ hardware_interrupt_common:
         EXCEPTION_PROLOG_COMMON(0x500, PACA_EXGEN)
 hardware_interrupt_entry:
         DISABLE_INTS
+        bl      .ppc64_runlatch_on
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      .do_IRQ
         b       .ret_from_except_lite
@@ -1550,6 +1537,9 @@ _STATIC(__boot_from_prom)
         mr      r28,r6
         mr      r27,r7
 
+        /* Align the stack to 16-byte boundary for broken yaboot */
+        rldicr  r1,r1,0,59
+
         /* Make sure we are running in 64 bits mode */
         bl      .enable_64b_mode
 
@@ -1817,22 +1807,6 @@ _STATIC(start_here_multiplatform)
         ori     r6,r6,MSR_RI
         mtmsrd  r6                      /* RI on */
 
-#ifdef CONFIG_HMT
-        /* Start up the second thread on cpu 0 */
-        mfspr   r3,SPRN_PVR
-        srwi    r3,r3,16
-        cmpwi   r3,0x34                 /* Pulsar  */
-        beq     90f
-        cmpwi   r3,0x36                 /* Icestar */
-        beq     90f
-        cmpwi   r3,0x37                 /* SStar   */
-        beq     90f
-        b       91f                     /* HMT not supported */
-90:     li      r3,0
-        bl      .hmt_start_secondary
-91:
-#endif
-
         /* The following gets the stack and TOC set up with the regs */
         /* pointing to the real addr of the kernel stack.  This is   */
         /* all done to support the C function call below which sets  */
@@ -1946,77 +1920,8 @@ _STATIC(start_here_common)
 
         bl .start_kernel
 
-_GLOBAL(hmt_init)
-#ifdef CONFIG_HMT
-        LOAD_REG_IMMEDIATE(r5, hmt_thread_data)
-        mfspr   r7,SPRN_PVR
-        srwi    r7,r7,16
-        cmpwi   r7,0x34                 /* Pulsar  */
-        beq     90f
-        cmpwi   r7,0x36                 /* Icestar */
-        beq     91f
-        cmpwi   r7,0x37                 /* SStar   */
-        beq     91f
-        b       101f
-90:     mfspr   r6,SPRN_PIR
-        andi.   r6,r6,0x1f
-        b       92f
-91:     mfspr   r6,SPRN_PIR
-        andi.   r6,r6,0x3ff
-92:     sldi    r4,r24,3
-        stwx    r6,r5,r4
-        bl      .hmt_start_secondary
-        b       101f
-
-__hmt_secondary_hold:
-        LOAD_REG_IMMEDIATE(r5, hmt_thread_data)
-        clrldi  r5,r5,4
-        li      r7,0
-        mfspr   r6,SPRN_PIR
-        mfspr   r8,SPRN_PVR
-        srwi    r8,r8,16
-        cmpwi   r8,0x34
-        bne     93f
-        andi.   r6,r6,0x1f
-        b       103f
-93:     andi.   r6,r6,0x3f
-
-103:    lwzx    r8,r5,r7
-        cmpw    r8,r6
-        beq     104f
-        addi    r7,r7,8
-        b       103b
-
-104:    addi    r7,r7,4
-        lwzx    r9,r5,r7
-        mr      r24,r9
-101:
-#endif
-        mr      r3,r24
-        b       .pSeries_secondary_smp_init
-
-#ifdef CONFIG_HMT
-_GLOBAL(hmt_start_secondary)
-        LOAD_REG_IMMEDIATE(r4,__hmt_secondary_hold)
-        clrldi  r4,r4,4
-        mtspr   SPRN_NIADORM, r4
-        mfspr   r4, SPRN_MSRDORM
-        li      r5, -65
-        and     r4, r4, r5
-        mtspr   SPRN_MSRDORM, r4
-        lis     r4,0xffef
-        ori     r4,r4,0x7403
-        mtspr   SPRN_TSC, r4
-        li      r4,0x1f4
-        mtspr   SPRN_TST, r4
-        mfspr   r4, SPRN_HID0
-        ori     r4, r4, 0x1
-        mtspr   SPRN_HID0, r4
-        mfspr   r4, SPRN_CTRLF
-        oris    r4, r4, 0x40
-        mtspr   SPRN_CTRLT, r4
-        blr
-#endif
+        /* Not reached */
+        BUG_OPCODE
 
 /*
  * We put a few things here that have to be page-aligned.
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 4d9b4388918b..946f3219fd29 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -334,9 +334,6 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
 
         spin_unlock_irqrestore(&(tbl->it_lock), flags);
 
-        /* Make sure updates are seen by hardware */
-        mb();
-
         DBG("mapped %d elements:\n", outcount);
 
         /* For the sake of iommu_unmap_sg, we clear out the length in the
@@ -347,6 +344,10 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                 outs->dma_address = DMA_ERROR_CODE;
                 outs->dma_length = 0;
         }
+
+        /* Make sure updates are seen by hardware */
+        mb();
+
         return outcount;
 
  failure:
@@ -358,6 +359,8 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                         npages = (PAGE_ALIGN(s->dma_address + s->dma_length) - vaddr)
                                 >> PAGE_SHIFT;
                         __iommu_free(tbl, vaddr, npages);
+                        s->dma_address = DMA_ERROR_CODE;
+                        s->dma_length = 0;
                 }
         }
         spin_unlock_irqrestore(&(tbl->it_lock), flags);
diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
index 1ae96a8ed7e2..e789fef4eb8a 100644
--- a/arch/powerpc/kernel/lparcfg.c
+++ b/arch/powerpc/kernel/lparcfg.c
@@ -341,7 +341,7 @@ static int lparcfg_data(struct seq_file *m, void *v)
         const char *system_id = "";
         unsigned int *lp_index_ptr, lp_index = 0;
         struct device_node *rtas_node;
-        int *lrdrp;
+        int *lrdrp = NULL;
 
         rootdn = find_path_device("/");
         if (rootdn) {
@@ -362,7 +362,9 @@ static int lparcfg_data(struct seq_file *m, void *v)
         seq_printf(m, "partition_id=%d\n", (int)lp_index);
 
         rtas_node = find_path_device("/rtas");
-        lrdrp = (int *)get_property(rtas_node, "ibm,lrdr-capacity", NULL);
+        if (rtas_node)
+                lrdrp = (int *)get_property(rtas_node, "ibm,lrdr-capacity",
+                                            NULL);
 
         if (lrdrp == NULL) {
                 partition_potential_processors = vdso_data->processorCount;
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index d6431440c54f..ee166c586642 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -26,8 +26,6 @@
 #include <asm/prom.h>
 #include <asm/smp.h>
 
-#define HASH_GROUP_SIZE 0x80    /* size of each hash group, asm/mmu.h */
-
 int default_machine_kexec_prepare(struct kimage *image)
 {
         int i;
@@ -61,7 +59,7 @@ int default_machine_kexec_prepare(struct kimage *image)
          */
         if (htab_address) {
                 low = __pa(htab_address);
-                high = low + (htab_hash_mask + 1) * HASH_GROUP_SIZE;
+                high = low + htab_size_bytes;
 
                 for (i = 0; i < image->nr_segments; i++) {
                         begin = image->segment[i].mem;
@@ -294,7 +292,7 @@ void default_machine_kexec(struct kimage *image)
 }
 
 /* Values we need to export to the second kernel via the device tree. */
-static unsigned long htab_base, htab_size, kernel_end;
+static unsigned long htab_base, kernel_end;
 
 static struct property htab_base_prop = {
         .name = "linux,htab-base",
@@ -305,7 +303,7 @@ static struct property htab_base_prop = {
 static struct property htab_size_prop = {
         .name = "linux,htab-size",
         .length = sizeof(unsigned long),
-        .value = (unsigned char *)&htab_size,
+        .value = (unsigned char *)&htab_size_bytes,
 };
 
 static struct property kernel_end_prop = {
@@ -331,8 +329,6 @@ static void __init export_htab_values(void)
 
         htab_base = __pa(htab_address);
         prom_add_property(node, &htab_base_prop);
-
-        htab_size = 1UL << ppc64_pft_size;
         prom_add_property(node, &htab_size_prop);
 
  out:
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index c367520bc1c3..ba92bab7cc2c 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -589,7 +589,6 @@ void __devinit scan_phb(struct pci_controller *hose)
 #endif /* CONFIG_PPC_MULTIPLATFORM */
         if (mode == PCI_PROBE_NORMAL)
                 hose->last_busno = bus->subordinate = pci_scan_child_bus(bus);
-        pci_bus_add_devices(bus);
 }
 
 static int __init pcibios_init(void)
@@ -608,8 +607,10 @@ static int __init pcibios_init(void)
         printk("PCI: Probing PCI hardware\n");
 
         /* Scan all of the recorded PCI controllers.  */
-        list_for_each_entry_safe(hose, tmp, &hose_list, list_node)
+        list_for_each_entry_safe(hose, tmp, &hose_list, list_node) {
                 scan_phb(hose);
+                pci_bus_add_devices(hose->bus);
+        }
 
 #ifndef CONFIG_PPC_ISERIES
         if (pci_probe_only)
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index d9a459c144d8..63ecbec05202 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -79,15 +79,8 @@ EXPORT_SYMBOL(sys_sigreturn);
 EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strpbrk);
-EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strcasecmp);
 
 EXPORT_SYMBOL(csum_partial);
@@ -117,15 +110,6 @@ EXPORT_SYMBOL(_insw_ns);
 EXPORT_SYMBOL(_outsw_ns);
 EXPORT_SYMBOL(_insl_ns);
 EXPORT_SYMBOL(_outsl_ns);
-EXPORT_SYMBOL(ioremap);
-#ifdef CONFIG_44x
-EXPORT_SYMBOL(ioremap64);
-#endif
-EXPORT_SYMBOL(__ioremap);
-EXPORT_SYMBOL(iounmap);
-#ifdef CONFIG_PPC32
-EXPORT_SYMBOL(ioremap_bot);     /* aka VMALLOC_END */
-#endif
 
 #if defined(CONFIG_PPC32) && (defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_IDE_MODULE))
 EXPORT_SYMBOL(ppc_ide_md);
@@ -168,7 +152,6 @@ EXPORT_SYMBOL(__flush_icache_range);
 EXPORT_SYMBOL(flush_dcache_range);
 
 #ifdef CONFIG_SMP
-EXPORT_SYMBOL(smp_call_function);
 #ifdef CONFIG_PPC32
 EXPORT_SYMBOL(smp_hw_index);
 #endif
@@ -185,9 +168,6 @@ EXPORT_SYMBOL(adb_try_handler_change);
 EXPORT_SYMBOL(cuda_request);
 EXPORT_SYMBOL(cuda_poll);
 #endif /* CONFIG_ADB_CUDA */
-#ifdef CONFIG_PPC_PMAC
-EXPORT_SYMBOL(sys_ctrler);
-#endif
 #ifdef CONFIG_VT
 EXPORT_SYMBOL(kd_mksound);
 #endif
@@ -205,7 +185,6 @@ EXPORT_SYMBOL(__lshrdi3);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memchr);
 
@@ -214,7 +193,6 @@ EXPORT_SYMBOL(screen_info);
 #endif
 
 #ifdef CONFIG_PPC32
-EXPORT_SYMBOL(__delay);
 EXPORT_SYMBOL(timer_interrupt);
 EXPORT_SYMBOL(irq_desc);
 EXPORT_SYMBOL(tb_ticks_per_jiffy);
@@ -222,10 +200,6 @@ EXPORT_SYMBOL(console_drivers);
 EXPORT_SYMBOL(cacheable_memcpy);
 #endif
 
-EXPORT_SYMBOL(__up);
-EXPORT_SYMBOL(__down);
-EXPORT_SYMBOL(__down_interruptible);
-
 #ifdef  CONFIG_8xx
 EXPORT_SYMBOL(cpm_install_handler);
 EXPORT_SYMBOL(cpm_free_handler);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 57703994a063..c225cf154bfe 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -888,3 +888,35 @@ void dump_stack(void)
         show_stack(current, NULL);
 }
 EXPORT_SYMBOL(dump_stack);
+
+#ifdef CONFIG_PPC64
+void ppc64_runlatch_on(void)
+{
+        unsigned long ctrl;
+
+        if (cpu_has_feature(CPU_FTR_CTRL) && !test_thread_flag(TIF_RUNLATCH)) {
+                HMT_medium();
+
+                ctrl = mfspr(SPRN_CTRLF);
+                ctrl |= CTRL_RUNLATCH;
+                mtspr(SPRN_CTRLT, ctrl);
+
+                set_thread_flag(TIF_RUNLATCH);
+        }
+}
+
+void ppc64_runlatch_off(void)
+{
+        unsigned long ctrl;
+
+        if (cpu_has_feature(CPU_FTR_CTRL) && test_thread_flag(TIF_RUNLATCH)) {
+                HMT_medium();
+
+                clear_thread_flag(TIF_RUNLATCH);
+
+                ctrl = mfspr(SPRN_CTRLF);
+                ctrl &= ~CTRL_RUNLATCH;
+                mtspr(SPRN_CTRLT, ctrl);
+        }
+}
+#endif
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index d50c8df0183e..6dbd21726770 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -491,7 +491,12 @@ void __init finish_device_tree(void)
         size = 16;
         finish_node(allnodes, &size, 1);
         size -= 16;
-        end = start = (unsigned long) __va(lmb_alloc(size, 128));
+
+        if (0 == size)
+                end = start = 0;
+        else
+                end = start = (unsigned long)__va(lmb_alloc(size, 128));
+
         finish_node(allnodes, &end, 0);
         BUG_ON(end != start + size);
 
@@ -811,8 +816,6 @@ void __init unflatten_device_tree(void)
 {
         unsigned long start, mem, size;
         struct device_node **allnextp = &allnodes;
-        char *p = NULL;
-        int l = 0;
 
         DBG(" -> unflatten_device_tree()\n");
 
@@ -852,19 +855,6 @@ void __init unflatten_device_tree(void)
         if (of_chosen == NULL)
                 of_chosen = of_find_node_by_path("/chosen@0");
 
-        /* Retreive command line */
-        if (of_chosen != NULL) {
-                p = (char *)get_property(of_chosen, "bootargs", &l);
-                if (p != NULL && l > 0)
-                        strlcpy(cmd_line, p, min(l, COMMAND_LINE_SIZE));
-        }
-#ifdef CONFIG_CMDLINE
-        if (l == 0 || (l == 1 && (*p) == 0))
-                strlcpy(cmd_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE);
-#endif /* CONFIG_CMDLINE */
-
-        DBG("Command line is: %s\n", cmd_line);
-
         DBG(" <- unflatten_device_tree()\n");
 }
 
@@ -935,6 +925,8 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
 {
         u32 *prop;
         unsigned long *lprop;
+        unsigned long l;
+        char *p;
 
         DBG("search \"chosen\", depth: %d, uname: %s\n", depth, uname);
 
@@ -999,6 +991,41 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
                crashk_res.end = crashk_res.start + *lprop - 1;
 #endif
 
+        /* Retreive command line */
+        p = of_get_flat_dt_prop(node, "bootargs", &l);
+        if (p != NULL && l > 0)
+                strlcpy(cmd_line, p, min((int)l, COMMAND_LINE_SIZE));
+
+#ifdef CONFIG_CMDLINE
+        if (l == 0 || (l == 1 && (*p) == 0))
+                strlcpy(cmd_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE);
+#endif /* CONFIG_CMDLINE */
+
+        DBG("Command line is: %s\n", cmd_line);
+
+        if (strstr(cmd_line, "mem=")) {
+                char *p, *q;
+                unsigned long maxmem = 0;
+
+                for (q = cmd_line; (p = strstr(q, "mem=")) != 0; ) {
+                        q = p + 4;
+                        if (p > cmd_line && p[-1] != ' ')
+                                continue;
+                        maxmem = simple_strtoul(q, &q, 0);
+                        if (*q == 'k' || *q == 'K') {
+                                maxmem <<= 10;
+                                ++q;
+                        } else if (*q == 'm' || *q == 'M') {
+                                maxmem <<= 20;
+                                ++q;
+                        } else if (*q == 'g' || *q == 'G') {
+                                maxmem <<= 30;
+                                ++q;
+                        }
+                }
+                memory_limit = maxmem;
+        }
+
         /* break now */
         return 1;
 }
@@ -1119,7 +1146,7 @@ static void __init early_reserve_mem(void)
                         size_32 = *(reserve_map_32++);
                         if (size_32 == 0)
                                 break;
-                        DBG("reserving: %lx -> %lx\n", base_32, size_32);
+                        DBG("reserving: %x -> %x\n", base_32, size_32);
                         lmb_reserve(base_32, size_32);
                 }
                 return;
@@ -1398,8 +1425,8 @@ struct device_node *of_find_node_by_name(struct device_node *from,
 
         read_lock(&devtree_lock);
         np = from ? from->allnext : allnodes;
-        for (; np != 0; np = np->allnext)
-                if (np->name != 0 && strcasecmp(np->name, name) == 0
+        for (; np != NULL; np = np->allnext)
+                if (np->name != NULL && strcasecmp(np->name, name) == 0
                     && of_node_get(np))
                         break;
         if (from)
@@ -1917,3 +1944,30 @@ int prom_update_property(struct device_node *np,
 
         return 0;
 }
+
+#ifdef CONFIG_KEXEC
+/* We may have allocated the flat device tree inside the crash kernel region
+ * in prom_init. If so we need to move it out into regular memory. */
+void kdump_move_device_tree(void)
+{
+        unsigned long start, end;
+        struct boot_param_header *new;
+
+        start = __pa((unsigned long)initial_boot_params);
+        end = start + initial_boot_params->totalsize;
+
+        if (end < crashk_res.start || start > crashk_res.end)
+                return;
+
+        new = (struct boot_param_header*)
+                __va(lmb_alloc(initial_boot_params->totalsize, PAGE_SIZE));
+
+        memcpy(new, initial_boot_params, initial_boot_params->totalsize);
+
+        initial_boot_params = new;
+
+        DBG("Flat device tree blob moved to %p\n", initial_boot_params);
+
+        /* XXX should we unreserve the old DT? */
+}
+#endif /* CONFIG_KEXEC */
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 7881ec96ef11..813c2cd194c2 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -205,14 +205,6 @@ static cell_t __initdata regbuf[1024];
 
 #define MAX_CPU_THREADS 2
 
-/* TO GO */
-#ifdef CONFIG_HMT
-struct {
-        unsigned int pir;
-        unsigned int threadid;
-} hmt_thread_data[NR_CPUS];
-#endif /* CONFIG_HMT */
-
 /*
  * Error results ... some OF calls will return "-1" on error, some
  * will return 0, some will return either. To simplify, here are
@@ -986,7 +978,7 @@ static void __init prom_init_mem(void)
                         if (size == 0)
                                 continue;
                         prom_debug("    %x %x\n", base, size);
-                        if (base == 0)
+                        if (base == 0 && (RELOC(of_platform) & PLATFORM_LPAR))
                                 RELOC(rmo_top) = size;
                         if ((base + size) > RELOC(ram_top))
                                 RELOC(ram_top) = base + size;
@@ -1319,10 +1311,6 @@ static void __init prom_hold_cpus(void)
          */
         *spinloop = 0;
 
-#ifdef CONFIG_HMT
-        for (i = 0; i < NR_CPUS; i++)
-                RELOC(hmt_thread_data)[i].pir = 0xdeadbeef;
-#endif
         /* look for cpus */
         for (node = 0; prom_next_node(&node); ) {
                 type[0] = 0;
@@ -1389,32 +1377,6 @@ static void __init prom_hold_cpus(void)
                 /* Reserve cpu #s for secondary threads.   They start later. */
                 cpuid += cpu_threads;
         }
-#ifdef CONFIG_HMT
-        /* Only enable HMT on processors that provide support. */
-        if (__is_processor(PV_PULSAR) || 
-            __is_processor(PV_ICESTAR) ||
-            __is_processor(PV_SSTAR)) {
-                prom_printf("    starting secondary threads\n");
-
-                for (i = 0; i < NR_CPUS; i += 2) {
-                        if (!cpu_online(i))
-                                continue;
-
-                        if (i == 0) {
-                                unsigned long pir = mfspr(SPRN_PIR);
-                                if (__is_processor(PV_PULSAR)) {
-                                        RELOC(hmt_thread_data)[i].pir = 
-                                                pir & 0x1f;
-                                } else {
-                                        RELOC(hmt_thread_data)[i].pir = 
-                                                pir & 0x3ff;
-                                }
-                        }
-                }
-        } else {
-                prom_printf("Processor is not HMT capable\n");
-        }
-#endif
 
         if (cpuid > NR_CPUS)
                 prom_printf("WARNING: maximum CPUs (" __stringify(NR_CPUS)
@@ -2098,6 +2060,10 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
          */
         prom_init_stdout();
 
+        /* Bail if this is a kdump kernel. */
+        if (PHYSICAL_START > 0)
+                prom_panic("Error: You can't boot a kdump kernel from OF!\n");
+
         /*
          * Check for an initrd
          */
diff --git a/arch/powerpc/kernel/prom_parse.c b/arch/powerpc/kernel/prom_parse.c
index a8099c806150..3934c227549b 100644
--- a/arch/powerpc/kernel/prom_parse.c
+++ b/arch/powerpc/kernel/prom_parse.c
@@ -465,8 +465,10 @@ u32 *of_get_pci_address(struct device_node *dev, int bar_no, u64 *size,
         if (parent == NULL)
                 return NULL;
         bus = of_match_bus(parent);
-        if (strcmp(bus->name, "pci"))
+        if (strcmp(bus->name, "pci")) {
+                of_node_put(parent);
                 return NULL;
+        }
         bus->count_cells(dev, &na, &ns);
         of_node_put(parent);
         if (!OF_CHECK_COUNTS(na, ns))
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 400793c71304..bcb83574335b 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -561,10 +561,7 @@ void do_syscall_trace_leave(struct pt_regs *regs)
                                    regs->result);
 
         if ((test_thread_flag(TIF_SYSCALL_TRACE)
-#ifdef CONFIG_PPC64
-             || test_thread_flag(TIF_SINGLESTEP)
-#endif
-             )
+             || test_thread_flag(TIF_SINGLESTEP))
             && (current->ptrace & PT_PTRACED))
                 do_syscall_trace();
 }
diff --git a/arch/powerpc/kernel/rtas-rtc.c b/arch/powerpc/kernel/rtas-rtc.c
index 635d3b9a8811..34d073fb6091 100644
--- a/arch/powerpc/kernel/rtas-rtc.c
+++ b/arch/powerpc/kernel/rtas-rtc.c
@@ -52,7 +52,7 @@ void rtas_get_rtc_time(struct rtc_time *rtc_tm)
                 error = rtas_call(rtas_token("get-time-of-day"), 0, 8, ret);
                 if (error == RTAS_CLOCK_BUSY || rtas_is_extended_busy(error)) {
                         if (in_interrupt() && printk_ratelimit()) {
-                                memset(&rtc_tm, 0, sizeof(struct rtc_time));
+                                memset(rtc_tm, 0, sizeof(struct rtc_time));
                                 printk(KERN_WARNING "error: reading clock"
                                        " would delay interrupt\n");
                                 return; /* delay not allowed */
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 7fe4a5c944c9..b5b2add7ad1e 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -22,6 +22,7 @@
 
 #include <asm/prom.h>
 #include <asm/rtas.h>
+#include <asm/hvcall.h>
 #include <asm/semaphore.h>
 #include <asm/machdep.h>
 #include <asm/page.h>
@@ -565,6 +566,7 @@ static int ibm_suspend_me_token = RTAS_UNKNOWN_SERVICE;
 #ifdef CONFIG_PPC_PSERIES
 static void rtas_percpu_suspend_me(void *info)
 {
+        int i;
         long rc;
         long flags;
         struct rtas_suspend_me_data *data =
@@ -587,18 +589,16 @@ static void rtas_percpu_suspend_me(void *info)
 
         if (rc == H_Continue) {
                 data->waiting = 0;
-                rtas_call(ibm_suspend_me_token, 0, 1,
-                          data->args->args);
+                data->args->args[data->args->nargs] =
+                        rtas_call(ibm_suspend_me_token, 0, 1, NULL);
+                for_each_cpu(i)
+                        plpar_hcall_norets(H_PROD,i);
         } else {
                 data->waiting = -EBUSY;
                 printk(KERN_ERR "Error on H_Join hypervisor call\n");
         }
 
 out:
-        /* before we restore interrupts, make sure we don't
-         * generate a spurious soft lockup errors
-         */
-        touch_softlockup_watchdog();
         local_irq_restore(flags);
         return;
 }
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 50500093c97f..aaf384c3f04a 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -672,8 +672,7 @@ static void rtas_flash_firmware(int reboot_type)
 static void remove_flash_pde(struct proc_dir_entry *dp)
 {
         if (dp) {
-                if (dp->data != NULL)
-                        kfree(dp->data);
+                kfree(dp->data);
                 dp->owner = NULL;
                 remove_proc_entry(dp->name, dp->parent);
         }
diff --git a/arch/powerpc/kernel/rtas_pci.c b/arch/powerpc/kernel/rtas_pci.c
index 5579f6559912..7442775ef2a1 100644
--- a/arch/powerpc/kernel/rtas_pci.c
+++ b/arch/powerpc/kernel/rtas_pci.c
@@ -280,8 +280,7 @@ static int phb_set_bus_ranges(struct device_node *dev,
         return 0;
 }
 
-static int __devinit setup_phb(struct device_node *dev,
-                               struct pci_controller *phb)
+int __devinit setup_phb(struct device_node *dev, struct pci_controller *phb)
 {
         if (is_python(dev))
                 python_countermeasures(dev);
@@ -359,27 +358,6 @@ unsigned long __init find_and_init_phbs(void)
         return 0;
 }
 
-struct pci_controller * __devinit init_phb_dynamic(struct device_node *dn)
-{
-        struct pci_controller *phb;
-        int primary;
-
-        primary = list_empty(&hose_list);
-        phb = pcibios_alloc_controller(dn);
-        if (!phb)
-                return NULL;
-        setup_phb(dn, phb);
-        pci_process_bridge_OF_ranges(phb, dn, primary);
-
-        pci_setup_phb_io_dynamic(phb, primary);
-
-        pci_devs_phb_init_dynamic(phb);
-        scan_phb(phb);
-
-        return phb;
-}
-EXPORT_SYMBOL(init_phb_dynamic);
-
 /* RPA-specific bits for removing PHBs */
 int pcibios_remove_root_bus(struct pci_controller *phb)
 {
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index e29b275e09e0..f96c49b03ba0 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -311,8 +311,6 @@ void smp_release_cpus(void)
 
         DBG(" <- smp_release_cpus()\n");
 }
-#else
-#define smp_release_cpus()
 #endif /* CONFIG_SMP || CONFIG_KEXEC */
 
 /*
@@ -398,6 +396,9 @@ void __init setup_system(void)
 {
         DBG(" -> setup_system()\n");
 
+#ifdef CONFIG_KEXEC
+        kdump_move_device_tree();
+#endif
         /*
          * Unflatten the device-tree passed by prom_init or kexec
          */
@@ -470,10 +471,12 @@ void __init setup_system(void)
         check_smt_enabled();
         smp_setup_cpu_maps();
 
+#ifdef CONFIG_SMP
         /* Release secondary cpus out of their spinloops at 0x60 now that
          * we can map physical -> logical CPU ids
          */
         smp_release_cpus();
+#endif
 
         printk("Starting Linux PPC64 %s\n", system_utsname.version);
 
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index c6d0595da6b5..d7a4e814974d 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -142,11 +142,7 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
         return 0;
 }
 
-static inline compat_uptr_t to_user_ptr(void *kp)
-{
-        return (compat_uptr_t)(u64)kp;
-}
-
+#define to_user_ptr(p)          ptr_to_compat(p)
 #define from_user_ptr(p)        compat_ptr(p)
 
 static inline int save_general_regs(struct pt_regs *regs,
@@ -155,10 +151,7 @@ static inline int save_general_regs(struct pt_regs *regs,
         elf_greg_t64 *gregs = (elf_greg_t64 *)regs;
         int i;
 
-        if (!FULL_REGS(regs)) {
-                set_thread_flag(TIF_SAVE_NVGPRS);
-                current_thread_info()->nvgprs_frame = frame->mc_gregs;
-        }
+        WARN_ON(!FULL_REGS(regs));
 
         for (i = 0; i <= PT_RESULT; i ++) {
                 if (i == 14 && !FULL_REGS(regs))
@@ -213,21 +206,13 @@ static inline int get_old_sigaction(struct k_sigaction *new_ka,
         return 0;
 }
 
-#define to_user_ptr(p)          (p)
-#define from_user_ptr(p)        (p)
+#define to_user_ptr(p)          ((unsigned long)(p))
+#define from_user_ptr(p)        ((void __user *)(p))
 
 static inline int save_general_regs(struct pt_regs *regs,
                 struct mcontext __user *frame)
 {
-        if (!FULL_REGS(regs)) {
-                /* Zero out the unsaved GPRs to avoid information
-                   leak, and set TIF_SAVE_NVGPRS to ensure that the
-                   registers do actually get saved later. */
-                memset(&regs->gpr[14], 0, 18 * sizeof(unsigned long));
-                current_thread_info()->nvgprs_frame = &frame->mc_gregs;
-                set_thread_flag(TIF_SAVE_NVGPRS);
-        }
-
+        WARN_ON(!FULL_REGS(regs));
         return __copy_to_user(&frame->mc_gregs, regs, GP_REGS_SIZE);
 }
 
@@ -526,7 +511,7 @@ long compat_sys_rt_sigaction(int sig, const struct sigaction32 __user *act,
 
         ret = do_sigaction(sig, act ? &new_ka : NULL, oact ? &old_ka : NULL);
         if (!ret && oact) {
-                ret = put_user((long)old_ka.sa.sa_handler, &oact->sa_handler);
+                ret = put_user(to_user_ptr(old_ka.sa.sa_handler), &oact->sa_handler);
                 ret |= put_sigset_t(&oact->sa_mask, &old_ka.sa.sa_mask);
                 ret |= __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
         }
@@ -675,8 +660,8 @@ long compat_sys_rt_sigqueueinfo(u32 pid, u32 sig, compat_siginfo_t __user *uinfo
 int compat_sys_sigaltstack(u32 __new, u32 __old, int r5,
                       int r6, int r7, int r8, struct pt_regs *regs)
 {
-        stack_32_t __user * newstack = (stack_32_t __user *)(long) __new;
-        stack_32_t __user * oldstack = (stack_32_t __user *)(long) __old;
+        stack_32_t __user * newstack = compat_ptr(__new);
+        stack_32_t __user * oldstack = compat_ptr(__old);
         stack_t uss, uoss;
         int ret;
         mm_segment_t old_fs;
@@ -708,7 +693,7 @@ int compat_sys_sigaltstack(u32 __new, u32 __old, int r5,
         set_fs(old_fs);
         /* Copy the stack information to the user output buffer */
         if (!ret && oldstack  &&
-                (put_user((long)uoss.ss_sp, &oldstack->ss_sp) ||
+                (put_user(ptr_to_compat(uoss.ss_sp), &oldstack->ss_sp) ||
                  __put_user(uoss.ss_flags, &oldstack->ss_flags) ||
                  __put_user(uoss.ss_size, &oldstack->ss_size)))
                 return -EFAULT;
@@ -830,8 +815,8 @@ static int do_setcontext(struct ucontext __user *ucp, struct pt_regs *regs, int
 }
 
 long sys_swapcontext(struct ucontext __user *old_ctx,
-                       struct ucontext __user *new_ctx,
-                       int ctx_size, int r6, int r7, int r8, struct pt_regs *regs)
+                     struct ucontext __user *new_ctx,
+                     int ctx_size, int r6, int r7, int r8, struct pt_regs *regs)
 {
         unsigned char tmp;
 
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index b3193116e686..4324f8a8ba24 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -60,8 +60,8 @@ struct rt_sigframe {
         struct ucontext uc;
         unsigned long _unused[2];
         unsigned int tramp[TRAMP_SIZE];
-        struct siginfo *pinfo;
-        void *puc;
+        struct siginfo __user *pinfo;
+        void __user *puc;
         struct siginfo info;
         /* 64 bit ABI allows for 288 bytes below sp before decrementing it. */
         char abigap[288];
@@ -118,14 +118,7 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         err |= __put_user(0, &sc->v_regs);
 #endif /* CONFIG_ALTIVEC */
         err |= __put_user(&sc->gp_regs, &sc->regs);
-        if (!FULL_REGS(regs)) {
-                /* Zero out the unsaved GPRs to avoid information
-                   leak, and set TIF_SAVE_NVGPRS to ensure that the
-                   registers do actually get saved later. */
-                memset(&regs->gpr[14], 0, 18 * sizeof(unsigned long));
-                set_thread_flag(TIF_SAVE_NVGPRS);
-                current_thread_info()->nvgprs_frame = &sc->gp_regs;
-        }
+        WARN_ON(!FULL_REGS(regs));
         err |= __copy_to_user(&sc->gp_regs, regs, GP_REGS_SIZE);
         err |= __copy_to_user(&sc->fp_regs, &current->thread.fpr, FP_REGS_SIZE);
         err |= __put_user(signr, &sc->signal);
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index c8458c531b25..13595a64f013 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -540,6 +540,9 @@ int __devinit start_secondary(void *unused)
         if (smp_ops->take_timebase)
                 smp_ops->take_timebase();
 
+        if (system_state > SYSTEM_BOOTING)
+                per_cpu(last_jiffy, cpu) = get_tb();
+
         spin_lock(&call_lock);
         cpu_set(cpu, cpu_online_map);
         spin_unlock(&call_lock);
diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c
index 475249dc2350..cd75ab2908fa 100644
--- a/arch/powerpc/kernel/sys_ppc32.c
+++ b/arch/powerpc/kernel/sys_ppc32.c
@@ -176,7 +176,6 @@ struct timex32 {
 };
 
 extern int do_adjtimex(struct timex *);
-extern void ppc_adjtimex(void);
 
 asmlinkage long compat_sys_adjtimex(struct timex32 __user *utp)
 {
@@ -209,9 +208,6 @@ asmlinkage long compat_sys_adjtimex(struct timex32 __user *utp)
 
         ret = do_adjtimex(&txc);
 
-        /* adjust the conversion of TB to time of day to track adjtimex */
-        ppc_adjtimex();
-
         if(put_user(txc.modes, &utp->modes) ||
            __put_user(txc.offset, &utp->offset) ||
            __put_user(txc.freq, &utp->freq) ||
diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
index 007b15ee36d2..1ad55f0466fd 100644
--- a/arch/powerpc/kernel/systbl.S
+++ b/arch/powerpc/kernel/systbl.S
@@ -36,8 +36,6 @@
 #ifdef CONFIG_PPC64
 #define sys_sigpending  sys_ni_syscall
 #define sys_old_getrlimit sys_ni_syscall
-#else
-#define ppc_rtas        sys_ni_syscall
 #endif
 
 _GLOBAL(sys_call_table)
@@ -290,7 +288,7 @@ COMPAT_SYS(clock_settime)
 COMPAT_SYS(clock_gettime)
 COMPAT_SYS(clock_getres)
 COMPAT_SYS(clock_nanosleep)
-COMPAT_SYS(swapcontext)
+SYSX(ppc64_swapcontext,ppc32_swapcontext,ppc_swapcontext)
 COMPAT_SYS(tgkill)
 COMPAT_SYS(utimes)
 COMPAT_SYS(statfs64)
@@ -323,3 +321,4 @@ SYSCALL(spu_run)
 SYSCALL(spu_create)
 COMPAT_SYS(pselect6)
 COMPAT_SYS(ppoll)
+SYSCALL(unshare)
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index c4a294d657b9..86f7e3d154d8 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -50,6 +50,7 @@
 #include <linux/security.h>
 #include <linux/percpu.h>
 #include <linux/rtc.h>
+#include <linux/jiffies.h>
 
 #include <asm/io.h>
 #include <asm/processor.h>
@@ -99,7 +100,15 @@ EXPORT_SYMBOL(tb_ticks_per_usec);
 unsigned long tb_ticks_per_sec;
 u64 tb_to_xs;
 unsigned tb_to_us;
-unsigned long processor_freq;
+
+#define TICKLEN_SCALE   (SHIFT_SCALE - 10)
+u64 last_tick_len;      /* units are ns / 2^TICKLEN_SCALE */
+u64 ticklen_to_xs;      /* 0.64 fraction */
+
+/* If last_tick_len corresponds to about 1/HZ seconds, then
+   last_tick_len << TICKLEN_SHIFT will be about 2^63. */
+#define TICKLEN_SHIFT   (63 - 30 - TICKLEN_SCALE + SHIFT_HZ)
+
 DEFINE_SPINLOCK(rtc_lock);
 EXPORT_SYMBOL_GPL(rtc_lock);
 
@@ -113,10 +122,6 @@ extern unsigned long wall_jiffies;
 extern struct timezone sys_tz;
 static long timezone_offset;
 
-void ppc_adjtimex(void);
-
-static unsigned adjusting_time = 0;
-
 unsigned long ppc_proc_freq;
 unsigned long ppc_tb_freq;
 
@@ -178,8 +183,7 @@ static __inline__ void timer_check_rtc(void)
          */
         if (ppc_md.set_rtc_time && ntp_synced() &&
             xtime.tv_sec - last_rtc_update >= 659 &&
-            abs((xtime.tv_nsec/1000) - (1000000-1000000/HZ)) < 500000/HZ &&
-            jiffies - wall_jiffies == 1) {
+            abs((xtime.tv_nsec/1000) - (1000000-1000000/HZ)) < 500000/HZ) {
                 struct rtc_time tm;
                 to_tm(xtime.tv_sec + 1 + timezone_offset, &tm);
                 tm.tm_year -= 1900;
@@ -226,15 +230,14 @@ void do_gettimeofday(struct timeval *tv)
         if (__USE_RTC()) {
                 /* do this the old way */
                 unsigned long flags, seq;
-                unsigned int sec, nsec, usec, lost;
+                unsigned int sec, nsec, usec;
 
                 do {
                         seq = read_seqbegin_irqsave(&xtime_lock, flags);
                         sec = xtime.tv_sec;
                         nsec = xtime.tv_nsec + tb_ticks_since(tb_last_stamp);
-                        lost = jiffies - wall_jiffies;
                 } while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
-                usec = nsec / 1000 + lost * (1000000 / HZ);
+                usec = nsec / 1000;
                 while (usec >= 1000000) {
                         usec -= 1000000;
                         ++sec;
@@ -248,23 +251,6 @@ void do_gettimeofday(struct timeval *tv)
 
 EXPORT_SYMBOL(do_gettimeofday);
 
-/* Synchronize xtime with do_gettimeofday */ 
-
-static inline void timer_sync_xtime(unsigned long cur_tb)
-{
-#ifdef CONFIG_PPC64
-        /* why do we do this? */
-        struct timeval my_tv;
-
-        __do_gettimeofday(&my_tv, cur_tb);
-
-        if (xtime.tv_sec <= my_tv.tv_sec) {
-                xtime.tv_sec = my_tv.tv_sec;
-                xtime.tv_nsec = my_tv.tv_usec * 1000;
-        }
-#endif
-}
-
 /*
  * There are two copies of tb_to_xs and stamp_xsec so that no
  * lock is needed to access and use these values in
@@ -297,9 +283,9 @@ static inline void update_gtod(u64 new_tb_stamp, u64 new_stamp_xsec,
          * the two values of tb_update_count match and are even then the
          * tb_to_xs and stamp_xsec values are consistent.  If not, then it
          * loops back and reads them again until this criteria is met.
+         * We expect the caller to have done the first increment of
+         * vdso_data->tb_update_count already.
          */
-        ++(vdso_data->tb_update_count);
-        smp_wmb();
         vdso_data->tb_orig_stamp = new_tb_stamp;
         vdso_data->stamp_xsec = new_stamp_xsec;
         vdso_data->tb_to_xs = new_tb_to_xs;
@@ -323,15 +309,40 @@ static __inline__ void timer_recalc_offset(u64 cur_tb)
 {
         unsigned long offset;
         u64 new_stamp_xsec;
+        u64 tlen, t2x;
+        u64 tb, xsec_old, xsec_new;
+        struct gettimeofday_vars *varp;
 
         if (__USE_RTC())
                 return;
+        tlen = current_tick_length();
         offset = cur_tb - do_gtod.varp->tb_orig_stamp;
-        if ((offset & 0x80000000u) == 0)
+        if (tlen == last_tick_len && offset < 0x80000000u)
                 return;
-        new_stamp_xsec = do_gtod.varp->stamp_xsec
-                + mulhdu(offset, do_gtod.varp->tb_to_xs);
-        update_gtod(cur_tb, new_stamp_xsec, do_gtod.varp->tb_to_xs);
+        if (tlen != last_tick_len) {
+                t2x = mulhdu(tlen << TICKLEN_SHIFT, ticklen_to_xs);
+                last_tick_len = tlen;
+        } else
+                t2x = do_gtod.varp->tb_to_xs;
+        new_stamp_xsec = (u64) xtime.tv_nsec * XSEC_PER_SEC;
+        do_div(new_stamp_xsec, 1000000000);
+        new_stamp_xsec += (u64) xtime.tv_sec * XSEC_PER_SEC;
+
+        ++vdso_data->tb_update_count;
+        smp_mb();
+
+        /*
+         * Make sure time doesn't go backwards for userspace gettimeofday.
+         */
+        tb = get_tb();
+        varp = do_gtod.varp;
+        xsec_old = mulhdu(tb - varp->tb_orig_stamp, varp->tb_to_xs)
+                + varp->stamp_xsec;
+        xsec_new = mulhdu(tb - cur_tb, t2x) + new_stamp_xsec;
+        if (xsec_new < xsec_old)
+                new_stamp_xsec += xsec_old - xsec_new;
+
+        update_gtod(cur_tb, new_stamp_xsec, t2x);
 }
 
 #ifdef CONFIG_SMP
@@ -462,13 +473,10 @@ void timer_interrupt(struct pt_regs * regs)
                 write_seqlock(&xtime_lock);
                 tb_last_jiffy += tb_ticks_per_jiffy;
                 tb_last_stamp = per_cpu(last_jiffy, cpu);
-                timer_recalc_offset(tb_last_jiffy);
                 do_timer(regs);
-                timer_sync_xtime(tb_last_jiffy);
+                timer_recalc_offset(tb_last_jiffy);
                 timer_check_rtc();
                 write_sequnlock(&xtime_lock);
-                if (adjusting_time && (time_adjust == 0))
-                        ppc_adjtimex();
         }
         
         next_dec = tb_ticks_per_jiffy - ticks;
@@ -492,16 +500,18 @@ void timer_interrupt(struct pt_regs * regs)
 
 void wakeup_decrementer(void)
 {
-        int i;
+        unsigned long ticks;
 
-        set_dec(tb_ticks_per_jiffy);
         /*
-         * We don't expect this to be called on a machine with a 601,
-         * so using get_tbl is fine.
+         * The timebase gets saved on sleep and restored on wakeup,
+         * so all we need to do is to reset the decrementer.
          */
-        tb_last_stamp = tb_last_jiffy = get_tb();
-        for_each_cpu(i)
-                per_cpu(last_jiffy, i) = tb_last_stamp;
+        ticks = tb_ticks_since(__get_cpu_var(last_jiffy));
+        if (ticks < tb_ticks_per_jiffy)
+                ticks = tb_ticks_per_jiffy - ticks;
+        else
+                ticks = 1;
+        set_dec(ticks);
 }
 
 #ifdef CONFIG_SMP
@@ -541,8 +551,8 @@ int do_settimeofday(struct timespec *tv)
         time_t wtm_sec, new_sec = tv->tv_sec;
         long wtm_nsec, new_nsec = tv->tv_nsec;
         unsigned long flags;
-        long int tb_delta;
-        u64 new_xsec, tb_delta_xs;
+        u64 new_xsec;
+        unsigned long tb_delta;
 
         if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
                 return -EINVAL;
@@ -563,9 +573,23 @@ int do_settimeofday(struct timespec *tv)
                 first_settimeofday = 0;
         }
 #endif
+
+        /* Make userspace gettimeofday spin until we're done. */
+        ++vdso_data->tb_update_count;
+        smp_mb();
+
+        /*
+         * Subtract off the number of nanoseconds since the
+         * beginning of the last tick.
+         * Note that since we don't increment jiffies_64 anywhere other
+         * than in do_timer (since we don't have a lost tick problem),
+         * wall_jiffies will always be the same as jiffies,
+         * and therefore the (jiffies - wall_jiffies) computation
+         * has been removed.
+         */
         tb_delta = tb_ticks_since(tb_last_stamp);
-        tb_delta += (jiffies - wall_jiffies) * tb_ticks_per_jiffy;
-        tb_delta_xs = mulhdu(tb_delta, do_gtod.varp->tb_to_xs);
+        tb_delta = mulhdu(tb_delta, do_gtod.varp->tb_to_xs); /* in xsec */
+        new_nsec -= SCALE_XSEC(tb_delta, 1000000000);
 
         wtm_sec  = wall_to_monotonic.tv_sec + (xtime.tv_sec - new_sec);
         wtm_nsec = wall_to_monotonic.tv_nsec + (xtime.tv_nsec - new_nsec);
@@ -580,12 +604,12 @@ int do_settimeofday(struct timespec *tv)
 
         ntp_clear();
 
-        new_xsec = 0;
-        if (new_nsec != 0) {
-                new_xsec = (u64)new_nsec * XSEC_PER_SEC;
+        new_xsec = xtime.tv_nsec;
+        if (new_xsec != 0) {
+                new_xsec *= XSEC_PER_SEC;
                 do_div(new_xsec, NSEC_PER_SEC);
         }
-        new_xsec += (u64)new_sec * XSEC_PER_SEC - tb_delta_xs;
+        new_xsec += (u64)xtime.tv_sec * XSEC_PER_SEC;
         update_gtod(tb_last_jiffy, new_xsec, do_gtod.varp->tb_to_xs);
 
         vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
@@ -612,10 +636,10 @@ void __init generic_calibrate_decr(void)
 
         ppc_tb_freq = DEFAULT_TB_FREQ;          /* hardcoded default */
         node_found = 0;
-        if (cpu != 0) {
+        if (cpu) {
                 fp = (unsigned int *)get_property(cpu, "timebase-frequency",
                                                   NULL);
-                if (fp != 0) {
+                if (fp) {
                         node_found = 1;
                         ppc_tb_freq = *fp;
                 }
@@ -626,10 +650,10 @@ void __init generic_calibrate_decr(void)
 
         ppc_proc_freq = DEFAULT_PROC_FREQ;
         node_found = 0;
-        if (cpu != 0) {
+        if (cpu) {
                 fp = (unsigned int *)get_property(cpu, "clock-frequency",
                                                   NULL);
-                if (fp != 0) {
+                if (fp) {
                         node_found = 1;
                         ppc_proc_freq = *fp;
                 }
@@ -671,7 +695,7 @@ void __init time_init(void)
         unsigned long flags;
         unsigned long tm = 0;
         struct div_result res;
-        u64 scale;
+        u64 scale, x;
         unsigned shift;
 
         if (ppc_md.time_init != NULL)
@@ -693,11 +717,42 @@ void __init time_init(void)
         }
 
         tb_ticks_per_jiffy = ppc_tb_freq / HZ;
-        tb_ticks_per_sec = tb_ticks_per_jiffy * HZ;
+        tb_ticks_per_sec = ppc_tb_freq;
         tb_ticks_per_usec = ppc_tb_freq / 1000000;
         tb_to_us = mulhwu_scale_factor(ppc_tb_freq, 1000000);
-        div128_by_32(1024*1024, 0, tb_ticks_per_sec, &res);
-        tb_to_xs = res.result_low;
+
+        /*
+         * Calculate the length of each tick in ns.  It will not be
+         * exactly 1e9/HZ unless ppc_tb_freq is divisible by HZ.
+         * We compute 1e9 * tb_ticks_per_jiffy / ppc_tb_freq,
+         * rounded up.
+         */
+        x = (u64) NSEC_PER_SEC * tb_ticks_per_jiffy + ppc_tb_freq - 1;
+        do_div(x, ppc_tb_freq);
+        tick_nsec = x;
+        last_tick_len = x << TICKLEN_SCALE;
+
+        /*
+         * Compute ticklen_to_xs, which is a factor which gets multiplied
+         * by (last_tick_len << TICKLEN_SHIFT) to get a tb_to_xs value.
+         * It is computed as:
+         * ticklen_to_xs = 2^N / (tb_ticks_per_jiffy * 1e9)
+         * where N = 64 + 20 - TICKLEN_SCALE - TICKLEN_SHIFT
+         * which turns out to be N = 51 - SHIFT_HZ.
+         * This gives the result as a 0.64 fixed-point fraction.
+         * That value is reduced by an offset amounting to 1 xsec per
+         * 2^31 timebase ticks to avoid problems with time going backwards
+         * by 1 xsec when we do timer_recalc_offset due to losing the
+         * fractional xsec.  That offset is equal to ppc_tb_freq/2^51
+         * since there are 2^20 xsec in a second.
+         */
+        div128_by_32((1ULL << 51) - ppc_tb_freq, 0,
+                     tb_ticks_per_jiffy << SHIFT_HZ, &res);
+        div128_by_32(res.result_high, res.result_low, NSEC_PER_SEC, &res);
+        ticklen_to_xs = res.result_low;
+
+        /* Compute tb_to_xs from tick_nsec */
+        tb_to_xs = mulhdu(last_tick_len << TICKLEN_SHIFT, ticklen_to_xs);
 
         /*
          * Compute scale factor for sched_clock.
@@ -724,6 +779,14 @@ void __init time_init(void)
                 tm = get_boot_time();
 
         write_seqlock_irqsave(&xtime_lock, flags);
+
+        /* If platform provided a timezone (pmac), we correct the time */
+        if (timezone_offset) {
+                sys_tz.tz_minuteswest = -timezone_offset / 60;
+                sys_tz.tz_dsttime = 0;
+                tm -= timezone_offset;
+        }
+
         xtime.tv_sec = tm;
         xtime.tv_nsec = 0;
         do_gtod.varp = &do_gtod.vars[0];
@@ -738,18 +801,11 @@ void __init time_init(void)
         vdso_data->tb_orig_stamp = tb_last_jiffy;
         vdso_data->tb_update_count = 0;
         vdso_data->tb_ticks_per_sec = tb_ticks_per_sec;
-        vdso_data->stamp_xsec = xtime.tv_sec * XSEC_PER_SEC;
+        vdso_data->stamp_xsec = (u64) xtime.tv_sec * XSEC_PER_SEC;
         vdso_data->tb_to_xs = tb_to_xs;
 
         time_freq = 0;
 
-        /* If platform provided a timezone (pmac), we correct the time */
-        if (timezone_offset) {
-                sys_tz.tz_minuteswest = -timezone_offset / 60;
-                sys_tz.tz_dsttime = 0;
-                xtime.tv_sec -= timezone_offset;
-        }
-
         last_rtc_update = xtime.tv_sec;
         set_normalized_timespec(&wall_to_monotonic,
                                 -xtime.tv_sec, -xtime.tv_nsec);
@@ -759,126 +815,6 @@ void __init time_init(void)
         set_dec(tb_ticks_per_jiffy);
 }
 
-/* 
- * After adjtimex is called, adjust the conversion of tb ticks
- * to microseconds to keep do_gettimeofday synchronized 
- * with ntpd.
- *
- * Use the time_adjust, time_freq and time_offset computed by adjtimex to 
- * adjust the frequency.
- */
-
-/* #define DEBUG_PPC_ADJTIMEX 1 */
-
-void ppc_adjtimex(void)
-{
-#ifdef CONFIG_PPC64
-        unsigned long den, new_tb_ticks_per_sec, tb_ticks, old_xsec,
-                new_tb_to_xs, new_xsec, new_stamp_xsec;
-        unsigned long tb_ticks_per_sec_delta;
-        long delta_freq, ltemp;
-        struct div_result divres; 
-        unsigned long flags;
-        long singleshot_ppm = 0;
-
-        /*
-         * Compute parts per million frequency adjustment to
-         * accomplish the time adjustment implied by time_offset to be
-         * applied over the elapsed time indicated by time_constant.
-         * Use SHIFT_USEC to get it into the same units as
-         * time_freq.
-         */
-        if ( time_offset < 0 ) {
-                ltemp = -time_offset;
-                ltemp <<= SHIFT_USEC - SHIFT_UPDATE;
-                ltemp >>= SHIFT_KG + time_constant;
-                ltemp = -ltemp;
-        } else {
-                ltemp = time_offset;
-                ltemp <<= SHIFT_USEC - SHIFT_UPDATE;
-                ltemp >>= SHIFT_KG + time_constant;
-        }
-        
-        /* If there is a single shot time adjustment in progress */
-        if ( time_adjust ) {
-#ifdef DEBUG_PPC_ADJTIMEX
-                printk("ppc_adjtimex: ");
-                if ( adjusting_time == 0 )
-                        printk("starting ");
-                printk("single shot time_adjust = %ld\n", time_adjust);
-#endif  
-        
-                adjusting_time = 1;
-                
-                /*
-                 * Compute parts per million frequency adjustment
-                 * to match time_adjust
-                 */
-                singleshot_ppm = tickadj * HZ;  
-                /*
-                 * The adjustment should be tickadj*HZ to match the code in
-                 * linux/kernel/timer.c, but experiments show that this is too
-                 * large. 3/4 of tickadj*HZ seems about right
-                 */
-                singleshot_ppm -= singleshot_ppm / 4;
-                /* Use SHIFT_USEC to get it into the same units as time_freq */
-                singleshot_ppm <<= SHIFT_USEC;
-                if ( time_adjust < 0 )
-                        singleshot_ppm = -singleshot_ppm;
-        }
-        else {
-#ifdef DEBUG_PPC_ADJTIMEX
-                if ( adjusting_time )
-                        printk("ppc_adjtimex: ending single shot time_adjust\n");
-#endif
-                adjusting_time = 0;
-        }
-        
-        /* Add up all of the frequency adjustments */
-        delta_freq = time_freq + ltemp + singleshot_ppm;
-        
-        /*
-         * Compute a new value for tb_ticks_per_sec based on
-         * the frequency adjustment
-         */
-        den = 1000000 * (1 << (SHIFT_USEC - 8));
-        if ( delta_freq < 0 ) {
-                tb_ticks_per_sec_delta = ( tb_ticks_per_sec * ( (-delta_freq) >> (SHIFT_USEC - 8))) / den;
-                new_tb_ticks_per_sec = tb_ticks_per_sec + tb_ticks_per_sec_delta;
-        }
-        else {
-                tb_ticks_per_sec_delta = ( tb_ticks_per_sec * ( delta_freq >> (SHIFT_USEC - 8))) / den;
-                new_tb_ticks_per_sec = tb_ticks_per_sec - tb_ticks_per_sec_delta;
-        }
-        
-#ifdef DEBUG_PPC_ADJTIMEX
-        printk("ppc_adjtimex: ltemp = %ld, time_freq = %ld, singleshot_ppm = %ld\n", ltemp, time_freq, singleshot_ppm);
-        printk("ppc_adjtimex: tb_ticks_per_sec - base = %ld  new = %ld\n", tb_ticks_per_sec, new_tb_ticks_per_sec);
-#endif
-
-        /*
-         * Compute a new value of tb_to_xs (used to convert tb to
-         * microseconds) and a new value of stamp_xsec which is the
-         * time (in 1/2^20 second units) corresponding to
-         * tb_orig_stamp.  This new value of stamp_xsec compensates
-         * for the change in frequency (implied by the new tb_to_xs)
-         * which guarantees that the current time remains the same.
-         */
-        write_seqlock_irqsave( &xtime_lock, flags );
-        tb_ticks = get_tb() - do_gtod.varp->tb_orig_stamp;
-        div128_by_32(1024*1024, 0, new_tb_ticks_per_sec, &divres);
-        new_tb_to_xs = divres.result_low;
-        new_xsec = mulhdu(tb_ticks, new_tb_to_xs);
-
-        old_xsec = mulhdu(tb_ticks, do_gtod.varp->tb_to_xs);
-        new_stamp_xsec = do_gtod.varp->stamp_xsec + old_xsec - new_xsec;
-
-        update_gtod(do_gtod.varp->tb_orig_stamp, new_stamp_xsec, new_tb_to_xs);
-
-        write_sequnlock_irqrestore( &xtime_lock, flags );
-#endif /* CONFIG_PPC64 */
-}
-
 
 #define FEBRUARY        2
 #define STARTOFTIME     1970
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 7509aa6474f2..98660aedeeb7 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -814,6 +814,8 @@ void __kprobes program_check_exception(struct pt_regs *regs)
                 return;
         }
 
+        local_irq_enable();
+
         /* Try to emulate it if we should. */
         if (reason & (REASON_ILLEGAL | REASON_PRIVILEGED)) {
                 switch (emulate_instruction(regs)) {
diff --git a/arch/powerpc/kernel/udbg_16550.c b/arch/powerpc/kernel/udbg_16550.c
index 2da65a9c93f6..5d29dcca523c 100644
--- a/arch/powerpc/kernel/udbg_16550.c
+++ b/arch/powerpc/kernel/udbg_16550.c
@@ -144,7 +144,7 @@ unsigned int udbg_probe_uart_speed(void __iomem *comport, unsigned int clock)
 }
 
 #ifdef CONFIG_PPC_MAPLE
-void udbg_maple_real_putc(unsigned char c)
+void udbg_maple_real_putc(char c)
 {
         if (udbg_comport) {
                 while ((real_readb(&udbg_comport->lsr) & LSR_THRE) == 0)
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index f0c47dab0903..04f7df39ffbb 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -182,8 +182,8 @@ static struct page * vdso_vma_nopage(struct vm_area_struct * vma,
         unsigned long offset = address - vma->vm_start;
         struct page *pg;
 #ifdef CONFIG_PPC64
-        void *vbase = test_thread_flag(TIF_32BIT) ?
-                vdso32_kbase : vdso64_kbase;
+        void *vbase = (vma->vm_mm->task_size > TASK_SIZE_USER32) ?
+                vdso64_kbase : vdso32_kbase;
 #else
         void *vbase = vdso32_kbase;
 #endif
diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
index ccaeda5136d1..4ee871f1cadb 100644
--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
@@ -225,9 +225,9 @@ V_FUNCTION_BEGIN(__do_get_xsec)
   .cfi_startproc
         /* check for update count & load values */
 1:      ld      r8,CFG_TB_UPDATE_COUNT(r3)
-        andi.   r0,r4,1                 /* pending update ? loop */
+        andi.   r0,r8,1                 /* pending update ? loop */
         bne-    1b
-        xor     r0,r4,r4                /* create dependency */
+        xor     r0,r8,r8                /* create dependency */
         add     r3,r3,r0
 
         /* Get TB & offset it */
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index d96bcfe4c6f6..33654d1b1b43 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -403,12 +403,17 @@ static void native_hpte_clear(void)
                  */
                 hpte_v = hptep->v;
 
+                /*
+                 * Call __tlbie() here rather than tlbie() since we
+                 * already hold the native_tlbie_lock.
+                 */
                 if (hpte_v & HPTE_V_VALID) {
                         hptep->v = 0;
-                        tlbie(slot2va(hpte_v, slot), MMU_PAGE_4K, 0);
+                        __tlbie(slot2va(hpte_v, slot), MMU_PAGE_4K);
                 }
         }
 
+        asm volatile("eieio; tlbsync; ptesync":::"memory");
         spin_unlock(&native_tlbie_lock);
         local_irq_restore(flags);
 }
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 149351a84b94..e9d589eefc14 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -88,6 +88,7 @@ static unsigned long _SDR1;
 struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
 
 hpte_t *htab_address;
+unsigned long htab_size_bytes;
 unsigned long htab_hash_mask;
 int mmu_linear_psize = MMU_PAGE_4K;
 int mmu_virtual_psize = MMU_PAGE_4K;
@@ -168,7 +169,7 @@ int htab_bolt_mapping(unsigned long vstart, unsigned long vend,
 #ifdef CONFIG_PPC_ISERIES
                 if (_machine == PLATFORM_ISERIES_LPAR)
                         ret = iSeries_hpte_insert(hpteg, va,
-                                                  virt_to_abs(paddr),
+                                                  __pa(vaddr),
                                                   tmp_mode,
                                                   HPTE_V_BOLTED,
                                                   psize);
@@ -399,7 +400,7 @@ void create_section_mapping(unsigned long start, unsigned long end)
 
 void __init htab_initialize(void)
 {
-        unsigned long table, htab_size_bytes;
+        unsigned long table;
         unsigned long pteg_count;
         unsigned long mode_rw;
         unsigned long base = 0, size = 0;
diff --git a/arch/powerpc/mm/lmb.c b/arch/powerpc/mm/lmb.c
index 9584608fd768..bbe3eac918e8 100644
--- a/arch/powerpc/mm/lmb.c
+++ b/arch/powerpc/mm/lmb.c
@@ -197,6 +197,8 @@ long __init lmb_reserve(unsigned long base, unsigned long size)
 {
         struct lmb_region *_rgn = &(lmb.reserved);
 
+        BUG_ON(0 == size);
+
         return lmb_add_region(_rgn, base, size);
 }
 
@@ -227,6 +229,8 @@ unsigned long __init lmb_alloc_base(unsigned long size, unsigned long align,
         long i, j;
         unsigned long base = 0;
 
+        BUG_ON(0 == size);
+
 #ifdef CONFIG_PPC32
         /* On 32-bit, make sure we allocate lowmem */
         if (max_addr == LMB_ALLOC_ANYWHERE)
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 15aac0d78dfa..550517c2dd42 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -435,17 +435,12 @@ void clear_user_page(void *page, unsigned long vaddr, struct page *pg)
 {
         clear_page(page);
 
-        if (cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
-                return;
         /*
          * We shouldnt have to do this, but some versions of glibc
          * require it (ld.so assumes zero filled pages are icache clean)
          * - Anton
          */
-
-        /* avoid an atomic op if possible */
-        if (test_bit(PG_arch_1, &pg->flags))
-                clear_bit(PG_arch_1, &pg->flags);
+        flush_dcache_page(pg);
 }
 EXPORT_SYMBOL(clear_user_page);
 
@@ -469,12 +464,7 @@ void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
                 return;
 #endif
 
-        if (cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
-                return;
-
-        /* avoid an atomic op if possible */
-        if (test_bit(PG_arch_1, &pg->flags))
-                clear_bit(PG_arch_1, &pg->flags);
+        flush_dcache_page(pg);
 }
 
 void flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index f4e5ac122615..d296eb6b4545 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -37,6 +37,7 @@
 
 unsigned long ioremap_base;
 unsigned long ioremap_bot;
+EXPORT_SYMBOL(ioremap_bot);     /* aka VMALLOC_END */
 int io_bat_index;
 
 #if defined(CONFIG_6xx) || defined(CONFIG_POWER3)
@@ -153,6 +154,7 @@ ioremap64(unsigned long long addr, unsigned long size)
 {
         return __ioremap(addr, size, _PAGE_NO_CACHE);
 }
+EXPORT_SYMBOL(ioremap64);
 
 void __iomem *
 ioremap(phys_addr_t addr, unsigned long size)
@@ -162,6 +164,7 @@ ioremap(phys_addr_t addr, unsigned long size)
         return ioremap64(addr64, size);
 }
 #endif /* CONFIG_PHYS_64BIT */
+EXPORT_SYMBOL(ioremap);
 
 void __iomem *
 __ioremap(phys_addr_t addr, unsigned long size, unsigned long flags)
@@ -247,6 +250,7 @@ __ioremap(phys_addr_t addr, unsigned long size, unsigned long flags)
 out:
         return (void __iomem *) (v + ((unsigned long)addr & ~PAGE_MASK));
 }
+EXPORT_SYMBOL(__ioremap);
 
 void iounmap(volatile void __iomem *addr)
 {
@@ -259,6 +263,7 @@ void iounmap(volatile void __iomem *addr)
         if (addr > high_memory && (unsigned long) addr < ioremap_bot)
                 vunmap((void *) (PAGE_MASK & (unsigned long)addr));
 }
+EXPORT_SYMBOL(iounmap);
 
 void __iomem *ioport_map(unsigned long port, unsigned int len)
 {
diff --git a/arch/powerpc/oprofile/Kconfig b/arch/powerpc/oprofile/Kconfig
index eb2dece76a54..d03c0e5ca870 100644
--- a/arch/powerpc/oprofile/Kconfig
+++ b/arch/powerpc/oprofile/Kconfig
@@ -1,4 +1,5 @@
 config PROFILING
+        depends on !PPC_ISERIES
         bool "Profiling support (EXPERIMENTAL)"
         help
           Say Y here to enable the extended profiling support mechanisms used
diff --git a/arch/powerpc/platforms/cell/Makefile b/arch/powerpc/platforms/cell/Makefile
index 16031b565be4..3b998a393e3f 100644
--- a/arch/powerpc/platforms/cell/Makefile
+++ b/arch/powerpc/platforms/cell/Makefile
@@ -2,7 +2,7 @@ obj-y			+= interrupt.o iommu.o setup.o spider-pic.o
 obj-y                   += pervasive.o
 
 obj-$(CONFIG_SMP)       += smp.o
-obj-$(CONFIG_SPU_FS)    += spufs/ spu-base.o
+obj-$(CONFIG_SPU_FS)    += spu-base.o spufs/
 
 spu-base-y              += spu_base.o spu_priv1.o
 
diff --git a/arch/powerpc/platforms/chrp/chrp.h b/arch/powerpc/platforms/chrp/chrp.h
index 3a2057fa314a..814f54742e0f 100644
--- a/arch/powerpc/platforms/chrp/chrp.h
+++ b/arch/powerpc/platforms/chrp/chrp.h
@@ -5,7 +5,6 @@
 extern void chrp_nvram_init(void);
 extern void chrp_get_rtc_time(struct rtc_time *);
 extern int chrp_set_rtc_time(struct rtc_time *);
-extern void chrp_calibrate_decr(void);
 extern long chrp_time_init(void);
 
 extern void chrp_find_bridges(void);
diff --git a/arch/powerpc/platforms/chrp/pci.c b/arch/powerpc/platforms/chrp/pci.c
index 00c52f27ef4f..8ef279ad36ad 100644
--- a/arch/powerpc/platforms/chrp/pci.c
+++ b/arch/powerpc/platforms/chrp/pci.c
@@ -204,9 +204,11 @@ static void __init setup_peg2(struct pci_controller *hose, struct device_node *d
         struct device_node *root = find_path_device("/");
         struct device_node *rtas;
 
+        of_node_get(root);
         rtas = of_find_node_by_name (root, "rtas");
         if (rtas) {
                 hose->ops = &rtas_pci_ops;
+                of_node_put(rtas);
         } else {
                 printk ("RTAS supporting Pegasos OF not found, please upgrade"
                         " your firmware\n");
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index 2dc87aa5962f..e1fadbf49150 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -506,7 +506,7 @@ void __init chrp_init(void)
         ppc_md.halt           = rtas_halt;
 
         ppc_md.time_init      = chrp_time_init;
-        ppc_md.calibrate_decr = chrp_calibrate_decr;
+        ppc_md.calibrate_decr = generic_calibrate_decr;
 
         /* this may get overridden with rtas routines later... */
         ppc_md.set_rtc_time   = chrp_set_rtc_time;
diff --git a/arch/powerpc/platforms/chrp/time.c b/arch/powerpc/platforms/chrp/time.c
index 36a0f97bb7b1..78df2e7ca88a 100644
--- a/arch/powerpc/platforms/chrp/time.c
+++ b/arch/powerpc/platforms/chrp/time.c
@@ -167,24 +167,3 @@ void chrp_get_rtc_time(struct rtc_time *tm)
         tm->tm_mon = mon;
         tm->tm_year = year;
 }
-
-
-void __init chrp_calibrate_decr(void)
-{
-        struct device_node *cpu;
-        unsigned int freq, *fp;
-
-        /*
-         * The cpu node should have a timebase-frequency property
-         * to tell us the rate at which the decrementer counts.
-         */
-        freq = 16666000;                /* hardcoded default */
-        cpu = find_type_devices("cpu");
-        if (cpu != 0) {
-                fp = (unsigned int *)
-                        get_property(cpu, "timebase-frequency", NULL);
-                if (fp != 0)
-                        freq = *fp;
-        }
-        ppc_tb_freq = freq;
-}
diff --git a/arch/powerpc/platforms/iseries/lpevents.c b/arch/powerpc/platforms/iseries/lpevents.c
index 0b885300d1d1..8ca7b9396355 100644
--- a/arch/powerpc/platforms/iseries/lpevents.c
+++ b/arch/powerpc/platforms/iseries/lpevents.c
@@ -184,6 +184,8 @@ void setup_hvlpevent_queue(void)
 {
         void *eventStack;
 
+        spin_lock_init(&hvlpevent_queue.lock);
+
         /* Allocate a page for the Event Stack. */
         eventStack = alloc_bootmem_pages(LpEventStackSize);
         memset(eventStack, 0, LpEventStackSize);
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index 3f8790146b00..3ecc4a652d82 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -648,6 +648,7 @@ static void yield_shared_processor(void)
          * here and let the timer_interrupt code sort out the actual time.
          */
         get_lppaca()->int_dword.fields.decr_int = 1;
+        ppc64_runlatch_on();
         process_iSeries_events();
 }
 
diff --git a/arch/powerpc/platforms/maple/pci.c b/arch/powerpc/platforms/maple/pci.c
index 7d4099a34f92..85d6c93659cc 100644
--- a/arch/powerpc/platforms/maple/pci.c
+++ b/arch/powerpc/platforms/maple/pci.c
@@ -435,8 +435,8 @@ void __init maple_pci_init(void)
                         PCI_DN(np)->busno = 0xf0;
         }
 
-        /* Tell pci.c to use the common resource allocation mecanism */
-        pci_probe_only = 0;
+        /* Tell pci.c to not change any resource allocations.  */
+        pci_probe_only = 1;
         
         /* Allow all IO */
         io_page_mask = -1;
diff --git a/arch/powerpc/platforms/powermac/feature.c b/arch/powerpc/platforms/powermac/feature.c
index 558dd0692092..bbe794891a20 100644
--- a/arch/powerpc/platforms/powermac/feature.c
+++ b/arch/powerpc/platforms/powermac/feature.c
@@ -1646,10 +1646,10 @@ static void intrepid_shutdown(struct macio_chip *macio, int sleep_mode)
                   KL0_SCC_CELL_ENABLE);
 
         MACIO_BIC(KEYLARGO_FCR1,
-                  /*KL1_USB2_CELL_ENABLE |*/
                 KL1_I2S0_CELL_ENABLE | KL1_I2S0_CLK_ENABLE_BIT |
                 KL1_I2S0_ENABLE | KL1_I2S1_CELL_ENABLE |
-                KL1_I2S1_CLK_ENABLE_BIT | KL1_I2S1_ENABLE);
+                KL1_I2S1_CLK_ENABLE_BIT | KL1_I2S1_ENABLE |
+                KL1_EIDE0_ENABLE);
         if (pmac_mb.board_flags & PMAC_MB_MOBILE)
                 MACIO_BIC(KEYLARGO_FCR1, KL1_UIDE_RESET_N);
 
@@ -2183,7 +2183,7 @@ static struct pmac_mb_def pmac_mb_defs[] = {
         },
         {       "PowerMac10,1",                 "Mac mini",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER,
+                PMAC_MB_MAY_SLEEP,
         },
         {       "iMac,1",                       "iMac (first generation)",
                 PMAC_TYPE_ORIG_IMAC,            paddington_features,
@@ -2295,11 +2295,11 @@ static struct pmac_mb_def pmac_mb_defs[] = {
         },
         {       "PowerBook5,8",                 "PowerBook G4 15\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
+                PMAC_MB_MAY_SLEEP  | PMAC_MB_MOBILE,
         },
         {       "PowerBook5,9",                 "PowerBook G4 17\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
+                PMAC_MB_MAY_SLEEP | PMAC_MB_MOBILE,
         },
         {       "PowerBook6,1",                 "PowerBook G4 12\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
@@ -2491,9 +2491,7 @@ found:
                         pmac_mb.model_id = PMAC_TYPE_COMET;
                 iounmap(mach_id_ptr);
         }
-#endif /* CONFIG_POWER4 */
 
-#ifdef CONFIG_6xx
         /* Set default value of powersave_nap on machines that support it.
          * It appears that uninorth rev 3 has a problem with it, we don't
          * enable it on those. In theory, the flush-on-lock property is
@@ -2522,10 +2520,11 @@ found:
          * NAP mode
          */
         powersave_lowspeed = 1;
-#endif /* CONFIG_6xx */
-#ifdef CONFIG_POWER4
+
+#else /* CONFIG_POWER4 */
         powersave_nap = 1;
-#endif
+#endif  /* CONFIG_POWER4 */
+
         /* Check for "mobile" machine */
         if (model && (strncmp(model, "PowerBook", 9) == 0
                    || strncmp(model, "iBook", 5) == 0))
diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index 535c802b369f..87eb6bb7f0e7 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1052,8 +1052,7 @@ struct pmac_i2c_bus *pmac_i2c_adapter_to_bus(struct i2c_adapter *adapter)
 }
 EXPORT_SYMBOL_GPL(pmac_i2c_adapter_to_bus);
 
-extern int pmac_i2c_match_adapter(struct device_node *dev,
-                                  struct i2c_adapter *adapter)
+int pmac_i2c_match_adapter(struct device_node *dev, struct i2c_adapter *adapter)
 {
         struct pmac_i2c_bus *bus = pmac_i2c_find_bus(dev);
 
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index f671ed253901..de3f30e6b333 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -136,14 +136,14 @@ static void __init fixup_bus_range(struct device_node *bridge)
         |(((unsigned int)(off)) & 0xFCUL) \
         |1UL)
 
-static unsigned long macrisc_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *macrisc_cfg_access(struct pci_controller* hose,
                                                u8 bus, u8 dev_fn, u8 offset)
 {
         unsigned int caddr;
 
         if (bus == hose->first_busno) {
                 if (dev_fn < (11 << 3))
-                        return 0;
+                        return NULL;
                 caddr = MACRISC_CFA0(dev_fn, offset);
         } else
                 caddr = MACRISC_CFA1(bus, dev_fn, offset);
@@ -154,14 +154,14 @@ static unsigned long macrisc_cfg_access(struct pci_controller* hose,
         } while (in_le32(hose->cfg_addr) != caddr);
 
         offset &= has_uninorth ? 0x07 : 0x03;
-        return ((unsigned long)hose->cfg_data) + offset;
+        return hose->cfg_data + offset;
 }
 
 static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
                                       int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -177,13 +177,13 @@ static int macrisc_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -193,7 +193,7 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
                                        int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -209,16 +209,16 @@ static int macrisc_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32(addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -348,25 +348,23 @@ static int u3_ht_skip_device(struct pci_controller *hose,
                 + (((unsigned int)bus) << 16) \
                 + 0x01000000UL)
 
-static unsigned long u3_ht_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *u3_ht_cfg_access(struct pci_controller* hose,
                                              u8 bus, u8 devfn, u8 offset)
 {
         if (bus == hose->first_busno) {
                 /* For now, we don't self probe U3 HT bridge */
                 if (PCI_SLOT(devfn) == 0)
-                        return 0;
-                return ((unsigned long)hose->cfg_data) +
-                        U3_HT_CFA0(devfn, offset);
+                        return NULL;
+                return hose->cfg_data + U3_HT_CFA0(devfn, offset);
         } else
-                return ((unsigned long)hose->cfg_data) +
-                        U3_HT_CFA1(bus, devfn, offset);
+                return hose->cfg_data + U3_HT_CFA1(bus, devfn, offset);
 }
 
 static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
                                     int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -400,13 +398,13 @@ static int u3_ht_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -416,7 +414,7 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
                                      int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -442,16 +440,16 @@ static int u3_ht_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32((u32 __iomem *)addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -476,7 +474,7 @@ static struct pci_ops u3_ht_pci_ops =
          |(((unsigned int)(off)) & 0xfcU)       \
          |1UL)
 
-static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
+static volatile void __iomem *u4_pcie_cfg_access(struct pci_controller* hose,
                                         u8 bus, u8 dev_fn, int offset)
 {
         unsigned int caddr;
@@ -492,14 +490,14 @@ static unsigned long u4_pcie_cfg_access(struct pci_controller* hose,
         } while (in_le32(hose->cfg_addr) != caddr);
 
         offset &= 0x03;
-        return ((unsigned long)hose->cfg_data) + offset;
+        return hose->cfg_data + offset;
 }
 
 static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
                                int offset, int len, u32 *val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -515,13 +513,13 @@ static int u4_pcie_read_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                *val = in_8((u8 *)addr);
+                *val = in_8(addr);
                 break;
         case 2:
-                *val = in_le16((u16 *)addr);
+                *val = in_le16(addr);
                 break;
         default:
-                *val = in_le32((u32 *)addr);
+                *val = in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -531,7 +529,7 @@ static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
                                 int offset, int len, u32 val)
 {
         struct pci_controller *hose;
-        unsigned long addr;
+        volatile void __iomem *addr;
 
         hose = pci_bus_to_host(bus);
         if (hose == NULL)
@@ -547,16 +545,16 @@ static int u4_pcie_write_config(struct pci_bus *bus, unsigned int devfn,
          */
         switch (len) {
         case 1:
-                out_8((u8 *)addr, val);
-                (void) in_8((u8 *)addr);
+                out_8(addr, val);
+                (void) in_8(addr);
                 break;
         case 2:
-                out_le16((u16 *)addr, val);
-                (void) in_le16((u16 *)addr);
+                out_le16(addr, val);
+                (void) in_le16(addr);
                 break;
         default:
-                out_le32((u32 *)addr, val);
-                (void) in_le32((u32 *)addr);
+                out_le32(addr, val);
+                (void) in_le32(addr);
                 break;
         }
         return PCIBIOS_SUCCESSFUL;
@@ -773,8 +771,7 @@ static void __init setup_u3_ht(struct pci_controller* hose)
          * the reg address cell, we shall fix that by killing struct
          * reg_property and using some accessor functions instead
          */
-        hose->cfg_data = (volatile unsigned char *)ioremap(0xf2000000,
-                                                           0x02000000);
+        hose->cfg_data = ioremap(0xf2000000, 0x02000000);
 
         /*
          * /ht node doesn't expose a "ranges" property, so we "remove"
diff --git a/arch/powerpc/platforms/powermac/pfunc_base.c b/arch/powerpc/platforms/powermac/pfunc_base.c
index 4ffd2a9832a0..9b7150f10414 100644
--- a/arch/powerpc/platforms/powermac/pfunc_base.c
+++ b/arch/powerpc/platforms/powermac/pfunc_base.c
@@ -9,7 +9,12 @@
 #include <asm/pmac_feature.h>
 #include <asm/pmac_pfunc.h>
 
+#undef DEBUG
+#ifdef DEBUG
 #define DBG(fmt...)     printk(fmt)
+#else
+#define DBG(fmt...)
+#endif
 
 static irqreturn_t macio_gpio_irq(int irq, void *data, struct pt_regs *regs)
 {
diff --git a/arch/powerpc/platforms/powermac/pfunc_core.c b/arch/powerpc/platforms/powermac/pfunc_core.c
index 356a739e52b2..4baa75b1d36f 100644
--- a/arch/powerpc/platforms/powermac/pfunc_core.c
+++ b/arch/powerpc/platforms/powermac/pfunc_core.c
@@ -20,7 +20,13 @@
 #define LOG_PARSE(fmt...)
 #define LOG_ERROR(fmt...)       printk(fmt)
 #define LOG_BLOB(t,b,c)
+
+#undef DEBUG
+#ifdef DEBUG
 #define DBG(fmt...)             printk(fmt)
+#else
+#define DBG(fmt...)
+#endif
 
 /* Command numbers */
 #define PMF_CMD_LIST                    0
diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c
index 89c4c3636161..29c2946f1c77 100644
--- a/arch/powerpc/platforms/powermac/setup.c
+++ b/arch/powerpc/platforms/powermac/setup.c
@@ -82,8 +82,6 @@
 
 #undef SHOW_GATWICK_IRQS
 
-unsigned char drive_info;
-
 int ppc_override_l2cr = 0;
 int ppc_override_l2cr_value;
 int has_l2cache = 0;
@@ -623,10 +621,6 @@ static void __init pmac_init_early(void)
         /* Probe motherboard chipset */
         pmac_feature_init();
 
-        /* We can NAP */
-        powersave_nap = 1;
-        printk(KERN_INFO "Using native/NAP idle loop\n");
-
         /* Initialize debug stuff */
         udbg_scc_init(!!strstr(cmd_line, "sccdbg"));
         udbg_adb_init(!!strstr(cmd_line, "btextdbg"));
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index 0df2cdcd805c..6d64a9bf3474 100644
--- a/arch/powerpc/platforms/powermac/smp.c
+++ b/arch/powerpc/platforms/powermac/smp.c
@@ -435,7 +435,7 @@ struct smp_ops_t psurge_smp_ops = {
  */
 
 static void (*pmac_tb_freeze)(int freeze);
-static unsigned long timebase;
+static u64 timebase;
 static int tb_req;
 
 static void smp_core99_give_timebase(void)
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index e3fc3407bb1f..a57032cf6f1b 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -9,13 +9,6 @@ config PPC_SPLPAR
           processors, that is, which share physical processors between
           two or more partitions.
 
-config HMT
-        bool "Hardware multithreading"
-        depends on SMP && PPC_PSERIES && BROKEN
-        help
-          This option enables hardware multithreading on RS64 cpus.
-          pSeries systems p620 and p660 have such a cpu type.
-
 config EEH
         bool "PCI Extended Error Handling (EEH)" if EMBEDDED
         depends on PPC_PSERIES
@@ -26,7 +19,7 @@ config SCANLOG
         depends on RTAS_PROC && PPC_PSERIES
 
 config LPARCFG
-        tristate "LPAR Configuration Data"
+        bool "LPAR Configuration Data"
         depends on PPC_PSERIES || PPC_ISERIES
         help
         Provide system capacity information via human readable
diff --git a/arch/powerpc/platforms/pseries/eeh.c b/arch/powerpc/platforms/pseries/eeh.c
index 83578313ee7e..2ab9dcdfb415 100644
--- a/arch/powerpc/platforms/pseries/eeh.c
+++ b/arch/powerpc/platforms/pseries/eeh.c
@@ -893,6 +893,20 @@ void eeh_add_device_tree_early(struct device_node *dn)
 }
 EXPORT_SYMBOL_GPL(eeh_add_device_tree_early);
 
+void eeh_add_device_tree_late(struct pci_bus *bus)
+{
+        struct pci_dev *dev;
+
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                eeh_add_device_late(dev);
+                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+                        struct pci_bus *subbus = dev->subordinate;
+                        if (subbus)
+                                eeh_add_device_tree_late(subbus);
+                }
+        }
+}
+
 /**
  * eeh_add_device_late - perform EEH initialization for the indicated pci device
  * @dev: pci device for which to set up EEH
diff --git a/arch/powerpc/platforms/pseries/eeh_driver.c b/arch/powerpc/platforms/pseries/eeh_driver.c
index 6373372932ba..b811d5ff92fe 100644
--- a/arch/powerpc/platforms/pseries/eeh_driver.c
+++ b/arch/powerpc/platforms/pseries/eeh_driver.c
@@ -37,7 +37,7 @@
 
 static inline const char * pcid_name (struct pci_dev *pdev)
 {
-        if (pdev->dev.driver)
+        if (pdev && pdev->dev.driver)
                 return pdev->dev.driver->name;
         return "";
 }
@@ -333,7 +333,7 @@ void handle_eeh_events (struct eeh_event *event)
                 rc = eeh_reset_device(frozen_pdn, NULL);
                 if (rc)
                         goto hard_fail;
-                pci_walk_bus(frozen_bus, eeh_report_reset, 0);
+                pci_walk_bus(frozen_bus, eeh_report_reset, NULL);
         }
 
         /* If all devices reported they can proceed, the re-enable PIO */
@@ -342,11 +342,11 @@ void handle_eeh_events (struct eeh_event *event)
                 rc = eeh_reset_device(frozen_pdn, NULL);
                 if (rc)
                         goto hard_fail;
-                pci_walk_bus(frozen_bus, eeh_report_reset, 0);
+                pci_walk_bus(frozen_bus, eeh_report_reset, NULL);
         }
 
         /* Tell all device drivers that they can resume operations */
-        pci_walk_bus(frozen_bus, eeh_report_resume, 0);
+        pci_walk_bus(frozen_bus, eeh_report_resume, NULL);
 
         return;
         
@@ -367,7 +367,7 @@ hard_fail:
         eeh_slot_error_detail(frozen_pdn, 2 /* Permanent Error */);
 
         /* Notify all devices that they're about to go down. */
-        pci_walk_bus(frozen_bus, eeh_report_failure, 0);
+        pci_walk_bus(frozen_bus, eeh_report_failure, NULL);
 
         /* Shut down the device drivers for good. */
         pcibios_remove_pci_devices(frozen_bus);
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index bdaa8aabdaa6..44abdeb9ca03 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -27,6 +27,7 @@
 
 #include <linux/pci.h>
 #include <asm/pci-bridge.h>
+#include <asm/ppc-pci.h>
 
 static struct pci_bus *
 find_bus_among_children(struct pci_bus *bus,
@@ -106,6 +107,8 @@ pcibios_fixup_new_pci_devices(struct pci_bus *bus, int fix_bus)
                         }
                 }
         }
+
+        eeh_add_device_tree_late(bus);
 }
 EXPORT_SYMBOL_GPL(pcibios_fixup_new_pci_devices);
 
@@ -114,7 +117,6 @@ pcibios_pci_config_bridge(struct pci_dev *dev)
 {
         u8 sec_busno;
         struct pci_bus *child_bus;
-        struct pci_dev *child_dev;
 
         /* Get busno of downstream bus */
         pci_read_config_byte(dev, PCI_SECONDARY_BUS, &sec_busno);
@@ -129,10 +131,6 @@ pcibios_pci_config_bridge(struct pci_dev *dev)
 
         pci_scan_child_bus(child_bus);
 
-        list_for_each_entry(child_dev, &child_bus->devices, bus_list) {
-                eeh_add_device_late(child_dev);
-        }
-
         /* Fixup new pci devices without touching bus struct */
         pcibios_fixup_new_pci_devices(child_bus, 0);
 
@@ -160,18 +158,52 @@ pcibios_add_pci_devices(struct pci_bus * bus)
 
         eeh_add_device_tree_early(dn);
 
-        /* pci_scan_slot should find all children */
-        slotno = PCI_SLOT(PCI_DN(dn->child)->devfn);
-        num = pci_scan_slot(bus, PCI_DEVFN(slotno, 0));
-        if (num) {
-                pcibios_fixup_new_pci_devices(bus, 1);
-                pci_bus_add_devices(bus);
-        }
+        if (_machine == PLATFORM_PSERIES_LPAR) {
+                /* use ofdt-based probe */
+                of_scan_bus(dn, bus);
+                if (!list_empty(&bus->devices)) {
+                        pcibios_fixup_new_pci_devices(bus, 0);
+                        pci_bus_add_devices(bus);
+                }
+        } else {
+                /* use legacy probe */
+                slotno = PCI_SLOT(PCI_DN(dn->child)->devfn);
+                num = pci_scan_slot(bus, PCI_DEVFN(slotno, 0));
+                if (num) {
+                        pcibios_fixup_new_pci_devices(bus, 1);
+                        pci_bus_add_devices(bus);
+                }
 
-        list_for_each_entry(dev, &bus->devices, bus_list) {
-                eeh_add_device_late (dev);
-                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
-                        pcibios_pci_config_bridge(dev);
+                list_for_each_entry(dev, &bus->devices, bus_list)
+                        if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+                                pcibios_pci_config_bridge(dev);
         }
 }
 EXPORT_SYMBOL_GPL(pcibios_add_pci_devices);
+
+struct pci_controller * __devinit init_phb_dynamic(struct device_node *dn)
+{
+        struct pci_controller *phb;
+        int primary;
+
+        primary = list_empty(&hose_list);
+        phb = pcibios_alloc_controller(dn);
+        if (!phb)
+                return NULL;
+        setup_phb(dn, phb);
+        pci_process_bridge_OF_ranges(phb, dn, 0);
+
+        pci_setup_phb_io_dynamic(phb, primary);
+
+        pci_devs_phb_init_dynamic(phb);
+
+        if (dn->child)
+                eeh_add_device_tree_early(dn);
+
+        scan_phb(phb);
+        pcibios_fixup_new_pci_devices(phb->bus, 0);
+        pci_bus_add_devices(phb->bus);
+
+        return phb;
+}
+EXPORT_SYMBOL_GPL(init_phb_dynamic);
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index da6cebaf72cd..9edeca83f434 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -585,7 +585,7 @@ static int pSeries_pci_probe_mode(struct pci_bus *bus)
 static void pseries_kexec_cpu_down(int crash_shutdown, int secondary)
 {
         /* Don't risk a hypervisor call if we're crashing */
-        if (!crash_shutdown) {
+        if (firmware_has_feature(FW_FEATURE_SPLPAR) && !crash_shutdown) {
                 unsigned long vpa = __pa(get_lppaca());
 
                 if (unregister_vpa(hard_smp_processor_id(), vpa)) {
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 8e6b1ed1396e..8d710af50756 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -292,7 +292,7 @@ static inline int __devinit smp_startup_cpu(unsigned int lcpu)
         if (start_cpu == RTAS_UNKNOWN_SERVICE)
                 return 1;
 
-        status = rtas_call(start_cpu, 3, 1, NULL, pcpu, start_here, lcpu);
+        status = rtas_call(start_cpu, 3, 1, NULL, pcpu, start_here, pcpu);
         if (status != 0) {
                 printk(KERN_ERR "start-cpu failed: %i\n", status);
                 return 0;
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 977de9db8754..6298264efe36 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -59,7 +59,7 @@ static unsigned long dart_tablesize;
 static u32 *dart_vbase;
 
 /* Mapped base address for the dart */
-static unsigned int *__iomem dart;
+static unsigned int __iomem *dart;
 
 /* Dummy val that entries are set to when unused */
 static unsigned int dart_emptyval;
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 4f26304d0263..7dcdfcb3c984 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -234,7 +234,7 @@ static void mpic_shutdown_ht_interrupt(struct mpic *mpic, unsigned int source,
         spin_lock_irqsave(&mpic->fixup_lock, flags);
         writeb(0x10 + 2 * fixup->index, fixup->base + 2);
         tmp = readl(fixup->base + 4);
-        tmp &= ~1U;
+        tmp |= 1;
         writel(tmp, fixup->base + 4);
         spin_unlock_irqrestore(&mpic->fixup_lock, flags);
 }
@@ -446,14 +446,15 @@ static unsigned int mpic_startup_irq(unsigned int irq)
 #ifdef CONFIG_MPIC_BROKEN_U3
         struct mpic *mpic = mpic_from_irq(irq);
         unsigned int src = irq - mpic->irq_offset;
+#endif /* CONFIG_MPIC_BROKEN_U3 */
+
+        mpic_enable_irq(irq);
 
+#ifdef CONFIG_MPIC_BROKEN_U3
         if (mpic_is_ht_interrupt(mpic, src))
                 mpic_startup_ht_interrupt(mpic, src, irq_desc[irq].status);
-
 #endif /* CONFIG_MPIC_BROKEN_U3 */
 
-        mpic_enable_irq(irq);
-
         return 0;
 }
 
diff --git a/arch/ppc/kernel/asm-offsets.c b/arch/ppc/kernel/asm-offsets.c
index 7964bf660e92..77e4dc780f8c 100644
--- a/arch/ppc/kernel/asm-offsets.c
+++ b/arch/ppc/kernel/asm-offsets.c
@@ -131,7 +131,6 @@ main(void)
         DEFINE(CPU_SPEC_FEATURES, offsetof(struct cpu_spec, cpu_features));
         DEFINE(CPU_SPEC_SETUP, offsetof(struct cpu_spec, cpu_setup));
 
-        DEFINE(TI_SIGFRAME, offsetof(struct thread_info, nvgprs_frame));
         DEFINE(TI_TASK, offsetof(struct thread_info, task));
         DEFINE(TI_EXECDOMAIN, offsetof(struct thread_info, exec_domain));
         DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));
diff --git a/arch/ppc/kernel/entry.S b/arch/ppc/kernel/entry.S
index a48b950722a1..3a2815978488 100644
--- a/arch/ppc/kernel/entry.S
+++ b/arch/ppc/kernel/entry.S
@@ -227,7 +227,7 @@ ret_from_syscall:
         MTMSRD(r10)
         lwz     r9,TI_FLAGS(r12)
         li      r8,-_LAST_ERRNO
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL)
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_USER_WORK_MASK|_TIF_PERSYSCALL_MASK)
         bne-    syscall_exit_work
         cmplw   0,r3,r8
         blt+    syscall_exit_cont
@@ -287,8 +287,10 @@ syscall_dotrace:
 
 syscall_exit_work:
         andi.   r0,r9,_TIF_RESTOREALL
-        bne-    2f
-        cmplw   0,r3,r8
+        beq+    0f
+        REST_NVGPRS(r1)
+        b       2f
+0:      cmplw   0,r3,r8
         blt+    1f
         andi.   r0,r9,_TIF_NOERROR
         bne-    1f
@@ -302,9 +304,7 @@ syscall_exit_work:
 2:      andi.   r0,r9,(_TIF_PERSYSCALL_MASK)
         beq     4f
 
-        /* Clear per-syscall TIF flags if any are set, but _leave_
-        _TIF_SAVE_NVGPRS set in r9 since we haven't dealt with that
-        yet.  */
+        /* Clear per-syscall TIF flags if any are set.  */
 
         li      r11,_TIF_PERSYSCALL_MASK
         addi    r12,r12,TI_FLAGS
@@ -318,8 +318,13 @@ syscall_exit_work:
         subi    r12,r12,TI_FLAGS
         
 4:      /* Anything which requires enabling interrupts? */
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP|_TIF_SAVE_NVGPRS)
-        beq     7f
+        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
+        beq     ret_from_except
+
+        /* Re-enable interrupts */
+        ori     r10,r10,MSR_EE
+        SYNC
+        MTMSRD(r10)
 
         /* Save NVGPRS if they're not saved already */
         lwz     r4,TRAP(r1)
@@ -328,71 +333,11 @@ syscall_exit_work:
         SAVE_NVGPRS(r1)
         li      r4,0xc00
         stw     r4,TRAP(r1)
-
-        /* Re-enable interrupts */
-5:      ori     r10,r10,MSR_EE
-        SYNC
-        MTMSRD(r10)
-
-        andi.   r0,r9,_TIF_SAVE_NVGPRS
-        bne     save_user_nvgprs
-
-save_user_nvgprs_cont:
-        andi.   r0,r9,(_TIF_SYSCALL_T_OR_A|_TIF_SINGLESTEP)
-        beq     7f
-
+5:
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      do_syscall_trace_leave
-        REST_NVGPRS(r1)
-
-6:      lwz     r3,GPR3(r1)
-        LOAD_MSR_KERNEL(r10,MSR_KERNEL) /* doesn't include MSR_EE */
-        SYNC
-        MTMSRD(r10)             /* disable interrupts again */
-        rlwinm  r12,r1,0,0,18   /* current_thread_info() */
-        lwz     r9,TI_FLAGS(r12)
-7:
-        andi.   r0,r9,_TIF_NEED_RESCHED
-        bne     8f
-        lwz     r5,_MSR(r1)
-        andi.   r5,r5,MSR_PR
-        beq     ret_from_except
-        andi.   r0,r9,_TIF_SIGPENDING
-        beq     ret_from_except
-        b       do_user_signal
-8:
-        ori     r10,r10,MSR_EE
-        SYNC
-        MTMSRD(r10)             /* re-enable interrupts */
-        bl      schedule
-        b       6b
-
-save_user_nvgprs:
-        lwz     r8,TI_SIGFRAME(r12)
-
-.macro savewords start, end
-  1:    stw \start,4*(\start)(r8)
-        .section __ex_table,"a"
-        .align  2
-        .long   1b,save_user_nvgprs_fault
-        .previous
-        .if \end - \start
-        savewords "(\start+1)",\end
-        .endif
-.endm   
-        savewords 14,31
-        b       save_user_nvgprs_cont
-
-        
-save_user_nvgprs_fault:
-        li      r3,11           /* SIGSEGV */
-        lwz     r4,TI_TASK(r12)
-        bl      force_sigsegv
+        b       ret_from_except_full
 
-        rlwinm  r12,r1,0,0,18   /* current_thread_info() */
-        lwz     r9,TI_FLAGS(r12)
-        b       save_user_nvgprs_cont
-        
 #ifdef SHOW_SYSCALLS
 do_show_syscall:
 #ifdef SHOW_SYSCALLS_TASK
@@ -490,6 +435,14 @@ ppc_clone:
         stw     r0,TRAP(r1)             /* register set saved */
         b       sys_clone
 
+        .globl  ppc_swapcontext
+ppc_swapcontext:
+        SAVE_NVGPRS(r1)
+        lwz     r0,TRAP(r1)
+        rlwinm  r0,r0,0,0,30            /* clear LSB to indicate full */
+        stw     r0,TRAP(r1)             /* register set saved */
+        b       sys_swapcontext
+
 /*
  * Top-level page fault handling.
  * This is in assembler because if do_page_fault tells us that
@@ -683,7 +636,7 @@ user_exc_return:		/* r10 contains MSR_KERNEL here */
         /* Check current_thread_info()->flags */
         rlwinm  r9,r1,0,0,18
         lwz     r9,TI_FLAGS(r9)
-        andi.   r0,r9,(_TIF_SIGPENDING|_TIF_NEED_RESCHED|_TIF_RESTOREALL)
+        andi.   r0,r9,(_TIF_SIGPENDING|_TIF_RESTORE_SIGMASK|_TIF_NEED_RESCHED)
         bne     do_work
 
 restore_user:
diff --git a/arch/ppc/kernel/head.S b/arch/ppc/kernel/head.S
index c5a890dca9cf..53ea845fb911 100644
--- a/arch/ppc/kernel/head.S
+++ b/arch/ppc/kernel/head.S
@@ -751,6 +751,7 @@ AltiVecUnavailable:
 #ifdef CONFIG_ALTIVEC
         bne     load_up_altivec         /* if from user, just load it up */
 #endif /* CONFIG_ALTIVEC */
+        addi    r3,r1,STACK_FRAME_OVERHEAD
         EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 
 #ifdef CONFIG_PPC64BRIDGE
diff --git a/arch/ppc/kernel/head_8xx.S b/arch/ppc/kernel/head_8xx.S
index 3e6ca7f5843f..c1e89ad0684d 100644
--- a/arch/ppc/kernel/head_8xx.S
+++ b/arch/ppc/kernel/head_8xx.S
@@ -810,13 +810,16 @@ initial_mmu:
         mtspr   SPRN_MD_TWC, r9
         li      r11, MI_BOOTINIT        /* Create RPN for address 0 */
         addis   r11, r11, 0x0080        /* Add 8M */
-        mtspr   SPRN_MD_RPN, r8
+        mtspr   SPRN_MD_RPN, r11
+
+        addi    r10, r10, 0x0100
+        mtspr   SPRN_MD_CTR, r10
 
         addis   r8, r8, 0x0080          /* Add 8M */
         mtspr   SPRN_MD_EPN, r8
         mtspr   SPRN_MD_TWC, r9
         addis   r11, r11, 0x0080        /* Add 8M */
-        mtspr   SPRN_MD_RPN, r8
+        mtspr   SPRN_MD_RPN, r11
 #endif
 
         /* Since the cache is enabled according to the information we
diff --git a/arch/ppc/kernel/misc.S b/arch/ppc/kernel/misc.S
index c3427eed8345..5a936566fd61 100644
--- a/arch/ppc/kernel/misc.S
+++ b/arch/ppc/kernel/misc.S
@@ -1048,286 +1048,3 @@ _GLOBAL(name) \
         blr
 
 SYSCALL(execve)
-
-/* Why isn't this a) automatic, b) written in 'C'? */
-        .data
-        .align 4
-_GLOBAL(sys_call_table)
-        .long sys_restart_syscall /* 0 */
-        .long sys_exit
-        .long ppc_fork
-        .long sys_read
-        .long sys_write
-        .long sys_open          /* 5 */
-        .long sys_close
-        .long sys_waitpid
-        .long sys_creat
-        .long sys_link
-        .long sys_unlink        /* 10 */
-        .long sys_execve
-        .long sys_chdir
-        .long sys_time
-        .long sys_mknod
-        .long sys_chmod         /* 15 */
-        .long sys_lchown
-        .long sys_ni_syscall                    /* old break syscall holder */
-        .long sys_stat
-        .long sys_lseek
-        .long sys_getpid        /* 20 */
-        .long sys_mount
-        .long sys_oldumount
-        .long sys_setuid
-        .long sys_getuid
-        .long sys_stime         /* 25 */
-        .long sys_ptrace
-        .long sys_alarm
-        .long sys_fstat
-        .long sys_pause
-        .long sys_utime         /* 30 */
-        .long sys_ni_syscall                    /* old stty syscall holder */
-        .long sys_ni_syscall                    /* old gtty syscall holder */
-        .long sys_access
-        .long sys_nice
-        .long sys_ni_syscall    /* 35 */        /* old ftime syscall holder */
-        .long sys_sync
-        .long sys_kill
-        .long sys_rename
-        .long sys_mkdir
-        .long sys_rmdir         /* 40 */
-        .long sys_dup
-        .long sys_pipe
-        .long sys_times
-        .long sys_ni_syscall                    /* old prof syscall holder */
-        .long sys_brk           /* 45 */
-        .long sys_setgid
-        .long sys_getgid
-        .long sys_signal
-        .long sys_geteuid
-        .long sys_getegid       /* 50 */
-        .long sys_acct
-        .long sys_umount                        /* recycled never used phys() */
-        .long sys_ni_syscall                    /* old lock syscall holder */
-        .long sys_ioctl
-        .long sys_fcntl         /* 55 */
-        .long sys_ni_syscall                    /* old mpx syscall holder */
-        .long sys_setpgid
-        .long sys_ni_syscall                    /* old ulimit syscall holder */
-        .long sys_olduname
-        .long sys_umask         /* 60 */
-        .long sys_chroot
-        .long sys_ustat
-        .long sys_dup2
-        .long sys_getppid
-        .long sys_getpgrp       /* 65 */
-        .long sys_setsid
-        .long sys_sigaction
-        .long sys_sgetmask
-        .long sys_ssetmask
-        .long sys_setreuid      /* 70 */
-        .long sys_setregid
-        .long sys_sigsuspend
-        .long sys_sigpending
-        .long sys_sethostname
-        .long sys_setrlimit     /* 75 */
-        .long sys_old_getrlimit
-        .long sys_getrusage
-        .long sys_gettimeofday
-        .long sys_settimeofday
-        .long sys_getgroups     /* 80 */
-        .long sys_setgroups
-        .long ppc_select
-        .long sys_symlink
-        .long sys_lstat
-        .long sys_readlink      /* 85 */
-        .long sys_uselib
-        .long sys_swapon
-        .long sys_reboot
-        .long old_readdir
-        .long sys_mmap          /* 90 */
-        .long sys_munmap
-        .long sys_truncate
-        .long sys_ftruncate
-        .long sys_fchmod
-        .long sys_fchown        /* 95 */
-        .long sys_getpriority
-        .long sys_setpriority
-        .long sys_ni_syscall                    /* old profil syscall holder */
-        .long sys_statfs
-        .long sys_fstatfs       /* 100 */
-        .long sys_ni_syscall
-        .long sys_socketcall
-        .long sys_syslog
-        .long sys_setitimer
-        .long sys_getitimer     /* 105 */
-        .long sys_newstat
-        .long sys_newlstat
-        .long sys_newfstat
-        .long sys_uname
-        .long sys_ni_syscall    /* 110 */
-        .long sys_vhangup
-        .long sys_ni_syscall    /* old 'idle' syscall */
-        .long sys_ni_syscall
-        .long sys_wait4
-        .long sys_swapoff       /* 115 */
-        .long sys_sysinfo
-        .long sys_ipc
-        .long sys_fsync
-        .long sys_sigreturn
-        .long ppc_clone         /* 120 */
-        .long sys_setdomainname
-        .long sys_newuname
-        .long sys_ni_syscall
-        .long sys_adjtimex
-        .long sys_mprotect      /* 125 */
-        .long sys_sigprocmask
-        .long sys_ni_syscall    /* old sys_create_module */
-        .long sys_init_module
-        .long sys_delete_module
-        .long sys_ni_syscall    /* old sys_get_kernel_syms */   /* 130 */
-        .long sys_quotactl
-        .long sys_getpgid
-        .long sys_fchdir
-        .long sys_bdflush
-        .long sys_sysfs         /* 135 */
-        .long sys_personality
-        .long sys_ni_syscall    /* for afs_syscall */
-        .long sys_setfsuid
-        .long sys_setfsgid
-        .long sys_llseek        /* 140 */
-        .long sys_getdents
-        .long ppc_select
-        .long sys_flock
-        .long sys_msync
-        .long sys_readv         /* 145 */
-        .long sys_writev
-        .long sys_getsid
-        .long sys_fdatasync
-        .long sys_sysctl
-        .long sys_mlock         /* 150 */
-        .long sys_munlock
-        .long sys_mlockall
-        .long sys_munlockall
-        .long sys_sched_setparam
-        .long sys_sched_getparam        /* 155 */
-        .long sys_sched_setscheduler
-        .long sys_sched_getscheduler
-        .long sys_sched_yield
-        .long sys_sched_get_priority_max
-        .long sys_sched_get_priority_min  /* 160 */
-        .long sys_sched_rr_get_interval
-        .long sys_nanosleep
-        .long sys_mremap
-        .long sys_setresuid
-        .long sys_getresuid     /* 165 */
-        .long sys_ni_syscall            /* old sys_query_module */
-        .long sys_poll
-        .long sys_nfsservctl
-        .long sys_setresgid
-        .long sys_getresgid     /* 170 */
-        .long sys_prctl
-        .long sys_rt_sigreturn
-        .long sys_rt_sigaction
-        .long sys_rt_sigprocmask
-        .long sys_rt_sigpending /* 175 */
-        .long sys_rt_sigtimedwait
-        .long sys_rt_sigqueueinfo
-        .long sys_rt_sigsuspend
-        .long sys_pread64
-        .long sys_pwrite64      /* 180 */
-        .long sys_chown
-        .long sys_getcwd
-        .long sys_capget
-        .long sys_capset
-        .long sys_sigaltstack   /* 185 */
-        .long sys_sendfile
-        .long sys_ni_syscall            /* streams1 */
-        .long sys_ni_syscall            /* streams2 */
-        .long ppc_vfork
-        .long sys_getrlimit     /* 190 */
-        .long sys_readahead
-        .long sys_mmap2
-        .long sys_truncate64
-        .long sys_ftruncate64
-        .long sys_stat64        /* 195 */
-        .long sys_lstat64
-        .long sys_fstat64
-        .long sys_pciconfig_read
-        .long sys_pciconfig_write
-        .long sys_pciconfig_iobase      /* 200 */
-        .long sys_ni_syscall            /* 201 - reserved - MacOnLinux - new */
-        .long sys_getdents64
-        .long sys_pivot_root
-        .long sys_fcntl64
-        .long sys_madvise       /* 205 */
-        .long sys_mincore
-        .long sys_gettid
-        .long sys_tkill
-        .long sys_setxattr
-        .long sys_lsetxattr     /* 210 */
-        .long sys_fsetxattr
-        .long sys_getxattr
-        .long sys_lgetxattr
-        .long sys_fgetxattr
-        .long sys_listxattr     /* 215 */
-        .long sys_llistxattr
-        .long sys_flistxattr
-        .long sys_removexattr
-        .long sys_lremovexattr
-        .long sys_fremovexattr  /* 220 */
-        .long sys_futex
-        .long sys_sched_setaffinity
-        .long sys_sched_getaffinity
-        .long sys_ni_syscall
-        .long sys_ni_syscall    /* 225 - reserved for Tux */
-        .long sys_sendfile64
-        .long sys_io_setup
-        .long sys_io_destroy
-        .long sys_io_getevents
-        .long sys_io_submit     /* 230 */
-        .long sys_io_cancel
-        .long sys_set_tid_address
-        .long sys_fadvise64
-        .long sys_exit_group
-        .long sys_lookup_dcookie /* 235 */
-        .long sys_epoll_create
-        .long sys_epoll_ctl
-        .long sys_epoll_wait
-        .long sys_remap_file_pages
-        .long sys_timer_create  /* 240 */
-        .long sys_timer_settime
-        .long sys_timer_gettime
-        .long sys_timer_getoverrun
-        .long sys_timer_delete
-        .long sys_clock_settime /* 245 */
-        .long sys_clock_gettime
-        .long sys_clock_getres
-        .long sys_clock_nanosleep
-        .long sys_swapcontext
-        .long sys_tgkill        /* 250 */
-        .long sys_utimes
-        .long sys_statfs64
-        .long sys_fstatfs64
-        .long ppc_fadvise64_64
-        .long sys_ni_syscall            /* 255 - rtas (used on ppc64) */
-        .long sys_debug_setcontext
-        .long sys_ni_syscall            /* 257 reserved for vserver */
-        .long sys_ni_syscall            /* 258 reserved for new sys_remap_file_pages */
-        .long sys_ni_syscall            /* 259 reserved for new sys_mbind */
-        .long sys_ni_syscall            /* 260 reserved for new sys_get_mempolicy */
-        .long sys_ni_syscall            /* 261 reserved for new sys_set_mempolicy */
-        .long sys_mq_open
-        .long sys_mq_unlink
-        .long sys_mq_timedsend
-        .long sys_mq_timedreceive       /* 265 */
-        .long sys_mq_notify
-        .long sys_mq_getsetattr
-        .long sys_kexec_load
-        .long sys_add_key
-        .long sys_request_key           /* 270 */
-        .long sys_keyctl
-        .long sys_waitid
-        .long sys_ioprio_set
-        .long sys_ioprio_get
-        .long sys_inotify_init          /* 275 */
-        .long sys_inotify_add_watch
-        .long sys_inotify_rm_watch
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index 3a6e4bcb3c53..82adb4601348 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -93,15 +93,8 @@ EXPORT_SYMBOL(test_and_change_bit);
 EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strpbrk);
-EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strcasecmp);
 EXPORT_SYMBOL(__div64_32);
 
@@ -186,11 +179,15 @@ EXPORT_SYMBOL(flush_tlb_kernel_range);
 EXPORT_SYMBOL(flush_tlb_page);
 EXPORT_SYMBOL(_tlbie);
 #ifdef CONFIG_ALTIVEC
+#ifndef CONFIG_SMP
 EXPORT_SYMBOL(last_task_used_altivec);
+#endif
 EXPORT_SYMBOL(giveup_altivec);
 #endif /* CONFIG_ALTIVEC */
 #ifdef CONFIG_SPE
+#ifndef CONFIG_SMP
 EXPORT_SYMBOL(last_task_used_spe);
+#endif
 EXPORT_SYMBOL(giveup_spe);
 #endif /* CONFIG_SPE */
 #ifdef CONFIG_SMP
@@ -249,7 +246,6 @@ EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(cacheable_memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memchr);
 
diff --git a/arch/ppc/platforms/4xx/bamboo.c b/arch/ppc/platforms/4xx/bamboo.c
index 159b228eca1e..0ec53f049338 100644
--- a/arch/ppc/platforms/4xx/bamboo.c
+++ b/arch/ppc/platforms/4xx/bamboo.c
@@ -332,8 +332,8 @@ bamboo_early_serial_map(void)
         port.irq = 0;
         port.uartclk = clocks.uart0;
         port.regshift = 0;
-        port.iotype = SERIAL_IO_MEM;
-        port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        port.iotype = UPIO_MEM;
+        port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         port.line = 0;
 
         if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/4xx/bubinga.c b/arch/ppc/platforms/4xx/bubinga.c
index 8110f55668c5..ce48a4f08cbb 100644
--- a/arch/ppc/platforms/4xx/bubinga.c
+++ b/arch/ppc/platforms/4xx/bubinga.c
@@ -97,8 +97,8 @@ bubinga_early_serial_map(void)
         port.irq = ACTING_UART0_INT;
         port.uartclk = uart_clock;
         port.regshift = 0;
-        port.iotype = SERIAL_IO_MEM;
-        port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        port.iotype = UPIO_MEM;
+        port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         port.line = 0;
 
         if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/4xx/ebony.c b/arch/ppc/platforms/4xx/ebony.c
index 64ebae19cdbb..9a828b623417 100644
--- a/arch/ppc/platforms/4xx/ebony.c
+++ b/arch/ppc/platforms/4xx/ebony.c
@@ -225,8 +225,8 @@ ebony_early_serial_map(void)
         port.irq = 0;
         port.uartclk = clocks.uart0;
         port.regshift = 0;
-        port.iotype = SERIAL_IO_MEM;
-        port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        port.iotype = UPIO_MEM;
+        port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         port.line = 0;
 
         if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/4xx/luan.c b/arch/ppc/platforms/4xx/luan.c
index d810b736d9bf..21d29132aebd 100644
--- a/arch/ppc/platforms/4xx/luan.c
+++ b/arch/ppc/platforms/4xx/luan.c
@@ -279,8 +279,8 @@ luan_early_serial_map(void)
         port.irq = UART0_INT;
         port.uartclk = clocks.uart0;
         port.regshift = 0;
-        port.iotype = SERIAL_IO_MEM;
-        port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        port.iotype = UPIO_MEM;
+        port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         port.line = 0;
 
         if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/4xx/ocotea.c b/arch/ppc/platforms/4xx/ocotea.c
index 73b2c98158f6..4f355b6acab2 100644
--- a/arch/ppc/platforms/4xx/ocotea.c
+++ b/arch/ppc/platforms/4xx/ocotea.c
@@ -248,8 +248,8 @@ ocotea_early_serial_map(void)
         port.irq = UART0_INT;
         port.uartclk = clocks.uart0;
         port.regshift = 0;
-        port.iotype = SERIAL_IO_MEM;
-        port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        port.iotype = UPIO_MEM;
+        port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         port.line = 0;
 
         if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/4xx/xilinx_ml300.c b/arch/ppc/platforms/4xx/xilinx_ml300.c
index 0b1b77d986bf..e90d97f64f76 100644
--- a/arch/ppc/platforms/4xx/xilinx_ml300.c
+++ b/arch/ppc/platforms/4xx/xilinx_ml300.c
@@ -95,8 +95,8 @@ ml300_early_serial_map(void)
                 port.irq = old_ports[i].irq;
                 port.uartclk = old_ports[i].baud_base * 16;
                 port.regshift = old_ports[i].iomem_reg_shift;
-                port.iotype = SERIAL_IO_MEM;
-                port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+                port.iotype = UPIO_MEM;
+                port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
                 port.line = i;
 
                 if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/4xx/yucca.c b/arch/ppc/platforms/4xx/yucca.c
index e60f4bd437ec..b065b8babcd3 100644
--- a/arch/ppc/platforms/4xx/yucca.c
+++ b/arch/ppc/platforms/4xx/yucca.c
@@ -305,8 +305,8 @@ yucca_early_serial_map(void)
         port.irq = UART0_INT;
         port.uartclk = clocks.uart0;
         port.regshift = 0;
-        port.iotype = SERIAL_IO_MEM;
-        port.flags = ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST;
+        port.iotype = UPIO_MEM;
+        port.flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
         port.line = 0;
 
         if (early_serial_setup(&port) != 0) {
diff --git a/arch/ppc/platforms/83xx/mpc834x_sys.c b/arch/ppc/platforms/83xx/mpc834x_sys.c
index 012e1e652c03..1a659bbc1860 100644
--- a/arch/ppc/platforms/83xx/mpc834x_sys.c
+++ b/arch/ppc/platforms/83xx/mpc834x_sys.c
@@ -301,14 +301,14 @@ platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
                 struct uart_port p;
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (unsigned char __iomem *)(VIRT_IMMRBAR + 0x4500);
                 p.uartclk = binfo->bi_busfreq;
 
                 gen550_init(0, &p);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (unsigned char __iomem *)(VIRT_IMMRBAR + 0x4600);
                 p.uartclk = binfo->bi_busfreq;
 
diff --git a/arch/ppc/platforms/85xx/mpc8540_ads.c b/arch/ppc/platforms/85xx/mpc8540_ads.c
index 2eceb1e6f4eb..408d64f18e1a 100644
--- a/arch/ppc/platforms/85xx/mpc8540_ads.c
+++ b/arch/ppc/platforms/85xx/mpc8540_ads.c
@@ -162,14 +162,14 @@ platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
                           binfo->bi_immr_base, MPC85xx_CCSRBAR_SIZE, _PAGE_IO, 0);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (void *) binfo->bi_immr_base + MPC85xx_UART0_OFFSET;
                 p.uartclk = binfo->bi_busfreq;
 
                 gen550_init(0, &p);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (void *) binfo->bi_immr_base + MPC85xx_UART1_OFFSET;
                 p.uartclk = binfo->bi_busfreq;
 
diff --git a/arch/ppc/platforms/85xx/mpc85xx_cds_common.c b/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
index b332ebae6bd3..1801ab392e22 100644
--- a/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
+++ b/arch/ppc/platforms/85xx/mpc85xx_cds_common.c
@@ -534,14 +534,14 @@ platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
                                 binfo->bi_immr_base, MPC85xx_CCSRBAR_SIZE, _PAGE_IO, 0);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (void *) binfo->bi_immr_base + MPC85xx_UART0_OFFSET;
                 p.uartclk = binfo->bi_busfreq;
 
                 gen550_init(0, &p);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (void *) binfo->bi_immr_base + MPC85xx_UART1_OFFSET;
                 p.uartclk = binfo->bi_busfreq;
 
diff --git a/arch/ppc/platforms/85xx/sbc8560.c b/arch/ppc/platforms/85xx/sbc8560.c
index e777ba824aa9..8a72221f816c 100644
--- a/arch/ppc/platforms/85xx/sbc8560.c
+++ b/arch/ppc/platforms/85xx/sbc8560.c
@@ -64,7 +64,7 @@ sbc8560_early_serial_map(void)
         uart_req.irq = MPC85xx_IRQ_EXT9;
         uart_req.flags = STD_COM_FLAGS;
         uart_req.uartclk = BASE_BAUD * 16;
-        uart_req.iotype = SERIAL_IO_MEM;
+        uart_req.iotype = UPIO_MEM;
         uart_req.mapbase = UARTA_ADDR;
         uart_req.membase = ioremap(uart_req.mapbase, MPC85xx_UART0_SIZE);
         uart_req.type = PORT_16650;
diff --git a/arch/ppc/platforms/85xx/tqm85xx.c b/arch/ppc/platforms/85xx/tqm85xx.c
index b436f4d0a3fa..a5e38ba62732 100644
--- a/arch/ppc/platforms/85xx/tqm85xx.c
+++ b/arch/ppc/platforms/85xx/tqm85xx.c
@@ -346,14 +346,14 @@ platform_init(unsigned long r3, unsigned long r4, unsigned long r5,
                           binfo->bi_immr_base, MPC85xx_CCSRBAR_SIZE, _PAGE_IO, 0);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (void *) binfo->bi_immr_base + MPC85xx_UART0_OFFSET;
                 p.uartclk = binfo->bi_busfreq;
 
                 gen550_init(0, &p);
 
                 memset(&p, 0, sizeof (p));
-                p.iotype = SERIAL_IO_MEM;
+                p.iotype = UPIO_MEM;
                 p.membase = (void *) binfo->bi_immr_base + MPC85xx_UART1_OFFSET;
                 p.uartclk = binfo->bi_busfreq;
 
diff --git a/arch/ppc/platforms/chestnut.c b/arch/ppc/platforms/chestnut.c
index 48a4a510d598..aefcc0e7be57 100644
--- a/arch/ppc/platforms/chestnut.c
+++ b/arch/ppc/platforms/chestnut.c
@@ -116,7 +116,7 @@ chestnut_early_serial_map(void)
         port.uartclk = BASE_BAUD * 16;
         port.irq = UART0_INT;
         port.flags = STD_COM_FLAGS | UPF_IOREMAP;
-        port.iotype = SERIAL_IO_MEM;
+        port.iotype = UPIO_MEM;
         port.mapbase = CHESTNUT_UART0_IO_BASE;
         port.regshift = 0;
 
diff --git a/arch/ppc/platforms/ev64260.c b/arch/ppc/platforms/ev64260.c
index 32358b3fb236..ffde8f6f6302 100644
--- a/arch/ppc/platforms/ev64260.c
+++ b/arch/ppc/platforms/ev64260.c
@@ -330,7 +330,7 @@ ev64260_early_serial_map(void)
                 port.irq = EV64260_UART_0_IRQ;
                 port.uartclk = BASE_BAUD * 16;
                 port.regshift = 2;
-                port.iotype = SERIAL_IO_MEM;
+                port.iotype = UPIO_MEM;
                 port.flags = STD_COM_FLAGS;
 
 #if defined(CONFIG_SERIAL_TEXT_DEBUG) || defined(CONFIG_KGDB)
diff --git a/arch/ppc/platforms/radstone_ppc7d.c b/arch/ppc/platforms/radstone_ppc7d.c
index 708b8739ecdd..872c0a3ba3c7 100644
--- a/arch/ppc/platforms/radstone_ppc7d.c
+++ b/arch/ppc/platforms/radstone_ppc7d.c
@@ -100,7 +100,7 @@ static void __init ppc7d_early_serial_map(void)
         serial_req.uartclk = UART_CLK;
         serial_req.irq = 4;
         serial_req.flags = STD_COM_FLAGS;
-        serial_req.iotype = SERIAL_IO_MEM;
+        serial_req.iotype = UPIO_MEM;
         serial_req.membase = (u_char *) PPC7D_SERIAL_0;
 
         gen550_init(0, &serial_req);
diff --git a/arch/ppc/platforms/spruce.c b/arch/ppc/platforms/spruce.c
index 5ad70d357cb9..69e1de7971f2 100644
--- a/arch/ppc/platforms/spruce.c
+++ b/arch/ppc/platforms/spruce.c
@@ -176,8 +176,8 @@ spruce_early_serial_map(void)
         memset(&serial_req, 0, sizeof(serial_req));
         serial_req.uartclk = uart_clk;
         serial_req.irq = UART0_INT;
-        serial_req.flags = ASYNC_BOOT_AUTOCONF;
-        serial_req.iotype = SERIAL_IO_MEM;
+        serial_req.flags = UPF_BOOT_AUTOCONF;
+        serial_req.iotype = UPIO_MEM;
         serial_req.membase = (u_char *)UART0_IO_BASE;
         serial_req.regshift = 0;
 
diff --git a/arch/ppc/syslib/ocp.c b/arch/ppc/syslib/ocp.c
index ab34b1d6072f..2fe28ded2c60 100644
--- a/arch/ppc/syslib/ocp.c
+++ b/arch/ppc/syslib/ocp.c
@@ -189,8 +189,8 @@ ocp_device_resume(struct device *dev)
 struct bus_type ocp_bus_type = {
         .name = "ocp",
         .match = ocp_device_match,
-        .probe = ocp_driver_probe,
-        .remove = ocp_driver_remove,
+        .probe = ocp_device_probe,
+        .remove = ocp_device_remove,
         .suspend = ocp_device_suspend,
         .resume = ocp_device_resume,
 };
diff --git a/arch/ppc/syslib/ppc83xx_setup.c b/arch/ppc/syslib/ppc83xx_setup.c
index 1b5fe9e398d4..7bada82527a8 100644
--- a/arch/ppc/syslib/ppc83xx_setup.c
+++ b/arch/ppc/syslib/ppc83xx_setup.c
@@ -108,7 +108,7 @@ mpc83xx_early_serial_map(void)
 
 #if defined(CONFIG_SERIAL_TEXT_DEBUG) || defined(CONFIG_KGDB)
         memset(&serial_req, 0, sizeof (serial_req));
-        serial_req.iotype = SERIAL_IO_MEM;
+        serial_req.iotype = UPIO_MEM;
         serial_req.mapbase = pdata[0].mapbase;
         serial_req.membase = pdata[0].membase;
         serial_req.regshift = 0;
diff --git a/arch/ppc/syslib/ppc85xx_setup.c b/arch/ppc/syslib/ppc85xx_setup.c
index 1a47ff4b831d..e4dda43fdaa7 100644
--- a/arch/ppc/syslib/ppc85xx_setup.c
+++ b/arch/ppc/syslib/ppc85xx_setup.c
@@ -90,7 +90,7 @@ mpc85xx_early_serial_map(void)
 
 #if defined(CONFIG_SERIAL_TEXT_DEBUG) || defined(CONFIG_KGDB)
         memset(&serial_req, 0, sizeof (serial_req));
-        serial_req.iotype = SERIAL_IO_MEM;
+        serial_req.iotype = UPIO_MEM;
         serial_req.mapbase = pdata[0].mapbase;
         serial_req.membase = pdata[0].membase;
         serial_req.regshift = 0;
diff --git a/arch/ppc/xmon/adb.c b/arch/ppc/xmon/adb.c
deleted file mode 100644
index e91384dcccac..000000000000
--- a/arch/ppc/xmon/adb.c
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- * Copyright (C) 1996 Paul Mackerras.
- */
-#include "nonstdio.h"
-#include "privinst.h"
-
-#define scanhex xmon_scanhex
-#define skipbl  xmon_skipbl
-
-#define ADB_B           (*(volatile unsigned char *)0xf3016000)
-#define ADB_SR          (*(volatile unsigned char *)0xf3017400)
-#define ADB_ACR         (*(volatile unsigned char *)0xf3017600)
-#define ADB_IFR         (*(volatile unsigned char *)0xf3017a00)
-
-static inline void eieio(void) { asm volatile ("eieio" : :); }
-
-#define N_ADB_LOG       1000
-struct adb_log {
-    unsigned char b;
-    unsigned char ifr;
-    unsigned char acr;
-    unsigned int time;
-} adb_log[N_ADB_LOG];
-int n_adb_log;
-
-void
-init_adb_log(void)
-{
-    adb_log[0].b = ADB_B;
-    adb_log[0].ifr = ADB_IFR;
-    adb_log[0].acr = ADB_ACR;
-    adb_log[0].time = get_dec();
-    n_adb_log = 0;
-}
-
-void
-dump_adb_log(void)
-{
-    unsigned t, t0;
-    struct adb_log *ap;
-    int i;
-
-    ap = adb_log;
-    t0 = ap->time;
-    for (i = 0; i <= n_adb_log; ++i, ++ap) {
-        t = t0 - ap->time;
-        printf("b=%x ifr=%x acr=%x at %d.%.7d\n", ap->b, ap->ifr, ap->acr,
-               t / 1000000000, (t % 1000000000) / 100);
-    }
-}
-
-void
-adb_chklog(void)
-{
-    struct adb_log *ap = &adb_log[n_adb_log + 1];
-
-    ap->b = ADB_B;
-    ap->ifr = ADB_IFR;
-    ap->acr = ADB_ACR;
-    if (ap->b != ap[-1].b || (ap->ifr & 4) != (ap[-1].ifr & 4)
-        || ap->acr != ap[-1].acr) {
-        ap->time = get_dec();
-        ++n_adb_log;
-    }
-}
-
-int
-adb_bitwait(int bmask, int bval, int fmask, int fval)
-{
-    int i;
-    struct adb_log *ap;
-
-    for (i = 10000; i > 0; --i) {
-        adb_chklog();
-        ap = &adb_log[n_adb_log];
-        if ((ap->b & bmask) == bval && (ap->ifr & fmask) == fval)
-            return 0;
-    }
-    return -1;
-}
-
-int
-adb_wait(void)
-{
-    if (adb_bitwait(0, 0, 4, 4) < 0) {
-        printf("adb: ready wait timeout\n");
-        return -1;
-    }
-    return 0;
-}
-
-void
-adb_readin(void)
-{
-    int i, j;
-    unsigned char d[64];
-
-    if (ADB_B & 8) {
-        printf("ADB_B: %x\n", ADB_B);
-        return;
-    }
-    i = 0;
-    adb_wait();
-    j = ADB_SR;
-    eieio();
-    ADB_B &= ~0x20;
-    eieio();
-    for (;;) {
-        if (adb_wait() < 0)
-            break;
-        d[i++] = ADB_SR;
-        eieio();
-        if (ADB_B & 8)
-            break;
-        ADB_B ^= 0x10;
-        eieio();
-    }
-    ADB_B |= 0x30;
-    if (adb_wait() == 0)
-        j = ADB_SR;
-    for (j = 0; j < i; ++j)
-        printf("%.2x ", d[j]);
-    printf("\n");
-}
-
-int
-adb_write(unsigned char *d, int i)
-{
-    int j;
-    unsigned x;
-
-    if ((ADB_B & 8) == 0) {
-        printf("r: ");
-        adb_readin();
-    }
-    for (;;) {
-        ADB_ACR = 0x1c;
-        eieio();
-        ADB_SR = d[0];
-        eieio();
-        ADB_B &= ~0x20;
-        eieio();
-        if (ADB_B & 8)
-            break;
-        ADB_ACR = 0xc;
-        eieio();
-        ADB_B |= 0x20;
-        eieio();
-        adb_readin();
-    }
-    adb_wait();
-    for (j = 1; j < i; ++j) {
-        ADB_SR = d[j];
-        eieio();
-        ADB_B ^= 0x10;
-        eieio();
-        if (adb_wait() < 0)
-            break;
-    }
-    ADB_ACR = 0xc;
-    eieio();
-    x = ADB_SR;
-    eieio();
-    ADB_B |= 0x30;
-    return j;
-}
-
-void
-adbcmds(void)
-{
-    char cmd;
-    unsigned rtcu, rtcl, dec, pdec, x;
-    int i, j;
-    unsigned char d[64];
-
-    cmd = skipbl();
-    switch (cmd) {
-    case 't':
-        for (;;) {
-            rtcl = get_rtcl();
-            rtcu = get_rtcu();
-            dec = get_dec();
-            printf("rtc u=%u l=%u dec=%x (%d = %d.%.7d)\n",
-                   rtcu, rtcl, dec, pdec - dec, (pdec - dec) / 1000000000,
-                   ((pdec - dec) % 1000000000) / 100);
-            pdec = dec;
-            if (cmd == 'x')
-                break;
-            while (xmon_read(stdin, &cmd, 1) != 1)
-                ;
-        }
-        break;
-    case 'r':
-        init_adb_log();
-        while (adb_bitwait(8, 0, 0, 0) == 0)
-            adb_readin();
-        break;
-    case 'w':
-        i = 0;
-        while (scanhex(&x))
-            d[i++] = x;
-        init_adb_log();
-        j = adb_write(d, i);
-        printf("sent %d bytes\n", j);
-        while (adb_bitwait(8, 0, 0, 0) == 0)
-            adb_readin();
-        break;
-    case 'l':
-        dump_adb_log();
-        break;
-    }
-}
diff --git a/arch/ppc/xmon/start.c b/arch/ppc/xmon/start.c
index 4344cbe9b5c5..ff86b2d814cb 100644
--- a/arch/ppc/xmon/start.c
+++ b/arch/ppc/xmon/start.c
@@ -6,16 +6,11 @@
 #include <asm/machdep.h>
 #include <asm/io.h>
 #include <asm/page.h>
-#include <linux/adb.h>
-#include <linux/pmu.h>
-#include <linux/cuda.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/sysrq.h>
 #include <linux/bitops.h>
 #include <asm/xmon.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
 #include <asm/machdep.h>
 #include <asm/errno.h>
 #include <asm/processor.h>
@@ -26,9 +21,7 @@ static volatile unsigned char *sccc, *sccd;
 unsigned int TXRDY, RXRDY, DLAB;
 static int xmon_expect(const char *str, unsigned int timeout);
 
-static int use_screen;
 static int via_modem;
-static int xmon_use_sccb;
 
 #define TB_SPEED        25000000
 
@@ -46,47 +39,6 @@ void buf_access(void)
                 sccd[3] &= ~DLAB;       /* reset DLAB */
 }
 
-extern int adb_init(void);
-
-#ifdef CONFIG_PPC_CHRP
-/*
- * This looks in the "ranges" property for the primary PCI host bridge
- * to find the physical address of the start of PCI/ISA I/O space.
- * It is basically a cut-down version of pci_process_bridge_OF_ranges.
- */
-static unsigned long chrp_find_phys_io_base(void)
-{
-        struct device_node *node;
-        unsigned int *ranges;
-        unsigned long base = CHRP_ISA_IO_BASE;
-        int rlen = 0;
-        int np;
-
-        node = find_devices("isa");
-        if (node != NULL) {
-                node = node->parent;
-                if (node == NULL || node->type == NULL
-                    || strcmp(node->type, "pci") != 0)
-                        node = NULL;
-        }
-        if (node == NULL)
-                node = find_devices("pci");
-        if (node == NULL)
-                return base;
-
-        ranges = (unsigned int *) get_property(node, "ranges", &rlen);
-        np = prom_n_addr_cells(node) + 5;
-        while ((rlen -= np * sizeof(unsigned int)) >= 0) {
-                if ((ranges[0] >> 24) == 1 && ranges[2] == 0) {
-                        /* I/O space starting at 0, grab the phys base */
-                        base = ranges[np - 3];
-                        break;
-                }
-                ranges += np;
-        }
-        return base;
-}
-#endif /* CONFIG_PPC_CHRP */
 
 #ifdef CONFIG_MAGIC_SYSRQ
 static void sysrq_handle_xmon(int key, struct pt_regs *regs,
@@ -109,22 +61,6 @@ xmon_map_scc(void)
 #ifdef CONFIG_PPC_MULTIPLATFORM
         volatile unsigned char *base;
 
-#ifdef CONFIG_PPC_CHRP
-        base = (volatile unsigned char *) isa_io_base;
-        if (_machine == _MACH_chrp)
-                base = (volatile unsigned char *)
-                        ioremap(chrp_find_phys_io_base(), 0x1000);
-
-        sccc = base + 0x3fd;
-        sccd = base + 0x3f8;
-        if (xmon_use_sccb) {
-                sccc -= 0x100;
-                sccd -= 0x100;
-        }
-        TXRDY = 0x20;
-        RXRDY = 1;
-        DLAB = 0x80;
-#endif /* CONFIG_PPC_CHRP */
 #elif defined(CONFIG_GEMINI)
         /* should already be mapped by the kernel boot */
         sccc = (volatile unsigned char *) 0xffeffb0d;
@@ -143,22 +79,9 @@ xmon_map_scc(void)
         register_sysrq_key('x', &sysrq_xmon_op);
 }
 
-static int scc_initialized = 0;
+static int scc_initialized;
 
 void xmon_init_scc(void);
-extern void cuda_poll(void);
-
-static inline void do_poll_adb(void)
-{
-#ifdef CONFIG_ADB_PMU
-        if (sys_ctrler == SYS_CTRLER_PMU)
-                pmu_poll_adb();
-#endif /* CONFIG_ADB_PMU */
-#ifdef CONFIG_ADB_CUDA
-        if (sys_ctrler == SYS_CTRLER_CUDA)
-                cuda_poll();
-#endif /* CONFIG_ADB_CUDA */
-}
 
 int
 xmon_write(void *handle, void *ptr, int nb)
@@ -176,20 +99,12 @@ xmon_write(void *handle, void *ptr, int nb)
                         break;
 #endif
 
-#ifdef CONFIG_BOOTX_TEXT
-        if (use_screen) {
-                /* write it on the screen */
-                for (i = 0; i < nb; ++i)
-                        btext_drawchar(*p++);
-                goto out;
-        }
-#endif
         if (!scc_initialized)
                 xmon_init_scc();
         ct = 0;
         for (i = 0; i < nb; ++i) {
                 while ((*sccc & TXRDY) == 0)
-                        do_poll_adb();
+                        ;
                 c = p[i];
                 if (c == '\n' && !ct) {
                         c = '\r';
@@ -203,7 +118,6 @@ xmon_write(void *handle, void *ptr, int nb)
                 eieio();
         }
 
- out:
 #ifdef CONFIG_SMP
         if (!locked)
                 clear_bit(0, &xmon_write_lock);
@@ -212,65 +126,7 @@ xmon_write(void *handle, void *ptr, int nb)
 }
 
 int xmon_wants_key;
-int xmon_adb_keycode;
-
-#ifdef CONFIG_BOOTX_TEXT
-static int xmon_adb_shiftstate;
-
-static unsigned char xmon_keytab[128] =
-        "asdfhgzxcv\000bqwer"                           /* 0x00 - 0x0f */
-        "yt123465=97-80]o"                              /* 0x10 - 0x1f */
-        "u[ip\rlj'k;\\,/nm."                            /* 0x20 - 0x2f */
-        "\t `\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-
-static unsigned char xmon_shift_keytab[128] =
-        "ASDFHGZXCV\000BQWER"                           /* 0x00 - 0x0f */
-        "YT!@#$^%+(&_*)}O"                              /* 0x10 - 0x1f */
-        "U{IP\rLJ\"K:|<?NM>"                            /* 0x20 - 0x2f */
-        "\t ~\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-
-static int
-xmon_get_adb_key(void)
-{
-        int k, t, on;
 
-        xmon_wants_key = 1;
-        for (;;) {
-                xmon_adb_keycode = -1;
-                t = 0;
-                on = 0;
-                do {
-                        if (--t < 0) {
-                                on = 1 - on;
-                                btext_drawchar(on? 0xdb: 0x20);
-                                btext_drawchar('\b');
-                                t = 200000;
-                        }
-                        do_poll_adb();
-                } while (xmon_adb_keycode == -1);
-                k = xmon_adb_keycode;
-                if (on)
-                        btext_drawstring(" \b");
-
-                /* test for shift keys */
-                if ((k & 0x7f) == 0x38 || (k & 0x7f) == 0x7b) {
-                        xmon_adb_shiftstate = (k & 0x80) == 0;
-                        continue;
-                }
-                if (k >= 0x80)
-                        continue;       /* ignore up transitions */
-                k = (xmon_adb_shiftstate? xmon_shift_keytab: xmon_keytab)[k];
-                if (k != 0)
-                        break;
-        }
-        xmon_wants_key = 0;
-        return k;
-}
-#endif /* CONFIG_BOOTX_TEXT */
 
 int
 xmon_read(void *handle, void *ptr, int nb)
@@ -278,18 +134,11 @@ xmon_read(void *handle, void *ptr, int nb)
     char *p = ptr;
     int i;
 
-#ifdef CONFIG_BOOTX_TEXT
-    if (use_screen) {
-        for (i = 0; i < nb; ++i)
-            *p++ = xmon_get_adb_key();
-        return i;
-    }
-#endif
     if (!scc_initialized)
         xmon_init_scc();
     for (i = 0; i < nb; ++i) {
         while ((*sccc & RXRDY) == 0)
-            do_poll_adb();
+            ;
         buf_access();
         *p++ = *sccd;
     }
@@ -300,7 +149,7 @@ int
 xmon_read_poll(void)
 {
         if ((*sccc & RXRDY) == 0) {
-                do_poll_adb();
+                ;
                 return -1;
         }
         buf_access();
@@ -310,15 +159,6 @@ xmon_read_poll(void)
 void
 xmon_init_scc(void)
 {
-        if ( _machine == _MACH_chrp )
-        {
-                sccd[3] = 0x83; eieio();        /* LCR = 8N1 + DLAB */
-                sccd[0] = 12; eieio();          /* DLL = 9600 baud */
-                sccd[1] = 0; eieio();
-                sccd[2] = 0; eieio();           /* FCR = 0 */
-                sccd[3] = 3; eieio();           /* LCR = 8N1 */
-                sccd[1] = 0; eieio();           /* IER = 0 */
-        }
         scc_initialized = 1;
         if (via_modem) {
                 for (;;) {
@@ -334,22 +174,6 @@ xmon_init_scc(void)
         }
 }
 
-#if 0
-extern int (*prom_entry)(void *);
-
-int
-xmon_exit(void)
-{
-    struct prom_args {
-        char *service;
-    } args;
-
-    for (;;) {
-        args.service = "exit";
-        (*prom_entry)(&args);
-    }
-}
-#endif
 
 void *xmon_stdin;
 void *xmon_stdout;
diff --git a/arch/ppc/xmon/xmon.c b/arch/ppc/xmon/xmon.c
index bdaf6597b4c2..06fa44b5c647 100644
--- a/arch/ppc/xmon/xmon.c
+++ b/arch/ppc/xmon/xmon.c
@@ -12,8 +12,6 @@
 #include <linux/kallsyms.h>
 #include <asm/ptrace.h>
 #include <asm/string.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
 #include <asm/machdep.h>
 #include <asm/xmon.h>
 #include "nonstdio.h"
@@ -101,9 +99,6 @@ void cacheflush(void);
 static void cpu_cmd(void);
 #endif /* CONFIG_SMP */
 static void csum(void);
-#ifdef CONFIG_BOOTX_TEXT
-static void vidcmds(void);
-#endif
 static void bootcmds(void);
 static void proccall(void);
 static void printtime(void);
@@ -522,11 +517,6 @@ cmds(struct pt_regs *excp)
                         cpu_cmd();
                         break;
 #endif /* CONFIG_SMP */
-#ifdef CONFIG_BOOTX_TEXT
-                case 'v':
-                        vidcmds();
-                        break;
-#endif
                 case 'z':
                         bootcmds();
                         break;
@@ -618,43 +608,6 @@ static void cpu_cmd(void)
 }
 #endif /* CONFIG_SMP */
 
-#ifdef CONFIG_BOOTX_TEXT
-extern boot_infos_t disp_bi;
-
-static void vidcmds(void)
-{
-        int c = inchar();
-        unsigned int val, w;
-        extern int boot_text_mapped;
-
-        if (!boot_text_mapped)
-                return;
-        if (c != '\n' && scanhex(&val)) {
-                switch (c) {
-                case 'd':
-                        w = disp_bi.dispDeviceRowBytes
-                                / (disp_bi.dispDeviceDepth >> 3);
-                        disp_bi.dispDeviceDepth = val;
-                        disp_bi.dispDeviceRowBytes = w * (val >> 3);
-                        return;
-                case 'p':
-                        disp_bi.dispDeviceRowBytes = val;
-                        return;
-                case 'w':
-                        disp_bi.dispDeviceRect[2] = val;
-                        return;
-                case 'h':
-                        disp_bi.dispDeviceRect[3] = val;
-                        return;
-                }
-        }
-        printf("W = %d (0x%x) H = %d (0x%x) D = %d (0x%x) P = %d (0x%x)\n",
-               disp_bi.dispDeviceRect[2], disp_bi.dispDeviceRect[2],
-               disp_bi.dispDeviceRect[3], disp_bi.dispDeviceRect[3],
-               disp_bi.dispDeviceDepth, disp_bi.dispDeviceDepth,
-               disp_bi.dispDeviceRowBytes, disp_bi.dispDeviceRowBytes);
-}
-#endif /* CONFIG_BOOTX_TEXT */
 
 static unsigned short fcstab[256] = {
         0x0000, 0x1189, 0x2312, 0x329b, 0x4624, 0x57ad, 0x6536, 0x74bf,
@@ -1020,7 +973,6 @@ dump_hash_table(void)
 }
 #else
 
-#ifndef CONFIG_PPC64BRIDGE
 static void
 dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
 {
@@ -1079,66 +1031,6 @@ dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
                 printf(" ... %x\n", last_va);
 }
 
-#else /* CONFIG_PPC64BRIDGE */
-static void
-dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
-{
-        extern void *Hash;
-        extern unsigned long Hash_size;
-        unsigned *htab = Hash;
-        unsigned hsize = Hash_size;
-        unsigned v, hmask, va, last_va;
-        int found, last_found, i;
-        unsigned *hg, w1, last_w2, last_va0;
-
-        last_found = 0;
-        hmask = hsize / 128 - 1;
-        va = start;
-        start = (start >> 12) & 0xffff;
-        end = (end >> 12) & 0xffff;
-        for (v = start; v < end; ++v) {
-                found = 0;
-                hg = htab + (((v ^ seg) & hmask) * 32);
-                w1 = 1 | (seg << 12) | ((v & 0xf800) >> 4);
-                for (i = 0; i < 8; ++i, hg += 4) {
-                        if (hg[1] == w1) {
-                                found = 1;
-                                break;
-                        }
-                }
-                if (!found) {
-                        w1 ^= 2;
-                        hg = htab + ((~(v ^ seg) & hmask) * 32);
-                        for (i = 0; i < 8; ++i, hg += 4) {
-                                if (hg[1] == w1) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                }
-                if (!(last_found && found && (hg[3] & ~0x180) == last_w2 + 4096)) {
-                        if (last_found) {
-                                if (last_va != last_va0)
-                                        printf(" ... %x", last_va);
-                                printf("\n");
-                        }
-                        if (found) {
-                                printf("%x to %x", va, hg[3]);
-                                last_va0 = va;
-                        }
-                        last_found = found;
-                }
-                if (found) {
-                        last_w2 = hg[3] & ~0x180;
-                        last_va = va;
-                }
-                va += 4096;
-        }
-        if (last_found)
-                printf(" ... %x\n", last_va);
-}
-#endif /* CONFIG_PPC64BRIDGE */
-
 static unsigned hash_ctx;
 static unsigned hash_start;
 static unsigned hash_end;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index b66602ad7b33..b7ca5bf9acfc 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -80,6 +80,10 @@ config HOTPLUG_CPU
           can be controlled through /sys/devices/system/cpu/cpu#.
           Say N if you want to disable CPU hotplug.
 
+config DEFAULT_MIGRATION_COST
+        int
+        default "1000000"
+
 config MATHEMU
         bool "IEEE FPU emulation"
         depends on MARCH_G5
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 3525c91204d4..f8d0cd540a06 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc1
-# Thu Jan 19 10:58:53 2006
+# Linux kernel version: 2.6.16-rc2
+# Wed Feb  8 10:44:39 2006
 #
 CONFIG_MMU=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
@@ -12,7 +12,6 @@ CONFIG_S390=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -154,6 +153,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -607,6 +607,7 @@ CONFIG_MSDOS_PARTITION=y
 # Instrumentation Support
 #
 # CONFIG_PROFILING is not set
+# CONFIG_STATISTICS is not set
 
 #
 # Kernel hacking
@@ -624,7 +625,7 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_FS is not set
+CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index bf9a7a361b34..cc058dc3bc8b 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -100,12 +100,12 @@
 #define SET_STAT_UID(stat, uid)         (stat).st_uid = high2lowuid(uid)
 #define SET_STAT_GID(stat, gid)         (stat).st_gid = high2lowgid(gid)
 
-asmlinkage long sys32_chown16(const char * filename, u16 user, u16 group)
+asmlinkage long sys32_chown16(const char __user * filename, u16 user, u16 group)
 {
         return sys_chown(filename, low2highuid(user), low2highgid(group));
 }
 
-asmlinkage long sys32_lchown16(const char * filename, u16 user, u16 group)
+asmlinkage long sys32_lchown16(const char __user * filename, u16 user, u16 group)
 {
         return sys_lchown(filename, low2highuid(user), low2highgid(group));
 }
@@ -141,7 +141,7 @@ asmlinkage long sys32_setresuid16(u16 ruid, u16 euid, u16 suid)
                 low2highuid(suid));
 }
 
-asmlinkage long sys32_getresuid16(u16 *ruid, u16 *euid, u16 *suid)
+asmlinkage long sys32_getresuid16(u16 __user *ruid, u16 __user *euid, u16 __user *suid)
 {
         int retval;
 
@@ -158,7 +158,7 @@ asmlinkage long sys32_setresgid16(u16 rgid, u16 egid, u16 sgid)
                 low2highgid(sgid));
 }
 
-asmlinkage long sys32_getresgid16(u16 *rgid, u16 *egid, u16 *sgid)
+asmlinkage long sys32_getresgid16(u16 __user *rgid, u16 __user *egid, u16 __user *sgid)
 {
         int retval;
 
@@ -179,7 +179,7 @@ asmlinkage long sys32_setfsgid16(u16 gid)
         return sys_setfsgid((gid_t)gid);
 }
 
-static int groups16_to_user(u16 *grouplist, struct group_info *group_info)
+static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info)
 {
         int i;
         u16 group;
@@ -193,7 +193,7 @@ static int groups16_to_user(u16 *grouplist, struct group_info *group_info)
         return 0;
 }
 
-static int groups16_from_user(struct group_info *group_info, u16 *grouplist)
+static int groups16_from_user(struct group_info *group_info, u16 __user *grouplist)
 {
         int i;
         u16 group;
@@ -207,7 +207,7 @@ static int groups16_from_user(struct group_info *group_info, u16 *grouplist)
         return 0;
 }
 
-asmlinkage long sys32_getgroups16(int gidsetsize, u16 *grouplist)
+asmlinkage long sys32_getgroups16(int gidsetsize, u16 __user *grouplist)
 {
         int i;
 
@@ -231,7 +231,7 @@ out:
         return i;
 }
 
-asmlinkage long sys32_setgroups16(int gidsetsize, u16 *grouplist)
+asmlinkage long sys32_setgroups16(int gidsetsize, u16 __user *grouplist)
 {
         struct group_info *group_info;
         int retval;
@@ -278,14 +278,14 @@ asmlinkage long sys32_getegid16(void)
 
 /* 32-bit timeval and related flotsam.  */
 
-static inline long get_tv32(struct timeval *o, struct compat_timeval *i)
+static inline long get_tv32(struct timeval *o, struct compat_timeval __user *i)
 {
         return (!access_ok(VERIFY_READ, o, sizeof(*o)) ||
                 (__get_user(o->tv_sec, &i->tv_sec) ||
                  __get_user(o->tv_usec, &i->tv_usec)));
 }
 
-static inline long put_tv32(struct compat_timeval *o, struct timeval *i)
+static inline long put_tv32(struct compat_timeval __user *o, struct timeval *i)
 {
         return (!access_ok(VERIFY_WRITE, o, sizeof(*o)) ||
                 (__put_user(i->tv_sec, &o->tv_sec) ||
@@ -341,7 +341,7 @@ asmlinkage long sys32_ipc(u32 call, int first, int second, int third, u32 ptr)
         return -ENOSYS;
 }
 
-asmlinkage long sys32_truncate64(const char * path, unsigned long high, unsigned long low)
+asmlinkage long sys32_truncate64(const char __user * path, unsigned long high, unsigned long low)
 {
         if ((int)high < 0)
                 return -EINVAL;
@@ -357,7 +357,7 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long high, unsigned
                 return sys_ftruncate(fd, (high << 32) | low);
 }
 
-int cp_compat_stat(struct kstat *stat, struct compat_stat *statbuf)
+int cp_compat_stat(struct kstat *stat, struct compat_stat __user *statbuf)
 {
         int err;
 
@@ -591,7 +591,7 @@ sys32_delete_module(const char __user *name_user, unsigned int flags)
 
 extern struct timezone sys_tz;
 
-asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_gettimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
         if (tv) {
                 struct timeval ktv;
@@ -606,7 +606,7 @@ asmlinkage long sys32_gettimeofday(struct compat_timeval *tv, struct timezone *t
         return 0;
 }
 
-static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
+static inline long get_ts32(struct timespec *o, struct compat_timeval __user *i)
 {
         long usec;
 
@@ -620,7 +620,7 @@ static inline long get_ts32(struct timespec *o, struct compat_timeval *i)
         return 0;
 }
 
-asmlinkage long sys32_settimeofday(struct compat_timeval *tv, struct timezone *tz)
+asmlinkage long sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user *tz)
 {
         struct timespec kts;
         struct timezone ktz;
@@ -645,7 +645,7 @@ asmlinkage long sys32_pause(void)
         return -ERESTARTNOHAND;
 }
 
-asmlinkage long sys32_pread64(unsigned int fd, char *ubuf,
+asmlinkage long sys32_pread64(unsigned int fd, char __user *ubuf,
                                 size_t count, u32 poshi, u32 poslo)
 {
         if ((compat_ssize_t) count < 0)
@@ -653,7 +653,7 @@ asmlinkage long sys32_pread64(unsigned int fd, char *ubuf,
         return sys_pread64(fd, ubuf, count, ((loff_t)AA(poshi) << 32) | AA(poslo));
 }
 
-asmlinkage long sys32_pwrite64(unsigned int fd, const char *ubuf,
+asmlinkage long sys32_pwrite64(unsigned int fd, const char __user *ubuf,
                                 size_t count, u32 poshi, u32 poslo)
 {
         if ((compat_ssize_t) count < 0)
@@ -666,7 +666,7 @@ asmlinkage compat_ssize_t sys32_readahead(int fd, u32 offhi, u32 offlo, s32 coun
         return sys_readahead(fd, ((loff_t)AA(offhi) << 32) | AA(offlo), count);
 }
 
-asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t *offset, size_t count)
+asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset, size_t count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
@@ -686,7 +686,7 @@ asmlinkage long sys32_sendfile(int out_fd, int in_fd, compat_off_t *offset, size
 }
 
 asmlinkage long sys32_sendfile64(int out_fd, int in_fd,
-                                compat_loff_t *offset, s32 count)
+                                compat_loff_t __user *offset, s32 count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
@@ -722,7 +722,7 @@ struct timex32 {
 
 extern int do_adjtimex(struct timex *);
 
-asmlinkage long sys32_adjtimex(struct timex32 *utp)
+asmlinkage long sys32_adjtimex(struct timex32 __user *utp)
 {
         struct timex txc;
         int ret;
@@ -789,12 +789,13 @@ struct __sysctl_args32 {
         u32 __unused[4];
 };
 
-asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
+asmlinkage long sys32_sysctl(struct __sysctl_args32 __user *args)
 {
         struct __sysctl_args32 tmp;
         int error;
-        size_t oldlen, *oldlenp = NULL;
-        unsigned long addr = (((long)&args->__unused[0]) + 7) & ~7;
+        size_t oldlen;
+        size_t __user *oldlenp = NULL;
+        unsigned long addr = (((unsigned long)&args->__unused[0]) + 7) & ~7;
 
         if (copy_from_user(&tmp, args, sizeof(tmp)))
                 return -EFAULT;
@@ -806,20 +807,20 @@ asmlinkage long sys32_sysctl(struct __sysctl_args32 *args)
                    basically copy the whole sysctl.c here, and
                    glibc's __sysctl uses rw memory for the structure
                    anyway.  */
-                if (get_user(oldlen, (u32 *)A(tmp.oldlenp)) ||
-                    put_user(oldlen, (size_t *)addr))
+                if (get_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)) ||
+                    put_user(oldlen, (size_t __user *)addr))
                         return -EFAULT;
-                oldlenp = (size_t *)addr;
+                oldlenp = (size_t __user *)addr;
         }
 
         lock_kernel();
-        error = do_sysctl((int *)A(tmp.name), tmp.nlen, (void *)A(tmp.oldval),
-                          oldlenp, (void *)A(tmp.newval), tmp.newlen);
+        error = do_sysctl(compat_ptr(tmp.name), tmp.nlen, compat_ptr(tmp.oldval),
+                          oldlenp, compat_ptr(tmp.newval), tmp.newlen);
         unlock_kernel();
         if (oldlenp) {
                 if (!error) {
-                        if (get_user(oldlen, (size_t *)addr) ||
-                            put_user(oldlen, (u32 *)A(tmp.oldlenp)))
+                        if (get_user(oldlen, (size_t __user *)addr) ||
+                            put_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)))
                                 error = -EFAULT;
                 }
                 copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
@@ -853,7 +854,7 @@ struct stat64_emu31 {
         unsigned long   st_ino;
 };      
 
-static int cp_stat64(struct stat64_emu31 *ubuf, struct kstat *stat)
+static int cp_stat64(struct stat64_emu31 __user *ubuf, struct kstat *stat)
 {
         struct stat64_emu31 tmp;
 
@@ -877,7 +878,7 @@ static int cp_stat64(struct stat64_emu31 *ubuf, struct kstat *stat)
         return copy_to_user(ubuf,&tmp,sizeof(tmp)) ? -EFAULT : 0; 
 }
 
-asmlinkage long sys32_stat64(char * filename, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_stat64(char __user * filename, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_stat(filename, &stat);
@@ -886,7 +887,7 @@ asmlinkage long sys32_stat64(char * filename, struct stat64_emu31 * statbuf)
         return ret;
 }
 
-asmlinkage long sys32_lstat64(char * filename, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_lstat64(char __user * filename, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_lstat(filename, &stat);
@@ -895,7 +896,7 @@ asmlinkage long sys32_lstat64(char * filename, struct stat64_emu31 * statbuf)
         return ret;
 }
 
-asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 * statbuf)
+asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 __user * statbuf)
 {
         struct kstat stat;
         int ret = vfs_fstat(fd, &stat);
@@ -904,6 +905,26 @@ asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 * statbuf)
         return ret;
 }
 
+asmlinkage long sys32_fstatat64(unsigned int dfd, char __user *filename,
+                                struct stat64_emu31 __user* statbuf, int flag)
+{
+        struct kstat stat;
+        int error = -EINVAL;
+
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
+
+        if (flag & AT_SYMLINK_NOFOLLOW)
+                error = vfs_lstat_fd(dfd, filename, &stat);
+        else
+                error = vfs_stat_fd(dfd, filename, &stat);
+
+        if (!error)
+                error = cp_stat64(statbuf, &stat);
+out:
+        return error;
+}
+
 /*
  * Linux/i386 didn't use to be able to handle more than
  * 4 system call parameters, so these system calls used a memory
@@ -952,7 +973,7 @@ out:
 
 
 asmlinkage unsigned long
-old32_mmap(struct mmap_arg_struct_emu31 *arg)
+old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
 {
         struct mmap_arg_struct_emu31 a;
         int error = -EFAULT;
@@ -970,7 +991,7 @@ out:
 }
 
 asmlinkage long 
-sys32_mmap2(struct mmap_arg_struct_emu31 *arg)
+sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg)
 {
         struct mmap_arg_struct_emu31 a;
         int error = -EFAULT;
@@ -982,7 +1003,7 @@ out:
         return error;
 }
 
-asmlinkage long sys32_read(unsigned int fd, char * buf, size_t count)
+asmlinkage long sys32_read(unsigned int fd, char __user * buf, size_t count)
 {
         if ((compat_ssize_t) count < 0)
                 return -EINVAL; 
@@ -990,7 +1011,7 @@ asmlinkage long sys32_read(unsigned int fd, char * buf, size_t count)
         return sys_read(fd, buf, count);
 }
 
-asmlinkage long sys32_write(unsigned int fd, char * buf, size_t count)
+asmlinkage long sys32_write(unsigned int fd, char __user * buf, size_t count)
 {
         if ((compat_ssize_t) count < 0)
                 return -EINVAL; 
@@ -1002,12 +1023,12 @@ asmlinkage long sys32_clone(struct pt_regs regs)
 {
         unsigned long clone_flags;
         unsigned long newsp;
-        int *parent_tidptr, *child_tidptr;
+        int __user *parent_tidptr, *child_tidptr;
 
         clone_flags = regs.gprs[3] & 0xffffffffUL;
         newsp = regs.orig_gpr2 & 0x7fffffffUL;
-        parent_tidptr = (int *) (regs.gprs[4] & 0x7fffffffUL);
-        child_tidptr = (int *) (regs.gprs[5] & 0x7fffffffUL);
+        parent_tidptr = compat_ptr(regs.gprs[4]);
+        child_tidptr = compat_ptr(regs.gprs[5]);
         if (!newsp)
                 newsp = regs.gprs[15];
         return do_fork(clone_flags, newsp, &regs, 0,
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index ef706694a0c1..5291b5f8788d 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -195,9 +195,6 @@ sys32_sigaction(int sig, const struct old_sigaction32 __user *act,
         return ret;
 }
 
-int
-do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact);
-
 asmlinkage long
 sys32_rt_sigaction(int sig, const struct sigaction32 __user *act,
            struct sigaction32 __user *oact,  size_t sigsetsize)
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 83b33fe1923c..50e80138e7ad 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1523,13 +1523,13 @@ compat_sys_futimesat_wrapper:
         llgtr   %r4,%r4                 # struct timeval *
         jg      compat_sys_futimesat
 
-        .globl compat_sys_newfstatat_wrapper
-compat_sys_newfstatat_wrapper:
+        .globl sys32_fstatat64_wrapper
+sys32_fstatat64_wrapper:
         llgfr   %r2,%r2                 # unsigned int
         llgtr   %r3,%r3                 # char *
-        llgtr   %r4,%r4                 # struct stat *
+        llgtr   %r4,%r4                 # struct stat64 *
         lgfr    %r5,%r5                 # int
-        jg      compat_sys_newfstatat
+        jg      sys32_fstatat64
 
         .globl sys_unlinkat_wrapper
 sys_unlinkat_wrapper:
@@ -1552,6 +1552,7 @@ sys_linkat_wrapper:
         llgtr   %r3,%r3                 # const char *
         lgfr    %r4,%r4                 # int
         llgtr   %r5,%r5                 # const char *
+        lgfr    %r6,%r6                 # int
         jg      sys_linkat
 
         .globl sys_symlinkat_wrapper
@@ -1602,3 +1603,8 @@ compat_sys_ppoll_wrapper:
         llgtr   %r5,%r5                 # const sigset_t *
         llgfr   %r6,%r6                 # size_t
         jg      compat_sys_ppoll
+
+        .globl sys_unshare_wrapper
+sys_unshare_wrapper:
+        llgfr   %r2,%r2                 # unsigned long
+        jg      sys_unshare
diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
index f0ed5c642c74..bad81b5832db 100644
--- a/arch/s390/kernel/machine_kexec.c
+++ b/arch/s390/kernel/machine_kexec.c
@@ -12,15 +12,16 @@
  * on the S390 architecture.
  */
 
-#include <asm/cio.h>
-#include <asm/setup.h>
 #include <linux/device.h>
 #include <linux/mm.h>
 #include <linux/kexec.h>
 #include <linux/delay.h>
+#include <asm/cio.h>
+#include <asm/setup.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/system.h>
+#include <asm/smp.h>
 
 static void kexec_halt_all_cpus(void *);
 
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 008c74526fd3..da6fbae8df91 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -128,8 +128,10 @@ void default_idle(void)
         __ctl_set_bit(8, 15);
 
 #ifdef CONFIG_HOTPLUG_CPU
-        if (cpu_is_offline(cpu))
+        if (cpu_is_offline(cpu)) {
+                preempt_enable_no_resched();
                 cpu_die();
+        }
 #endif
 
         local_mcck_disable();
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index de8784267473..24f62f16c0e5 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -600,6 +600,7 @@ setup_arch(char **cmdline_p)
         init_mm.brk = (unsigned long) &_end;
 
         parse_cmdline_early(cmdline_p);
+        parse_early_param();
 
         setup_memory();
         setup_resources();
@@ -607,6 +608,7 @@ setup_arch(char **cmdline_p)
 
         cpu_init();
         __cpu_logical_map[0] = S390_lowcore.cpu_data.cpu_addr;
+        smp_setup_cpu_possible_map();
 
         /*
          * Create kernel page tables and switch to virtual addressing.
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index cbfcfd02a43a..7dbe00c76c6b 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -1,8 +1,7 @@
 /*
  *  arch/s390/kernel/smp.c
  *
- *  S390 version
- *    Copyright (C) 1999,2000 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Copyright (C) IBM Corp. 1999,2006
  *    Author(s): Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com),
  *               Martin Schwidefsky (schwidefsky@de.ibm.com)
  *               Heiko Carstens (heiko.carstens@de.ibm.com)
@@ -41,8 +40,6 @@
 #include <asm/cpcmd.h>
 #include <asm/tlbflush.h>
 
-/* prototypes */
-
 extern volatile int __cpu_logical_map[];
 
 /*
@@ -51,13 +48,11 @@ extern volatile int __cpu_logical_map[];
 
 struct _lowcore *lowcore_ptr[NR_CPUS];
 
-cpumask_t cpu_online_map;
-cpumask_t cpu_possible_map;
+cpumask_t cpu_online_map = CPU_MASK_NONE;
+cpumask_t cpu_possible_map = CPU_MASK_NONE;
 
 static struct task_struct *current_set[NR_CPUS];
 
-EXPORT_SYMBOL(cpu_online_map);
-
 /*
  * Reboot, halt and power_off routines for SMP.
  */
@@ -490,10 +485,10 @@ void smp_ctl_clear_bit(int cr, int bit) {
  * Lets check how many CPUs we have.
  */
 
-void
-__init smp_check_cpus(unsigned int max_cpus)
+static unsigned int
+__init smp_count_cpus(void)
 {
-        int cpu, num_cpus;
+        unsigned int cpu, num_cpus;
         __u16 boot_cpu_addr;
 
         /*
@@ -503,22 +498,20 @@ __init smp_check_cpus(unsigned int max_cpus)
         boot_cpu_addr = S390_lowcore.cpu_data.cpu_addr;
         current_thread_info()->cpu = 0;
         num_cpus = 1;
-        for (cpu = 0; cpu <= 65535 && num_cpus < max_cpus; cpu++) {
+        for (cpu = 0; cpu <= 65535; cpu++) {
                 if ((__u16) cpu == boot_cpu_addr)
                         continue;
-                __cpu_logical_map[num_cpus] = (__u16) cpu;
-                if (signal_processor(num_cpus, sigp_sense) ==
+                __cpu_logical_map[1] = (__u16) cpu;
+                if (signal_processor(1, sigp_sense) ==
                     sigp_not_operational)
                         continue;
-                cpu_set(num_cpus, cpu_present_map);
                 num_cpus++;
         }
 
-        for (cpu = 1; cpu < max_cpus; cpu++)
-                cpu_set(cpu, cpu_possible_map);
-
         printk("Detected %d CPU's\n",(int) num_cpus);
         printk("Boot cpu address %2X\n", boot_cpu_addr);
+
+        return num_cpus;
 }
 
 /*
@@ -679,6 +672,44 @@ __cpu_up(unsigned int cpu)
         return 0;
 }
 
+static unsigned int __initdata additional_cpus;
+static unsigned int __initdata possible_cpus;
+
+void __init smp_setup_cpu_possible_map(void)
+{
+        unsigned int phy_cpus, pos_cpus, cpu;
+
+        phy_cpus = smp_count_cpus();
+        pos_cpus = min(phy_cpus + additional_cpus, (unsigned int) NR_CPUS);
+
+        if (possible_cpus)
+                pos_cpus = min(possible_cpus, (unsigned int) NR_CPUS);
+
+        for (cpu = 0; cpu < pos_cpus; cpu++)
+                cpu_set(cpu, cpu_possible_map);
+
+        phy_cpus = min(phy_cpus, pos_cpus);
+
+        for (cpu = 0; cpu < phy_cpus; cpu++)
+                cpu_set(cpu, cpu_present_map);
+}
+
+#ifdef CONFIG_HOTPLUG_CPU
+
+static int __init setup_additional_cpus(char *s)
+{
+        additional_cpus = simple_strtoul(s, NULL, 0);
+        return 0;
+}
+early_param("additional_cpus", setup_additional_cpus);
+
+static int __init setup_possible_cpus(char *s)
+{
+        possible_cpus = simple_strtoul(s, NULL, 0);
+        return 0;
+}
+early_param("possible_cpus", setup_possible_cpus);
+
 int
 __cpu_disable(void)
 {
@@ -747,6 +778,8 @@ cpu_die(void)
         for(;;);
 }
 
+#endif /* CONFIG_HOTPLUG_CPU */
+
 /*
  *      Cycle through the processors and setup structures.
  */
@@ -760,7 +793,6 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         /* request the 0x1201 emergency signal external interrupt */
         if (register_external_interrupt(0x1201, do_ext_call_interrupt) != 0)
                 panic("Couldn't request external interrupt 0x1201");
-        smp_check_cpus(max_cpus);
         memset(lowcore_ptr,0,sizeof(lowcore_ptr));  
         /*
          *  Initialize prefix pages and stacks for all possible cpus
@@ -809,8 +841,6 @@ void __devinit smp_prepare_boot_cpu(void)
         BUG_ON(smp_processor_id() != 0);
 
         cpu_set(0, cpu_online_map);
-        cpu_set(0, cpu_present_map);
-        cpu_set(0, cpu_possible_map);
         S390_lowcore.percpu_offset = __per_cpu_offset[0];
         current_set[0] = current;
 }
@@ -849,6 +879,7 @@ static int __init topology_init(void)
 
 subsys_initcall(topology_init);
 
+EXPORT_SYMBOL(cpu_online_map);
 EXPORT_SYMBOL(cpu_possible_map);
 EXPORT_SYMBOL(lowcore_ptr);
 EXPORT_SYMBOL(smp_ctl_set_bit);
diff --git a/arch/s390/kernel/sys_s390.c b/arch/s390/kernel/sys_s390.c
index 6a63553493c5..e351780bb660 100644
--- a/arch/s390/kernel/sys_s390.c
+++ b/arch/s390/kernel/sys_s390.c
@@ -122,8 +122,8 @@ out:
 #ifndef CONFIG_64BIT
 struct sel_arg_struct {
         unsigned long n;
-        fd_set *inp, *outp, *exp;
-        struct timeval *tvp;
+        fd_set __user *inp, *outp, *exp;
+        struct timeval __user *tvp;
 };
 
 asmlinkage long old_select(struct sel_arg_struct __user *arg)
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 3280345efacd..7c88d85c3597 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -301,7 +301,7 @@ SYSCALL(sys_mkdirat,sys_mkdirat,sys_mkdirat_wrapper)
 SYSCALL(sys_mknodat,sys_mknodat,sys_mknodat_wrapper)    /* 290 */
 SYSCALL(sys_fchownat,sys_fchownat,sys_fchownat_wrapper)
 SYSCALL(sys_futimesat,sys_futimesat,compat_sys_futimesat_wrapper)
-SYSCALL(sys_newfstatat,sys_newfstatat,compat_sys_newfstatat_wrapper)
+SYSCALL(sys_fstatat64,sys_newfstatat,sys32_fstatat64_wrapper)
 SYSCALL(sys_unlinkat,sys_unlinkat,sys_unlinkat_wrapper)
 SYSCALL(sys_renameat,sys_renameat,sys_renameat_wrapper) /* 295 */
 SYSCALL(sys_linkat,sys_linkat,sys_linkat_wrapper)
@@ -311,3 +311,4 @@ SYSCALL(sys_fchmodat,sys_fchmodat,sys_fchmodat_wrapper)
 SYSCALL(sys_faccessat,sys_faccessat,sys_faccessat_wrapper)      /* 300 */
 SYSCALL(sys_pselect6,sys_pselect6,compat_sys_pselect6_wrapper)
 SYSCALL(sys_ppoll,sys_ppoll,compat_sys_ppoll_wrapper)
+SYSCALL(sys_unshare,sys_unshare,sys_unshare_wrapper)
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 5d21e9e6e7b4..a46793beeddd 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -486,7 +486,7 @@ asmlinkage void illegal_op(struct pt_regs * regs, long interruption_code)
                 info.si_signo = signal;
                 info.si_errno = 0;
                 info.si_code = ILL_ILLOPC;
-                info.si_addr = (void *) location;
+                info.si_addr = (void __user *) location;
                 do_trap(interruption_code, signal,
                         "illegal operation", regs, &info);
         }
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index e96c35bddac7..71f0a2fb3078 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -30,7 +30,7 @@ void __delay(unsigned long loops)
          */
         __asm__ __volatile__(
                 "0: brct %0,0b"
-                : /* no outputs */ : "r" (loops/2) );
+                : /* no outputs */ : "r" ((loops/2) + 1));
 }
 
 /*
diff --git a/arch/s390/lib/spinlock.c b/arch/s390/lib/spinlock.c
index 60f80a4eed4e..b9b7958a226a 100644
--- a/arch/s390/lib/spinlock.c
+++ b/arch/s390/lib/spinlock.c
@@ -2,8 +2,7 @@
  *  arch/s390/lib/spinlock.c
  *    Out of line spinlock code.
  *
- *  S390 version
- *    Copyright (C) 2004 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Copyright (C) IBM Corp. 2004, 2006
  *    Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com)
  */
 
@@ -44,6 +43,8 @@ _raw_spin_lock_wait(raw_spinlock_t *lp, unsigned int pc)
                         _diag44();
                         count = spin_retry;
                 }
+                if (__raw_spin_is_locked(lp))
+                        continue;
                 if (_raw_compare_and_swap(&lp->lock, 0, pc) == 0)
                         return;
         }
@@ -56,6 +57,8 @@ _raw_spin_trylock_retry(raw_spinlock_t *lp, unsigned int pc)
         int count = spin_retry;
 
         while (count-- > 0) {
+                if (__raw_spin_is_locked(lp))
+                        continue;
                 if (_raw_compare_and_swap(&lp->lock, 0, pc) == 0)
                         return 1;
         }
@@ -74,6 +77,8 @@ _raw_read_lock_wait(raw_rwlock_t *rw)
                         _diag44();
                         count = spin_retry;
                 }
+                if (!__raw_read_can_lock(rw))
+                        continue;
                 old = rw->lock & 0x7fffffffU;
                 if (_raw_compare_and_swap(&rw->lock, old, old + 1) == old)
                         return;
@@ -88,6 +93,8 @@ _raw_read_trylock_retry(raw_rwlock_t *rw)
         int count = spin_retry;
 
         while (count-- > 0) {
+                if (!__raw_read_can_lock(rw))
+                        continue;
                 old = rw->lock & 0x7fffffffU;
                 if (_raw_compare_and_swap(&rw->lock, old, old + 1) == old)
                         return 1;
@@ -106,6 +113,8 @@ _raw_write_lock_wait(raw_rwlock_t *rw)
                         _diag44();
                         count = spin_retry;
                 }
+                if (!__raw_write_can_lock(rw))
+                        continue;
                 if (_raw_compare_and_swap(&rw->lock, 0, 0x80000000) == 0)
                         return;
         }
@@ -118,6 +127,8 @@ _raw_write_trylock_retry(raw_rwlock_t *rw)
         int count = spin_retry;
 
         while (count-- > 0) {
+                if (!__raw_write_can_lock(rw))
+                        continue;
                 if (_raw_compare_and_swap(&rw->lock, 0, 0x80000000) == 0)
                         return 1;
         }
diff --git a/arch/s390/lib/uaccess.S b/arch/s390/lib/uaccess.S
index 88fc94fe6488..5d59e2625048 100644
--- a/arch/s390/lib/uaccess.S
+++ b/arch/s390/lib/uaccess.S
@@ -198,12 +198,12 @@ __strnlen_user_asm:
 0:      srst    %r2,%r1
         jo      0b
         sacf    0
-        jh      1f              # \0 found in string ?
         ahi     %r2,1           # strnlen_user result includes the \0
-1:      slr     %r2,%r3
+                                # or return count+1 if \0 not found
+        slr     %r2,%r3
         br      %r14
 2:      sacf    0
-        lhi     %r2,-EFAULT
+        slr     %r2,%r2         # return 0 on exception
         br      %r14
         .section __ex_table,"a"
         .long   0b,2b
diff --git a/arch/s390/lib/uaccess64.S b/arch/s390/lib/uaccess64.S
index 50219786fc7a..19b41a33c230 100644
--- a/arch/s390/lib/uaccess64.S
+++ b/arch/s390/lib/uaccess64.S
@@ -194,12 +194,12 @@ __strnlen_user_asm:
 0:      srst    %r2,%r1
         jo      0b
         sacf    0
-        jh      1f              # \0 found in string ?
         aghi    %r2,1           # strnlen_user result includes the \0
-1:      slgr    %r2,%r3
+                                # or return count+1 if \0 not found
+        slgr    %r2,%r3
         br      %r14
 2:      sacf    0
-        lghi    %r2,-EFAULT
+        slgr    %r2,%r2         # return 0 on exception
         br      %r14
         .section __ex_table,"a"
         .quad   0b,2b
diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
index 2d5cb1385753..b075ab499d05 100644
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -42,8 +42,8 @@ static volatile long cmm_timed_pages_target = 0;
 static long cmm_timeout_pages = 0;
 static long cmm_timeout_seconds = 0;
 
-static struct cmm_page_array *cmm_page_list = 0;
-static struct cmm_page_array *cmm_timed_page_list = 0;
+static struct cmm_page_array *cmm_page_list = NULL;
+static struct cmm_page_array *cmm_timed_page_list = NULL;
 
 static unsigned long cmm_thread_active = 0;
 static struct work_struct cmm_thread_starter;
@@ -259,7 +259,7 @@ static struct ctl_table cmm_table[];
 
 static int
 cmm_pages_handler(ctl_table *ctl, int write, struct file *filp,
-                  void *buffer, size_t *lenp, loff_t *ppos)
+                  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char buf[16], *p;
         long pages;
@@ -300,7 +300,7 @@ cmm_pages_handler(ctl_table *ctl, int write, struct file *filp,
 
 static int
 cmm_timeout_handler(ctl_table *ctl, int write, struct file *filp,
-                    void *buffer, size_t *lenp, loff_t *ppos)
+                    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char buf[64], *p;
         long pages, seconds;
@@ -419,7 +419,7 @@ cmm_init (void)
 #ifdef CONFIG_CMM_IUCV
         smsg_register_callback(SMSG_PREFIX, cmm_smsg_target);
 #endif
-        INIT_WORK(&cmm_thread_starter, (void *) cmm_start_thread, 0);
+        INIT_WORK(&cmm_thread_starter, (void *) cmm_start_thread, NULL);
         init_waitqueue_head(&cmm_thread_wait);
         init_timer(&cmm_timer);
         return 0;
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 504d56f8ca7f..e9b275d90737 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -392,9 +392,9 @@ config SH_TMU
 
 endmenu
 
-source "arch/sh/boards/renesas/hs7751rvoip/Kconfig"
+#source "arch/sh/boards/renesas/hs7751rvoip/Kconfig"
 
-source "arch/sh/boards/renesas/rts7751r2d/Kconfig"
+#source "arch/sh/boards/renesas/rts7751r2d/Kconfig"
 
 config SH_PCLK_FREQ
         int "Peripheral clock frequency (in Hz)"
@@ -446,7 +446,7 @@ endmenu
 
 config ISA_DMA_API
         bool
-        depends on MPC1211
+        depends on SH_MPC1211
         default y
 
 menu "Kernel features"
diff --git a/arch/sh/boards/renesas/rts7751r2d/io.c b/arch/sh/boards/renesas/rts7751r2d/io.c
index c46f9154cfd5..123abbbc91e0 100644
--- a/arch/sh/boards/renesas/rts7751r2d/io.c
+++ b/arch/sh/boards/renesas/rts7751r2d/io.c
@@ -216,24 +216,26 @@ void rts7751r2d_insb(unsigned long port, void *addr, unsigned long count)
 {
         volatile __u8 *bp;
         volatile __u16 *p;
+        unsigned char *s = addr;
 
         if (CHECK_AX88796L_PORT(port)) {
                 p = (volatile unsigned short *)port88796l(port, 0);
-                while (count--) *((unsigned char *) addr)++ = *p & 0xff;
+                while (count--) *s++ = *p & 0xff;
         } else if (PXSEG(port))
-                while (count--) *((unsigned char *) addr)++ = *(volatile unsigned char *)port;
+                while (count--) *s++ = *(volatile unsigned char *)port;
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 bp = (__u8 *)PCI_IOMAP(port);
-                while (count--) *((volatile unsigned char *) addr)++ = *bp;
+                while (count--) *s++ = *bp;
         } else {
                 p = (volatile unsigned short *)port2adr(port);
-                while (count--) *((unsigned char *) addr)++ = *p & 0xff;
+                while (count--) *s++ = *p & 0xff;
         }
 }
 
 void rts7751r2d_insw(unsigned long port, void *addr, unsigned long count)
 {
         volatile __u16 *p;
+        __u16 *s = addr;
 
         if (CHECK_AX88796L_PORT(port))
                 p = (volatile unsigned short *)port88796l(port, 1);
@@ -243,7 +245,7 @@ void rts7751r2d_insw(unsigned long port, void *addr, unsigned long count)
                 p = (volatile unsigned short *)PCI_IOMAP(port);
         else
                 p = (volatile unsigned short *)port2adr(port);
-        while (count--) *((__u16 *) addr)++ = *p;
+        while (count--) *s++ = *p;
 }
 
 void rts7751r2d_insl(unsigned long port, void *addr, unsigned long count)
@@ -252,8 +254,9 @@ void rts7751r2d_insl(unsigned long port, void *addr, unsigned long count)
                 maybebadio(insl, port);
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 volatile __u32 *p = (__u32 *)PCI_IOMAP(port);
+                __u32 *s = addr;
 
-                while (count--) *((__u32 *) addr)++ = *p;
+                while (count--) *s++ = *p;
         } else
                 maybebadio(insl, port);
 }
@@ -262,24 +265,26 @@ void rts7751r2d_outsb(unsigned long port, const void *addr, unsigned long count)
 {
         volatile __u8 *bp;
         volatile __u16 *p;
+        const __u8 *s = addr;
 
         if (CHECK_AX88796L_PORT(port)) {
                 p = (volatile unsigned short *)port88796l(port, 0);
-                while (count--) *p = *((unsigned char *) addr)++;
+                while (count--) *p = *s++;
         } else if (PXSEG(port))
-                while (count--) *(volatile unsigned char *)port = *((unsigned char *) addr)++;
+                while (count--) *(volatile unsigned char *)port = *s++;
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 bp = (__u8 *)PCI_IOMAP(port);
-                while (count--) *bp = *((volatile unsigned char *) addr)++;
+                while (count--) *bp = *s++;
         } else {
                 p = (volatile unsigned short *)port2adr(port);
-                while (count--) *p = *((unsigned char *) addr)++;
+                while (count--) *p = *s++;
         }
 }
 
 void rts7751r2d_outsw(unsigned long port, const void *addr, unsigned long count)
 {
         volatile __u16 *p;
+        const __u16 *s = addr;
 
         if (CHECK_AX88796L_PORT(port))
                 p = (volatile unsigned short *)port88796l(port, 1);
@@ -289,7 +294,7 @@ void rts7751r2d_outsw(unsigned long port, const void *addr, unsigned long count)
                 p = (volatile unsigned short *)PCI_IOMAP(port);
         else
                 p = (volatile unsigned short *)port2adr(port);
-        while (count--) *p = *((__u16 *) addr)++;
+        while (count--) *p = *s++;
 }
 
 void rts7751r2d_outsl(unsigned long port, const void *addr, unsigned long count)
@@ -298,8 +303,9 @@ void rts7751r2d_outsl(unsigned long port, const void *addr, unsigned long count)
                 maybebadio(outsl, port);
         else if (CHECK_SH7751_PCIIO(port) || shifted_port(port)) {
                 volatile __u32 *p = (__u32 *)PCI_IOMAP(port);
+                const __u32 *s = addr;
 
-                while (count--) *p = *((__u32 *) addr)++;
+                while (count--) *p = *s++;
         } else
                 maybebadio(outsl, port);
 }
diff --git a/arch/sh64/kernel/sh_ksyms.c b/arch/sh64/kernel/sh_ksyms.c
index 472b450e61be..de29c45f23a7 100644
--- a/arch/sh64/kernel/sh_ksyms.c
+++ b/arch/sh64/kernel/sh_ksyms.c
@@ -31,14 +31,6 @@
 
 extern int dump_fpu(struct pt_regs *, elf_fpregset_t *);
 
-#if 0
-/* Not yet - there's no declaration of drive_info anywhere. */
-#if defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_HD) || defined(CONFIG_BLK_DEV_IDE_MODULE) || defined(CONFIG_BLK_DEV_HD_MODULE)
-extern struct drive_info_struct drive_info;
-EXPORT_SYMBOL(drive_info);
-#endif
-#endif
-
 /* platform dependent support */
 EXPORT_SYMBOL(dump_fpu);
 EXPORT_SYMBOL(iounmap);
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index 267ec8f6fb58..887f6a160c58 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -38,7 +38,7 @@
 
 #define curptr      g6
 
-#define NR_SYSCALLS 299      /* Each OS is different... */
+#define NR_SYSCALLS 300      /* Each OS is different... */
 
 /* These are just handy. */
 #define _SV     save    %sp, -STACKFRAME_SZ, %sp
diff --git a/arch/sparc/kernel/process.c b/arch/sparc/kernel/process.c
index fbb05a452e51..118cac84a0f5 100644
--- a/arch/sparc/kernel/process.c
+++ b/arch/sparc/kernel/process.c
@@ -54,7 +54,7 @@ void (*pm_idle)(void);
  * This is done via auxio, but could be used as a fallback
  * handler when auxio is not present-- unused for now...
  */
-void (*pm_power_off)(void);
+void (*pm_power_off)(void) = machine_power_off;
 
 /*
  * sysctl - toggle power-off restriction for serial console 
diff --git a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S
index 6877ae4cd1d9..768de64b371f 100644
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -76,9 +76,9 @@ sys_call_table:
 /*270*/ .long sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
 /*275*/ .long sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_waitid
 /*280*/ .long sys_ni_syscall, sys_add_key, sys_request_key, sys_keyctl, sys_openat
-/*285*/ .long sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_newfstatat
+/*285*/ .long sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
 /*290*/ .long sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
-/*295*/ .long sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll
+/*295*/ .long sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
 
 #ifdef CONFIG_SUNOS_EMUL
         /* Now the SunOS syscall table. */
@@ -190,5 +190,6 @@ sunos_sys_table:
 /*290*/ .long sunos_nosys, sunos_nosys, sunos_nosys
         .long sunos_nosys, sunos_nosys, sunos_nosys
         .long sunos_nosys, sunos_nosys, sunos_nosys
+        .long sunos_nosys
 
 #endif
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index ab733be9af08..4c0a50a76554 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -383,6 +383,7 @@ source "arch/sparc64/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/sparc64/boot/.gitignore b/arch/sparc64/boot/.gitignore
new file mode 100644
index 000000000000..36356f9d498e
--- /dev/null
+++ b/arch/sparc64/boot/.gitignore
@@ -0,0 +1,4 @@
+image
+tftpboot.img
+vmlinux.aout
+piggyback
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index 9ceddad0fb49..069d49777b2a 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc1
-# Wed Jan 18 13:41:02 2006
+# Linux kernel version: 2.6.16-rc2
+# Tue Feb  7 17:47:18 2006
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -23,7 +23,6 @@ CONFIG_HZ=250
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -31,7 +30,7 @@ CONFIG_INIT_ENV_ARG_LIMIT=32
 # General setup
 #
 CONFIG_LOCALVERSION=""
-CONFIG_LOCALVERSION_AUTO=y
+# CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -155,6 +154,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -224,6 +224,11 @@ CONFIG_IP_DCCP_TFRC_LIB=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 CONFIG_VLAN_8021Q=m
@@ -233,11 +238,6 @@ CONFIG_VLAN_8021Q=m
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-
-#
-# TIPC Configuration (EXPERIMENTAL)
-#
-# CONFIG_TIPC is not set
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
@@ -657,6 +657,7 @@ CONFIG_SERIAL_SUNSU_CONSOLE=y
 CONFIG_SERIAL_SUNSAB=m
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
 
@@ -765,6 +766,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_FSCPOS is not set
 # CONFIG_SENSORS_GL518SM is not set
@@ -1118,6 +1120,10 @@ CONFIG_USB_HIDDEV=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # Misc Linux/SPARC drivers
 #
 CONFIG_SUN_OPENPROMIO=m
diff --git a/arch/sparc64/kernel/entry.S b/arch/sparc64/kernel/entry.S
index 12911e7463f2..a73553ae7e53 100644
--- a/arch/sparc64/kernel/entry.S
+++ b/arch/sparc64/kernel/entry.S
@@ -25,7 +25,7 @@
 
 #define curptr      g6
 
-#define NR_SYSCALLS 299      /* Each OS is different... */
+#define NR_SYSCALLS 300      /* Each OS is different... */
 
         .text
         .align          32
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index 054461e6946d..158bd31e15b7 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -542,6 +542,8 @@ void __init setup_arch(char **cmdline_p)
         }
 #endif
 
+        smp_setup_cpu_possible_map();
+
         paging_init();
 }
 
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 1fb6323e65a4..1f7ad8a69052 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -1079,18 +1079,12 @@ int setup_profiling_timer(unsigned int multiplier)
         return 0;
 }
 
+/* Constrain the number of cpus to max_cpus.  */
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
-        int instance, mid;
-
-        instance = 0;
-        while (!cpu_find_by_instance(instance, NULL, &mid)) {
-                if (mid < max_cpus)
-                        cpu_set(mid, phys_cpu_present_map);
-                instance++;
-        }
-
         if (num_possible_cpus() > max_cpus) {
+                int instance, mid;
+
                 instance = 0;
                 while (!cpu_find_by_instance(instance, NULL, &mid)) {
                         if (mid != boot_cpu_id) {
@@ -1105,6 +1099,22 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         smp_store_cpu_info(boot_cpu_id);
 }
 
+/* Set this up early so that things like the scheduler can init
+ * properly.  We use the same cpu mask for both the present and
+ * possible cpu map.
+ */
+void __init smp_setup_cpu_possible_map(void)
+{
+        int instance, mid;
+
+        instance = 0;
+        while (!cpu_find_by_instance(instance, NULL, &mid)) {
+                if (mid < NR_CPUS)
+                        cpu_set(mid, phys_cpu_present_map);
+                instance++;
+        }
+}
+
 void __devinit smp_prepare_boot_cpu(void)
 {
         if (hard_smp_processor_id() >= NR_CPUS) {
diff --git a/arch/sparc64/kernel/sys32.S b/arch/sparc64/kernel/sys32.S
index 60b59375aa78..c4a1cef4b1e5 100644
--- a/arch/sparc64/kernel/sys32.S
+++ b/arch/sparc64/kernel/sys32.S
@@ -318,7 +318,7 @@ do_sys_recvmsg: /* compat_sys_recvmsg(int, struct compat_msghdr *, unsigned int)
         nop
         nop
 
-        .section        __ex_table
+        .section        __ex_table,"a"
         .align          4
         .word           1b, __retl_efault, 2b, __retl_efault
         .word           3b, __retl_efault, 4b, __retl_efault
diff --git a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
index 9264ccbaaafa..417727bd87ba 100644
--- a/arch/sparc64/kernel/sys_sparc32.c
+++ b/arch/sparc64/kernel/sys_sparc32.c
@@ -428,6 +428,27 @@ asmlinkage long compat_sys_fstat64(unsigned int fd,
         return error;
 }
 
+asmlinkage long compat_sys_fstatat64(unsigned int dfd, char __user *filename,
+                struct compat_stat64 __user * statbuf, int flag)
+{
+        struct kstat stat;
+        int error = -EINVAL;
+
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
+
+        if (flag & AT_SYMLINK_NOFOLLOW)
+                error = vfs_lstat_fd(dfd, filename, &stat);
+        else
+                error = vfs_stat_fd(dfd, filename, &stat);
+
+        if (!error)
+                error = cp_compat_stat64(&stat, statbuf);
+
+out:
+        return error;
+}
+
 asmlinkage long compat_sys_sysfs(int option, u32 arg1, u32 arg2)
 {
         return sys_sysfs(option, arg1, arg2);
diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
index 2881faf36635..c3adb7ac167d 100644
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -77,9 +77,9 @@ sys_call_table32:
 /*270*/ .word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
         .word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
 /*280*/ .word sys_ni_syscall, sys_add_key, sys_request_key, sys_keyctl, compat_sys_openat
-        .word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_newfstatat
+        .word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
 /*285*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
-        .word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll
+        .word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
 
 #endif /* CONFIG_COMPAT */
 
@@ -146,9 +146,9 @@ sys_call_table:
 /*270*/ .word sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
         .word sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_waitid
 /*280*/ .word sys_nis_syscall, sys_add_key, sys_request_key, sys_keyctl, sys_openat
-        .word sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, compat_sys_newfstatat
+        .word sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
 /*285*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
-        .word sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll
+        .word sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
 
 #if defined(CONFIG_SUNOS_EMUL) || defined(CONFIG_SOLARIS_EMUL) || \
     defined(CONFIG_SOLARIS_EMUL_MODULE)
@@ -261,4 +261,5 @@ sunos_sys_table:
 /*290*/ .word sunos_nosys, sunos_nosys, sunos_nosys
         .word sunos_nosys, sunos_nosys, sunos_nosys
         .word sunos_nosys, sunos_nosys, sunos_nosys
+        .word sunos_nosys
 #endif
diff --git a/arch/sparc64/kernel/una_asm.S b/arch/sparc64/kernel/una_asm.S
index 1f5b5b708ce7..be183fe41443 100644
--- a/arch/sparc64/kernel/una_asm.S
+++ b/arch/sparc64/kernel/una_asm.S
@@ -47,7 +47,7 @@ __do_int_store:
          mov    0, %o0
         .size   __do_int_store, .-__do_int_store
 
-        .section        __ex_table
+        .section        __ex_table,"a"
         .word           4b, __retl_efault
         .word           5b, __retl_efault
         .word           6b, __retl_efault
@@ -129,7 +129,7 @@ do_int_load:
          mov    0, %o0
         .size   __do_int_load, .-__do_int_load
 
-        .section        __ex_table
+        .section        __ex_table,"a"
         .word           4b, __retl_efault
         .word           5b, __retl_efault
         .word           6b, __retl_efault
diff --git a/arch/sparc64/lib/U1copy_from_user.S b/arch/sparc64/lib/U1copy_from_user.S
index 93146a81e2d3..3192b0bf4fab 100644
--- a/arch/sparc64/lib/U1copy_from_user.S
+++ b/arch/sparc64/lib/U1copy_from_user.S
@@ -9,7 +9,7 @@
         .align 4;               \
 99:     retl;                   \
          mov    1, %o0;         \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/U1copy_to_user.S b/arch/sparc64/lib/U1copy_to_user.S
index 1fccc521e2bd..d1210ffb0b82 100644
--- a/arch/sparc64/lib/U1copy_to_user.S
+++ b/arch/sparc64/lib/U1copy_to_user.S
@@ -9,7 +9,7 @@
         .align 4;               \
 99:     retl;                   \
          mov    1, %o0;         \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/U3copy_from_user.S b/arch/sparc64/lib/U3copy_from_user.S
index df600b667e48..f5bfc8d9d216 100644
--- a/arch/sparc64/lib/U3copy_from_user.S
+++ b/arch/sparc64/lib/U3copy_from_user.S
@@ -9,7 +9,7 @@
         .align 4;               \
 99:     retl;                   \
          mov    1, %o0;         \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/U3copy_to_user.S b/arch/sparc64/lib/U3copy_to_user.S
index f337f22ed82e..2334f111bb0c 100644
--- a/arch/sparc64/lib/U3copy_to_user.S
+++ b/arch/sparc64/lib/U3copy_to_user.S
@@ -9,7 +9,7 @@
         .align 4;               \
 99:     retl;                   \
          mov    1, %o0;         \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/bzero.S b/arch/sparc64/lib/bzero.S
index 21a933ffb7c2..1d2abcfa4e52 100644
--- a/arch/sparc64/lib/bzero.S
+++ b/arch/sparc64/lib/bzero.S
@@ -92,7 +92,7 @@ __bzero_done:
         .align 4;               \
 99:     retl;                   \
          mov    %o1, %o0;       \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/copy_in_user.S b/arch/sparc64/lib/copy_in_user.S
index 816076c0bc06..650af3f21f78 100644
--- a/arch/sparc64/lib/copy_in_user.S
+++ b/arch/sparc64/lib/copy_in_user.S
@@ -13,7 +13,7 @@
         .align 4;               \
 99:     retl;                   \
          mov 1, %o0;            \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/csum_copy_from_user.S b/arch/sparc64/lib/csum_copy_from_user.S
index 817ebdae39f8..a22eddbe5dba 100644
--- a/arch/sparc64/lib/csum_copy_from_user.S
+++ b/arch/sparc64/lib/csum_copy_from_user.S
@@ -9,7 +9,7 @@
         .align 4;               \
 99:     retl;                   \
          mov    -1, %o0;        \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/csum_copy_to_user.S b/arch/sparc64/lib/csum_copy_to_user.S
index c2f9463ea1e2..d5b12f441f02 100644
--- a/arch/sparc64/lib/csum_copy_to_user.S
+++ b/arch/sparc64/lib/csum_copy_to_user.S
@@ -9,7 +9,7 @@
         .align 4;               \
 99:     retl;                   \
          mov    -1, %o0;        \
-        .section __ex_table;    \
+        .section __ex_table,"a";\
         .align 4;               \
         .word 98b, 99b;         \
         .text;                  \
diff --git a/arch/sparc64/lib/strlen_user.S b/arch/sparc64/lib/strlen_user.S
index 9ed54ba14fc6..114ed111e251 100644
--- a/arch/sparc64/lib/strlen_user.S
+++ b/arch/sparc64/lib/strlen_user.S
@@ -85,7 +85,7 @@ __strnlen_user:
         retl
          clr    %o0
 
-        .section __ex_table,#alloc
+        .section __ex_table,"a"
         .align  4
 
         .word   10b, 30b
diff --git a/arch/sparc64/lib/strncpy_from_user.S b/arch/sparc64/lib/strncpy_from_user.S
index e1264650ca7a..b2f499f79427 100644
--- a/arch/sparc64/lib/strncpy_from_user.S
+++ b/arch/sparc64/lib/strncpy_from_user.S
@@ -125,7 +125,7 @@ __strncpy_from_user:
          add    %o2, %o3, %o0
         .size   __strncpy_from_user, .-__strncpy_from_user
 
-        .section __ex_table,#alloc
+        .section __ex_table,"a"
         .align  4
         .word   60b, __retl_efault
         .word   61b, __retl_efault
diff --git a/arch/sparc64/solaris/entry64.S b/arch/sparc64/solaris/entry64.S
index eb314ed23cdb..f170324e8bf2 100644
--- a/arch/sparc64/solaris/entry64.S
+++ b/arch/sparc64/solaris/entry64.S
@@ -217,7 +217,7 @@ solaris_unimplemented:
         ba,pt           %xcc, ret_from_solaris
          nop
 
-        .section        __ex_table,#alloc
+        .section        __ex_table,"a"
         .align          4
         .word           exen, exenf
 
diff --git a/arch/sparc64/solaris/systbl.S b/arch/sparc64/solaris/systbl.S
index d25667eeae10..7043ca18caf9 100644
--- a/arch/sparc64/solaris/systbl.S
+++ b/arch/sparc64/solaris/systbl.S
@@ -283,32 +283,3 @@ solaris_sys_table:
         .word solaris_unimplemented     /*                      253     */
         .word solaris_unimplemented     /*                      254     */
         .word solaris_unimplemented     /*                      255     */
-        .word solaris_unimplemented     /*                      256     */
-        .word solaris_unimplemented     /*                      257     */
-        .word solaris_unimplemented     /*                      258     */
-        .word solaris_unimplemented     /*                      259     */
-        .word solaris_unimplemented     /*                      260     */
-        .word solaris_unimplemented     /*                      261     */
-        .word solaris_unimplemented     /*                      262     */
-        .word solaris_unimplemented     /*                      263     */
-        .word solaris_unimplemented     /*                      264     */
-        .word solaris_unimplemented     /*                      265     */
-        .word solaris_unimplemented     /*                      266     */
-        .word solaris_unimplemented     /*                      267     */
-        .word solaris_unimplemented     /*                      268     */
-        .word solaris_unimplemented     /*                      269     */
-        .word solaris_unimplemented     /*                      270     */
-        .word solaris_unimplemented     /*                      271     */
-        .word solaris_unimplemented     /*                      272     */
-        .word solaris_unimplemented     /*                      273     */
-        .word solaris_unimplemented     /*                      274     */
-        .word solaris_unimplemented     /*                      275     */
-        .word solaris_unimplemented     /*                      276     */
-        .word solaris_unimplemented     /*                      277     */
-        .word solaris_unimplemented     /*                      278     */
-        .word solaris_unimplemented     /*                      279     */
-        .word solaris_unimplemented     /*                      280     */
-        .word solaris_unimplemented     /*                      281     */
-        .word solaris_unimplemented     /*                      282     */
-        .word solaris_unimplemented     /*                      283     */
-
diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c
index 5d50d4a44abf..2f880cb167a5 100644
--- a/arch/um/drivers/chan_user.c
+++ b/arch/um/drivers/chan_user.c
@@ -9,6 +9,7 @@
 #include <termios.h>
 #include <string.h>
 #include <signal.h>
+#include <sched.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
@@ -73,7 +74,6 @@ static void winch_handler(int sig)
 struct winch_data {
         int pty_fd;
         int pipe_fd;
-        int close_me;
 };
 
 static int winch_thread(void *arg)
@@ -84,7 +84,6 @@ static int winch_thread(void *arg)
         int count, err;
         char c = 1;
 
-        os_close_file(data->close_me);
         pty_fd = data->pty_fd;
         pipe_fd = data->pipe_fd;
         count = os_write_file(pipe_fd, &c, sizeof(c));
@@ -153,15 +152,16 @@ static int winch_tramp(int fd, struct tty_struct *tty, int *fd_out)
         }
 
         data = ((struct winch_data) { .pty_fd           = fd,
-                                      .pipe_fd          = fds[1],
-                                      .close_me         = fds[0] } );
-        err = run_helper_thread(winch_thread, &data, 0, &stack, 0);
+                                      .pipe_fd          = fds[1] } );
+        /* CLONE_FILES so this thread doesn't hold open files which are open
+         * now, but later closed.  This is a problem with /dev/net/tun.
+         */
+        err = run_helper_thread(winch_thread, &data, CLONE_FILES, &stack, 0);
         if(err < 0){
                 printk("fork of winch_thread failed - errno = %d\n", errno);
                 goto out_close;
         }
 
-        os_close_file(fds[1]);
         *fd_out = fds[0];
         n = os_read_file(fds[0], &c, sizeof(c));
         if(n != sizeof(c)){
@@ -169,13 +169,12 @@ static int winch_tramp(int fd, struct tty_struct *tty, int *fd_out)
                 printk("read failed, err = %d\n", -n);
                 printk("fd %d will not support SIGWINCH\n", fd);
                 err = -EINVAL;
-                goto out_close1;
+                goto out_close;
         }
         return err ;
 
  out_close:
         os_close_file(fds[1]);
- out_close1:
         os_close_file(fds[0]);
  out:
         return err;
diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index dc36b222100b..04e3958266e0 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -46,7 +46,7 @@ extern int file_reader(__u64 offset, char *buf, int len, void *arg);
 extern int read_cow_header(int (*reader)(__u64, char *, int, void *),
                            void *arg, __u32 *version_out,
                            char **backing_file_out, time_t *mtime_out,
-                           unsigned long long *size_out, int *sectorsize_out,
+                           __u64 *size_out, int *sectorsize_out,
                            __u32 *align_out, int *bitmap_offset_out);
 
 extern int write_cow_header(char *cow_file, int fd, char *backing_file,
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index c83fc5d68936..94de4ead4f7a 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -23,17 +23,17 @@ static inline char *cow_strdup(char *str)
         return(uml_strdup(str));
 }
 
-static inline int cow_seek_file(int fd, unsigned long long offset)
+static inline int cow_seek_file(int fd, __u64 offset)
 {
         return(os_seek_file(fd, offset));
 }
 
-static inline int cow_file_size(char *file, unsigned long long *size_out)
+static inline int cow_file_size(char *file, __u64 *size_out)
 {
         return(os_file_size(file, size_out));
 }
 
-static inline int cow_write_file(int fd, char *buf, int size)
+static inline int cow_write_file(int fd, void *buf, int size)
 {
         return(os_write_file(fd, buf, size));
 }
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index fbe2217db5dd..61951b721268 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -176,7 +176,7 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
         err = -ENOMEM;
         header = cow_malloc(sizeof(*header));
         if(header == NULL){
-                cow_printf("Failed to allocate COW V3 header\n");
+                cow_printf("write_cow_header - failed to allocate COW V3 header\n");
                 goto out;
         }
         header->magic = htonl(COW_MAGIC);
@@ -196,15 +196,17 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
 
         err = os_file_modtime(header->backing_file, &modtime);
         if(err < 0){
-                cow_printf("Backing file '%s' mtime request failed, "
-                           "err = %d\n", header->backing_file, -err);
+                cow_printf("write_cow_header - backing file '%s' mtime "
+                           "request failed, err = %d\n", header->backing_file,
+                           -err);
                 goto out_free;
         }
 
         err = cow_file_size(header->backing_file, size);
         if(err < 0){
-                cow_printf("Couldn't get size of backing file '%s', "
-                           "err = %d\n", header->backing_file, -err);
+                cow_printf("write_cow_header - couldn't get size of "
+                           "backing file '%s', err = %d\n",
+                           header->backing_file, -err);
                 goto out_free;
         }
 
@@ -214,10 +216,11 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
         header->alignment = htonl(alignment);
         header->cow_format = COW_BITMAP;
 
-        err = os_write_file(fd, header, sizeof(*header));
+        err = cow_write_file(fd, header, sizeof(*header));
         if(err != sizeof(*header)){
-                cow_printf("Write of header to new COW file '%s' failed, "
-                           "err = %d\n", cow_file, -err);
+                cow_printf("write_cow_header - write of header to "
+                           "new COW file '%s' failed, err = %d\n", cow_file,
+                           -err);
                 goto out_free;
         }
         err = 0;
@@ -299,7 +302,7 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
         }
         else if(version == 3){
                 if(n < sizeof(header->v3)){
-                        cow_printf("read_cow_header - failed to read V2 "
+                        cow_printf("read_cow_header - failed to read V3 "
                                    "header\n");
                         goto out;
                 }
@@ -359,7 +362,8 @@ int init_cow_file(int fd, char *cow_file, char *backing_file, int sectorsize,
         if(err != sizeof(zero)){
                 cow_printf("Write of bitmap to new COW file '%s' failed, "
                            "err = %d\n", cow_file, -err);
-                err = -EINVAL;
+                if (err >= 0)
+                        err = -EINVAL;
                 goto out;
         }
 
diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 8ebb2241ad42..8c7279bb353b 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -131,9 +131,8 @@ static int uml_net_open(struct net_device *dev)
                              SA_INTERRUPT | SA_SHIRQ, dev->name, dev);
         if(err != 0){
                 printk(KERN_ERR "uml_net_open: failed to get irq(%d)\n", err);
-                if(lp->close != NULL) (*lp->close)(lp->fd, &lp->user);
-                lp->fd = -1;
                 err = -ENETUNREACH;
+                goto out_close;
         }
 
         lp->tl.data = (unsigned long) &lp->user;
@@ -145,9 +144,19 @@ static int uml_net_open(struct net_device *dev)
          */
         while((err = uml_net_rx(dev)) > 0) ;
 
- out:
         spin_unlock(&lp->lock);
-        return(err);
+
+        spin_lock(&opened_lock);
+        list_add(&lp->list, &opened);
+        spin_unlock(&opened_lock);
+
+        return 0;
+out_close:
+        if(lp->close != NULL) (*lp->close)(lp->fd, &lp->user);
+        lp->fd = -1;
+out:
+        spin_unlock(&lp->lock);
+        return err;
 }
 
 static int uml_net_close(struct net_device *dev)
@@ -161,9 +170,13 @@ static int uml_net_close(struct net_device *dev)
         if(lp->close != NULL)
                 (*lp->close)(lp->fd, &lp->user);
         lp->fd = -1;
-        list_del(&lp->list);
 
         spin_unlock(&lp->lock);
+
+        spin_lock(&opened_lock);
+        list_del(&lp->list);
+        spin_unlock(&opened_lock);
+
         return 0;
 }
 
@@ -410,11 +423,7 @@ static int eth_configure(int n, void *init, char *mac,
         if (device->have_mac)
                 set_ether_mac(dev, device->mac);
 
-        spin_lock(&opened_lock);
-        list_add(&lp->list, &opened);
-        spin_unlock(&opened_lock);
-
-        return(0);
+        return 0;
 }
 
 static struct uml_net *find_device(int n)
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 098fa65981ab..0e2f06187ea7 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -47,10 +47,12 @@ void tap_check_ips(char *gate_addr, unsigned char *eth_addr)
         }
 }
 
+/* Do reliable error handling as this fails frequently enough. */
 void read_output(int fd, char *output, int len)
 {
-        int remain, n, actual;
+        int remain, ret, expected;
         char c;
+        char *str;
 
         if(output == NULL){
                 output = &c;
@@ -58,23 +60,31 @@ void read_output(int fd, char *output, int len)
         }
                 
         *output = '\0';
-        n = os_read_file(fd, &remain, sizeof(remain));
-        if(n != sizeof(remain)){
-                printk("read_output - read of length failed, err = %d\n", -n);
-                return;
+        ret = os_read_file(fd, &remain, sizeof(remain));
+
+        if (ret != sizeof(remain)) {
+                expected = sizeof(remain);
+                str = "length";
+                goto err;
         }
 
         while(remain != 0){
-                n = (remain < len) ? remain : len;
-                actual = os_read_file(fd, output, n);
-                if(actual != n){
-                        printk("read_output - read of data failed, "
-                               "err = %d\n", -actual);
-                        return;
+                expected = (remain < len) ? remain : len;
+                ret = os_read_file(fd, output, expected);
+                if (ret != expected) {
+                        str = "data";
+                        goto err;
                 }
-                remain -= actual;
+                remain -= ret;
         }
+
         return;
+
+err:
+        if (ret < 0)
+                printk("read_output - read of %s failed, errno = %d\n", str, -ret);
+        else
+                printk("read_output - read of %s failed, read only %d of %d bytes\n", str, ret, expected);
 }
 
 int net_read(int fd, void *buf, int len)
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 101efd26d467..fa617e0719ab 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1135,7 +1135,7 @@ static int path_requires_switch(char *from_cmdline, char *from_cow, char *cow)
 static int backing_file_mismatch(char *file, __u64 size, time_t mtime)
 {
         unsigned long modtime;
-        long long actual;
+        unsigned long long actual;
         int err;
 
         err = os_file_modtime(file, &modtime);
diff --git a/arch/um/include/init.h b/arch/um/include/init.h
index cbd79a8d213d..d4de7c0120ce 100644
--- a/arch/um/include/init.h
+++ b/arch/um/include/init.h
@@ -122,7 +122,7 @@ extern struct uml_param __uml_setup_start, __uml_setup_end;
 
 #define __exitcall(fn) static exitcall_t __exitcall_##fn __exit_call = fn
 
-#define __init_call __attribute__ ((unused,__section__ (".initcall.init")))
+#define __init_call     __attribute_used__ __attribute__ ((__section__ (".initcall.init")))
 
 #endif
 
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index eb1710b81255..2a1c64d8d0bf 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -179,8 +179,11 @@ extern void os_stop_process(int pid);
 extern void os_kill_process(int pid, int reap_child);
 extern void os_kill_ptraced_process(int pid, int reap_child);
 extern void os_usr1_process(int pid);
+extern long os_ptrace_ldt(long pid, long addr, long data);
+
 extern int os_getpid(void);
 extern int os_getpgrp(void);
+
 extern void init_new_thread_stack(void *sig_stack, void (*usr1_handler)(int));
 extern void init_new_thread_signals(int altstack);
 extern int run_kernel_thread(int (*fn)(void *), void *arg, void **jmp_ptr);
diff --git a/arch/um/include/registers.h b/arch/um/include/registers.h
index 4892e5fcef07..83b688ca198f 100644
--- a/arch/um/include/registers.h
+++ b/arch/um/include/registers.h
@@ -14,7 +14,7 @@ extern int restore_fp_registers(int pid, unsigned long *fp_regs);
 extern void save_registers(int pid, union uml_pt_regs *regs);
 extern void restore_registers(int pid, union uml_pt_regs *regs);
 extern void init_registers(int pid);
-extern void get_safe_registers(unsigned long * regs);
+extern void get_safe_registers(unsigned long * regs, unsigned long * fp_regs);
 extern void get_thread_regs(union uml_pt_regs *uml_regs, void *buffer);
 
 #endif
diff --git a/arch/um/kernel/skas/process.c b/arch/um/kernel/skas/process.c
deleted file mode 100644
index eea1c9c4bb0f..000000000000
--- a/arch/um/kernel/skas/process.c
+++ /dev/null
@@ -1,569 +0,0 @@
-/* 
- * Copyright (C) 2002- 2004 Jeff Dike (jdike@addtoit.com)
- * Licensed under the GPL
- */
-
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <errno.h>
-#include <signal.h>
-#include <setjmp.h>
-#include <sched.h>
-#include <sys/wait.h>
-#include <sys/mman.h>
-#include <sys/user.h>
-#include <sys/time.h>
-#include <asm/unistd.h>
-#include <asm/types.h>
-#include "user.h"
-#include "ptrace_user.h"
-#include "sysdep/ptrace.h"
-#include "user_util.h"
-#include "kern_util.h"
-#include "skas.h"
-#include "stub-data.h"
-#include "mm_id.h"
-#include "sysdep/sigcontext.h"
-#include "sysdep/stub.h"
-#include "os.h"
-#include "proc_mm.h"
-#include "skas_ptrace.h"
-#include "chan_user.h"
-#include "registers.h"
-#include "mem.h"
-#include "uml-config.h"
-#include "process.h"
-
-int is_skas_winch(int pid, int fd, void *data)
-{
-        if(pid != os_getpgrp())
-                return(0);
-
-        register_winch_irq(-1, fd, -1, data);
-        return(1);
-}
-
-void wait_stub_done(int pid, int sig, char * fname)
-{
-        int n, status, err;
-
-        do {
-                if ( sig != -1 ) {
-                        err = ptrace(PTRACE_CONT, pid, 0, sig);
-                        if(err)
-                                panic("%s : continue failed, errno = %d\n",
-                                      fname, errno);
-                }
-                sig = 0;
-
-                CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED));
-        } while((n >= 0) && WIFSTOPPED(status) &&
-                ((WSTOPSIG(status) == SIGVTALRM) ||
-                 /* running UML inside a detached screen can cause
-                  * SIGWINCHes
-                  */
-                 (WSTOPSIG(status) == SIGWINCH)));
-
-        if((n < 0) || !WIFSTOPPED(status) ||
-           (WSTOPSIG(status) != SIGUSR1 && WSTOPSIG(status) != SIGTRAP)){
-                unsigned long regs[HOST_FRAME_SIZE];
-                if(ptrace(PTRACE_GETREGS, pid, 0, regs) < 0)
-                        printk("Failed to get registers from stub, "
-                               "errno = %d\n", errno);
-                else {
-                        int i;
-
-                        printk("Stub registers -\n");
-                        for(i = 0; i < HOST_FRAME_SIZE; i++)
-                                printk("\t%d - %lx\n", i, regs[i]);
-                }
-                panic("%s : failed to wait for SIGUSR1/SIGTRAP, "
-                      "pid = %d, n = %d, errno = %d, status = 0x%x\n",
-                      fname, pid, n, errno, status);
-        }
-}
-
-void get_skas_faultinfo(int pid, struct faultinfo * fi)
-{
-        int err;
-
-        if(ptrace_faultinfo){
-                err = ptrace(PTRACE_FAULTINFO, pid, 0, fi);
-                if(err)
-                        panic("get_skas_faultinfo - PTRACE_FAULTINFO failed, "
-                              "errno = %d\n", errno);
-
-                /* Special handling for i386, which has different structs */
-                if (sizeof(struct ptrace_faultinfo) < sizeof(struct faultinfo))
-                        memset((char *)fi + sizeof(struct ptrace_faultinfo), 0,
-                               sizeof(struct faultinfo) -
-                               sizeof(struct ptrace_faultinfo));
-        }
-        else {
-                wait_stub_done(pid, SIGSEGV, "get_skas_faultinfo");
-
-                /* faultinfo is prepared by the stub-segv-handler at start of
-                 * the stub stack page. We just have to copy it.
-                 */
-                memcpy(fi, (void *)current_stub_stack(), sizeof(*fi));
-        }
-}
-
-static void handle_segv(int pid, union uml_pt_regs * regs)
-{
-        get_skas_faultinfo(pid, &regs->skas.faultinfo);
-        segv(regs->skas.faultinfo, 0, 1, NULL);
-}
-
-/*To use the same value of using_sysemu as the caller, ask it that value (in local_using_sysemu)*/
-static void handle_trap(int pid, union uml_pt_regs *regs, int local_using_sysemu)
-{
-        int err, status;
-
-        /* Mark this as a syscall */
-        UPT_SYSCALL_NR(regs) = PT_SYSCALL_NR(regs->skas.regs);
-
-        if (!local_using_sysemu)
-        {
-                err = ptrace(PTRACE_POKEUSR, pid, PT_SYSCALL_NR_OFFSET, __NR_getpid);
-                if(err < 0)
-                        panic("handle_trap - nullifying syscall failed errno = %d\n",
-                              errno);
-
-                err = ptrace(PTRACE_SYSCALL, pid, 0, 0);
-                if(err < 0)
-                        panic("handle_trap - continuing to end of syscall failed, "
-                              "errno = %d\n", errno);
-
-                CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED));
-                if((err < 0) || !WIFSTOPPED(status) ||
-                   (WSTOPSIG(status) != SIGTRAP + 0x80))
-                        panic("handle_trap - failed to wait at end of syscall, "
-                              "errno = %d, status = %d\n", errno, status);
-        }
-
-        handle_syscall(regs);
-}
-
-extern int __syscall_stub_start;
-int stub_code_fd = -1;
-__u64 stub_code_offset;
-
-static int userspace_tramp(void *stack)
-{
-        void *addr;
-
-        ptrace(PTRACE_TRACEME, 0, 0, 0);
-
-        init_new_thread_signals(1);
-        enable_timer();
-
-        if(!proc_mm){
-                /* This has a pte, but it can't be mapped in with the usual
-                 * tlb_flush mechanism because this is part of that mechanism
-                 */
-                addr = mmap64((void *) UML_CONFIG_STUB_CODE, page_size(),
-                              PROT_EXEC, MAP_FIXED | MAP_PRIVATE,
-                              stub_code_fd, stub_code_offset);
-                if(addr == MAP_FAILED){
-                        printk("mapping stub code failed, errno = %d\n",
-                               errno);
-                        exit(1);
-                }
-
-                if(stack != NULL){
-                        int fd;
-                        __u64 offset;
-
-                        fd = phys_mapping(to_phys(stack), &offset);
-                        addr = mmap((void *) UML_CONFIG_STUB_DATA, page_size(),
-                                    PROT_READ | PROT_WRITE,
-                                    MAP_FIXED | MAP_SHARED, fd, offset);
-                        if(addr == MAP_FAILED){
-                                printk("mapping stub stack failed, "
-                                       "errno = %d\n", errno);
-                                exit(1);
-                        }
-                }
-        }
-        if(!ptrace_faultinfo){
-                unsigned long v = UML_CONFIG_STUB_CODE +
-                                  (unsigned long) stub_segv_handler -
-                                  (unsigned long) &__syscall_stub_start;
-
-                set_sigstack((void *) UML_CONFIG_STUB_DATA, page_size());
-                set_handler(SIGSEGV, (void *) v, SA_ONSTACK,
-                            SIGIO, SIGWINCH, SIGALRM, SIGVTALRM,
-                            SIGUSR1, -1);
-        }
-
-        os_stop_process(os_getpid());
-        return(0);
-}
-
-/* Each element set once, and only accessed by a single processor anyway */
-#undef NR_CPUS
-#define NR_CPUS 1
-int userspace_pid[NR_CPUS];
-
-int start_userspace(unsigned long stub_stack)
-{
-        void *stack;
-        unsigned long sp;
-        int pid, status, n, flags;
-
-        if ( stub_code_fd == -1 )
-                stub_code_fd = phys_mapping(to_phys(&__syscall_stub_start),
-                                            &stub_code_offset);
-
-        stack = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC,
-                     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-        if(stack == MAP_FAILED)
-                panic("start_userspace : mmap failed, errno = %d", errno);
-        sp = (unsigned long) stack + PAGE_SIZE - sizeof(void *);
-
-        flags = CLONE_FILES | SIGCHLD;
-        if(proc_mm) flags |= CLONE_VM;
-        pid = clone(userspace_tramp, (void *) sp, flags, (void *) stub_stack);
-        if(pid < 0)
-                panic("start_userspace : clone failed, errno = %d", errno);
-
-        do {
-                CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED));
-                if(n < 0)
-                        panic("start_userspace : wait failed, errno = %d", 
-                              errno);
-        } while(WIFSTOPPED(status) && (WSTOPSIG(status) == SIGVTALRM));
-
-        if(!WIFSTOPPED(status) || (WSTOPSIG(status) != SIGSTOP))
-                panic("start_userspace : expected SIGSTOP, got status = %d",
-                      status);
-
-        if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL, (void *)PTRACE_O_TRACESYSGOOD) < 0)
-                panic("start_userspace : PTRACE_SETOPTIONS failed, errno=%d\n",
-                      errno);
-
-        if(munmap(stack, PAGE_SIZE) < 0)
-                panic("start_userspace : munmap failed, errno = %d\n", errno);
-
-        return(pid);
-}
-
-void userspace(union uml_pt_regs *regs)
-{
-        int err, status, op, pid = userspace_pid[0];
-        int local_using_sysemu; /*To prevent races if using_sysemu changes under us.*/
-
-        while(1){
-                restore_registers(pid, regs);
-
-                /* Now we set local_using_sysemu to be used for one loop */
-                local_using_sysemu = get_using_sysemu();
-
-                op = SELECT_PTRACE_OPERATION(local_using_sysemu, singlestepping(NULL));
-
-                err = ptrace(op, pid, 0, 0);
-                if(err)
-                        panic("userspace - could not resume userspace process, "
-                              "pid=%d, ptrace operation = %d, errno = %d\n",
-                              op, errno);
-
-                CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED));
-                if(err < 0)
-                        panic("userspace - waitpid failed, errno = %d\n", 
-                              errno);
-
-                regs->skas.is_user = 1;
-                save_registers(pid, regs);
-                UPT_SYSCALL_NR(regs) = -1; /* Assume: It's not a syscall */
-
-                if(WIFSTOPPED(status)){
-                        switch(WSTOPSIG(status)){
-                        case SIGSEGV:
-                                if(PTRACE_FULL_FAULTINFO || !ptrace_faultinfo)
-                                        user_signal(SIGSEGV, regs, pid);
-                                else handle_segv(pid, regs);
-                                break;
-                        case SIGTRAP + 0x80:
-                                handle_trap(pid, regs, local_using_sysemu);
-                                break;
-                        case SIGTRAP:
-                                relay_signal(SIGTRAP, regs);
-                                break;
-                        case SIGIO:
-                        case SIGVTALRM:
-                        case SIGILL:
-                        case SIGBUS:
-                        case SIGFPE:
-                        case SIGWINCH:
-                                user_signal(WSTOPSIG(status), regs, pid);
-                                break;
-                        default:
-                                printk("userspace - child stopped with signal "
-                                       "%d\n", WSTOPSIG(status));
-                        }
-                        pid = userspace_pid[0];
-                        interrupt_end();
-
-                        /* Avoid -ERESTARTSYS handling in host */
-                        PT_SYSCALL_NR(regs->skas.regs) = -1;
-                }
-        }
-}
-#define INIT_JMP_NEW_THREAD 0
-#define INIT_JMP_REMOVE_SIGSTACK 1
-#define INIT_JMP_CALLBACK 2
-#define INIT_JMP_HALT 3
-#define INIT_JMP_REBOOT 4
-
-
-int copy_context_skas0(unsigned long new_stack, int pid)
-{
-        int err;
-        unsigned long regs[MAX_REG_NR];
-        unsigned long current_stack = current_stub_stack();
-        struct stub_data *data = (struct stub_data *) current_stack;
-        struct stub_data *child_data = (struct stub_data *) new_stack;
-        __u64 new_offset;
-        int new_fd = phys_mapping(to_phys((void *)new_stack), &new_offset);
-
-        /* prepare offset and fd of child's stack as argument for parent's
-         * and child's mmap2 calls
-         */
-        *data = ((struct stub_data) { .offset   = MMAP_OFFSET(new_offset),
-                                      .fd       = new_fd,
-                                      .timer    = ((struct itimerval)
-                                                   { { 0, 1000000 / hz() },
-                                                     { 0, 1000000 / hz() }})});
-        get_safe_registers(regs);
-
-        /* Set parent's instruction pointer to start of clone-stub */
-        regs[REGS_IP_INDEX] = UML_CONFIG_STUB_CODE +
-                                (unsigned long) stub_clone_handler -
-                                (unsigned long) &__syscall_stub_start;
-        regs[REGS_SP_INDEX] = UML_CONFIG_STUB_DATA + PAGE_SIZE -
-                sizeof(void *);
-        err = ptrace_setregs(pid, regs);
-        if(err < 0)
-                panic("copy_context_skas0 : PTRACE_SETREGS failed, "
-                      "pid = %d, errno = %d\n", pid, errno);
-
-        /* set a well known return code for detection of child write failure */
-        child_data->err = 12345678;
-
-        /* Wait, until parent has finished its work: read child's pid from
-         * parent's stack, and check, if bad result.
-         */
-        wait_stub_done(pid, 0, "copy_context_skas0");
-
-        pid = data->err;
-        if(pid < 0)
-                panic("copy_context_skas0 - stub-parent reports error %d\n",
-                      pid);
-
-        /* Wait, until child has finished too: read child's result from
-         * child's stack and check it.
-         */
-        wait_stub_done(pid, -1, "copy_context_skas0");
-        if (child_data->err != UML_CONFIG_STUB_DATA)
-                panic("copy_context_skas0 - stub-child reports error %d\n",
-                      child_data->err);
-
-        if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL,
-                   (void *)PTRACE_O_TRACESYSGOOD) < 0)
-                panic("copy_context_skas0 : PTRACE_SETOPTIONS failed, "
-                      "errno = %d\n", errno);
-
-        return pid;
-}
-
-/*
- * This is used only, if stub pages are needed, while proc_mm is
- * availabl. Opening /proc/mm creates a new mm_context, which lacks
- * the stub-pages. Thus, we map them using /proc/mm-fd
- */
-void map_stub_pages(int fd, unsigned long code,
-                    unsigned long data, unsigned long stack)
-{
-        struct proc_mm_op mmop;
-        int n;
-
-        mmop = ((struct proc_mm_op) { .op        = MM_MMAP,
-                                      .u         =
-                                      { .mmap    =
-                                        { .addr    = code,
-                                          .len     = PAGE_SIZE,
-                                          .prot    = PROT_EXEC,
-                                          .flags   = MAP_FIXED | MAP_PRIVATE,
-                                          .fd      = stub_code_fd,
-                                          .offset  = stub_code_offset
-        } } });
-        n = os_write_file(fd, &mmop, sizeof(mmop));
-        if(n != sizeof(mmop))
-                panic("map_stub_pages : /proc/mm map for code failed, "
-                      "err = %d\n", -n);
-
-        if ( stack ) {
-                __u64 map_offset;
-                int map_fd = phys_mapping(to_phys((void *)stack), &map_offset);
-                mmop = ((struct proc_mm_op)
-                                { .op        = MM_MMAP,
-                                  .u         =
-                                  { .mmap    =
-                                    { .addr    = data,
-                                      .len     = PAGE_SIZE,
-                                      .prot    = PROT_READ | PROT_WRITE,
-                                      .flags   = MAP_FIXED | MAP_SHARED,
-                                      .fd      = map_fd,
-                                      .offset  = map_offset
-                } } });
-                n = os_write_file(fd, &mmop, sizeof(mmop));
-                if(n != sizeof(mmop))
-                        panic("map_stub_pages : /proc/mm map for data failed, "
-                              "err = %d\n", -n);
-        }
-}
-
-void new_thread(void *stack, void **switch_buf_ptr, void **fork_buf_ptr,
-                void (*handler)(int))
-{
-        unsigned long flags;
-        sigjmp_buf switch_buf, fork_buf;
-
-        *switch_buf_ptr = &switch_buf;
-        *fork_buf_ptr = &fork_buf;
-
-        /* Somewhat subtle - siglongjmp restores the signal mask before doing
-         * the longjmp.  This means that when jumping from one stack to another
-         * when the target stack has interrupts enabled, an interrupt may occur
-         * on the source stack.  This is bad when starting up a process because
-         * it's not supposed to get timer ticks until it has been scheduled.
-         * So, we disable interrupts around the sigsetjmp to ensure that
-         * they can't happen until we get back here where they are safe.
-         */
-        flags = get_signals();
-        block_signals();
-        if(sigsetjmp(fork_buf, 1) == 0)
-                new_thread_proc(stack, handler);
-
-        remove_sigstack();
-
-        set_signals(flags);
-}
-
-void thread_wait(void *sw, void *fb)
-{
-        sigjmp_buf buf, **switch_buf = sw, *fork_buf;
-
-        *switch_buf = &buf;
-        fork_buf = fb;
-        if(sigsetjmp(buf, 1) == 0)
-                siglongjmp(*fork_buf, INIT_JMP_REMOVE_SIGSTACK);
-}
-
-void switch_threads(void *me, void *next)
-{
-        sigjmp_buf my_buf, **me_ptr = me, *next_buf = next;
-        
-        *me_ptr = &my_buf;
-        if(sigsetjmp(my_buf, 1) == 0)
-                siglongjmp(*next_buf, 1);
-}
-
-static sigjmp_buf initial_jmpbuf;
-
-/* XXX Make these percpu */
-static void (*cb_proc)(void *arg);
-static void *cb_arg;
-static sigjmp_buf *cb_back;
-
-int start_idle_thread(void *stack, void *switch_buf_ptr, void **fork_buf_ptr)
-{
-        sigjmp_buf **switch_buf = switch_buf_ptr;
-        int n;
-
-        set_handler(SIGWINCH, (__sighandler_t) sig_handler,
-                    SA_ONSTACK | SA_RESTART, SIGUSR1, SIGIO, SIGALRM,
-                    SIGVTALRM, -1);
-
-        *fork_buf_ptr = &initial_jmpbuf;
-        n = sigsetjmp(initial_jmpbuf, 1);
-        switch(n){
-        case INIT_JMP_NEW_THREAD:
-                new_thread_proc((void *) stack, new_thread_handler);
-                break;
-        case INIT_JMP_REMOVE_SIGSTACK:
-                remove_sigstack();
-                break;
-        case INIT_JMP_CALLBACK:
-                (*cb_proc)(cb_arg);
-                siglongjmp(*cb_back, 1);
-                break;
-        case INIT_JMP_HALT:
-                kmalloc_ok = 0;
-                return(0);
-        case INIT_JMP_REBOOT:
-                kmalloc_ok = 0;
-                return(1);
-        default:
-                panic("Bad sigsetjmp return in start_idle_thread - %d\n", n);
-        }
-        siglongjmp(**switch_buf, 1);
-}
-
-void initial_thread_cb_skas(void (*proc)(void *), void *arg)
-{
-        sigjmp_buf here;
-
-        cb_proc = proc;
-        cb_arg = arg;
-        cb_back = &here;
-
-        block_signals();
-        if(sigsetjmp(here, 1) == 0)
-                siglongjmp(initial_jmpbuf, INIT_JMP_CALLBACK);
-        unblock_signals();
-
-        cb_proc = NULL;
-        cb_arg = NULL;
-        cb_back = NULL;
-}
-
-void halt_skas(void)
-{
-        block_signals();
-        siglongjmp(initial_jmpbuf, INIT_JMP_HALT);
-}
-
-void reboot_skas(void)
-{
-        block_signals();
-        siglongjmp(initial_jmpbuf, INIT_JMP_REBOOT);
-}
-
-void switch_mm_skas(struct mm_id *mm_idp)
-{
-        int err;
-
-#warning need cpu pid in switch_mm_skas
-        if(proc_mm){
-                err = ptrace(PTRACE_SWITCH_MM, userspace_pid[0], 0,
-                             mm_idp->u.mm_fd);
-                if(err)
-                        panic("switch_mm_skas - PTRACE_SWITCH_MM failed, "
-                              "errno = %d\n", errno);
-        }
-        else userspace_pid[0] = mm_idp->u.pid;
-}
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/um_arch.c b/arch/um/kernel/um_arch.c
index e2d3ca445ef5..27cdf9164422 100644
--- a/arch/um/kernel/um_arch.c
+++ b/arch/um/kernel/um_arch.c
@@ -193,6 +193,24 @@ __uml_setup("root=", uml_root_setup,
 "        root=/dev/ubd5\n\n"
 );
 
+#ifndef CONFIG_MODE_TT
+
+static int __init no_skas_debug_setup(char *line, int *add)
+{
+        printf("'debug' is not necessary to gdb UML in skas mode - run \n");
+        printf("'gdb linux' and disable CONFIG_CMDLINE_ON_HOST if gdb \n");
+        printf("doesn't work as expected\n");
+
+        return 0;
+}
+
+__uml_setup("debug", no_skas_debug_setup,
+"debug\n"
+"    this flag is not needed to run gdb on UML in skas mode\n\n"
+);
+
+#endif
+
 #ifdef CONFIG_SMP
 static int __init uml_ncpus_setup(char *line, int *add)
 {
diff --git a/arch/um/os-Linux/drivers/tuntap_user.c b/arch/um/os-Linux/drivers/tuntap_user.c
index 52945338b64d..87c3aa0252db 100644
--- a/arch/um/os-Linux/drivers/tuntap_user.c
+++ b/arch/um/os-Linux/drivers/tuntap_user.c
@@ -122,6 +122,7 @@ static int tuntap_open_tramp(char *gate, int *fd_out, int me, int remote,
                 return(-EINVAL);
         }
         *fd_out = ((int *) CMSG_DATA(cmsg))[0];
+        os_set_exec_close(*fd_out, 1);
         return(0);
 }
 
@@ -137,7 +138,8 @@ static int tuntap_open(void *data)
                 return(err);
 
         if(pri->fixed_config){
-                pri->fd = os_open_file("/dev/net/tun", of_rdwr(OPENFLAGS()), 0);
+                pri->fd = os_open_file("/dev/net/tun",
+                                       of_cloexec(of_rdwr(OPENFLAGS())), 0);
                 if(pri->fd < 0){
                         printk("Failed to open /dev/net/tun, err = %d\n",
                                -pri->fd);
diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c
index f55773c819e6..3bd10deea280 100644
--- a/arch/um/os-Linux/file.c
+++ b/arch/um/os-Linux/file.c
@@ -272,14 +272,23 @@ int os_connect_socket(char *name)
         snprintf(sock.sun_path, sizeof(sock.sun_path), "%s", name);
 
         fd = socket(AF_UNIX, SOCK_STREAM, 0);
-        if(fd < 0)
-                return(fd);
+        if(fd < 0) {
+                err = -errno;
+                goto out;
+        }
 
         err = connect(fd, (struct sockaddr *) &sock, sizeof(sock));
-        if(err)
-                return(-errno);
+        if(err) {
+                err = -errno;
+                goto out_close;
+        }
 
-        return(fd);
+        return fd;
+
+out_close:
+        close(fd);
+out:
+        return err;
 }
 
 void os_close_file(int fd)
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index 7f5e2dac2a35..d261888f39c4 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -19,6 +19,7 @@
 #include "irq_user.h"
 #include "kern_util.h"
 #include "longjmp.h"
+#include "skas_ptrace.h"
 
 #define ARBITRARY_ADDR -1
 #define FAILURE_PID    -1
@@ -100,6 +101,21 @@ void os_kill_process(int pid, int reap_child)
                 
 }
 
+/* This is here uniquely to have access to the userspace errno, i.e. the one
+ * used by ptrace in case of error.
+ */
+
+long os_ptrace_ldt(long pid, long addr, long data)
+{
+        int ret;
+
+        ret = ptrace(PTRACE_LDT, pid, addr, data);
+
+        if (ret < 0)
+                return -errno;
+        return ret;
+}
+
 /* Kill off a ptraced child by all means available.  kill it normally first,
  * then PTRACE_KILL it, then PTRACE_CONT it in case it's in a run state from
  * which it can't exit directly.
diff --git a/arch/um/os-Linux/skas/mem.c b/arch/um/os-Linux/skas/mem.c
index 9890e9090f58..fbb080c2fc26 100644
--- a/arch/um/os-Linux/skas/mem.c
+++ b/arch/um/os-Linux/skas/mem.c
@@ -60,7 +60,7 @@ static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr)
 
         multi_count++;
 
-        get_safe_registers(regs);
+        get_safe_registers(regs, NULL);
         regs[REGS_IP_INDEX] = UML_CONFIG_STUB_CODE +
                 ((unsigned long) &batch_syscall_stub -
                  (unsigned long) &__syscall_stub_start);
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index 120a21c5883f..bbf34cb91ce1 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -310,16 +310,12 @@ void userspace(union uml_pt_regs *regs)
                 }
         }
 }
-#define INIT_JMP_NEW_THREAD 0
-#define INIT_JMP_REMOVE_SIGSTACK 1
-#define INIT_JMP_CALLBACK 2
-#define INIT_JMP_HALT 3
-#define INIT_JMP_REBOOT 4
 
 int copy_context_skas0(unsigned long new_stack, int pid)
 {
         int err;
-        unsigned long regs[MAX_REG_NR];
+        unsigned long regs[HOST_FRAME_SIZE];
+        unsigned long fp_regs[HOST_FP_SIZE];
         unsigned long current_stack = current_stub_stack();
         struct stub_data *data = (struct stub_data *) current_stack;
         struct stub_data *child_data = (struct stub_data *) new_stack;
@@ -334,7 +330,7 @@ int copy_context_skas0(unsigned long new_stack, int pid)
                                       .timer    = ((struct itimerval)
                                                     { { 0, 1000000 / hz() },
                                                       { 0, 1000000 / hz() }})});
-        get_safe_registers(regs);
+        get_safe_registers(regs, fp_regs);
 
         /* Set parent's instruction pointer to start of clone-stub */
         regs[REGS_IP_INDEX] = UML_CONFIG_STUB_CODE +
@@ -350,6 +346,11 @@ int copy_context_skas0(unsigned long new_stack, int pid)
                 panic("copy_context_skas0 : PTRACE_SETREGS failed, "
                       "pid = %d, errno = %d\n", pid, errno);
 
+        err = ptrace_setfpregs(pid, fp_regs);
+        if(err < 0)
+                panic("copy_context_skas0 : PTRACE_SETFPREGS failed, "
+                      "pid = %d, errno = %d\n", pid, errno);
+
         /* set a well known return code for detection of child write failure */
         child_data->err = 12345678;
 
@@ -457,6 +458,12 @@ void new_thread(void *stack, void **switch_buf_ptr, void **fork_buf_ptr,
         set_signals(flags);
 }
 
+#define INIT_JMP_NEW_THREAD 0
+#define INIT_JMP_REMOVE_SIGSTACK 1
+#define INIT_JMP_CALLBACK 2
+#define INIT_JMP_HALT 3
+#define INIT_JMP_REBOOT 4
+
 void thread_wait(void *sw, void *fb)
 {
         sigjmp_buf buf, **switch_buf = sw, *fork_buf;
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index 6c5b17ed59e1..829d6b0d8b02 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -49,6 +49,7 @@ static int ptrace_child(void *arg)
         int pid = os_getpid(), ppid = getppid();
         int sc_result;
 
+        change_sig(SIGWINCH, 0);
         if(ptrace(PTRACE_TRACEME, 0, 0, 0) < 0){
                 perror("ptrace");
                 os_kill_process(pid, 0);
diff --git a/arch/um/os-Linux/sys-i386/registers.c b/arch/um/os-Linux/sys-i386/registers.c
index aee4812333c6..7a6f6b99ceff 100644
--- a/arch/um/os-Linux/sys-i386/registers.c
+++ b/arch/um/os-Linux/sys-i386/registers.c
@@ -122,9 +122,12 @@ void init_registers(int pid)
                       err);
 }
 
-void get_safe_registers(unsigned long *regs)
+void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
         memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long));
+        if(fp_regs != NULL)
+                memcpy(fp_regs, exec_fp_regs,
+                       HOST_FP_SIZE * sizeof(unsigned long));
 }
 
 void get_thread_regs(union uml_pt_regs *uml_regs, void *buffer)
diff --git a/arch/um/os-Linux/sys-x86_64/registers.c b/arch/um/os-Linux/sys-x86_64/registers.c
index 4b638dfb52b0..001941fa1a1e 100644
--- a/arch/um/os-Linux/sys-x86_64/registers.c
+++ b/arch/um/os-Linux/sys-x86_64/registers.c
@@ -70,9 +70,12 @@ void init_registers(int pid)
                       err);
 }
 
-void get_safe_registers(unsigned long *regs)
+void get_safe_registers(unsigned long *regs, unsigned long *fp_regs)
 {
         memcpy(regs, exec_regs, HOST_FRAME_SIZE * sizeof(unsigned long));
+        if(fp_regs != NULL)
+                memcpy(fp_regs, exec_fp_regs,
+                       HOST_FP_SIZE * sizeof(unsigned long));
 }
 
 void get_thread_regs(union uml_pt_regs *uml_regs, void *buffer)
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index 1fa09a79a10b..fe0877b3509c 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -107,7 +107,7 @@ long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
                  * So we need to switch child's mm into our userspace, then
                  * later switch back.
                  *
-                 * Note: I'm unshure: should interrupts be disabled here?
+                 * Note: I'm unsure: should interrupts be disabled here?
                  */
                 if(!current->active_mm || current->active_mm == &init_mm ||
                    mm_idp != &current->active_mm->context.skas.id)
@@ -129,9 +129,7 @@ long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
                         pid = userspace_pid[cpu];
                 }
 
-                res = ptrace(PTRACE_LDT, pid, 0, (unsigned long) &ldt_op);
-                if(res)
-                        res = errno;
+                res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op);
 
                 if(proc_mm)
                         put_cpu();
@@ -181,8 +179,7 @@ static long read_ldt_from_host(void __user * ptr, unsigned long bytecount)
          */
 
         cpu = get_cpu();
-        res = ptrace(PTRACE_LDT, userspace_pid[cpu], 0,
-                     (unsigned long) &ptrace_ldt);
+        res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt);
         put_cpu();
         if(res < 0)
                 goto out;
diff --git a/arch/um/sys-x86_64/ptrace_user.c b/arch/um/sys-x86_64/ptrace_user.c
index 12e404c6fa46..b5f9c33e311e 100644
--- a/arch/um/sys-x86_64/ptrace_user.c
+++ b/arch/um/sys-x86_64/ptrace_user.c
@@ -24,6 +24,13 @@ int ptrace_setregs(long pid, unsigned long *regs)
         return(0);
 }
 
+int ptrace_setfpregs(long pid, unsigned long *regs)
+{
+        if (ptrace(PTRACE_SETFPREGS, pid, 0, regs) < 0)
+                return -errno;
+        return 0;
+}
+
 void ptrace_pokeuser(unsigned long addr, unsigned long data)
 {
         panic("ptrace_pokeuser");
diff --git a/arch/um/sys-x86_64/user-offsets.c b/arch/um/sys-x86_64/user-offsets.c
index 5a585bfbb8c2..7bd54a921cf7 100644
--- a/arch/um/sys-x86_64/user-offsets.c
+++ b/arch/um/sys-x86_64/user-offsets.c
@@ -57,7 +57,7 @@ void foo(void)
 #endif
 
         DEFINE_LONGS(HOST_FRAME_SIZE, FRAME_SIZE);
-        DEFINE(HOST_FP_SIZE, 0);
+        DEFINE(HOST_FP_SIZE, sizeof(struct _fpstate) / sizeof(unsigned long));
         DEFINE(HOST_XFP_SIZE, 0);
         DEFINE_LONGS(HOST_RBX, RBX);
         DEFINE_LONGS(HOST_RCX, RCX);
diff --git a/arch/v850/Kconfig b/arch/v850/Kconfig
index 04494638b963..e7fc3e500342 100644
--- a/arch/v850/Kconfig
+++ b/arch/v850/Kconfig
@@ -28,6 +28,10 @@ config GENERIC_IRQ_PROBE
         bool
         default y
 
+config TIME_LOW_RES
+        bool
+        default y
+
 # Turn off some random 386 crap that can affect device config
 config ISA
         bool
diff --git a/arch/v850/kernel/process.c b/arch/v850/kernel/process.c
index eb909937958b..621111ddf907 100644
--- a/arch/v850/kernel/process.c
+++ b/arch/v850/kernel/process.c
@@ -30,6 +30,9 @@
 #include <asm/system.h>
 #include <asm/pgtable.h>
 
+void (*pm_power_off)(void) = NULL;
+EXPORT_SYMBOL(pm_power_off);
+
 extern void ret_from_fork (void);
 
 
diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig
index 2f9deca31cc9..e18eb79bf855 100644
--- a/arch/x86_64/Kconfig
+++ b/arch/x86_64/Kconfig
@@ -354,21 +354,6 @@ config HPET_TIMER
           as it is off-chip.  You can find the HPET spec at
           <http://www.intel.com/hardwaredesign/hpetspec.htm>.
 
-config X86_PM_TIMER
-        bool "PM timer" if EMBEDDED
-        depends on ACPI
-        default y
-        help
-          Support the ACPI PM timer for time keeping. This is slow,
-          but is useful on some chipsets without HPET on systems with more
-          than one CPU. On a single processor or single socket multi core
-          system it is normally not required.
-          When the PM timer is active 64bit vsyscalls are disabled
-          and should not be enabled (/proc/sys/kernel/vsyscall64 should
-          not be changed).
-          The kernel selects the PM timer only as a last resort, so it is
-          useful to enable just in case.
-
 config HPET_EMULATE_RTC
         bool "Provide RTC interrupt"
         depends on HPET_TIMER && RTC=y
@@ -592,6 +577,7 @@ source "arch/x86_64/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/x86_64/Kconfig.debug b/arch/x86_64/Kconfig.debug
index fcb06a50fdd2..ea31b4c62105 100644
--- a/arch/x86_64/Kconfig.debug
+++ b/arch/x86_64/Kconfig.debug
@@ -2,13 +2,6 @@ menu "Kernel hacking"
 
 source "lib/Kconfig.debug"
 
-config INIT_DEBUG
-        bool "Debug __init statements"
-        depends on DEBUG_KERNEL
-        help
-          Fill __init and __initdata at the end of boot. This helps debugging
-          illegal uses of __init and __initdata after initialization.
-
 config DEBUG_RODATA
        bool "Write protect kernel read-only data structures"
        depends on DEBUG_KERNEL
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 09a3eb743315..ce4de61ed85d 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-git12
-# Mon Jan 16 13:09:08 2006
+# Linux kernel version: 2.6.16-rc3-git9
+# Sat Feb 18 00:27:03 2006
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -21,7 +21,6 @@ CONFIG_DMI=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -267,6 +266,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -310,6 +310,11 @@ CONFIG_IPV6=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -319,11 +324,6 @@ CONFIG_IPV6=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-
-#
-# TIPC Configuration (EXPERIMENTAL)
-#
-# CONFIG_TIPC is not set
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
@@ -446,7 +446,6 @@ CONFIG_BLK_DEV_PIIX=y
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
 CONFIG_BLK_DEV_PDC202XX_NEW=y
-# CONFIG_PDC202XX_FORCE is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
 # CONFIG_BLK_DEV_SIS5513 is not set
@@ -573,7 +572,33 @@ CONFIG_FUSION_MAX_SGE=128
 #
 # IEEE 1394 (FireWire) support
 #
-# CONFIG_IEEE1394 is not set
+CONFIG_IEEE1394=y
+
+#
+# Subsystem Options
+#
+# CONFIG_IEEE1394_VERBOSEDEBUG is not set
+# CONFIG_IEEE1394_OUI_DB is not set
+# CONFIG_IEEE1394_EXTRA_CONFIG_ROMS is not set
+# CONFIG_IEEE1394_EXPORT_FULL_API is not set
+
+#
+# Device Drivers
+#
+
+#
+# Texas Instruments PCILynx requires I2C
+#
+CONFIG_IEEE1394_OHCI1394=y
+
+#
+# Protocol Drivers
+#
+# CONFIG_IEEE1394_VIDEO1394 is not set
+# CONFIG_IEEE1394_SBP2 is not set
+# CONFIG_IEEE1394_ETH1394 is not set
+# CONFIG_IEEE1394_DV1394 is not set
+CONFIG_IEEE1394_RAWIO=y
 
 #
 # I2O device support
@@ -772,6 +797,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -871,6 +897,7 @@ CONFIG_HPET_MMAP=y
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_HDAPS is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
@@ -1098,6 +1125,11 @@ CONFIG_USB_MON=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+# CONFIG_EDAC is not set
+
+#
 # Firmware Drivers
 #
 # CONFIG_EDD is not set
@@ -1291,7 +1323,6 @@ CONFIG_DEBUG_FS=y
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_FORCED_INLINING is not set
 # CONFIG_RCU_TORTURE_TEST is not set
-CONFIG_INIT_DEBUG=y
 # CONFIG_DEBUG_RODATA is not set
 # CONFIG_IOMMU_DEBUG is not set
 
diff --git a/arch/x86_64/ia32/ia32entry.S b/arch/x86_64/ia32/ia32entry.S
index 067c0f47bd0d..00dee176c08e 100644
--- a/arch/x86_64/ia32/ia32entry.S
+++ b/arch/x86_64/ia32/ia32entry.S
@@ -677,7 +677,7 @@ ia32_sys_call_table:
         .quad sys_mknodat
         .quad sys_fchownat
         .quad compat_sys_futimesat
-        .quad compat_sys_newfstatat     /* 300 */
+        .quad sys32_fstatat             /* 300 */
         .quad sys_unlinkat
         .quad sys_renameat
         .quad sys_linkat
@@ -685,6 +685,9 @@ ia32_sys_call_table:
         .quad sys_readlinkat            /* 305 */
         .quad sys_fchmodat
         .quad sys_faccessat
+        .quad sys_ni_syscall            /* pselect6 for now */
+        .quad sys_ni_syscall            /* ppoll for now */
+        .quad sys_unshare               /* 310 */
 ia32_syscall_end:               
         .rept IA32_NR_syscalls-(ia32_syscall_end-ia32_sys_call_table)/8
                 .quad ni_syscall
diff --git a/arch/x86_64/ia32/sys_ia32.c b/arch/x86_64/ia32/sys_ia32.c
index 54481af5344a..2bc55af95419 100644
--- a/arch/x86_64/ia32/sys_ia32.c
+++ b/arch/x86_64/ia32/sys_ia32.c
@@ -180,6 +180,28 @@ sys32_fstat64(unsigned int fd, struct stat64 __user *statbuf)
         return ret;
 }
 
+asmlinkage long
+sys32_fstatat(unsigned int dfd, char __user *filename,
+              struct stat64 __user* statbuf, int flag)
+{
+        struct kstat stat;
+        int error = -EINVAL;
+
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
+
+        if (flag & AT_SYMLINK_NOFOLLOW)
+                error = vfs_lstat_fd(dfd, filename, &stat);
+        else
+                error = vfs_stat_fd(dfd, filename, &stat);
+
+        if (!error)
+                error = cp_stat64(statbuf, &stat);
+
+out:
+        return error;
+}
+
 /*
  * Linux/i386 didn't use to be able to handle more than
  * 4 system call parameters, so these system calls used a memory
diff --git a/arch/x86_64/kernel/Makefile b/arch/x86_64/kernel/Makefile
index 72fe60c20d39..a098a11e7755 100644
--- a/arch/x86_64/kernel/Makefile
+++ b/arch/x86_64/kernel/Makefile
@@ -43,7 +43,7 @@ CFLAGS_vsyscall.o		:= $(PROFILING) -g0
 
 bootflag-y                      += ../../i386/kernel/bootflag.o
 cpuid-$(subst m,y,$(CONFIG_X86_CPUID))  += ../../i386/kernel/cpuid.o
-topology-y                     += ../../i386/mach-default/topology.o
+topology-y                     += ../../i386/kernel/topology.o
 microcode-$(subst m,y,$(CONFIG_MICROCODE))  += ../../i386/kernel/microcode.o
 intel_cacheinfo-y               += ../../i386/kernel/cpu/intel_cacheinfo.o
 quirks-y                        += ../../i386/kernel/quirks.o
diff --git a/arch/x86_64/kernel/aperture.c b/arch/x86_64/kernel/aperture.c
index e4e2b7d01f89..a0f955b9995f 100644
--- a/arch/x86_64/kernel/aperture.c
+++ b/arch/x86_64/kernel/aperture.c
@@ -248,7 +248,7 @@ void __init iommu_hole_init(void)
                 /* Got the aperture from the AGP bridge */
         } else if (swiotlb && !valid_agp) {
                 /* Do nothing */
-        } else if ((!no_iommu && end_pfn >= MAX_DMA32_PFN) ||
+        } else if ((!no_iommu && end_pfn > MAX_DMA32_PFN) ||
                    force_iommu ||
                    valid_agp ||
                    fallback_aper_force) { 
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index 5d3c5b07b8db..e5b14c57eaa0 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -35,8 +35,12 @@
 #include <asm/mach_apic.h>
 #include <asm/nmi.h>
 #include <asm/idle.h>
+#include <asm/proto.h>
+#include <asm/timex.h>
 
 int apic_verbosity;
+int apic_runs_main_timer;
+int apic_calibrate_pmtmr __initdata;
 
 int disable_apic_timer __initdata;
 
@@ -68,6 +72,26 @@ int get_maxlvt(void)
         return maxlvt;
 }
 
+/*
+ * 'what should we do if we get a hw irq event on an illegal vector'.
+ * each architecture has to answer this themselves.
+ */
+void ack_bad_irq(unsigned int irq)
+{
+        printk("unexpected IRQ trap at vector %02x\n", irq);
+        /*
+         * Currently unexpected vectors happen only on SMP and APIC.
+         * We _must_ ack these because every local APIC has only N
+         * irq slots per priority level, and a 'hanging, unacked' IRQ
+         * holds up an irq slot - in excessive cases (when multiple
+         * unexpected vectors occur) that might lock up the APIC
+         * completely.
+         * But don't ack when the APIC is disabled. -AK
+         */
+        if (!disable_apic)
+                ack_APIC_irq();
+}
+
 void clear_local_APIC(void)
 {
         int maxlvt;
@@ -684,7 +708,7 @@ static void setup_APIC_timer(unsigned int clocks)
         local_irq_save(flags);
 
         /* wait for irq slice */
-        if (vxtime.hpet_address) {
+        if (vxtime.hpet_address && hpet_use_timer) {
                 int trigger = hpet_readl(HPET_T0_CMP);
                 while (hpet_readl(HPET_COUNTER) >= trigger)
                         /* do nothing */ ;
@@ -702,9 +726,17 @@ static void setup_APIC_timer(unsigned int clocks)
                         c2 |= inb_p(0x40) << 8;
                 } while (c2 - c1 < 300);
         }
-
         __setup_APIC_LVTT(clocks);
-
+        /* Turn off PIT interrupt if we use APIC timer as main timer.
+           Only works with the PM timer right now
+           TBD fix it for HPET too. */
+        if (vxtime.mode == VXTIME_PMTMR &&
+                smp_processor_id() == boot_cpu_id &&
+                apic_runs_main_timer == 1 &&
+                !cpu_isset(boot_cpu_id, timer_interrupt_broadcast_ipi_mask)) {
+                stop_timer_interrupt();
+                apic_runs_main_timer++;
+        }
         local_irq_restore(flags);
 }
 
@@ -735,14 +767,27 @@ static int __init calibrate_APIC_clock(void)
         __setup_APIC_LVTT(1000000000);
 
         apic_start = apic_read(APIC_TMCCT);
-        rdtscl(tsc_start);
-
-        do {
+#ifdef CONFIG_X86_PM_TIMER
+        if (apic_calibrate_pmtmr && pmtmr_ioport) {
+                pmtimer_wait(5000);  /* 5ms wait */
                 apic = apic_read(APIC_TMCCT);
-                rdtscl(tsc);
-        } while ((tsc - tsc_start) < TICK_COUNT && (apic - apic_start) < TICK_COUNT);
+                result = (apic_start - apic) * 1000L / 5;
+        } else
+#endif
+        {
+                rdtscl(tsc_start);
+
+                do {
+                        apic = apic_read(APIC_TMCCT);
+                        rdtscl(tsc);
+                } while ((tsc - tsc_start) < TICK_COUNT &&
+                                (apic - apic_start) < TICK_COUNT);
+
+                result = (apic_start - apic) * 1000L * cpu_khz /
+                                        (tsc - tsc_start);
+        }
+        printk("result %d\n", result);
 
-        result = (apic_start - apic) * 1000L * cpu_khz / (tsc - tsc_start);
 
         printk(KERN_INFO "Detected %d.%03d MHz APIC timer.\n",
                 result / 1000 / 1000, result / 1000 % 1000);
@@ -872,6 +917,8 @@ void smp_local_timer_interrupt(struct pt_regs *regs)
 #ifdef CONFIG_SMP
         update_process_times(user_mode(regs));
 #endif
+        if (apic_runs_main_timer > 1 && smp_processor_id() == boot_cpu_id)
+                main_timer_handler(regs);
         /*
          * We take the 'long' return path, and there every subsystem
          * grabs the appropriate locks (kernel lock/ irq lock).
@@ -924,7 +971,7 @@ void smp_apic_timer_interrupt(struct pt_regs *regs)
  * multi-chassis. Use available data to take a good guess.
  * If in doubt, go HPET.
  */
-__init int oem_force_hpet_timer(void)
+__cpuinit int oem_force_hpet_timer(void)
 {
         int i, clusters, zeros;
         unsigned id;
@@ -1081,10 +1128,35 @@ static __init int setup_nolapic(char *str)
 
 static __init int setup_noapictimer(char *str) 
 { 
+        if (str[0] != ' ' && str[0] != 0)
+                return -1;
         disable_apic_timer = 1;
         return 0;
 } 
 
+static __init int setup_apicmaintimer(char *str)
+{
+        apic_runs_main_timer = 1;
+        nohpet = 1;
+        return 0;
+}
+__setup("apicmaintimer", setup_apicmaintimer);
+
+static __init int setup_noapicmaintimer(char *str)
+{
+        apic_runs_main_timer = -1;
+        return 0;
+}
+__setup("noapicmaintimer", setup_noapicmaintimer);
+
+static __init int setup_apicpmtimer(char *s)
+{
+        apic_calibrate_pmtmr = 1;
+        notsc_setup(NULL);
+        return setup_apicmaintimer(NULL);
+}
+__setup("apicpmtimer", setup_apicpmtimer);
+
 /* dummy parsing: see setup.c */
 
 __setup("disableapic", setup_disableapic); 
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index dbdba56e8faa..7c10e9009d61 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -499,7 +499,9 @@ ENTRY(stub_rt_sigreturn)
         movq %gs:pda_irqstackptr,%rax
         cmoveq %rax,%rsp /*todo This needs CFI annotation! */
         pushq %rdi                      # save old stack        
+#ifndef CONFIG_DEBUG_INFO
         CFI_ADJUST_CFA_OFFSET   8
+#endif
         call \func
         .endm
 
@@ -509,7 +511,9 @@ ENTRY(common_interrupt)
         /* 0(%rsp): oldrsp-ARGOFFSET */
 ret_from_intr:
         popq  %rdi
+#ifndef CONFIG_DEBUG_INFO
         CFI_ADJUST_CFA_OFFSET   -8
+#endif
         cli     
         decl %gs:pda_irqcount
 #ifdef CONFIG_DEBUG_INFO
@@ -550,6 +554,7 @@ iret_label:
         /* running with kernel gs */
 bad_iret:
         movq $-9999,%rdi        /* better code? */
+        sti
         jmp do_exit                     
         .previous       
         
@@ -922,7 +927,7 @@ KPROBE_ENTRY(debug)
         .previous .text
 
         /* runs on exception stack */   
-ENTRY(nmi)
+KPROBE_ENTRY(nmi)
         INTR_FRAME
         pushq $-1
         CFI_ADJUST_CFA_OFFSET 8
@@ -969,6 +974,7 @@ paranoid_schedule:
         cli
         jmp paranoid_userspace
         CFI_ENDPROC
+        .previous .text
 
 KPROBE_ENTRY(int3)
         INTR_FRAME
diff --git a/arch/x86_64/kernel/head.S b/arch/x86_64/kernel/head.S
index 692c737feddb..02fc7fa0ea28 100644
--- a/arch/x86_64/kernel/head.S
+++ b/arch/x86_64/kernel/head.S
@@ -213,6 +213,11 @@ ENTRY(early_idt_handler)
         cmpl $2,early_recursion_flag(%rip)
         jz  1f
         call dump_stack
+#ifdef CONFIG_KALLSYMS  
+        leaq early_idt_ripmsg(%rip),%rdi
+        movq 8(%rsp),%rsi       # get rip again
+        call __print_symbol
+#endif
 1:      hlt
         jmp 1b
 early_recursion_flag:
@@ -220,6 +225,8 @@ early_recursion_flag:
 
 early_idt_msg:
         .asciz "PANIC: early exception rip %lx error %lx cr2 %lx\n"
+early_idt_ripmsg:
+        .asciz "RIP %s\n"
 
 .code32
 ENTRY(no_long_mode)
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 1a5060b434b8..ffed464e6b12 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -30,6 +30,9 @@
 #include <linux/mc146818rtc.h>
 #include <linux/acpi.h>
 #include <linux/sysdev.h>
+#ifdef CONFIG_ACPI
+#include <acpi/acpi_bus.h>
+#endif
 
 #include <asm/io.h>
 #include <asm/smp.h>
@@ -47,6 +50,8 @@ static int no_timer_check;
 
 int disable_timer_pin_1 __initdata;
 
+int timer_over_8254 __initdata = 1;
+
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
@@ -248,6 +253,20 @@ static int __init enable_ioapic_setup(char *str)
 __setup("noapic", disable_ioapic_setup);
 __setup("apic", enable_ioapic_setup);
 
+static int __init setup_disable_8254_timer(char *s)
+{
+        timer_over_8254 = -1;
+        return 1;
+}
+static int __init setup_enable_8254_timer(char *s)
+{
+        timer_over_8254 = 2;
+        return 1;
+}
+
+__setup("disable_8254_timer", setup_disable_8254_timer);
+__setup("enable_8254_timer", setup_enable_8254_timer);
+
 #include <asm/pci-direct.h>
 #include <linux/pci_ids.h>
 #include <linux/pci.h>
@@ -260,6 +279,8 @@ __setup("apic", enable_ioapic_setup);
 
    And another hack to disable the IOMMU on VIA chipsets.
 
+   ... and others. Really should move this somewhere else.
+
    Kludge-O-Rama. */
 void __init check_ioapic(void) 
 { 
@@ -304,8 +325,20 @@ void __init check_ioapic(void)
 #endif
                                         /* RED-PEN skip them on mptables too? */
                                         return;
+
+                                /* This should be actually default, but
+                                   for 2.6.16 let's do it for ATI only where
+                                   it's really needed. */
+                                case PCI_VENDOR_ID_ATI:
+                                        if (timer_over_8254 == 1) {     
+                                                timer_over_8254 = 0;    
+                                        printk(KERN_INFO
+                "ATI board detected. Disabling timer routing over 8254.\n");
+                                        }       
+                                        return;
                                 } 
 
+
                                 /* No multi-function device? */
                                 type = read_pci_config_byte(num,slot,func,
                                                             PCI_HEADER_TYPE);
@@ -1749,6 +1782,8 @@ static inline void unlock_ExtINT_logic(void)
  * a wide range of boards and BIOS bugs.  Fortunately only the timer IRQ
  * is so screwy.  Thanks to Brian Perkins for testing/hacking this beast
  * fanatically on his truly buggy board.
+ *
+ * FIXME: really need to revamp this for modern platforms only.
  */
 static inline void check_timer(void)
 {
@@ -1771,7 +1806,8 @@ static inline void check_timer(void)
          */
         apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
         init_8259A(1);
-        enable_8259A_irq(0);
+        if (timer_over_8254 > 0)
+                enable_8259A_irq(0);
 
         pin1  = find_isa_irq_pin(0, mp_INT);
         apic1 = find_isa_irq_apic(0, mp_INT);
@@ -1826,7 +1862,7 @@ static inline void check_timer(void)
         }
         printk(" failed.\n");
 
-        if (nmi_watchdog) {
+        if (nmi_watchdog == NMI_IO_APIC) {
                 printk(KERN_WARNING "timer doesn't work through the IO-APIC - disabling NMI Watchdog!\n");
                 nmi_watchdog = 0;
         }
diff --git a/arch/x86_64/kernel/machine_kexec.c b/arch/x86_64/kernel/machine_kexec.c
index 89fab51e20f4..25ac8a3faae6 100644
--- a/arch/x86_64/kernel/machine_kexec.c
+++ b/arch/x86_64/kernel/machine_kexec.c
@@ -140,7 +140,7 @@ static void load_segments(void)
                 "\tmovl %0,%%ss\n"
                 "\tmovl %0,%%fs\n"
                 "\tmovl %0,%%gs\n"
-                : : "a" (__KERNEL_DS)
+                : : "a" (__KERNEL_DS) : "memory"
                 );
 }
 
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 13a2eada6c95..b8b9529fa89e 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -380,7 +380,7 @@ static void __cpuinit mce_cpu_features(struct cpuinfo_x86 *c)
  */
 void __cpuinit mcheck_init(struct cpuinfo_x86 *c)
 {
-        static cpumask_t mce_cpus __initdata = CPU_MASK_NONE;
+        static cpumask_t mce_cpus = CPU_MASK_NONE;
 
         mce_cpu_quirks(c); 
 
diff --git a/arch/x86_64/kernel/mpparse.c b/arch/x86_64/kernel/mpparse.c
index dc49bfb6db0a..9013a90b5c2e 100644
--- a/arch/x86_64/kernel/mpparse.c
+++ b/arch/x86_64/kernel/mpparse.c
@@ -288,9 +288,9 @@ static int __init smp_read_mpc(struct mp_config_table *mpc)
 
         memcpy(str,mpc->mpc_productid,12);
         str[12]=0;
-        printk(KERN_INFO "Product ID: %s ",str);
+        printk("Product ID: %s ",str);
 
-        printk(KERN_INFO "APIC at: 0x%X\n",mpc->mpc_lapic);
+        printk("APIC at: 0x%X\n",mpc->mpc_lapic);
 
         /* save the local APIC address, it might be non-default */
         if (!acpi_lapic)
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 5fae6f0cd994..5bf17e41cd2d 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -24,6 +24,7 @@
 #include <linux/sysdev.h>
 #include <linux/nmi.h>
 #include <linux/sysctl.h>
+#include <linux/kprobes.h>
 
 #include <asm/smp.h>
 #include <asm/mtrr.h>
@@ -235,6 +236,7 @@ static void enable_lapic_nmi_watchdog(void)
 {
         if (nmi_active < 0) {
                 nmi_watchdog = NMI_LOCAL_APIC;
+                touch_nmi_watchdog();
                 setup_apic_nmi_watchdog();
         }
 }
@@ -455,20 +457,22 @@ static DEFINE_PER_CPU(int, nmi_touch);
 
 void touch_nmi_watchdog (void)
 {
-        int i;
+        if (nmi_watchdog > 0) {
+                unsigned cpu;
 
-        /*
-         * Tell other CPUs to reset their alert counters. We cannot
-         * do it ourselves because the alert count increase is not
-         * atomic.
-         */
-        for (i = 0; i < NR_CPUS; i++)
-                per_cpu(nmi_touch, i) = 1;
+                /*
+                 * Tell other CPUs to reset their alert counters. We cannot
+                 * do it ourselves because the alert count increase is not
+                 * atomic.
+                 */
+                for_each_present_cpu (cpu)
+                        per_cpu(nmi_touch, cpu) = 1;
+        }
 
         touch_softlockup_watchdog();
 }
 
-void nmi_watchdog_tick (struct pt_regs * regs, unsigned reason)
+void __kprobes nmi_watchdog_tick(struct pt_regs * regs, unsigned reason)
 {
         int sum;
         int touched = 0;
@@ -512,14 +516,14 @@ void nmi_watchdog_tick (struct pt_regs * regs, unsigned reason)
         }
 }
 
-static int dummy_nmi_callback(struct pt_regs * regs, int cpu)
+static __kprobes int dummy_nmi_callback(struct pt_regs * regs, int cpu)
 {
         return 0;
 }
  
 static nmi_callback_t nmi_callback = dummy_nmi_callback;
  
-asmlinkage void do_nmi(struct pt_regs * regs, long error_code)
+asmlinkage __kprobes void do_nmi(struct pt_regs * regs, long error_code)
 {
         int cpu = safe_smp_processor_id();
 
diff --git a/arch/x86_64/kernel/pci-dma.c b/arch/x86_64/kernel/pci-dma.c
index 2f5d8328e2b9..4ed391edd47a 100644
--- a/arch/x86_64/kernel/pci-dma.c
+++ b/arch/x86_64/kernel/pci-dma.c
@@ -107,6 +107,9 @@ dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
                                 goto again;
                         }
 
+                        /* Let low level make its own zone decisions */
+                        gfp &= ~(GFP_DMA32|GFP_DMA);
+
                         if (dma_ops->alloc_coherent)
                                 return dma_ops->alloc_coherent(dev, size,
                                                            dma_handle, gfp);
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index c37fc7726ba6..0c3f052ba6ce 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -228,11 +228,6 @@ static inline int need_iommu(struct device *dev, unsigned long addr, size_t size
         int mmu = high;
         if (force_iommu) 
                 mmu = 1; 
-        if (no_iommu) { 
-                if (high) 
-                        panic("PCI-DMA: high address but no IOMMU.\n"); 
-                mmu = 0; 
-        }       
         return mmu; 
 }
 
@@ -241,11 +236,6 @@ static inline int nonforced_iommu(struct device *dev, unsigned long addr, size_t
         u64 mask = *dev->dma_mask;
         int high = addr + size >= mask;
         int mmu = high;
-        if (no_iommu) { 
-                if (high) 
-                        panic("PCI-DMA: high address but no IOMMU.\n"); 
-                mmu = 0; 
-        }       
         return mmu; 
 }
 
@@ -379,7 +369,7 @@ static int __dma_map_cont(struct scatterlist *sg, int start, int stopat,
                         SET_LEAK(iommu_page);
                         addr += PAGE_SIZE;
                         iommu_page++;
-        } 
+                }
         } 
         BUG_ON(iommu_page - iommu_start != pages);      
         return 0;
@@ -457,9 +447,12 @@ int gart_map_sg(struct device *dev, struct scatterlist *sg, int nents, int dir)
 error:
         flush_gart(NULL);
         gart_unmap_sg(dev, sg, nents, dir);
-        /* When it was forced try again unforced */
-        if (force_iommu) 
-                return dma_map_sg_nonforce(dev, sg, nents, dir);
+        /* When it was forced or merged try again in a dumb way */
+        if (force_iommu || iommu_merge) {
+                out = dma_map_sg_nonforce(dev, sg, nents, dir);
+                if (out > 0)
+                        return out;
+        }
         if (panic_on_overflow)
                 panic("dma_map_sg: overflow on %lu pages\n", pages);
         iommu_full(dev, pages << PAGE_SHIFT, dir);
@@ -631,20 +624,25 @@ static int __init pci_iommu_init(void)
                 (agp_copy_info(agp_bridge, &info) < 0);
 #endif  
 
-        if (swiotlb) { 
-                no_iommu = 1;
+        if (swiotlb)
                 return -1; 
-        } 
-        
+
         if (no_iommu ||
             (!force_iommu && end_pfn <= MAX_DMA32_PFN) ||
             !iommu_aperture ||
             (no_agp && init_k8_gatt(&info) < 0)) {
-                no_iommu = 1;
-                no_iommu_init();
+                printk(KERN_INFO "PCI-DMA: Disabling IOMMU.\n");
+                if (end_pfn > MAX_DMA32_PFN) {
+                        printk(KERN_ERR "WARNING more than 4GB of memory "
+                                        "but IOMMU not compiled in.\n"
+                               KERN_ERR "WARNING 32bit PCI may malfunction.\n"
+                               KERN_ERR "You might want to enable "
+                                        "CONFIG_GART_IOMMU\n");
+                }
                 return -1;
         }
 
+        printk(KERN_INFO "PCI-DMA: using GART IOMMU.\n");
         aper_size = info.aper_size * 1024 * 1024;       
         iommu_size = check_iommu_size(info.aper_base, aper_size); 
         iommu_pages = iommu_size >> PAGE_SHIFT; 
@@ -718,7 +716,6 @@ static int __init pci_iommu_init(void)
                      
         flush_gart(NULL);
 
-        printk(KERN_INFO "PCI-DMA: using GART IOMMU.\n");
         dma_ops = &gart_dma_ops;
 
         return 0;
diff --git a/arch/x86_64/kernel/pci-nommu.c b/arch/x86_64/kernel/pci-nommu.c
index e41564975195..44adcc2d5e5b 100644
--- a/arch/x86_64/kernel/pci-nommu.c
+++ b/arch/x86_64/kernel/pci-nommu.c
@@ -88,12 +88,5 @@ void __init no_iommu_init(void)
 {
         if (dma_ops)
                 return;
-        printk(KERN_INFO "PCI-DMA: Disabling IOMMU.\n");
         dma_ops = &nommu_dma_ops;
-        if (end_pfn > MAX_DMA32_PFN) {
-                printk(KERN_ERR
-                       "WARNING more than 4GB of memory but IOMMU not compiled in.\n"
-                       KERN_ERR "WARNING 32bit PCI may malfunction.\n"
-                       KERN_ERR "You might want to enable CONFIG_GART_IOMMU\n");
-        }
 }
diff --git a/arch/x86_64/kernel/pci-swiotlb.c b/arch/x86_64/kernel/pci-swiotlb.c
index 3569a25ad7fb..990ed67896f2 100644
--- a/arch/x86_64/kernel/pci-swiotlb.c
+++ b/arch/x86_64/kernel/pci-swiotlb.c
@@ -35,8 +35,8 @@ void pci_swiotlb_init(void)
             (end_pfn > MAX_DMA32_PFN || force_iommu))
                swiotlb = 1;
         if (swiotlb) {
-                swiotlb_init();
                 printk(KERN_INFO "PCI-DMA: Using software bounce buffering for IO (SWIOTLB)\n");
+                swiotlb_init();
                 dma_ops = &swiotlb_dma_ops;
         }
 }
diff --git a/arch/x86_64/kernel/pmtimer.c b/arch/x86_64/kernel/pmtimer.c
index feb5f108dd26..5c51d10408a6 100644
--- a/arch/x86_64/kernel/pmtimer.c
+++ b/arch/x86_64/kernel/pmtimer.c
@@ -80,6 +80,31 @@ int pmtimer_mark_offset(void)
         return lost - 1;
 }
 
+static unsigned pmtimer_wait_tick(void)
+{
+        u32 a, b;
+        for (a = b = inl(pmtmr_ioport) & ACPI_PM_MASK;
+             a == b;
+             b = inl(pmtmr_ioport) & ACPI_PM_MASK)
+                ;
+        return b;
+}
+
+/* note: wait time is rounded up to one tick */
+void pmtimer_wait(unsigned us)
+{
+        u32 a, b;
+        a = pmtimer_wait_tick();
+        do {
+                b = inl(pmtmr_ioport);
+        } while (cyc2us(b - a) < us);
+}
+
+void pmtimer_resume(void)
+{
+        last_pmtmr_tick = inl(pmtmr_ioport);
+}
+
 unsigned int do_gettimeoffset_pm(void)
 {
         u32 now, offset, delta = 0;
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 8ded407e4a94..22a05dec81a2 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -516,8 +516,10 @@ out:
  * This could still be optimized: 
  * - fold all the options into a flag word and test it with a single test.
  * - could test fs/gs bitsliced
+ *
+ * Kprobes not supported here. Set the probe on schedule instead.
  */
-struct task_struct *
+__kprobes struct task_struct *
 __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
 {
         struct thread_struct *prev = &prev_p->thread,
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 28895c03cb11..aa55e3cec665 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -94,7 +94,6 @@ unsigned long saved_video_mode;
 /*
  * Setup options
  */
-struct drive_info_struct { char dummy[32]; } drive_info;
 struct screen_info screen_info;
 struct sys_desc_table_struct {
         unsigned short length;
@@ -424,6 +423,12 @@ static __init void parse_cmdline_early (char ** cmdline_p)
                 else if(!memcmp(from, "elfcorehdr=", 11))
                         elfcorehdr_addr = memparse(from+11, &from);
 #endif
+
+#ifdef CONFIG_HOTPLUG_CPU
+                else if (!memcmp(from, "additional_cpus=", 16))
+                        setup_additional_cpus(from+16);
+#endif
+
         next_char:
                 c = *(from++);
                 if (!c)
@@ -572,7 +577,6 @@ void __init setup_arch(char **cmdline_p)
         unsigned long kernel_end;
 
         ROOT_DEV = old_decode_dev(ORIG_ROOT_DEV);
-        drive_info = DRIVE_INFO;
         screen_info = SCREEN_INFO;
         edid_info = EDID_INFO;
         saved_video_mode = SAVED_VIDEO_MODE;
@@ -741,7 +745,7 @@ void __init setup_arch(char **cmdline_p)
         e820_setup_gap();
 
 #ifdef CONFIG_GART_IOMMU
-       iommu_hole_init();
+        iommu_hole_init();
 #endif
 
 #ifdef CONFIG_VT
@@ -877,6 +881,7 @@ static void __init amd_detect_cmp(struct cpuinfo_x86 *c)
 static int __init init_amd(struct cpuinfo_x86 *c)
 {
         int r;
+        unsigned level;
 
 #ifdef CONFIG_SMP
         unsigned long value;
@@ -899,6 +904,11 @@ static int __init init_amd(struct cpuinfo_x86 *c)
            3DNow is IDd by bit 31 in extended CPUID (1*32+31) anyway */
         clear_bit(0*32+31, &c->x86_capability);
         
+        /* On C+ stepping K8 rep microcode works well for copy/memset */
+        level = cpuid_eax(1);
+        if (c->x86 == 15 && ((level >= 0x0f48 && level < 0x0f50) || level >= 0x0f58))
+                set_bit(X86_FEATURE_REP_GOOD, &c->x86_capability);
+
         r = get_model_name(c);
         if (!r) { 
                 switch (c->x86) { 
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index a28756ef7cef..66e98659d077 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -59,6 +59,7 @@
 #include <asm/nmi.h>
 #include <asm/irq.h>
 #include <asm/hw_irq.h>
+#include <asm/numa.h>
 
 /* Number of siblings per CPU package */
 int smp_num_siblings = 1;
@@ -890,6 +891,7 @@ do_rest:
         if (boot_error) {
                 cpu_clear(cpu, cpu_callout_map); /* was set here (do_boot_cpu()) */
                 clear_bit(cpu, &cpu_initialized); /* was set by cpu_init() */
+                clear_node_cpumask(cpu); /* was set by numa_add_cpu */
                 cpu_clear(cpu, cpu_present_map);
                 cpu_clear(cpu, cpu_possible_map);
                 x86_cpu_to_apicid[cpu] = BAD_APICID;
@@ -1150,8 +1152,6 @@ void __init smp_cpus_done(unsigned int max_cpus)
         setup_ioapic_dest();
 #endif
 
-        time_init_gtod();
-
         check_nmi_watchdog();
 }
 
@@ -1187,6 +1187,7 @@ void remove_cpu_from_maps(void)
         cpu_clear(cpu, cpu_callout_map);
         cpu_clear(cpu, cpu_callin_map);
         clear_bit(cpu, &cpu_initialized); /* was set by cpu_init() */
+        clear_node_cpumask(cpu);
 }
 
 int __cpu_disable(void)
@@ -1241,7 +1242,7 @@ void __cpu_die(unsigned int cpu)
         printk(KERN_ERR "CPU %u didn't die...\n", cpu);
 }
 
-static __init int setup_additional_cpus(char *s)
+__init int setup_additional_cpus(char *s)
 {
         return get_option(&s, &additional_cpus);
 }
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index f8c47c688443..3080f84bf7b7 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -48,10 +48,12 @@ static void cpufreq_delayed_get(void);
 extern void i8254_timer_resume(void);
 extern int using_apic_timer;
 
+static char *time_init_gtod(void);
+
 DEFINE_SPINLOCK(rtc_lock);
 DEFINE_SPINLOCK(i8253_lock);
 
-static int nohpet __initdata = 0;
+int nohpet __initdata = 0;
 static int notsc __initdata = 0;
 
 #undef HPET_HACK_ENABLE_DANGEROUS
@@ -59,7 +61,7 @@ static int notsc __initdata = 0;
 unsigned int cpu_khz;                                   /* TSC clocks / usec, not used here */
 static unsigned long hpet_period;                       /* fsecs / HPET clock */
 unsigned long hpet_tick;                                /* HPET clocks / interrupt */
-static int hpet_use_timer;                              /* Use counter of hpet for time keeping, otherwise PIT */
+int hpet_use_timer;                             /* Use counter of hpet for time keeping, otherwise PIT */
 unsigned long vxtime_hz = PIT_TICK_RATE;
 int report_lost_ticks;                          /* command line option */
 unsigned long long monotonic_base;
@@ -326,7 +328,10 @@ static noinline void handle_lost_ticks(int lost, struct pt_regs *regs)
             print_symbol("rip %s\n", regs->rip);
             if (vxtime.mode == VXTIME_TSC && vxtime.hpet_address) {
                     printk(KERN_WARNING "Falling back to HPET\n");
-                    vxtime.last = hpet_readl(HPET_T0_CMP) - hpet_tick;
+                    if (hpet_use_timer)
+                        vxtime.last = hpet_readl(HPET_T0_CMP) - hpet_tick;
+                    else
+                        vxtime.last = hpet_readl(HPET_COUNTER);
                     vxtime.mode = VXTIME_HPET;
                     do_gettimeoffset = do_gettimeoffset_hpet;
             }
@@ -345,7 +350,7 @@ static noinline void handle_lost_ticks(int lost, struct pt_regs *regs)
 #endif
 }
 
-static irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+void main_timer_handler(struct pt_regs *regs)
 {
         static unsigned long rtc_update = 0;
         unsigned long tsc;
@@ -458,12 +463,17 @@ static irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         }
  
         write_sequnlock(&xtime_lock);
+}
 
+static irqreturn_t timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        if (apic_runs_main_timer > 1)
+                return IRQ_HANDLED;
+        main_timer_handler(regs);
 #ifdef CONFIG_X86_LOCAL_APIC
         if (using_apic_timer)
                 smp_send_timer_broadcast_ipi();
 #endif
-
         return IRQ_HANDLED;
 }
 
@@ -743,7 +753,7 @@ static __init int late_hpet_init(void)
          * Timer0 and Timer1 is used by platform.
          */
         hd.hd_phys_address = vxtime.hpet_address;
-        hd.hd_address = (void *)fix_to_virt(FIX_HPET_BASE);
+        hd.hd_address = (void __iomem *)fix_to_virt(FIX_HPET_BASE);
         hd.hd_nirqs = ntimer;
         hd.hd_flags = HPET_DATA_PLATFORM;
         hpet_reserve_timer(&hd, 0);
@@ -843,17 +853,43 @@ static int hpet_reenable(void)
         return hpet_timer_stop_set_go(hpet_tick);
 }
 
-void __init pit_init(void)
+#define PIT_MODE 0x43
+#define PIT_CH0  0x40
+
+static void __init __pit_init(int val, u8 mode)
 {
         unsigned long flags;
 
         spin_lock_irqsave(&i8253_lock, flags);
-        outb_p(0x34, 0x43);             /* binary, mode 2, LSB/MSB, ch 0 */
-        outb_p(LATCH & 0xff, 0x40);     /* LSB */
-        outb_p(LATCH >> 8, 0x40);       /* MSB */
+        outb_p(mode, PIT_MODE);
+        outb_p(val & 0xff, PIT_CH0);    /* LSB */
+        outb_p(val >> 8, PIT_CH0);      /* MSB */
         spin_unlock_irqrestore(&i8253_lock, flags);
 }
 
+void __init pit_init(void)
+{
+        __pit_init(LATCH, 0x34); /* binary, mode 2, LSB/MSB, ch 0 */
+}
+
+void __init pit_stop_interrupt(void)
+{
+        __pit_init(0, 0x30); /* mode 0 */
+}
+
+void __init stop_timer_interrupt(void)
+{
+        char *name;
+        if (vxtime.hpet_address) {
+                name = "HPET";
+                hpet_timer_stop_set_go(0);
+        } else {
+                name = "PIT";
+                pit_stop_interrupt();
+        }
+        printk(KERN_INFO "timer: %s interrupt stopped.\n", name);
+}
+
 int __init time_setup(char *str)
 {
         report_lost_ticks = 1;
@@ -867,6 +903,7 @@ static struct irqaction irq0 = {
 void __init time_init(void)
 {
         char *timename;
+        char *gtod;
 
 #ifdef HPET_HACK_ENABLE_DANGEROUS
         if (!vxtime.hpet_address) {
@@ -911,28 +948,26 @@ void __init time_init(void)
                 timename = "PIT";
         }
 
-        printk(KERN_INFO "time.c: Using %ld.%06ld MHz %s timer.\n",
-               vxtime_hz / 1000000, vxtime_hz % 1000000, timename);
+        vxtime.mode = VXTIME_TSC;
+        gtod = time_init_gtod();
+
+        printk(KERN_INFO "time.c: Using %ld.%06ld MHz WALL %s GTOD %s timer.\n",
+               vxtime_hz / 1000000, vxtime_hz % 1000000, timename, gtod);
         printk(KERN_INFO "time.c: Detected %d.%03d MHz processor.\n",
                 cpu_khz / 1000, cpu_khz % 1000);
-        vxtime.mode = VXTIME_TSC;
         vxtime.quot = (1000000L << 32) / vxtime_hz;
         vxtime.tsc_quot = (1000L << 32) / cpu_khz;
         vxtime.last_tsc = get_cycles_sync();
         setup_irq(0, &irq0);
 
         set_cyc2ns_scale(cpu_khz);
-
-#ifndef CONFIG_SMP
-        time_init_gtod();
-#endif
 }
 
 /*
  * Make an educated guess if the TSC is trustworthy and synchronized
  * over all CPUs.
  */
-__init int unsynchronized_tsc(void)
+__cpuinit int unsynchronized_tsc(void)
 {
 #ifdef CONFIG_SMP
         if (oem_force_hpet_timer())
@@ -947,9 +982,9 @@ __init int unsynchronized_tsc(void)
 }
 
 /*
- * Decide after all CPUs are booted what mode gettimeofday should use.
+ * Decide what mode gettimeofday should use.
  */
-void __init time_init_gtod(void)
+__init static char *time_init_gtod(void)
 {
         char *timetype;
 
@@ -957,7 +992,10 @@ void __init time_init_gtod(void)
                 notsc = 1;
         if (vxtime.hpet_address && notsc) {
                 timetype = hpet_use_timer ? "HPET" : "PIT/HPET";
-                vxtime.last = hpet_readl(HPET_T0_CMP) - hpet_tick;
+                if (hpet_use_timer)
+                        vxtime.last = hpet_readl(HPET_T0_CMP) - hpet_tick;
+                else
+                        vxtime.last = hpet_readl(HPET_COUNTER);
                 vxtime.mode = VXTIME_HPET;
                 do_gettimeoffset = do_gettimeoffset_hpet;
 #ifdef CONFIG_X86_PM_TIMER
@@ -974,8 +1012,7 @@ void __init time_init_gtod(void)
                 timetype = hpet_use_timer ? "HPET/TSC" : "PIT/TSC";
                 vxtime.mode = VXTIME_TSC;
         }
-
-        printk(KERN_INFO "time.c: Using %s based timekeeping.\n", timetype);
+        return timetype;
 }
 
 __setup("report_lost_ticks", time_setup);
@@ -1016,9 +1053,21 @@ static int timer_resume(struct sys_device *dev)
         write_seqlock_irqsave(&xtime_lock,flags);
         xtime.tv_sec = sec;
         xtime.tv_nsec = 0;
+        if (vxtime.mode == VXTIME_HPET) {
+                if (hpet_use_timer)
+                        vxtime.last = hpet_readl(HPET_T0_CMP) - hpet_tick;
+                else
+                        vxtime.last = hpet_readl(HPET_COUNTER);
+#ifdef CONFIG_X86_PM_TIMER
+        } else if (vxtime.mode == VXTIME_PMTMR) {
+                pmtimer_resume();
+#endif
+        } else
+                vxtime.last_tsc = get_cycles_sync();
         write_sequnlock_irqrestore(&xtime_lock,flags);
         jiffies += sleep_length;
         wall_jiffies += sleep_length;
+        monotonic_base += sleep_length * (NSEC_PER_SEC/HZ);
         touch_softlockup_watchdog();
         return 0;
 }
@@ -1278,8 +1327,7 @@ static int __init nohpet_setup(char *s)
 
 __setup("nohpet", nohpet_setup);
 
-
-static int __init notsc_setup(char *s)
+int __init notsc_setup(char *s)
 {
         notsc = 1;
         return 0;
diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
index 8bb0aeda78b9..28d50dc540e8 100644
--- a/arch/x86_64/kernel/traps.c
+++ b/arch/x86_64/kernel/traps.c
@@ -90,6 +90,20 @@ static inline void conditional_sti(struct pt_regs *regs)
                 local_irq_enable();
 }
 
+static inline void preempt_conditional_sti(struct pt_regs *regs)
+{
+        preempt_disable();
+        if (regs->eflags & X86_EFLAGS_IF)
+                local_irq_enable();
+}
+
+static inline void preempt_conditional_cli(struct pt_regs *regs)
+{
+        if (regs->eflags & X86_EFLAGS_IF)
+                local_irq_disable();
+        preempt_enable_no_resched();
+}
+
 static int kstack_depth_to_print = 10;
 
 #ifdef CONFIG_KALLSYMS
@@ -372,7 +386,7 @@ void out_of_line_bug(void)
 static DEFINE_SPINLOCK(die_lock);
 static int die_owner = -1;
 
-unsigned long oops_begin(void)
+unsigned __kprobes long oops_begin(void)
 {
         int cpu = safe_smp_processor_id();
         unsigned long flags;
@@ -391,7 +405,7 @@ unsigned long oops_begin(void)
         return flags;
 }
 
-void oops_end(unsigned long flags)
+void __kprobes oops_end(unsigned long flags)
 { 
         die_owner = -1;
         bust_spinlocks(0);
@@ -400,7 +414,7 @@ void oops_end(unsigned long flags)
                 panic("Oops");
 }
 
-void __die(const char * str, struct pt_regs * regs, long err)
+void __kprobes __die(const char * str, struct pt_regs * regs, long err)
 {
         static int die_counter;
         printk(KERN_EMERG "%s: %04lx [%u] ", str, err & 0xffff,++die_counter);
@@ -432,7 +446,7 @@ void die(const char * str, struct pt_regs * regs, long err)
         do_exit(SIGSEGV); 
 }
 
-void die_nmi(char *str, struct pt_regs *regs)
+void __kprobes die_nmi(char *str, struct pt_regs *regs)
 {
         unsigned long flags = oops_begin();
 
@@ -575,7 +589,8 @@ asmlinkage void __kprobes do_general_protection(struct pt_regs * regs,
         }
 }
 
-static void mem_parity_error(unsigned char reason, struct pt_regs * regs)
+static __kprobes void
+mem_parity_error(unsigned char reason, struct pt_regs * regs)
 {
         printk("Uhhuh. NMI received. Dazed and confused, but trying to continue\n");
         printk("You probably have a hardware problem with your RAM chips\n");
@@ -585,7 +600,8 @@ static void mem_parity_error(unsigned char reason, struct pt_regs * regs)
         outb(reason, 0x61);
 }
 
-static void io_check_error(unsigned char reason, struct pt_regs * regs)
+static __kprobes void
+io_check_error(unsigned char reason, struct pt_regs * regs)
 {
         printk("NMI: IOCK error (debug interrupt?)\n");
         show_registers(regs);
@@ -598,7 +614,8 @@ static void io_check_error(unsigned char reason, struct pt_regs * regs)
         outb(reason, 0x61);
 }
 
-static void unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
+static __kprobes void
+unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
 {       printk("Uhhuh. NMI received for unknown reason %02x.\n", reason);
         printk("Dazed and confused, but trying to continue\n");
         printk("Do you have a strange power saving mode enabled?\n");
@@ -606,7 +623,7 @@ static void unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
 
 /* Runs on IST stack. This code must keep interrupts off all the time.
    Nested NMIs are prevented by the CPU. */
-asmlinkage void default_do_nmi(struct pt_regs *regs)
+asmlinkage __kprobes void default_do_nmi(struct pt_regs *regs)
 {
         unsigned char reason = 0;
         int cpu;
@@ -658,7 +675,7 @@ asmlinkage void __kprobes do_int3(struct pt_regs * regs, long error_code)
 /* Help handler running on IST stack to switch back to user stack
    for scheduling or signal handling. The actual stack switch is done in
    entry.S */
-asmlinkage struct pt_regs *sync_regs(struct pt_regs *eregs)
+asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
 {
         struct pt_regs *regs = eregs;
         /* Did already sync */
@@ -690,7 +707,7 @@ asmlinkage void __kprobes do_debug(struct pt_regs * regs,
                                                 SIGTRAP) == NOTIFY_STOP)
                 return;
 
-        conditional_sti(regs);
+        preempt_conditional_sti(regs);
 
         /* Mask out spurious debug traps due to lazy DR7 setting */
         if (condition & (DR_TRAP0|DR_TRAP1|DR_TRAP2|DR_TRAP3)) {
@@ -735,11 +752,13 @@ asmlinkage void __kprobes do_debug(struct pt_regs * regs,
 
 clear_dr7:
         set_debugreg(0UL, 7);
+        preempt_conditional_cli(regs);
         return;
 
 clear_TF_reenable:
         set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
         regs->eflags &= ~TF_MASK;
+        preempt_conditional_cli(regs);
 }
 
 static int kernel_math_error(struct pt_regs *regs, const char *str, int trapnr)
diff --git a/arch/x86_64/kernel/vmlinux.lds.S b/arch/x86_64/kernel/vmlinux.lds.S
index b0eed1faf740..74db0062d4a2 100644
--- a/arch/x86_64/kernel/vmlinux.lds.S
+++ b/arch/x86_64/kernel/vmlinux.lds.S
@@ -172,13 +172,15 @@ SECTIONS
   . = ALIGN(4096);
   __initramfs_start = .;
   .init.ramfs : AT(ADDR(.init.ramfs) - LOAD_OFFSET) { *(.init.ramfs) }
-  __initramfs_end = .;  
-  . = ALIGN(32);
+  __initramfs_end = .;
+  /* temporary here to work around NR_CPUS. If you see this comment in 2.6.17+
+   complain */
+  . = ALIGN(4096);      
+  __init_end = .;       
+  . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
   __per_cpu_start = .;
   .data.percpu  : AT(ADDR(.data.percpu) - LOAD_OFFSET) { *(.data.percpu) }
   __per_cpu_end = .;
-  . = ALIGN(4096);
-  __init_end = .;
 
   . = ALIGN(4096);
   __nosave_begin = .;
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index b614d54d2ae4..3496abc8d372 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -39,11 +39,6 @@ extern void __write_lock_failed(rwlock_t *rw);
 extern void __read_lock_failed(rwlock_t *rw);
 #endif
 
-#if defined(CONFIG_BLK_DEV_IDE) || defined(CONFIG_BLK_DEV_HD) || defined(CONFIG_BLK_DEV_IDE_MODULE) || defined(CONFIG_BLK_DEV_HD_MODULE)
-extern struct drive_info_struct drive_info;
-EXPORT_SYMBOL(drive_info);
-#endif
-
 /* platform dependent support */
 EXPORT_SYMBOL(boot_cpu_data);
 //EXPORT_SYMBOL(dump_fpu);
diff --git a/arch/x86_64/lib/clear_page.S b/arch/x86_64/lib/clear_page.S
index 43d9fa136180..1f81b79b796c 100644
--- a/arch/x86_64/lib/clear_page.S
+++ b/arch/x86_64/lib/clear_page.S
@@ -5,8 +5,46 @@
         .globl clear_page
         .p2align 4
 clear_page:
+        xorl   %eax,%eax
+        movl   $4096/64,%ecx
+        .p2align 4
+.Lloop:
+        decl    %ecx
+#define PUT(x) movq %rax,x*8(%rdi)
+        movq %rax,(%rdi)
+        PUT(1)
+        PUT(2)
+        PUT(3)
+        PUT(4)
+        PUT(5)
+        PUT(6)
+        PUT(7)
+        leaq    64(%rdi),%rdi
+        jnz     .Lloop
+        nop
+        ret
+clear_page_end:
+
+        /* Some CPUs run faster using the string instructions.
+           It is also a lot simpler. Use this when possible */
+
+#include <asm/cpufeature.h>
+
+        .section .altinstructions,"a"
+        .align 8
+        .quad  clear_page
+        .quad  clear_page_c
+        .byte  X86_FEATURE_REP_GOOD
+        .byte  clear_page_end-clear_page
+        .byte  clear_page_c_end-clear_page_c
+        .previous
+
+        .section .altinstr_replacement,"ax"
+clear_page_c:
         movl $4096/8,%ecx
         xorl %eax,%eax
         rep 
         stosq
         ret
+clear_page_c_end:
+        .previous
diff --git a/arch/x86_64/lib/copy_page.S b/arch/x86_64/lib/copy_page.S
index 621a19769406..8fa19d96a7ee 100644
--- a/arch/x86_64/lib/copy_page.S
+++ b/arch/x86_64/lib/copy_page.S
@@ -8,7 +8,94 @@
         .globl copy_page
         .p2align 4
 copy_page:
+        subq    $3*8,%rsp
+        movq    %rbx,(%rsp)
+        movq    %r12,1*8(%rsp)
+        movq    %r13,2*8(%rsp)
+
+        movl    $(4096/64)-5,%ecx
+        .p2align 4
+.Loop64:
+        dec     %rcx
+
+        movq        (%rsi), %rax
+        movq      8 (%rsi), %rbx
+        movq     16 (%rsi), %rdx
+        movq     24 (%rsi), %r8
+        movq     32 (%rsi), %r9
+        movq     40 (%rsi), %r10
+        movq     48 (%rsi), %r11
+        movq     56 (%rsi), %r12
+
+        prefetcht0 5*64(%rsi)
+
+        movq     %rax,    (%rdi)
+        movq     %rbx,  8 (%rdi)
+        movq     %rdx, 16 (%rdi)
+        movq     %r8,  24 (%rdi)
+        movq     %r9,  32 (%rdi)
+        movq     %r10, 40 (%rdi)
+        movq     %r11, 48 (%rdi)
+        movq     %r12, 56 (%rdi)
+
+        leaq    64 (%rsi), %rsi
+        leaq    64 (%rdi), %rdi
+
+        jnz     .Loop64
+
+        movl    $5,%ecx
+        .p2align 4
+.Loop2:
+        decl   %ecx
+
+        movq        (%rsi), %rax
+        movq      8 (%rsi), %rbx
+        movq     16 (%rsi), %rdx
+        movq     24 (%rsi), %r8
+        movq     32 (%rsi), %r9
+        movq     40 (%rsi), %r10
+        movq     48 (%rsi), %r11
+        movq     56 (%rsi), %r12
+
+        movq     %rax,    (%rdi)
+        movq     %rbx,  8 (%rdi)
+        movq     %rdx, 16 (%rdi)
+        movq     %r8,  24 (%rdi)
+        movq     %r9,  32 (%rdi)
+        movq     %r10, 40 (%rdi)
+        movq     %r11, 48 (%rdi)
+        movq     %r12, 56 (%rdi)
+
+        leaq    64(%rdi),%rdi
+        leaq    64(%rsi),%rsi
+
+        jnz     .Loop2
+
+        movq    (%rsp),%rbx
+        movq    1*8(%rsp),%r12
+        movq    2*8(%rsp),%r13
+        addq    $3*8,%rsp
+        ret
+
+        /* Some CPUs run faster using the string copy instructions.
+           It is also a lot simpler. Use this when possible */
+
+#include <asm/cpufeature.h>
+
+        .section .altinstructions,"a"
+        .align 8
+        .quad  copy_page
+        .quad  copy_page_c
+        .byte  X86_FEATURE_REP_GOOD
+        .byte  copy_page_c_end-copy_page_c
+        .byte  copy_page_c_end-copy_page_c
+        .previous
+
+        .section .altinstr_replacement,"ax"
+copy_page_c:
         movl $4096/8,%ecx
         rep 
         movsq 
         ret
+copy_page_c_end:
+        .previous
diff --git a/arch/x86_64/lib/copy_user.S b/arch/x86_64/lib/copy_user.S
index 79422b6559c3..f64569b83b54 100644
--- a/arch/x86_64/lib/copy_user.S
+++ b/arch/x86_64/lib/copy_user.S
@@ -4,9 +4,12 @@
  * Functions to copy from and to user space.            
  */              
 
+#define FIX_ALIGNMENT 1
+
         #include <asm/current.h>
         #include <asm/asm-offsets.h>
         #include <asm/thread_info.h>
+        #include <asm/cpufeature.h>
 
 /* Standard copy_to_user with segment limit checking */         
         .globl copy_to_user
@@ -18,7 +21,23 @@ copy_to_user:
         jc  bad_to_user
         cmpq threadinfo_addr_limit(%rax),%rcx
         jae bad_to_user
-        jmp copy_user_generic
+2:
+        .byte 0xe9      /* 32bit jump */
+        .long .Lcug-1f
+1:
+
+        .section .altinstr_replacement,"ax"
+3:      .byte 0xe9                      /* replacement jmp with 8 bit immediate */
+        .long copy_user_generic_c-1b    /* offset */
+        .previous
+        .section .altinstructions,"a"
+        .align 8
+        .quad  2b
+        .quad  3b
+        .byte  X86_FEATURE_REP_GOOD
+        .byte  5
+        .byte  5
+        .previous
 
 /* Standard copy_from_user with segment limit checking */       
         .globl copy_from_user
@@ -53,44 +72,230 @@ bad_to_user:
  * rsi source
  * rdx count
  *
- * Only 4GB of copy is supported. This shouldn't be a problem
- * because the kernel normally only writes from/to page sized chunks
- * even if user space passed a longer buffer.
- * And more would be dangerous because both Intel and AMD have
- * errata with rep movsq > 4GB. If someone feels the need to fix
- * this please consider this.
- *
  * Output:              
  * eax uncopied bytes or 0 if successful.
  */
-
         .globl copy_user_generic
+        .p2align 4
 copy_user_generic:
+        .byte 0x66,0x66,0x90    /* 5 byte nop for replacement jump */
+        .byte 0x66,0x90
+1:
+        .section .altinstr_replacement,"ax"
+2:      .byte 0xe9                   /* near jump with 32bit immediate */
+        .long copy_user_generic_c-1b /* offset */
+        .previous
+        .section .altinstructions,"a"
+        .align 8
+        .quad  copy_user_generic
+        .quad  2b
+        .byte  X86_FEATURE_REP_GOOD
+        .byte  5
+        .byte  5
+        .previous
+.Lcug:
+        pushq %rbx
+        xorl %eax,%eax          /*zero for the exception handler */
+
+#ifdef FIX_ALIGNMENT
+        /* check for bad alignment of destination */
+        movl %edi,%ecx
+        andl $7,%ecx
+        jnz  .Lbad_alignment
+.Lafter_bad_alignment:
+#endif
+
+        movq %rdx,%rcx
+
+        movl $64,%ebx
+        shrq $6,%rdx
+        decq %rdx
+        js   .Lhandle_tail
+
+        .p2align 4
+.Lloop:
+.Ls1:   movq (%rsi),%r11
+.Ls2:   movq 1*8(%rsi),%r8
+.Ls3:   movq 2*8(%rsi),%r9
+.Ls4:   movq 3*8(%rsi),%r10
+.Ld1:   movq %r11,(%rdi)
+.Ld2:   movq %r8,1*8(%rdi)
+.Ld3:   movq %r9,2*8(%rdi)
+.Ld4:   movq %r10,3*8(%rdi)
+
+.Ls5:   movq 4*8(%rsi),%r11
+.Ls6:   movq 5*8(%rsi),%r8
+.Ls7:   movq 6*8(%rsi),%r9
+.Ls8:   movq 7*8(%rsi),%r10
+.Ld5:   movq %r11,4*8(%rdi)
+.Ld6:   movq %r8,5*8(%rdi)
+.Ld7:   movq %r9,6*8(%rdi)
+.Ld8:   movq %r10,7*8(%rdi)
+
+        decq %rdx
+
+        leaq 64(%rsi),%rsi
+        leaq 64(%rdi),%rdi
+
+        jns  .Lloop
+
+        .p2align 4
+.Lhandle_tail:
+        movl %ecx,%edx
+        andl $63,%ecx
+        shrl $3,%ecx
+        jz   .Lhandle_7
+        movl $8,%ebx
+        .p2align 4
+.Lloop_8:
+.Ls9:   movq (%rsi),%r8
+.Ld9:   movq %r8,(%rdi)
+        decl %ecx
+        leaq 8(%rdi),%rdi
+        leaq 8(%rsi),%rsi
+        jnz .Lloop_8
+
+.Lhandle_7:
+        movl %edx,%ecx
+        andl $7,%ecx
+        jz   .Lende
+        .p2align 4
+.Lloop_1:
+.Ls10:  movb (%rsi),%bl
+.Ld10:  movb %bl,(%rdi)
+        incq %rdi
+        incq %rsi
+        decl %ecx
+        jnz .Lloop_1
+
+.Lende:
+        popq %rbx
+        ret
+
+#ifdef FIX_ALIGNMENT
+        /* align destination */
+        .p2align 4
+.Lbad_alignment:
+        movl $8,%r9d
+        subl %ecx,%r9d
+        movl %r9d,%ecx
+        cmpq %r9,%rdx
+        jz   .Lhandle_7
+        js   .Lhandle_7
+.Lalign_1:
+.Ls11:  movb (%rsi),%bl
+.Ld11:  movb %bl,(%rdi)
+        incq %rsi
+        incq %rdi
+        decl %ecx
+        jnz .Lalign_1
+        subq %r9,%rdx
+        jmp .Lafter_bad_alignment
+#endif
+
+        /* table sorted by exception address */
+        .section __ex_table,"a"
+        .align 8
+        .quad .Ls1,.Ls1e
+        .quad .Ls2,.Ls2e
+        .quad .Ls3,.Ls3e
+        .quad .Ls4,.Ls4e
+        .quad .Ld1,.Ls1e
+        .quad .Ld2,.Ls2e
+        .quad .Ld3,.Ls3e
+        .quad .Ld4,.Ls4e
+        .quad .Ls5,.Ls5e
+        .quad .Ls6,.Ls6e
+        .quad .Ls7,.Ls7e
+        .quad .Ls8,.Ls8e
+        .quad .Ld5,.Ls5e
+        .quad .Ld6,.Ls6e
+        .quad .Ld7,.Ls7e
+        .quad .Ld8,.Ls8e
+        .quad .Ls9,.Le_quad
+        .quad .Ld9,.Le_quad
+        .quad .Ls10,.Le_byte
+        .quad .Ld10,.Le_byte
+#ifdef FIX_ALIGNMENT
+        .quad .Ls11,.Lzero_rest
+        .quad .Ld11,.Lzero_rest
+#endif
+        .quad .Le5,.Le_zero
+        .previous
+
+        /* compute 64-offset for main loop. 8 bytes accuracy with error on the
+           pessimistic side. this is gross. it would be better to fix the
+           interface. */
+        /* eax: zero, ebx: 64 */
+.Ls1e:  addl $8,%eax
+.Ls2e:  addl $8,%eax
+.Ls3e:  addl $8,%eax
+.Ls4e:  addl $8,%eax
+.Ls5e:  addl $8,%eax
+.Ls6e:  addl $8,%eax
+.Ls7e:  addl $8,%eax
+.Ls8e:  addl $8,%eax
+        addq %rbx,%rdi  /* +64 */
+        subq %rax,%rdi  /* correct destination with computed offset */
+
+        shlq $6,%rdx    /* loop counter * 64 (stride length) */
+        addq %rax,%rdx  /* add offset to loopcnt */
+        andl $63,%ecx   /* remaining bytes */
+        addq %rcx,%rdx  /* add them */
+        jmp .Lzero_rest
+
+        /* exception on quad word loop in tail handling */
+        /* ecx: loopcnt/8, %edx: length, rdi: correct */
+.Le_quad:
+        shll $3,%ecx
+        andl $7,%edx
+        addl %ecx,%edx
+        /* edx: bytes to zero, rdi: dest, eax:zero */
+.Lzero_rest:
+        movq %rdx,%rcx
+.Le_byte:
+        xorl %eax,%eax
+.Le5:   rep
+        stosb
+        /* when there is another exception while zeroing the rest just return */
+.Le_zero:
+        movq %rdx,%rax
+        jmp .Lende
+
+        /* Some CPUs run faster using the string copy instructions.
+           This is also a lot simpler. Use them when possible.
+           Patch in jmps to this code instead of copying it fully
+           to avoid unwanted aliasing in the exception tables. */
+
+ /* rdi destination
+  * rsi source
+  * rdx count
+  *
+  * Output:
+  * eax uncopied bytes or 0 if successfull.
+  *
+  * Only 4GB of copy is supported. This shouldn't be a problem
+  * because the kernel normally only writes from/to page sized chunks
+  * even if user space passed a longer buffer.
+  * And more would be dangerous because both Intel and AMD have
+  * errata with rep movsq > 4GB. If someone feels the need to fix
+  * this please consider this.
+   */
+copy_user_generic_c:
         movl %edx,%ecx
         shrl $3,%ecx
         andl $7,%edx    
-        jz   5f
 1:      rep 
         movsq 
         movl %edx,%ecx
-        xor %eax,%eax
 2:      rep
         movsb
+4:      movl %ecx,%eax
         ret
-        /* align here? */
-5:      xorl %eax,%eax
-6:      rep movsq
-        ret
-
-        .section .fixup,"ax"
 3:      lea (%rdx,%rcx,8),%rax
         ret
-4:      movl %ecx,%eax
-        ret
-        .previous
 
         .section __ex_table,"a"
         .quad 1b,3b
         .quad 2b,4b
-        .quad 6b,4b
         .previous
diff --git a/arch/x86_64/lib/memcpy.S b/arch/x86_64/lib/memcpy.S
index 92dd80544602..5554948b5554 100644
--- a/arch/x86_64/lib/memcpy.S
+++ b/arch/x86_64/lib/memcpy.S
@@ -11,8 +11,6 @@
  * 
  * Output:
  * rax original destination
- * 
- * TODO: check best memcpy for PSC
  */     
 
         .globl __memcpy
@@ -20,6 +18,95 @@
         .p2align 4
 __memcpy:
 memcpy:         
+        pushq %rbx
+        movq %rdi,%rax
+
+        movl %edx,%ecx
+        shrl $6,%ecx
+        jz .Lhandle_tail
+
+        .p2align 4
+.Lloop_64:
+        decl %ecx
+
+        movq (%rsi),%r11
+        movq 8(%rsi),%r8
+
+        movq %r11,(%rdi)
+        movq %r8,1*8(%rdi)
+
+        movq 2*8(%rsi),%r9
+        movq 3*8(%rsi),%r10
+
+        movq %r9,2*8(%rdi)
+        movq %r10,3*8(%rdi)
+
+        movq 4*8(%rsi),%r11
+        movq 5*8(%rsi),%r8
+
+        movq %r11,4*8(%rdi)
+        movq %r8,5*8(%rdi)
+
+        movq 6*8(%rsi),%r9
+        movq 7*8(%rsi),%r10
+
+        movq %r9,6*8(%rdi)
+        movq %r10,7*8(%rdi)
+
+        leaq 64(%rsi),%rsi
+        leaq 64(%rdi),%rdi
+        jnz  .Lloop_64
+
+.Lhandle_tail:
+        movl %edx,%ecx
+        andl $63,%ecx
+        shrl $3,%ecx
+        jz   .Lhandle_7
+        .p2align 4
+.Lloop_8:
+        decl %ecx
+        movq (%rsi),%r8
+        movq %r8,(%rdi)
+        leaq 8(%rdi),%rdi
+        leaq 8(%rsi),%rsi
+        jnz  .Lloop_8
+
+.Lhandle_7:
+        movl %edx,%ecx
+        andl $7,%ecx
+        jz .Lende
+        .p2align 4
+.Lloop_1:
+        movb (%rsi),%r8b
+        movb %r8b,(%rdi)
+        incq %rdi
+        incq %rsi
+        decl %ecx
+        jnz .Lloop_1
+
+.Lende:
+        popq %rbx
+        ret
+.Lfinal:
+
+        /* Some CPUs run faster using the string copy instructions.
+           It is also a lot simpler. Use this when possible */
+
+        .section .altinstructions,"a"
+        .align 8
+        .quad  memcpy
+        .quad  memcpy_c
+        .byte  X86_FEATURE_REP_GOOD
+        .byte  .Lfinal-memcpy
+        .byte  memcpy_c_end-memcpy_c
+        .previous
+
+        .section .altinstr_replacement,"ax"
+ /* rdi destination
+  * rsi source
+  * rdx count
+  */
+memcpy_c:
         movq %rdi,%rax
         movl %edx,%ecx
         shrl $3,%ecx
@@ -30,3 +117,5 @@ memcpy:
         rep
         movsb
         ret
+memcpy_c_end:
+        .previous
diff --git a/arch/x86_64/lib/memset.S b/arch/x86_64/lib/memset.S
index 2aa48f24ed1e..ad397f2c7de8 100644
--- a/arch/x86_64/lib/memset.S
+++ b/arch/x86_64/lib/memset.S
@@ -13,6 +13,98 @@
         .p2align 4
 memset: 
 __memset:
+        movq %rdi,%r10
+        movq %rdx,%r11
+
+        /* expand byte value  */
+        movzbl %sil,%ecx
+        movabs $0x0101010101010101,%rax
+        mul    %rcx             /* with rax, clobbers rdx */
+
+        /* align dst */
+        movl  %edi,%r9d
+        andl  $7,%r9d
+        jnz  .Lbad_alignment
+.Lafter_bad_alignment:
+
+        movl %r11d,%ecx
+        shrl $6,%ecx
+        jz       .Lhandle_tail
+
+        .p2align 4
+.Lloop_64:
+        decl   %ecx
+        movq  %rax,(%rdi)
+        movq  %rax,8(%rdi)
+        movq  %rax,16(%rdi)
+        movq  %rax,24(%rdi)
+        movq  %rax,32(%rdi)
+        movq  %rax,40(%rdi)
+        movq  %rax,48(%rdi)
+        movq  %rax,56(%rdi)
+        leaq  64(%rdi),%rdi
+        jnz    .Lloop_64
+
+        /* Handle tail in loops. The loops should be faster than hard
+           to predict jump tables. */
+        .p2align 4
+.Lhandle_tail:
+        movl    %r11d,%ecx
+        andl    $63&(~7),%ecx
+        jz              .Lhandle_7
+        shrl    $3,%ecx
+        .p2align 4
+.Lloop_8:
+        decl   %ecx
+        movq  %rax,(%rdi)
+        leaq  8(%rdi),%rdi
+        jnz    .Lloop_8
+
+.Lhandle_7:
+        movl    %r11d,%ecx
+        andl    $7,%ecx
+        jz      .Lende
+        .p2align 4
+.Lloop_1:
+        decl    %ecx
+        movb    %al,(%rdi)
+        leaq    1(%rdi),%rdi
+        jnz     .Lloop_1
+
+.Lende:
+        movq    %r10,%rax
+        ret
+
+.Lbad_alignment:
+        cmpq $7,%r11
+        jbe     .Lhandle_7
+        movq %rax,(%rdi)        /* unaligned store */
+        movq $8,%r8
+        subq %r9,%r8
+        addq %r8,%rdi
+        subq %r8,%r11
+        jmp .Lafter_bad_alignment
+
+        /* Some CPUs run faster using the string instructions.
+           It is also a lot simpler. Use this when possible */
+
+#include <asm/cpufeature.h>
+
+        .section .altinstructions,"a"
+        .align 8
+        .quad  memset
+        .quad  memset_c
+        .byte  X86_FEATURE_REP_GOOD
+        .byte  memset_c_end-memset_c
+        .byte  memset_c_end-memset_c
+        .previous
+
+        .section .altinstr_replacement,"ax"
+ /* rdi destination
+  * rsi value
+  * rdx count
+  */
+memset_c:
         movq %rdi,%r9
         movl %edx,%r8d
         andl $7,%r8d            
@@ -29,3 +121,5 @@ __memset:
         stosb
         movq %r9,%rax
         ret
+memset_c_end:
+        .previous
diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
index 26eac194064b..2e7c3c8ffe03 100644
--- a/arch/x86_64/mm/fault.c
+++ b/arch/x86_64/mm/fault.c
@@ -33,7 +33,6 @@
 #include <asm/proto.h>
 #include <asm/kdebug.h>
 #include <asm-generic/sections.h>
-#include <asm/kdebug.h>
 
 /* Page fault error code bits */
 #define PF_PROT (1<<0)          /* or no page found */
@@ -157,8 +156,8 @@ void dump_pagetable(unsigned long address)
 
         pgd = __va((unsigned long)pgd & PHYSICAL_PAGE_MASK); 
         pgd += pgd_index(address);
-        printk("PGD %lx ", pgd_val(*pgd));
         if (bad_address(pgd)) goto bad;
+        printk("PGD %lx ", pgd_val(*pgd));
         if (!pgd_present(*pgd)) goto ret; 
 
         pud = __pud_offset_k((pud_t *)pgd_page(*pgd), address);
diff --git a/arch/x86_64/mm/k8topology.c b/arch/x86_64/mm/k8topology.c
index a5663e0bb01c..dd60e71fdba6 100644
--- a/arch/x86_64/mm/k8topology.c
+++ b/arch/x86_64/mm/k8topology.c
@@ -155,7 +155,7 @@ int __init k8_scan_nodes(unsigned long start, unsigned long end)
         if (!found)
                 return -1; 
 
-        memnode_shift = compute_hash_shift(nodes, numnodes);
+        memnode_shift = compute_hash_shift(nodes, 8);
         if (memnode_shift < 0) { 
                 printk(KERN_ERR "No NUMA node hash function found. Contact maintainer\n"); 
                 return -1; 
diff --git a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
index 6ef9f9a76235..22e51beee8d3 100644
--- a/arch/x86_64/mm/numa.c
+++ b/arch/x86_64/mm/numa.c
@@ -351,7 +351,7 @@ void __init init_cpu_to_node(void)
                         continue;
                 if (apicid_to_node[apicid] == NUMA_NO_NODE)
                         continue;
-                cpu_to_node[i] = apicid_to_node[apicid];
+                numa_set_node(i,apicid_to_node[apicid]);
         }
 }
 
diff --git a/arch/x86_64/mm/srat.c b/arch/x86_64/mm/srat.c
index 8b7f85608fa8..482c25767369 100644
--- a/arch/x86_64/mm/srat.c
+++ b/arch/x86_64/mm/srat.c
@@ -26,6 +26,10 @@ static nodemask_t nodes_found __initdata;
 static struct node nodes[MAX_NUMNODES] __initdata;
 static u8 pxm2node[256] = { [0 ... 255] = 0xff };
 
+/* Too small nodes confuse the VM badly. Usually they result
+   from BIOS bugs. */
+#define NODE_MIN_SIZE (4*1024*1024)
+
 static int node_to_pxm(int n);
 
 int pxm_to_node(int pxm)
@@ -131,7 +135,12 @@ void __init
 acpi_numa_processor_affinity_init(struct acpi_table_processor_affinity *pa)
 {
         int pxm, node;
-        if (srat_disabled() || pa->flags.enabled == 0)
+        if (srat_disabled())
+                return;
+        if (pa->header.length != sizeof(struct acpi_table_processor_affinity)) {                bad_srat();
+                return;
+        }
+        if (pa->flags.enabled == 0)
                 return;
         pxm = pa->proximity_domain;
         node = setup_node(pxm);
@@ -155,8 +164,16 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
         int node, pxm;
         int i;
 
-        if (srat_disabled() || ma->flags.enabled == 0)
+        if (srat_disabled())
+                return;
+        if (ma->header.length != sizeof(struct acpi_table_memory_affinity)) {
+                bad_srat();
                 return;
+        }
+        if (ma->flags.enabled == 0)
+                return;
+        start = ma->base_addr_lo | ((u64)ma->base_addr_hi << 32);
+        end = start + (ma->length_lo | ((u64)ma->length_hi << 32));
         pxm = ma->proximity_domain;
         node = setup_node(pxm);
         if (node < 0) {
@@ -164,8 +181,6 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
                 bad_srat();
                 return;
         }
-        start = ma->base_addr_lo | ((u64)ma->base_addr_hi << 32);
-        end = start + (ma->length_lo | ((u64)ma->length_hi << 32));
         /* It is fine to add this area to the nodes data it will be used later*/
         if (ma->flags.hot_pluggable == 1)
                 printk(KERN_INFO "SRAT: hot plug zone found %lx - %lx \n",
@@ -213,7 +228,8 @@ static int nodes_cover_memory(void)
         }
 
         e820ram = end_pfn - e820_hole_size(0, end_pfn);
-        if (pxmram < e820ram) {
+        /* We seem to lose 3 pages somewhere. Allow a bit of slack. */
+        if ((long)(e820ram - pxmram) >= 1*1024*1024) {
                 printk(KERN_ERR
         "SRAT: PXMs only cover %luMB of your %luMB e820 RAM. Not used.\n",
                         (pxmram << PAGE_SHIFT) >> 20,
@@ -223,6 +239,16 @@ static int nodes_cover_memory(void)
         return 1;
 }
 
+static void unparse_node(int node)
+{
+        int i;
+        node_clear(node, nodes_parsed);
+        for (i = 0; i < MAX_LOCAL_APIC; i++) {
+                if (apicid_to_node[i] == node)
+                        apicid_to_node[i] = NUMA_NO_NODE;
+        }
+}
+
 void __init acpi_numa_arch_fixup(void) {}
 
 /* Use the information discovered above to actually set up the nodes. */
@@ -230,22 +256,22 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
 {
         int i;
 
-        if (acpi_numa <= 0)
-                return -1;
-
         /* First clean up the node list */
-        for_each_node_mask(i, nodes_parsed) {
+        for (i = 0; i < MAX_NUMNODES; i++) {
                 cutoff_node(i, start, end);
-                if (nodes[i].start == nodes[i].end)
-                        node_clear(i, nodes_parsed);
+                if ((nodes[i].end - nodes[i].start) < NODE_MIN_SIZE)
+                        unparse_node(i);
         }
 
+        if (acpi_numa <= 0)
+                return -1;
+
         if (!nodes_cover_memory()) {
                 bad_srat();
                 return -1;
         }
 
-        memnode_shift = compute_hash_shift(nodes, nodes_weight(nodes_parsed));
+        memnode_shift = compute_hash_shift(nodes, MAX_NUMNODES);
         if (memnode_shift < 0) {
                 printk(KERN_ERR
                      "SRAT: No NUMA node hash function found. Contact maintainer\n");
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index 00d4ddbf980c..18f371fe37f8 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -46,10 +46,10 @@ static char __iomem *get_virt(unsigned int seg, unsigned bus)
         if (pci_mmcfg_config_num == 1 &&
                 cfg->pci_segment_group_number == 0 &&
                 (cfg->start_bus_number | cfg->end_bus_number) == 0)
-                return cfg->base_address;
+                return pci_mmcfg_virt[0].virt;
 
         /* Fall back to type 0 */
-        return 0;
+        return NULL;
 }
 
 static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 7ee4a14ec3b1..e90ef5db8913 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -26,6 +26,10 @@ config GENERIC_HARDIRQS
         bool
         default y
 
+config RWSEM_GENERIC_SPINLOCK
+       bool
+       default y
+
 source "init/Kconfig"
 
 menu "Processor type and features"
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index f1f596644bfc..64a649eb883f 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -64,6 +64,9 @@ EXPORT_SYMBOL(init_task);
 
 struct task_struct *current_set[NR_CPUS] = {&init_task, };
 
+void (*pm_power_off)(void) = NULL;
+EXPORT_SYMBOL(pm_power_off);
+
 
 #if XCHAL_CP_NUM > 0
 
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 74fae2daf87e..c8dbe38c81c8 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -239,7 +239,6 @@ enum cfqq_state_flags {
         CFQ_CFQQ_FLAG_fifo_expire,
         CFQ_CFQQ_FLAG_idle_window,
         CFQ_CFQQ_FLAG_prio_changed,
-        CFQ_CFQQ_FLAG_expired,
 };
 
 #define CFQ_CFQQ_FNS(name)                                              \
@@ -264,7 +263,6 @@ CFQ_CFQQ_FNS(must_dispatch);
 CFQ_CFQQ_FNS(fifo_expire);
 CFQ_CFQQ_FNS(idle_window);
 CFQ_CFQQ_FNS(prio_changed);
-CFQ_CFQQ_FNS(expired);
 #undef CFQ_CFQQ_FNS
 
 enum cfq_rq_state_flags {
@@ -336,7 +334,7 @@ static struct request *cfq_find_rq_hash(struct cfq_data *cfqd, sector_t offset)
  */
 static inline void cfq_schedule_dispatch(struct cfq_data *cfqd)
 {
-        if (!cfqd->rq_in_driver && cfqd->busy_queues)
+        if (cfqd->busy_queues)
                 kblockd_schedule_work(&cfqd->unplug_work);
 }
 
@@ -736,13 +734,63 @@ __cfq_set_active_queue(struct cfq_data *cfqd, struct cfq_queue *cfqq)
                 cfqq->slice_left = 0;
                 cfq_clear_cfqq_must_alloc_slice(cfqq);
                 cfq_clear_cfqq_fifo_expire(cfqq);
-                cfq_clear_cfqq_expired(cfqq);
         }
 
         cfqd->active_queue = cfqq;
 }
 
 /*
+ * current cfqq expired its slice (or was too idle), select new one
+ */
+static void
+__cfq_slice_expired(struct cfq_data *cfqd, struct cfq_queue *cfqq,
+                    int preempted)
+{
+        unsigned long now = jiffies;
+
+        if (cfq_cfqq_wait_request(cfqq))
+                del_timer(&cfqd->idle_slice_timer);
+
+        if (!preempted && !cfq_cfqq_dispatched(cfqq)) {
+                cfqq->service_last = now;
+                cfq_schedule_dispatch(cfqd);
+        }
+
+        cfq_clear_cfqq_must_dispatch(cfqq);
+        cfq_clear_cfqq_wait_request(cfqq);
+
+        /*
+         * store what was left of this slice, if the queue idled out
+         * or was preempted
+         */
+        if (time_after(cfqq->slice_end, now))
+                cfqq->slice_left = cfqq->slice_end - now;
+        else
+                cfqq->slice_left = 0;
+
+        if (cfq_cfqq_on_rr(cfqq))
+                cfq_resort_rr_list(cfqq, preempted);
+
+        if (cfqq == cfqd->active_queue)
+                cfqd->active_queue = NULL;
+
+        if (cfqd->active_cic) {
+                put_io_context(cfqd->active_cic->ioc);
+                cfqd->active_cic = NULL;
+        }
+
+        cfqd->dispatch_slice = 0;
+}
+
+static inline void cfq_slice_expired(struct cfq_data *cfqd, int preempted)
+{
+        struct cfq_queue *cfqq = cfqd->active_queue;
+
+        if (cfqq)
+                __cfq_slice_expired(cfqd, cfqq, preempted);
+}
+
+/*
  * 0
  * 0,1
  * 0,1,2
@@ -801,16 +849,7 @@ static int cfq_get_next_prio_level(struct cfq_data *cfqd)
 
 static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd)
 {
-        struct cfq_queue *cfqq;
-
-        /*
-         * if current queue is expired but not done with its requests yet,
-         * wait for that to happen
-         */
-        if ((cfqq = cfqd->active_queue) != NULL) {
-                if (cfq_cfqq_expired(cfqq) && cfq_cfqq_dispatched(cfqq))
-                        return NULL;
-        }
+        struct cfq_queue *cfqq = NULL;
 
         /*
          * if current list is non-empty, grab first entry. if it is empty,
@@ -837,66 +876,11 @@ static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd)
         return cfqq;
 }
 
-/*
- * current cfqq expired its slice (or was too idle), select new one
- */
-static void
-__cfq_slice_expired(struct cfq_data *cfqd, struct cfq_queue *cfqq,
-                    int preempted)
-{
-        unsigned long now = jiffies;
-
-        if (cfq_cfqq_wait_request(cfqq))
-                del_timer(&cfqd->idle_slice_timer);
-
-        if (!preempted && !cfq_cfqq_dispatched(cfqq))
-                cfqq->service_last = now;
-
-        cfq_clear_cfqq_must_dispatch(cfqq);
-        cfq_clear_cfqq_wait_request(cfqq);
-
-        /*
-         * store what was left of this slice, if the queue idled out
-         * or was preempted
-         */
-        if (time_after(cfqq->slice_end, now))
-                cfqq->slice_left = cfqq->slice_end - now;
-        else
-                cfqq->slice_left = 0;
-
-        if (cfq_cfqq_on_rr(cfqq))
-                cfq_resort_rr_list(cfqq, preempted);
-
-        if (cfqq == cfqd->active_queue)
-                cfqd->active_queue = NULL;
-
-        if (cfqd->active_cic) {
-                put_io_context(cfqd->active_cic->ioc);
-                cfqd->active_cic = NULL;
-        }
-
-        cfqd->dispatch_slice = 0;
-}
-
-static inline void cfq_slice_expired(struct cfq_data *cfqd, int preempted)
-{
-        struct cfq_queue *cfqq = cfqd->active_queue;
-
-        if (cfqq) {
-                /*
-                 * use deferred expiry, if there are requests in progress as
-                 * not to disturb the slice of the next queue
-                 */
-                if (cfq_cfqq_dispatched(cfqq))
-                        cfq_mark_cfqq_expired(cfqq);
-                else
-                        __cfq_slice_expired(cfqd, cfqq, preempted);
-        }
-}
-
 static int cfq_arm_slice_timer(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 
 {
+        unsigned long sl;
+
         WARN_ON(!RB_EMPTY(&cfqq->sort_list));
         WARN_ON(cfqq != cfqd->active_queue);
 
@@ -916,13 +900,8 @@ static int cfq_arm_slice_timer(struct cfq_data *cfqd, struct cfq_queue *cfqq)
         cfq_mark_cfqq_must_dispatch(cfqq);
         cfq_mark_cfqq_wait_request(cfqq);
 
-        if (!timer_pending(&cfqd->idle_slice_timer)) {
-                unsigned long slice_left = min(cfqq->slice_end - 1, (unsigned long) cfqd->cfq_slice_idle);
-
-                cfqd->idle_slice_timer.expires = jiffies + slice_left;
-                add_timer(&cfqd->idle_slice_timer);
-        }
-
+        sl = min(cfqq->slice_end - 1, (unsigned long) cfqd->cfq_slice_idle);
+        mod_timer(&cfqd->idle_slice_timer, jiffies + sl);
         return 1;
 }
 
@@ -1006,9 +985,6 @@ static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
         if (!cfqq)
                 goto new_queue;
 
-        if (cfq_cfqq_expired(cfqq))
-                goto new_queue;
-
         /*
          * slice has expired
          */
@@ -1181,10 +1157,8 @@ static void cfq_put_queue(struct cfq_queue *cfqq)
         BUG_ON(cfqq->allocated[READ] + cfqq->allocated[WRITE]);
         BUG_ON(cfq_cfqq_on_rr(cfqq));
 
-        if (unlikely(cfqd->active_queue == cfqq)) {
+        if (unlikely(cfqd->active_queue == cfqq))
                 __cfq_slice_expired(cfqd, cfqq, 0);
-                cfq_schedule_dispatch(cfqd);
-        }
 
         cfq_put_cfqd(cfqq->cfqd);
 
@@ -1245,10 +1219,8 @@ static void cfq_exit_single_io_context(struct cfq_io_context *cic)
 
         spin_lock(q->queue_lock);
 
-        if (unlikely(cic->cfqq == cfqd->active_queue)) {
+        if (unlikely(cic->cfqq == cfqd->active_queue))
                 __cfq_slice_expired(cfqd, cic->cfqq, 0);
-                cfq_schedule_dispatch(cfqd);
-        }
 
         cfq_put_queue(cic->cfqq);
         cic->cfqq = NULL;
@@ -1715,10 +1687,7 @@ static void cfq_completed_request(request_queue_t *q, struct request *rq)
                         cfqq->service_last = now;
                         cfq_resort_rr_list(cfqq, 0);
                 }
-                if (cfq_cfqq_expired(cfqq)) {
-                        __cfq_slice_expired(cfqd, cfqq, 0);
-                        cfq_schedule_dispatch(cfqd);
-                }
+                cfq_schedule_dispatch(cfqd);
         }
 
         if (cfq_crq_is_sync(crq))
diff --git a/block/elevator.c b/block/elevator.c
index 96a61e029ce5..24b702d649a9 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -293,7 +293,7 @@ void elv_requeue_request(request_queue_t *q, struct request *rq)
 
         rq->flags &= ~REQ_STARTED;
 
-        __elv_add_request(q, rq, ELEVATOR_INSERT_REQUEUE, 0);
+        elv_insert(q, rq, ELEVATOR_INSERT_REQUEUE);
 }
 
 static void elv_drain_elevator(request_queue_t *q)
@@ -310,40 +310,11 @@ static void elv_drain_elevator(request_queue_t *q)
         }
 }
 
-void __elv_add_request(request_queue_t *q, struct request *rq, int where,
-                       int plug)
+void elv_insert(request_queue_t *q, struct request *rq, int where)
 {
         struct list_head *pos;
         unsigned ordseq;
 
-        if (q->ordcolor)
-                rq->flags |= REQ_ORDERED_COLOR;
-
-        if (rq->flags & (REQ_SOFTBARRIER | REQ_HARDBARRIER)) {
-                /*
-                 * toggle ordered color
-                 */
-                q->ordcolor ^= 1;
-
-                /*
-                 * barriers implicitly indicate back insertion
-                 */
-                if (where == ELEVATOR_INSERT_SORT)
-                        where = ELEVATOR_INSERT_BACK;
-
-                /*
-                 * this request is scheduling boundary, update end_sector
-                 */
-                if (blk_fs_request(rq)) {
-                        q->end_sector = rq_end_sector(rq);
-                        q->boundary_rq = rq;
-                }
-        } else if (!(rq->flags & REQ_ELVPRIV) && where == ELEVATOR_INSERT_SORT)
-                where = ELEVATOR_INSERT_BACK;
-
-        if (plug)
-                blk_plug_device(q);
-
         rq->q = q;
 
         switch (where) {
@@ -424,6 +395,42 @@ void __elv_add_request(request_queue_t *q, struct request *rq, int where,
         }
 }
 
+void __elv_add_request(request_queue_t *q, struct request *rq, int where,
+                       int plug)
+{
+        if (q->ordcolor)
+                rq->flags |= REQ_ORDERED_COLOR;
+
+        if (rq->flags & (REQ_SOFTBARRIER | REQ_HARDBARRIER)) {
+                /*
+                 * toggle ordered color
+                 */
+                if (blk_barrier_rq(rq))
+                        q->ordcolor ^= 1;
+
+                /*
+                 * barriers implicitly indicate back insertion
+                 */
+                if (where == ELEVATOR_INSERT_SORT)
+                        where = ELEVATOR_INSERT_BACK;
+
+                /*
+                 * this request is scheduling boundary, update
+                 * end_sector
+                 */
+                if (blk_fs_request(rq)) {
+                        q->end_sector = rq_end_sector(rq);
+                        q->boundary_rq = rq;
+                }
+        } else if (!(rq->flags & REQ_ELVPRIV) && where == ELEVATOR_INSERT_SORT)
+                where = ELEVATOR_INSERT_BACK;
+
+        if (plug)
+                blk_plug_device(q);
+
+        elv_insert(q, rq, where);
+}
+
 void elv_add_request(request_queue_t *q, struct request *rq, int where,
                      int plug)
 {
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index f9fc07efd2da..0ef2971a9e82 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -454,7 +454,7 @@ static void queue_flush(request_queue_t *q, unsigned which)
         rq->end_io = end_io;
         q->prepare_flush_fn(q, rq);
 
-        __elv_add_request(q, rq, ELEVATOR_INSERT_FRONT, 0);
+        elv_insert(q, rq, ELEVATOR_INSERT_FRONT);
 }
 
 static inline struct request *start_ordered(request_queue_t *q,
@@ -490,7 +490,7 @@ static inline struct request *start_ordered(request_queue_t *q,
         else
                 q->ordseq |= QUEUE_ORDSEQ_POSTFLUSH;
 
-        __elv_add_request(q, rq, ELEVATOR_INSERT_FRONT, 0);
+        elv_insert(q, rq, ELEVATOR_INSERT_FRONT);
 
         if (q->ordered & QUEUE_ORDERED_PREFLUSH) {
                 queue_flush(q, QUEUE_ORDERED_PREFLUSH);
@@ -508,7 +508,7 @@ static inline struct request *start_ordered(request_queue_t *q,
 
 int blk_do_ordered(request_queue_t *q, struct request **rqp)
 {
-        struct request *rq = *rqp, *allowed_rq;
+        struct request *rq = *rqp;
         int is_barrier = blk_fs_request(rq) && blk_barrier_rq(rq);
 
         if (!q->ordseq) {
@@ -532,32 +532,26 @@ int blk_do_ordered(request_queue_t *q, struct request **rqp)
                 }
         }
 
+        /*
+         * Ordered sequence in progress
+         */
+
+        /* Special requests are not subject to ordering rules. */
+        if (!blk_fs_request(rq) &&
+            rq != &q->pre_flush_rq && rq != &q->post_flush_rq)
+                return 1;
+
         if (q->ordered & QUEUE_ORDERED_TAG) {
+                /* Ordered by tag.  Blocking the next barrier is enough. */
                 if (is_barrier && rq != &q->bar_rq)
                         *rqp = NULL;
-                return 1;
-        }
-
-        switch (blk_ordered_cur_seq(q)) {
-        case QUEUE_ORDSEQ_PREFLUSH:
-                allowed_rq = &q->pre_flush_rq;
-                break;
-        case QUEUE_ORDSEQ_BAR:
-                allowed_rq = &q->bar_rq;
-                break;
-        case QUEUE_ORDSEQ_POSTFLUSH:
-                allowed_rq = &q->post_flush_rq;
-                break;
-        default:
-                allowed_rq = NULL;
-                break;
+        } else {
+                /* Ordered by draining.  Wait for turn. */
+                WARN_ON(blk_ordered_req_seq(rq) < blk_ordered_cur_seq(q));
+                if (blk_ordered_req_seq(rq) > blk_ordered_cur_seq(q))
+                        *rqp = NULL;
         }
 
-        if (rq != allowed_rq &&
-            (blk_fs_request(rq) || rq == &q->pre_flush_rq ||
-             rq == &q->post_flush_rq))
-                *rqp = NULL;
-
         return 1;
 }
 
@@ -631,26 +625,31 @@ static inline int ordered_bio_endio(struct request *rq, struct bio *bio,
  *    Different hardware can have different requirements as to what pages
  *    it can do I/O directly to. A low level driver can call
  *    blk_queue_bounce_limit to have lower memory pages allocated as bounce
- *    buffers for doing I/O to pages residing above @page. By default
- *    the block layer sets this to the highest numbered "low" memory page.
+ *    buffers for doing I/O to pages residing above @page.
  **/
 void blk_queue_bounce_limit(request_queue_t *q, u64 dma_addr)
 {
         unsigned long bounce_pfn = dma_addr >> PAGE_SHIFT;
-
-        /*
-         * set appropriate bounce gfp mask -- unfortunately we don't have a
-         * full 4GB zone, so we have to resort to low memory for any bounces.
-         * ISA has its own < 16MB zone.
-         */
-        if (bounce_pfn < blk_max_low_pfn) {
-                BUG_ON(dma_addr < BLK_BOUNCE_ISA);
+        int dma = 0;
+
+        q->bounce_gfp = GFP_NOIO;
+#if BITS_PER_LONG == 64
+        /* Assume anything <= 4GB can be handled by IOMMU.
+           Actually some IOMMUs can handle everything, but I don't
+           know of a way to test this here. */
+        if (bounce_pfn < (0xffffffff>>PAGE_SHIFT))
+                dma = 1;
+        q->bounce_pfn = max_low_pfn;
+#else
+        if (bounce_pfn < blk_max_low_pfn)
+                dma = 1;
+        q->bounce_pfn = bounce_pfn;
+#endif
+        if (dma) {
                 init_emergency_isa_pool();
                 q->bounce_gfp = GFP_NOIO | GFP_DMA;
-        } else
-                q->bounce_gfp = GFP_NOIO;
-
-        q->bounce_pfn = bounce_pfn;
+                q->bounce_pfn = bounce_pfn;
+        }
 }
 
 EXPORT_SYMBOL(blk_queue_bounce_limit);
@@ -3453,7 +3452,7 @@ int __init blk_dev_init(void)
         iocontext_cachep = kmem_cache_create("blkdev_ioc",
                         sizeof(struct io_context), 0, SLAB_PANIC, NULL, NULL);
 
-        for (i = 0; i < NR_CPUS; i++)
+        for_each_cpu(i)
                 INIT_LIST_HEAD(&per_cpu(blk_cpu_done, i));
 
         open_softirq(BLOCK_SOFTIRQ, blk_done_softirq, NULL);
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index cc72210687eb..24f7af9d0abc 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -310,6 +310,8 @@ static int sg_io(struct file *file, request_queue_t *q,
         if (!rq->timeout)
                 rq->timeout = BLK_DEFAULT_TIMEOUT;
 
+        rq->retries = 0;
+
         start_time = jiffies;
 
         /* ignore return value. All information is passed back to caller
@@ -427,6 +429,7 @@ static int sg_scsi_ioctl(struct file *file, request_queue_t *q,
         rq->data = buffer;
         rq->data_len = bytes;
         rq->flags |= REQ_BLOCK_PC;
+        rq->retries = 0;
 
         blk_execute_rq(q, bd_disk, rq, 0);
         err = rq->errors & 0xff;        /* only 8 bit SCSI status */
diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
index 47ac90e615f4..2953e2cc56f0 100644
--- a/crypto/scatterwalk.c
+++ b/crypto/scatterwalk.c
@@ -17,7 +17,6 @@
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
-#include <asm/bug.h>
 #include <asm/scatterlist.h>
 #include "internal.h"
 #include "scatterwalk.h"
diff --git a/drivers/Makefile b/drivers/Makefile
index 619dd964c51c..5c69b86db624 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -69,7 +69,7 @@ obj-$(CONFIG_EISA)		+= eisa/
 obj-$(CONFIG_CPU_FREQ)          += cpufreq/
 obj-$(CONFIG_MMC)               += mmc/
 obj-$(CONFIG_INFINIBAND)        += infiniband/
-obj-$(CONFIG_SGI_IOC4)          += sn/
+obj-$(CONFIG_SGI_SN)            += sn/
 obj-y                           += firmware/
 obj-$(CONFIG_CRYPTO)            += crypto/
 obj-$(CONFIG_SUPERH)            += sh/
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 0cce28c4025b..33e2ca847a26 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -247,7 +247,7 @@ config ACPI_CUSTOM_DSDT_FILE
           Enter the full path name to the file wich includes the AmlCode declaration.
 
 config ACPI_BLACKLIST_YEAR
-        int "Disable ACPI for systems before Jan 1st this year" if X86
+        int "Disable ACPI for systems before Jan 1st this year" if X86_32
         default 0
         help
           enter a 4-digit year, eg. 2001 to disable ACPI by default
@@ -285,9 +285,8 @@ config ACPI_SYSTEM
           dump your ACPI DSDT table using /proc/acpi/dsdt.
 
 config X86_PM_TIMER
-        bool "Power Management Timer Support"
+        bool "Power Management Timer Support" if EMBEDDED
         depends on X86
-        depends on !X86_64
         default y
         help
           The Power Management Timer is available on all ACPI-capable,
@@ -298,9 +297,8 @@ config X86_PM_TIMER
           voltage scaling, unlike the commonly used Time Stamp Counter
           (TSC) timing source.
 
-          So, if you see messages like 'Losing too many ticks!' in the
-          kernel logs, and/or you are using this on a notebook which
-          does not yet have an HPET, you should say "Y" here.
+          You should nearly always say Y here because many modern
+          systems require this timer. 
 
 config ACPI_CONTAINER
         tristate "ACPI0004,PNP0A05 and PNP0A06 Container Driver (EXPERIMENTAL)"
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index be2dae52f6fa..eb730a80952c 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -94,7 +94,9 @@ static int set_max_cstate(struct dmi_system_id *id)
         return 0;
 }
 
-static struct dmi_system_id __initdata processor_power_dmi_table[] = {
+/* Actually this shouldn't be __cpuinitdata, would be better to fix the
+   callers to only run once -AK */
+static struct dmi_system_id __cpuinitdata processor_power_dmi_table[] = {
         { set_max_cstate, "IBM ThinkPad R40e", {
           DMI_MATCH(DMI_BIOS_VENDOR,"IBM"),
           DMI_MATCH(DMI_BIOS_VERSION,"1SET60WW")}, (void *)1},
@@ -899,7 +901,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                 case ACPI_STATE_C3:
                         acpi_processor_power_verify_c3(pr, cx);
 #ifdef ARCH_APICTIMER_STOPS_ON_C3
-                        if (c->x86_vendor == X86_VENDOR_INTEL) {
+                        if (cx->valid && c->x86_vendor == X86_VENDOR_INTEL) {
                                 on_each_cpu(switch_APIC_timer_to_ipi,
                                                 &mask, 1, 1);
                         }
diff --git a/drivers/acpi/resources/rscalc.c b/drivers/acpi/resources/rscalc.c
index 7d6481d9fbec..4038dbfa63a0 100644
--- a/drivers/acpi/resources/rscalc.c
+++ b/drivers/acpi/resources/rscalc.c
@@ -391,8 +391,7 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                          * Ensure a 32-bit boundary for the structure
                          */
                         extra_struct_bytes =
-                            ACPI_ROUND_UP_to_32_bITS(resource_length) -
-                            resource_length;
+                            ACPI_ROUND_UP_to_32_bITS(resource_length);
                         break;
 
                 case ACPI_RESOURCE_NAME_END_TAG:
@@ -408,8 +407,7 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                          * Add vendor data and ensure a 32-bit boundary for the structure
                          */
                         extra_struct_bytes =
-                            ACPI_ROUND_UP_to_32_bITS(resource_length) -
-                            resource_length;
+                            ACPI_ROUND_UP_to_32_bITS(resource_length);
                         break;
 
                 case ACPI_RESOURCE_NAME_ADDRESS32:
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index 14f6a6201da3..05983a312d50 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -555,7 +555,7 @@ fore200e_pca_reset(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_pca_map(struct fore200e* fore200e)
 {
     DPRINTK(2, "device %s being mapped in memory\n", fore200e->name);
@@ -589,7 +589,7 @@ fore200e_pca_unmap(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_pca_configure(struct fore200e* fore200e)
 {
     struct pci_dev* pci_dev = (struct pci_dev*)fore200e->bus_dev;
@@ -2125,7 +2125,7 @@ fore200e_change_qos(struct atm_vcc* vcc,struct atm_qos* qos, int flags)
 }
     
 
-static int __init
+static int __devinit
 fore200e_irq_request(struct fore200e* fore200e)
 {
     if (request_irq(fore200e->irq, fore200e_interrupt, SA_SHIRQ, fore200e->name, fore200e->atm_dev) < 0) {
@@ -2148,7 +2148,7 @@ fore200e_irq_request(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_get_esi(struct fore200e* fore200e)
 {
     struct prom_data* prom = fore200e_kmalloc(sizeof(struct prom_data), GFP_KERNEL | GFP_DMA);
@@ -2180,7 +2180,7 @@ fore200e_get_esi(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_alloc_rx_buf(struct fore200e* fore200e)
 {
     int scheme, magn, nbr, size, i;
@@ -2245,7 +2245,7 @@ fore200e_alloc_rx_buf(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_init_bs_queue(struct fore200e* fore200e)
 {
     int scheme, magn, i;
@@ -2308,7 +2308,7 @@ fore200e_init_bs_queue(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_init_rx_queue(struct fore200e* fore200e)
 {
     struct host_rxq*     rxq =  &fore200e->host_rxq;
@@ -2368,7 +2368,7 @@ fore200e_init_rx_queue(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_init_tx_queue(struct fore200e* fore200e)
 {
     struct host_txq*     txq =  &fore200e->host_txq;
@@ -2431,7 +2431,7 @@ fore200e_init_tx_queue(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_init_cmd_queue(struct fore200e* fore200e)
 {
     struct host_cmdq*     cmdq =  &fore200e->host_cmdq;
@@ -2487,7 +2487,7 @@ fore200e_param_bs_queue(struct fore200e* fore200e,
 }
 
 
-static int __init
+static int __devinit
 fore200e_initialize(struct fore200e* fore200e)
 {
     struct cp_queues __iomem * cpq;
@@ -2539,7 +2539,7 @@ fore200e_initialize(struct fore200e* fore200e)
 }
 
 
-static void __init
+static void __devinit
 fore200e_monitor_putc(struct fore200e* fore200e, char c)
 {
     struct cp_monitor __iomem * monitor = fore200e->cp_monitor;
@@ -2551,7 +2551,7 @@ fore200e_monitor_putc(struct fore200e* fore200e, char c)
 }
 
 
-static int __init
+static int __devinit
 fore200e_monitor_getc(struct fore200e* fore200e)
 {
     struct cp_monitor __iomem * monitor = fore200e->cp_monitor;
@@ -2576,7 +2576,7 @@ fore200e_monitor_getc(struct fore200e* fore200e)
 }
 
 
-static void __init
+static void __devinit
 fore200e_monitor_puts(struct fore200e* fore200e, char* str)
 {
     while (*str) {
@@ -2591,7 +2591,7 @@ fore200e_monitor_puts(struct fore200e* fore200e, char* str)
 }
 
 
-static int __init
+static int __devinit
 fore200e_start_fw(struct fore200e* fore200e)
 {
     int               ok;
@@ -2622,7 +2622,7 @@ fore200e_start_fw(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_load_fw(struct fore200e* fore200e)
 {
     u32* fw_data = (u32*) fore200e->bus->fw_data;
@@ -2648,7 +2648,7 @@ fore200e_load_fw(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_register(struct fore200e* fore200e)
 {
     struct atm_dev* atm_dev;
@@ -2675,7 +2675,7 @@ fore200e_register(struct fore200e* fore200e)
 }
 
 
-static int __init
+static int __devinit
 fore200e_init(struct fore200e* fore200e)
 {
     if (fore200e_register(fore200e) < 0)
@@ -2721,7 +2721,7 @@ fore200e_init(struct fore200e* fore200e)
         return -EBUSY;
 
     fore200e_supply(fore200e);
-    
+
     /* all done, board initialization is now complete */
     fore200e->state = FORE200E_STATE_COMPLETE;
     return 0;
diff --git a/drivers/base/base.h b/drivers/base/base.h
index e3b548d46cff..5735b38582d0 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -19,6 +19,10 @@ extern void bus_remove_driver(struct device_driver *);
 extern void driver_detach(struct device_driver * drv);
 extern int driver_probe_device(struct device_driver *, struct device *);
 
+extern void sysdev_shutdown(void);
+extern int sysdev_suspend(pm_message_t state);
+extern int sysdev_resume(void);
+
 static inline struct class_device *to_class_dev(struct kobject *obj)
 {
         return container_of(obj, struct class_device, kobj);
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 29f6af554e71..c3141565d59d 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -133,6 +133,8 @@ static struct kobj_type ktype_bus = {
 decl_subsys(bus, &ktype_bus, NULL);
 
 
+#ifdef CONFIG_HOTPLUG
+
 /* Manually detach a device from its associated driver. */
 static int driver_helper(struct device *dev, void *data)
 {
@@ -193,6 +195,7 @@ static ssize_t driver_bind(struct device_driver *drv,
 }
 static DRIVER_ATTR(bind, S_IWUSR, NULL, driver_bind);
 
+#endif
 
 static struct device * next_device(struct klist_iter * i)
 {
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index d1a05224627e..105a0d61eb1f 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -303,7 +303,7 @@ static int block_size_init(void)
  */
 #ifdef CONFIG_ARCH_MEMORY_PROBE
 static ssize_t
-memory_probe_store(struct class *class, const char __user *buf, size_t count)
+memory_probe_store(struct class *class, const char *buf, size_t count)
 {
         u64 phys_addr;
         int ret;
diff --git a/drivers/base/power/resume.c b/drivers/base/power/resume.c
index 0a7aa07b9a2a..317edbf0feca 100644
--- a/drivers/base/power/resume.c
+++ b/drivers/base/power/resume.c
@@ -9,10 +9,9 @@
  */
 
 #include <linux/device.h>
+#include "../base.h"
 #include "power.h"
 
-extern int sysdev_resume(void);
-
 
 /**
  *      resume_device - Restore state for one device.
diff --git a/drivers/base/power/shutdown.c b/drivers/base/power/shutdown.c
index c2475f3134ea..8826a5b6673e 100644
--- a/drivers/base/power/shutdown.c
+++ b/drivers/base/power/shutdown.c
@@ -12,6 +12,7 @@
 #include <linux/device.h>
 #include <asm/semaphore.h>
 
+#include "../base.h"
 #include "power.h"
 
 #define to_dev(node) container_of(node, struct device, kobj.entry)
@@ -28,7 +29,6 @@ extern struct subsystem devices_subsys;
  * they only get one called once when interrupts are disabled.
  */
 
-extern int sysdev_shutdown(void);
 
 /**
  * device_shutdown - call ->shutdown() on each device to shutdown.
diff --git a/drivers/base/power/suspend.c b/drivers/base/power/suspend.c
index 50501764d050..8660779fb288 100644
--- a/drivers/base/power/suspend.c
+++ b/drivers/base/power/suspend.c
@@ -9,10 +9,9 @@
  */
 
 #include <linux/device.h>
+#include "../base.h"
 #include "power.h"
 
-extern int sysdev_suspend(pm_message_t state);
-
 /*
  * The entries in the dpm_active list are in a depth first order, simply
  * because children are guaranteed to be discovered after parents, and
diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
index f3a0c562bcb5..40d7242a07c1 100644
--- a/drivers/base/power/sysfs.c
+++ b/drivers/base/power/sysfs.c
@@ -27,22 +27,30 @@
 
 static ssize_t state_show(struct device * dev, struct device_attribute *attr, char * buf)
 {
-        return sprintf(buf, "%u\n", dev->power.power_state.event);
+        if (dev->power.power_state.event)
+                return sprintf(buf, "2\n");
+        else
+                return sprintf(buf, "0\n");
 }
 
 static ssize_t state_store(struct device * dev, struct device_attribute *attr, const char * buf, size_t n)
 {
         pm_message_t state;
-        char * rest;
-        int error = 0;
+        int error = -EINVAL;
 
-        state.event = simple_strtoul(buf, &rest, 10);
-        if (*rest)
-                return -EINVAL;
-        if (state.event)
+        state.event = PM_EVENT_SUSPEND;
+        /* Older apps expected to write "3" here - confused with PCI D3 */
+        if ((n == 1) && !strcmp(buf, "3"))
                 error = dpm_runtime_suspend(dev, state);
-        else
+
+        if ((n == 1) && !strcmp(buf, "2"))
+                error = dpm_runtime_suspend(dev, state);
+
+        if ((n == 1) && !strcmp(buf, "0")) {
                 dpm_runtime_resume(dev);
+                error = 0;
+        }
+
         return error ? error : n;
 }
 
diff --git a/drivers/base/sys.c b/drivers/base/sys.c
index 66ed8f2fece5..6fc23ab127bd 100644
--- a/drivers/base/sys.c
+++ b/drivers/base/sys.c
@@ -21,8 +21,11 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/pm.h>
+#include <linux/device.h>
 #include <asm/semaphore.h>
 
+#include "base.h"
+
 extern struct subsystem devices_subsys;
 
 #define to_sysdev(k) container_of(k, struct sys_device, kobj)
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index 6ede1f352c29..37b8cda3e8bc 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -41,6 +41,7 @@
 #include <linux/timer.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/random.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include "DAC960.h"
@@ -3463,7 +3464,7 @@ static inline boolean DAC960_ProcessCompletedRequest(DAC960_Command_T *Command,
                 Command->SegmentCount, Command->DmaDirection);
 
          if (!end_that_request_first(Request, UpToDate, Command->BlockCount)) {
-
+                add_disk_randomness(Request->rq_disk);
                 end_that_request_last(Request, UpToDate);
 
                 if (Command->Completion) {
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index 139cbba76180..8b1331677407 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -433,12 +433,12 @@ config CDROM_PKTCDVD_BUFFERS
           This controls the maximum number of active concurrent packets. More
           concurrent packets can increase write performance, but also require
           more memory. Each concurrent packet will require approximately 64Kb
-          of non-swappable kernel memory, memory which will be allocated at
-          pktsetup time.
+          of non-swappable kernel memory, memory which will be allocated when
+          a disc is opened for writing.
 
 config CDROM_PKTCDVD_WCACHE
-        bool "Enable write caching"
-        depends on CDROM_PKTCDVD
+        bool "Enable write caching (EXPERIMENTAL)"
+        depends on CDROM_PKTCDVD && EXPERIMENTAL
         help
           If enabled, write caching will be set for the CD-R/W device. For now
           this option is dangerous unless the CD-RW media is known good, as we
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 12d7b9bdfa93..0d65394707db 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -2183,6 +2183,7 @@ static void cciss_softirq_done(struct request *rq)
 {
         CommandList_struct *cmd = rq->completion_data;
         ctlr_info_t *h = hba[cmd->ctlr];
+        unsigned long flags;
         u64bit temp64;
         int i, ddir;
 
@@ -2205,10 +2206,10 @@ static void cciss_softirq_done(struct request *rq)
         printk("Done with %p\n", rq);
 #endif /* CCISS_DEBUG */ 
 
-        spin_lock_irq(&h->lock);
+        spin_lock_irqsave(&h->lock, flags);
         end_that_request_last(rq, rq->errors);
         cmd_free(h, cmd,1);
-        spin_unlock_irq(&h->lock);
+        spin_unlock_irqrestore(&h->lock, flags);
 }
 
 /* checks the status of the job and calls complete buffers to mark all 
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 93affeeef7bd..bc9b2bcd7dba 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -43,8 +43,6 @@
  *
  *************************************************************************/
 
-#define VERSION_CODE    "v0.2.0a 2004-07-14 Jens Axboe (axboe@suse.de) and petero2@telia.com"
-
 #include <linux/pktcdvd.h>
 #include <linux/config.h>
 #include <linux/module.h>
@@ -60,6 +58,7 @@
 #include <linux/suspend.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_ioctl.h>
+#include <scsi/scsi.h>
 
 #include <asm/uaccess.h>
 
@@ -131,7 +130,7 @@ static struct bio *pkt_bio_alloc(int nr_iovecs)
 /*
  * Allocate a packet_data struct
  */
-static struct packet_data *pkt_alloc_packet_data(void)
+static struct packet_data *pkt_alloc_packet_data(int frames)
 {
         int i;
         struct packet_data *pkt;
@@ -140,11 +139,12 @@ static struct packet_data *pkt_alloc_packet_data(void)
         if (!pkt)
                 goto no_pkt;
 
-        pkt->w_bio = pkt_bio_alloc(PACKET_MAX_SIZE);
+        pkt->frames = frames;
+        pkt->w_bio = pkt_bio_alloc(frames);
         if (!pkt->w_bio)
                 goto no_bio;
 
-        for (i = 0; i < PAGES_PER_PACKET; i++) {
+        for (i = 0; i < frames / FRAMES_PER_PAGE; i++) {
                 pkt->pages[i] = alloc_page(GFP_KERNEL|__GFP_ZERO);
                 if (!pkt->pages[i])
                         goto no_page;
@@ -152,7 +152,7 @@ static struct packet_data *pkt_alloc_packet_data(void)
 
         spin_lock_init(&pkt->lock);
 
-        for (i = 0; i < PACKET_MAX_SIZE; i++) {
+        for (i = 0; i < frames; i++) {
                 struct bio *bio = pkt_bio_alloc(1);
                 if (!bio)
                         goto no_rd_bio;
@@ -162,14 +162,14 @@ static struct packet_data *pkt_alloc_packet_data(void)
         return pkt;
 
 no_rd_bio:
-        for (i = 0; i < PACKET_MAX_SIZE; i++) {
+        for (i = 0; i < frames; i++) {
                 struct bio *bio = pkt->r_bios[i];
                 if (bio)
                         bio_put(bio);
         }
 
 no_page:
-        for (i = 0; i < PAGES_PER_PACKET; i++)
+        for (i = 0; i < frames / FRAMES_PER_PAGE; i++)
                 if (pkt->pages[i])
                         __free_page(pkt->pages[i]);
         bio_put(pkt->w_bio);
@@ -186,12 +186,12 @@ static void pkt_free_packet_data(struct packet_data *pkt)
 {
         int i;
 
-        for (i = 0; i < PACKET_MAX_SIZE; i++) {
+        for (i = 0; i < pkt->frames; i++) {
                 struct bio *bio = pkt->r_bios[i];
                 if (bio)
                         bio_put(bio);
         }
-        for (i = 0; i < PAGES_PER_PACKET; i++)
+        for (i = 0; i < pkt->frames / FRAMES_PER_PAGE; i++)
                 __free_page(pkt->pages[i]);
         bio_put(pkt->w_bio);
         kfree(pkt);
@@ -206,17 +206,17 @@ static void pkt_shrink_pktlist(struct pktcdvd_device *pd)
         list_for_each_entry_safe(pkt, next, &pd->cdrw.pkt_free_list, list) {
                 pkt_free_packet_data(pkt);
         }
+        INIT_LIST_HEAD(&pd->cdrw.pkt_free_list);
 }
 
 static int pkt_grow_pktlist(struct pktcdvd_device *pd, int nr_packets)
 {
         struct packet_data *pkt;
 
-        INIT_LIST_HEAD(&pd->cdrw.pkt_free_list);
-        INIT_LIST_HEAD(&pd->cdrw.pkt_active_list);
-        spin_lock_init(&pd->cdrw.active_list_lock);
+        BUG_ON(!list_empty(&pd->cdrw.pkt_free_list));
+
         while (nr_packets > 0) {
-                pkt = pkt_alloc_packet_data();
+                pkt = pkt_alloc_packet_data(pd->settings.size >> 2);
                 if (!pkt) {
                         pkt_shrink_pktlist(pd);
                         return 0;
@@ -381,6 +381,7 @@ static int pkt_generic_packet(struct pktcdvd_device *pd, struct packet_command *
         memcpy(rq->cmd, cgc->cmd, CDROM_PACKET_SIZE);
         if (sizeof(rq->cmd) > CDROM_PACKET_SIZE)
                 memset(rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd) - CDROM_PACKET_SIZE);
+        rq->cmd_len = COMMAND_SIZE(rq->cmd[0]);
 
         rq->ref_count++;
         rq->flags |= REQ_NOMERGE;
@@ -646,7 +647,7 @@ static void pkt_copy_bio_data(struct bio *src_bio, int seg, int offs, struct pag
  * b) The data can be used as cache to avoid read requests if we receive a
  *    new write request for the same zone.
  */
-static void pkt_make_local_copy(struct packet_data *pkt, struct page **pages, int *offsets)
+static void pkt_make_local_copy(struct packet_data *pkt, struct bio_vec *bvec)
 {
         int f, p, offs;
 
@@ -654,15 +655,15 @@ static void pkt_make_local_copy(struct packet_data *pkt, struct page **pages, in
         p = 0;
         offs = 0;
         for (f = 0; f < pkt->frames; f++) {
-                if (pages[f] != pkt->pages[p]) {
-                        void *vfrom = kmap_atomic(pages[f], KM_USER0) + offsets[f];
+                if (bvec[f].bv_page != pkt->pages[p]) {
+                        void *vfrom = kmap_atomic(bvec[f].bv_page, KM_USER0) + bvec[f].bv_offset;
                         void *vto = page_address(pkt->pages[p]) + offs;
                         memcpy(vto, vfrom, CD_FRAMESIZE);
                         kunmap_atomic(vfrom, KM_USER0);
-                        pages[f] = pkt->pages[p];
-                        offsets[f] = offs;
+                        bvec[f].bv_page = pkt->pages[p];
+                        bvec[f].bv_offset = offs;
                 } else {
-                        BUG_ON(offsets[f] != offs);
+                        BUG_ON(bvec[f].bv_offset != offs);
                 }
                 offs += CD_FRAMESIZE;
                 if (offs >= PAGE_SIZE) {
@@ -951,7 +952,7 @@ try_next_bio:
 
         pd->current_sector = zone + pd->settings.size;
         pkt->sector = zone;
-        pkt->frames = pd->settings.size >> 2;
+        BUG_ON(pkt->frames != pd->settings.size >> 2);
         pkt->write_size = 0;
 
         /*
@@ -992,18 +993,17 @@ try_next_bio:
 static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
 {
         struct bio *bio;
-        struct page *pages[PACKET_MAX_SIZE];
-        int offsets[PACKET_MAX_SIZE];
         int f;
         int frames_write;
+        struct bio_vec *bvec = pkt->w_bio->bi_io_vec;
 
         for (f = 0; f < pkt->frames; f++) {
-                pages[f] = pkt->pages[(f * CD_FRAMESIZE) / PAGE_SIZE];
-                offsets[f] = (f * CD_FRAMESIZE) % PAGE_SIZE;
+                bvec[f].bv_page = pkt->pages[(f * CD_FRAMESIZE) / PAGE_SIZE];
+                bvec[f].bv_offset = (f * CD_FRAMESIZE) % PAGE_SIZE;
         }
 
         /*
-         * Fill-in pages[] and offsets[] with data from orig_bios.
+         * Fill-in bvec with data from orig_bios.
          */
         frames_write = 0;
         spin_lock(&pkt->lock);
@@ -1025,11 +1025,11 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
                         }
 
                         if (src_bvl->bv_len - src_offs >= CD_FRAMESIZE) {
-                                pages[f] = src_bvl->bv_page;
-                                offsets[f] = src_bvl->bv_offset + src_offs;
+                                bvec[f].bv_page = src_bvl->bv_page;
+                                bvec[f].bv_offset = src_bvl->bv_offset + src_offs;
                         } else {
                                 pkt_copy_bio_data(bio, segment, src_offs,
-                                                  pages[f], offsets[f]);
+                                                  bvec[f].bv_page, bvec[f].bv_offset);
                         }
                         src_offs += CD_FRAMESIZE;
                         frames_write++;
@@ -1043,7 +1043,7 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
         BUG_ON(frames_write != pkt->write_size);
 
         if (test_bit(PACKET_MERGE_SEGS, &pd->flags) || (pkt->write_size < pkt->frames)) {
-                pkt_make_local_copy(pkt, pages, offsets);
+                pkt_make_local_copy(pkt, bvec);
                 pkt->cache_valid = 1;
         } else {
                 pkt->cache_valid = 0;
@@ -1056,17 +1056,9 @@ static void pkt_start_write(struct pktcdvd_device *pd, struct packet_data *pkt)
         pkt->w_bio->bi_bdev = pd->bdev;
         pkt->w_bio->bi_end_io = pkt_end_io_packet_write;
         pkt->w_bio->bi_private = pkt;
-        for (f = 0; f < pkt->frames; f++) {
-                if ((f + 1 < pkt->frames) && (pages[f + 1] == pages[f]) &&
-                    (offsets[f + 1] = offsets[f] + CD_FRAMESIZE)) {
-                        if (!bio_add_page(pkt->w_bio, pages[f], CD_FRAMESIZE * 2, offsets[f]))
-                                BUG();
-                        f++;
-                } else {
-                        if (!bio_add_page(pkt->w_bio, pages[f], CD_FRAMESIZE, offsets[f]))
-                                BUG();
-                }
-        }
+        for (f = 0; f < pkt->frames; f++)
+                if (!bio_add_page(pkt->w_bio, bvec[f].bv_page, CD_FRAMESIZE, bvec[f].bv_offset))
+                        BUG();
         VPRINTK("pktcdvd: vcnt=%d\n", pkt->w_bio->bi_vcnt);
 
         atomic_set(&pkt->io_wait, 1);
@@ -1505,40 +1497,42 @@ static int pkt_set_write_settings(struct pktcdvd_device *pd)
 }
 
 /*
- * 0 -- we can write to this track, 1 -- we can't
+ * 1 -- we can write to this track, 0 -- we can't
  */
-static int pkt_good_track(track_information *ti)
+static int pkt_writable_track(struct pktcdvd_device *pd, track_information *ti)
 {
-        /*
-         * only good for CD-RW at the moment, not DVD-RW
-         */
+        switch (pd->mmc3_profile) {
+                case 0x1a: /* DVD+RW */
+                case 0x12: /* DVD-RAM */
+                        /* The track is always writable on DVD+RW/DVD-RAM */
+                        return 1;
+                default:
+                        break;
+        }
 
-        /*
-         * FIXME: only for FP
-         */
-        if (ti->fp == 0)
+        if (!ti->packet || !ti->fp)
                 return 0;
 
         /*
          * "good" settings as per Mt Fuji.
          */
-        if (ti->rt == 0 && ti->blank == 0 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 0 && ti->blank == 0)
+                return 1;
 
-        if (ti->rt == 0 && ti->blank == 1 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 0 && ti->blank == 1)
+                return 1;
 
-        if (ti->rt == 1 && ti->blank == 0 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 1 && ti->blank == 0)
+                return 1;
 
         printk("pktcdvd: bad state %d-%d-%d\n", ti->rt, ti->blank, ti->packet);
-        return 1;
+        return 0;
 }
 
 /*
- * 0 -- we can write to this disc, 1 -- we can't
+ * 1 -- we can write to this disc, 0 -- we can't
  */
-static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
+static int pkt_writable_disc(struct pktcdvd_device *pd, disc_information *di)
 {
         switch (pd->mmc3_profile) {
                 case 0x0a: /* CD-RW */
@@ -1547,10 +1541,10 @@ static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
                 case 0x1a: /* DVD+RW */
                 case 0x13: /* DVD-RW */
                 case 0x12: /* DVD-RAM */
-                        return 0;
-                default:
-                        printk("pktcdvd: Wrong disc profile (%x)\n", pd->mmc3_profile);
                         return 1;
+                default:
+                        VPRINTK("pktcdvd: Wrong disc profile (%x)\n", pd->mmc3_profile);
+                        return 0;
         }
 
         /*
@@ -1559,25 +1553,25 @@ static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
          */
         if (di->disc_type == 0xff) {
                 printk("pktcdvd: Unknown disc. No track?\n");
-                return 1;
+                return 0;
         }
 
         if (di->disc_type != 0x20 && di->disc_type != 0) {
                 printk("pktcdvd: Wrong disc type (%x)\n", di->disc_type);
-                return 1;
+                return 0;
         }
 
         if (di->erasable == 0) {
                 printk("pktcdvd: Disc not erasable\n");
-                return 1;
+                return 0;
         }
 
         if (di->border_status == PACKET_SESSION_RESERVED) {
                 printk("pktcdvd: Can't write to last track (reserved)\n");
-                return 1;
+                return 0;
         }
 
-        return 0;
+        return 1;
 }
 
 static int pkt_probe_settings(struct pktcdvd_device *pd)
@@ -1602,23 +1596,9 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 return ret;
         }
 
-        if (pkt_good_disc(pd, &di))
-                return -ENXIO;
+        if (!pkt_writable_disc(pd, &di))
+                return -EROFS;
 
-        switch (pd->mmc3_profile) {
-                case 0x1a: /* DVD+RW */
-                        printk("pktcdvd: inserted media is DVD+RW\n");
-                        break;
-                case 0x13: /* DVD-RW */
-                        printk("pktcdvd: inserted media is DVD-RW\n");
-                        break;
-                case 0x12: /* DVD-RAM */
-                        printk("pktcdvd: inserted media is DVD-RAM\n");
-                        break;
-                default:
-                        printk("pktcdvd: inserted media is CD-R%s\n", di.erasable ? "W" : "");
-                        break;
-        }
         pd->type = di.erasable ? PACKET_CDRW : PACKET_CDR;
 
         track = 1; /* (di.last_track_msb << 8) | di.last_track_lsb; */
@@ -1627,9 +1607,9 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 return ret;
         }
 
-        if (pkt_good_track(&ti)) {
+        if (!pkt_writable_track(pd, &ti)) {
                 printk("pktcdvd: can't write to this track\n");
-                return -ENXIO;
+                return -EROFS;
         }
 
         /*
@@ -1639,11 +1619,11 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
         pd->settings.size = be32_to_cpu(ti.fixed_packet_size) << 2;
         if (pd->settings.size == 0) {
                 printk("pktcdvd: detected zero packet size!\n");
-                pd->settings.size = 128;
+                return -ENXIO;
         }
         if (pd->settings.size > PACKET_MAX_SECTORS) {
                 printk("pktcdvd: packet size is too big\n");
-                return -ENXIO;
+                return -EROFS;
         }
         pd->settings.fp = ti.fp;
         pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
@@ -1685,7 +1665,7 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                         break;
                 default:
                         printk("pktcdvd: unknown data mode\n");
-                        return 1;
+                        return -EROFS;
         }
         return 0;
 }
@@ -1895,8 +1875,8 @@ static int pkt_open_write(struct pktcdvd_device *pd)
         unsigned int write_speed, media_write_speed, read_speed;
 
         if ((ret = pkt_probe_settings(pd))) {
-                DPRINTK("pktcdvd: %s failed probe\n", pd->name);
-                return -EIO;
+                VPRINTK("pktcdvd: %s failed probe\n", pd->name);
+                return ret;
         }
 
         if ((ret = pkt_set_write_settings(pd))) {
@@ -1987,8 +1967,14 @@ static int pkt_open_dev(struct pktcdvd_device *pd, int write)
         if ((ret = pkt_set_segment_merging(pd, q)))
                 goto out_unclaim;
 
-        if (write)
+        if (write) {
+                if (!pkt_grow_pktlist(pd, CONFIG_CDROM_PKTCDVD_BUFFERS)) {
+                        printk("pktcdvd: not enough memory for buffers\n");
+                        ret = -ENOMEM;
+                        goto out_unclaim;
+                }
                 printk("pktcdvd: %lukB available on disc\n", lba << 1);
+        }
 
         return 0;
 
@@ -2014,6 +2000,8 @@ static void pkt_release_dev(struct pktcdvd_device *pd, int flush)
         pkt_set_speed(pd, MAX_SPEED, MAX_SPEED);
         bd_release(pd->bdev);
         blkdev_put(pd->bdev);
+
+        pkt_shrink_pktlist(pd);
 }
 
 static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
@@ -2046,10 +2034,9 @@ static int pkt_open(struct inode *inode, struct file *file)
                         goto out_dec;
                 }
         } else {
-                if (pkt_open_dev(pd, file->f_mode & FMODE_WRITE)) {
-                        ret = -EIO;
+                ret = pkt_open_dev(pd, file->f_mode & FMODE_WRITE);
+                if (ret)
                         goto out_dec;
-                }
                 /*
                  * needed here as well, since ext2 (among others) may change
                  * the blocksize at mount time
@@ -2379,12 +2366,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
         /* This is safe, since we have a reference from open(). */
         __module_get(THIS_MODULE);
 
-        if (!pkt_grow_pktlist(pd, CONFIG_CDROM_PKTCDVD_BUFFERS)) {
-                printk("pktcdvd: not enough memory for buffers\n");
-                ret = -ENOMEM;
-                goto out_mem;
-        }
-
         pd->bdev = bdev;
         set_blocksize(bdev, CD_FRAMESIZE);
 
@@ -2395,7 +2376,7 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
         if (IS_ERR(pd->cdrw.thread)) {
                 printk("pktcdvd: can't start kernel thread\n");
                 ret = -ENOMEM;
-                goto out_thread;
+                goto out_mem;
         }
 
         proc = create_proc_entry(pd->name, 0, pkt_proc);
@@ -2406,8 +2387,6 @@ static int pkt_new_dev(struct pktcdvd_device *pd, dev_t dev)
         DPRINTK("pktcdvd: writer %s mapped to %s\n", pd->name, bdevname(bdev, b));
         return 0;
 
-out_thread:
-        pkt_shrink_pktlist(pd);
 out_mem:
         blkdev_put(bdev);
         /* This is safe: open() is still holding a reference. */
@@ -2437,11 +2416,12 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
                  * The door gets locked when the device is opened, so we
                  * have to unlock it or else the eject command fails.
                  */
-                pkt_lock_door(pd, 0);
+                if (pd->refcnt == 1)
+                        pkt_lock_door(pd, 0);
                 return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
         default:
-                printk("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
+                VPRINTK("pktcdvd: Unknown ioctl for %s (%x)\n", pd->name, cmd);
                 return -ENOTTY;
         }
 
@@ -2503,6 +2483,10 @@ static int pkt_setup_dev(struct pkt_ctrl_command *ctrl_cmd)
                 goto out_mem;
         pd->disk = disk;
 
+        INIT_LIST_HEAD(&pd->cdrw.pkt_free_list);
+        INIT_LIST_HEAD(&pd->cdrw.pkt_active_list);
+        spin_lock_init(&pd->cdrw.active_list_lock);
+
         spin_lock_init(&pd->lock);
         spin_lock_init(&pd->iosched.lock);
         sprintf(pd->name, "pktcdvd%d", idx);
@@ -2567,8 +2551,6 @@ static int pkt_remove_dev(struct pkt_ctrl_command *ctrl_cmd)
 
         blkdev_put(pd->bdev);
 
-        pkt_shrink_pktlist(pd);
-
         remove_proc_entry(pd->name, pkt_proc);
         DPRINTK("pktcdvd: writer %s unmapped\n", pd->name);
 
@@ -2678,7 +2660,6 @@ static int __init pkt_init(void)
 
         pkt_proc = proc_mkdir("pktcdvd", proc_root_driver);
 
-        DPRINTK("pktcdvd: %s\n", VERSION_CODE);
         return 0;
 
 out:
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index e522d19ad886..7e21b1ff27c4 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -474,18 +474,6 @@ static int bt3c_hci_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long
 /* ======================== Card services HCI interaction ======================== */
 
 
-static struct device *bt3c_device(void)
-{
-        static struct device dev = {
-                .bus_id = "pcmcia",
-        };
-        kobject_set_name(&dev.kobj, "bt3c");
-        kobject_init(&dev.kobj);
-
-        return &dev;
-}
-
-
 static int bt3c_load_firmware(bt3c_info_t *info, unsigned char *firmware, int count)
 {
         char *ptr = (char *) firmware;
@@ -574,6 +562,7 @@ static int bt3c_open(bt3c_info_t *info)
 {
         const struct firmware *firmware;
         struct hci_dev *hdev;
+        client_handle_t handle;
         int err;
 
         spin_lock_init(&(info->lock));
@@ -605,8 +594,10 @@ static int bt3c_open(bt3c_info_t *info)
 
         hdev->owner = THIS_MODULE;
 
+        handle = info->link.handle;
+
         /* Load firmware */
-        err = request_firmware(&firmware, "BT3CPCC.bin", bt3c_device());
+        err = request_firmware(&firmware, "BT3CPCC.bin", &handle_to_dev(handle));
         if (err < 0) {
                 BT_ERR("Firmware request failed");
                 goto error;
diff --git a/drivers/cdrom/viocd.c b/drivers/cdrom/viocd.c
index 193446e6a08a..e27617259552 100644
--- a/drivers/cdrom/viocd.c
+++ b/drivers/cdrom/viocd.c
@@ -42,8 +42,6 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
-#include <asm/bug.h>
-
 #include <asm/vio.h>
 #include <asm/scatterlist.h>
 #include <asm/iseries/hv_types.h>
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 4c67727d75b1..05ba410682a3 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -222,7 +222,7 @@ config SYNCLINKMP
 
 config SYNCLINK_GT
         tristate "SyncLink GT/AC support"
-        depends on SERIAL_NONSTANDARD
+        depends on SERIAL_NONSTANDARD && PCI
         help
           Support for SyncLink GT and SyncLink AC families of
           synchronous and asynchronous serial adapters
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 486ed8a11b59..a4d425d2dce2 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -15,22 +15,23 @@ config AGP
           due to kernel allocation issues), you could use PCI accesses
           and have up to a couple gigs of texture space.
 
-          Note that this is the only means to have XFree4/GLX use
+          Note that this is the only means to have X/GLX use
           write-combining with MTRR support on the AGP bus. Without it, OpenGL
           direct rendering will be a lot slower but still faster than PIO.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
-
           To compile this driver as a module, choose M here: the
           module will be called agpgart.
 
+          You should say Y here if you want to use GLX or DRI.
+
+          If unsure, say N.
+
 config AGP_ALI
         tristate "ALI chipset support"
         depends on AGP && X86_32
         ---help---
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on the following ALi chipsets.  The supported chipsets
+          X on the following ALi chipsets.  The supported chipsets
           include M1541, M1621, M1631, M1632, M1641,M1647,and M1651.
           For the ALi-chipset question, ALi suggests you refer to
           <http://www.ali.com.tw/eng/support/index.shtml>.
@@ -40,28 +41,19 @@ config AGP_ALI
           timing issues, this chipset cannot do AGP 2x with the G200.
           This is a hardware limitation. AGP 1x seems to be fine, though.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
-
 config AGP_ATI
         tristate "ATI chipset support"
         depends on AGP && X86_32
         ---help---
-      This option gives you AGP support for the GLX component of
-      XFree86 4.x on the ATI RadeonIGP family of chipsets.
-
-      You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-      use GLX or DRI.  If unsure, say N.
+          This option gives you AGP support for the GLX component of
+          X on the ATI RadeonIGP family of chipsets.
 
 config AGP_AMD
         tristate "AMD Irongate, 761, and 762 chipset support"
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on AMD Irongate, 761, and 762 chipsets.
-
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
+          X on AMD Irongate, 761, and 762 chipsets.
 
 config AGP_AMD64
         tristate "AMD Opteron/Athlon64 on-CPU GART support" if !GART_IOMMU
@@ -69,45 +61,38 @@ config AGP_AMD64
         default y if GART_IOMMU
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
+          X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
           You still need an external AGP bridge like the AMD 8151, VIA
           K8T400M, SiS755. It may also support other AGP bridges when loaded
           with agp_try_unsupported=1.
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say Y
 
 config AGP_INTEL
         tristate "Intel 440LX/BX/GX, I8xx and E7x05 chipset support"
         depends on AGP && X86
         help
-          This option gives you AGP support for the GLX component of XFree86 4.x
+          This option gives you AGP support for the GLX component of X
           on Intel 440LX/BX/GX, 815, 820, 830, 840, 845, 850, 860, 875,
-          E7205 and E7505 chipsets and full support for the 810, 815, 830M, 845G,
-          852GM, 855GM, 865G and I915 integrated graphics chipsets.
+          E7205 and E7505 chipsets and full support for the 810, 815, 830M,
+          845G, 852GM, 855GM, 865G and I915 integrated graphics chipsets.
+
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI, or if you have any Intel integrated graphics
-          chipsets.  If unsure, say Y.
 
 config AGP_NVIDIA
         tristate "NVIDIA nForce/nForce2 chipset support"
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on the following NVIDIA chipsets.  The supported chipsets
-          include nForce and nForce2
+          X on NVIDIA chipsets including nForce and nForce2
 
 config AGP_SIS
         tristate "SiS chipset support"
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on Silicon Integrated Systems [SiS] chipsets.
+          X on Silicon Integrated Systems [SiS] chipsets.
 
           Note that 5591/5592 AGP chipsets are NOT supported.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
 
 config AGP_SWORKS
         tristate "Serverworks LE/HE chipset support"
@@ -121,10 +106,7 @@ config AGP_VIA
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on VIA MVP3/Apollo Pro chipsets.
-
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
+          X on VIA MVP3/Apollo Pro chipsets.
 
 config AGP_I460
         tristate "Intel 460GX chipset support"
@@ -159,9 +141,6 @@ config AGP_EFFICEON
           This option gives you AGP support for the Transmeta Efficeon
           series processors with integrated northbridges.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say Y.
-
 config AGP_SGI_TIOCA
         tristate "SGI TIO chipset AGP support"
         depends on AGP && (IA64_SGI_SN2 || IA64_GENERIC)
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 9964c508c111..1251b2515bbe 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -516,8 +516,10 @@ static int __devinit nforce3_agp_init(struct pci_dev *pdev)
         pci_read_config_dword (hammers[0], AMD64_GARTAPERTUREBASE, &apbase);
 
         /* if x86-64 aperture base is beyond 4G, exit here */
-        if ( (apbase & 0x7fff) >> (32 - 25) )
-                 return -ENODEV;
+        if ( (apbase & 0x7fff) >> (32 - 25) ) {
+                printk(KERN_INFO PFX "aperture base > 4G\n");
+                return -ENODEV;
+        }
 
         apbase = (apbase & 0x7fff) << 25;
 
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 268f78d926d3..efef9999f1cf 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -468,9 +468,7 @@ static int __devinit agp_serverworks_probe(struct pci_dev *pdev,
 
         switch (pdev->device) {
         case 0x0006:
-                /* ServerWorks CNB20HE
-                Fail silently.*/
-                printk (KERN_ERR PFX "Detected ServerWorks CNB20HE chipset: No AGP present.\n");
+                printk (KERN_ERR PFX "ServerWorks CNB20HE is unsupported due to lack of documentation.\n");
                 return -ENODEV;
 
         case PCI_DEVICE_ID_SERVERWORKS_HE:
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 71b8b32b075f..107df9fdba4e 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -980,7 +980,7 @@ extern int drm_put_head(drm_head_t * head);
 extern unsigned int drm_debug;
 extern unsigned int drm_cards_limit;
 extern drm_head_t **drm_heads;
-extern struct drm_sysfs_class *drm_class;
+extern struct class *drm_class;
 extern struct proc_dir_entry *drm_proc_root;
 
                                 /* Proc support (drm_proc.h) */
@@ -1011,11 +1011,9 @@ extern void __drm_pci_free(drm_device_t * dev, drm_dma_handle_t * dmah);
 extern void drm_pci_free(drm_device_t * dev, drm_dma_handle_t * dmah);
 
                                /* sysfs support (drm_sysfs.c) */
-struct drm_sysfs_class;
-extern struct drm_sysfs_class *drm_sysfs_create(struct module *owner,
-                                                char *name);
-extern void drm_sysfs_destroy(struct drm_sysfs_class *cs);
-extern struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs,
+extern struct class *drm_sysfs_create(struct module *owner, char *name);
+extern void drm_sysfs_destroy(struct class *cs);
+extern struct class_device *drm_sysfs_device_add(struct class *cs,
                                                  drm_head_t *head);
 extern void drm_sysfs_device_remove(struct class_device *class_dev);
 
diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
index 8fd6357a48da..2c17e88a8847 100644
--- a/drivers/char/drm/drm_pciids.h
+++ b/drivers/char/drm/drm_pciids.h
@@ -85,7 +85,6 @@
         {0x1002, 0x5969, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
         {0x1002, 0x596A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x596B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
-        {0x1002, 0x5b60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x5c61, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|CHIP_IS_MOBILITY}, \
         {0x1002, 0x5c62, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5c63, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|CHIP_IS_MOBILITY}, \
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 7a9263ff3007..68073e14fdec 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -50,7 +50,7 @@ module_param_named(cards_limit, drm_cards_limit, int, 0444);
 module_param_named(debug, drm_debug, int, 0600);
 
 drm_head_t **drm_heads;
-struct drm_sysfs_class *drm_class;
+struct class *drm_class;
 struct proc_dir_entry *drm_proc_root;
 
 static int drm_fill_in_dev(drm_device_t * dev, struct pci_dev *pdev,
diff --git a/drivers/char/drm/drm_sysfs.c b/drivers/char/drm/drm_sysfs.c
index 68e43ddc16ae..0b9f98a7eb10 100644
--- a/drivers/char/drm/drm_sysfs.c
+++ b/drivers/char/drm/drm_sysfs.c
@@ -1,3 +1,4 @@
+
 /*
  * drm_sysfs.c - Modifications to drm_sysfs_class.c to support
  *               extra sysfs attribute from DRM. Normal drm_sysfs_class
@@ -19,36 +20,6 @@
 #include "drm_core.h"
 #include "drmP.h"
 
-struct drm_sysfs_class {
-        struct class_device_attribute attr;
-        struct class class;
-};
-#define to_drm_sysfs_class(d) container_of(d, struct drm_sysfs_class, class)
-
-struct simple_dev {
-        dev_t dev;
-        struct class_device class_dev;
-};
-#define to_simple_dev(d) container_of(d, struct simple_dev, class_dev)
-
-static void release_simple_dev(struct class_device *class_dev)
-{
-        struct simple_dev *s_dev = to_simple_dev(class_dev);
-        kfree(s_dev);
-}
-
-static ssize_t show_dev(struct class_device *class_dev, char *buf)
-{
-        struct simple_dev *s_dev = to_simple_dev(class_dev);
-        return print_dev_t(buf, s_dev->dev);
-}
-
-static void drm_sysfs_class_release(struct class *class)
-{
-        struct drm_sysfs_class *cs = to_drm_sysfs_class(class);
-        kfree(cs);
-}
-
 /* Display the version of drm_core. This doesn't work right in current design */
 static ssize_t version_show(struct class *dev, char *buf)
 {
@@ -69,38 +40,16 @@ static CLASS_ATTR(version, S_IRUGO, version_show, NULL);
  * Note, the pointer created here is to be destroyed when finished by making a
  * call to drm_sysfs_destroy().
  */
-struct drm_sysfs_class *drm_sysfs_create(struct module *owner, char *name)
+struct class *drm_sysfs_create(struct module *owner, char *name)
 {
-        struct drm_sysfs_class *cs;
-        int retval;
-
-        cs = kmalloc(sizeof(*cs), GFP_KERNEL);
-        if (!cs) {
-                retval = -ENOMEM;
-                goto error;
-        }
-        memset(cs, 0x00, sizeof(*cs));
-
-        cs->class.name = name;
-        cs->class.class_release = drm_sysfs_class_release;
-        cs->class.release = release_simple_dev;
-
-        cs->attr.attr.name = "dev";
-        cs->attr.attr.mode = S_IRUGO;
-        cs->attr.attr.owner = owner;
-        cs->attr.show = show_dev;
-        cs->attr.store = NULL;
-
-        retval = class_register(&cs->class);
-        if (retval)
-                goto error;
-        class_create_file(&cs->class, &class_attr_version);
-
-        return cs;
-
-      error:
-        kfree(cs);
-        return ERR_PTR(retval);
+        struct class *class;
+
+        class = class_create(owner, name);
+        if (!class)
+                return class;
+
+        class_create_file(class, &class_attr_version);
+        return class;
 }
 
 /**
@@ -110,12 +59,13 @@ struct drm_sysfs_class *drm_sysfs_create(struct module *owner, char *name)
  * Note, the pointer to be destroyed must have been created with a call to
  * drm_sysfs_create().
  */
-void drm_sysfs_destroy(struct drm_sysfs_class *cs)
+void drm_sysfs_destroy(struct class *class)
 {
-        if ((cs == NULL) || (IS_ERR(cs)))
+        if ((class == NULL) || (IS_ERR(class)))
                 return;
 
-        class_unregister(&cs->class);
+        class_remove_file(class, &class_attr_version);
+        class_destroy(class);
 }
 
 static ssize_t show_dri(struct class_device *class_device, char *buf)
@@ -132,7 +82,7 @@ static struct class_device_attribute class_device_attrs[] = {
 
 /**
  * drm_sysfs_device_add - adds a class device to sysfs for a character driver
- * @cs: pointer to the struct drm_sysfs_class that this device should be registered to.
+ * @cs: pointer to the struct class that this device should be registered to.
  * @dev: the dev_t for the device to be added.
  * @device: a pointer to a struct device that is assiociated with this class device.
  * @fmt: string for the class device's name
@@ -141,46 +91,26 @@ static struct class_device_attribute class_device_attrs[] = {
  * class.  A "dev" file will be created, showing the dev_t for the device.  The
  * pointer to the struct class_device will be returned from the call.  Any further
  * sysfs files that might be required can be created using this pointer.
- * Note: the struct drm_sysfs_class passed to this function must have previously been
+ * Note: the struct class passed to this function must have previously been
  * created with a call to drm_sysfs_create().
  */
-struct class_device *drm_sysfs_device_add(struct drm_sysfs_class *cs,
-                                          drm_head_t *head)
+struct class_device *drm_sysfs_device_add(struct class *cs, drm_head_t *head)
 {
-        struct simple_dev *s_dev = NULL;
-        int i, retval;
-
-        if ((cs == NULL) || (IS_ERR(cs))) {
-                retval = -ENODEV;
-                goto error;
-        }
-
-        s_dev = kmalloc(sizeof(*s_dev), GFP_KERNEL);
-        if (!s_dev) {
-                retval = -ENOMEM;
-                goto error;
-        }
-        memset(s_dev, 0x00, sizeof(*s_dev));
-
-        s_dev->dev = MKDEV(DRM_MAJOR, head->minor);
-        s_dev->class_dev.dev = &(head->dev->pdev)->dev;
-        s_dev->class_dev.class = &cs->class;
+        struct class_device *class_dev;
+        int i;
 
-        snprintf(s_dev->class_dev.class_id, BUS_ID_SIZE, "card%d", head->minor);
-        retval = class_device_register(&s_dev->class_dev);
-        if (retval)
-                goto error;
+        class_dev = class_device_create(cs, NULL,
+                                        MKDEV(DRM_MAJOR, head->minor),
+                                        &(head->dev->pdev)->dev,
+                                        "card%d", head->minor);
+        if (!class_dev)
+                return NULL;
 
-        class_device_create_file(&s_dev->class_dev, &cs->attr);
-        class_set_devdata(&s_dev->class_dev, head);
+        class_set_devdata(class_dev, head);
 
         for (i = 0; i < ARRAY_SIZE(class_device_attrs); i++)
-                class_device_create_file(&s_dev->class_dev, &class_device_attrs[i]);
-        return &s_dev->class_dev;
-
-error:
-        kfree(s_dev);
-        return ERR_PTR(retval);
+                class_device_create_file(class_dev, &class_device_attrs[i]);
+        return class_dev;
 }
 
 /**
@@ -192,10 +122,9 @@ error:
  */
 void drm_sysfs_device_remove(struct class_device *class_dev)
 {
-        struct simple_dev *s_dev = to_simple_dev(class_dev);
         int i;
 
         for (i = 0; i < ARRAY_SIZE(class_device_attrs); i++)
-                class_device_remove_file(&s_dev->class_dev, &class_device_attrs[i]);
-        class_device_unregister(&s_dev->class_dev);
+                class_device_remove_file(class_dev, &class_device_attrs[i]);
+        class_device_unregister(class_dev);
 }
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index a1381c61aa63..d3879ac9970f 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -202,10 +202,15 @@ void i915_driver_irq_postinstall(drm_device_t * dev)
 void i915_driver_irq_uninstall(drm_device_t * dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        u16 temp;
+
         if (!dev_priv)
                 return;
 
         I915_WRITE16(I915REG_HWSTAM, 0xffff);
         I915_WRITE16(I915REG_INT_MASK_R, 0xffff);
         I915_WRITE16(I915REG_INT_ENABLE_R, 0x0);
+
+        temp = I915_READ16(I915REG_INT_IDENTITY_R);
+        I915_WRITE16(I915REG_INT_IDENTITY_R, temp);
 }
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index 291dbf4c8186..c08fa5076f05 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -161,6 +161,7 @@ void r300_init_reg_flags(void)
         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
         ADD_RANGE(R300_GB_ENABLE, 1);
         ADD_RANGE(R300_GB_MSPOS0, 5);
+        ADD_RANGE(R300_TX_CNTL, 1);
         ADD_RANGE(R300_TX_ENABLE, 1);
         ADD_RANGE(0x4200, 4);
         ADD_RANGE(0x4214, 1);
@@ -489,6 +490,50 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
 
         return 0;
 }
+static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
+                                             drm_radeon_kcmd_buffer_t *cmdbuf)
+{
+        u32 *cmd = (u32 *) cmdbuf->buf;
+        int count, ret;
+        RING_LOCALS;
+
+        count=(cmd[0]>>16) & 0x3fff;
+
+        if (cmd[0] & 0x8000) {
+                u32 offset;
+
+                if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL 
+                              | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
+                        offset = cmd[2] << 10;
+                        ret = r300_check_offset(dev_priv, offset);
+                        if (ret) {
+                                DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
+                                return DRM_ERR(EINVAL);
+                        }
+                }
+
+                if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
+                    (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
+                        offset = cmd[3] << 10;
+                        ret = r300_check_offset(dev_priv, offset);
+                        if (ret) {
+                                DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
+                                return DRM_ERR(EINVAL);
+                        }
+                        
+                }
+        }
+
+        BEGIN_RING(count+2);
+        OUT_RING(cmd[0]);
+        OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
+        ADVANCE_RING();
+
+        cmdbuf->buf += (count+2)*4;
+        cmdbuf->bufsz -= (count+2)*4;
+
+        return 0;
+}
 
 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
                                             drm_radeon_kcmd_buffer_t *cmdbuf)
@@ -527,6 +572,9 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
         case RADEON_3D_LOAD_VBPNTR:     /* load vertex array pointers */
                 return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
 
+        case RADEON_CNTL_BITBLT_MULTI:
+                return r300_emit_bitblt_multi(dev_priv, cmdbuf);
+
         case RADEON_CP_3D_DRAW_IMMD_2:  /* triggers drawing using in-packet vertex data */
         case RADEON_CP_3D_DRAW_VBUF_2:  /* triggers drawing of vertex buffers setup elsewhere */
         case RADEON_CP_3D_DRAW_INDX_2:  /* triggers drawing using indices to vertex buffer */
diff --git a/drivers/char/drm/r300_reg.h b/drivers/char/drm/r300_reg.h
index a0ed20e25221..d1e19954406b 100644
--- a/drivers/char/drm/r300_reg.h
+++ b/drivers/char/drm/r300_reg.h
@@ -451,6 +451,9 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 /* END */
 
 /* gap */
+/* Zero to flush caches. */
+#define R300_TX_CNTL                        0x4100
+
 /* The upper enable bits are guessed, based on fglrx reported limits. */
 #define R300_TX_ENABLE                      0x4104
 #       define R300_TX_ENABLE_0                  (1 << 0)
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index 498b19b1d641..1f7d2ab8c4fc 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -90,9 +90,10 @@
  * 1.19- Add support for gart table in FB memory and PCIE r300
  * 1.20- Add support for r300 texrect
  * 1.21- Add support for card type getparam
+ * 1.22- Add support for texture cache flushes (R300_TX_CNTL)
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            21
+#define DRIVER_MINOR            22
 #define DRIVER_PATCHLEVEL       0
 
 /*
diff --git a/drivers/char/esp.c b/drivers/char/esp.c
index 57539d8f9f7c..09dc4b01232c 100644
--- a/drivers/char/esp.c
+++ b/drivers/char/esp.c
@@ -150,17 +150,6 @@ static void rs_wait_until_sent(struct tty_struct *, int);
 /* Standard COM flags (except for COM4, because of the 8514 problem) */
 #define STD_COM_FLAGS (ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST)
 
-/*
- * tmp_buf is used as a temporary buffer by serial_write.  We need to
- * lock it in case the memcpy_fromfs blocks while swapping in a page,
- * and some other program tries to do a serial write at the same time.
- * Since the lock will only come under contention when the system is
- * swapping and available memory is low, it makes sense to share one
- * buffer across all the serial ports, since it significantly saves
- * memory if large numbers of serial ports are open.
- */
-static unsigned char *tmp_buf;
-
 static inline int serial_paranoia_check(struct esp_struct *info,
                                         char *name, const char *routine)
 {
@@ -1267,7 +1256,7 @@ static int rs_write(struct tty_struct * tty,
         if (serial_paranoia_check(info, tty->name, "rs_write"))
                 return 0;
 
-        if (!tty || !info->xmit_buf || !tmp_buf)
+        if (!tty || !info->xmit_buf)
                 return 0;
             
         while (1) {
@@ -2291,11 +2280,7 @@ static int esp_open(struct tty_struct *tty, struct file * filp)
         tty->driver_data = info;
         info->tty = tty;
 
-        if (!tmp_buf) {
-                tmp_buf = (unsigned char *) get_zeroed_page(GFP_KERNEL);
-                if (!tmp_buf)
-                        return -ENOMEM;
-        }
+        spin_unlock_irqrestore(&info->lock, flags);
         
         /*
          * Start up serial port
@@ -2602,9 +2587,6 @@ static void __exit espserial_exit(void)
                 free_pages((unsigned long)dma_buffer,
                         get_order(DMA_BUFFER_SZ));
 
-        if (tmp_buf)
-                free_page((unsigned long)tmp_buf);
-
         while (free_pio_buf) {
                 pio_buf = free_pio_buf->next;
                 kfree(free_pio_buf);
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 66a2fee06eb9..ef140ebde117 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -956,22 +956,18 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)
                 }
         } else if (res->type == ACPI_RESOURCE_TYPE_EXTENDED_IRQ) {
                 struct acpi_resource_extended_irq *irqp;
-                int i;
+                int i, irq;
 
                 irqp = &res->data.extended_irq;
 
-                if (irqp->interrupt_count > 0) {
-                        hdp->hd_nirqs = irqp->interrupt_count;
-
-                        for (i = 0; i < hdp->hd_nirqs; i++) {
-                                int rc =
-                                    acpi_register_gsi(irqp->interrupts[i],
-                                                      irqp->triggering,
-                                                      irqp->polarity);
-                                if (rc < 0)
-                                        return AE_ERROR;
-                                hdp->hd_irq[i] = rc;
-                        }
+                for (i = 0; i < irqp->interrupt_count; i++) {
+                        irq = acpi_register_gsi(irqp->interrupts[i],
+                                      irqp->triggering, irqp->polarity);
+                        if (irq < 0)
+                                return AE_ERROR;
+
+                        hdp->hd_irq[hdp->hd_nirqs] = irq;
+                        hdp->hd_nirqs++;
                 }
         }
 
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 1994a92d4733..f65b2e14a485 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -335,6 +335,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
         } /* else count == 0 */
 
         tty->driver_data = hp;
+        tty->low_latency = 1; /* Makes flushes to ldisc synchronous. */
+
         hp->tty = tty;
         /* Save for request_irq outside of spin_lock. */
         irq = hp->irq;
@@ -633,9 +635,6 @@ static int hvc_poll(struct hvc_struct *hp)
                         tty_insert_flip_char(tty, buf[i], 0);
                 }
 
-                if (count)
-                        tty_schedule_flip(tty);
-
                 /*
                  * Account for the total amount read in one loop, and if above
                  * 64 bytes, we do a quick schedule loop to let the tty grok
@@ -656,6 +655,9 @@ static int hvc_poll(struct hvc_struct *hp)
  bail:
         spin_unlock_irqrestore(&hp->lock, flags);
 
+        if (read_total)
+                tty_flip_buffer_push(tty);
+        
         return poll_mask;
 }
 
diff --git a/drivers/char/hw_random.c b/drivers/char/hw_random.c
index b3bc2e37e616..29dc87e59020 100644
--- a/drivers/char/hw_random.c
+++ b/drivers/char/hw_random.c
@@ -131,7 +131,9 @@ enum {
         rng_hw_none,
         rng_hw_intel,
         rng_hw_amd,
+#ifdef __i386__
         rng_hw_via,
+#endif
         rng_hw_geode,
 };
 
diff --git a/drivers/char/mmtimer.c b/drivers/char/mmtimer.c
index c92378121b4c..1b05fa688996 100644
--- a/drivers/char/mmtimer.c
+++ b/drivers/char/mmtimer.c
@@ -675,7 +675,7 @@ static int __init mmtimer_init(void)
         cnodeid_t node, maxn = -1;
 
         if (!ia64_platform_is("sn2"))
-                return -1;
+                return 0;
 
         /*
          * Sanity check the cycles/sec variable
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 649677b5dc36..5fdf18515433 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -13,11 +13,12 @@
   *
   * (C) 2000,2001,2002,2003,2004 Omnikey AG
   *
-  * (C) 2005 Harald Welte <laforge@gnumonks.org>
+  * (C) 2005-2006 Harald Welte <laforge@gnumonks.org>
   *     - Adhere to Kernel CodingStyle
   *     - Port to 2.6.13 "new" style PCMCIA
   *     - Check for copy_{from,to}_user return values
   *     - Use nonseekable_open()
+  *     - add class interface for udev device creation
   *
   * All rights reserved. Licensed under dual BSD/GPL license.
   */
@@ -56,7 +57,7 @@ module_param(pc_debug, int, 0600);
 #else
 #define DEBUGP(n, rdr, x, args...)
 #endif
-static char *version = "cm4000_cs.c v2.4.0gm5 - All bugs added by Harald Welte";
+static char *version = "cm4000_cs.c v2.4.0gm6 - All bugs added by Harald Welte";
 
 #define T_1SEC          (HZ)
 #define T_10MSEC        msecs_to_jiffies(10)
@@ -156,6 +157,7 @@ struct cm4000_dev {
                 /*queue*/ 4*sizeof(wait_queue_head_t))
 
 static dev_link_t *dev_table[CM4000_MAX_DEV];
+static struct class *cmm_class;
 
 /* This table doesn't use spaces after the comma between fields and thus
  * violates CodingStyle.  However, I don't really think wrapping it around will
@@ -1937,6 +1939,9 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
         cm4000_config(link, i);
 
+        class_device_create(cmm_class, NULL, MKDEV(major, i), NULL,
+                            "cmm%d", i);
+
         return 0;
 }
 
@@ -1962,6 +1967,8 @@ static void cm4000_detach(struct pcmcia_device *p_dev)
         dev_table[devno] = NULL;
         kfree(dev);
 
+        class_device_destroy(cmm_class, MKDEV(major, devno));
+
         return;
 }
 
@@ -1995,8 +2002,18 @@ static struct pcmcia_driver cm4000_driver = {
 
 static int __init cmm_init(void)
 {
+        int rc;
+
         printk(KERN_INFO "%s\n", version);
-        pcmcia_register_driver(&cm4000_driver);
+
+        cmm_class = class_create(THIS_MODULE, "cardman_4000");
+        if (!cmm_class)
+                return -1;
+
+        rc = pcmcia_register_driver(&cm4000_driver);
+        if (rc < 0)
+                return rc;
+
         major = register_chrdev(0, DEVICE_NAME, &cm4000_fops);
         if (major < 0) {
                 printk(KERN_WARNING MODULE_NAME
@@ -2012,6 +2029,7 @@ static void __exit cmm_exit(void)
         printk(KERN_INFO MODULE_NAME ": unloading\n");
         pcmcia_unregister_driver(&cm4000_driver);
         unregister_chrdev(major, DEVICE_NAME);
+        class_destroy(cmm_class);
 };
 
 module_init(cmm_init);
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 46eb371bf17e..466e33bab029 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -3,12 +3,13 @@
  *
  * (c) 2000-2004 Omnikey AG (http://www.omnikey.com/)
  *
- * (C) 2005 Harald Welte <laforge@gnumonks.org>
+ * (C) 2005-2006 Harald Welte <laforge@gnumonks.org>
  *      - add support for poll()
  *      - driver cleanup
  *      - add waitqueues
  *      - adhere to linux kernel coding style and policies
  *      - support 2.6.13 "new style" pcmcia interface
+ *      - add class interface for udev device creation
  *
  * The device basically is a USB CCID compliant device that has been
  * attached to an I/O-Mapped FIFO.
@@ -53,7 +54,7 @@ module_param(pc_debug, int, 0600);
 #endif
 
 static char *version =
-"OMNIKEY CardMan 4040 v1.1.0gm4 - All bugs added by Harald Welte";
+"OMNIKEY CardMan 4040 v1.1.0gm5 - All bugs added by Harald Welte";
 
 #define CCID_DRIVER_BULK_DEFAULT_TIMEOUT        (150*HZ)
 #define CCID_DRIVER_ASYNC_POWERUP_TIMEOUT       (35*HZ)
@@ -67,6 +68,7 @@ static char *version =
 static void reader_release(dev_link_t *link);
 
 static int major;
+static struct class *cmx_class;
 
 #define         BS_READABLE     0x01
 #define         BS_WRITABLE     0x02
@@ -696,6 +698,9 @@ static int reader_attach(struct pcmcia_device *p_dev)
         link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
         reader_config(link, i);
 
+        class_device_create(cmx_class, NULL, MKDEV(major, i), NULL,
+                            "cmx%d", i);
+
         return 0;
 }
 
@@ -721,6 +726,8 @@ static void reader_detach(struct pcmcia_device *p_dev)
         dev_table[devno] = NULL;
         kfree(dev);
 
+        class_device_destroy(cmx_class, MKDEV(major, devno));
+
         return;
 }
 
@@ -755,8 +762,17 @@ static struct pcmcia_driver reader_driver = {
 
 static int __init cm4040_init(void)
 {
+        int rc;
+
         printk(KERN_INFO "%s\n", version);
-        pcmcia_register_driver(&reader_driver);
+        cmx_class = class_create(THIS_MODULE, "cardman_4040");
+        if (!cmx_class)
+                return -1;
+
+        rc = pcmcia_register_driver(&reader_driver);
+        if (rc < 0)
+                return rc;
+
         major = register_chrdev(0, DEVICE_NAME, &reader_fops);
         if (major < 0) {
                 printk(KERN_WARNING MODULE_NAME
@@ -771,6 +787,7 @@ static void __exit cm4040_exit(void)
         printk(KERN_INFO MODULE_NAME ": unloading\n");
         pcmcia_unregister_driver(&reader_driver);
         unregister_chrdev(major, DEVICE_NAME);
+        class_destroy(cmx_class);
 }
 
 module_init(cm4040_init);
diff --git a/drivers/char/ser_a2232.c b/drivers/char/ser_a2232.c
index 80a5b840e22f..fee68cc895f8 100644
--- a/drivers/char/ser_a2232.c
+++ b/drivers/char/ser_a2232.c
@@ -103,6 +103,7 @@
 
 #include <linux/serial.h>
 #include <linux/generic_serial.h>
+#include <linux/tty_flip.h>
 
 #include "ser_a2232.h"
 #include "ser_a2232fw.h"
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index c2490e270f1f..a6b4f02bdceb 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1095,17 +1095,17 @@ static inline void sx_receive_chars (struct sx_port *port)
 
                 sx_dprintk (SX_DEBUG_RECEIVE, "rxop=%d, c = %d.\n", rx_op, c); 
 
+                /* Don't copy past the end of the hardware receive buffer */
+                if (rx_op + c > 0x100) c = 0x100 - rx_op;
+
+                sx_dprintk (SX_DEBUG_RECEIVE, "c = %d.\n", c);
+
                 /* Don't copy more bytes than there is room for in the buffer */
 
                 c = tty_prepare_flip_string(tty, &rp, c);
 
                 sx_dprintk (SX_DEBUG_RECEIVE, "c = %d.\n", c); 
 
-                /* Don't copy past the end of the hardware receive buffer */
-                if (rx_op + c > 0x100) c = 0x100 - rx_op;
-
-                sx_dprintk (SX_DEBUG_RECEIVE, "c = %d.\n", c);
-
                 /* If for one reason or another, we can't copy more data, we're done! */
                 if (c == 0) break;
 
@@ -2173,15 +2173,17 @@ static int probe_si (struct sx_board *board)
         if ( IS_SI1_BOARD(board)) {
                 /* This should be an SI1 board, which has this
                    location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                         func_exit ();
                         return 0; 
+                }
         } else {
                 /* This should be an SI2 board, which has the bottom
                    3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                         func_exit ();
                         return 0; 
+                }
         }
 
         /* Now we're pretty much convinced that there is an SI board here, 
@@ -2192,15 +2194,17 @@ static int probe_si (struct sx_board *board)
         if ( IS_SI1_BOARD(board)) {
                 /* This should be an SI1 board, which has this
                    location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                         func_exit();
                         return 0; 
+                }
         } else {
                 /* This should be an SI2 board, which has the bottom
                    3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                         func_exit ();
                         return 0; 
+                }
         }
 
         printheader ();
diff --git a/drivers/char/synclink_gt.c b/drivers/char/synclink_gt.c
index a85a60a93deb..b046390cd256 100644
--- a/drivers/char/synclink_gt.c
+++ b/drivers/char/synclink_gt.c
@@ -306,7 +306,7 @@ struct slgt_info {
         int tx_active;
 
         unsigned char signals;    /* serial signal states */
-        unsigned int init_error;  /* initialization error */
+        int init_error;  /* initialization error */
 
         unsigned char *tx_buf;
         int tx_count;
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 5765f672e853..d58f82318853 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -243,7 +243,7 @@ static struct sysrq_key_op sysrq_term_op = {
 
 static void moom_callback(void *ignored)
 {
-        out_of_memory(GFP_KERNEL, 0);
+        out_of_memory(&NODE_DATA(0)->node_zonelists[ZONE_NORMAL], GFP_KERNEL, 0);
 }
 
 static DECLARE_WORK(moom_work, moom_callback, NULL);
diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
index 41a94bc79f67..eb2eb3e12d6a 100644
--- a/drivers/char/tipar.c
+++ b/drivers/char/tipar.c
@@ -250,12 +250,17 @@ tipar_open(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode) - TIPAR_MINOR;
 
-        if (minor > tp_count - 1)
+        if (tp_count == 0 || minor > tp_count - 1)
                 return -ENXIO;
 
         if (test_and_set_bit(minor, &opened))
                 return -EBUSY;
 
+        if (!table[minor].dev) {
+                printk(KERN_ERR "%s: NULL device for minor %u\n",
+                                __FUNCTION__, minor);
+                return -ENXIO;
+        }
         parport_claim_or_block(table[minor].dev);
         init_ti_parallel(minor);
         parport_release(table[minor].dev);
@@ -510,16 +515,20 @@ tipar_init_module(void)
                 err = PTR_ERR(tipar_class);
                 goto out_chrdev;
         }
-        if (parport_register_driver(&tipar_driver)) {
+        if (parport_register_driver(&tipar_driver) || tp_count == 0) {
                 printk(KERN_ERR "tipar: unable to register with parport\n");
                 err = -EIO;
-                goto out;
+                goto out_class;
         }
 
         err = 0;
         goto out;
 
+out_class:
+        class_destroy(tipar_class);
+
 out_chrdev:
+        devfs_remove("ticables/par");
         unregister_chrdev(TIPAR_MAJOR, "tipar");
 out:
         return err;     
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index ec7590951af5..24095f6ee6da 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -33,6 +33,7 @@
 static int TPM_INF_DATA;
 static int TPM_INF_ADDR;
 static int TPM_INF_BASE;
+static int TPM_INF_ADDR_LEN;
 static int TPM_INF_PORT_LEN;
 
 /* TPM header definitions */
@@ -195,6 +196,7 @@ static int tpm_inf_recv(struct tpm_chip *chip, u8 * buf, size_t count)
         int i;
         int ret;
         u32 size = 0;
+        number_of_wtx = 0;
 
 recv_begin:
         /* start receiving header */
@@ -378,24 +380,35 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
             !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
                 TPM_INF_ADDR = pnp_port_start(dev, 0);
+                TPM_INF_ADDR_LEN = pnp_port_len(dev, 0);
                 TPM_INF_DATA = (TPM_INF_ADDR + 1);
                 TPM_INF_BASE = pnp_port_start(dev, 1);
                 TPM_INF_PORT_LEN = pnp_port_len(dev, 1);
-                if (!TPM_INF_PORT_LEN)
-                        return -EINVAL;
+                if ((TPM_INF_PORT_LEN < 4) || (TPM_INF_ADDR_LEN < 2)) {
+                        rc = -EINVAL;
+                        goto err_last;
+                }
                 dev_info(&dev->dev, "Found %s with ID %s\n",
                          dev->name, dev_id->id);
-                if (!((TPM_INF_BASE >> 8) & 0xff))
-                        return -EINVAL;
+                if (!((TPM_INF_BASE >> 8) & 0xff)) {
+                        rc = -EINVAL;
+                        goto err_last;
+                }
                 /* publish my base address and request region */
                 tpm_inf.base = TPM_INF_BASE;
                 if (request_region
                     (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
-                        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto err_last;
+                }
+                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
+                                "tpm_infineon0") == NULL) {
+                        rc = -EINVAL;
+                        goto err_last;
                 }
         } else {
-                return -EINVAL;
+                rc = -EINVAL;
+                goto err_last;
         }
 
         /* query chip for its vendor, its version number a.s.o. */
@@ -443,8 +456,8 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         dev_err(&dev->dev,
                                 "Could not set IO-ports to 0x%lx\n",
                                 tpm_inf.base);
-                        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
-                        return -EIO;
+                        rc = -EIO;
+                        goto err_release_region;
                 }
 
                 /* activate register */
@@ -471,14 +484,21 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 rc = tpm_register_hardware(&dev->dev, &tpm_inf);
                 if (rc < 0) {
-                        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto err_release_region;
                 }
                 return 0;
         } else {
-                dev_info(&dev->dev, "No Infineon TPM found!\n");
-                return -ENODEV;
+                rc = -ENODEV;
+                goto err_release_region;
         }
+
+err_release_region:
+        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
+
+err_last:
+        return rc;
 }
 
 static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
@@ -518,5 +538,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.6");
+MODULE_VERSION("1.7");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 076e07c1da38..53d3d066554e 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -268,6 +268,8 @@ static struct tty_buffer *tty_buffer_alloc(size_t size)
         p->size = size;
         p->next = NULL;
         p->active = 0;
+        p->commit = 0;
+        p->read = 0;
         p->char_buf_ptr = (char *)(p->data);
         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
 /*      printk("Flip create %p\n", p); */
@@ -298,8 +300,10 @@ static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
                         *tbh = t->next;
                         t->next = NULL;
                         t->used = 0;
+                        t->commit = 0;
+                        t->read = 0;
                         /* DEBUG ONLY */
-                        memset(t->data, '*', size);
+/*                      memset(t->data, '*', size); */
 /*                      printk("Flip recycle %p\n", t); */
                         return t;
                 }
@@ -335,6 +339,7 @@ int tty_buffer_request_room(struct tty_struct *tty, size_t size)
                         if (b != NULL) {
                                 b->next = n;
                                 b->active = 0;
+                                b->commit = b->used;
                         } else
                                 tty->buf.head = n;
                         tty->buf.tail = n;
@@ -1836,7 +1841,6 @@ static void release_dev(struct file * filp)
                 tty_closing = tty->count <= 1;
                 o_tty_closing = o_tty &&
                         (o_tty->count <= (pty_master ? 1 : 0));
-                up(&tty_sem);
                 do_sleep = 0;
 
                 if (tty_closing) {
@@ -1864,6 +1868,7 @@ static void release_dev(struct file * filp)
 
                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
                                     "active!\n", tty_name(tty, buf));
+                up(&tty_sem);
                 schedule();
         }       
 
@@ -1872,8 +1877,6 @@ static void release_dev(struct file * filp)
          * both sides, and we've completed the last operation that could 
          * block, so it's safe to proceed with closing.
          */
-         
-        down(&tty_sem);
         if (pty_master) {
                 if (--o_tty->count < 0) {
                         printk(KERN_WARNING "release_dev: bad pty slave count "
@@ -1887,7 +1890,6 @@ static void release_dev(struct file * filp)
                        tty->count, tty_name(tty, buf));
                 tty->count = 0;
         }
-        up(&tty_sem);
         
         /*
          * We've decremented tty->count, so we need to remove this file
@@ -1932,6 +1934,8 @@ static void release_dev(struct file * filp)
                 read_unlock(&tasklist_lock);
         }
 
+        up(&tty_sem);
+
         /* check whether both sides are closing ... */
         if (!tty_closing || (o_tty && !o_tty_closing))
                 return;
@@ -2752,6 +2756,9 @@ static void flush_to_ldisc(void *private_)
         unsigned long   flags;
         struct tty_ldisc *disc;
         struct tty_buffer *tbuf;
+        int count;
+        char *char_buf;
+        unsigned char *flag_buf;
 
         disc = tty_ldisc_ref(tty);
         if (disc == NULL)       /*  !TTY_LDISC */
@@ -2765,16 +2772,20 @@ static void flush_to_ldisc(void *private_)
                 goto out;
         }
         spin_lock_irqsave(&tty->buf.lock, flags);
-        while((tbuf = tty->buf.head) != NULL && !tbuf->active) {
+        while((tbuf = tty->buf.head) != NULL) {
+                while ((count = tbuf->commit - tbuf->read) != 0) {
+                        char_buf = tbuf->char_buf_ptr + tbuf->read;
+                        flag_buf = tbuf->flag_buf_ptr + tbuf->read;
+                        tbuf->read += count;
+                        spin_unlock_irqrestore(&tty->buf.lock, flags);
+                        disc->receive_buf(tty, char_buf, flag_buf, count);
+                        spin_lock_irqsave(&tty->buf.lock, flags);
+                }
+                if (tbuf->active)
+                        break;
                 tty->buf.head = tbuf->next;
                 if (tty->buf.head == NULL)
                         tty->buf.tail = NULL;
-                spin_unlock_irqrestore(&tty->buf.lock, flags);
-                /* printk("Process buffer %p for %d\n", tbuf, tbuf->used); */
-                disc->receive_buf(tty, tbuf->char_buf_ptr,
-                                       tbuf->flag_buf_ptr,
-                                       tbuf->used);
-                spin_lock_irqsave(&tty->buf.lock, flags);
                 tty_buffer_free(tty, tbuf);
         }
         spin_unlock_irqrestore(&tty->buf.lock, flags);
@@ -2871,8 +2882,10 @@ void tty_flip_buffer_push(struct tty_struct *tty)
 {
         unsigned long flags;
         spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL)
+        if (tty->buf.tail != NULL) {
                 tty->buf.tail->active = 0;
+                tty->buf.tail->commit = tty->buf.tail->used;
+        }
         spin_unlock_irqrestore(&tty->buf.lock, flags);
 
         if (tty->low_latency)
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 37c9e13ad3ac..8d6b249ad66b 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -49,29 +49,37 @@
  *      More info available at http://www.berkprod.com/ or http://www.pcwatchdog.com/
  */
 
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/types.h>
-#include <linux/timer.h>
-#include <linux/jiffies.h>
-#include <linux/config.h>
-#include <linux/wait.h>
-#include <linux/slab.h>
-#include <linux/ioport.h>
-#include <linux/delay.h>
-#include <linux/fs.h>
-#include <linux/miscdevice.h>
-#include <linux/watchdog.h>
-#include <linux/notifier.h>
-#include <linux/init.h>
-#include <linux/spinlock.h>
-#include <linux/reboot.h>
+#include <linux/config.h>       /* For CONFIG_WATCHDOG_NOWAYOUT/... */
+#include <linux/module.h>       /* For module specific items */
+#include <linux/moduleparam.h>  /* For new moduleparam's */
+#include <linux/types.h>        /* For standard types (like size_t) */
+#include <linux/errno.h>        /* For the -ENODEV/... values */
+#include <linux/kernel.h>       /* For printk/panic/... */
+#include <linux/delay.h>        /* For mdelay function */
+#include <linux/timer.h>        /* For timer related operations */
+#include <linux/jiffies.h>      /* For jiffies stuff */
+#include <linux/miscdevice.h>   /* For MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR) */
+#include <linux/watchdog.h>     /* For the watchdog specific items */
+#include <linux/notifier.h>     /* For notifier support */
+#include <linux/reboot.h>       /* For reboot_notifier stuff */
+#include <linux/init.h>         /* For __init/__exit/... */
+#include <linux/fs.h>           /* For file operations */
+#include <linux/ioport.h>       /* For io-port access */
+#include <linux/spinlock.h>     /* For spin_lock/spin_unlock/... */
 #include <linux/sched.h>        /* TASK_INTERRUPTIBLE, set_current_state() and friends */
-#include <asm/uaccess.h>
-#include <asm/io.h>
+#include <linux/slab.h>         /* For kmalloc */
 
-#define WD_VER                  "1.16 (06/12/2004)"
-#define PFX                     "pcwd: "
+#include <asm/uaccess.h>        /* For copy_to_user/put_user/... */
+#include <asm/io.h>             /* For inb/outb/... */
+
+/* Module and version information */
+#define WATCHDOG_VERSION "1.16"
+#define WATCHDOG_DATE "03 Jan 2006"
+#define WATCHDOG_DRIVER_NAME "ISA-PC Watchdog"
+#define WATCHDOG_NAME "pcwd"
+#define PFX WATCHDOG_NAME ": "
+#define DRIVER_VERSION WATCHDOG_DRIVER_NAME " driver, v" WATCHDOG_VERSION " (" WATCHDOG_DATE ")\n"
+#define WD_VER WATCHDOG_VERSION " (" WATCHDOG_DATE ")"
 
 /*
  * It should be noted that PCWD_REVISION_B was removed because A and B
@@ -85,36 +93,38 @@
 
 /*
  * These are the defines that describe the control status bits for the
- * PC Watchdog card, revision A.
- */
+ * PCI-PC Watchdog card.
+*/
+/* Port 1 : Control Status #1 for the PC Watchdog card, revision A. */
 #define WD_WDRST                0x01    /* Previously reset state */
 #define WD_T110                 0x02    /* Temperature overheat sense */
 #define WD_HRTBT                0x04    /* Heartbeat sense */
 #define WD_RLY2                 0x08    /* External relay triggered */
 #define WD_SRLY2                0x80    /* Software external relay triggered */
-
-/*
- * These are the defines that describe the control status bits for the
- * PC Watchdog card, revision C.
- */
+/* Port 1 : Control Status #1 for the PC Watchdog card, revision C. */
 #define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
 #define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
 #define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+/* Port 2 : Control Status #2 */
+#define WD_WDIS                 0x10    /* Watchdog Disabled */
+#define WD_ENTP                 0x20    /* Watchdog Enable Temperature Trip */
+#define WD_SSEL                 0x40    /* Watchdog Switch Select (1:SW1 <-> 0:SW2) */
+#define WD_WCMD                 0x80    /* Watchdog Command Mode */
 
 /* max. time we give an ISA watchdog card to process a command */
 /* 500ms for each 4 bit response (according to spec.) */
 #define ISA_COMMAND_TIMEOUT     1000
 
 /* Watchdog's internal commands */
-#define CMD_ISA_IDLE                    0x00
-#define CMD_ISA_VERSION_INTEGER         0x01
-#define CMD_ISA_VERSION_TENTH           0x02
-#define CMD_ISA_VERSION_HUNDRETH        0x03
-#define CMD_ISA_VERSION_MINOR           0x04
-#define CMD_ISA_SWITCH_SETTINGS         0x05
-#define CMD_ISA_DELAY_TIME_2SECS        0x0A
-#define CMD_ISA_DELAY_TIME_4SECS        0x0B
-#define CMD_ISA_DELAY_TIME_8SECS        0x0C
+#define CMD_ISA_IDLE                    0x00
+#define CMD_ISA_VERSION_INTEGER         0x01
+#define CMD_ISA_VERSION_TENTH           0x02
+#define CMD_ISA_VERSION_HUNDRETH        0x03
+#define CMD_ISA_VERSION_MINOR           0x04
+#define CMD_ISA_SWITCH_SETTINGS         0x05
+#define CMD_ISA_DELAY_TIME_2SECS        0x0A
+#define CMD_ISA_DELAY_TIME_4SECS        0x0B
+#define CMD_ISA_DELAY_TIME_8SECS        0x0C
 
 /*
  * We are using an kernel timer to do the pinging of the watchdog
@@ -130,15 +140,17 @@ static int cards_found;
 /* internal variables */
 static atomic_t open_allowed = ATOMIC_INIT(1);
 static char expect_close;
-static struct timer_list timer;
-static unsigned long next_heartbeat;
 static int temp_panic;
-static int revision;                    /* The card's revision */
-static int supports_temp;               /* Wether or not the card has a temperature device */
-static int command_mode;                /* Wether or not the card is in command mode */
-static int initial_status;              /* The card's boot status */
-static int current_readport;            /* The cards I/O address */
-static spinlock_t io_lock;
+static struct {                         /* this is private data for each ISA-PC watchdog card */
+        int revision;                   /* The card's revision */
+        int supports_temp;              /* Wether or not the card has a temperature device */
+        int command_mode;               /* Wether or not the card is in command mode */
+        int boot_status;                /* The card's boot status */
+        int io_addr;                    /* The cards I/O address */
+        spinlock_t io_lock;             /* the lock for io operations */
+        struct timer_list timer;        /* The timer that pings the watchdog */
+        unsigned long next_heartbeat;   /* the next_heartbeat for the timer */
+} pcwd_private;
 
 /* module parameters */
 #define WATCHDOG_HEARTBEAT 60           /* 60 sec default heartbeat */
@@ -161,14 +173,14 @@ static int send_isa_command(int cmd)
         int port0, last_port0;  /* Double read for stabilising */
 
         /* The WCMD bit must be 1 and the command is only 4 bits in size */
-        control_status = (cmd & 0x0F) | 0x80;
-        outb_p(control_status, current_readport + 2);
+        control_status = (cmd & 0x0F) | WD_WCMD;
+        outb_p(control_status, pcwd_private.io_addr + 2);
         udelay(ISA_COMMAND_TIMEOUT);
 
-        port0 = inb_p(current_readport);
+        port0 = inb_p(pcwd_private.io_addr);
         for (i = 0; i < 25; ++i) {
                 last_port0 = port0;
-                port0 = inb_p(current_readport);
+                port0 = inb_p(pcwd_private.io_addr);
 
                 if (port0 == last_port0)
                         break;  /* Data is stable */
@@ -184,7 +196,7 @@ static int set_command_mode(void)
         int i, found=0, count=0;
 
         /* Set the card into command mode */
-        spin_lock(&io_lock);
+        spin_lock(&pcwd_private.io_lock);
         while ((!found) && (count < 3)) {
                 i = send_isa_command(CMD_ISA_IDLE);
 
@@ -192,15 +204,15 @@ static int set_command_mode(void)
                         found = 1;
                 else if (i == 0xF3) {
                         /* Card does not like what we've done to it */
-                        outb_p(0x00, current_readport + 2);
+                        outb_p(0x00, pcwd_private.io_addr + 2);
                         udelay(1200);   /* Spec says wait 1ms */
-                        outb_p(0x00, current_readport + 2);
+                        outb_p(0x00, pcwd_private.io_addr + 2);
                         udelay(ISA_COMMAND_TIMEOUT);
                 }
                 count++;
         }
-        spin_unlock(&io_lock);
-        command_mode = found;
+        spin_unlock(&pcwd_private.io_lock);
+        pcwd_private.command_mode = found;
 
         return(found);
 }
@@ -208,12 +220,95 @@ static int set_command_mode(void)
 static void unset_command_mode(void)
 {
         /* Set the card into normal mode */
-        spin_lock(&io_lock);
-        outb_p(0x00, current_readport + 2);
+        spin_lock(&pcwd_private.io_lock);
+        outb_p(0x00, pcwd_private.io_addr + 2);
         udelay(ISA_COMMAND_TIMEOUT);
-        spin_unlock(&io_lock);
+        spin_unlock(&pcwd_private.io_lock);
+
+        pcwd_private.command_mode = 0;
+}
+
+static inline void pcwd_check_temperature_support(void)
+{
+        if (inb(pcwd_private.io_addr) != 0xF0)
+                pcwd_private.supports_temp = 1;
+}
+
+static inline char *get_firmware(void)
+{
+        int one, ten, hund, minor;
+        char *ret;
+
+        ret = kmalloc(6, GFP_KERNEL);
+        if(ret == NULL)
+                return NULL;
+
+        if (set_command_mode()) {
+                one = send_isa_command(CMD_ISA_VERSION_INTEGER);
+                ten = send_isa_command(CMD_ISA_VERSION_TENTH);
+                hund = send_isa_command(CMD_ISA_VERSION_HUNDRETH);
+                minor = send_isa_command(CMD_ISA_VERSION_MINOR);
+                sprintf(ret, "%c.%c%c%c", one, ten, hund, minor);
+        }
+        else
+                sprintf(ret, "ERROR");
+
+        unset_command_mode();
+        return(ret);
+}
+
+static inline int pcwd_get_option_switches(void)
+{
+        int option_switches=0;
+
+        if (set_command_mode()) {
+                /* Get switch settings */
+                option_switches = send_isa_command(CMD_ISA_SWITCH_SETTINGS);
+        }
+
+        unset_command_mode();
+        return(option_switches);
+}
+
+static void pcwd_show_card_info(void)
+{
+        char *firmware;
+        int option_switches;
+
+        /* Get some extra info from the hardware (in command/debug/diag mode) */
+        if (pcwd_private.revision == PCWD_REVISION_A)
+                printk(KERN_INFO PFX "ISA-PC Watchdog (REV.A) detected at port 0x%04x\n", pcwd_private.io_addr);
+        else if (pcwd_private.revision == PCWD_REVISION_C) {
+                firmware = get_firmware();
+                printk(KERN_INFO PFX "ISA-PC Watchdog (REV.C) detected at port 0x%04x (Firmware version: %s)\n",
+                        pcwd_private.io_addr, firmware);
+                kfree(firmware);
+                option_switches = pcwd_get_option_switches();
+                printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
+                        option_switches,
+                        ((option_switches & 0x10) ? "ON" : "OFF"),
+                        ((option_switches & 0x08) ? "ON" : "OFF"));
+
+                /* Reprogram internal heartbeat to 2 seconds */
+                if (set_command_mode()) {
+                        send_isa_command(CMD_ISA_DELAY_TIME_2SECS);
+                        unset_command_mode();
+                }
+        }
+
+        if (pcwd_private.supports_temp)
+                printk(KERN_INFO PFX "Temperature Option Detected\n");
+
+        if (pcwd_private.boot_status & WDIOF_CARDRESET)
+                printk(KERN_INFO PFX "Previous reboot was caused by the card\n");
+
+        if (pcwd_private.boot_status & WDIOF_OVERHEAT) {
+                printk(KERN_EMERG PFX "Card senses a CPU Overheat. Panicking!\n");
+                printk(KERN_EMERG PFX "CPU Overheat\n");
+        }
 
-        command_mode = 0;
+        if (pcwd_private.boot_status == 0)
+                printk(KERN_INFO PFX "No previous trip detected - Cold boot or reset\n");
 }
 
 static void pcwd_timer_ping(unsigned long data)
@@ -222,25 +317,25 @@ static void pcwd_timer_ping(unsigned long data)
 
         /* If we got a heartbeat pulse within the WDT_INTERVAL
          * we agree to ping the WDT */
-        if(time_before(jiffies, next_heartbeat)) {
+        if(time_before(jiffies, pcwd_private.next_heartbeat)) {
                 /* Ping the watchdog */
-                spin_lock(&io_lock);
-                if (revision == PCWD_REVISION_A) {
+                spin_lock(&pcwd_private.io_lock);
+                if (pcwd_private.revision == PCWD_REVISION_A) {
                         /*  Rev A cards are reset by setting the WD_WDRST bit in register 1 */
-                        wdrst_stat = inb_p(current_readport);
+                        wdrst_stat = inb_p(pcwd_private.io_addr);
                         wdrst_stat &= 0x0F;
                         wdrst_stat |= WD_WDRST;
 
-                        outb_p(wdrst_stat, current_readport + 1);
+                        outb_p(wdrst_stat, pcwd_private.io_addr + 1);
                 } else {
                         /* Re-trigger watchdog by writing to port 0 */
-                        outb_p(0x00, current_readport);
+                        outb_p(0x00, pcwd_private.io_addr);
                 }
 
                 /* Re-set the timer interval */
-                mod_timer(&timer, jiffies + WDT_INTERVAL);
+                mod_timer(&pcwd_private.timer, jiffies + WDT_INTERVAL);
 
-                spin_unlock(&io_lock);
+                spin_unlock(&pcwd_private.io_lock);
         } else {
                 printk(KERN_WARNING PFX "Heartbeat lost! Will not ping the watchdog\n");
         }
@@ -250,19 +345,19 @@ static int pcwd_start(void)
 {
         int stat_reg;
 
-        next_heartbeat = jiffies + (heartbeat * HZ);
+        pcwd_private.next_heartbeat = jiffies + (heartbeat * HZ);
 
         /* Start the timer */
-        mod_timer(&timer, jiffies + WDT_INTERVAL);
+        mod_timer(&pcwd_private.timer, jiffies + WDT_INTERVAL);
 
         /* Enable the port */
-        if (revision == PCWD_REVISION_C) {
-                spin_lock(&io_lock);
-                outb_p(0x00, current_readport + 3);
+        if (pcwd_private.revision == PCWD_REVISION_C) {
+                spin_lock(&pcwd_private.io_lock);
+                outb_p(0x00, pcwd_private.io_addr + 3);
                 udelay(ISA_COMMAND_TIMEOUT);
-                stat_reg = inb_p(current_readport + 2);
-                spin_unlock(&io_lock);
-                if (stat_reg & 0x10) {
+                stat_reg = inb_p(pcwd_private.io_addr + 2);
+                spin_unlock(&pcwd_private.io_lock);
+                if (stat_reg & WD_WDIS) {
                         printk(KERN_INFO PFX "Could not start watchdog\n");
                         return -EIO;
                 }
@@ -275,18 +370,18 @@ static int pcwd_stop(void)
         int stat_reg;
 
         /* Stop the timer */
-        del_timer(&timer);
+        del_timer(&pcwd_private.timer);
 
         /*  Disable the board  */
-        if (revision == PCWD_REVISION_C) {
-                spin_lock(&io_lock);
-                outb_p(0xA5, current_readport + 3);
+        if (pcwd_private.revision == PCWD_REVISION_C) {
+                spin_lock(&pcwd_private.io_lock);
+                outb_p(0xA5, pcwd_private.io_addr + 3);
                 udelay(ISA_COMMAND_TIMEOUT);
-                outb_p(0xA5, current_readport + 3);
+                outb_p(0xA5, pcwd_private.io_addr + 3);
                 udelay(ISA_COMMAND_TIMEOUT);
-                stat_reg = inb_p(current_readport + 2);
-                spin_unlock(&io_lock);
-                if ((stat_reg & 0x10) == 0) {
+                stat_reg = inb_p(pcwd_private.io_addr + 2);
+                spin_unlock(&pcwd_private.io_lock);
+                if ((stat_reg & WD_WDIS) == 0) {
                         printk(KERN_INFO PFX "Could not stop watchdog\n");
                         return -EIO;
                 }
@@ -297,7 +392,7 @@ static int pcwd_stop(void)
 static int pcwd_keepalive(void)
 {
         /* user land ping */
-        next_heartbeat = jiffies + (heartbeat * HZ);
+        pcwd_private.next_heartbeat = jiffies + (heartbeat * HZ);
         return 0;
 }
 
@@ -315,23 +410,23 @@ static int pcwd_get_status(int *status)
         int card_status;
 
         *status=0;
-        spin_lock(&io_lock);
-        if (revision == PCWD_REVISION_A)
+        spin_lock(&pcwd_private.io_lock);
+        if (pcwd_private.revision == PCWD_REVISION_A)
                 /* Rev A cards return status information from
                  * the base register, which is used for the
                  * temperature in other cards. */
-                card_status = inb(current_readport);
+                card_status = inb(pcwd_private.io_addr);
         else {
                 /* Rev C cards return card status in the base
                  * address + 1 register. And use different bits
                  * to indicate a card initiated reset, and an
                  * over-temperature condition. And the reboot
                  * status can be reset. */
-                card_status = inb(current_readport + 1);
+                card_status = inb(pcwd_private.io_addr + 1);
         }
-        spin_unlock(&io_lock);
+        spin_unlock(&pcwd_private.io_lock);
 
-        if (revision == PCWD_REVISION_A) {
+        if (pcwd_private.revision == PCWD_REVISION_A) {
                 if (card_status & WD_WDRST)
                         *status |= WDIOF_CARDRESET;
 
@@ -360,10 +455,10 @@ static int pcwd_get_status(int *status)
 
 static int pcwd_clear_status(void)
 {
-        if (revision == PCWD_REVISION_C) {
-                spin_lock(&io_lock);
-                outb_p(0x00, current_readport + 1); /* clear reset status */
-                spin_unlock(&io_lock);
+        if (pcwd_private.revision == PCWD_REVISION_C) {
+                spin_lock(&pcwd_private.io_lock);
+                outb_p(0x00, pcwd_private.io_addr + 1); /* clear reset status */
+                spin_unlock(&pcwd_private.io_lock);
         }
         return 0;
 }
@@ -371,20 +466,20 @@ static int pcwd_clear_status(void)
 static int pcwd_get_temperature(int *temperature)
 {
         /* check that port 0 gives temperature info and no command results */
-        if (command_mode)
+        if (pcwd_private.command_mode)
                 return -1;
 
         *temperature = 0;
-        if (!supports_temp)
+        if (!pcwd_private.supports_temp)
                 return -ENODEV;
 
         /*
          * Convert celsius to fahrenheit, since this was
          * the decided 'standard' for this return value.
          */
-        spin_lock(&io_lock);
-        *temperature = ((inb(current_readport)) * 9 / 5) + 32;
-        spin_unlock(&io_lock);
+        spin_lock(&pcwd_private.io_lock);
+        *temperature = ((inb(pcwd_private.io_addr)) * 9 / 5) + 32;
+        spin_unlock(&pcwd_private.io_lock);
 
         return 0;
 }
@@ -425,7 +520,7 @@ static int pcwd_ioctl(struct inode *inode, struct file *file,
                 return put_user(status, argp);
 
         case WDIOC_GETBOOTSTATUS:
-                return put_user(initial_status, argp);
+                return put_user(pcwd_private.boot_status, argp);
 
         case WDIOC_GETTEMP:
                 if (pcwd_get_temperature(&temperature))
@@ -434,7 +529,7 @@ static int pcwd_ioctl(struct inode *inode, struct file *file,
                 return put_user(temperature, argp);
 
         case WDIOC_SETOPTIONS:
-                if (revision == PCWD_REVISION_C)
+                if (pcwd_private.revision == PCWD_REVISION_C)
                 {
                         if(copy_from_user(&rv, argp, sizeof(int)))
                                 return -EFAULT;
@@ -550,7 +645,7 @@ static ssize_t pcwd_temp_read(struct file *file, char __user *buf, size_t count,
 
 static int pcwd_temp_open(struct inode *inode, struct file *file)
 {
-        if (!supports_temp)
+        if (!pcwd_private.supports_temp)
                 return -ENODEV;
 
         return nonseekable_open(inode, file);
@@ -616,68 +711,24 @@ static struct notifier_block pcwd_notifier = {
  *      Init & exit routines
  */
 
-static inline void get_support(void)
-{
-        if (inb(current_readport) != 0xF0)
-                supports_temp = 1;
-}
-
 static inline int get_revision(void)
 {
         int r = PCWD_REVISION_C;
 
-        spin_lock(&io_lock);
+        spin_lock(&pcwd_private.io_lock);
         /* REV A cards use only 2 io ports; test
          * presumes a floating bus reads as 0xff. */
-        if ((inb(current_readport + 2) == 0xFF) ||
-            (inb(current_readport + 3) == 0xFF))
+        if ((inb(pcwd_private.io_addr + 2) == 0xFF) ||
+            (inb(pcwd_private.io_addr + 3) == 0xFF))
                 r=PCWD_REVISION_A;
-        spin_unlock(&io_lock);
+        spin_unlock(&pcwd_private.io_lock);
 
         return r;
 }
 
-static inline char *get_firmware(void)
-{
-        int one, ten, hund, minor;
-        char *ret;
-
-        ret = kmalloc(6, GFP_KERNEL);
-        if(ret == NULL)
-                return NULL;
-
-        if (set_command_mode()) {
-                one = send_isa_command(CMD_ISA_VERSION_INTEGER);
-                ten = send_isa_command(CMD_ISA_VERSION_TENTH);
-                hund = send_isa_command(CMD_ISA_VERSION_HUNDRETH);
-                minor = send_isa_command(CMD_ISA_VERSION_MINOR);
-                sprintf(ret, "%c.%c%c%c", one, ten, hund, minor);
-        }
-        else
-                sprintf(ret, "ERROR");
-
-        unset_command_mode();
-        return(ret);
-}
-
-static inline int get_option_switches(void)
-{
-        int rv=0;
-
-        if (set_command_mode()) {
-                /* Get switch settings */
-                rv = send_isa_command(CMD_ISA_SWITCH_SETTINGS);
-        }
-
-        unset_command_mode();
-        return(rv);
-}
-
 static int __devinit pcwatchdog_init(int base_addr)
 {
         int ret;
-        char *firmware;
-        int option_switches;
 
         cards_found++;
         if (cards_found == 1)
@@ -692,104 +743,66 @@ static int __devinit pcwatchdog_init(int base_addr)
                 printk(KERN_ERR PFX "No I/O-Address for card detected\n");
                 return -ENODEV;
         }
-        current_readport = base_addr;
+        pcwd_private.io_addr = base_addr;
 
         /* Check card's revision */
-        revision = get_revision();
+        pcwd_private.revision = get_revision();
 
-        if (!request_region(current_readport, (revision == PCWD_REVISION_A) ? 2 : 4, "PCWD")) {
+        if (!request_region(pcwd_private.io_addr, (pcwd_private.revision == PCWD_REVISION_A) ? 2 : 4, "PCWD")) {
                 printk(KERN_ERR PFX "I/O address 0x%04x already in use\n",
-                        current_readport);
-                current_readport = 0x0000;
+                        pcwd_private.io_addr);
+                pcwd_private.io_addr = 0x0000;
                 return -EIO;
         }
 
         /* Initial variables */
-        supports_temp = 0;
+        pcwd_private.supports_temp = 0;
         temp_panic = 0;
-        initial_status = 0x0000;
+        pcwd_private.boot_status = 0x0000;
 
         /* get the boot_status */
-        pcwd_get_status(&initial_status);
+        pcwd_get_status(&pcwd_private.boot_status);
 
         /* clear the "card caused reboot" flag */
         pcwd_clear_status();
 
-        init_timer(&timer);
-        timer.function = pcwd_timer_ping;
-        timer.data = 0;
+        init_timer(&pcwd_private.timer);
+        pcwd_private.timer.function = pcwd_timer_ping;
+        pcwd_private.timer.data = 0;
 
         /*  Disable the board  */
         pcwd_stop();
 
         /*  Check whether or not the card supports the temperature device */
-        get_support();
-
-        /* Get some extra info from the hardware (in command/debug/diag mode) */
-        if (revision == PCWD_REVISION_A)
-                printk(KERN_INFO PFX "ISA-PC Watchdog (REV.A) detected at port 0x%04x\n", current_readport);
-        else if (revision == PCWD_REVISION_C) {
-                firmware = get_firmware();
-                printk(KERN_INFO PFX "ISA-PC Watchdog (REV.C) detected at port 0x%04x (Firmware version: %s)\n",
-                        current_readport, firmware);
-                kfree(firmware);
-                option_switches = get_option_switches();
-                printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
-                        option_switches,
-                        ((option_switches & 0x10) ? "ON" : "OFF"),
-                        ((option_switches & 0x08) ? "ON" : "OFF"));
-
-                /* Reprogram internal heartbeat to 2 seconds */
-                if (set_command_mode()) {
-                        send_isa_command(CMD_ISA_DELAY_TIME_2SECS);
-                        unset_command_mode();
-                }
-        } else {
-                /* Should NEVER happen, unless get_revision() fails. */
-                printk(KERN_INFO PFX "Unable to get revision\n");
-                release_region(current_readport, (revision == PCWD_REVISION_A) ? 2 : 4);
-                current_readport = 0x0000;
-                return -1;
-        }
+        pcwd_check_temperature_support();
 
-        if (supports_temp)
-                printk(KERN_INFO PFX "Temperature Option Detected\n");
-
-        if (initial_status & WDIOF_CARDRESET)
-                printk(KERN_INFO PFX "Previous reboot was caused by the card\n");
-
-        if (initial_status & WDIOF_OVERHEAT) {
-                printk(KERN_EMERG PFX "Card senses a CPU Overheat. Panicking!\n");
-                printk(KERN_EMERG PFX "CPU Overheat\n");
-        }
-
-        if (initial_status == 0)
-                printk(KERN_INFO PFX "No previous trip detected - Cold boot or reset\n");
+        /* Show info about the card itself */
+        pcwd_show_card_info();
 
         /* Check that the heartbeat value is within it's range ; if not reset to the default */
-        if (pcwd_set_heartbeat(heartbeat)) {
-                pcwd_set_heartbeat(WATCHDOG_HEARTBEAT);
-                printk(KERN_INFO PFX "heartbeat value must be 2<=heartbeat<=7200, using %d\n",
-                        WATCHDOG_HEARTBEAT);
+        if (pcwd_set_heartbeat(heartbeat)) {
+                pcwd_set_heartbeat(WATCHDOG_HEARTBEAT);
+                printk(KERN_INFO PFX "heartbeat value must be 2<=heartbeat<=7200, using %d\n",
+                        WATCHDOG_HEARTBEAT);
         }
 
         ret = register_reboot_notifier(&pcwd_notifier);
         if (ret) {
                 printk(KERN_ERR PFX "cannot register reboot notifier (err=%d)\n",
                         ret);
-                release_region(current_readport, (revision == PCWD_REVISION_A) ? 2 : 4);
-                current_readport = 0x0000;
+                release_region(pcwd_private.io_addr, (pcwd_private.revision == PCWD_REVISION_A) ? 2 : 4);
+                pcwd_private.io_addr = 0x0000;
                 return ret;
         }
 
-        if (supports_temp) {
+        if (pcwd_private.supports_temp) {
                 ret = misc_register(&temp_miscdev);
                 if (ret) {
                         printk(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
                                 TEMP_MINOR, ret);
                         unregister_reboot_notifier(&pcwd_notifier);
-                        release_region(current_readport, (revision == PCWD_REVISION_A) ? 2 : 4);
-                        current_readport = 0x0000;
+                        release_region(pcwd_private.io_addr, (pcwd_private.revision == PCWD_REVISION_A) ? 2 : 4);
+                        pcwd_private.io_addr = 0x0000;
                         return ret;
                 }
         }
@@ -798,11 +811,11 @@ static int __devinit pcwatchdog_init(int base_addr)
         if (ret) {
                 printk(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
                         WATCHDOG_MINOR, ret);
-                if (supports_temp)
+                if (pcwd_private.supports_temp)
                         misc_deregister(&temp_miscdev);
                 unregister_reboot_notifier(&pcwd_notifier);
-                release_region(current_readport, (revision == PCWD_REVISION_A) ? 2 : 4);
-                current_readport = 0x0000;
+                release_region(pcwd_private.io_addr, (pcwd_private.revision == PCWD_REVISION_A) ? 2 : 4);
+                pcwd_private.io_addr = 0x0000;
                 return ret;
         }
 
@@ -820,11 +833,12 @@ static void __devexit pcwatchdog_exit(void)
 
         /* Deregister */
         misc_deregister(&pcwd_miscdev);
-        if (supports_temp)
+        if (pcwd_private.supports_temp)
                 misc_deregister(&temp_miscdev);
         unregister_reboot_notifier(&pcwd_notifier);
-        release_region(current_readport, (revision == PCWD_REVISION_A) ? 2 : 4);
-        current_readport = 0x0000;
+        release_region(pcwd_private.io_addr, (pcwd_private.revision == PCWD_REVISION_A) ? 2 : 4);
+        pcwd_private.io_addr = 0x0000;
+        cards_found--;
 }
 
 /*
@@ -887,7 +901,7 @@ static int __init pcwd_init_module(void)
 {
         int i, found = 0;
 
-        spin_lock_init(&io_lock);
+        spin_lock_init(&pcwd_private.io_lock);
 
         for (i = 0; pcwd_ioports[i] != 0; i++) {
                 if (pcwd_checkcard(pcwd_ioports[i])) {
@@ -906,7 +920,7 @@ static int __init pcwd_init_module(void)
 
 static void __exit pcwd_cleanup_module(void)
 {
-        if (current_readport)
+        if (pcwd_private.io_addr)
                 pcwatchdog_exit();
         return;
 }
diff --git a/drivers/char/watchdog/sa1100_wdt.c b/drivers/char/watchdog/sa1100_wdt.c
index b474ea52d6e8..522a9370db94 100644
--- a/drivers/char/watchdog/sa1100_wdt.c
+++ b/drivers/char/watchdog/sa1100_wdt.c
@@ -93,23 +93,25 @@ static int sa1100dog_ioctl(struct inode *inode, struct file *file,
 {
         int ret = -ENOIOCTLCMD;
         int time;
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
 
         switch (cmd) {
         case WDIOC_GETSUPPORT:
-                ret = copy_to_user((struct watchdog_info __user *)arg, &ident,
+                ret = copy_to_user(argp, &ident,
                                    sizeof(ident)) ? -EFAULT : 0;
                 break;
 
         case WDIOC_GETSTATUS:
-                ret = put_user(0, (int __user *)arg);
+                ret = put_user(0, p);
                 break;
 
         case WDIOC_GETBOOTSTATUS:
-                ret = put_user(boot_status, (int __user *)arg);
+                ret = put_user(boot_status, p);
                 break;
 
         case WDIOC_SETTIMEOUT:
-                ret = get_user(time, (int __user *)arg);
+                ret = get_user(time, p);
                 if (ret)
                         break;
 
@@ -123,7 +125,7 @@ static int sa1100dog_ioctl(struct inode *inode, struct file *file,
                 /*fall through*/
 
         case WDIOC_GETTIMEOUT:
-                ret = put_user(pre_margin / OSCR_FREQ, (int __user *)arg);
+                ret = put_user(pre_margin / OSCR_FREQ, p);
                 break;
 
         case WDIOC_KEEPALIVE:
diff --git a/drivers/char/watchdog/sbc_epx_c3.c b/drivers/char/watchdog/sbc_epx_c3.c
index 7a4dfb95d087..837b1ec3ffe3 100644
--- a/drivers/char/watchdog/sbc_epx_c3.c
+++ b/drivers/char/watchdog/sbc_epx_c3.c
@@ -92,7 +92,7 @@ static int epx_c3_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static ssize_t epx_c3_write(struct file *file, const char *data,
+static ssize_t epx_c3_write(struct file *file, const char __user *data,
                         size_t len, loff_t *ppos)
 {
         /* Refresh the timer. */
@@ -105,6 +105,7 @@ static int epx_c3_ioctl(struct inode *inode, struct file *file,
                         unsigned int cmd, unsigned long arg)
 {
         int options, retval = -EINVAL;
+        int __user *argp = (void __user *)arg;
         static struct watchdog_info ident = {
                 .options                = WDIOF_KEEPALIVEPING |
                                           WDIOF_MAGICCLOSE,
@@ -114,20 +115,19 @@ static int epx_c3_ioctl(struct inode *inode, struct file *file,
 
         switch (cmd) {
         case WDIOC_GETSUPPORT:
-                if (copy_to_user((struct watchdog_info *)arg,
-                                 &ident, sizeof(ident)))
+                if (copy_to_user(argp, &ident, sizeof(ident)))
                         return -EFAULT;
                 return 0;
         case WDIOC_GETSTATUS:
         case WDIOC_GETBOOTSTATUS:
-                return put_user(0,(int *)arg);
+                return put_user(0, argp);
         case WDIOC_KEEPALIVE:
                 epx_c3_pet();
                 return 0;
         case WDIOC_GETTIMEOUT:
-                return put_user(WATCHDOG_TIMEOUT,(int *)arg);
-        case WDIOC_SETOPTIONS: {
-                if (get_user(options, (int *)arg))
+                return put_user(WATCHDOG_TIMEOUT, argp);
+        case WDIOC_SETOPTIONS:
+                if (get_user(options, argp))
                         return -EFAULT;
 
                 if (options & WDIOS_DISABLECARD) {
@@ -141,7 +141,6 @@ static int epx_c3_ioctl(struct inode *inode, struct file *file,
                 }
 
                 return retval;
-        }
         default:
                 return -ENOIOCTLCMD;
         }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 7a511479ae29..9582de1c9cad 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -35,8 +35,8 @@
  * level driver of CPUFreq support, and its spinlock. This lock
  * also protects the cpufreq_cpu_data array.
  */
-static struct cpufreq_driver    *cpufreq_driver;
-static struct cpufreq_policy    *cpufreq_cpu_data[NR_CPUS];
+static struct cpufreq_driver *cpufreq_driver;
+static struct cpufreq_policy *cpufreq_cpu_data[NR_CPUS];
 static DEFINE_SPINLOCK(cpufreq_driver_lock);
 
 /* internal prototypes */
@@ -50,15 +50,15 @@ static void handle_update(void *data);
  * changes to devices when the CPU clock speed changes.
  * The mutex locks both lists.
  */
-static struct notifier_block    *cpufreq_policy_notifier_list;
-static struct notifier_block    *cpufreq_transition_notifier_list;
-static DECLARE_RWSEM            (cpufreq_notifier_rwsem);
+static struct notifier_block *cpufreq_policy_notifier_list;
+static struct notifier_block *cpufreq_transition_notifier_list;
+static DECLARE_RWSEM (cpufreq_notifier_rwsem);
 
 
 static LIST_HEAD(cpufreq_governor_list);
-static DEFINE_MUTEX             (cpufreq_governor_mutex);
+static DEFINE_MUTEX (cpufreq_governor_mutex);
 
-struct cpufreq_policy * cpufreq_cpu_get(unsigned int cpu)
+struct cpufreq_policy *cpufreq_cpu_get(unsigned int cpu)
 {
         struct cpufreq_policy *data;
         unsigned long flags;
@@ -85,20 +85,19 @@ struct cpufreq_policy * cpufreq_cpu_get(unsigned int cpu)
         if (!kobject_get(&data->kobj))
                 goto err_out_put_module;
 
-
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
-
         return data;
 
- err_out_put_module:
+err_out_put_module:
         module_put(cpufreq_driver->owner);
- err_out_unlock:
+err_out_unlock:
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
- err_out:
+err_out:
         return NULL;
 }
 EXPORT_SYMBOL_GPL(cpufreq_cpu_get);
 
+
 void cpufreq_cpu_put(struct cpufreq_policy *data)
 {
         kobject_put(&data->kobj);
@@ -229,44 +228,53 @@ static inline void adjust_jiffies(unsigned long val, struct cpufreq_freqs *ci) {
 
 
 /**
- * cpufreq_notify_transition - call notifier chain and adjust_jiffies on frequency transition
+ * cpufreq_notify_transition - call notifier chain and adjust_jiffies
+ * on frequency transition.
  *
- * This function calls the transition notifiers and the "adjust_jiffies" function. It is called
- * twice on all CPU frequency changes that have external effects. 
+ * This function calls the transition notifiers and the "adjust_jiffies"
+ * function. It is called twice on all CPU frequency changes that have
+ * external effects. 
  */
 void cpufreq_notify_transition(struct cpufreq_freqs *freqs, unsigned int state)
 {
+        struct cpufreq_policy *policy;
+
         BUG_ON(irqs_disabled());
 
         freqs->flags = cpufreq_driver->flags;
-        dprintk("notification %u of frequency transition to %u kHz\n", state, freqs->new);
+        dprintk("notification %u of frequency transition to %u kHz\n",
+                state, freqs->new);
 
         down_read(&cpufreq_notifier_rwsem);
+
+        policy = cpufreq_cpu_data[freqs->cpu];
         switch (state) {
+
         case CPUFREQ_PRECHANGE:
-                /* detect if the driver reported a value as "old frequency" which
-                 * is not equal to what the cpufreq core thinks is "old frequency".
+                /* detect if the driver reported a value as "old frequency" 
+                 * which is not equal to what the cpufreq core thinks is
+                 * "old frequency".
                  */
                 if (!(cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)) {
-                        if ((likely(cpufreq_cpu_data[freqs->cpu])) &&
-                            (likely(cpufreq_cpu_data[freqs->cpu]->cpu == freqs->cpu)) &&
-                            (likely(cpufreq_cpu_data[freqs->cpu]->cur)) &&
-                            (unlikely(freqs->old != cpufreq_cpu_data[freqs->cpu]->cur)))
-                        {
-                                dprintk(KERN_WARNING "Warning: CPU frequency is %u, "
-                                       "cpufreq assumed %u kHz.\n", freqs->old, cpufreq_cpu_data[freqs->cpu]->cur);
-                                freqs->old = cpufreq_cpu_data[freqs->cpu]->cur;
+                        if ((policy) && (policy->cpu == freqs->cpu) &&
+                            (policy->cur) && (policy->cur != freqs->old)) {
+                                dprintk(KERN_WARNING "Warning: CPU frequency is"
+                                        " %u, cpufreq assumed %u kHz.\n",
+                                        freqs->old, policy->cur);
+                                freqs->old = policy->cur;
                         }
                 }
-                notifier_call_chain(&cpufreq_transition_notifier_list, CPUFREQ_PRECHANGE, freqs);
+                notifier_call_chain(&cpufreq_transition_notifier_list,
+                                        CPUFREQ_PRECHANGE, freqs);
                 adjust_jiffies(CPUFREQ_PRECHANGE, freqs);
                 break;
+
         case CPUFREQ_POSTCHANGE:
                 adjust_jiffies(CPUFREQ_POSTCHANGE, freqs);
-                notifier_call_chain(&cpufreq_transition_notifier_list, CPUFREQ_POSTCHANGE, freqs);
-                if ((likely(cpufreq_cpu_data[freqs->cpu])) && 
-                    (likely(cpufreq_cpu_data[freqs->cpu]->cpu == freqs->cpu)))
-                        cpufreq_cpu_data[freqs->cpu]->cur = freqs->new;
+                notifier_call_chain(&cpufreq_transition_notifier_list,
+                                        CPUFREQ_POSTCHANGE, freqs);
+                if (likely(policy) && likely(policy->cpu == freqs->cpu))
+                        policy->cur = freqs->new;
                 break;
         }
         up_read(&cpufreq_notifier_rwsem);
@@ -308,7 +316,7 @@ static int cpufreq_parse_governor (char *str_governor, unsigned int *policy,
                                 return 0;
                         }
                 }
-        out:
+out:
                 mutex_unlock(&cpufreq_governor_mutex);
         }
         return -EINVAL;
@@ -415,7 +423,6 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
                 return -EINVAL;
 
         ret = cpufreq_set_policy(&new_policy);
-
         return ret ? ret : count;
 }
 
@@ -446,7 +453,7 @@ static ssize_t show_scaling_available_governors (struct cpufreq_policy * policy,
                         goto out;
                 i += scnprintf(&buf[i], CPUFREQ_NAME_LEN, "%s ", t->name);
         }
- out:
+out:
         i += sprintf(&buf[i], "\n");
         return i;
 }
@@ -789,7 +796,6 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         kfree(data);
 
         cpufreq_debug_enable_ratelimit();
-
         return 0;
 }
 
@@ -870,8 +876,7 @@ unsigned int cpufreq_get(unsigned int cpu)
 
         ret = cpufreq_driver->get(cpu);
 
-        if (ret && policy->cur && !(cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)) 
-        {
+        if (ret && policy->cur && !(cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)) {
                 /* verify no discrepancy between actual and saved value exists */
                 if (unlikely(ret != policy->cur)) {
                         cpufreq_out_of_sync(cpu, policy->cur, ret);
@@ -881,7 +886,7 @@ unsigned int cpufreq_get(unsigned int cpu)
 
         mutex_unlock(&policy->lock);
 
- out:
+out:
         cpufreq_cpu_put(policy);
 
         return (ret);
@@ -962,7 +967,7 @@ static int cpufreq_suspend(struct sys_device * sysdev, pm_message_t pmsg)
                 cpu_policy->cur = cur_freq;
         }
 
- out:
+out:
         cpufreq_cpu_put(cpu_policy);
         return 0;
 }
@@ -1169,7 +1174,6 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
         mutex_unlock(&policy->lock);
 
         cpufreq_cpu_put(policy);
-
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
@@ -1208,7 +1212,6 @@ int cpufreq_governor(unsigned int cpu, unsigned int event)
         mutex_unlock(&policy->lock);
 
         cpufreq_cpu_put(policy);
-
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_governor);
@@ -1232,7 +1235,6 @@ int cpufreq_register_governor(struct cpufreq_governor *governor)
         list_add(&governor->governor_list, &cpufreq_governor_list);
 
         mutex_unlock(&cpufreq_governor_mutex);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(cpufreq_register_governor);
@@ -1277,7 +1279,6 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
         mutex_unlock(&cpu_policy->lock);
 
         cpufreq_cpu_put(cpu_policy);
-
         return 0;
 }
 EXPORT_SYMBOL(cpufreq_get_policy);
@@ -1291,9 +1292,7 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_poli
         dprintk("setting new policy for CPU %u: %u - %u kHz\n", policy->cpu,
                 policy->min, policy->max);
 
-        memcpy(&policy->cpuinfo, 
-               &data->cpuinfo, 
-               sizeof(struct cpufreq_cpuinfo));
+        memcpy(&policy->cpuinfo, &data->cpuinfo, sizeof(struct cpufreq_cpuinfo));
 
         /* verify the cpu speed can be set within this limit */
         ret = cpufreq_driver->verify(policy);
@@ -1324,8 +1323,8 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_poli
 
         up_read(&cpufreq_notifier_rwsem);
 
-        data->min    = policy->min;
-        data->max    = policy->max;
+        data->min = policy->min;
+        data->max = policy->max;
 
         dprintk("new min and max freqs are %u - %u kHz\n", data->min, data->max);
 
@@ -1362,7 +1361,7 @@ static int __cpufreq_set_policy(struct cpufreq_policy *data, struct cpufreq_poli
                 __cpufreq_governor(data, CPUFREQ_GOV_LIMITS);
         }
 
- error_out:
+error_out:
         cpufreq_debug_enable_ratelimit();
         return ret;
 }
@@ -1421,9 +1420,7 @@ int cpufreq_update_policy(unsigned int cpu)
         mutex_lock(&data->lock);
 
         dprintk("updating policy for CPU %u\n", cpu);
-        memcpy(&policy, 
-               data,
-               sizeof(struct cpufreq_policy));
+        memcpy(&policy, data, sizeof(struct cpufreq_policy));
         policy.min = data->user_policy.min;
         policy.max = data->user_policy.max;
         policy.policy = data->user_policy.policy;
@@ -1433,8 +1430,13 @@ int cpufreq_update_policy(unsigned int cpu)
           -> ask driver for current freq and notify governors about a change */
         if (cpufreq_driver->get) {
                 policy.cur = cpufreq_driver->get(cpu);
-                if (data->cur != policy.cur)
-                        cpufreq_out_of_sync(cpu, data->cur, policy.cur);
+                if (!data->cur) {
+                        dprintk("Driver did not initialize current freq");
+                        data->cur = policy.cur;
+                } else {
+                        if (data->cur != policy.cur)
+                                cpufreq_out_of_sync(cpu, data->cur, policy.cur);
+                }
         }
 
         ret = __cpufreq_set_policy(data, &policy);
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 64819aa7cac4..0c08c58252be 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -348,10 +348,10 @@ aes_set_key(void *ctx_arg, const uint8_t *in_key, unsigned int key_len, uint32_t
                 break;
 
         case 32:
-                E_KEY[4] = le32_to_cpu(in_key[4]);
-                E_KEY[5] = le32_to_cpu(in_key[5]);
-                E_KEY[6] = le32_to_cpu(in_key[6]);
-                t = E_KEY[7] = le32_to_cpu(in_key[7]);
+                E_KEY[4] = le32_to_cpu(key[4]);
+                E_KEY[5] = le32_to_cpu(key[5]);
+                E_KEY[6] = le32_to_cpu(key[6]);
+                t = E_KEY[7] = le32_to_cpu(key[7]);
                 for (i = 0; i < 7; ++i)
                         loop8 (i);
                 break;
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index d94331c1e5b0..52f3eb45d2b9 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -6,18 +6,29 @@
 # $Id: Kconfig,v 1.4.2.7 2005/07/08 22:05:38 dsp_llnl Exp $
 #
 
-menu 'EDAC - error detection and reporting (RAS)'
+menu 'EDAC - error detection and reporting (RAS) (EXPERIMENTAL)'
 
 config EDAC
-        tristate "EDAC core system error reporting"
-        depends on X86
-        default y
+        tristate "EDAC core system error reporting (EXPERIMENTAL)"
+        depends on X86 && EXPERIMENTAL
         help
           EDAC is designed to report errors in the core system.
           These are low-level errors that are reported in the CPU or
           supporting chipset: memory errors, cache errors, PCI errors,
           thermal throttling, etc..  If unsure, select 'Y'.
 
+          If this code is reporting problems on your system, please
+          see the EDAC project web pages for more information at:
+
+          <http://bluesmoke.sourceforge.net/>
+
+          and:
+
+          <http://buttersideup.com/edacwiki>
+
+          There is also a mailing list for the EDAC project, which can
+          be found via the sourceforge page.
+
 
 comment "Reporting subsystems"
         depends on EDAC
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index b10ee4698b1d..9c205274c1cb 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -38,6 +38,12 @@
 
 #define EDAC_MC_VERSION "edac_mc  Ver: 2.0.0 " __DATE__
 
+/* For now, disable the EDAC sysfs code.  The sysfs interface that EDAC
+ * presents to user space needs more thought, and is likely to change
+ * substantially.
+ */
+#define DISABLE_EDAC_SYSFS
+
 #ifdef CONFIG_EDAC_DEBUG
 /* Values of 0 to 4 will generate output */
 int edac_debug_level = 1;
@@ -47,7 +53,7 @@ EXPORT_SYMBOL(edac_debug_level);
 /* EDAC Controls, setable by module parameter, and sysfs */
 static int log_ue = 1;
 static int log_ce = 1;
-static int panic_on_ue = 1;
+static int panic_on_ue;
 static int poll_msec = 1000;
 
 static int check_pci_parity = 0;        /* default YES check PCI parity */
@@ -77,6 +83,8 @@ static int pci_whitelist_count ;
 
 /*  START sysfs data and methods */
 
+#ifndef DISABLE_EDAC_SYSFS
+
 static const char *mem_types[] = {
         [MEM_EMPTY] = "Empty",
         [MEM_RESERVED] = "Reserved",
@@ -132,11 +140,13 @@ static struct kobject edac_pci_kobj;
  * /sys/devices/system/edac/mc;
  *      data structures and methods
  */
+#if 0
 static ssize_t memctrl_string_show(void *ptr, char *buffer)
 {
         char *value = (char*) ptr;
         return sprintf(buffer, "%s\n", value);
 }
+#endif
 
 static ssize_t memctrl_int_show(void *ptr, char *buffer)
 {
@@ -207,7 +217,9 @@ struct memctrl_dev_attribute attr_##_name = {			\
 };
 
 /* cwrow<id> attribute f*/
+#if 0
 MEMCTRL_STRING_ATTR(mc_version,EDAC_MC_VERSION,S_IRUGO,memctrl_string_show,NULL);
+#endif
 
 /* csrow<id> control files */
 MEMCTRL_ATTR(panic_on_ue,S_IRUGO|S_IWUSR,memctrl_int_show,memctrl_int_store);
@@ -222,7 +234,6 @@ static struct memctrl_dev_attribute *memctrl_attr[] = {
         &attr_log_ue,
         &attr_log_ce,
         &attr_poll_msec,
-        &attr_mc_version,
         NULL,
 };
 
@@ -238,6 +249,7 @@ static struct kobj_type ktype_memctrl = {
         .default_attrs  = (struct attribute **) memctrl_attr,
 };
 
+#endif  /* DISABLE_EDAC_SYSFS */
 
 /* Initialize the main sysfs entries for edac:
  *   /sys/devices/system/edac
@@ -248,6 +260,11 @@ static struct kobj_type ktype_memctrl = {
  *         !0 FAILURE
  */
 static int edac_sysfs_memctrl_setup(void)
+#ifdef DISABLE_EDAC_SYSFS
+{
+        return 0;
+}
+#else
 {
         int err=0;
 
@@ -280,6 +297,7 @@ static int edac_sysfs_memctrl_setup(void)
 
         return err;
 }
+#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * MC teardown:
@@ -287,6 +305,7 @@ static int edac_sysfs_memctrl_setup(void)
  */
 static void edac_sysfs_memctrl_teardown(void)
 {
+#ifndef DISABLE_EDAC_SYSFS
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
         /* Unregister the MC's kobject */
@@ -297,8 +316,11 @@ static void edac_sysfs_memctrl_teardown(void)
 
         /* Unregister the 'edac' object */
         sysdev_class_unregister(&edac_class);
+#endif  /* DISABLE_EDAC_SYSFS */
 }
 
+#ifndef DISABLE_EDAC_SYSFS
+
 /*
  * /sys/devices/system/edac/pci;
  *      data structures and methods
@@ -309,6 +331,8 @@ struct list_control {
         int *count;
 };
 
+
+#if 0
 /* Output the list as:  vendor_id:device:id<,vendor_id:device_id> */
 static ssize_t edac_pci_list_string_show(void *ptr, char *buffer)
 {
@@ -430,6 +454,7 @@ static ssize_t edac_pci_list_string_store(void *ptr, const char *buffer,
         return count;
 }
 
+#endif
 static ssize_t edac_pci_int_show(void *ptr, char *buffer)
 {
         int *value = ptr;
@@ -498,6 +523,7 @@ struct edac_pci_dev_attribute edac_pci_attr_##_name = {		\
         .store  = _store,                                       \
 };
 
+#if 0
 static struct list_control pci_whitelist_control = {
         .list = pci_whitelist,
         .count = &pci_whitelist_count
@@ -520,6 +546,7 @@ EDAC_PCI_STRING_ATTR(pci_parity_blacklist,
         S_IRUGO|S_IWUSR,
         edac_pci_list_string_show,
         edac_pci_list_string_store);
+#endif
 
 /* PCI Parity control files */
 EDAC_PCI_ATTR(check_pci_parity,S_IRUGO|S_IWUSR,edac_pci_int_show,edac_pci_int_store);
@@ -531,8 +558,6 @@ static struct edac_pci_dev_attribute *edac_pci_attr[] = {
         &edac_pci_attr_check_pci_parity,
         &edac_pci_attr_panic_on_pci_parity,
         &edac_pci_attr_pci_parity_count,
-        &edac_pci_attr_pci_parity_whitelist,
-        &edac_pci_attr_pci_parity_blacklist,
         NULL,
 };
 
@@ -548,11 +573,18 @@ static struct kobj_type ktype_edac_pci = {
         .default_attrs  = (struct attribute **) edac_pci_attr,
 };
 
+#endif  /* DISABLE_EDAC_SYSFS */
+
 /**
  * edac_sysfs_pci_setup()
  *
  */
 static int edac_sysfs_pci_setup(void)
+#ifdef DISABLE_EDAC_SYSFS
+{
+        return 0;
+}
+#else
 {
         int err;
 
@@ -576,16 +608,20 @@ static int edac_sysfs_pci_setup(void)
         }
         return err;
 }
-
+#endif  /* DISABLE_EDAC_SYSFS */
 
 static void edac_sysfs_pci_teardown(void)
 {
+#ifndef DISABLE_EDAC_SYSFS
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
 
         kobject_unregister(&edac_pci_kobj);
         kobject_put(&edac_pci_kobj);
+#endif
 }
 
+#ifndef DISABLE_EDAC_SYSFS
+
 /* EDAC sysfs CSROW data structures and methods */
 
 /* Set of more detailed csrow<id> attribute show/store functions */
@@ -1039,6 +1075,8 @@ static struct kobj_type ktype_mci = {
         .default_attrs  = (struct attribute **) mci_attr,
 };
 
+#endif  /* DISABLE_EDAC_SYSFS */
+
 #define EDAC_DEVICE_SYMLINK     "device"
 
 /*
@@ -1050,6 +1088,11 @@ static struct kobj_type ktype_mci = {
  *      !0      Failure
  */
 static int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
+#ifdef DISABLE_EDAC_SYSFS
+{
+        return 0;
+}
+#else
 {
         int i;
         int err;
@@ -1118,12 +1161,14 @@ fail:
 
         return err;
 }
+#endif  /* DISABLE_EDAC_SYSFS */
 
 /*
  * remove a Memory Controller instance
  */
 static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 {
+#ifndef DISABLE_EDAC_SYSFS
         int i;
 
         debugf0("MC: " __FILE__ ": %s()\n", __func__);
@@ -1140,6 +1185,7 @@ static void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
 
         kobject_unregister(&mci->edac_mci_kobj);
         kobject_put(&mci->edac_mci_kobj);
+#endif  /* DISABLE_EDAC_SYSFS */
 }
 
 /* END OF sysfs data and methods */
diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
index 009c08fe5d69..1991f94af753 100644
--- a/drivers/edac/i82875p_edac.c
+++ b/drivers/edac/i82875p_edac.c
@@ -159,7 +159,7 @@ enum i82875p_chips {
 
 struct i82875p_pvt {
         struct pci_dev *ovrfl_pdev;
-        void *ovrfl_window;
+        void __iomem *ovrfl_window;
 };
 
 
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 5c8943509cc1..66d03f242d3c 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -1053,7 +1053,7 @@ static int fc_do_els(fc_channel *fc, unsigned int alpa, void *data, int len)
         int i;
 
         fcmd = &_fcmd;
-        memset(fcmd, 0, sizeof(fcmd));
+        memset(fcmd, 0, sizeof(fcp_cmnd));
         FCD(("PLOGI SID %d DID %d\n", fc->sid, alpa))
         fch = &fcmd->fch;
         FILL_FCHDR_RCTL_DID(fch, R_CTL_ELS_REQ, alpa);
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 8ed6ddbb9c5d..4652512f7d1a 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -39,7 +39,7 @@
 #include "dcdbas.h"
 
 #define DRIVER_NAME             "dcdbas"
-#define DRIVER_VERSION          "5.6.0-1"
+#define DRIVER_VERSION          "5.6.0-2"
 #define DRIVER_DESCRIPTION      "Dell Systems Management Base Driver"
 
 static struct platform_device *dcdbas_pdev;
@@ -581,9 +581,13 @@ static int __init dcdbas_init(void)
  */
 static void __exit dcdbas_exit(void)
 {
-        platform_device_unregister(dcdbas_pdev);
+        /*
+         * make sure functions that use dcdbas_pdev are called
+         * before platform_device_unregister
+         */
         unregister_reboot_notifier(&dcdbas_reboot_nb);
         smi_data_buf_free();
+        platform_device_unregister(dcdbas_pdev);
 }
 
 module_init(dcdbas_init);
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index c58295914365..7230d4e08196 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -113,6 +113,16 @@ config SENSORS_DS1621
           This driver can also be built as a module.  If so, the module
           will be called ds1621.
 
+config SENSORS_F71805F
+        tristate "Fintek F71805F/FG"
+        depends on HWMON && EXPERIMENTAL
+        help
+          If you say yes here you get support for hardware monitoring
+          features of the Fintek F71805F/FG chips.
+
+          This driver can also be built as a module.  If so, the module
+          will be called f71805f.
+
 config SENSORS_FSCHER
         tristate "FSC Hermes"
         depends on HWMON && I2C && EXPERIMENTAL
diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index 06d4a1d14105..fbdb8d911a72 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -18,6 +18,7 @@ obj-$(CONFIG_SENSORS_ADM1031)	+= adm1031.o
 obj-$(CONFIG_SENSORS_ADM9240)   += adm9240.o
 obj-$(CONFIG_SENSORS_ATXP1)     += atxp1.o
 obj-$(CONFIG_SENSORS_DS1621)    += ds1621.o
+obj-$(CONFIG_SENSORS_F71805F)   += f71805f.o
 obj-$(CONFIG_SENSORS_FSCHER)    += fscher.o
 obj-$(CONFIG_SENSORS_FSCPOS)    += fscpos.o
 obj-$(CONFIG_SENSORS_GL518SM)   += gl518sm.o
diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
new file mode 100644
index 000000000000..e029e0a94ecc
--- /dev/null
+++ b/drivers/hwmon/f71805f.c
@@ -0,0 +1,908 @@
+/*
+ * f71805f.c - driver for the Fintek F71805F/FG Super-I/O chip integrated
+ *             hardware monitoring features
+ * Copyright (C) 2005  Jean Delvare <khali@linux-fr.org>
+ *
+ * The F71805F/FG is a LPC Super-I/O chip made by Fintek. It integrates
+ * complete hardware monitoring features: voltage, fan and temperature
+ * sensors, and manual and automatic fan speed control.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/jiffies.h>
+#include <linux/platform_device.h>
+#include <linux/hwmon.h>
+#include <linux/hwmon-sysfs.h>
+#include <linux/err.h>
+#include <asm/io.h>
+
+static struct platform_device *pdev;
+
+#define DRVNAME "f71805f"
+
+/*
+ * Super-I/O constants and functions
+ */
+
+#define F71805F_LD_HWM          0x04
+
+#define SIO_REG_LDSEL           0x07    /* Logical device select */
+#define SIO_REG_DEVID           0x20    /* Device ID (2 bytes) */
+#define SIO_REG_DEVREV          0x22    /* Device revision */
+#define SIO_REG_MANID           0x23    /* Fintek ID (2 bytes) */
+#define SIO_REG_ENABLE          0x30    /* Logical device enable */
+#define SIO_REG_ADDR            0x60    /* Logical device address (2 bytes) */
+
+#define SIO_FINTEK_ID           0x1934
+#define SIO_F71805F_ID          0x0406
+
+static inline int
+superio_inb(int base, int reg)
+{
+        outb(reg, base);
+        return inb(base + 1);
+}
+
+static int
+superio_inw(int base, int reg)
+{
+        int val;
+        outb(reg++, base);
+        val = inb(base + 1) << 8;
+        outb(reg, base);
+        val |= inb(base + 1);
+        return val;
+}
+
+static inline void
+superio_select(int base, int ld)
+{
+        outb(SIO_REG_LDSEL, base);
+        outb(ld, base + 1);
+}
+
+static inline void
+superio_enter(int base)
+{
+        outb(0x87, base);
+        outb(0x87, base);
+}
+
+static inline void
+superio_exit(int base)
+{
+        outb(0xaa, base);
+}
+
+/*
+ * ISA constants
+ */
+
+#define REGION_LENGTH           2
+#define ADDR_REG_OFFSET         0
+#define DATA_REG_OFFSET         1
+
+static struct resource f71805f_resource __initdata = {
+        .flags  = IORESOURCE_IO,
+};
+
+/*
+ * Registers
+ */
+
+/* in nr from 0 to 8 (8-bit values) */
+#define F71805F_REG_IN(nr)              (0x10 + (nr))
+#define F71805F_REG_IN_HIGH(nr)         (0x40 + 2 * (nr))
+#define F71805F_REG_IN_LOW(nr)          (0x41 + 2 * (nr))
+/* fan nr from 0 to 2 (12-bit values, two registers) */
+#define F71805F_REG_FAN(nr)             (0x20 + 2 * (nr))
+#define F71805F_REG_FAN_LOW(nr)         (0x28 + 2 * (nr))
+#define F71805F_REG_FAN_CTRL(nr)        (0x60 + 16 * (nr))
+/* temp nr from 0 to 2 (8-bit values) */
+#define F71805F_REG_TEMP(nr)            (0x1B + (nr))
+#define F71805F_REG_TEMP_HIGH(nr)       (0x54 + 2 * (nr))
+#define F71805F_REG_TEMP_HYST(nr)       (0x55 + 2 * (nr))
+#define F71805F_REG_TEMP_MODE           0x01
+
+#define F71805F_REG_START               0x00
+/* status nr from 0 to 2 */
+#define F71805F_REG_STATUS(nr)          (0x36 + (nr))
+
+/*
+ * Data structures and manipulation thereof
+ */
+
+struct f71805f_data {
+        unsigned short addr;
+        const char *name;
+        struct semaphore lock;
+        struct class_device *class_dev;
+
+        struct semaphore update_lock;
+        char valid;             /* !=0 if following fields are valid */
+        unsigned long last_updated;     /* In jiffies */
+        unsigned long last_limits;      /* In jiffies */
+
+        /* Register values */
+        u8 in[9];
+        u8 in_high[9];
+        u8 in_low[9];
+        u16 fan[3];
+        u16 fan_low[3];
+        u8 fan_enabled;         /* Read once at init time */
+        u8 temp[3];
+        u8 temp_high[3];
+        u8 temp_hyst[3];
+        u8 temp_mode;
+        u8 alarms[3];
+};
+
+static inline long in_from_reg(u8 reg)
+{
+        return (reg * 8);
+}
+
+/* The 2 least significant bits are not used */
+static inline u8 in_to_reg(long val)
+{
+        if (val <= 0)
+                return 0;
+        if (val >= 2016)
+                return 0xfc;
+        return (((val + 16) / 32) << 2);
+}
+
+/* in0 is downscaled by a factor 2 internally */
+static inline long in0_from_reg(u8 reg)
+{
+        return (reg * 16);
+}
+
+static inline u8 in0_to_reg(long val)
+{
+        if (val <= 0)
+                return 0;
+        if (val >= 4032)
+                return 0xfc;
+        return (((val + 32) / 64) << 2);
+}
+
+/* The 4 most significant bits are not used */
+static inline long fan_from_reg(u16 reg)
+{
+        reg &= 0xfff;
+        if (!reg || reg == 0xfff)
+                return 0;
+        return (1500000 / reg);
+}
+
+static inline u16 fan_to_reg(long rpm)
+{
+        /* If the low limit is set below what the chip can measure,
+           store the largest possible 12-bit value in the registers,
+           so that no alarm will ever trigger. */
+        if (rpm < 367)
+                return 0xfff;
+        return (1500000 / rpm);
+}
+
+static inline long temp_from_reg(u8 reg)
+{
+        return (reg * 1000);
+}
+
+static inline u8 temp_to_reg(long val)
+{
+        if (val < 0)
+                val = 0;
+        else if (val > 1000 * 0xff)
+                val = 0xff;
+        return ((val + 500) / 1000);
+}
+
+/*
+ * Device I/O access
+ */
+
+static u8 f71805f_read8(struct f71805f_data *data, u8 reg)
+{
+        u8 val;
+
+        down(&data->lock);
+        outb(reg, data->addr + ADDR_REG_OFFSET);
+        val = inb(data->addr + DATA_REG_OFFSET);
+        up(&data->lock);
+
+        return val;
+}
+
+static void f71805f_write8(struct f71805f_data *data, u8 reg, u8 val)
+{
+        down(&data->lock);
+        outb(reg, data->addr + ADDR_REG_OFFSET);
+        outb(val, data->addr + DATA_REG_OFFSET);
+        up(&data->lock);
+}
+
+/* It is important to read the MSB first, because doing so latches the
+   value of the LSB, so we are sure both bytes belong to the same value. */
+static u16 f71805f_read16(struct f71805f_data *data, u8 reg)
+{
+        u16 val;
+
+        down(&data->lock);
+        outb(reg, data->addr + ADDR_REG_OFFSET);
+        val = inb(data->addr + DATA_REG_OFFSET) << 8;
+        outb(++reg, data->addr + ADDR_REG_OFFSET);
+        val |= inb(data->addr + DATA_REG_OFFSET);
+        up(&data->lock);
+
+        return val;
+}
+
+static void f71805f_write16(struct f71805f_data *data, u8 reg, u16 val)
+{
+        down(&data->lock);
+        outb(reg, data->addr + ADDR_REG_OFFSET);
+        outb(val >> 8, data->addr + DATA_REG_OFFSET);
+        outb(++reg, data->addr + ADDR_REG_OFFSET);
+        outb(val & 0xff, data->addr + DATA_REG_OFFSET);
+        up(&data->lock);
+}
+
+static struct f71805f_data *f71805f_update_device(struct device *dev)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        int nr;
+
+        down(&data->update_lock);
+
+        /* Limit registers cache is refreshed after 60 seconds */
+        if (time_after(jiffies, data->last_updated + 60 * HZ)
+         || !data->valid) {
+                for (nr = 0; nr < 9; nr++) {
+                        data->in_high[nr] = f71805f_read8(data,
+                                            F71805F_REG_IN_HIGH(nr));
+                        data->in_low[nr] = f71805f_read8(data,
+                                           F71805F_REG_IN_LOW(nr));
+                }
+                for (nr = 0; nr < 3; nr++) {
+                        if (data->fan_enabled & (1 << nr))
+                                data->fan_low[nr] = f71805f_read16(data,
+                                                    F71805F_REG_FAN_LOW(nr));
+                }
+                for (nr = 0; nr < 3; nr++) {
+                        data->temp_high[nr] = f71805f_read8(data,
+                                              F71805F_REG_TEMP_HIGH(nr));
+                        data->temp_hyst[nr] = f71805f_read8(data,
+                                              F71805F_REG_TEMP_HYST(nr));
+                }
+                data->temp_mode = f71805f_read8(data, F71805F_REG_TEMP_MODE);
+
+                data->last_limits = jiffies;
+        }
+
+        /* Measurement registers cache is refreshed after 1 second */
+        if (time_after(jiffies, data->last_updated + HZ)
+         || !data->valid) {
+                for (nr = 0; nr < 9; nr++) {
+                        data->in[nr] = f71805f_read8(data,
+                                       F71805F_REG_IN(nr));
+                }
+                for (nr = 0; nr < 3; nr++) {
+                        if (data->fan_enabled & (1 << nr))
+                                data->fan[nr] = f71805f_read16(data,
+                                                F71805F_REG_FAN(nr));
+                }
+                for (nr = 0; nr < 3; nr++) {
+                        data->temp[nr] = f71805f_read8(data,
+                                         F71805F_REG_TEMP(nr));
+                }
+                for (nr = 0; nr < 3; nr++) {
+                        data->alarms[nr] = f71805f_read8(data,
+                                           F71805F_REG_STATUS(nr));
+                }
+
+                data->last_updated = jiffies;
+                data->valid = 1;
+        }
+
+        up(&data->update_lock);
+
+        return data;
+}
+
+/*
+ * Sysfs interface
+ */
+
+static ssize_t show_in0(struct device *dev, struct device_attribute *devattr,
+                        char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+
+        return sprintf(buf, "%ld\n", in0_from_reg(data->in[0]));
+}
+
+static ssize_t show_in0_max(struct device *dev, struct device_attribute
+                            *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+
+        return sprintf(buf, "%ld\n", in0_from_reg(data->in_high[0]));
+}
+
+static ssize_t show_in0_min(struct device *dev, struct device_attribute
+                            *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+
+        return sprintf(buf, "%ld\n", in0_from_reg(data->in_low[0]));
+}
+
+static ssize_t set_in0_max(struct device *dev, struct device_attribute
+                           *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->in_high[0] = in0_to_reg(val);
+        f71805f_write8(data, F71805F_REG_IN_HIGH(0), data->in_high[0]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+static ssize_t set_in0_min(struct device *dev, struct device_attribute
+                           *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->in_low[0] = in0_to_reg(val);
+        f71805f_write8(data, F71805F_REG_IN_LOW(0), data->in_low[0]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+static DEVICE_ATTR(in0_input, S_IRUGO, show_in0, NULL);
+static DEVICE_ATTR(in0_max, S_IRUGO| S_IWUSR, show_in0_max, set_in0_max);
+static DEVICE_ATTR(in0_min, S_IRUGO| S_IWUSR, show_in0_min, set_in0_min);
+
+static ssize_t show_in(struct device *dev, struct device_attribute *devattr,
+                       char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", in_from_reg(data->in[nr]));
+}
+
+static ssize_t show_in_max(struct device *dev, struct device_attribute
+                           *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", in_from_reg(data->in_high[nr]));
+}
+
+static ssize_t show_in_min(struct device *dev, struct device_attribute
+                           *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", in_from_reg(data->in_low[nr]));
+}
+
+static ssize_t set_in_max(struct device *dev, struct device_attribute
+                          *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->in_high[nr] = in_to_reg(val);
+        f71805f_write8(data, F71805F_REG_IN_HIGH(nr), data->in_high[nr]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+static ssize_t set_in_min(struct device *dev, struct device_attribute
+                          *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->in_low[nr] = in_to_reg(val);
+        f71805f_write8(data, F71805F_REG_IN_LOW(nr), data->in_low[nr]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+#define sysfs_in(offset)                                        \
+static SENSOR_DEVICE_ATTR(in##offset##_input, S_IRUGO,          \
+                show_in, NULL, offset);                         \
+static SENSOR_DEVICE_ATTR(in##offset##_max, S_IRUGO | S_IWUSR,  \
+                show_in_max, set_in_max, offset);               \
+static SENSOR_DEVICE_ATTR(in##offset##_min, S_IRUGO | S_IWUSR,  \
+                show_in_min, set_in_min, offset)
+
+sysfs_in(1);
+sysfs_in(2);
+sysfs_in(3);
+sysfs_in(4);
+sysfs_in(5);
+sysfs_in(6);
+sysfs_in(7);
+sysfs_in(8);
+
+static ssize_t show_fan(struct device *dev, struct device_attribute *devattr,
+                        char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", fan_from_reg(data->fan[nr]));
+}
+
+static ssize_t show_fan_min(struct device *dev, struct device_attribute
+                            *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", fan_from_reg(data->fan_low[nr]));
+}
+
+static ssize_t set_fan_min(struct device *dev, struct device_attribute
+                           *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->fan_low[nr] = fan_to_reg(val);
+        f71805f_write16(data, F71805F_REG_FAN_LOW(nr), data->fan_low[nr]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+#define sysfs_fan(offset)                                       \
+static SENSOR_DEVICE_ATTR(fan##offset##_input, S_IRUGO,         \
+                show_fan, NULL, offset - 1);                    \
+static SENSOR_DEVICE_ATTR(fan##offset##_min, S_IRUGO | S_IWUSR, \
+                show_fan_min, set_fan_min, offset - 1)
+
+sysfs_fan(1);
+sysfs_fan(2);
+sysfs_fan(3);
+
+static ssize_t show_temp(struct device *dev, struct device_attribute *devattr,
+                         char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", temp_from_reg(data->temp[nr]));
+}
+
+static ssize_t show_temp_max(struct device *dev, struct device_attribute
+                             *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", temp_from_reg(data->temp_high[nr]));
+}
+
+static ssize_t show_temp_hyst(struct device *dev, struct device_attribute
+                              *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        return sprintf(buf, "%ld\n", temp_from_reg(data->temp_hyst[nr]));
+}
+
+static ssize_t show_temp_type(struct device *dev, struct device_attribute
+                              *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+
+        /* 3 is diode, 4 is thermistor */
+        return sprintf(buf, "%u\n", (data->temp_mode & (1 << nr)) ? 3 : 4);
+}
+
+static ssize_t set_temp_max(struct device *dev, struct device_attribute
+                            *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->temp_high[nr] = temp_to_reg(val);
+        f71805f_write8(data, F71805F_REG_TEMP_HIGH(nr), data->temp_high[nr]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+static ssize_t set_temp_hyst(struct device *dev, struct device_attribute
+                             *devattr, const char *buf, size_t count)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
+        int nr = attr->index;
+        long val = simple_strtol(buf, NULL, 10);
+
+        down(&data->update_lock);
+        data->temp_hyst[nr] = temp_to_reg(val);
+        f71805f_write8(data, F71805F_REG_TEMP_HYST(nr), data->temp_hyst[nr]);
+        up(&data->update_lock);
+
+        return count;
+}
+
+#define sysfs_temp(offset)                                              \
+static SENSOR_DEVICE_ATTR(temp##offset##_input, S_IRUGO,                \
+                show_temp, NULL, offset - 1);                           \
+static SENSOR_DEVICE_ATTR(temp##offset##_max, S_IRUGO | S_IWUSR,        \
+                show_temp_max, set_temp_max, offset - 1);               \
+static SENSOR_DEVICE_ATTR(temp##offset##_max_hyst, S_IRUGO | S_IWUSR,   \
+                show_temp_hyst, set_temp_hyst, offset - 1);             \
+static SENSOR_DEVICE_ATTR(temp##offset##_type, S_IRUGO,                 \
+                show_temp_type, NULL, offset - 1)
+
+sysfs_temp(1);
+sysfs_temp(2);
+sysfs_temp(3);
+
+static ssize_t show_alarms_in(struct device *dev, struct device_attribute
+                              *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+
+        return sprintf(buf, "%d\n", data->alarms[0] |
+                                    ((data->alarms[1] & 0x01) << 8));
+}
+
+static ssize_t show_alarms_fan(struct device *dev, struct device_attribute
+                               *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+
+        return sprintf(buf, "%d\n", data->alarms[2] & 0x07);
+}
+
+static ssize_t show_alarms_temp(struct device *dev, struct device_attribute
+                                *devattr, char *buf)
+{
+        struct f71805f_data *data = f71805f_update_device(dev);
+
+        return sprintf(buf, "%d\n", (data->alarms[1] >> 3) & 0x07);
+}
+
+static DEVICE_ATTR(alarms_in, S_IRUGO, show_alarms_in, NULL);
+static DEVICE_ATTR(alarms_fan, S_IRUGO, show_alarms_fan, NULL);
+static DEVICE_ATTR(alarms_temp, S_IRUGO, show_alarms_temp, NULL);
+
+static ssize_t show_name(struct device *dev, struct device_attribute
+                         *devattr, char *buf)
+{
+        struct f71805f_data *data = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%s\n", data->name);
+}
+
+static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
+
+/*
+ * Device registration and initialization
+ */
+
+static void __devinit f71805f_init_device(struct f71805f_data *data)
+{
+        u8 reg;
+        int i;
+
+        reg = f71805f_read8(data, F71805F_REG_START);
+        if ((reg & 0x41) != 0x01) {
+                printk(KERN_DEBUG DRVNAME ": Starting monitoring "
+                       "operations\n");
+                f71805f_write8(data, F71805F_REG_START, (reg | 0x01) & ~0x40);
+        }
+
+        /* Fan monitoring can be disabled. If it is, we won't be polling
+           the register values, and won't create the related sysfs files. */
+        for (i = 0; i < 3; i++) {
+                reg = f71805f_read8(data, F71805F_REG_FAN_CTRL(i));
+                if (!(reg & 0x80))
+                        data->fan_enabled |= (1 << i);
+        }
+}
+
+static int __devinit f71805f_probe(struct platform_device *pdev)
+{
+        struct f71805f_data *data;
+        struct resource *res;
+        int err;
+
+        if (!(data = kzalloc(sizeof(struct f71805f_data), GFP_KERNEL))) {
+                err = -ENOMEM;
+                printk(KERN_ERR DRVNAME ": Out of memory\n");
+                goto exit;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_IO, 0);
+        data->addr = res->start;
+        init_MUTEX(&data->lock);
+        data->name = "f71805f";
+        init_MUTEX(&data->update_lock);
+
+        platform_set_drvdata(pdev, data);
+
+        data->class_dev = hwmon_device_register(&pdev->dev);
+        if (IS_ERR(data->class_dev)) {
+                err = PTR_ERR(data->class_dev);
+                dev_err(&pdev->dev, "Class registration failed (%d)\n", err);
+                goto exit_free;
+        }
+
+        /* Initialize the F71805F chip */
+        f71805f_init_device(data);
+
+        /* Register sysfs interface files */
+        device_create_file(&pdev->dev, &dev_attr_in0_input);
+        device_create_file(&pdev->dev, &dev_attr_in0_max);
+        device_create_file(&pdev->dev, &dev_attr_in0_min);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in1_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in2_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in3_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in4_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in5_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in6_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in7_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in8_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in1_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in2_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in3_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in4_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in5_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in6_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in7_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in8_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in1_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in2_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in3_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in4_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in5_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in6_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in7_min.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_in8_min.dev_attr);
+        if (data->fan_enabled & (1 << 0)) {
+                device_create_file(&pdev->dev,
+                                   &sensor_dev_attr_fan1_input.dev_attr);
+                device_create_file(&pdev->dev,
+                                   &sensor_dev_attr_fan1_min.dev_attr);
+        }
+        if (data->fan_enabled & (1 << 1)) {
+                device_create_file(&pdev->dev,
+                                   &sensor_dev_attr_fan2_input.dev_attr);
+                device_create_file(&pdev->dev,
+                                   &sensor_dev_attr_fan2_min.dev_attr);
+        }
+        if (data->fan_enabled & (1 << 2)) {
+                device_create_file(&pdev->dev,
+                                   &sensor_dev_attr_fan3_input.dev_attr);
+                device_create_file(&pdev->dev,
+                                   &sensor_dev_attr_fan3_min.dev_attr);
+        }
+        device_create_file(&pdev->dev,
+                           &sensor_dev_attr_temp1_input.dev_attr);
+        device_create_file(&pdev->dev,
+                           &sensor_dev_attr_temp2_input.dev_attr);
+        device_create_file(&pdev->dev,
+                           &sensor_dev_attr_temp3_input.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_temp1_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_temp2_max.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_temp3_max.dev_attr);
+        device_create_file(&pdev->dev,
+                           &sensor_dev_attr_temp1_max_hyst.dev_attr);
+        device_create_file(&pdev->dev,
+                           &sensor_dev_attr_temp2_max_hyst.dev_attr);
+        device_create_file(&pdev->dev,
+                           &sensor_dev_attr_temp3_max_hyst.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_temp1_type.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_temp2_type.dev_attr);
+        device_create_file(&pdev->dev, &sensor_dev_attr_temp3_type.dev_attr);
+        device_create_file(&pdev->dev, &dev_attr_alarms_in);
+        device_create_file(&pdev->dev, &dev_attr_alarms_fan);
+        device_create_file(&pdev->dev, &dev_attr_alarms_temp);
+        device_create_file(&pdev->dev, &dev_attr_name);
+
+        return 0;
+
+exit_free:
+        kfree(data);
+exit:
+        return err;
+}
+
+static int __devexit f71805f_remove(struct platform_device *pdev)
+{
+        struct f71805f_data *data = platform_get_drvdata(pdev);
+
+        platform_set_drvdata(pdev, NULL);
+        hwmon_device_unregister(data->class_dev);
+        kfree(data);
+
+        return 0;
+}
+
+static struct platform_driver f71805f_driver = {
+        .driver = {
+                .owner  = THIS_MODULE,
+                .name   = DRVNAME,
+        },
+        .probe          = f71805f_probe,
+        .remove         = __devexit_p(f71805f_remove),
+};
+
+static int __init f71805f_device_add(unsigned short address)
+{
+        int err;
+
+        pdev = platform_device_alloc(DRVNAME, address);
+        if (!pdev) {
+                err = -ENOMEM;
+                printk(KERN_ERR DRVNAME ": Device allocation failed\n");
+                goto exit;
+        }
+
+        f71805f_resource.start = address;
+        f71805f_resource.end = address + REGION_LENGTH - 1;
+        f71805f_resource.name = pdev->name;
+        err = platform_device_add_resources(pdev, &f71805f_resource, 1);
+        if (err) {
+                printk(KERN_ERR DRVNAME ": Device resource addition failed "
+                       "(%d)\n", err);
+                goto exit_device_put;
+        }
+
+        err = platform_device_add(pdev);
+        if (err) {
+                printk(KERN_ERR DRVNAME ": Device addition failed (%d)\n",
+                       err);
+                goto exit_device_put;
+        }
+
+        return 0;
+
+exit_device_put:
+        platform_device_put(pdev);
+exit:
+        return err;
+}
+
+static int __init f71805f_find(int sioaddr, unsigned short *address)
+{
+        int err = -ENODEV;
+        u16 devid;
+
+        superio_enter(sioaddr);
+
+        devid = superio_inw(sioaddr, SIO_REG_MANID);
+        if (devid != SIO_FINTEK_ID)
+                goto exit;
+
+        devid = superio_inw(sioaddr, SIO_REG_DEVID);
+        if (devid != SIO_F71805F_ID) {
+                printk(KERN_INFO DRVNAME ": Unsupported Fintek device, "
+                       "skipping\n");
+                goto exit;
+        }
+
+        superio_select(sioaddr, F71805F_LD_HWM);
+        if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
+                printk(KERN_WARNING DRVNAME ": Device not activated, "
+                       "skipping\n");
+                goto exit;
+        }
+
+        *address = superio_inw(sioaddr, SIO_REG_ADDR);
+        if (*address == 0) {
+                printk(KERN_WARNING DRVNAME ": Base address not set, "
+                       "skipping\n");
+                goto exit;
+        }
+
+        err = 0;
+        printk(KERN_INFO DRVNAME ": Found F71805F chip at %#x, revision %u\n",
+               *address, superio_inb(sioaddr, SIO_REG_DEVREV));
+
+exit:
+        superio_exit(sioaddr);
+        return err;
+}
+
+static int __init f71805f_init(void)
+{
+        int err;
+        unsigned short address;
+
+        if (f71805f_find(0x2e, &address)
+         && f71805f_find(0x4e, &address))
+                return -ENODEV;
+
+        err = platform_driver_register(&f71805f_driver);
+        if (err)
+                goto exit;
+
+        /* Sets global pdev as a side effect */
+        err = f71805f_device_add(address);
+        if (err)
+                goto exit_driver;
+
+        return 0;
+
+exit_driver:
+        platform_driver_unregister(&f71805f_driver);
+exit:
+        return err;
+}
+
+static void __exit f71805f_exit(void)
+{
+        platform_device_unregister(pdev);
+        platform_driver_unregister(&f71805f_driver);
+}
+
+MODULE_AUTHOR("Jean Delvare <khali@linux-fr>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("F71805F hardware monitoring driver");
+
+module_init(f71805f_init);
+module_exit(f71805f_exit);
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 0da7c9c508c3..d7a9401600bb 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -45,8 +45,7 @@
 
 
 /* Addresses to scan */
-static unsigned short normal_i2c[] = { 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d,
-                                        0x2e, 0x2f, I2C_CLIENT_END };
+static unsigned short normal_i2c[] = { 0x2d, I2C_CLIENT_END };
 static unsigned short isa_address;
 
 /* Insmod parameters */
@@ -830,6 +829,11 @@ static int it87_detect(struct i2c_adapter *adapter, int address, int kind)
         if ((err = i2c_attach_client(new_client)))
                 goto ERROR2;
 
+        if (!is_isa)
+                dev_info(&new_client->dev, "The I2C interface to IT87xxF "
+                         "hardware monitoring chips is deprecated. Please "
+                         "report if you still rely on it.\n");
+
         /* Check PWM configuration */
         enable_pwm_interface = it87_check_pwm(new_client);
 
@@ -1182,7 +1186,8 @@ static int __init sm_it87_init(void)
 
 static void __exit sm_it87_exit(void)
 {
-        i2c_isa_del_driver(&it87_isa_driver);
+        if (isa_address)
+                i2c_isa_del_driver(&it87_isa_driver);
         i2c_del_driver(&it87_driver);
 }
 
diff --git a/drivers/hwmon/lm77.c b/drivers/hwmon/lm77.c
index a2f420d01fb7..df9e02aaa70a 100644
--- a/drivers/hwmon/lm77.c
+++ b/drivers/hwmon/lm77.c
@@ -87,15 +87,15 @@ static struct i2c_driver lm77_driver = {
 
 /* In the temperature registers, the low 3 bits are not part of the
    temperature values; they are the status bits. */
-static inline u16 LM77_TEMP_TO_REG(int temp)
+static inline s16 LM77_TEMP_TO_REG(int temp)
 {
         int ntemp = SENSORS_LIMIT(temp, LM77_TEMP_MIN, LM77_TEMP_MAX);
-        return (u16)((ntemp / 500) * 8);
+        return (ntemp / 500) * 8;
 }
 
-static inline int LM77_TEMP_FROM_REG(u16 reg)
+static inline int LM77_TEMP_FROM_REG(s16 reg)
 {
-        return ((int)reg / 8) * 500;
+        return (reg / 8) * 500;
 }
 
 /* sysfs stuff */
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 3eb08f004c0f..271e9cb9532c 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -437,12 +437,12 @@ static SENSOR_DEVICE_ATTR(temp##offset##_input, S_IRUGO,		\
                 show_temp, NULL, offset - 1);                           \
 static SENSOR_DEVICE_ATTR(temp##offset##_max, S_IRUGO | S_IWUSR,        \
                 show_temp_max, set_temp_max, offset - 1);               \
-static SENSOR_DEVICE_ATTR(temp##offset##_min, S_IRUGO | S_IWUSR,        \
+static SENSOR_DEVICE_ATTR(temp##offset##_max_hyst, S_IRUGO | S_IWUSR,   \
                 show_temp_min, set_temp_min, offset - 1)
 
 static DEVICE_ATTR(temp1_input, S_IRUGO, show_temp0, NULL);
 static DEVICE_ATTR(temp1_max, S_IRUGO | S_IWUSR, show_temp0_max, set_temp0_max);
-static DEVICE_ATTR(temp1_min, S_IRUGO | S_IWUSR, show_temp0_min, set_temp0_min);
+static DEVICE_ATTR(temp1_max_hyst, S_IRUGO | S_IWUSR, show_temp0_min, set_temp0_min);
 
 define_temperature_sysfs(2);
 define_temperature_sysfs(3);
@@ -451,7 +451,7 @@ define_temperature_sysfs(5);
 define_temperature_sysfs(6);
 
 #define CFG_INFO_TEMP(id)       { &sensor_dev_attr_temp##id##_input.dev_attr, \
-                                &sensor_dev_attr_temp##id##_min.dev_attr, \
+                                &sensor_dev_attr_temp##id##_max_hyst.dev_attr, \
                                 &sensor_dev_attr_temp##id##_max.dev_attr }
 #define CFG_INFO_VOLT(id)       { &sensor_dev_attr_in##id##_input.dev_attr, \
                                 &sensor_dev_attr_in##id##_min.dev_attr, \
@@ -464,7 +464,7 @@ struct str_device_attr_table {
 };
 
 static struct str_device_attr_table cfg_info_temp[] = {
-        { &dev_attr_temp1_input, &dev_attr_temp1_min, &dev_attr_temp1_max },
+        { &dev_attr_temp1_input, &dev_attr_temp1_max_hyst, &dev_attr_temp1_max },
         CFG_INFO_TEMP(2),
         CFG_INFO_TEMP(3),
         CFG_INFO_TEMP(4),
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index 557114872f3c..64c1f8af5bb2 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -95,11 +95,16 @@ MODULE_PARM_DESC(init, "Set to zero to bypass chip initialization");
                                                      (0x39)))
 
 #define W83781D_REG_CONFIG              0x40
+
+/* Interrupt status (W83781D, AS99127F) */
 #define W83781D_REG_ALARM1              0x41
 #define W83781D_REG_ALARM2              0x42
-#define W83781D_REG_ALARM3              0x450   /* not on W83781D */
 
-#define W83781D_REG_IRQ                 0x4C
+/* Real-time status (W83782D, W83783S, W83627HF) */
+#define W83782D_REG_ALARM1              0x459
+#define W83782D_REG_ALARM2              0x45A
+#define W83782D_REG_ALARM3              0x45B
+
 #define W83781D_REG_BEEP_CONFIG         0x4D
 #define W83781D_REG_BEEP_INTS1          0x56
 #define W83781D_REG_BEEP_INTS2          0x57
@@ -1513,15 +1518,6 @@ w83781d_init_client(struct i2c_client *client)
                                         W83781D_REG_TEMP3_CONFIG, tmp & 0xfe);
                         }
                 }
-
-                if (type != w83781d) {
-                        /* enable comparator mode for temp2 and temp3 so
-                           alarm indication will work correctly */
-                        i = w83781d_read_value(client, W83781D_REG_IRQ);
-                        if (!(i & 0x40))
-                                w83781d_write_value(client, W83781D_REG_IRQ,
-                                                    i | 0x40);
-                }
         }
 
         /* Start monitoring */
@@ -1612,14 +1608,25 @@ static struct w83781d_data *w83781d_update_device(struct device *dev)
                         data->fan_div[1] |= (i >> 4) & 0x04;
                         data->fan_div[2] |= (i >> 5) & 0x04;
                 }
-                data->alarms =
-                    w83781d_read_value(client,
-                                       W83781D_REG_ALARM1) +
-                    (w83781d_read_value(client, W83781D_REG_ALARM2) << 8);
                 if ((data->type == w83782d) || (data->type == w83627hf)) {
-                        data->alarms |=
-                            w83781d_read_value(client,
-                                               W83781D_REG_ALARM3) << 16;
+                        data->alarms = w83781d_read_value(client,
+                                                W83782D_REG_ALARM1)
+                                     | (w83781d_read_value(client,
+                                                W83782D_REG_ALARM2) << 8)
+                                     | (w83781d_read_value(client,
+                                                W83782D_REG_ALARM3) << 16);
+                } else if (data->type == w83783s) {
+                        data->alarms = w83781d_read_value(client,
+                                                W83782D_REG_ALARM1)
+                                     | (w83781d_read_value(client,
+                                                W83782D_REG_ALARM2) << 8);
+                } else {
+                        /* No real-time status registers, fall back to
+                           interrupt status registers */
+                        data->alarms = w83781d_read_value(client,
+                                                W83781D_REG_ALARM1)
+                                     | (w83781d_read_value(client,
+                                                W83781D_REG_ALARM2) << 8);
                 }
                 i = w83781d_read_value(client, W83781D_REG_BEEP_INTS2);
                 data->beep_enable = i >> 7;
diff --git a/drivers/hwmon/w83792d.c b/drivers/hwmon/w83792d.c
index b176bf0c4c7b..a2f6bb676235 100644
--- a/drivers/hwmon/w83792d.c
+++ b/drivers/hwmon/w83792d.c
@@ -303,10 +303,6 @@ struct w83792d_data {
 static int w83792d_attach_adapter(struct i2c_adapter *adapter);
 static int w83792d_detect(struct i2c_adapter *adapter, int address, int kind);
 static int w83792d_detach_client(struct i2c_client *client);
-
-static int w83792d_read_value(struct i2c_client *client, u8 register);
-static int w83792d_write_value(struct i2c_client *client, u8 register,
-                                u8 value);
 static struct w83792d_data *w83792d_update_device(struct device *dev);
 
 #ifdef DEBUG
@@ -329,6 +325,20 @@ static inline long in_count_from_reg(int nr, struct w83792d_data *data)
         return ((data->in[nr] << 2) | ((data->low_bits >> (2 * nr)) & 0x03));
 }
 
+/* The SMBus locks itself. The Winbond W83792D chip has a bank register,
+   but the driver only accesses registers in bank 0, so we don't have
+   to switch banks and lock access between switches. */
+static inline int w83792d_read_value(struct i2c_client *client, u8 reg)
+{
+        return i2c_smbus_read_byte_data(client, reg);
+}
+
+static inline int
+w83792d_write_value(struct i2c_client *client, u8 reg, u8 value)
+{
+        return i2c_smbus_write_byte_data(client, reg, value);
+}
+
 /* following are the sysfs callback functions */
 static ssize_t show_in(struct device *dev, struct device_attribute *attr,
                         char *buf)
@@ -1386,19 +1396,6 @@ w83792d_detach_client(struct i2c_client *client)
         return 0;
 }
 
-/* The SMBus locks itself. The Winbond W83792D chip has a bank register,
-   but the driver only accesses registers in bank 0, so we don't have
-   to switch banks and lock access between switches. */
-static int w83792d_read_value(struct i2c_client *client, u8 reg)
-{
-        return i2c_smbus_read_byte_data(client, reg);
-}
-
-static int w83792d_write_value(struct i2c_client *client, u8 reg, u8 value)
-{
-        return i2c_smbus_write_byte_data(client, reg, value);
-}
-
 static void
 w83792d_init_client(struct i2c_client *client)
 {
diff --git a/drivers/i2c/algos/i2c-algo-sibyte.c b/drivers/i2c/algos/i2c-algo-sibyte.c
index 938848ae162d..3df3f09995c2 100644
--- a/drivers/i2c/algos/i2c-algo-sibyte.c
+++ b/drivers/i2c/algos/i2c-algo-sibyte.c
@@ -202,7 +202,7 @@ EXPORT_SYMBOL(i2c_sibyte_del_bus);
 #ifdef MODULE
 MODULE_AUTHOR("Kip Walker, Broadcom Corp.");
 MODULE_DESCRIPTION("SiByte I2C-Bus algorithm");
-MODULE_PARM(bit_scan, "i");
+module_param(bit_scan, int, 0);
 MODULE_PARM_DESC(bit_scan, "Scan for active chips on the bus");
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 08d5b8fed2dc..ff92735c7c85 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -124,6 +124,7 @@ config I2C_I801
             ICH6
             ICH7
             ESB2
+            ICH8
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-i801.
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 1c752ddc10e2..8e0f3158215f 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -32,6 +32,7 @@
     ICH6                266A
     ICH7                27DA
     ESB2                269B
+    ICH8                283E
     This driver supports several versions of Intel's I/O Controller Hubs (ICH).
     For SMBus support, they are similar to the PIIX4 and are part
     of Intel's '810' and other chipsets.
@@ -527,6 +528,7 @@ static struct pci_device_id i801_ids[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_16) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_17) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB2_17) },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH8_5) },
         { 0, }
 };
 
diff --git a/drivers/i2c/busses/i2c-isa.c b/drivers/i2c/busses/i2c-isa.c
index 9f2ffef4d812..4344ae6b1fcb 100644
--- a/drivers/i2c/busses/i2c-isa.c
+++ b/drivers/i2c/busses/i2c-isa.c
@@ -72,16 +72,6 @@ static ssize_t show_adapter_name(struct device *dev,
 }
 static DEVICE_ATTR(name, S_IRUGO, show_adapter_name, NULL);
 
-static int i2c_isa_device_probe(struct device *dev)
-{
-        return -ENODEV;
-}
-
-static int i2c_isa_device_remove(struct device *dev)
-{
-        return 0;
-}
-
 
 /* We implement an interface which resembles i2c_{add,del}_driver,
    but for i2c-isa drivers. We don't have to remember and handle lists
@@ -93,8 +83,6 @@ int i2c_isa_add_driver(struct i2c_driver *driver)
 
         /* Add the driver to the list of i2c drivers in the driver core */
         driver->driver.bus = &i2c_bus_type;
-        driver->driver.probe = i2c_isa_device_probe;
-        driver->driver.remove = i2c_isa_device_remove;
         res = driver_register(&driver->driver);
         if (res)
                 return res;
diff --git a/drivers/i2c/busses/i2c-parport-light.c b/drivers/i2c/busses/i2c-parport-light.c
index 3e5eba9fcacb..c63025a4c861 100644
--- a/drivers/i2c/busses/i2c-parport-light.c
+++ b/drivers/i2c/busses/i2c-parport-light.c
@@ -121,14 +121,11 @@ static struct i2c_adapter parport_adapter = {
 
 static int __init i2c_parport_init(void)
 {
-        int type_count;
-
-        type_count = sizeof(adapter_parm)/sizeof(struct adapter_parm);
-        if (type < 0 || type >= type_count) {
+        if (type < 0 || type >= ARRAY_SIZE(adapter_parm)) {
                 printk(KERN_WARNING "i2c-parport: invalid type (%d)\n", type);
                 type = 0;
         }
-        
+
         if (base == 0) {
                 printk(KERN_INFO "i2c-parport: using default base 0x%x\n", DEFAULT_BASE);
                 base = DEFAULT_BASE;
@@ -152,7 +149,7 @@ static int __init i2c_parport_init(void)
                 release_region(base, 3);
                 return -ENODEV;
         }
-        
+
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index 2854d858fc9b..7e2e8cd1c14a 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -241,14 +241,11 @@ static struct parport_driver i2c_parport_driver = {
 
 static int __init i2c_parport_init(void)
 {
-        int type_count;
-
-        type_count = sizeof(adapter_parm)/sizeof(struct adapter_parm);
-        if (type < 0 || type >= type_count) {
+        if (type < 0 || type >= ARRAY_SIZE(adapter_parm)) {
                 printk(KERN_WARNING "i2c-parport: invalid type (%d)\n", type);
                 type = 0;
         }
-        
+
         return parport_register_driver(&i2c_parport_driver);
 }
 
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 86e2234faf80..7579f4b256a8 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -861,7 +861,7 @@ static irqreturn_t i2c_pxa_handler(int this_irq, void *dev_id, struct pt_regs *r
                 decode_ISR(isr);
         }
 
-        if (i2c->irqlogidx < sizeof(i2c->isrlog)/sizeof(u32))
+        if (i2c->irqlogidx < ARRAY_SIZE(i2c->isrlog))
                 i2c->isrlog[i2c->irqlogidx++] = isr;
 
         show_state(i2c);
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 0ce58b506046..1a2c9ab5d9e3 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -946,6 +946,20 @@ s32 i2c_smbus_read_i2c_block_data(struct i2c_client *client, u8 command, u8 *val
         }
 }
 
+s32 i2c_smbus_write_i2c_block_data(struct i2c_client *client, u8 command,
+                                   u8 length, u8 *values)
+{
+        union i2c_smbus_data data;
+
+        if (length > I2C_SMBUS_BLOCK_MAX)
+                length = I2C_SMBUS_BLOCK_MAX;
+        data.block[0] = length;
+        memcpy(data.block + 1, values, length);
+        return i2c_smbus_xfer(client->adapter, client->addr, client->flags,
+                              I2C_SMBUS_WRITE, command,
+                              I2C_SMBUS_I2C_BLOCK_DATA, &data);
+}
+
 /* Simulate a SMBus command using the i2c protocol 
    No checking of parameters is done!  */
 static s32 i2c_smbus_xfer_emulated(struct i2c_adapter * adapter, u16 addr, 
@@ -1150,6 +1164,7 @@ EXPORT_SYMBOL(i2c_smbus_read_word_data);
 EXPORT_SYMBOL(i2c_smbus_write_word_data);
 EXPORT_SYMBOL(i2c_smbus_write_block_data);
 EXPORT_SYMBOL(i2c_smbus_read_i2c_block_data);
+EXPORT_SYMBOL(i2c_smbus_write_i2c_block_data);
 
 MODULE_AUTHOR("Simon G. Vogl <simon@tk.uni-linz.ac.at>");
 MODULE_DESCRIPTION("I2C-Bus main module");
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 6c60a9d2afd8..09086b8b6486 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -190,7 +190,8 @@ static ide_startstop_t __ide_do_rw_disk(ide_drive_t *drive, struct request *rq,
                 if (lba48) {
                         task_ioreg_t tasklets[10];
 
-                        pr_debug("%s: LBA=0x%012llx\n", drive->name, block);
+                        pr_debug("%s: LBA=0x%012llx\n", drive->name,
+                                        (unsigned long long)block);
 
                         tasklets[0] = 0;
                         tasklets[1] = 0;
@@ -317,7 +318,8 @@ static ide_startstop_t ide_do_rw_disk (ide_drive_t *drive, struct request *rq, s
 
         pr_debug("%s: %sing: block=%llu, sectors=%lu, buffer=0x%08lx\n",
                  drive->name, rq_data_dir(rq) == READ ? "read" : "writ",
-                 block, rq->nr_sectors, (unsigned long)rq->buffer);
+                 (unsigned long long)block, rq->nr_sectors,
+                 (unsigned long)rq->buffer);
 
         if (hwif->rw_disk)
                 hwif->rw_disk(drive, rq);
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 9834dce4e20f..0606bd2f6020 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -34,6 +34,7 @@
 #include <linux/kernel.h>
 #include <linux/timer.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/major.h>
 #include <linux/errno.h>
@@ -314,6 +315,8 @@ static void ide_pio_datablock(ide_drive_t *drive, struct request *rq,
         if (rq->bio)    /* fs request */
                 rq->errors = 0;
 
+        touch_softlockup_watchdog();
+
         switch (drive->hwif->data_phase) {
         case TASKFILE_MULTI_IN:
         case TASKFILE_MULTI_OUT:
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index 4c2af9020905..6213bd3caee5 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -445,6 +445,7 @@ static struct pcmcia_device_id ide_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("PCMCIA", "PnPIDE", 0x281f1c5d, 0x0c694728),
         PCMCIA_DEVICE_PROD_ID12("SHUTTLE TECHNOLOGY LTD.", "PCCARD-IDE/ATAPI Adapter", 0x4a3f0ba0, 0x322560e1),
         PCMCIA_DEVICE_PROD_ID12("TOSHIBA", "MK2001MPL", 0xb4585a1a, 0x3489e003),
+        PCMCIA_DEVICE_PROD_ID1("TRANSCEND    512M   ", 0xd0909443),
         PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
         PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
         PCMCIA_DEVICE_PROD_ID12("STI", "Flash 5.0", 0xbf2df18d, 0x8cb57a0e),
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index 2b286e865163..43b96e298363 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -13,11 +13,6 @@
  * License along with this program; if not, write the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  *
- * Contact information:  Silicon Graphics, Inc., 1600 Amphitheatre Pkwy,
- * Mountain View, CA  94043, or:
- *
- * http://www.sgi.com
- *
  * For further information regarding this notice, see:
  *
  * http://oss.sgi.com/projects/GenInfo/NoticeExplan
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 18d7eda38851..eca92eb475a1 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -137,15 +137,15 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device (default = 1)"
 /*
  * SCSI inquiry hack for really badly behaved sbp2 devices. Turn this on
  * if your sbp2 device is not properly handling the SCSI inquiry command.
- * This hack makes the inquiry look more like a typical MS Windows
- * inquiry.
+ * This hack makes the inquiry look more like a typical MS Windows inquiry
+ * by enforcing 36 byte inquiry and avoiding access to mode_sense page 8.
  *
  * If force_inquiry_hack=1 is required for your device to work,
  * please submit the logged sbp2_firmware_revision value of this device to
  * the linux1394-devel mailing list.
  */
 static int force_inquiry_hack;
-module_param(force_inquiry_hack, int, 0444);
+module_param(force_inquiry_hack, int, 0644);
 MODULE_PARM_DESC(force_inquiry_hack, "Force SCSI inquiry hack (default = 0)");
 
 /*
@@ -264,18 +264,17 @@ static struct hpsb_protocol_driver sbp2_driver = {
         },
 };
 
-
-/* List of device firmware's that require a forced 36 byte inquiry.  */
+/*
+ * List of device firmwares that require the inquiry hack.
+ * Yields a few false positives but did not break other devices so far.
+ */
 static u32 sbp2_broken_inquiry_list[] = {
-        0x00002800,     /* Stefan Richter <richtest@bauwesen.tu-cottbus.de> */
+        0x00002800,     /* Stefan Richter <stefanr@s5r6.in-berlin.de> */
                         /* DViCO Momobay CX-1 */
         0x00000200      /* Andreas Plesch <plesch@fas.harvard.edu> */
                         /* QPS Fire DVDBurner */
 };
 
-#define NUM_BROKEN_INQUIRY_DEVS \
-        (sizeof(sbp2_broken_inquiry_list)/sizeof(*sbp2_broken_inquiry_list))
-
 /**************************************
  * General utility functions
  **************************************/
@@ -643,9 +642,15 @@ static int sbp2_remove(struct device *dev)
         if (!scsi_id)
                 return 0;
 
-        /* Trigger shutdown functions in scsi's highlevel. */
-        if (scsi_id->scsi_host)
+        if (scsi_id->scsi_host) {
+                /* Get rid of enqueued commands if there is no chance to
+                 * send them. */
+                if (!sbp2util_node_is_available(scsi_id))
+                        sbp2scsi_complete_all_commands(scsi_id, DID_NO_CONNECT);
+                /* scsi_remove_device() will trigger shutdown functions of SCSI
+                 * highlevel drivers which would deadlock if blocked. */
                 scsi_unblock_requests(scsi_id->scsi_host);
+        }
         sdev = scsi_id->sdev;
         if (sdev) {
                 scsi_id->sdev = NULL;
@@ -742,11 +747,6 @@ static struct scsi_id_instance_data *sbp2_alloc_device(struct unit_directory *ud
                 hi->host = ud->ne->host;
                 INIT_LIST_HEAD(&hi->scsi_ids);
 
-                /* Register our sbp2 status address space... */
-                hpsb_register_addrspace(&sbp2_highlevel, ud->ne->host, &sbp2_ops,
-                                        SBP2_STATUS_FIFO_ADDRESS,
-                                        SBP2_STATUS_FIFO_ADDRESS +
-                                        SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(SBP2_MAX_UDS_PER_NODE+1));
 #ifdef CONFIG_IEEE1394_SBP2_PHYS_DMA
                 /* Handle data movement if physical dma is not
                  * enabled/supportedon host controller */
@@ -759,6 +759,18 @@ static struct scsi_id_instance_data *sbp2_alloc_device(struct unit_directory *ud
 
         list_add_tail(&scsi_id->scsi_list, &hi->scsi_ids);
 
+        /* Register the status FIFO address range. We could use the same FIFO
+         * for targets at different nodes. However we need different FIFOs per
+         * target in order to support multi-unit devices. */
+        scsi_id->status_fifo_addr = hpsb_allocate_and_register_addrspace(
+                        &sbp2_highlevel, ud->ne->host, &sbp2_ops,
+                        sizeof(struct sbp2_status_block), sizeof(quadlet_t),
+                        ~0ULL, ~0ULL);
+        if (!scsi_id->status_fifo_addr) {
+                SBP2_ERR("failed to allocate status FIFO address range");
+                goto failed_alloc;
+        }
+
         /* Register our host with the SCSI stack. */
         scsi_host = scsi_host_alloc(&scsi_driver_template,
                                     sizeof(unsigned long));
@@ -997,6 +1009,10 @@ static void sbp2_remove_device(struct scsi_id_instance_data *scsi_id)
                 SBP2_DMA_FREE("single query logins data");
         }
 
+        if (scsi_id->status_fifo_addr)
+                hpsb_unregister_addrspace(&sbp2_highlevel, hi->host,
+                        scsi_id->status_fifo_addr);
+
         scsi_id->ud->device.driver_data = NULL;
 
         SBP2_DEBUG("SBP-2 device removed, SCSI ID = %d", scsi_id->ud->id);
@@ -1075,11 +1091,10 @@ static int sbp2_query_logins(struct scsi_id_instance_data *scsi_id)
                 ORB_SET_QUERY_LOGINS_RESP_LENGTH(sizeof(struct sbp2_query_logins_response));
         SBP2_DEBUG("sbp2_query_logins: reserved_resp_length initialized");
 
-        scsi_id->query_logins_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                                    SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->query_logins_orb->status_FIFO_hi = (ORB_SET_NODE_ID(hi->host->node_id) |
-                                                     SBP2_STATUS_FIFO_ADDRESS_HI);
-        SBP2_DEBUG("sbp2_query_logins: status FIFO initialized");
+        scsi_id->query_logins_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->query_logins_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         sbp2util_cpu_to_be32_buffer(scsi_id->query_logins_orb, sizeof(struct sbp2_query_logins_orb));
 
@@ -1184,11 +1199,10 @@ static int sbp2_login_device(struct scsi_id_instance_data *scsi_id)
                 ORB_SET_LOGIN_RESP_LENGTH(sizeof(struct sbp2_login_response));
         SBP2_DEBUG("sbp2_login_device: passwd_resp_lengths initialized");
 
-        scsi_id->login_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                             SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->login_orb->status_FIFO_hi = (ORB_SET_NODE_ID(hi->host->node_id) |
-                                              SBP2_STATUS_FIFO_ADDRESS_HI);
-        SBP2_DEBUG("sbp2_login_device: status FIFO initialized");
+        scsi_id->login_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->login_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         /*
          * Byte swap ORB if necessary
@@ -1301,10 +1315,10 @@ static int sbp2_logout_device(struct scsi_id_instance_data *scsi_id)
         scsi_id->logout_orb->login_ID_misc |= ORB_SET_NOTIFY(1);
 
         scsi_id->logout_orb->reserved5 = 0x0;
-        scsi_id->logout_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                              SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->logout_orb->status_FIFO_hi = (ORB_SET_NODE_ID(hi->host->node_id) |
-                                               SBP2_STATUS_FIFO_ADDRESS_HI);
+        scsi_id->logout_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->logout_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         /*
          * Byte swap ORB if necessary
@@ -1366,10 +1380,10 @@ static int sbp2_reconnect_device(struct scsi_id_instance_data *scsi_id)
         scsi_id->reconnect_orb->login_ID_misc |= ORB_SET_NOTIFY(1);
 
         scsi_id->reconnect_orb->reserved5 = 0x0;
-        scsi_id->reconnect_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                                 SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->reconnect_orb->status_FIFO_hi =
-                (ORB_SET_NODE_ID(hi->host->node_id) | SBP2_STATUS_FIFO_ADDRESS_HI);
+        scsi_id->reconnect_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->reconnect_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         /*
          * Byte swap ORB if necessary
@@ -1560,7 +1574,7 @@ static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,
         /* Check for a blacklisted set of devices that require us to force
          * a 36 byte host inquiry. This can be overriden as a module param
          * (to force all hosts).  */
-        for (i = 0; i < NUM_BROKEN_INQUIRY_DEVS; i++) {
+        for (i = 0; i < ARRAY_SIZE(sbp2_broken_inquiry_list); i++) {
                 if ((firmware_revision & 0xffff00) ==
                                 sbp2_broken_inquiry_list[i]) {
                         SBP2_WARN("Node " NODE_BUS_FMT ": Using 36byte inquiry workaround",
@@ -2007,18 +2021,6 @@ static int sbp2_send_command(struct scsi_id_instance_data *scsi_id,
         }
 
         /*
-         * The scsi stack sends down a request_bufflen which does not match the
-         * length field in the scsi cdb. This causes some sbp2 devices to
-         * reject this inquiry command. Fix the request_bufflen.
-         */
-        if (*cmd == INQUIRY) {
-                if (force_inquiry_hack || scsi_id->workarounds & SBP2_BREAKAGE_INQUIRY_HACK)
-                        request_bufflen = cmd[4] = 0x24;
-                else
-                        request_bufflen = cmd[4];
-        }
-
-        /*
          * Now actually fill in the comamnd orb and sbp2 s/g list
          */
         sbp2_create_command_orb(scsi_id, command, cmd, SCpnt->use_sg,
@@ -2082,9 +2084,7 @@ static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
 
         SBP2_DEBUG("sbp2_check_sbp2_response");
 
-        switch (SCpnt->cmnd[0]) {
-
-        case INQUIRY:
+        if (SCpnt->cmnd[0] == INQUIRY && (SCpnt->cmnd[1] & 3) == 0) {
                 /*
                  * Make sure data length is ok. Minimum length is 36 bytes
                  */
@@ -2097,13 +2097,7 @@ static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
                  */
                 scsi_buf[2] |= 2;
                 scsi_buf[3] = (scsi_buf[3] & 0xf0) | 2;
-
-                break;
-
-        default:
-                break;
         }
-        return;
 }
 
 /*
@@ -2114,7 +2108,6 @@ static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int dest
 {
         struct sbp2scsi_host_info *hi;
         struct scsi_id_instance_data *scsi_id = NULL, *scsi_id_tmp;
-        u32 id;
         struct scsi_cmnd *SCpnt = NULL;
         u32 scsi_status = SBP2_SCSI_STATUS_GOOD;
         struct sbp2_command_info *command;
@@ -2137,12 +2130,12 @@ static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int dest
         }
 
         /*
-         * Find our scsi_id structure by looking at the status fifo address written to by
-         * the sbp2 device.
+         * Find our scsi_id structure by looking at the status fifo address
+         * written to by the sbp2 device.
          */
-        id = SBP2_STATUS_FIFO_OFFSET_TO_ENTRY((u32)(addr - SBP2_STATUS_FIFO_ADDRESS));
         list_for_each_entry(scsi_id_tmp, &hi->scsi_ids, scsi_list) {
-                if (scsi_id_tmp->ne->nodeid == nodeid && scsi_id_tmp->ud->id == id) {
+                if (scsi_id_tmp->ne->nodeid == nodeid &&
+                    scsi_id_tmp->status_fifo_addr == addr) {
                         scsi_id = scsi_id_tmp;
                         break;
                 }
@@ -2483,7 +2476,16 @@ static void sbp2scsi_complete_command(struct scsi_id_instance_data *scsi_id,
 
 static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
 {
-        ((struct scsi_id_instance_data *)sdev->host->hostdata[0])->sdev = sdev;
+        struct scsi_id_instance_data *scsi_id =
+                (struct scsi_id_instance_data *)sdev->host->hostdata[0];
+
+        scsi_id->sdev = sdev;
+
+        if (force_inquiry_hack ||
+            scsi_id->workarounds & SBP2_BREAKAGE_INQUIRY_HACK) {
+                sdev->inquiry_len = 36;
+                sdev->skip_ms_page_8 = 1;
+        }
         return 0;
 }
 
diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
index 900ea1d25e71..e2d357a9ea3a 100644
--- a/drivers/ieee1394/sbp2.h
+++ b/drivers/ieee1394/sbp2.h
@@ -33,15 +33,17 @@
 #define ORB_DIRECTION_NO_DATA_TRANSFER  0x2
 
 #define ORB_SET_NULL_PTR(value)                 ((value & 0x1) << 31)
-#define ORB_SET_NOTIFY(value)                   ((value & 0x1) << 31)
-#define ORB_SET_RQ_FMT(value)                   ((value & 0x3) << 29)   /* unused ? */
+#define ORB_SET_NOTIFY(value)                   ((value & 0x1) << 31)
+#define ORB_SET_RQ_FMT(value)                   ((value & 0x3) << 29)   /* unused ? */
 #define ORB_SET_NODE_ID(value)                  ((value & 0xffff) << 16)
-#define ORB_SET_DATA_SIZE(value)                (value & 0xffff)
-#define ORB_SET_PAGE_SIZE(value)                ((value & 0x7) << 16)
-#define ORB_SET_PAGE_TABLE_PRESENT(value)       ((value & 0x1) << 19)
-#define ORB_SET_MAX_PAYLOAD(value)              ((value & 0xf) << 20)
-#define ORB_SET_SPEED(value)                    ((value & 0x7) << 24)
-#define ORB_SET_DIRECTION(value)                ((value & 0x1) << 27)
+#define ORB_SET_STATUS_FIFO_HI(value, id)       (value >> 32 | ORB_SET_NODE_ID(id))
+#define ORB_SET_STATUS_FIFO_LO(value)           (value & 0xffffffff)
+#define ORB_SET_DATA_SIZE(value)                (value & 0xffff)
+#define ORB_SET_PAGE_SIZE(value)                ((value & 0x7) << 16)
+#define ORB_SET_PAGE_TABLE_PRESENT(value)       ((value & 0x1) << 19)
+#define ORB_SET_MAX_PAYLOAD(value)              ((value & 0xf) << 20)
+#define ORB_SET_SPEED(value)                    ((value & 0x7) << 24)
+#define ORB_SET_DIRECTION(value)                ((value & 0x1) << 27)
 
 struct sbp2_command_orb {
         volatile u32 next_ORB_hi;
@@ -76,8 +78,8 @@ struct sbp2_login_orb {
         u32 login_response_lo;
         u32 lun_misc;
         u32 passwd_resp_lengths;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 #define RESPONSE_GET_LOGIN_ID(value)            (value & 0xffff)
@@ -102,8 +104,8 @@ struct sbp2_query_logins_orb {
         u32 query_response_lo;
         u32 lun_misc;
         u32 reserved_resp_length;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 #define RESPONSE_GET_MAX_LOGINS(value)          (value & 0xffff)
@@ -123,8 +125,8 @@ struct sbp2_reconnect_orb {
         u32 reserved4;
         u32 login_ID_misc;
         u32 reserved5;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 struct sbp2_logout_orb {
@@ -134,8 +136,8 @@ struct sbp2_logout_orb {
         u32 reserved4;
         u32 login_ID_misc;
         u32 reserved5;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 #define PAGE_TABLE_SET_SEGMENT_BASE_HI(value)   (value & 0xffff)
@@ -195,30 +197,6 @@ struct sbp2_status_block {
  * Miscellaneous SBP2 related config rom defines
  */
 
-/* The status fifo address definition below is used as a base for each
- * node, which a chunk seperately assigned to each unit directory in the
- * node.  For example, 0xfffe00000000ULL is used for the first sbp2 device
- * detected on node 0, 0xfffe00000020ULL for the next sbp2 device on node
- * 0, and so on.
- *
- * Note: We could use a single status fifo address for all sbp2 devices,
- * and figure out which sbp2 device the status belongs to by looking at
- * the source node id of the status write... but, using separate addresses
- * for each sbp2 unit directory allows for better code and the ability to
- * support multiple luns within a single 1394 node.
- *
- * Also note that we choose the address range below as it is a region
- * specified for write posting, where the ohci controller will
- * automatically send an ack_complete when the status is written by the
- * sbp2 device... saving a split transaction.   =)
- */
-#define SBP2_STATUS_FIFO_ADDRESS                                0xfffe00000000ULL
-#define SBP2_STATUS_FIFO_ADDRESS_HI                             0xfffe
-#define SBP2_STATUS_FIFO_ADDRESS_LO                             0x0
-
-#define SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(entry)                 ((entry) << 5)
-#define SBP2_STATUS_FIFO_OFFSET_TO_ENTRY(offset)                ((offset) >> 5)
-
 #define SBP2_UNIT_DIRECTORY_OFFSET_KEY                          0xd1
 #define SBP2_CSR_OFFSET_KEY                                     0x54
 #define SBP2_UNIT_SPEC_ID_KEY                                   0x12
@@ -258,7 +236,6 @@ struct sbp2_status_block {
  */
 
 #define SBP2_MAX_SG_ELEMENT_LENGTH      0xf000
-#define SBP2_MAX_UDS_PER_NODE           16      /* Maximum scsi devices per node */
 #define SBP2_MAX_SECTORS                255     /* Max sectors supported */
 #define SBP2_MAX_CMDS                   8       /* This should be safe */
 
@@ -338,6 +315,11 @@ struct scsi_id_instance_data {
         u32 sbp2_firmware_revision;
 
         /*
+         * Address for the device to write status blocks to
+         */
+        u64 status_fifo_addr;
+
+        /*
          * Variable used for logins, reconnects, logouts, query logins
          */
         atomic_t sbp2_login_complete;
diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
index 39fb88309e8e..216dbbf1dc8e 100644
--- a/drivers/ieee1394/video1394.c
+++ b/drivers/ieee1394/video1394.c
@@ -744,7 +744,7 @@ static int __video1394_ioctl(struct file *file,
                         if (i == ISO_CHANNELS) {
                             PRINT(KERN_ERR, ohci->host->id, 
                                   "No free channel found");
-                            return EAGAIN;
+                            return -EAGAIN;
                         }
                         if (!(ohci->ISO_channel_usage & mask)) {
                             v.channel = i;
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index d393b504bf26..c82f47a66e48 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -665,7 +665,15 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         struct ib_wc mad_wc;
         struct ib_send_wr *send_wr = &mad_send_wr->send_wr;
 
-        if (!smi_handle_dr_smp_send(smp, device->node_type, port_num)) {
+        /*
+         * Directed route handling starts if the initial LID routed part of
+         * a request or the ending LID routed part of a response is empty.
+         * If we are at the start of the LID routed part, don't update the
+         * hop_ptr or hop_cnt.  See section 14.2.2, Vol 1 IB spec.
+         */
+        if ((ib_get_smp_direction(smp) ? smp->dr_dlid : smp->dr_slid) ==
+             IB_LID_PERMISSIVE &&
+            !smi_handle_dr_smp_send(smp, device->node_type, port_num)) {
                 ret = -EINVAL;
                 printk(KERN_ERR PFX "Invalid directed route\n");
                 goto out;
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
index e95c4293a496..f6a05965a4e8 100644
--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -1319,15 +1319,6 @@ static struct class ucm_class = {
         .release = ib_ucm_release_class_dev
 };
 
-static ssize_t show_dev(struct class_device *class_dev, char *buf)
-{
-        struct ib_ucm_device *dev;
-        
-        dev = container_of(class_dev, struct ib_ucm_device, class_dev);
-        return print_dev_t(buf, dev->dev.dev);
-}
-static CLASS_DEVICE_ATTR(dev, S_IRUGO, show_dev, NULL);
-
 static ssize_t show_ibdev(struct class_device *class_dev, char *buf)
 {
         struct ib_ucm_device *dev;
@@ -1364,15 +1355,13 @@ static void ib_ucm_add_one(struct ib_device *device)
 
         ucm_dev->class_dev.class = &ucm_class;
         ucm_dev->class_dev.dev = device->dma_device;
+        ucm_dev->class_dev.devt = ucm_dev->dev.dev;
         snprintf(ucm_dev->class_dev.class_id, BUS_ID_SIZE, "ucm%d",
                  ucm_dev->devnum);
         if (class_device_register(&ucm_dev->class_dev))
                 goto err_cdev;
 
         if (class_device_create_file(&ucm_dev->class_dev,
-                                     &class_device_attr_dev))
-                goto err_class;
-        if (class_device_create_file(&ucm_dev->class_dev,
                                      &class_device_attr_ibdev))
                 goto err_class;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index f9b9b93dc501..2825615ce81c 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -1029,25 +1029,6 @@ int mthca_QUERY_DEV_LIM(struct mthca_dev *dev,
         MTHCA_GET(size, outbox, QUERY_DEV_LIM_UAR_ENTRY_SZ_OFFSET);
         dev_lim->uar_scratch_entry_sz = size;
 
-        mthca_dbg(dev, "Max QPs: %d, reserved QPs: %d, entry size: %d\n",
-                  dev_lim->max_qps, dev_lim->reserved_qps, dev_lim->qpc_entry_sz);
-        mthca_dbg(dev, "Max SRQs: %d, reserved SRQs: %d, entry size: %d\n",
-                  dev_lim->max_srqs, dev_lim->reserved_srqs, dev_lim->srq_entry_sz);
-        mthca_dbg(dev, "Max CQs: %d, reserved CQs: %d, entry size: %d\n",
-                  dev_lim->max_cqs, dev_lim->reserved_cqs, dev_lim->cqc_entry_sz);
-        mthca_dbg(dev, "Max EQs: %d, reserved EQs: %d, entry size: %d\n",
-                  dev_lim->max_eqs, dev_lim->reserved_eqs, dev_lim->eqc_entry_sz);
-        mthca_dbg(dev, "reserved MPTs: %d, reserved MTTs: %d\n",
-                  dev_lim->reserved_mrws, dev_lim->reserved_mtts);
-        mthca_dbg(dev, "Max PDs: %d, reserved PDs: %d, reserved UARs: %d\n",
-                  dev_lim->max_pds, dev_lim->reserved_pds, dev_lim->reserved_uars);
-        mthca_dbg(dev, "Max QP/MCG: %d, reserved MGMs: %d\n",
-                  dev_lim->max_pds, dev_lim->reserved_mgms);
-        mthca_dbg(dev, "Max CQEs: %d, max WQEs: %d, max SRQ WQEs: %d\n",
-                  dev_lim->max_cq_sz, dev_lim->max_qp_sz, dev_lim->max_srq_sz);
-
-        mthca_dbg(dev, "Flags: %08x\n", dev_lim->flags);
-
         if (mthca_is_memfree(dev)) {
                 MTHCA_GET(field, outbox, QUERY_DEV_LIM_MAX_SRQ_SZ_OFFSET);
                 dev_lim->max_srq_sz = 1 << field;
@@ -1093,6 +1074,25 @@ int mthca_QUERY_DEV_LIM(struct mthca_dev *dev,
                 dev_lim->mpt_entry_sz = MTHCA_MPT_ENTRY_SIZE;
         }
 
+        mthca_dbg(dev, "Max QPs: %d, reserved QPs: %d, entry size: %d\n",
+                  dev_lim->max_qps, dev_lim->reserved_qps, dev_lim->qpc_entry_sz);
+        mthca_dbg(dev, "Max SRQs: %d, reserved SRQs: %d, entry size: %d\n",
+                  dev_lim->max_srqs, dev_lim->reserved_srqs, dev_lim->srq_entry_sz);
+        mthca_dbg(dev, "Max CQs: %d, reserved CQs: %d, entry size: %d\n",
+                  dev_lim->max_cqs, dev_lim->reserved_cqs, dev_lim->cqc_entry_sz);
+        mthca_dbg(dev, "Max EQs: %d, reserved EQs: %d, entry size: %d\n",
+                  dev_lim->max_eqs, dev_lim->reserved_eqs, dev_lim->eqc_entry_sz);
+        mthca_dbg(dev, "reserved MPTs: %d, reserved MTTs: %d\n",
+                  dev_lim->reserved_mrws, dev_lim->reserved_mtts);
+        mthca_dbg(dev, "Max PDs: %d, reserved PDs: %d, reserved UARs: %d\n",
+                  dev_lim->max_pds, dev_lim->reserved_pds, dev_lim->reserved_uars);
+        mthca_dbg(dev, "Max QP/MCG: %d, reserved MGMs: %d\n",
+                  dev_lim->max_pds, dev_lim->reserved_mgms);
+        mthca_dbg(dev, "Max CQEs: %d, max WQEs: %d, max SRQ WQEs: %d\n",
+                  dev_lim->max_cq_sz, dev_lim->max_qp_sz, dev_lim->max_srq_sz);
+
+        mthca_dbg(dev, "Flags: %08x\n", dev_lim->flags);
+
 out:
         mthca_free_mailbox(dev, mailbox);
         return err;
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 2a165fd06e57..e481037288d6 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -53,8 +53,8 @@
 
 #define DRV_NAME        "ib_mthca"
 #define PFX             DRV_NAME ": "
-#define DRV_VERSION     "0.06"
-#define DRV_RELDATE     "June 23, 2005"
+#define DRV_VERSION     "0.07"
+#define DRV_RELDATE     "February 13, 2006"
 
 enum {
         MTHCA_FLAG_DDR_HIDDEN = 1 << 1,
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index e0a5412b7e68..2f85a9a831b1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -78,6 +78,7 @@ enum {
         IPOIB_FLAG_SUBINTERFACE   = 4,
         IPOIB_MCAST_RUN           = 5,
         IPOIB_STOP_REAPER         = 6,
+        IPOIB_MCAST_STARTED       = 7,
 
         IPOIB_MAX_BACKOFF_SECONDS = 16,
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index ccaa0c387076..a2408d7ec598 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -533,8 +533,10 @@ void ipoib_mcast_join_task(void *dev_ptr)
         }
 
         if (!priv->broadcast) {
-                priv->broadcast = ipoib_mcast_alloc(dev, 1);
-                if (!priv->broadcast) {
+                struct ipoib_mcast *broadcast;
+
+                broadcast = ipoib_mcast_alloc(dev, 1);
+                if (!broadcast) {
                         ipoib_warn(priv, "failed to allocate broadcast group\n");
                         mutex_lock(&mcast_mutex);
                         if (test_bit(IPOIB_MCAST_RUN, &priv->flags))
@@ -544,10 +546,11 @@ void ipoib_mcast_join_task(void *dev_ptr)
                         return;
                 }
 
-                memcpy(priv->broadcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
+                spin_lock_irq(&priv->lock);
+                memcpy(broadcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
                        sizeof (union ib_gid));
+                priv->broadcast = broadcast;
 
-                spin_lock_irq(&priv->lock);
                 __ipoib_mcast_add(dev, priv->broadcast);
                 spin_unlock_irq(&priv->lock);
         }
@@ -601,6 +604,10 @@ int ipoib_mcast_start_thread(struct net_device *dev)
                 queue_work(ipoib_workqueue, &priv->mcast_task);
         mutex_unlock(&mcast_mutex);
 
+        spin_lock_irq(&priv->lock);
+        set_bit(IPOIB_MCAST_STARTED, &priv->flags);
+        spin_unlock_irq(&priv->lock);
+
         return 0;
 }
 
@@ -611,6 +618,10 @@ int ipoib_mcast_stop_thread(struct net_device *dev, int flush)
 
         ipoib_dbg_mcast(priv, "stopping multicast thread\n");
 
+        spin_lock_irq(&priv->lock);
+        clear_bit(IPOIB_MCAST_STARTED, &priv->flags);
+        spin_unlock_irq(&priv->lock);
+
         mutex_lock(&mcast_mutex);
         clear_bit(IPOIB_MCAST_RUN, &priv->flags);
         cancel_delayed_work(&priv->mcast_task);
@@ -693,6 +704,14 @@ void ipoib_mcast_send(struct net_device *dev, union ib_gid *mgid,
          */
         spin_lock(&priv->lock);
 
+        if (!test_bit(IPOIB_MCAST_STARTED, &priv->flags)        ||
+            !priv->broadcast                                    ||
+            !test_bit(IPOIB_MCAST_FLAG_ATTACHED, &priv->broadcast->flags)) {
+                ++priv->stats.tx_dropped;
+                dev_kfree_skb_any(skb);
+                goto unlock;
+        }
+
         mcast = __ipoib_mcast_find(dev, mgid);
         if (!mcast) {
                 /* Let's create a new send only group now */
@@ -754,6 +773,7 @@ out:
                 ipoib_send(dev, skb, mcast->ah, IB_MULTICAST_QPN);
         }
 
+unlock:
         spin_unlock(&priv->lock);
 }
 
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 2d2d4ac3525a..960dae5c87d1 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1155,6 +1155,12 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
 
         spin_lock_irq(target->scsi_host->host_lock);
 
+        if (target->state == SRP_TARGET_DEAD ||
+            target->state == SRP_TARGET_REMOVED) {
+                scmnd->result = DID_BAD_TARGET << 16;
+                goto out;
+        }
+
         if (scmnd->host_scribble == (void *) -1L)
                 goto out;
 
diff --git a/drivers/input/keyboard/Makefile b/drivers/input/keyboard/Makefile
index 6e0afbb22383..2708167ba175 100644
--- a/drivers/input/keyboard/Makefile
+++ b/drivers/input/keyboard/Makefile
@@ -11,7 +11,6 @@ obj-$(CONFIG_KEYBOARD_XTKBD)		+= xtkbd.o
 obj-$(CONFIG_KEYBOARD_AMIGA)            += amikbd.o
 obj-$(CONFIG_KEYBOARD_LOCOMO)           += locomokbd.o
 obj-$(CONFIG_KEYBOARD_NEWTON)           += newtonkbd.o
-obj-$(CONFIG_KEYBOARD_98KBD)            += 98kbd.o
 obj-$(CONFIG_KEYBOARD_CORGI)            += corgikbd.o
 obj-$(CONFIG_KEYBOARD_SPITZ)            += spitzkbd.o
 obj-$(CONFIG_KEYBOARD_HIL)              += hil_kbd.o
diff --git a/drivers/input/misc/Makefile b/drivers/input/misc/Makefile
index 184c4129470d..415c49178985 100644
--- a/drivers/input/misc/Makefile
+++ b/drivers/input/misc/Makefile
@@ -7,7 +7,6 @@
 obj-$(CONFIG_INPUT_SPARCSPKR)           += sparcspkr.o
 obj-$(CONFIG_INPUT_PCSPKR)              += pcspkr.o
 obj-$(CONFIG_INPUT_M68K_BEEP)           += m68kspkr.o
-obj-$(CONFIG_INPUT_98SPKR)              += 98spkr.o
 obj-$(CONFIG_INPUT_UINPUT)              += uinput.o
 obj-$(CONFIG_INPUT_WISTRON_BTNS)        += wistron_btns.o
 obj-$(CONFIG_HP_SDC_RTC)                += hp_sdc_rtc.o
diff --git a/drivers/input/misc/ixp4xx-beeper.c b/drivers/input/misc/ixp4xx-beeper.c
index d448bb5e4869..3a6ae85cd69c 100644
--- a/drivers/input/misc/ixp4xx-beeper.c
+++ b/drivers/input/misc/ixp4xx-beeper.c
@@ -19,6 +19,7 @@
 #include <linux/input.h>
 #include <linux/delay.h>
 #include <linux/platform_device.h>
+#include <linux/interrupt.h>
 #include <asm/hardware.h>
 
 MODULE_AUTHOR("Alessandro Zummo <a.zummo@towertech.it>");
diff --git a/drivers/input/mouse/logips2pp.c b/drivers/input/mouse/logips2pp.c
index c88520d3d13c..40333d61093c 100644
--- a/drivers/input/mouse/logips2pp.c
+++ b/drivers/input/mouse/logips2pp.c
@@ -232,6 +232,7 @@ static struct ps2pp_info *get_model_info(unsigned char model)
                 { 88,   PS2PP_KIND_WHEEL,       PS2PP_WHEEL },
                 { 96,   0,                      0 },
                 { 97,   PS2PP_KIND_TP3,         PS2PP_WHEEL | PS2PP_HWHEEL },
+                { 99,   PS2PP_KIND_WHEEL,       PS2PP_WHEEL },
                 { 100,  PS2PP_KIND_MX,                                  /* MX510 */
                                 PS2PP_WHEEL | PS2PP_SIDE_BTN | PS2PP_TASK_BTN |
                                 PS2PP_EXTRA_BTN | PS2PP_NAV_BTN },
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 19b1b0121726..ad6217467676 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -58,7 +58,7 @@ static unsigned int psmouse_resetafter = 5;
 module_param_named(resetafter, psmouse_resetafter, uint, 0644);
 MODULE_PARM_DESC(resetafter, "Reset device after so many bad packets (0 = never).");
 
-static unsigned int psmouse_resync_time = 5;
+static unsigned int psmouse_resync_time;
 module_param_named(resync_time, psmouse_resync_time, uint, 0644);
 MODULE_PARM_DESC(resync_time, "How long can mouse stay idle before forcing resync (in seconds, 0 = never).");
 
diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
index b4898d8a68e2..6d9ec9ab1b90 100644
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -68,15 +68,19 @@ struct trackpoint_attr_data {
         size_t field_offset;
         unsigned char command;
         unsigned char mask;
+        unsigned char inverted;
 };
 
 static ssize_t trackpoint_show_int_attr(struct psmouse *psmouse, void *data, char *buf)
 {
         struct trackpoint_data *tp = psmouse->private;
         struct trackpoint_attr_data *attr = data;
-        unsigned char *field = (unsigned char *)((char *)tp + attr->field_offset);
+        unsigned char value = *(unsigned char *)((char *)tp + attr->field_offset);
+
+        if (attr->inverted)
+                value = !value;
 
-        return sprintf(buf, "%u\n", *field);
+        return sprintf(buf, "%u\n", value);
 }
 
 static ssize_t trackpoint_set_int_attr(struct psmouse *psmouse, void *data,
@@ -120,6 +124,9 @@ static ssize_t trackpoint_set_bit_attr(struct psmouse *psmouse, void *data,
         if (*rest || value > 1)
                 return -EINVAL;
 
+        if (attr->inverted)
+                value = !value;
+
         if (*field != value) {
                 *field = value;
                 trackpoint_toggle_bit(&psmouse->ps2dev, attr->command, attr->mask);
@@ -129,11 +136,12 @@ static ssize_t trackpoint_set_bit_attr(struct psmouse *psmouse, void *data,
 }
 
 
-#define TRACKPOINT_BIT_ATTR(_name, _command, _mask)                             \
+#define TRACKPOINT_BIT_ATTR(_name, _command, _mask, _inv)                               \
         static struct trackpoint_attr_data trackpoint_attr_##_name = {          \
                 .field_offset   = offsetof(struct trackpoint_data, _name),      \
                 .command        = _command,                                     \
                 .mask           = _mask,                                        \
+                .inverted       = _inv,                                         \
         };                                                                      \
         PSMOUSE_DEFINE_ATTR(_name, S_IWUSR | S_IRUGO,                           \
                             &trackpoint_attr_##_name,                           \
@@ -150,9 +158,9 @@ TRACKPOINT_INT_ATTR(upthresh, TP_UP_THRESH);
 TRACKPOINT_INT_ATTR(ztime, TP_Z_TIME);
 TRACKPOINT_INT_ATTR(jenks, TP_JENKS_CURV);
 
-TRACKPOINT_BIT_ATTR(press_to_select, TP_TOGGLE_PTSON, TP_MASK_PTSON);
-TRACKPOINT_BIT_ATTR(skipback, TP_TOGGLE_SKIPBACK, TP_MASK_SKIPBACK);
-TRACKPOINT_BIT_ATTR(ext_dev, TP_TOGGLE_EXT_DEV, TP_MASK_EXT_DEV);
+TRACKPOINT_BIT_ATTR(press_to_select, TP_TOGGLE_PTSON, TP_MASK_PTSON, 0);
+TRACKPOINT_BIT_ATTR(skipback, TP_TOGGLE_SKIPBACK, TP_MASK_SKIPBACK, 0);
+TRACKPOINT_BIT_ATTR(ext_dev, TP_TOGGLE_EXT_DEV, TP_MASK_EXT_DEV, 1);
 
 static struct attribute *trackpoint_attrs[] = {
         &psmouse_attr_sensitivity.dattr.attr,
diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
index 9857d8b6ad66..050298b1a09d 100644
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -78,7 +78,7 @@
 
 #define TP_TOGGLE_MB            0x23    /* Disable/Enable Middle Button */
 #define TP_MASK_MB                      0x01
-#define TP_TOGGLE_EXT_DEV       0x23    /* Toggle external device */
+#define TP_TOGGLE_EXT_DEV       0x23    /* Disable external device */
 #define TP_MASK_EXT_DEV                 0x02
 #define TP_TOGGLE_DRIFT         0x23    /* Drift Correction */
 #define TP_MASK_DRIFT                   0x80
@@ -125,7 +125,7 @@
 #define TP_DEF_MB               0x00
 #define TP_DEF_PTSON            0x00
 #define TP_DEF_SKIPBACK         0x00
-#define TP_DEF_EXT_DEV          0x01
+#define TP_DEF_EXT_DEV          0x00    /* 0 means enabled */
 
 #define MAKE_PS2_CMD(params, results, cmd) ((params<<12) | (results<<8) | (cmd))
 
diff --git a/drivers/input/serio/Makefile b/drivers/input/serio/Makefile
index 678a8599f9ff..4155197867a3 100644
--- a/drivers/input/serio/Makefile
+++ b/drivers/input/serio/Makefile
@@ -13,7 +13,6 @@ obj-$(CONFIG_SERIO_RPCKBD)	+= rpckbd.o
 obj-$(CONFIG_SERIO_SA1111)      += sa1111ps2.o
 obj-$(CONFIG_SERIO_AMBAKMI)     += ambakmi.o
 obj-$(CONFIG_SERIO_Q40KBD)      += q40kbd.o
-obj-$(CONFIG_SERIO_98KBD)       += 98kbd-io.o
 obj-$(CONFIG_SERIO_GSCPS2)      += gscps2.o
 obj-$(CONFIG_HP_SDC)            += hp_sdc.o
 obj-$(CONFIG_HIL_MLC)           += hp_sdc_mlc.o hil_mlc.o
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index b45a45ca7cc9..8c12a974b411 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -48,10 +48,13 @@
 
 #define TS_POLL_PERIOD  msecs_to_jiffies(10)
 
+/* this driver doesn't aim at the peak continuous sample rate */
+#define SAMPLE_BITS     (8 /*cmd*/ + 16 /*sample*/ + 2 /* before, after */)
+
 struct ts_event {
         /* For portability, we can't read 12 bit values using SPI (which
          * would make the controller deliver them as native byteorder u16
-         * with msbs zeroed).  Instead, we read them as two 8-byte values,
+         * with msbs zeroed).  Instead, we read them as two 8-bit values,
          * which need byteswapping then range adjustment.
          */
         __be16 x;
@@ -60,7 +63,7 @@ struct ts_event {
 };
 
 struct ads7846 {
-        struct input_dev        input;
+        struct input_dev        *input;
         char                    phys[32];
 
         struct spi_device       *spi;
@@ -68,6 +71,7 @@ struct ads7846 {
         u16                     vref_delay_usecs;
         u16                     x_plate_ohms;
 
+        u8                      read_x, read_y, read_z1, read_z2;
         struct ts_event         tc;
 
         struct spi_transfer     xfer[8];
@@ -117,10 +121,10 @@ struct ads7846 {
 #define READ_12BIT_DFR(x) (ADS_START | ADS_A2A1A0_d_ ## x \
         | ADS_12_BIT | ADS_DFR)
 
-static const u8 read_y  = READ_12BIT_DFR(y)  | ADS_PD10_ADC_ON;
-static const u8 read_z1 = READ_12BIT_DFR(z1) | ADS_PD10_ADC_ON;
-static const u8 read_z2 = READ_12BIT_DFR(z2) | ADS_PD10_ADC_ON;
-static const u8 read_x  = READ_12BIT_DFR(x)  | ADS_PD10_PDOWN;  /* LAST */
+#define READ_Y  (READ_12BIT_DFR(y)  | ADS_PD10_ADC_ON)
+#define READ_Z1 (READ_12BIT_DFR(z1) | ADS_PD10_ADC_ON)
+#define READ_Z2 (READ_12BIT_DFR(z2) | ADS_PD10_ADC_ON)
+#define READ_X  (READ_12BIT_DFR(x)  | ADS_PD10_PDOWN)   /* LAST */
 
 /* single-ended samples need to first power up reference voltage;
  * we leave both ADC and VREF powered
@@ -128,8 +132,8 @@ static const u8	read_x  = READ_12BIT_DFR(x)  | ADS_PD10_PDOWN;	/* LAST */
 #define READ_12BIT_SER(x) (ADS_START | ADS_A2A1A0_ ## x \
         | ADS_12_BIT | ADS_SER)
 
-static const u8 ref_on = READ_12BIT_DFR(x) | ADS_PD10_ALL_ON;
-static const u8 ref_off = READ_12BIT_DFR(y) | ADS_PD10_PDOWN;
+#define REF_ON  (READ_12BIT_DFR(x) | ADS_PD10_ALL_ON)
+#define REF_OFF (READ_12BIT_DFR(y) | ADS_PD10_PDOWN)
 
 /*--------------------------------------------------------------------------*/
 
@@ -138,7 +142,9 @@ static const u8	ref_off = READ_12BIT_DFR(y) | ADS_PD10_PDOWN;
  */
 
 struct ser_req {
+        u8                      ref_on;
         u8                      command;
+        u8                      ref_off;
         u16                     scratch;
         __be16                  sample;
         struct spi_message      msg;
@@ -152,7 +158,7 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         struct ser_req          *req = kzalloc(sizeof *req, SLAB_KERNEL);
         int                     status;
         int                     sample;
-        int                     i;
+        int                     i;
 
         if (!req)
                 return -ENOMEM;
@@ -160,7 +166,8 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         INIT_LIST_HEAD(&req->msg.transfers);
 
         /* activate reference, so it has time to settle; */
-        req->xfer[0].tx_buf = &ref_on;
+        req->ref_on = REF_ON;
+        req->xfer[0].tx_buf = &req->ref_on;
         req->xfer[0].len = 1;
         req->xfer[1].rx_buf = &req->scratch;
         req->xfer[1].len = 2;
@@ -182,7 +189,8 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         /* REVISIT:  take a few more samples, and compare ... */
 
         /* turn off reference */
-        req->xfer[4].tx_buf = &ref_off;
+        req->ref_off = REF_OFF;
+        req->xfer[4].tx_buf = &req->ref_off;
         req->xfer[4].len = 1;
         req->xfer[5].rx_buf = &req->scratch;
         req->xfer[5].len = 2;
@@ -236,11 +244,12 @@ SHOW(vbatt)
 
 static void ads7846_rx(void *ads)
 {
-        struct ads7846  *ts = ads;
-        unsigned        Rt;
-        unsigned        sync = 0;
-        u16             x, y, z1, z2;
-        unsigned long   flags;
+        struct ads7846          *ts = ads;
+        struct input_dev        *input_dev = ts->input;
+        unsigned                Rt;
+        unsigned                sync = 0;
+        u16                     x, y, z1, z2;
+        unsigned long           flags;
 
         /* adjust:  12 bit samples (left aligned), built from
          * two 8 bit values writen msb-first.
@@ -276,21 +285,21 @@ static void ads7846_rx(void *ads)
          * won't notice that, even if nPENIRQ never fires ...
          */
         if (!ts->pendown && Rt != 0) {
-                input_report_key(&ts->input, BTN_TOUCH, 1);
+                input_report_key(input_dev, BTN_TOUCH, 1);
                 sync = 1;
         } else if (ts->pendown && Rt == 0) {
-                input_report_key(&ts->input, BTN_TOUCH, 0);
+                input_report_key(input_dev, BTN_TOUCH, 0);
                 sync = 1;
         }
 
         if (Rt) {
-                input_report_abs(&ts->input, ABS_X, x);
-                input_report_abs(&ts->input, ABS_Y, y);
-                input_report_abs(&ts->input, ABS_PRESSURE, Rt);
+                input_report_abs(input_dev, ABS_X, x);
+                input_report_abs(input_dev, ABS_Y, y);
+                input_report_abs(input_dev, ABS_PRESSURE, Rt);
                 sync = 1;
         }
         if (sync)
-                input_sync(&ts->input);
+                input_sync(input_dev);
 
 #ifdef  VERBOSE
         if (Rt || ts->pendown)
@@ -396,9 +405,10 @@ static int ads7846_resume(struct spi_device *spi)
 static int __devinit ads7846_probe(struct spi_device *spi)
 {
         struct ads7846                  *ts;
+        struct input_dev                *input_dev;
         struct ads7846_platform_data    *pdata = spi->dev.platform_data;
         struct spi_transfer             *x;
-        int                             i;
+        int                             err;
 
         if (!spi->irq) {
                 dev_dbg(&spi->dev, "no IRQ?\n");
@@ -411,9 +421,9 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         }
 
         /* don't exceed max specified sample rate */
-        if (spi->max_speed_hz > (125000 * 16)) {
+        if (spi->max_speed_hz > (125000 * SAMPLE_BITS)) {
                 dev_dbg(&spi->dev, "f(sample) %d KHz?\n",
-                                (spi->max_speed_hz/16)/1000);
+                                (spi->max_speed_hz/SAMPLE_BITS)/1000);
                 return -EINVAL;
         }
 
@@ -423,13 +433,18 @@ static int __devinit ads7846_probe(struct spi_device *spi)
          * to discard the four garbage LSBs.
          */
 
-        if (!(ts = kzalloc(sizeof(struct ads7846), GFP_KERNEL)))
-                return -ENOMEM;
+        ts = kzalloc(sizeof(struct ads7846), GFP_KERNEL);
+        input_dev = input_allocate_device();
+        if (!ts || !input_dev) {
+                err = -ENOMEM;
+                goto err_free_mem;
+        }
 
         dev_set_drvdata(&spi->dev, ts);
+        spi->dev.power.power_state = PMSG_ON;
 
         ts->spi = spi;
-        spi->dev.power.power_state = PMSG_ON;
+        ts->input = input_dev;
 
         init_timer(&ts->timer);
         ts->timer.data = (unsigned long) ts;
@@ -439,70 +454,80 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         ts->vref_delay_usecs = pdata->vref_delay_usecs ? : 100;
         ts->x_plate_ohms = pdata->x_plate_ohms ? : 400;
 
-        init_input_dev(&ts->input);
+        snprintf(ts->phys, sizeof(ts->phys), "%s/input0", spi->dev.bus_id);
 
-        ts->input.dev = &spi->dev;
-        ts->input.name = "ADS784x Touchscreen";
-        snprintf(ts->phys, sizeof ts->phys, "%s/input0", spi->dev.bus_id);
-        ts->input.phys = ts->phys;
+        input_dev->name = "ADS784x Touchscreen";
+        input_dev->phys = ts->phys;
+        input_dev->cdev.dev = &spi->dev;
 
-        ts->input.evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
-        ts->input.keybit[LONG(BTN_TOUCH)] = BIT(BTN_TOUCH);
-        input_set_abs_params(&ts->input, ABS_X,
+        input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
+        input_dev->keybit[LONG(BTN_TOUCH)] = BIT(BTN_TOUCH);
+        input_set_abs_params(input_dev, ABS_X,
                         pdata->x_min ? : 0,
                         pdata->x_max ? : MAX_12BIT,
                         0, 0);
-        input_set_abs_params(&ts->input, ABS_Y,
+        input_set_abs_params(input_dev, ABS_Y,
                         pdata->y_min ? : 0,
                         pdata->y_max ? : MAX_12BIT,
                         0, 0);
-        input_set_abs_params(&ts->input, ABS_PRESSURE,
+        input_set_abs_params(input_dev, ABS_PRESSURE,
                         pdata->pressure_min, pdata->pressure_max, 0, 0);
 
-        input_register_device(&ts->input);
-
         /* set up the transfers to read touchscreen state; this assumes we
          * use formula #2 for pressure, not #3.
          */
+        INIT_LIST_HEAD(&ts->msg.transfers);
         x = ts->xfer;
 
         /* y- still on; turn on only y+ (and ADC) */
-        x->tx_buf = &read_y;
+        ts->read_y = READ_Y;
+        x->tx_buf = &ts->read_y;
         x->len = 1;
+        spi_message_add_tail(x, &ts->msg);
+
         x++;
         x->rx_buf = &ts->tc.y;
         x->len = 2;
-        x++;
+        spi_message_add_tail(x, &ts->msg);
 
         /* turn y+ off, x- on; we'll use formula #2 */
         if (ts->model == 7846) {
-                x->tx_buf = &read_z1;
+                x++;
+                ts->read_z1 = READ_Z1;
+                x->tx_buf = &ts->read_z1;
                 x->len = 1;
+                spi_message_add_tail(x, &ts->msg);
+
                 x++;
                 x->rx_buf = &ts->tc.z1;
                 x->len = 2;
-                x++;
+                spi_message_add_tail(x, &ts->msg);
 
-                x->tx_buf = &read_z2;
+                x++;
+                ts->read_z2 = READ_Z2;
+                x->tx_buf = &ts->read_z2;
                 x->len = 1;
+                spi_message_add_tail(x, &ts->msg);
+
                 x++;
                 x->rx_buf = &ts->tc.z2;
                 x->len = 2;
-                x++;
+                spi_message_add_tail(x, &ts->msg);
         }
 
         /* turn y- off, x+ on, then leave in lowpower */
-        x->tx_buf = &read_x;
+        x++;
+        ts->read_x = READ_X;
+        x->tx_buf = &ts->read_x;
         x->len = 1;
+        spi_message_add_tail(x, &ts->msg);
+
         x++;
         x->rx_buf = &ts->tc.x;
         x->len = 2;
-        x++;
-
-        CS_CHANGE(x[-1]);
+        CS_CHANGE(*x);
+        spi_message_add_tail(x, &ts->msg);
 
-        for (i = 0; i < x - ts->xfer; i++)
-                spi_message_add_tail(&ts->xfer[i], &ts->msg);
         ts->msg.complete = ads7846_rx;
         ts->msg.context = ts;
 
@@ -510,9 +535,8 @@ static int __devinit ads7846_probe(struct spi_device *spi)
                         SA_SAMPLE_RANDOM | SA_TRIGGER_FALLING,
                         spi->dev.bus_id, ts)) {
                 dev_dbg(&spi->dev, "irq %d busy?\n", spi->irq);
-                input_unregister_device(&ts->input);
-                kfree(ts);
-                return -EBUSY;
+                err = -EBUSY;
+                goto err_free_mem;
         }
 
         dev_info(&spi->dev, "touchscreen, irq %d\n", spi->irq);
@@ -534,7 +558,18 @@ static int __devinit ads7846_probe(struct spi_device *spi)
                 device_create_file(&spi->dev, &dev_attr_vbatt);
         device_create_file(&spi->dev, &dev_attr_vaux);
 
+        err = input_register_device(input_dev);
+        if (err)
+                goto err_free_irq;
+
         return 0;
+
+ err_free_irq:
+        free_irq(spi->irq, ts);
+ err_free_mem:
+        input_free_device(input_dev);
+        kfree(ts);
+        return err;
 }
 
 static int __devexit ads7846_remove(struct spi_device *spi)
@@ -554,7 +589,7 @@ static int __devexit ads7846_remove(struct spi_device *spi)
                 device_remove_file(&spi->dev, &dev_attr_vbatt);
         device_remove_file(&spi->dev, &dev_attr_vaux);
 
-        input_unregister_device(&ts->input);
+        input_unregister_device(ts->input);
         kfree(ts);
 
         dev_dbg(&spi->dev, "unregistered touchscreen\n");
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index 0ef560144be3..6dfc94122dd9 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -351,7 +351,7 @@ config HISAX_ENTERNOW_PCI
 
 config HISAX_AMD7930
         bool "Am7930 (EXPERIMENTAL)"
-        depends on EXPERIMENTAL && SPARC
+        depends on EXPERIMENTAL && SPARC && BROKEN
         help
           This enables HiSax support for the AMD7930 chips on some SPARCs.
           This code is not finished yet.
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index 8159bcecd0c2..df9d65201819 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1929,6 +1929,8 @@ static struct pci_device_id hisax_pci_tbl[] __initdata = {
         {PCI_VENDOR_ID_CCD,      PCI_DEVICE_ID_CCD_B00B,         PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_CCD,      PCI_DEVICE_ID_CCD_B00C,         PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_CCD,      PCI_DEVICE_ID_CCD_B100,         PCI_ANY_ID, PCI_ANY_ID},
+        {PCI_VENDOR_ID_CCD,      PCI_DEVICE_ID_CCD_B700,         PCI_ANY_ID, PCI_ANY_ID},
+        {PCI_VENDOR_ID_CCD,      PCI_DEVICE_ID_CCD_B701,         PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_ABOCOM,   PCI_DEVICE_ID_ABOCOM_2BD1,      PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_ASUSTEK,  PCI_DEVICE_ID_ASUSTEK_0675,     PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_BERKOM,   PCI_DEVICE_ID_BERKOM_T_CONCEPT, PCI_ANY_ID, PCI_ANY_ID},
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 4866fc32d8d9..91d25acb5ede 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -51,6 +51,8 @@ static const PCI_ENTRY id_list[] =
         {PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_B00B, "Billion", "B00B"},
         {PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_B00C, "Billion", "B00C"},
         {PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_B100, "Seyeon", "B100"},
+        {PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_B700, "Primux II S0", "B700"},
+        {PCI_VENDOR_ID_CCD, PCI_DEVICE_ID_CCD_B701, "Primux II S0 NT", "B701"},
         {PCI_VENDOR_ID_ABOCOM, PCI_DEVICE_ID_ABOCOM_2BD1, "Abocom/Magitek", "2BD1"},
         {PCI_VENDOR_ID_ASUSTEK, PCI_DEVICE_ID_ASUSTEK_0675, "Asuscom/Askey", "675"},
         {PCI_VENDOR_ID_BERKOM, PCI_DEVICE_ID_BERKOM_T_CONCEPT, "German telekom", "T-Concept"},
diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index ca5b4a3b683e..262c44127419 100644
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -1,7 +1,7 @@
 /*
  * hfc_usb.c
  *
- * $Id: hfc_usb.c,v 4.36 2005/04/08 09:55:13 martinb1 Exp $
+ * $Id: hfc_usb.c,v 2.3.2.13 2006/02/17 17:17:22 mbachem Exp $
  *
  * modular HiSax ISDN driver for Colognechip HFC-S USB chip
  *
@@ -45,7 +45,7 @@
 #include "hfc_usb.h"
 
 static const char *hfcusb_revision =
-    "$Revision: 4.36 $ $Date: 2005/04/08 09:55:13 $ ";
+    "$Revision: 2.3.2.13 $ $Date: 2006/02/17 17:17:22 $ ";
 
 /* Hisax debug support
 * use "modprobe debug=x" where x is bitfield of USB_DBG & ISDN_DBG
@@ -219,7 +219,7 @@ symbolic(struct hfcusb_symbolic_list list[], const int num)
         for (i = 0; list[i].name != NULL; i++)
                 if (list[i].num == num)
                         return (list[i].name);
-        return "<unkown ERROR>";
+        return "<unknown ERROR>";
 }
 
 
@@ -235,9 +235,9 @@ ctrl_start_transfer(hfcusb_data * hfc)
                 hfc->ctrl_urb->transfer_buffer = NULL;
                 hfc->ctrl_urb->transfer_buffer_length = 0;
                 hfc->ctrl_write.wIndex =
-                    hfc->ctrl_buff[hfc->ctrl_out_idx].hfc_reg;
+                    cpu_to_le16(hfc->ctrl_buff[hfc->ctrl_out_idx].hfc_reg);
                 hfc->ctrl_write.wValue =
-                    hfc->ctrl_buff[hfc->ctrl_out_idx].reg_val;
+                    cpu_to_le16(hfc->ctrl_buff[hfc->ctrl_out_idx].reg_val);
 
                 usb_submit_urb(hfc->ctrl_urb, GFP_ATOMIC);      /* start transfer */
         }
@@ -1282,7 +1282,7 @@ usb_init(hfcusb_data * hfc)
         /* init the background machinery for control requests */
         hfc->ctrl_read.bRequestType = 0xc0;
         hfc->ctrl_read.bRequest = 1;
-        hfc->ctrl_read.wLength = 1;
+        hfc->ctrl_read.wLength = cpu_to_le16(1);
         hfc->ctrl_write.bRequestType = 0x40;
         hfc->ctrl_write.bRequest = 0;
         hfc->ctrl_write.wLength = 0;
@@ -1373,9 +1373,8 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
 
         vend_idx = 0xffff;
         for (i = 0; hfcusb_idtab[i].idVendor; i++) {
-                if (dev->descriptor.idVendor == hfcusb_idtab[i].idVendor
-                    && dev->descriptor.idProduct ==
-                    hfcusb_idtab[i].idProduct) {
+                if ((le16_to_cpu(dev->descriptor.idVendor) == hfcusb_idtab[i].idVendor)
+                    && (le16_to_cpu(dev->descriptor.idProduct) == hfcusb_idtab[i].idProduct)) {
                         vend_idx = i;
                         continue;
                 }
@@ -1516,8 +1515,7 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                                                             usb_transfer_mode
                                                             = USB_INT;
                                                         packet_size =
-                                                            ep->desc.
-                                                            wMaxPacketSize;
+                                                            le16_to_cpu(ep->desc.wMaxPacketSize);
                                                         break;
                                                 case USB_ENDPOINT_XFER_BULK:
                                                         if (ep_addr & 0x80)
@@ -1545,8 +1543,7 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                                                             usb_transfer_mode
                                                             = USB_BULK;
                                                         packet_size =
-                                                            ep->desc.
-                                                            wMaxPacketSize;
+                                                            le16_to_cpu(ep->desc.wMaxPacketSize);
                                                         break;
                                                 case USB_ENDPOINT_XFER_ISOC:
                                                         if (ep_addr & 0x80)
@@ -1574,8 +1571,7 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                                                             usb_transfer_mode
                                                             = USB_ISOC;
                                                         iso_packet_size =
-                                                            ep->desc.
-                                                            wMaxPacketSize;
+                                                            le16_to_cpu(ep->desc.wMaxPacketSize);
                                                         break;
                                                 default:
                                                         context->
@@ -1588,10 +1584,8 @@ hfc_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
                                                     fifonum = cidx;
                                                 context->fifos[cidx].hfc =
                                                     context;
-                                                context->fifos[cidx].
-                                                    usb_packet_maxlen =
-                                                    ep->desc.
-                                                    wMaxPacketSize;
+                                                context->fifos[cidx].usb_packet_maxlen =
+                                                    le16_to_cpu(ep->desc.wMaxPacketSize);
                                                 context->fifos[cidx].
                                                     intervall =
                                                     ep->desc.bInterval;
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index f190a99604f0..aeaa1db74bd8 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -1682,6 +1682,7 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
 #ifdef ISDN_DEBUG_MODEM_OPEN
                 printk(KERN_DEBUG "isdn_tty_close after info->count != 0\n");
 #endif
+                module_put(info->owner);
                 return;
         }
         info->flags |= ISDN_ASYNC_CLOSING;
@@ -2359,8 +2360,8 @@ isdn_tty_at_cout(char *msg, modem_info * info)
 
         /* use queue instead of direct, if online and */
         /* data is in queue or buffer is full */
-        if ((info->online && tty_buffer_request_room(tty, l) < l) ||
-            (!skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {
+        if (info->online && ((tty_buffer_request_room(tty, l) < l) ||
+            !skb_queue_empty(&dev->drv[info->isdn_driver]->rpqueue[info->isdn_channel]))) {
                 skb = alloc_skb(l, GFP_ATOMIC);
                 if (!skb) {
                         spin_unlock_irqrestore(&info->readlock, flags);
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 7d4a0ac28c06..12ad462737ba 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -187,6 +187,14 @@ config WINDFARM_PM91
           This driver provides thermal control for the PowerMac9,1
           which is the recent (SMU based) single CPU desktop G5
 
+config WINDFARM_PM112
+        tristate "Support for thermal management on PowerMac11,2"
+        depends on WINDFARM && I2C && PMAC_SMU
+        select I2C_POWERMAC
+        help
+          This driver provides thermal control for the PowerMac11,2
+          which are the recent dual and quad G5 machines using the
+          970MP dual-core processor.
 
 config ANSLCD
         tristate "Support for ANS LCD display"
diff --git a/drivers/macintosh/Makefile b/drivers/macintosh/Makefile
index f4657aa81fb0..6081acdea404 100644
--- a/drivers/macintosh/Makefile
+++ b/drivers/macintosh/Makefile
@@ -35,3 +35,8 @@ obj-$(CONFIG_WINDFARM_PM91)     += windfarm_smu_controls.o \
                                    windfarm_smu_sensors.o \
                                    windfarm_lm75_sensor.o windfarm_pid.o \
                                    windfarm_cpufreq_clamp.o windfarm_pm91.o
+obj-$(CONFIG_WINDFARM_PM112)    += windfarm_pm112.o windfarm_smu_sat.o \
+                                   windfarm_smu_controls.o \
+                                   windfarm_smu_sensors.o \
+                                   windfarm_max6690_sensor.o \
+                                   windfarm_lm75_sensor.o windfarm_pid.o
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index 6eb93e45fcd3..4a478eb0e27d 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -825,7 +825,7 @@ proc_get_info(char *page, char **start, off_t off,
         p += sprintf(p, "PMU driver version     : %d\n", PMU_DRIVER_VERSION);
         p += sprintf(p, "PMU firmware version   : %02x\n", pmu_version);
         p += sprintf(p, "AC Power               : %d\n",
-                ((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0));
+                ((pmu_power_flags & PMU_PWR_AC_PRESENT) != 0) || pmu_battery_count == 0);
         p += sprintf(p, "Battery count          : %d\n", pmu_battery_count);
 
         return p - page;
diff --git a/drivers/macintosh/windfarm.h b/drivers/macintosh/windfarm.h
index 3f0cb0312ea3..7a2482cc26a7 100644
--- a/drivers/macintosh/windfarm.h
+++ b/drivers/macintosh/windfarm.h
@@ -14,6 +14,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/notifier.h>
+#include <linux/device.h>
 
 /* Display a 16.16 fixed point value */
 #define FIX32TOPRINT(f) ((f) >> 16),((((f) & 0xffff) * 1000) >> 16)
@@ -39,6 +40,7 @@ struct wf_control {
         char                    *name;
         int                     type;
         struct kref             ref;
+        struct device_attribute attr;
 };
 
 #define WF_CONTROL_TYPE_GENERIC         0
@@ -87,6 +89,7 @@ struct wf_sensor {
         struct wf_sensor_ops    *ops;
         char                    *name;
         struct kref             ref;
+        struct device_attribute attr;
 };
 
 /* Same lifetime rules as controls */
diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
index 6c2a471ea6c0..6c0ba04bc57a 100644
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -33,6 +33,9 @@
 #include <linux/reboot.h>
 #include <linux/device.h>
 #include <linux/platform_device.h>
+#include <linux/mutex.h>
+
+#include <asm/prom.h>
 
 #include "windfarm.h"
 
@@ -48,13 +51,17 @@
 
 static LIST_HEAD(wf_controls);
 static LIST_HEAD(wf_sensors);
-static DECLARE_MUTEX(wf_lock);
+static DEFINE_MUTEX(wf_lock);
 static struct notifier_block *wf_client_list;
 static int wf_client_count;
 static unsigned int wf_overtemp;
 static unsigned int wf_overtemp_counter;
 struct task_struct *wf_thread;
 
+static struct platform_device wf_platform_device = {
+        .name   = "windfarm",
+};
+
 /*
  * Utilities & tick thread
  */
@@ -156,26 +163,67 @@ static void wf_control_release(struct kref *kref)
                 kfree(ct);
 }
 
+static ssize_t wf_show_control(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        struct wf_control *ctrl = container_of(attr, struct wf_control, attr);
+        s32 val = 0;
+        int err;
+
+        err = ctrl->ops->get_value(ctrl, &val);
+        if (err < 0)
+                return err;
+        return sprintf(buf, "%d\n", val);
+}
+
+/* This is really only for debugging... */
+static ssize_t wf_store_control(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t count)
+{
+        struct wf_control *ctrl = container_of(attr, struct wf_control, attr);
+        int val;
+        int err;
+        char *endp;
+
+        val = simple_strtoul(buf, &endp, 0);
+        while (endp < buf + count && (*endp == ' ' || *endp == '\n'))
+                ++endp;
+        if (endp - buf < count)
+                return -EINVAL;
+        err = ctrl->ops->set_value(ctrl, val);
+        if (err < 0)
+                return err;
+        return count;
+}
+
 int wf_register_control(struct wf_control *new_ct)
 {
         struct wf_control *ct;
 
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         list_for_each_entry(ct, &wf_controls, link) {
                 if (!strcmp(ct->name, new_ct->name)) {
                         printk(KERN_WARNING "windfarm: trying to register"
                                " duplicate control %s\n", ct->name);
-                        up(&wf_lock);
+                        mutex_unlock(&wf_lock);
                         return -EEXIST;
                 }
         }
         kref_init(&new_ct->ref);
         list_add(&new_ct->link, &wf_controls);
 
+        new_ct->attr.attr.name = new_ct->name;
+        new_ct->attr.attr.owner = THIS_MODULE;
+        new_ct->attr.attr.mode = 0644;
+        new_ct->attr.show = wf_show_control;
+        new_ct->attr.store = wf_store_control;
+        device_create_file(&wf_platform_device.dev, &new_ct->attr);
+
         DBG("wf: Registered control %s\n", new_ct->name);
 
         wf_notify(WF_EVENT_NEW_CONTROL, new_ct);
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 
         return 0;
 }
@@ -183,9 +231,9 @@ EXPORT_SYMBOL_GPL(wf_register_control);
 
 void wf_unregister_control(struct wf_control *ct)
 {
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         list_del(&ct->link);
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 
         DBG("wf: Unregistered control %s\n", ct->name);
 
@@ -197,16 +245,16 @@ struct wf_control * wf_find_control(const char *name)
 {
         struct wf_control *ct;
 
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         list_for_each_entry(ct, &wf_controls, link) {
                 if (!strcmp(ct->name, name)) {
                         if (wf_get_control(ct))
                                 ct = NULL;
-                        up(&wf_lock);
+                        mutex_unlock(&wf_lock);
                         return ct;
                 }
         }
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(wf_find_control);
@@ -246,26 +294,46 @@ static void wf_sensor_release(struct kref *kref)
                 kfree(sr);
 }
 
+static ssize_t wf_show_sensor(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        struct wf_sensor *sens = container_of(attr, struct wf_sensor, attr);
+        s32 val = 0;
+        int err;
+
+        err = sens->ops->get_value(sens, &val);
+        if (err < 0)
+                return err;
+        return sprintf(buf, "%d.%03d\n", FIX32TOPRINT(val));
+}
+
 int wf_register_sensor(struct wf_sensor *new_sr)
 {
         struct wf_sensor *sr;
 
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         list_for_each_entry(sr, &wf_sensors, link) {
                 if (!strcmp(sr->name, new_sr->name)) {
                         printk(KERN_WARNING "windfarm: trying to register"
                                " duplicate sensor %s\n", sr->name);
-                        up(&wf_lock);
+                        mutex_unlock(&wf_lock);
                         return -EEXIST;
                 }
         }
         kref_init(&new_sr->ref);
         list_add(&new_sr->link, &wf_sensors);
 
+        new_sr->attr.attr.name = new_sr->name;
+        new_sr->attr.attr.owner = THIS_MODULE;
+        new_sr->attr.attr.mode = 0444;
+        new_sr->attr.show = wf_show_sensor;
+        new_sr->attr.store = NULL;
+        device_create_file(&wf_platform_device.dev, &new_sr->attr);
+
         DBG("wf: Registered sensor %s\n", new_sr->name);
 
         wf_notify(WF_EVENT_NEW_SENSOR, new_sr);
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 
         return 0;
 }
@@ -273,9 +341,9 @@ EXPORT_SYMBOL_GPL(wf_register_sensor);
 
 void wf_unregister_sensor(struct wf_sensor *sr)
 {
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         list_del(&sr->link);
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 
         DBG("wf: Unregistered sensor %s\n", sr->name);
 
@@ -287,16 +355,16 @@ struct wf_sensor * wf_find_sensor(const char *name)
 {
         struct wf_sensor *sr;
 
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         list_for_each_entry(sr, &wf_sensors, link) {
                 if (!strcmp(sr->name, name)) {
                         if (wf_get_sensor(sr))
                                 sr = NULL;
-                        up(&wf_lock);
+                        mutex_unlock(&wf_lock);
                         return sr;
                 }
         }
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(wf_find_sensor);
@@ -329,7 +397,7 @@ int wf_register_client(struct notifier_block *nb)
         struct wf_control *ct;
         struct wf_sensor *sr;
 
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         rc = notifier_chain_register(&wf_client_list, nb);
         if (rc != 0)
                 goto bail;
@@ -341,19 +409,19 @@ int wf_register_client(struct notifier_block *nb)
         if (wf_client_count == 1)
                 wf_start_thread();
  bail:
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
         return rc;
 }
 EXPORT_SYMBOL_GPL(wf_register_client);
 
 int wf_unregister_client(struct notifier_block *nb)
 {
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         notifier_chain_unregister(&wf_client_list, nb);
         wf_client_count++;
         if (wf_client_count == 0)
                 wf_stop_thread();
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 
         return 0;
 }
@@ -361,23 +429,23 @@ EXPORT_SYMBOL_GPL(wf_unregister_client);
 
 void wf_set_overtemp(void)
 {
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         wf_overtemp++;
         if (wf_overtemp == 1) {
                 printk(KERN_WARNING "windfarm: Overtemp condition detected !\n");
                 wf_overtemp_counter = 0;
                 wf_notify(WF_EVENT_OVERTEMP, NULL);
         }
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 }
 EXPORT_SYMBOL_GPL(wf_set_overtemp);
 
 void wf_clear_overtemp(void)
 {
-        down(&wf_lock);
+        mutex_lock(&wf_lock);
         WARN_ON(wf_overtemp == 0);
         if (wf_overtemp == 0) {
-                up(&wf_lock);
+                mutex_unlock(&wf_lock);
                 return;
         }
         wf_overtemp--;
@@ -385,7 +453,7 @@ void wf_clear_overtemp(void)
                 printk(KERN_WARNING "windfarm: Overtemp condition cleared !\n");
                 wf_notify(WF_EVENT_NORMALTEMP, NULL);
         }
-        up(&wf_lock);
+        mutex_unlock(&wf_lock);
 }
 EXPORT_SYMBOL_GPL(wf_clear_overtemp);
 
@@ -395,14 +463,15 @@ int wf_is_overtemp(void)
 }
 EXPORT_SYMBOL_GPL(wf_is_overtemp);
 
-static struct platform_device wf_platform_device = {
-        .name   = "windfarm",
-};
-
 static int __init windfarm_core_init(void)
 {
         DBG("wf: core loaded\n");
 
+        /* Don't register on old machines that use therm_pm72 for now */
+        if (machine_is_compatible("PowerMac7,2") ||
+            machine_is_compatible("PowerMac7,3") ||
+            machine_is_compatible("RackMac3,1"))
+                return -ENODEV;
         platform_device_register(&wf_platform_device);
         return 0;
 }
diff --git a/drivers/macintosh/windfarm_cpufreq_clamp.c b/drivers/macintosh/windfarm_cpufreq_clamp.c
index 607dbaca69c9..81337cd16e80 100644
--- a/drivers/macintosh/windfarm_cpufreq_clamp.c
+++ b/drivers/macintosh/windfarm_cpufreq_clamp.c
@@ -8,6 +8,8 @@
 #include <linux/wait.h>
 #include <linux/cpufreq.h>
 
+#include <asm/prom.h>
+
 #include "windfarm.h"
 
 #define VERSION "0.3"
@@ -74,6 +76,12 @@ static int __init wf_cpufreq_clamp_init(void)
 {
         struct wf_control *clamp;
 
+        /* Don't register on old machines that use therm_pm72 for now */
+        if (machine_is_compatible("PowerMac7,2") ||
+            machine_is_compatible("PowerMac7,3") ||
+            machine_is_compatible("RackMac3,1"))
+                return -ENODEV;
+
         clamp = kmalloc(sizeof(struct wf_control), GFP_KERNEL);
         if (clamp == NULL)
                 return -ENOMEM;
diff --git a/drivers/macintosh/windfarm_lm75_sensor.c b/drivers/macintosh/windfarm_lm75_sensor.c
index 906d3ecae6e6..423bfa2432c0 100644
--- a/drivers/macintosh/windfarm_lm75_sensor.c
+++ b/drivers/macintosh/windfarm_lm75_sensor.c
@@ -25,7 +25,7 @@
 
 #include "windfarm.h"
 
-#define VERSION "0.1"
+#define VERSION "0.2"
 
 #undef DEBUG
 
@@ -113,6 +113,7 @@ static struct wf_lm75_sensor *wf_lm75_create(struct i2c_adapter *adapter,
                                              const char *loc)
 {
         struct wf_lm75_sensor *lm;
+        int rc;
 
         DBG("wf_lm75: creating  %s device at address 0x%02x\n",
             ds1775 ? "ds1775" : "lm75", addr);
@@ -139,9 +140,11 @@ static struct wf_lm75_sensor *wf_lm75_create(struct i2c_adapter *adapter,
         lm->i2c.driver = &wf_lm75_driver;
         strncpy(lm->i2c.name, lm->sens.name, I2C_NAME_SIZE-1);
 
-        if (i2c_attach_client(&lm->i2c)) {
-                printk(KERN_ERR "windfarm: failed to attach %s %s to i2c\n",
-                       ds1775 ? "ds1775" : "lm75", lm->i2c.name);
+        rc = i2c_attach_client(&lm->i2c);
+        if (rc) {
+                printk(KERN_ERR "windfarm: failed to attach %s %s to i2c,"
+                       " err %d\n", ds1775 ? "ds1775" : "lm75",
+                       lm->i2c.name, rc);
                 goto fail;
         }
 
@@ -175,16 +178,22 @@ static int wf_lm75_attach(struct i2c_adapter *adapter)
              (dev = of_get_next_child(busnode, dev)) != NULL;) {
                 const char *loc =
                         get_property(dev, "hwsensor-location", NULL);
-                u32 *reg = (u32 *)get_property(dev, "reg", NULL);
-                DBG(" dev: %s... (loc: %p, reg: %p)\n", dev->name, loc, reg);
-                if (loc == NULL || reg == NULL)
+                u8 addr;
+
+                /* We must re-match the adapter in order to properly check
+                 * the channel on multibus setups
+                 */
+                if (!pmac_i2c_match_adapter(dev, adapter))
+                        continue;
+                addr = pmac_i2c_get_dev_addr(dev);
+                if (loc == NULL || addr == 0)
                         continue;
                 /* real lm75 */
                 if (device_is_compatible(dev, "lm75"))
-                        wf_lm75_create(adapter, *reg, 0, loc);
+                        wf_lm75_create(adapter, addr, 0, loc);
                 /* ds1775 (compatible, better resolution */
                 else if (device_is_compatible(dev, "ds1775"))
-                        wf_lm75_create(adapter, *reg, 1, loc);
+                        wf_lm75_create(adapter, addr, 1, loc);
         }
         return 0;
 }
@@ -206,6 +215,11 @@ static int wf_lm75_detach(struct i2c_client *client)
 
 static int __init wf_lm75_sensor_init(void)
 {
+        /* Don't register on old machines that use therm_pm72 for now */
+        if (machine_is_compatible("PowerMac7,2") ||
+            machine_is_compatible("PowerMac7,3") ||
+            machine_is_compatible("RackMac3,1"))
+                return -ENODEV;
         return i2c_add_driver(&wf_lm75_driver);
 }
 
diff --git a/drivers/macintosh/windfarm_max6690_sensor.c b/drivers/macintosh/windfarm_max6690_sensor.c
new file mode 100644
index 000000000000..8e99d408fddd
--- /dev/null
+++ b/drivers/macintosh/windfarm_max6690_sensor.c
@@ -0,0 +1,180 @@
+/*
+ * Windfarm PowerMac thermal control.  MAX6690 sensor.
+ *
+ * Copyright (C) 2005 Paul Mackerras, IBM Corp. <paulus@samba.org>
+ *
+ * Use and redistribute under the terms of the GNU GPL v2.
+ */
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/i2c-dev.h>
+#include <asm/prom.h>
+#include <asm/pmac_low_i2c.h>
+
+#include "windfarm.h"
+
+#define VERSION "0.2"
+
+/* This currently only exports the external temperature sensor,
+   since that's all the control loops need. */
+
+/* Some MAX6690 register numbers */
+#define MAX6690_INTERNAL_TEMP   0
+#define MAX6690_EXTERNAL_TEMP   1
+
+struct wf_6690_sensor {
+        struct i2c_client       i2c;
+        struct wf_sensor        sens;
+};
+
+#define wf_to_6690(x)   container_of((x), struct wf_6690_sensor, sens)
+#define i2c_to_6690(x)  container_of((x), struct wf_6690_sensor, i2c)
+
+static int wf_max6690_attach(struct i2c_adapter *adapter);
+static int wf_max6690_detach(struct i2c_client *client);
+
+static struct i2c_driver wf_max6690_driver = {
+        .driver = {
+                .name           = "wf_max6690",
+        },
+        .attach_adapter = wf_max6690_attach,
+        .detach_client  = wf_max6690_detach,
+};
+
+static int wf_max6690_get(struct wf_sensor *sr, s32 *value)
+{
+        struct wf_6690_sensor *max = wf_to_6690(sr);
+        s32 data;
+
+        if (max->i2c.adapter == NULL)
+                return -ENODEV;
+
+        /* chip gets initialized by firmware */
+        data = i2c_smbus_read_byte_data(&max->i2c, MAX6690_EXTERNAL_TEMP);
+        if (data < 0)
+                return data;
+        *value = data << 16;
+        return 0;
+}
+
+static void wf_max6690_release(struct wf_sensor *sr)
+{
+        struct wf_6690_sensor *max = wf_to_6690(sr);
+
+        if (max->i2c.adapter) {
+                i2c_detach_client(&max->i2c);
+                max->i2c.adapter = NULL;
+        }
+        kfree(max);
+}
+
+static struct wf_sensor_ops wf_max6690_ops = {
+        .get_value      = wf_max6690_get,
+        .release        = wf_max6690_release,
+        .owner          = THIS_MODULE,
+};
+
+static void wf_max6690_create(struct i2c_adapter *adapter, u8 addr)
+{
+        struct wf_6690_sensor *max;
+        char *name = "backside-temp";
+
+        max = kzalloc(sizeof(struct wf_6690_sensor), GFP_KERNEL);
+        if (max == NULL) {
+                printk(KERN_ERR "windfarm: Couldn't create MAX6690 sensor %s: "
+                       "no memory\n", name);
+                return;
+        }
+
+        max->sens.ops = &wf_max6690_ops;
+        max->sens.name = name;
+        max->i2c.addr = addr >> 1;
+        max->i2c.adapter = adapter;
+        max->i2c.driver = &wf_max6690_driver;
+        strncpy(max->i2c.name, name, I2C_NAME_SIZE-1);
+
+        if (i2c_attach_client(&max->i2c)) {
+                printk(KERN_ERR "windfarm: failed to attach MAX6690 sensor\n");
+                goto fail;
+        }
+
+        if (wf_register_sensor(&max->sens)) {
+                i2c_detach_client(&max->i2c);
+                goto fail;
+        }
+
+        return;
+
+ fail:
+        kfree(max);
+}
+
+static int wf_max6690_attach(struct i2c_adapter *adapter)
+{
+        struct device_node *busnode, *dev = NULL;
+        struct pmac_i2c_bus *bus;
+        const char *loc;
+
+        bus = pmac_i2c_adapter_to_bus(adapter);
+        if (bus == NULL)
+                return -ENODEV;
+        busnode = pmac_i2c_get_bus_node(bus);
+
+        while ((dev = of_get_next_child(busnode, dev)) != NULL) {
+                u8 addr;
+
+                /* We must re-match the adapter in order to properly check
+                 * the channel on multibus setups
+                 */
+                if (!pmac_i2c_match_adapter(dev, adapter))
+                        continue;
+                if (!device_is_compatible(dev, "max6690"))
+                        continue;
+                addr = pmac_i2c_get_dev_addr(dev);
+                loc = get_property(dev, "hwsensor-location", NULL);
+                if (loc == NULL || addr == 0)
+                        continue;
+                printk("found max6690, loc=%s addr=0x%02x\n", loc, addr);
+                if (strcmp(loc, "BACKSIDE"))
+                        continue;
+                wf_max6690_create(adapter, addr);
+        }
+
+        return 0;
+}
+
+static int wf_max6690_detach(struct i2c_client *client)
+{
+        struct wf_6690_sensor *max = i2c_to_6690(client);
+
+        max->i2c.adapter = NULL;
+        wf_unregister_sensor(&max->sens);
+
+        return 0;
+}
+
+static int __init wf_max6690_sensor_init(void)
+{
+        /* Don't register on old machines that use therm_pm72 for now */
+        if (machine_is_compatible("PowerMac7,2") ||
+            machine_is_compatible("PowerMac7,3") ||
+            machine_is_compatible("RackMac3,1"))
+                return -ENODEV;
+        return i2c_add_driver(&wf_max6690_driver);
+}
+
+static void __exit wf_max6690_sensor_exit(void)
+{
+        i2c_del_driver(&wf_max6690_driver);
+}
+
+module_init(wf_max6690_sensor_init);
+module_exit(wf_max6690_sensor_exit);
+
+MODULE_AUTHOR("Paul Mackerras <paulus@samba.org>");
+MODULE_DESCRIPTION("MAX6690 sensor objects for PowerMac thermal control");
+MODULE_LICENSE("GPL");
diff --git a/drivers/macintosh/windfarm_pid.c b/drivers/macintosh/windfarm_pid.c
index 2e803b368757..f10efb28cae4 100644
--- a/drivers/macintosh/windfarm_pid.c
+++ b/drivers/macintosh/windfarm_pid.c
@@ -88,8 +88,8 @@ EXPORT_SYMBOL_GPL(wf_cpu_pid_init);
 
 s32 wf_cpu_pid_run(struct wf_cpu_pid_state *st, s32 new_power, s32 new_temp)
 {
-        s64     error, integ, deriv, prop;
-        s32     target, sval, adj;
+        s64     integ, deriv, prop;
+        s32     error, target, sval, adj;
         int     i, hlen = st->param.history_len;
 
         /* Calculate error term */
@@ -117,7 +117,7 @@ s32 wf_cpu_pid_run(struct wf_cpu_pid_state *st, s32 new_power, s32 new_temp)
                 integ += st->errors[(st->index + hlen - i) % hlen];
         integ *= st->param.interval;
         integ *= st->param.gr;
-        sval = st->param.tmax - ((integ >> 20) & 0xffffffff);
+        sval = st->param.tmax - (s32)(integ >> 20);
         adj = min(st->param.ttarget, sval);
 
         DBG("integ: %lx, sval: %lx, adj: %lx\n", integ, sval, adj);
@@ -129,7 +129,7 @@ s32 wf_cpu_pid_run(struct wf_cpu_pid_state *st, s32 new_power, s32 new_temp)
         deriv *= st->param.gd;
 
         /* Calculate proportional term */
-        prop = (new_temp - adj);
+        prop = st->last_delta = (new_temp - adj);
         prop *= st->param.gp;
 
         DBG("deriv: %lx, prop: %lx\n", deriv, prop);
@@ -143,3 +143,7 @@ s32 wf_cpu_pid_run(struct wf_cpu_pid_state *st, s32 new_power, s32 new_temp)
         return st->target;
 }
 EXPORT_SYMBOL_GPL(wf_cpu_pid_run);
+
+MODULE_AUTHOR("Benjamin Herrenschmidt <benh@kernel.crashing.org>");
+MODULE_DESCRIPTION("PID algorithm for PowerMacs thermal control");
+MODULE_LICENSE("GPL");
diff --git a/drivers/macintosh/windfarm_pid.h b/drivers/macintosh/windfarm_pid.h
index a364c2a2499c..bbccc22d42b8 100644
--- a/drivers/macintosh/windfarm_pid.h
+++ b/drivers/macintosh/windfarm_pid.h
@@ -72,6 +72,7 @@ struct wf_cpu_pid_state {
         int     index;                          /* index of current power */
         int     tindex;                         /* index of current temp */
         s32     target;                         /* current target value */
+        s32     last_delta;                     /* last Tactual - Ttarget */
         s32     powers[WF_PID_MAX_HISTORY];     /* power history buffer */
         s32     errors[WF_PID_MAX_HISTORY];     /* error history buffer */
         s32     temps[2];                       /* temp. history buffer */
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
new file mode 100644
index 000000000000..ef66bf2778ec
--- /dev/null
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -0,0 +1,700 @@
+/*
+ * Windfarm PowerMac thermal control.
+ * Control loops for machines with SMU and PPC970MP processors.
+ *
+ * Copyright (C) 2005 Paul Mackerras, IBM Corp. <paulus@samba.org>
+ * Copyright (C) 2006 Benjamin Herrenschmidt, IBM Corp.
+ *
+ * Use and redistribute under the terms of the GNU GPL v2.
+ */
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/reboot.h>
+#include <asm/prom.h>
+#include <asm/smu.h>
+
+#include "windfarm.h"
+#include "windfarm_pid.h"
+
+#define VERSION "0.2"
+
+#define DEBUG
+#undef LOTSA_DEBUG
+
+#ifdef DEBUG
+#define DBG(args...)    printk(args)
+#else
+#define DBG(args...)    do { } while(0)
+#endif
+
+#ifdef LOTSA_DEBUG
+#define DBG_LOTS(args...)       printk(args)
+#else
+#define DBG_LOTS(args...)       do { } while(0)
+#endif
+
+/* define this to force CPU overtemp to 60 degree, useful for testing
+ * the overtemp code
+ */
+#undef HACKED_OVERTEMP
+
+/* We currently only handle 2 chips, 4 cores... */
+#define NR_CHIPS        2
+#define NR_CORES        4
+#define NR_CPU_FANS     3 * NR_CHIPS
+
+/* Controls and sensors */
+static struct wf_sensor *sens_cpu_temp[NR_CORES];
+static struct wf_sensor *sens_cpu_power[NR_CORES];
+static struct wf_sensor *hd_temp;
+static struct wf_sensor *slots_power;
+static struct wf_sensor *u4_temp;
+
+static struct wf_control *cpu_fans[NR_CPU_FANS];
+static char *cpu_fan_names[NR_CPU_FANS] = {
+        "cpu-rear-fan-0",
+        "cpu-rear-fan-1",
+        "cpu-front-fan-0",
+        "cpu-front-fan-1",
+        "cpu-pump-0",
+        "cpu-pump-1",
+};
+static struct wf_control *cpufreq_clamp;
+
+/* Second pump isn't required (and isn't actually present) */
+#define CPU_FANS_REQD           (NR_CPU_FANS - 2)
+#define FIRST_PUMP              4
+#define LAST_PUMP               5
+
+/* We keep a temperature history for average calculation of 180s */
+#define CPU_TEMP_HIST_SIZE      180
+
+/* Scale factor for fan speed, *100 */
+static int cpu_fan_scale[NR_CPU_FANS] = {
+        100,
+        100,
+        97,             /* inlet fans run at 97% of exhaust fan */
+        97,
+        100,            /* updated later */
+        100,            /* updated later */
+};
+
+static struct wf_control *backside_fan;
+static struct wf_control *slots_fan;
+static struct wf_control *drive_bay_fan;
+
+/* PID loop state */
+static struct wf_cpu_pid_state cpu_pid[NR_CORES];
+static u32 cpu_thist[CPU_TEMP_HIST_SIZE];
+static int cpu_thist_pt;
+static s64 cpu_thist_total;
+static s32 cpu_all_tmax = 100 << 16;
+static int cpu_last_target;
+static struct wf_pid_state backside_pid;
+static int backside_tick;
+static struct wf_pid_state slots_pid;
+static int slots_started;
+static struct wf_pid_state drive_bay_pid;
+static int drive_bay_tick;
+
+static int nr_cores;
+static int have_all_controls;
+static int have_all_sensors;
+static int started;
+
+static int failure_state;
+#define FAILURE_SENSOR          1
+#define FAILURE_FAN             2
+#define FAILURE_PERM            4
+#define FAILURE_LOW_OVERTEMP    8
+#define FAILURE_HIGH_OVERTEMP   16
+
+/* Overtemp values */
+#define LOW_OVER_AVERAGE        0
+#define LOW_OVER_IMMEDIATE      (10 << 16)
+#define LOW_OVER_CLEAR          ((-10) << 16)
+#define HIGH_OVER_IMMEDIATE     (14 << 16)
+#define HIGH_OVER_AVERAGE       (10 << 16)
+#define HIGH_OVER_IMMEDIATE     (14 << 16)
+
+
+/* Implementation... */
+static int create_cpu_loop(int cpu)
+{
+        int chip = cpu / 2;
+        int core = cpu & 1;
+        struct smu_sdbp_header *hdr;
+        struct smu_sdbp_cpupiddata *piddata;
+        struct wf_cpu_pid_param pid;
+        struct wf_control *main_fan = cpu_fans[0];
+        s32 tmax;
+        int fmin;
+
+        /* Get PID params from the appropriate SAT */
+        hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL);
+        if (hdr == NULL) {
+                printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n");
+                return -EINVAL;
+        }
+        piddata = (struct smu_sdbp_cpupiddata *)&hdr[1];
+
+        /* Get FVT params to get Tmax; if not found, assume default */
+        hdr = smu_sat_get_sdb_partition(chip, 0xC4 + core, NULL);
+        if (hdr) {
+                struct smu_sdbp_fvt *fvt = (struct smu_sdbp_fvt *)&hdr[1];
+                tmax = fvt->maxtemp << 16;
+        } else
+                tmax = 95 << 16;        /* default to 95 degrees C */
+
+        /* We keep a global tmax for overtemp calculations */
+        if (tmax < cpu_all_tmax)
+                cpu_all_tmax = tmax;
+
+        /*
+         * Darwin has a minimum fan speed of 1000 rpm for the 4-way and
+         * 515 for the 2-way.  That appears to be overkill, so for now,
+         * impose a minimum of 750 or 515.
+         */
+        fmin = (nr_cores > 2) ? 750 : 515;
+
+        /* Initialize PID loop */
+        pid.interval = 1;       /* seconds */
+        pid.history_len = piddata->history_len;
+        pid.gd = piddata->gd;
+        pid.gp = piddata->gp;
+        pid.gr = piddata->gr / piddata->history_len;
+        pid.pmaxadj = (piddata->max_power << 16) - (piddata->power_adj << 8);
+        pid.ttarget = tmax - (piddata->target_temp_delta << 16);
+        pid.tmax = tmax;
+        pid.min = main_fan->ops->get_min(main_fan);
+        pid.max = main_fan->ops->get_max(main_fan);
+        if (pid.min < fmin)
+                pid.min = fmin;
+
+        wf_cpu_pid_init(&cpu_pid[cpu], &pid);
+        return 0;
+}
+
+static void cpu_max_all_fans(void)
+{
+        int i;
+
+        /* We max all CPU fans in case of a sensor error. We also do the
+         * cpufreq clamping now, even if it's supposedly done later by the
+         * generic code anyway, we do it earlier here to react faster
+         */
+        if (cpufreq_clamp)
+                wf_control_set_max(cpufreq_clamp);
+        for (i = 0; i < NR_CPU_FANS; ++i)
+                if (cpu_fans[i])
+                        wf_control_set_max(cpu_fans[i]);
+}
+
+static int cpu_check_overtemp(s32 temp)
+{
+        int new_state = 0;
+        s32 t_avg, t_old;
+
+        /* First check for immediate overtemps */
+        if (temp >= (cpu_all_tmax + LOW_OVER_IMMEDIATE)) {
+                new_state |= FAILURE_LOW_OVERTEMP;
+                if ((failure_state & FAILURE_LOW_OVERTEMP) == 0)
+                        printk(KERN_ERR "windfarm: Overtemp due to immediate CPU"
+                               " temperature !\n");
+        }
+        if (temp >= (cpu_all_tmax + HIGH_OVER_IMMEDIATE)) {
+                new_state |= FAILURE_HIGH_OVERTEMP;
+                if ((failure_state & FAILURE_HIGH_OVERTEMP) == 0)
+                        printk(KERN_ERR "windfarm: Critical overtemp due to"
+                               " immediate CPU temperature !\n");
+        }
+
+        /* We calculate a history of max temperatures and use that for the
+         * overtemp management
+         */
+        t_old = cpu_thist[cpu_thist_pt];
+        cpu_thist[cpu_thist_pt] = temp;
+        cpu_thist_pt = (cpu_thist_pt + 1) % CPU_TEMP_HIST_SIZE;
+        cpu_thist_total -= t_old;
+        cpu_thist_total += temp;
+        t_avg = cpu_thist_total / CPU_TEMP_HIST_SIZE;
+
+        DBG_LOTS("t_avg = %d.%03d (out: %d.%03d, in: %d.%03d)\n",
+                 FIX32TOPRINT(t_avg), FIX32TOPRINT(t_old), FIX32TOPRINT(temp));
+
+        /* Now check for average overtemps */
+        if (t_avg >= (cpu_all_tmax + LOW_OVER_AVERAGE)) {
+                new_state |= FAILURE_LOW_OVERTEMP;
+                if ((failure_state & FAILURE_LOW_OVERTEMP) == 0)
+                        printk(KERN_ERR "windfarm: Overtemp due to average CPU"
+                               " temperature !\n");
+        }
+        if (t_avg >= (cpu_all_tmax + HIGH_OVER_AVERAGE)) {
+                new_state |= FAILURE_HIGH_OVERTEMP;
+                if ((failure_state & FAILURE_HIGH_OVERTEMP) == 0)
+                        printk(KERN_ERR "windfarm: Critical overtemp due to"
+                               " average CPU temperature !\n");
+        }
+
+        /* Now handle overtemp conditions. We don't currently use the windfarm
+         * overtemp handling core as it's not fully suited to the needs of those
+         * new machine. This will be fixed later.
+         */
+        if (new_state) {
+                /* High overtemp -> immediate shutdown */
+                if (new_state & FAILURE_HIGH_OVERTEMP)
+                        machine_power_off();
+                if ((failure_state & new_state) != new_state)
+                        cpu_max_all_fans();
+                failure_state |= new_state;
+        } else if ((failure_state & FAILURE_LOW_OVERTEMP) &&
+                   (temp < (cpu_all_tmax + LOW_OVER_CLEAR))) {
+                printk(KERN_ERR "windfarm: Overtemp condition cleared !\n");
+                failure_state &= ~FAILURE_LOW_OVERTEMP;
+        }
+
+        return failure_state & (FAILURE_LOW_OVERTEMP | FAILURE_HIGH_OVERTEMP);
+}
+
+static void cpu_fans_tick(void)
+{
+        int err, cpu;
+        s32 greatest_delta = 0;
+        s32 temp, power, t_max = 0;
+        int i, t, target = 0;
+        struct wf_sensor *sr;
+        struct wf_control *ct;
+        struct wf_cpu_pid_state *sp;
+
+        DBG_LOTS(KERN_DEBUG);
+        for (cpu = 0; cpu < nr_cores; ++cpu) {
+                /* Get CPU core temperature */
+                sr = sens_cpu_temp[cpu];
+                err = sr->ops->get_value(sr, &temp);
+                if (err) {
+                        DBG("\n");
+                        printk(KERN_WARNING "windfarm: CPU %d temperature "
+                               "sensor error %d\n", cpu, err);
+                        failure_state |= FAILURE_SENSOR;
+                        cpu_max_all_fans();
+                        return;
+                }
+
+                /* Keep track of highest temp */
+                t_max = max(t_max, temp);
+
+                /* Get CPU power */
+                sr = sens_cpu_power[cpu];
+                err = sr->ops->get_value(sr, &power);
+                if (err) {
+                        DBG("\n");
+                        printk(KERN_WARNING "windfarm: CPU %d power "
+                               "sensor error %d\n", cpu, err);
+                        failure_state |= FAILURE_SENSOR;
+                        cpu_max_all_fans();
+                        return;
+                }
+
+                /* Run PID */
+                sp = &cpu_pid[cpu];
+                t = wf_cpu_pid_run(sp, power, temp);
+
+                if (cpu == 0 || sp->last_delta > greatest_delta) {
+                        greatest_delta = sp->last_delta;
+                        target = t;
+                }
+                DBG_LOTS("[%d] P=%d.%.3d T=%d.%.3d ",
+                    cpu, FIX32TOPRINT(power), FIX32TOPRINT(temp));
+        }
+        DBG_LOTS("fans = %d, t_max = %d.%03d\n", target, FIX32TOPRINT(t_max));
+
+        /* Darwin limits decrease to 20 per iteration */
+        if (target < (cpu_last_target - 20))
+                target = cpu_last_target - 20;
+        cpu_last_target = target;
+        for (cpu = 0; cpu < nr_cores; ++cpu)
+                cpu_pid[cpu].target = target;
+
+        /* Handle possible overtemps */
+        if (cpu_check_overtemp(t_max))
+                return;
+
+        /* Set fans */
+        for (i = 0; i < NR_CPU_FANS; ++i) {
+                ct = cpu_fans[i];
+                if (ct == NULL)
+                        continue;
+                err = ct->ops->set_value(ct, target * cpu_fan_scale[i] / 100);
+                if (err) {
+                        printk(KERN_WARNING "windfarm: fan %s reports "
+                               "error %d\n", ct->name, err);
+                        failure_state |= FAILURE_FAN;
+                        break;
+                }
+        }
+}
+
+/* Backside/U4 fan */
+static struct wf_pid_param backside_param = {
+        .interval       = 5,
+        .history_len    = 2,
+        .gd             = 48 << 20,
+        .gp             = 5 << 20,
+        .gr             = 0,
+        .itarget        = 64 << 16,
+        .additive       = 1,
+};
+
+static void backside_fan_tick(void)
+{
+        s32 temp;
+        int speed;
+        int err;
+
+        if (!backside_fan || !u4_temp)
+                return;
+        if (!backside_tick) {
+                /* first time; initialize things */
+                printk(KERN_INFO "windfarm: Backside control loop started.\n");
+                backside_param.min = backside_fan->ops->get_min(backside_fan);
+                backside_param.max = backside_fan->ops->get_max(backside_fan);
+                wf_pid_init(&backside_pid, &backside_param);
+                backside_tick = 1;
+        }
+        if (--backside_tick > 0)
+                return;
+        backside_tick = backside_pid.param.interval;
+
+        err = u4_temp->ops->get_value(u4_temp, &temp);
+        if (err) {
+                printk(KERN_WARNING "windfarm: U4 temp sensor error %d\n",
+                       err);
+                failure_state |= FAILURE_SENSOR;
+                wf_control_set_max(backside_fan);
+                return;
+        }
+        speed = wf_pid_run(&backside_pid, temp);
+        DBG_LOTS("backside PID temp=%d.%.3d speed=%d\n",
+                 FIX32TOPRINT(temp), speed);
+
+        err = backside_fan->ops->set_value(backside_fan, speed);
+        if (err) {
+                printk(KERN_WARNING "windfarm: backside fan error %d\n", err);
+                failure_state |= FAILURE_FAN;
+        }
+}
+
+/* Drive bay fan */
+static struct wf_pid_param drive_bay_prm = {
+        .interval       = 5,
+        .history_len    = 2,
+        .gd             = 30 << 20,
+        .gp             = 5 << 20,
+        .gr             = 0,
+        .itarget        = 40 << 16,
+        .additive       = 1,
+};
+
+static void drive_bay_fan_tick(void)
+{
+        s32 temp;
+        int speed;
+        int err;
+
+        if (!drive_bay_fan || !hd_temp)
+                return;
+        if (!drive_bay_tick) {
+                /* first time; initialize things */
+                printk(KERN_INFO "windfarm: Drive bay control loop started.\n");
+                drive_bay_prm.min = drive_bay_fan->ops->get_min(drive_bay_fan);
+                drive_bay_prm.max = drive_bay_fan->ops->get_max(drive_bay_fan);
+                wf_pid_init(&drive_bay_pid, &drive_bay_prm);
+                drive_bay_tick = 1;
+        }
+        if (--drive_bay_tick > 0)
+                return;
+        drive_bay_tick = drive_bay_pid.param.interval;
+
+        err = hd_temp->ops->get_value(hd_temp, &temp);
+        if (err) {
+                printk(KERN_WARNING "windfarm: drive bay temp sensor "
+                       "error %d\n", err);
+                failure_state |= FAILURE_SENSOR;
+                wf_control_set_max(drive_bay_fan);
+                return;
+        }
+        speed = wf_pid_run(&drive_bay_pid, temp);
+        DBG_LOTS("drive_bay PID temp=%d.%.3d speed=%d\n",
+                 FIX32TOPRINT(temp), speed);
+
+        err = drive_bay_fan->ops->set_value(drive_bay_fan, speed);
+        if (err) {
+                printk(KERN_WARNING "windfarm: drive bay fan error %d\n", err);
+                failure_state |= FAILURE_FAN;
+        }
+}
+
+/* PCI slots area fan */
+/* This makes the fan speed proportional to the power consumed */
+static struct wf_pid_param slots_param = {
+        .interval       = 1,
+        .history_len    = 2,
+        .gd             = 0,
+        .gp             = 0,
+        .gr             = 0x1277952,
+        .itarget        = 0,
+        .min            = 1560,
+        .max            = 3510,
+};
+
+static void slots_fan_tick(void)
+{
+        s32 power;
+        int speed;
+        int err;
+
+        if (!slots_fan || !slots_power)
+                return;
+        if (!slots_started) {
+                /* first time; initialize things */
+                printk(KERN_INFO "windfarm: Slots control loop started.\n");
+                wf_pid_init(&slots_pid, &slots_param);
+                slots_started = 1;
+        }
+
+        err = slots_power->ops->get_value(slots_power, &power);
+        if (err) {
+                printk(KERN_WARNING "windfarm: slots power sensor error %d\n",
+                       err);
+                failure_state |= FAILURE_SENSOR;
+                wf_control_set_max(slots_fan);
+                return;
+        }
+        speed = wf_pid_run(&slots_pid, power);
+        DBG_LOTS("slots PID power=%d.%.3d speed=%d\n",
+                 FIX32TOPRINT(power), speed);
+
+        err = slots_fan->ops->set_value(slots_fan, speed);
+        if (err) {
+                printk(KERN_WARNING "windfarm: slots fan error %d\n", err);
+                failure_state |= FAILURE_FAN;
+        }
+}
+
+static void set_fail_state(void)
+{
+        int i;
+
+        if (cpufreq_clamp)
+                wf_control_set_max(cpufreq_clamp);
+        for (i = 0; i < NR_CPU_FANS; ++i)
+                if (cpu_fans[i])
+                        wf_control_set_max(cpu_fans[i]);
+        if (backside_fan)
+                wf_control_set_max(backside_fan);
+        if (slots_fan)
+                wf_control_set_max(slots_fan);
+        if (drive_bay_fan)
+                wf_control_set_max(drive_bay_fan);
+}
+
+static void pm112_tick(void)
+{
+        int i, last_failure;
+
+        if (!started) {
+                started = 1;
+                printk(KERN_INFO "windfarm: CPUs control loops started.\n");
+                for (i = 0; i < nr_cores; ++i) {
+                        if (create_cpu_loop(i) < 0) {
+                                failure_state = FAILURE_PERM;
+                                set_fail_state();
+                                break;
+                        }
+                }
+                DBG_LOTS("cpu_all_tmax=%d.%03d\n", FIX32TOPRINT(cpu_all_tmax));
+
+#ifdef HACKED_OVERTEMP
+                cpu_all_tmax = 60 << 16;
+#endif
+        }
+
+        /* Permanent failure, bail out */
+        if (failure_state & FAILURE_PERM)
+                return;
+        /* Clear all failure bits except low overtemp which will be eventually
+         * cleared by the control loop itself
+         */
+        last_failure = failure_state;
+        failure_state &= FAILURE_LOW_OVERTEMP;
+        cpu_fans_tick();
+        backside_fan_tick();
+        slots_fan_tick();
+        drive_bay_fan_tick();
+
+        DBG_LOTS("last_failure: 0x%x, failure_state: %x\n",
+                 last_failure, failure_state);
+
+        /* Check for failures. Any failure causes cpufreq clamping */
+        if (failure_state && last_failure == 0 && cpufreq_clamp)
+                wf_control_set_max(cpufreq_clamp);
+        if (failure_state == 0 && last_failure && cpufreq_clamp)
+                wf_control_set_min(cpufreq_clamp);
+
+        /* That's it for now, we might want to deal with other failures
+         * differently in the future though
+         */
+}
+
+static void pm112_new_control(struct wf_control *ct)
+{
+        int i, max_exhaust;
+
+        if (cpufreq_clamp == NULL && !strcmp(ct->name, "cpufreq-clamp")) {
+                if (wf_get_control(ct) == 0)
+                        cpufreq_clamp = ct;
+        }
+
+        for (i = 0; i < NR_CPU_FANS; ++i) {
+                if (!strcmp(ct->name, cpu_fan_names[i])) {
+                        if (cpu_fans[i] == NULL && wf_get_control(ct) == 0)
+                                cpu_fans[i] = ct;
+                        break;
+                }
+        }
+        if (i >= NR_CPU_FANS) {
+                /* not a CPU fan, try the others */
+                if (!strcmp(ct->name, "backside-fan")) {
+                        if (backside_fan == NULL && wf_get_control(ct) == 0)
+                                backside_fan = ct;
+                } else if (!strcmp(ct->name, "slots-fan")) {
+                        if (slots_fan == NULL && wf_get_control(ct) == 0)
+                                slots_fan = ct;
+                } else if (!strcmp(ct->name, "drive-bay-fan")) {
+                        if (drive_bay_fan == NULL && wf_get_control(ct) == 0)
+                                drive_bay_fan = ct;
+                }
+                return;
+        }
+
+        for (i = 0; i < CPU_FANS_REQD; ++i)
+                if (cpu_fans[i] == NULL)
+                        return;
+
+        /* work out pump scaling factors */
+        max_exhaust = cpu_fans[0]->ops->get_max(cpu_fans[0]);
+        for (i = FIRST_PUMP; i <= LAST_PUMP; ++i)
+                if ((ct = cpu_fans[i]) != NULL)
+                        cpu_fan_scale[i] =
+                                ct->ops->get_max(ct) * 100 / max_exhaust;
+
+        have_all_controls = 1;
+}
+
+static void pm112_new_sensor(struct wf_sensor *sr)
+{
+        unsigned int i;
+
+        if (!strncmp(sr->name, "cpu-temp-", 9)) {
+                i = sr->name[9] - '0';
+                if (sr->name[10] == 0 && i < NR_CORES &&
+                    sens_cpu_temp[i] == NULL && wf_get_sensor(sr) == 0)
+                        sens_cpu_temp[i] = sr;
+
+        } else if (!strncmp(sr->name, "cpu-power-", 10)) {
+                i = sr->name[10] - '0';
+                if (sr->name[11] == 0 && i < NR_CORES &&
+                    sens_cpu_power[i] == NULL && wf_get_sensor(sr) == 0)
+                        sens_cpu_power[i] = sr;
+        } else if (!strcmp(sr->name, "hd-temp")) {
+                if (hd_temp == NULL && wf_get_sensor(sr) == 0)
+                        hd_temp = sr;
+        } else if (!strcmp(sr->name, "slots-power")) {
+                if (slots_power == NULL && wf_get_sensor(sr) == 0)
+                        slots_power = sr;
+        } else if (!strcmp(sr->name, "backside-temp")) {
+                if (u4_temp == NULL && wf_get_sensor(sr) == 0)
+                        u4_temp = sr;
+        } else
+                return;
+
+        /* check if we have all the sensors we need */
+        for (i = 0; i < nr_cores; ++i)
+                if (sens_cpu_temp[i] == NULL || sens_cpu_power[i] == NULL)
+                        return;
+
+        have_all_sensors = 1;
+}
+
+static int pm112_wf_notify(struct notifier_block *self,
+                           unsigned long event, void *data)
+{
+        switch (event) {
+        case WF_EVENT_NEW_SENSOR:
+                pm112_new_sensor(data);
+                break;
+        case WF_EVENT_NEW_CONTROL:
+                pm112_new_control(data);
+                break;
+        case WF_EVENT_TICK:
+                if (have_all_controls && have_all_sensors)
+                        pm112_tick();
+        }
+        return 0;
+}
+
+static struct notifier_block pm112_events = {
+        .notifier_call = pm112_wf_notify,
+};
+
+static int wf_pm112_probe(struct device *dev)
+{
+        wf_register_client(&pm112_events);
+        return 0;
+}
+
+static int wf_pm112_remove(struct device *dev)
+{
+        wf_unregister_client(&pm112_events);
+        /* should release all sensors and controls */
+        return 0;
+}
+
+static struct device_driver wf_pm112_driver = {
+        .name = "windfarm",
+        .bus = &platform_bus_type,
+        .probe = wf_pm112_probe,
+        .remove = wf_pm112_remove,
+};
+
+static int __init wf_pm112_init(void)
+{
+        struct device_node *cpu;
+
+        if (!machine_is_compatible("PowerMac11,2"))
+                return -ENODEV;
+
+        /* Count the number of CPU cores */
+        nr_cores = 0;
+        for (cpu = NULL; (cpu = of_find_node_by_type(cpu, "cpu")) != NULL; )
+                ++nr_cores;
+
+        printk(KERN_INFO "windfarm: initializing for dual-core desktop G5\n");
+        driver_register(&wf_pm112_driver);
+        return 0;
+}
+
+static void __exit wf_pm112_exit(void)
+{
+        driver_unregister(&wf_pm112_driver);
+}
+
+module_init(wf_pm112_init);
+module_exit(wf_pm112_exit);
+
+MODULE_AUTHOR("Paul Mackerras <paulus@samba.org>");
+MODULE_DESCRIPTION("Thermal control for PowerMac11,2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/macintosh/windfarm_pm81.c b/drivers/macintosh/windfarm_pm81.c
index eb69a601e765..f1df6efcbe68 100644
--- a/drivers/macintosh/windfarm_pm81.c
+++ b/drivers/macintosh/windfarm_pm81.c
@@ -538,45 +538,6 @@ static void wf_smu_cpu_fans_tick(struct wf_smu_cpu_fans_state *st)
         }
 }
 
-
-/*
- * ****** Attributes ******
- *
- */
-
-#define BUILD_SHOW_FUNC_FIX(name, data)                         \
-static ssize_t show_##name(struct device *dev,                  \
-                           struct device_attribute *attr,       \
-                           char *buf)                           \
-{                                                               \
-        ssize_t r;                                              \
-        s32 val = 0;                                            \
-        data->ops->get_value(data, &val);                       \
-        r = sprintf(buf, "%d.%03d", FIX32TOPRINT(val));         \
-        return r;                                               \
-}                                                               \
-static DEVICE_ATTR(name,S_IRUGO,show_##name, NULL);
-
-
-#define BUILD_SHOW_FUNC_INT(name, data)                         \
-static ssize_t show_##name(struct device *dev,                  \
-                           struct device_attribute *attr,       \
-                           char *buf)                           \
-{                                                               \
-        s32 val = 0;                                            \
-        data->ops->get_value(data, &val);                       \
-        return sprintf(buf, "%d", val);                         \
-}                                                               \
-static DEVICE_ATTR(name,S_IRUGO,show_##name, NULL);
-
-BUILD_SHOW_FUNC_INT(cpu_fan, fan_cpu_main);
-BUILD_SHOW_FUNC_INT(sys_fan, fan_system);
-BUILD_SHOW_FUNC_INT(hd_fan, fan_hd);
-
-BUILD_SHOW_FUNC_FIX(cpu_temp, sensor_cpu_temp);
-BUILD_SHOW_FUNC_FIX(cpu_power, sensor_cpu_power);
-BUILD_SHOW_FUNC_FIX(hd_temp, sensor_hd_temp);
-
 /*
  * ****** Setup / Init / Misc ... ******
  *
@@ -654,17 +615,13 @@ static void wf_smu_new_control(struct wf_control *ct)
                 return;
 
         if (fan_cpu_main == NULL && !strcmp(ct->name, "cpu-fan")) {
-                if (wf_get_control(ct) == 0) {
+                if (wf_get_control(ct) == 0)
                         fan_cpu_main = ct;
-                        device_create_file(wf_smu_dev, &dev_attr_cpu_fan);
-                }
         }
 
         if (fan_system == NULL && !strcmp(ct->name, "system-fan")) {
-                if (wf_get_control(ct) == 0) {
+                if (wf_get_control(ct) == 0)
                         fan_system = ct;
-                        device_create_file(wf_smu_dev, &dev_attr_sys_fan);
-                }
         }
 
         if (cpufreq_clamp == NULL && !strcmp(ct->name, "cpufreq-clamp")) {
@@ -683,10 +640,8 @@ static void wf_smu_new_control(struct wf_control *ct)
         }
 
         if (fan_hd == NULL && !strcmp(ct->name, "drive-bay-fan")) {
-                if (wf_get_control(ct) == 0) {
+                if (wf_get_control(ct) == 0)
                         fan_hd = ct;
-                        device_create_file(wf_smu_dev, &dev_attr_hd_fan);
-                }
         }
 
         if (fan_system && fan_hd && fan_cpu_main && cpufreq_clamp)
@@ -699,24 +654,18 @@ static void wf_smu_new_sensor(struct wf_sensor *sr)
                 return;
 
         if (sensor_cpu_power == NULL && !strcmp(sr->name, "cpu-power")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_cpu_power = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_cpu_power);
-                }
         }
 
         if (sensor_cpu_temp == NULL && !strcmp(sr->name, "cpu-temp")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_cpu_temp = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_cpu_temp);
-                }
         }
 
         if (sensor_hd_temp == NULL && !strcmp(sr->name, "hd-temp")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_hd_temp = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_hd_temp);
-                }
         }
 
         if (sensor_cpu_power && sensor_cpu_temp && sensor_hd_temp)
@@ -794,32 +743,20 @@ static int wf_smu_remove(struct device *ddev)
          * with that except by adding locks all over... I'll do that
          * eventually but heh, who ever rmmod this module anyway ?
          */
-        if (sensor_cpu_power) {
-                device_remove_file(wf_smu_dev, &dev_attr_cpu_power);
+        if (sensor_cpu_power)
                 wf_put_sensor(sensor_cpu_power);
-        }
-        if (sensor_cpu_temp) {
-                device_remove_file(wf_smu_dev, &dev_attr_cpu_temp);
+        if (sensor_cpu_temp)
                 wf_put_sensor(sensor_cpu_temp);
-        }
-        if (sensor_hd_temp) {
-                device_remove_file(wf_smu_dev, &dev_attr_hd_temp);
+        if (sensor_hd_temp)
                 wf_put_sensor(sensor_hd_temp);
-        }
 
         /* Release all controls */
-        if (fan_cpu_main) {
-                device_remove_file(wf_smu_dev, &dev_attr_cpu_fan);
+        if (fan_cpu_main)
                 wf_put_control(fan_cpu_main);
-        }
-        if (fan_hd) {
-                device_remove_file(wf_smu_dev, &dev_attr_hd_fan);
+        if (fan_hd)
                 wf_put_control(fan_hd);
-        }
-        if (fan_system) {
-                device_remove_file(wf_smu_dev, &dev_attr_sys_fan);
+        if (fan_system)
                 wf_put_control(fan_system);
-        }
         if (cpufreq_clamp)
                 wf_put_control(cpufreq_clamp);
 
diff --git a/drivers/macintosh/windfarm_pm91.c b/drivers/macintosh/windfarm_pm91.c
index 43243cf7410b..0d6372e96d32 100644
--- a/drivers/macintosh/windfarm_pm91.c
+++ b/drivers/macintosh/windfarm_pm91.c
@@ -458,45 +458,6 @@ static void wf_smu_slots_fans_tick(struct wf_smu_slots_fans_state *st)
 
 
 /*
- * ****** Attributes ******
- *
- */
-
-#define BUILD_SHOW_FUNC_FIX(name, data)                         \
-static ssize_t show_##name(struct device *dev,                  \
-                           struct device_attribute *attr,       \
-                           char *buf)                           \
-{                                                               \
-        ssize_t r;                                              \
-        s32 val = 0;                                            \
-        data->ops->get_value(data, &val);                       \
-        r = sprintf(buf, "%d.%03d", FIX32TOPRINT(val));         \
-        return r;                                               \
-}                                                               \
-static DEVICE_ATTR(name,S_IRUGO,show_##name, NULL);
-
-
-#define BUILD_SHOW_FUNC_INT(name, data)                         \
-static ssize_t show_##name(struct device *dev,                  \
-                           struct device_attribute *attr,       \
-                           char *buf)                           \
-{                                                               \
-        s32 val = 0;                                            \
-        data->ops->get_value(data, &val);                       \
-        return sprintf(buf, "%d", val);                         \
-}                                                               \
-static DEVICE_ATTR(name,S_IRUGO,show_##name, NULL);
-
-BUILD_SHOW_FUNC_INT(cpu_fan, fan_cpu_main);
-BUILD_SHOW_FUNC_INT(hd_fan, fan_hd);
-BUILD_SHOW_FUNC_INT(slots_fan, fan_slots);
-
-BUILD_SHOW_FUNC_FIX(cpu_temp, sensor_cpu_temp);
-BUILD_SHOW_FUNC_FIX(cpu_power, sensor_cpu_power);
-BUILD_SHOW_FUNC_FIX(hd_temp, sensor_hd_temp);
-BUILD_SHOW_FUNC_FIX(slots_power, sensor_slots_power);
-
-/*
  * ****** Setup / Init / Misc ... ******
  *
  */
@@ -581,10 +542,8 @@ static void wf_smu_new_control(struct wf_control *ct)
                 return;
 
         if (fan_cpu_main == NULL && !strcmp(ct->name, "cpu-rear-fan-0")) {
-                if (wf_get_control(ct) == 0) {
+                if (wf_get_control(ct) == 0)
                         fan_cpu_main = ct;
-                        device_create_file(wf_smu_dev, &dev_attr_cpu_fan);
-                }
         }
 
         if (fan_cpu_second == NULL && !strcmp(ct->name, "cpu-rear-fan-1")) {
@@ -603,17 +562,13 @@ static void wf_smu_new_control(struct wf_control *ct)
         }
 
         if (fan_hd == NULL && !strcmp(ct->name, "drive-bay-fan")) {
-                if (wf_get_control(ct) == 0) {
+                if (wf_get_control(ct) == 0)
                         fan_hd = ct;
-                        device_create_file(wf_smu_dev, &dev_attr_hd_fan);
-                }
         }
 
         if (fan_slots == NULL && !strcmp(ct->name, "slots-fan")) {
-                if (wf_get_control(ct) == 0) {
+                if (wf_get_control(ct) == 0)
                         fan_slots = ct;
-                        device_create_file(wf_smu_dev, &dev_attr_slots_fan);
-                }
         }
 
         if (fan_cpu_main && (fan_cpu_second || fan_cpu_third) && fan_hd &&
@@ -627,31 +582,23 @@ static void wf_smu_new_sensor(struct wf_sensor *sr)
                 return;
 
         if (sensor_cpu_power == NULL && !strcmp(sr->name, "cpu-power")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_cpu_power = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_cpu_power);
-                }
         }
 
         if (sensor_cpu_temp == NULL && !strcmp(sr->name, "cpu-temp")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_cpu_temp = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_cpu_temp);
-                }
         }
 
         if (sensor_hd_temp == NULL && !strcmp(sr->name, "hd-temp")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_hd_temp = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_hd_temp);
-                }
         }
 
         if (sensor_slots_power == NULL && !strcmp(sr->name, "slots-power")) {
-                if (wf_get_sensor(sr) == 0) {
+                if (wf_get_sensor(sr) == 0)
                         sensor_slots_power = sr;
-                        device_create_file(wf_smu_dev, &dev_attr_slots_power);
-                }
         }
 
         if (sensor_cpu_power && sensor_cpu_temp &&
@@ -720,40 +667,26 @@ static int wf_smu_remove(struct device *ddev)
          * with that except by adding locks all over... I'll do that
          * eventually but heh, who ever rmmod this module anyway ?
          */
-        if (sensor_cpu_power) {
-                device_remove_file(wf_smu_dev, &dev_attr_cpu_power);
+        if (sensor_cpu_power)
                 wf_put_sensor(sensor_cpu_power);
-        }
-        if (sensor_cpu_temp) {
-                device_remove_file(wf_smu_dev, &dev_attr_cpu_temp);
+        if (sensor_cpu_temp)
                 wf_put_sensor(sensor_cpu_temp);
-        }
-        if (sensor_hd_temp) {
-                device_remove_file(wf_smu_dev, &dev_attr_hd_temp);
+        if (sensor_hd_temp)
                 wf_put_sensor(sensor_hd_temp);
-        }
-        if (sensor_slots_power) {
-                device_remove_file(wf_smu_dev, &dev_attr_slots_power);
+        if (sensor_slots_power)
                 wf_put_sensor(sensor_slots_power);
-        }
 
         /* Release all controls */
-        if (fan_cpu_main) {
-                device_remove_file(wf_smu_dev, &dev_attr_cpu_fan);
+        if (fan_cpu_main)
                 wf_put_control(fan_cpu_main);
-        }
         if (fan_cpu_second)
                 wf_put_control(fan_cpu_second);
         if (fan_cpu_third)
                 wf_put_control(fan_cpu_third);
-        if (fan_hd) {
-                device_remove_file(wf_smu_dev, &dev_attr_hd_fan);
+        if (fan_hd)
                 wf_put_control(fan_hd);
-        }
-        if (fan_slots) {
-                device_remove_file(wf_smu_dev, &dev_attr_slots_fan);
+        if (fan_slots)
                 wf_put_control(fan_slots);
-        }
         if (cpufreq_clamp)
                 wf_put_control(cpufreq_clamp);
 
diff --git a/drivers/macintosh/windfarm_smu_controls.c b/drivers/macintosh/windfarm_smu_controls.c
index 4d811600bdab..a9e88edc0c72 100644
--- a/drivers/macintosh/windfarm_smu_controls.c
+++ b/drivers/macintosh/windfarm_smu_controls.c
@@ -24,7 +24,7 @@
 
 #include "windfarm.h"
 
-#define VERSION "0.3"
+#define VERSION "0.4"
 
 #undef DEBUG
 
@@ -34,6 +34,8 @@
 #define DBG(args...)    do { } while(0)
 #endif
 
+static int smu_supports_new_fans_ops = 1;
+
 /*
  * SMU fans control object
  */
@@ -59,23 +61,49 @@ static int smu_set_fan(int pwm, u8 id, u16 value)
 
         /* Fill SMU command structure */
         cmd.cmd = SMU_CMD_FAN_COMMAND;
-        cmd.data_len = 14;
+
+        /* The SMU has an "old" and a "new" way of setting the fan speed
+         * Unfortunately, I found no reliable way to know which one works
+         * on a given machine model. After some investigations it appears
+         * that MacOS X just tries the new one, and if it fails fallbacks
+         * to the old ones ... Ugh.
+         */
+ retry:
+        if (smu_supports_new_fans_ops) {
+                buffer[0] = 0x30;
+                buffer[1] = id;
+                *((u16 *)(&buffer[2])) = value;
+                cmd.data_len = 4;
+        } else {
+                if (id > 7)
+                        return -EINVAL;
+                /* Fill argument buffer */
+                memset(buffer, 0, 16);
+                buffer[0] = pwm ? 0x10 : 0x00;
+                buffer[1] = 0x01 << id;
+                *((u16 *)&buffer[2 + id * 2]) = value;
+                cmd.data_len = 14;
+        }
+
         cmd.reply_len = 16;
         cmd.data_buf = cmd.reply_buf = buffer;
         cmd.status = 0;
         cmd.done = smu_done_complete;
         cmd.misc = &comp;
 
-        /* Fill argument buffer */
-        memset(buffer, 0, 16);
-        buffer[0] = pwm ? 0x10 : 0x00;
-        buffer[1] = 0x01 << id;
-        *((u16 *)&buffer[2 + id * 2]) = value;
-
         rc = smu_queue_cmd(&cmd);
         if (rc)
                 return rc;
         wait_for_completion(&comp);
+
+        /* Handle fallback (see coment above) */
+        if (cmd.status != 0 && smu_supports_new_fans_ops) {
+                printk(KERN_WARNING "windfarm: SMU failed new fan command "
+                       "falling back to old method\n");
+                smu_supports_new_fans_ops = 0;
+                goto retry;
+        }
+
         return cmd.status;
 }
 
@@ -158,19 +186,29 @@ static struct smu_fan_control *smu_fan_create(struct device_node *node,
 
         /* Names used on desktop models */
         if (!strcmp(l, "Rear Fan 0") || !strcmp(l, "Rear Fan") ||
-            !strcmp(l, "Rear fan 0") || !strcmp(l, "Rear fan"))
+            !strcmp(l, "Rear fan 0") || !strcmp(l, "Rear fan") ||
+            !strcmp(l, "CPU A EXHAUST"))
                 fct->ctrl.name = "cpu-rear-fan-0";
-        else if (!strcmp(l, "Rear Fan 1") || !strcmp(l, "Rear fan 1"))
+        else if (!strcmp(l, "Rear Fan 1") || !strcmp(l, "Rear fan 1") ||
+                 !strcmp(l, "CPU B EXHAUST"))
                 fct->ctrl.name = "cpu-rear-fan-1";
         else if (!strcmp(l, "Front Fan 0") || !strcmp(l, "Front Fan") ||
-                 !strcmp(l, "Front fan 0") || !strcmp(l, "Front fan"))
+                 !strcmp(l, "Front fan 0") || !strcmp(l, "Front fan") ||
+                 !strcmp(l, "CPU A INTAKE"))
                 fct->ctrl.name = "cpu-front-fan-0";
-        else if (!strcmp(l, "Front Fan 1") || !strcmp(l, "Front fan 1"))
+        else if (!strcmp(l, "Front Fan 1") || !strcmp(l, "Front fan 1") ||
+                 !strcmp(l, "CPU B INTAKE"))
                 fct->ctrl.name = "cpu-front-fan-1";
-        else if (!strcmp(l, "Slots Fan") || !strcmp(l, "Slots fan"))
+        else if (!strcmp(l, "CPU A PUMP"))
+                fct->ctrl.name = "cpu-pump-0";
+        else if (!strcmp(l, "Slots Fan") || !strcmp(l, "Slots fan") ||
+                 !strcmp(l, "EXPANSION SLOTS INTAKE"))
                 fct->ctrl.name = "slots-fan";
-        else if (!strcmp(l, "Drive Bay") || !strcmp(l, "Drive bay"))
+        else if (!strcmp(l, "Drive Bay") || !strcmp(l, "Drive bay") ||
+                 !strcmp(l, "DRIVE BAY A INTAKE"))
                 fct->ctrl.name = "drive-bay-fan";
+        else if (!strcmp(l, "BACKSIDE"))
+                fct->ctrl.name = "backside-fan";
 
         /* Names used on iMac models */
         if (!strcmp(l, "System Fan") || !strcmp(l, "System fan"))
@@ -223,7 +261,8 @@ static int __init smu_controls_init(void)
 
         /* Look for RPM fans */
         for (fans = NULL; (fans = of_get_next_child(smu, fans)) != NULL;)
-                if (!strcmp(fans->name, "rpm-fans"))
+                if (!strcmp(fans->name, "rpm-fans") ||
+                    device_is_compatible(fans, "smu-rpm-fans"))
                         break;
         for (fan = NULL;
              fans && (fan = of_get_next_child(fans, fan)) != NULL;) {
diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
new file mode 100644
index 000000000000..24e51d5e97fc
--- /dev/null
+++ b/drivers/macintosh/windfarm_smu_sat.c
@@ -0,0 +1,419 @@
+/*
+ * Windfarm PowerMac thermal control.  SMU "satellite" controller sensors.
+ *
+ * Copyright (C) 2005 Paul Mackerras, IBM Corp. <paulus@samba.org>
+ *
+ * Released under the terms of the GNU GPL v2.
+ */
+
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/wait.h>
+#include <linux/i2c.h>
+#include <linux/i2c-dev.h>
+#include <asm/semaphore.h>
+#include <asm/prom.h>
+#include <asm/smu.h>
+#include <asm/pmac_low_i2c.h>
+
+#include "windfarm.h"
+
+#define VERSION "0.2"
+
+#define DEBUG
+
+#ifdef DEBUG
+#define DBG(args...)    printk(args)
+#else
+#define DBG(args...)    do { } while(0)
+#endif
+
+/* If the cache is older than 800ms we'll refetch it */
+#define MAX_AGE         msecs_to_jiffies(800)
+
+struct wf_sat {
+        int                     nr;
+        atomic_t                refcnt;
+        struct semaphore        mutex;
+        unsigned long           last_read; /* jiffies when cache last updated */
+        u8                      cache[16];
+        struct i2c_client       i2c;
+        struct device_node      *node;
+};
+
+static struct wf_sat *sats[2];
+
+struct wf_sat_sensor {
+        int             index;
+        int             index2;         /* used for power sensors */
+        int             shift;
+        struct wf_sat   *sat;
+        struct wf_sensor sens;
+};
+
+#define wf_to_sat(c)    container_of(c, struct wf_sat_sensor, sens)
+#define i2c_to_sat(c)   container_of(c, struct wf_sat, i2c)
+
+static int wf_sat_attach(struct i2c_adapter *adapter);
+static int wf_sat_detach(struct i2c_client *client);
+
+static struct i2c_driver wf_sat_driver = {
+        .driver = {
+                .name           = "wf_smu_sat",
+        },
+        .attach_adapter = wf_sat_attach,
+        .detach_client  = wf_sat_detach,
+};
+
+/*
+ * XXX i2c_smbus_read_i2c_block_data doesn't pass the requested
+ * length down to the low-level driver, so we use this, which
+ * works well enough with the SMU i2c driver code...
+ */
+static int sat_read_block(struct i2c_client *client, u8 command,
+                          u8 *values, int len)
+{
+        union i2c_smbus_data data;
+        int err;
+
+        data.block[0] = len;
+        err = i2c_smbus_xfer(client->adapter, client->addr, client->flags,
+                             I2C_SMBUS_READ, command, I2C_SMBUS_I2C_BLOCK_DATA,
+                             &data);
+        if (!err)
+                memcpy(values, data.block, len);
+        return err;
+}
+
+struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
+                                                  unsigned int *size)
+{
+        struct wf_sat *sat;
+        int err;
+        unsigned int i, len;
+        u8 *buf;
+        u8 data[4];
+
+        /* TODO: Add the resulting partition to the device-tree */
+
+        if (sat_id > 1 || (sat = sats[sat_id]) == NULL)
+                return NULL;
+
+        err = i2c_smbus_write_word_data(&sat->i2c, 8, id << 8);
+        if (err) {
+                printk(KERN_ERR "smu_sat_get_sdb_part wr error %d\n", err);
+                return NULL;
+        }
+
+        len = i2c_smbus_read_word_data(&sat->i2c, 9);
+        if (len < 0) {
+                printk(KERN_ERR "smu_sat_get_sdb_part rd len error\n");
+                return NULL;
+        }
+        if (len == 0) {
+                printk(KERN_ERR "smu_sat_get_sdb_part no partition %x\n", id);
+                return NULL;
+        }
+
+        len = le16_to_cpu(len);
+        len = (len + 3) & ~3;
+        buf = kmalloc(len, GFP_KERNEL);
+        if (buf == NULL)
+                return NULL;
+
+        for (i = 0; i < len; i += 4) {
+                err = sat_read_block(&sat->i2c, 0xa, data, 4);
+                if (err) {
+                        printk(KERN_ERR "smu_sat_get_sdb_part rd err %d\n",
+                               err);
+                        goto fail;
+                }
+                buf[i] = data[1];
+                buf[i+1] = data[0];
+                buf[i+2] = data[3];
+                buf[i+3] = data[2];
+        }
+#ifdef DEBUG
+        DBG(KERN_DEBUG "sat %d partition %x:", sat_id, id);
+        for (i = 0; i < len; ++i)
+                DBG(" %x", buf[i]);
+        DBG("\n");
+#endif
+
+        if (size)
+                *size = len;
+        return (struct smu_sdbp_header *) buf;
+
+ fail:
+        kfree(buf);
+        return NULL;
+}
+EXPORT_SYMBOL_GPL(smu_sat_get_sdb_partition);
+
+/* refresh the cache */
+static int wf_sat_read_cache(struct wf_sat *sat)
+{
+        int err;
+
+        err = sat_read_block(&sat->i2c, 0x3f, sat->cache, 16);
+        if (err)
+                return err;
+        sat->last_read = jiffies;
+#ifdef LOTSA_DEBUG
+        {
+                int i;
+                DBG(KERN_DEBUG "wf_sat_get: data is");
+                for (i = 0; i < 16; ++i)
+                        DBG(" %.2x", sat->cache[i]);
+                DBG("\n");
+        }
+#endif
+        return 0;
+}
+
+static int wf_sat_get(struct wf_sensor *sr, s32 *value)
+{
+        struct wf_sat_sensor *sens = wf_to_sat(sr);
+        struct wf_sat *sat = sens->sat;
+        int i, err;
+        s32 val;
+
+        if (sat->i2c.adapter == NULL)
+                return -ENODEV;
+
+        down(&sat->mutex);
+        if (time_after(jiffies, (sat->last_read + MAX_AGE))) {
+                err = wf_sat_read_cache(sat);
+                if (err)
+                        goto fail;
+        }
+
+        i = sens->index * 2;
+        val = ((sat->cache[i] << 8) + sat->cache[i+1]) << sens->shift;
+        if (sens->index2 >= 0) {
+                i = sens->index2 * 2;
+                /* 4.12 * 8.8 -> 12.20; shift right 4 to get 16.16 */
+                val = (val * ((sat->cache[i] << 8) + sat->cache[i+1])) >> 4;
+        }
+
+        *value = val;
+        err = 0;
+
+ fail:
+        up(&sat->mutex);
+        return err;
+}
+
+static void wf_sat_release(struct wf_sensor *sr)
+{
+        struct wf_sat_sensor *sens = wf_to_sat(sr);
+        struct wf_sat *sat = sens->sat;
+
+        if (atomic_dec_and_test(&sat->refcnt)) {
+                if (sat->i2c.adapter) {
+                        i2c_detach_client(&sat->i2c);
+                        sat->i2c.adapter = NULL;
+                }
+                if (sat->nr >= 0)
+                        sats[sat->nr] = NULL;
+                kfree(sat);
+        }
+        kfree(sens);
+}
+
+static struct wf_sensor_ops wf_sat_ops = {
+        .get_value      = wf_sat_get,
+        .release        = wf_sat_release,
+        .owner          = THIS_MODULE,
+};
+
+static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev)
+{
+        struct wf_sat *sat;
+        struct wf_sat_sensor *sens;
+        u32 *reg;
+        char *loc, *type;
+        u8 addr, chip, core;
+        struct device_node *child;
+        int shift, cpu, index;
+        char *name;
+        int vsens[2], isens[2];
+
+        reg = (u32 *) get_property(dev, "reg", NULL);
+        if (reg == NULL)
+                return;
+        addr = *reg;
+        DBG(KERN_DEBUG "wf_sat: creating sat at address %x\n", addr);
+
+        sat = kzalloc(sizeof(struct wf_sat), GFP_KERNEL);
+        if (sat == NULL)
+                return;
+        sat->nr = -1;
+        sat->node = of_node_get(dev);
+        atomic_set(&sat->refcnt, 0);
+        init_MUTEX(&sat->mutex);
+        sat->i2c.addr = (addr >> 1) & 0x7f;
+        sat->i2c.adapter = adapter;
+        sat->i2c.driver = &wf_sat_driver;
+        strncpy(sat->i2c.name, "smu-sat", I2C_NAME_SIZE-1);
+
+        if (i2c_attach_client(&sat->i2c)) {
+                printk(KERN_ERR "windfarm: failed to attach smu-sat to i2c\n");
+                goto fail;
+        }
+
+        vsens[0] = vsens[1] = -1;
+        isens[0] = isens[1] = -1;
+        child = NULL;
+        while ((child = of_get_next_child(dev, child)) != NULL) {
+                reg = (u32 *) get_property(child, "reg", NULL);
+                type = get_property(child, "device_type", NULL);
+                loc = get_property(child, "location", NULL);
+                if (reg == NULL || loc == NULL)
+                        continue;
+
+                /* the cooked sensors are between 0x30 and 0x37 */
+                if (*reg < 0x30 || *reg > 0x37)
+                        continue;
+                index = *reg - 0x30;
+
+                /* expect location to be CPU [AB][01] ... */
+                if (strncmp(loc, "CPU ", 4) != 0)
+                        continue;
+                chip = loc[4] - 'A';
+                core = loc[5] - '0';
+                if (chip > 1 || core > 1) {
+                        printk(KERN_ERR "wf_sat_create: don't understand "
+                               "location %s for %s\n", loc, child->full_name);
+                        continue;
+                }
+                cpu = 2 * chip + core;
+                if (sat->nr < 0)
+                        sat->nr = chip;
+                else if (sat->nr != chip) {
+                        printk(KERN_ERR "wf_sat_create: can't cope with "
+                               "multiple CPU chips on one SAT (%s)\n", loc);
+                        continue;
+                }
+
+                if (strcmp(type, "voltage-sensor") == 0) {
+                        name = "cpu-voltage";
+                        shift = 4;
+                        vsens[core] = index;
+                } else if (strcmp(type, "current-sensor") == 0) {
+                        name = "cpu-current";
+                        shift = 8;
+                        isens[core] = index;
+                } else if (strcmp(type, "temp-sensor") == 0) {
+                        name = "cpu-temp";
+                        shift = 10;
+                } else
+                        continue;       /* hmmm shouldn't happen */
+
+                /* the +16 is enough for "cpu-voltage-n" */
+                sens = kzalloc(sizeof(struct wf_sat_sensor) + 16, GFP_KERNEL);
+                if (sens == NULL) {
+                        printk(KERN_ERR "wf_sat_create: couldn't create "
+                               "%s sensor %d (no memory)\n", name, cpu);
+                        continue;
+                }
+                sens->index = index;
+                sens->index2 = -1;
+                sens->shift = shift;
+                sens->sat = sat;
+                atomic_inc(&sat->refcnt);
+                sens->sens.ops = &wf_sat_ops;
+                sens->sens.name = (char *) (sens + 1);
+                snprintf(sens->sens.name, 16, "%s-%d", name, cpu);
+
+                if (wf_register_sensor(&sens->sens)) {
+                        atomic_dec(&sat->refcnt);
+                        kfree(sens);
+                }
+        }
+
+        /* make the power sensors */
+        for (core = 0; core < 2; ++core) {
+                if (vsens[core] < 0 || isens[core] < 0)
+                        continue;
+                cpu = 2 * sat->nr + core;
+                sens = kzalloc(sizeof(struct wf_sat_sensor) + 16, GFP_KERNEL);
+                if (sens == NULL) {
+                        printk(KERN_ERR "wf_sat_create: couldn't create power "
+                               "sensor %d (no memory)\n", cpu);
+                        continue;
+                }
+                sens->index = vsens[core];
+                sens->index2 = isens[core];
+                sens->shift = 0;
+                sens->sat = sat;
+                atomic_inc(&sat->refcnt);
+                sens->sens.ops = &wf_sat_ops;
+                sens->sens.name = (char *) (sens + 1);
+                snprintf(sens->sens.name, 16, "cpu-power-%d", cpu);
+
+                if (wf_register_sensor(&sens->sens)) {
+                        atomic_dec(&sat->refcnt);
+                        kfree(sens);
+                }
+        }
+
+        if (sat->nr >= 0)
+                sats[sat->nr] = sat;
+
+        return;
+
+ fail:
+        kfree(sat);
+}
+
+static int wf_sat_attach(struct i2c_adapter *adapter)
+{
+        struct device_node *busnode, *dev = NULL;
+        struct pmac_i2c_bus *bus;
+
+        bus = pmac_i2c_adapter_to_bus(adapter);
+        if (bus == NULL)
+                return -ENODEV;
+        busnode = pmac_i2c_get_bus_node(bus);
+
+        while ((dev = of_get_next_child(busnode, dev)) != NULL)
+                if (device_is_compatible(dev, "smu-sat"))
+                        wf_sat_create(adapter, dev);
+        return 0;
+}
+
+static int wf_sat_detach(struct i2c_client *client)
+{
+        struct wf_sat *sat = i2c_to_sat(client);
+
+        /* XXX TODO */
+
+        sat->i2c.adapter = NULL;
+        return 0;
+}
+
+static int __init sat_sensors_init(void)
+{
+        int err;
+
+        err = i2c_add_driver(&wf_sat_driver);
+        if (err < 0)
+                return err;
+        return 0;
+}
+
+static void __exit sat_sensors_exit(void)
+{
+        i2c_del_driver(&wf_sat_driver);
+}
+
+module_init(sat_sensors_init);
+/*module_exit(sat_sensors_exit); Uncomment when cleanup is implemented */
+
+MODULE_AUTHOR("Paul Mackerras <paulus@samba.org>");
+MODULE_DESCRIPTION("SMU satellite sensors for PowerMac thermal control");
+MODULE_LICENSE("GPL");
diff --git a/drivers/macintosh/windfarm_smu_sensors.c b/drivers/macintosh/windfarm_smu_sensors.c
index 1a00d9c75a23..bed25dcf8a1e 100644
--- a/drivers/macintosh/windfarm_smu_sensors.c
+++ b/drivers/macintosh/windfarm_smu_sensors.c
@@ -220,14 +220,29 @@ static struct smu_ad_sensor *smu_ads_create(struct device_node *node)
             !strcmp(l, "CPU T-Diode")) {
                 ads->sens.ops = &smu_cputemp_ops;
                 ads->sens.name = "cpu-temp";
+                if (cpudiode == NULL) {
+                        DBG("wf: cpudiode partition (%02x) not found\n",
+                            SMU_SDB_CPUDIODE_ID);
+                        goto fail;
+                }
         } else if (!strcmp(c, "current-sensor") &&
                    !strcmp(l, "CPU Current")) {
                 ads->sens.ops = &smu_cpuamp_ops;
                 ads->sens.name = "cpu-current";
+                if (cpuvcp == NULL) {
+                        DBG("wf: cpuvcp partition (%02x) not found\n",
+                            SMU_SDB_CPUVCP_ID);
+                        goto fail;
+                }
         } else if (!strcmp(c, "voltage-sensor") &&
                    !strcmp(l, "CPU Voltage")) {
                 ads->sens.ops = &smu_cpuvolt_ops;
                 ads->sens.name = "cpu-voltage";
+                if (cpuvcp == NULL) {
+                        DBG("wf: cpuvcp partition (%02x) not found\n",
+                            SMU_SDB_CPUVCP_ID);
+                        goto fail;
+                }
         } else if (!strcmp(c, "power-sensor") &&
                    !strcmp(l, "Slots Power")) {
                 ads->sens.ops = &smu_slotspow_ops;
@@ -365,29 +380,22 @@ smu_cpu_power_create(struct wf_sensor *volts, struct wf_sensor *amps)
         return NULL;
 }
 
-static int smu_fetch_param_partitions(void)
+static void smu_fetch_param_partitions(void)
 {
         struct smu_sdbp_header *hdr;
 
         /* Get CPU voltage/current/power calibration data */
         hdr = smu_get_sdb_partition(SMU_SDB_CPUVCP_ID, NULL);
-        if (hdr == NULL) {
-                DBG("wf: cpuvcp partition (%02x) not found\n",
-                    SMU_SDB_CPUVCP_ID);
-                return -ENODEV;
+        if (hdr != NULL) {
+                cpuvcp = (struct smu_sdbp_cpuvcp *)&hdr[1];
+                /* Keep version around */
+                cpuvcp_version = hdr->version;
         }
-        cpuvcp = (struct smu_sdbp_cpuvcp *)&hdr[1];
-        /* Keep version around */
-        cpuvcp_version = hdr->version;
 
         /* Get CPU diode calibration data */
         hdr = smu_get_sdb_partition(SMU_SDB_CPUDIODE_ID, NULL);
-        if (hdr == NULL) {
-                DBG("wf: cpudiode partition (%02x) not found\n",
-                    SMU_SDB_CPUDIODE_ID);
-                return -ENODEV;
-        }
-        cpudiode = (struct smu_sdbp_cpudiode *)&hdr[1];
+        if (hdr != NULL)
+                cpudiode = (struct smu_sdbp_cpudiode *)&hdr[1];
 
         /* Get slots power calibration data if any */
         hdr = smu_get_sdb_partition(SMU_SDB_SLOTSPOW_ID, NULL);
@@ -398,23 +406,18 @@ static int smu_fetch_param_partitions(void)
         hdr = smu_get_sdb_partition(SMU_SDB_DEBUG_SWITCHES_ID, NULL);
         if (hdr != NULL)
                 debugswitches = (u8 *)&hdr[1];
-
-        return 0;
 }
 
 static int __init smu_sensors_init(void)
 {
         struct device_node *smu, *sensors, *s;
         struct smu_ad_sensor *volt_sensor = NULL, *curr_sensor = NULL;
-        int rc;
 
         if (!smu_present())
                 return -ENODEV;
 
         /* Get parameters partitions */
-        rc = smu_fetch_param_partitions();
-        if (rc)
-                return rc;
+        smu_fetch_param_partitions();
 
         smu = of_find_node_by_type(NULL, "smu");
         if (smu == NULL)
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index ab89278a56bf..697aacafb02a 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -103,9 +103,15 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 return -EINVAL;
         }
 
+        if (((uint32_t)ti->len) & (chunk_size - 1)) {
+                ti->error = "dm-stripe: Target length not divisible by "
+                    "chunk size";
+                return -EINVAL;
+        }
+
         width = ti->len;
         if (sector_div(width, stripes)) {
-                ti->error = "dm-stripe: Target length not divisable by "
+                ti->error = "dm-stripe: Target length not divisible by "
                     "number of stripes";
                 return -EINVAL;
         }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index e9adeb9d172f..745ca1f67b14 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -849,10 +849,16 @@ static struct mapped_device *alloc_dev(unsigned int minor, int persistent)
 
 static void free_dev(struct mapped_device *md)
 {
-        free_minor(md->disk->first_minor);
+        unsigned int minor = md->disk->first_minor;
+
+        if (md->suspended_bdev) {
+                thaw_bdev(md->suspended_bdev, NULL);
+                bdput(md->suspended_bdev);
+        }
         mempool_destroy(md->tio_pool);
         mempool_destroy(md->io_pool);
         del_gendisk(md->disk);
+        free_minor(minor);
         put_disk(md->disk);
         blk_put_queue(md->queue);
         kfree(md);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d39f584cd8b3..5d88329e3c7a 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -306,6 +306,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
         r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
         int mirror, behind = test_bit(R1BIO_BehindIO, &r1_bio->state);
         conf_t *conf = mddev_to_conf(r1_bio->mddev);
+        struct bio *to_put = NULL;
 
         if (bio->bi_size)
                 return 1;
@@ -323,6 +324,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                  * this branch is our 'one mirror IO has finished' event handler:
                  */
                 r1_bio->bios[mirror] = NULL;
+                to_put = bio;
                 if (!uptodate) {
                         md_error(r1_bio->mddev, conf->mirrors[mirror].rdev);
                         /* an I/O failed, we can't clear the bitmap */
@@ -375,7 +377,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                         /* Don't dec_pending yet, we want to hold
                          * the reference over the retry
                          */
-                        return 0;
+                        goto out;
                 }
                 if (test_bit(R1BIO_BehindIO, &r1_bio->state)) {
                         /* free extra copy of the data pages */
@@ -392,10 +394,11 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                 raid_end_bio_io(r1_bio);
         }
 
-        if (r1_bio->bios[mirror]==NULL)
-                bio_put(bio);
-
         rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
+ out:
+        if (to_put)
+                bio_put(to_put);
+
         return 0;
 }
 
@@ -857,7 +860,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
         atomic_set(&r1_bio->remaining, 0);
         atomic_set(&r1_bio->behind_remaining, 0);
 
-        do_barriers = bio->bi_rw & BIO_RW_BARRIER;
+        do_barriers = bio_barrier(bio);
         if (do_barriers)
                 set_bit(R1BIO_Barrier, &r1_bio->state);
 
diff --git a/drivers/media/dvb/b2c2/Kconfig b/drivers/media/dvb/b2c2/Kconfig
index 2583a865a58e..2963605c0ecc 100644
--- a/drivers/media/dvb/b2c2/Kconfig
+++ b/drivers/media/dvb/b2c2/Kconfig
@@ -4,7 +4,7 @@ config DVB_B2C2_FLEXCOP
         select DVB_STV0299
         select DVB_MT352
         select DVB_MT312
-        select DVB_NXT2002
+        select DVB_NXT200X
         select DVB_STV0297
         select DVB_BCM3510
         select DVB_LGDT330X
diff --git a/drivers/media/dvb/b2c2/flexcop-common.h b/drivers/media/dvb/b2c2/flexcop-common.h
index 344a3c898460..7d7e1613c5a7 100644
--- a/drivers/media/dvb/b2c2/flexcop-common.h
+++ b/drivers/media/dvb/b2c2/flexcop-common.h
@@ -116,11 +116,9 @@ void flexcop_dma_free(struct flexcop_dma *dma);
 
 int flexcop_dma_control_timer_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff);
 int flexcop_dma_control_size_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff);
-int flexcop_dma_control_packet_irq(struct flexcop_device *fc, flexcop_dma_index_t no, int onoff);
 int flexcop_dma_config(struct flexcop_device *fc, struct flexcop_dma *dma, flexcop_dma_index_t dma_idx);
 int flexcop_dma_xfer_control(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, flexcop_dma_addr_index_t index, int onoff);
 int flexcop_dma_config_timer(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, u8 cycles);
-int flexcop_dma_config_packet_count(struct flexcop_device *fc, flexcop_dma_index_t dma_idx, u8 packets);
 
 /* from flexcop-eeprom.c */
 /* the PCI part uses this call to get the MAC address, the USB part has its own */
diff --git a/drivers/media/dvb/b2c2/flexcop-dma.c b/drivers/media/dvb/b2c2/flexcop-dma.c
index cf4ed1df6086..6f592bc32d22 100644
--- a/drivers/media/dvb/b2c2/flexcop-dma.c
+++ b/drivers/media/dvb/b2c2/flexcop-dma.c
@@ -169,38 +169,3 @@ int flexcop_dma_config_timer(struct flexcop_device *fc,
 }
 EXPORT_SYMBOL(flexcop_dma_config_timer);
 
-/* packet IRQ does not exist in FCII or FCIIb - according to data book and tests */
-int flexcop_dma_control_packet_irq(struct flexcop_device *fc,
-                flexcop_dma_index_t no,
-                int onoff)
-{
-        flexcop_ibi_value v = fc->read_ibi_reg(fc,ctrl_208);
-
-        deb_rdump("reg: %03x: %x\n",ctrl_208,v.raw);
-        if (no & FC_DMA_1)
-                v.ctrl_208.DMA1_Size_IRQ_Enable_sig = onoff;
-
-        if (no & FC_DMA_2)
-                v.ctrl_208.DMA2_Size_IRQ_Enable_sig = onoff;
-
-        fc->write_ibi_reg(fc,ctrl_208,v);
-        deb_rdump("reg: %03x: %x\n",ctrl_208,v.raw);
-
-        return 0;
-}
-EXPORT_SYMBOL(flexcop_dma_control_packet_irq);
-
-int flexcop_dma_config_packet_count(struct flexcop_device *fc,
-                flexcop_dma_index_t dma_idx,
-                u8 packets)
-{
-        flexcop_ibi_register r = (dma_idx & FC_DMA_1) ? dma1_004 : dma2_014;
-        flexcop_ibi_value v = fc->read_ibi_reg(fc,r);
-
-        flexcop_dma_remap(fc,dma_idx,1);
-
-        v.dma_0x4_remap.DMA_maxpackets = packets;
-        fc->write_ibi_reg(fc,r,v);
-        return 0;
-}
-EXPORT_SYMBOL(flexcop_dma_config_packet_count);
diff --git a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
index 0b940e152b79..9c7f122826e0 100644
--- a/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
+++ b/drivers/media/dvb/b2c2/flexcop-fe-tuner.c
@@ -9,7 +9,7 @@
 
 #include "stv0299.h"
 #include "mt352.h"
-#include "nxt2002.h"
+#include "nxt200x.h"
 #include "bcm3510.h"
 #include "stv0297.h"
 #include "mt312.h"
@@ -343,9 +343,10 @@ static struct lgdt330x_config air2pc_atsc_hd5000_config = {
         .clock_polarity_flip = 1,
 };
 
-static struct nxt2002_config samsung_tbmv_config = {
+static struct nxt200x_config samsung_tbmv_config = {
         .demod_address    = 0x0a,
-        .request_firmware = flexcop_fe_request_firmware,
+        .pll_address      = 0xc2,
+        .pll_desc         = &dvb_pll_samsung_tbmv,
 };
 
 static struct bcm3510_config air2pc_atsc_first_gen_config = {
@@ -505,7 +506,7 @@ int flexcop_frontend_init(struct flexcop_device *fc)
                 info("found the mt352 at i2c address: 0x%02x",samsung_tdtc9251dh0_config.demod_address);
         } else
         /* try the air atsc 2nd generation (nxt2002) */
-        if ((fc->fe = nxt2002_attach(&samsung_tbmv_config, &fc->i2c_adap)) != NULL) {
+        if ((fc->fe = nxt200x_attach(&samsung_tbmv_config, &fc->i2c_adap)) != NULL) {
                 fc->dev_type          = FC_AIR_ATSC2;
                 info("found the nxt2002 at i2c address: 0x%02x",samsung_tbmv_config.demod_address);
         } else
@@ -525,7 +526,7 @@ int flexcop_frontend_init(struct flexcop_device *fc)
                 info("found the stv0297 at i2c address: 0x%02x",alps_tdee4_stv0297_config.demod_address);
         } else
         /* try the sky v2.3 (vp310/Samsung tbdu18132(tsa5059)) */
-        if ((fc->fe = vp310_attach(&skystar23_samsung_tbdu18132_config, &fc->i2c_adap)) != NULL) {
+        if ((fc->fe = vp310_mt312_attach(&skystar23_samsung_tbdu18132_config, &fc->i2c_adap)) != NULL) {
                 ops = fc->fe->ops;
 
                 ops->diseqc_send_master_cmd = flexcop_diseqc_send_master_cmd;
diff --git a/drivers/media/dvb/b2c2/flexcop-misc.c b/drivers/media/dvb/b2c2/flexcop-misc.c
index 62282d8dbfa8..167583bf0621 100644
--- a/drivers/media/dvb/b2c2/flexcop-misc.c
+++ b/drivers/media/dvb/b2c2/flexcop-misc.c
@@ -36,14 +36,14 @@ void flexcop_determine_revision(struct flexcop_device *fc)
         /* bus parts have to decide if hw pid filtering is used or not. */
 }
 
-const char *flexcop_revision_names[] = {
+static const char *flexcop_revision_names[] = {
         "Unkown chip",
         "FlexCopII",
         "FlexCopIIb",
         "FlexCopIII",
 };
 
-const char *flexcop_device_names[] = {
+static const char *flexcop_device_names[] = {
         "Unkown device",
         "Air2PC/AirStar 2 DVB-T",
         "Air2PC/AirStar 2 ATSC 1st generation",
@@ -54,7 +54,7 @@ const char *flexcop_device_names[] = {
         "Air2PC/AirStar 2 ATSC 3rd generation (HD5000)",
 };
 
-const char *flexcop_bus_names[] = {
+static const char *flexcop_bus_names[] = {
         "USB",
         "PCI",
 };
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 2f76eb3fea40..9bc40bdcc282 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -161,8 +161,10 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id, struct pt_regs *regs)
                         fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2;
                 u32 cur_pos = cur_addr - fc_pci->dma[0].dma_addr0;
 
-                deb_irq("%u irq: %08x cur_addr: %08x: cur_pos: %08x, last_cur_pos: %08x ",
-                                jiffies_to_usecs(jiffies - fc_pci->last_irq),v.raw,cur_addr,cur_pos,fc_pci->last_dma1_cur_pos);
+                deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, last_cur_pos: %08x ",
+                                jiffies_to_usecs(jiffies - fc_pci->last_irq),
+                                v.raw, (unsigned long long)cur_addr, cur_pos,
+                                fc_pci->last_dma1_cur_pos);
                 fc_pci->last_irq = jiffies;
 
                 /* buffer end was reached, restarted from the beginning
diff --git a/drivers/media/dvb/b2c2/flexcop-reg.h b/drivers/media/dvb/b2c2/flexcop-reg.h
index 3153f9513c63..491f9bd6e195 100644
--- a/drivers/media/dvb/b2c2/flexcop-reg.h
+++ b/drivers/media/dvb/b2c2/flexcop-reg.h
@@ -16,8 +16,6 @@ typedef enum {
         FLEXCOP_III,
 } flexcop_revision_t;
 
-extern const char *flexcop_revision_names[];
-
 typedef enum {
         FC_UNK = 0,
         FC_AIR_DVB,
@@ -34,8 +32,6 @@ typedef enum {
         FC_PCI,
 } flexcop_bus_t;
 
-extern const char *flexcop_device_names[];
-
 /* FlexCop IBI Registers */
 #if defined(__LITTLE_ENDIAN)
         #include "flexcop_ibi_value_le.h"
diff --git a/drivers/media/dvb/bt8xx/bt878.c b/drivers/media/dvb/bt8xx/bt878.c
index a04bb61f21f4..356f447ee2ab 100644
--- a/drivers/media/dvb/bt8xx/bt878.c
+++ b/drivers/media/dvb/bt8xx/bt878.c
@@ -381,6 +381,23 @@ bt878_device_control(struct bt878 *bt, unsigned int cmd, union dst_gpio_packet *
 
 EXPORT_SYMBOL(bt878_device_control);
 
+
+static struct cards card_list[] __devinitdata = {
+
+        { 0x01010071, BTTV_BOARD_NEBULA_DIGITV,                 "Nebula Electronics DigiTV" },
+        { 0x07611461, BTTV_BOARD_AVDVBT_761,                    "AverMedia AverTV DVB-T 761" },
+        { 0x001c11bd, BTTV_BOARD_PINNACLESAT,                   "Pinnacle PCTV Sat" },
+        { 0x002611bd, BTTV_BOARD_TWINHAN_DST,                   "Pinnacle PCTV SAT CI" },
+        { 0x00011822, BTTV_BOARD_TWINHAN_DST,                   "Twinhan VisionPlus DVB" },
+        { 0xfc00270f, BTTV_BOARD_TWINHAN_DST,                   "ChainTech digitop DST-1000 DVB-S" },
+        { 0x07711461, BTTV_BOARD_AVDVBT_771,                    "AVermedia AverTV DVB-T 771" },
+        { 0xdb1018ac, BTTV_BOARD_DVICO_DVBT_LITE,               "DViCO FusionHDTV DVB-T Lite" },
+        { 0xd50018ac, BTTV_BOARD_DVICO_FUSIONHDTV_5_LITE,       "DViCO FusionHDTV 5 Lite" },
+        { 0x20007063, BTTV_BOARD_PC_HDTV,                       "pcHDTV HD-2000 TV"},
+        { 0, -1, NULL }
+};
+
+
 /***********************/
 /* PCI device handling */
 /***********************/
@@ -388,18 +405,41 @@ EXPORT_SYMBOL(bt878_device_control);
 static int __devinit bt878_probe(struct pci_dev *dev,
                                  const struct pci_device_id *pci_id)
 {
-        int result;
+        int result = 0, has_dvb = 0, i;
         unsigned char lat;
         struct bt878 *bt;
 #if defined(__powerpc__)
         unsigned int cmd;
 #endif
+        unsigned int cardid;
+        unsigned short id;
+        struct cards *dvb_cards;
 
         printk(KERN_INFO "bt878: Bt878 AUDIO function found (%d).\n",
                bt878_num);
         if (pci_enable_device(dev))
                 return -EIO;
 
+        pci_read_config_word(dev, PCI_SUBSYSTEM_ID, &id);
+        cardid = id << 16;
+        pci_read_config_word(dev, PCI_SUBSYSTEM_VENDOR_ID, &id);
+        cardid |= id;
+
+        for (i = 0, dvb_cards = card_list; i < ARRAY_SIZE(card_list); i++, dvb_cards++) {
+                if (cardid == dvb_cards->pci_id) {
+                        printk("%s: card id=[0x%x],[ %s ] has DVB functions.\n",
+                                __func__, cardid, dvb_cards->name);
+                        has_dvb = 1;
+                }
+        }
+
+        if (!has_dvb) {
+                printk("%s: card id=[0x%x], Unknown card.\nExiting..\n", __func__, cardid);
+                result = -EINVAL;
+
+                goto fail0;
+        }
+
         bt = &bt878[bt878_num];
         bt->dev = dev;
         bt->nr = bt878_num;
@@ -416,6 +456,8 @@ static int __devinit bt878_probe(struct pci_dev *dev,
 
         pci_read_config_byte(dev, PCI_CLASS_REVISION, &bt->revision);
         pci_read_config_byte(dev, PCI_LATENCY_TIMER, &lat);
+
+
         printk(KERN_INFO "bt878(%d): Bt%x (rev %d) at %02x:%02x.%x, ",
                bt878_num, bt->id, bt->revision, dev->bus->number,
                PCI_SLOT(dev->devfn), PCI_FUNC(dev->devfn));
diff --git a/drivers/media/dvb/bt8xx/bt878.h b/drivers/media/dvb/bt8xx/bt878.h
index a73baf00ca39..9faf93770d08 100644
--- a/drivers/media/dvb/bt8xx/bt878.h
+++ b/drivers/media/dvb/bt8xx/bt878.h
@@ -88,6 +88,23 @@
 
 #define BT878_RISC_SYNC_MASK    (1 << 15)
 
+
+#define BTTV_BOARD_UNKNOWN                 0x00
+#define BTTV_BOARD_PINNACLESAT             0x5e
+#define BTTV_BOARD_NEBULA_DIGITV           0x68
+#define BTTV_BOARD_PC_HDTV                 0x70
+#define BTTV_BOARD_TWINHAN_DST             0x71
+#define BTTV_BOARD_AVDVBT_771              0x7b
+#define BTTV_BOARD_AVDVBT_761              0x7c
+#define BTTV_BOARD_DVICO_DVBT_LITE         0x80
+#define BTTV_BOARD_DVICO_FUSIONHDTV_5_LITE 0x87
+
+struct cards {
+        __u32 pci_id;
+        __u16 card_id;
+        char  *name;
+};
+
 extern int bt878_num;
 
 struct bt878 {
diff --git a/drivers/media/dvb/bt8xx/dst.c b/drivers/media/dvb/bt8xx/dst.c
index 3a2ff1cc24b7..0310e3dd07e6 100644
--- a/drivers/media/dvb/bt8xx/dst.c
+++ b/drivers/media/dvb/bt8xx/dst.c
@@ -602,7 +602,7 @@ static int dst_type_print(u8 type)
 
 */
 
-struct dst_types dst_tlist[] = {
+static struct dst_types dst_tlist[] = {
         {
                 .device_id = "200103A",
                 .offset = 0,
diff --git a/drivers/media/dvb/dvb-core/demux.h b/drivers/media/dvb/dvb-core/demux.h
index 9f025825b2d2..0c1d87c5227a 100644
--- a/drivers/media/dvb/dvb-core/demux.h
+++ b/drivers/media/dvb/dvb-core/demux.h
@@ -216,7 +216,7 @@ struct dmx_frontend {
 /*--------------------------------------------------------------------------*/
 
 /*
- * Flags OR'ed in the capabilites field of struct dmx_demux.
+ * Flags OR'ed in the capabilities field of struct dmx_demux.
  */
 
 #define DMX_TS_FILTERING                        1
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 90a69d343b79..d3df12039b06 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -83,12 +83,18 @@ config DVB_USB_UMT_010
           Say Y here to support the HanfTek UMT-010 USB2.0 stick-sized DVB-T receiver.
 
 config DVB_USB_CXUSB
-        tristate "Medion MD95700 hybrid USB2.0 (Conexant) support"
+        tristate "Conexant USB2.0 hybrid reference design support"
         depends on DVB_USB
         select DVB_CX22702
+        select DVB_LGDT330X
+        select DVB_MT352
         help
-          Say Y here to support the Medion MD95700 hybrid USB2.0 device. Currently
-          only the DVB-T part is supported.
+          Say Y here to support the Conexant USB2.0 hybrid reference design.
+          Currently, only DVB and ATSC modes are supported, analog mode
+          shall be added in the future. Devices that require this module:
+
+          Medion MD95700 hybrid USB2.0 device.
+          DViCO FusionHDTV (Bluebird) USB2.0 devices
 
 config DVB_USB_DIGITV
         tristate "Nebula Electronics uDigiTV DVB-T USB2.0 support"
diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
index a7fb06f4cd34..162f9795cd89 100644
--- a/drivers/media/dvb/dvb-usb/cxusb.c
+++ b/drivers/media/dvb/dvb-usb/cxusb.c
@@ -184,7 +184,7 @@ static int cxusb_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
         return 0;
 }
 
-struct dvb_usb_rc_key dvico_mce_rc_keys[] = {
+static struct dvb_usb_rc_key dvico_mce_rc_keys[] = {
         { 0xfe, 0x02, KEY_TV },
         { 0xfe, 0x0e, KEY_MP3 },
         { 0xfe, 0x1a, KEY_DVD },
@@ -234,7 +234,7 @@ struct dvb_usb_rc_key dvico_mce_rc_keys[] = {
 
 static int cxusb_dee1601_demod_init(struct dvb_frontend* fe)
 {
-        static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x38 };
+        static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x28 };
         static u8 reset []         = { RESET,      0x80 };
         static u8 adc_ctl_1_cfg [] = { ADC_CTL_1,  0x40 };
         static u8 agc_cfg []       = { AGC_TARGET, 0x28, 0x20 };
@@ -255,7 +255,7 @@ static int cxusb_dee1601_demod_init(struct dvb_frontend* fe)
 
 static int cxusb_mt352_demod_init(struct dvb_frontend* fe)
 {       /* used in both lgz201 and th7579 */
-        static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x39 };
+        static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x29 };
         static u8 reset []         = { RESET,      0x80 };
         static u8 adc_ctl_1_cfg [] = { ADC_CTL_1,  0x40 };
         static u8 agc_cfg []       = { AGC_TARGET, 0x24, 0x20 };
@@ -273,7 +273,7 @@ static int cxusb_mt352_demod_init(struct dvb_frontend* fe)
         return 0;
 }
 
-struct cx22702_config cxusb_cx22702_config = {
+static struct cx22702_config cxusb_cx22702_config = {
         .demod_address = 0x63,
 
         .output_mode = CX22702_PARALLEL_OUTPUT,
@@ -282,13 +282,13 @@ struct cx22702_config cxusb_cx22702_config = {
         .pll_set  = dvb_usb_pll_set_i2c,
 };
 
-struct lgdt330x_config cxusb_lgdt330x_config = {
+static struct lgdt330x_config cxusb_lgdt3303_config = {
         .demod_address = 0x0e,
         .demod_chip    = LGDT3303,
         .pll_set       = dvb_usb_pll_set_i2c,
 };
 
-struct mt352_config cxusb_dee1601_config = {
+static struct mt352_config cxusb_dee1601_config = {
         .demod_address = 0x0f,
         .demod_init    = cxusb_dee1601_demod_init,
         .pll_set       = dvb_usb_pll_set,
@@ -357,14 +357,14 @@ static int cxusb_cx22702_frontend_attach(struct dvb_usb_device *d)
         return -EIO;
 }
 
-static int cxusb_lgdt330x_frontend_attach(struct dvb_usb_device *d)
+static int cxusb_lgdt3303_frontend_attach(struct dvb_usb_device *d)
 {
         if (usb_set_interface(d->udev,0,7) < 0)
                 err("set interface failed");
 
         cxusb_ctrl_msg(d,CMD_DIGITAL, NULL, 0, NULL, 0);
 
-        if ((d->fe = lgdt330x_attach(&cxusb_lgdt330x_config, &d->i2c_adap)) != NULL)
+        if ((d->fe = lgdt330x_attach(&cxusb_lgdt3303_config, &d->i2c_adap)) != NULL)
                 return 0;
 
         return -EIO;
@@ -506,7 +506,7 @@ static struct dvb_usb_properties cxusb_bluebird_lgh064f_properties = {
 
         .streaming_ctrl   = cxusb_streaming_ctrl,
         .power_ctrl       = cxusb_power_ctrl,
-        .frontend_attach  = cxusb_lgdt330x_frontend_attach,
+        .frontend_attach  = cxusb_lgdt3303_frontend_attach,
         .tuner_attach     = cxusb_lgh064f_tuner_attach,
 
         .i2c_algo         = &cxusb_i2c_algo,
diff --git a/drivers/media/dvb/dvb-usb/digitv.c b/drivers/media/dvb/dvb-usb/digitv.c
index e6c55c9c9417..caa1346e3063 100644
--- a/drivers/media/dvb/dvb-usb/digitv.c
+++ b/drivers/media/dvb/dvb-usb/digitv.c
@@ -175,11 +175,13 @@ static int digitv_probe(struct usb_interface *intf,
         if ((ret = dvb_usb_device_init(intf,&digitv_properties,THIS_MODULE,&d)) == 0) {
                 u8 b[4] = { 0 };
 
-                b[0] = 1;
-                digitv_ctrl_msg(d,USB_WRITE_REMOTE_TYPE,0,b,4,NULL,0);
+                if (d != NULL) { /* do that only when the firmware is loaded */
+                        b[0] = 1;
+                        digitv_ctrl_msg(d,USB_WRITE_REMOTE_TYPE,0,b,4,NULL,0);
 
-                b[0] = 0;
-                digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0);
+                        b[0] = 0;
+                        digitv_ctrl_msg(d,USB_WRITE_REMOTE,0,b,4,NULL,0);
+                }
         }
         return ret;
 }
@@ -194,7 +196,7 @@ static struct dvb_usb_properties digitv_properties = {
         .caps = DVB_USB_IS_AN_I2C_ADAPTER,
 
         .usb_ctrl = CYPRESS_FX2,
-        .firmware = "dvb-usb-digitv-01.fw",
+        .firmware = "dvb-usb-digitv-02.fw",
 
         .size_of_priv     = 0,
 
@@ -229,6 +231,7 @@ static struct dvb_usb_properties digitv_properties = {
                         { &digitv_table[0], NULL },
                         { NULL },
                 },
+                { NULL },
         }
 };
 
diff --git a/drivers/media/dvb/dvb-usb/dtt200u.c b/drivers/media/dvb/dvb-usb/dtt200u.c
index 130ea7f21f5e..12ebaf8bddca 100644
--- a/drivers/media/dvb/dvb-usb/dtt200u.c
+++ b/drivers/media/dvb/dvb-usb/dtt200u.c
@@ -151,7 +151,7 @@ static struct dvb_usb_properties dtt200u_properties = {
                   .cold_ids = { &dtt200u_usb_table[0], NULL },
                   .warm_ids = { &dtt200u_usb_table[1], NULL },
                 },
-                { 0 },
+                { NULL },
         }
 };
 
@@ -192,7 +192,7 @@ static struct dvb_usb_properties wt220u_properties = {
                   .cold_ids = { &dtt200u_usb_table[2], NULL },
                   .warm_ids = { &dtt200u_usb_table[3], NULL },
                 },
-                { 0 },
+                { NULL },
         }
 };
 
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c b/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c
index 8535895819fb..9222b0a81f74 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-firmware.c
@@ -24,6 +24,9 @@ static struct usb_cypress_controller cypress[] = {
         { .id = CYPRESS_FX2,     .name = "Cypress FX2",     .cpu_cs_register = 0xe600 },
 };
 
+static int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx,
+                               int *pos);
+
 /*
  * load a firmware packet to the device
  */
@@ -112,7 +115,8 @@ int dvb_usb_download_firmware(struct usb_device *udev, struct dvb_usb_properties
         return ret;
 }
 
-int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx, int *pos)
+static int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx,
+                               int *pos)
 {
         u8 *b = (u8 *) &fw->data[*pos];
         int data_offs = 4;
@@ -142,5 +146,3 @@ int dvb_usb_get_hexline(const struct firmware *fw, struct hexline *hx, int *pos)
 
         return *pos;
 }
-EXPORT_SYMBOL(dvb_usb_get_hexline);
-
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-init.c b/drivers/media/dvb/dvb-usb/dvb-usb-init.c
index 716f8bf528cd..ce34a55e5c24 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-init.c
@@ -47,7 +47,7 @@ static int dvb_usb_init(struct dvb_usb_device *d)
 
         d->state = DVB_USB_STATE_INIT;
 
-/* check the capabilites and set appropriate variables */
+/* check the capabilities and set appropriate variables */
 
 /* speed - when running at FULL speed we need a HW PID filter */
         if (d->udev->speed == USB_SPEED_FULL && !(d->props.caps & DVB_USB_HAS_PID_FILTER)) {
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb.h b/drivers/media/dvb/dvb-usb/dvb-usb.h
index dd568396e594..d4909e5c67e0 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb.h
@@ -87,7 +87,7 @@ struct dvb_usb_device;
 
 /**
  * struct dvb_usb_properties - properties of a dvb-usb-device
- * @caps: capabilites of the DVB USB device.
+ * @caps: capabilities of the DVB USB device.
  * @pid_filter_count: number of PID filter position in the optional hardware
  *  PID-filter.
  *
@@ -341,7 +341,6 @@ struct hexline {
         u8 data[255];
         u8 chk;
 };
-extern int dvb_usb_get_hexline(const struct firmware *, struct hexline *, int *);
 extern int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type);
 
 #endif
diff --git a/drivers/media/dvb/dvb-usb/vp702x.c b/drivers/media/dvb/dvb-usb/vp702x.c
index afa00fdb5ec0..4a95eca81c5c 100644
--- a/drivers/media/dvb/dvb-usb/vp702x.c
+++ b/drivers/media/dvb/dvb-usb/vp702x.c
@@ -53,7 +53,8 @@ int vp702x_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8
         return ret;
 }
 
-int vp702x_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen)
+static int vp702x_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value,
+                             u16 index, u8 *b, int blen)
 {
         deb_xfer("out: req. %x, val: %x, ind: %x, buffer: ",req,value,index);
         debug_dump(b,blen,deb_xfer);
@@ -88,7 +89,8 @@ unlock:
         return ret;
 }
 
-int vp702x_usb_inout_cmd(struct dvb_usb_device *d, u8 cmd, u8 *o, int olen, u8 *i, int ilen, int msec)
+static int vp702x_usb_inout_cmd(struct dvb_usb_device *d, u8 cmd, u8 *o,
+                                int olen, u8 *i, int ilen, int msec)
 {
         u8 bout[olen+2];
         u8 bin[ilen+1];
diff --git a/drivers/media/dvb/dvb-usb/vp702x.h b/drivers/media/dvb/dvb-usb/vp702x.h
index a808d48e7bf2..c2f97f96c21f 100644
--- a/drivers/media/dvb/dvb-usb/vp702x.h
+++ b/drivers/media/dvb/dvb-usb/vp702x.h
@@ -101,8 +101,6 @@ extern int dvb_usb_vp702x_debug;
 extern struct dvb_frontend * vp702x_fe_attach(struct dvb_usb_device *d);
 
 extern int vp702x_usb_inout_op(struct dvb_usb_device *d, u8 *o, int olen, u8 *i, int ilen, int msec);
-extern int vp702x_usb_inout_cmd(struct dvb_usb_device *d, u8 cmd, u8 *o, int olen, u8 *i, int ilen, int msec);
 extern int vp702x_usb_in_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen);
-extern int vp702x_usb_out_op(struct dvb_usb_device *d, u8 req, u16 value, u16 index, u8 *b, int blen);
 
 #endif
diff --git a/drivers/media/dvb/dvb-usb/vp7045-fe.c b/drivers/media/dvb/dvb-usb/vp7045-fe.c
index 5242cca5db4a..9999336aeeb6 100644
--- a/drivers/media/dvb/dvb-usb/vp7045-fe.c
+++ b/drivers/media/dvb/dvb-usb/vp7045-fe.c
@@ -23,10 +23,11 @@
 
 struct vp7045_fe_state {
         struct dvb_frontend fe;
+        struct dvb_frontend_ops ops;
+
         struct dvb_usb_device *d;
 };
 
-
 static int vp7045_fe_read_status(struct dvb_frontend* fe, fe_status_t *status)
 {
         struct vp7045_fe_state *state = fe->demodulator_priv;
@@ -150,7 +151,8 @@ struct dvb_frontend * vp7045_fe_attach(struct dvb_usb_device *d)
                 goto error;
 
         s->d = d;
-        s->fe.ops = &vp7045_fe_ops;
+        memcpy(&s->ops, &vp7045_fe_ops, sizeof(struct dvb_frontend_ops));
+        s->fe.ops = &s->ops;
         s->fe.demodulator_priv = s;
 
         goto success;
diff --git a/drivers/media/dvb/dvb-usb/vp7045.c b/drivers/media/dvb/dvb-usb/vp7045.c
index 028204956bb0..3835235b68df 100644
--- a/drivers/media/dvb/dvb-usb/vp7045.c
+++ b/drivers/media/dvb/dvb-usb/vp7045.c
@@ -247,7 +247,7 @@ static struct dvb_usb_properties vp7045_properties = {
                   .cold_ids = { &vp7045_usb_table[2], NULL },
                   .warm_ids = { &vp7045_usb_table[3], NULL },
                 },
-                { 0 },
+                { NULL },
         }
 };
 
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index db3a8b40031e..c676b1e23ab0 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -28,14 +28,8 @@ config DVB_TDA8083
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
 
-config DVB_TDA80XX
-        tristate "Philips TDA8044 or TDA8083 based"
-        depends on DVB_CORE
-        help
-          A DVB-S tuner module. Say Y when you want to support this frontend.
-
 config DVB_MT312
-        tristate "Zarlink MT312 based"
+        tristate "Zarlink VP310/MT312 based"
         depends on DVB_CORE
         help
           A DVB-S tuner module. Say Y when you want to support this frontend.
@@ -139,12 +133,6 @@ config DVB_DIB3000MC
 comment "DVB-C (cable) frontends"
         depends on DVB_CORE
 
-config DVB_ATMEL_AT76C651
-        tristate "Atmel AT76C651 based"
-        depends on DVB_CORE
-        help
-          A DVB-C tuner module. Say Y when you want to support this frontend.
-
 config DVB_VES1820
         tristate "VLSI VES1820 based"
         depends on DVB_CORE
@@ -166,18 +154,6 @@ config DVB_STV0297
 comment "ATSC (North American/Korean Terresterial DTV) frontends"
         depends on DVB_CORE
 
-config DVB_NXT2002
-        tristate "Nxt2002 based"
-        depends on DVB_CORE
-        select FW_LOADER
-        help
-          An ATSC 8VSB tuner module. Say Y when you want to support this frontend.
-
-          This driver needs external firmware. Please use the command
-          "<kerneldir>/Documentation/dvb/get_dvb_firmware nxt2002" to
-          download/extract it, and then copy it to /usr/lib/hotplug/firmware
-          or /lib/firmware (depending on configuration of firmware hotplug).
-
 config DVB_NXT200X
         tristate "Nextwave NXT2002/NXT2004 based"
         depends on DVB_CORE
diff --git a/drivers/media/dvb/frontends/Makefile b/drivers/media/dvb/frontends/Makefile
index 615ec830e1c9..1af769cd90c0 100644
--- a/drivers/media/dvb/frontends/Makefile
+++ b/drivers/media/dvb/frontends/Makefile
@@ -8,7 +8,6 @@ obj-$(CONFIG_DVB_CORE) += dvb-pll.o
 obj-$(CONFIG_DVB_STV0299) += stv0299.o
 obj-$(CONFIG_DVB_SP8870) += sp8870.o
 obj-$(CONFIG_DVB_CX22700) += cx22700.o
-obj-$(CONFIG_DVB_ATMEL_AT76C651) += at76c651.o
 obj-$(CONFIG_DVB_CX24110) += cx24110.o
 obj-$(CONFIG_DVB_TDA8083) += tda8083.o
 obj-$(CONFIG_DVB_L64781) += l64781.o
@@ -22,10 +21,8 @@ obj-$(CONFIG_DVB_SP887X) += sp887x.o
 obj-$(CONFIG_DVB_NXT6000) += nxt6000.o
 obj-$(CONFIG_DVB_MT352) += mt352.o
 obj-$(CONFIG_DVB_CX22702) += cx22702.o
-obj-$(CONFIG_DVB_TDA80XX) += tda80xx.o
 obj-$(CONFIG_DVB_TDA10021) += tda10021.o
 obj-$(CONFIG_DVB_STV0297) += stv0297.o
-obj-$(CONFIG_DVB_NXT2002) += nxt2002.o
 obj-$(CONFIG_DVB_NXT200X) += nxt200x.o
 obj-$(CONFIG_DVB_OR51211) += or51211.o
 obj-$(CONFIG_DVB_OR51132) += or51132.o
diff --git a/drivers/media/dvb/frontends/at76c651.c b/drivers/media/dvb/frontends/at76c651.c
deleted file mode 100644
index 8e0f4b3a1417..000000000000
--- a/drivers/media/dvb/frontends/at76c651.c
+++ /dev/null
@@ -1,450 +0,0 @@
-/*
- * at76c651.c
- *
- * Atmel DVB-C Frontend Driver (at76c651/tua6010xs)
- *
- * Copyright (C) 2001 fnbrd <fnbrd@gmx.de>
- *             & 2002-2004 Andreas Oberritter <obi@linuxtv.org>
- *             & 2003 Wolfram Joost <dbox2@frokaschwei.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- * AT76C651
- * http://www.nalanda.nitc.ac.in/industry/datasheets/atmel/acrobat/doc1293.pdf
- * http://www.atmel.com/atmel/acrobat/doc1320.pdf
- */
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/slab.h>
-#include <linux/bitops.h>
-#include "dvb_frontend.h"
-#include "at76c651.h"
-
-
-struct at76c651_state {
-
-        struct i2c_adapter* i2c;
-
-        struct dvb_frontend_ops ops;
-
-        const struct at76c651_config* config;
-
-        struct dvb_frontend frontend;
-
-        /* revision of the chip */
-        u8 revision;
-
-        /* last QAM value set */
-        u8 qam;
-};
-
-static int debug;
-#define dprintk(args...) \
-        do { \
-                if (debug) printk(KERN_DEBUG "at76c651: " args); \
-        } while (0)
-
-
-#if ! defined(__powerpc__)
-static __inline__ int __ilog2(unsigned long x)
-{
-        int i;
-
-        if (x == 0)
-                return -1;
-
-        for (i = 0; x != 0; i++)
-                x >>= 1;
-
-        return i - 1;
-}
-#endif
-
-static int at76c651_writereg(struct at76c651_state* state, u8 reg, u8 data)
-{
-        int ret;
-        u8 buf[] = { reg, data };
-        struct i2c_msg msg =
-                { .addr = state->config->demod_address, .flags = 0, .buf = buf, .len = 2 };
-
-        ret = i2c_transfer(state->i2c, &msg, 1);
-
-        if (ret != 1)
-                dprintk("%s: writereg error "
-                        "(reg == 0x%02x, val == 0x%02x, ret == %i)\n",
-                        __FUNCTION__, reg, data, ret);
-
-        msleep(10);
-
-        return (ret != 1) ? -EREMOTEIO : 0;
-}
-
-static u8 at76c651_readreg(struct at76c651_state* state, u8 reg)
-{
-        int ret;
-        u8 val;
-        struct i2c_msg msg[] = {
-                { .addr = state->config->demod_address, .flags = 0, .buf = &reg, .len = 1 },
-                { .addr = state->config->demod_address, .flags = I2C_M_RD, .buf = &val, .len = 1 }
-        };
-
-        ret = i2c_transfer(state->i2c, msg, 2);
-
-        if (ret != 2)
-                dprintk("%s: readreg error (ret == %i)\n", __FUNCTION__, ret);
-
-        return val;
-}
-
-static int at76c651_reset(struct at76c651_state* state)
-{
-        return at76c651_writereg(state, 0x07, 0x01);
-}
-
-static void at76c651_disable_interrupts(struct at76c651_state* state)
-{
-        at76c651_writereg(state, 0x0b, 0x00);
-}
-
-static int at76c651_set_auto_config(struct at76c651_state *state)
-{
-        /*
-         * Autoconfig
-         */
-
-        at76c651_writereg(state, 0x06, 0x01);
-
-        /*
-         * Performance optimizations, should be done after autoconfig
-         */
-
-        at76c651_writereg(state, 0x10, 0x06);
-        at76c651_writereg(state, 0x11, ((state->qam == 5) || (state->qam == 7)) ? 0x12 : 0x10);
-        at76c651_writereg(state, 0x15, 0x28);
-        at76c651_writereg(state, 0x20, 0x09);
-        at76c651_writereg(state, 0x24, ((state->qam == 5) || (state->qam == 7)) ? 0xC0 : 0x90);
-        at76c651_writereg(state, 0x30, 0x90);
-        if (state->qam == 5)
-                at76c651_writereg(state, 0x35, 0x2A);
-
-        /*
-         * Initialize A/D-converter
-         */
-
-        if (state->revision == 0x11) {
-                at76c651_writereg(state, 0x2E, 0x38);
-                at76c651_writereg(state, 0x2F, 0x13);
-        }
-
-        at76c651_disable_interrupts(state);
-
-        /*
-         * Restart operation
-         */
-
-        at76c651_reset(state);
-
-        return 0;
-}
-
-static void at76c651_set_bbfreq(struct at76c651_state* state)
-{
-        at76c651_writereg(state, 0x04, 0x3f);
-        at76c651_writereg(state, 0x05, 0xee);
-}
-
-static int at76c651_set_symbol_rate(struct at76c651_state* state, u32 symbol_rate)
-{
-        u8 exponent;
-        u32 mantissa;
-
-        if (symbol_rate > 9360000)
-                return -EINVAL;
-
-        /*
-         * FREF = 57800 kHz
-         * exponent = 10 + floor (log2(symbol_rate / FREF))
-         * mantissa = (symbol_rate / FREF) * (1 << (30 - exponent))
-         */
-
-        exponent = __ilog2((symbol_rate << 4) / 903125);
-        mantissa = ((symbol_rate / 3125) * (1 << (24 - exponent))) / 289;
-
-        at76c651_writereg(state, 0x00, mantissa >> 13);
-        at76c651_writereg(state, 0x01, mantissa >> 5);
-        at76c651_writereg(state, 0x02, (mantissa << 3) | exponent);
-
-        return 0;
-}
-
-static int at76c651_set_qam(struct at76c651_state *state, fe_modulation_t qam)
-{
-        switch (qam) {
-        case QPSK:
-                state->qam = 0x02;
-                break;
-        case QAM_16:
-                state->qam = 0x04;
-                break;
-        case QAM_32:
-                state->qam = 0x05;
-                break;
-        case QAM_64:
-                state->qam = 0x06;
-                break;
-        case QAM_128:
-                state->qam = 0x07;
-                break;
-        case QAM_256:
-                state->qam = 0x08;
-                break;
-#if 0
-        case QAM_512:
-                state->qam = 0x09;
-                break;
-        case QAM_1024:
-                state->qam = 0x0A;
-                break;
-#endif
-        default:
-                return -EINVAL;
-
-        }
-
-        return at76c651_writereg(state, 0x03, state->qam);
-}
-
-static int at76c651_set_inversion(struct at76c651_state* state, fe_spectral_inversion_t inversion)
-{
-        u8 feciqinv = at76c651_readreg(state, 0x60);
-
-        switch (inversion) {
-        case INVERSION_OFF:
-                feciqinv |= 0x02;
-                feciqinv &= 0xFE;
-                break;
-
-        case INVERSION_ON:
-                feciqinv |= 0x03;
-                break;
-
-        case INVERSION_AUTO:
-                feciqinv &= 0xFC;
-                break;
-
-        default:
-                return -EINVAL;
-        }
-
-        return at76c651_writereg(state, 0x60, feciqinv);
-}
-
-static int at76c651_set_parameters(struct dvb_frontend* fe,
-                                   struct dvb_frontend_parameters *p)
-{
-        int ret;
-        struct at76c651_state* state = fe->demodulator_priv;
-
-        at76c651_writereg(state, 0x0c, 0xc3);
-        state->config->pll_set(fe, p);
-        at76c651_writereg(state, 0x0c, 0xc2);
-
-        if ((ret = at76c651_set_symbol_rate(state, p->u.qam.symbol_rate)))
-                return ret;
-
-        if ((ret = at76c651_set_inversion(state, p->inversion)))
-                return ret;
-
-        return at76c651_set_auto_config(state);
-}
-
-static int at76c651_set_defaults(struct dvb_frontend* fe)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-
-        at76c651_set_symbol_rate(state, 6900000);
-        at76c651_set_qam(state, QAM_64);
-        at76c651_set_bbfreq(state);
-        at76c651_set_auto_config(state);
-
-        if (state->config->pll_init) {
-                at76c651_writereg(state, 0x0c, 0xc3);
-                state->config->pll_init(fe);
-                at76c651_writereg(state, 0x0c, 0xc2);
-        }
-
-        return 0;
-}
-
-static int at76c651_read_status(struct dvb_frontend* fe, fe_status_t* status)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-        u8 sync;
-
-        /*
-         * Bits: FEC, CAR, EQU, TIM, AGC2, AGC1, ADC, PLL (PLL=0)
-         */
-        sync = at76c651_readreg(state, 0x80);
-        *status = 0;
-
-        if (sync & (0x04 | 0x10))       /* AGC1 || TIM */
-                *status |= FE_HAS_SIGNAL;
-        if (sync & 0x10)                /* TIM */
-                *status |= FE_HAS_CARRIER;
-        if (sync & 0x80)                /* FEC */
-                *status |= FE_HAS_VITERBI;
-        if (sync & 0x40)                /* CAR */
-                *status |= FE_HAS_SYNC;
-        if ((sync & 0xF0) == 0xF0)      /* TIM && EQU && CAR && FEC */
-                *status |= FE_HAS_LOCK;
-
-        return 0;
-}
-
-static int at76c651_read_ber(struct dvb_frontend* fe, u32* ber)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-
-        *ber = (at76c651_readreg(state, 0x81) & 0x0F) << 16;
-        *ber |= at76c651_readreg(state, 0x82) << 8;
-        *ber |= at76c651_readreg(state, 0x83);
-        *ber *= 10;
-
-        return 0;
-}
-
-static int at76c651_read_signal_strength(struct dvb_frontend* fe, u16* strength)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-
-        u8 gain = ~at76c651_readreg(state, 0x91);
-        *strength = (gain << 8) | gain;
-
-        return 0;
-}
-
-static int at76c651_read_snr(struct dvb_frontend* fe, u16* snr)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-
-        *snr = 0xFFFF -
-            ((at76c651_readreg(state, 0x8F) << 8) |
-             at76c651_readreg(state, 0x90));
-
-        return 0;
-}
-
-static int at76c651_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-
-        *ucblocks = at76c651_readreg(state, 0x82);
-
-        return 0;
-}
-
-static int at76c651_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings *fesettings)
-{
-        fesettings->min_delay_ms = 50;
-        fesettings->step_size = 0;
-        fesettings->max_drift = 0;
-        return 0;
-}
-
-static void at76c651_release(struct dvb_frontend* fe)
-{
-        struct at76c651_state* state = fe->demodulator_priv;
-        kfree(state);
-}
-
-static struct dvb_frontend_ops at76c651_ops;
-
-struct dvb_frontend* at76c651_attach(const struct at76c651_config* config,
-                                     struct i2c_adapter* i2c)
-{
-        struct at76c651_state* state = NULL;
-
-        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct at76c651_state), GFP_KERNEL);
-        if (state == NULL) goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->qam = 0;
-
-        /* check if the demod is there */
-        if (at76c651_readreg(state, 0x0e) != 0x65) goto error;
-
-        /* finalise state setup */
-        state->i2c = i2c;
-        state->revision = at76c651_readreg(state, 0x0f) & 0xfe;
-        memcpy(&state->ops, &at76c651_ops, sizeof(struct dvb_frontend_ops));
-
-        /* create dvb_frontend */
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
-        kfree(state);
-        return NULL;
-}
-
-static struct dvb_frontend_ops at76c651_ops = {
-
-        .info = {
-                .name = "Atmel AT76C651B DVB-C",
-                .type = FE_QAM,
-                .frequency_min = 48250000,
-                .frequency_max = 863250000,
-                .frequency_stepsize = 62500,
-                /*.frequency_tolerance = */     /* FIXME: 12% of SR */
-                .symbol_rate_min = 0,           /* FIXME */
-                .symbol_rate_max = 9360000,     /* FIXME */
-                .symbol_rate_tolerance = 4000,
-                .caps = FE_CAN_INVERSION_AUTO |
-                    FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
-                    FE_CAN_FEC_4_5 | FE_CAN_FEC_5_6 | FE_CAN_FEC_6_7 |
-                    FE_CAN_FEC_7_8 | FE_CAN_FEC_8_9 | FE_CAN_FEC_AUTO |
-                    FE_CAN_QAM_16 | FE_CAN_QAM_32 | FE_CAN_QAM_64 | FE_CAN_QAM_128 |
-                    FE_CAN_MUTE_TS | FE_CAN_QAM_256 | FE_CAN_RECOVER
-        },
-
-        .release = at76c651_release,
-
-        .init = at76c651_set_defaults,
-
-        .set_frontend = at76c651_set_parameters,
-        .get_tune_settings = at76c651_get_tune_settings,
-
-        .read_status = at76c651_read_status,
-        .read_ber = at76c651_read_ber,
-        .read_signal_strength = at76c651_read_signal_strength,
-        .read_snr = at76c651_read_snr,
-        .read_ucblocks = at76c651_read_ucblocks,
-};
-
-module_param(debug, int, 0644);
-MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
-
-MODULE_DESCRIPTION("Atmel AT76C651 DVB-C Demodulator Driver");
-MODULE_AUTHOR("Andreas Oberritter <obi@linuxtv.org>");
-MODULE_LICENSE("GPL");
-
-EXPORT_SYMBOL(at76c651_attach);
diff --git a/drivers/media/dvb/frontends/at76c651.h b/drivers/media/dvb/frontends/at76c651.h
deleted file mode 100644
index 34054df93608..000000000000
--- a/drivers/media/dvb/frontends/at76c651.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * at76c651.c
- *
- * Atmel DVB-C Frontend Driver (at76c651)
- *
- * Copyright (C) 2001 fnbrd <fnbrd@gmx.de>
- *             & 2002-2004 Andreas Oberritter <obi@linuxtv.org>
- *             & 2003 Wolfram Joost <dbox2@frokaschwei.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- * AT76C651
- * http://www.nalanda.nitc.ac.in/industry/datasheets/atmel/acrobat/doc1293.pdf
- * http://www.atmel.com/atmel/acrobat/doc1320.pdf
- */
-
-#ifndef AT76C651_H
-#define AT76C651_H
-
-#include <linux/dvb/frontend.h>
-
-struct at76c651_config
-{
-        /* the demodulator's i2c address */
-        u8 demod_address;
-
-        /* PLL maintenance */
-        int (*pll_init)(struct dvb_frontend* fe);
-        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params);
-};
-
-extern struct dvb_frontend* at76c651_attach(const struct at76c651_config* config,
-                                            struct i2c_adapter* i2c);
-
-#endif // AT76C651_H
diff --git a/drivers/media/dvb/frontends/dvb-pll.c b/drivers/media/dvb/frontends/dvb-pll.c
index 1b9934ea5b06..4dcb6050d4fa 100644
--- a/drivers/media/dvb/frontends/dvb-pll.c
+++ b/drivers/media/dvb/frontends/dvb-pll.c
@@ -326,11 +326,11 @@ struct dvb_pll_desc dvb_pll_tuv1236d = {
 };
 EXPORT_SYMBOL(dvb_pll_tuv1236d);
 
-/* Samsung TBMV30111IN
+/* Samsung TBMV30111IN / TBMV30712IN1
  * used in Air2PC ATSC - 2nd generation (nxt2002)
  */
-struct dvb_pll_desc dvb_pll_tbmv30111in = {
-        .name = "Samsung TBMV30111IN",
+struct dvb_pll_desc dvb_pll_samsung_tbmv = {
+        .name = "Samsung TBMV30111IN / TBMV30712IN1",
         .min = 54000000,
         .max = 860000000,
         .count = 6,
@@ -343,7 +343,7 @@ struct dvb_pll_desc dvb_pll_tbmv30111in = {
                 { 999999999, 44000000, 166666, 0xfc, 0x02 },
         }
 };
-EXPORT_SYMBOL(dvb_pll_tbmv30111in);
+EXPORT_SYMBOL(dvb_pll_samsung_tbmv);
 
 /*
  * Philips SD1878 Tuner.
diff --git a/drivers/media/dvb/frontends/dvb-pll.h b/drivers/media/dvb/frontends/dvb-pll.h
index f682c09189b3..bb8d4b4eb183 100644
--- a/drivers/media/dvb/frontends/dvb-pll.h
+++ b/drivers/media/dvb/frontends/dvb-pll.h
@@ -38,7 +38,7 @@ extern struct dvb_pll_desc dvb_pll_tded4;
 
 extern struct dvb_pll_desc dvb_pll_tuv1236d;
 extern struct dvb_pll_desc dvb_pll_tdhu2;
-extern struct dvb_pll_desc dvb_pll_tbmv30111in;
+extern struct dvb_pll_desc dvb_pll_samsung_tbmv;
 extern struct dvb_pll_desc dvb_pll_philips_sd1878_tda8261;
 
 int dvb_pll_configure(struct dvb_pll_desc *desc, u8 *buf,
diff --git a/drivers/media/dvb/frontends/mt312.c b/drivers/media/dvb/frontends/mt312.c
index ec4e641acc64..d3aea83cf218 100644
--- a/drivers/media/dvb/frontends/mt312.c
+++ b/drivers/media/dvb/frontends/mt312.c
@@ -612,76 +612,6 @@ static void mt312_release(struct dvb_frontend* fe)
         kfree(state);
 }
 
-static struct dvb_frontend_ops vp310_mt312_ops;
-
-struct dvb_frontend* vp310_attach(const struct mt312_config* config,
-                                  struct i2c_adapter* i2c)
-{
-        struct mt312_state* state = NULL;
-
-        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
-        if (state == NULL)
-                goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        memcpy(&state->ops, &vp310_mt312_ops, sizeof(struct dvb_frontend_ops));
-        strcpy(state->ops.info.name, "Zarlink VP310 DVB-S");
-
-        /* check if the demod is there */
-        if (mt312_readreg(state, ID, &state->id) < 0)
-                goto error;
-        if (state->id != ID_VP310) {
-                goto error;
-        }
-
-        /* create dvb_frontend */
-        state->frequency = 90;
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
-        kfree(state);
-        return NULL;
-}
-
-struct dvb_frontend* mt312_attach(const struct mt312_config* config,
-                                  struct i2c_adapter* i2c)
-{
-        struct mt312_state* state = NULL;
-
-        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
-        if (state == NULL)
-                goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        memcpy(&state->ops, &vp310_mt312_ops, sizeof(struct dvb_frontend_ops));
-        strcpy(state->ops.info.name, "Zarlink MT312 DVB-S");
-
-        /* check if the demod is there */
-        if (mt312_readreg(state, ID, &state->id) < 0)
-                goto error;
-        if (state->id != ID_MT312) {
-                goto error;
-        }
-
-        /* create dvb_frontend */
-        state->frequency = 60;
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
-        kfree(state);
-        return NULL;
-}
-
 static struct dvb_frontend_ops vp310_mt312_ops = {
 
         .info = {
@@ -720,6 +650,49 @@ static struct dvb_frontend_ops vp310_mt312_ops = {
         .set_voltage = mt312_set_voltage,
 };
 
+struct dvb_frontend* vp310_mt312_attach(const struct mt312_config* config,
+                                        struct i2c_adapter* i2c)
+{
+        struct mt312_state* state = NULL;
+
+        /* allocate memory for the internal state */
+        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        if (state == NULL)
+                goto error;
+
+        /* setup the state */
+        state->config = config;
+        state->i2c = i2c;
+        memcpy(&state->ops, &vp310_mt312_ops, sizeof(struct dvb_frontend_ops));
+
+        /* check if the demod is there */
+        if (mt312_readreg(state, ID, &state->id) < 0)
+                goto error;
+
+        switch (state->id) {
+        case ID_VP310:
+                strcpy(state->ops.info.name, "Zarlink VP310 DVB-S");
+                state->frequency = 90;
+                break;
+        case ID_MT312:
+                strcpy(state->ops.info.name, "Zarlink MT312 DVB-S");
+                state->frequency = 60;
+                break;
+        default:
+                printk (KERN_WARNING "Only Zarlink VP310/MT312 are supported chips.\n");
+                goto error;
+        }
+
+        /* create dvb_frontend */
+        state->frontend.ops = &state->ops;
+        state->frontend.demodulator_priv = state;
+        return &state->frontend;
+
+error:
+        kfree(state);
+        return NULL;
+}
+
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
 
@@ -727,5 +700,4 @@ MODULE_DESCRIPTION("Zarlink VP310/MT312 DVB-S Demodulator driver");
 MODULE_AUTHOR("Andreas Oberritter <obi@linuxtv.org>");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(mt312_attach);
-EXPORT_SYMBOL(vp310_attach);
+EXPORT_SYMBOL(vp310_mt312_attach);
diff --git a/drivers/media/dvb/frontends/mt312.h b/drivers/media/dvb/frontends/mt312.h
index b3a53a73a117..074d844f0139 100644
--- a/drivers/media/dvb/frontends/mt312.h
+++ b/drivers/media/dvb/frontends/mt312.h
@@ -38,10 +38,8 @@ struct mt312_config
         int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params);
 };
 
-extern struct dvb_frontend* mt312_attach(const struct mt312_config* config,
-                                         struct i2c_adapter* i2c);
+struct dvb_frontend* vp310_mt312_attach(const struct mt312_config* config,
+                                        struct i2c_adapter* i2c);
 
-extern struct dvb_frontend* vp310_attach(const struct mt312_config* config,
-                                         struct i2c_adapter* i2c);
 
 #endif // MT312_H
diff --git a/drivers/media/dvb/frontends/nxt2002.c b/drivers/media/dvb/frontends/nxt2002.c
deleted file mode 100644
index 4f263e65ba14..000000000000
--- a/drivers/media/dvb/frontends/nxt2002.c
+++ /dev/null
@@ -1,706 +0,0 @@
-/*
-    Support for B2C2/BBTI Technisat Air2PC - ATSC
-
-    Copyright (C) 2004 Taylor Jacob <rtjacob@earthlink.net>
-
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
-*/
-
-/*
- * This driver needs external firmware. Please use the command
- * "<kerneldir>/Documentation/dvb/get_dvb_firmware nxt2002" to
- * download/extract it, and then copy it to /usr/lib/hotplug/firmware
- * or /lib/firmware (depending on configuration of firmware hotplug).
- */
-#define NXT2002_DEFAULT_FIRMWARE "dvb-fe-nxt2002.fw"
-#define CRC_CCIT_MASK 0x1021
-
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/device.h>
-#include <linux/firmware.h>
-#include <linux/string.h>
-#include <linux/slab.h>
-
-#include "dvb_frontend.h"
-#include "nxt2002.h"
-
-struct nxt2002_state {
-
-        struct i2c_adapter* i2c;
-        struct dvb_frontend_ops ops;
-        const struct nxt2002_config* config;
-        struct dvb_frontend frontend;
-
-        /* demodulator private data */
-        u8 initialised:1;
-};
-
-static int debug;
-#define dprintk(args...) \
-        do { \
-                if (debug) printk(KERN_DEBUG "nxt2002: " args); \
-        } while (0)
-
-static int i2c_writebytes (struct nxt2002_state* state, u8 reg, u8 *buf, u8 len)
-{
-        /* probbably a much better way or doing this */
-        u8 buf2 [256],x;
-        int err;
-        struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, .buf = buf2, .len = len + 1 };
-
-        buf2[0] = reg;
-        for (x = 0 ; x < len ; x++)
-                buf2[x+1] = buf[x];
-
-        if ((err = i2c_transfer (state->i2c, &msg, 1)) != 1) {
-                printk ("%s: i2c write error (addr %02x, err == %i)\n",
-                        __FUNCTION__, state->config->demod_address, err);
-                return -EREMOTEIO;
-        }
-
-        return 0;
-}
-
-static u8 i2c_readbytes (struct nxt2002_state* state, u8 reg, u8* buf, u8 len)
-{
-        u8 reg2 [] = { reg };
-
-        struct i2c_msg msg [] = { { .addr = state->config->demod_address, .flags = 0, .buf = reg2, .len = 1 },
-                        { .addr = state->config->demod_address, .flags = I2C_M_RD, .buf = buf, .len = len } };
-
-        int err;
-
-        if ((err = i2c_transfer (state->i2c, msg, 2)) != 2) {
-                printk ("%s: i2c read error (addr %02x, err == %i)\n",
-                        __FUNCTION__, state->config->demod_address, err);
-                return -EREMOTEIO;
-        }
-
-        return 0;
-}
-
-static u16 nxt2002_crc(u16 crc, u8 c)
-{
-
-        u8 i;
-        u16 input = (u16) c & 0xFF;
-
-        input<<=8;
-        for(i=0 ;i<8 ;i++) {
-                if((crc ^ input) & 0x8000)
-                        crc=(crc<<1)^CRC_CCIT_MASK;
-                else
-                        crc<<=1;
-        input<<=1;
-        }
-        return crc;
-}
-
-static int nxt2002_writereg_multibyte (struct nxt2002_state* state, u8 reg, u8* data, u8 len)
-{
-        u8 buf;
-        dprintk("%s\n", __FUNCTION__);
-
-        /* set multi register length */
-        i2c_writebytes(state,0x34,&len,1);
-
-        /* set mutli register register */
-        i2c_writebytes(state,0x35,&reg,1);
-
-        /* send the actual data */
-        i2c_writebytes(state,0x36,data,len);
-
-        /* toggle the multireg write bit*/
-        buf = 0x02;
-        i2c_writebytes(state,0x21,&buf,1);
-
-        i2c_readbytes(state,0x21,&buf,1);
-
-        if ((buf & 0x02) == 0)
-                return 0;
-
-        dprintk("Error writing multireg register %02X\n",reg);
-
-        return 0;
-}
-
-static int nxt2002_readreg_multibyte (struct nxt2002_state* state, u8 reg, u8* data, u8 len)
-{
-        u8 len2;
-        dprintk("%s\n", __FUNCTION__);
-
-        /* set multi register length */
-        len2 = len & 0x80;
-        i2c_writebytes(state,0x34,&len2,1);
-
-        /* set mutli register register */
-        i2c_writebytes(state,0x35,&reg,1);
-
-        /* send the actual data */
-        i2c_readbytes(state,reg,data,len);
-
-        return 0;
-}
-
-static void nxt2002_microcontroller_stop (struct nxt2002_state* state)
-{
-        u8 buf[2],counter = 0;
-        dprintk("%s\n", __FUNCTION__);
-
-        buf[0] = 0x80;
-        i2c_writebytes(state,0x22,buf,1);
-
-        while (counter < 20) {
-                i2c_readbytes(state,0x31,buf,1);
-                if (buf[0] & 0x40)
-                        return;
-                msleep(10);
-                counter++;
-        }
-
-        dprintk("Timeout waiting for micro to stop.. This is ok after firmware upload\n");
-        return;
-}
-
-static void nxt2002_microcontroller_start (struct nxt2002_state* state)
-{
-        u8 buf;
-        dprintk("%s\n", __FUNCTION__);
-
-        buf = 0x00;
-        i2c_writebytes(state,0x22,&buf,1);
-}
-
-static int nxt2002_writetuner (struct nxt2002_state* state, u8* data)
-{
-        u8 buf,count = 0;
-
-        dprintk("Tuner Bytes: %02X %02X %02X %02X\n",data[0],data[1],data[2],data[3]);
-
-        dprintk("%s\n", __FUNCTION__);
-        /* stop the micro first */
-        nxt2002_microcontroller_stop(state);
-
-        /* set the i2c transfer speed to the tuner */
-        buf = 0x03;
-        i2c_writebytes(state,0x20,&buf,1);
-
-        /* setup to transfer 4 bytes via i2c */
-        buf = 0x04;
-        i2c_writebytes(state,0x34,&buf,1);
-
-        /* write actual tuner bytes */
-        i2c_writebytes(state,0x36,data,4);
-
-        /* set tuner i2c address */
-        buf = 0xC2;
-        i2c_writebytes(state,0x35,&buf,1);
-
-        /* write UC Opmode to begin transfer */
-        buf = 0x80;
-        i2c_writebytes(state,0x21,&buf,1);
-
-        while (count < 20) {
-                i2c_readbytes(state,0x21,&buf,1);
-                if ((buf & 0x80)== 0x00)
-                        return 0;
-                msleep(100);
-                count++;
-        }
-
-        printk("nxt2002: timeout error writing tuner\n");
-        return 0;
-}
-
-static void nxt2002_agc_reset(struct nxt2002_state* state)
-{
-        u8 buf;
-        dprintk("%s\n", __FUNCTION__);
-
-        buf = 0x08;
-        i2c_writebytes(state,0x08,&buf,1);
-
-        buf = 0x00;
-        i2c_writebytes(state,0x08,&buf,1);
-
-        return;
-}
-
-static int nxt2002_load_firmware (struct dvb_frontend* fe, const struct firmware *fw)
-{
-
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u8 buf[256],written = 0,chunkpos = 0;
-        u16 rambase,position,crc = 0;
-
-        dprintk("%s\n", __FUNCTION__);
-        dprintk("Firmware is %zu bytes\n",fw->size);
-
-        /* Get the RAM base for this nxt2002 */
-        i2c_readbytes(state,0x10,buf,1);
-
-        if (buf[0] & 0x10)
-                rambase = 0x1000;
-        else
-                rambase = 0x0000;
-
-        dprintk("rambase on this nxt2002 is %04X\n",rambase);
-
-        /* Hold the micro in reset while loading firmware */
-        buf[0] = 0x80;
-        i2c_writebytes(state,0x2B,buf,1);
-
-        for (position = 0; position < fw->size ; position++) {
-                if (written == 0) {
-                        crc = 0;
-                        chunkpos = 0x28;
-                        buf[0] = ((rambase + position) >> 8);
-                        buf[1] = (rambase + position) & 0xFF;
-                        buf[2] = 0x81;
-                        /* write starting address */
-                        i2c_writebytes(state,0x29,buf,3);
-                }
-                written++;
-                chunkpos++;
-
-                if ((written % 4) == 0)
-                        i2c_writebytes(state,chunkpos,&fw->data[position-3],4);
-
-                crc = nxt2002_crc(crc,fw->data[position]);
-
-                if ((written == 255) || (position+1 == fw->size)) {
-                        /* write remaining bytes of firmware */
-                        i2c_writebytes(state, chunkpos+4-(written %4),
-                                &fw->data[position-(written %4) + 1],
-                                written %4);
-                        buf[0] = crc << 8;
-                        buf[1] = crc & 0xFF;
-
-                        /* write crc */
-                        i2c_writebytes(state,0x2C,buf,2);
-
-                        /* do a read to stop things */
-                        i2c_readbytes(state,0x2A,buf,1);
-
-                        /* set transfer mode to complete */
-                        buf[0] = 0x80;
-                        i2c_writebytes(state,0x2B,buf,1);
-
-                        written = 0;
-                }
-        }
-
-        printk ("done.\n");
-        return 0;
-};
-
-static int nxt2002_setup_frontend_parameters (struct dvb_frontend* fe,
-                                             struct dvb_frontend_parameters *p)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u32 freq = 0;
-        u16 tunerfreq = 0;
-        u8 buf[4];
-
-        freq = 44000 + ( p->frequency / 1000 );
-
-        dprintk("freq = %d      p->frequency = %d\n",freq,p->frequency);
-
-        tunerfreq = freq * 24/4000;
-
-        buf[0] = (tunerfreq >> 8) & 0x7F;
-        buf[1] = (tunerfreq & 0xFF);
-
-        if (p->frequency <= 214000000) {
-                buf[2] = 0x84 + (0x06 << 3);
-                buf[3] = (p->frequency <= 172000000) ? 0x01 : 0x02;
-        } else if (p->frequency <= 721000000) {
-                buf[2] = 0x84 + (0x07 << 3);
-                buf[3] = (p->frequency <= 467000000) ? 0x02 : 0x08;
-        } else if (p->frequency <= 841000000) {
-                buf[2] = 0x84 + (0x0E << 3);
-                buf[3] = 0x08;
-        } else {
-                buf[2] = 0x84 + (0x0F << 3);
-                buf[3] = 0x02;
-        }
-
-        /* write frequency information */
-        nxt2002_writetuner(state,buf);
-
-        /* reset the agc now that tuning has been completed */
-        nxt2002_agc_reset(state);
-
-        /* set target power level */
-        switch (p->u.vsb.modulation) {
-                case QAM_64:
-                case QAM_256:
-                                buf[0] = 0x74;
-                                break;
-                case VSB_8:
-                                buf[0] = 0x70;
-                                break;
-                default:
-                                return -EINVAL;
-                                break;
-        }
-        i2c_writebytes(state,0x42,buf,1);
-
-        /* configure sdm */
-        buf[0] = 0x87;
-        i2c_writebytes(state,0x57,buf,1);
-
-        /* write sdm1 input */
-        buf[0] = 0x10;
-        buf[1] = 0x00;
-        nxt2002_writereg_multibyte(state,0x58,buf,2);
-
-        /* write sdmx input */
-        switch (p->u.vsb.modulation) {
-                case QAM_64:
-                                buf[0] = 0x68;
-                                break;
-                case QAM_256:
-                                buf[0] = 0x64;
-                                break;
-                case VSB_8:
-                                buf[0] = 0x60;
-                                break;
-                default:
-                                return -EINVAL;
-                                break;
-        }
-        buf[1] = 0x00;
-        nxt2002_writereg_multibyte(state,0x5C,buf,2);
-
-        /* write adc power lpf fc */
-        buf[0] = 0x05;
-        i2c_writebytes(state,0x43,buf,1);
-
-        /* write adc power lpf fc */
-        buf[0] = 0x05;
-        i2c_writebytes(state,0x43,buf,1);
-
-        /* write accumulator2 input */
-        buf[0] = 0x80;
-        buf[1] = 0x00;
-        nxt2002_writereg_multibyte(state,0x4B,buf,2);
-
-        /* write kg1 */
-        buf[0] = 0x00;
-        i2c_writebytes(state,0x4D,buf,1);
-
-        /* write sdm12 lpf fc */
-        buf[0] = 0x44;
-        i2c_writebytes(state,0x55,buf,1);
-
-        /* write agc control reg */
-        buf[0] = 0x04;
-        i2c_writebytes(state,0x41,buf,1);
-
-        /* write agc ucgp0 */
-        switch (p->u.vsb.modulation) {
-                case QAM_64:
-                                buf[0] = 0x02;
-                                break;
-                case QAM_256:
-                                buf[0] = 0x03;
-                                break;
-                case VSB_8:
-                                buf[0] = 0x00;
-                                break;
-                default:
-                                return -EINVAL;
-                                break;
-        }
-        i2c_writebytes(state,0x30,buf,1);
-
-        /* write agc control reg */
-        buf[0] = 0x00;
-        i2c_writebytes(state,0x41,buf,1);
-
-        /* write accumulator2 input */
-        buf[0] = 0x80;
-        buf[1] = 0x00;
-        nxt2002_writereg_multibyte(state,0x49,buf,2);
-        nxt2002_writereg_multibyte(state,0x4B,buf,2);
-
-        /* write agc control reg */
-        buf[0] = 0x04;
-        i2c_writebytes(state,0x41,buf,1);
-
-        nxt2002_microcontroller_start(state);
-
-        /* adjacent channel detection should be done here, but I don't
-        have any stations with this need so I cannot test it */
-
-        return 0;
-}
-
-static int nxt2002_read_status(struct dvb_frontend* fe, fe_status_t* status)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u8 lock;
-        i2c_readbytes(state,0x31,&lock,1);
-
-        *status = 0;
-        if (lock & 0x20) {
-                *status |= FE_HAS_SIGNAL;
-                *status |= FE_HAS_CARRIER;
-                *status |= FE_HAS_VITERBI;
-                *status |= FE_HAS_SYNC;
-                *status |= FE_HAS_LOCK;
-        }
-        return 0;
-}
-
-static int nxt2002_read_ber(struct dvb_frontend* fe, u32* ber)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u8 b[3];
-
-        nxt2002_readreg_multibyte(state,0xE6,b,3);
-
-        *ber = ((b[0] << 8) + b[1]) * 8;
-
-        return 0;
-}
-
-static int nxt2002_read_signal_strength(struct dvb_frontend* fe, u16* strength)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u8 b[2];
-        u16 temp = 0;
-
-        /* setup to read cluster variance */
-        b[0] = 0x00;
-        i2c_writebytes(state,0xA1,b,1);
-
-        /* get multreg val */
-        nxt2002_readreg_multibyte(state,0xA6,b,2);
-
-        temp = (b[0] << 8) | b[1];
-        *strength = ((0x7FFF - temp) & 0x0FFF) * 16;
-
-        return 0;
-}
-
-static int nxt2002_read_snr(struct dvb_frontend* fe, u16* snr)
-{
-
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u8 b[2];
-        u16 temp = 0, temp2;
-        u32 snrdb = 0;
-
-        /* setup to read cluster variance */
-        b[0] = 0x00;
-        i2c_writebytes(state,0xA1,b,1);
-
-        /* get multreg val from 0xA6 */
-        nxt2002_readreg_multibyte(state,0xA6,b,2);
-
-        temp = (b[0] << 8) | b[1];
-        temp2 = 0x7FFF - temp;
-
-        /* snr will be in db */
-        if (temp2 > 0x7F00)
-                snrdb = 1000*24 + ( 1000*(30-24) * ( temp2 - 0x7F00 ) / ( 0x7FFF - 0x7F00 ) );
-        else if (temp2 > 0x7EC0)
-                snrdb = 1000*18 + ( 1000*(24-18) * ( temp2 - 0x7EC0 ) / ( 0x7F00 - 0x7EC0 ) );
-        else if (temp2 > 0x7C00)
-                snrdb = 1000*12 + ( 1000*(18-12) * ( temp2 - 0x7C00 ) / ( 0x7EC0 - 0x7C00 ) );
-        else
-                snrdb = 1000*0 + ( 1000*(12-0) * ( temp2 - 0 ) / ( 0x7C00 - 0 ) );
-
-        /* the value reported back from the frontend will be FFFF=32db 0000=0db */
-
-        *snr = snrdb * (0xFFFF/32000);
-
-        return 0;
-}
-
-static int nxt2002_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        u8 b[3];
-
-        nxt2002_readreg_multibyte(state,0xE6,b,3);
-        *ucblocks = b[2];
-
-        return 0;
-}
-
-static int nxt2002_sleep(struct dvb_frontend* fe)
-{
-        return 0;
-}
-
-static int nxt2002_init(struct dvb_frontend* fe)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        const struct firmware *fw;
-        int ret;
-        u8 buf[2];
-
-        if (!state->initialised) {
-                /* request the firmware, this will block until someone uploads it */
-                printk("nxt2002: Waiting for firmware upload (%s)...\n", NXT2002_DEFAULT_FIRMWARE);
-                ret = state->config->request_firmware(fe, &fw, NXT2002_DEFAULT_FIRMWARE);
-                printk("nxt2002: Waiting for firmware upload(2)...\n");
-                if (ret) {
-                        printk("nxt2002: no firmware upload (timeout or file not found?)\n");
-                        return ret;
-                }
-
-                ret = nxt2002_load_firmware(fe, fw);
-                if (ret) {
-                        printk("nxt2002: writing firmware to device failed\n");
-                        release_firmware(fw);
-                        return ret;
-                }
-                printk("nxt2002: firmware upload complete\n");
-
-                /* Put the micro into reset */
-                nxt2002_microcontroller_stop(state);
-
-                /* ensure transfer is complete */
-                buf[0]=0;
-                i2c_writebytes(state,0x2B,buf,1);
-
-                /* Put the micro into reset for real this time */
-                nxt2002_microcontroller_stop(state);
-
-                /* soft reset everything (agc,frontend,eq,fec)*/
-                buf[0] = 0x0F;
-                i2c_writebytes(state,0x08,buf,1);
-                buf[0] = 0x00;
-                i2c_writebytes(state,0x08,buf,1);
-
-                /* write agc sdm configure */
-                buf[0] = 0xF1;
-                i2c_writebytes(state,0x57,buf,1);
-
-                /* write mod output format */
-                buf[0] = 0x20;
-                i2c_writebytes(state,0x09,buf,1);
-
-                /* write fec mpeg mode */
-                buf[0] = 0x7E;
-                buf[1] = 0x00;
-                i2c_writebytes(state,0xE9,buf,2);
-
-                /* write mux selection */
-                buf[0] = 0x00;
-                i2c_writebytes(state,0xCC,buf,1);
-
-                state->initialised = 1;
-        }
-
-        return 0;
-}
-
-static int nxt2002_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings* fesettings)
-{
-        fesettings->min_delay_ms = 500;
-        fesettings->step_size = 0;
-        fesettings->max_drift = 0;
-        return 0;
-}
-
-static void nxt2002_release(struct dvb_frontend* fe)
-{
-        struct nxt2002_state* state = fe->demodulator_priv;
-        kfree(state);
-}
-
-static struct dvb_frontend_ops nxt2002_ops;
-
-struct dvb_frontend* nxt2002_attach(const struct nxt2002_config* config,
-                                   struct i2c_adapter* i2c)
-{
-        struct nxt2002_state* state = NULL;
-        u8 buf [] = {0,0,0,0,0};
-
-        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct nxt2002_state), GFP_KERNEL);
-        if (state == NULL) goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        memcpy(&state->ops, &nxt2002_ops, sizeof(struct dvb_frontend_ops));
-        state->initialised = 0;
-
-        /* Check the first 5 registers to ensure this a revision we can handle */
-
-        i2c_readbytes(state, 0x00, buf, 5);
-        if (buf[0] != 0x04) goto error;         /* device id */
-        if (buf[1] != 0x02) goto error;         /* fab id */
-        if (buf[2] != 0x11) goto error;         /* month */
-        if (buf[3] != 0x20) goto error;         /* year msb */
-        if (buf[4] != 0x00) goto error;         /* year lsb */
-
-        /* create dvb_frontend */
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
-        kfree(state);
-        return NULL;
-}
-
-static struct dvb_frontend_ops nxt2002_ops = {
-
-        .info = {
-                .name = "Nextwave nxt2002 VSB/QAM frontend",
-                .type = FE_ATSC,
-                .frequency_min =  54000000,
-                .frequency_max = 860000000,
-                /* stepsize is just a guess */
-                .frequency_stepsize = 166666,
-                .caps = FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
-                        FE_CAN_FEC_5_6 | FE_CAN_FEC_7_8 | FE_CAN_FEC_AUTO |
-                        FE_CAN_8VSB | FE_CAN_QAM_64 | FE_CAN_QAM_256
-        },
-
-        .release = nxt2002_release,
-
-        .init = nxt2002_init,
-        .sleep = nxt2002_sleep,
-
-        .set_frontend = nxt2002_setup_frontend_parameters,
-        .get_tune_settings = nxt2002_get_tune_settings,
-
-        .read_status = nxt2002_read_status,
-        .read_ber = nxt2002_read_ber,
-        .read_signal_strength = nxt2002_read_signal_strength,
-        .read_snr = nxt2002_read_snr,
-        .read_ucblocks = nxt2002_read_ucblocks,
-
-};
-
-module_param(debug, int, 0644);
-MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
-
-MODULE_DESCRIPTION("NXT2002 ATSC (8VSB & ITU J83 AnnexB FEC QAM64/256) demodulator driver");
-MODULE_AUTHOR("Taylor Jacob");
-MODULE_LICENSE("GPL");
-
-EXPORT_SYMBOL(nxt2002_attach);
diff --git a/drivers/media/dvb/frontends/nxt2002.h b/drivers/media/dvb/frontends/nxt2002.h
deleted file mode 100644
index 462301f577ee..000000000000
--- a/drivers/media/dvb/frontends/nxt2002.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/*
-   Driver for the Nxt2002 demodulator
-*/
-
-#ifndef NXT2002_H
-#define NXT2002_H
-
-#include <linux/dvb/frontend.h>
-#include <linux/firmware.h>
-
-struct nxt2002_config
-{
-        /* the demodulator's i2c address */
-        u8 demod_address;
-
-        /* request firmware for device */
-        int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
-};
-
-extern struct dvb_frontend* nxt2002_attach(const struct nxt2002_config* config,
-                                           struct i2c_adapter* i2c);
-
-#endif // NXT2002_H
diff --git a/drivers/media/dvb/frontends/nxt200x.c b/drivers/media/dvb/frontends/nxt200x.c
index 78d2b93d35b9..9e3535394509 100644
--- a/drivers/media/dvb/frontends/nxt200x.c
+++ b/drivers/media/dvb/frontends/nxt200x.c
@@ -1,9 +1,10 @@
 /*
  *    Support for NXT2002 and NXT2004 - VSB/QAM
  *
- *    Copyright (C) 2005 Kirk Lapray (kirk.lapray@gmail.com)
+ *    Copyright (C) 2005 Kirk Lapray <kirk.lapray@gmail.com>
+ *    Copyright (C) 2006 Michael Krufky <mkrufky@m1k.net>
  *    based on nxt2002 by Taylor Jacob <rtjacob@earthlink.net>
- *    and nxt2004 by Jean-Francois Thibert (jeanfrancois@sagetv.com)
+ *    and nxt2004 by Jean-Francois Thibert <jeanfrancois@sagetv.com>
  *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
@@ -614,7 +615,17 @@ static int nxt200x_setup_frontend_parameters (struct dvb_frontend* fe,
         /* write sdm1 input */
         buf[0] = 0x10;
         buf[1] = 0x00;
-        nxt200x_writebytes(state, 0x58, buf, 2);
+        switch (state->demod_chip) {
+                case NXT2002:
+                        nxt200x_writereg_multibyte(state, 0x58, buf, 2);
+                        break;
+                case NXT2004:
+                        nxt200x_writebytes(state, 0x58, buf, 2);
+                        break;
+                default:
+                        return -EINVAL;
+                        break;
+        }
 
         /* write sdmx input */
         switch (p->u.vsb.modulation) {
@@ -632,7 +643,17 @@ static int nxt200x_setup_frontend_parameters (struct dvb_frontend* fe,
                                 break;
         }
         buf[1] = 0x00;
-        nxt200x_writebytes(state, 0x5C, buf, 2);
+        switch (state->demod_chip) {
+                case NXT2002:
+                        nxt200x_writereg_multibyte(state, 0x5C, buf, 2);
+                        break;
+                case NXT2004:
+                        nxt200x_writebytes(state, 0x5C, buf, 2);
+                        break;
+                default:
+                        return -EINVAL;
+                        break;
+        }
 
         /* write adc power lpf fc */
         buf[0] = 0x05;
@@ -648,7 +669,17 @@ static int nxt200x_setup_frontend_parameters (struct dvb_frontend* fe,
         /* write accumulator2 input */
         buf[0] = 0x80;
         buf[1] = 0x00;
-        nxt200x_writebytes(state, 0x4B, buf, 2);
+        switch (state->demod_chip) {
+                case NXT2002:
+                        nxt200x_writereg_multibyte(state, 0x4B, buf, 2);
+                        break;
+                case NXT2004:
+                        nxt200x_writebytes(state, 0x4B, buf, 2);
+                        break;
+                default:
+                        return -EINVAL;
+                        break;
+        }
 
         /* write kg1 */
         buf[0] = 0x00;
@@ -714,8 +745,19 @@ static int nxt200x_setup_frontend_parameters (struct dvb_frontend* fe,
         /* write accumulator2 input */
         buf[0] = 0x80;
         buf[1] = 0x00;
-        nxt200x_writebytes(state, 0x49, buf,2);
-        nxt200x_writebytes(state, 0x4B, buf,2);
+        switch (state->demod_chip) {
+                case NXT2002:
+                        nxt200x_writereg_multibyte(state, 0x49, buf, 2);
+                        nxt200x_writereg_multibyte(state, 0x4B, buf, 2);
+                        break;
+                case NXT2004:
+                        nxt200x_writebytes(state, 0x49, buf, 2);
+                        nxt200x_writebytes(state, 0x4B, buf, 2);
+                        break;
+                default:
+                        return -EINVAL;
+                        break;
+        }
 
         /* write agc control reg */
         buf[0] = 0x04;
@@ -1199,7 +1241,7 @@ module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
 
 MODULE_DESCRIPTION("NXT200X (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
-MODULE_AUTHOR("Kirk Lapray, Jean-Francois Thibert, and Taylor Jacob");
+MODULE_AUTHOR("Kirk Lapray, Michael Krufky, Jean-Francois Thibert, and Taylor Jacob");
 MODULE_LICENSE("GPL");
 
 EXPORT_SYMBOL(nxt200x_attach);
diff --git a/drivers/media/dvb/frontends/stv0297.c b/drivers/media/dvb/frontends/stv0297.c
index 6122ba754bc5..eb15676d374f 100644
--- a/drivers/media/dvb/frontends/stv0297.c
+++ b/drivers/media/dvb/frontends/stv0297.c
@@ -393,10 +393,6 @@ static int stv0297_set_frontend(struct dvb_frontend *fe, struct dvb_frontend_par
                 break;
 
         case QAM_128:
-                delay = 150;
-                sweeprate = 1000;
-                break;
-
         case QAM_256:
                 delay = 200;
                 sweeprate = 500;
diff --git a/drivers/media/dvb/frontends/tda80xx.c b/drivers/media/dvb/frontends/tda80xx.c
deleted file mode 100644
index d1cabb6a0a13..000000000000
--- a/drivers/media/dvb/frontends/tda80xx.c
+++ /dev/null
@@ -1,734 +0,0 @@
-/*
- * tda80xx.c
- *
- * Philips TDA8044 / TDA8083 QPSK demodulator driver
- *
- * Copyright (C) 2001 Felix Domke <tmbinc@elitedvb.net>
- * Copyright (C) 2002-2004 Andreas Oberritter <obi@linuxtv.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include <linux/config.h>
-#include <linux/delay.h>
-#include <linux/init.h>
-#include <linux/spinlock.h>
-#include <linux/threads.h>
-#include <linux/interrupt.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <asm/irq.h>
-#include <asm/div64.h>
-
-#include "dvb_frontend.h"
-#include "tda80xx.h"
-
-enum {
-        ID_TDA8044 = 0x04,
-        ID_TDA8083 = 0x05,
-};
-
-
-struct tda80xx_state {
-
-        struct i2c_adapter* i2c;
-
-        struct dvb_frontend_ops ops;
-
-        /* configuration settings */
-        const struct tda80xx_config* config;
-
-        struct dvb_frontend frontend;
-
-        u32 clk;
-        int afc_loop;
-        struct work_struct worklet;
-        fe_code_rate_t code_rate;
-        fe_spectral_inversion_t spectral_inversion;
-        fe_status_t status;
-        u8 id;
-};
-
-static int debug = 1;
-#define dprintk if (debug) printk
-
-static u8 tda8044_inittab_pre[] = {
-        0x02, 0x00, 0x6f, 0xb5, 0x86, 0x22, 0x00, 0xea,
-        0x30, 0x42, 0x98, 0x68, 0x70, 0x42, 0x99, 0x58,
-        0x95, 0x10, 0xf5, 0xe7, 0x93, 0x0b, 0x15, 0x68,
-        0x9a, 0x90, 0x61, 0x80, 0x00, 0xe0, 0x40, 0x00,
-        0x0f, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00
-};
-
-static u8 tda8044_inittab_post[] = {
-        0x04, 0x00, 0x6f, 0xb5, 0x86, 0x22, 0x00, 0xea,
-        0x30, 0x42, 0x98, 0x68, 0x70, 0x42, 0x99, 0x50,
-        0x95, 0x10, 0xf5, 0xe7, 0x93, 0x0b, 0x15, 0x68,
-        0x9a, 0x90, 0x61, 0x80, 0x00, 0xe0, 0x40, 0x6c,
-        0x0f, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00
-};
-
-static u8 tda8083_inittab[] = {
-        0x04, 0x00, 0x4a, 0x79, 0x04, 0x00, 0xff, 0xea,
-        0x48, 0x42, 0x79, 0x60, 0x70, 0x52, 0x9a, 0x10,
-        0x0e, 0x10, 0xf2, 0xa7, 0x93, 0x0b, 0x05, 0xc8,
-        0x9d, 0x00, 0x42, 0x80, 0x00, 0x60, 0x40, 0x00,
-        0x00, 0x75, 0x00, 0xe0, 0x00, 0x00, 0x00, 0x00,
-        0x00, 0x00, 0x00, 0x00
-};
-
-static __inline__ u32 tda80xx_div(u32 a, u32 b)
-{
-        return (a + (b / 2)) / b;
-}
-
-static __inline__ u32 tda80xx_gcd(u32 a, u32 b)
-{
-        u32 r;
-
-        while ((r = a % b)) {
-                a = b;
-                b = r;
-        }
-
-        return b;
-}
-
-static int tda80xx_read(struct tda80xx_state* state, u8 reg, u8 *buf, u8 len)
-{
-        int ret;
-        struct i2c_msg msg[] = { { .addr = state->config->demod_address, .flags = 0, .buf = &reg, .len = 1 },
-                          { .addr = state->config->demod_address, .flags = I2C_M_RD, .buf = buf, .len = len } };
-
-        ret = i2c_transfer(state->i2c, msg, 2);
-
-        if (ret != 2)
-                dprintk("%s: readreg error (reg %02x, ret == %i)\n",
-                                __FUNCTION__, reg, ret);
-
-        mdelay(10);
-
-        return (ret == 2) ? 0 : -EREMOTEIO;
-}
-
-static int tda80xx_write(struct tda80xx_state* state, u8 reg, const u8 *buf, u8 len)
-{
-        int ret;
-        u8 wbuf[len + 1];
-        struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, .buf = wbuf, .len = len + 1 };
-
-        wbuf[0] = reg;
-        memcpy(&wbuf[1], buf, len);
-
-        ret = i2c_transfer(state->i2c, &msg, 1);
-
-        if (ret != 1)
-                dprintk("%s: i2c xfer error (ret == %i)\n", __FUNCTION__, ret);
-
-        mdelay(10);
-
-        return (ret == 1) ? 0 : -EREMOTEIO;
-}
-
-static __inline__ u8 tda80xx_readreg(struct tda80xx_state* state, u8 reg)
-{
-        u8 val;
-
-        tda80xx_read(state, reg, &val, 1);
-
-        return val;
-}
-
-static __inline__ int tda80xx_writereg(struct tda80xx_state* state, u8 reg, u8 data)
-{
-        return tda80xx_write(state, reg, &data, 1);
-}
-
-static int tda80xx_set_parameters(struct tda80xx_state* state,
-                                  fe_spectral_inversion_t inversion,
-                                  u32 symbol_rate,
-                                  fe_code_rate_t fec_inner)
-{
-        u8 buf[15];
-        u64 ratio;
-        u32 clk;
-        u32 k;
-        u32 sr = symbol_rate;
-        u32 gcd;
-        u8 scd;
-
-        if (symbol_rate > (state->clk * 3) / 16)
-                scd = 0;
-        else if (symbol_rate > (state->clk * 3) / 32)
-                scd = 1;
-        else if (symbol_rate > (state->clk * 3) / 64)
-                scd = 2;
-        else
-                scd = 3;
-
-        clk = scd ? (state->clk / (scd * 2)) : state->clk;
-
-        /*
-         * Viterbi decoder:
-         * Differential decoding off
-         * Spectral inversion unknown
-         * QPSK modulation
-         */
-        if (inversion == INVERSION_ON)
-                buf[0] = 0x60;
-        else if (inversion == INVERSION_OFF)
-                buf[0] = 0x20;
-        else
-                buf[0] = 0x00;
-
-        /*
-         * CLK ratio:
-         * system clock frequency is up to 64 or 96 MHz
-         *
-         * formula:
-         * r = k * clk / symbol_rate
-         *
-         * k:   2^21 for caa 0..3,
-         *      2^20 for caa 4..5,
-         *      2^19 for caa 6..7
-         */
-        if (symbol_rate <= (clk * 3) / 32)
-                k = (1 << 19);
-        else if (symbol_rate <= (clk * 3) / 16)
-                k = (1 << 20);
-        else
-                k = (1 << 21);
-
-        gcd = tda80xx_gcd(clk, sr);
-        clk /= gcd;
-        sr /= gcd;
-
-        gcd = tda80xx_gcd(k, sr);
-        k /= gcd;
-        sr /= gcd;
-
-        ratio = (u64)k * (u64)clk;
-        do_div(ratio, sr);
-
-        buf[1] = ratio >> 16;
-        buf[2] = ratio >> 8;
-        buf[3] = ratio;
-
-        /* nyquist filter roll-off factor 35% */
-        buf[4] = 0x20;
-
-        clk = scd ? (state->clk / (scd * 2)) : state->clk;
-
-        /* Anti Alias Filter */
-        if (symbol_rate < (clk * 3) / 64)
-                printk("tda80xx: unsupported symbol rate: %u\n", symbol_rate);
-        else if (symbol_rate <= clk / 16)
-                buf[4] |= 0x07;
-        else if (symbol_rate <= (clk * 3) / 32)
-                buf[4] |= 0x06;
-        else if (symbol_rate <= clk / 8)
-                buf[4] |= 0x05;
-        else if (symbol_rate <= (clk * 3) / 16)
-                buf[4] |= 0x04;
-        else if (symbol_rate <= clk / 4)
-                buf[4] |= 0x03;
-        else if (symbol_rate <= (clk * 3) / 8)
-                buf[4] |= 0x02;
-        else if (symbol_rate <= clk / 2)
-                buf[4] |= 0x01;
-        else
-                buf[4] |= 0x00;
-
-        /* Sigma Delta converter */
-        buf[5] = 0x00;
-
-        /* FEC: Possible puncturing rates */
-        if (fec_inner == FEC_NONE)
-                buf[6] = 0x00;
-        else if ((fec_inner >= FEC_1_2) && (fec_inner <= FEC_8_9))
-                buf[6] = (1 << (8 - fec_inner));
-        else if (fec_inner == FEC_AUTO)
-                buf[6] = 0xff;
-        else
-                return -EINVAL;
-
-        /* carrier lock detector threshold value */
-        buf[7] = 0x30;
-        /* AFC1: proportional part settings */
-        buf[8] = 0x42;
-        /* AFC1: integral part settings */
-        buf[9] = 0x98;
-        /* PD: Leaky integrator SCPC mode */
-        buf[10] = 0x28;
-        /* AFC2, AFC1 controls */
-        buf[11] = 0x30;
-        /* PD: proportional part settings */
-        buf[12] = 0x42;
-        /* PD: integral part settings */
-        buf[13] = 0x99;
-        /* AGC */
-        buf[14] = 0x50 | scd;
-
-        printk("symbol_rate=%u clk=%u\n", symbol_rate, clk);
-
-        return tda80xx_write(state, 0x01, buf, sizeof(buf));
-}
-
-static int tda80xx_set_clk(struct tda80xx_state* state)
-{
-        u8 buf[2];
-
-        /* CLK proportional part */
-        buf[0] = (0x06 << 5) | 0x08;    /* CMP[2:0], CSP[4:0] */
-        /* CLK integral part */
-        buf[1] = (0x04 << 5) | 0x1a;    /* CMI[2:0], CSI[4:0] */
-
-        return tda80xx_write(state, 0x17, buf, sizeof(buf));
-}
-
-#if 0
-static int tda80xx_set_scpc_freq_offset(struct tda80xx_state* state)
-{
-        /* a constant value is nonsense here imho */
-        return tda80xx_writereg(state, 0x22, 0xf9);
-}
-#endif
-
-static int tda80xx_close_loop(struct tda80xx_state* state)
-{
-        u8 buf[2];
-
-        /* PD: Loop closed, LD: lock detect enable, SCPC: Sweep mode - AFC1 loop closed */
-        buf[0] = 0x68;
-        /* AFC1: Loop closed, CAR Feedback: 8192 */
-        buf[1] = 0x70;
-
-        return tda80xx_write(state, 0x0b, buf, sizeof(buf));
-}
-
-static irqreturn_t tda80xx_irq(int irq, void *priv, struct pt_regs *pt)
-{
-        schedule_work(priv);
-
-        return IRQ_HANDLED;
-}
-
-static void tda80xx_read_status_int(struct tda80xx_state* state)
-{
-        u8 val;
-
-        static const fe_spectral_inversion_t inv_tab[] = {
-                INVERSION_OFF, INVERSION_ON
-        };
-
-        static const fe_code_rate_t fec_tab[] = {
-                FEC_8_9, FEC_1_2, FEC_2_3, FEC_3_4,
-                FEC_4_5, FEC_5_6, FEC_6_7, FEC_7_8,
-        };
-
-        val = tda80xx_readreg(state, 0x02);
-
-        state->status = 0;
-
-        if (val & 0x01) /* demodulator lock */
-                state->status |= FE_HAS_SIGNAL;
-        if (val & 0x02) /* clock recovery lock */
-                state->status |= FE_HAS_CARRIER;
-        if (val & 0x04) /* viterbi lock */
-                state->status |= FE_HAS_VITERBI;
-        if (val & 0x08) /* deinterleaver lock (packet sync) */
-                state->status |= FE_HAS_SYNC;
-        if (val & 0x10) /* derandomizer lock (frame sync) */
-                state->status |= FE_HAS_LOCK;
-        if (val & 0x20) /* frontend can not lock */
-                state->status |= FE_TIMEDOUT;
-
-        if ((state->status & (FE_HAS_CARRIER)) && (state->afc_loop)) {
-                printk("tda80xx: closing loop\n");
-                tda80xx_close_loop(state);
-                state->afc_loop = 0;
-        }
-
-        if (state->status & (FE_HAS_VITERBI | FE_HAS_SYNC | FE_HAS_LOCK)) {
-                val = tda80xx_readreg(state, 0x0e);
-                state->code_rate = fec_tab[val & 0x07];
-                if (state->status & (FE_HAS_SYNC | FE_HAS_LOCK))
-                        state->spectral_inversion = inv_tab[(val >> 7) & 0x01];
-                else
-                        state->spectral_inversion = INVERSION_AUTO;
-        }
-        else {
-                state->code_rate = FEC_AUTO;
-        }
-}
-
-static void tda80xx_worklet(void *priv)
-{
-        struct tda80xx_state *state = priv;
-
-        tda80xx_writereg(state, 0x00, 0x04);
-        enable_irq(state->config->irq);
-
-        tda80xx_read_status_int(state);
-}
-
-static void tda80xx_wait_diseqc_fifo(struct tda80xx_state* state)
-{
-        size_t i;
-
-        for (i = 0; i < 100; i++) {
-                if (tda80xx_readreg(state, 0x02) & 0x80)
-                        break;
-                msleep(10);
-        }
-}
-
-static int tda8044_init(struct dvb_frontend* fe)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-        int ret;
-
-        /*
-         * this function is a mess...
-         */
-
-        if ((ret = tda80xx_write(state, 0x00, tda8044_inittab_pre, sizeof(tda8044_inittab_pre))))
-                return ret;
-
-        tda80xx_writereg(state, 0x0f, 0x50);
-#if 1
-        tda80xx_writereg(state, 0x20, 0x8F);            /* FIXME */
-        tda80xx_writereg(state, 0x20, state->config->volt18setting);    /* FIXME */
-        //tda80xx_writereg(state, 0x00, 0x04);
-        tda80xx_writereg(state, 0x00, 0x0C);
-#endif
-        //tda80xx_writereg(state, 0x00, 0x08); /* Reset AFC1 loop filter */
-
-        tda80xx_write(state, 0x00, tda8044_inittab_post, sizeof(tda8044_inittab_post));
-
-        if (state->config->pll_init) {
-                tda80xx_writereg(state, 0x1c, 0x80);
-                state->config->pll_init(fe);
-                tda80xx_writereg(state, 0x1c, 0x00);
-        }
-
-        return 0;
-}
-
-static int tda8083_init(struct dvb_frontend* fe)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        tda80xx_write(state, 0x00, tda8083_inittab, sizeof(tda8083_inittab));
-
-        if (state->config->pll_init) {
-                tda80xx_writereg(state, 0x1c, 0x80);
-                state->config->pll_init(fe);
-                tda80xx_writereg(state, 0x1c, 0x00);
-        }
-
-        return 0;
-}
-
-static int tda80xx_set_voltage(struct dvb_frontend* fe, fe_sec_voltage_t voltage)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        switch (voltage) {
-        case SEC_VOLTAGE_13:
-                return tda80xx_writereg(state, 0x20, state->config->volt13setting);
-        case SEC_VOLTAGE_18:
-                return tda80xx_writereg(state, 0x20, state->config->volt18setting);
-        case SEC_VOLTAGE_OFF:
-                return tda80xx_writereg(state, 0x20, 0);
-        default:
-                return -EINVAL;
-        }
-}
-
-static int tda80xx_set_tone(struct dvb_frontend* fe, fe_sec_tone_mode_t tone)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        switch (tone) {
-        case SEC_TONE_OFF:
-                return tda80xx_writereg(state, 0x29, 0x00);
-        case SEC_TONE_ON:
-                return tda80xx_writereg(state, 0x29, 0x80);
-        default:
-                return -EINVAL;
-        }
-}
-
-static int tda80xx_send_diseqc_msg(struct dvb_frontend* fe, struct dvb_diseqc_master_cmd *cmd)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        if (cmd->msg_len > 6)
-                return -EINVAL;
-
-        tda80xx_writereg(state, 0x29, 0x08 | (cmd->msg_len - 3));
-        tda80xx_write(state, 0x23, cmd->msg, cmd->msg_len);
-        tda80xx_writereg(state, 0x29, 0x0c | (cmd->msg_len - 3));
-        tda80xx_wait_diseqc_fifo(state);
-
-        return 0;
-}
-
-static int tda80xx_send_diseqc_burst(struct dvb_frontend* fe, fe_sec_mini_cmd_t cmd)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        switch (cmd) {
-        case SEC_MINI_A:
-                tda80xx_writereg(state, 0x29, 0x14);
-                break;
-        case SEC_MINI_B:
-                tda80xx_writereg(state, 0x29, 0x1c);
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        tda80xx_wait_diseqc_fifo(state);
-
-        return 0;
-}
-
-static int tda80xx_sleep(struct dvb_frontend* fe)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        tda80xx_writereg(state, 0x00, 0x02);    /* enter standby */
-
-        return 0;
-}
-
-static int tda80xx_set_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        tda80xx_writereg(state, 0x1c, 0x80);
-        state->config->pll_set(fe, p);
-        tda80xx_writereg(state, 0x1c, 0x00);
-
-        tda80xx_set_parameters(state, p->inversion, p->u.qpsk.symbol_rate, p->u.qpsk.fec_inner);
-        tda80xx_set_clk(state);
-        //tda80xx_set_scpc_freq_offset(state);
-        state->afc_loop = 1;
-
-        return 0;
-}
-
-static int tda80xx_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_parameters *p)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        if (!state->config->irq)
-                tda80xx_read_status_int(state);
-
-        p->inversion = state->spectral_inversion;
-        p->u.qpsk.fec_inner = state->code_rate;
-
-        return 0;
-}
-
-static int tda80xx_read_status(struct dvb_frontend* fe, fe_status_t* status)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        if (!state->config->irq)
-                tda80xx_read_status_int(state);
-        *status = state->status;
-
-        return 0;
-}
-
-static int tda80xx_read_ber(struct dvb_frontend* fe, u32* ber)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-        int ret;
-        u8 buf[3];
-
-        if ((ret = tda80xx_read(state, 0x0b, buf, sizeof(buf))))
-                return ret;
-
-        *ber = ((buf[0] & 0x1f) << 16) | (buf[1] << 8) | buf[2];
-
-        return 0;
-}
-
-static int tda80xx_read_signal_strength(struct dvb_frontend* fe, u16* strength)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        u8 gain = ~tda80xx_readreg(state, 0x01);
-        *strength = (gain << 8) | gain;
-
-        return 0;
-}
-
-static int tda80xx_read_snr(struct dvb_frontend* fe, u16* snr)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        u8 quality = tda80xx_readreg(state, 0x08);
-        *snr = (quality << 8) | quality;
-
-        return 0;
-}
-
-static int tda80xx_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        *ucblocks = tda80xx_readreg(state, 0x0f);
-        if (*ucblocks == 0xff)
-                *ucblocks = 0xffffffff;
-
-        return 0;
-}
-
-static int tda80xx_init(struct dvb_frontend* fe)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        switch(state->id) {
-        case ID_TDA8044:
-                return tda8044_init(fe);
-
-        case ID_TDA8083:
-                return tda8083_init(fe);
-        }
-        return 0;
-}
-
-static void tda80xx_release(struct dvb_frontend* fe)
-{
-        struct tda80xx_state* state = fe->demodulator_priv;
-
-        if (state->config->irq)
-                free_irq(state->config->irq, &state->worklet);
-
-        kfree(state);
-}
-
-static struct dvb_frontend_ops tda80xx_ops;
-
-struct dvb_frontend* tda80xx_attach(const struct tda80xx_config* config,
-                                    struct i2c_adapter* i2c)
-{
-        struct tda80xx_state* state = NULL;
-        int ret;
-
-        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda80xx_state), GFP_KERNEL);
-        if (state == NULL) goto error;
-
-        /* setup the state */
-        state->config = config;
-        state->i2c = i2c;
-        memcpy(&state->ops, &tda80xx_ops, sizeof(struct dvb_frontend_ops));
-        state->spectral_inversion = INVERSION_AUTO;
-        state->code_rate = FEC_AUTO;
-        state->status = 0;
-        state->afc_loop = 0;
-
-        /* check if the demod is there */
-        if (tda80xx_writereg(state, 0x89, 0x00) < 0) goto error;
-        state->id = tda80xx_readreg(state, 0x00);
-
-        switch (state->id) {
-        case ID_TDA8044:
-                state->clk = 96000000;
-                printk("tda80xx: Detected tda8044\n");
-                break;
-
-        case ID_TDA8083:
-                state->clk = 64000000;
-                printk("tda80xx: Detected tda8083\n");
-                break;
-
-        default:
-                goto error;
-        }
-
-        /* setup IRQ */
-        if (state->config->irq) {
-                INIT_WORK(&state->worklet, tda80xx_worklet, state);
-                if ((ret = request_irq(state->config->irq, tda80xx_irq, SA_ONESHOT, "tda80xx", &state->worklet)) < 0) {
-                        printk(KERN_ERR "tda80xx: request_irq failed (%d)\n", ret);
-                        goto error;
-                }
-        }
-
-        /* create dvb_frontend */
-        state->frontend.ops = &state->ops;
-        state->frontend.demodulator_priv = state;
-        return &state->frontend;
-
-error:
-        kfree(state);
-        return NULL;
-}
-
-static struct dvb_frontend_ops tda80xx_ops = {
-
-        .info = {
-                .name = "Philips TDA80xx DVB-S",
-                .type = FE_QPSK,
-                .frequency_min = 500000,
-                .frequency_max = 2700000,
-                .frequency_stepsize = 125,
-                .symbol_rate_min = 4500000,
-                .symbol_rate_max = 45000000,
-                .caps = FE_CAN_INVERSION_AUTO |
-                        FE_CAN_FEC_1_2 | FE_CAN_FEC_2_3 | FE_CAN_FEC_3_4 |
-                        FE_CAN_FEC_4_5 | FE_CAN_FEC_5_6 | FE_CAN_FEC_6_7 |
-                        FE_CAN_FEC_7_8 | FE_CAN_FEC_8_9 | FE_CAN_FEC_AUTO |
-                        FE_CAN_QPSK |
-                        FE_CAN_MUTE_TS
-        },
-
-        .release = tda80xx_release,
-
-        .init = tda80xx_init,
-        .sleep = tda80xx_sleep,
-
-        .set_frontend = tda80xx_set_frontend,
-        .get_frontend = tda80xx_get_frontend,
-
-        .read_status = tda80xx_read_status,
-        .read_ber = tda80xx_read_ber,
-        .read_signal_strength = tda80xx_read_signal_strength,
-        .read_snr = tda80xx_read_snr,
-        .read_ucblocks = tda80xx_read_ucblocks,
-
-        .diseqc_send_master_cmd = tda80xx_send_diseqc_msg,
-        .diseqc_send_burst = tda80xx_send_diseqc_burst,
-        .set_tone = tda80xx_set_tone,
-        .set_voltage = tda80xx_set_voltage,
-};
-
-module_param(debug, int, 0644);
-
-MODULE_DESCRIPTION("Philips TDA8044 / TDA8083 DVB-S Demodulator driver");
-MODULE_AUTHOR("Felix Domke, Andreas Oberritter");
-MODULE_LICENSE("GPL");
-
-EXPORT_SYMBOL(tda80xx_attach);
diff --git a/drivers/media/dvb/frontends/tda80xx.h b/drivers/media/dvb/frontends/tda80xx.h
deleted file mode 100644
index cd639a0aad55..000000000000
--- a/drivers/media/dvb/frontends/tda80xx.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * tda80xx.c
- *
- * Philips TDA8044 / TDA8083 QPSK demodulator driver
- *
- * Copyright (C) 2001 Felix Domke <tmbinc@elitedvb.net>
- * Copyright (C) 2002-2004 Andreas Oberritter <obi@linuxtv.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#ifndef TDA80XX_H
-#define TDA80XX_H
-
-#include <linux/dvb/frontend.h>
-
-struct tda80xx_config
-{
-        /* the demodulator's i2c address */
-        u8 demod_address;
-
-        /* IRQ to use (0=>no IRQ used) */
-        u32 irq;
-
-        /* Register setting to use for 13v */
-        u8 volt13setting;
-
-        /* Register setting to use for 18v */
-        u8 volt18setting;
-
-        /* PLL maintenance */
-        int (*pll_init)(struct dvb_frontend* fe);
-        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params);
-};
-
-extern struct dvb_frontend* tda80xx_attach(const struct tda80xx_config* config,
-                                           struct i2c_adapter* i2c);
-
-#endif // TDA80XX_H
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 27494901975f..7c6ccb96b157 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -1439,7 +1439,7 @@ static int check_firmware(struct av7110* av7110)
         len = ntohl(*(u32*) ptr);
         ptr += 4;
         if (len >= 512) {
-                printk("dvb-ttpci: dpram file is way to big.\n");
+                printk("dvb-ttpci: dpram file is way too big.\n");
                 return -EINVAL;
         }
         if (crc != crc32_le(0, ptr, len)) {
@@ -2329,6 +2329,17 @@ static int frontend_init(struct av7110 *av7110)
                         av7110->fe = ves1820_attach(&alps_tdbe2_config, &av7110->i2c_adap, read_pwm(av7110));
                         break;
 
+                case 0x0004: // Galaxis DVB-S rev1.3
+                        /* ALPS BSRV2 */
+                        av7110->fe = ves1x93_attach(&alps_bsrv2_config, &av7110->i2c_adap);
+                        if (av7110->fe) {
+                                av7110->fe->ops->diseqc_send_master_cmd = av7110_diseqc_send_master_cmd;
+                                av7110->fe->ops->diseqc_send_burst = av7110_diseqc_send_burst;
+                                av7110->fe->ops->set_tone = av7110_set_tone;
+                                av7110->recover = dvb_s_recover;
+                        }
+                        break;
+
                 case 0x0006: /* Fujitsu-Siemens DVB-S rev 1.6 */
                         /* Grundig 29504-451 */
                         av7110->fe = tda8083_attach(&grundig_29504_451_config, &av7110->i2c_adap);
@@ -2466,7 +2477,8 @@ static int frontend_init(struct av7110 *av7110)
  * The same behaviour of missing VSYNC can be duplicated on budget
  * cards, by seting DD1_INIT trigger mode 7 in 3rd nibble.
  */
-static int av7110_attach(struct saa7146_dev* dev, struct saa7146_pci_extension_data *pci_ext)
+static int __devinit av7110_attach(struct saa7146_dev* dev,
+                                   struct saa7146_pci_extension_data *pci_ext)
 {
         const int length = TS_WIDTH * TS_HEIGHT;
         struct pci_dev *pdev = dev->pci;
@@ -2816,7 +2828,7 @@ err_kfree_0:
         goto out;
 }
 
-static int av7110_detach(struct saa7146_dev* saa)
+static int __devexit av7110_detach(struct saa7146_dev* saa)
 {
         struct av7110 *av7110 = saa->ext_priv;
         dprintk(4, "%p\n", av7110);
@@ -2930,6 +2942,7 @@ MAKE_AV7110_INFO(tts_1_3se,  "Technotrend/Hauppauge WinTV DVB-S rev1.3 SE");
 MAKE_AV7110_INFO(ttt,        "Technotrend/Hauppauge DVB-T");
 MAKE_AV7110_INFO(fsc,        "Fujitsu Siemens DVB-C");
 MAKE_AV7110_INFO(fss,        "Fujitsu Siemens DVB-S rev1.6");
+MAKE_AV7110_INFO(gxs_1_3,    "Galaxis DVB-S rev1.3");
 
 static struct pci_device_id pci_tbl[] = {
         MAKE_EXTENSION_PCI(fsc,         0x110a, 0x0000),
@@ -2937,13 +2950,13 @@ static struct pci_device_id pci_tbl[] = {
         MAKE_EXTENSION_PCI(ttt_1_X,     0x13c2, 0x0001),
         MAKE_EXTENSION_PCI(ttc_2_X,     0x13c2, 0x0002),
         MAKE_EXTENSION_PCI(tts_2_X,     0x13c2, 0x0003),
+        MAKE_EXTENSION_PCI(gxs_1_3,     0x13c2, 0x0004),
         MAKE_EXTENSION_PCI(fss,         0x13c2, 0x0006),
         MAKE_EXTENSION_PCI(ttt,         0x13c2, 0x0008),
         MAKE_EXTENSION_PCI(ttc_1_X,     0x13c2, 0x000a),
         MAKE_EXTENSION_PCI(tts_2_3,     0x13c2, 0x000e),
         MAKE_EXTENSION_PCI(tts_1_3se,   0x13c2, 0x1002),
 
-/*      MAKE_EXTENSION_PCI(???, 0x13c2, 0x0004), UNDEFINED CARD */ // Galaxis DVB PC-Sat-Carte
 /*      MAKE_EXTENSION_PCI(???, 0x13c2, 0x0005), UNDEFINED CARD */ // Technisat SkyStar1
 /*      MAKE_EXTENSION_PCI(???, 0x13c2, 0x0009), UNDEFINED CARD */ // TT/Hauppauge WinTV Nexus-CA v????
 
@@ -2962,7 +2975,7 @@ static struct saa7146_extension av7110_extension = {
         .module         = THIS_MODULE,
         .pci_tbl        = &pci_tbl[0],
         .attach         = av7110_attach,
-        .detach         = av7110_detach,
+        .detach         = __devexit_p(av7110_detach),
 
         .irq_mask       = MASK_19 | MASK_03 | MASK_10,
         .irq_func       = av7110_irq,
diff --git a/drivers/media/dvb/ttpci/av7110.h b/drivers/media/dvb/ttpci/av7110.h
index 6ea30df2e823..fafd25fab835 100644
--- a/drivers/media/dvb/ttpci/av7110.h
+++ b/drivers/media/dvb/ttpci/av7110.h
@@ -273,8 +273,6 @@ struct av7110 {
 extern int ChangePIDs(struct av7110 *av7110, u16 vpid, u16 apid, u16 ttpid,
                        u16 subpid, u16 pcrpid);
 
-extern int av7110_setup_irc_config (struct av7110 *av7110, u32 ir_config);
-
 extern int av7110_ir_init(struct av7110 *av7110);
 extern void av7110_ir_exit(struct av7110 *av7110);
 
diff --git a/drivers/media/dvb/ttpci/av7110_hw.c b/drivers/media/dvb/ttpci/av7110_hw.c
index b2e63e9fc053..0bb6e74ae7f0 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.c
+++ b/drivers/media/dvb/ttpci/av7110_hw.c
@@ -245,6 +245,9 @@ int av7110_bootarm(struct av7110 *av7110)
 
         /* test DEBI */
         iwdebi(av7110, DEBISWAP, DPRAM_BASE, 0x76543210, 4);
+        /* FIXME: Why does Nexus CA require 2x iwdebi for first init? */
+        iwdebi(av7110, DEBISWAP, DPRAM_BASE, 0x76543210, 4);
+
         if ((ret=irdebi(av7110, DEBINOSWAP, DPRAM_BASE, 0, 4)) != 0x10325476) {
                 printk(KERN_ERR "dvb-ttpci: debi test in av7110_bootarm() failed: "
                        "%08x != %08x (check your BIOS 'Plug&Play OS' settings)\n",
diff --git a/drivers/media/dvb/ttpci/av7110_ir.c b/drivers/media/dvb/ttpci/av7110_ir.c
index 9138132ad25f..d54bbcdde2cc 100644
--- a/drivers/media/dvb/ttpci/av7110_ir.c
+++ b/drivers/media/dvb/ttpci/av7110_ir.c
@@ -155,6 +155,19 @@ static void input_repeat_key(unsigned long data)
 }
 
 
+static int av7110_setup_irc_config(struct av7110 *av7110, u32 ir_config)
+{
+        int ret = 0;
+
+        dprintk(4, "%p\n", av7110);
+        if (av7110) {
+                ret = av7110_fw_cmd(av7110, COMTYPE_PIDFILTER, SetIR, 1, ir_config);
+                av7110->ir_config = ir_config;
+        }
+        return ret;
+}
+
+
 static int av7110_ir_write_proc(struct file *file, const char __user *buffer,
                                 unsigned long count, void *data)
 {
@@ -187,19 +200,6 @@ static int av7110_ir_write_proc(struct file *file, const char __user *buffer,
 }
 
 
-int av7110_setup_irc_config(struct av7110 *av7110, u32 ir_config)
-{
-        int ret = 0;
-
-        dprintk(4, "%p\n", av7110);
-        if (av7110) {
-                ret = av7110_fw_cmd(av7110, COMTYPE_PIDFILTER, SetIR, 1, ir_config);
-                av7110->ir_config = ir_config;
-        }
-        return ret;
-}
-
-
 static void ir_handler(struct av7110 *av7110, u32 ircom)
 {
         dprintk(4, "ircommand = %08x\n", ircom);
@@ -208,7 +208,7 @@ static void ir_handler(struct av7110 *av7110, u32 ircom)
 }
 
 
-int __init av7110_ir_init(struct av7110 *av7110)
+int __devinit av7110_ir_init(struct av7110 *av7110)
 {
         static struct proc_dir_entry *e;
 
@@ -248,7 +248,7 @@ int __init av7110_ir_init(struct av7110 *av7110)
 }
 
 
-void __exit av7110_ir_exit(struct av7110 *av7110)
+void __devexit av7110_ir_exit(struct av7110 *av7110)
 {
         int i;
 
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c
index aa4c4c521880..578b20085082 100644
--- a/drivers/media/video/bttv-driver.c
+++ b/drivers/media/video/bttv-driver.c
@@ -214,7 +214,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
                    we can capture, of the first and second field. */
                 .vbistart       = { 7,320 },
         },{
-                .v4l2_id        = V4L2_STD_NTSC_M,
+                .v4l2_id        = V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR,
                 .name           = "NTSC",
                 .Fsc            = 28636363,
                 .swidth         = 768,
diff --git a/drivers/media/video/compat_ioctl32.c b/drivers/media/video/compat_ioctl32.c
index 297c32ab51e3..840fe0177121 100644
--- a/drivers/media/video/compat_ioctl32.c
+++ b/drivers/media/video/compat_ioctl32.c
@@ -167,29 +167,32 @@ static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
         if (kp->clipcount > 2048)
                 return -EINVAL;
         if (kp->clipcount) {
-                struct v4l2_clip32 *uclips = compat_ptr(up->clips);
-                struct v4l2_clip *kclips;
+                struct v4l2_clip32 __user *uclips;
+                struct v4l2_clip __user *kclips;
                 int n = kp->clipcount;
+                compat_caddr_t p;
 
+                if (get_user(p, &up->clips))
+                        return -EFAULT;
+                uclips = compat_ptr(p);
                 kclips = compat_alloc_user_space(n * sizeof(struct v4l2_clip));
                 kp->clips = kclips;
                 while (--n >= 0) {
-                        if (!access_ok(VERIFY_READ, &uclips->c, sizeof(uclips->c)) ||
-                                copy_from_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
+                        if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c)))
+                                return -EFAULT;
+                        if (put_user(n ? kclips + 1 : NULL, &kclips->next))
                                 return -EFAULT;
-                        kclips->next = n ? kclips + 1 : 0;
                         uclips += 1;
                         kclips += 1;
                 }
         } else
-                kp->clips = 0;
+                kp->clips = NULL;
         return 0;
 }
 
 static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_window32)) ||
-                copy_to_user(&up->w, &kp->w, sizeof(up->w)) ||
+        if (copy_to_user(&up->w, &kp->w, sizeof(up->w)) ||
                 put_user(kp->field, &up->field) ||
                 put_user(kp->chromakey, &up->chromakey) ||
                 put_user(kp->clipcount, &up->clipcount))
@@ -199,33 +202,29 @@ static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user
 
 static inline int get_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_pix_format)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_pix_format)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_pix_format)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_pix_format)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_pix_format)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_pix_format)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int get_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_vbi_format)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_vbi_format)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_vbi_format)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_vbi_format)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_vbi_format)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_vbi_format)))
+                return -EFAULT;
         return 0;
 }
 
@@ -279,18 +278,16 @@ static int put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user
 
 static inline int get_v4l2_standard(struct v4l2_standard *kp, struct v4l2_standard __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_standard)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_standard)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_standard)))
+                return -EFAULT;
         return 0;
 
 }
 
 static inline int put_v4l2_standard(struct v4l2_standard *kp, struct v4l2_standard __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_standard)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_standard)))
+                return -EFAULT;
         return 0;
 }
 
@@ -328,18 +325,16 @@ static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32
 
 static inline int get_v4l2_tuner(struct v4l2_tuner *kp, struct v4l2_tuner __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_tuner)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_tuner)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_tuner)))
+                return -EFAULT;
         return 0;
 
 }
 
 static inline int put_v4l2_tuner(struct v4l2_tuner *kp, struct v4l2_tuner __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_tuner)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_tuner)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_tuner)))
+                return -EFAULT;
         return 0;
 }
 
@@ -380,11 +375,13 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
                 break;
         case V4L2_MEMORY_USERPTR:
                 {
-                unsigned long tmp = (unsigned long)compat_ptr(up->m.userptr);
+                compat_long_t tmp;
 
-                if(get_user(kp->length, &up->length) ||
-                        get_user(kp->m.userptr, &tmp))
-                                return -EFAULT;
+                if (get_user(kp->length, &up->length) ||
+                    get_user(tmp, &up->m.userptr))
+                        return -EFAULT;
+
+                kp->m.userptr = (unsigned long)compat_ptr(tmp);
                 }
                 break;
         case V4L2_MEMORY_OVERLAY:
@@ -468,33 +465,29 @@ static int put_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
 
 static inline int get_v4l2_input32(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_input) - 4) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_input) - 4))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_input) - 4))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_input32(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_input) - 4) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_input) - 4))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_input) - 4))
+                return -EFAULT;
         return 0;
 }
 
 static inline int get_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_input)) ||
-                copy_from_user(kp, up, sizeof(struct v4l2_input)))
-                        return -EFAULT;
+        if (copy_from_user(kp, up, sizeof(struct v4l2_input)))
+                return -EFAULT;
         return 0;
 }
 
 static inline int put_v4l2_input(struct v4l2_input *kp, struct v4l2_input __user *up)
 {
-        if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_input)) ||
-                copy_to_user(up, kp, sizeof(struct v4l2_input)))
-                        return -EFAULT;
+        if (copy_to_user(up, kp, sizeof(struct v4l2_input)))
+                return -EFAULT;
         return 0;
 }
 
diff --git a/drivers/media/video/cpia.c b/drivers/media/video/cpia.c
index 9f59541155d9..85d964b5b33c 100644
--- a/drivers/media/video/cpia.c
+++ b/drivers/media/video/cpia.c
@@ -3369,7 +3369,7 @@ static int cpia_do_ioctl(struct inode *inode, struct file *file,
         //DBG("cpia_ioctl: %u\n", ioctlnr);
 
         switch (ioctlnr) {
-        /* query capabilites */
+        /* query capabilities */
         case VIDIOCGCAP:
         {
                 struct video_capability *b = arg;
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index c66c2c1f4809..5588b9a5c430 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -220,33 +220,23 @@ static void input_change(struct i2c_client *client)
                 cx25840_write(client, 0x808, 0xff);
                 cx25840_write(client, 0x80b, 0x10);
         } else if (std & V4L2_STD_NTSC) {
-                /* NTSC */
-                if (state->pvr150_workaround) {
-                        /* Certain Hauppauge PVR150 models have a hardware bug
-                           that causes audio to drop out. For these models the
-                           audio standard must be set explicitly.
-                           To be precise: it affects cards with tuner models
-                           85, 99 and 112 (model numbers from tveeprom). */
-                        if (std == V4L2_STD_NTSC_M_JP) {
-                                /* Japan uses EIAJ audio standard */
-                                cx25840_write(client, 0x808, 0x2f);
-                        } else {
-                                /* Others use the BTSC audio standard */
-                                cx25840_write(client, 0x808, 0x1f);
-                        }
-                        /* South Korea uses the A2-M (aka Zweiton M) audio
-                           standard, and should set 0x808 to 0x3f, but I don't
-                           know how to detect this. */
-                } else if (std == V4L2_STD_NTSC_M_JP) {
+                /* Certain Hauppauge PVR150 models have a hardware bug
+                   that causes audio to drop out. For these models the
+                   audio standard must be set explicitly.
+                   To be precise: it affects cards with tuner models
+                   85, 99 and 112 (model numbers from tveeprom). */
+                int hw_fix = state->pvr150_workaround;
+
+                if (std == V4L2_STD_NTSC_M_JP) {
                         /* Japan uses EIAJ audio standard */
-                        cx25840_write(client, 0x808, 0xf7);
+                        cx25840_write(client, 0x808, hw_fix ? 0x2f : 0xf7);
+                } else if (std == V4L2_STD_NTSC_M_KR) {
+                        /* South Korea uses A2 audio standard */
+                        cx25840_write(client, 0x808, hw_fix ? 0x3f : 0xf8);
                 } else {
                         /* Others use the BTSC audio standard */
-                        cx25840_write(client, 0x808, 0xf6);
+                        cx25840_write(client, 0x808, hw_fix ? 0x1f : 0xf6);
                 }
-                /* South Korea uses the A2-M (aka Zweiton M) audio standard,
-                   and should set 0x808 to 0xf8, but I don't know how to
-                   detect this. */
                 cx25840_write(client, 0x80b, 0x00);
         }
 
@@ -330,17 +320,17 @@ static int set_v4lstd(struct i2c_client *client, v4l2_std_id std)
         u8 fmt=0;       /* zero is autodetect */
 
         /* First tests should be against specific std */
-        if (std & V4L2_STD_NTSC_M_JP) {
+        if (std == V4L2_STD_NTSC_M_JP) {
                 fmt=0x2;
-        } else if (std & V4L2_STD_NTSC_443) {
+        } else if (std == V4L2_STD_NTSC_443) {
                 fmt=0x3;
-        } else if (std & V4L2_STD_PAL_M) {
+        } else if (std == V4L2_STD_PAL_M) {
                 fmt=0x5;
-        } else if (std & V4L2_STD_PAL_N) {
+        } else if (std == V4L2_STD_PAL_N) {
                 fmt=0x6;
-        } else if (std & V4L2_STD_PAL_Nc) {
+        } else if (std == V4L2_STD_PAL_Nc) {
                 fmt=0x7;
-        } else if (std & V4L2_STD_PAL_60) {
+        } else if (std == V4L2_STD_PAL_60) {
                 fmt=0x8;
         } else {
                 /* Then, test against generic ones */
@@ -369,7 +359,7 @@ v4l2_std_id cx25840_get_v4lstd(struct i2c_client * client)
         }
 
         switch (fmt) {
-        case 0x1: return V4L2_STD_NTSC_M;
+        case 0x1: return V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR;
         case 0x2: return V4L2_STD_NTSC_M_JP;
         case 0x3: return V4L2_STD_NTSC_443;
         case 0x4: return V4L2_STD_PAL;
@@ -577,7 +567,7 @@ static struct v4l2_queryctrl cx25840_qctrl[] = {
                 .type          = V4L2_CTRL_TYPE_INTEGER,
                 .name          = "Contrast",
                 .minimum       = 0,
-                .maximum       = 255,
+                .maximum       = 127,
                 .step          = 1,
                 .default_value = 64,
                 .flags         = 0,
@@ -586,7 +576,7 @@ static struct v4l2_queryctrl cx25840_qctrl[] = {
                 .type          = V4L2_CTRL_TYPE_INTEGER,
                 .name          = "Saturation",
                 .minimum       = 0,
-                .maximum       = 255,
+                .maximum       = 127,
                 .step          = 1,
                 .default_value = 64,
                 .flags         = 0,
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 53308911ae6e..87d79df05336 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -15,23 +15,10 @@ config VIDEO_CX88
           To compile this driver as a module, choose M here: the
           module will be called cx8800
 
-config VIDEO_CX88_DVB
-        tristate "DVB/ATSC Support for cx2388x based TV cards"
-        depends on VIDEO_CX88 && DVB_CORE
-        select VIDEO_BUF_DVB
-        ---help---
-          This adds support for DVB/ATSC cards based on the
-          Connexant 2388x chip.
-
-          To compile this driver as a module, choose M here: the
-          module will be called cx88-dvb.
-
-          You must also select one or more DVB/ATSC demodulators.
-          If you are unsure which you need, choose all of them.
-
 config VIDEO_CX88_ALSA
         tristate "ALSA DMA audio support"
         depends on VIDEO_CX88 && SND && EXPERIMENTAL
+        select SND_PCM
         ---help---
           This is a video4linux driver for direct (DMA) audio on
           Conexant 2388x based TV cards.
@@ -43,11 +30,26 @@ config VIDEO_CX88_ALSA
           To compile this driver as a module, choose M here: the
           module will be called cx88-alsa.
 
+config VIDEO_CX88_DVB
+        tristate "DVB/ATSC Support for cx2388x based TV cards"
+        depends on VIDEO_CX88 && DVB_CORE
+        select VIDEO_BUF_DVB
+        ---help---
+          This adds support for DVB/ATSC cards based on the
+          Connexant 2388x chip.
+
+          To compile this driver as a module, choose M here: the
+          module will be called cx88-dvb.
+
+          You must also select one or more DVB/ATSC demodulators.
+          If you are unsure which you need, choose all of them.
+
 config VIDEO_CX88_DVB_ALL_FRONTENDS
         bool "Build all supported frontends for cx2388x based TV cards"
         default y
         depends on VIDEO_CX88_DVB
         select DVB_MT352
+        select VIDEO_CX88_VP3054
         select DVB_OR51132
         select DVB_CX22702
         select DVB_LGDT330X
@@ -69,6 +71,16 @@ config VIDEO_CX88_DVB_MT352
           This adds DVB-T support for cards based on the
           Connexant 2388x chip and the MT352 demodulator.
 
+config VIDEO_CX88_VP3054
+        tristate "VP-3054 Secondary I2C Bus Support"
+        default m
+        depends on DVB_MT352
+        ---help---
+          This adds DVB-T support for cards based on the
+          Connexant 2388x chip and the MT352 demodulator,
+          which also require support for the VP-3054
+          Secondary I2C bus, such at DNTV Live! DVB-T Pro.
+
 config VIDEO_CX88_DVB_OR51132
         bool "OR51132 ATSC Support"
         default y
diff --git a/drivers/media/video/cx88/Makefile b/drivers/media/video/cx88/Makefile
index 6e5eaa22619e..2b902784facc 100644
--- a/drivers/media/video/cx88/Makefile
+++ b/drivers/media/video/cx88/Makefile
@@ -4,8 +4,9 @@ cx8800-objs	:= cx88-video.o cx88-vbi.o
 cx8802-objs     := cx88-mpeg.o
 
 obj-$(CONFIG_VIDEO_CX88) += cx88xx.o cx8800.o cx8802.o cx88-blackbird.o
-obj-$(CONFIG_VIDEO_CX88_DVB) += cx88-dvb.o cx88-vp3054-i2c.o
+obj-$(CONFIG_VIDEO_CX88_DVB) += cx88-dvb.o
 obj-$(CONFIG_VIDEO_CX88_ALSA) += cx88-alsa.o
+obj-$(CONFIG_VIDEO_CX88_VP3054) += cx88-vp3054-i2c.o
 
 EXTRA_CFLAGS += -I$(src)/..
 EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
@@ -18,6 +19,6 @@ extra-cflags-$(CONFIG_DVB_LGDT330X)  += -DHAVE_LGDT330X=1
 extra-cflags-$(CONFIG_DVB_MT352)     += -DHAVE_MT352=1
 extra-cflags-$(CONFIG_DVB_NXT200X)   += -DHAVE_NXT200X=1
 extra-cflags-$(CONFIG_DVB_CX24123)   += -DHAVE_CX24123=1
-extra-cflags-$(CONFIG_VIDEO_CX88_DVB)+= -DHAVE_VP3054_I2C=1
+extra-cflags-$(CONFIG_VIDEO_CX88_VP3054)+= -DHAVE_VP3054_I2C=1
 
 EXTRA_CFLAGS += $(extra-cflags-y) $(extra-cflags-m)
diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
index a2e36a1e5f59..2acccd6d49bc 100644
--- a/drivers/media/video/cx88/cx88-alsa.c
+++ b/drivers/media/video/cx88/cx88-alsa.c
@@ -128,7 +128,7 @@ MODULE_PARM_DESC(debug,"enable debug messages");
  * BOARD Specific: Sets audio DMA
  */
 
-int _cx88_start_audio_dma(snd_cx88_card_t *chip)
+static int _cx88_start_audio_dma(snd_cx88_card_t *chip)
 {
         struct cx88_buffer   *buf = chip->buf;
         struct cx88_core *core=chip->core;
@@ -173,7 +173,7 @@ int _cx88_start_audio_dma(snd_cx88_card_t *chip)
 /*
  * BOARD Specific: Resets audio DMA
  */
-int _cx88_stop_audio_dma(snd_cx88_card_t *chip)
+static int _cx88_stop_audio_dma(snd_cx88_card_t *chip)
 {
         struct cx88_core *core=chip->core;
         dprintk(1, "Stopping audio DMA\n");
@@ -613,7 +613,7 @@ static snd_kcontrol_new_t snd_cx88_capture_volume = {
  * Only boards with eeprom and byte 1 at eeprom=1 have it
  */
 
-struct pci_device_id cx88_audio_pci_tbl[] = {
+static struct pci_device_id cx88_audio_pci_tbl[] = {
         {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
         {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
         {0, }
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index ad2f565f522c..1bc999247fdc 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -1246,6 +1246,11 @@ struct cx88_subid cx88_subids[] = {
                 .card      = CX88_BOARD_DVICO_FUSIONHDTV_DVB_T_DUAL,
         },{
                 .subvendor = 0x18ac,
+                .subdevice = 0xdb54,
+                .card      = CX88_BOARD_DVICO_FUSIONHDTV_DVB_T_DUAL,
+                /* Re-branded DViCO: DigitalNow DVB-T Dual */
+        },{
+                .subvendor = 0x18ac,
                 .subdevice = 0xdb11,
                 .card      = CX88_BOARD_DVICO_FUSIONHDTV_DVB_T_PLUS,
                 /* Re-branded DViCO: UltraView DVB-T Plus */
@@ -1293,6 +1298,7 @@ static void hauppauge_eeprom(struct cx88_core *core, u8 *eeprom_data)
         switch (tv.model)
         {
         case 28552: /* WinTV-PVR 'Roslyn' (No IR) */
+        case 34519: /* WinTV-PCI-FM */
         case 90002: /* Nova-T-PCI (9002) */
         case 92001: /* Nova-S-Plus (Video and IR) */
         case 92002: /* Nova-S-Plus (Video and IR) */
diff --git a/drivers/media/video/cx88/cx88-core.c b/drivers/media/video/cx88/cx88-core.c
index 8d6d6a6cf785..3720f24a25cf 100644
--- a/drivers/media/video/cx88/cx88-core.c
+++ b/drivers/media/video/cx88/cx88-core.c
@@ -787,12 +787,14 @@ static int set_pll(struct cx88_core *core, int prescale, u32 ofreq)
 
 int cx88_start_audio_dma(struct cx88_core *core)
 {
+        /* constant 128 made buzz in analog Nicam-stereo for bigger fifo_size */
+        int bpl = cx88_sram_channels[SRAM_CH25].fifo_size/4;
         /* setup fifo + format */
-        cx88_sram_channel_setup(core, &cx88_sram_channels[SRAM_CH25], 128, 0);
-        cx88_sram_channel_setup(core, &cx88_sram_channels[SRAM_CH26], 128, 0);
+        cx88_sram_channel_setup(core, &cx88_sram_channels[SRAM_CH25], bpl, 0);
+        cx88_sram_channel_setup(core, &cx88_sram_channels[SRAM_CH26], bpl, 0);
 
-        cx_write(MO_AUDD_LNGTH,    128); /* fifo bpl size */
-        cx_write(MO_AUDR_LNGTH,    128); /* fifo bpl size */
+        cx_write(MO_AUDD_LNGTH, bpl); /* fifo bpl size */
+        cx_write(MO_AUDR_LNGTH, bpl); /* fifo bpl size */
 
         /* start dma */
         cx_write(MO_AUD_DMACNTRL, 0x0003); /* Up and Down fifo enable */
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index da2ad5c4b553..165d948624a3 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -482,6 +482,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
         switch (core->board) {
         case CX88_BOARD_DNTV_LIVE_DVB_T:
         case CX88_BOARD_KWORLD_DVB_T:
+        case CX88_BOARD_KWORLD_DVB_T_CX22702:
                 ir_codes = ir_codes_dntv_live_dvb_t;
                 ir->gpio_addr = MO_GP1_IO;
                 ir->mask_keycode = 0x1f;
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index dff3893f32fd..e5ee8bceb210 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -139,6 +139,9 @@ int em28xx_read_reg_req_len(struct em28xx *dev, u8 req, u16 reg,
 {
         int ret, byte;
 
+        if (dev->state & DEV_DISCONNECTED)
+                return(-ENODEV);
+
         em28xx_regdbg("req=%02x, reg=%02x ", req, reg);
 
         ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
@@ -165,6 +168,9 @@ int em28xx_read_reg_req(struct em28xx *dev, u8 req, u16 reg)
         u8 val;
         int ret;
 
+        if (dev->state & DEV_DISCONNECTED)
+                return(-ENODEV);
+
         em28xx_regdbg("req=%02x, reg=%02x:", req, reg);
 
         ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), req,
@@ -195,7 +201,12 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
         int ret;
 
         /*usb_control_msg seems to expect a kmalloced buffer */
-        unsigned char *bufs = kmalloc(len, GFP_KERNEL);
+        unsigned char *bufs;
+
+        if (dev->state & DEV_DISCONNECTED)
+                return(-ENODEV);
+
+        bufs = kmalloc(len, GFP_KERNEL);
 
         em28xx_regdbg("req=%02x reg=%02x:", req, reg);
 
@@ -212,7 +223,7 @@ int em28xx_write_regs_req(struct em28xx *dev, u8 req, u16 reg, char *buf,
         ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), req,
                               USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                               0x0000, reg, bufs, len, HZ);
-        mdelay(5);              /* FIXME: magic number */
+        msleep(5);              /* FIXME: magic number */
         kfree(bufs);
         return ret;
 }
@@ -253,7 +264,7 @@ int em28xx_write_ac97(struct em28xx *dev, u8 reg, u8 * val)
         if ((ret = em28xx_read_reg(dev, AC97BUSY_REG)) < 0)
                 return ret;
         else if (((u8) ret) & 0x01) {
-                em28xx_warn ("AC97 command still being exectuted: not handled properly!\n");
+                em28xx_warn ("AC97 command still being executed: not handled properly!\n");
         }
         return 0;
 }
diff --git a/drivers/media/video/em28xx/em28xx-i2c.c b/drivers/media/video/em28xx/em28xx-i2c.c
index 0591a705b7a1..6ca8631bc36d 100644
--- a/drivers/media/video/em28xx/em28xx-i2c.c
+++ b/drivers/media/video/em28xx/em28xx-i2c.c
@@ -78,7 +78,7 @@ static int em2800_i2c_send_max4(struct em28xx *dev, unsigned char addr,
                 ret = dev->em28xx_read_reg(dev, 0x05);
                 if (ret == 0x80 + len - 1)
                         return len;
-                mdelay(5);
+                msleep(5);
         }
         em28xx_warn("i2c write timed out\n");
         return -EIO;
@@ -138,7 +138,7 @@ static int em2800_i2c_check_for_device(struct em28xx *dev, unsigned char addr)
                         return -ENODEV;
                 else if (msg == 0x84)
                         return 0;
-                mdelay(5);
+                msleep(5);
         }
         return -ENODEV;
 }
@@ -278,9 +278,9 @@ static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,
                                                            msgs[i].buf,
                                                            msgs[i].len,
                                                            i == num - 1);
-                        if (rc < 0)
-                                goto err;
                 }
+                if (rc < 0)
+                        goto err;
                 if (i2c_debug>=2)
                         printk("\n");
         }
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index eea304f75176..5b267808a9d4 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -6,6 +6,9 @@
                       Mauro Carvalho Chehab <mchehab@brturbo.com.br>
                       Sascha Sommer <saschasommer@freenet.de>
 
+        Some parts based on SN9C10x PC Camera Controllers GPL driver made
+                by Luca Risolia <luca.risolia@studio.unibo.it>
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
@@ -364,6 +367,9 @@ static int em28xx_v4l2_open(struct inode *inode, struct file *filp)
         em28xx_capture_start(dev, 1);
         em28xx_resolution_set(dev);
 
+        /* device needs to be initialized before isoc transfer */
+        video_mux(dev, 0);
+
         /* start the transfer */
         errCode = em28xx_init_isoc(dev);
         if (errCode)
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 8416ceff524b..41715cacf926 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -1,7 +1,7 @@
 /*
     mxb - v4l2 driver for the Multimedia eXtension Board
     
-    Copyright (C) 1998-2003 Michael Hunold <michael@mihu.de>
+    Copyright (C) 1998-2006 Michael Hunold <michael@mihu.de>
 
     Visit http://www.mihu.de/linux/saa7146/mxb/
     for further details about this card.
@@ -327,6 +327,7 @@ static int mxb_init_done(struct saa7146_dev* dev)
         struct video_decoder_init init;
         struct i2c_msg msg;
         struct tuner_setup tun_setup;
+        v4l2_std_id std = V4L2_STD_PAL_BG;
 
         int i = 0, err = 0;
         struct  tea6415c_multiplex vm;  
@@ -361,6 +362,9 @@ static int mxb_init_done(struct saa7146_dev* dev)
         mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_FREQUENCY,
                                         &mxb->cur_freq);
 
+        /* set a default video standard */
+        mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
+
         /* mute audio on tea6420s */
         mxb->tea6420_1->driver->command(mxb->tea6420_1,TEA6420_SWITCH, &TEA6420_line[6][0]);
         mxb->tea6420_2->driver->command(mxb->tea6420_2,TEA6420_SWITCH, &TEA6420_line[6][1]);
@@ -921,17 +925,21 @@ static int std_callback(struct saa7146_dev* dev, struct saa7146_standard *std)
         int one = 1;
 
         if(V4L2_STD_PAL_I == std->id ) {
+                v4l2_std_id std = V4L2_STD_PAL_I;
                 DEB_D(("VIDIOC_S_STD: setting mxb for PAL_I.\n"));
                 /* set the 7146 gpio register -- I don't know what this does exactly */
                 saa7146_write(dev, GPIO_CTRL, 0x00404050);
                 /* unset the 7111 gpio register -- I don't know what this does exactly */
                 mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_SET_GPIO, &zero);
+                mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
         } else {
+                v4l2_std_id std = V4L2_STD_PAL_BG;
                 DEB_D(("VIDIOC_S_STD: setting mxb for PAL/NTSC/SECAM.\n"));
                 /* set the 7146 gpio register -- I don't know what this does exactly */
                 saa7146_write(dev, GPIO_CTRL, 0x00404050);
                 /* set the 7111 gpio register -- I don't know what this does exactly */
                 mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_SET_GPIO, &one);
+                mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_STD, &std);
         }
         return 0;
 }
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index 048d000941c7..ffd87ce55556 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -1027,7 +1027,7 @@ static struct v4l2_queryctrl saa7115_qctrl[] = {
                 .type          = V4L2_CTRL_TYPE_INTEGER,
                 .name          = "Contrast",
                 .minimum       = 0,
-                .maximum       = 255,
+                .maximum       = 127,
                 .step          = 1,
                 .default_value = 64,
                 .flags         = 0,
@@ -1036,7 +1036,7 @@ static struct v4l2_queryctrl saa7115_qctrl[] = {
                 .type          = V4L2_CTRL_TYPE_INTEGER,
                 .name          = "Saturation",
                 .minimum       = 0,
-                .maximum       = 255,
+                .maximum       = 127,
                 .step          = 1,
                 .default_value = 64,
                 .flags         = 0,
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index a7a6ab9298a9..7df5e0826e12 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -54,10 +54,12 @@ MODULE_PARM_DESC(debug,"enable debug messages [alsa]");
 
 static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;      /* Index 0-MAX */
 static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;       /* ID for this card */
-static int enable[SNDRV_CARDS] = {1, [1 ... (SNDRV_CARDS - 1)] = 0};
+static int enable[SNDRV_CARDS] = {1, [1 ... (SNDRV_CARDS - 1)] = 1};
 
 module_param_array(index, int, NULL, 0444);
+module_param_array(enable, int, NULL, 0444);
 MODULE_PARM_DESC(index, "Index value for SAA7134 capture interface(s).");
+MODULE_PARM_DESC(enable, "Enable (or not) the SAA7134 capture interface(s).");
 
 #define dprintk(fmt, arg...)    if (debug) \
         printk(KERN_DEBUG "%s/alsa: " fmt, dev->name , ##arg)
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index c64718aec9cb..6bc63a4086c1 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -136,7 +136,7 @@ struct saa7134_board saa7134_boards[] = {
         },
         [SAA7134_BOARD_FLYVIDEO2000] = {
                 /* "TC Wan" <tcwan@cs.usm.my> */
-                .name           = "LifeView FlyVIDEO2000",
+                .name           = "LifeView/Typhoon FlyVIDEO2000",
                 .audio_clock    = 0x00200000,
                 .tuner_type     = TUNER_LG_PAL_NEW_TAPC,
                 .radio_type     = UNSET,
@@ -977,7 +977,7 @@ struct saa7134_board saa7134_boards[] = {
                 .radio_type     = UNSET,
                 .tuner_addr     = ADDR_UNSET,
                 .radio_addr     = ADDR_UNSET,
-                .tda9887_conf   = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_ACTIVE,
+                .tda9887_conf   = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_INACTIVE,
                 .inputs         = {{
                         .name = name_tv,
                         .vmux = 3,
@@ -1666,7 +1666,7 @@ struct saa7134_board saa7134_boards[] = {
                 .radio_type     = UNSET,
                 .tuner_addr     = ADDR_UNSET,
                 .radio_addr     = ADDR_UNSET,
-                .tda9887_conf   = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_ACTIVE,
+                .tda9887_conf   = TDA9887_PRESENT | TDA9887_INTERCARRIER | TDA9887_PORT2_INACTIVE,
                 .mpeg           = SAA7134_MPEG_DVB,
                 .inputs         = {{
                         .name = name_tv,
@@ -1884,44 +1884,38 @@ struct saa7134_board saa7134_boards[] = {
                         .gpio = 0x000,
                 },
         },
-        [SAA7134_BOARD_THYPHOON_DVBT_DUO_CARDBUS] = {
-                .name           = "Typhoon DVB-T Duo Digital/Analog Cardbus",
+        [SAA7134_BOARD_FLYDVBT_DUO_CARDBUS] = {
+                .name           = "LifeView/Typhoon FlyDVB-T Duo Cardbus",
                 .audio_clock    = 0x00200000,
                 .tuner_type     = TUNER_PHILIPS_TDA8290,
                 .radio_type     = UNSET,
                 .tuner_addr     = ADDR_UNSET,
                 .radio_addr     = ADDR_UNSET,
                 .mpeg           = SAA7134_MPEG_DVB,
-                /* .gpiomask       = 0xe000, */
+                .gpiomask       = 0x00200000,
                 .inputs         = {{
                         .name = name_tv,
                         .vmux = 1,
                         .amux = TV,
-                /*      .gpio = 0x0000,      */
+                        .gpio = 0x200000,       /* GPIO21=High for TV input */
                         .tv   = 1,
                 },{
+                        .name = name_svideo,    /* S-Video signal on S-Video input */
+                        .vmux = 8,
+                        .amux = LINE2,
+                },{
                         .name = name_comp1,     /* Composite signal on S-Video input */
                         .vmux = 0,
                         .amux = LINE2,
-                /*      .gpio = 0x4000,      */
                 },{
                         .name = name_comp2,     /* Composite input */
                         .vmux = 3,
                         .amux = LINE2,
-                /*      .gpio = 0x4000,      */
-                },{
-                        .name = name_svideo,    /* S-Video signal on S-Video input */
-                        .vmux = 8,
-                        .amux = LINE2,
-                /*      .gpio = 0x4000,      */
                 }},
                 .radio = {
                         .name = name_radio,
-                        .amux = LINE2,
-                },
-                .mute = {
-                        .name = name_mute,
-                        .amux = LINE1,
+                        .amux = TV,
+                        .gpio = 0x000000,       /* GPIO21=Low for FM radio antenna */
                 },
         },
         [SAA7134_BOARD_VIDEOMATE_TV_GOLD_PLUSII] = {
@@ -2193,7 +2187,7 @@ struct saa7134_board saa7134_boards[] = {
                 .radio_type     = UNSET,
                 .tuner_addr     = 0x61,
                 .radio_addr     = ADDR_UNSET,
-                .tda9887_conf   = TDA9887_PRESENT,
+                .tda9887_conf   = TDA9887_PRESENT | TDA9887_PORT1_ACTIVE,
                 .mpeg           = SAA7134_MPEG_DVB,
                 .inputs = {{
                         .name   = name_tv,
@@ -2217,7 +2211,7 @@ struct saa7134_board saa7134_boards[] = {
                 .radio_type     = UNSET,
                 .tuner_addr     = 0x61,
                 .radio_addr     = ADDR_UNSET,
-                .tda9887_conf   = TDA9887_PRESENT,
+                .tda9887_conf   = TDA9887_PRESENT | TDA9887_PORT1_ACTIVE,
                 .mpeg           = SAA7134_MPEG_DVB,
                 .inputs = {{
                         .name   = name_tv,
@@ -2398,7 +2392,7 @@ struct saa7134_board saa7134_boards[] = {
                 }},
         },
         [SAA7134_BOARD_PINNACLE_PCTV_110i] = {
-                .name           = "Pinnacle PCTV 110i (saa7133)",
+               .name           = "Pinnacle PCTV 40i/50i/110i (saa7133)",
                 .audio_clock    = 0x00187de7,
                 .tuner_type     = TUNER_PHILIPS_TDA8290,
                 .radio_type     = UNSET,
@@ -2413,6 +2407,10 @@ struct saa7134_board saa7134_boards[] = {
                 },{
                           .name = name_comp1,
                           .vmux = 1,
+                         .amux = LINE2,
+               },{
+                         .name = name_comp2,
+                         .vmux = 0,
                           .amux = LINE2,
                 },{
                           .name = name_svideo,
@@ -2701,6 +2699,12 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .driver_data  = SAA7134_BOARD_FLYVIDEO2000,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
+                .device       = PCI_DEVICE_ID_PHILIPS_SAA7130,
+                .subvendor    = 0x4e42,         /* Typhoon */
+                .subdevice    = 0x0138,         /* LifeView FlyTV Prime30 OEM */
+                .driver_data  = SAA7134_BOARD_FLYVIDEO2000,
+        },{
+                .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x5168,
                 .subdevice    = 0x0212, /* minipci, LR212 */
@@ -2745,7 +2749,7 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7130,
                 .subvendor    = 0x1048,
-                .subdevice    = 0x226b,
+                .subdevice    = 0x226a,
                 .driver_data  = SAA7134_BOARD_ELSA_500TV,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
@@ -2935,7 +2939,7 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                 .subvendor    = 0x5168,
                 .subdevice    = 0x0502,                /* Cardbus version */
-                .driver_data  = SAA7134_BOARD_FLYDVBTDUO,
+                .driver_data  = SAA7134_BOARD_FLYDVBT_DUO_CARDBUS,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
@@ -2980,12 +2984,12 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .subdevice    = 0x1370,        /* cardbus version */
                 .driver_data  = SAA7134_BOARD_ADS_INSTANT_TV,
 
-        },{     /* Typhoon DVB-T Duo Digital/Analog Cardbus */
+        },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
-                .subvendor    = 0x4e42,
-                .subdevice    = 0x0502,
-                .driver_data  = SAA7134_BOARD_THYPHOON_DVBT_DUO_CARDBUS,
+                .subvendor    = 0x4e42,         /* Typhoon */
+                .subdevice    = 0x0502,         /* LifeView LR502 OEM */
+                .driver_data  = SAA7134_BOARD_FLYDVBT_DUO_CARDBUS,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
@@ -3201,13 +3205,17 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                 /* power-up tuner chip */
                 saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0x00040000, 0x00040000);
                 saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x00040000, 0x00000000);
+        case SAA7134_BOARD_PINNACLE_300I_DVBT_PAL:
+                /* this turns the remote control chip off to work around a bug in it */
+                saa_writeb(SAA7134_GPIO_GPMODE1, 0x80);
+                saa_writeb(SAA7134_GPIO_GPSTATUS1, 0x80);
+                break;
         case SAA7134_BOARD_MONSTERTV_MOBILE:
                 /* power-up tuner chip */
                 saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0x00040000, 0x00040000);
                 saa_andorl(SAA7134_GPIO_GPSTATUS0 >> 2, 0x00040000, 0x00000004);
                 break;
-        case SAA7134_BOARD_FLYDVBTDUO:
-        case SAA7134_BOARD_THYPHOON_DVBT_DUO_CARDBUS:
+        case SAA7134_BOARD_FLYDVBT_DUO_CARDBUS:
                 /* turn the fan on */
                 saa_writeb(SAA7134_GPIO_GPMODE3, 0x08);
                 saa_writeb(SAA7134_GPIO_GPSTATUS3, 0x06);
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 399f9952596c..9db8e13f21c3 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -110,6 +110,7 @@ static int mt352_pinnacle_init(struct dvb_frontend* fe)
         mt352_write(fe, fsm_ctl_cfg,    sizeof(fsm_ctl_cfg));
         mt352_write(fe, scan_ctl_cfg,   sizeof(scan_ctl_cfg));
         mt352_write(fe, irq_cfg,        sizeof(irq_cfg));
+
         return 0;
 }
 
@@ -117,8 +118,10 @@ static int mt352_pinnacle_pll_set(struct dvb_frontend* fe,
                                   struct dvb_frontend_parameters* params,
                                   u8* pllbuf)
 {
-        static int on  = TDA9887_PRESENT | TDA9887_PORT2_INACTIVE;
-        static int off = TDA9887_PRESENT | TDA9887_PORT2_ACTIVE;
+        u8 off[] = { 0x00, 0xf1};
+        u8 on[]  = { 0x00, 0x71};
+        struct i2c_msg msg = {.addr=0x43, .flags=0, .buf=off, .len = sizeof(off)};
+
         struct saa7134_dev *dev = fe->dvb->priv;
         struct v4l2_frequency f;
 
@@ -126,9 +129,10 @@ static int mt352_pinnacle_pll_set(struct dvb_frontend* fe,
         f.tuner     = 0;
         f.type      = V4L2_TUNER_DIGITAL_TV;
         f.frequency = params->frequency / 1000 * 16 / 1000;
-        saa7134_i2c_call_clients(dev,TDA9887_SET_CONFIG,&on);
+        i2c_transfer(&dev->i2c_adap, &msg, 1);
         saa7134_i2c_call_clients(dev,VIDIOC_S_FREQUENCY,&f);
-        saa7134_i2c_call_clients(dev,TDA9887_SET_CONFIG,&off);
+        msg.buf = on;
+        i2c_transfer(&dev->i2c_adap, &msg, 1);
 
         pinnacle_antenna_pwr(dev, antenna_pwr);
 
@@ -861,7 +865,7 @@ static int dvb_init(struct saa7134_dev *dev)
                 dev->dvb.frontend = tda10046_attach(&tda827x_lifeview_config,
                                                     &dev->i2c_adap);
                 break;
-        case SAA7134_BOARD_THYPHOON_DVBT_DUO_CARDBUS:
+        case SAA7134_BOARD_FLYDVBT_DUO_CARDBUS:
                 dev->dvb.frontend = tda10046_attach(&tda827x_lifeview_config,
                                                     &dev->i2c_adap);
                 break;
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index e70eae8d29bb..3261d8bebdd1 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -185,7 +185,7 @@ struct saa7134_format {
 #define SAA7134_BOARD_AVERMEDIA_GO_007_FM 57
 #define SAA7134_BOARD_ADS_INSTANT_TV 58
 #define SAA7134_BOARD_KWORLD_VSTREAM_XPERT 59
-#define SAA7134_BOARD_THYPHOON_DVBT_DUO_CARDBUS 60
+#define SAA7134_BOARD_FLYDVBT_DUO_CARDBUS 60
 #define SAA7134_BOARD_PHILIPS_TOUGH 61
 #define SAA7134_BOARD_VIDEOMATE_TV_GOLD_PLUSII 62
 #define SAA7134_BOARD_KWORLD_XPERT 63
diff --git a/drivers/media/video/stradis.c b/drivers/media/video/stradis.c
index 54fc33011ffb..9d769264a329 100644
--- a/drivers/media/video/stradis.c
+++ b/drivers/media/video/stradis.c
@@ -2012,7 +2012,6 @@ static int __devinit init_saa7146(struct pci_dev *pdev)
 {
         struct saa7146 *saa = pci_get_drvdata(pdev);
 
-        memset(saa, 0, sizeof(*saa));
         saa->user = 0;
         /* reset the saa7146 */
         saawrite(0xffff0000, SAA7146_MC1);
@@ -2062,16 +2061,16 @@ static int __devinit init_saa7146(struct pci_dev *pdev)
         }
         if (saa->audbuf == NULL && (saa->audbuf = vmalloc(65536)) == NULL) {
                 dev_err(&pdev->dev, "%d: malloc failed\n", saa->nr);
-                goto errvid;
+                goto errfree;
         }
         if (saa->osdbuf == NULL && (saa->osdbuf = vmalloc(131072)) == NULL) {
                 dev_err(&pdev->dev, "%d: malloc failed\n", saa->nr);
-                goto erraud;
+                goto errfree;
         }
         /* allocate 81920 byte buffer for clipping */
         if ((saa->dmavid2 = kzalloc(VIDEO_CLIPMAP_SIZE, GFP_KERNEL)) == NULL) {
                 dev_err(&pdev->dev, "%d: clip kmalloc failed\n", saa->nr);
-                goto errosd;
+                goto errfree;
         }
         /* setup clipping registers */
         saawrite(virt_to_bus(saa->dmavid2), SAA7146_BASE_EVEN2);
@@ -2085,15 +2084,11 @@ static int __devinit init_saa7146(struct pci_dev *pdev)
         I2CBusScan(saa);
 
         return 0;
-errosd:
+errfree:
         vfree(saa->osdbuf);
-        saa->osdbuf = NULL;
-erraud:
         vfree(saa->audbuf);
-        saa->audbuf = NULL;
-errvid:
         vfree(saa->vidbuf);
-        saa->vidbuf = NULL;
+        saa->audbuf = saa->osdbuf = saa->vidbuf = NULL;
 err:
         return -ENOMEM;
 }
diff --git a/drivers/media/video/tda8290.c b/drivers/media/video/tda8290.c
index 7b4fb282ac82..a796a4e1917c 100644
--- a/drivers/media/video/tda8290.c
+++ b/drivers/media/video/tda8290.c
@@ -580,9 +580,10 @@ int tda8290_init(struct i2c_client *c)
 
 int tda8290_probe(struct i2c_client *c)
 {
-        unsigned char soft_reset[]  = { 0x00, 0x00 };
-        unsigned char easy_mode_b[] = { 0x01, 0x02 };
-        unsigned char easy_mode_g[] = { 0x01, 0x04 };
+        unsigned char soft_reset[]   = { 0x00, 0x00 };
+        unsigned char easy_mode_b[]  = { 0x01, 0x02 };
+        unsigned char easy_mode_g[]  = { 0x01, 0x04 };
+        unsigned char restore_9886[] = { 0x00, 0xd6, 0x30 };
         unsigned char addr_dto_lsb = 0x07;
         unsigned char data;
 
@@ -599,6 +600,7 @@ int tda8290_probe(struct i2c_client *c)
                         return 0;
                 }
         }
+        i2c_master_send(c, restore_9886, 3);
         return -1;
 }
 
diff --git a/drivers/media/video/tda9887.c b/drivers/media/video/tda9887.c
index 5815649bdc78..0d54f6c1982b 100644
--- a/drivers/media/video/tda9887.c
+++ b/drivers/media/video/tda9887.c
@@ -231,7 +231,7 @@ static struct tvnorm tvnorms[] = {
                            cAudioIF_6_5   |
                            cVideoIF_38_90 ),
         },{
-                .std   = V4L2_STD_NTSC_M,
+                .std   = V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR,
                 .name  = "NTSC-M",
                 .b     = ( cNegativeFmTV  |
                            cQSS           ),
@@ -619,6 +619,11 @@ static int tda9887_fixup_std(struct tda9887 *t)
                         tda9887_dbg("insmod fixup: NTSC => NTSC_M_JP\n");
                         t->std = V4L2_STD_NTSC_M_JP;
                         break;
+                case 'k':
+                case 'K':
+                        tda9887_dbg("insmod fixup: NTSC => NTSC_M_KR\n");
+                        t->std = V4L2_STD_NTSC_M_KR;
+                        break;
                 case '-':
                         /* default parameter, do nothing */
                         break;
@@ -876,7 +881,7 @@ static int tda9887_resume(struct device * dev)
 /* ----------------------------------------------------------------------- */
 
 static struct i2c_driver driver = {
-        .id             = -1, /* FIXME */
+        .id             = I2C_DRIVERID_TDA9887,
         .attach_adapter = tda9887_probe,
         .detach_client  = tda9887_detach,
         .command        = tda9887_command,
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index 2995b22acb43..b6101bf446d4 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -216,6 +216,7 @@ static void set_type(struct i2c_client *c, unsigned int type,
                 buffer[3] = 0xa4;
                 i2c_master_send(c,buffer,4);
                 default_tuner_init(c);
+                break;
         default:
                 default_tuner_init(c);
                 break;
@@ -365,6 +366,11 @@ static int tuner_fixup_std(struct tuner *t)
                         tuner_dbg("insmod fixup: NTSC => NTSC_M_JP\n");
                         t->std = V4L2_STD_NTSC_M_JP;
                         break;
+                case 'k':
+                case 'K':
+                        tuner_dbg("insmod fixup: NTSC => NTSC_M_KR\n");
+                        t->std = V4L2_STD_NTSC_M_KR;
+                        break;
                 case '-':
                         /* default parameter, do nothing */
                         break;
@@ -448,7 +454,7 @@ static int tuner_attach(struct i2c_adapter *adap, int addr, int kind)
                         printk("%02x ",buffer[i]);
                 printk("\n");
         }
-        /* TEA5767 autodetection code - only for addr = 0xc0 */
+        /* autodetection code based on the i2c addr */
         if (!no_autodetect) {
                 switch (addr) {
                 case 0x42:
@@ -707,8 +713,9 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                         struct v4l2_frequency *f = arg;
 
                         switch_v4l2();
-                        if (V4L2_TUNER_RADIO == f->type &&
-                            V4L2_TUNER_RADIO != t->mode) {
+                        if ((V4L2_TUNER_RADIO == f->type && V4L2_TUNER_RADIO != t->mode)
+                                || (V4L2_TUNER_DIGITAL_TV == f->type
+                                        && V4L2_TUNER_DIGITAL_TV != t->mode)) {
                                 if (set_mode (client, t, f->type, "VIDIOC_S_FREQUENCY")
                                             == EINVAL)
                                         return 0;
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index 6d03b9b05c6e..c8e5ad0e8185 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -390,6 +390,14 @@ static void tda9840_setmode(struct CHIPSTATE *chip, int mode)
                 chip_write(chip, TDA9840_SW, t);
 }
 
+static int tda9840_checkit(struct CHIPSTATE *chip)
+{
+        int rc;
+        rc = chip_read(chip);
+        /* lower 5 bits should be 0 */
+        return ((rc & 0x1f) == 0) ? 1 : 0;
+}
+
 /* ---------------------------------------------------------------------- */
 /* audio chip descriptions - defines+functions for tda985x                */
 
@@ -1264,6 +1272,7 @@ static struct CHIPDESC chiplist[] = {
                 .addr_hi    = I2C_TDA9840 >> 1,
                 .registers  = 5,
 
+                .checkit    = tda9840_checkit,
                 .getmode    = tda9840_getmode,
                 .setmode    = tda9840_setmode,
                 .checkmode  = generic_checkmode,
diff --git a/drivers/media/video/tvp5150.c b/drivers/media/video/tvp5150.c
index fad9ea0ae4f2..1864423b3046 100644
--- a/drivers/media/video/tvp5150.c
+++ b/drivers/media/video/tvp5150.c
@@ -746,24 +746,27 @@ static int tvp5150_set_std(struct i2c_client *c, v4l2_std_id std)
 
 static inline void tvp5150_reset(struct i2c_client *c)
 {
-        u8 type, ver_656, msb_id, lsb_id, msb_rom, lsb_rom;
+        u8 msb_id, lsb_id, msb_rom, lsb_rom;
         struct tvp5150 *decoder = i2c_get_clientdata(c);
 
-        type=tvp5150_read(c,TVP5150_AUTOSW_MSK);
         msb_id=tvp5150_read(c,TVP5150_MSB_DEV_ID);
         lsb_id=tvp5150_read(c,TVP5150_LSB_DEV_ID);
         msb_rom=tvp5150_read(c,TVP5150_ROM_MAJOR_VER);
         lsb_rom=tvp5150_read(c,TVP5150_ROM_MINOR_VER);
 
-        if (type==0xdc) {
-                ver_656=tvp5150_read(c,TVP5150_REV_SELECT);
-                tvp5150_info("tvp%02x%02xam1 detected 656 version is %d.\n",msb_id, lsb_id,ver_656);
-        } else if (type==0xfc) {
-                tvp5150_info("tvp%02x%02xa detected.\n",msb_id, lsb_id);
+        if ((msb_rom==4)&&(lsb_rom==0)) { /* Is TVP5150AM1 */
+                tvp5150_info("tvp%02x%02xam1 detected.\n",msb_id, lsb_id);
+
+                /* ITU-T BT.656.4 timing */
+                tvp5150_write(c,TVP5150_REV_SELECT,0);
         } else {
-                tvp5150_info("unknown tvp%02x%02x chip detected(%d).\n",msb_id,lsb_id,type);
+                if ((msb_rom==3)||(lsb_rom==0x21)) { /* Is TVP5150A */
+                        tvp5150_info("tvp%02x%02xa detected.\n",msb_id, lsb_id);
+                } else {
+                        tvp5150_info("*** unknown tvp%02x%02x chip detected.\n",msb_id,lsb_id);
+                        tvp5150_info("*** Rom ver is %d.%d\n",msb_rom,lsb_rom);
+                }
         }
-        tvp5150_info("Rom ver is %d.%d\n",msb_rom,lsb_rom);
 
         /* Initializes TVP5150 to its default values */
         tvp5150_write_inittab(c, tvp5150_init_default);
@@ -893,6 +896,17 @@ static int tvp5150_command(struct i2c_client *c,
                 }
         case DECODER_GET_STATUS:
                 {
+                        int *iarg = arg;
+                        int status;
+                        int res=0;
+                        status = tvp5150_read(c, 0x88);
+                        if(status&0x08){
+                                res |= DECODER_STATUS_COLOR;
+                        }
+                        if(status&0x04 && status&0x02){
+                                res |= DECODER_STATUS_GOOD;
+                        }
+                        *iarg=res;
                         break;
                 }
 
diff --git a/drivers/media/video/videocodec.h b/drivers/media/video/videocodec.h
index 156ae57096fe..b1239ac7f371 100644
--- a/drivers/media/video/videocodec.h
+++ b/drivers/media/video/videocodec.h
@@ -56,7 +56,7 @@
    the slave is bound to it). Otherwise it doesn't need this functions and
    therfor they may not be initialized.
 
-   The other fuctions are just for convenience, as they are for shure used by
+   The other fuctions are just for convenience, as they are for sure used by
    most/all of the codecs. The last ones may be ommited, too. 
 
    See the structure declaration below for more information and which data has
diff --git a/drivers/media/video/zr36050.c b/drivers/media/video/zr36050.c
index bd0cd28543ca..6699725be605 100644
--- a/drivers/media/video/zr36050.c
+++ b/drivers/media/video/zr36050.c
@@ -159,7 +159,7 @@ zr36050_wait_end (struct zr36050 *ptr)
 
         while (!(zr36050_read_status1(ptr) & 0x4)) {
                 udelay(1);
-                if (i++ > 200000) {     // 200ms, there is for shure something wrong!!!
+                if (i++ > 200000) {     // 200ms, there is for sure something wrong!!!
                         dprintk(1,
                                 "%s: timout at wait_end (last status: 0x%02x)\n",
                                 ptr->name, ptr->status1);
diff --git a/drivers/media/video/zr36060.c b/drivers/media/video/zr36060.c
index 28fa31a5f150..d8dd003a7aad 100644
--- a/drivers/media/video/zr36060.c
+++ b/drivers/media/video/zr36060.c
@@ -161,7 +161,7 @@ zr36060_wait_end (struct zr36060 *ptr)
 
         while (zr36060_read_status(ptr) & ZR060_CFSR_Busy) {
                 udelay(1);
-                if (i++ > 200000) {     // 200ms, there is for shure something wrong!!!
+                if (i++ > 200000) {     // 200ms, there is for sure something wrong!!!
                         dprintk(1,
                                 "%s: timout at wait_end (last status: 0x%02x)\n",
                                 ptr->name, ptr->status);
diff --git a/drivers/media/video/zr36120_i2c.c b/drivers/media/video/zr36120_i2c.c
index 6bfe84d657f1..21fde43a6aed 100644
--- a/drivers/media/video/zr36120_i2c.c
+++ b/drivers/media/video/zr36120_i2c.c
@@ -65,7 +65,7 @@ void attach_inform(struct i2c_bus *bus, int id)
          case I2C_DRIVERID_VIDEODECODER:
                 DEBUG(printk(CARD_INFO "decoder attached\n",CARD));
 
-                /* fetch the capabilites of the decoder */
+                /* fetch the capabilities of the decoder */
                 rv = i2c_control_device(&ztv->i2c, I2C_DRIVERID_VIDEODECODER, DECODER_GET_CAPABILITIES, &dc);
                 if (rv) {
                         DEBUG(printk(CARD_DEBUG "decoder is not V4L aware!\n",CARD));
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 9a2c7605d49c..642a61b6d0a4 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -452,8 +452,7 @@ mpt_base_reply(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf, MPT_FRAME_HDR *reply)
         } else if (func == MPI_FUNCTION_EVENT_ACK) {
                 dprintk((MYIOC_s_INFO_FMT "mpt_base_reply, EventAck reply received\n",
                                 ioc->name));
-        } else if (func == MPI_FUNCTION_CONFIG ||
-                   func == MPI_FUNCTION_TOOLBOX) {
+        } else if (func == MPI_FUNCTION_CONFIG) {
                 CONFIGPARMS *pCfg;
                 unsigned long flags;
 
@@ -5327,115 +5326,6 @@ mpt_config(MPT_ADAPTER *ioc, CONFIGPARMS *pCfg)
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
-/**
- *      mpt_toolbox - Generic function to issue toolbox message
- *      @ioc - Pointer to an adapter structure
- *      @cfg - Pointer to a toolbox structure. Struct contains
- *              action, page address, direction, physical address
- *              and pointer to a configuration page header
- *              Page header is updated.
- *
- *      Returns 0 for success
- *      -EPERM if not allowed due to ISR context
- *      -EAGAIN if no msg frames currently available
- *      -EFAULT for non-successful reply or no reply (timeout)
- */
-int
-mpt_toolbox(MPT_ADAPTER *ioc, CONFIGPARMS *pCfg)
-{
-        ToolboxIstwiReadWriteRequest_t  *pReq;
-        MPT_FRAME_HDR   *mf;
-        struct pci_dev  *pdev;
-        unsigned long    flags;
-        int              rc;
-        u32              flagsLength;
-        int              in_isr;
-
-        /*      Prevent calling wait_event() (below), if caller happens
-         *      to be in ISR context, because that is fatal!
-         */
-        in_isr = in_interrupt();
-        if (in_isr) {
-                dcprintk((MYIOC_s_WARN_FMT "toobox request not allowed in ISR context!\n",
-                                ioc->name));
-                return -EPERM;
-        }
-
-        /* Get and Populate a free Frame
-         */
-        if ((mf = mpt_get_msg_frame(mpt_base_index, ioc)) == NULL) {
-                dcprintk((MYIOC_s_WARN_FMT "mpt_toolbox: no msg frames!\n",
-                                ioc->name));
-                return -EAGAIN;
-        }
-        pReq = (ToolboxIstwiReadWriteRequest_t  *)mf;
-        pReq->Tool = pCfg->action;
-        pReq->Reserved = 0;
-        pReq->ChainOffset = 0;
-        pReq->Function = MPI_FUNCTION_TOOLBOX;
-        pReq->Reserved1 = 0;
-        pReq->Reserved2 = 0;
-        pReq->MsgFlags = 0;
-        pReq->Flags = pCfg->dir;
-        pReq->BusNum = 0;
-        pReq->Reserved3 = 0;
-        pReq->NumAddressBytes = 0x01;
-        pReq->Reserved4 = 0;
-        pReq->DataLength = cpu_to_le16(0x04);
-        pdev = ioc->pcidev;
-        if (pdev->devfn & 1)
-                pReq->DeviceAddr = 0xB2;
-        else
-                pReq->DeviceAddr = 0xB0;
-        pReq->Addr1 = 0;
-        pReq->Addr2 = 0;
-        pReq->Addr3 = 0;
-        pReq->Reserved5 = 0;
-
-        /* Add a SGE to the config request.
-         */
-
-        flagsLength = MPT_SGE_FLAGS_SSIMPLE_READ | 4;
-
-        mpt_add_sge((char *)&pReq->SGL, flagsLength, pCfg->physAddr);
-
-        dcprintk((MYIOC_s_INFO_FMT "Sending Toolbox request, Tool=%x\n",
-                ioc->name, pReq->Tool));
-
-        /* Append pCfg pointer to end of mf
-         */
-        *((void **) (((u8 *) mf) + (ioc->req_sz - sizeof(void *)))) =  (void *) pCfg;
-
-        /* Initalize the timer
-         */
-        init_timer(&pCfg->timer);
-        pCfg->timer.data = (unsigned long) ioc;
-        pCfg->timer.function = mpt_timer_expired;
-        pCfg->wait_done = 0;
-
-        /* Set the timer; ensure 10 second minimum */
-        if (pCfg->timeout < 10)
-                pCfg->timer.expires = jiffies + HZ*10;
-        else
-                pCfg->timer.expires = jiffies + HZ*pCfg->timeout;
-
-        /* Add to end of Q, set timer and then issue this command */
-        spin_lock_irqsave(&ioc->FreeQlock, flags);
-        list_add_tail(&pCfg->linkage, &ioc->configQ);
-        spin_unlock_irqrestore(&ioc->FreeQlock, flags);
-
-        add_timer(&pCfg->timer);
-        mpt_put_msg_frame(mpt_base_index, ioc, mf);
-        wait_event(mpt_waitq, pCfg->wait_done);
-
-        /* mf has been freed - do not access */
-
-        rc = pCfg->status;
-
-        return rc;
-}
-
-/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *      mpt_timer_expired - Call back for timer process.
  *      Used only internal config functionality.
@@ -6142,7 +6032,7 @@ ProcessEventNotification(MPT_ADAPTER *ioc, EventNotificationReply_t *pEventReply
         if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
                 int idx;
 
-                idx = ioc->eventContext % ioc->eventLogSize;
+                idx = ioc->eventContext % MPTCTL_EVENT_LOG_SIZE;
 
                 ioc->events[idx].event = event;
                 ioc->events[idx].eventContext = ioc->eventContext;
@@ -6540,7 +6430,6 @@ EXPORT_SYMBOL(mpt_lan_index);
 EXPORT_SYMBOL(mpt_stm_index);
 EXPORT_SYMBOL(mpt_HardResetHandler);
 EXPORT_SYMBOL(mpt_config);
-EXPORT_SYMBOL(mpt_toolbox);
 EXPORT_SYMBOL(mpt_findImVolumes);
 EXPORT_SYMBOL(mpt_read_ioc_pg_3);
 EXPORT_SYMBOL(mpt_alloc_fw_memory);
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index ea2649ecad1f..723d54300953 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -616,6 +616,7 @@ typedef struct _MPT_ADAPTER
          * increments by 32 bytes
          */
         int                      errata_flag_1064;
+        int                      aen_event_read_flag; /* flag to indicate event log was read*/
         u8                       FirstWhoInit;
         u8                       upload_fw;     /* If set, do a fw upload */
         u8                       reload_fw;     /* Force a FW Reload on next reset */
@@ -1026,7 +1027,6 @@ extern u32	 mpt_GetIocState(MPT_ADAPTER *ioc, int cooked);
 extern void      mpt_print_ioc_summary(MPT_ADAPTER *ioc, char *buf, int *size, int len, int showlan);
 extern int       mpt_HardResetHandler(MPT_ADAPTER *ioc, int sleepFlag);
 extern int       mpt_config(MPT_ADAPTER *ioc, CONFIGPARMS *cfg);
-extern int       mpt_toolbox(MPT_ADAPTER *ioc, CONFIGPARMS *cfg);
 extern void      mpt_alloc_fw_memory(MPT_ADAPTER *ioc, int size);
 extern void      mpt_free_fw_memory(MPT_ADAPTER *ioc);
 extern int       mpt_findImVolumes(MPT_ADAPTER *ioc);
diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c
index bdf709987982..9b64e07400da 100644
--- a/drivers/message/fusion/mptctl.c
+++ b/drivers/message/fusion/mptctl.c
@@ -136,6 +136,12 @@ static void mptctl_free_tm_flags(MPT_ADAPTER *ioc);
  */
 static int  mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase);
 
+/*
+ * Event Handler function
+ */
+static int mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply);
+struct fasync_struct *async_queue=NULL;
+
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  * Scatter gather list (SGL) sizes and limits...
@@ -385,18 +391,18 @@ static int mptctl_bus_reset(MPT_IOCTL *ioctl)
         }
 
         /* Now wait for the command to complete */
-        ii = wait_event_interruptible_timeout(mptctl_wait,
+        ii = wait_event_timeout(mptctl_wait,
              ioctl->wait_done == 1,
              HZ*5 /* 5 second timeout */);
 
         if(ii <=0 && (ioctl->wait_done != 1 ))  {
+                mpt_free_msg_frame(hd->ioc, mf);
                 ioctl->wait_done = 0;
                 retval = -1; /* return failure */
         }
 
 mptctl_bus_reset_done:
 
-        mpt_free_msg_frame(hd->ioc, mf);
         mptctl_free_tm_flags(ioctl->ioc);
         return retval;
 }
@@ -472,6 +478,69 @@ mptctl_ioc_reset(MPT_ADAPTER *ioc, int reset_phase)
 }
 
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
+/* ASYNC Event Notification Support */
+static int
+mptctl_event_process(MPT_ADAPTER *ioc, EventNotificationReply_t *pEvReply)
+{
+        u8 event;
+
+        event = le32_to_cpu(pEvReply->Event) & 0xFF;
+
+        dctlprintk(("%s() called\n", __FUNCTION__));
+        if(async_queue == NULL)
+                return 1;
+
+        /* Raise SIGIO for persistent events.
+         * TODO - this define is not in MPI spec yet,
+         * but they plan to set it to 0x21
+         */
+         if (event == 0x21 ) {
+                ioc->aen_event_read_flag=1;
+                dctlprintk(("Raised SIGIO to application\n"));
+                devtprintk(("Raised SIGIO to application\n"));
+                kill_fasync(&async_queue, SIGIO, POLL_IN);
+                return 1;
+         }
+
+        /* This flag is set after SIGIO was raised, and
+         * remains set until the application has read
+         * the event log via ioctl=MPTEVENTREPORT
+         */
+        if(ioc->aen_event_read_flag)
+                return 1;
+
+        /* Signal only for the events that are
+         * requested for by the application
+         */
+        if (ioc->events && (ioc->eventTypes & ( 1 << event))) {
+                ioc->aen_event_read_flag=1;
+                dctlprintk(("Raised SIGIO to application\n"));
+                devtprintk(("Raised SIGIO to application\n"));
+                kill_fasync(&async_queue, SIGIO, POLL_IN);
+        }
+        return 1;
+}
+
+static int
+mptctl_fasync(int fd, struct file *filep, int mode)
+{
+        MPT_ADAPTER     *ioc;
+
+        list_for_each_entry(ioc, &ioc_list, list)
+                ioc->aen_event_read_flag=0;
+
+        dctlprintk(("%s() called\n", __FUNCTION__));
+        return fasync_helper(fd, filep, mode, &async_queue);
+}
+
+static int
+mptctl_release(struct inode *inode, struct file *filep)
+{
+        dctlprintk(("%s() called\n", __FUNCTION__));
+        return fasync_helper(-1, filep, 0, &async_queue);
+}
+
+/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
  *  MPT ioctl handler
  *  cmd - specify the particular IOCTL command to be issued
@@ -674,22 +743,23 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
         u16                      iocstat;
         pFWDownloadReply_t       ReplyMsg = NULL;
 
-        dctlprintk((KERN_INFO "mptctl_do_fwdl called. mptctl_id = %xh.\n", mptctl_id));
+        dctlprintk(("mptctl_do_fwdl called. mptctl_id = %xh.\n", mptctl_id));
 
-        dctlprintk((KERN_INFO "DbG: kfwdl.bufp  = %p\n", ufwbuf));
-        dctlprintk((KERN_INFO "DbG: kfwdl.fwlen = %d\n", (int)fwlen));
-        dctlprintk((KERN_INFO "DbG: kfwdl.ioc   = %04xh\n", ioc));
+        dctlprintk(("DbG: kfwdl.bufp  = %p\n", ufwbuf));
+        dctlprintk(("DbG: kfwdl.fwlen = %d\n", (int)fwlen));
+        dctlprintk(("DbG: kfwdl.ioc   = %04xh\n", ioc));
 
-        if ((ioc = mpt_verify_adapter(ioc, &iocp)) < 0) {
-                dctlprintk(("%s@%d::_ioctl_fwdl - ioc%d not found!\n",
-                                __FILE__, __LINE__, ioc));
+        if (mpt_verify_adapter(ioc, &iocp) < 0) {
+                dctlprintk(("ioctl_fwdl - ioc%d not found!\n",
+                                 ioc));
                 return -ENODEV; /* (-6) No such device or address */
-        }
+        } else {
 
-        /*  Valid device. Get a message frame and construct the FW download message.
-         */
-        if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
-                return -EAGAIN;
+                /*  Valid device. Get a message frame and construct the FW download message.
+                */
+                if ((mf = mpt_get_msg_frame(mptctl_id, iocp)) == NULL)
+                        return -EAGAIN;
+        }
         dlmsg = (FWDownload_t*) mf;
         ptsge = (FWDownloadTCSGE_t *) &dlmsg->SGL;
         sgOut = (char *) (ptsge + 1);
@@ -702,7 +772,11 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
         dlmsg->ChainOffset = 0;
         dlmsg->Function = MPI_FUNCTION_FW_DOWNLOAD;
         dlmsg->Reserved1[0] = dlmsg->Reserved1[1] = dlmsg->Reserved1[2] = 0;
-        dlmsg->MsgFlags = 0;
+        if (iocp->facts.MsgVersion >= MPI_VERSION_01_05)
+                dlmsg->MsgFlags = MPI_FW_DOWNLOAD_MSGFLGS_LAST_SEGMENT;
+        else
+                dlmsg->MsgFlags = 0;
+
 
         /* Set up the Transaction SGE.
          */
@@ -754,7 +828,7 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
                 goto fwdl_out;
         }
 
-        dctlprintk((KERN_INFO "DbG: sgl buffer  = %p, sgfrags = %d\n", sgl, numfrags));
+        dctlprintk(("DbG: sgl buffer  = %p, sgfrags = %d\n", sgl, numfrags));
 
         /*
          * Parse SG list, copying sgl itself,
@@ -803,11 +877,11 @@ mptctl_do_fw_download(int ioc, char __user *ufwbuf, size_t fwlen)
         /*
          * Finally, perform firmware download.
          */
-        iocp->ioctl->wait_done = 0;
+        ReplyMsg = NULL;
         mpt_put_msg_frame(mptctl_id, iocp, mf);
 
         /* Now wait for the command to complete */
-        ret = wait_event_interruptible_timeout(mptctl_wait,
+        ret = wait_event_timeout(mptctl_wait,
              iocp->ioctl->wait_done == 1,
              HZ*60);
 
@@ -1145,7 +1219,9 @@ mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
         /* Fill in the data and return the structure to the calling
          * program
          */
-        if (ioc->bus_type == FC)
+        if (ioc->bus_type == SAS)
+                karg->adapterType = MPT_IOCTL_INTERFACE_SAS;
+        else if (ioc->bus_type == FC)
                 karg->adapterType = MPT_IOCTL_INTERFACE_FC;
         else
                 karg->adapterType = MPT_IOCTL_INTERFACE_SCSI;
@@ -1170,12 +1246,11 @@ mptctl_getiocinfo (unsigned long arg, unsigned int data_size)
                 karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
                 karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
         } else if (cim_rev == 2) {
-                /* Get the PCI bus, device, function and segment ID numbers 
+                /* Get the PCI bus, device, function and segment ID numbers
                    for the IOC */
                 karg->pciInfo.u.bits.busNumber = pdev->bus->number;
                 karg->pciInfo.u.bits.deviceNumber = PCI_SLOT( pdev->devfn );
                 karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
-                karg->pciInfo.u.bits.functionNumber = PCI_FUNC( pdev->devfn );
                 karg->pciInfo.segmentID = pci_domain_nr(pdev->bus);
         }
 
@@ -1500,7 +1575,7 @@ mptctl_eventquery (unsigned long arg)
                 return -ENODEV;
         }
 
-        karg.eventEntries = ioc->eventLogSize;
+        karg.eventEntries = MPTCTL_EVENT_LOG_SIZE;
         karg.eventTypes = ioc->eventTypes;
 
         /* Copy the data from kernel memory to user memory
@@ -1550,7 +1625,6 @@ mptctl_eventenable (unsigned long arg)
                 memset(ioc->events, 0, sz);
                 ioc->alloc_total += sz;
 
-                ioc->eventLogSize = MPTCTL_EVENT_LOG_SIZE;
                 ioc->eventContext = 0;
         }
 
@@ -1590,7 +1664,7 @@ mptctl_eventreport (unsigned long arg)
         maxEvents = numBytes/sizeof(MPT_IOCTL_EVENTS);
 
 
-        max = ioc->eventLogSize < maxEvents ? ioc->eventLogSize : maxEvents;
+        max = MPTCTL_EVENT_LOG_SIZE < maxEvents ? MPTCTL_EVENT_LOG_SIZE : maxEvents;
 
         /* If fewer than 1 event is requested, there must have
          * been some type of error.
@@ -1598,6 +1672,9 @@ mptctl_eventreport (unsigned long arg)
         if ((max < 1) || !ioc->events)
                 return -ENODATA;
 
+        /* reset this flag so SIGIO can restart */
+        ioc->aen_event_read_flag=0;
+
         /* Copy the data from kernel memory to user memory
          */
         numBytes = max * sizeof(MPT_IOCTL_EVENTS);
@@ -1817,6 +1894,8 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
         case MPI_FUNCTION_SCSI_ENCLOSURE_PROCESSOR:
         case MPI_FUNCTION_FW_DOWNLOAD:
         case MPI_FUNCTION_FC_PRIMITIVE_SEND:
+        case MPI_FUNCTION_TOOLBOX:
+        case MPI_FUNCTION_SAS_IO_UNIT_CONTROL:
                 break;
 
         case MPI_FUNCTION_SCSI_IO_REQUEST:
@@ -1837,7 +1916,9 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
                                 goto done_free_mem;
                         }
 
-                        pScsiReq->MsgFlags = mpt_msg_flags();
+                        pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
+                        pScsiReq->MsgFlags |= mpt_msg_flags();
+
 
                         /* verify that app has not requested
                          *      more sense data than driver
@@ -1888,6 +1969,25 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
                 }
                 break;
 
+        case MPI_FUNCTION_SMP_PASSTHROUGH:
+                /* Check mf->PassthruFlags to determine if
+                 * transfer is ImmediateMode or not.
+                 * Immediate mode returns data in the ReplyFrame.
+                 * Else, we are sending request and response data
+                 * in two SGLs at the end of the mf.
+                 */
+                break;
+
+        case MPI_FUNCTION_SATA_PASSTHROUGH:
+                if (!ioc->sh) {
+                        printk(KERN_ERR "%s@%d::mptctl_do_mpt_command - "
+                                "SCSI driver is not loaded. \n",
+                                        __FILE__, __LINE__);
+                        rc = -EFAULT;
+                        goto done_free_mem;
+                }
+                break;
+
         case MPI_FUNCTION_RAID_ACTION:
                 /* Just add a SGE
                  */
@@ -1900,7 +2000,9 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
                         int scsidir = MPI_SCSIIO_CONTROL_READ;
                         int dataSize;
 
-                        pScsiReq->MsgFlags = mpt_msg_flags();
+                        pScsiReq->MsgFlags &= ~MPI_SCSIIO_MSGFLGS_SENSE_WIDTH;
+                        pScsiReq->MsgFlags |= mpt_msg_flags();
+
 
                         /* verify that app has not requested
                          *      more sense data than driver
@@ -2130,7 +2232,7 @@ mptctl_do_mpt_command (struct mpt_ioctl_command karg, void __user *mfPtr)
 
         /* Now wait for the command to complete */
         timeout = (karg.timeout > 0) ? karg.timeout : MPT_IOCTL_DEFAULT_TIMEOUT;
-        timeout = wait_event_interruptible_timeout(mptctl_wait,
+        timeout = wait_event_timeout(mptctl_wait,
              ioc->ioctl->wait_done == 1,
              HZ*timeout);
 
@@ -2246,13 +2348,16 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
         hp_host_info_t  __user *uarg = (void __user *) arg;
         MPT_ADAPTER             *ioc;
         struct pci_dev          *pdev;
-        char                    *pbuf;
+        char                    *pbuf=NULL;
         dma_addr_t              buf_dma;
         hp_host_info_t          karg;
         CONFIGPARMS             cfg;
         ConfigPageHeader_t      hdr;
         int                     iocnum;
         int                     rc, cim_rev;
+        ToolboxIstwiReadWriteRequest_t  *IstwiRWRequest;
+        MPT_FRAME_HDR           *mf = NULL;
+        MPIHeader_t             *mpi_hdr;
 
         dctlprintk((": mptctl_hp_hostinfo called.\n"));
         /* Reset long to int. Should affect IA64 and SPARC only
@@ -2370,7 +2475,7 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
 
         karg.base_io_addr = pci_resource_start(pdev, 0);
 
-        if (ioc->bus_type == FC)
+        if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
                 karg.bus_phys_width = HP_BUS_WIDTH_UNK;
         else
                 karg.bus_phys_width = HP_BUS_WIDTH_16;
@@ -2388,20 +2493,67 @@ mptctl_hp_hostinfo(unsigned long arg, unsigned int data_size)
                 }
         }
 
-        cfg.pageAddr = 0;
-        cfg.action = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
-        cfg.dir = MPI_TB_ISTWI_FLAGS_READ;
-        cfg.timeout = 10;
+        /* 
+         * Gather ISTWI(Industry Standard Two Wire Interface) Data
+         */
+        if ((mf = mpt_get_msg_frame(mptctl_id, ioc)) == NULL) {
+                dfailprintk((MYIOC_s_WARN_FMT "%s, no msg frames!!\n",
+                    ioc->name,__FUNCTION__));
+                goto out;
+        }
+
+        IstwiRWRequest = (ToolboxIstwiReadWriteRequest_t *)mf;
+        mpi_hdr = (MPIHeader_t *) mf;
+        memset(IstwiRWRequest,0,sizeof(ToolboxIstwiReadWriteRequest_t));
+        IstwiRWRequest->Function = MPI_FUNCTION_TOOLBOX;
+        IstwiRWRequest->Tool = MPI_TOOLBOX_ISTWI_READ_WRITE_TOOL;
+        IstwiRWRequest->MsgContext = mpi_hdr->MsgContext;
+        IstwiRWRequest->Flags = MPI_TB_ISTWI_FLAGS_READ;
+        IstwiRWRequest->NumAddressBytes = 0x01;
+        IstwiRWRequest->DataLength = cpu_to_le16(0x04);
+        if (pdev->devfn & 1)
+                IstwiRWRequest->DeviceAddr = 0xB2;
+        else
+                IstwiRWRequest->DeviceAddr = 0xB0;
+
         pbuf = pci_alloc_consistent(ioc->pcidev, 4, &buf_dma);
-        if (pbuf) {
-                cfg.physAddr = buf_dma;
-                if ((mpt_toolbox(ioc, &cfg)) == 0) {
-                        karg.rsvd = *(u32 *)pbuf;
-                }
-                pci_free_consistent(ioc->pcidev, 4, pbuf, buf_dma);
-                pbuf = NULL;
+        if (!pbuf)
+                goto out;
+        mpt_add_sge((char *)&IstwiRWRequest->SGL,
+            (MPT_SGE_FLAGS_SSIMPLE_READ|4), buf_dma);
+
+        ioc->ioctl->wait_done = 0;
+        mpt_put_msg_frame(mptctl_id, ioc, mf);
+
+        rc = wait_event_timeout(mptctl_wait,
+             ioc->ioctl->wait_done == 1,
+             HZ*MPT_IOCTL_DEFAULT_TIMEOUT /* 10 sec */);
+
+        if(rc <=0 && (ioc->ioctl->wait_done != 1 )) {
+                /* 
+                 * Now we need to reset the board
+                 */
+                mpt_free_msg_frame(ioc, mf);
+                mptctl_timeout_expired(ioc->ioctl);
+                goto out;
         }
 
+        /* 
+         *ISTWI Data Definition
+         * pbuf[0] = FW_VERSION = 0x4
+         * pbuf[1] = Bay Count = 6 or 4 or 2, depending on
+         *  the config, you should be seeing one out of these three values
+         * pbuf[2] = Drive Installed Map = bit pattern depend on which
+         *   bays have drives in them
+         * pbuf[3] = Checksum (0x100 = (byte0 + byte2 + byte3)
+         */
+        if (ioc->ioctl->status & MPT_IOCTL_STATUS_RF_VALID)
+                karg.rsvd = *(u32 *)pbuf;
+
+ out:
+        if (pbuf)
+                pci_free_consistent(ioc->pcidev, 4, pbuf, buf_dma);
+
         /* Copy the data from kernel memory to user memory
          */
         if (copy_to_user((char __user *)arg, &karg, sizeof(hp_host_info_t))) {
@@ -2459,7 +2611,7 @@ mptctl_hp_targetinfo(unsigned long arg)
 
         /*  There is nothing to do for FCP parts.
          */
-        if (ioc->bus_type == FC)
+        if ((ioc->bus_type == SAS) || (ioc->bus_type == FC))
                 return 0;
 
         if ((ioc->spi_data.sdp0length == 0) || (ioc->sh == NULL))
@@ -2569,6 +2721,8 @@ mptctl_hp_targetinfo(unsigned long arg)
 static struct file_operations mptctl_fops = {
         .owner =        THIS_MODULE,
         .llseek =       no_llseek,
+        .release =      mptctl_release,
+        .fasync =       mptctl_fasync,
         .unlocked_ioctl = mptctl_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = compat_mpctl_ioctl,
@@ -2813,6 +2967,11 @@ static int __init mptctl_init(void)
                 /* FIXME! */
         }
 
+        if (mpt_event_register(mptctl_id, mptctl_event_process) == 0) {
+                devtprintk((KERN_INFO MYNAM
+                  ": Registered for IOC event notifications\n"));
+        }
+
         return 0;
 
 out_fail:
diff --git a/drivers/message/fusion/mptctl.h b/drivers/message/fusion/mptctl.h
index 518996e03481..a2f8a97992e6 100644
--- a/drivers/message/fusion/mptctl.h
+++ b/drivers/message/fusion/mptctl.h
@@ -169,8 +169,10 @@ struct mpt_ioctl_pci_info2 {
  *  Read only.
  *  Data starts at offset 0xC
  */
-#define MPT_IOCTL_INTERFACE_FC          (0x01)
 #define MPT_IOCTL_INTERFACE_SCSI        (0x00)
+#define MPT_IOCTL_INTERFACE_FC          (0x01)
+#define MPT_IOCTL_INTERFACE_FC_IP       (0x02)
+#define MPT_IOCTL_INTERFACE_SAS         (0x03)
 #define MPT_IOCTL_VERSION_LENGTH        (32)
 
 struct mpt_ioctl_iocinfo {
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 05789e505464..4fee6befc93d 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -2489,7 +2489,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR
                                 int idx;
                                 MPT_ADAPTER *ioc = hd->ioc;
 
-                                idx = ioc->eventContext % ioc->eventLogSize;
+                                idx = ioc->eventContext % MPTCTL_EVENT_LOG_SIZE;
                                 ioc->events[idx].event = MPI_EVENT_SCSI_DEVICE_STATUS_CHANGE;
                                 ioc->events[idx].eventContext = ioc->eventContext;
 
diff --git a/drivers/message/i2o/i2o_scsi.c b/drivers/message/i2o/i2o_scsi.c
index f9e5a23697a1..c08ddac3717d 100644
--- a/drivers/message/i2o/i2o_scsi.c
+++ b/drivers/message/i2o/i2o_scsi.c
@@ -732,7 +732,7 @@ static int i2o_scsi_abort(struct scsi_cmnd *SCpnt)
             cpu_to_le32(I2O_CMD_SCSI_ABORT << 24 | HOST_TID << 12 | tid);
         msg->body[0] = cpu_to_le32(i2o_cntxt_list_get_ptr(c, SCpnt));
 
-        if (i2o_msg_post_wait(c, msg, I2O_TIMEOUT_SCSI_SCB_ABORT))
+        if (!i2o_msg_post_wait(c, msg, I2O_TIMEOUT_SCSI_SCB_ABORT))
                 status = SUCCESS;
 
         return status;
diff --git a/drivers/misc/ibmasm/ibmasm.h b/drivers/misc/ibmasm/ibmasm.h
index 1cef2387fa65..6aba41954448 100644
--- a/drivers/misc/ibmasm/ibmasm.h
+++ b/drivers/misc/ibmasm/ibmasm.h
@@ -101,15 +101,16 @@ struct command {
 static inline void command_put(struct command *cmd)
 {
         unsigned long flags;
+        spinlock_t *lock = cmd->lock;
 
-        spin_lock_irqsave(cmd->lock, flags);
-        kobject_put(&cmd->kobj);
-        spin_unlock_irqrestore(cmd->lock, flags);
+        spin_lock_irqsave(lock, flags);
+        kobject_put(&cmd->kobj);
+        spin_unlock_irqrestore(lock, flags);
 }
 
 static inline void command_get(struct command *cmd)
 {
-        kobject_get(&cmd->kobj);
+        kobject_get(&cmd->kobj);
 }
 
 
diff --git a/drivers/mmc/Kconfig b/drivers/mmc/Kconfig
index c483a863b116..5d397b7a5497 100644
--- a/drivers/mmc/Kconfig
+++ b/drivers/mmc/Kconfig
@@ -65,7 +65,7 @@ config MMC_AU1X
         depends on SOC_AU1X00 && MMC
         help
           This selects the AMD Alchemy(R) Multimedia card interface.
-          iIf you have a Alchemy platform with a MMC slot, say Y or M here.
+          If you have a Alchemy platform with a MMC slot, say Y or M here.
 
           If unsure, say N.
 
diff --git a/drivers/mmc/au1xmmc.c b/drivers/mmc/au1xmmc.c
index aaf04638054e..8d84b045bc83 100644
--- a/drivers/mmc/au1xmmc.c
+++ b/drivers/mmc/au1xmmc.c
@@ -37,7 +37,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/device.h>
+#include <linux/platform_device.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
@@ -194,7 +194,7 @@ static int au1xmmc_send_command(struct au1xmmc_host *host, int wait,
 
         u32 mmccmd = (cmd->opcode << SD_CMD_CI_SHIFT);
 
-        switch(cmd->flags) {
+        switch (mmc_resp_type(cmd)) {
         case MMC_RSP_R1:
                 mmccmd |= SD_CMD_RT_1;
                 break;
@@ -483,34 +483,35 @@ static void au1xmmc_cmd_complete(struct au1xmmc_host *host, u32 status)
         cmd = mrq->cmd;
         cmd->error = MMC_ERR_NONE;
 
-        if ((cmd->flags & MMC_RSP_MASK) == MMC_RSP_SHORT) {
-
-                /* Techincally, we should be getting all 48 bits of the response
-                 * (SD_RESP1 + SD_RESP2), but because our response omits the CRC,
-                 * our data ends up being shifted 8 bits to the right.  In this case,
-                 * that means that the OSR data starts at bit 31, so we can just
-                 * read RESP0 and return that
-                 */
-
-                cmd->resp[0] = au_readl(host->iobase + SD_RESP0);
-        }
-        else if ((cmd->flags & MMC_RSP_MASK) == MMC_RSP_LONG) {
-                u32 r[4];
-                int i;
-
-                r[0] = au_readl(host->iobase + SD_RESP3);
-                r[1] = au_readl(host->iobase + SD_RESP2);
-                r[2] = au_readl(host->iobase + SD_RESP1);
-                r[3] = au_readl(host->iobase + SD_RESP0);
-
-                /* The CRC is omitted from the response, so really we only got
-                 * 120 bytes, but the engine expects 128 bits, so we have to shift
-                 * things up
-                 */
-
-                for(i = 0; i < 4; i++) {
-                        cmd->resp[i] = (r[i] & 0x00FFFFFF) << 8;
-                        if (i != 3) cmd->resp[i] |= (r[i + 1] & 0xFF000000) >> 24;
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136) {
+                        u32 r[4];
+                        int i;
+
+                        r[0] = au_readl(host->iobase + SD_RESP3);
+                        r[1] = au_readl(host->iobase + SD_RESP2);
+                        r[2] = au_readl(host->iobase + SD_RESP1);
+                        r[3] = au_readl(host->iobase + SD_RESP0);
+
+                        /* The CRC is omitted from the response, so really
+                         * we only got 120 bytes, but the engine expects
+                         * 128 bits, so we have to shift things up
+                         */
+
+                        for(i = 0; i < 4; i++) {
+                                cmd->resp[i] = (r[i] & 0x00FFFFFF) << 8;
+                                if (i != 3)
+                                        cmd->resp[i] |= (r[i + 1] & 0xFF000000) >> 24;
+                        }
+                } else {
+                        /* Techincally, we should be getting all 48 bits of
+                         * the response (SD_RESP1 + SD_RESP2), but because
+                         * our response omits the CRC, our data ends up
+                         * being shifted 8 bits to the right.  In this case,
+                         * that means that the OSR data starts at bit 31,
+                         * so we can just read RESP0 and return that
+                         */
+                        cmd->resp[0] = au_readl(host->iobase + SD_RESP0);
                 }
         }
 
@@ -739,7 +740,6 @@ static void au1xmmc_set_ios(struct mmc_host* mmc, struct mmc_ios* ios)
 static void au1xmmc_dma_callback(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct au1xmmc_host *host = (struct au1xmmc_host *) dev_id;
-        u32 status;
 
         /* Avoid spurious interrupts */
 
@@ -886,7 +886,7 @@ struct mmc_host_ops au1xmmc_ops = {
         .set_ios        = au1xmmc_set_ios,
 };
 
-static int au1xmmc_probe(struct device *dev)
+static int __devinit au1xmmc_probe(struct platform_device *pdev)
 {
 
         int i, ret = 0;
@@ -903,7 +903,7 @@ static int au1xmmc_probe(struct device *dev)
         disable_irq(AU1100_SD_IRQ);
 
         for(i = 0; i < AU1XMMC_CONTROLLER_COUNT; i++) {
-                struct mmc_host *mmc = mmc_alloc_host(sizeof(struct au1xmmc_host), dev);
+                struct mmc_host *mmc = mmc_alloc_host(sizeof(struct au1xmmc_host), &pdev->dev);
                 struct au1xmmc_host *host = 0;
 
                 if (!mmc) {
@@ -966,7 +966,7 @@ static int au1xmmc_probe(struct device *dev)
         return 0;
 }
 
-static int au1xmmc_remove(struct device *dev)
+static int __devexit au1xmmc_remove(struct platform_device *pdev)
 {
 
         int i;
@@ -996,23 +996,24 @@ static int au1xmmc_remove(struct device *dev)
         return 0;
 }
 
-static struct device_driver au1xmmc_driver = {
-        .name          = DRIVER_NAME,
-        .bus           = &platform_bus_type,
+static struct platform_driver au1xmmc_driver = {
         .probe         = au1xmmc_probe,
         .remove        = au1xmmc_remove,
         .suspend       = NULL,
-        .resume        = NULL
+        .resume        = NULL,
+        .driver        = {
+                .name  = DRIVER_NAME,
+        },
 };
 
 static int __init au1xmmc_init(void)
 {
-        return driver_register(&au1xmmc_driver);
+        return platform_driver_register(&au1xmmc_driver);
 }
 
 static void __exit au1xmmc_exit(void)
 {
-        driver_unregister(&au1xmmc_driver);
+        platform_driver_unregister(&au1xmmc_driver);
 }
 
 module_init(au1xmmc_init);
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index bfca5c176e88..1888060c5e0c 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -211,7 +211,7 @@ int mmc_wait_for_app_cmd(struct mmc_host *host, unsigned int rca,
 
                 appcmd.opcode = MMC_APP_CMD;
                 appcmd.arg = rca << 16;
-                appcmd.flags = MMC_RSP_R1;
+                appcmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
                 appcmd.retries = 0;
                 memset(appcmd.resp, 0, sizeof(appcmd.resp));
                 appcmd.data = NULL;
@@ -331,7 +331,7 @@ static int mmc_select_card(struct mmc_host *host, struct mmc_card *card)
 
         cmd.opcode = MMC_SELECT_CARD;
         cmd.arg = card->rca << 16;
-        cmd.flags = MMC_RSP_R1;
+        cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
 
         err = mmc_wait_for_cmd(host, &cmd, CMD_RETRIES);
         if (err != MMC_ERR_NONE)
@@ -358,7 +358,7 @@ static int mmc_select_card(struct mmc_host *host, struct mmc_card *card)
                         struct mmc_command cmd;
                         cmd.opcode = SD_APP_SET_BUS_WIDTH;
                         cmd.arg = SD_BUS_WIDTH_4;
-                        cmd.flags = MMC_RSP_R1;
+                        cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
 
                         err = mmc_wait_for_app_cmd(host, card->rca, &cmd,
                                 CMD_RETRIES);
@@ -386,7 +386,7 @@ static void mmc_deselect_cards(struct mmc_host *host)
 
                 cmd.opcode = MMC_SELECT_CARD;
                 cmd.arg = 0;
-                cmd.flags = MMC_RSP_NONE;
+                cmd.flags = MMC_RSP_NONE | MMC_CMD_AC;
 
                 mmc_wait_for_cmd(host, &cmd, 0);
         }
@@ -677,7 +677,7 @@ static void mmc_idle_cards(struct mmc_host *host)
 
         cmd.opcode = MMC_GO_IDLE_STATE;
         cmd.arg = 0;
-        cmd.flags = MMC_RSP_NONE;
+        cmd.flags = MMC_RSP_NONE | MMC_CMD_BC;
 
         mmc_wait_for_cmd(host, &cmd, 0);
 
@@ -738,7 +738,7 @@ static int mmc_send_op_cond(struct mmc_host *host, u32 ocr, u32 *rocr)
 
         cmd.opcode = MMC_SEND_OP_COND;
         cmd.arg = ocr;
-        cmd.flags = MMC_RSP_R3;
+        cmd.flags = MMC_RSP_R3 | MMC_CMD_BCR;
 
         for (i = 100; i; i--) {
                 err = mmc_wait_for_cmd(host, &cmd, 0);
@@ -766,7 +766,7 @@ static int mmc_send_app_op_cond(struct mmc_host *host, u32 ocr, u32 *rocr)
 
         cmd.opcode = SD_APP_OP_COND;
         cmd.arg = ocr;
-        cmd.flags = MMC_RSP_R3;
+        cmd.flags = MMC_RSP_R3 | MMC_CMD_BCR;
 
         for (i = 100; i; i--) {
                 err = mmc_wait_for_app_cmd(host, 0, &cmd, CMD_RETRIES);
@@ -805,7 +805,7 @@ static void mmc_discover_cards(struct mmc_host *host)
 
                 cmd.opcode = MMC_ALL_SEND_CID;
                 cmd.arg = 0;
-                cmd.flags = MMC_RSP_R2;
+                cmd.flags = MMC_RSP_R2 | MMC_CMD_BCR;
 
                 err = mmc_wait_for_cmd(host, &cmd, CMD_RETRIES);
                 if (err == MMC_ERR_TIMEOUT) {
@@ -835,7 +835,7 @@ static void mmc_discover_cards(struct mmc_host *host)
 
                         cmd.opcode = SD_SEND_RELATIVE_ADDR;
                         cmd.arg = 0;
-                        cmd.flags = MMC_RSP_R6;
+                        cmd.flags = MMC_RSP_R6 | MMC_CMD_BCR;
 
                         err = mmc_wait_for_cmd(host, &cmd, CMD_RETRIES);
                         if (err != MMC_ERR_NONE)
@@ -856,7 +856,7 @@ static void mmc_discover_cards(struct mmc_host *host)
                 } else {
                         cmd.opcode = MMC_SET_RELATIVE_ADDR;
                         cmd.arg = card->rca << 16;
-                        cmd.flags = MMC_RSP_R1;
+                        cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
 
                         err = mmc_wait_for_cmd(host, &cmd, CMD_RETRIES);
                         if (err != MMC_ERR_NONE)
@@ -878,7 +878,7 @@ static void mmc_read_csds(struct mmc_host *host)
 
                 cmd.opcode = MMC_SEND_CSD;
                 cmd.arg = card->rca << 16;
-                cmd.flags = MMC_RSP_R2;
+                cmd.flags = MMC_RSP_R2 | MMC_CMD_AC;
 
                 err = mmc_wait_for_cmd(host, &cmd, CMD_RETRIES);
                 if (err != MMC_ERR_NONE) {
@@ -920,7 +920,7 @@ static void mmc_read_scrs(struct mmc_host *host)
 
                 cmd.opcode = MMC_APP_CMD;
                 cmd.arg = card->rca << 16;
-                cmd.flags = MMC_RSP_R1;
+                cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
 
                 err = mmc_wait_for_cmd(host, &cmd, 0);
                 if ((err != MMC_ERR_NONE) || !(cmd.resp[0] & R1_APP_CMD)) {
@@ -932,7 +932,7 @@ static void mmc_read_scrs(struct mmc_host *host)
 
                 cmd.opcode = SD_APP_SEND_SCR;
                 cmd.arg = 0;
-                cmd.flags = MMC_RSP_R1;
+                cmd.flags = MMC_RSP_R1 | MMC_CMD_ADTC;
 
                 memset(&data, 0, sizeof(struct mmc_data));
 
@@ -1003,7 +1003,7 @@ static void mmc_check_cards(struct mmc_host *host)
 
                 cmd.opcode = MMC_SEND_STATUS;
                 cmd.arg = card->rca << 16;
-                cmd.flags = MMC_RSP_R1;
+                cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
 
                 err = mmc_wait_for_cmd(host, &cmd, CMD_RETRIES);
                 if (err == MMC_ERR_NONE)
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index 5b014c370e80..8eb2a2ede64b 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -171,14 +171,14 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 brq.mrq.data = &brq.data;
 
                 brq.cmd.arg = req->sector << 9;
-                brq.cmd.flags = MMC_RSP_R1;
+                brq.cmd.flags = MMC_RSP_R1 | MMC_CMD_ADTC;
                 brq.data.timeout_ns = card->csd.tacc_ns * 10;
                 brq.data.timeout_clks = card->csd.tacc_clks * 10;
                 brq.data.blksz_bits = md->block_bits;
                 brq.data.blocks = req->nr_sectors >> (md->block_bits - 9);
                 brq.stop.opcode = MMC_STOP_TRANSMISSION;
                 brq.stop.arg = 0;
-                brq.stop.flags = MMC_RSP_R1B;
+                brq.stop.flags = MMC_RSP_R1B | MMC_CMD_AC;
 
                 if (rq_data_dir(req) == READ) {
                         brq.cmd.opcode = brq.data.blocks > 1 ? MMC_READ_MULTIPLE_BLOCK : MMC_READ_SINGLE_BLOCK;
@@ -223,7 +223,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
 
                         cmd.opcode = MMC_SEND_STATUS;
                         cmd.arg = card->rca << 16;
-                        cmd.flags = MMC_RSP_R1;
+                        cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
                         err = mmc_wait_for_cmd(card->host, &cmd, 5);
                         if (err) {
                                 printk(KERN_ERR "%s: error %d requesting status\n",
@@ -430,7 +430,7 @@ mmc_blk_set_blksize(struct mmc_blk_data *md, struct mmc_card *card)
         mmc_card_claim_host(card);
         cmd.opcode = MMC_SET_BLOCKLEN;
         cmd.arg = 1 << md->block_bits;
-        cmd.flags = MMC_RSP_R1;
+        cmd.flags = MMC_RSP_R1 | MMC_CMD_AC;
         err = mmc_wait_for_cmd(card->host, &cmd, 5);
         mmc_card_release_host(card);
 
diff --git a/drivers/mmc/mmci.c b/drivers/mmc/mmci.c
index 634ef53e85a5..9fef29d978b5 100644
--- a/drivers/mmc/mmci.c
+++ b/drivers/mmc/mmci.c
@@ -97,6 +97,13 @@ static void mmci_start_data(struct mmci_host *host, struct mmc_data *data)
         if (data->flags & MMC_DATA_READ) {
                 datactrl |= MCI_DPSM_DIRECTION;
                 irqmask = MCI_RXFIFOHALFFULLMASK;
+
+                /*
+                 * If we have less than a FIFOSIZE of bytes to transfer,
+                 * trigger a PIO interrupt as soon as any data is available.
+                 */
+                if (host->size < MCI_FIFOSIZE)
+                        irqmask |= MCI_RXDATAAVLBLMASK;
         } else {
                 /*
                  * We don't actually need to include "FIFO empty" here
@@ -124,15 +131,10 @@ mmci_start_command(struct mmci_host *host, struct mmc_command *cmd, u32 c)
         }
 
         c |= cmd->opcode | MCI_CPSM_ENABLE;
-        switch (cmd->flags & MMC_RSP_MASK) {
-        case MMC_RSP_NONE:
-        default:
-                break;
-        case MMC_RSP_LONG:
-                c |= MCI_CPSM_LONGRSP;
-        case MMC_RSP_SHORT:
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136)
+                        c |= MCI_CPSM_LONGRSP;
                 c |= MCI_CPSM_RESPONSE;
-                break;
         }
         if (/*interrupt*/0)
                 c |= MCI_CPSM_INTERRUPT;
diff --git a/drivers/mmc/pxamci.c b/drivers/mmc/pxamci.c
index ee8f8a0420d1..285d7d068097 100644
--- a/drivers/mmc/pxamci.c
+++ b/drivers/mmc/pxamci.c
@@ -178,14 +178,15 @@ static void pxamci_start_cmd(struct pxamci_host *host, struct mmc_command *cmd,
         if (cmd->flags & MMC_RSP_BUSY)
                 cmdat |= CMDAT_BUSY;
 
-        switch (cmd->flags & (MMC_RSP_MASK | MMC_RSP_CRC)) {
-        case MMC_RSP_SHORT | MMC_RSP_CRC:
+#define RSP_TYPE(x)     ((x) & ~(MMC_RSP_BUSY|MMC_RSP_OPCODE))
+        switch (RSP_TYPE(mmc_resp_type(cmd))) {
+        case RSP_TYPE(MMC_RSP_R1): /* r1, r1b, r6 */
                 cmdat |= CMDAT_RESP_SHORT;
                 break;
-        case MMC_RSP_SHORT:
+        case RSP_TYPE(MMC_RSP_R3):
                 cmdat |= CMDAT_RESP_R3;
                 break;
-        case MMC_RSP_LONG | MMC_RSP_CRC:
+        case RSP_TYPE(MMC_RSP_R2):
                 cmdat |= CMDAT_RESP_R2;
                 break;
         default:
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index f25757625361..3be397d436fa 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -459,7 +459,7 @@ static void wbsd_send_command(struct wbsd_host *host, struct mmc_command *cmd)
         /*
          * Do we expect a reply?
          */
-        if ((cmd->flags & MMC_RSP_MASK) != MMC_RSP_NONE) {
+        if (cmd->flags & MMC_RSP_PRESENT) {
                 /*
                  * Read back status.
                  */
@@ -476,10 +476,10 @@ static void wbsd_send_command(struct wbsd_host *host, struct mmc_command *cmd)
                         cmd->error = MMC_ERR_BADCRC;
                 /* All ok */
                 else {
-                        if ((cmd->flags & MMC_RSP_MASK) == MMC_RSP_SHORT)
-                                wbsd_get_short_reply(host, cmd);
-                        else
+                        if (cmd->flags & MMC_RSP_136)
                                 wbsd_get_long_reply(host, cmd);
+                        else
+                                wbsd_get_short_reply(host, cmd);
                 }
         }
 
diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index effa0d7a73ac..205bb7083335 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -301,7 +301,7 @@ config MTD_JEDEC
 
 config MTD_XIP
         bool "XIP aware MTD support"
-        depends on !SMP && (MTD_CFI_INTELEXT || MTD_CFI_AMDSTD) && EXPERIMENTAL && ARM
+        depends on !SMP && (MTD_CFI_INTELEXT || MTD_CFI_AMDSTD) && EXPERIMENTAL && ARCH_MTD_XIP
         default y if XIP_KERNEL
         help
           This allows MTD support to work with flash memory which is also
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 69c04945591f..1c074d63ff3a 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -408,6 +408,7 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
                 cfi->chips[i].buffer_write_time = 1<<cfi->cfiq->BufWriteTimeoutTyp;
                 cfi->chips[i].erase_time = 1<<cfi->cfiq->BlockEraseTimeoutTyp;
                 cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
         }
 
         map->fldrv = &cfi_intelext_chipdrv;
@@ -1019,8 +1020,8 @@ static void __xipram xip_udelay(struct map_info *map, struct flchip *chip,
 #define XIP_INVAL_CACHED_RANGE(map, from, size)  \
         INVALIDATE_CACHED_RANGE(map, from, size)
 
-#define INVALIDATE_CACHE_UDELAY(map, chip, adr, len, usec)  \
-        UDELAY(map, chip, adr, usec)
+#define INVALIDATE_CACHE_UDELAY(map, chip, cmd_adr, adr, len, usec)  \
+        UDELAY(map, chip, cmd_adr, usec)
 
 /*
  * Extra notes:
@@ -1052,7 +1053,7 @@ do {  \
         spin_lock(chip->mutex);  \
 } while (0)
 
-#define INVALIDATE_CACHE_UDELAY(map, chip, adr, len, usec)  \
+#define INVALIDATE_CACHE_UDELAY(map, chip, cmd_adr, adr, len, usec)  \
 do {  \
         spin_unlock(chip->mutex);  \
         INVALIDATE_CACHED_RANGE(map, adr, len);  \
@@ -1284,7 +1285,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
         map_write(map, datum, adr);
         chip->state = mode;
 
-        INVALIDATE_CACHE_UDELAY(map, chip,
+        INVALIDATE_CACHE_UDELAY(map, chip, adr,
                                 adr, map_bankwidth(map),
                                 chip->word_write_time);
 
@@ -1572,8 +1573,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         map_write(map, CMD(0xd0), cmd_adr);
         chip->state = FL_WRITING;
 
-        INVALIDATE_CACHE_UDELAY(map, chip,
-                                cmd_adr, len,
+        INVALIDATE_CACHE_UDELAY(map, chip, cmd_adr,
+                                adr, len,
                                 chip->buffer_write_time);
 
         timeo = jiffies + (HZ/2);
@@ -1744,7 +1745,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
 
-        INVALIDATE_CACHE_UDELAY(map, chip,
+        INVALIDATE_CACHE_UDELAY(map, chip, adr,
                                 adr, len,
                                 chip->erase_time*1000/2);
 
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 155737e7483f..a19480d07888 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -178,7 +178,7 @@ static int dataflash_erase(struct mtd_info *mtd, struct erase_info *instr)
                  * we're at a block boundary and need to erase the whole block.
                  */
                 pageaddr = instr->addr / priv->page_size;
-                do_block = (pageaddr & 0x7) == 0 && instr->len <= blocksize;
+                do_block = (pageaddr & 0x7) == 0 && instr->len >= blocksize;
                 pageaddr = pageaddr << priv->page_offset;
 
                 command[0] = do_block ? OP_ERASE_BLOCK : OP_ERASE_PAGE;
diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c
index 7b7ca5ab5ae4..8815c8dbef2d 100644
--- a/drivers/mtd/redboot.c
+++ b/drivers/mtd/redboot.c
@@ -1,5 +1,5 @@
 /*
- * $Id: redboot.c,v 1.18 2005/11/07 11:14:21 gleixner Exp $
+ * $Id: redboot.c,v 1.19 2005/12/01 10:03:51 dwmw2 Exp $
  *
  * Parse RedBoot-style Flash Image System (FIS) tables and
  * produce a Linux partition array to match.
@@ -89,8 +89,32 @@ static int parse_redboot_partitions(struct mtd_info *master,
                         i = numslots;
                         break;
                 }
-                if (!memcmp(buf[i].name, "FIS directory", 14))
+                if (!memcmp(buf[i].name, "FIS directory", 14)) {
+                        /* This is apparently the FIS directory entry for the
+                         * FIS directory itself.  The FIS directory size is
+                         * one erase block; if the buf[i].size field is
+                         * swab32(erasesize) then we know we are looking at
+                         * a byte swapped FIS directory - swap all the entries!
+                         * (NOTE: this is 'size' not 'data_length'; size is
+                         * the full size of the entry.)
+                         */
+                        if (swab32(buf[i].size) == master->erasesize) {
+                                int j;
+                                for (j = 0; j < numslots && buf[j].name[0] != 0xff; ++j) {
+                                        /* The unsigned long fields were written with the
+                                         * wrong byte sex, name and pad have no byte sex.
+                                         */
+                                        swab32s(&buf[j].flash_base);
+                                        swab32s(&buf[j].mem_base);
+                                        swab32s(&buf[j].size);
+                                        swab32s(&buf[j].entry_point);
+                                        swab32s(&buf[j].data_length);
+                                        swab32s(&buf[j].desc_cksum);
+                                        swab32s(&buf[j].file_cksum);
+                                }
+                        }
                         break;
+                }
         }
         if (i == numslots) {
                 /* Didn't find it */
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 824e430486c2..830528dce0ca 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1574,6 +1574,7 @@ MODULE_LICENSE("GPL");
 
 static int __init el3_init_module(void)
 {
+        int ret = 0;
         el3_cards = 0;
 
         if (debug >= 0)
@@ -1589,14 +1590,16 @@ static int __init el3_init_module(void)
         }
 
 #ifdef CONFIG_EISA
-        if (eisa_driver_register (&el3_eisa_driver) < 0) {
-                eisa_driver_unregister (&el3_eisa_driver);
-        }
+        ret = eisa_driver_register(&el3_eisa_driver);
 #endif
 #ifdef CONFIG_MCA
-        mca_register_driver(&el3_mca_driver);
+        {
+                int err = mca_register_driver(&el3_mca_driver);
+                if (ret == 0)
+                        ret = err;
+        }
 #endif
-        return 0;
+        return ret;
 }
 
 static void __exit el3_cleanup_module(void)
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index f822cd3025ff..dd410496aadb 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -1118,13 +1118,18 @@ err_out:
         return -ENOMEM;
 }
 
+static void cp_init_rings_index (struct cp_private *cp)
+{
+        cp->rx_tail = 0;
+        cp->tx_head = cp->tx_tail = 0;
+}
+
 static int cp_init_rings (struct cp_private *cp)
 {
         memset(cp->tx_ring, 0, sizeof(struct cp_desc) * CP_TX_RING_SIZE);
         cp->tx_ring[CP_TX_RING_SIZE - 1].opts1 = cpu_to_le32(RingEnd);
 
-        cp->rx_tail = 0;
-        cp->tx_head = cp->tx_tail = 0;
+        cp_init_rings_index(cp);
 
         return cp_refill_rx (cp);
 }
@@ -1886,30 +1891,30 @@ static int cp_suspend (struct pci_dev *pdev, pm_message_t state)
 
         spin_unlock_irqrestore (&cp->lock, flags);
 
-        if (cp->pdev && cp->wol_enabled) {
-                pci_save_state (cp->pdev);
-                cp_set_d3_state (cp);
-        }
+        pci_save_state(pdev);
+        pci_enable_wake(pdev, pci_choose_state(pdev, state), cp->wol_enabled);
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
 
         return 0;
 }
 
 static int cp_resume (struct pci_dev *pdev)
 {
-        struct net_device *dev;
-        struct cp_private *cp;
+        struct net_device *dev = pci_get_drvdata (pdev);
+        struct cp_private *cp = netdev_priv(dev);
         unsigned long flags;
 
-        dev = pci_get_drvdata (pdev);
-        cp  = netdev_priv(dev);
+        if (!netif_running(dev))
+                return 0;
 
         netif_device_attach (dev);
-        
-        if (cp->pdev && cp->wol_enabled) {
-                pci_set_power_state (cp->pdev, PCI_D0);
-                pci_restore_state (cp->pdev);
-        }
-        
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        pci_enable_wake(pdev, PCI_D0, 0);
+
+        /* FIXME: sh*t may happen if the Rx ring buffer is depleted */
+        cp_init_rings_index (cp);
         cp_init_hw (cp);
         netif_start_queue (dev);
 
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index adfba44dac5a..2beac55b57d6 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -586,6 +586,7 @@ struct rtl8139_private {
         dma_addr_t tx_bufs_dma;
         signed char phys[4];            /* MII device addresses. */
         char twistie, twist_row, twist_col;     /* Twister tune state. */
+        unsigned int watchdog_fired : 1;
         unsigned int default_port : 4;  /* Last dev->if_port value. */
         unsigned int have_thread : 1;
         spinlock_t lock;
@@ -638,6 +639,7 @@ static void rtl8139_set_rx_mode (struct net_device *dev);
 static void __set_rx_mode (struct net_device *dev);
 static void rtl8139_hw_start (struct net_device *dev);
 static void rtl8139_thread (void *_data);
+static void rtl8139_tx_timeout_task(void *_data);
 static struct ethtool_ops rtl8139_ethtool_ops;
 
 /* write MMIO register, with flush */
@@ -1598,13 +1600,14 @@ static void rtl8139_thread (void *_data)
 {
         struct net_device *dev = _data;
         struct rtl8139_private *tp = netdev_priv(dev);
-        unsigned long thr_delay;
+        unsigned long thr_delay = next_tick;
 
-        if (rtnl_shlock_nowait() == 0) {
+        if (tp->watchdog_fired) {
+                tp->watchdog_fired = 0;
+                rtl8139_tx_timeout_task(_data);
+        } else if (rtnl_shlock_nowait() == 0) {
                 rtl8139_thread_iter (dev, tp, tp->mmio_addr);
                 rtnl_unlock ();
-
-                thr_delay = next_tick;
         } else {
                 /* unlikely race.  mitigate with fast poll. */
                 thr_delay = HZ / 2;
@@ -1631,7 +1634,8 @@ static void rtl8139_stop_thread(struct rtl8139_private *tp)
         if (tp->have_thread) {
                 cancel_rearming_delayed_work(&tp->thread);
                 tp->have_thread = 0;
-        }
+        } else
+                flush_scheduled_work();
 }
 
 static inline void rtl8139_tx_clear (struct rtl8139_private *tp)
@@ -1642,14 +1646,13 @@ static inline void rtl8139_tx_clear (struct rtl8139_private *tp)
         /* XXX account for unsent Tx packets in tp->stats.tx_dropped */
 }
 
-
-static void rtl8139_tx_timeout (struct net_device *dev)
+static void rtl8139_tx_timeout_task (void *_data)
 {
+        struct net_device *dev = _data;
         struct rtl8139_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->mmio_addr;
         int i;
         u8 tmp8;
-        unsigned long flags;
 
         printk (KERN_DEBUG "%s: Transmit timeout, status %2.2x %4.4x %4.4x "
                 "media %2.2x.\n", dev->name, RTL_R8 (ChipCmd),
@@ -1670,23 +1673,34 @@ static void rtl8139_tx_timeout (struct net_device *dev)
         if (tmp8 & CmdTxEnb)
                 RTL_W8 (ChipCmd, CmdRxEnb);
 
-        spin_lock(&tp->rx_lock);
+        spin_lock_bh(&tp->rx_lock);
         /* Disable interrupts by clearing the interrupt mask. */
         RTL_W16 (IntrMask, 0x0000);
 
         /* Stop a shared interrupt from scavenging while we are. */
-        spin_lock_irqsave (&tp->lock, flags);
+        spin_lock_irq(&tp->lock);
         rtl8139_tx_clear (tp);
-        spin_unlock_irqrestore (&tp->lock, flags);
+        spin_unlock_irq(&tp->lock);
 
         /* ...and finally, reset everything */
         if (netif_running(dev)) {
                 rtl8139_hw_start (dev);
                 netif_wake_queue (dev);
         }
-        spin_unlock(&tp->rx_lock);
+        spin_unlock_bh(&tp->rx_lock);
 }
 
+static void rtl8139_tx_timeout (struct net_device *dev)
+{
+        struct rtl8139_private *tp = netdev_priv(dev);
+
+        if (!tp->have_thread) {
+                INIT_WORK(&tp->thread, rtl8139_tx_timeout_task, dev);
+                schedule_delayed_work(&tp->thread, next_tick);
+        } else
+                tp->watchdog_fired = 1;
+
+}
 
 static int rtl8139_start_xmit (struct sk_buff *skb, struct net_device *dev)
 {
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 6a6a08441804..aa633fa95e64 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -4,9 +4,9 @@
 #
 
 menu "Network device support"
+        depends on NET
 
 config NETDEVICES
-        depends on NET
         default y if UML
         bool "Network device support"
         ---help---
@@ -24,9 +24,6 @@ config NETDEVICES
 
           If unsure, say Y.
 
-# All the following symbols are dependent on NETDEVICES - do not repeat
-# that for each of the symbols.
-if NETDEVICES
 
 config IFB
         tristate "Intermediate Functional Block support"
@@ -1090,7 +1087,8 @@ config NE2000
           without a specific driver are compatible with NE2000.
 
           If you have a PCI NE2000 card however, say N here and Y to "PCI
-          NE2000 support", above. If you have a NE2000 card and are running on
+          NE2000 and clone support" under "EISA, VLB, PCI and on board
+          controllers" below. If you have a NE2000 card and are running on
           an MCA system (a bus system used on some IBM PS/2 computers and
           laptops), say N here and Y to "NE/2 (ne2000 MCA version) support",
           below.
@@ -2023,8 +2021,8 @@ config SIS190
           will be called sis190.  This is recommended.
 
 config SKGE
-        tristate "New SysKonnect GigaEthernet support (EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
+        tristate "New SysKonnect GigaEthernet support"
+        depends on PCI
         select CRC32
         ---help---
           This driver support the Marvell Yukon or SysKonnect SK-98xx/SK-95xx
@@ -2085,7 +2083,6 @@ config SK98LIN
             - Allied Telesyn AT-2971SX Gigabit Ethernet Adapter
             - Allied Telesyn AT-2971T Gigabit Ethernet Adapter
             - Belkin Gigabit Desktop Card 10/100/1000Base-T Adapter, Copper RJ-45
-            - DGE-530T Gigabit Ethernet Adapter
             - EG1032 v2 Instant Gigabit Network Adapter
             - EG1064 v2 Instant Gigabit Network Adapter
             - Marvell 88E8001 Gigabit LOM Ethernet Adapter (Abit)
@@ -2718,8 +2715,6 @@ config NETCONSOLE
         If you want to log kernel messages over the network, enable this.
         See <file:Documentation/networking/netconsole.txt> for details.
 
-endif #NETDEVICES
-
 config NETPOLL
         def_bool NETCONSOLE
 
diff --git a/drivers/net/appletalk/cops.h b/drivers/net/appletalk/cops.h
index c68ba9c2ef46..fd2750b269c8 100644
--- a/drivers/net/appletalk/cops.h
+++ b/drivers/net/appletalk/cops.h
@@ -51,7 +51,7 @@
 struct ltfirmware
 {
         unsigned int length;
-        unsigned char * data;
+        const unsigned char *data;
 };
 
 #define DAYNA 1
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 4ff006c37626..bcf9f17daf0d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1145,7 +1145,8 @@ int bond_sethwaddr(struct net_device *bond_dev, struct net_device *slave_dev)
 }
 
 #define BOND_INTERSECT_FEATURES \
-        (NETIF_F_SG|NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM)
+        (NETIF_F_SG|NETIF_F_IP_CSUM|NETIF_F_NO_CSUM|NETIF_F_HW_CSUM|\
+        NETIF_F_TSO|NETIF_F_UFO)
 
 /* 
  * Compute the common dev->feature set available to all slaves.  Some
@@ -1168,6 +1169,16 @@ static int bond_compute_features(struct bonding *bond)
                           NETIF_F_HW_CSUM)))
                 features &= ~NETIF_F_SG;
 
+        /* 
+         * features will include NETIF_F_TSO (NETIF_F_UFO) iff all 
+         * slave devices support NETIF_F_TSO (NETIF_F_UFO), which 
+         * implies that all slaves also support scatter-gather 
+         * (NETIF_F_SG), which implies that features also includes 
+         * NETIF_F_SG. So no need to check whether we have an  
+         * illegal combination of NETIF_F_{TSO,UFO} and 
+         * !NETIF_F_SG 
+         */
+
         features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES);
         bond_dev->features = features;
 
@@ -1570,6 +1581,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
                 printk(KERN_INFO DRV_NAME
                        ": %s: %s not enslaved\n",
                        bond_dev->name, slave_dev->name);
+                write_unlock_bh(&bond->lock);
                 return -EINVAL;
         }
 
@@ -4080,6 +4092,8 @@ static void bond_ethtool_get_drvinfo(struct net_device *bond_dev,
 
 static struct ethtool_ops bond_ethtool_ops = {
         .get_tx_csum            = ethtool_op_get_tx_csum,
+        .get_tso                = ethtool_op_get_tso,
+        .get_ufo                = ethtool_op_get_ufo,
         .get_sg                 = ethtool_op_get_sg,
         .get_drvinfo            = bond_ethtool_get_drvinfo,
 };
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 32d13da43a0b..041bcc583557 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -260,7 +260,7 @@ static ssize_t bonding_store_slaves(struct class_device *cd, const char *buffer,
         char *ifname;
         int i, res, found, ret = count;
         struct slave *slave;
-        struct net_device *dev = 0;
+        struct net_device *dev = NULL;
         struct bonding *bond = to_bond(cd);
 
         /* Quick sanity check -- is the bond interface up? */
@@ -995,7 +995,7 @@ static ssize_t bonding_store_primary(struct class_device *cd, const char *buf, s
                         printk(KERN_INFO DRV_NAME
                                ": %s: Setting primary slave to None.\n",
                                bond->dev->name);
-                        bond->primary_slave = 0;
+                        bond->primary_slave = NULL;
                                 bond_select_active_slave(bond);
                 } else {
                         printk(KERN_INFO DRV_NAME
@@ -1123,7 +1123,7 @@ static ssize_t bonding_store_active_slave(struct class_device *cd, const char *b
                         printk(KERN_INFO DRV_NAME
                                ": %s: Setting active slave to None.\n",
                                bond->dev->name);
-                        bond->primary_slave = 0;
+                        bond->primary_slave = NULL;
                                 bond_select_active_slave(bond);
                 } else {
                         printk(KERN_INFO DRV_NAME
diff --git a/drivers/net/chelsio/espi.c b/drivers/net/chelsio/espi.c
index 230642571c92..e824acaf188a 100644
--- a/drivers/net/chelsio/espi.c
+++ b/drivers/net/chelsio/espi.c
@@ -296,9 +296,7 @@ void t1_espi_destroy(struct peespi *espi)
 
 struct peespi *t1_espi_create(adapter_t *adapter)
 {
-        struct peespi *espi = kmalloc(sizeof(*espi), GFP_KERNEL);
-
-        memset(espi, 0, sizeof(*espi));
+        struct peespi *espi = kzalloc(sizeof(*espi), GFP_KERNEL);
 
         if (espi)
                 espi->adapter = adapter;
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 2c5b849b7ba4..30ff8ea1a402 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1021,7 +1021,7 @@ static void restart_tx_queues(struct sge *sge)
                         if (test_and_clear_bit(nd->if_port,
                                                &sge->stopped_tx_queues) &&
                             netif_running(nd)) {
-                                sge->stats.cmdQ_restarted[3]++;
+                                sge->stats.cmdQ_restarted[2]++;
                                 netif_wake_queue(nd);
                         }
                 }
@@ -1350,7 +1350,7 @@ static int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter,
                 if (unlikely(credits < count)) {
                         netif_stop_queue(dev);
                         set_bit(dev->if_port, &sge->stopped_tx_queues);
-                        sge->stats.cmdQ_full[3]++;
+                        sge->stats.cmdQ_full[2]++;
                         spin_unlock(&q->lock);
                         if (!netif_queue_stopped(dev))
                                 CH_ERR("%s: Tx ring full while queue awake!\n",
@@ -1358,7 +1358,7 @@ static int t1_sge_tx(struct sk_buff *skb, struct adapter *adapter,
                         return NETDEV_TX_BUSY;
                 }
                 if (unlikely(credits - count < q->stop_thres)) {
-                        sge->stats.cmdQ_full[3]++;
+                        sge->stats.cmdQ_full[2]++;
                         netif_stop_queue(dev);
                         set_bit(dev->if_port, &sge->stopped_tx_queues);
                 }
diff --git a/drivers/net/de620.c b/drivers/net/de620.c
index 0069f5fa973a..22fc5b869a60 100644
--- a/drivers/net/de620.c
+++ b/drivers/net/de620.c
@@ -1012,7 +1012,7 @@ static int __init read_eeprom(struct net_device *dev)
 #ifdef MODULE
 static struct net_device *de620_dev;
 
-int init_module(void)
+int __init init_module(void)
 {
         de620_dev = de620_probe(-1);
         if (IS_ERR(de620_dev))
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 430c628279b3..fb9dae302dcc 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -50,8 +50,8 @@
 
 */
 #define DRV_NAME        "D-Link DL2000-based linux driver"
-#define DRV_VERSION     "v1.17a"
-#define DRV_RELDATE     "2002/10/04"
+#define DRV_VERSION     "v1.17b"
+#define DRV_RELDATE     "2006/03/10"
 #include "dl2k.h"
 
 static char version[] __devinitdata =
@@ -765,7 +765,7 @@ rio_free_tx (struct net_device *dev, int irq)
                         break;
                 skb = np->tx_skbuff[entry];
                 pci_unmap_single (np->pdev,
-                                  np->tx_ring[entry].fraginfo,
+                                  np->tx_ring[entry].fraginfo & 0xffffffffffff,
                                   skb->len, PCI_DMA_TODEVICE);
                 if (irq)
                         dev_kfree_skb_irq (skb);
@@ -892,14 +892,16 @@ receive_packet (struct net_device *dev)
 
                         /* Small skbuffs for short packets */
                         if (pkt_len > copy_thresh) {
-                                pci_unmap_single (np->pdev, desc->fraginfo,
+                                pci_unmap_single (np->pdev,
+                                                  desc->fraginfo & 0xffffffffffff,
                                                   np->rx_buf_sz,
                                                   PCI_DMA_FROMDEVICE);
                                 skb_put (skb = np->rx_skbuff[entry], pkt_len);
                                 np->rx_skbuff[entry] = NULL;
                         } else if ((skb = dev_alloc_skb (pkt_len + 2)) != NULL) {
                                 pci_dma_sync_single_for_cpu(np->pdev,
-                                                            desc->fraginfo,
+                                                            desc->fraginfo & 
+                                                                0xffffffffffff,
                                                             np->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
                                 skb->dev = dev;
@@ -910,7 +912,8 @@ receive_packet (struct net_device *dev)
                                                   pkt_len, 0);
                                 skb_put (skb, pkt_len);
                                 pci_dma_sync_single_for_device(np->pdev,
-                                                               desc->fraginfo,
+                                                               desc->fraginfo &
+                                                                 0xffffffffffff,
                                                                np->rx_buf_sz,
                                                                PCI_DMA_FROMDEVICE);
                         }
@@ -1796,8 +1799,9 @@ rio_close (struct net_device *dev)
                 np->rx_ring[i].fraginfo = 0;
                 skb = np->rx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single (np->pdev, np->rx_ring[i].fraginfo,
-                                          skb->len, PCI_DMA_FROMDEVICE);
+                        pci_unmap_single(np->pdev, 
+                                         np->rx_ring[i].fraginfo & 0xffffffffffff,
+                                         skb->len, PCI_DMA_FROMDEVICE);
                         dev_kfree_skb (skb);
                         np->rx_skbuff[i] = NULL;
                 }
@@ -1805,8 +1809,9 @@ rio_close (struct net_device *dev)
         for (i = 0; i < TX_RING_SIZE; i++) {
                 skb = np->tx_skbuff[i];
                 if (skb) {
-                        pci_unmap_single (np->pdev, np->tx_ring[i].fraginfo,
-                                          skb->len, PCI_DMA_TODEVICE);
+                        pci_unmap_single(np->pdev, 
+                                         np->tx_ring[i].fraginfo & 0xffffffffffff,
+                                         skb->len, PCI_DMA_TODEVICE);
                         dev_kfree_skb (skb);
                         np->tx_skbuff[i] = NULL;
                 }
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index bf1fd2b98bf8..f57a85feda3d 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2154,6 +2154,9 @@ static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
 
         msleep(10);
 
+        pci_dma_sync_single_for_cpu(nic->pdev, nic->rx_to_clean->dma_addr,
+                        RFD_BUF_LEN, PCI_DMA_FROMDEVICE);
+
         if(memcmp(nic->rx_to_clean->skb->data + sizeof(struct rfd),
            skb->data, ETH_DATA_LEN))
                 err = -EAGAIN;
@@ -2161,8 +2164,8 @@ static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
 err_loopback_none:
         mdio_write(nic->netdev, nic->mii.phy_id, MII_BMCR, 0);
         nic->loopback = lb_none;
-        e100_hw_init(nic);
         e100_clean_cbs(nic);
+        e100_hw_reset(nic);
 err_clean_rx:
         e100_rx_clean_list(nic);
         return err;
@@ -2752,8 +2755,6 @@ static int e100_resume(struct pci_dev *pdev)
         retval = pci_enable_wake(pdev, 0, 0);
         if (retval)
                 DPRINTK(PROBE,ERR, "Error clearing wake events\n");
-        if(e100_hw_init(nic))
-                DPRINTK(HW, ERR, "e100_hw_init failed\n");
 
         netif_device_attach(netdev);
         if(netif_running(netdev))
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 27c77306193b..99baf0e099fc 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -225,9 +225,6 @@ struct e1000_rx_ring {
         struct e1000_ps_page *ps_page;
         struct e1000_ps_page_dma *ps_page_dma;
 
-        struct sk_buff *rx_skb_top;
-        struct sk_buff *rx_skb_prev;
-
         /* cpu for rx queue */
         int cpu;
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 31e332935e5a..84dcca3776ee 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -103,7 +103,7 @@ static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION "6.3.9-k2"DRIVERNAPI
+#define DRV_VERSION "6.3.9-k4"DRIVERNAPI
 char e1000_driver_version[] = DRV_VERSION;
 static char e1000_copyright[] = "Copyright (c) 1999-2005 Intel Corporation.";
 
@@ -1635,8 +1635,6 @@ setup_rx_desc_die:
 
         rxdr->next_to_clean = 0;
         rxdr->next_to_use = 0;
-        rxdr->rx_skb_top = NULL;
-        rxdr->rx_skb_prev = NULL;
 
         return 0;
 }
@@ -1713,8 +1711,23 @@ e1000_setup_rctl(struct e1000_adapter *adapter)
                 rctl |= adapter->rx_buffer_len << 0x11;
         } else {
                 rctl &= ~E1000_RCTL_SZ_4096;
-                rctl &= ~E1000_RCTL_BSEX;
-                rctl |= E1000_RCTL_SZ_2048;
+                rctl |= E1000_RCTL_BSEX; 
+                switch (adapter->rx_buffer_len) {
+                case E1000_RXBUFFER_2048:
+                default:
+                        rctl |= E1000_RCTL_SZ_2048;
+                        rctl &= ~E1000_RCTL_BSEX;
+                        break;
+                case E1000_RXBUFFER_4096:
+                        rctl |= E1000_RCTL_SZ_4096;
+                        break;
+                case E1000_RXBUFFER_8192:
+                        rctl |= E1000_RCTL_SZ_8192;
+                        break;
+                case E1000_RXBUFFER_16384:
+                        rctl |= E1000_RCTL_SZ_16384;
+                        break;
+                }
         }
 
 #ifndef CONFIG_E1000_DISABLE_PACKET_SPLIT
@@ -2107,16 +2120,6 @@ e1000_clean_rx_ring(struct e1000_adapter *adapter,
                 }
         }
 
-        /* there also may be some cached data in our adapter */
-        if (rx_ring->rx_skb_top) {
-                dev_kfree_skb(rx_ring->rx_skb_top);
-
-                /* rx_skb_prev will be wiped out by rx_skb_top */
-                rx_ring->rx_skb_top = NULL;
-                rx_ring->rx_skb_prev = NULL;
-        }
-
-
         size = sizeof(struct e1000_buffer) * rx_ring->count;
         memset(rx_ring->buffer_info, 0, size);
         size = sizeof(struct e1000_ps_page) * rx_ring->count;
@@ -2914,7 +2917,7 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                         if (!__pskb_pull_tail(skb, pull_size)) {
                                 printk(KERN_ERR "__pskb_pull_tail failed.\n");
                                 dev_kfree_skb_any(skb);
-                                return -EFAULT;
+                                return NETDEV_TX_OK;
                         }
                         len = skb->len - skb->data_len;
                 }
@@ -3106,24 +3109,27 @@ e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 break;
         }
 
-        /* since the driver code now supports splitting a packet across
-         * multiple descriptors, most of the fifo related limitations on
-         * jumbo frame traffic have gone away.
-         * simply use 2k descriptors for everything.
-         *
-         * NOTE: dev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
-         * means we reserve 2 more, this pushes us to allocate from the next
-         * larger slab size
-         * i.e. RXBUFFER_2048 --> size-4096 slab */
-
-        /* recent hardware supports 1KB granularity */
+
         if (adapter->hw.mac_type > e1000_82547_rev_2) {
-                adapter->rx_buffer_len =
-                    ((max_frame < E1000_RXBUFFER_2048) ?
-                        max_frame : E1000_RXBUFFER_2048);
+                adapter->rx_buffer_len = max_frame;
                 E1000_ROUNDUP(adapter->rx_buffer_len, 1024);
-        } else
-                adapter->rx_buffer_len = E1000_RXBUFFER_2048;
+        } else {
+                if(unlikely((adapter->hw.mac_type < e1000_82543) &&
+                   (max_frame > MAXIMUM_ETHERNET_FRAME_SIZE))) {
+                        DPRINTK(PROBE, ERR, "Jumbo Frames not supported "
+                                            "on 82542\n");
+                        return -EINVAL;
+                } else {
+                        if(max_frame <= E1000_RXBUFFER_2048)
+                                adapter->rx_buffer_len = E1000_RXBUFFER_2048;
+                        else if(max_frame <= E1000_RXBUFFER_4096)
+                                adapter->rx_buffer_len = E1000_RXBUFFER_4096;
+                        else if(max_frame <= E1000_RXBUFFER_8192)
+                                adapter->rx_buffer_len = E1000_RXBUFFER_8192;
+                        else if(max_frame <= E1000_RXBUFFER_16384)
+                                adapter->rx_buffer_len = E1000_RXBUFFER_16384;
+                }
+        }
 
         netdev->mtu = new_mtu;
 
@@ -3620,7 +3626,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
         uint8_t last_byte;
         unsigned int i;
         int cleaned_count = 0;
-        boolean_t cleaned = FALSE, multi_descriptor = FALSE;
+        boolean_t cleaned = FALSE;
 
         i = rx_ring->next_to_clean;
         rx_desc = E1000_RX_DESC(*rx_ring, i);
@@ -3652,43 +3658,12 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 length = le16_to_cpu(rx_desc->length);
 
-                skb_put(skb, length);
-
-                if (!(status & E1000_RXD_STAT_EOP)) {
-                        if (!rx_ring->rx_skb_top) {
-                                rx_ring->rx_skb_top = skb;
-                                rx_ring->rx_skb_top->len = length;
-                                rx_ring->rx_skb_prev = skb;
-                        } else {
-                                if (skb_shinfo(rx_ring->rx_skb_top)->frag_list) {
-                                        rx_ring->rx_skb_prev->next = skb;
-                                        skb->prev = rx_ring->rx_skb_prev;
-                                } else {
-                                        skb_shinfo(rx_ring->rx_skb_top)->frag_list = skb;
-                                }
-                                rx_ring->rx_skb_prev = skb;
-                                rx_ring->rx_skb_top->data_len += length;
-                        }
+                if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
+                        /* All receives must fit into a single buffer */
+                        E1000_DBG("%s: Receive packet consumed multiple"
+                                  " buffers\n", netdev->name);
+                        dev_kfree_skb_irq(skb);
                         goto next_desc;
-                } else {
-                        if (rx_ring->rx_skb_top) {
-                                if (skb_shinfo(rx_ring->rx_skb_top)
-                                                        ->frag_list) {
-                                        rx_ring->rx_skb_prev->next = skb;
-                                        skb->prev = rx_ring->rx_skb_prev;
-                                } else
-                                        skb_shinfo(rx_ring->rx_skb_top)
-                                                        ->frag_list = skb;
-
-                                rx_ring->rx_skb_top->data_len += length;
-                                rx_ring->rx_skb_top->len +=
-                                        rx_ring->rx_skb_top->data_len;
-
-                                skb = rx_ring->rx_skb_top;
-                                multi_descriptor = TRUE;
-                                rx_ring->rx_skb_top = NULL;
-                                rx_ring->rx_skb_prev = NULL;
-                        }
                 }
 
                 if (unlikely(rx_desc->errors & E1000_RXD_ERR_FRAME_ERR_MASK)) {
@@ -3712,10 +3687,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                  * performance for small packets with large amounts
                  * of reassembly being done in the stack */
 #define E1000_CB_LENGTH 256
-                if ((length < E1000_CB_LENGTH) &&
-                   !rx_ring->rx_skb_top &&
-                   /* or maybe (status & E1000_RXD_STAT_EOP) && */
-                   !multi_descriptor) {
+                if (length < E1000_CB_LENGTH) {
                         struct sk_buff *new_skb =
                             dev_alloc_skb(length + NET_IP_ALIGN);
                         if (new_skb) {
@@ -3729,7 +3701,8 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                 skb = new_skb;
                                 skb_put(skb, length);
                         }
-                }
+                } else
+                        skb_put(skb, length);
 
                 /* end copybreak code */
 
@@ -3737,7 +3710,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                 e1000_rx_checksum(adapter,
                                   (uint32_t)(status) |
                                   ((uint32_t)(rx_desc->errors) << 24),
-                                  rx_desc->csum, skb);
+                                  le16_to_cpu(rx_desc->csum), skb);
 
                 skb->protocol = eth_type_trans(skb, netdev);
 #ifdef CONFIG_E1000_NAPI
@@ -3881,11 +3854,11 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                 }
 
                 e1000_rx_checksum(adapter, staterr,
-                                  rx_desc->wb.lower.hi_dword.csum_ip.csum, skb);
+                                  le16_to_cpu(rx_desc->wb.lower.hi_dword.csum_ip.csum), skb);
                 skb->protocol = eth_type_trans(skb, netdev);
 
                 if (likely(rx_desc->wb.upper.header_status &
-                          E1000_RXDPS_HDRSTAT_HDRSP))
+                           cpu_to_le16(E1000_RXDPS_HDRSTAT_HDRSP)))
                         adapter->rx_hdr_split++;
 #ifdef CONFIG_E1000_NAPI
                 if (unlikely(adapter->vlgrp && (staterr & E1000_RXD_STAT_VP))) {
@@ -3911,7 +3884,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
 #endif
 
 next_desc:
-                rx_desc->wb.middle.status_error &= ~0xFF;
+                rx_desc->wb.middle.status_error &= cpu_to_le32(~0xFF);
                 buffer_info->skb = NULL;
 
                 /* return some buffers to hardware, one at a time is too slow */
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 0c18dbd67d3b..0e8e3fcde9ff 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -199,8 +199,7 @@ static int gfar_probe(struct platform_device *pdev)
 
         /* get a pointer to the register memory */
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        priv->regs = (struct gfar *)
-                ioremap(r->start, sizeof (struct gfar));
+        priv->regs = ioremap(r->start, sizeof (struct gfar));
 
         if (NULL == priv->regs) {
                 err = -ENOMEM;
@@ -369,7 +368,7 @@ static int gfar_probe(struct platform_device *pdev)
         return 0;
 
 register_fail:
-        iounmap((void *) priv->regs);
+        iounmap(priv->regs);
 regs_fail:
         free_netdev(dev);
         return err;
@@ -382,7 +381,7 @@ static int gfar_remove(struct platform_device *pdev)
 
         platform_set_drvdata(pdev, NULL);
 
-        iounmap((void *) priv->regs);
+        iounmap(priv->regs);
         free_netdev(dev);
 
         return 0;
@@ -454,8 +453,7 @@ static void init_registers(struct net_device *dev)
 
         /* Zero out the rmon mib registers if it has them */
         if (priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_RMON) {
-                memset((void *) &(priv->regs->rmon), 0,
-                       sizeof (struct rmon_mib));
+                memset_io(&(priv->regs->rmon), 0, sizeof (struct rmon_mib));
 
                 /* Mask off the CAM interrupts */
                 gfar_write(&priv->regs->rmon.cam1, 0xffffffff);
@@ -477,7 +475,7 @@ static void init_registers(struct net_device *dev)
 void gfar_halt(struct net_device *dev)
 {
         struct gfar_private *priv = netdev_priv(dev);
-        struct gfar *regs = priv->regs;
+        struct gfar __iomem *regs = priv->regs;
         u32 tempval;
 
         /* Mask all interrupts */
@@ -507,7 +505,7 @@ void gfar_halt(struct net_device *dev)
 void stop_gfar(struct net_device *dev)
 {
         struct gfar_private *priv = netdev_priv(dev);
-        struct gfar *regs = priv->regs;
+        struct gfar __iomem *regs = priv->regs;
         unsigned long flags;
 
         phy_stop(priv->phydev);
@@ -590,7 +588,7 @@ static void free_skb_resources(struct gfar_private *priv)
 void gfar_start(struct net_device *dev)
 {
         struct gfar_private *priv = netdev_priv(dev);
-        struct gfar *regs = priv->regs;
+        struct gfar __iomem *regs = priv->regs;
         u32 tempval;
 
         /* Enable Rx and Tx in MACCFG1 */
@@ -624,7 +622,7 @@ int startup_gfar(struct net_device *dev)
         unsigned long vaddr;
         int i;
         struct gfar_private *priv = netdev_priv(dev);
-        struct gfar *regs = priv->regs;
+        struct gfar __iomem *regs = priv->regs;
         int err = 0;
         u32 rctrl = 0;
         u32 attrs = 0;
@@ -1622,7 +1620,7 @@ static irqreturn_t gfar_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 static void adjust_link(struct net_device *dev)
 {
         struct gfar_private *priv = netdev_priv(dev);
-        struct gfar *regs = priv->regs;
+        struct gfar __iomem *regs = priv->regs;
         unsigned long flags;
         struct phy_device *phydev = priv->phydev;
         int new_state = 0;
@@ -1703,7 +1701,7 @@ static void gfar_set_multi(struct net_device *dev)
 {
         struct dev_mc_list *mc_ptr;
         struct gfar_private *priv = netdev_priv(dev);
-        struct gfar *regs = priv->regs;
+        struct gfar __iomem *regs = priv->regs;
         u32 tempval;
 
         if(dev->flags & IFF_PROMISC) {
@@ -1842,7 +1840,7 @@ static void gfar_set_mac_for_addr(struct net_device *dev, int num, u8 *addr)
         int idx;
         char tmpbuf[MAC_ADDR_LEN];
         u32 tempval;
-        u32 *macptr = &priv->regs->macstnaddr1;
+        u32 __iomem *macptr = &priv->regs->macstnaddr1;
 
         macptr += num*2;
 
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index cb9d66ac3ab9..d37d5401be6e 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -682,8 +682,8 @@ struct gfar_private {
         struct rxbd8 *cur_rx;           /* Next free rx ring entry */
         struct txbd8 *cur_tx;           /* Next free ring entry */
         struct txbd8 *dirty_tx;         /* The Ring entry to be freed. */
-        struct gfar *regs;      /* Pointer to the GFAR memory mapped Registers */
-        u32 *hash_regs[16];
+        struct gfar __iomem *regs;      /* Pointer to the GFAR memory mapped Registers */
+        u32 __iomem *hash_regs[16];
         int hash_width;
         struct net_device_stats stats; /* linux network statistics */
         struct gfar_extra_stats extra_stats;
@@ -718,14 +718,14 @@ struct gfar_private {
         uint32_t msg_enable;
 };
 
-static inline u32 gfar_read(volatile unsigned *addr)
+static inline u32 gfar_read(volatile unsigned __iomem *addr)
 {
         u32 val;
         val = in_be32(addr);
         return val;
 }
 
-static inline void gfar_write(volatile unsigned *addr, u32 val)
+static inline void gfar_write(volatile unsigned __iomem *addr, u32 val)
 {
         out_be32(addr, val);
 }
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 765e810620fe..5de7b2e259dc 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -144,11 +144,11 @@ static void gfar_fill_stats(struct net_device *dev, struct ethtool_stats *dummy,
         u64 *extra = (u64 *) & priv->extra_stats;
 
         if (priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_RMON) {
-                u32 *rmon = (u32 *) & priv->regs->rmon;
+                u32 __iomem *rmon = (u32 __iomem *) & priv->regs->rmon;
                 struct gfar_stats *stats = (struct gfar_stats *) buf;
 
                 for (i = 0; i < GFAR_RMON_LEN; i++)
-                        stats->rmon[i] = (u64) (rmon[i]);
+                        stats->rmon[i] = (u64) gfar_read(&rmon[i]);
 
                 for (i = 0; i < GFAR_EXTRA_STATS_LEN; i++)
                         stats->extra[i] = extra[i];
@@ -221,11 +221,11 @@ static void gfar_get_regs(struct net_device *dev, struct ethtool_regs *regs, voi
 {
         int i;
         struct gfar_private *priv = netdev_priv(dev);
-        u32 *theregs = (u32 *) priv->regs;
+        u32 __iomem *theregs = (u32 __iomem *) priv->regs;
         u32 *buf = (u32 *) regbuf;
 
         for (i = 0; i < sizeof (struct gfar) / sizeof (u32); i++)
-                buf[i] = theregs[i];
+                buf[i] = gfar_read(&theregs[i]);
 }
 
 /* Convert microseconds to ethernet clock ticks, which changes
diff --git a/drivers/net/gianfar_mii.c b/drivers/net/gianfar_mii.c
index 74e52fcbf806..c6b725529af5 100644
--- a/drivers/net/gianfar_mii.c
+++ b/drivers/net/gianfar_mii.c
@@ -50,7 +50,7 @@
  * All PHY configuration is done through the TSEC1 MIIM regs */
 int gfar_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value)
 {
-        struct gfar_mii *regs = bus->priv;
+        struct gfar_mii __iomem *regs = (void __iomem *)bus->priv;
 
         /* Set the PHY address and the register address we want to write */
         gfar_write(&regs->miimadd, (mii_id << 8) | regnum);
@@ -70,7 +70,7 @@ int gfar_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value)
  * configuration has to be done through the TSEC1 MIIM regs */
 int gfar_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 {
-        struct gfar_mii *regs = bus->priv;
+        struct gfar_mii __iomem *regs = (void __iomem *)bus->priv;
         u16 value;
 
         /* Set the PHY address and the register address we want to read */
@@ -94,7 +94,7 @@ int gfar_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 /* Reset the MIIM registers, and wait for the bus to free */
 int gfar_mdio_reset(struct mii_bus *bus)
 {
-        struct gfar_mii *regs = bus->priv;
+        struct gfar_mii __iomem *regs = (void __iomem *)bus->priv;
         unsigned int timeout = PHY_INIT_TIMEOUT;
 
         spin_lock_bh(&bus->mdio_lock);
@@ -126,7 +126,7 @@ int gfar_mdio_probe(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct gianfar_mdio_data *pdata;
-        struct gfar_mii *regs;
+        struct gfar_mii __iomem *regs;
         struct mii_bus *new_bus;
         struct resource *r;
         int err = 0;
@@ -155,15 +155,14 @@ int gfar_mdio_probe(struct device *dev)
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 
         /* Set the PHY base address */
-        regs = (struct gfar_mii *) ioremap(r->start,
-                        sizeof (struct gfar_mii));
+        regs = ioremap(r->start, sizeof (struct gfar_mii));
 
         if (NULL == regs) {
                 err = -ENOMEM;
                 goto reg_map_fail;
         }
 
-        new_bus->priv = regs;
+        new_bus->priv = (void __force *)regs;
 
         new_bus->irq = pdata->irq;
 
@@ -181,7 +180,7 @@ int gfar_mdio_probe(struct device *dev)
         return 0;
 
 bus_register_fail:
-        iounmap((void *) regs);
+        iounmap(regs);
 reg_map_fail:
         kfree(new_bus);
 
@@ -197,7 +196,7 @@ int gfar_mdio_remove(struct device *dev)
 
         dev_set_drvdata(dev, NULL);
 
-        iounmap((void *) (&bus->priv));
+        iounmap((void __iomem *)bus->priv);
         bus->priv = NULL;
         kfree(bus);
 
diff --git a/drivers/net/hamradio/baycom_par.c b/drivers/net/hamradio/baycom_par.c
index 3b1bef1ee215..77411a00d1ee 100644
--- a/drivers/net/hamradio/baycom_par.c
+++ b/drivers/net/hamradio/baycom_par.c
@@ -86,7 +86,6 @@
 #include <linux/bitops.h>
 #include <linux/jiffies.h>
 
-#include <asm/bug.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 1b699259b4ec..31fb2d75dc44 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -57,7 +57,7 @@ struct ifb_private {
         struct sk_buff_head     tq;
 };
 
-static int numifbs = 1;
+static int numifbs = 2;
 
 static void ri_tasklet(unsigned long dev);
 static int ifb_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index fa176ffb4ad5..8936058a3cce 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -108,6 +108,7 @@ static void irda_usb_close(struct irda_usb_cb *self);
 static void speed_bulk_callback(struct urb *urb, struct pt_regs *regs);
 static void write_bulk_callback(struct urb *urb, struct pt_regs *regs);
 static void irda_usb_receive(struct urb *urb, struct pt_regs *regs);
+static void irda_usb_rx_defer_expired(unsigned long data);
 static int irda_usb_net_open(struct net_device *dev);
 static int irda_usb_net_close(struct net_device *dev);
 static int irda_usb_net_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
@@ -677,6 +678,12 @@ static void irda_usb_net_timeout(struct net_device *netdev)
  * on the interrupt pipe and hang the Rx URB only when an interrupt is
  * received.
  * Jean II
+ *
+ * Note : don't read the above as what we are currently doing, but as
+ * something we could do with KC dongle. Also don't forget that the
+ * interrupt pipe is not part of the original standard, so this would
+ * need to be optional...
+ * Jean II
  */
 
 /*------------------------------------------------------------------*/
@@ -704,10 +711,8 @@ static void irda_usb_submit(struct irda_usb_cb *self, struct sk_buff *skb, struc
         /* Reinitialize URB */
         usb_fill_bulk_urb(urb, self->usbdev, 
                       usb_rcvbulkpipe(self->usbdev, self->bulk_in_ep), 
-                      skb->data, skb->truesize,
+                      skb->data, IRDA_SKB_MAX_MTU,
                       irda_usb_receive, skb);
-        /* Note : unlink *must* be synchronous because of the code in 
-         * irda_usb_net_close() -> free the skb - Jean II */
         urb->status = 0;
 
         /* Can be called from irda_usb_receive (irq handler) -> GFP_ATOMIC */
@@ -734,6 +739,7 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
         struct irda_skb_cb *cb;
         struct sk_buff *newskb;
         struct sk_buff *dataskb;
+        struct urb *next_urb;
         int             docopy;
 
         IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length);
@@ -755,20 +761,37 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
         if (urb->status != 0) {
                 switch (urb->status) {
                 case -EILSEQ:
-                        self->stats.rx_errors++;
                         self->stats.rx_crc_errors++;    
-                        break;
+                        /* Also precursor to a hot-unplug on UHCI. */
+                        /* Fallthrough... */
                 case -ECONNRESET:               /* -104 */
-                        IRDA_DEBUG(0, "%s(), Connection Reset (-104), transfer_flags 0x%04X \n", __FUNCTION__, urb->transfer_flags);
+                        /* Random error, if I remember correctly */
                         /* uhci_cleanup_unlink() is going to kill the Rx
                          * URB just after we return. No problem, at this
                          * point the URB will be idle ;-) - Jean II */
-                        break;
+                case -ESHUTDOWN:                /* -108 */
+                        /* That's usually a hot-unplug. Submit will fail... */
+                case -ETIMEDOUT:                /* -110 */
+                        /* Usually precursor to a hot-unplug on OHCI. */
                 default:
-                        IRDA_DEBUG(0, "%s(), RX status %d,transfer_flags 0x%04X \n", __FUNCTION__, urb->status, urb->transfer_flags);
+                        self->stats.rx_errors++;
+                        IRDA_DEBUG(0, "%s(), RX status %d, transfer_flags 0x%04X \n", __FUNCTION__, urb->status, urb->transfer_flags);
                         break;
                 }
-                goto done;
+                /* If we received an error, we don't want to resubmit the
+                 * Rx URB straight away but to give the USB layer a little
+                 * bit of breathing room.
+                 * We are in the USB thread context, therefore there is a
+                 * danger of recursion (new URB we submit fails, we come
+                 * back here).
+                 * With recent USB stack (2.6.15+), I'm seeing that on
+                 * hot unplug of the dongle...
+                 * Lowest effective timer is 10ms...
+                 * Jean II */
+                self->rx_defer_timer.function = &irda_usb_rx_defer_expired;
+                self->rx_defer_timer.data = (unsigned long) urb;
+                mod_timer(&self->rx_defer_timer, jiffies + (10 * HZ / 1000));
+                return;
         }
         
         /* Check for empty frames */
@@ -845,13 +868,45 @@ done:
          * idle slot....
          * Jean II */
         /* Note : with this scheme, we could submit the idle URB before
-         * processing the Rx URB. Another time... Jean II */
+         * processing the Rx URB. I don't think it would buy us anything as
+         * we are running in the USB thread context. Jean II */
+        next_urb = self->idle_rx_urb;
 
-        /* Submit the idle URB to replace the URB we've just received */
-        irda_usb_submit(self, skb, self->idle_rx_urb);
         /* Recycle Rx URB : Now, the idle URB is the present one */
         urb->context = NULL;
         self->idle_rx_urb = urb;
+
+        /* Submit the idle URB to replace the URB we've just received.
+         * Do it last to avoid race conditions... Jean II */
+        irda_usb_submit(self, skb, next_urb);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * In case of errors, we want the USB layer to have time to recover.
+ * Now, it is time to resubmit ouur Rx URB...
+ */
+static void irda_usb_rx_defer_expired(unsigned long data)
+{
+        struct urb *urb = (struct urb *) data;
+        struct sk_buff *skb = (struct sk_buff *) urb->context;
+        struct irda_usb_cb *self; 
+        struct irda_skb_cb *cb;
+        struct urb *next_urb;
+
+        IRDA_DEBUG(2, "%s()\n", __FUNCTION__);
+
+        /* Find ourselves */
+        cb = (struct irda_skb_cb *) skb->cb;
+        IRDA_ASSERT(cb != NULL, return;);
+        self = (struct irda_usb_cb *) cb->context;
+        IRDA_ASSERT(self != NULL, return;);
+
+        /* Same stuff as when Rx is done, see above... */
+        next_urb = self->idle_rx_urb;
+        urb->context = NULL;
+        self->idle_rx_urb = urb;
+        irda_usb_submit(self, skb, next_urb);
 }
 
 /*------------------------------------------------------------------*/
@@ -990,6 +1045,9 @@ static int irda_usb_net_close(struct net_device *netdev)
         /* Stop network Tx queue */
         netif_stop_queue(netdev);
 
+        /* Kill defered Rx URB */
+        del_timer(&self->rx_defer_timer);
+
         /* Deallocate all the Rx path buffers (URBs and skb) */
         for (i = 0; i < IU_MAX_RX_URBS; i++) {
                 struct urb *urb = self->rx_urb[i];
@@ -1365,6 +1423,7 @@ static int irda_usb_probe(struct usb_interface *intf,
         self = net->priv;
         self->netdev = net;
         spin_lock_init(&self->lock);
+        init_timer(&self->rx_defer_timer);
 
         /* Create all of the needed urbs */
         for (i = 0; i < IU_MAX_RX_URBS; i++) {
@@ -1498,6 +1557,9 @@ static void irda_usb_disconnect(struct usb_interface *intf)
          * This will stop/desactivate the Tx path. - Jean II */
         self->present = 0;
 
+        /* Kill defered Rx URB */
+        del_timer(&self->rx_defer_timer);
+
         /* We need to have irq enabled to unlink the URBs. That's OK,
          * at this point the Tx path is gone - Jean II */
         spin_unlock_irqrestore(&self->lock, flags);
@@ -1507,11 +1569,11 @@ static void irda_usb_disconnect(struct usb_interface *intf)
                 /* Accept no more transmissions */
                 /*netif_device_detach(self->netdev);*/
                 netif_stop_queue(self->netdev);
-                /* Stop all the receive URBs */
+                /* Stop all the receive URBs. Must be synchronous. */
                 for (i = 0; i < IU_MAX_RX_URBS; i++)
                         usb_kill_urb(self->rx_urb[i]);
                 /* Cancel Tx and speed URB.
-                 * Toggle flags to make sure it's synchronous. */
+                 * Make sure it's synchronous to avoid races. */
                 usb_kill_urb(self->tx_urb);
                 usb_kill_urb(self->speed_urb);
         }
diff --git a/drivers/net/irda/irda-usb.h b/drivers/net/irda/irda-usb.h
index bd8f66542322..4026af42dd47 100644
--- a/drivers/net/irda/irda-usb.h
+++ b/drivers/net/irda/irda-usb.h
@@ -136,8 +136,6 @@ struct irda_usb_cb {
         __u16 bulk_out_mtu;             /* Max Tx packet size in bytes */
         __u8  bulk_int_ep;              /* Interrupt Endpoint assignments */
 
-        wait_queue_head_t wait_q;       /* for timeouts */
-
         struct urb *rx_urb[IU_MAX_RX_URBS];     /* URBs used to receive data frames */
         struct urb *idle_rx_urb;        /* Pointer to idle URB in Rx path */
         struct urb *tx_urb;             /* URB used to send data frames */
@@ -147,17 +145,18 @@ struct irda_usb_cb {
         struct net_device_stats stats;
         struct irlap_cb   *irlap;       /* The link layer we are binded to */
         struct qos_info qos;
-        hashbin_t *tx_list;             /* Queued transmit skb's */
         char *speed_buff;               /* Buffer for speed changes */
 
         struct timeval stamp;
         struct timeval now;
 
-        spinlock_t lock;                /* For serializing operations */
+        spinlock_t lock;                /* For serializing Tx operations */
 
         __u16 xbofs;                    /* Current xbofs setting */
         __s16 new_xbofs;                /* xbofs we need to set */
         __u32 speed;                    /* Current speed */
         __s32 new_speed;                /* speed we need to set */
+
+        struct timer_list rx_defer_timer;       /* Wait for Rx error to clear */
 };
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 7ef4b0434a3f..c0998ef938e0 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -32,6 +32,8 @@
  */
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
+#include <linux/in.h>
+#include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 01ddfc8cce3f..aa5581369399 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -806,6 +806,7 @@ static struct pcmcia_device_id axnet_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x0309),
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1106),
         PCMCIA_DEVICE_MANF_CARD(0x8a01, 0xc1ab),
+        PCMCIA_DEVICE_PROD_ID12("AmbiCom,Inc.", "Fast Ethernet PC Card(AMB8110)", 0x49b020a7, 0x119cc9fc),
         PCMCIA_DEVICE_PROD_ID124("Fast Ethernet", "16-bit PC Card", "AX88190", 0xb4be14e3, 0x9a12eb6a, 0xab9be5ef),
         PCMCIA_DEVICE_PROD_ID12("ASIX", "AX88190", 0x0959823b, 0xab9be5ef),
         PCMCIA_DEVICE_PROD_ID12("Billionton", "LNA-100B", 0x552ab682, 0xbc3b87e1),
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 1c6d328165bb..0245e40b51a1 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1610,6 +1610,8 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                 }
                 else if (!pskb_may_pull(skb, skb->len))
                         goto err;
+                else
+                        skb->ip_summed = CHECKSUM_NONE;
 
                 len = slhc_uncompress(ppp->vj, skb->data + 2, skb->len - 2);
                 if (len <= 0) {
@@ -1690,6 +1692,7 @@ ppp_receive_nonmp_frame(struct ppp *ppp, struct sk_buff *skb)
                         kfree_skb(skb);
                 } else {
                         skb_pull(skb, 2);       /* chop off protocol */
+                        skb_postpull_rcsum(skb, skb->data - 2, 2);
                         skb->dev = ppp->dev;
                         skb->protocol = htons(npindex_to_ethertype[npi]);
                         skb->mac.raw = skb->data;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 2e1bed153c39..8cc0d0bbdf50 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -287,6 +287,20 @@ enum RTL8169_register_content {
         TxInterFrameGapShift = 24,
         TxDMAShift = 8, /* DMA burst value (0-7) is shift this many bits */
 
+        /* Config1 register p.24 */
+        PMEnable        = (1 << 0),     /* Power Management Enable */
+
+        /* Config3 register p.25 */
+        MagicPacket     = (1 << 5),     /* Wake up when receives a Magic Packet */
+        LinkUp          = (1 << 4),     /* Wake up when the cable connection is re-established */
+
+        /* Config5 register p.27 */
+        BWF             = (1 << 6),     /* Accept Broadcast wakeup frame */
+        MWF             = (1 << 5),     /* Accept Multicast wakeup frame */
+        UWF             = (1 << 4),     /* Accept Unicast wakeup frame */
+        LanWake         = (1 << 1),     /* LanWake enable/disable */
+        PMEStatus       = (1 << 0),     /* PME status can be reset by PCI RST# */
+
         /* TBICSR p.28 */
         TBIReset        = 0x80000000,
         TBILoopback     = 0x40000000,
@@ -433,6 +447,7 @@ struct rtl8169_private {
         unsigned int (*phy_reset_pending)(void __iomem *);
         unsigned int (*link_ok)(void __iomem *);
         struct work_struct task;
+        unsigned wol_enabled : 1;
 };
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -484,13 +499,12 @@ static void mdio_write(void __iomem *ioaddr, int RegAddr, int value)
         int i;
 
         RTL_W32(PHYAR, 0x80000000 | (RegAddr & 0xFF) << 16 | value);
-        udelay(1000);
 
-        for (i = 2000; i > 0; i--) {
+        for (i = 20; i > 0; i--) {
                 /* Check if the RTL8169 has completed writing to the specified MII register */
                 if (!(RTL_R32(PHYAR) & 0x80000000)) 
                         break;
-                udelay(100);
+                udelay(25);
         }
 }
 
@@ -499,15 +513,14 @@ static int mdio_read(void __iomem *ioaddr, int RegAddr)
         int i, value = -1;
 
         RTL_W32(PHYAR, 0x0 | (RegAddr & 0xFF) << 16);
-        udelay(1000);
 
-        for (i = 2000; i > 0; i--) {
+        for (i = 20; i > 0; i--) {
                 /* Check if the RTL8169 has completed retrieving data from the specified MII register */
                 if (RTL_R32(PHYAR) & 0x80000000) {
                         value = (int) (RTL_R32(PHYAR) & 0xFFFF);
                         break;
                 }
-                udelay(100);
+                udelay(25);
         }
         return value;
 }
@@ -609,6 +622,80 @@ static void rtl8169_link_option(int idx, u8 *autoneg, u16 *speed, u8 *duplex)
         *duplex = p->duplex;
 }
 
+static void rtl8169_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        u8 options;
+
+        wol->wolopts = 0;
+
+#define WAKE_ANY (WAKE_PHY | WAKE_MAGIC | WAKE_UCAST | WAKE_BCAST | WAKE_MCAST)
+        wol->supported = WAKE_ANY;
+
+        spin_lock_irq(&tp->lock);
+
+        options = RTL_R8(Config1);
+        if (!(options & PMEnable))
+                goto out_unlock;
+
+        options = RTL_R8(Config3);
+        if (options & LinkUp)
+                wol->wolopts |= WAKE_PHY;
+        if (options & MagicPacket)
+                wol->wolopts |= WAKE_MAGIC;
+
+        options = RTL_R8(Config5);
+        if (options & UWF)
+                wol->wolopts |= WAKE_UCAST;
+        if (options & BWF)
+                wol->wolopts |= WAKE_BCAST;
+        if (options & MWF)
+                wol->wolopts |= WAKE_MCAST;
+
+out_unlock:
+        spin_unlock_irq(&tp->lock);
+}
+
+static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        int i;
+        static struct {
+                u32 opt;
+                u16 reg;
+                u8  mask;
+        } cfg[] = {
+                { WAKE_ANY,   Config1, PMEnable },
+                { WAKE_PHY,   Config3, LinkUp },
+                { WAKE_MAGIC, Config3, MagicPacket },
+                { WAKE_UCAST, Config5, UWF },
+                { WAKE_BCAST, Config5, BWF },
+                { WAKE_MCAST, Config5, MWF },
+                { WAKE_ANY,   Config5, LanWake }
+        };
+
+        spin_lock_irq(&tp->lock);
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
+
+        for (i = 0; i < ARRAY_SIZE(cfg); i++) {
+                u8 options = RTL_R8(cfg[i].reg) & ~cfg[i].mask;
+                if (wol->wolopts & cfg[i].opt)
+                        options |= cfg[i].mask;
+                RTL_W8(cfg[i].reg, options);
+        }
+
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
+        tp->wol_enabled = (wol->wolopts) ? 1 : 0;
+
+        spin_unlock_irq(&tp->lock);
+
+        return 0;
+}
+
 static void rtl8169_get_drvinfo(struct net_device *dev,
                                 struct ethtool_drvinfo *info)
 {
@@ -677,6 +764,9 @@ static int rtl8169_set_speed_xmii(struct net_device *dev,
 
                 if (duplex == DUPLEX_HALF)
                         auto_nego &= ~(PHY_Cap_10_Full | PHY_Cap_100_Full);
+
+                if (duplex == DUPLEX_FULL)
+                        auto_nego &= ~(PHY_Cap_10_Half | PHY_Cap_100_Half);
         }
 
         tp->phy_auto_nego_reg = auto_nego;
@@ -1024,6 +1114,8 @@ static struct ethtool_ops rtl8169_ethtool_ops = {
         .get_tso                = ethtool_op_get_tso,
         .set_tso                = ethtool_op_set_tso,
         .get_regs               = rtl8169_get_regs,
+        .get_wol                = rtl8169_get_wol,
+        .set_wol                = rtl8169_set_wol,
         .get_strings            = rtl8169_get_strings,
         .get_stats_count        = rtl8169_get_stats_count,
         .get_ethtool_stats      = rtl8169_get_ethtool_stats,
@@ -1441,6 +1533,11 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         }
         tp->chipset = i;
 
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
+        RTL_W8(Config1, RTL_R8(Config1) | PMEnable);
+        RTL_W8(Config5, RTL_R8(Config5) & PMEStatus);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
         *ioaddr_out = ioaddr;
         *dev_out = dev;
 out:
@@ -1611,49 +1708,6 @@ rtl8169_remove_one(struct pci_dev *pdev)
         pci_set_drvdata(pdev, NULL);
 }
 
-#ifdef CONFIG_PM
-
-static int rtl8169_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        struct rtl8169_private *tp = netdev_priv(dev);
-        void __iomem *ioaddr = tp->mmio_addr;
-        unsigned long flags;
-
-        if (!netif_running(dev))
-                return 0;
-        
-        netif_device_detach(dev);
-        netif_stop_queue(dev);
-        spin_lock_irqsave(&tp->lock, flags);
-
-        /* Disable interrupts, stop Rx and Tx */
-        RTL_W16(IntrMask, 0);
-        RTL_W8(ChipCmd, 0);
-                
-        /* Update the error counts. */
-        tp->stats.rx_missed_errors += RTL_R32(RxMissed);
-        RTL_W32(RxMissed, 0);
-        spin_unlock_irqrestore(&tp->lock, flags);
-        
-        return 0;
-}
-
-static int rtl8169_resume(struct pci_dev *pdev)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-
-        if (!netif_running(dev))
-            return 0;
-
-        netif_device_attach(dev);
-        rtl8169_hw_start(dev);
-
-        return 0;
-}
-                                                                                
-#endif /* CONFIG_PM */
-
 static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
                                   struct net_device *dev)
 {
@@ -2699,6 +2753,56 @@ static struct net_device_stats *rtl8169_get_stats(struct net_device *dev)
         return &tp->stats;
 }
 
+#ifdef CONFIG_PM
+
+static int rtl8169_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        if (!netif_running(dev))
+                goto out;
+
+        netif_device_detach(dev);
+        netif_stop_queue(dev);
+
+        spin_lock_irq(&tp->lock);
+
+        rtl8169_asic_down(ioaddr);
+
+        tp->stats.rx_missed_errors += RTL_R32(RxMissed);
+        RTL_W32(RxMissed, 0);
+
+        spin_unlock_irq(&tp->lock);
+
+        pci_save_state(pdev);
+        pci_enable_wake(pdev, pci_choose_state(pdev, state), tp->wol_enabled);
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+out:
+        return 0;
+}
+
+static int rtl8169_resume(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+
+        if (!netif_running(dev))
+                goto out;
+
+        netif_device_attach(dev);
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        pci_enable_wake(pdev, PCI_D0, 0);
+
+        rtl8169_schedule_work(dev, rtl8169_reset_task);
+out:
+        return 0;
+}
+
+#endif /* CONFIG_PM */
+
 static struct pci_driver rtl8169_pci_driver = {
         .name           = MODULENAME,
         .id_table       = rtl8169_pci_tbl,
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 49b597cbc19a..b7f00d6eb6a6 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -4092,6 +4092,7 @@ static void s2io_set_multicast(struct net_device *dev)
                      i++, mclist = mclist->next) {
                         memcpy(sp->usr_addrs[i].addr, mclist->dmi_addr,
                                ETH_ALEN);
+                        mac_addr = 0;
                         for (j = 0; j < ETH_ALEN; j++) {
                                 mac_addr |= mclist->dmi_addr[j];
                                 mac_addr <<= 8;
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index b420182eec4b..ed4bc91638d2 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -1791,6 +1791,8 @@ static int __devinit sis190_init_one(struct pci_dev *pdev,
                 goto out;
         }
 
+        pci_set_drvdata(pdev, dev);
+
         tp = netdev_priv(dev);
         ioaddr = tp->mmio_addr;
 
@@ -1827,8 +1829,6 @@ static int __devinit sis190_init_one(struct pci_dev *pdev,
         if (rc < 0)
                 goto err_remove_mii;
 
-        pci_set_drvdata(pdev, dev);
-
         net_probe(tp, KERN_INFO "%s: %s at %p (IRQ: %d), "
                "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
                pci_name(pdev), sis_chip_info[ent->driver_data].name,
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index 3d95fa20cd88..7a952fe60be2 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -540,7 +540,7 @@ static int __devinit sis900_probe(struct pci_dev *pci_dev,
         printk("%2.2x.\n", net_dev->dev_addr[i]);
 
         /* Detect Wake on Lan support */
-        ret = inl(CFGPMC & PMESP);
+        ret = (inl(net_dev->base_addr + CFGPMC) & PMESP) >> 27;
         if (netif_msg_probe(sis_priv) && (ret & PME_D3C) == 0)
                 printk(KERN_INFO "%s: Wake on LAN only available from suspend to RAM.", net_dev->name);
 
@@ -2040,7 +2040,7 @@ static int sis900_set_wol(struct net_device *net_dev, struct ethtool_wolinfo *wo
 
         if (wol->wolopts == 0) {
                 pci_read_config_dword(sis_priv->pci_dev, CFGPMCSR, &cfgpmcsr);
-                cfgpmcsr |= ~PME_EN;
+                cfgpmcsr &= ~PME_EN;
                 pci_write_config_dword(sis_priv->pci_dev, CFGPMCSR, cfgpmcsr);
                 outl(pmctrl_bits, pmctrl_addr);
                 if (netif_msg_wol(sis_priv))
diff --git a/drivers/net/sis900.h b/drivers/net/sis900.h
index 4233ea55670f..50323941e3c0 100644
--- a/drivers/net/sis900.h
+++ b/drivers/net/sis900.h
@@ -33,7 +33,6 @@ enum sis900_registers {
         rxcfg=0x34,             //Receive Configuration Register
         flctrl=0x38,            //Flow Control Register
         rxlen=0x3c,             //Receive Packet Length Register
-        cfgpmcsr=0x44,          //Configuration Power Management Control/Status Register
         rfcr=0x48,              //Receive Filter Control Register
         rfdr=0x4C,              //Receive Filter Data Register
         pmctrl=0xB0,            //Power Management Control Register
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index bf55a4cfb3d2..25e028b7ce48 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -879,13 +879,12 @@ static int __xm_phy_read(struct skge_hw *hw, int port, u16 reg, u16 *val)
         int i;
 
         xm_write16(hw, port, XM_PHY_ADDR, reg | hw->phy_addr);
-        xm_read16(hw, port, XM_PHY_DATA);
+        *val = xm_read16(hw, port, XM_PHY_DATA);
 
-        /* Need to wait for external PHY */
         for (i = 0; i < PHY_RETRIES; i++) {
-                udelay(1);
                 if (xm_read16(hw, port, XM_MMU_CMD) & XM_MMU_PHY_RDY)
                         goto ready;
+                udelay(1);
         }
 
         return -ETIMEDOUT;
@@ -918,7 +917,12 @@ static int xm_phy_write(struct skge_hw *hw, int port, u16 reg, u16 val)
 
  ready:
         xm_write16(hw, port, XM_PHY_DATA, val);
-        return 0;
+        for (i = 0; i < PHY_RETRIES; i++) {
+                if (!(xm_read16(hw, port, XM_MMU_CMD) & XM_MMU_PHY_BUSY))
+                        return 0;
+                udelay(1);
+        }
+        return -ETIMEDOUT;
 }
 
 static void genesis_init(struct skge_hw *hw)
@@ -1168,13 +1172,17 @@ static void genesis_mac_init(struct skge_hw *hw, int port)
         u32 r;
         const u8 zero[6]  = { 0 };
 
-        /* Clear MIB counters */
-        xm_write16(hw, port, XM_STAT_CMD,
-                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
-        /* Clear two times according to Errata #3 */
-        xm_write16(hw, port, XM_STAT_CMD,
-                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
+        for (i = 0; i < 10; i++) {
+                skge_write16(hw, SK_REG(port, TX_MFF_CTRL1),
+                             MFF_SET_MAC_RST);
+                if (skge_read16(hw, SK_REG(port, TX_MFF_CTRL1)) & MFF_SET_MAC_RST)
+                        goto reset_ok;
+                udelay(1);
+        }
 
+        printk(KERN_WARNING PFX "%s: genesis reset failed\n", dev->name);
+
+ reset_ok:
         /* Unreset the XMAC. */
         skge_write16(hw, SK_REG(port, TX_MFF_CTRL1), MFF_CLR_MAC_RST);
 
@@ -1191,7 +1199,7 @@ static void genesis_mac_init(struct skge_hw *hw, int port)
                 r |= GP_DIR_2|GP_IO_2;
 
         skge_write32(hw, B2_GP_IO, r);
-        skge_read32(hw, B2_GP_IO);
+
 
         /* Enable GMII interface */
         xm_write16(hw, port, XM_HW_CFG, XM_HW_GMII_MD);
@@ -1205,6 +1213,13 @@ static void genesis_mac_init(struct skge_hw *hw, int port)
         for (i = 1; i < 16; i++)
                 xm_outaddr(hw, port, XM_EXM(i), zero);
 
+        /* Clear MIB counters */
+        xm_write16(hw, port, XM_STAT_CMD,
+                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
+        /* Clear two times according to Errata #3 */
+        xm_write16(hw, port, XM_STAT_CMD,
+                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
+
         /* configure Rx High Water Mark (XM_RX_HI_WM) */
         xm_write16(hw, port, XM_RX_HI_WM, 1450);
 
@@ -1697,6 +1712,7 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
         skge_write32(hw, SK_REG(port, GPHY_CTRL), reg | GPC_RST_SET);
         skge_write32(hw, SK_REG(port, GPHY_CTRL), reg | GPC_RST_CLR);
         skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_ON | GMC_RST_CLR);
+
         if (skge->autoneg == AUTONEG_DISABLE) {
                 reg = GM_GPCR_AU_ALL_DIS;
                 gma_write16(hw, port, GM_GP_CTRL,
@@ -1704,16 +1720,23 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
 
                 switch (skge->speed) {
                 case SPEED_1000:
+                        reg &= ~GM_GPCR_SPEED_100;
                         reg |= GM_GPCR_SPEED_1000;
-                        /* fallthru */
+                        break;
                 case SPEED_100:
+                        reg &= ~GM_GPCR_SPEED_1000;
                         reg |= GM_GPCR_SPEED_100;
+                        break;
+                case SPEED_10:
+                        reg &= ~(GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100);
+                        break;
                 }
 
                 if (skge->duplex == DUPLEX_FULL)
                         reg |= GM_GPCR_DUP_FULL;
         } else
                 reg = GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100 | GM_GPCR_DUP_FULL;
+
         switch (skge->flow_control) {
         case FLOW_MODE_NONE:
                 skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
@@ -2162,8 +2185,10 @@ static int skge_up(struct net_device *dev)
         skge->tx_avail = skge->tx_ring.count - 1;
 
         /* Enable IRQ from port */
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= portirqmask[port];
         skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         /* Initialize MAC */
         spin_lock_bh(&hw->phy_lock);
@@ -2221,8 +2246,10 @@ static int skge_down(struct net_device *dev)
         else
                 yukon_stop(skge);
 
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask &= ~portirqmask[skge->port];
         skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         /* Stop transmitter */
         skge_write8(hw, Q_ADDR(txqaddr[port], Q_CSR), CSR_STOP);
@@ -2670,8 +2697,7 @@ static int skge_poll(struct net_device *dev, int *budget)
 
         /* restart receiver */
         wmb();
-        skge_write8(hw, Q_ADDR(rxqaddr[skge->port], Q_CSR),
-                    CSR_START | CSR_IRQ_CL_F);
+        skge_write8(hw, Q_ADDR(rxqaddr[skge->port], Q_CSR), CSR_START);
 
         *budget -= work_done;
         dev->quota -= work_done;
@@ -2679,10 +2705,11 @@ static int skge_poll(struct net_device *dev, int *budget)
         if (work_done >=  to_do)
                 return 1; /* not done */
 
-        netif_rx_complete(dev);
-        hw->intr_mask |= portirqmask[skge->port];
-        skge_write32(hw, B0_IMSK, hw->intr_mask);
-        skge_read32(hw, B0_IMSK);
+        spin_lock_irq(&hw->hw_lock);
+        __netif_rx_complete(dev);
+        hw->intr_mask |= portirqmask[skge->port];
+        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         return 0;
 }
@@ -2842,18 +2869,10 @@ static void skge_extirq(unsigned long data)
         }
         spin_unlock(&hw->phy_lock);
 
-        local_irq_disable();
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= IS_EXT_REG;
         skge_write32(hw, B0_IMSK, hw->intr_mask);
-        local_irq_enable();
-}
-
-static inline void skge_wakeup(struct net_device *dev)
-{
-        struct skge_port *skge = netdev_priv(dev);
-
-        prefetch(skge->rx_ring.to_clean);
-        netif_rx_schedule(dev);
+        spin_unlock_irq(&hw->hw_lock);
 }
 
 static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
@@ -2864,15 +2883,17 @@ static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
         if (status == 0 || status == ~0) /* hotplug or shared irq */
                 return IRQ_NONE;
 
-        status &= hw->intr_mask;
+        spin_lock(&hw->hw_lock);
         if (status & IS_R1_F) {
+                skge_write8(hw, Q_ADDR(Q_R1, Q_CSR), CSR_IRQ_CL_F);
                 hw->intr_mask &= ~IS_R1_F;
-                skge_wakeup(hw->dev[0]);
+                netif_rx_schedule(hw->dev[0]);
         }
 
         if (status & IS_R2_F) {
+                skge_write8(hw, Q_ADDR(Q_R2, Q_CSR), CSR_IRQ_CL_F);
                 hw->intr_mask &= ~IS_R2_F;
-                skge_wakeup(hw->dev[1]);
+                netif_rx_schedule(hw->dev[1]);
         }
 
         if (status & IS_XA1_F)
@@ -2914,6 +2935,7 @@ static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
         }
 
         skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock(&hw->hw_lock);
 
         return IRQ_HANDLED;
 }
@@ -3282,6 +3304,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
 
         hw->pdev = pdev;
         spin_lock_init(&hw->phy_lock);
+        spin_lock_init(&hw->hw_lock);
         tasklet_init(&hw->ext_tasklet, skge_extirq, (unsigned long) hw);
 
         hw->regs = ioremap_nocache(pci_resource_start(pdev, 0), 0x4000);
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index 2efdacc290e5..941f12a333b6 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -2402,6 +2402,7 @@ struct skge_hw {
 
         struct tasklet_struct ext_tasklet;
         spinlock_t           phy_lock;
+        spinlock_t           hw_lock;
 };
 
 enum {
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index f8b973a04b65..73260364cba3 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -23,12 +23,6 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-/*
- * TOTEST
- *      - speed setting
- *      - suspend/resume
- */
-
 #include <linux/config.h>
 #include <linux/crc32.h>
 #include <linux/kernel.h>
@@ -57,7 +51,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "0.13"
+#define DRV_VERSION             "0.15"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -80,7 +74,7 @@
 #define TX_RING_SIZE            512
 #define TX_DEF_PENDING          (TX_RING_SIZE - 1)
 #define TX_MIN_PENDING          64
-#define MAX_SKB_TX_LE           (4 + 2*MAX_SKB_FRAGS)
+#define MAX_SKB_TX_LE           (4 + (sizeof(dma_addr_t)/sizeof(u32))*MAX_SKB_FRAGS)
 
 #define STATUS_RING_SIZE        2048    /* 2 ports * (TX + 2*RX) */
 #define STATUS_LE_BYTES         (STATUS_RING_SIZE*sizeof(struct sky2_status_le))
@@ -197,11 +191,11 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
         pr_debug("sky2_set_power_state %d\n", state);
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
 
-        pci_read_config_word(hw->pdev, hw->pm_cap + PCI_PM_PMC, &power_control);
-        vaux = (sky2_read8(hw, B0_CTST) & Y2_VAUX_AVAIL) &&
+        power_control = sky2_pci_read16(hw, hw->pm_cap + PCI_PM_PMC);
+        vaux = (sky2_read16(hw, B0_CTST) & Y2_VAUX_AVAIL) &&
                 (power_control & PCI_PM_CAP_PME_D3cold);
 
-        pci_read_config_word(hw->pdev, hw->pm_cap + PCI_PM_CTRL, &power_control);
+        power_control = sky2_pci_read16(hw, hw->pm_cap + PCI_PM_CTRL);
 
         power_control |= PCI_PM_CTRL_PME_STATUS;
         power_control &= ~(PCI_PM_CTRL_STATE_MASK);
@@ -225,7 +219,7 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                         sky2_write8(hw, B2_Y2_CLK_GATE, 0);
 
                 /* Turn off phy power saving */
-                pci_read_config_dword(hw->pdev, PCI_DEV_REG1, &reg1);
+                reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
                 reg1 &= ~(PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
 
                 /* looks like this XL is back asswards .. */
@@ -234,18 +228,28 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                         if (hw->ports > 1)
                                 reg1 |= PCI_Y2_PHY2_COMA;
                 }
-                pci_write_config_dword(hw->pdev, PCI_DEV_REG1, reg1);
+
+                if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
+                        sky2_pci_write32(hw, PCI_DEV_REG3, 0);
+                        reg1 = sky2_pci_read32(hw, PCI_DEV_REG4);
+                        reg1 &= P_ASPM_CONTROL_MSK;
+                        sky2_pci_write32(hw, PCI_DEV_REG4, reg1);
+                        sky2_pci_write32(hw, PCI_DEV_REG5, 0);
+                }
+
+                sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+
                 break;
 
         case PCI_D3hot:
         case PCI_D3cold:
                 /* Turn on phy power saving */
-                pci_read_config_dword(hw->pdev, PCI_DEV_REG1, &reg1);
+                reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
                 if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
                         reg1 &= ~(PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
                 else
                         reg1 |= (PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
-                pci_write_config_dword(hw->pdev, PCI_DEV_REG1, reg1);
+                sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
 
                 if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
                         sky2_write8(hw, B2_Y2_CLK_GATE, 0);
@@ -267,7 +271,7 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                 ret = -1;
         }
 
-        pci_write_config_byte(hw->pdev, hw->pm_cap + PCI_PM_CTRL, power_control);
+        sky2_pci_write16(hw, hw->pm_cap + PCI_PM_CTRL, power_control);
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         return ret;
 }
@@ -465,16 +469,31 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 ledover |= PHY_M_LED_MO_RX(MO_LED_OFF);
         }
 
-        gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev >= 2) {
+                /* apply fixes in PHY AFE */
+                gm_phy_write(hw, port, 22, 255);
+                /* increase differential signal amplitude in 10BASE-T */
+                gm_phy_write(hw, port, 24, 0xaa99);
+                gm_phy_write(hw, port, 23, 0x2011);
 
-        if (sky2->autoneg == AUTONEG_DISABLE || sky2->speed == SPEED_100) {
-                /* turn on 100 Mbps LED (LED_LINK100) */
-                ledover |= PHY_M_LED_MO_100(MO_LED_ON);
-        }
+                /* fix for IEEE A/B Symmetry failure in 1000BASE-T */
+                gm_phy_write(hw, port, 24, 0xa204);
+                gm_phy_write(hw, port, 23, 0x2002);
 
-        if (ledover)
-                gm_phy_write(hw, port, PHY_MARV_LED_OVER, ledover);
+                /* set page register to 0 */
+                gm_phy_write(hw, port, 22, 0);
+        } else {
+                gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
+
+                if (sky2->autoneg == AUTONEG_DISABLE || sky2->speed == SPEED_100) {
+                        /* turn on 100 Mbps LED (LED_LINK100) */
+                        ledover |= PHY_M_LED_MO_100(MO_LED_ON);
+                }
+
+                if (ledover)
+                        gm_phy_write(hw, port, PHY_MARV_LED_OVER, ledover);
 
+        }
         /* Enable phy interrupt on auto-negotiation complete (or link up) */
         if (sky2->autoneg == AUTONEG_ENABLE)
                 gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_IS_AN_COMPL);
@@ -522,10 +541,16 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
 
                 switch (sky2->speed) {
                 case SPEED_1000:
+                        reg &= ~GM_GPCR_SPEED_100;
                         reg |= GM_GPCR_SPEED_1000;
-                        /* fallthru */
+                        break;
                 case SPEED_100:
+                        reg &= ~GM_GPCR_SPEED_1000;
                         reg |= GM_GPCR_SPEED_100;
+                        break;
+                case SPEED_10:
+                        reg &= ~(GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100);
+                        break;
                 }
 
                 if (sky2->duplex == DUPLEX_FULL)
@@ -597,8 +622,8 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
 
         /* Configure Rx MAC FIFO */
         sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_CLR);
-        sky2_write16(hw, SK_REG(port, RX_GMF_CTRL_T),
-                     GMF_RX_CTRL_DEF);
+        sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T),
+                     GMF_OPER_ON | GMF_RX_F_FL_ON);
 
         /* Flush Rx MAC FIFO on any flow control or error */
         sky2_write16(hw, SK_REG(port, RX_GMF_FL_MSK), GMR_FS_ANY_ERR);
@@ -949,6 +974,12 @@ static int sky2_rx_start(struct sky2_port *sky2)
 
         sky2->rx_put = sky2->rx_next = 0;
         sky2_qset(hw, rxq);
+
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev >= 2) {
+                /* MAC Rx RAM Read is controlled by hardware */
+                sky2_write32(hw, Q_ADDR(rxq, Q_F), F_M_RX_RAM_DIS);
+        }
+
         sky2_prefetch_init(hw, rxq, sky2->rx_le_map, RX_LE_SIZE - 1);
 
         rx_set_checksum(sky2);
@@ -964,6 +995,10 @@ static int sky2_rx_start(struct sky2_port *sky2)
                 sky2_rx_add(sky2, re->mapaddr);
         }
 
+        /* Truncate oversize frames */
+        sky2_write16(hw, SK_REG(sky2->port, RX_GMF_TR_THR), sky2->rx_bufsize - 8);
+        sky2_write32(hw, SK_REG(sky2->port, RX_GMF_CTRL_T), RX_TRUNC_ON);
+
         /* Tell chip about available buffers */
         sky2_write16(hw, Y2_QADDR(rxq, PREF_UNIT_PUT_IDX), sky2->rx_put);
         sky2->rx_last_put = sky2_read16(hw, Y2_QADDR(rxq, PREF_UNIT_PUT_IDX));
@@ -1031,9 +1066,10 @@ static int sky2_up(struct net_device *dev)
                     RB_RST_SET);
 
         sky2_qset(hw, txqaddr[port]);
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U)
-                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), 0x1a0);
 
+        /* Set almost empty threshold */
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == 1)
+                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), 0x1a0);
 
         sky2_prefetch_init(hw, txqaddr[port], sky2->tx_le_map,
                            TX_RING_SIZE - 1);
@@ -1043,8 +1079,10 @@ static int sky2_up(struct net_device *dev)
                 goto err_out;
 
         /* Enable interrupts from phy/mac for port */
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= (port == 0) ? Y2_IS_PORT_1 : Y2_IS_PORT_2;
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
         return 0;
 
 err_out:
@@ -1111,6 +1149,7 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         struct sky2_tx_le *le = NULL;
         struct tx_ring_info *re;
         unsigned i, len;
+        int avail;
         dma_addr_t mapping;
         u32 addr64;
         u16 mss;
@@ -1253,12 +1292,16 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
         re->idx = sky2->tx_prod;
         le->ctrl |= EOP;
 
+        avail = tx_avail(sky2);
+        if (mss != 0 || avail < TX_MIN_PENDING) {
+                le->ctrl |= FRC_STAT;
+                if (avail <= MAX_SKB_TX_LE)
+                        netif_stop_queue(dev);
+        }
+
         sky2_put_idx(hw, txqaddr[sky2->port], sky2->tx_prod,
                      &sky2->tx_last_put, TX_RING_SIZE);
 
-        if (tx_avail(sky2) <= MAX_SKB_TX_LE)
-                netif_stop_queue(dev);
-
 out_unlock:
         spin_unlock(&sky2->tx_lock);
 
@@ -1344,10 +1387,10 @@ static int sky2_down(struct net_device *dev)
         netif_stop_queue(dev);
 
         /* Disable port IRQ */
-        local_irq_disable();
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask &= ~((sky2->port == 0) ? Y2_IS_IRQ_PHY1 : Y2_IS_IRQ_PHY2);
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
-        local_irq_enable();
+        spin_unlock_irq(&hw->hw_lock);
 
         flush_scheduled_work();
 
@@ -1448,6 +1491,29 @@ static void sky2_link_up(struct sky2_port *sky2)
         sky2_write8(hw, SK_REG(port, GMAC_IRQ_MSK), GMAC_DEF_MSK);
 
         reg = gma_read16(hw, port, GM_GP_CTRL);
+        if (sky2->autoneg == AUTONEG_DISABLE) {
+                reg |= GM_GPCR_AU_ALL_DIS;
+
+                /* Is write/read necessary?  Copied from sky2_mac_init */
+                gma_write16(hw, port, GM_GP_CTRL, reg);
+                gma_read16(hw, port, GM_GP_CTRL);
+
+                switch (sky2->speed) {
+                case SPEED_1000:
+                        reg &= ~GM_GPCR_SPEED_100;
+                        reg |= GM_GPCR_SPEED_1000;
+                        break;
+                case SPEED_100:
+                        reg &= ~GM_GPCR_SPEED_1000;
+                        reg |= GM_GPCR_SPEED_100;
+                        break;
+                case SPEED_10:
+                        reg &= ~(GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100);
+                        break;
+                }
+        } else
+                reg &= ~GM_GPCR_AU_ALL_DIS;
+
         if (sky2->duplex == DUPLEX_FULL || sky2->autoneg == AUTONEG_ENABLE)
                 reg |= GM_GPCR_DUP_FULL;
 
@@ -1606,10 +1672,10 @@ static void sky2_phy_task(void *arg)
 out:
         up(&sky2->phy_sema);
 
-        local_irq_disable();
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= (sky2->port == 0) ? Y2_IS_IRQ_PHY1 : Y2_IS_IRQ_PHY2;
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
-        local_irq_enable();
+        spin_unlock_irq(&hw->hw_lock);
 }
 
 
@@ -1650,10 +1716,12 @@ static void sky2_tx_timeout(struct net_device *dev)
 
 
 #define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
-/* Want receive buffer size to be multiple of 64 bits, and incl room for vlan */
+/* Want receive buffer size to be multiple of 64 bits
+ * and incl room for vlan and truncation
+ */
 static inline unsigned sky2_buf_size(int mtu)
 {
-        return roundup(mtu + ETH_HLEN + 4, 8);
+        return roundup(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
 }
 
 static int sky2_change_mtu(struct net_device *dev, int new_mtu)
@@ -1736,7 +1804,7 @@ static struct sk_buff *sky2_receive(struct sky2_port *sky2,
         if (!(status & GMR_FS_RX_OK))
                 goto resubmit;
 
-        if ((status >> 16) != length || length > sky2->rx_bufsize)
+        if (length > sky2->netdev->mtu + ETH_HLEN)
                 goto oversize;
 
         if (length < copybreak) {
@@ -1834,6 +1902,19 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         u16 hwidx;
         u16 tx_done[2] = { TX_NO_STATUS, TX_NO_STATUS };
 
+        sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
+
+        /*
+         * Kick the STAT_LEV_TIMER_CTRL timer.
+         * This fixes my hangs on Yukon-EC (0xb6) rev 1.
+         * The if clause is there to start the timer only if it has been
+         * configured correctly and not been disabled via ethtool.
+         */
+        if (sky2_read8(hw, STAT_LEV_TIMER_CTRL) == TIM_START) {
+                sky2_write8(hw, STAT_LEV_TIMER_CTRL, TIM_STOP);
+                sky2_write8(hw, STAT_LEV_TIMER_CTRL, TIM_START);
+        }
+
         hwidx = sky2_read16(hw, STAT_PUT_IDX);
         BUG_ON(hwidx >= STATUS_RING_SIZE);
         rmb();
@@ -1913,21 +1994,22 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         }
 
 exit_loop:
-        sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
-
         sky2_tx_check(hw, 0, tx_done[0]);
         sky2_tx_check(hw, 1, tx_done[1]);
 
-        if (sky2_read16(hw, STAT_PUT_IDX) == hw->st_idx) {
-                /* need to restart TX timer */
-                if (is_ec_a1(hw)) {
-                        sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_STOP);
-                        sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START);
-                }
+        if (sky2_read8(hw, STAT_TX_TIMER_CTRL) == TIM_START) {
+                sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_STOP);
+                sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START);
+        }
+
+        if (likely(work_done < to_do)) {
+                spin_lock_irq(&hw->hw_lock);
+                __netif_rx_complete(dev0);
 
-                netif_rx_complete(dev0);
                 hw->intr_mask |= Y2_IS_STAT_BMU;
                 sky2_write32(hw, B0_IMSK, hw->intr_mask);
+                spin_unlock_irq(&hw->hw_lock);
+
                 return 0;
         } else {
                 *budget -= work_done;
@@ -1990,13 +2072,13 @@ static void sky2_hw_intr(struct sky2_hw *hw)
         if (status & (Y2_IS_MST_ERR | Y2_IS_IRQ_STAT)) {
                 u16 pci_err;
 
-                pci_read_config_word(hw->pdev, PCI_STATUS, &pci_err);
+                pci_err = sky2_pci_read16(hw, PCI_STATUS);
                 if (net_ratelimit())
                         printk(KERN_ERR PFX "%s: pci hw error (0x%x)\n",
                                pci_name(hw->pdev), pci_err);
 
                 sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-                pci_write_config_word(hw->pdev, PCI_STATUS,
+                sky2_pci_write16(hw, PCI_STATUS,
                                       pci_err | PCI_STATUS_ERROR_BITS);
                 sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         }
@@ -2005,7 +2087,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
                 /* PCI-Express uncorrectable Error occurred */
                 u32 pex_err;
 
-                pci_read_config_dword(hw->pdev, PEX_UNC_ERR_STAT, &pex_err);
+                pex_err = sky2_pci_read32(hw, PEX_UNC_ERR_STAT);
 
                 if (net_ratelimit())
                         printk(KERN_ERR PFX "%s: pci express error (0x%x)\n",
@@ -2013,7 +2095,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
 
                 /* clear the interrupt */
                 sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-                pci_write_config_dword(hw->pdev, PEX_UNC_ERR_STAT,
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT,
                                        0xffffffffUL);
                 sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
@@ -2059,6 +2141,7 @@ static void sky2_phy_intr(struct sky2_hw *hw, unsigned port)
 
         hw->intr_mask &= ~(port == 0 ? Y2_IS_IRQ_PHY1 : Y2_IS_IRQ_PHY2);
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
+
         schedule_work(&sky2->phy_task);
 }
 
@@ -2072,6 +2155,7 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
         if (status == 0 || status == ~0)
                 return IRQ_NONE;
 
+        spin_lock(&hw->hw_lock);
         if (status & Y2_IS_HW_ERR)
                 sky2_hw_intr(hw);
 
@@ -2100,7 +2184,7 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
 
         sky2_write32(hw, B0_Y2_SP_ICR, 2);
 
-        sky2_read32(hw, B0_IMSK);
+        spin_unlock(&hw->hw_lock);
 
         return IRQ_HANDLED;
 }
@@ -2141,14 +2225,12 @@ static inline u32 sky2_clk2us(const struct sky2_hw *hw, u32 clk)
 
 static int sky2_reset(struct sky2_hw *hw)
 {
-        u32 ctst;
         u16 status;
         u8 t8, pmd_type;
         int i;
 
-        ctst = sky2_read32(hw, B0_CTST);
-
         sky2_write8(hw, B0_CTST, CS_RST_CLR);
+
         hw->chip_id = sky2_read8(hw, B2_CHIP_ID);
         if (hw->chip_id < CHIP_ID_YUKON_XL || hw->chip_id > CHIP_ID_YUKON_FE) {
                 printk(KERN_ERR PFX "%s: unsupported chip type 0x%x\n",
@@ -2156,12 +2238,6 @@ static int sky2_reset(struct sky2_hw *hw)
                 return -EOPNOTSUPP;
         }
 
-        /* ring for status responses */
-        hw->st_le = pci_alloc_consistent(hw->pdev, STATUS_LE_BYTES,
-                                         &hw->st_dma);
-        if (!hw->st_le)
-                return -ENOMEM;
-
         /* disable ASF */
         if (hw->chip_id <= CHIP_ID_YUKON_EC) {
                 sky2_write8(hw, B28_Y2_ASF_STAT_CMD, Y2_ASF_RESET);
@@ -2173,20 +2249,18 @@ static int sky2_reset(struct sky2_hw *hw)
         sky2_write8(hw, B0_CTST, CS_RST_CLR);
 
         /* clear PCI errors, if any */
-        pci_read_config_word(hw->pdev, PCI_STATUS, &status);
+        status = sky2_pci_read16(hw, PCI_STATUS);
+
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-        pci_write_config_word(hw->pdev, PCI_STATUS,
-                              status | PCI_STATUS_ERROR_BITS);
+        sky2_pci_write16(hw, PCI_STATUS, status | PCI_STATUS_ERROR_BITS);
+
 
         sky2_write8(hw, B0_CTST, CS_MRST_CLR);
 
         /* clear any PEX errors */
-        if (is_pciex(hw)) {
-                u16 lstat;
-                pci_write_config_dword(hw->pdev, PEX_UNC_ERR_STAT,
-                                       0xffffffffUL);
-                pci_read_config_word(hw->pdev, PEX_LNK_STAT, &lstat);
-        }
+        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP)) 
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT, 0xffffffffUL);
+
 
         pmd_type = sky2_read8(hw, B2_PMD_TYP);
         hw->copper = !(pmd_type == 'L' || pmd_type == 'S');
@@ -2285,8 +2359,7 @@ static int sky2_reset(struct sky2_hw *hw)
                         sky2_write8(hw, STAT_FIFO_ISR_WM, 16);
 
                 sky2_write32(hw, STAT_TX_TIMER_INI, sky2_us2clk(hw, 1000));
-                sky2_write32(hw, STAT_LEV_TIMER_INI, sky2_us2clk(hw, 100));
-                sky2_write32(hw, STAT_ISR_TIMER_INI, sky2_us2clk(hw, 20));
+                sky2_write32(hw, STAT_ISR_TIMER_INI, sky2_us2clk(hw, 7));
         }
 
         /* enable status unit */
@@ -2551,19 +2624,24 @@ static struct net_device_stats *sky2_get_stats(struct net_device *dev)
 static int sky2_set_mac_address(struct net_device *dev, void *p)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
-        struct sockaddr *addr = p;
+        struct sky2_hw *hw = sky2->hw;
+        unsigned port = sky2->port;
+        const struct sockaddr *addr = p;
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
         memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
-        memcpy_toio(sky2->hw->regs + B2_MAC_1 + sky2->port * 8,
+        memcpy_toio(hw->regs + B2_MAC_1 + port * 8,
                     dev->dev_addr, ETH_ALEN);
-        memcpy_toio(sky2->hw->regs + B2_MAC_2 + sky2->port * 8,
+        memcpy_toio(hw->regs + B2_MAC_2 + port * 8,
                     dev->dev_addr, ETH_ALEN);
 
-        if (netif_running(dev))
-                sky2_phy_reinit(sky2);
+        /* virtual address for data */
+        gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
+
+        /* physical address: used for pause frames */
+        gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
 
         return 0;
 }
@@ -2815,11 +2893,11 @@ static int sky2_set_coalesce(struct net_device *dev,
             (ecmd->rx_coalesce_usecs_irq < tmin || ecmd->rx_coalesce_usecs_irq > tmax))
                 return -EINVAL;
 
-        if (ecmd->tx_max_coalesced_frames > 0xffff)
+        if (ecmd->tx_max_coalesced_frames >= TX_RING_SIZE-1)
                 return -EINVAL;
-        if (ecmd->rx_max_coalesced_frames > 0xff)
+        if (ecmd->rx_max_coalesced_frames > RX_MAX_PENDING)
                 return -EINVAL;
-        if (ecmd->rx_max_coalesced_frames_irq > 0xff)
+        if (ecmd->rx_max_coalesced_frames_irq >RX_MAX_PENDING)
                 return -EINVAL;
 
         if (ecmd->tx_coalesce_usecs == 0)
@@ -2843,7 +2921,7 @@ static int sky2_set_coalesce(struct net_device *dev,
         if (ecmd->rx_coalesce_usecs_irq == 0)
                 sky2_write8(hw, STAT_ISR_TIMER_CTRL, TIM_STOP);
         else {
-                sky2_write32(hw, STAT_TX_TIMER_INI,
+                sky2_write32(hw, STAT_ISR_TIMER_INI,
                              sky2_us2clk(hw, ecmd->rx_coalesce_usecs_irq));
                 sky2_write8(hw, STAT_ISR_TIMER_CTRL, TIM_START);
         }
@@ -3106,17 +3184,6 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
                 }
         }
 
-#ifdef __BIG_ENDIAN
-        /* byte swap descriptors in hardware */
-        {
-                u32 reg;
-
-                pci_read_config_dword(pdev, PCI_DEV_REG2, &reg);
-                reg |= PCI_REV_DESC;
-                pci_write_config_dword(pdev, PCI_DEV_REG2, reg);
-        }
-#endif
-
         err = -ENOMEM;
         hw = kzalloc(sizeof(*hw), GFP_KERNEL);
         if (!hw) {
@@ -3134,6 +3201,24 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
                 goto err_out_free_hw;
         }
         hw->pm_cap = pm_cap;
+        spin_lock_init(&hw->hw_lock);
+
+#ifdef __BIG_ENDIAN
+        /* byte swap descriptors in hardware */
+        {
+                u32 reg;
+
+                reg = sky2_pci_read32(hw, PCI_DEV_REG2);
+                reg |= PCI_REV_DESC;
+                sky2_pci_write32(hw, PCI_DEV_REG2, reg);
+        }
+#endif
+
+        /* ring for status responses */
+        hw->st_le = pci_alloc_consistent(hw->pdev, STATUS_LE_BYTES,
+                                         &hw->st_dma);
+        if (!hw->st_le)
+                goto err_out_iounmap;
 
         err = sky2_reset(hw);
         if (err)
@@ -3263,25 +3348,33 @@ static int sky2_suspend(struct pci_dev *pdev, pm_message_t state)
 static int sky2_resume(struct pci_dev *pdev)
 {
         struct sky2_hw *hw = pci_get_drvdata(pdev);
-        int i;
+        int i, err;
 
         pci_restore_state(pdev);
         pci_enable_wake(pdev, PCI_D0, 0);
-        sky2_set_power_state(hw, PCI_D0);
+        err = sky2_set_power_state(hw, PCI_D0);
+        if (err)
+                goto out;
 
-        sky2_reset(hw);
+        err = sky2_reset(hw);
+        if (err)
+                goto out;
 
         for (i = 0; i < 2; i++) {
                 struct net_device *dev = hw->dev[i];
-                if (dev) {
-                        if (netif_running(dev)) {
-                                netif_device_attach(dev);
-                                if (sky2_up(dev))
-                                        dev_close(dev);
+                if (dev && netif_running(dev)) {
+                        netif_device_attach(dev);
+                        err = sky2_up(dev);
+                        if (err) {
+                                printk(KERN_ERR PFX "%s: could not up: %d\n",
+                                       dev->name, err);
+                                dev_close(dev);
+                                break;
                         }
                 }
         }
-        return 0;
+out:
+        return err;
 }
 #endif
 
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 95518921001c..dce955c76f3c 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -5,14 +5,22 @@
 #define _SKY2_H
 
 /* PCI config registers */
-#define PCI_DEV_REG1    0x40
-#define PCI_DEV_REG2    0x44
-#define PCI_DEV_STATUS  0x7c
-#define PCI_OS_PCI_X    (1<<26)
+enum {
+        PCI_DEV_REG1    = 0x40,
+        PCI_DEV_REG2    = 0x44,
+        PCI_DEV_STATUS  = 0x7c,
+        PCI_DEV_REG3    = 0x80,
+        PCI_DEV_REG4    = 0x84,
+        PCI_DEV_REG5    = 0x88,
+};
 
-#define PEX_LNK_STAT    0xf2
-#define PEX_UNC_ERR_STAT 0x104
-#define PEX_DEV_CTRL    0xe8
+enum {
+        PEX_DEV_CAP     = 0xe4,
+        PEX_DEV_CTRL    = 0xe8,
+        PEX_DEV_STA     = 0xea,
+        PEX_LNK_STAT    = 0xf2,
+        PEX_UNC_ERR_STAT= 0x104,
+};
 
 /* Yukon-2 */
 enum pci_dev_reg_1 {
@@ -37,6 +45,25 @@ enum pci_dev_reg_2 {
         PCI_USEDATA64   = 1<<0,         /* Use 64Bit Data bus ext */
 };
 
+/*      PCI_OUR_REG_4           32 bit  Our Register 4 (Yukon-ECU only) */
+enum pci_dev_reg_4 {
+                                        /* (Link Training & Status State Machine) */
+        P_TIMER_VALUE_MSK       = 0xffL<<16,    /* Bit 23..16:  Timer Value Mask */
+                                        /* (Active State Power Management) */
+        P_FORCE_ASPM_REQUEST    = 1<<15, /* Force ASPM Request (A1 only) */
+        P_ASPM_GPHY_LINK_DOWN   = 1<<14, /* GPHY Link Down (A1 only) */
+        P_ASPM_INT_FIFO_EMPTY   = 1<<13, /* Internal FIFO Empty (A1 only) */
+        P_ASPM_CLKRUN_REQUEST   = 1<<12, /* CLKRUN Request (A1 only) */
+
+        P_ASPM_FORCE_CLKREQ_ENA = 1<<4, /* Force CLKREQ Enable (A1b only) */
+        P_ASPM_CLKREQ_PAD_CTL   = 1<<3, /* CLKREQ PAD Control (A1 only) */
+        P_ASPM_A1_MODE_SELECT   = 1<<2, /* A1 Mode Select (A1 only) */
+        P_CLK_GATE_PEX_UNIT_ENA = 1<<1, /* Enable Gate PEX Unit Clock */
+        P_CLK_GATE_ROOT_COR_ENA = 1<<0, /* Enable Gate Root Core Clock */
+        P_ASPM_CONTROL_MSK      = P_FORCE_ASPM_REQUEST | P_ASPM_GPHY_LINK_DOWN
+                                  | P_ASPM_CLKRUN_REQUEST | P_ASPM_INT_FIFO_EMPTY,
+};
+
 
 #define PCI_STATUS_ERROR_BITS (PCI_STATUS_DETECTED_PARITY | \
                                PCI_STATUS_SIG_SYSTEM_ERROR | \
@@ -507,6 +534,16 @@ enum {
 };
 #define Q_ADDR(reg, offs) (B8_Q_REGS + (reg) + (offs))
 
+/*      Q_F                             32 bit  Flag Register */
+enum {
+        F_ALM_FULL      = 1<<27, /* Rx FIFO: almost full */
+        F_EMPTY         = 1<<27, /* Tx FIFO: empty flag */
+        F_FIFO_EOF      = 1<<26, /* Tag (EOF Flag) bit in FIFO */
+        F_WM_REACHED    = 1<<25, /* Watermark reached */
+        F_M_RX_RAM_DIS  = 1<<24, /* MAC Rx RAM Read Port disable */
+        F_FIFO_LEVEL    = 0x1fL<<16, /* Bit 23..16:     # of Qwords in FIFO */
+        F_WATER_MARK    = 0x0007ffL, /* Bit 10.. 0:     Watermark */
+};
 
 /* Queue Prefetch Unit Offsets, use Y2_QADDR() to address (Yukon-2 only)*/
 enum {
@@ -909,10 +946,12 @@ enum {
         PHY_BCOM_ID1_C0 = 0x6044,
         PHY_BCOM_ID1_C5 = 0x6047,
 
-        PHY_MARV_ID1_B0 = 0x0C23, /* Yukon (PHY 88E1011) */
+        PHY_MARV_ID1_B0 = 0x0C23, /* Yukon      (PHY 88E1011) */
         PHY_MARV_ID1_B2 = 0x0C25, /* Yukon-Plus (PHY 88E1011) */
-        PHY_MARV_ID1_C2 = 0x0CC2, /* Yukon-EC (PHY 88E1111) */
-        PHY_MARV_ID1_Y2 = 0x0C91, /* Yukon-2 (PHY 88E1112) */
+        PHY_MARV_ID1_C2 = 0x0CC2, /* Yukon-EC   (PHY 88E1111) */
+        PHY_MARV_ID1_Y2 = 0x0C91, /* Yukon-2    (PHY 88E1112) */
+        PHY_MARV_ID1_FE = 0x0C83, /* Yukon-FE   (PHY 88E3082 Rev.A1) */
+        PHY_MARV_ID1_ECU= 0x0CB0, /* Yukon-ECU  (PHY 88E1149 Rev.B2?) */
 };
 
 /* Advertisement register bits */
@@ -1837,8 +1876,9 @@ struct sky2_port {
 struct sky2_hw {
         void __iomem         *regs;
         struct pci_dev       *pdev;
-        u32                  intr_mask;
         struct net_device    *dev[2];
+        spinlock_t           hw_lock;
+        u32                  intr_mask;
 
         int                  pm_cap;
         u8                   chip_id;
@@ -1867,14 +1907,6 @@ static inline u8 sky2_read8(const struct sky2_hw *hw, unsigned reg)
         return readb(hw->regs + reg);
 }
 
-/* This should probably go away, bus based tweeks suck */
-static inline int is_pciex(const struct sky2_hw *hw)
-{
-        u32 status;
-        pci_read_config_dword(hw->pdev, PCI_DEV_STATUS, &status);
-        return (status & PCI_OS_PCI_X) == 0;
-}
-
 static inline void sky2_write32(const struct sky2_hw *hw, unsigned reg, u32 val)
 {
         writel(val, hw->regs + reg);
@@ -1919,4 +1951,25 @@ static inline void gma_set_addr(struct sky2_hw *hw, unsigned port, unsigned reg,
         gma_write16(hw, port, reg+4,(u16) addr[2] | ((u16) addr[3] << 8));
         gma_write16(hw, port, reg+8,(u16) addr[4] | ((u16) addr[5] << 8));
 }
+
+/* PCI config space access */
+static inline u32 sky2_pci_read32(const struct sky2_hw *hw, unsigned reg)
+{
+        return sky2_read32(hw, Y2_CFG_SPC + reg);
+}
+
+static inline u16 sky2_pci_read16(const struct sky2_hw *hw, unsigned reg)
+{
+        return sky2_read16(hw, Y2_CFG_SPC + reg);
+}
+
+static inline void sky2_pci_write32(struct sky2_hw *hw, unsigned reg, u32 val)
+{
+        sky2_write32(hw, Y2_CFG_SPC + reg, val);
+}
+
+static inline void sky2_pci_write16(struct sky2_hw *hw, unsigned reg, u16 val)
+{
+        sky2_write16(hw, Y2_CFG_SPC + reg, val);
+}
 #endif
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index e7dc653d5bd6..caf4102b54ce 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -3532,9 +3532,23 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
                 (base + len + 8 < base));
 }
 
+/* Test for DMA addresses > 40-bit */
+static inline int tg3_40bit_overflow_test(struct tg3 *tp, dma_addr_t mapping,
+                                          int len)
+{
+#if defined(CONFIG_HIGHMEM) && (BITS_PER_LONG == 64)
+        if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS)
+                return (((u64) mapping + len) > DMA_40BIT_MASK);
+        return 0;
+#else
+        return 0;
+#endif
+}
+
 static void tg3_set_txd(struct tg3 *, int, dma_addr_t, int, u32, u32);
 
-static int tigon3_4gb_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
+/* Workaround 4GB and 40-bit hardware DMA bugs. */
+static int tigon3_dma_hwbug_workaround(struct tg3 *tp, struct sk_buff *skb,
                                        u32 last_plus_one, u32 *start,
                                        u32 base_flags, u32 mss)
 {
@@ -3742,6 +3756,9 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         if (tg3_4g_overflow_test(mapping, len))
                                 would_hit_hwbug = 1;
 
+                        if (tg3_40bit_overflow_test(tp, mapping, len))
+                                would_hit_hwbug = 1;
+
                         if (tp->tg3_flags2 & TG3_FLG2_HW_TSO)
                                 tg3_set_txd(tp, entry, mapping, len,
                                             base_flags, (i == last)|(mss << 1));
@@ -3763,7 +3780,7 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* If the workaround fails due to memory/mapping
                  * failure, silently drop this packet.
                  */
-                if (tigon3_4gb_hwbug_workaround(tp, skb, last_plus_one,
+                if (tigon3_dma_hwbug_workaround(tp, skb, last_plus_one,
                                                 &start, base_flags, mss))
                         goto out_unlock;
 
@@ -9408,6 +9425,15 @@ static int __devinit tg3_is_sun_570X(struct tg3 *tp)
                         return 0;
                 if (venid == PCI_VENDOR_ID_SUN)
                         return 1;
+
+                /* TG3 chips onboard the SunBlade-2500 don't have the
+                 * subsystem-vendor-id set to PCI_VENDOR_ID_SUN but they
+                 * are distinguishable from non-Sun variants by being
+                 * named "network" by the firmware.  Non-Sun cards will
+                 * show up as being named "ethernet".
+                 */
+                if (!strcmp(pcp->prom_name, "network"))
+                        return 1;
         }
         return 0;
 }
@@ -9526,12 +9552,36 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 }
         }
 
-        /* Find msi capability. */
+        /* The EPB bridge inside 5714, 5715, and 5780 cannot support
+         * DMA addresses > 40-bit. This bridge may have other additional
+         * 57xx devices behind it in some 4-port NIC designs for example.
+         * Any tg3 device found behind the bridge will also need the 40-bit
+         * DMA workaround.
+         */
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5780 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714) {
                 tp->tg3_flags2 |= TG3_FLG2_5780_CLASS;
+                tp->tg3_flags |= TG3_FLAG_40BIT_DMA_BUG;
                 tp->msi_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_MSI);
         }
+        else {
+                struct pci_dev *bridge = NULL;
+
+                do {
+                        bridge = pci_get_device(PCI_VENDOR_ID_SERVERWORKS,
+                                                PCI_DEVICE_ID_SERVERWORKS_EPB,
+                                                bridge);
+                        if (bridge && bridge->subordinate &&
+                            (bridge->subordinate->number <=
+                             tp->pdev->bus->number) &&
+                            (bridge->subordinate->subordinate >=
+                             tp->pdev->bus->number)) {
+                                tp->tg3_flags |= TG3_FLAG_40BIT_DMA_BUG;
+                                pci_dev_put(bridge);
+                                break;
+                        }
+                } while (bridge);
+        }
 
         /* Initialize misc host control in PCI block. */
         tp->misc_host_ctrl |= (misc_ctrl_reg &
@@ -10277,7 +10327,14 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
                     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
                         u32 ccval = (tr32(TG3PCI_CLOCK_CTRL) & 0x1f);
 
-                        if (ccval == 0x6 || ccval == 0x7)
+                        /* If the 5704 is behind the EPB bridge, we can
+                         * do the less restrictive ONE_DMA workaround for
+                         * better performance.
+                         */
+                        if ((tp->tg3_flags & TG3_FLAG_40BIT_DMA_BUG) &&
+                            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704)
+                                tp->dma_rwctrl |= 0x8000;
+                        else if (ccval == 0x6 || ccval == 0x7)
                                 tp->dma_rwctrl |= DMA_RWCTRL_ONE_DMA;
 
                         /* Set bit 23 to enable PCIX hw bug fix */
@@ -10517,8 +10574,6 @@ static char * __devinit tg3_bus_string(struct tg3 *tp, char *str)
                         strcat(str, "66MHz");
                 else if (clock_ctrl == 6)
                         strcat(str, "100MHz");
-                else if (clock_ctrl == 7)
-                        strcat(str, "133MHz");
         } else {
                 strcpy(str, "PCI:");
                 if (tp->tg3_flags & TG3_FLAG_PCI_HIGH_SPEED)
@@ -10599,8 +10654,9 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         unsigned long tg3reg_base, tg3reg_len;
         struct net_device *dev;
         struct tg3 *tp;
-        int i, err, pci_using_dac, pm_cap;
+        int i, err, pm_cap;
         char str[40];
+        u64 dma_mask, persist_dma_mask;
 
         if (tg3_version_printed++ == 0)
                 printk(KERN_INFO "%s", version);
@@ -10637,26 +10693,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                 goto err_out_free_res;
         }
 
-        /* Configure DMA attributes. */
-        err = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
-        if (!err) {
-                pci_using_dac = 1;
-                err = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);
-                if (err < 0) {
-                        printk(KERN_ERR PFX "Unable to obtain 64 bit DMA "
-                               "for consistent allocations\n");
-                        goto err_out_free_res;
-                }
-        } else {
-                err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
-                if (err) {
-                        printk(KERN_ERR PFX "No usable DMA configuration, "
-                               "aborting.\n");
-                        goto err_out_free_res;
-                }
-                pci_using_dac = 0;
-        }
-
         tg3reg_base = pci_resource_start(pdev, 0);
         tg3reg_len = pci_resource_len(pdev, 0);
 
@@ -10670,8 +10706,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         SET_MODULE_OWNER(dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
 
-        if (pci_using_dac)
-                dev->features |= NETIF_F_HIGHDMA;
         dev->features |= NETIF_F_LLTX;
 #if TG3_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
@@ -10756,6 +10790,45 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                 goto err_out_iounmap;
         }
 
+        /* The EPB bridge inside 5714, 5715, and 5780 and any
+         * device behind the EPB cannot support DMA addresses > 40-bit.
+         * On 64-bit systems with IOMMU, use 40-bit dma_mask.
+         * On 64-bit systems without IOMMU, use 64-bit dma_mask and
+         * do DMA address check in tg3_start_xmit().
+         */
+        if (tp->tg3_flags2 & TG3_FLG2_IS_5788)
+                persist_dma_mask = dma_mask = DMA_32BIT_MASK;
+        else if (tp->tg3_flags & TG3_FLAG_40BIT_DMA_BUG) {
+                persist_dma_mask = dma_mask = DMA_40BIT_MASK;
+#ifdef CONFIG_HIGHMEM
+                dma_mask = DMA_64BIT_MASK;
+#endif
+        } else
+                persist_dma_mask = dma_mask = DMA_64BIT_MASK;
+
+        /* Configure DMA attributes. */
+        if (dma_mask > DMA_32BIT_MASK) {
+                err = pci_set_dma_mask(pdev, dma_mask);
+                if (!err) {
+                        dev->features |= NETIF_F_HIGHDMA;
+                        err = pci_set_consistent_dma_mask(pdev,
+                                                          persist_dma_mask);
+                        if (err < 0) {
+                                printk(KERN_ERR PFX "Unable to obtain 64 bit "
+                                       "DMA for consistent allocations\n");
+                                goto err_out_iounmap;
+                        }
+                }
+        }
+        if (err || dma_mask == DMA_32BIT_MASK) {
+                err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                if (err) {
+                        printk(KERN_ERR PFX "No usable DMA configuration, "
+                               "aborting.\n");
+                        goto err_out_iounmap;
+                }
+        }
+
         tg3_init_bufmgr_config(tp);
 
 #if TG3_TSO_SUPPORT != 0
@@ -10824,9 +10897,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         } else
                 tp->tg3_flags &= ~TG3_FLAG_RX_CHECKSUMS;
 
-        if (tp->tg3_flags2 & TG3_FLG2_IS_5788)
-                dev->features &= ~NETIF_F_HIGHDMA;
-
         /* flow control autonegotiation is default behavior */
         tp->tg3_flags |= TG3_FLAG_PAUSE_AUTONEG;
 
@@ -10870,8 +10940,10 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
                (tp->tg3_flags & TG3_FLAG_SPLIT_MODE) != 0,
                (tp->tg3_flags2 & TG3_FLG2_NO_ETH_WIRE_SPEED) == 0,
                (tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE) != 0);
-        printk(KERN_INFO "%s: dma_rwctrl[%08x]\n",
-               dev->name, tp->dma_rwctrl);
+        printk(KERN_INFO "%s: dma_rwctrl[%08x] dma_mask[%d-bit]\n",
+               dev->name, tp->dma_rwctrl,
+               (pdev->dma_mask == DMA_32BIT_MASK) ? 32 :
+                (((u64) pdev->dma_mask == DMA_40BIT_MASK) ? 40 : 64));
 
         return 0;
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 7f4b7f6ac40d..7e3b613afb29 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2163,6 +2163,7 @@ struct tg3 {
 #define TG3_FLAG_10_100_ONLY            0x01000000
 #define TG3_FLAG_PAUSE_AUTONEG          0x02000000
 #define TG3_FLAG_IN_RESET_TASK          0x04000000
+#define TG3_FLAG_40BIT_DMA_BUG          0x08000000
 #define TG3_FLAG_BROKEN_CHECKSUMS       0x10000000
 #define TG3_FLAG_GOT_SERDES_FLOWCTL     0x20000000
 #define TG3_FLAG_SPLIT_MODE             0x40000000
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index c2506b56a186..12076f8f942c 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -536,6 +536,7 @@ static int __devinit TLan_probe1(struct pci_dev *pdev,
         u16                device_id;
         int                reg, rc = -ENODEV;
 
+#ifdef CONFIG_PCI
         if (pdev) {
                 rc = pci_enable_device(pdev);
                 if (rc)
@@ -547,6 +548,7 @@ static int __devinit TLan_probe1(struct pci_dev *pdev,
                         goto err_out;
                 }
         }
+#endif  /*  CONFIG_PCI  */
 
         dev = alloc_etherdev(sizeof(TLanPrivateInfo));
         if (dev == NULL) {
diff --git a/drivers/net/tokenring/smctr.h b/drivers/net/tokenring/smctr.h
index b306c7e4c793..88dfa2e01d6e 100644
--- a/drivers/net/tokenring/smctr.h
+++ b/drivers/net/tokenring/smctr.h
@@ -1042,7 +1042,7 @@ typedef struct net_local {
         __u16            functional_address[2];
         __u16            bitwise_group_address[2];
 
-        __u8            *ptr_ucode;
+        const __u8       *ptr_ucode;
 
         __u8            cleanup;
 
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index d7fb3ffe06ac..2d0cfbceee22 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1362,7 +1362,6 @@ static int de_open (struct net_device *dev)
 {
         struct de_private *de = dev->priv;
         int rc;
-        unsigned long flags;
 
         if (netif_msg_ifup(de))
                 printk(KERN_DEBUG "%s: enabling interface\n", dev->name);
@@ -1376,18 +1375,20 @@ static int de_open (struct net_device *dev)
                 return rc;
         }
 
-        rc = de_init_hw(de);
-        if (rc) {
-                printk(KERN_ERR "%s: h/w init failure, err=%d\n",
-                       dev->name, rc);
-                goto err_out_free;
-        }
+        dw32(IntrMask, 0);
 
         rc = request_irq(dev->irq, de_interrupt, SA_SHIRQ, dev->name, dev);
         if (rc) {
                 printk(KERN_ERR "%s: IRQ %d request failure, err=%d\n",
                        dev->name, dev->irq, rc);
-                goto err_out_hw;
+                goto err_out_free;
+        }
+
+        rc = de_init_hw(de);
+        if (rc) {
+                printk(KERN_ERR "%s: h/w init failure, err=%d\n",
+                       dev->name, rc);
+                goto err_out_free_irq;
         }
 
         netif_start_queue(dev);
@@ -1395,11 +1396,8 @@ static int de_open (struct net_device *dev)
 
         return 0;
 
-err_out_hw:
-        spin_lock_irqsave(&de->lock, flags);
-        de_stop_hw(de);
-        spin_unlock_irqrestore(&de->lock, flags);
-
+err_out_free_irq:
+        free_irq(dev->irq, dev);
 err_out_free:
         de_free_rings(de);
         return rc;
@@ -1455,6 +1453,8 @@ static void de_tx_timeout (struct net_device *dev)
         synchronize_irq(dev->irq);
         de_clean_rings(de);
 
+        de_init_rings(de);
+
         de_init_hw(de);
         
         netif_wake_queue(dev);
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 983981666800..238e9c72cb3a 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -214,7 +214,7 @@ static u32 uli526x_cr6_user_set;
 /* For module input parameter */
 static int debug;
 static u32 cr6set;
-static unsigned char mode = 8;
+static int mode = 8;
 
 /* function declaration ------------------------------------- */
 static int uli526x_open(struct net_device *);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 50b8c6754b1e..a1ed2d983740 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -249,8 +249,11 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv,
 
         if (align)
                 skb_reserve(skb, align);
-        if (memcpy_fromiovec(skb_put(skb, len), iv, len))
+        if (memcpy_fromiovec(skb_put(skb, len), iv, len)) {
+                tun->stats.rx_dropped++;
+                kfree_skb(skb);
                 return -EFAULT;
+        }
 
         skb->dev = tun->dev;
         switch (tun->flags & TUN_TYPE_MASK) {
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index c2d5907dc8e0..ed1f837c8fda 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1106,6 +1106,9 @@ static void velocity_free_rd_ring(struct velocity_info *vptr)
 
         for (i = 0; i < vptr->options.numrx; i++) {
                 struct velocity_rd_info *rd_info = &(vptr->rd_info[i]);
+                struct rx_desc *rd = vptr->rd_ring + i;
+
+                memset(rd, 0, sizeof(*rd));
 
                 if (!rd_info->skb)
                         continue;
diff --git a/drivers/net/wan/dscc4.c b/drivers/net/wan/dscc4.c
index 2f61a47b4716..1ff5de076d21 100644
--- a/drivers/net/wan/dscc4.c
+++ b/drivers/net/wan/dscc4.c
@@ -1943,7 +1943,7 @@ static int dscc4_init_ring(struct net_device *dev)
                                         (++i%TX_RING_SIZE)*sizeof(*tx_fd));
         } while (i < TX_RING_SIZE);
 
-        if (dscc4_init_dummy_skb(dpriv) < 0)
+        if (!dscc4_init_dummy_skb(dpriv))
                 goto err_free_dma_tx;
 
         memset(dpriv->rx_skbuff, 0, sizeof(struct sk_buff *)*RX_RING_SIZE);
diff --git a/drivers/net/wan/pci200syn.c b/drivers/net/wan/pci200syn.c
index 8dea07b47999..eba8e5cfacc2 100644
--- a/drivers/net/wan/pci200syn.c
+++ b/drivers/net/wan/pci200syn.c
@@ -29,7 +29,7 @@
 #include <linux/netdevice.h>
 #include <linux/hdlc.h>
 #include <linux/pci.h>
-#include <asm/delay.h>
+#include <linux/delay.h>
 #include <asm/io.h>
 
 #include "hd64572.h"
diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
index 9c1e10602f2b..9d3b51c3ef54 100644
--- a/drivers/net/wan/wanxl.c
+++ b/drivers/net/wan/wanxl.c
@@ -27,8 +27,8 @@
 #include <linux/hdlc.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
+#include <linux/delay.h>
 #include <asm/io.h>
-#include <asm/delay.h>
 
 #include "wanxl.h"
 
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 233a4f608084..ef85d76575a2 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -148,7 +148,7 @@ config IPW2100
           In order to use this driver, you will need a firmware image for it.
           You can obtain the firmware from
           <http://ipw2100.sf.net/>.  Once you have the firmware image, you 
-          will need to place it in /etc/firmware.
+          will need to place it in /lib/firmware.
 
           You will also very likely need the Wireless Tools in order to
           configure your card:
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 98a76f10a0f7..dfc24016ba81 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1872,7 +1872,7 @@ static int atmel_set_encodeext(struct net_device *dev,
         struct atmel_private *priv = netdev_priv(dev);
         struct iw_point *encoding = &wrqu->encoding;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int idx, key_len;
+        int idx, key_len, alg = ext->alg, set_key = 1;
 
         /* Determine and validate the key index */
         idx = encoding->flags & IW_ENCODE_INDEX;
@@ -1883,39 +1883,42 @@ static int atmel_set_encodeext(struct net_device *dev,
         } else
                 idx = priv->default_key;
 
-        if ((encoding->flags & IW_ENCODE_DISABLED) ||
-            ext->alg == IW_ENCODE_ALG_NONE) {
-                priv->wep_is_on = 0;
-                priv->encryption_level = 0;
-                priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
-        }
+        if (encoding->flags & IW_ENCODE_DISABLED)
+            alg = IW_ENCODE_ALG_NONE;
 
-        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
+        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
                 priv->default_key = idx;
+                set_key = ext->key_len > 0 ? 1 : 0;
+        }
 
-        /* Set the requested key */
-        switch (ext->alg) {
-        case IW_ENCODE_ALG_NONE:
-                break;
-        case IW_ENCODE_ALG_WEP:
-                if (ext->key_len > 5) {
-                        priv->wep_key_len[idx] = 13;
-                        priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
-                        priv->encryption_level = 2;
-                } else if (ext->key_len > 0) {
-                        priv->wep_key_len[idx] = 5;
-                        priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
-                        priv->encryption_level = 1;
-                } else {
+        if (set_key) {
+                /* Set the requested key first */
+                switch (alg) {
+                case IW_ENCODE_ALG_NONE:
+                        priv->wep_is_on = 0;
+                        priv->encryption_level = 0;
+                        priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
+                        break;
+                case IW_ENCODE_ALG_WEP:
+                        if (ext->key_len > 5) {
+                                priv->wep_key_len[idx] = 13;
+                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
+                                priv->encryption_level = 2;
+                        } else if (ext->key_len > 0) {
+                                priv->wep_key_len[idx] = 5;
+                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
+                                priv->encryption_level = 1;
+                        } else {
+                                return -EINVAL;
+                        }
+                        priv->wep_is_on = 1;
+                        memset(priv->wep_keys[idx], 0, 13);
+                        key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
+                        memcpy(priv->wep_keys[idx], ext->key, key_len);
+                        break;
+                default:
                         return -EINVAL;
                 }
-                priv->wep_is_on = 1;
-                memset(priv->wep_keys[idx], 0, 13);
-                key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
-                memcpy(priv->wep_keys[idx], ext->key, key_len);
-                break;
-        default:
-                return -EINVAL;
         }
 
         return -EINPROGRESS;
@@ -3061,17 +3064,26 @@ static void authenticate(struct atmel_private *priv, u16 frame_len)
         }
 
         if (status == C80211_MGMT_SC_Success && priv->wep_is_on) {
+                int should_associate = 0;
                 /* WEP */
                 if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
                         return;
 
-                if (trans_seq_no == 0x0002 &&
-                    auth->el_id == C80211_MGMT_ElementID_ChallengeText) {
-                        send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
-                        return;
+                if (system == C80211_MGMT_AAN_OPENSYSTEM) {
+                        if (trans_seq_no == 0x0002) {
+                                should_associate = 1;
+                        }
+                } else if (system == C80211_MGMT_AAN_SHAREDKEY) {
+                        if (trans_seq_no == 0x0002 &&
+                            auth->el_id == C80211_MGMT_ElementID_ChallengeText) {
+                                send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
+                                return;
+                        } else if (trans_seq_no == 0x0004) {
+                                should_associate = 1;
+                        }
                 }
 
-                if (trans_seq_no == 0x0004) {
+                if (should_associate) {
                         if(priv->station_was_associated) {
                                 atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
                                 send_association_request(priv, 1);
@@ -3084,11 +3096,13 @@ static void authenticate(struct atmel_private *priv, u16 frame_len)
                 }
         }
 
-        if (status == C80211_MGMT_SC_AuthAlgNotSupported) {
+        if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
                 /* Do opensystem first, then try sharedkey */
-                if (system ==  C80211_MGMT_AAN_OPENSYSTEM) {
+                if (system == WLAN_AUTH_OPEN) {
                         priv->CurrentAuthentTransactionSeqNum = 0x001;
-                        send_authentication_request(priv, C80211_MGMT_AAN_SHAREDKEY, NULL, 0);
+                        priv->exclude_unencrypted = 1;
+                        send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
+                        return;
                 } else if (priv->connect_to_any_BSS) {
                         int bss_index;
 
@@ -3439,10 +3453,13 @@ static void atmel_management_timer(u_long a)
                         priv->AuthenticationRequestRetryCnt = 0;
                         restart_search(priv);
                 } else {
+                        int auth = C80211_MGMT_AAN_OPENSYSTEM;
                         priv->AuthenticationRequestRetryCnt++;
                         priv->CurrentAuthentTransactionSeqNum = 0x0001;
                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
-                        send_authentication_request(priv, C80211_MGMT_AAN_OPENSYSTEM, NULL, 0);
+                        if (priv->wep_is_on && priv->exclude_unencrypted)
+                                auth = C80211_MGMT_AAN_SHAREDKEY;
+                        send_authentication_request(priv, auth, NULL, 0);
           }
           break;
 
@@ -3541,12 +3558,15 @@ static void atmel_command_irq(struct atmel_private *priv)
                                 priv->station_was_associated = priv->station_is_associated;
                                 atmel_enter_state(priv, STATION_STATE_READY);
                         } else {
+                                int auth = C80211_MGMT_AAN_OPENSYSTEM;
                                 priv->AuthenticationRequestRetryCnt = 0;
                                 atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
 
                                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
                                 priv->CurrentAuthentTransactionSeqNum = 0x0001;
-                                send_authentication_request(priv, C80211_MGMT_AAN_SHAREDKEY, NULL, 0);
+                                if (priv->wep_is_on && priv->exclude_unencrypted)
+                                        auth = C80211_MGMT_AAN_SHAREDKEY;
+                                send_authentication_request(priv, auth, NULL, 0);
                         }
                         return;
                 }
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index 8bc0b528548f..f8f4503475f9 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -877,7 +877,6 @@ static struct pcmcia_device_id hostap_cs_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0x0101, 0x0777),
         PCMCIA_DEVICE_MANF_CARD(0x0126, 0x8000),
         PCMCIA_DEVICE_MANF_CARD(0x0138, 0x0002),
-        PCMCIA_DEVICE_MANF_CARD(0x0156, 0x0002),
         PCMCIA_DEVICE_MANF_CARD(0x0250, 0x0002),
         PCMCIA_DEVICE_MANF_CARD(0x026f, 0x030b),
         PCMCIA_DEVICE_MANF_CARD(0x0274, 0x1612),
@@ -891,6 +890,10 @@ static struct pcmcia_device_id hostap_cs_ids[] = {
         PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0002),
         PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0005),
         PCMCIA_DEVICE_MANF_CARD(0xd601, 0x0010),
+        PCMCIA_DEVICE_MANF_CARD_PROD_ID1(0x0156, 0x0002, "INTERSIL",
+                                         0x74c5e40d),
+        PCMCIA_DEVICE_MANF_CARD_PROD_ID1(0x0156, 0x0002, "Intersil",
+                                         0x4b801a17),
         PCMCIA_MFC_DEVICE_PROD_ID12(0, "SanDisk", "ConnectPlus",
                                     0x7a954bd9, 0x74be00c6),
         PCMCIA_DEVICE_PROD_ID1234(
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 14beab4bc91c..287676ad80df 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -4616,9 +4616,9 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                 }
 
         default:
-                IPW_ERROR("Unknown notification: "
-                          "subtype=%d,flags=0x%2x,size=%d\n",
-                          notif->subtype, notif->flags, notif->size);
+                IPW_DEBUG_NOTIF("Unknown notification: "
+                                "subtype=%d,flags=0x%2x,size=%d\n",
+                                notif->subtype, notif->flags, notif->size);
         }
 }
 
diff --git a/drivers/net/wireless/orinoco_cs.c b/drivers/net/wireless/orinoco_cs.c
index 3c128b692bce..ec6f2a48895b 100644
--- a/drivers/net/wireless/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco_cs.c
@@ -590,6 +590,7 @@ static struct pcmcia_device_id orinoco_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PC CARD HARMONY 80211B", 0xc6536a5e, 0x090c3cd9),
         PCMCIA_DEVICE_PROD_ID12("PROXIM", "LAN PCI CARD HARMONY 80211B", 0xc6536a5e, 0x9f494e26),
         PCMCIA_DEVICE_PROD_ID12("SAMSUNG", "11Mbps WLAN Card", 0x43d74cb4, 0x579bd91b),
+        PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2532W-B EliteConnect Wireless Adapter", 0xc4f8b18b, 0x196bd757),
         PCMCIA_DEVICE_PROD_ID12("SMC", "SMC2632W", 0xc4f8b18b, 0x474a1f2a),
         PCMCIA_DEVICE_PROD_ID12("Symbol Technologies", "LA4111 Spectrum24 Wireless LAN PC Card", 0x3f02b4d6, 0x3663cb0e),
         PCMCIA_DEVICE_PROD_ID123("The Linksys Group, Inc.", "Instant Wireless Network PC Card", "ISL37300P", 0xa5f472c2, 0x590eb502, 0xc9049a39),
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index c5cd61c7f927..e5bb9f5ae429 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -748,7 +748,7 @@ prism54_get_essid(struct net_device *ndev, struct iw_request_info *info,
         if (essid->length) {
                 dwrq->flags = 1;        /* set ESSID to ON for Wireless Extensions */
                 /* if it is to big, trunk it */
-                dwrq->length = min(IW_ESSID_MAX_SIZE, essid->length);
+                dwrq->length = min((u8)IW_ESSID_MAX_SIZE, essid->length);
         } else {
                 dwrq->flags = 0;
                 dwrq->length = 0;
diff --git a/drivers/net/wireless/wavelan_cs.c b/drivers/net/wireless/wavelan_cs.c
index cf373625fc70..98122f3a4bc2 100644
--- a/drivers/net/wireless/wavelan_cs.c
+++ b/drivers/net/wireless/wavelan_cs.c
@@ -950,16 +950,8 @@ wv_82593_cmd(struct net_device *	dev,
 static inline int
 wv_diag(struct net_device *     dev)
 {
-  int           ret = FALSE;
-
-  if(wv_82593_cmd(dev, "wv_diag(): diagnose",
-                  OP0_DIAGNOSE, SR0_DIAGNOSE_PASSED))
-    ret = TRUE;
-
-#ifdef DEBUG_CONFIG_ERRORS
-  printk(KERN_INFO "wavelan_cs: i82593 Self Test failed!\n");
-#endif
-  return(ret);
+  return(wv_82593_cmd(dev, "wv_diag(): diagnose",
+                      OP0_DIAGNOSE, SR0_DIAGNOSE_PASSED));
 } /* wv_diag */
 
 /*------------------------------------------------------------------*/
@@ -3604,8 +3596,8 @@ wv_82593_config(struct net_device *	dev)
   cfblk.lin_prio = 0;           /* conform to 802.3 backoff algoritm */
   cfblk.exp_prio = 5;           /* conform to 802.3 backoff algoritm */
   cfblk.bof_met = 1;            /* conform to 802.3 backoff algoritm */
-  cfblk.ifrm_spc = 0x20;        /* 32 bit times interframe spacing */
-  cfblk.slottim_low = 0x20;     /* 32 bit times slot time */
+  cfblk.ifrm_spc = 0x20 >> 4;   /* 32 bit times interframe spacing */
+  cfblk.slottim_low = 0x20 >> 5;        /* 32 bit times slot time */
   cfblk.slottim_hi = 0x0;
   cfblk.max_retr = 15;
   cfblk.prmisc = ((lp->promiscuous) ? TRUE: FALSE);     /* Promiscuous mode */
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index 9e0229f7e25f..93f8a8fa8890 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -40,6 +40,8 @@
 #include <linux/string.h>
 #include <linux/pci.h>
 #include <linux/reboot.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 
 #include <asm/byteorder.h>
 #include <asm/cache.h>          /* for L1_CACHE_BYTES */
@@ -1019,62 +1021,33 @@ static struct hppa_dma_ops ccio_ops = {
 };
 
 #ifdef CONFIG_PROC_FS
-static int proc_append(char *src, int len, char **dst, off_t *offset, int *max)
-{
-        if (len < *offset) {
-                *offset -= len;
-                return 0;
-        }
-        if (*offset > 0) {
-                src += *offset;
-                len -= *offset;
-                *offset = 0;
-        }
-        if (len > *max) {
-                len = *max;
-        }
-        memcpy(*dst, src, len);
-        *dst += len;
-        *max -= len;
-        return (*max == 0);
-}
-
-static int ccio_proc_info(char *buf, char **start, off_t offset, int count,
-                          int *eof, void *data)
+static int ccio_proc_info(struct seq_file *m, void *p)
 {
-        int max = count;
-        char tmp[80]; /* width of an ANSI-standard terminal */
+        int len = 0;
         struct ioc *ioc = ioc_list;
 
         while (ioc != NULL) {
                 unsigned int total_pages = ioc->res_size << 3;
                 unsigned long avg = 0, min, max;
-                int j, len;
+                int j;
 
-                len = sprintf(tmp, "%s\n", ioc->name);
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "%s\n", ioc->name);
                 
-                len = sprintf(tmp, "Cujo 2.0 bug    : %s\n",
-                              (ioc->cujo20_bug ? "yes" : "no"));
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "Cujo 2.0 bug    : %s\n",
+                                  (ioc->cujo20_bug ? "yes" : "no"));
                 
-                len = sprintf(tmp, "IO PDIR size    : %d bytes (%d entries)\n",
-                              total_pages * 8, total_pages);
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "IO PDIR size    : %d bytes (%d entries)\n",
+                               total_pages * 8, total_pages);
+
 #ifdef CCIO_MAP_STATS
-                len = sprintf(tmp, "IO PDIR entries : %ld free  %ld used (%d%%)\n",
-                              total_pages - ioc->used_pages, ioc->used_pages,
-                              (int)(ioc->used_pages * 100 / total_pages));
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "IO PDIR entries : %ld free  %ld used (%d%%)\n",
+                                  total_pages - ioc->used_pages, ioc->used_pages,
+                                  (int)(ioc->used_pages * 100 / total_pages));
 #endif
-                len = sprintf(tmp, "Resource bitmap : %d bytes (%d pages)\n", 
-                        ioc->res_size, total_pages);
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+
+                len += seq_printf(m, "Resource bitmap : %d bytes (%d pages)\n", 
+                                  ioc->res_size, total_pages);
+
 #ifdef CCIO_SEARCH_TIME
                 min = max = ioc->avg_search[0];
                 for(j = 0; j < CCIO_SEARCH_SAMPLE; ++j) {
@@ -1085,70 +1058,83 @@ static int ccio_proc_info(char *buf, char **start, off_t offset, int count,
                                 min = ioc->avg_search[j];
                 }
                 avg /= CCIO_SEARCH_SAMPLE;
-                len = sprintf(tmp, "  Bitmap search : %ld/%ld/%ld (min/avg/max CPU Cycles)\n",
-                              min, avg, max);
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "  Bitmap search : %ld/%ld/%ld (min/avg/max CPU Cycles)\n",
+                                  min, avg, max);
 #endif
 #ifdef CCIO_MAP_STATS
-                len = sprintf(tmp, "pci_map_single(): %8ld calls  %8ld pages (avg %d/1000)\n",
-                              ioc->msingle_calls, ioc->msingle_pages,
-                              (int)((ioc->msingle_pages * 1000)/ioc->msingle_calls));
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
-                
+                len += seq_printf(m, "pci_map_single(): %8ld calls  %8ld pages (avg %d/1000)\n",
+                                  ioc->msingle_calls, ioc->msingle_pages,
+                                  (int)((ioc->msingle_pages * 1000)/ioc->msingle_calls));
 
                 /* KLUGE - unmap_sg calls unmap_single for each mapped page */
                 min = ioc->usingle_calls - ioc->usg_calls;
                 max = ioc->usingle_pages - ioc->usg_pages;
-                len = sprintf(tmp, "pci_unmap_single: %8ld calls  %8ld pages (avg %d/1000)\n",
-                              min, max, (int)((max * 1000)/min));
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "pci_unmap_single: %8ld calls  %8ld pages (avg %d/1000)\n",
+                                  min, max, (int)((max * 1000)/min));
  
-                len = sprintf(tmp, "pci_map_sg()    : %8ld calls  %8ld pages (avg %d/1000)\n",
-                              ioc->msg_calls, ioc->msg_pages,
-                              (int)((ioc->msg_pages * 1000)/ioc->msg_calls));
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
-                len = sprintf(tmp, "pci_unmap_sg()  : %8ld calls  %8ld pages (avg %d/1000)\n\n\n",
-                              ioc->usg_calls, ioc->usg_pages,
-                              (int)((ioc->usg_pages * 1000)/ioc->usg_calls));
-                if (proc_append(tmp, len, &buf, &offset, &count))
-                        break;
+                len += seq_printf(m, "pci_map_sg()    : %8ld calls  %8ld pages (avg %d/1000)\n",
+                                  ioc->msg_calls, ioc->msg_pages,
+                                  (int)((ioc->msg_pages * 1000)/ioc->msg_calls));
+
+                len += seq_printf(m, "pci_unmap_sg()  : %8ld calls  %8ld pages (avg %d/1000)\n\n\n",
+                                  ioc->usg_calls, ioc->usg_pages,
+                                  (int)((ioc->usg_pages * 1000)/ioc->usg_calls));
 #endif  /* CCIO_MAP_STATS */
+
                 ioc = ioc->next;
         }
 
-        if (count == 0) {
-                *eof = 1;
-        }
-        return (max - count);
+        return 0;
+}
+
+static int ccio_proc_info_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, &ccio_proc_info, NULL);
 }
 
-static int ccio_resource_map(char *buf, char **start, off_t offset, int len,
-                             int *eof, void *data)
+static struct file_operations ccio_proc_info_fops = {
+        .owner = THIS_MODULE,
+        .open = ccio_proc_info_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+
+static int ccio_proc_bitmap_info(struct seq_file *m, void *p)
 {
+        int len = 0;
         struct ioc *ioc = ioc_list;
 
-        buf[0] = '\0';
         while (ioc != NULL) {
                 u32 *res_ptr = (u32 *)ioc->res_map;
                 int j;
 
                 for (j = 0; j < (ioc->res_size / sizeof(u32)); j++) {
                         if ((j & 7) == 0)
-                                strcat(buf,"\n   ");
-                        sprintf(buf, "%s %08x", buf, *res_ptr);
+                                len += seq_puts(m, "\n   ");
+                        len += seq_printf(m, "%08x", *res_ptr);
                         res_ptr++;
                 }
-                strcat(buf, "\n\n");
+                len += seq_puts(m, "\n\n");
                 ioc = ioc->next;
                 break; /* XXX - remove me */
         }
 
-        return strlen(buf);
+        return 0;
 }
+
+static int ccio_proc_bitmap_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, &ccio_proc_bitmap_info, NULL);
+}
+
+static struct file_operations ccio_proc_bitmap_fops = {
+        .owner = THIS_MODULE,
+        .open = ccio_proc_bitmap_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
 #endif
 
 /**
@@ -1423,7 +1409,7 @@ static void __init ccio_init_resources(struct ioc *ioc)
         struct resource *res = ioc->mmio_region;
         char *name = kmalloc(14, GFP_KERNEL);
 
-        sprintf(name, "GSC Bus [%d/]", ioc->hw_path);
+        snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path);
 
         ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low);
         ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv);
@@ -1556,13 +1542,13 @@ static int ccio_probe(struct parisc_device *dev)
 {
         int i;
         struct ioc *ioc, **ioc_p = &ioc_list;
+        struct proc_dir_entry *info_entry, *bitmap_entry;
         
-        ioc = kmalloc(sizeof(struct ioc), GFP_KERNEL);
+        ioc = kzalloc(sizeof(struct ioc), GFP_KERNEL);
         if (ioc == NULL) {
                 printk(KERN_ERR MODULE_NAME ": memory allocation failure\n");
                 return 1;
         }
-        memset(ioc, 0, sizeof(struct ioc));
 
         ioc->name = dev->id.hversion == U2_IOA_RUNWAY ? "U2" : "UTurn";
 
@@ -1578,19 +1564,20 @@ static int ccio_probe(struct parisc_device *dev)
         ccio_ioc_init(ioc);
         ccio_init_resources(ioc);
         hppa_dma_ops = &ccio_ops;
-        dev->dev.platform_data = kmalloc(sizeof(struct pci_hba_data), GFP_KERNEL);
+        dev->dev.platform_data = kzalloc(sizeof(struct pci_hba_data), GFP_KERNEL);
 
         /* if this fails, no I/O cards will work, so may as well bug */
         BUG_ON(dev->dev.platform_data == NULL);
         HBA_DATA(dev->dev.platform_data)->iommu = ioc;
         
-
         if (ioc_count == 0) {
-                /* FIXME: Create separate entries for each ioc */
-                create_proc_read_entry(MODULE_NAME, S_IRWXU, proc_runway_root,
-                                       ccio_proc_info, NULL);
-                create_proc_read_entry(MODULE_NAME"-bitmap", S_IRWXU,
-                                       proc_runway_root, ccio_resource_map, NULL);
+                info_entry = create_proc_entry(MODULE_NAME, 0, proc_runway_root);
+                if (info_entry)
+                        info_entry->proc_fops = &ccio_proc_info_fops;
+
+                bitmap_entry = create_proc_entry(MODULE_NAME"-bitmap", 0, proc_runway_root);
+                if (bitmap_entry)
+                        bitmap_entry->proc_fops = &ccio_proc_bitmap_fops;
         }
 
         ioc_count++;
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 216d1d859326..3d1a7f98c676 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -989,14 +989,12 @@ static int __init dino_probe(struct parisc_device *dev)
 */
         }
 
-        dino_dev = kmalloc(sizeof(struct dino_device), GFP_KERNEL);
+        dino_dev = kzalloc(sizeof(struct dino_device), GFP_KERNEL);
         if (!dino_dev) {
                 printk("dino_init_chip - couldn't alloc dino_device\n");
                 return 1;
         }
 
-        memset(dino_dev, 0, sizeof(struct dino_device));
-
         dino_dev->hba.dev = dev;
         dino_dev->hba.base_addr = ioremap(hpa, 4096);
         dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
diff --git a/drivers/parisc/hppb.c b/drivers/parisc/hppb.c
index 5edf93f80757..07dc2b6d4e93 100644
--- a/drivers/parisc/hppb.c
+++ b/drivers/parisc/hppb.c
@@ -60,12 +60,11 @@ static int hppb_probe(struct parisc_device *dev)
         }
 
         if(card->hpa) {
-                card->next = kmalloc(sizeof(struct hppb_card), GFP_KERNEL);
+                card->next = kzalloc(sizeof(struct hppb_card), GFP_KERNEL);
                 if(!card->next) {
                         printk(KERN_ERR "HP-PB: Unable to allocate memory.\n");
                         return 1;
                 }
-                memset(card->next, '\0', sizeof(struct hppb_card));
                 card = card->next;
         }
         printk(KERN_INFO "Found GeckoBoa at 0x%lx\n", dev->hpa.start);
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 19657efa8dc3..8d7a36392eb8 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -873,28 +873,24 @@ void *iosapic_register(unsigned long hpa)
                 return NULL;
         }
 
-        isi = (struct iosapic_info *)kmalloc(sizeof(struct iosapic_info), GFP_KERNEL);
+        isi = (struct iosapic_info *)kzalloc(sizeof(struct iosapic_info), GFP_KERNEL);
         if (!isi) {
                 BUG();
                 return NULL;
         }
 
-        memset(isi, 0, sizeof(struct iosapic_info));
-
         isi->addr = ioremap(hpa, 4096);
         isi->isi_hpa = hpa;
         isi->isi_version = iosapic_rd_version(isi);
         isi->isi_num_vectors = IOSAPIC_IRDT_MAX_ENTRY(isi->isi_version) + 1;
 
         vip = isi->isi_vector = (struct vector_info *)
-                kmalloc(sizeof(struct vector_info) * isi->isi_num_vectors, GFP_KERNEL);
+                kzalloc(sizeof(struct vector_info) * isi->isi_num_vectors, GFP_KERNEL);
         if (vip == NULL) {
                 kfree(isi);
                 return NULL;
         }
 
-        memset(vip, 0, sizeof(struct vector_info) * isi->isi_num_vectors);
-
         for (cnt=0; cnt < isi->isi_num_vectors; cnt++, vip++) {
                 vip->irqline = (unsigned char) cnt;
                 vip->iosapic = isi;
diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c
index 2b3ba1dcf332..cb3d28176129 100644
--- a/drivers/parisc/lasi.c
+++ b/drivers/parisc/lasi.c
@@ -166,11 +166,12 @@ static void lasi_power_off(void)
 int __init
 lasi_init_chip(struct parisc_device *dev)
 {
+        extern void (*chassis_power_off)(void);
         struct gsc_asic *lasi;
         struct gsc_irq gsc_irq;
         int ret;
 
-        lasi = kmalloc(sizeof(*lasi), GFP_KERNEL);
+        lasi = kzalloc(sizeof(*lasi), GFP_KERNEL);
         if (!lasi)
                 return -ENOMEM;
 
@@ -222,7 +223,7 @@ lasi_init_chip(struct parisc_device *dev)
          * ensure that only the first LASI (the one controlling the power off)
          * should set the HPA here */
         lasi_power_off_hpa = lasi->hpa;
-        pm_power_off = lasi_power_off;
+        chassis_power_off = lasi_power_off;
         
         return ret;
 }
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index cbae8c8963fa..e8a2a4a852f5 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -1565,7 +1565,7 @@ lba_driver_probe(struct parisc_device *dev)
         } else if (IS_MERCURY(dev) || IS_QUICKSILVER(dev)) {
                 func_class &= 0xff;
                 version = kmalloc(6, GFP_KERNEL);
-                sprintf(version,"TR%d.%d",(func_class >> 4),(func_class & 0xf));
+                snprintf(version, 6, "TR%d.%d",(func_class >> 4),(func_class & 0xf));
                 /* We could use one printk for both Elroy and Mercury,
                  * but for the mask for func_class.
                  */ 
@@ -1586,14 +1586,12 @@ lba_driver_probe(struct parisc_device *dev)
         **      have an IRT entry will get NULL back from iosapic code.
         */
         
-        lba_dev = kmalloc(sizeof(struct lba_device), GFP_KERNEL);
+        lba_dev = kzalloc(sizeof(struct lba_device), GFP_KERNEL);
         if (!lba_dev) {
                 printk(KERN_ERR "lba_init_chip - couldn't alloc lba_device\n");
                 return(1);
         }
 
-        memset(lba_dev, 0, sizeof(struct lba_device));
-
 
         /* ---------- First : initialize data we already have --------- */
 
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 42a3c54e8e6c..a28e17898fbd 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -1,7 +1,7 @@
 /* 
  *    Interfaces to retrieve and set PDC Stable options (firmware)
  *
- *    Copyright (C) 2005 Thibaut VARENE <varenet@parisc-linux.org>
+ *    Copyright (C) 2005-2006 Thibaut VARENE <varenet@parisc-linux.org>
  *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
@@ -26,11 +26,19 @@
  *
  *    Since locations between 96 and 192 are the various paths, most (if not
  *    all) PA-RISC machines should have them. Anyway, for safety reasons, the
- *    following code can deal with only 96 bytes of Stable Storage, and all
+ *    following code can deal with just 96 bytes of Stable Storage, and all
  *    sizes between 96 and 192 bytes (provided they are multiple of struct
  *    device_path size, eg: 128, 160 and 192) to provide full information.
  *    The code makes no use of data above 192 bytes. One last word: there's one
  *    path we can always count on: the primary path.
+ *
+ *    The current policy wrt file permissions is:
+ *      - write: root only
+ *      - read: (reading triggers PDC calls) ? root only : everyone
+ *    The rationale is that PDC calls could hog (DoS) the machine.
+ *
+ *      TODO:
+ *      - timer/fastsize write calls
  */
 
 #undef PDCS_DEBUG
@@ -50,13 +58,15 @@
 #include <linux/kobject.h>
 #include <linux/device.h>
 #include <linux/errno.h>
+#include <linux/spinlock.h>
 
 #include <asm/pdc.h>
 #include <asm/page.h>
 #include <asm/uaccess.h>
 #include <asm/hardware.h>
 
-#define PDCS_VERSION    "0.10"
+#define PDCS_VERSION    "0.22"
+#define PDCS_PREFIX     "PDC Stable Storage"
 
 #define PDCS_ADDR_PPRI  0x00
 #define PDCS_ADDR_OSID  0x40
@@ -70,10 +80,12 @@ MODULE_DESCRIPTION("sysfs interface to HP PDC Stable Storage data");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(PDCS_VERSION);
 
+/* holds Stable Storage size. Initialized once and for all, no lock needed */
 static unsigned long pdcs_size __read_mostly;
 
 /* This struct defines what we need to deal with a parisc pdc path entry */
 struct pdcspath_entry {
+        rwlock_t rw_lock;               /* to protect path entry access */
         short ready;                    /* entry record is valid if != 0 */
         unsigned long addr;             /* entry address in stable storage */
         char *name;                     /* entry name */
@@ -121,6 +133,8 @@ struct pdcspath_attribute paths_attr_##_name = { \
  * content of the stable storage WRT various paths in these structs. We read
  * these structs when reading the files, and we will write to these structs when
  * writing to the files, and only then write them back to the Stable Storage.
+ *
+ * This function expects to be called with @entry->rw_lock write-hold.
  */
 static int
 pdcspath_fetch(struct pdcspath_entry *entry)
@@ -160,14 +174,15 @@ pdcspath_fetch(struct pdcspath_entry *entry)
  * pointer, from which it'll find out the corresponding hardware path.
  * For now we do not handle the case where there's an error in writing to the
  * Stable Storage area, so you'd better not mess up the data :P
+ *
+ * This function expects to be called with @entry->rw_lock write-hold.
  */
-static int
+static void
 pdcspath_store(struct pdcspath_entry *entry)
 {
         struct device_path *devpath;
 
-        if (!entry)
-                return -EINVAL;
+        BUG_ON(!entry);
 
         devpath = &entry->devpath;
         
@@ -176,10 +191,8 @@ pdcspath_store(struct pdcspath_entry *entry)
            First case, we don't have a preset hwpath... */
         if (!entry->ready) {
                 /* ...but we have a device, map it */
-                if (entry->dev)
-                        device_to_hwpath(entry->dev, (struct hardware_path *)devpath);
-                else
-                        return -EINVAL;
+                BUG_ON(!entry->dev);
+                device_to_hwpath(entry->dev, (struct hardware_path *)devpath);
         }
         /* else, we expect the provided hwpath to be valid. */
         
@@ -191,15 +204,13 @@ pdcspath_store(struct pdcspath_entry *entry)
                 printk(KERN_ERR "%s: an error occured when writing to PDC.\n"
                                 "It is likely that the Stable Storage data has been corrupted.\n"
                                 "Please check it carefully upon next reboot.\n", __func__);
-                return -EIO;
+                WARN_ON(1);
         }
                 
         /* kobject is already registered */
         entry->ready = 2;
         
         DPRINTK("%s: device: 0x%p\n", __func__, entry->dev);
-        
-        return 0;
 }
 
 /**
@@ -214,14 +225,17 @@ pdcspath_hwpath_read(struct pdcspath_entry *entry, char *buf)
 {
         char *out = buf;
         struct device_path *devpath;
-        unsigned short i;
+        short i;
 
         if (!entry || !buf)
                 return -EINVAL;
 
+        read_lock(&entry->rw_lock);
         devpath = &entry->devpath;
+        i = entry->ready;
+        read_unlock(&entry->rw_lock);
 
-        if (!entry->ready)
+        if (!i) /* entry is not ready */
                 return -ENODATA;
         
         for (i = 0; i < 6; i++) {
@@ -242,7 +256,7 @@ pdcspath_hwpath_read(struct pdcspath_entry *entry, char *buf)
  * 
  * We will call this function to change the current hardware path.
  * Hardware paths are to be given '/'-delimited, without brackets.
- * We take care to make sure that the provided path actually maps to an existing
+ * We make sure that the provided path actually maps to an existing
  * device, BUT nothing would prevent some foolish user to set the path to some
  * PCI bridge or even a CPU...
  * A better work around would be to make sure we are at the end of a device tree
@@ -298,17 +312,19 @@ pdcspath_hwpath_write(struct pdcspath_entry *entry, const char *buf, size_t coun
         }
         
         /* So far so good, let's get in deep */
+        write_lock(&entry->rw_lock);
         entry->ready = 0;
         entry->dev = dev;
         
         /* Now, dive in. Write back to the hardware */
-        WARN_ON(pdcspath_store(entry)); /* this warn should *NEVER* happen */
+        pdcspath_store(entry);
         
         /* Update the symlink to the real device */
         sysfs_remove_link(&entry->kobj, "device");
         sysfs_create_link(&entry->kobj, &entry->dev->kobj, "device");
+        write_unlock(&entry->rw_lock);
         
-        printk(KERN_INFO "PDC Stable Storage: changed \"%s\" path to \"%s\"\n",
+        printk(KERN_INFO PDCS_PREFIX ": changed \"%s\" path to \"%s\"\n",
                 entry->name, buf);
         
         return count;
@@ -326,14 +342,17 @@ pdcspath_layer_read(struct pdcspath_entry *entry, char *buf)
 {
         char *out = buf;
         struct device_path *devpath;
-        unsigned short i;
+        short i;
 
         if (!entry || !buf)
                 return -EINVAL;
         
+        read_lock(&entry->rw_lock);
         devpath = &entry->devpath;
+        i = entry->ready;
+        read_unlock(&entry->rw_lock);
 
-        if (!entry->ready)
+        if (!i) /* entry is not ready */
                 return -ENODATA;
         
         for (i = 0; devpath->layers[i] && (likely(i < 6)); i++)
@@ -388,15 +407,17 @@ pdcspath_layer_write(struct pdcspath_entry *entry, const char *buf, size_t count
         }
                 
         /* So far so good, let's get in deep */
+        write_lock(&entry->rw_lock);
         
         /* First, overwrite the current layers with the new ones, not touching
            the hardware path. */
         memcpy(&entry->devpath.layers, &layers, sizeof(layers));
         
         /* Now, dive in. Write back to the hardware */
-        WARN_ON(pdcspath_store(entry)); /* this warn should *NEVER* happen */
+        pdcspath_store(entry);
+        write_unlock(&entry->rw_lock);
         
-        printk(KERN_INFO "PDC Stable Storage: changed \"%s\" layers to \"%s\"\n",
+        printk(KERN_INFO PDCS_PREFIX ": changed \"%s\" layers to \"%s\"\n",
                 entry->name, buf);
         
         return count;
@@ -415,9 +436,6 @@ pdcspath_attr_show(struct kobject *kobj, struct attribute *attr, char *buf)
         struct pdcspath_attribute *pdcs_attr = to_pdcspath_attribute(attr);
         ssize_t ret = 0;
 
-        if (!capable(CAP_SYS_ADMIN))
-                return -EACCES;
-
         if (pdcs_attr->show)
                 ret = pdcs_attr->show(entry, buf);
 
@@ -454,8 +472,8 @@ static struct sysfs_ops pdcspath_attr_ops = {
 };
 
 /* These are the two attributes of any PDC path. */
-static PATHS_ATTR(hwpath, 0600, pdcspath_hwpath_read, pdcspath_hwpath_write);
-static PATHS_ATTR(layer, 0600, pdcspath_layer_read, pdcspath_layer_write);
+static PATHS_ATTR(hwpath, 0644, pdcspath_hwpath_read, pdcspath_hwpath_write);
+static PATHS_ATTR(layer, 0644, pdcspath_layer_read, pdcspath_layer_write);
 
 static struct attribute *paths_subsys_attrs[] = {
         &paths_attr_hwpath.attr,
@@ -484,36 +502,119 @@ static struct pdcspath_entry *pdcspath_entries[] = {
         NULL,
 };
 
+
+/* For more insight of what's going on here, refer to PDC Procedures doc,
+ * Section PDC_STABLE */
+
 /**
- * pdcs_info_read - Pretty printing of the remaining useful data.
+ * pdcs_size_read - Stable Storage size output.
  * @entry: An allocated and populated subsytem struct. We don't use it tho.
  * @buf: The output buffer to write to.
- * 
- * We will call this function to format the output of the 'info' attribute file.
- * Please refer to PDC Procedures documentation, section PDC_STABLE to get a
- * better insight of what we're doing here.
  */
 static ssize_t
-pdcs_info_read(struct subsystem *entry, char *buf)
+pdcs_size_read(struct subsystem *entry, char *buf)
 {
         char *out = buf;
-        __u32 result;
-        struct device_path devpath;
-        char *tmpstr = NULL;
         
         if (!entry || !buf)
                 return -EINVAL;
                 
         /* show the size of the stable storage */
-        out += sprintf(out, "Stable Storage size: %ld bytes\n", pdcs_size);
+        out += sprintf(out, "%ld\n", pdcs_size);
 
-        /* deal with flags */
-        if (pdc_stable_read(PDCS_ADDR_PPRI, &devpath, sizeof(devpath)) != PDC_OK)
-                return -EIO;
+        return out - buf;
+}
+
+/**
+ * pdcs_auto_read - Stable Storage autoboot/search flag output.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The output buffer to write to.
+ * @knob: The PF_AUTOBOOT or PF_AUTOSEARCH flag
+ */
+static ssize_t
+pdcs_auto_read(struct subsystem *entry, char *buf, int knob)
+{
+        char *out = buf;
+        struct pdcspath_entry *pathentry;
         
-        out += sprintf(out, "Autoboot: %s\n", (devpath.flags & PF_AUTOBOOT) ? "On" : "Off");
-        out += sprintf(out, "Autosearch: %s\n", (devpath.flags & PF_AUTOSEARCH) ? "On" : "Off");
-        out += sprintf(out, "Timer: %u s\n", (devpath.flags & PF_TIMER) ? (1 << (devpath.flags & PF_TIMER)) : 0);
+        if (!entry || !buf)
+                return -EINVAL;
+
+        /* Current flags are stored in primary boot path entry */
+        pathentry = &pdcspath_entry_primary;
+
+        read_lock(&pathentry->rw_lock);
+        out += sprintf(out, "%s\n", (pathentry->devpath.flags & knob) ?
+                                        "On" : "Off");
+        read_unlock(&pathentry->rw_lock);
+
+        return out - buf;
+}
+
+/**
+ * pdcs_autoboot_read - Stable Storage autoboot flag output.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The output buffer to write to.
+ */
+static inline ssize_t
+pdcs_autoboot_read(struct subsystem *entry, char *buf)
+{
+        return pdcs_auto_read(entry, buf, PF_AUTOBOOT);
+}
+
+/**
+ * pdcs_autosearch_read - Stable Storage autoboot flag output.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The output buffer to write to.
+ */
+static inline ssize_t
+pdcs_autosearch_read(struct subsystem *entry, char *buf)
+{
+        return pdcs_auto_read(entry, buf, PF_AUTOSEARCH);
+}
+
+/**
+ * pdcs_timer_read - Stable Storage timer count output (in seconds).
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The output buffer to write to.
+ *
+ * The value of the timer field correponds to a number of seconds in powers of 2.
+ */
+static ssize_t
+pdcs_timer_read(struct subsystem *entry, char *buf)
+{
+        char *out = buf;
+        struct pdcspath_entry *pathentry;
+
+        if (!entry || !buf)
+                return -EINVAL;
+
+        /* Current flags are stored in primary boot path entry */
+        pathentry = &pdcspath_entry_primary;
+
+        /* print the timer value in seconds */
+        read_lock(&pathentry->rw_lock);
+        out += sprintf(out, "%u\n", (pathentry->devpath.flags & PF_TIMER) ?
+                                (1 << (pathentry->devpath.flags & PF_TIMER)) : 0);
+        read_unlock(&pathentry->rw_lock);
+
+        return out - buf;
+}
+
+/**
+ * pdcs_osid_read - Stable Storage OS ID register output.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The output buffer to write to.
+ */
+static ssize_t
+pdcs_osid_read(struct subsystem *entry, char *buf)
+{
+        char *out = buf;
+        __u32 result;
+        char *tmpstr = NULL;
+
+        if (!entry || !buf)
+                return -EINVAL;
 
         /* get OSID */
         if (pdc_stable_read(PDCS_ADDR_OSID, &result, sizeof(result)) != PDC_OK)
@@ -529,13 +630,31 @@ pdcs_info_read(struct subsystem *entry, char *buf)
                 case 0x0005:    tmpstr = "Novell Netware dependent data"; break;
                 default:        tmpstr = "Unknown"; break;
         }
-        out += sprintf(out, "OS ID: %s (0x%.4x)\n", tmpstr, (result >> 16));
+        out += sprintf(out, "%s (0x%.4x)\n", tmpstr, (result >> 16));
+
+        return out - buf;
+}
+
+/**
+ * pdcs_fastsize_read - Stable Storage FastSize register output.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The output buffer to write to.
+ *
+ * This register holds the amount of system RAM to be tested during boot sequence.
+ */
+static ssize_t
+pdcs_fastsize_read(struct subsystem *entry, char *buf)
+{
+        char *out = buf;
+        __u32 result;
+
+        if (!entry || !buf)
+                return -EINVAL;
 
         /* get fast-size */
         if (pdc_stable_read(PDCS_ADDR_FSIZ, &result, sizeof(result)) != PDC_OK)
                 return -EIO;
 
-        out += sprintf(out, "Memory tested: ");
         if ((result & 0x0F) < 0x0E)
                 out += sprintf(out, "%d kB", (1<<(result & 0x0F))*256);
         else
@@ -546,22 +665,18 @@ pdcs_info_read(struct subsystem *entry, char *buf)
 }
 
 /**
- * pdcs_info_write - This function handles boot flag modifying.
+ * pdcs_auto_write - This function handles autoboot/search flag modifying.
  * @entry: An allocated and populated subsytem struct. We don't use it tho.
  * @buf: The input buffer to read from.
  * @count: The number of bytes to be read.
+ * @knob: The PF_AUTOBOOT or PF_AUTOSEARCH flag
  * 
- * We will call this function to change the current boot flags.
+ * We will call this function to change the current autoboot flag.
  * We expect a precise syntax:
- *      \"n n\" (n == 0 or 1) to toggle respectively AutoBoot and AutoSearch
- *
- * As of now there is no incentive on my side to provide more "knobs" to that
- * interface, since modifying the rest of the data is pretty meaningless when
- * the machine is running and for the expected use of that facility, such as
- * PALO setting up the boot disk when installing a Linux distribution...
+ *      \"n\" (n == 0 or 1) to toggle AutoBoot Off or On
  */
 static ssize_t
-pdcs_info_write(struct subsystem *entry, const char *buf, size_t count)
+pdcs_auto_write(struct subsystem *entry, const char *buf, size_t count, int knob)
 {
         struct pdcspath_entry *pathentry;
         unsigned char flags;
@@ -582,7 +697,9 @@ pdcs_info_write(struct subsystem *entry, const char *buf, size_t count)
         pathentry = &pdcspath_entry_primary;
         
         /* Be nice to the existing flag record */
+        read_lock(&pathentry->rw_lock);
         flags = pathentry->devpath.flags;
+        read_unlock(&pathentry->rw_lock);
         
         DPRINTK("%s: flags before: 0x%X\n", __func__, flags);
                         
@@ -595,50 +712,85 @@ pdcs_info_write(struct subsystem *entry, const char *buf, size_t count)
         if ((c != 0) && (c != 1))
                 goto parse_error;
         if (c == 0)
-                flags &= ~PF_AUTOBOOT;
+                flags &= ~knob;
         else
-                flags |= PF_AUTOBOOT;
-        
-        if (*temp++ != ' ')
-                goto parse_error;
-        
-        c = *temp++ - '0';
-        if ((c != 0) && (c != 1))
-                goto parse_error;
-        if (c == 0)
-                flags &= ~PF_AUTOSEARCH;
-        else
-                flags |= PF_AUTOSEARCH;
+                flags |= knob;
         
         DPRINTK("%s: flags after: 0x%X\n", __func__, flags);
                 
         /* So far so good, let's get in deep */
+        write_lock(&pathentry->rw_lock);
         
         /* Change the path entry flags first */
         pathentry->devpath.flags = flags;
                 
         /* Now, dive in. Write back to the hardware */
-        WARN_ON(pdcspath_store(pathentry));     /* this warn should *NEVER* happen */
+        pdcspath_store(pathentry);
+        write_unlock(&pathentry->rw_lock);
         
-        printk(KERN_INFO "PDC Stable Storage: changed flags to \"%s\"\n", buf);
+        printk(KERN_INFO PDCS_PREFIX ": changed \"%s\" to \"%s\"\n",
+                (knob & PF_AUTOBOOT) ? "autoboot" : "autosearch",
+                (flags & knob) ? "On" : "Off");
         
         return count;
 
 parse_error:
-        printk(KERN_WARNING "%s: Parse error: expect \"n n\" (n == 0 or 1) for AB and AS\n", __func__);
+        printk(KERN_WARNING "%s: Parse error: expect \"n\" (n == 0 or 1)\n", __func__);
         return -EINVAL;
 }
 
-/* The last attribute (the 'root' one actually) with all remaining data. */
-static PDCS_ATTR(info, 0600, pdcs_info_read, pdcs_info_write);
+/**
+ * pdcs_autoboot_write - This function handles autoboot flag modifying.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The input buffer to read from.
+ * @count: The number of bytes to be read.
+ *
+ * We will call this function to change the current boot flags.
+ * We expect a precise syntax:
+ *      \"n\" (n == 0 or 1) to toggle AutoSearch Off or On
+ */
+static inline ssize_t
+pdcs_autoboot_write(struct subsystem *entry, const char *buf, size_t count)
+{
+        return pdcs_auto_write(entry, buf, count, PF_AUTOBOOT);
+}
+
+/**
+ * pdcs_autosearch_write - This function handles autosearch flag modifying.
+ * @entry: An allocated and populated subsytem struct. We don't use it tho.
+ * @buf: The input buffer to read from.
+ * @count: The number of bytes to be read.
+ *
+ * We will call this function to change the current boot flags.
+ * We expect a precise syntax:
+ *      \"n\" (n == 0 or 1) to toggle AutoSearch Off or On
+ */
+static inline ssize_t
+pdcs_autosearch_write(struct subsystem *entry, const char *buf, size_t count)
+{
+        return pdcs_auto_write(entry, buf, count, PF_AUTOSEARCH);
+}
+
+/* The remaining attributes. */
+static PDCS_ATTR(size, 0444, pdcs_size_read, NULL);
+static PDCS_ATTR(autoboot, 0644, pdcs_autoboot_read, pdcs_autoboot_write);
+static PDCS_ATTR(autosearch, 0644, pdcs_autosearch_read, pdcs_autosearch_write);
+static PDCS_ATTR(timer, 0444, pdcs_timer_read, NULL);
+static PDCS_ATTR(osid, 0400, pdcs_osid_read, NULL);
+static PDCS_ATTR(fastsize, 0400, pdcs_fastsize_read, NULL);
 
 static struct subsys_attribute *pdcs_subsys_attrs[] = {
-        &pdcs_attr_info,
-        NULL,   /* maybe more in the future? */
+        &pdcs_attr_size,
+        &pdcs_attr_autoboot,
+        &pdcs_attr_autosearch,
+        &pdcs_attr_timer,
+        &pdcs_attr_osid,
+        &pdcs_attr_fastsize,
+        NULL,
 };
 
 static decl_subsys(paths, &ktype_pdcspath, NULL);
-static decl_subsys(pdc, NULL, NULL);
+static decl_subsys(stable, NULL, NULL);
 
 /**
  * pdcs_register_pathentries - Prepares path entries kobjects for sysfs usage.
@@ -656,8 +808,16 @@ pdcs_register_pathentries(void)
         struct pdcspath_entry *entry;
         int err;
         
+        /* Initialize the entries rw_lock before anything else */
+        for (i = 0; (entry = pdcspath_entries[i]); i++)
+                rwlock_init(&entry->rw_lock);
+
         for (i = 0; (entry = pdcspath_entries[i]); i++) {
-                if (pdcspath_fetch(entry) < 0)
+                write_lock(&entry->rw_lock);
+                err = pdcspath_fetch(entry);
+                write_unlock(&entry->rw_lock);
+
+                if (err < 0)
                         continue;
 
                 if ((err = kobject_set_name(&entry->kobj, "%s", entry->name)))
@@ -667,13 +827,14 @@ pdcs_register_pathentries(void)
                         return err;
                 
                 /* kobject is now registered */
+                write_lock(&entry->rw_lock);
                 entry->ready = 2;
                 
-                if (!entry->dev)
-                        continue;
-
                 /* Add a nice symlink to the real device */
-                sysfs_create_link(&entry->kobj, &entry->dev->kobj, "device");
+                if (entry->dev)
+                        sysfs_create_link(&entry->kobj, &entry->dev->kobj, "device");
+
+                write_unlock(&entry->rw_lock);
         }
         
         return 0;
@@ -688,14 +849,17 @@ pdcs_unregister_pathentries(void)
         unsigned short i;
         struct pdcspath_entry *entry;
         
-        for (i = 0; (entry = pdcspath_entries[i]); i++)
+        for (i = 0; (entry = pdcspath_entries[i]); i++) {
+                read_lock(&entry->rw_lock);
                 if (entry->ready >= 2)
-                        kobject_unregister(&entry->kobj);       
+                        kobject_unregister(&entry->kobj);
+                read_unlock(&entry->rw_lock);
+        }
 }
 
 /*
- * For now we register the pdc subsystem with the firmware subsystem
- * and the paths subsystem with the pdc subsystem
+ * For now we register the stable subsystem with the firmware subsystem
+ * and the paths subsystem with the stable subsystem
  */
 static int __init
 pdc_stable_init(void)
@@ -707,19 +871,23 @@ pdc_stable_init(void)
         if (pdc_stable_get_size(&pdcs_size) != PDC_OK) 
                 return -ENODEV;
 
-        printk(KERN_INFO "PDC Stable Storage facility v%s\n", PDCS_VERSION);
+        /* make sure we have enough data */
+        if (pdcs_size < 96)
+                return -ENODATA;
+
+        printk(KERN_INFO PDCS_PREFIX " facility v%s\n", PDCS_VERSION);
 
-        /* For now we'll register the pdc subsys within this driver */
-        if ((rc = firmware_register(&pdc_subsys)))
+        /* For now we'll register the stable subsys within this driver */
+        if ((rc = firmware_register(&stable_subsys)))
                 goto fail_firmreg;
 
-        /* Don't forget the info entry */
+        /* Don't forget the root entries */
         for (i = 0; (attr = pdcs_subsys_attrs[i]) && !error; i++)
                 if (attr->show)
-                        error = subsys_create_file(&pdc_subsys, attr);
+                        error = subsys_create_file(&stable_subsys, attr);
         
-        /* register the paths subsys as a subsystem of pdc subsys */
-        kset_set_kset_s(&paths_subsys, pdc_subsys);
+        /* register the paths subsys as a subsystem of stable subsys */
+        kset_set_kset_s(&paths_subsys, stable_subsys);
         if ((rc= subsystem_register(&paths_subsys)))
                 goto fail_subsysreg;
 
@@ -734,10 +902,10 @@ fail_pdcsreg:
         subsystem_unregister(&paths_subsys);
         
 fail_subsysreg:
-        firmware_unregister(&pdc_subsys);
+        firmware_unregister(&stable_subsys);
         
 fail_firmreg:
-        printk(KERN_INFO "PDC Stable Storage bailing out\n");
+        printk(KERN_INFO PDCS_PREFIX " bailing out\n");
         return rc;
 }
 
@@ -747,7 +915,7 @@ pdc_stable_exit(void)
         pdcs_unregister_pathentries();
         subsystem_unregister(&paths_subsys);
 
-        firmware_unregister(&pdc_subsys);
+        firmware_unregister(&stable_subsys);
 }
 
 
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index c85653f315aa..5d47c5965c51 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -37,6 +37,8 @@
 #include <asm/hardware.h>       /* for register_parisc_driver() stuff */
 
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+
 #include <asm/runway.h>         /* for proc_runway_root */
 #include <asm/pdc.h>            /* for PDC_MODEL_* */
 #include <asm/pdcpat.h>         /* for is_pdc_pat() */
@@ -1892,46 +1894,43 @@ sba_common_init(struct sba_device *sba_dev)
 }
 
 #ifdef CONFIG_PROC_FS
-static int sba_proc_info(char *buf, char **start, off_t offset, int len)
+static int sba_proc_info(struct seq_file *m, void *p)
 {
         struct sba_device *sba_dev = sba_list;
         struct ioc *ioc = &sba_dev->ioc[0];     /* FIXME: Multi-IOC support! */
         int total_pages = (int) (ioc->res_size << 3); /* 8 bits per byte */
-        unsigned long i;
 #ifdef SBA_COLLECT_STATS
         unsigned long avg = 0, min, max;
 #endif
+        int i, len = 0;
 
-        sprintf(buf, "%s rev %d.%d\n",
+        len += seq_printf(m, "%s rev %d.%d\n",
                 sba_dev->name,
                 (sba_dev->hw_rev & 0x7) + 1,
                 (sba_dev->hw_rev & 0x18) >> 3
                 );
-        sprintf(buf, "%sIO PDIR size    : %d bytes (%d entries)\n",
-                buf,
+        len += seq_printf(m, "IO PDIR size    : %d bytes (%d entries)\n",
                 (int) ((ioc->res_size << 3) * sizeof(u64)), /* 8 bits/byte */
                 total_pages);
 
-        sprintf(buf, "%sResource bitmap : %d bytes (%d pages)\n", 
-                buf, ioc->res_size, ioc->res_size << 3);   /* 8 bits per byte */
+        len += seq_printf(m, "Resource bitmap : %d bytes (%d pages)\n", 
+                ioc->res_size, ioc->res_size << 3);   /* 8 bits per byte */
 
-        sprintf(buf, "%sLMMIO_BASE/MASK/ROUTE %08x %08x %08x\n",
-                buf,
+        len += seq_printf(m, "LMMIO_BASE/MASK/ROUTE %08x %08x %08x\n",
                 READ_REG32(sba_dev->sba_hpa + LMMIO_DIST_BASE),
                 READ_REG32(sba_dev->sba_hpa + LMMIO_DIST_MASK),
                 READ_REG32(sba_dev->sba_hpa + LMMIO_DIST_ROUTE)
                 );
 
         for (i=0; i<4; i++)
-                sprintf(buf, "%sDIR%ld_BASE/MASK/ROUTE %08x %08x %08x\n",
-                        buf, i,
+                len += seq_printf(m, "DIR%d_BASE/MASK/ROUTE %08x %08x %08x\n", i,
                         READ_REG32(sba_dev->sba_hpa + LMMIO_DIRECT0_BASE  + i*0x18),
                         READ_REG32(sba_dev->sba_hpa + LMMIO_DIRECT0_MASK  + i*0x18),
                         READ_REG32(sba_dev->sba_hpa + LMMIO_DIRECT0_ROUTE + i*0x18)
                 );
 
 #ifdef SBA_COLLECT_STATS
-        sprintf(buf, "%sIO PDIR entries : %ld free  %ld used (%d%%)\n", buf,
+        len += seq_printf(m, "IO PDIR entries : %ld free  %ld used (%d%%)\n",
                 total_pages - ioc->used_pages, ioc->used_pages,
                 (int) (ioc->used_pages * 100 / total_pages));
 
@@ -1942,53 +1941,76 @@ static int sba_proc_info(char *buf, char **start, off_t offset, int len)
                 if (ioc->avg_search[i] < min) min = ioc->avg_search[i];
         }
         avg /= SBA_SEARCH_SAMPLE;
-        sprintf(buf, "%s  Bitmap search : %ld/%ld/%ld (min/avg/max CPU Cycles)\n",
-                buf, min, avg, max);
+        len += seq_printf(m, "  Bitmap search : %ld/%ld/%ld (min/avg/max CPU Cycles)\n",
+                min, avg, max);
 
-        sprintf(buf, "%spci_map_single(): %12ld calls  %12ld pages (avg %d/1000)\n",
-                buf, ioc->msingle_calls, ioc->msingle_pages,
+        len += seq_printf(m, "pci_map_single(): %12ld calls  %12ld pages (avg %d/1000)\n",
+                ioc->msingle_calls, ioc->msingle_pages,
                 (int) ((ioc->msingle_pages * 1000)/ioc->msingle_calls));
 
         /* KLUGE - unmap_sg calls unmap_single for each mapped page */
         min = ioc->usingle_calls;
         max = ioc->usingle_pages - ioc->usg_pages;
-        sprintf(buf, "%spci_unmap_single: %12ld calls  %12ld pages (avg %d/1000)\n",
-                buf, min, max,
-                (int) ((max * 1000)/min));
+        len += seq_printf(m, "pci_unmap_single: %12ld calls  %12ld pages (avg %d/1000)\n",
+                min, max, (int) ((max * 1000)/min));
 
-        sprintf(buf, "%spci_map_sg()    : %12ld calls  %12ld pages (avg %d/1000)\n",
-                buf, ioc->msg_calls, ioc->msg_pages,
+        len += seq_printf(m, "pci_map_sg()    : %12ld calls  %12ld pages (avg %d/1000)\n",
+                ioc->msg_calls, ioc->msg_pages, 
                 (int) ((ioc->msg_pages * 1000)/ioc->msg_calls));
 
-        sprintf(buf, "%spci_unmap_sg()  : %12ld calls  %12ld pages (avg %d/1000)\n",
-                buf, ioc->usg_calls, ioc->usg_pages,
+        len += seq_printf(m, "pci_unmap_sg()  : %12ld calls  %12ld pages (avg %d/1000)\n",
+                ioc->usg_calls, ioc->usg_pages,
                 (int) ((ioc->usg_pages * 1000)/ioc->usg_calls));
 #endif
 
-        return strlen(buf);
+        return 0;
 }
 
-#if 0
-/* XXX too much output - exceeds 4k limit and needs to be re-written */
 static int
-sba_resource_map(char *buf, char **start, off_t offset, int len)
+sba_proc_open(struct inode *i, struct file *f)
+{
+        return single_open(f, &sba_proc_info, NULL);
+}
+
+static struct file_operations sba_proc_fops = {
+        .owner = THIS_MODULE,
+        .open = sba_proc_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
+
+static int
+sba_proc_bitmap_info(struct seq_file *m, void *p)
 {
         struct sba_device *sba_dev = sba_list;
-        struct ioc *ioc = &sba_dev->ioc[0];     /* FIXME: Mutli-IOC suppoer! */
+        struct ioc *ioc = &sba_dev->ioc[0];     /* FIXME: Multi-IOC support! */
         unsigned int *res_ptr = (unsigned int *)ioc->res_map;
-        int i;
+        int i, len = 0;
 
-        buf[0] = '\0';
-        for(i = 0; i < (ioc->res_size / sizeof(unsigned int)); ++i, ++res_ptr) {
+        for (i = 0; i < (ioc->res_size/sizeof(unsigned int)); ++i, ++res_ptr) {
                 if ((i & 7) == 0)
-                    strcat(buf,"\n   ");
-                sprintf(buf, "%s %08x", buf, *res_ptr);
+                        len += seq_printf(m, "\n   ");
+                len += seq_printf(m, " %08x", *res_ptr);
         }
-        strcat(buf, "\n");
+        len += seq_printf(m, "\n");
 
-        return strlen(buf);
+        return 0;
 }
-#endif /* 0 */
+
+static int
+sba_proc_bitmap_open(struct inode *i, struct file *f)
+{
+        return single_open(f, &sba_proc_bitmap_info, NULL);
+}
+
+static struct file_operations sba_proc_bitmap_fops = {
+        .owner = THIS_MODULE,
+        .open = sba_proc_bitmap_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+};
 #endif /* CONFIG_PROC_FS */
 
 static struct parisc_device_id sba_tbl[] = {
@@ -2021,6 +2043,7 @@ sba_driver_callback(struct parisc_device *dev)
         int i;
         char *version;
         void __iomem *sba_addr = ioremap(dev->hpa.start, SBA_FUNC_SIZE);
+        struct proc_dir_entry *info_entry, *bitmap_entry, *root;
 
         sba_dump_ranges(sba_addr);
 
@@ -2064,14 +2087,13 @@ sba_driver_callback(struct parisc_device *dev)
         printk(KERN_INFO "%s found %s at 0x%lx\n",
                 MODULE_NAME, version, dev->hpa.start);
 
-        sba_dev = kmalloc(sizeof(struct sba_device), GFP_KERNEL);
+        sba_dev = kzalloc(sizeof(struct sba_device), GFP_KERNEL);
         if (!sba_dev) {
                 printk(KERN_ERR MODULE_NAME " - couldn't alloc sba_device\n");
                 return -ENOMEM;
         }
 
         parisc_set_drvdata(dev, sba_dev);
-        memset(sba_dev, 0, sizeof(struct sba_device));
 
         for(i=0; i<MAX_IOC; i++)
                 spin_lock_init(&(sba_dev->ioc[i].res_lock));
@@ -2089,19 +2111,27 @@ sba_driver_callback(struct parisc_device *dev)
         hppa_dma_ops = &sba_ops;
 
 #ifdef CONFIG_PROC_FS
-        if (IS_ASTRO(&dev->id)) {
-                create_proc_info_entry("Astro", 0, proc_runway_root, sba_proc_info);
-        } else if (IS_IKE(&dev->id)) {
-                create_proc_info_entry("Ike", 0, proc_runway_root, sba_proc_info);
-        } else if (IS_PLUTO(&dev->id)) {
-                create_proc_info_entry("Pluto", 0, proc_mckinley_root, sba_proc_info);
-        } else {
-                create_proc_info_entry("Reo", 0, proc_runway_root, sba_proc_info);
+        switch (dev->id.hversion) {
+        case PLUTO_MCKINLEY_PORT:
+                root = proc_mckinley_root;
+                break;
+        case ASTRO_RUNWAY_PORT:
+        case IKE_MERCED_PORT:
+        default:
+                root = proc_runway_root;
+                break;
         }
-#if 0
-        create_proc_info_entry("bitmap", 0, proc_runway_root, sba_resource_map);
-#endif
+
+        info_entry = create_proc_entry("sba_iommu", 0, root);
+        bitmap_entry = create_proc_entry("sba_iommu-bitmap", 0, root);
+
+        if (info_entry)
+                info_entry->proc_fops = &sba_proc_fops;
+
+        if (bitmap_entry)
+                bitmap_entry->proc_fops = &sba_proc_bitmap_fops;
 #endif
+
         parisc_vmerge_boundary = IOVP_SIZE;
         parisc_vmerge_max_size = IOVP_SIZE * BITS_PER_LONG;
         parisc_has_iommu();
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index d14888e149bb..ba971fecd0d8 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -89,6 +89,9 @@ static struct superio_device sio_dev;
 #define DBG_INIT(x...)
 #endif
 
+#define SUPERIO "SuperIO"
+#define PFX     SUPERIO ": "
+
 static irqreturn_t
 superio_interrupt(int parent_irq, void *devp, struct pt_regs *regs)
 {
@@ -117,7 +120,7 @@ superio_interrupt(int parent_irq, void *devp, struct pt_regs *regs)
         local_irq = results & 0x0f;
 
         if (local_irq == 2 || local_irq > 7) {
-                printk(KERN_ERR "SuperIO: slave interrupted!\n");
+                printk(KERN_ERR PFX "slave interrupted!\n");
                 return IRQ_HANDLED;
         }
 
@@ -128,7 +131,7 @@ superio_interrupt(int parent_irq, void *devp, struct pt_regs *regs)
                 outb(OCW3_ISR,IC_PIC1+0);
                 results = inb(IC_PIC1+0);
                 if ((results & 0x80) == 0) { /* if ISR7 not set: spurious */
-                        printk(KERN_WARNING "SuperIO: spurious interrupt!\n");
+                        printk(KERN_WARNING PFX "spurious interrupt!\n");
                         return IRQ_HANDLED;
                 }
         }
@@ -163,27 +166,27 @@ superio_init(struct pci_dev *pcidev)
         /* ...then properly fixup the USB to point at suckyio PIC */
         sio->usb_pdev->irq = superio_fixup_irq(sio->usb_pdev);
 
-        printk(KERN_INFO "SuperIO: Found NS87560 Legacy I/O device at %s (IRQ %i) \n",
+        printk(KERN_INFO PFX "Found NS87560 Legacy I/O device at %s (IRQ %i) \n",
                pci_name(pdev), pdev->irq);
 
         pci_read_config_dword (pdev, SIO_SP1BAR, &sio->sp1_base);
         sio->sp1_base &= ~1;
-        printk (KERN_INFO "SuperIO: Serial port 1 at 0x%x\n", sio->sp1_base);
+        printk(KERN_INFO PFX "Serial port 1 at 0x%x\n", sio->sp1_base);
 
         pci_read_config_dword (pdev, SIO_SP2BAR, &sio->sp2_base);
         sio->sp2_base &= ~1;
-        printk (KERN_INFO "SuperIO: Serial port 2 at 0x%x\n", sio->sp2_base);
+        printk(KERN_INFO PFX "Serial port 2 at 0x%x\n", sio->sp2_base);
 
         pci_read_config_dword (pdev, SIO_PPBAR, &sio->pp_base);
         sio->pp_base &= ~1;
-        printk (KERN_INFO "SuperIO: Parallel port at 0x%x\n", sio->pp_base);
+        printk(KERN_INFO PFX "Parallel port at 0x%x\n", sio->pp_base);
 
         pci_read_config_dword (pdev, SIO_FDCBAR, &sio->fdc_base);
         sio->fdc_base &= ~1;
-        printk (KERN_INFO "SuperIO: Floppy controller at 0x%x\n", sio->fdc_base);
+        printk(KERN_INFO PFX "Floppy controller at 0x%x\n", sio->fdc_base);
         pci_read_config_dword (pdev, SIO_ACPIBAR, &sio->acpi_base);
         sio->acpi_base &= ~1;
-        printk (KERN_INFO "SuperIO: ACPI at 0x%x\n", sio->acpi_base);
+        printk(KERN_INFO PFX "ACPI at 0x%x\n", sio->acpi_base);
 
         request_region (IC_PIC1, 0x1f, "pic1");
         request_region (IC_PIC2, 0x1f, "pic2");
@@ -263,14 +266,14 @@ superio_init(struct pci_dev *pcidev)
         /* Setup USB power regulation */
         outb(1, sio->acpi_base + USB_REG_CR);
         if (inb(sio->acpi_base + USB_REG_CR) & 1)
-                printk(KERN_INFO "SuperIO: USB regulator enabled\n");
+                printk(KERN_INFO PFX "USB regulator enabled\n");
         else
-                printk(KERN_ERR "USB regulator not initialized!\n");
+                printk(KERN_ERR PFX "USB regulator not initialized!\n");
 
         if (request_irq(pdev->irq, superio_interrupt, SA_INTERRUPT,
-                        "SuperIO", (void *)sio)) {
+                        SUPERIO, (void *)sio)) {
 
-                printk(KERN_ERR "SuperIO: could not get irq\n");
+                printk(KERN_ERR PFX "could not get irq\n");
                 BUG();
                 return;
         }
@@ -284,7 +287,7 @@ static void superio_disable_irq(unsigned int irq)
         u8 r8;
 
         if ((irq < 1) || (irq == 2) || (irq > 7)) {
-                printk(KERN_ERR "SuperIO: Illegal irq number.\n");
+                printk(KERN_ERR PFX "Illegal irq number.\n");
                 BUG();
                 return;
         }
@@ -301,7 +304,7 @@ static void superio_enable_irq(unsigned int irq)
         u8 r8;
 
         if ((irq < 1) || (irq == 2) || (irq > 7)) {
-                printk(KERN_ERR "SuperIO: Illegal irq number (%d).\n", irq);
+                printk(KERN_ERR PFX "Illegal irq number (%d).\n", irq);
                 BUG();
                 return;
         }
@@ -319,7 +322,7 @@ static unsigned int superio_startup_irq(unsigned int irq)
 }
 
 static struct hw_interrupt_type superio_interrupt_type = {
-        .typename =     "SuperIO",
+        .typename =     SUPERIO,
         .startup =      superio_startup_irq,
         .shutdown =     superio_disable_irq,
         .enable =       superio_enable_irq,
@@ -413,7 +416,7 @@ static void __devinit superio_serial_init(void)
 
         retval = early_serial_setup(&serial[0]);
         if (retval < 0) {
-                printk(KERN_WARNING "SuperIO: Register Serial #0 failed.\n");
+                printk(KERN_WARNING PFX "Register Serial #0 failed.\n");
                 return;
         }
 
@@ -423,7 +426,7 @@ static void __devinit superio_serial_init(void)
         retval = early_serial_setup(&serial[1]);
 
         if (retval < 0)
-                printk(KERN_WARNING "SuperIO: Register Serial #1 failed.\n");
+                printk(KERN_WARNING PFX "Register Serial #1 failed.\n");
 #endif /* CONFIG_SERIAL_8250 */
 }
 
@@ -437,7 +440,7 @@ static void __devinit superio_parport_init(void)
                         PARPORT_DMA_NONE /* dma */,
                         NULL /*struct pci_dev* */) )
 
-                printk(KERN_WARNING "SuperIO: Probing parallel port failed.\n");
+                printk(KERN_WARNING PFX "Probing parallel port failed.\n");
 #endif  /* CONFIG_PARPORT_PC */
 }
 
@@ -499,7 +502,7 @@ static struct pci_device_id superio_tbl[] = {
 };
 
 static struct pci_driver superio_driver = {
-        .name =         "SuperIO",
+        .name =         SUPERIO,
         .id_table =     superio_tbl,
         .probe =        superio_probe,
 };
diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c
index 17dce2adf7fe..813c2c24ab1e 100644
--- a/drivers/parisc/wax.c
+++ b/drivers/parisc/wax.c
@@ -76,7 +76,7 @@ wax_init_chip(struct parisc_device *dev)
         struct gsc_irq gsc_irq;
         int ret;
 
-        wax = kmalloc(sizeof(*wax), GFP_KERNEL);
+        wax = kzalloc(sizeof(*wax), GFP_KERNEL);
         if (!wax)
                 return -ENOMEM;
 
diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c
index fde29a75f888..1de52d9febf9 100644
--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -249,7 +249,7 @@ struct parport *__devinit parport_gsc_probe_port (unsigned long base,
         struct parport tmp;
         struct parport *p = &tmp;
 
-        priv = kmalloc (sizeof (struct parport_gsc_private), GFP_KERNEL);
+        priv = kzalloc (sizeof (struct parport_gsc_private), GFP_KERNEL);
         if (!priv) {
                 printk (KERN_DEBUG "parport (0x%lx): no memory!\n", base);
                 return NULL;
diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
index 166de3507780..10845253c9e0 100644
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -312,8 +312,7 @@ static int __devinit parport_register (struct pci_dev *dev,
 {
         struct parport_pc_pci *card;
         struct parport_serial_private *priv = pci_get_drvdata (dev);
-        int i = id->driver_data, n;
-        int success = 0;
+        int n, success = 0;
 
         priv->par = cards[id->driver_data];
         card = &priv->par;
@@ -344,10 +343,8 @@ static int __devinit parport_register (struct pci_dev *dev,
                                         "hi" as an offset (see SYBA
                                         def.) */
                 /* TODO: test if sharing interrupts works */
-                printk (KERN_DEBUG "PCI parallel port detected: %04x:%04x, "
-                        "I/O at %#lx(%#lx)\n",
-                        parport_serial_pci_tbl[i].vendor,
-                        parport_serial_pci_tbl[i].device, io_lo, io_hi);
+                dev_dbg(&dev->dev, "PCI parallel port detected: I/O at "
+                        "%#lx(%#lx)\n", io_lo, io_hi);
                 port = parport_pc_probe_port (io_lo, io_hi, PARPORT_IRQ_NONE,
                                               PARPORT_DMA_NONE, dev);
                 if (port) {
@@ -359,7 +356,7 @@ static int __devinit parport_register (struct pci_dev *dev,
         if (card->postinit_hook)
                 card->postinit_hook (dev, card, !success);
 
-        return success ? 0 : 1;
+        return 0;
 }
 
 static int __devinit parport_serial_pci_probe (struct pci_dev *dev,
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 0a424a4e8187..bb96ce1db08c 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -352,11 +352,20 @@ static void pcmcia_release_dev(struct device *dev)
         kfree(p_dev);
 }
 
+static void pcmcia_add_pseudo_device(struct pcmcia_socket *s)
+{
+        if (!s->pcmcia_state.device_add_pending) {
+                s->pcmcia_state.device_add_pending = 1;
+                schedule_work(&s->device_add);
+        }
+        return;
+}
 
 static int pcmcia_device_probe(struct device * dev)
 {
         struct pcmcia_device *p_dev;
         struct pcmcia_driver *p_drv;
+        struct pcmcia_device_id *did;
         struct pcmcia_socket *s;
         int ret = 0;
 
@@ -392,6 +401,19 @@ static int pcmcia_device_probe(struct device * dev)
         }
 
         ret = p_drv->probe(p_dev);
+        if (ret)
+                goto put_module;
+
+        /* handle pseudo multifunction devices:
+         * there are at most two pseudo multifunction devices.
+         * if we're matching against the first, schedule a
+         * call which will then check whether there are two
+         * pseudo devices, and if not, add the second one.
+         */
+        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
+            (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
+                pcmcia_add_pseudo_device(p_dev->socket);
 
  put_module:
         if (ret)
@@ -660,15 +682,6 @@ static void pcmcia_delayed_add_pseudo_device(void *data)
         s->pcmcia_state.device_add_pending = 0;
 }
 
-static inline void pcmcia_add_pseudo_device(struct pcmcia_socket *s)
-{
-        if (!s->pcmcia_state.device_add_pending) {
-                s->pcmcia_state.device_add_pending = 1;
-                schedule_work(&s->device_add);
-        }
-        return;
-}
-
 static int pcmcia_requery(struct device *dev, void * _data)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
@@ -755,15 +768,6 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
         }
 
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) {
-                /* handle pseudo multifunction devices:
-                 * there are at most two pseudo multifunction devices.
-                 * if we're matching against the first, schedule a
-                 * call which will then check whether there are two
-                 * pseudo devices, and if not, add the second one.
-                 */
-                if (dev->device_no == 0)
-                        pcmcia_add_pseudo_device(dev->socket);
-
                 if (dev->device_no != did->device_no)
                         return 0;
         }
diff --git a/drivers/pnp/card.c b/drivers/pnp/card.c
index aaa568a3806e..b68eef251614 100644
--- a/drivers/pnp/card.c
+++ b/drivers/pnp/card.c
@@ -303,13 +303,11 @@ found:
         down_write(&dev->dev.bus->subsys.rwsem);
         dev->card_link = clink;
         dev->dev.driver = &drv->link.driver;
-        if (drv->link.driver.probe) {
-                if (drv->link.driver.probe(&dev->dev)) {
-                        dev->dev.driver = NULL;
-                        dev->card_link = NULL;
-                        up_write(&dev->dev.bus->subsys.rwsem);
-                        return NULL;
-                }
+        if (pnp_bus_type.probe(&dev->dev)) {
+                dev->dev.driver = NULL;
+                dev->card_link = NULL;
+                up_write(&dev->dev.bus->subsys.rwsem);
+                return NULL;
         }
         device_bind_driver(&dev->dev);
         up_write(&dev->dev.bus->subsys.rwsem);
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 6912399d0937..6f50cc9323d9 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -55,21 +55,13 @@ config DASD_DIAG
           Disks under VM.  If you are not running under VM or unsure what it is,
           say "N".
 
-config DASD_EER
-        tristate "Extended error reporting (EER)"
-        depends on DASD
-        help
-          This driver provides a character device interface to the
-          DASD extended error reporting. This is only needed if you want to
-          use applications written for the EER facility.
-
 config DASD_CMB
         tristate "Compatibility interface for DASD channel measurement blocks"
         depends on DASD
         help
-          This driver provides an additional interface to the channel
-          measurement facility, which is normally accessed though sysfs, with
-          a set of ioctl functions specific to the dasd driver.
+          This driver provides an additional interface to the channel measurement
+          facility, which is normally accessed though sysfs, with a set of
+          ioctl functions specific to the dasd driver.
           This is only needed if you want to use applications written for
           linux-2.4 dasd channel measurement facility interface.
 
diff --git a/drivers/s390/block/Makefile b/drivers/s390/block/Makefile
index 0c0d871e8f51..58c6780134f7 100644
--- a/drivers/s390/block/Makefile
+++ b/drivers/s390/block/Makefile
@@ -5,7 +5,6 @@
 dasd_eckd_mod-objs := dasd_eckd.o dasd_3990_erp.o dasd_9343_erp.o
 dasd_fba_mod-objs  := dasd_fba.o dasd_3370_erp.o dasd_9336_erp.o
 dasd_diag_mod-objs := dasd_diag.o
-dasd_eer_mod-objs := dasd_eer.o
 dasd_mod-objs      := dasd.o dasd_ioctl.o dasd_proc.o dasd_devmap.o \
                         dasd_genhd.o dasd_erp.o
 
@@ -14,6 +13,5 @@ obj-$(CONFIG_DASD_DIAG) += dasd_diag_mod.o
 obj-$(CONFIG_DASD_ECKD) += dasd_eckd_mod.o
 obj-$(CONFIG_DASD_FBA)  += dasd_fba_mod.o
 obj-$(CONFIG_DASD_CMB)  += dasd_cmb.o
-obj-$(CONFIG_DASD_EER)  += dasd_eer.o
 obj-$(CONFIG_BLK_DEV_XPRAM) += xpram.o
 obj-$(CONFIG_DCSSBLK) += dcssblk.o
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 08c88fcd8963..33157c84d1d3 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -18,7 +18,6 @@
 #include <linux/slab.h>
 #include <linux/buffer_head.h>
 #include <linux/hdreg.h>
-#include <linux/notifier.h>
 
 #include <asm/ccwdev.h>
 #include <asm/ebcdic.h>
@@ -58,7 +57,6 @@ static void dasd_int_handler(struct ccw_device *, unsigned long, struct irb *);
 static void dasd_flush_ccw_queue(struct dasd_device *, int);
 static void dasd_tasklet(struct dasd_device *);
 static void do_kick_device(void *data);
-static void dasd_disable_eer(struct dasd_device *device);
 
 /*
  * SECTION: Operations on the device structure.
@@ -153,10 +151,13 @@ dasd_state_new_to_known(struct dasd_device *device)
 static inline void
 dasd_state_known_to_new(struct dasd_device * device)
 {
-        /* disable extended error reporting for this device */
-        dasd_disable_eer(device);
         /* Forget the discipline information. */
+        if (device->discipline)
+                module_put(device->discipline->owner);
         device->discipline = NULL;
+        if (device->base_discipline)
+                module_put(device->base_discipline->owner);
+        device->base_discipline = NULL;
         device->state = DASD_STATE_NEW;
 
         dasd_free_queue(device);
@@ -214,9 +215,10 @@ dasd_state_basic_to_known(struct dasd_device * device)
  * interrupt for this detection ccw uses the kernel event daemon to
  * trigger the call to dasd_change_state. All this is done in the
  * discipline code, see dasd_eckd.c.
- * After the analysis ccw is done (do_analysis returned 0 or error)
- * the block device is setup. Either a fake disk is added to allow
- * formatting or a proper device request queue is created.
+ * After the analysis ccw is done (do_analysis returned 0) the block
+ * device is setup.
+ * In case the analysis returns an error, the device setup is stopped
+ * (a fake disk was already added to allow formatting).
  */
 static inline int
 dasd_state_basic_to_ready(struct dasd_device * device)
@@ -226,13 +228,19 @@ dasd_state_basic_to_ready(struct dasd_device * device)
         rc = 0;
         if (device->discipline->do_analysis != NULL)
                 rc = device->discipline->do_analysis(device);
-        if (rc)
+        if (rc) {
+                if (rc != -EAGAIN)
+                        device->state = DASD_STATE_UNFMT;
                 return rc;
+        }
+        /* make disk known with correct capacity */
         dasd_setup_queue(device);
+        set_capacity(device->gdp, device->blocks << device->s2b_shift);
         device->state = DASD_STATE_READY;
-        if (dasd_scan_partitions(device) != 0)
+        rc = dasd_scan_partitions(device);
+        if (rc)
                 device->state = DASD_STATE_BASIC;
-        return 0;
+        return rc;
 }
 
 /*
@@ -253,6 +261,15 @@ dasd_state_ready_to_basic(struct dasd_device * device)
 }
 
 /*
+ * Back to basic.
+ */
+static inline void
+dasd_state_unfmt_to_basic(struct dasd_device * device)
+{
+        device->state = DASD_STATE_BASIC;
+}
+
+/*
  * Make the device online and schedule the bottom half to start
  * the requeueing of requests from the linux request queue to the
  * ccw queue.
@@ -318,8 +335,12 @@ dasd_decrease_state(struct dasd_device *device)
         if (device->state == DASD_STATE_READY &&
             device->target <= DASD_STATE_BASIC)
                 dasd_state_ready_to_basic(device);
-        
-        if (device->state == DASD_STATE_BASIC && 
+
+        if (device->state == DASD_STATE_UNFMT &&
+            device->target <= DASD_STATE_BASIC)
+                dasd_state_unfmt_to_basic(device);
+
+        if (device->state == DASD_STATE_BASIC &&
             device->target <= DASD_STATE_KNOWN)
                 dasd_state_basic_to_known(device);
         
@@ -871,9 +892,6 @@ dasd_handle_state_change_pending(struct dasd_device *device)
         struct dasd_ccw_req *cqr;
         struct list_head *l, *n;
 
-        /* first of all call extended error reporting */
-        dasd_write_eer_trigger(DASD_EER_STATECHANGE, device, NULL);
-
         device->stopped &= ~DASD_STOPPED_PENDING;
 
         /* restart all 'running' IO on queue */
@@ -1093,19 +1111,6 @@ restart:
                         }
                         goto restart;
                 }
-
-                /* first of all call extended error reporting */
-                if (device->eer && cqr->status == DASD_CQR_FAILED) {
-                        dasd_write_eer_trigger(DASD_EER_FATALERROR,
-                                               device, cqr);
-
-                        /* restart request  */
-                        cqr->status = DASD_CQR_QUEUED;
-                        cqr->retries = 255;
-                        device->stopped |= DASD_STOPPED_QUIESCE;
-                        goto restart;
-                }
-
                 /* Process finished ERP request. */
                 if (cqr->refers) {
                         __dasd_process_erp(device, cqr);
@@ -1243,8 +1248,7 @@ __dasd_start_head(struct dasd_device * device)
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, list);
         /* check FAILFAST */
         if (device->stopped & ~DASD_STOPPED_PENDING &&
-            test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
-            (!device->eer)) {
+            test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags)) {
                 cqr->status = DASD_CQR_FAILED;
                 dasd_schedule_bh(device);
         }
@@ -1738,7 +1742,7 @@ dasd_open(struct inode *inp, struct file *filp)
                 goto out;
         }
 
-        if (device->state < DASD_STATE_BASIC) {
+        if (device->state <= DASD_STATE_BASIC) {
                 DBF_DEV_EVENT(DBF_ERR, device, " %s",
                               " Cannot open unrecognized device");
                 rc = -ENODEV;
@@ -1880,9 +1884,10 @@ dasd_generic_remove (struct ccw_device *cdev)
  */
 int
 dasd_generic_set_online (struct ccw_device *cdev,
-                         struct dasd_discipline *discipline)
+                         struct dasd_discipline *base_discipline)
 
 {
+        struct dasd_discipline *discipline;
         struct dasd_device *device;
         int rc;
 
@@ -1890,6 +1895,7 @@ dasd_generic_set_online (struct ccw_device *cdev,
         if (IS_ERR(device))
                 return PTR_ERR(device);
 
+        discipline = base_discipline;
         if (device->features & DASD_FEATURE_USEDIAG) {
                 if (!dasd_diag_discipline_pointer) {
                         printk (KERN_WARNING
@@ -1901,6 +1907,16 @@ dasd_generic_set_online (struct ccw_device *cdev,
                 }
                 discipline = dasd_diag_discipline_pointer;
         }
+        if (!try_module_get(base_discipline->owner)) {
+                dasd_delete_device(device);
+                return -EINVAL;
+        }
+        if (!try_module_get(discipline->owner)) {
+                module_put(base_discipline->owner);
+                dasd_delete_device(device);
+                return -EINVAL;
+        }
+        device->base_discipline = base_discipline;
         device->discipline = discipline;
 
         rc = discipline->check_device(device);
@@ -1909,6 +1925,8 @@ dasd_generic_set_online (struct ccw_device *cdev,
                         "dasd_generic couldn't online device %s "
                         "with discipline %s rc=%i\n",
                         cdev->dev.bus_id, discipline->name, rc);
+                module_put(discipline->owner);
+                module_put(base_discipline->owner);
                 dasd_delete_device(device);
                 return rc;
         }
@@ -1986,9 +2004,6 @@ dasd_generic_notify(struct ccw_device *cdev, int event)
         switch (event) {
         case CIO_GONE:
         case CIO_NO_PATH:
-                /* first of all call extended error reporting */
-                dasd_write_eer_trigger(DASD_EER_NOPATH, device, NULL);
-
                 if (device->state < DASD_STATE_BASIC)
                         break;
                 /* Device is active. We want to keep it. */
@@ -2046,51 +2061,6 @@ dasd_generic_auto_online (struct ccw_driver *dasd_discipline_driver)
         put_driver(drv);
 }
 
-/*
- * notifications for extended error reports
- */
-static struct notifier_block *dasd_eer_chain;
-
-int
-dasd_register_eer_notifier(struct notifier_block *nb)
-{
-        return notifier_chain_register(&dasd_eer_chain, nb);
-}
-
-int
-dasd_unregister_eer_notifier(struct notifier_block *nb)
-{
-        return notifier_chain_unregister(&dasd_eer_chain, nb);
-}
-
-/*
- * Notify the registered error reporting module of a problem
- */
-void
-dasd_write_eer_trigger(unsigned int id, struct dasd_device *device,
-                       struct dasd_ccw_req *cqr)
-{
-        if (device->eer) {
-                struct dasd_eer_trigger temp;
-                temp.id = id;
-                temp.device = device;
-                temp.cqr = cqr;
-                notifier_call_chain(&dasd_eer_chain, DASD_EER_TRIGGER,
-                                    (void *)&temp);
-        }
-}
-
-/*
- * Tell the registered error reporting module to disable error reporting for
- * a given device and to cleanup any private data structures on that device.
- */
-static void
-dasd_disable_eer(struct dasd_device *device)
-{
-        notifier_call_chain(&dasd_eer_chain, DASD_EER_DISABLE, (void *)device);
-}
-
-
 static int __init
 dasd_init(void)
 {
@@ -2172,11 +2142,6 @@ EXPORT_SYMBOL_GPL(dasd_generic_set_online);
 EXPORT_SYMBOL_GPL(dasd_generic_set_offline);
 EXPORT_SYMBOL_GPL(dasd_generic_auto_online);
 
-EXPORT_SYMBOL(dasd_register_eer_notifier);
-EXPORT_SYMBOL(dasd_unregister_eer_notifier);
-EXPORT_SYMBOL(dasd_write_eer_trigger);
-
-
 /*
  * Overrides for Emacs so that we follow Linus's tabbing style.
  * Emacs will notice this stuff at the end of the file and automatically
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index c811380b9079..4ee0f934e325 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -1108,9 +1108,6 @@ dasd_3990_handle_env_data(struct dasd_ccw_req * erp, char *sense)
                 case 0x0B:
                         DEV_MESSAGE(KERN_WARNING, device, "%s",
                                     "FORMAT F - Volume is suspended duplex");
-                        /* call extended error reporting (EER) */
-                        dasd_write_eer_trigger(DASD_EER_PPRCSUSPEND, device,
-                                               erp->refers);
                         break;
                 case 0x0C:
                         DEV_MESSAGE(KERN_WARNING, device, "%s",
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index e15dd7978050..bc3823d35223 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -29,7 +29,6 @@
 #define DASD_ECKD_CCW_PSF                0x27
 #define DASD_ECKD_CCW_RSSD               0x3e
 #define DASD_ECKD_CCW_LOCATE_RECORD      0x47
-#define DASD_ECKD_CCW_SNSS               0x54
 #define DASD_ECKD_CCW_DEFINE_EXTENT      0x63
 #define DASD_ECKD_CCW_WRITE_MT           0x85
 #define DASD_ECKD_CCW_READ_MT            0x86
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
deleted file mode 100644
index f70cd7716b24..000000000000
--- a/drivers/s390/block/dasd_eer.c
+++ /dev/null
@@ -1,1090 +0,0 @@
-/*
- *      character device driver for extended error reporting
- *
- *
- *      Copyright (C) 2005 IBM Corporation
- *      extended error reporting for DASD ECKD devices
- *      Author(s): Stefan Weinhuber <wein@de.ibm.com>
- *
- */
-
-#include <linux/init.h>
-#include <linux/fs.h>
-#include <linux/kernel.h>
-#include <linux/miscdevice.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/device.h>
-#include <linux/workqueue.h>
-#include <linux/poll.h>
-#include <linux/notifier.h>
-
-#include <asm/uaccess.h>
-#include <asm/semaphore.h>
-#include <asm/atomic.h>
-#include <asm/ebcdic.h>
-
-#include "dasd_int.h"
-#include "dasd_eckd.h"
-
-
-MODULE_LICENSE("GPL");
-
-MODULE_AUTHOR("Stefan Weinhuber <wein@de.ibm.com>");
-MODULE_DESCRIPTION("DASD extended error reporting module");
-
-
-#ifdef PRINTK_HEADER
-#undef PRINTK_HEADER
-#endif                          /* PRINTK_HEADER */
-#define PRINTK_HEADER "dasd(eer):"
-
-
-
-
-
-/*****************************************************************************/
-/*      the internal buffer                                                  */
-/*****************************************************************************/
-
-/*
- * The internal buffer is meant to store obaque blobs of data, so it doesn't
- * know of higher level concepts like triggers.
- * It consists of a number of pages that are used as a ringbuffer. Each data
- * blob is stored in a simple record that consists of an integer, which
- * contains the size of the following data, and the data bytes themselfes.
- *
- * To allow for multiple independent readers we create one internal buffer
- * each time the device is opened and destroy the buffer when the file is
- * closed again.
- *
- * One record can be written to a buffer by using the functions
- * - dasd_eer_start_record (one time per record to write the size to the buffer
- *                          and reserve the space for the data)
- * - dasd_eer_write_buffer (one or more times per record to write the data)
- * The data can be written in several steps but you will have to compute
- * the total size up front for the invocation of dasd_eer_start_record.
- * If the ringbuffer is full, dasd_eer_start_record will remove the required
- * number of old records.
- *
- * A record is typically read in two steps, first read the integer that
- * specifies the size of the following data, then read the data.
- * Both can be done by
- * - dasd_eer_read_buffer
- *
- * For all mentioned functions you need to get the bufferlock first and keep it
- * until a complete record is written or read.
- */
-
-
-/*
- * Alle information necessary to keep track of an internal buffer is kept in
- * a struct eerbuffer. The buffer specific to a file pointer is strored in
- * the private_data field of that file. To be able to write data to all
- * existing buffers, each buffer is also added to the bufferlist.
- * If the user doesn't want to read a complete record in one go, we have to
- * keep track of the rest of the record. residual stores the number of bytes
- * that are still to deliver. If the rest of the record is invalidated between
- * two reads then residual will be set to -1 so that the next read will fail.
- * All entries in the eerbuffer structure are protected with the bufferlock.
- * To avoid races between writing to a buffer on the one side and creating
- * and destroying buffers on the other side, the bufferlock must also be used
- * to protect the bufferlist.
- */
-
-struct eerbuffer {
-        struct list_head list;
-        char **buffer;
-        int buffersize;
-        int buffer_page_count;
-        int head;
-        int tail;
-        int residual;
-};
-
-LIST_HEAD(bufferlist);
-
-static spinlock_t bufferlock = SPIN_LOCK_UNLOCKED;
-
-DECLARE_WAIT_QUEUE_HEAD(dasd_eer_read_wait_queue);
-
-/*
- * How many free bytes are available on the buffer.
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_get_free_bytes(struct eerbuffer *eerb)
-{
-        if (eerb->head < eerb->tail) {
-                return eerb->tail - eerb->head - 1;
-        } else
-                return eerb->buffersize - eerb->head + eerb->tail -1;
-}
-
-/*
- * How many bytes of buffer space are used.
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_get_filled_bytes(struct eerbuffer *eerb)
-{
-
-        if (eerb->head >= eerb->tail) {
-                return eerb->head - eerb->tail;
-        } else
-                return eerb->buffersize - eerb->tail + eerb->head;
-}
-
-/*
- * The dasd_eer_write_buffer function just copies count bytes of data
- * to the buffer. Make sure to call dasd_eer_start_record first, to
- * make sure that enough free space is available.
- * needs to be called with bufferlock held
- */
-static void
-dasd_eer_write_buffer(struct eerbuffer *eerb, int count, char *data)
-{
-
-        unsigned long headindex,localhead;
-        unsigned long rest, len;
-        char *nextdata;
-
-        nextdata = data;
-        rest = count;
-        while (rest > 0) {
-                headindex = eerb->head / PAGE_SIZE;
-                localhead = eerb->head % PAGE_SIZE;
-                len = min(rest, (PAGE_SIZE - localhead));
-                memcpy(eerb->buffer[headindex]+localhead, nextdata, len);
-                nextdata += len;
-                rest -= len;
-                eerb->head += len;
-                if ( eerb->head == eerb->buffersize )
-                        eerb->head = 0; /* wrap around */
-                if (eerb->head > eerb->buffersize) {
-                        MESSAGE(KERN_ERR, "%s", "runaway buffer head.");
-                        BUG();
-                }
-        }
-}
-
-/*
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_read_buffer(struct eerbuffer *eerb, int count, char *data)
-{
-
-        unsigned long tailindex,localtail;
-        unsigned long rest, len, finalcount;
-        char *nextdata;
-
-        finalcount = min(count, dasd_eer_get_filled_bytes(eerb));
-        nextdata = data;
-        rest = finalcount;
-        while (rest > 0) {
-                tailindex = eerb->tail / PAGE_SIZE;
-                localtail = eerb->tail % PAGE_SIZE;
-                len = min(rest, (PAGE_SIZE - localtail));
-                memcpy(nextdata, eerb->buffer[tailindex]+localtail, len);
-                nextdata += len;
-                rest -= len;
-                eerb->tail += len;
-                if ( eerb->tail == eerb->buffersize )
-                        eerb->tail = 0; /* wrap around */
-                if (eerb->tail > eerb->buffersize) {
-                        MESSAGE(KERN_ERR, "%s", "runaway buffer tail.");
-                        BUG();
-                }
-        }
-        return finalcount;
-}
-
-/*
- * Whenever you want to write a blob of data to the internal buffer you
- * have to start by using this function first. It will write the number
- * of bytes that will be written to the buffer. If necessary it will remove
- * old records to make room for the new one.
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_start_record(struct eerbuffer *eerb, int count)
-{
-        int tailcount;
-        if (count + sizeof(count) > eerb->buffersize)
-                return -ENOMEM;
-        while (dasd_eer_get_free_bytes(eerb) < count + sizeof(count)) {
-                if (eerb->residual > 0) {
-                        eerb->tail += eerb->residual;
-                        if (eerb->tail >= eerb->buffersize)
-                                eerb->tail -= eerb->buffersize;
-                        eerb->residual = -1;
-                }
-                dasd_eer_read_buffer(eerb, sizeof(tailcount),
-                                     (char*)(&tailcount));
-                eerb->tail += tailcount;
-                if (eerb->tail >= eerb->buffersize)
-                        eerb->tail -= eerb->buffersize;
-        }
-        dasd_eer_write_buffer(eerb, sizeof(count), (char*)(&count));
-
-        return 0;
-};
-
-/*
- * release pages that are not used anymore
- */
-static void
-dasd_eer_free_buffer_pages(char **buf, int no_pages)
-{
-        int i;
-
-        for (i = 0; i < no_pages; ++i) {
-                free_page((unsigned long)buf[i]);
-        }
-}
-
-/*
- * allocate a new set of memory pages
- */
-static int
-dasd_eer_allocate_buffer_pages(char **buf, int no_pages)
-{
-        int i;
-
-        for (i = 0; i < no_pages; ++i) {
-                buf[i] = (char *) get_zeroed_page(GFP_KERNEL);
-                if (!buf[i]) {
-                        dasd_eer_free_buffer_pages(buf, i);
-                        return -ENOMEM;
-                }
-        }
-        return 0;
-}
-
-/*
- * empty the buffer by resetting head and tail
- * In case there is a half read data blob in the buffer, we set residual
- * to -1 to indicate that the remainder of the blob is lost.
- */
-static void
-dasd_eer_purge_buffer(struct eerbuffer *eerb)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&bufferlock, flags);
-        if (eerb->residual > 0)
-                eerb->residual = -1;
-        eerb->tail=0;
-        eerb->head=0;
-        spin_unlock_irqrestore(&bufferlock, flags);
-}
-
-/*
- * set the size of the buffer, newsize is the new number of pages to be used
- * we don't try to copy any data back an forth, so any resize will also purge
- * the buffer
- */
-static int
-dasd_eer_resize_buffer(struct eerbuffer *eerb, int newsize)
-{
-        int i, oldcount, reuse;
-        char **new;
-        char **old;
-        unsigned long flags;
-
-        if (newsize < 1)
-                return -EINVAL;
-        if (eerb->buffer_page_count == newsize) {
-                /* documented behaviour is that any successfull invocation
-                 * will purge all records */
-                dasd_eer_purge_buffer(eerb);
-                return 0;
-        }
-        new = kmalloc(newsize*sizeof(char*), GFP_KERNEL);
-        if (!new)
-                return -ENOMEM;
-
-        reuse=min(eerb->buffer_page_count, newsize);
-        for (i = 0; i < reuse; ++i) {
-                new[i] = eerb->buffer[i];
-        }
-        if (eerb->buffer_page_count < newsize) {
-                if (dasd_eer_allocate_buffer_pages(
-                            &new[eerb->buffer_page_count],
-                            newsize - eerb->buffer_page_count)) {
-                        kfree(new);
-                        return -ENOMEM;
-                }
-        }
-
-        spin_lock_irqsave(&bufferlock, flags);
-        old = eerb->buffer;
-        eerb->buffer = new;
-        if (eerb->residual > 0)
-                eerb->residual = -1;
-        eerb->tail = 0;
-        eerb->head = 0;
-        oldcount = eerb->buffer_page_count;
-        eerb->buffer_page_count = newsize;
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        if (oldcount > newsize) {
-                for (i = newsize; i < oldcount; ++i) {
-                        free_page((unsigned long)old[i]);
-                }
-        }
-        kfree(old);
-
-        return 0;
-}
-
-
-/*****************************************************************************/
-/*      The extended error reporting functionality                           */
-/*****************************************************************************/
-
-/*
- * When a DASD device driver wants to report an error, it calls the
- * function dasd_eer_write_trigger (via a notifier mechanism) and gives the
- * respective trigger ID as parameter.
- * Currently there are four kinds of triggers:
- *
- * DASD_EER_FATALERROR:  all kinds of unrecoverable I/O problems
- * DASD_EER_PPRCSUSPEND: PPRC was suspended
- * DASD_EER_NOPATH:      There is no path to the device left.
- * DASD_EER_STATECHANGE: The state of the device has changed.
- *
- * For the first three triggers all required information can be supplied by
- * the caller. For these triggers a record is written by the function
- * dasd_eer_write_standard_trigger.
- *
- * When dasd_eer_write_trigger is called to write a DASD_EER_STATECHANGE
- * trigger, we have to gather the necessary sense data first. We cannot queue
- * the necessary SNSS (sense subsystem status) request immediatly, since we
- * are likely to run in a deadlock situation. Instead, we schedule a
- * work_struct that calls the function dasd_eer_sense_subsystem_status to
- * create and start an SNSS  request asynchronously.
- *
- * To avoid memory allocations at runtime, the necessary memory is allocated
- * when the extended error reporting is enabled for a device (by
- * dasd_eer_probe). There is one private eer data structure for each eer
- * enabled DASD device. It contains memory for the work_struct, one SNSS cqr
- * and a flags field that is used to coordinate the use of the cqr. The call
- * to write a state change trigger can come in at any time, so we have one flag
- * CQR_IN_USE that protects the cqr itself. When this flag indicates that the
- * cqr is currently in use, dasd_eer_sense_subsystem_status cannot start a
- * second request but sets the SNSS_REQUESTED flag instead.
- *
- * When the request is finished, the callback function dasd_eer_SNSS_cb
- * is called. This function will invoke the function
- * dasd_eer_write_SNSS_trigger to finally write the trigger. It will also
- * check the SNSS_REQUESTED flag and if it is set it will call
- * dasd_eer_sense_subsystem_status again.
- *
- * To avoid race conditions during the handling of the lock, the flags must
- * be protected by the snsslock.
- */
-
-struct dasd_eer_private {
-        struct dasd_ccw_req *cqr;
-        unsigned long flags;
-        struct work_struct worker;
-};
-
-static void dasd_eer_destroy(struct dasd_device *device,
-                             struct dasd_eer_private *eer);
-static int
-dasd_eer_write_trigger(struct dasd_eer_trigger *trigger);
-static void dasd_eer_sense_subsystem_status(void *data);
-static int dasd_eer_notify(struct notifier_block *self,
-                           unsigned long action, void *data);
-
-struct workqueue_struct *dasd_eer_workqueue;
-
-#define SNSS_DATA_SIZE 44
-static spinlock_t snsslock = SPIN_LOCK_UNLOCKED;
-
-#define DASD_EER_BUSID_SIZE 10
-struct dasd_eer_header {
-        __u32 total_size;
-        __u32 trigger;
-        __u64 tv_sec;
-        __u64 tv_usec;
-        char busid[DASD_EER_BUSID_SIZE];
-} __attribute__ ((packed));
-
-static struct notifier_block dasd_eer_nb = {
-        .notifier_call = dasd_eer_notify,
-};
-
-/*
- * flags for use with dasd_eer_private
- */
-#define CQR_IN_USE     0
-#define SNSS_REQUESTED 1
-
-/*
- * This function checks if extended error reporting is available for a given
- * dasd_device. If yes, then it creates and returns a struct dasd_eer,
- * otherwise it returns an -EPERM error pointer.
- */
-struct dasd_eer_private *
-dasd_eer_probe(struct dasd_device *device)
-{
-        struct dasd_eer_private *private;
-
-        if (!(device && device->discipline
-              && !strcmp(device->discipline->name, "ECKD"))) {
-                return ERR_PTR(-EPERM);
-        }
-        /* allocate the private data structure */
-        private = (struct dasd_eer_private *)kmalloc(
-                sizeof(struct dasd_eer_private), GFP_KERNEL);
-        if (!private) {
-                return ERR_PTR(-ENOMEM);
-        }
-        INIT_WORK(&private->worker, dasd_eer_sense_subsystem_status,
-                  (void *)device);
-        private->cqr = dasd_kmalloc_request("ECKD",
-                                            1 /* SNSS */ ,
-                                            SNSS_DATA_SIZE ,
-                                            device);
-        if (!private->cqr) {
-                kfree(private);
-                return ERR_PTR(-ENOMEM);
-        }
-        private->flags = 0;
-        return private;
-};
-
-/*
- * If our private SNSS request is queued, remove it from the
- * dasd ccw queue so we can free the requests memory.
- */
-static void
-dasd_eer_dequeue_SNSS_request(struct dasd_device *device,
-                              struct dasd_eer_private *eer)
-{
-        struct list_head *lst, *nxt;
-        struct dasd_ccw_req *cqr, *erpcqr;
-        dasd_erp_fn_t erp_fn;
-
-        spin_lock_irq(get_ccwdev_lock(device->cdev));
-        list_for_each_safe(lst, nxt, &device->ccw_queue) {
-                cqr = list_entry(lst, struct dasd_ccw_req, list);
-                /* we are looking for two kinds or requests */
-                /* first kind: our SNSS request: */
-                if (cqr == eer->cqr) {
-                        if (cqr->status == DASD_CQR_IN_IO)
-                                device->discipline->term_IO(cqr);
-                        list_del(&cqr->list);
-                        break;
-                }
-                /* second kind: ERP requests for our SNSS request */
-                if (cqr->refers) {
-                        /* If this erp request chain ends in our cqr, then */
-                        /* cal the erp_postaction to clean it up  */
-                        erpcqr = cqr;
-                        while (erpcqr->refers) {
-                                erpcqr = erpcqr->refers;
-                        }
-                        if (erpcqr == eer->cqr) {
-                                erp_fn = device->discipline->erp_postaction(
-                                         cqr);
-                                erp_fn(cqr);
-                        }
-                        continue;
-                }
-        }
-        spin_unlock_irq(get_ccwdev_lock(device->cdev));
-}
-
-/*
- * This function dismantles a struct dasd_eer that was created by
- * dasd_eer_probe. Since we want to free our private data structure,
- * we must make sure that the memory is not in use anymore.
- * We have to flush the work queue and remove a possible SNSS request
- * from the dasd queue.
- */
-static void
-dasd_eer_destroy(struct dasd_device *device, struct dasd_eer_private *eer)
-{
-        flush_workqueue(dasd_eer_workqueue);
-        dasd_eer_dequeue_SNSS_request(device, eer);
-        dasd_kfree_request(eer->cqr, device);
-        kfree(eer);
-};
-
-/*
- * enable the extended error reporting for a particular device
- */
-static int
-dasd_eer_enable_on_device(struct dasd_device *device)
-{
-        void *eer;
-        if (!device)
-                return -ENODEV;
-        if (device->eer)
-                return 0;
-        if (!try_module_get(THIS_MODULE)) {
-                return -EINVAL;
-        }
-        eer = (void *)dasd_eer_probe(device);
-        if (IS_ERR(eer)) {
-                module_put(THIS_MODULE);
-                return PTR_ERR(eer);
-        }
-        device->eer = eer;
-        return 0;
-}
-
-/*
- * enable the extended error reporting for a particular device
- */
-static int
-dasd_eer_disable_on_device(struct dasd_device *device)
-{
-        struct dasd_eer_private *eer = device->eer;
-
-        if (!device)
-                return -ENODEV;
-        if (!device->eer)
-                return 0;
-        device->eer = NULL;
-        dasd_eer_destroy(device,eer);
-        module_put(THIS_MODULE);
-
-        return 0;
-}
-
-/*
- * Set extended error reporting (eer)
- * Note: This will be registered as a DASD ioctl, to be called on DASD devices.
- */
-static int
-dasd_ioctl_set_eer(struct block_device *bdev, int no, long args)
-{
-        struct dasd_device *device;
-        int intval;
-
-        if (!capable(CAP_SYS_ADMIN))
-                return -EACCES;
-        if (bdev != bdev->bd_contains)
-                /* Error-reporting is not allowed for partitions */
-                return -EINVAL;
-        if (get_user(intval, (int __user *) args))
-                return -EFAULT;
-        device =  bdev->bd_disk->private_data;
-        if (device == NULL)
-                return -ENODEV;
-
-        intval = (intval != 0);
-        DEV_MESSAGE (KERN_DEBUG, device,
-                     "set eer on device to %d", intval);
-        if (intval)
-                return dasd_eer_enable_on_device(device);
-        else
-                return dasd_eer_disable_on_device(device);
-}
-
-/*
- * Get value of extended error reporting.
- * Note: This will be registered as a DASD ioctl, to be called on DASD devices.
- */
-static int
-dasd_ioctl_get_eer(struct block_device *bdev, int no, long args)
-{
-        struct dasd_device *device;
-
-        device =  bdev->bd_disk->private_data;
-        if (device == NULL)
-                return -ENODEV;
-        return put_user((device->eer != NULL), (int __user *) args);
-}
-
-/*
- * The following function can be used for those triggers that have
- * all necessary data available when the function is called.
- * If the parameter cqr is not NULL, the chain of requests will be searched
- * for valid sense data, and all valid sense data sets will be added to
- * the triggers data.
- */
-static int
-dasd_eer_write_standard_trigger(int trigger, struct dasd_device *device,
-                                struct dasd_ccw_req *cqr)
-{
-        struct dasd_ccw_req *temp_cqr;
-        int data_size;
-        struct timeval tv;
-        struct dasd_eer_header header;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        /* go through cqr chain and count the valid sense data sets */
-        temp_cqr = cqr;
-        data_size = 0;
-        while (temp_cqr) {
-                if (temp_cqr->irb.esw.esw0.erw.cons)
-                        data_size += 32;
-                temp_cqr = temp_cqr->refers;
-        }
-
-        header.total_size = sizeof(header) + data_size + 4; /* "EOR" */
-        header.trigger = trigger;
-        do_gettimeofday(&tv);
-        header.tv_sec = tv.tv_sec;
-        header.tv_usec = tv.tv_usec;
-        strncpy(header.busid, device->cdev->dev.bus_id, DASD_EER_BUSID_SIZE);
-
-        spin_lock_irqsave(&bufferlock, flags);
-        list_for_each_entry(eerb, &bufferlist, list) {
-                dasd_eer_start_record(eerb, header.total_size);
-                dasd_eer_write_buffer(eerb, sizeof(header), (char*)(&header));
-                temp_cqr = cqr;
-                while (temp_cqr) {
-                        if (temp_cqr->irb.esw.esw0.erw.cons)
-                                dasd_eer_write_buffer(eerb, 32, cqr->irb.ecw);
-                        temp_cqr = temp_cqr->refers;
-                }
-                dasd_eer_write_buffer(eerb, 4,"EOR");
-        }
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        wake_up_interruptible(&dasd_eer_read_wait_queue);
-
-        return 0;
-}
-
-/*
- * This function writes a DASD_EER_STATECHANGE trigger.
- */
-static void
-dasd_eer_write_SNSS_trigger(struct dasd_device *device,
-                            struct dasd_ccw_req *cqr)
-{
-        int data_size;
-        int snss_rc;
-        struct timeval tv;
-        struct dasd_eer_header header;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        snss_rc = (cqr->status == DASD_CQR_FAILED) ? -EIO : 0;
-        if (snss_rc)
-                data_size = 0;
-        else
-                data_size = SNSS_DATA_SIZE;
-
-        header.total_size = sizeof(header) + data_size + 4; /* "EOR" */
-        header.trigger = DASD_EER_STATECHANGE;
-        do_gettimeofday(&tv);
-        header.tv_sec = tv.tv_sec;
-        header.tv_usec = tv.tv_usec;
-        strncpy(header.busid, device->cdev->dev.bus_id, DASD_EER_BUSID_SIZE);
-
-        spin_lock_irqsave(&bufferlock, flags);
-        list_for_each_entry(eerb, &bufferlist, list) {
-                dasd_eer_start_record(eerb, header.total_size);
-                dasd_eer_write_buffer(eerb, sizeof(header),(char*)(&header));
-                if (!snss_rc)
-                        dasd_eer_write_buffer(eerb, SNSS_DATA_SIZE, cqr->data);
-                dasd_eer_write_buffer(eerb, 4,"EOR");
-        }
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        wake_up_interruptible(&dasd_eer_read_wait_queue);
-}
-
-/*
- * callback function for use with SNSS request
- */
-static void
-dasd_eer_SNSS_cb(struct dasd_ccw_req *cqr, void *data)
-{
-        struct dasd_device *device;
-        struct dasd_eer_private *private;
-        unsigned long irqflags;
-
-        device = (struct dasd_device *)data;
-        private = (struct dasd_eer_private *)device->eer;
-        dasd_eer_write_SNSS_trigger(device, cqr);
-        spin_lock_irqsave(&snsslock, irqflags);
-        if(!test_and_clear_bit(SNSS_REQUESTED, &private->flags)) {
-                clear_bit(CQR_IN_USE, &private->flags);
-                spin_unlock_irqrestore(&snsslock, irqflags);
-                return;
-        };
-        clear_bit(CQR_IN_USE, &private->flags);
-        spin_unlock_irqrestore(&snsslock, irqflags);
-        dasd_eer_sense_subsystem_status(device);
-        return;
-}
-
-/*
- * clean a used cqr before using it again
- */
-static void
-dasd_eer_clean_SNSS_request(struct dasd_ccw_req *cqr)
-{
-        struct ccw1 *cpaddr = cqr->cpaddr;
-        void *data = cqr->data;
-
-        memset(cqr, 0, sizeof(struct dasd_ccw_req));
-        memset(cpaddr, 0, sizeof(struct ccw1));
-        memset(data, 0, SNSS_DATA_SIZE);
-        cqr->cpaddr = cpaddr;
-        cqr->data = data;
-        strncpy((char *) &cqr->magic, "ECKD", 4);
-        ASCEBC((char *) &cqr->magic, 4);
-        set_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
-}
-
-/*
- * build and start an SNSS request
- * This function is called from a work queue so we have to
- * pass the dasd_device pointer as a void pointer.
- */
-static void
-dasd_eer_sense_subsystem_status(void *data)
-{
-        struct dasd_device *device;
-        struct dasd_eer_private *private;
-        struct dasd_ccw_req *cqr;
-        struct ccw1 *ccw;
-        unsigned long irqflags;
-
-        device = (struct dasd_device *)data;
-        private = (struct dasd_eer_private *)device->eer;
-        if (!private) /* device not eer enabled any more */
-                return;
-        cqr = private->cqr;
-        spin_lock_irqsave(&snsslock, irqflags);
-        if(test_and_set_bit(CQR_IN_USE, &private->flags)) {
-                set_bit(SNSS_REQUESTED, &private->flags);
-                spin_unlock_irqrestore(&snsslock, irqflags);
-                return;
-        };
-        spin_unlock_irqrestore(&snsslock, irqflags);
-        dasd_eer_clean_SNSS_request(cqr);
-        cqr->device = device;
-        cqr->retries = 255;
-        cqr->expires = 10 * HZ;
-
-        ccw = cqr->cpaddr;
-        ccw->cmd_code = DASD_ECKD_CCW_SNSS;
-        ccw->count = SNSS_DATA_SIZE;
-        ccw->flags = 0;
-        ccw->cda = (__u32)(addr_t)cqr->data;
-
-        cqr->buildclk = get_clock();
-        cqr->status = DASD_CQR_FILLED;
-        cqr->callback = dasd_eer_SNSS_cb;
-        cqr->callback_data = (void *)device;
-        dasd_add_request_head(cqr);
-
-        return;
-}
-
-/*
- * This function is called for all triggers. It calls the appropriate
- * function that writes the actual trigger records.
- */
-static int
-dasd_eer_write_trigger(struct dasd_eer_trigger *trigger)
-{
-        int rc;
-        struct dasd_eer_private *private = trigger->device->eer;
-
-        switch (trigger->id) {
-        case DASD_EER_FATALERROR:
-        case DASD_EER_PPRCSUSPEND:
-                rc = dasd_eer_write_standard_trigger(
-                        trigger->id, trigger->device, trigger->cqr);
-                break;
-        case DASD_EER_NOPATH:
-                rc = dasd_eer_write_standard_trigger(
-                        trigger->id, trigger->device, NULL);
-                break;
-        case DASD_EER_STATECHANGE:
-                if (queue_work(dasd_eer_workqueue, &private->worker)) {
-                        rc=0;
-                } else {
-                        /* If the work_struct was already queued, it can't
-                         * be queued again. But this is OK since we don't
-                         * need to have it queued twice.
-                         */
-                        rc = -EBUSY;
-                }
-                break;
-        default: /* unknown trigger, so we write it without any sense data */
-                rc = dasd_eer_write_standard_trigger(
-                        trigger->id, trigger->device, NULL);
-                break;
-        }
-        return rc;
-}
-
-/*
- * This function is registered with the dasd device driver and gets called
- * for all dasd eer notifications.
- */
-static int dasd_eer_notify(struct notifier_block *self,
-                            unsigned long action, void *data)
-{
-        switch (action) {
-        case DASD_EER_DISABLE:
-                dasd_eer_disable_on_device((struct dasd_device *)data);
-                break;
-        case DASD_EER_TRIGGER:
-                dasd_eer_write_trigger((struct dasd_eer_trigger *)data);
-                break;
-        }
-        return NOTIFY_OK;
-}
-
-
-/*****************************************************************************/
-/*      the device operations                                                */
-/*****************************************************************************/
-
-/*
- * On the one side we need a lock to access our internal buffer, on the
- * other side a copy_to_user can sleep. So we need to copy the data we have
- * to transfer in a readbuffer, which is protected by the readbuffer_mutex.
- */
-static char readbuffer[PAGE_SIZE];
-DECLARE_MUTEX(readbuffer_mutex);
-
-
-static int
-dasd_eer_open(struct inode *inp, struct file *filp)
-{
-        struct eerbuffer *eerb;
-        unsigned long flags;
-
-        eerb = kmalloc(sizeof(struct eerbuffer), GFP_KERNEL);
-        eerb->head = 0;
-        eerb->tail = 0;
-        eerb->residual = 0;
-        eerb->buffer_page_count = 1;
-        eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE;
-        eerb->buffer = kmalloc(eerb->buffer_page_count*sizeof(char*),
-                               GFP_KERNEL);
-        if (!eerb->buffer)
-                return -ENOMEM;
-        if (dasd_eer_allocate_buffer_pages(eerb->buffer,
-                                           eerb->buffer_page_count)) {
-                kfree(eerb->buffer);
-                return -ENOMEM;
-        }
-        filp->private_data = eerb;
-        spin_lock_irqsave(&bufferlock, flags);
-        list_add(&eerb->list, &bufferlist);
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        return nonseekable_open(inp,filp);
-}
-
-static int
-dasd_eer_close(struct inode *inp, struct file *filp)
-{
-        struct eerbuffer *eerb;
-        unsigned long flags;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        spin_lock_irqsave(&bufferlock, flags);
-        list_del(&eerb->list);
-        spin_unlock_irqrestore(&bufferlock, flags);
-        dasd_eer_free_buffer_pages(eerb->buffer, eerb->buffer_page_count);
-        kfree(eerb->buffer);
-        kfree(eerb);
-
-        return 0;
-}
-
-static long
-dasd_eer_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-{
-        int intval;
-        struct eerbuffer *eerb;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        switch (cmd) {
-        case DASD_EER_PURGE:
-                dasd_eer_purge_buffer(eerb);
-                return 0;
-        case DASD_EER_SETBUFSIZE:
-                if (get_user(intval, (int __user *)arg))
-                        return -EFAULT;
-                return dasd_eer_resize_buffer(eerb, intval);
-        default:
-                return -ENOIOCTLCMD;
-        }
-}
-
-static ssize_t
-dasd_eer_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
-{
-        int tc,rc;
-        int tailcount,effective_count;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        if(down_interruptible(&readbuffer_mutex))
-                return -ERESTARTSYS;
-
-        spin_lock_irqsave(&bufferlock, flags);
-
-        if (eerb->residual < 0) { /* the remainder of this record */
-                                  /* has been deleted             */
-                eerb->residual = 0;
-                spin_unlock_irqrestore(&bufferlock, flags);
-                up(&readbuffer_mutex);
-                return -EIO;
-        } else if (eerb->residual > 0) {
-                /* OK we still have a second half of a record to deliver */
-                effective_count = min(eerb->residual, (int)count);
-                eerb->residual -= effective_count;
-        } else {
-                tc = 0;
-                while (!tc) {
-                        tc = dasd_eer_read_buffer(eerb,
-                                sizeof(tailcount), (char*)(&tailcount));
-                        if (!tc) {
-                                /* no data available */
-                                spin_unlock_irqrestore(&bufferlock, flags);
-                                up(&readbuffer_mutex);
-                                if (filp->f_flags & O_NONBLOCK)
-                                        return -EAGAIN;
-                                rc = wait_event_interruptible(
-                                        dasd_eer_read_wait_queue,
-                                        eerb->head != eerb->tail);
-                                if (rc) {
-                                        return rc;
-                                }
-                                if(down_interruptible(&readbuffer_mutex))
-                                        return -ERESTARTSYS;
-                                spin_lock_irqsave(&bufferlock, flags);
-                        }
-                }
-                WARN_ON(tc != sizeof(tailcount));
-                effective_count = min(tailcount,(int)count);
-                eerb->residual = tailcount - effective_count;
-        }
-
-        tc = dasd_eer_read_buffer(eerb, effective_count, readbuffer);
-        WARN_ON(tc != effective_count);
-
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        if (copy_to_user(buf, readbuffer, effective_count)) {
-                up(&readbuffer_mutex);
-                return -EFAULT;
-        }
-
-        up(&readbuffer_mutex);
-        return effective_count;
-}
-
-static unsigned int
-dasd_eer_poll (struct file *filp, poll_table *ptable)
-{
-        unsigned int mask;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        poll_wait(filp, &dasd_eer_read_wait_queue, ptable);
-        spin_lock_irqsave(&bufferlock, flags);
-        if (eerb->head != eerb->tail)
-                mask = POLLIN | POLLRDNORM ;
-        else
-                mask = 0;
-        spin_unlock_irqrestore(&bufferlock, flags);
-        return mask;
-}
-
-static struct file_operations dasd_eer_fops = {
-        .open           = &dasd_eer_open,
-        .release        = &dasd_eer_close,
-        .unlocked_ioctl = &dasd_eer_ioctl,
-        .compat_ioctl   = &dasd_eer_ioctl,
-        .read           = &dasd_eer_read,
-        .poll           = &dasd_eer_poll,
-        .owner          = THIS_MODULE,
-};
-
-static struct miscdevice dasd_eer_dev = {
-        .minor      = MISC_DYNAMIC_MINOR,
-        .name       = "dasd_eer",
-        .fops       = &dasd_eer_fops,
-};
-
-
-/*****************************************************************************/
-/*      Init and exit                                                        */
-/*****************************************************************************/
-
-static int
-__init dasd_eer_init(void)
-{
-        int rc;
-
-        dasd_eer_workqueue = create_singlethread_workqueue("dasd_eer");
-        if (!dasd_eer_workqueue) {
-                MESSAGE(KERN_ERR , "%s", "dasd_eer_init could not "
-                       "create workqueue \n");
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        rc = dasd_register_eer_notifier(&dasd_eer_nb);
-        if (rc) {
-                MESSAGE(KERN_ERR, "%s", "dasd_eer_init could not "
-                       "register error reporting");
-                goto queue;
-        }
-
-        dasd_ioctl_no_register(THIS_MODULE, BIODASDEERSET, dasd_ioctl_set_eer);
-        dasd_ioctl_no_register(THIS_MODULE, BIODASDEERGET, dasd_ioctl_get_eer);
-
-        /* we don't need our own character device,
-         * so we just register as misc device */
-        rc = misc_register(&dasd_eer_dev);
-        if (rc) {
-                MESSAGE(KERN_ERR, "%s", "dasd_eer_init could not "
-                       "register misc device");
-                goto unregister;
-        }
-
-        return 0;
-
-unregister:
-        dasd_unregister_eer_notifier(&dasd_eer_nb);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERSET,
-                                 dasd_ioctl_set_eer);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERGET,
-                                 dasd_ioctl_get_eer);
-queue:
-        destroy_workqueue(dasd_eer_workqueue);
-out:
-        return rc;
-
-}
-module_init(dasd_eer_init);
-
-static void
-__exit dasd_eer_exit(void)
-{
-        dasd_unregister_eer_notifier(&dasd_eer_nb);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERSET,
-                                 dasd_ioctl_set_eer);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERGET,
-                                 dasd_ioctl_get_eer);
-        destroy_workqueue(dasd_eer_workqueue);
-
-        WARN_ON(misc_deregister(&dasd_eer_dev) != 0);
-}
-module_exit(dasd_eer_exit);
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 65dc844b975c..fce2835e7d19 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -100,8 +100,6 @@ dasd_scan_partitions(struct dasd_device * device)
 {
         struct block_device *bdev;
 
-        /* Make the disk known. */
-        set_capacity(device->gdp, device->blocks << device->s2b_shift);
         bdev = bdget_disk(device->gdp, 0);
         if (!bdev || blkdev_get(bdev, FMODE_READ, 1) < 0)
                 return -ENODEV;
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index d1b08fa13fd2..7cb0b9e78a6a 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -26,7 +26,7 @@
  *   new: the dasd_device structure is allocated.
  *   known: the discipline for the device is identified.
  *   basic: the device can do basic i/o.
- *   accept: the device is analysed (format is known).
+ *   unfmt: the device could not be analyzed (format is unknown).
  *   ready: partition detection is done and the device is can do block io.
  *   online: the device accepts requests from the block device queue.
  *
@@ -47,8 +47,9 @@
 #define DASD_STATE_NEW    0
 #define DASD_STATE_KNOWN  1
 #define DASD_STATE_BASIC  2
-#define DASD_STATE_READY  3
-#define DASD_STATE_ONLINE 4
+#define DASD_STATE_UNFMT  3
+#define DASD_STATE_READY  4
+#define DASD_STATE_ONLINE 5
 
 #include <linux/module.h>
 #include <linux/wait.h>
@@ -275,34 +276,6 @@ struct dasd_discipline {
 
 extern struct dasd_discipline *dasd_diag_discipline_pointer;
 
-
-/*
- * Notification numbers for extended error reporting notifications:
- * The DASD_EER_DISABLE notification is sent before a dasd_device (and it's
- * eer pointer) is freed. The error reporting module needs to do all necessary
- * cleanup steps.
- * The DASD_EER_TRIGGER notification sends the actual error reports (triggers).
- */
-#define DASD_EER_DISABLE 0
-#define DASD_EER_TRIGGER 1
-
-/* Trigger IDs for extended error reporting DASD_EER_TRIGGER notification */
-#define DASD_EER_FATALERROR  1
-#define DASD_EER_NOPATH      2
-#define DASD_EER_STATECHANGE 3
-#define DASD_EER_PPRCSUSPEND 4
-
-/*
- * The dasd_eer_trigger structure contains all data that we need to send
- * along with an DASD_EER_TRIGGER notification.
- */
-struct dasd_eer_trigger {
-        unsigned int id;
-        struct dasd_device *device;
-        struct dasd_ccw_req *cqr;
-};
-
-
 struct dasd_device {
         /* Block device stuff. */
         struct gendisk *gdp;
@@ -316,11 +289,9 @@ struct dasd_device {
         unsigned long flags;            /* per device flags */
         unsigned short features;        /* copy of devmap-features (read-only!) */
 
-        /* extended error reporting stuff (eer) */
-        void *eer;
-
         /* Device discipline stuff. */
         struct dasd_discipline *discipline;
+        struct dasd_discipline *base_discipline;
         char *private;
 
         /* Device state and target state. */
@@ -519,12 +490,6 @@ int dasd_generic_set_online(struct ccw_device *, struct dasd_discipline *);
 int dasd_generic_set_offline (struct ccw_device *cdev);
 int dasd_generic_notify(struct ccw_device *, int);
 void dasd_generic_auto_online (struct ccw_driver *);
-int dasd_register_eer_notifier(struct notifier_block *);
-int dasd_unregister_eer_notifier(struct notifier_block *);
-void dasd_write_eer_trigger(unsigned int , struct dasd_device *,
-                        struct dasd_ccw_req *);
-
-
 
 /* externals in dasd_devmap.c */
 extern int dasd_max_devindex;
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 2d5da3c75ca7..1aa3c261718a 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -93,6 +93,9 @@ dasd_devices_show(struct seq_file *m, void *v)
         case DASD_STATE_BASIC:
                 seq_printf(m, "basic");
                 break;
+        case DASD_STATE_UNFMT:
+                seq_printf(m, "unformatted");
+                break;
         case DASD_STATE_READY:
         case DASD_STATE_ONLINE:
                 seq_printf(m, "active ");
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index ceb0e474fde4..4138564402b8 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -85,11 +85,10 @@ static volatile enum sclp_mask_state_t {
 /* Maximum retry counts */
 #define SCLP_INIT_RETRY         3
 #define SCLP_MASK_RETRY         3
-#define SCLP_REQUEST_RETRY      3
 
 /* Timeout intervals in seconds.*/
-#define SCLP_BUSY_INTERVAL      2
-#define SCLP_RETRY_INTERVAL     5
+#define SCLP_BUSY_INTERVAL      10
+#define SCLP_RETRY_INTERVAL     15
 
 static void sclp_process_queue(void);
 static int sclp_init_mask(int calculate);
@@ -153,11 +152,9 @@ __sclp_start_request(struct sclp_req *req)
         if (sclp_running_state != sclp_running_state_idle)
                 return 0;
         del_timer(&sclp_request_timer);
-        if (req->start_count <= SCLP_REQUEST_RETRY) {
-                rc = service_call(req->command, req->sccb);
-                req->start_count++;
-        } else
-                rc = -EIO;
+        rc = service_call(req->command, req->sccb);
+        req->start_count++;
+
         if (rc == 0) {
                 /* Sucessfully started request */
                 req->status = SCLP_REQ_RUNNING;
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 92be75d99a56..f4183d660258 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -232,7 +232,7 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
                 return 0;
 
         mask = 0x80 >> j;
-        spin_lock(&sch->lock);
+        spin_lock_irq(&sch->lock);
 
         stsch(sch->schid, &schib);
         if (!schib.pmcw.dnv)
@@ -281,10 +281,10 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         if (sch->driver && sch->driver->verify)
                 sch->driver->verify(&sch->dev);
 out_unlock:
-        spin_unlock(&sch->lock);
+        spin_unlock_irq(&sch->lock);
         return 0;
 out_unreg:
-        spin_unlock(&sch->lock);
+        spin_unlock_irq(&sch->lock);
         sch->lpm = 0;
         if (css_enqueue_subchannel_slow(sch->schid)) {
                 css_clear_subchannel_slow_list();
@@ -652,7 +652,7 @@ __chp_add(struct subchannel_id schid, void *data)
         if (!sch)
                 /* Check if the subchannel is now available. */
                 return __chp_add_new_sch(schid);
-        spin_lock(&sch->lock);
+        spin_lock_irq(&sch->lock);
         for (i=0; i<8; i++)
                 if (sch->schib.pmcw.chpid[i] == chp->id) {
                         if (stsch(sch->schid, &sch->schib) != 0) {
@@ -674,7 +674,7 @@ __chp_add(struct subchannel_id schid, void *data)
         if (sch->driver && sch->driver->verify)
                 sch->driver->verify(&sch->dev);
 
-        spin_unlock(&sch->lock);
+        spin_unlock_irq(&sch->lock);
         put_device(&sch->dev);
         return 0;
 }
@@ -1115,6 +1115,9 @@ chsc_enable_facility(int operation_code)
                 goto out;
         }
         switch (sda_area->response.code) {
+        case 0x0001: /* everything ok */
+                ret = 0;
+                break;
         case 0x0003: /* invalid request block */
         case 0x0007:
                 ret = -EINVAL;
@@ -1123,6 +1126,8 @@ chsc_enable_facility(int operation_code)
         case 0x0101: /* facility not provided */
                 ret = -EOPNOTSUPP;
                 break;
+        default: /* something went wrong */
+                ret = -EIO;
         }
  out:
         free_page((unsigned long)sda_area);
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 1bbf231f8aaf..3c77d65960db 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -409,6 +409,9 @@ __init_channel_subsystem(struct subchannel_id schid, void *data)
                 /* -ENXIO: no more subchannels. */
                 case -ENXIO:
                         return ret;
+                /* -EIO: this subchannel set not supported. */
+                case -EIO:
+                        return ret;
                 default:
                         return 0;
                 }
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 062fb100d94c..afc4e88551ad 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -359,7 +359,7 @@ ccw_device_set_online(struct ccw_device *cdev)
         else 
                 pr_debug("ccw_device_offline returned %d, device %s\n",
                          ret, cdev->dev.bus_id);
-        return (ret = 0) ? -ENODEV : ret;
+        return (ret == 0) ? -ENODEV : ret;
 }
 
 static ssize_t
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index d2a5b04d7cba..85b1020a1fcc 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -405,7 +405,7 @@ __ccw_device_disband_start(struct ccw_device *cdev)
                 cdev->private->iretry = 5;
                 cdev->private->imask >>= 1;
         }
-        ccw_device_verify_done(cdev, (sch->lpm != 0) ? 0 : -ENODEV);
+        ccw_device_disband_done(cdev, (sch->lpm != 0) ? 0 : -ENODEV);
 }
 
 /*
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index dad4dd9887c9..6c762b43f921 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -317,7 +317,6 @@ ccw_device_do_sense(struct ccw_device *cdev, struct irb *irb)
         /*
          * We have ending status but no sense information. Do a basic sense.
          */
-        sch = to_subchannel(cdev->dev.parent);
         sch->sense_ccw.cmd_code = CCW_CMD_BASIC_SENSE;
         sch->sense_ccw.cda = (__u32) __pa(cdev->private->irb.ecw);
         sch->sense_ccw.count = SENSE_MAX_COUNT;
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 45ce032772f4..9ed37dc9a1b0 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -165,8 +165,13 @@ qdio_do_eqbs(struct qdio_q *q, unsigned char *state,
         q_no = q->q_no;
         if(!q->is_input_q)
                 q_no += irq->no_input_qs;
+again:
         ccq = do_eqbs(irq->sch_token, state, q_no, start, cnt);
         rc = qdio_check_ccq(q, ccq);
+        if (rc == 1) {
+                QDIO_DBF_TEXT5(1,trace,"eqAGAIN");
+                goto again;
+        }
         if (rc < 0) {
                 QDIO_DBF_TEXT2(1,trace,"eqberr");
                 sprintf(dbf_text,"%2x,%2x,%d,%d",tmp_cnt, *cnt, ccq, q_no);
@@ -195,8 +200,13 @@ qdio_do_sqbs(struct qdio_q *q, unsigned char state,
         q_no = q->q_no;
         if(!q->is_input_q)
                 q_no += irq->no_input_qs;
+again:
         ccq = do_sqbs(irq->sch_token, state, q_no, start, cnt);
         rc = qdio_check_ccq(q, ccq);
+        if (rc == 1) {
+                QDIO_DBF_TEXT5(1,trace,"sqAGAIN");
+                goto again;
+        }
         if (rc < 0) {
                 QDIO_DBF_TEXT3(1,trace,"sqberr");
                 sprintf(dbf_text,"%2x,%2x,%d,%d",tmp_cnt,*cnt,ccq,q_no);
@@ -1187,8 +1197,7 @@ tiqdio_is_inbound_q_done(struct qdio_q *q)
 
         if (!no_used)
                 return 1;
-
-        if (!q->siga_sync)
+        if (!q->siga_sync && !irq->is_qebsm)
                 /* we'll check for more primed buffers in qeth_stop_polling */
                 return 0;
         if (irq->is_qebsm) {
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 6229ba4995ad..9cf88d7201d3 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -98,9 +98,9 @@ lcs_register_debug_facility(void)
                 return -ENOMEM;
         }
         debug_register_view(lcs_dbf_setup, &debug_hex_ascii_view);
-        debug_set_level(lcs_dbf_setup, 4);
+        debug_set_level(lcs_dbf_setup, 2);
         debug_register_view(lcs_dbf_trace, &debug_hex_ascii_view);
-        debug_set_level(lcs_dbf_trace, 4);
+        debug_set_level(lcs_dbf_trace, 2);
         return 0;
 }
 
@@ -1292,9 +1292,8 @@ lcs_set_multicast_list(struct net_device *dev)
         LCS_DBF_TEXT(4, trace, "setmulti");
         card = (struct lcs_card *) dev->priv;
 
-        if (!lcs_set_thread_start_bit(card, LCS_SET_MC_THREAD)) {
+        if (!lcs_set_thread_start_bit(card, LCS_SET_MC_THREAD)) 
                 schedule_work(&card->kernel_thread_starter);
-        }
 }
 
 #endif /* CONFIG_IP_MULTICAST */
@@ -1459,6 +1458,8 @@ lcs_txbuffer_cb(struct lcs_channel *channel, struct lcs_buffer *buffer)
         lcs_release_buffer(channel, buffer);
         card = (struct lcs_card *)
                 ((char *) channel - offsetof(struct lcs_card, write));
+        if (netif_queue_stopped(card->dev))
+                netif_wake_queue(card->dev);
         spin_lock(&card->lock);
         card->tx_emitted--;
         if (card->tx_emitted <= 0 && card->tx_buffer != NULL)
@@ -1478,6 +1479,7 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
                  struct net_device *dev)
 {
         struct lcs_header *header;
+        int rc = 0;
 
         LCS_DBF_TEXT(5, trace, "hardxmit");
         if (skb == NULL) {
@@ -1492,10 +1494,8 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
                 card->stats.tx_carrier_errors++;
                 return 0;
         }
-        if (netif_queue_stopped(dev) ) {
-                card->stats.tx_dropped++;
-                return -EBUSY;
-        }
+        netif_stop_queue(card->dev);
+        spin_lock(&card->lock);
         if (card->tx_buffer != NULL &&
             card->tx_buffer->count + sizeof(struct lcs_header) +
             skb->len + sizeof(u16) > LCS_IOBUFFERSIZE)
@@ -1506,7 +1506,8 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
                 card->tx_buffer = lcs_get_buffer(&card->write);
                 if (card->tx_buffer == NULL) {
                         card->stats.tx_dropped++;
-                        return -EBUSY;
+                        rc = -EBUSY;
+                        goto out;
                 }
                 card->tx_buffer->callback = lcs_txbuffer_cb;
                 card->tx_buffer->count = 0;
@@ -1518,13 +1519,18 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
         header->type = card->lan_type;
         header->slot = card->portno;
         memcpy(header + 1, skb->data, skb->len);
+        spin_unlock(&card->lock);
         card->stats.tx_bytes += skb->len;
         card->stats.tx_packets++;
         dev_kfree_skb(skb);
-        if (card->tx_emitted <= 0)
+        netif_wake_queue(card->dev);
+        spin_lock(&card->lock);
+        if (card->tx_emitted <= 0 && card->tx_buffer != NULL)
                 /* If this is the first tx buffer emit it immediately. */
                 __lcs_emit_txbuffer(card);
-        return 0;
+out:
+        spin_unlock(&card->lock);
+        return rc;
 }
 
 static int
@@ -1535,9 +1541,7 @@ lcs_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         LCS_DBF_TEXT(5, trace, "pktxmit");
         card = (struct lcs_card *) dev->priv;
-        spin_lock(&card->lock);
         rc = __lcs_start_xmit(card, skb, dev);
-        spin_unlock(&card->lock);
         return rc;
 }
 
@@ -2319,7 +2323,6 @@ __init lcs_init_module(void)
                 PRINT_ERR("Initialization failed\n");
                 return rc;
         }
-
         return 0;
 }
 
diff --git a/drivers/s390/net/lcs.h b/drivers/s390/net/lcs.h
index 08e60ad43916..2fad5e40c2e4 100644
--- a/drivers/s390/net/lcs.h
+++ b/drivers/s390/net/lcs.h
@@ -95,7 +95,7 @@ do {                                       \
  */
 #define LCS_ILLEGAL_OFFSET              0xffff
 #define LCS_IOBUFFERSIZE                0x5000
-#define LCS_NUM_BUFFS                   8       /* needs to be power of 2 */
+#define LCS_NUM_BUFFS                   32      /* needs to be power of 2 */
 #define LCS_MAC_LENGTH                  6
 #define LCS_INVALID_PORT_NO             -1
 #define LCS_LANCMD_TIMEOUT_DEFAULT      5
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 9a064d4727ad..4df0fcd7b10b 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -1076,16 +1076,6 @@ qeth_get_qdio_q_format(struct qeth_card *card)
 }
 
 static inline int
-qeth_isdigit(char * buf)
-{
-        while (*buf) {
-                if (!isdigit(*buf++))
-                        return 0;
-        }
-        return 1;
-}
-
-static inline int
 qeth_isxdigit(char * buf)
 {
         while (*buf) {
@@ -1104,33 +1094,17 @@ qeth_ipaddr4_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr4(const char *buf, __u8 *addr)
 {
-        const char *start, *end;
-        char abuf[4];
-        char *tmp;
-        int len;
-        int i;
-
-        start = buf;
-        for (i = 0; i < 4; i++) {
-                if (i == 3) {
-                        end = strchr(start,0xa);
-                        if (end)
-                                len = end - start;
-                        else            
-                                len = strlen(start);
-                }
-                else {
-                        end = strchr(start, '.');
-                        len = end - start;
-                }
-                if ((len <= 0) || (len > 3))
-                        return -EINVAL;
-                memset(abuf, 0, 4);
-                strncpy(abuf, start, len);
-                if (!qeth_isdigit(abuf))
+        int count = 0, rc = 0;
+        int in[4];
+
+        rc = sscanf(buf, "%d.%d.%d.%d%n", 
+                    &in[0], &in[1], &in[2], &in[3], &count);
+        if (rc != 4  || count) 
+                return -EINVAL;
+        for (count = 0; count < 4; count++) {
+                if (in[count] > 255)
                         return -EINVAL;
-                addr[i] = simple_strtoul(abuf, &tmp, 10);
-                start = end + 1;
+                addr[count] = in[count];
         }
         return 0;
 }
@@ -1149,36 +1123,44 @@ qeth_ipaddr6_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
 {
-        const char *start, *end;
-        u16 *tmp_addr;
-        char abuf[5];
-        char *tmp;
-        int len;
-        int i;
-
-        tmp_addr = (u16 *)addr;
-        start = buf;
-        for (i = 0; i < 8; i++) {
-                if (i == 7) {
-                        end = strchr(start,0xa);
-                        if (end)
-                                len = end - start;
-                        else
-                                len = strlen(start);
-                }
-                else {
-                        end = strchr(start, ':');
-                        len = end - start;
+        char *end, *start;
+        __u16 *in;
+        char num[5];
+        int num2, cnt, out, found, save_cnt;
+        unsigned short in_tmp[8] = {0, };
+
+        cnt = out = found = save_cnt = num2 = 0;
+        end = start = (char *) buf;
+        in = (__u16 *) addr;    
+        memset(in, 0, 16);
+        while (end) {
+                end = strchr(end,':');
+                if (end == NULL) {
+                        end = (char *)buf + (strlen(buf));
+                        out = 1;
+                }
+                if ((end - start)) { 
+                        memset(num, 0, 5);
+                        memcpy(num, start, end - start);
+                        if (!qeth_isxdigit(num))
+                                return -EINVAL;
+                        sscanf(start, "%x", &num2);
+                        if (found)
+                                in_tmp[save_cnt++] = num2;
+                        else
+                                in[cnt++] = num2;
+                        if (out)
+                                break;
+                } else {
+                        if (found)
+                                return -EINVAL;
+                        found = 1;
                 }
-                if ((len <= 0) || (len > 4))
-                        return -EINVAL;
-                memset(abuf, 0, 5);
-                strncpy(abuf, start, len);
-                if (!qeth_isxdigit(abuf))
-                        return -EINVAL;
-                tmp_addr[i] = simple_strtoul(abuf, &tmp, 16);
-                start = end + 1;
-        }
+                start = ++end;
+        }
+        cnt = 7;
+        while (save_cnt)
+                in[cnt--] = in_tmp[--save_cnt];
         return 0;
 }
 
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index b02313127780..82cb4af2f0e7 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -59,8 +59,7 @@ qeth_eddp_free_context(struct qeth_eddp_context *ctx)
         for (i = 0; i < ctx->num_pages; ++i)
                 free_page((unsigned long)ctx->pages[i]);
         kfree(ctx->pages);
-        if (ctx->elements != NULL)
-                kfree(ctx->elements);
+        kfree(ctx->elements);
         kfree(ctx);
 }
 
@@ -413,6 +412,13 @@ __qeth_eddp_fill_context_tcp(struct qeth_eddp_context *ctx,
         
         QETH_DBF_TEXT(trace, 5, "eddpftcp");
         eddp->skb_offset = sizeof(struct qeth_hdr) + eddp->nhl + eddp->thl;
+       if (eddp->qh.hdr.l2.id == QETH_HEADER_TYPE_LAYER2) {
+               eddp->skb_offset += sizeof(struct ethhdr);
+#ifdef CONFIG_QETH_VLAN
+               if (eddp->mac.h_proto == __constant_htons(ETH_P_8021Q))
+                       eddp->skb_offset += VLAN_HLEN;
+#endif /* CONFIG_QETH_VLAN */
+       }
         tcph = eddp->skb->h.th;
         while (eddp->skb_offset < eddp->skb->len) {
                 data_len = min((int)skb_shinfo(eddp->skb)->tso_size,
@@ -483,6 +489,7 @@ qeth_eddp_fill_context_tcp(struct qeth_eddp_context *ctx,
                 return -ENOMEM;
         }
         if (qhdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2) {
+                skb->mac.raw = (skb->data) + sizeof(struct qeth_hdr);
                 memcpy(&eddp->mac, eth_hdr(skb), ETH_HLEN);
 #ifdef CONFIG_QETH_VLAN
                 if (eddp->mac.h_proto == __constant_htons(ETH_P_8021Q)) {
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 410abeada6c4..dba7f7f02e79 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -516,7 +516,8 @@ __qeth_set_offline(struct ccwgroup_device *cgdev, int recovery_mode)
         QETH_DBF_TEXT(setup, 3, "setoffl");
         QETH_DBF_HEX(setup, 3, &card, sizeof(void *));
         
-        netif_carrier_off(card->dev);
+        if (card->dev && netif_carrier_ok(card->dev))
+                netif_carrier_off(card->dev);
         recover_flag = card->state;
         if (qeth_stop_card(card, recovery_mode) == -ERESTARTSYS){
                 PRINT_WARN("Stopping card %s interrupted by user!\n",
@@ -1679,6 +1680,7 @@ qeth_cmd_timeout(unsigned long data)
         spin_unlock_irqrestore(&reply->card->lock, flags);
 }
 
+
 static struct qeth_ipa_cmd *
 qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
 {
@@ -1699,7 +1701,8 @@ qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
                                            QETH_CARD_IFNAME(card),
                                            card->info.chpid);
                                 card->lan_online = 0;
-                                netif_carrier_off(card->dev);
+                                if (card->dev && netif_carrier_ok(card->dev))
+                                        netif_carrier_off(card->dev);
                                 return NULL;
                         case IPA_CMD_STARTLAN:
                                 PRINT_INFO("Link reestablished on %s "
@@ -5562,7 +5565,7 @@ qeth_set_multicast_list(struct net_device *dev)
         if (card->info.type == QETH_CARD_TYPE_OSN)
                 return ;
          
-        QETH_DBF_TEXT(trace,3,"setmulti");
+        QETH_DBF_TEXT(trace, 3, "setmulti");
         qeth_delete_mc_addresses(card);
         if (card->options.layer2) {
                 qeth_layer2_add_multicast(card);
@@ -5579,7 +5582,6 @@ out:
                 return;
         if (qeth_set_thread_start_bit(card, QETH_SET_PROMISC_MODE_THREAD)==0)
                 schedule_work(&card->kernel_thread_starter);
-
 }
 
 static int
@@ -7452,6 +7454,7 @@ qeth_softsetup_card(struct qeth_card *card)
                 card->lan_online = 1;
         if (card->info.type==QETH_CARD_TYPE_OSN)
                 goto out;
+        qeth_set_large_send(card, card->options.large_send);
         if (card->options.layer2) {
                 card->dev->features |=
                         NETIF_F_HW_VLAN_FILTER |
@@ -7468,12 +7471,6 @@ qeth_softsetup_card(struct qeth_card *card)
 #endif
                 goto out;
         }
-        if ((card->options.large_send == QETH_LARGE_SEND_EDDP) ||
-            (card->options.large_send == QETH_LARGE_SEND_TSO))
-                card->dev->features |= NETIF_F_TSO | NETIF_F_SG;
-        else
-                card->dev->features &= ~(NETIF_F_TSO | NETIF_F_SG);
-
         if ((rc = qeth_setadapter_parms(card)))
                 QETH_DBF_TEXT_(setup, 2, "2err%d", rc);
         if ((rc = qeth_start_ipassists(card)))
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index d6469baa7e16..72118ee68954 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -168,7 +168,7 @@ smsg_init(void)
                 driver_unregister(&smsg_driver);
                 return -EIO;    /* better errno ? */
         }
-        rc = iucv_connect (&smsg_pathid, 1, 0, "*MSG    ", 0, 0, 0, 0,
+        rc = iucv_connect (&smsg_pathid, 255, 0, "*MSG    ", 0, 0, 0, 0,
                            smsg_handle, 0);
         if (rc) {
                 printk(KERN_ERR "SMSGIUCV: failed to connect to *MSG");
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 4d7d47cf2394..a5f2ba9a8fdb 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -710,10 +710,9 @@ static inline void
 _zfcp_scsi_dbf_event_common(const char *tag, const char *tag2, int level,
                             struct zfcp_adapter *adapter,
                             struct scsi_cmnd *scsi_cmnd,
-                            struct zfcp_fsf_req *new_fsf_req)
+                            struct zfcp_fsf_req *fsf_req,
+                            struct zfcp_fsf_req *old_fsf_req)
 {
-        struct zfcp_fsf_req *fsf_req =
-            (struct zfcp_fsf_req *)scsi_cmnd->host_scribble;
         struct zfcp_scsi_dbf_record *rec = &adapter->scsi_dbf_buf;
         struct zfcp_dbf_dump *dump = (struct zfcp_dbf_dump *)rec;
         unsigned long flags;
@@ -727,19 +726,20 @@ _zfcp_scsi_dbf_event_common(const char *tag, const char *tag2, int level,
                 if (offset == 0) {
                         strncpy(rec->tag, tag, ZFCP_DBF_TAG_SIZE);
                         strncpy(rec->tag2, tag2, ZFCP_DBF_TAG_SIZE);
-                        if (scsi_cmnd->device) {
-                                rec->scsi_id = scsi_cmnd->device->id;
-                                rec->scsi_lun = scsi_cmnd->device->lun;
+                        if (scsi_cmnd != NULL) {
+                                if (scsi_cmnd->device) {
+                                        rec->scsi_id = scsi_cmnd->device->id;
+                                        rec->scsi_lun = scsi_cmnd->device->lun;
+                                }
+                                rec->scsi_result = scsi_cmnd->result;
+                                rec->scsi_cmnd = (unsigned long)scsi_cmnd;
+                                rec->scsi_serial = scsi_cmnd->serial_number;
+                                memcpy(rec->scsi_opcode, &scsi_cmnd->cmnd,
+                                        min((int)scsi_cmnd->cmd_len,
+                                                ZFCP_DBF_SCSI_OPCODE));
+                                rec->scsi_retries = scsi_cmnd->retries;
+                                rec->scsi_allowed = scsi_cmnd->allowed;
                         }
-                        rec->scsi_result = scsi_cmnd->result;
-                        rec->scsi_cmnd = (unsigned long)scsi_cmnd;
-                        rec->scsi_serial = scsi_cmnd->serial_number;
-                        memcpy(rec->scsi_opcode,
-                               &scsi_cmnd->cmnd,
-                               min((int)scsi_cmnd->cmd_len,
-                                   ZFCP_DBF_SCSI_OPCODE));
-                        rec->scsi_retries = scsi_cmnd->retries;
-                        rec->scsi_allowed = scsi_cmnd->allowed;
                         if (fsf_req != NULL) {
                                 fcp_rsp = (struct fcp_rsp_iu *)
                                     &(fsf_req->qtcb->bottom.io.fcp_rsp);
@@ -772,15 +772,8 @@ _zfcp_scsi_dbf_event_common(const char *tag, const char *tag2, int level,
                                 rec->fsf_seqno = fsf_req->seq_no;
                                 rec->fsf_issued = fsf_req->issued;
                         }
-                        if (new_fsf_req != NULL) {
-                                rec->type.new_fsf_req.fsf_reqid =
-                                    (unsigned long)
-                                    new_fsf_req;
-                                rec->type.new_fsf_req.fsf_seqno =
-                                    new_fsf_req->seq_no;
-                                rec->type.new_fsf_req.fsf_issued =
-                                    new_fsf_req->issued;
-                        }
+                        rec->type.old_fsf_reqid =
+                                    (unsigned long) old_fsf_req;
                 } else {
                         strncpy(dump->tag, "dump", ZFCP_DBF_TAG_SIZE);
                         dump->total_size = buflen;
@@ -801,19 +794,21 @@ _zfcp_scsi_dbf_event_common(const char *tag, const char *tag2, int level,
 inline void
 zfcp_scsi_dbf_event_result(const char *tag, int level,
                            struct zfcp_adapter *adapter,
-                           struct scsi_cmnd *scsi_cmnd)
+                           struct scsi_cmnd *scsi_cmnd,
+                           struct zfcp_fsf_req *fsf_req)
 {
-        _zfcp_scsi_dbf_event_common("rslt",
-                                    tag, level, adapter, scsi_cmnd, NULL);
+        _zfcp_scsi_dbf_event_common("rslt", tag, level,
+                        adapter, scsi_cmnd, fsf_req, NULL);
 }
 
 inline void
 zfcp_scsi_dbf_event_abort(const char *tag, struct zfcp_adapter *adapter,
                           struct scsi_cmnd *scsi_cmnd,
-                          struct zfcp_fsf_req *new_fsf_req)
+                          struct zfcp_fsf_req *new_fsf_req,
+                          struct zfcp_fsf_req *old_fsf_req)
 {
-        _zfcp_scsi_dbf_event_common("abrt",
-                                    tag, 1, adapter, scsi_cmnd, new_fsf_req);
+        _zfcp_scsi_dbf_event_common("abrt", tag, 1,
+                        adapter, scsi_cmnd, new_fsf_req, old_fsf_req);
 }
 
 inline void
@@ -823,7 +818,7 @@ zfcp_scsi_dbf_event_devreset(const char *tag, u8 flag, struct zfcp_unit *unit,
         struct zfcp_adapter *adapter = unit->port->adapter;
 
         _zfcp_scsi_dbf_event_common(flag == FCP_TARGET_RESET ? "trst" : "lrst",
-                                    tag, 1, adapter, scsi_cmnd, NULL);
+                        tag, 1, adapter, scsi_cmnd, NULL, NULL);
 }
 
 static int
@@ -856,6 +851,10 @@ zfcp_scsi_dbf_view_format(debug_info_t * id, struct debug_view *view,
                              rec->scsi_retries);
         len += zfcp_dbf_view(out_buf + len, "scsi_allowed", "0x%02x",
                              rec->scsi_allowed);
+        if (strncmp(rec->tag, "abrt", ZFCP_DBF_TAG_SIZE) == 0) {
+                len += zfcp_dbf_view(out_buf + len, "old_fsf_reqid", "0x%0Lx",
+                                     rec->type.old_fsf_reqid);
+        }
         len += zfcp_dbf_view(out_buf + len, "fsf_reqid", "0x%0Lx",
                              rec->fsf_reqid);
         len += zfcp_dbf_view(out_buf + len, "fsf_seqno", "0x%08x",
@@ -883,21 +882,6 @@ zfcp_scsi_dbf_view_format(debug_info_t * id, struct debug_view *view,
                                        min((int)rec->type.fcp.sns_info_len,
                                            ZFCP_DBF_SCSI_FCP_SNS_INFO), 0,
                                        rec->type.fcp.sns_info_len);
-        } else if (strncmp(rec->tag, "abrt", ZFCP_DBF_TAG_SIZE) == 0) {
-                len += zfcp_dbf_view(out_buf + len, "fsf_reqid_abort", "0x%0Lx",
-                                     rec->type.new_fsf_req.fsf_reqid);
-                len += zfcp_dbf_view(out_buf + len, "fsf_seqno_abort", "0x%08x",
-                                     rec->type.new_fsf_req.fsf_seqno);
-                len += zfcp_dbf_stck(out_buf + len, "fsf_issued",
-                                     rec->type.new_fsf_req.fsf_issued);
-        } else if ((strncmp(rec->tag, "trst", ZFCP_DBF_TAG_SIZE) == 0) ||
-                   (strncmp(rec->tag, "lrst", ZFCP_DBF_TAG_SIZE) == 0)) {
-                len += zfcp_dbf_view(out_buf + len, "fsf_reqid_reset", "0x%0Lx",
-                                     rec->type.new_fsf_req.fsf_reqid);
-                len += zfcp_dbf_view(out_buf + len, "fsf_seqno_reset", "0x%08x",
-                                     rec->type.new_fsf_req.fsf_seqno);
-                len += zfcp_dbf_stck(out_buf + len, "fsf_issued",
-                                     rec->type.new_fsf_req.fsf_issued);
         }
 
         len += sprintf(out_buf + len, "\n");
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index e260d19fa717..6eba56cd89ba 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -152,11 +152,6 @@ typedef u32 scsi_lun_t;
 #define ZFCP_EXCHANGE_CONFIG_DATA_FIRST_SLEEP   100
 #define ZFCP_EXCHANGE_CONFIG_DATA_RETRIES       7
 
-/* Retry 5 times every 2 second, then every minute */
-#define ZFCP_EXCHANGE_PORT_DATA_SHORT_RETRIES   5
-#define ZFCP_EXCHANGE_PORT_DATA_SHORT_SLEEP     200
-#define ZFCP_EXCHANGE_PORT_DATA_LONG_SLEEP      6000
-
 /* timeout value for "default timer" for fsf requests */
 #define ZFCP_FSF_REQUEST_TIMEOUT (60*HZ);
 
@@ -429,11 +424,7 @@ struct zfcp_scsi_dbf_record {
         u32 fsf_seqno;
         u64 fsf_issued;
         union {
-                struct {
-                        u64 fsf_reqid;
-                        u32 fsf_seqno;
-                        u64 fsf_issued;
-                } new_fsf_req;
+                u64 old_fsf_reqid;
                 struct {
                         u8 rsp_validity;
                         u8 rsp_scsi_status;
@@ -673,6 +664,7 @@ do { \
 #define ZFCP_STATUS_UNIT_TEMPORARY              0x00000002
 #define ZFCP_STATUS_UNIT_SHARED                 0x00000004
 #define ZFCP_STATUS_UNIT_READONLY               0x00000008
+#define ZFCP_STATUS_UNIT_REGISTERED             0x00000010
 
 /* FSF request status (this does not have a common part) */
 #define ZFCP_STATUS_FSFREQ_NOT_INIT             0x00000000
@@ -915,8 +907,6 @@ struct zfcp_adapter {
         wwn_t                   peer_wwnn;         /* P2P peer WWNN */
         wwn_t                   peer_wwpn;         /* P2P peer WWPN */
         u32                     peer_d_id;         /* P2P peer D_ID */
-        wwn_t                   physical_wwpn;     /* WWPN of physical port */
-        u32                     physical_s_id;     /* local FC port ID */
         struct ccw_device       *ccw_device;       /* S/390 ccw device */
         u8                      fc_service_class;
         u32                     hydra_version;     /* Hydra version */
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index da947e662031..57cb628a05aa 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -2246,15 +2246,6 @@ zfcp_erp_adapter_strategy_open_fsf(struct zfcp_erp_action *erp_action)
 {
         int retval;
 
-        if ((atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
-                              &erp_action->adapter->status)) &&
-            (erp_action->adapter->adapter_features &
-             FSF_FEATURE_HBAAPI_MANAGEMENT)) {
-                zfcp_erp_adapter_strategy_open_fsf_xport(erp_action);
-                atomic_set(&erp_action->adapter->erp_counter, 0);
-                return ZFCP_ERP_FAILED;
-        }
-
         retval = zfcp_erp_adapter_strategy_open_fsf_xconfig(erp_action);
         if (retval == ZFCP_ERP_FAILED)
                 return ZFCP_ERP_FAILED;
@@ -2266,13 +2257,6 @@ zfcp_erp_adapter_strategy_open_fsf(struct zfcp_erp_action *erp_action)
         return zfcp_erp_adapter_strategy_open_fsf_statusread(erp_action);
 }
 
-/*
- * function:    
- *
- * purpose:     
- *
- * returns:
- */
 static int
 zfcp_erp_adapter_strategy_open_fsf_xconfig(struct zfcp_erp_action *erp_action)
 {
@@ -2350,48 +2334,40 @@ static int
 zfcp_erp_adapter_strategy_open_fsf_xport(struct zfcp_erp_action *erp_action)
 {
         int ret;
-        int retries;
-        int sleep;
-        struct zfcp_adapter *adapter = erp_action->adapter;
+        struct zfcp_adapter *adapter;
 
+        adapter = erp_action->adapter;
         atomic_clear_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
 
-        retries = 0;
-        do {
-                write_lock(&adapter->erp_lock);
-                zfcp_erp_action_to_running(erp_action);
-                write_unlock(&adapter->erp_lock);
-                zfcp_erp_timeout_init(erp_action);
-                ret = zfcp_fsf_exchange_port_data(erp_action, adapter, NULL);
-                if (ret == -EOPNOTSUPP) {
-                        debug_text_event(adapter->erp_dbf, 3, "a_xport_notsupp");
-                        return ZFCP_ERP_SUCCEEDED;
-                } else if (ret) {
-                        debug_text_event(adapter->erp_dbf, 3, "a_xport_failed");
-                        return ZFCP_ERP_FAILED;
-                }
-                debug_text_event(adapter->erp_dbf, 6, "a_xport_ok");
+        write_lock(&adapter->erp_lock);
+        zfcp_erp_action_to_running(erp_action);
+        write_unlock(&adapter->erp_lock);
 
-                down(&adapter->erp_ready_sem);
-                if (erp_action->status & ZFCP_STATUS_ERP_TIMEDOUT) {
-                        ZFCP_LOG_INFO("error: exchange of port data "
-                                      "for adapter %s timed out\n",
-                                      zfcp_get_busid_by_adapter(adapter));
-                        break;
-                }
-                if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED,
-                                      &adapter->status))
-                        break;
+        zfcp_erp_timeout_init(erp_action);
+        ret = zfcp_fsf_exchange_port_data(erp_action, adapter, NULL);
+        if (ret == -EOPNOTSUPP) {
+                debug_text_event(adapter->erp_dbf, 3, "a_xport_notsupp");
+                return ZFCP_ERP_SUCCEEDED;
+        } else if (ret) {
+                debug_text_event(adapter->erp_dbf, 3, "a_xport_failed");
+                return ZFCP_ERP_FAILED;
+        }
+        debug_text_event(adapter->erp_dbf, 6, "a_xport_ok");
 
-                if (retries < ZFCP_EXCHANGE_PORT_DATA_SHORT_RETRIES) {
-                        sleep = ZFCP_EXCHANGE_PORT_DATA_SHORT_SLEEP;
-                        retries++;
-                } else
-                        sleep = ZFCP_EXCHANGE_PORT_DATA_LONG_SLEEP;
-                schedule_timeout(sleep);
-        } while (1);
+        ret = ZFCP_ERP_SUCCEEDED;
+        down(&adapter->erp_ready_sem);
+        if (erp_action->status & ZFCP_STATUS_ERP_TIMEDOUT) {
+                ZFCP_LOG_INFO("error: exchange port data timed out (adapter "
+                              "%s)\n", zfcp_get_busid_by_adapter(adapter));
+                ret = ZFCP_ERP_FAILED;
+        }
+        if (!atomic_test_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status)) {
+                ZFCP_LOG_INFO("error: exchange port data failed (adapter "
+                              "%s\n", zfcp_get_busid_by_adapter(adapter));
+                ret = ZFCP_ERP_FAILED;
+        }
 
-        return ZFCP_ERP_SUCCEEDED;
+        return ret;
 }
 
 /*
@@ -3415,10 +3391,13 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
                     && (!atomic_test_mask(ZFCP_STATUS_UNIT_TEMPORARY,
                                           &unit->status))
                     && !unit->device
-                    && port->rport)
-                        scsi_add_device(port->adapter->scsi_host, 0,
-                                        port->rport->scsi_target_id,
-                                        unit->scsi_lun);
+                    && port->rport) {
+                        atomic_set_mask(ZFCP_STATUS_UNIT_REGISTERED,
+                                        &unit->status);
+                        scsi_scan_target(&port->rport->dev, 0,
+                                         port->rport->scsi_target_id,
+                                         unit->scsi_lun, 0);
+                }
                 zfcp_unit_put(unit);
                 break;
         case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
@@ -3439,6 +3418,8 @@ zfcp_erp_action_cleanup(int action, struct zfcp_adapter *adapter,
                                                 "(adapter %s, wwpn=0x%016Lx)\n",
                                                 zfcp_get_busid_by_port(port),
                                                 port->wwpn);
+                        else
+                                scsi_flush_work(adapter->scsi_host);
                 }
                 zfcp_port_put(port);
                 break;
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index c1ba7cf1b496..700f5402a978 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -194,9 +194,10 @@ extern void zfcp_san_dbf_event_els_response(struct zfcp_fsf_req *);
 extern void zfcp_san_dbf_event_incoming_els(struct zfcp_fsf_req *);
 
 extern void zfcp_scsi_dbf_event_result(const char *, int, struct zfcp_adapter *,
-                                       struct scsi_cmnd *);
+                                       struct scsi_cmnd *,
+                                       struct zfcp_fsf_req *);
 extern void zfcp_scsi_dbf_event_abort(const char *, struct zfcp_adapter *,
-                                      struct scsi_cmnd *,
+                                      struct scsi_cmnd *, struct zfcp_fsf_req *,
                                       struct zfcp_fsf_req *);
 extern void zfcp_scsi_dbf_event_devreset(const char *, u8, struct zfcp_unit *,
                                          struct scsi_cmnd *);
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 9f0cb3d820c0..662ec571d73b 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -388,6 +388,7 @@ zfcp_fsf_protstatus_eval(struct zfcp_fsf_req *fsf_req)
         case FSF_PROT_LINK_DOWN:
                 zfcp_fsf_link_down_info_eval(adapter,
                                              &prot_status_qual->link_down_info);
+                zfcp_erp_adapter_reopen(adapter, 0);
                 fsf_req->status |= ZFCP_STATUS_FSFREQ_ERROR;
                 break;
 
@@ -558,10 +559,8 @@ zfcp_fsf_link_down_info_eval(struct zfcp_adapter *adapter,
 
         atomic_set_mask(ZFCP_STATUS_ADAPTER_LINK_UNPLUGGED, &adapter->status);
 
-        if (link_down == NULL) {
-                zfcp_erp_adapter_reopen(adapter, 0);
-                return;
-        }
+        if (link_down == NULL)
+                goto out;
 
         switch (link_down->error_code) {
         case FSF_PSQ_LINK_NO_LIGHT:
@@ -643,16 +642,8 @@ zfcp_fsf_link_down_info_eval(struct zfcp_adapter *adapter,
                                 link_down->explanation_code,
                                 link_down->vendor_specific_code);
 
-        switch (link_down->error_code) {
-        case FSF_PSQ_LINK_NO_LIGHT:
-        case FSF_PSQ_LINK_WRAP_PLUG:
-        case FSF_PSQ_LINK_NO_FCP:
-        case FSF_PSQ_LINK_FIRMWARE_UPDATE:
-                zfcp_erp_adapter_reopen(adapter, 0);
-                break;
-        default:
-                zfcp_erp_adapter_failed(adapter);
-        }
+ out:
+        zfcp_erp_adapter_failed(adapter);
 }
 
 /*
@@ -2304,6 +2295,35 @@ zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action,
         return retval;
 }
 
+/**
+ * zfcp_fsf_exchange_port_evaluate
+ * @fsf_req: fsf_req which belongs to xchg port data request
+ * @xchg_ok: specifies if xchg port data was incomplete or complete (0/1)
+ */
+static void
+zfcp_fsf_exchange_port_evaluate(struct zfcp_fsf_req *fsf_req, int xchg_ok)
+{
+        struct zfcp_adapter *adapter;
+        struct fsf_qtcb *qtcb;
+        struct fsf_qtcb_bottom_port *bottom, *data;
+        struct Scsi_Host *shost;
+
+        adapter = fsf_req->adapter;
+        qtcb = fsf_req->qtcb;
+        bottom = &qtcb->bottom.port;
+        shost = adapter->scsi_host;
+
+        data = (struct fsf_qtcb_bottom_port*) fsf_req->data;
+        if (data)
+                memcpy(data, bottom, sizeof(struct fsf_qtcb_bottom_port));
+
+        if (adapter->connection_features & FSF_FEATURE_NPIV_MODE)
+                fc_host_permanent_port_name(shost) = bottom->wwpn;
+        else
+                fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
+        fc_host_maxframe_size(shost) = bottom->maximum_frame_size;
+        fc_host_supported_speeds(shost) = bottom->supported_speed;
+}
 
 /**
  * zfcp_fsf_exchange_port_data_handler - handler for exchange_port_data request
@@ -2312,38 +2332,26 @@ zfcp_fsf_exchange_port_data(struct zfcp_erp_action *erp_action,
 static void
 zfcp_fsf_exchange_port_data_handler(struct zfcp_fsf_req *fsf_req)
 {
-        struct zfcp_adapter *adapter = fsf_req->adapter;
-        struct Scsi_Host *shost = adapter->scsi_host;
-        struct fsf_qtcb *qtcb = fsf_req->qtcb;
-        struct fsf_qtcb_bottom_port *bottom, *data;
+        struct zfcp_adapter *adapter;
+        struct fsf_qtcb *qtcb;
+
+        adapter = fsf_req->adapter;
+        qtcb = fsf_req->qtcb;
 
         if (fsf_req->status & ZFCP_STATUS_FSFREQ_ERROR)
                 return;
 
         switch (qtcb->header.fsf_status) {
         case FSF_GOOD:
+                zfcp_fsf_exchange_port_evaluate(fsf_req, 1);
                 atomic_set_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
-
-                bottom = &qtcb->bottom.port;
-                data = (struct fsf_qtcb_bottom_port*) fsf_req->data;
-                if (data)
-                        memcpy(data, bottom, sizeof(struct fsf_qtcb_bottom_port));
-                if (adapter->connection_features & FSF_FEATURE_NPIV_MODE)
-                        fc_host_permanent_port_name(shost) = bottom->wwpn;
-                else
-                        fc_host_permanent_port_name(shost) =
-                                fc_host_port_name(shost);
-                fc_host_maxframe_size(shost) = bottom->maximum_frame_size;
-                fc_host_supported_speeds(shost) = bottom->supported_speed;
                 break;
-
         case FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE:
+                zfcp_fsf_exchange_port_evaluate(fsf_req, 0);
                 atomic_set_mask(ZFCP_STATUS_ADAPTER_XPORT_OK, &adapter->status);
-
                 zfcp_fsf_link_down_info_eval(adapter,
                         &qtcb->header.fsf_status_qual.link_down_info);
                 break;
-
         default:
                 debug_text_event(adapter->erp_dbf, 0, "xchg-port-ng");
                 debug_event(adapter->erp_dbf, 0,
@@ -4203,11 +4211,11 @@ zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *fsf_req)
         ZFCP_LOG_DEBUG("scpnt->result =0x%x\n", scpnt->result);
 
         if (scpnt->result != 0)
-                zfcp_scsi_dbf_event_result("erro", 3, fsf_req->adapter, scpnt);
+                zfcp_scsi_dbf_event_result("erro", 3, fsf_req->adapter, scpnt, fsf_req);
         else if (scpnt->retries > 0)
-                zfcp_scsi_dbf_event_result("retr", 4, fsf_req->adapter, scpnt);
+                zfcp_scsi_dbf_event_result("retr", 4, fsf_req->adapter, scpnt, fsf_req);
         else
-                zfcp_scsi_dbf_event_result("norm", 6, fsf_req->adapter, scpnt);
+                zfcp_scsi_dbf_event_result("norm", 6, fsf_req->adapter, scpnt, fsf_req);
 
         /* cleanup pointer (need this especially for abort) */
         scpnt->host_scribble = NULL;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index e0803757c0fa..9e6d07d7b3c8 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -68,7 +68,7 @@ struct zfcp_data zfcp_data = {
               eh_host_reset_handler:   zfcp_scsi_eh_host_reset_handler,
                                        /* FIXME(openfcp): Tune */
               can_queue:               4096,
-              this_id:                 0,
+              this_id:                 -1,
               /*
                * FIXME:
                * one less? can zfcp_create_sbale cope with it?
@@ -183,7 +183,8 @@ zfcp_scsi_slave_alloc(struct scsi_device *sdp)
 
         read_lock_irqsave(&zfcp_data.config_lock, flags);
         unit = zfcp_unit_lookup(adapter, sdp->channel, sdp->id, sdp->lun);
-        if (unit) {
+        if (unit && atomic_test_mask(ZFCP_STATUS_UNIT_REGISTERED,
+                                     &unit->status)) {
                 sdp->hostdata = unit;
                 unit->device = sdp;
                 zfcp_unit_get(unit);
@@ -208,6 +209,7 @@ zfcp_scsi_slave_destroy(struct scsi_device *sdpnt)
         struct zfcp_unit *unit = (struct zfcp_unit *) sdpnt->hostdata;
 
         if (unit) {
+                atomic_clear_mask(ZFCP_STATUS_UNIT_REGISTERED, &unit->status);
                 sdpnt->hostdata = NULL;
                 unit->device = NULL;
                 zfcp_unit_put(unit);
@@ -242,7 +244,7 @@ zfcp_scsi_command_fail(struct scsi_cmnd *scpnt, int result)
         if ((scpnt->device != NULL) && (scpnt->device->host != NULL))
                 zfcp_scsi_dbf_event_result("fail", 4,
                         (struct zfcp_adapter*) scpnt->device->host->hostdata[0],
-                        scpnt);
+                        scpnt, NULL);
         /* return directly */
         scpnt->scsi_done(scpnt);
 }
@@ -291,7 +293,7 @@ zfcp_scsi_command_async(struct zfcp_adapter *adapter, struct zfcp_unit *unit,
                                "on port 0x%016Lx in recovery\n",
                                zfcp_get_busid_by_unit(unit),
                                unit->fcp_lun, unit->port->wwpn);
-                retval = SCSI_MLQUEUE_DEVICE_BUSY;
+                zfcp_scsi_command_fail(scpnt, DID_NO_CONNECT);
                 goto out;
         }
 
@@ -446,7 +448,7 @@ zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
         old_fsf_req = (struct zfcp_fsf_req *) scpnt->host_scribble;
         if (!old_fsf_req) {
                 write_unlock_irqrestore(&adapter->abort_lock, flags);
-                zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, new_fsf_req);
+                zfcp_scsi_dbf_event_abort("lte1", adapter, scpnt, NULL, NULL);
                 retval = SUCCESS;
                 goto out;
         }
@@ -460,6 +462,8 @@ zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
                                                  adapter, unit, 0);
         if (!new_fsf_req) {
                 ZFCP_LOG_INFO("error: initiation of Abort FCP Cmnd failed\n");
+                zfcp_scsi_dbf_event_abort("nres", adapter, scpnt, NULL,
+                                          old_fsf_req);
                 retval = FAILED;
                 goto out;
         }
@@ -470,13 +474,16 @@ zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt)
 
         /* status should be valid since signals were not permitted */
         if (new_fsf_req->status & ZFCP_STATUS_FSFREQ_ABORTSUCCEEDED) {
-                zfcp_scsi_dbf_event_abort("okay", adapter, scpnt, new_fsf_req);
+                zfcp_scsi_dbf_event_abort("okay", adapter, scpnt, new_fsf_req,
+                                          NULL);
                 retval = SUCCESS;
         } else if (new_fsf_req->status & ZFCP_STATUS_FSFREQ_ABORTNOTNEEDED) {
-                zfcp_scsi_dbf_event_abort("lte2", adapter, scpnt, new_fsf_req);
+                zfcp_scsi_dbf_event_abort("lte2", adapter, scpnt, new_fsf_req,
+                                          NULL);
                 retval = SUCCESS;
         } else {
-                zfcp_scsi_dbf_event_abort("fail", adapter, scpnt, new_fsf_req);
+                zfcp_scsi_dbf_event_abort("fail", adapter, scpnt, new_fsf_req,
+                                          NULL);
                 retval = FAILED;
         }
         zfcp_fsf_req_free(new_fsf_req);
diff --git a/drivers/s390/scsi/zfcp_sysfs_adapter.c b/drivers/s390/scsi/zfcp_sysfs_adapter.c
index dfc07370f412..b29ac25e07f3 100644
--- a/drivers/s390/scsi/zfcp_sysfs_adapter.c
+++ b/drivers/s390/scsi/zfcp_sysfs_adapter.c
@@ -55,8 +55,6 @@ ZFCP_DEFINE_ADAPTER_ATTR(status, "0x%08x\n", atomic_read(&adapter->status));
 ZFCP_DEFINE_ADAPTER_ATTR(peer_wwnn, "0x%016llx\n", adapter->peer_wwnn);
 ZFCP_DEFINE_ADAPTER_ATTR(peer_wwpn, "0x%016llx\n", adapter->peer_wwpn);
 ZFCP_DEFINE_ADAPTER_ATTR(peer_d_id, "0x%06x\n", adapter->peer_d_id);
-ZFCP_DEFINE_ADAPTER_ATTR(physical_wwpn, "0x%016llx\n", adapter->physical_wwpn);
-ZFCP_DEFINE_ADAPTER_ATTR(physical_s_id, "0x%06x\n", adapter->physical_s_id);
 ZFCP_DEFINE_ADAPTER_ATTR(card_version, "0x%04x\n", adapter->hydra_version);
 ZFCP_DEFINE_ADAPTER_ATTR(lic_version, "0x%08x\n", adapter->fsf_lic_version);
 ZFCP_DEFINE_ADAPTER_ATTR(hardware_version, "0x%08x\n",
@@ -241,8 +239,6 @@ static struct attribute *zfcp_adapter_attrs[] = {
         &dev_attr_peer_wwnn.attr,
         &dev_attr_peer_wwpn.attr,
         &dev_attr_peer_d_id.attr,
-        &dev_attr_physical_wwpn.attr,
-        &dev_attr_physical_s_id.attr,
         &dev_attr_card_version.attr,
         &dev_attr_lic_version.attr,
         &dev_attr_status.attr,
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 31c497542272..d9152d02088c 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -61,6 +61,7 @@
                  Add support for embedded firmware error strings.
    2.26.02.003 - Correctly handle single sgl's with use_sg=1.
    2.26.02.004 - Add support for 9550SX controllers.
+   2.26.02.005 - Fix use_sg == 0 mapping on systems with 4GB or higher.
 */
 
 #include <linux/module.h>
@@ -84,7 +85,7 @@
 #include "3w-9xxx.h"
 
 /* Globals */
-#define TW_DRIVER_VERSION "2.26.02.004"
+#define TW_DRIVER_VERSION "2.26.02.005"
 static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
 static unsigned int twa_device_extension_count;
 static int twa_major = -1;
@@ -1408,7 +1409,7 @@ static dma_addr_t twa_map_scsi_single_data(TW_Device_Extension *tw_dev, int requ
         dma_addr_t mapping;
         struct scsi_cmnd *cmd = tw_dev->srb[request_id];
         struct pci_dev *pdev = tw_dev->tw_pci_dev;
-        int retval = 0;
+        dma_addr_t retval = 0;
 
         if (cmd->request_bufflen == 0) {
                 retval = 0;
@@ -1798,7 +1799,7 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
         int i, sg_count;
         struct scsi_cmnd *srb = NULL;
         struct scatterlist *sglist = NULL;
-        u32 buffaddr = 0x0;
+        dma_addr_t buffaddr = 0x0;
         int retval = 1;
 
         if (tw_dev->srb[request_id]) {
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 7139659dd952..a16f8ded8f1d 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -173,10 +173,10 @@ int aac_get_config_status(struct aac_dev *dev)
         int status = 0;
         struct fib * fibptr;
 
-        if (!(fibptr = fib_alloc(dev)))
+        if (!(fibptr = aac_fib_alloc(dev)))
                 return -ENOMEM;
 
-        fib_init(fibptr);
+        aac_fib_init(fibptr);
         {
                 struct aac_get_config_status *dinfo;
                 dinfo = (struct aac_get_config_status *) fib_data(fibptr);
@@ -186,7 +186,7 @@ int aac_get_config_status(struct aac_dev *dev)
                 dinfo->count = cpu_to_le32(sizeof(((struct aac_get_config_status_resp *)NULL)->data));
         }
 
-        status = fib_send(ContainerCommand,
+        status = aac_fib_send(ContainerCommand,
                             fibptr,
                             sizeof (struct aac_get_config_status),
                             FsaNormal,
@@ -209,30 +209,30 @@ int aac_get_config_status(struct aac_dev *dev)
                         status = -EINVAL;
                 }
         }
-        fib_complete(fibptr);
+        aac_fib_complete(fibptr);
         /* Send a CT_COMMIT_CONFIG to enable discovery of devices */
         if (status >= 0) {
                 if (commit == 1) {
                         struct aac_commit_config * dinfo;
-                        fib_init(fibptr);
+                        aac_fib_init(fibptr);
                         dinfo = (struct aac_commit_config *) fib_data(fibptr);
         
                         dinfo->command = cpu_to_le32(VM_ContainerConfig);
                         dinfo->type = cpu_to_le32(CT_COMMIT_CONFIG);
         
-                        status = fib_send(ContainerCommand,
+                        status = aac_fib_send(ContainerCommand,
                                     fibptr,
                                     sizeof (struct aac_commit_config),
                                     FsaNormal,
                                     1, 1,
                                     NULL, NULL);
-                        fib_complete(fibptr);
+                        aac_fib_complete(fibptr);
                 } else if (commit == 0) {
                         printk(KERN_WARNING
                           "aac_get_config_status: Foreign device configurations are being ignored\n");
                 }
         }
-        fib_free(fibptr);
+        aac_fib_free(fibptr);
         return status;
 }
 
@@ -255,15 +255,15 @@ int aac_get_containers(struct aac_dev *dev)
 
         instance = dev->scsi_host_ptr->unique_id;
 
-        if (!(fibptr = fib_alloc(dev)))
+        if (!(fibptr = aac_fib_alloc(dev)))
                 return -ENOMEM;
 
-        fib_init(fibptr);
+        aac_fib_init(fibptr);
         dinfo = (struct aac_get_container_count *) fib_data(fibptr);
         dinfo->command = cpu_to_le32(VM_ContainerConfig);
         dinfo->type = cpu_to_le32(CT_GET_CONTAINER_COUNT);
 
-        status = fib_send(ContainerCommand,
+        status = aac_fib_send(ContainerCommand,
                     fibptr,
                     sizeof (struct aac_get_container_count),
                     FsaNormal,
@@ -272,7 +272,7 @@ int aac_get_containers(struct aac_dev *dev)
         if (status >= 0) {
                 dresp = (struct aac_get_container_count_resp *)fib_data(fibptr);
                 maximum_num_containers = le32_to_cpu(dresp->ContainerSwitchEntries);
-                fib_complete(fibptr);
+                aac_fib_complete(fibptr);
         }
 
         if (maximum_num_containers < MAXIMUM_NUM_CONTAINERS)
@@ -280,7 +280,7 @@ int aac_get_containers(struct aac_dev *dev)
         fsa_dev_ptr = (struct fsa_dev_info *) kmalloc(
           sizeof(*fsa_dev_ptr) * maximum_num_containers, GFP_KERNEL);
         if (!fsa_dev_ptr) {
-                fib_free(fibptr);
+                aac_fib_free(fibptr);
                 return -ENOMEM;
         }
         memset(fsa_dev_ptr, 0, sizeof(*fsa_dev_ptr) * maximum_num_containers);
@@ -294,14 +294,14 @@ int aac_get_containers(struct aac_dev *dev)
 
                 fsa_dev_ptr[index].devname[0] = '\0';
 
-                fib_init(fibptr);
+                aac_fib_init(fibptr);
                 dinfo = (struct aac_query_mount *) fib_data(fibptr);
 
                 dinfo->command = cpu_to_le32(VM_NameServe);
                 dinfo->count = cpu_to_le32(index);
                 dinfo->type = cpu_to_le32(FT_FILESYS);
 
-                status = fib_send(ContainerCommand,
+                status = aac_fib_send(ContainerCommand,
                                     fibptr,
                                     sizeof (struct aac_query_mount),
                                     FsaNormal,
@@ -319,7 +319,7 @@ int aac_get_containers(struct aac_dev *dev)
                         dinfo->count = cpu_to_le32(index);
                         dinfo->type = cpu_to_le32(FT_FILESYS);
 
-                        if (fib_send(ContainerCommand,
+                        if (aac_fib_send(ContainerCommand,
                                     fibptr,
                                     sizeof(struct aac_query_mount),
                                     FsaNormal,
@@ -347,7 +347,7 @@ int aac_get_containers(struct aac_dev *dev)
                         if (le32_to_cpu(dresp->mnt[0].state) & FSCS_READONLY)
                                     fsa_dev_ptr[index].ro = 1;
                 }
-                fib_complete(fibptr);
+                aac_fib_complete(fibptr);
                 /*
                  *      If there are no more containers, then stop asking.
                  */
@@ -355,7 +355,7 @@ int aac_get_containers(struct aac_dev *dev)
                         break;
                 }
         }
-        fib_free(fibptr);
+        aac_fib_free(fibptr);
         return status;
 }
 
@@ -413,8 +413,8 @@ static void get_container_name_callback(void *context, struct fib * fibptr)
 
         scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_GOOD;
 
-        fib_complete(fibptr);
-        fib_free(fibptr);
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
         scsicmd->scsi_done(scsicmd);
 }
 
@@ -430,10 +430,10 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd, int cid)
 
         dev = (struct aac_dev *)scsicmd->device->host->hostdata;
 
-        if (!(cmd_fibcontext = fib_alloc(dev)))
+        if (!(cmd_fibcontext = aac_fib_alloc(dev)))
                 return -ENOMEM;
 
-        fib_init(cmd_fibcontext);
+        aac_fib_init(cmd_fibcontext);
         dinfo = (struct aac_get_name *) fib_data(cmd_fibcontext);
 
         dinfo->command = cpu_to_le32(VM_ContainerConfig);
@@ -441,7 +441,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd, int cid)
         dinfo->cid = cpu_to_le32(cid);
         dinfo->count = cpu_to_le32(sizeof(((struct aac_get_name_resp *)NULL)->data));
 
-        status = fib_send(ContainerCommand, 
+        status = aac_fib_send(ContainerCommand,
                   cmd_fibcontext, 
                   sizeof (struct aac_get_name),
                   FsaNormal, 
@@ -455,14 +455,14 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd, int cid)
         if (status == -EINPROGRESS) 
                 return 0;
                 
-        printk(KERN_WARNING "aac_get_container_name: fib_send failed with status: %d.\n", status);
-        fib_complete(cmd_fibcontext);
-        fib_free(cmd_fibcontext);
+        printk(KERN_WARNING "aac_get_container_name: aac_fib_send failed with status: %d.\n", status);
+        aac_fib_complete(cmd_fibcontext);
+        aac_fib_free(cmd_fibcontext);
         return -1;
 }
 
 /**
- *      probe_container         -       query a logical volume
+ *      aac_probe_container             -       query a logical volume
  *      @dev: device to query
  *      @cid: container identifier
  *
@@ -470,7 +470,7 @@ static int aac_get_container_name(struct scsi_cmnd * scsicmd, int cid)
  *      is updated in the struct fsa_dev_info structure rather than returned.
  */
  
-int probe_container(struct aac_dev *dev, int cid)
+int aac_probe_container(struct aac_dev *dev, int cid)
 {
         struct fsa_dev_info *fsa_dev_ptr;
         int status;
@@ -482,10 +482,10 @@ int probe_container(struct aac_dev *dev, int cid)
         fsa_dev_ptr = dev->fsa_dev;
         instance = dev->scsi_host_ptr->unique_id;
 
-        if (!(fibptr = fib_alloc(dev)))
+        if (!(fibptr = aac_fib_alloc(dev)))
                 return -ENOMEM;
 
-        fib_init(fibptr);
+        aac_fib_init(fibptr);
 
         dinfo = (struct aac_query_mount *)fib_data(fibptr);
 
@@ -493,14 +493,14 @@ int probe_container(struct aac_dev *dev, int cid)
         dinfo->count = cpu_to_le32(cid);
         dinfo->type = cpu_to_le32(FT_FILESYS);
 
-        status = fib_send(ContainerCommand,
+        status = aac_fib_send(ContainerCommand,
                             fibptr,
                             sizeof(struct aac_query_mount),
                             FsaNormal,
                             1, 1,
                             NULL, NULL);
         if (status < 0) {
-                printk(KERN_WARNING "aacraid: probe_container query failed.\n");
+                printk(KERN_WARNING "aacraid: aac_probe_container query failed.\n");
                 goto error;
         }
 
@@ -512,7 +512,7 @@ int probe_container(struct aac_dev *dev, int cid)
                 dinfo->count = cpu_to_le32(cid);
                 dinfo->type = cpu_to_le32(FT_FILESYS);
 
-                if (fib_send(ContainerCommand,
+                if (aac_fib_send(ContainerCommand,
                             fibptr,
                             sizeof(struct aac_query_mount),
                             FsaNormal,
@@ -535,8 +535,8 @@ int probe_container(struct aac_dev *dev, int cid)
         }
 
 error:
-        fib_complete(fibptr);
-        fib_free(fibptr);
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
 
         return status;
 }
@@ -700,14 +700,14 @@ int aac_get_adapter_info(struct aac_dev* dev)
         struct aac_bus_info *command;
         struct aac_bus_info_response *bus_info;
 
-        if (!(fibptr = fib_alloc(dev)))
+        if (!(fibptr = aac_fib_alloc(dev)))
                 return -ENOMEM;
 
-        fib_init(fibptr);
+        aac_fib_init(fibptr);
         info = (struct aac_adapter_info *) fib_data(fibptr);
         memset(info,0,sizeof(*info));
 
-        rcode = fib_send(RequestAdapterInfo,
+        rcode = aac_fib_send(RequestAdapterInfo,
                          fibptr, 
                          sizeof(*info),
                          FsaNormal, 
@@ -716,8 +716,8 @@ int aac_get_adapter_info(struct aac_dev* dev)
                          NULL);
 
         if (rcode < 0) {
-                fib_complete(fibptr);
-                fib_free(fibptr);
+                aac_fib_complete(fibptr);
+                aac_fib_free(fibptr);
                 return rcode;
         }
         memcpy(&dev->adapter_info, info, sizeof(*info));
@@ -725,13 +725,13 @@ int aac_get_adapter_info(struct aac_dev* dev)
         if (dev->adapter_info.options & AAC_OPT_SUPPLEMENT_ADAPTER_INFO) {
                 struct aac_supplement_adapter_info * info;
 
-                fib_init(fibptr);
+                aac_fib_init(fibptr);
 
                 info = (struct aac_supplement_adapter_info *) fib_data(fibptr);
 
                 memset(info,0,sizeof(*info));
 
-                rcode = fib_send(RequestSupplementAdapterInfo,
+                rcode = aac_fib_send(RequestSupplementAdapterInfo,
                                  fibptr,
                                  sizeof(*info),
                                  FsaNormal,
@@ -748,7 +748,7 @@ int aac_get_adapter_info(struct aac_dev* dev)
          * GetBusInfo 
          */
 
-        fib_init(fibptr);
+        aac_fib_init(fibptr);
 
         bus_info = (struct aac_bus_info_response *) fib_data(fibptr);
 
@@ -761,7 +761,7 @@ int aac_get_adapter_info(struct aac_dev* dev)
         command->MethodId = cpu_to_le32(1);
         command->CtlCmd = cpu_to_le32(GetBusInfo);
 
-        rcode = fib_send(ContainerCommand,
+        rcode = aac_fib_send(ContainerCommand,
                          fibptr,
                          sizeof (*bus_info),
                          FsaNormal,
@@ -891,8 +891,8 @@ int aac_get_adapter_info(struct aac_dev* dev)
                 }
         }
 
-        fib_complete(fibptr);
-        fib_free(fibptr);
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
 
         return rcode;
 }
@@ -976,8 +976,8 @@ static void io_callback(void *context, struct fib * fibptr)
                     ? sizeof(scsicmd->sense_buffer)
                     : sizeof(dev->fsa_dev[cid].sense_data));
         }
-        fib_complete(fibptr);
-        fib_free(fibptr);
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
 
         scsicmd->scsi_done(scsicmd);
 }
@@ -1062,11 +1062,11 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
         /*
          *      Alocate and initialize a Fib
          */
-        if (!(cmd_fibcontext = fib_alloc(dev))) {
+        if (!(cmd_fibcontext = aac_fib_alloc(dev))) {
                 return -1;
         }
 
-        fib_init(cmd_fibcontext);
+        aac_fib_init(cmd_fibcontext);
 
         if (dev->raw_io_interface) {
                 struct aac_raw_io *readcmd;
@@ -1086,7 +1086,7 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ContainerRawIo,
+                status = aac_fib_send(ContainerRawIo,
                           cmd_fibcontext, 
                           fibsize, 
                           FsaNormal, 
@@ -1112,7 +1112,7 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ContainerCommand64, 
+                status = aac_fib_send(ContainerCommand64,
                           cmd_fibcontext, 
                           fibsize, 
                           FsaNormal, 
@@ -1136,7 +1136,7 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ContainerCommand, 
+                status = aac_fib_send(ContainerCommand,
                           cmd_fibcontext, 
                           fibsize, 
                           FsaNormal, 
@@ -1153,14 +1153,14 @@ static int aac_read(struct scsi_cmnd * scsicmd, int cid)
         if (status == -EINPROGRESS) 
                 return 0;
                 
-        printk(KERN_WARNING "aac_read: fib_send failed with status: %d.\n", status);
+        printk(KERN_WARNING "aac_read: aac_fib_send failed with status: %d.\n", status);
         /*
          *      For some reason, the Fib didn't queue, return QUEUE_FULL
          */
         scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_TASK_SET_FULL;
         scsicmd->scsi_done(scsicmd);
-        fib_complete(cmd_fibcontext);
-        fib_free(cmd_fibcontext);
+        aac_fib_complete(cmd_fibcontext);
+        aac_fib_free(cmd_fibcontext);
         return 0;
 }
 
@@ -1228,12 +1228,12 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
         /*
          *      Allocate and initialize a Fib then setup a BlockWrite command
          */
-        if (!(cmd_fibcontext = fib_alloc(dev))) {
+        if (!(cmd_fibcontext = aac_fib_alloc(dev))) {
                 scsicmd->result = DID_ERROR << 16;
                 scsicmd->scsi_done(scsicmd);
                 return 0;
         }
-        fib_init(cmd_fibcontext);
+        aac_fib_init(cmd_fibcontext);
 
         if (dev->raw_io_interface) {
                 struct aac_raw_io *writecmd;
@@ -1253,7 +1253,7 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ContainerRawIo,
+                status = aac_fib_send(ContainerRawIo,
                           cmd_fibcontext, 
                           fibsize, 
                           FsaNormal, 
@@ -1279,7 +1279,7 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ContainerCommand64, 
+                status = aac_fib_send(ContainerCommand64,
                           cmd_fibcontext, 
                           fibsize, 
                           FsaNormal, 
@@ -1305,7 +1305,7 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ContainerCommand, 
+                status = aac_fib_send(ContainerCommand,
                           cmd_fibcontext, 
                           fibsize, 
                           FsaNormal, 
@@ -1322,15 +1322,15 @@ static int aac_write(struct scsi_cmnd * scsicmd, int cid)
                 return 0;
         }
 
-        printk(KERN_WARNING "aac_write: fib_send failed with status: %d\n", status);
+        printk(KERN_WARNING "aac_write: aac_fib_send failed with status: %d\n", status);
         /*
          *      For some reason, the Fib didn't queue, return QUEUE_FULL
          */
         scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 | SAM_STAT_TASK_SET_FULL;
         scsicmd->scsi_done(scsicmd);
 
-        fib_complete(cmd_fibcontext);
-        fib_free(cmd_fibcontext);
+        aac_fib_complete(cmd_fibcontext);
+        aac_fib_free(cmd_fibcontext);
         return 0;
 }
 
@@ -1369,8 +1369,8 @@ static void synchronize_callback(void *context, struct fib *fibptr)
                           sizeof(cmd->sense_buffer)));
         }
 
-        fib_complete(fibptr);
-        fib_free(fibptr);
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
         cmd->scsi_done(cmd);
 }
 
@@ -1407,10 +1407,10 @@ static int aac_synchronize(struct scsi_cmnd *scsicmd, int cid)
          *      Allocate and initialize a Fib
          */
         if (!(cmd_fibcontext = 
-            fib_alloc((struct aac_dev *)scsicmd->device->host->hostdata))) 
+            aac_fib_alloc((struct aac_dev *)scsicmd->device->host->hostdata)))
                 return SCSI_MLQUEUE_HOST_BUSY;
 
-        fib_init(cmd_fibcontext);
+        aac_fib_init(cmd_fibcontext);
 
         synchronizecmd = fib_data(cmd_fibcontext);
         synchronizecmd->command = cpu_to_le32(VM_ContainerConfig);
@@ -1422,7 +1422,7 @@ static int aac_synchronize(struct scsi_cmnd *scsicmd, int cid)
         /*
          *      Now send the Fib to the adapter
          */
-        status = fib_send(ContainerCommand,
+        status = aac_fib_send(ContainerCommand,
                   cmd_fibcontext,
                   sizeof(struct aac_synchronize),
                   FsaNormal,
@@ -1437,9 +1437,9 @@ static int aac_synchronize(struct scsi_cmnd *scsicmd, int cid)
                 return 0;
 
         printk(KERN_WARNING 
-                "aac_synchronize: fib_send failed with status: %d.\n", status);
-        fib_complete(cmd_fibcontext);
-        fib_free(cmd_fibcontext);
+                "aac_synchronize: aac_fib_send failed with status: %d.\n", status);
+        aac_fib_complete(cmd_fibcontext);
+        aac_fib_free(cmd_fibcontext);
         return SCSI_MLQUEUE_HOST_BUSY;
 }
 
@@ -1465,7 +1465,7 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
          *      itself.
          */
         if (scmd_id(scsicmd) != host->this_id) {
-                if ((scsicmd->device->channel == 0) ){
+                if ((scsicmd->device->channel == CONTAINER_CHANNEL)) {
                         if( (scsicmd->device->id >= dev->maximum_num_containers) || (scsicmd->device->lun != 0)){ 
                                 scsicmd->result = DID_NO_CONNECT << 16;
                                 scsicmd->scsi_done(scsicmd);
@@ -1488,7 +1488,7 @@ int aac_scsi_cmd(struct scsi_cmnd * scsicmd)
                                 case READ_CAPACITY:
                                 case TEST_UNIT_READY:
                                         spin_unlock_irq(host->host_lock);
-                                        probe_container(dev, cid);
+                                        aac_probe_container(dev, cid);
                                         if ((fsa_dev_ptr[cid].valid & 1) == 0)
                                                 fsa_dev_ptr[cid].valid = 0;
                                         spin_lock_irq(host->host_lock);
@@ -1935,33 +1935,7 @@ static void aac_srb_callback(void *context, struct fib * fibptr)
         case SRB_STATUS_ERROR_RECOVERY:
         case SRB_STATUS_PENDING:
         case SRB_STATUS_SUCCESS:
-                if(scsicmd->cmnd[0] == INQUIRY ){
-                        u8 b;
-                        u8 b1;
-                        /* We can't expose disk devices because we can't tell whether they
-                         * are the raw container drives or stand alone drives.  If they have
-                         * the removable bit set then we should expose them though.
-                         */
-                        b = (*(u8*)scsicmd->buffer)&0x1f;
-                        b1 = ((u8*)scsicmd->buffer)[1];
-                        if( b==TYPE_TAPE || b==TYPE_WORM || b==TYPE_ROM || b==TYPE_MOD|| b==TYPE_MEDIUM_CHANGER 
-                                        || (b==TYPE_DISK && (b1&0x80)) ){
-                                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
-                        /*
-                         * We will allow disk devices if in RAID/SCSI mode and
-                         * the channel is 2
-                         */
-                        } else if ((dev->raid_scsi_mode) &&
-                                        (scmd_channel(scsicmd) == 2)) {
-                                scsicmd->result = DID_OK << 16 | 
-                                                COMMAND_COMPLETE << 8;
-                        } else {
-                                scsicmd->result = DID_NO_CONNECT << 16 | 
-                                                COMMAND_COMPLETE << 8;
-                        }
-                } else {
-                        scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
-                }
+                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
                 break;
         case SRB_STATUS_DATA_OVERRUN:
                 switch(scsicmd->cmnd[0]){
@@ -1981,28 +1955,7 @@ static void aac_srb_callback(void *context, struct fib * fibptr)
                         scsicmd->result = DID_ERROR << 16 | COMMAND_COMPLETE << 8;
                         break;
                 case INQUIRY: {
-                        u8 b;
-                        u8 b1;
-                        /* We can't expose disk devices because we can't tell whether they
-                        * are the raw container drives or stand alone drives
-                        */
-                        b = (*(u8*)scsicmd->buffer)&0x0f;
-                        b1 = ((u8*)scsicmd->buffer)[1];
-                        if( b==TYPE_TAPE || b==TYPE_WORM || b==TYPE_ROM || b==TYPE_MOD|| b==TYPE_MEDIUM_CHANGER
-                                        || (b==TYPE_DISK && (b1&0x80)) ){
-                                scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
-                        /*
-                         * We will allow disk devices if in RAID/SCSI mode and
-                         * the channel is 2
-                         */
-                        } else if ((dev->raid_scsi_mode) &&
-                                        (scmd_channel(scsicmd) == 2)) {
-                                scsicmd->result = DID_OK << 16 | 
-                                                COMMAND_COMPLETE << 8;
-                        } else {
-                                scsicmd->result = DID_NO_CONNECT << 16 | 
-                                                COMMAND_COMPLETE << 8;
-                        }
+                        scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8;
                         break;
                 }
                 default:
@@ -2089,8 +2042,8 @@ static void aac_srb_callback(void *context, struct fib * fibptr)
          */
         scsicmd->result |= le32_to_cpu(srbreply->scsi_status);
 
-        fib_complete(fibptr);
-        fib_free(fibptr);
+        aac_fib_complete(fibptr);
+        aac_fib_free(fibptr);
         scsicmd->scsi_done(scsicmd);
 }
 
@@ -2142,10 +2095,10 @@ static int aac_send_srb_fib(struct scsi_cmnd* scsicmd)
         /*
          *      Allocate and initialize a Fib then setup a BlockWrite command
          */
-        if (!(cmd_fibcontext = fib_alloc(dev))) {
+        if (!(cmd_fibcontext = aac_fib_alloc(dev))) {
                 return -1;
         }
-        fib_init(cmd_fibcontext);
+        aac_fib_init(cmd_fibcontext);
 
         srbcmd = (struct aac_srb*) fib_data(cmd_fibcontext);
         srbcmd->function = cpu_to_le32(SRBF_ExecuteScsi);
@@ -2179,7 +2132,7 @@ static int aac_send_srb_fib(struct scsi_cmnd* scsicmd)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ScsiPortCommand64, cmd_fibcontext, 
+                status = aac_fib_send(ScsiPortCommand64, cmd_fibcontext,
                                 fibsize, FsaNormal, 0, 1,
                                   (fib_callback) aac_srb_callback, 
                                   (void *) scsicmd);
@@ -2201,7 +2154,7 @@ static int aac_send_srb_fib(struct scsi_cmnd* scsicmd)
                 /*
                  *      Now send the Fib to the adapter
                  */
-                status = fib_send(ScsiPortCommand, cmd_fibcontext, fibsize, FsaNormal, 0, 1,
+                status = aac_fib_send(ScsiPortCommand, cmd_fibcontext, fibsize, FsaNormal, 0, 1,
                                   (fib_callback) aac_srb_callback, (void *) scsicmd);
         }
         /*
@@ -2211,9 +2164,9 @@ static int aac_send_srb_fib(struct scsi_cmnd* scsicmd)
                 return 0;
         }
 
-        printk(KERN_WARNING "aac_srb: fib_send failed with status: %d\n", status);
-        fib_complete(cmd_fibcontext);
-        fib_free(cmd_fibcontext);
+        printk(KERN_WARNING "aac_srb: aac_fib_send failed with status: %d\n", status);
+        aac_fib_complete(cmd_fibcontext);
+        aac_fib_free(cmd_fibcontext);
 
         return -1;
 }
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 66dbb6d2c506..2d430b7e8cf4 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1774,16 +1774,16 @@ static inline u32 cap_to_cyls(sector_t capacity, u32 divisor)
 struct scsi_cmnd;
 
 const char *aac_driverinfo(struct Scsi_Host *);
-struct fib *fib_alloc(struct aac_dev *dev);
-int fib_setup(struct aac_dev *dev);
-void fib_map_free(struct aac_dev *dev);
-void fib_free(struct fib * context);
-void fib_init(struct fib * context);
+struct fib *aac_fib_alloc(struct aac_dev *dev);
+int aac_fib_setup(struct aac_dev *dev);
+void aac_fib_map_free(struct aac_dev *dev);
+void aac_fib_free(struct fib * context);
+void aac_fib_init(struct fib * context);
 void aac_printf(struct aac_dev *dev, u32 val);
-int fib_send(u16 command, struct fib * context, unsigned long size, int priority, int wait, int reply, fib_callback callback, void *ctxt);
+int aac_fib_send(u16 command, struct fib * context, unsigned long size, int priority, int wait, int reply, fib_callback callback, void *ctxt);
 int aac_consumer_get(struct aac_dev * dev, struct aac_queue * q, struct aac_entry **entry);
 void aac_consumer_free(struct aac_dev * dev, struct aac_queue * q, u32 qnum);
-int fib_complete(struct fib * context);
+int aac_fib_complete(struct fib * context);
 #define fib_data(fibctx) ((void *)(fibctx)->hw_fib->data)
 struct aac_dev *aac_init_adapter(struct aac_dev *dev);
 int aac_get_config_status(struct aac_dev *dev);
@@ -1799,11 +1799,11 @@ unsigned int aac_command_normal(struct aac_queue * q);
 unsigned int aac_intr_normal(struct aac_dev * dev, u32 Index);
 int aac_command_thread(struct aac_dev * dev);
 int aac_close_fib_context(struct aac_dev * dev, struct aac_fib_context *fibctx);
-int fib_adapter_complete(struct fib * fibptr, unsigned short size);
+int aac_fib_adapter_complete(struct fib * fibptr, unsigned short size);
 struct aac_driver_ident* aac_get_driver_ident(int devtype);
 int aac_get_adapter_info(struct aac_dev* dev);
 int aac_send_shutdown(struct aac_dev *dev);
-int probe_container(struct aac_dev *dev, int cid);
+int aac_probe_container(struct aac_dev *dev, int cid);
 extern int numacb;
 extern int acbsize;
 extern char aac_driver_version[];
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index 4fe79cd7c957..47fefca72695 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
         unsigned size;
         int retval;
 
-        fibptr = fib_alloc(dev);
+        fibptr = aac_fib_alloc(dev);
         if(fibptr == NULL) {
                 return -ENOMEM;
         }
@@ -73,7 +73,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
          *      First copy in the header so that we can check the size field.
          */
         if (copy_from_user((void *)kfib, arg, sizeof(struct aac_fibhdr))) {
-                fib_free(fibptr);
+                aac_fib_free(fibptr);
                 return -EFAULT;
         }
         /*
@@ -110,13 +110,13 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
                  */
                 kfib->header.XferState = 0;
         } else {
-                retval = fib_send(le16_to_cpu(kfib->header.Command), fibptr,
+                retval = aac_fib_send(le16_to_cpu(kfib->header.Command), fibptr,
                                 le16_to_cpu(kfib->header.Size) , FsaNormal,
                                 1, 1, NULL, NULL);
                 if (retval) {
                         goto cleanup;
                 }
-                if (fib_complete(fibptr) != 0) {
+                if (aac_fib_complete(fibptr) != 0) {
                         retval = -EINVAL;
                         goto cleanup;
                 }
@@ -138,7 +138,7 @@ cleanup:
                 fibptr->hw_fib_pa = hw_fib_pa;
                 fibptr->hw_fib = hw_fib;
         }
-        fib_free(fibptr);
+        aac_fib_free(fibptr);
         return retval;
 }
 
@@ -464,10 +464,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
         /*
          *      Allocate and initialize a Fib then setup a BlockWrite command
          */
-        if (!(srbfib = fib_alloc(dev))) {
+        if (!(srbfib = aac_fib_alloc(dev))) {
                 return -ENOMEM;
         }
-        fib_init(srbfib);
+        aac_fib_init(srbfib);
 
         srbcmd = (struct aac_srb*) fib_data(srbfib);
 
@@ -601,7 +601,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 
                 srbcmd->count = cpu_to_le32(byte_count);
                 psg->count = cpu_to_le32(sg_indx+1);
-                status = fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL);
+                status = aac_fib_send(ScsiPortCommand64, srbfib, actual_fibsize, FsaNormal, 1, 1,NULL,NULL);
         } else {
                 struct user_sgmap* upsg = &user_srbcmd->sg;
                 struct sgmap* psg = &srbcmd->sg;
@@ -649,7 +649,7 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                 }
                 srbcmd->count = cpu_to_le32(byte_count);
                 psg->count = cpu_to_le32(sg_indx+1);
-                status = fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);
+                status = aac_fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);
         }
 
         if (status != 0){
@@ -684,8 +684,8 @@ cleanup:
         for(i=0; i <= sg_indx; i++){
                 kfree(sg_list[i]);
         }
-        fib_complete(srbfib);
-        fib_free(srbfib);
+        aac_fib_complete(srbfib);
+        aac_fib_free(srbfib);
 
         return rcode;
 }
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 82821d331c07..1628d094943d 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -185,17 +185,17 @@ int aac_send_shutdown(struct aac_dev * dev)
         struct aac_close *cmd;
         int status;
 
-        fibctx = fib_alloc(dev);
+        fibctx = aac_fib_alloc(dev);
         if (!fibctx)
                 return -ENOMEM;
-        fib_init(fibctx);
+        aac_fib_init(fibctx);
 
         cmd = (struct aac_close *) fib_data(fibctx);
 
         cmd->command = cpu_to_le32(VM_CloseAll);
         cmd->cid = cpu_to_le32(0xffffffff);
 
-        status = fib_send(ContainerCommand,
+        status = aac_fib_send(ContainerCommand,
                           fibctx,
                           sizeof(struct aac_close),
                           FsaNormal,
@@ -203,8 +203,8 @@ int aac_send_shutdown(struct aac_dev * dev)
                           NULL, NULL);
 
         if (status == 0)
-                fib_complete(fibctx);
-        fib_free(fibctx);
+                aac_fib_complete(fibctx);
+        aac_fib_free(fibctx);
         return status;
 }
 
@@ -427,7 +427,7 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
         /*
          *      Initialize the list of fibs
          */
-        if(fib_setup(dev)<0){
+        if (aac_fib_setup(dev) < 0) {
                 kfree(dev->queues);
                 return NULL;
         }
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index 38d6d00fb0fc..609fd19b1844 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -38,10 +38,10 @@
 #include <linux/slab.h>
 #include <linux/completion.h>
 #include <linux/blkdev.h>
+#include <linux/delay.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_device.h>
 #include <asm/semaphore.h>
-#include <asm/delay.h>
 
 #include "aacraid.h"
 
@@ -67,27 +67,27 @@ static int fib_map_alloc(struct aac_dev *dev)
 }
 
 /**
- *      fib_map_free            -       free the fib objects
+ *      aac_fib_map_free                -       free the fib objects
  *      @dev: Adapter to free
  *
  *      Free the PCI mappings and the memory allocated for FIB blocks
  *      on this adapter.
  */
 
-void fib_map_free(struct aac_dev *dev)
+void aac_fib_map_free(struct aac_dev *dev)
 {
         pci_free_consistent(dev->pdev, dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB), dev->hw_fib_va, dev->hw_fib_pa);
 }
 
 /**
- *      fib_setup       -       setup the fibs
+ *      aac_fib_setup   -       setup the fibs
  *      @dev: Adapter to set up
  *
  *      Allocate the PCI space for the fibs, map it and then intialise the
  *      fib area, the unmapped fib data and also the free list
  */
 
-int fib_setup(struct aac_dev * dev)
+int aac_fib_setup(struct aac_dev * dev)
 {
         struct fib *fibptr;
         struct hw_fib *hw_fib_va;
@@ -134,14 +134,14 @@ int fib_setup(struct aac_dev * dev)
 }
 
 /**
- *      fib_alloc       -       allocate a fib
+ *      aac_fib_alloc   -       allocate a fib
  *      @dev: Adapter to allocate the fib for
  *
  *      Allocate a fib from the adapter fib pool. If the pool is empty we
  *      return NULL.
  */
  
-struct fib * fib_alloc(struct aac_dev *dev)
+struct fib *aac_fib_alloc(struct aac_dev *dev)
 {
         struct fib * fibptr;
         unsigned long flags;
@@ -170,14 +170,14 @@ struct fib * fib_alloc(struct aac_dev *dev)
 }
 
 /**
- *      fib_free        -       free a fib
+ *      aac_fib_free    -       free a fib
  *      @fibptr: fib to free up
  *
  *      Frees up a fib and places it on the appropriate queue
  *      (either free or timed out)
  */
  
-void fib_free(struct fib * fibptr)
+void aac_fib_free(struct fib *fibptr)
 {
         unsigned long flags;
 
@@ -188,7 +188,7 @@ void fib_free(struct fib * fibptr)
                 fibptr->dev->timeout_fib = fibptr;
         } else {
                 if (fibptr->hw_fib->header.XferState != 0) {
-                        printk(KERN_WARNING "fib_free, XferState != 0, fibptr = 0x%p, XferState = 0x%x\n", 
+                        printk(KERN_WARNING "aac_fib_free, XferState != 0, fibptr = 0x%p, XferState = 0x%x\n",
                                  (void*)fibptr, 
                                  le32_to_cpu(fibptr->hw_fib->header.XferState));
                 }
@@ -199,13 +199,13 @@ void fib_free(struct fib * fibptr)
 }
 
 /**
- *      fib_init        -       initialise a fib
+ *      aac_fib_init    -       initialise a fib
  *      @fibptr: The fib to initialize
  *      
  *      Set up the generic fib fields ready for use
  */
  
-void fib_init(struct fib *fibptr)
+void aac_fib_init(struct fib *fibptr)
 {
         struct hw_fib *hw_fib = fibptr->hw_fib;
 
@@ -362,7 +362,7 @@ static int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_f
  */
 
 /**
- *      fib_send        -       send a fib to the adapter
+ *      aac_fib_send    -       send a fib to the adapter
  *      @command: Command to send
  *      @fibptr: The fib
  *      @size: Size of fib data area
@@ -378,7 +378,9 @@ static int aac_queue_get(struct aac_dev * dev, u32 * index, u32 qid, struct hw_f
  *      response FIB is received from the adapter.
  */
  
-int fib_send(u16 command, struct fib * fibptr, unsigned long size,  int priority, int wait, int reply, fib_callback callback, void * callback_data)
+int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
+                int priority, int wait, int reply, fib_callback callback,
+                void *callback_data)
 {
         struct aac_dev * dev = fibptr->dev;
         struct hw_fib * hw_fib = fibptr->hw_fib;
@@ -493,7 +495,7 @@ int fib_send(u16 command, struct fib * fibptr, unsigned long size,  int priority
                 q->numpending++;
                 *(q->headers.producer) = cpu_to_le32(index + 1);
                 spin_unlock_irqrestore(q->lock, qflags);
-                dprintk((KERN_DEBUG "fib_send: inserting a queue entry at index %d.\n",index));
+                dprintk((KERN_DEBUG "aac_fib_send: inserting a queue entry at index %d.\n",index));
                 if (!(nointr & aac_config.irq_mod))
                         aac_adapter_notify(dev, AdapNormCmdQueue);
         }
@@ -520,7 +522,7 @@ int fib_send(u16 command, struct fib * fibptr, unsigned long size,  int priority
                                         list_del(&fibptr->queue);
                                         spin_unlock_irqrestore(q->lock, qflags);
                                         if (wait == -1) {
-                                                printk(KERN_ERR "aacraid: fib_send: first asynchronous command timed out.\n"
+                                                printk(KERN_ERR "aacraid: aac_fib_send: first asynchronous command timed out.\n"
                                                   "Usually a result of a PCI interrupt routing problem;\n"
                                                   "update mother board BIOS or consider utilizing one of\n"
                                                   "the SAFE mode kernel options (acpi, apic etc)\n");
@@ -624,7 +626,7 @@ void aac_consumer_free(struct aac_dev * dev, struct aac_queue *q, u32 qid)
 }        
 
 /**
- *      fib_adapter_complete    -       complete adapter issued fib
+ *      aac_fib_adapter_complete        -       complete adapter issued fib
  *      @fibptr: fib to complete
  *      @size: size of fib
  *
@@ -632,7 +634,7 @@ void aac_consumer_free(struct aac_dev * dev, struct aac_queue *q, u32 qid)
  *      the adapter.
  */
 
-int fib_adapter_complete(struct fib * fibptr, unsigned short size)
+int aac_fib_adapter_complete(struct fib *fibptr, unsigned short size)
 {
         struct hw_fib * hw_fib = fibptr->hw_fib;
         struct aac_dev * dev = fibptr->dev;
@@ -683,20 +685,20 @@ int fib_adapter_complete(struct fib * fibptr, unsigned short size)
         }
         else 
         {
-                printk(KERN_WARNING "fib_adapter_complete: Unknown xferstate detected.\n");
+                printk(KERN_WARNING "aac_fib_adapter_complete: Unknown xferstate detected.\n");
                 BUG();
         }   
         return 0;
 }
 
 /**
- *      fib_complete    -       fib completion handler
+ *      aac_fib_complete        -       fib completion handler
  *      @fib: FIB to complete
  *
  *      Will do all necessary work to complete a FIB.
  */
  
-int fib_complete(struct fib * fibptr)
+int aac_fib_complete(struct fib *fibptr)
 {
         struct hw_fib * hw_fib = fibptr->hw_fib;
 
@@ -995,14 +997,14 @@ static void aac_handle_aif(struct aac_dev * dev, struct fib * fibptr)
         if (!dev || !dev->scsi_host_ptr)
                 return;
         /*
-         * force reload of disk info via probe_container
+         * force reload of disk info via aac_probe_container
          */
         if ((device_config_needed == CHANGE)
          && (dev->fsa_dev[container].valid == 1))
                 dev->fsa_dev[container].valid = 2;
         if ((device_config_needed == CHANGE) ||
                         (device_config_needed == ADD))
-                probe_container(dev, container);
+                aac_probe_container(dev, container);
         device = scsi_device_lookup(dev->scsi_host_ptr, 
                 CONTAINER_TO_CHANNEL(container), 
                 CONTAINER_TO_ID(container), 
@@ -1104,7 +1106,7 @@ int aac_command_thread(struct aac_dev * dev)
                                 /* Handle Driver Notify Events */
                                 aac_handle_aif(dev, fib);
                                 *(__le32 *)hw_fib->data = cpu_to_le32(ST_OK);
-                                fib_adapter_complete(fib, (u16)sizeof(u32));
+                                aac_fib_adapter_complete(fib, (u16)sizeof(u32));
                         } else {
                                 struct list_head *entry;
                                 /* The u32 here is important and intended. We are using
@@ -1241,7 +1243,7 @@ int aac_command_thread(struct aac_dev * dev)
                                  *      Set the status of this FIB
                                  */
                                 *(__le32 *)hw_fib->data = cpu_to_le32(ST_OK);
-                                fib_adapter_complete(fib, sizeof(u32));
+                                aac_fib_adapter_complete(fib, sizeof(u32));
                                 spin_unlock_irqrestore(&dev->fib_lock, flagv);
                                 /* Free up the remaining resources */
                                 hw_fib_p = hw_fib_pool;
diff --git a/drivers/scsi/aacraid/dpcsup.c b/drivers/scsi/aacraid/dpcsup.c
index 439948ef8251..f6bcb9486f85 100644
--- a/drivers/scsi/aacraid/dpcsup.c
+++ b/drivers/scsi/aacraid/dpcsup.c
@@ -206,7 +206,7 @@ unsigned int aac_command_normal(struct aac_queue *q)
                          *      Set the status of this FIB
                          */
                         *(__le32 *)hw_fib->data = cpu_to_le32(ST_OK);
-                        fib_adapter_complete(fib, sizeof(u32));
+                        aac_fib_adapter_complete(fib, sizeof(u32));
                         spin_lock_irqsave(q->lock, flags);
                 }               
         }
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 0bf5f9a943e8..271617890562 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -385,17 +385,45 @@ static int aac_biosparm(struct scsi_device *sdev, struct block_device *bdev,
 
 static int aac_slave_configure(struct scsi_device *sdev)
 {
-        struct Scsi_Host *host = sdev->host;
+        if (sdev_channel(sdev) == CONTAINER_CHANNEL) {
+                sdev->skip_ms_page_8 = 1;
+                sdev->skip_ms_page_3f = 1;
+        }
+        if ((sdev->type == TYPE_DISK) &&
+                        (sdev_channel(sdev) != CONTAINER_CHANNEL)) {
+                struct aac_dev *aac = (struct aac_dev *)sdev->host->hostdata;
+                if (!aac->raid_scsi_mode || (sdev_channel(sdev) != 2))
+                        sdev->no_uld_attach = 1;
+        }
+        if (sdev->tagged_supported && (sdev->type == TYPE_DISK) &&
+                        (sdev_channel(sdev) == CONTAINER_CHANNEL)) {
+                struct scsi_device * dev;
+                struct Scsi_Host *host = sdev->host;
+                unsigned num_lsu = 0;
+                unsigned num_one = 0;
+                unsigned depth;
 
-        if (sdev->tagged_supported)
-                scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, 128);
-        else
+                __shost_for_each_device(dev, host) {
+                        if (dev->tagged_supported && (dev->type == TYPE_DISK) &&
+                                (sdev_channel(dev) == CONTAINER_CHANNEL))
+                                ++num_lsu;
+                        else
+                                ++num_one;
+                }
+                if (num_lsu == 0)
+                        ++num_lsu;
+                depth = (host->can_queue - num_one) / num_lsu;
+                if (depth > 256)
+                        depth = 256;
+                else if (depth < 2)
+                        depth = 2;
+                scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG, depth);
+                if (!(((struct aac_dev *)host->hostdata)->adapter_info.options &
+                                AAC_OPT_NEW_COMM))
+                        blk_queue_max_segment_size(sdev->request_queue, 65536);
+        } else
                 scsi_adjust_queue_depth(sdev, 0, 1);
 
-        if (!(((struct aac_dev *)host->hostdata)->adapter_info.options
-          & AAC_OPT_NEW_COMM))
-                blk_queue_max_segment_size(sdev->request_queue, 65536);
-
         return 0;
 }
 
@@ -870,7 +898,7 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
  
         /*
          * max channel will be the physical channels plus 1 virtual channel
-         * all containers are on the virtual channel 0
+         * all containers are on the virtual channel 0 (CONTAINER_CHANNEL)
          * physical channels are address by their actual physical number+1
          */
         if (aac->nondasd_support == 1)
@@ -913,7 +941,7 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
         aac_adapter_disable_int(aac);
         free_irq(pdev->irq, aac);
  out_unmap:
-        fib_map_free(aac);
+        aac_fib_map_free(aac);
         pci_free_consistent(aac->pdev, aac->comm_size, aac->comm_addr, aac->comm_phys);
         kfree(aac->queues);
         iounmap(aac->regs.sa);
@@ -947,7 +975,7 @@ static void __devexit aac_remove_one(struct pci_dev *pdev)
 
         aac_send_shutdown(aac);
         aac_adapter_disable_int(aac);
-        fib_map_free(aac);
+        aac_fib_map_free(aac);
         pci_free_consistent(aac->pdev, aac->comm_size, aac->comm_addr,
                         aac->comm_phys);
         kfree(aac->queues);
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index cb2ee25f213f..531a1f9ceb51 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -1260,16 +1260,15 @@ static void free_hard_reset_SCs(struct Scsi_Host *shpnt, Scsi_Cmnd **SCs)
  * Reset the bus
  *
  */
-static int aha152x_bus_reset(Scsi_Cmnd *SCpnt)
+static int aha152x_bus_reset_host(struct Scsi_Host *shpnt)
 {
-        struct Scsi_Host *shpnt = SCpnt->device->host;
         unsigned long flags;
 
         DO_LOCK(flags);
 
 #if defined(AHA152X_DEBUG)
         if(HOSTDATA(shpnt)->debug & debug_eh) {
-                printk(DEBUG_LEAD "aha152x_bus_reset(%p)", CMDINFO(SCpnt), SCpnt);
+                printk(KERN_DEBUG "scsi%d: bus reset", shpnt->host_no);
                 show_queues(shpnt);
         }
 #endif
@@ -1277,14 +1276,14 @@ static int aha152x_bus_reset(Scsi_Cmnd *SCpnt)
         free_hard_reset_SCs(shpnt, &ISSUE_SC);
         free_hard_reset_SCs(shpnt, &DISCONNECTED_SC);
 
-        DPRINTK(debug_eh, DEBUG_LEAD "resetting bus\n", CMDINFO(SCpnt));
+        DPRINTK(debug_eh, KERN_DEBUG "scsi%d: resetting bus\n", shpnt->host_no);
 
         SETPORT(SCSISEQ, SCSIRSTO);
         mdelay(256);
         SETPORT(SCSISEQ, 0);
         mdelay(DELAY);
 
-        DPRINTK(debug_eh, DEBUG_LEAD "bus resetted\n", CMDINFO(SCpnt));
+        DPRINTK(debug_eh, KERN_DEBUG "scsi%d: bus resetted\n", shpnt->host_no);
 
         setup_expected_interrupts(shpnt);
         if(HOSTDATA(shpnt)->commands==0)
@@ -1295,6 +1294,14 @@ static int aha152x_bus_reset(Scsi_Cmnd *SCpnt)
         return SUCCESS;
 }
 
+/*
+ * Reset the bus
+ *
+ */
+static int aha152x_bus_reset(Scsi_Cmnd *SCpnt)
+{
+        return aha152x_bus_reset_host(SCpnt->device->host);
+}
 
 /*
  *  Restore default values to the AIC-6260 registers and reset the fifos
@@ -1337,23 +1344,28 @@ static void reset_ports(struct Scsi_Host *shpnt)
  * Reset the host (bus and controller)
  *
  */
-int aha152x_host_reset(Scsi_Cmnd * SCpnt)
+int aha152x_host_reset_host(struct Scsi_Host *shpnt)
 {
-#if defined(AHA152X_DEBUG)
-        struct Scsi_Host *shpnt = SCpnt->device->host;
-#endif
-
-        DPRINTK(debug_eh, DEBUG_LEAD "aha152x_host_reset(%p)\n", CMDINFO(SCpnt), SCpnt);
+        DPRINTK(debug_eh, KERN_DEBUG "scsi%d: host reset\n", shpnt->host_no);
 
-        aha152x_bus_reset(SCpnt);
+        aha152x_bus_reset_host(shpnt);
 
-        DPRINTK(debug_eh, DEBUG_LEAD "resetting ports\n", CMDINFO(SCpnt));
-        reset_ports(SCpnt->device->host);
+        DPRINTK(debug_eh, KERN_DEBUG "scsi%d: resetting ports\n", shpnt->host_no);
+        reset_ports(shpnt);
 
         return SUCCESS;
 }
 
 /*
+ * Reset the host (bus and controller)
+ * 
+ */
+static int aha152x_host_reset(Scsi_Cmnd *SCpnt)
+{
+        return aha152x_host_reset_host(SCpnt->device->host);
+}
+
+/*
  * Return the "logical geometry"
  *
  */
@@ -1431,22 +1443,18 @@ static void run(void)
 {
         int i;
         for (i = 0; i<ARRAY_SIZE(aha152x_host); i++) {
-                struct Scsi_Host *shpnt = aha152x_host[i];
-                if (shpnt && HOSTDATA(shpnt)->service) {
-                        HOSTDATA(shpnt)->service=0;
-                        is_complete(shpnt);
-                }
+                is_complete(aha152x_host[i]);
         }
 }
 
 /*
- *    Interrupts handler
+ * Interrupt handler
  *
  */
-
 static irqreturn_t intr(int irqno, void *dev_id, struct pt_regs *regs)
 {
         struct Scsi_Host *shpnt = lookup_irq(irqno);
+        unsigned long flags;
         unsigned char rev, dmacntrl0;
 
         if (!shpnt) {
@@ -1472,23 +1480,23 @@ static irqreturn_t intr(int irqno, void *dev_id, struct pt_regs *regs)
         if ((rev == 0xFF) && (dmacntrl0 == 0xFF))
                 return IRQ_NONE;
 
+        if( TESTLO(DMASTAT, INTSTAT) )
+                return IRQ_NONE;        
+
         /* no more interrupts from the controller, while we're busy.
            INTEN is restored by the BH handler */
         CLRBITS(DMACNTRL0, INTEN);
 
-#if 0
-        /* check if there is already something to be
-           serviced; should not happen */
-        if(HOSTDATA(shpnt)->service) {
-                printk(KERN_ERR "aha152x%d: lost interrupt (%d)\n", HOSTNO, HOSTDATA(shpnt)->service);
-                show_queues(shpnt);
+        DO_LOCK(flags);
+        if( HOSTDATA(shpnt)->service==0 ) {
+                HOSTDATA(shpnt)->service=1;
+
+                /* Poke the BH handler */
+                INIT_WORK(&aha152x_tq, (void *) run, NULL);
+                schedule_work(&aha152x_tq);
         }
-#endif
-        
-        /* Poke the BH handler */
-        HOSTDATA(shpnt)->service++;
-        INIT_WORK(&aha152x_tq, (void *) run, NULL);
-        schedule_work(&aha152x_tq);
+        DO_UNLOCK(flags);
+
         return IRQ_HANDLED;
 }
 
@@ -2527,7 +2535,18 @@ static void is_complete(struct Scsi_Host *shpnt)
         unsigned long flags;
         int pending;
 
+        if(!shpnt)
+                return;
+
         DO_LOCK(flags);
+
+        if( HOSTDATA(shpnt)->service==0 )  {
+                DO_UNLOCK(flags);
+                return;
+        }
+
+        HOSTDATA(shpnt)->service = 0;
+
         if(HOSTDATA(shpnt)->in_intr) {
                 DO_UNLOCK(flags);
                 /* aha152x_error never returns.. */
diff --git a/drivers/scsi/aha152x.h b/drivers/scsi/aha152x.h
index d277613af29b..d2add24d02a3 100644
--- a/drivers/scsi/aha152x.h
+++ b/drivers/scsi/aha152x.h
@@ -332,6 +332,6 @@ struct aha152x_setup {
 
 struct Scsi_Host *aha152x_probe_one(struct aha152x_setup *);
 void aha152x_release(struct Scsi_Host *);
-int aha152x_host_reset(Scsi_Cmnd *);
+int aha152x_host_reset_host(struct Scsi_Host *);
 
 #endif /* _AHA152X_H */
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index a800fb51168b..559ff7aae3f1 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -742,23 +742,17 @@ static irqreturn_t ahci_interrupt (int irq, void *dev_instance, struct pt_regs *
                         struct ata_queued_cmd *qc;
                         qc = ata_qc_from_tag(ap, ap->active_tag);
                         if (!ahci_host_intr(ap, qc))
-                                if (ata_ratelimit()) {
-                                        struct pci_dev *pdev =
-                                                to_pci_dev(ap->host_set->dev);
-                                        dev_printk(KERN_WARNING, &pdev->dev,
+                                if (ata_ratelimit())
+                                        dev_printk(KERN_WARNING, host_set->dev,
                                           "unhandled interrupt on port %u\n",
                                           i);
-                                }
 
                         VPRINTK("port %u\n", i);
                 } else {
                         VPRINTK("port %u (no irq)\n", i);
-                        if (ata_ratelimit()) {
-                                struct pci_dev *pdev =
-                                        to_pci_dev(ap->host_set->dev);
-                                dev_printk(KERN_WARNING, &pdev->dev,
+                        if (ata_ratelimit())
+                                dev_printk(KERN_WARNING, host_set->dev,
                                         "interrupt on disabled port %u\n", i);
-                        }
                 }
 
                 irq_ack |= (1 << i);
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
index f6900538be90..87a8c3d2072c 100644
--- a/drivers/scsi/esp.c
+++ b/drivers/scsi/esp.c
@@ -2068,14 +2068,12 @@ static int esp_reset(struct scsi_cmnd *SCptr)
 {
         struct esp *esp = (struct esp *) SCptr->device->host->hostdata;
 
+        spin_lock_irq(esp->ehost->host_lock);
         (void) esp_do_resetbus(esp);
-
         spin_unlock_irq(esp->ehost->host_lock);
 
         wait_event(esp->reset_queue, (esp->resetting_bus == 0));
 
-        spin_lock_irq(esp->ehost->host_lock);
-
         return SUCCESS;
 }
 
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index bd3ffdf6c800..62e3cda859af 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -2816,7 +2816,7 @@ static int gdth_fill_cache_cmd(int hanum,Scsi_Cmnd *scp,ushort hdrive)
             }
 #endif
 
-        } else {
+        } else if (scp->request_bufflen) {
             scp->SCp.Status = GDTH_MAP_SINGLE;
             scp->SCp.Message = (read_write == 1 ? 
                 PCI_DMA_TODEVICE : PCI_DMA_FROMDEVICE);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 27acf78cf8d8..2bba5e55d7bc 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4236,35 +4236,6 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd)
 }
 
 /**
- * ipr_save_ioafp_mode_select - Save adapters mode select data
- * @ioa_cfg:    ioa config struct
- * @scsi_cmd:   scsi command struct
- *
- * This function saves mode select data for the adapter to
- * use following an adapter reset.
- *
- * Return value:
- *      0 on success / SCSI_MLQUEUE_HOST_BUSY on failure
- **/
-static int ipr_save_ioafp_mode_select(struct ipr_ioa_cfg *ioa_cfg,
-                                       struct scsi_cmnd *scsi_cmd)
-{
-        if (!ioa_cfg->saved_mode_pages) {
-                ioa_cfg->saved_mode_pages  = kmalloc(sizeof(struct ipr_mode_pages),
-                                                     GFP_ATOMIC);
-                if (!ioa_cfg->saved_mode_pages) {
-                        dev_err(&ioa_cfg->pdev->dev,
-                                "IOA mode select buffer allocation failed\n");
-                        return SCSI_MLQUEUE_HOST_BUSY;
-                }
-        }
-
-        memcpy(ioa_cfg->saved_mode_pages, scsi_cmd->buffer, scsi_cmd->cmnd[4]);
-        ioa_cfg->saved_mode_page_len = scsi_cmd->cmnd[4];
-        return 0;
-}
-
-/**
  * ipr_queuecommand - Queue a mid-layer request
  * @scsi_cmd:   scsi command struct
  * @done:               done function
@@ -4338,9 +4309,6 @@ static int ipr_queuecommand(struct scsi_cmnd *scsi_cmd,
             (!ipr_is_gscsi(res) || scsi_cmd->cmnd[0] == IPR_QUERY_RSRC_STATE))
                 ioarcb->cmd_pkt.request_type = IPR_RQTYPE_IOACMD;
 
-        if (ipr_is_ioa_resource(res) && scsi_cmd->cmnd[0] == MODE_SELECT)
-                rc = ipr_save_ioafp_mode_select(ioa_cfg, scsi_cmd);
-
         if (likely(rc == 0))
                 rc = ipr_build_ioadl(ioa_cfg, ipr_cmd);
 
@@ -4829,17 +4797,11 @@ static int ipr_ioafp_mode_select_page28(struct ipr_cmnd *ipr_cmd)
         int length;
 
         ENTER;
-        if (ioa_cfg->saved_mode_pages) {
-                memcpy(mode_pages, ioa_cfg->saved_mode_pages,
-                       ioa_cfg->saved_mode_page_len);
-                length = ioa_cfg->saved_mode_page_len;
-        } else {
-                ipr_scsi_bus_speed_limit(ioa_cfg);
-                ipr_check_term_power(ioa_cfg, mode_pages);
-                ipr_modify_ioafp_mode_page_28(ioa_cfg, mode_pages);
-                length = mode_pages->hdr.length + 1;
-                mode_pages->hdr.length = 0;
-        }
+        ipr_scsi_bus_speed_limit(ioa_cfg);
+        ipr_check_term_power(ioa_cfg, mode_pages);
+        ipr_modify_ioafp_mode_page_28(ioa_cfg, mode_pages);
+        length = mode_pages->hdr.length + 1;
+        mode_pages->hdr.length = 0;
 
         ipr_build_mode_select(ipr_cmd, cpu_to_be32(IPR_IOA_RES_HANDLE), 0x11,
                               ioa_cfg->vpd_cbs_dma + offsetof(struct ipr_misc_cbs, mode_pages),
@@ -5969,7 +5931,6 @@ static void ipr_free_mem(struct ipr_ioa_cfg *ioa_cfg)
         }
 
         ipr_free_dump(ioa_cfg);
-        kfree(ioa_cfg->saved_mode_pages);
         kfree(ioa_cfg->trace);
 }
 
diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
index b639332131f1..fd360bfe56dd 100644
--- a/drivers/scsi/ipr.h
+++ b/drivers/scsi/ipr.h
@@ -36,8 +36,8 @@
 /*
  * Literals
  */
-#define IPR_DRIVER_VERSION "2.1.1"
-#define IPR_DRIVER_DATE "(November 15, 2005)"
+#define IPR_DRIVER_VERSION "2.1.2"
+#define IPR_DRIVER_DATE "(February 8, 2006)"
 
 /*
  * IPR_MAX_CMD_PER_LUN: This defines the maximum number of outstanding
@@ -1000,7 +1000,6 @@ struct ipr_ioa_cfg {
         struct Scsi_Host *host;
         struct pci_dev *pdev;
         struct ipr_sglist *ucode_sglist;
-        struct ipr_mode_pages *saved_mode_pages;
         u8 saved_mode_page_len;
 
         struct work_struct work_q;
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 780bfcc67096..ff79e68b347c 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -146,7 +146,7 @@ iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err)
         spin_unlock_irqrestore(&session->lock, flags);
         set_bit(SUSPEND_BIT, &conn->suspend_tx);
         set_bit(SUSPEND_BIT, &conn->suspend_rx);
-        iscsi_conn_error(iscsi_handle(conn), err);
+        iscsi_conn_error(conn->cls_conn, err);
 }
 
 static inline int
@@ -244,12 +244,10 @@ iscsi_ctask_cleanup(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
         if (sc->sc_data_direction == DMA_TO_DEVICE) {
                 struct iscsi_data_task *dtask, *n;
                 /* WRITE: cleanup Data-Out's if any */
-                spin_lock(&conn->lock);
                 list_for_each_entry_safe(dtask, n, &ctask->dataqueue, item) {
                         list_del(&dtask->item);
                         mempool_free(dtask, ctask->datapool);
                 }
-                spin_unlock(&conn->lock);
         }
         ctask->xmstate = XMSTATE_IDLE;
         ctask->r2t = NULL;
@@ -689,7 +687,7 @@ iscsi_hdr_recv(struct iscsi_conn *conn)
                                 break;
 
                         if (!conn->in.datalen) {
-                                rc = iscsi_recv_pdu(iscsi_handle(conn), hdr,
+                                rc = iscsi_recv_pdu(conn->cls_conn, hdr,
                                                     NULL, 0);
                                 if (conn->login_mtask != mtask) {
                                         spin_lock(&session->lock);
@@ -737,7 +735,7 @@ iscsi_hdr_recv(struct iscsi_conn *conn)
                         if (!conn->in.datalen) {
                                 struct iscsi_mgmt_task *mtask;
 
-                                rc = iscsi_recv_pdu(iscsi_handle(conn), hdr,
+                                rc = iscsi_recv_pdu(conn->cls_conn, hdr,
                                                     NULL, 0);
                                 mtask = (struct iscsi_mgmt_task *)
                                         session->mgmt_cmds[conn->in.itt -
@@ -761,7 +759,7 @@ iscsi_hdr_recv(struct iscsi_conn *conn)
                                 rc = iscsi_check_assign_cmdsn(session,
                                                  (struct iscsi_nopin*)hdr);
                                 if (!rc && hdr->ttt != ISCSI_RESERVED_TAG)
-                                        rc = iscsi_recv_pdu(iscsi_handle(conn),
+                                        rc = iscsi_recv_pdu(conn->cls_conn,
                                                             hdr, NULL, 0);
                         } else
                                 rc = ISCSI_ERR_PROTO;
@@ -1044,7 +1042,7 @@ iscsi_data_recv(struct iscsi_conn *conn)
                         goto exit;
                 }
 
-                rc = iscsi_recv_pdu(iscsi_handle(conn), conn->in.hdr,
+                rc = iscsi_recv_pdu(conn->cls_conn, conn->in.hdr,
                                     conn->data, conn->in.datalen);
 
                 if (!rc && conn->datadgst_en &&
@@ -2428,19 +2426,20 @@ iscsi_pool_free(struct iscsi_queue *q, void **items)
 }
 
 static struct iscsi_cls_conn *
-iscsi_conn_create(struct Scsi_Host *shost, uint32_t conn_idx)
+iscsi_conn_create(struct iscsi_cls_session *cls_session, uint32_t conn_idx)
 {
+        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
         struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
         struct iscsi_conn *conn;
         struct iscsi_cls_conn *cls_conn;
 
-        cls_conn = iscsi_create_conn(hostdata_session(shost->hostdata),
-                                     conn_idx);
+        cls_conn = iscsi_create_conn(cls_session, conn_idx);
         if (!cls_conn)
                 return NULL;
         conn = cls_conn->dd_data;
+        memset(conn, 0, sizeof(*conn));
 
-        memset(conn, 0, sizeof(struct iscsi_conn));
+        conn->cls_conn = cls_conn;
         conn->c_stage = ISCSI_CONN_INITIAL_STAGE;
         conn->in_progress = IN_PROGRESS_WAIT_HEADER;
         conn->id = conn_idx;
@@ -2452,8 +2451,6 @@ iscsi_conn_create(struct Scsi_Host *shost, uint32_t conn_idx)
         conn->data_size = DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH;
         conn->max_recv_dlength = DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH;
 
-        spin_lock_init(&conn->lock);
-
         /* initialize general xmit PDU commands queue */
         conn->xmitqueue = kfifo_alloc(session->cmds_max * sizeof(void*),
                                         GFP_KERNEL, NULL);
@@ -2625,11 +2622,13 @@ iscsi_conn_destroy(struct iscsi_cls_conn *cls_conn)
 }
 
 static int
-iscsi_conn_bind(iscsi_sessionh_t sessionh, iscsi_connh_t connh,
-                uint32_t transport_fd, int is_leading)
+iscsi_conn_bind(struct iscsi_cls_session *cls_session,
+                struct iscsi_cls_conn *cls_conn, uint32_t transport_fd,
+                int is_leading)
 {
-        struct iscsi_session *session = iscsi_ptr(sessionh);
-        struct iscsi_conn *tmp = ERR_PTR(-EEXIST), *conn = iscsi_ptr(connh);
+        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
+        struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
+        struct iscsi_conn *tmp = ERR_PTR(-EEXIST), *conn = cls_conn->dd_data;
         struct sock *sk;
         struct socket *sock;
         int err;
@@ -2703,9 +2702,9 @@ iscsi_conn_bind(iscsi_sessionh_t sessionh, iscsi_connh_t connh,
 }
 
 static int
-iscsi_conn_start(iscsi_connh_t connh)
+iscsi_conn_start(struct iscsi_cls_conn *cls_conn)
 {
-        struct iscsi_conn *conn = iscsi_ptr(connh);
+        struct iscsi_conn *conn = cls_conn->dd_data;
         struct iscsi_session *session = conn->session;
         struct sock *sk;
 
@@ -2754,9 +2753,9 @@ iscsi_conn_start(iscsi_connh_t connh)
 }
 
 static void
-iscsi_conn_stop(iscsi_connh_t connh, int flag)
+iscsi_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
 {
-        struct iscsi_conn *conn = iscsi_ptr(connh);
+        struct iscsi_conn *conn = cls_conn->dd_data;
         struct iscsi_session *session = conn->session;
         struct sock *sk;
         unsigned long flags;
@@ -3253,9 +3252,9 @@ static struct scsi_host_template iscsi_sht = {
 
 static struct iscsi_transport iscsi_tcp_transport;
 
-static struct Scsi_Host *
+static struct iscsi_cls_session *
 iscsi_session_create(struct scsi_transport_template *scsit,
-                     uint32_t initial_cmdsn)
+                     uint32_t initial_cmdsn, uint32_t *sid)
 {
         struct Scsi_Host *shost;
         struct iscsi_session *session;
@@ -3268,13 +3267,14 @@ iscsi_session_create(struct scsi_transport_template *scsit,
         session = iscsi_hostdata(shost->hostdata);
         memset(session, 0, sizeof(struct iscsi_session));
         session->host = shost;
-        session->state = ISCSI_STATE_LOGGED_IN;
+        session->state = ISCSI_STATE_FREE;
         session->mgmtpool_max = ISCSI_MGMT_CMDS_MAX;
         session->cmds_max = ISCSI_XMIT_CMDS_MAX;
         session->cmdsn = initial_cmdsn;
         session->exp_cmdsn = initial_cmdsn + 1;
         session->max_cmdsn = initial_cmdsn + 1;
         session->max_r2t = 1;
+        *sid = shost->host_no;
 
         /* initialize SCSI PDU commands pool */
         if (iscsi_pool_init(&session->cmdpool, session->cmds_max,
@@ -3311,22 +3311,24 @@ iscsi_session_create(struct scsi_transport_template *scsit,
         if (iscsi_r2tpool_alloc(session))
                 goto r2tpool_alloc_fail;
 
-        return shost;
+        return hostdata_session(shost->hostdata);
 
 r2tpool_alloc_fail:
         for (cmd_i = 0; cmd_i < session->mgmtpool_max; cmd_i++)
                 kfree(session->mgmt_cmds[cmd_i]->data);
-        iscsi_pool_free(&session->mgmtpool, (void**)session->mgmt_cmds);
 immdata_alloc_fail:
+        iscsi_pool_free(&session->mgmtpool, (void**)session->mgmt_cmds);
 mgmtpool_alloc_fail:
         iscsi_pool_free(&session->cmdpool, (void**)session->cmds);
 cmdpool_alloc_fail:
+        iscsi_transport_destroy_session(shost);
         return NULL;
 }
 
 static void
-iscsi_session_destroy(struct Scsi_Host *shost)
+iscsi_session_destroy(struct iscsi_cls_session *cls_session)
 {
+        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
         struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
         int cmd_i;
         struct iscsi_data_task *dtask, *n;
@@ -3350,10 +3352,10 @@ iscsi_session_destroy(struct Scsi_Host *shost)
 }
 
 static int
-iscsi_conn_set_param(iscsi_connh_t connh, enum iscsi_param param,
+iscsi_conn_set_param(struct iscsi_cls_conn *cls_conn, enum iscsi_param param,
                      uint32_t value)
 {
-        struct iscsi_conn *conn = iscsi_ptr(connh);
+        struct iscsi_conn *conn = cls_conn->dd_data;
         struct iscsi_session *session = conn->session;
 
         spin_lock_bh(&session->lock);
@@ -3495,9 +3497,10 @@ iscsi_conn_set_param(iscsi_connh_t connh, enum iscsi_param param,
 }
 
 static int
-iscsi_session_get_param(struct Scsi_Host *shost,
+iscsi_session_get_param(struct iscsi_cls_session *cls_session,
                         enum iscsi_param param, uint32_t *value)
 {
+        struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
         struct iscsi_session *session = iscsi_hostdata(shost->hostdata);
 
         switch(param) {
@@ -3539,9 +3542,10 @@ iscsi_session_get_param(struct Scsi_Host *shost,
 }
 
 static int
-iscsi_conn_get_param(void *data, enum iscsi_param param, uint32_t *value)
+iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
+                     enum iscsi_param param, uint32_t *value)
 {
-        struct iscsi_conn *conn = data;
+        struct iscsi_conn *conn = cls_conn->dd_data;
 
         switch(param) {
         case ISCSI_PARAM_MAX_RECV_DLENGTH:
@@ -3564,9 +3568,9 @@ iscsi_conn_get_param(void *data, enum iscsi_param param, uint32_t *value)
 }
 
 static void
-iscsi_conn_get_stats(iscsi_connh_t connh, struct iscsi_stats *stats)
+iscsi_conn_get_stats(struct iscsi_cls_conn *cls_conn, struct iscsi_stats *stats)
 {
-        struct iscsi_conn *conn = iscsi_ptr(connh);
+        struct iscsi_conn *conn = cls_conn->dd_data;
 
         stats->txdata_octets = conn->txdata_octets;
         stats->rxdata_octets = conn->rxdata_octets;
@@ -3587,10 +3591,10 @@ iscsi_conn_get_stats(iscsi_connh_t connh, struct iscsi_stats *stats)
 }
 
 static int
-iscsi_conn_send_pdu(iscsi_connh_t connh, struct iscsi_hdr *hdr, char *data,
-                    uint32_t data_size)
+iscsi_conn_send_pdu(struct iscsi_cls_conn *cls_conn, struct iscsi_hdr *hdr,
+                    char *data, uint32_t data_size)
 {
-        struct iscsi_conn *conn = iscsi_ptr(connh);
+        struct iscsi_conn *conn = cls_conn->dd_data;
         int rc;
 
         mutex_lock(&conn->xmitmutex);
diff --git a/drivers/scsi/iscsi_tcp.h b/drivers/scsi/iscsi_tcp.h
index f95e61b76f70..ba26741ac154 100644
--- a/drivers/scsi/iscsi_tcp.h
+++ b/drivers/scsi/iscsi_tcp.h
@@ -113,7 +113,10 @@ struct iscsi_tcp_recv {
         int                     datadgst;
 };
 
+struct iscsi_cls_conn;
+
 struct iscsi_conn {
+        struct iscsi_cls_conn   *cls_conn;      /* ptr to class connection */
         struct iscsi_hdr        hdr;            /* header placeholder */
         char                    hdrext[4*sizeof(__u16) +
                                     sizeof(__u32)];
@@ -143,7 +146,6 @@ struct iscsi_conn {
         struct iscsi_mgmt_task  *login_mtask;   /* mtask used for login/text */
         struct iscsi_mgmt_task  *mtask;         /* xmit mtask in progress */
         struct iscsi_cmd_task   *ctask;         /* xmit ctask in progress */
-        spinlock_t              lock;           /* FIXME: to be removed */
 
         /* old values for socket callbacks */
         void                    (*old_data_ready)(struct sock *, int);
diff --git a/drivers/scsi/jazz_esp.c b/drivers/scsi/jazz_esp.c
index 23728d1c980c..fcd304e11c26 100644
--- a/drivers/scsi/jazz_esp.c
+++ b/drivers/scsi/jazz_esp.c
@@ -65,27 +65,6 @@ static int jazz_esp_release(struct Scsi_Host *shost)
         return 0;
 }
 
-static struct scsi_host_template driver_template = {
-        .proc_name              = "jazz_esp",
-        .proc_info              = &esp_proc_info,
-        .name                   = "ESP 100/100a/200",
-        .detect                 = jazz_esp_detect,
-        .slave_alloc            = esp_slave_alloc,
-        .slave_destroy          = esp_slave_destroy,
-        .release                = jazz_esp_release,
-        .info                   = esp_info,
-        .queuecommand           = esp_queue,
-        .eh_abort_handler       = esp_abort,
-        .eh_bus_reset_handler   = esp_reset,
-        .can_queue              = 7,
-        .this_id                = 7,
-        .sg_tablesize           = SG_ALL,
-        .cmd_per_lun            = 1,
-        .use_clustering         = DISABLE_CLUSTERING,
-};
-
-#include "scsi_module.c"
-
 /***************************************************************** Detection */
 static int jazz_esp_detect(struct scsi_host_template *tpnt)
 {
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 46c4cdbaee86..4f91b0dc572b 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -82,6 +82,10 @@ int atapi_enabled = 0;
 module_param(atapi_enabled, int, 0444);
 MODULE_PARM_DESC(atapi_enabled, "Enable discovery of ATAPI devices (0=off, 1=on)");
 
+int libata_fua = 0;
+module_param_named(fua, libata_fua, int, 0444);
+MODULE_PARM_DESC(fua, "FUA support (0=off, 1=on)");
+
 MODULE_AUTHOR("Jeff Garzik");
 MODULE_DESCRIPTION("Library module for ATA devices");
 MODULE_LICENSE("GPL");
@@ -614,7 +618,7 @@ int ata_rwcmd_protocol(struct ata_queued_cmd *qc)
         } else if (lba48 && (qc->ap->flags & ATA_FLAG_PIO_LBA48)) {
                 /* Unable to use DMA due to host limitation */
                 tf->protocol = ATA_PROT_PIO;
-                index = dev->multi_count ? 0 : 4;
+                index = dev->multi_count ? 0 : 8;
         } else {
                 tf->protocol = ATA_PROT_DMA;
                 index = 16;
@@ -2514,7 +2518,7 @@ static void ata_sg_clean(struct ata_queued_cmd *qc)
         assert(sg != NULL);
 
         if (qc->flags & ATA_QCFLAG_SINGLE)
-                assert(qc->n_elem == 1);
+                assert(qc->n_elem <= 1);
 
         VPRINTK("unmapping %u sg elements\n", qc->n_elem);
 
@@ -2537,7 +2541,7 @@ static void ata_sg_clean(struct ata_queued_cmd *qc)
                         kunmap_atomic(addr, KM_IRQ0);
                 }
         } else {
-                if (sg_dma_len(&sg[0]) > 0)
+                if (qc->n_elem)
                         dma_unmap_single(ap->host_set->dev,
                                 sg_dma_address(&sg[0]), sg_dma_len(&sg[0]),
                                 dir);
@@ -2570,7 +2574,7 @@ static void ata_fill_sg(struct ata_queued_cmd *qc)
         unsigned int idx;
 
         assert(qc->__sg != NULL);
-        assert(qc->n_elem > 0);
+        assert(qc->n_elem > 0 || qc->pad_len > 0);
 
         idx = 0;
         ata_for_each_sg(sg, qc) {
@@ -2715,6 +2719,7 @@ static int ata_sg_setup_one(struct ata_queued_cmd *qc)
         int dir = qc->dma_dir;
         struct scatterlist *sg = qc->__sg;
         dma_addr_t dma_address;
+        int trim_sg = 0;
 
         /* we must lengthen transfers to end on a 32-bit boundary */
         qc->pad_len = sg->length & 3;
@@ -2734,13 +2739,15 @@ static int ata_sg_setup_one(struct ata_queued_cmd *qc)
                 sg_dma_len(psg) = ATA_DMA_PAD_SZ;
                 /* trim sg */
                 sg->length -= qc->pad_len;
+                if (sg->length == 0)
+                        trim_sg = 1;
 
                 DPRINTK("padding done, sg->length=%u pad_len=%u\n",
                         sg->length, qc->pad_len);
         }
 
-        if (!sg->length) {
-                sg_dma_address(sg) = 0;
+        if (trim_sg) {
+                qc->n_elem--;
                 goto skip_map;
         }
 
@@ -2753,9 +2760,9 @@ static int ata_sg_setup_one(struct ata_queued_cmd *qc)
         }
 
         sg_dma_address(sg) = dma_address;
-skip_map:
         sg_dma_len(sg) = sg->length;
 
+skip_map:
         DPRINTK("mapped buffer of %d bytes for %s\n", sg_dma_len(sg),
                 qc->tf.flags & ATA_TFLAG_WRITE ? "write" : "read");
 
@@ -3357,11 +3364,12 @@ static void ata_pio_error(struct ata_port *ap)
 {
         struct ata_queued_cmd *qc;
 
-        printk(KERN_WARNING "ata%u: PIO error\n", ap->id);
-
         qc = ata_qc_from_tag(ap, ap->active_tag);
         assert(qc != NULL);
 
+        if (qc->tf.command != ATA_CMD_PACKET)
+                printk(KERN_WARNING "ata%u: PIO error\n", ap->id);
+
         /* make sure qc->err_mask is available to 
          * know what's wrong and recover
          */
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 07b1e7cc61df..59503c9ccac9 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -1708,6 +1708,8 @@ static int ata_dev_supports_fua(u16 *id)
 {
         unsigned char model[41], fw[9];
 
+        if (!libata_fua)
+                return 0;
         if (!ata_id_has_fua(id))
                 return 0;
 
diff --git a/drivers/scsi/libata.h b/drivers/scsi/libata.h
index e03ce48b7b4b..fddaf479a544 100644
--- a/drivers/scsi/libata.h
+++ b/drivers/scsi/libata.h
@@ -41,6 +41,7 @@ struct ata_scsi_args {
 
 /* libata-core.c */
 extern int atapi_enabled;
+extern int libata_fua;
 extern struct ata_queued_cmd *ata_qc_new_init(struct ata_port *ap,
                                       struct ata_device *dev);
 extern int ata_rwcmd_protocol(struct ata_queued_cmd *qc);
diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
index 311a4122bd70..93edaa8696cf 100644
--- a/drivers/scsi/mac53c94.c
+++ b/drivers/scsi/mac53c94.c
@@ -537,9 +537,9 @@ static int mac53c94_remove(struct macio_dev *mdev)
         free_irq(fp->intr, fp);
 
         if (fp->regs)
-                iounmap((void *) fp->regs);
+                iounmap(fp->regs);
         if (fp->dma)
-                iounmap((void *) fp->dma);
+                iounmap(fp->dma);
         kfree(fp->dma_cmd_space);
 
         scsi_host_put(host);
diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
index d101a8a6f4e8..7144674bc8e6 100644
--- a/drivers/scsi/megaraid.c
+++ b/drivers/scsi/megaraid.c
@@ -5049,7 +5049,7 @@ static struct pci_device_id megaraid_pci_tbl[] = {
 MODULE_DEVICE_TABLE(pci, megaraid_pci_tbl);
 
 static struct pci_driver megaraid_pci_driver = {
-        .name           = "megaraid",
+        .name           = "megaraid_legacy",
         .id_table       = megaraid_pci_tbl,
         .probe          = megaraid_probe_one,
         .remove         = __devexit_p(megaraid_remove_one),
diff --git a/drivers/scsi/megaraid.h b/drivers/scsi/megaraid.h
index 4b3e0d6e5afa..4b75fe619d9c 100644
--- a/drivers/scsi/megaraid.h
+++ b/drivers/scsi/megaraid.h
@@ -5,7 +5,7 @@
 #include <linux/mutex.h>
 
 #define MEGARAID_VERSION        \
-        "v2.00.3 (Release Date: Wed Feb 19 08:51:30 EST 2003)\n"
+        "v2.00.4 (Release Date: Thu Feb 9 08:51:30 EST 2006)\n"
 
 /*
  * Driver features - change the values to enable or disable features in the
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index a487f414960e..4f39dd01936d 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -10,7 +10,7 @@
  *         2 of the License, or (at your option) any later version.
  *
  * FILE         : megaraid_sas.c
- * Version      : v00.00.02.02
+ * Version      : v00.00.02.04
  *
  * Authors:
  *      Sreenivas Bagalkote     <Sreenivas.Bagalkote@lsil.com>
@@ -60,6 +60,12 @@ static struct pci_device_id megasas_pci_table[] = {
          PCI_ANY_ID,
          },
         {
+         PCI_VENDOR_ID_LSI_LOGIC,
+         PCI_DEVICE_ID_LSI_SAS1078R, // ppc IOP
+         PCI_ANY_ID,
+         PCI_ANY_ID,
+        },
+        {
          PCI_VENDOR_ID_DELL,
          PCI_DEVICE_ID_DELL_PERC5, // xscale IOP
          PCI_ANY_ID,
@@ -199,6 +205,86 @@ static struct megasas_instance_template megasas_instance_template_xscale = {
 */
 
 /**
+*       The following functions are defined for ppc (deviceid : 0x60) 
+*       controllers
+*/
+
+/**
+ * megasas_enable_intr_ppc -    Enables interrupts
+ * @regs:                       MFI register set
+ */
+static inline void
+megasas_enable_intr_ppc(struct megasas_register_set __iomem * regs)
+{
+        writel(0xFFFFFFFF, &(regs)->outbound_doorbell_clear);
+    
+        writel(~0x80000004, &(regs)->outbound_intr_mask);
+
+        /* Dummy readl to force pci flush */
+        readl(&regs->outbound_intr_mask);
+}
+
+/**
+ * megasas_read_fw_status_reg_ppc - returns the current FW status value
+ * @regs:                       MFI register set
+ */
+static u32
+megasas_read_fw_status_reg_ppc(struct megasas_register_set __iomem * regs)
+{
+        return readl(&(regs)->outbound_scratch_pad);
+}
+
+/**
+ * megasas_clear_interrupt_ppc -        Check & clear interrupt
+ * @regs:                               MFI register set
+ */
+static int 
+megasas_clear_intr_ppc(struct megasas_register_set __iomem * regs)
+{
+        u32 status;
+        /*
+         * Check if it is our interrupt
+         */
+        status = readl(&regs->outbound_intr_status);
+
+        if (!(status & MFI_REPLY_1078_MESSAGE_INTERRUPT)) {
+                return 1;
+        }
+
+        /*
+         * Clear the interrupt by writing back the same value
+         */
+        writel(status, &regs->outbound_doorbell_clear);
+
+        return 0;
+}
+/**
+ * megasas_fire_cmd_ppc -       Sends command to the FW
+ * @frame_phys_addr :           Physical address of cmd
+ * @frame_count :               Number of frames for the command
+ * @regs :                      MFI register set
+ */
+static inline void 
+megasas_fire_cmd_ppc(dma_addr_t frame_phys_addr, u32 frame_count, struct megasas_register_set __iomem *regs)
+{
+        writel((frame_phys_addr | (frame_count<<1))|1, 
+                        &(regs)->inbound_queue_port);
+}
+
+static struct megasas_instance_template megasas_instance_template_ppc = {
+        
+        .fire_cmd = megasas_fire_cmd_ppc,
+        .enable_intr = megasas_enable_intr_ppc,
+        .clear_intr = megasas_clear_intr_ppc,
+        .read_fw_status_reg = megasas_read_fw_status_reg_ppc,
+};
+
+/**
+*       This is the end of set of functions & definitions
+*       specific to ppc (deviceid : 0x60) controllers
+*/
+
+/**
  * megasas_disable_intr -       Disables interrupts
  * @regs:                       MFI register set
  */
@@ -707,6 +793,20 @@ megasas_queue_command(struct scsi_cmnd *scmd, void (*done) (struct scsi_cmnd *))
         return 0;
 }
 
+static int megasas_slave_configure(struct scsi_device *sdev)
+{
+        /*
+         * Don't export physical disk devices to the disk driver.
+         *
+         * FIXME: Currently we don't export them to the midlayer at all.
+         *        That will be fixed once LSI engineers have audited the
+         *        firmware for possible issues.
+         */
+        if (sdev->channel < MEGASAS_MAX_PD_CHANNELS && sdev->type == TYPE_DISK)
+                return -ENXIO;
+        return 0;
+}
+
 /**
  * megasas_wait_for_outstanding -       Wait for all outstanding cmds
  * @instance:                           Adapter soft state
@@ -857,6 +957,7 @@ static struct scsi_host_template megasas_template = {
         .module = THIS_MODULE,
         .name = "LSI Logic SAS based MegaRAID driver",
         .proc_name = "megaraid_sas",
+        .slave_configure = megasas_slave_configure,
         .queuecommand = megasas_queue_command,
         .eh_device_reset_handler = megasas_reset_device,
         .eh_bus_reset_handler = megasas_reset_bus_host,
@@ -985,20 +1086,6 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd,
                         break;
                 }
 
-                /*
-                 * Don't export physical disk devices to mid-layer.
-                 */
-                if (!MEGASAS_IS_LOGICAL(cmd->scmd) &&
-                    (hdr->cmd_status == MFI_STAT_OK) &&
-                    (cmd->scmd->cmnd[0] == INQUIRY)) {
-
-                        if (((*(u8 *) cmd->scmd->request_buffer) & 0x1F) ==
-                            TYPE_DISK) {
-                                cmd->scmd->result = DID_BAD_TARGET << 16;
-                                exception = 1;
-                        }
-                }
-
         case MFI_CMD_LD_READ:
         case MFI_CMD_LD_WRITE:
 
@@ -1607,7 +1694,17 @@ static int megasas_init_mfi(struct megasas_instance *instance)
 
         reg_set = instance->reg_set;
 
-        instance->instancet = &megasas_instance_template_xscale;
+        switch(instance->pdev->device)
+        {
+                case PCI_DEVICE_ID_LSI_SAS1078R:        
+                        instance->instancet = &megasas_instance_template_ppc;
+                        break;
+                case PCI_DEVICE_ID_LSI_SAS1064R:
+                case PCI_DEVICE_ID_DELL_PERC5:
+                default:
+                        instance->instancet = &megasas_instance_template_xscale;
+                        break;
+        }
 
         /*
          * We expect the FW state to be READY
@@ -1983,6 +2080,7 @@ static int megasas_io_attach(struct megasas_instance *instance)
         host->max_channel = MEGASAS_MAX_CHANNELS - 1;
         host->max_id = MEGASAS_MAX_DEV_PER_CHANNEL;
         host->max_lun = MEGASAS_MAX_LUN;
+        host->max_cmd_len = 16;
 
         /*
          * Notify the mid-layer about the new controller
diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
index d6d166c0663f..89639f0c38ef 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -18,9 +18,9 @@
 /**
  * MegaRAID SAS Driver meta data
  */
-#define MEGASAS_VERSION                         "00.00.02.02"
-#define MEGASAS_RELDATE                         "Jan 23, 2006"
-#define MEGASAS_EXT_VERSION                     "Mon Jan 23 14:09:01 PST 2006"
+#define MEGASAS_VERSION                         "00.00.02.04"
+#define MEGASAS_RELDATE                         "Feb 03, 2006"
+#define MEGASAS_EXT_VERSION                     "Fri Feb 03 14:31:44 PST 2006"
 /*
  * =====================================
  * MegaRAID SAS MFI firmware definitions
@@ -553,31 +553,46 @@ struct megasas_ctrl_info {
 #define MFI_OB_INTR_STATUS_MASK                 0x00000002
 #define MFI_POLL_TIMEOUT_SECS                   10
 
+#define MFI_REPLY_1078_MESSAGE_INTERRUPT        0x80000000
+#define PCI_DEVICE_ID_LSI_SAS1078R              0x00000060
+ 
 struct megasas_register_set {
+        u32     reserved_0[4];                  /*0000h*/
 
-        u32 reserved_0[4];      /*0000h */
+        u32     inbound_msg_0;                  /*0010h*/
+        u32     inbound_msg_1;                  /*0014h*/
+        u32     outbound_msg_0;                 /*0018h*/
+        u32     outbound_msg_1;                 /*001Ch*/
 
-        u32 inbound_msg_0;      /*0010h */
-        u32 inbound_msg_1;      /*0014h */
-        u32 outbound_msg_0;     /*0018h */
-        u32 outbound_msg_1;     /*001Ch */
+        u32     inbound_doorbell;               /*0020h*/
+        u32     inbound_intr_status;            /*0024h*/
+        u32     inbound_intr_mask;              /*0028h*/
 
-        u32 inbound_doorbell;   /*0020h */
-        u32 inbound_intr_status;        /*0024h */
-        u32 inbound_intr_mask;  /*0028h */
+        u32     outbound_doorbell;              /*002Ch*/
+        u32     outbound_intr_status;           /*0030h*/
+        u32     outbound_intr_mask;             /*0034h*/
 
-        u32 outbound_doorbell;  /*002Ch */
-        u32 outbound_intr_status;       /*0030h */
-        u32 outbound_intr_mask; /*0034h */
+        u32     reserved_1[2];                  /*0038h*/
 
-        u32 reserved_1[2];      /*0038h */
+        u32     inbound_queue_port;             /*0040h*/
+        u32     outbound_queue_port;            /*0044h*/
 
-        u32 inbound_queue_port; /*0040h */
-        u32 outbound_queue_port;        /*0044h */
+        u32     reserved_2[22];                 /*0048h*/
 
-        u32 reserved_2;         /*004Ch */
+        u32     outbound_doorbell_clear;        /*00A0h*/
 
-        u32 index_registers[1004];      /*0050h */
+        u32     reserved_3[3];                  /*00A4h*/
+
+        u32     outbound_scratch_pad ;          /*00B0h*/
+
+        u32     reserved_4[3];                  /*00B4h*/
+
+        u32     inbound_low_queue_port ;        /*00C0h*/
+
+        u32     inbound_high_queue_port ;       /*00C4h*/
+
+        u32     reserved_5;                     /*00C8h*/
+        u32     index_registers[820];           /*00CCh*/
 
 } __attribute__ ((packed));
 
diff --git a/drivers/scsi/pcmcia/Kconfig b/drivers/scsi/pcmcia/Kconfig
index df52190f4d94..eac8e179cfff 100644
--- a/drivers/scsi/pcmcia/Kconfig
+++ b/drivers/scsi/pcmcia/Kconfig
@@ -8,6 +8,7 @@ menu "PCMCIA SCSI adapter support"
 config PCMCIA_AHA152X
         tristate "Adaptec AHA152X PCMCIA support"
         depends on m && !64BIT
+        select SCSI_SPI_ATTRS
         help
           Say Y here if you intend to attach this type of PCMCIA SCSI host
           adapter to your computer.
diff --git a/drivers/scsi/pcmcia/aha152x_stub.c b/drivers/scsi/pcmcia/aha152x_stub.c
index 0c9edb7051f4..5609847e254a 100644
--- a/drivers/scsi/pcmcia/aha152x_stub.c
+++ b/drivers/scsi/pcmcia/aha152x_stub.c
@@ -275,10 +275,8 @@ static int aha152x_resume(struct pcmcia_device *dev)
 
         link->state &= ~DEV_SUSPEND;
         if (link->state & DEV_CONFIG) {
-                Scsi_Cmnd tmp;
                 pcmcia_request_configuration(link->handle, &link->conf);
-                tmp.device->host = info->host;
-                aha152x_host_reset(&tmp);
+                aha152x_host_reset_host(info->host);
         }
 
         return 0;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index b17ee62dd1a9..92b3e13e9061 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -7,7 +7,6 @@
 #include "qla_def.h"
 
 #include <linux/vmalloc.h>
-#include <scsi/scsi_transport_fc.h>
 
 /* SYSFS attributes --------------------------------------------------------- */
 
@@ -114,7 +113,7 @@ qla2x00_sysfs_read_nvram(struct kobject *kobj, char *buf, loff_t off,
             struct device, kobj)));
         unsigned long   flags;
 
-        if (!capable(CAP_SYS_ADMIN) || off != 0 || count != ha->nvram_size)
+        if (!capable(CAP_SYS_ADMIN) || off != 0)
                 return 0;
 
         /* Read NVRAM. */
@@ -123,7 +122,7 @@ qla2x00_sysfs_read_nvram(struct kobject *kobj, char *buf, loff_t off,
             ha->nvram_size);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
-        return (count);
+        return ha->nvram_size;
 }
 
 static ssize_t
@@ -175,19 +174,150 @@ static struct bin_attribute sysfs_nvram_attr = {
                 .mode = S_IRUSR | S_IWUSR,
                 .owner = THIS_MODULE,
         },
-        .size = 0,
+        .size = 512,
         .read = qla2x00_sysfs_read_nvram,
         .write = qla2x00_sysfs_write_nvram,
 };
 
+static ssize_t
+qla2x00_sysfs_read_optrom(struct kobject *kobj, char *buf, loff_t off,
+    size_t count)
+{
+        struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
+            struct device, kobj)));
+
+        if (ha->optrom_state != QLA_SREADING)
+                return 0;
+        if (off > ha->optrom_size)
+                return 0;
+        if (off + count > ha->optrom_size)
+                count = ha->optrom_size - off;
+
+        memcpy(buf, &ha->optrom_buffer[off], count);
+
+        return count;
+}
+
+static ssize_t
+qla2x00_sysfs_write_optrom(struct kobject *kobj, char *buf, loff_t off,
+    size_t count)
+{
+        struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
+            struct device, kobj)));
+
+        if (ha->optrom_state != QLA_SWRITING)
+                return -EINVAL;
+        if (off > ha->optrom_size)
+                return -ERANGE;
+        if (off + count > ha->optrom_size)
+                count = ha->optrom_size - off;
+
+        memcpy(&ha->optrom_buffer[off], buf, count);
+
+        return count;
+}
+
+static struct bin_attribute sysfs_optrom_attr = {
+        .attr = {
+                .name = "optrom",
+                .mode = S_IRUSR | S_IWUSR,
+                .owner = THIS_MODULE,
+        },
+        .size = OPTROM_SIZE_24XX,
+        .read = qla2x00_sysfs_read_optrom,
+        .write = qla2x00_sysfs_write_optrom,
+};
+
+static ssize_t
+qla2x00_sysfs_write_optrom_ctl(struct kobject *kobj, char *buf, loff_t off,
+    size_t count)
+{
+        struct scsi_qla_host *ha = to_qla_host(dev_to_shost(container_of(kobj,
+            struct device, kobj)));
+        int val;
+
+        if (off)
+                return 0;
+
+        if (sscanf(buf, "%d", &val) != 1)
+                return -EINVAL;
+
+        switch (val) {
+        case 0:
+                if (ha->optrom_state != QLA_SREADING &&
+                    ha->optrom_state != QLA_SWRITING)
+                        break;
+
+                ha->optrom_state = QLA_SWAITING;
+                vfree(ha->optrom_buffer);
+                ha->optrom_buffer = NULL;
+                break;
+        case 1:
+                if (ha->optrom_state != QLA_SWAITING)
+                        break;
+
+                ha->optrom_state = QLA_SREADING;
+                ha->optrom_buffer = (uint8_t *)vmalloc(ha->optrom_size);
+                if (ha->optrom_buffer == NULL) {
+                        qla_printk(KERN_WARNING, ha,
+                            "Unable to allocate memory for optrom retrieval "
+                            "(%x).\n", ha->optrom_size);
+
+                        ha->optrom_state = QLA_SWAITING;
+                        return count;
+                }
+
+                memset(ha->optrom_buffer, 0, ha->optrom_size);
+                ha->isp_ops.read_optrom(ha, ha->optrom_buffer, 0,
+                    ha->optrom_size);
+                break;
+        case 2:
+                if (ha->optrom_state != QLA_SWAITING)
+                        break;
+
+                ha->optrom_state = QLA_SWRITING;
+                ha->optrom_buffer = (uint8_t *)vmalloc(ha->optrom_size);
+                if (ha->optrom_buffer == NULL) {
+                        qla_printk(KERN_WARNING, ha,
+                            "Unable to allocate memory for optrom update "
+                            "(%x).\n", ha->optrom_size);
+
+                        ha->optrom_state = QLA_SWAITING;
+                        return count;
+                }
+                memset(ha->optrom_buffer, 0, ha->optrom_size);
+                break;
+        case 3:
+                if (ha->optrom_state != QLA_SWRITING)
+                        break;
+
+                ha->isp_ops.write_optrom(ha, ha->optrom_buffer, 0,
+                    ha->optrom_size);
+                break;
+        }
+        return count;
+}
+
+static struct bin_attribute sysfs_optrom_ctl_attr = {
+        .attr = {
+                .name = "optrom_ctl",
+                .mode = S_IWUSR,
+                .owner = THIS_MODULE,
+        },
+        .size = 0,
+        .write = qla2x00_sysfs_write_optrom_ctl,
+};
+
 void
 qla2x00_alloc_sysfs_attr(scsi_qla_host_t *ha)
 {
         struct Scsi_Host *host = ha->host;
 
         sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_fw_dump_attr);
-        sysfs_nvram_attr.size = ha->nvram_size;
         sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_nvram_attr);
+        sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_optrom_attr);
+        sysfs_create_bin_file(&host->shost_gendev.kobj,
+            &sysfs_optrom_ctl_attr);
 }
 
 void
@@ -197,6 +327,12 @@ qla2x00_free_sysfs_attr(scsi_qla_host_t *ha)
 
         sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_fw_dump_attr);
         sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_nvram_attr);
+        sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_optrom_attr);
+        sysfs_remove_bin_file(&host->shost_gendev.kobj,
+            &sysfs_optrom_ctl_attr);
+
+        if (ha->beacon_blink_led == 1)
+                ha->isp_ops.beacon_off(ha);
 }
 
 /* Scsi_Host attributes. */
@@ -384,6 +520,50 @@ qla2x00_zio_timer_store(struct class_device *cdev, const char *buf,
         return strlen(buf);
 }
 
+static ssize_t
+qla2x00_beacon_show(struct class_device *cdev, char *buf)
+{
+        scsi_qla_host_t *ha = to_qla_host(class_to_shost(cdev));
+        int len = 0;
+
+        if (ha->beacon_blink_led)
+                len += snprintf(buf + len, PAGE_SIZE-len, "Enabled\n");
+        else
+                len += snprintf(buf + len, PAGE_SIZE-len, "Disabled\n");
+        return len;
+}
+
+static ssize_t
+qla2x00_beacon_store(struct class_device *cdev, const char *buf,
+    size_t count)
+{
+        scsi_qla_host_t *ha = to_qla_host(class_to_shost(cdev));
+        int val = 0;
+        int rval;
+
+        if (IS_QLA2100(ha) || IS_QLA2200(ha))
+                return -EPERM;
+
+        if (test_bit(ABORT_ISP_ACTIVE, &ha->dpc_flags)) {
+                qla_printk(KERN_WARNING, ha,
+                    "Abort ISP active -- ignoring beacon request.\n");
+                return -EBUSY;
+        }
+
+        if (sscanf(buf, "%d", &val) != 1)
+                return -EINVAL;
+
+        if (val)
+                rval = ha->isp_ops.beacon_on(ha);
+        else
+                rval = ha->isp_ops.beacon_off(ha);
+
+        if (rval != QLA_SUCCESS)
+                count = 0;
+
+        return count;
+}
+
 static CLASS_DEVICE_ATTR(driver_version, S_IRUGO, qla2x00_drvr_version_show,
         NULL);
 static CLASS_DEVICE_ATTR(fw_version, S_IRUGO, qla2x00_fw_version_show, NULL);
@@ -398,6 +578,8 @@ static CLASS_DEVICE_ATTR(zio, S_IRUGO | S_IWUSR, qla2x00_zio_show,
     qla2x00_zio_store);
 static CLASS_DEVICE_ATTR(zio_timer, S_IRUGO | S_IWUSR, qla2x00_zio_timer_show,
     qla2x00_zio_timer_store);
+static CLASS_DEVICE_ATTR(beacon, S_IRUGO | S_IWUSR, qla2x00_beacon_show,
+    qla2x00_beacon_store);
 
 struct class_device_attribute *qla2x00_host_attrs[] = {
         &class_device_attr_driver_version,
@@ -411,6 +593,7 @@ struct class_device_attribute *qla2x00_host_attrs[] = {
         &class_device_attr_state,
         &class_device_attr_zio,
         &class_device_attr_zio_timer,
+        &class_device_attr_beacon,
         NULL,
 };
 
@@ -426,6 +609,49 @@ qla2x00_get_host_port_id(struct Scsi_Host *shost)
 }
 
 static void
+qla2x00_get_host_speed(struct Scsi_Host *shost)
+{
+        scsi_qla_host_t *ha = to_qla_host(shost);
+        uint32_t speed = 0;
+
+        switch (ha->link_data_rate) {
+        case LDR_1GB:
+                speed = 1;
+                break;
+        case LDR_2GB:
+                speed = 2;
+                break;
+        case LDR_4GB:
+                speed = 4;
+                break;
+        }
+        fc_host_speed(shost) = speed;
+}
+
+static void
+qla2x00_get_host_port_type(struct Scsi_Host *shost)
+{
+        scsi_qla_host_t *ha = to_qla_host(shost);
+        uint32_t port_type = FC_PORTTYPE_UNKNOWN;
+
+        switch (ha->current_topology) {
+        case ISP_CFG_NL:
+                port_type = FC_PORTTYPE_LPORT;
+                break;
+        case ISP_CFG_FL:
+                port_type = FC_PORTTYPE_NLPORT;
+                break;
+        case ISP_CFG_N:
+                port_type = FC_PORTTYPE_PTP;
+                break;
+        case ISP_CFG_F:
+                port_type = FC_PORTTYPE_NPORT;
+                break;
+        }
+        fc_host_port_type(shost) = port_type;
+}
+
+static void
 qla2x00_get_starget_node_name(struct scsi_target *starget)
 {
         struct Scsi_Host *host = dev_to_shost(starget->dev.parent);
@@ -512,6 +738,41 @@ qla2x00_issue_lip(struct Scsi_Host *shost)
         return 0;
 }
 
+static struct fc_host_statistics *
+qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
+{
+        scsi_qla_host_t *ha = to_qla_host(shost);
+        int rval;
+        uint16_t mb_stat[1];
+        link_stat_t stat_buf;
+        struct fc_host_statistics *pfc_host_stat;
+
+        pfc_host_stat = &ha->fc_host_stat;
+        memset(pfc_host_stat, -1, sizeof(struct fc_host_statistics));
+
+        if (IS_QLA24XX(ha) || IS_QLA25XX(ha)) {
+                rval = qla24xx_get_isp_stats(ha, (uint32_t *)&stat_buf,
+                    sizeof(stat_buf) / 4, mb_stat);
+        } else {
+                rval = qla2x00_get_link_status(ha, ha->loop_id, &stat_buf,
+                    mb_stat);
+        }
+        if (rval != 0) {
+                qla_printk(KERN_WARNING, ha,
+                    "Unable to retrieve host statistics (%d).\n", mb_stat[0]);
+                return pfc_host_stat;
+        }
+
+        pfc_host_stat->link_failure_count = stat_buf.link_fail_cnt;
+        pfc_host_stat->loss_of_sync_count = stat_buf.loss_sync_cnt;
+        pfc_host_stat->loss_of_signal_count = stat_buf.loss_sig_cnt;
+        pfc_host_stat->prim_seq_protocol_err_count = stat_buf.prim_seq_err_cnt;
+        pfc_host_stat->invalid_tx_word_count = stat_buf.inval_xmit_word_cnt;
+        pfc_host_stat->invalid_crc_count = stat_buf.inval_crc_cnt;
+
+        return pfc_host_stat;
+}
+
 struct fc_function_template qla2xxx_transport_functions = {
 
         .show_host_node_name = 1,
@@ -520,6 +781,10 @@ struct fc_function_template qla2xxx_transport_functions = {
 
         .get_host_port_id = qla2x00_get_host_port_id,
         .show_host_port_id = 1,
+        .get_host_speed = qla2x00_get_host_speed,
+        .show_host_speed = 1,
+        .get_host_port_type = qla2x00_get_host_port_type,
+        .show_host_port_type = 1,
 
         .dd_fcrport_size = sizeof(struct fc_port *),
         .show_rport_supported_classes = 1,
@@ -536,6 +801,7 @@ struct fc_function_template qla2xxx_transport_functions = {
         .show_rport_dev_loss_tmo = 1,
 
         .issue_fc_host_lip = qla2x00_issue_lip,
+        .get_fc_host_stats = qla2x00_get_fc_host_stats,
 };
 
 void
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index bad066e5772a..b31a03bbd14f 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -29,6 +29,7 @@
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_transport_fc.h>
 
 #if defined(CONFIG_SCSI_QLA2XXX_EMBEDDED_FIRMWARE)
 #if defined(CONFIG_SCSI_QLA21XX) || defined(CONFIG_SCSI_QLA21XX_MODULE)
@@ -181,6 +182,13 @@
 #define WRT_REG_DWORD(addr, data)       writel(data,addr)
 
 /*
+ * The ISP2312 v2 chip cannot access the FLASH/GPIO registers via MMIO in an
+ * 133Mhz slot.
+ */
+#define RD_REG_WORD_PIO(addr)           (inw((unsigned long)addr))
+#define WRT_REG_WORD_PIO(addr, data)    (outw(data,(unsigned long)addr))
+
+/*
  * Fibre Channel device definitions.
  */
 #define WWN_SIZE                8       /* Size of WWPN, WWN & WWNN */
@@ -432,6 +440,9 @@ struct device_reg_2xxx {
 #define GPIO_LED_GREEN_ON_AMBER_OFF     0x0040
 #define GPIO_LED_GREEN_OFF_AMBER_ON     0x0080
 #define GPIO_LED_GREEN_ON_AMBER_ON      0x00C0
+#define GPIO_LED_ALL_OFF                0x0000
+#define GPIO_LED_RED_ON_OTHER_OFF       0x0001  /* isp2322 */
+#define GPIO_LED_RGA_ON                 0x00C1  /* isp2322: red green amber */
 
         union {
                 struct {
@@ -2199,6 +2210,15 @@ struct isp_operations {
 
         void (*fw_dump) (struct scsi_qla_host *, int);
         void (*ascii_fw_dump) (struct scsi_qla_host *);
+
+        int (*beacon_on) (struct scsi_qla_host *);
+        int (*beacon_off) (struct scsi_qla_host *);
+        void (*beacon_blink) (struct scsi_qla_host *);
+
+        uint8_t * (*read_optrom) (struct scsi_qla_host *, uint8_t *,
+                uint32_t, uint32_t);
+        int (*write_optrom) (struct scsi_qla_host *, uint8_t *, uint32_t,
+                uint32_t);
 };
 
 /*
@@ -2331,6 +2351,10 @@ typedef struct scsi_qla_host {
         uint16_t        min_external_loopid;    /* First external loop Id */
 
         uint16_t        link_data_rate;         /* F/W operating speed */
+#define LDR_1GB         0
+#define LDR_2GB         1
+#define LDR_4GB         3
+#define LDR_UNKNOWN     0xFFFF
 
         uint8_t         current_topology;
         uint8_t         prev_topology;
@@ -2486,12 +2510,26 @@ typedef struct scsi_qla_host {
         uint8_t         *port_name;
         uint32_t    isp_abort_cnt;
 
+        /* Option ROM information. */
+        char            *optrom_buffer;
+        uint32_t        optrom_size;
+        int             optrom_state;
+#define QLA_SWAITING    0
+#define QLA_SREADING    1
+#define QLA_SWRITING    2
+
         /* Needed for BEACON */
         uint16_t        beacon_blink_led;
-        uint16_t        beacon_green_on;
+        uint8_t         beacon_color_state;
+#define QLA_LED_GRN_ON          0x01
+#define QLA_LED_YLW_ON          0x02
+#define QLA_LED_ABR_ON          0x04
+#define QLA_LED_ALL_ON          0x07    /* yellow, green, amber. */
+                                        /* ISP2322: red, green, amber. */
 
         uint16_t        zio_mode;
         uint16_t        zio_timer;
+        struct fc_host_statistics fc_host_stat;
 } scsi_qla_host_t;
 
 
@@ -2557,7 +2595,9 @@ struct _qla2x00stats  {
 /*
  * Flash support definitions
  */
-#define FLASH_IMAGE_SIZE        131072
+#define OPTROM_SIZE_2300        0x20000
+#define OPTROM_SIZE_2322        0x100000
+#define OPTROM_SIZE_24XX        0x100000
 
 #include "qla_gbl.h"
 #include "qla_dbg.h"
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 35266bd5d538..ffdc2680f049 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -75,12 +75,12 @@ extern void qla2x00_cmd_timeout(srb_t *);
 extern void qla2x00_mark_device_lost(scsi_qla_host_t *, fc_port_t *, int, int);
 extern void qla2x00_mark_all_devices_lost(scsi_qla_host_t *, int);
 
-extern void qla2x00_blink_led(scsi_qla_host_t *);
-
 extern int qla2x00_down_timeout(struct semaphore *, unsigned long);
 
 extern struct fw_blob *qla2x00_request_firmware(scsi_qla_host_t *);
 
+extern int qla2x00_wait_for_hba_online(scsi_qla_host_t *);
+
 /*
  * Global Function Prototypes in qla_iocb.c source file.
  */
@@ -185,6 +185,13 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *, uint16_t *, uint16_t *, uint16_t *,
 extern int
 qla2x00_get_fcal_position_map(scsi_qla_host_t *ha, char *pos_map);
 
+extern int
+qla2x00_get_link_status(scsi_qla_host_t *, uint16_t, link_stat_t *,
+    uint16_t *);
+
+extern int
+qla24xx_get_isp_stats(scsi_qla_host_t *, uint32_t *, uint32_t, uint16_t *);
+
 extern int qla24xx_abort_command(scsi_qla_host_t *, srb_t *);
 extern int qla24xx_abort_target(fc_port_t *);
 
@@ -228,6 +235,22 @@ extern int qla2x00_write_nvram_data(scsi_qla_host_t *, uint8_t *, uint32_t,
 extern int qla24xx_write_nvram_data(scsi_qla_host_t *, uint8_t *, uint32_t,
     uint32_t);
 
+extern int qla2x00_beacon_on(struct scsi_qla_host *);
+extern int qla2x00_beacon_off(struct scsi_qla_host *);
+extern void qla2x00_beacon_blink(struct scsi_qla_host *);
+extern int qla24xx_beacon_on(struct scsi_qla_host *);
+extern int qla24xx_beacon_off(struct scsi_qla_host *);
+extern void qla24xx_beacon_blink(struct scsi_qla_host *);
+
+extern uint8_t *qla2x00_read_optrom_data(struct scsi_qla_host *, uint8_t *,
+    uint32_t, uint32_t);
+extern int qla2x00_write_optrom_data(struct scsi_qla_host *, uint8_t *,
+    uint32_t, uint32_t);
+extern uint8_t *qla24xx_read_optrom_data(struct scsi_qla_host *, uint8_t *,
+    uint32_t, uint32_t);
+extern int qla24xx_write_optrom_data(struct scsi_qla_host *, uint8_t *,
+    uint32_t, uint32_t);
+
 /*
  * Global Function Prototypes in qla_dbg.c source file.
  */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e67bb0997818..634ee174bff2 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -8,7 +8,6 @@
 
 #include <linux/delay.h>
 #include <linux/vmalloc.h>
-#include <scsi/scsi_transport_fc.h>
 
 #include "qla_devtbl.h"
 
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 7ec0b8d6f07b..6544b6d0891d 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -814,6 +814,7 @@ qla24xx_start_scsi(srb_t *sp)
         cmd_pkt->port_id[2] = sp->fcport->d_id.b.domain;
 
         int_to_scsilun(sp->cmd->device->lun, &cmd_pkt->lun);
+        host_to_fcp_swap((uint8_t *)&cmd_pkt->lun, sizeof(cmd_pkt->lun));
 
         /* Load SCSI command packet. */
         memcpy(cmd_pkt->fcp_cdb, cmd->cmnd, cmd->cmd_len);
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 71a46fcee8cc..42aa7a7c1a73 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -402,9 +402,9 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                 break;
 
         case MBA_LOOP_UP:               /* Loop Up Event */
-                ha->link_data_rate = 0;
                 if (IS_QLA2100(ha) || IS_QLA2200(ha)) {
                         link_speed = link_speeds[0];
+                        ha->link_data_rate = LDR_1GB;
                 } else {
                         link_speed = link_speeds[LS_UNKNOWN];
                         if (mb[1] < 5)
@@ -436,7 +436,7 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
                 }
 
                 ha->flags.management_server_logged_in = 0;
-                ha->link_data_rate = 0;
+                ha->link_data_rate = LDR_UNKNOWN;
                 if (ql2xfdmienable)
                         set_bit(REGISTER_FDMI_NEEDED, &ha->dpc_flags);
 
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 3099b379de9d..363dfdd042b0 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -7,7 +7,6 @@
 #include "qla_def.h"
 
 #include <linux/delay.h>
-#include <scsi/scsi_transport_fc.h>
 
 static void
 qla2x00_mbx_sem_timeout(unsigned long data)
@@ -1874,7 +1873,8 @@ qla2x00_get_id_list(scsi_qla_host_t *ha, void *id_list, dma_addr_t id_list_dma,
                 mcp->mb[3] = LSW(id_list_dma);
                 mcp->mb[6] = MSW(MSD(id_list_dma));
                 mcp->mb[7] = LSW(MSD(id_list_dma));
-                mcp->out_mb |= MBX_7|MBX_6|MBX_3|MBX_2;
+                mcp->mb[8] = 0;
+                mcp->out_mb |= MBX_8|MBX_7|MBX_6|MBX_3|MBX_2;
         } else {
                 mcp->mb[1] = MSW(id_list_dma);
                 mcp->mb[2] = LSW(id_list_dma);
@@ -2017,8 +2017,109 @@ qla2x00_get_fcal_position_map(scsi_qla_host_t *ha, char *pos_map)
 
         return rval;
 }
+#endif
+
+/*
+ * qla2x00_get_link_status
+ *
+ * Input:
+ *      ha = adapter block pointer.
+ *      loop_id = device loop ID.
+ *      ret_buf = pointer to link status return buffer.
+ *
+ * Returns:
+ *      0 = success.
+ *      BIT_0 = mem alloc error.
+ *      BIT_1 = mailbox error.
+ */
+int
+qla2x00_get_link_status(scsi_qla_host_t *ha, uint16_t loop_id,
+    link_stat_t *ret_buf, uint16_t *status)
+{
+        int rval;
+        mbx_cmd_t mc;
+        mbx_cmd_t *mcp = &mc;
+        link_stat_t *stat_buf;
+        dma_addr_t stat_buf_dma;
+
+        DEBUG11(printk("%s(%ld): entered.\n", __func__, ha->host_no);)
+
+        stat_buf = dma_pool_alloc(ha->s_dma_pool, GFP_ATOMIC, &stat_buf_dma);
+        if (stat_buf == NULL) {
+                DEBUG2_3_11(printk("%s(%ld): Failed to allocate memory.\n",
+                    __func__, ha->host_no));
+                return BIT_0;
+        }
+        memset(stat_buf, 0, sizeof(link_stat_t));
+
+        mcp->mb[0] = MBC_GET_LINK_STATUS;
+        mcp->mb[2] = MSW(stat_buf_dma);
+        mcp->mb[3] = LSW(stat_buf_dma);
+        mcp->mb[6] = MSW(MSD(stat_buf_dma));
+        mcp->mb[7] = LSW(MSD(stat_buf_dma));
+        mcp->out_mb = MBX_7|MBX_6|MBX_3|MBX_2|MBX_0;
+        mcp->in_mb = MBX_0;
+        if (IS_QLA24XX(ha) || IS_QLA25XX(ha)) {
+                mcp->mb[1] = loop_id;
+                mcp->mb[4] = 0;
+                mcp->mb[10] = 0;
+                mcp->out_mb |= MBX_10|MBX_4|MBX_1;
+                mcp->in_mb |= MBX_1;
+        } else if (HAS_EXTENDED_IDS(ha)) {
+                mcp->mb[1] = loop_id;
+                mcp->mb[10] = 0;
+                mcp->out_mb |= MBX_10|MBX_1;
+        } else {
+                mcp->mb[1] = loop_id << 8;
+                mcp->out_mb |= MBX_1;
+        }
+        mcp->tov = 30;
+        mcp->flags = IOCTL_CMD;
+        rval = qla2x00_mailbox_command(ha, mcp);
+
+        if (rval == QLA_SUCCESS) {
+                if (mcp->mb[0] != MBS_COMMAND_COMPLETE) {
+                        DEBUG2_3_11(printk("%s(%ld): cmd failed. mbx0=%x.\n",
+                            __func__, ha->host_no, mcp->mb[0]);)
+                        status[0] = mcp->mb[0];
+                        rval = BIT_1;
+                } else {
+                        /* copy over data -- firmware data is LE. */
+                        ret_buf->link_fail_cnt =
+                            le32_to_cpu(stat_buf->link_fail_cnt);
+                        ret_buf->loss_sync_cnt =
+                            le32_to_cpu(stat_buf->loss_sync_cnt);
+                        ret_buf->loss_sig_cnt =
+                            le32_to_cpu(stat_buf->loss_sig_cnt);
+                        ret_buf->prim_seq_err_cnt =
+                            le32_to_cpu(stat_buf->prim_seq_err_cnt);
+                        ret_buf->inval_xmit_word_cnt =
+                            le32_to_cpu(stat_buf->inval_xmit_word_cnt);
+                        ret_buf->inval_crc_cnt =
+                            le32_to_cpu(stat_buf->inval_crc_cnt);
+
+                        DEBUG11(printk("%s(%ld): stat dump: fail_cnt=%d "
+                            "loss_sync=%d loss_sig=%d seq_err=%d "
+                            "inval_xmt_word=%d inval_crc=%d.\n", __func__,
+                            ha->host_no, stat_buf->link_fail_cnt,
+                            stat_buf->loss_sync_cnt, stat_buf->loss_sig_cnt,
+                            stat_buf->prim_seq_err_cnt,
+                            stat_buf->inval_xmit_word_cnt,
+                            stat_buf->inval_crc_cnt);)
+                }
+        } else {
+                /* Failed. */
+                DEBUG2_3_11(printk("%s(%ld): failed=%x.\n", __func__,
+                    ha->host_no, rval);)
+                rval = BIT_1;
+        }
+
+        dma_pool_free(ha->s_dma_pool, stat_buf, stat_buf_dma);
 
-uint8_t
+        return rval;
+}
+
+int
 qla24xx_get_isp_stats(scsi_qla_host_t *ha, uint32_t *dwbuf, uint32_t dwords,
     uint16_t *status)
 {
@@ -2080,7 +2181,6 @@ qla24xx_get_isp_stats(scsi_qla_host_t *ha, uint32_t *dwbuf, uint32_t dwords,
 
         return rval;
 }
-#endif
 
 int
 qla24xx_abort_command(scsi_qla_host_t *ha, srb_t *sp)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 5866a7c706a8..9f91f1a20542 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -366,6 +366,12 @@ qla2x00_queuecommand(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
                 goto qc_fail_command;
         }
 
+        /* Close window on fcport/rport state-transitioning. */
+        if (!*(fc_port_t **)rport->dd_data) {
+                cmd->result = DID_IMM_RETRY << 16;
+                goto qc_fail_command;
+        }
+
         if (atomic_read(&fcport->state) != FCS_ONLINE) {
                 if (atomic_read(&fcport->state) == FCS_DEVICE_DEAD ||
                     atomic_read(&ha->loop_state) == LOOP_DEAD) {
@@ -421,6 +427,12 @@ qla24xx_queuecommand(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *))
                 goto qc24_fail_command;
         }
 
+        /* Close window on fcport/rport state-transitioning. */
+        if (!*(fc_port_t **)rport->dd_data) {
+                cmd->result = DID_IMM_RETRY << 16;
+                goto qc24_fail_command;
+        }
+
         if (atomic_read(&fcport->state) != FCS_ONLINE) {
                 if (atomic_read(&fcport->state) == FCS_DEVICE_DEAD ||
                     atomic_read(&ha->loop_state) == LOOP_DEAD) {
@@ -513,7 +525,7 @@ qla2x00_eh_wait_on_command(scsi_qla_host_t *ha, struct scsi_cmnd *cmd)
  *    Success (Adapter is online) : 0
  *    Failed  (Adapter is offline/disabled) : 1
  */
-static int
+int
 qla2x00_wait_for_hba_online(scsi_qla_host_t *ha)
 {
         int             return_status;
@@ -1312,6 +1324,8 @@ int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
         ha->ports = MAX_BUSES;
         ha->init_cb_size = sizeof(init_cb_t);
         ha->mgmt_svr_loop_id = MANAGEMENT_SERVER;
+        ha->link_data_rate = LDR_UNKNOWN;
+        ha->optrom_size = OPTROM_SIZE_2300;
 
         /* Assign ISP specific operations. */
         ha->isp_ops.pci_config          = qla2100_pci_config;
@@ -1339,6 +1353,8 @@ int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
         ha->isp_ops.write_nvram         = qla2x00_write_nvram_data;
         ha->isp_ops.fw_dump             = qla2100_fw_dump;
         ha->isp_ops.ascii_fw_dump       = qla2100_ascii_fw_dump;
+        ha->isp_ops.read_optrom         = qla2x00_read_optrom_data;
+        ha->isp_ops.write_optrom        = qla2x00_write_optrom_data;
         if (IS_QLA2100(ha)) {
                 host->max_id = MAX_TARGETS_2100;
                 ha->mbx_count = MAILBOX_REGISTER_COUNT_2100;
@@ -1364,7 +1380,12 @@ int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
                 ha->isp_ops.intr_handler = qla2300_intr_handler;
                 ha->isp_ops.fw_dump = qla2300_fw_dump;
                 ha->isp_ops.ascii_fw_dump = qla2300_ascii_fw_dump;
+                ha->isp_ops.beacon_on = qla2x00_beacon_on;
+                ha->isp_ops.beacon_off = qla2x00_beacon_off;
+                ha->isp_ops.beacon_blink = qla2x00_beacon_blink;
                 ha->gid_list_info_size = 6;
+                if (IS_QLA2322(ha) || IS_QLA6322(ha))
+                        ha->optrom_size = OPTROM_SIZE_2322;
         } else if (IS_QLA24XX(ha) || IS_QLA25XX(ha)) {
                 host->max_id = MAX_TARGETS_2200;
                 ha->mbx_count = MAILBOX_REGISTER_COUNT;
@@ -1400,7 +1421,13 @@ int qla2x00_probe_one(struct pci_dev *pdev, struct qla_board_info *brd_info)
                 ha->isp_ops.write_nvram = qla24xx_write_nvram_data;
                 ha->isp_ops.fw_dump = qla24xx_fw_dump;
                 ha->isp_ops.ascii_fw_dump = qla24xx_ascii_fw_dump;
+                ha->isp_ops.read_optrom = qla24xx_read_optrom_data;
+                ha->isp_ops.write_optrom = qla24xx_write_optrom_data;
+                ha->isp_ops.beacon_on = qla24xx_beacon_on;
+                ha->isp_ops.beacon_off = qla24xx_beacon_off;
+                ha->isp_ops.beacon_blink = qla24xx_beacon_blink;
                 ha->gid_list_info_size = 8;
+                ha->optrom_size = OPTROM_SIZE_24XX;
         }
         host->can_queue = ha->request_q_length + 128;
 
@@ -1657,11 +1684,13 @@ qla2x00_schedule_rport_del(struct scsi_qla_host *ha, fc_port_t *fcport,
                 spin_lock_irqsave(&fcport->rport_lock, flags);
                 fcport->drport = rport;
                 fcport->rport = NULL;
+                *(fc_port_t **)rport->dd_data = NULL;
                 spin_unlock_irqrestore(&fcport->rport_lock, flags);
                 set_bit(FCPORT_UPDATE_NEEDED, &ha->dpc_flags);
         } else {
                 spin_lock_irqsave(&fcport->rport_lock, flags);
                 fcport->rport = NULL;
+                *(fc_port_t **)rport->dd_data = NULL;
                 spin_unlock_irqrestore(&fcport->rport_lock, flags);
                 fc_remote_port_delete(rport);
         }
@@ -2066,6 +2095,8 @@ qla2x00_mem_free(scsi_qla_host_t *ha)
         ha->fw_dumped = 0;
         ha->fw_dump_reading = 0;
         ha->fw_dump_buffer = NULL;
+
+        vfree(ha->optrom_buffer);
 }
 
 /*
@@ -2314,6 +2345,9 @@ qla2x00_do_dpc(void *data)
                 if (!ha->interrupts_on)
                         ha->isp_ops.enable_intrs(ha);
 
+                if (test_and_clear_bit(BEACON_BLINK_NEEDED, &ha->dpc_flags))
+                        ha->isp_ops.beacon_blink(ha);
+
                 ha->dpc_active = 0;
         } /* End of while(1) */
 
@@ -2491,6 +2525,12 @@ qla2x00_timer(scsi_qla_host_t *ha)
                     atomic_read(&ha->loop_down_timer)));
         }
 
+        /* Check if beacon LED needs to be blinked */
+        if (ha->beacon_blink_led == 1) {
+                set_bit(BEACON_BLINK_NEEDED, &ha->dpc_flags);
+                start_dpc++;
+        }
+
         /* Schedule the DPC routine if needed */
         if ((test_bit(ISP_ABORT_NEEDED, &ha->dpc_flags) ||
             test_bit(LOOP_RESYNC_NEEDED, &ha->dpc_flags) ||
@@ -2499,6 +2539,7 @@ qla2x00_timer(scsi_qla_host_t *ha)
             start_dpc ||
             test_bit(LOGIN_RETRY_NEEDED, &ha->dpc_flags) ||
             test_bit(RESET_MARKER_NEEDED, &ha->dpc_flags) ||
+            test_bit(BEACON_BLINK_NEEDED, &ha->dpc_flags) ||
             test_bit(RELOGIN_NEEDED, &ha->dpc_flags)) &&
             ha->dpc_wait && !ha->dpc_active) {
 
diff --git a/drivers/scsi/qla2xxx/qla_rscn.c b/drivers/scsi/qla2xxx/qla_rscn.c
index 2c3342108dd8..b70bebe18c01 100644
--- a/drivers/scsi/qla2xxx/qla_rscn.c
+++ b/drivers/scsi/qla2xxx/qla_rscn.c
@@ -6,8 +6,6 @@
  */
 #include "qla_def.h"
 
-#include <scsi/scsi_transport_fc.h>
-
 /**
  * IO descriptor handle definitions.
  *
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index f4d755a643e4..3866a5760f15 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -695,3 +695,966 @@ qla24xx_write_nvram_data(scsi_qla_host_t *ha, uint8_t *buf, uint32_t naddr,
 
         return ret;
 }
+
+
+static inline void
+qla2x00_flip_colors(scsi_qla_host_t *ha, uint16_t *pflags)
+{
+        if (IS_QLA2322(ha)) {
+                /* Flip all colors. */
+                if (ha->beacon_color_state == QLA_LED_ALL_ON) {
+                        /* Turn off. */
+                        ha->beacon_color_state = 0;
+                        *pflags = GPIO_LED_ALL_OFF;
+                } else {
+                        /* Turn on. */
+                        ha->beacon_color_state = QLA_LED_ALL_ON;
+                        *pflags = GPIO_LED_RGA_ON;
+                }
+        } else {
+                /* Flip green led only. */
+                if (ha->beacon_color_state == QLA_LED_GRN_ON) {
+                        /* Turn off. */
+                        ha->beacon_color_state = 0;
+                        *pflags = GPIO_LED_GREEN_OFF_AMBER_OFF;
+                } else {
+                        /* Turn on. */
+                        ha->beacon_color_state = QLA_LED_GRN_ON;
+                        *pflags = GPIO_LED_GREEN_ON_AMBER_OFF;
+                }
+        }
+}
+
+void
+qla2x00_beacon_blink(struct scsi_qla_host *ha)
+{
+        uint16_t gpio_enable;
+        uint16_t gpio_data;
+        uint16_t led_color = 0;
+        unsigned long flags;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        if (ha->pio_address)
+                reg = (struct device_reg_2xxx __iomem *)ha->pio_address;
+
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+
+        /* Save the Original GPIOE. */
+        if (ha->pio_address) {
+                gpio_enable = RD_REG_WORD_PIO(&reg->gpioe);
+                gpio_data = RD_REG_WORD_PIO(&reg->gpiod);
+        } else {
+                gpio_enable = RD_REG_WORD(&reg->gpioe);
+                gpio_data = RD_REG_WORD(&reg->gpiod);
+        }
+
+        /* Set the modified gpio_enable values */
+        gpio_enable |= GPIO_LED_MASK;
+
+        if (ha->pio_address) {
+                WRT_REG_WORD_PIO(&reg->gpioe, gpio_enable);
+        } else {
+                WRT_REG_WORD(&reg->gpioe, gpio_enable);
+                RD_REG_WORD(&reg->gpioe);
+        }
+
+        qla2x00_flip_colors(ha, &led_color);
+
+        /* Clear out any previously set LED color. */
+        gpio_data &= ~GPIO_LED_MASK;
+
+        /* Set the new input LED color to GPIOD. */
+        gpio_data |= led_color;
+
+        /* Set the modified gpio_data values */
+        if (ha->pio_address) {
+                WRT_REG_WORD_PIO(&reg->gpiod, gpio_data);
+        } else {
+                WRT_REG_WORD(&reg->gpiod, gpio_data);
+                RD_REG_WORD(&reg->gpiod);
+        }
+
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+}
+
+int
+qla2x00_beacon_on(struct scsi_qla_host *ha)
+{
+        uint16_t gpio_enable;
+        uint16_t gpio_data;
+        unsigned long flags;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        ha->fw_options[1] &= ~FO1_SET_EMPHASIS_SWING;
+        ha->fw_options[1] |= FO1_DISABLE_GPIO6_7;
+
+        if (qla2x00_set_fw_options(ha, ha->fw_options) != QLA_SUCCESS) {
+                qla_printk(KERN_WARNING, ha,
+                    "Unable to update fw options (beacon on).\n");
+                return QLA_FUNCTION_FAILED;
+        }
+
+        if (ha->pio_address)
+                reg = (struct device_reg_2xxx __iomem *)ha->pio_address;
+
+        /* Turn off LEDs. */
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        if (ha->pio_address) {
+                gpio_enable = RD_REG_WORD_PIO(&reg->gpioe);
+                gpio_data = RD_REG_WORD_PIO(&reg->gpiod);
+        } else {
+                gpio_enable = RD_REG_WORD(&reg->gpioe);
+                gpio_data = RD_REG_WORD(&reg->gpiod);
+        }
+        gpio_enable |= GPIO_LED_MASK;
+
+        /* Set the modified gpio_enable values. */
+        if (ha->pio_address) {
+                WRT_REG_WORD_PIO(&reg->gpioe, gpio_enable);
+        } else {
+                WRT_REG_WORD(&reg->gpioe, gpio_enable);
+                RD_REG_WORD(&reg->gpioe);
+        }
+
+        /* Clear out previously set LED colour. */
+        gpio_data &= ~GPIO_LED_MASK;
+        if (ha->pio_address) {
+                WRT_REG_WORD_PIO(&reg->gpiod, gpio_data);
+        } else {
+                WRT_REG_WORD(&reg->gpiod, gpio_data);
+                RD_REG_WORD(&reg->gpiod);
+        }
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+        /*
+         * Let the per HBA timer kick off the blinking process based on
+         * the following flags. No need to do anything else now.
+         */
+        ha->beacon_blink_led = 1;
+        ha->beacon_color_state = 0;
+
+        return QLA_SUCCESS;
+}
+
+int
+qla2x00_beacon_off(struct scsi_qla_host *ha)
+{
+        int rval = QLA_SUCCESS;
+
+        ha->beacon_blink_led = 0;
+
+        /* Set the on flag so when it gets flipped it will be off. */
+        if (IS_QLA2322(ha))
+                ha->beacon_color_state = QLA_LED_ALL_ON;
+        else
+                ha->beacon_color_state = QLA_LED_GRN_ON;
+
+        ha->isp_ops.beacon_blink(ha);   /* This turns green LED off */
+
+        ha->fw_options[1] &= ~FO1_SET_EMPHASIS_SWING;
+        ha->fw_options[1] &= ~FO1_DISABLE_GPIO6_7;
+
+        rval = qla2x00_set_fw_options(ha, ha->fw_options);
+        if (rval != QLA_SUCCESS)
+                qla_printk(KERN_WARNING, ha,
+                    "Unable to update fw options (beacon off).\n");
+        return rval;
+}
+
+
+static inline void
+qla24xx_flip_colors(scsi_qla_host_t *ha, uint16_t *pflags)
+{
+        /* Flip all colors. */
+        if (ha->beacon_color_state == QLA_LED_ALL_ON) {
+                /* Turn off. */
+                ha->beacon_color_state = 0;
+                *pflags = 0;
+        } else {
+                /* Turn on. */
+                ha->beacon_color_state = QLA_LED_ALL_ON;
+                *pflags = GPDX_LED_YELLOW_ON | GPDX_LED_AMBER_ON;
+        }
+}
+
+void
+qla24xx_beacon_blink(struct scsi_qla_host *ha)
+{
+        uint16_t led_color = 0;
+        uint32_t gpio_data;
+        unsigned long flags;
+        struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+
+        /* Save the Original GPIOD. */
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        gpio_data = RD_REG_DWORD(&reg->gpiod);
+
+        /* Enable the gpio_data reg for update. */
+        gpio_data |= GPDX_LED_UPDATE_MASK;
+
+        WRT_REG_DWORD(&reg->gpiod, gpio_data);
+        gpio_data = RD_REG_DWORD(&reg->gpiod);
+
+        /* Set the color bits. */
+        qla24xx_flip_colors(ha, &led_color);
+
+        /* Clear out any previously set LED color. */
+        gpio_data &= ~GPDX_LED_COLOR_MASK;
+
+        /* Set the new input LED color to GPIOD. */
+        gpio_data |= led_color;
+
+        /* Set the modified gpio_data values. */
+        WRT_REG_DWORD(&reg->gpiod, gpio_data);
+        gpio_data = RD_REG_DWORD(&reg->gpiod);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+}
+
+int
+qla24xx_beacon_on(struct scsi_qla_host *ha)
+{
+        uint32_t gpio_data;
+        unsigned long flags;
+        struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+
+        if (ha->beacon_blink_led == 0) {
+                /* Enable firmware for update */
+                ha->fw_options[1] |= ADD_FO1_DISABLE_GPIO_LED_CTRL;
+
+                if (qla2x00_set_fw_options(ha, ha->fw_options) != QLA_SUCCESS)
+                        return QLA_FUNCTION_FAILED;
+
+                if (qla2x00_get_fw_options(ha, ha->fw_options) !=
+                    QLA_SUCCESS) {
+                        qla_printk(KERN_WARNING, ha,
+                            "Unable to update fw options (beacon on).\n");
+                        return QLA_FUNCTION_FAILED;
+                }
+
+                spin_lock_irqsave(&ha->hardware_lock, flags);
+                gpio_data = RD_REG_DWORD(&reg->gpiod);
+
+                /* Enable the gpio_data reg for update. */
+                gpio_data |= GPDX_LED_UPDATE_MASK;
+                WRT_REG_DWORD(&reg->gpiod, gpio_data);
+                RD_REG_DWORD(&reg->gpiod);
+
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
+        }
+
+        /* So all colors blink together. */
+        ha->beacon_color_state = 0;
+
+        /* Let the per HBA timer kick off the blinking process. */
+        ha->beacon_blink_led = 1;
+
+        return QLA_SUCCESS;
+}
+
+int
+qla24xx_beacon_off(struct scsi_qla_host *ha)
+{
+        uint32_t gpio_data;
+        unsigned long flags;
+        struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+
+        ha->beacon_blink_led = 0;
+        ha->beacon_color_state = QLA_LED_ALL_ON;
+
+        ha->isp_ops.beacon_blink(ha);   /* Will flip to all off. */
+
+        /* Give control back to firmware. */
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        gpio_data = RD_REG_DWORD(&reg->gpiod);
+
+        /* Disable the gpio_data reg for update. */
+        gpio_data &= ~GPDX_LED_UPDATE_MASK;
+        WRT_REG_DWORD(&reg->gpiod, gpio_data);
+        RD_REG_DWORD(&reg->gpiod);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+        ha->fw_options[1] &= ~ADD_FO1_DISABLE_GPIO_LED_CTRL;
+
+        if (qla2x00_set_fw_options(ha, ha->fw_options) != QLA_SUCCESS) {
+                qla_printk(KERN_WARNING, ha,
+                    "Unable to update fw options (beacon off).\n");
+                return QLA_FUNCTION_FAILED;
+        }
+
+        if (qla2x00_get_fw_options(ha, ha->fw_options) != QLA_SUCCESS) {
+                qla_printk(KERN_WARNING, ha,
+                    "Unable to get fw options (beacon off).\n");
+                return QLA_FUNCTION_FAILED;
+        }
+
+        return QLA_SUCCESS;
+}
+
+
+/*
+ * Flash support routines
+ */
+
+/**
+ * qla2x00_flash_enable() - Setup flash for reading and writing.
+ * @ha: HA context
+ */
+static void
+qla2x00_flash_enable(scsi_qla_host_t *ha)
+{
+        uint16_t data;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        data = RD_REG_WORD(&reg->ctrl_status);
+        data |= CSR_FLASH_ENABLE;
+        WRT_REG_WORD(&reg->ctrl_status, data);
+        RD_REG_WORD(&reg->ctrl_status);         /* PCI Posting. */
+}
+
+/**
+ * qla2x00_flash_disable() - Disable flash and allow RISC to run.
+ * @ha: HA context
+ */
+static void
+qla2x00_flash_disable(scsi_qla_host_t *ha)
+{
+        uint16_t data;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        data = RD_REG_WORD(&reg->ctrl_status);
+        data &= ~(CSR_FLASH_ENABLE);
+        WRT_REG_WORD(&reg->ctrl_status, data);
+        RD_REG_WORD(&reg->ctrl_status);         /* PCI Posting. */
+}
+
+/**
+ * qla2x00_read_flash_byte() - Reads a byte from flash
+ * @ha: HA context
+ * @addr: Address in flash to read
+ *
+ * A word is read from the chip, but, only the lower byte is valid.
+ *
+ * Returns the byte read from flash @addr.
+ */
+static uint8_t
+qla2x00_read_flash_byte(scsi_qla_host_t *ha, uint32_t addr)
+{
+        uint16_t data;
+        uint16_t bank_select;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        bank_select = RD_REG_WORD(&reg->ctrl_status);
+
+        if (IS_QLA2322(ha) || IS_QLA6322(ha)) {
+                /* Specify 64K address range: */
+                /*  clear out Module Select and Flash Address bits [19:16]. */
+                bank_select &= ~0xf8;
+                bank_select |= addr >> 12 & 0xf0;
+                bank_select |= CSR_FLASH_64K_BANK;
+                WRT_REG_WORD(&reg->ctrl_status, bank_select);
+                RD_REG_WORD(&reg->ctrl_status); /* PCI Posting. */
+
+                WRT_REG_WORD(&reg->flash_address, (uint16_t)addr);
+                data = RD_REG_WORD(&reg->flash_data);
+
+                return (uint8_t)data;
+        }
+
+        /* Setup bit 16 of flash address. */
+        if ((addr & BIT_16) && ((bank_select & CSR_FLASH_64K_BANK) == 0)) {
+                bank_select |= CSR_FLASH_64K_BANK;
+                WRT_REG_WORD(&reg->ctrl_status, bank_select);
+                RD_REG_WORD(&reg->ctrl_status); /* PCI Posting. */
+        } else if (((addr & BIT_16) == 0) &&
+            (bank_select & CSR_FLASH_64K_BANK)) {
+                bank_select &= ~(CSR_FLASH_64K_BANK);
+                WRT_REG_WORD(&reg->ctrl_status, bank_select);
+                RD_REG_WORD(&reg->ctrl_status); /* PCI Posting. */
+        }
+
+        /* Always perform IO mapped accesses to the FLASH registers. */
+        if (ha->pio_address) {
+                uint16_t data2;
+
+                reg = (struct device_reg_2xxx __iomem *)ha->pio_address;
+                WRT_REG_WORD_PIO(&reg->flash_address, (uint16_t)addr);
+                do {
+                        data = RD_REG_WORD_PIO(&reg->flash_data);
+                        barrier();
+                        cpu_relax();
+                        data2 = RD_REG_WORD_PIO(&reg->flash_data);
+                } while (data != data2);
+        } else {
+                WRT_REG_WORD(&reg->flash_address, (uint16_t)addr);
+                data = qla2x00_debounce_register(&reg->flash_data);
+        }
+
+        return (uint8_t)data;
+}
+
+/**
+ * qla2x00_write_flash_byte() - Write a byte to flash
+ * @ha: HA context
+ * @addr: Address in flash to write
+ * @data: Data to write
+ */
+static void
+qla2x00_write_flash_byte(scsi_qla_host_t *ha, uint32_t addr, uint8_t data)
+{
+        uint16_t bank_select;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        bank_select = RD_REG_WORD(&reg->ctrl_status);
+        if (IS_QLA2322(ha) || IS_QLA6322(ha)) {
+                /* Specify 64K address range: */
+                /*  clear out Module Select and Flash Address bits [19:16]. */
+                bank_select &= ~0xf8;
+                bank_select |= addr >> 12 & 0xf0;
+                bank_select |= CSR_FLASH_64K_BANK;
+                WRT_REG_WORD(&reg->ctrl_status, bank_select);
+                RD_REG_WORD(&reg->ctrl_status); /* PCI Posting. */
+
+                WRT_REG_WORD(&reg->flash_address, (uint16_t)addr);
+                RD_REG_WORD(&reg->ctrl_status);         /* PCI Posting. */
+                WRT_REG_WORD(&reg->flash_data, (uint16_t)data);
+                RD_REG_WORD(&reg->ctrl_status);         /* PCI Posting. */
+
+                return;
+        }
+
+        /* Setup bit 16 of flash address. */
+        if ((addr & BIT_16) && ((bank_select & CSR_FLASH_64K_BANK) == 0)) {
+                bank_select |= CSR_FLASH_64K_BANK;
+                WRT_REG_WORD(&reg->ctrl_status, bank_select);
+                RD_REG_WORD(&reg->ctrl_status); /* PCI Posting. */
+        } else if (((addr & BIT_16) == 0) &&
+            (bank_select & CSR_FLASH_64K_BANK)) {
+                bank_select &= ~(CSR_FLASH_64K_BANK);
+                WRT_REG_WORD(&reg->ctrl_status, bank_select);
+                RD_REG_WORD(&reg->ctrl_status); /* PCI Posting. */
+        }
+
+        /* Always perform IO mapped accesses to the FLASH registers. */
+        if (ha->pio_address) {
+                reg = (struct device_reg_2xxx __iomem *)ha->pio_address;
+                WRT_REG_WORD_PIO(&reg->flash_address, (uint16_t)addr);
+                WRT_REG_WORD_PIO(&reg->flash_data, (uint16_t)data);
+        } else {
+                WRT_REG_WORD(&reg->flash_address, (uint16_t)addr);
+                RD_REG_WORD(&reg->ctrl_status);         /* PCI Posting. */
+                WRT_REG_WORD(&reg->flash_data, (uint16_t)data);
+                RD_REG_WORD(&reg->ctrl_status);         /* PCI Posting. */
+        }
+}
+
+/**
+ * qla2x00_poll_flash() - Polls flash for completion.
+ * @ha: HA context
+ * @addr: Address in flash to poll
+ * @poll_data: Data to be polled
+ * @man_id: Flash manufacturer ID
+ * @flash_id: Flash ID
+ *
+ * This function polls the device until bit 7 of what is read matches data
+ * bit 7 or until data bit 5 becomes a 1.  If that hapens, the flash ROM timed
+ * out (a fatal error).  The flash book recommeds reading bit 7 again after
+ * reading bit 5 as a 1.
+ *
+ * Returns 0 on success, else non-zero.
+ */
+static int
+qla2x00_poll_flash(scsi_qla_host_t *ha, uint32_t addr, uint8_t poll_data,
+    uint8_t man_id, uint8_t flash_id)
+{
+        int status;
+        uint8_t flash_data;
+        uint32_t cnt;
+
+        status = 1;
+
+        /* Wait for 30 seconds for command to finish. */
+        poll_data &= BIT_7;
+        for (cnt = 3000000; cnt; cnt--) {
+                flash_data = qla2x00_read_flash_byte(ha, addr);
+                if ((flash_data & BIT_7) == poll_data) {
+                        status = 0;
+                        break;
+                }
+
+                if (man_id != 0x40 && man_id != 0xda) {
+                        if ((flash_data & BIT_5) && cnt > 2)
+                                cnt = 2;
+                }
+                udelay(10);
+                barrier();
+        }
+        return status;
+}
+
+#define IS_OEM_001(ha) \
+        ((ha)->pdev->device == PCI_DEVICE_ID_QLOGIC_ISP2322 && \
+         (ha)->pdev->subsystem_vendor == 0x1028 && \
+         (ha)->pdev->subsystem_device == 0x0170)
+
+/**
+ * qla2x00_program_flash_address() - Programs a flash address
+ * @ha: HA context
+ * @addr: Address in flash to program
+ * @data: Data to be written in flash
+ * @man_id: Flash manufacturer ID
+ * @flash_id: Flash ID
+ *
+ * Returns 0 on success, else non-zero.
+ */
+static int
+qla2x00_program_flash_address(scsi_qla_host_t *ha, uint32_t addr, uint8_t data,
+    uint8_t man_id, uint8_t flash_id)
+{
+        /* Write Program Command Sequence. */
+        if (IS_OEM_001(ha)) {
+                qla2x00_write_flash_byte(ha, 0xaaa, 0xaa);
+                qla2x00_write_flash_byte(ha, 0x555, 0x55);
+                qla2x00_write_flash_byte(ha, 0xaaa, 0xa0);
+                qla2x00_write_flash_byte(ha, addr, data);
+        } else {
+                if (man_id == 0xda && flash_id == 0xc1) {
+                        qla2x00_write_flash_byte(ha, addr, data);
+                        if (addr & 0x7e)
+                                return 0;
+                } else {
+                        qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+                        qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+                        qla2x00_write_flash_byte(ha, 0x5555, 0xa0);
+                        qla2x00_write_flash_byte(ha, addr, data);
+                }
+        }
+
+        udelay(150);
+
+        /* Wait for write to complete. */
+        return qla2x00_poll_flash(ha, addr, data, man_id, flash_id);
+}
+
+/**
+ * qla2x00_erase_flash() - Erase the flash.
+ * @ha: HA context
+ * @man_id: Flash manufacturer ID
+ * @flash_id: Flash ID
+ *
+ * Returns 0 on success, else non-zero.
+ */
+static int
+qla2x00_erase_flash(scsi_qla_host_t *ha, uint8_t man_id, uint8_t flash_id)
+{
+        /* Individual Sector Erase Command Sequence */
+        if (IS_OEM_001(ha)) {
+                qla2x00_write_flash_byte(ha, 0xaaa, 0xaa);
+                qla2x00_write_flash_byte(ha, 0x555, 0x55);
+                qla2x00_write_flash_byte(ha, 0xaaa, 0x80);
+                qla2x00_write_flash_byte(ha, 0xaaa, 0xaa);
+                qla2x00_write_flash_byte(ha, 0x555, 0x55);
+                qla2x00_write_flash_byte(ha, 0xaaa, 0x10);
+        } else {
+                qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+                qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+                qla2x00_write_flash_byte(ha, 0x5555, 0x80);
+                qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+                qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+                qla2x00_write_flash_byte(ha, 0x5555, 0x10);
+        }
+
+        udelay(150);
+
+        /* Wait for erase to complete. */
+        return qla2x00_poll_flash(ha, 0x00, 0x80, man_id, flash_id);
+}
+
+/**
+ * qla2x00_erase_flash_sector() - Erase a flash sector.
+ * @ha: HA context
+ * @addr: Flash sector to erase
+ * @sec_mask: Sector address mask
+ * @man_id: Flash manufacturer ID
+ * @flash_id: Flash ID
+ *
+ * Returns 0 on success, else non-zero.
+ */
+static int
+qla2x00_erase_flash_sector(scsi_qla_host_t *ha, uint32_t addr,
+    uint32_t sec_mask, uint8_t man_id, uint8_t flash_id)
+{
+        /* Individual Sector Erase Command Sequence */
+        qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+        qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+        qla2x00_write_flash_byte(ha, 0x5555, 0x80);
+        qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+        qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+        if (man_id == 0x1f && flash_id == 0x13)
+                qla2x00_write_flash_byte(ha, addr & sec_mask, 0x10);
+        else
+                qla2x00_write_flash_byte(ha, addr & sec_mask, 0x30);
+
+        udelay(150);
+
+        /* Wait for erase to complete. */
+        return qla2x00_poll_flash(ha, addr, 0x80, man_id, flash_id);
+}
+
+/**
+ * qla2x00_get_flash_manufacturer() - Read manufacturer ID from flash chip.
+ * @man_id: Flash manufacturer ID
+ * @flash_id: Flash ID
+ */
+static void
+qla2x00_get_flash_manufacturer(scsi_qla_host_t *ha, uint8_t *man_id,
+    uint8_t *flash_id)
+{
+        qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+        qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+        qla2x00_write_flash_byte(ha, 0x5555, 0x90);
+        *man_id = qla2x00_read_flash_byte(ha, 0x0000);
+        *flash_id = qla2x00_read_flash_byte(ha, 0x0001);
+        qla2x00_write_flash_byte(ha, 0x5555, 0xaa);
+        qla2x00_write_flash_byte(ha, 0x2aaa, 0x55);
+        qla2x00_write_flash_byte(ha, 0x5555, 0xf0);
+}
+
+
+static inline void
+qla2x00_suspend_hba(struct scsi_qla_host *ha)
+{
+        int cnt;
+        unsigned long flags;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        /* Suspend HBA. */
+        scsi_block_requests(ha->host);
+        ha->isp_ops.disable_intrs(ha);
+        set_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
+
+        /* Pause RISC. */
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        WRT_REG_WORD(&reg->hccr, HCCR_PAUSE_RISC);
+        RD_REG_WORD(&reg->hccr);
+        if (IS_QLA2100(ha) || IS_QLA2200(ha) || IS_QLA2300(ha)) {
+                for (cnt = 0; cnt < 30000; cnt++) {
+                        if ((RD_REG_WORD(&reg->hccr) & HCCR_RISC_PAUSE) != 0)
+                                break;
+                        udelay(100);
+                }
+        } else {
+                udelay(10);
+        }
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+}
+
+static inline void
+qla2x00_resume_hba(struct scsi_qla_host *ha)
+{
+        /* Resume HBA. */
+        clear_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
+        set_bit(ISP_ABORT_NEEDED, &ha->dpc_flags);
+        up(ha->dpc_wait);
+        qla2x00_wait_for_hba_online(ha);
+        scsi_unblock_requests(ha->host);
+}
+
+uint8_t *
+qla2x00_read_optrom_data(struct scsi_qla_host *ha, uint8_t *buf,
+    uint32_t offset, uint32_t length)
+{
+        unsigned long flags;
+        uint32_t addr, midpoint;
+        uint8_t *data;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        /* Suspend HBA. */
+        qla2x00_suspend_hba(ha);
+
+        /* Go with read. */
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        midpoint = ha->optrom_size / 2;
+
+        qla2x00_flash_enable(ha);
+        WRT_REG_WORD(&reg->nvram, 0);
+        RD_REG_WORD(&reg->nvram);               /* PCI Posting. */
+        for (addr = offset, data = buf; addr < length; addr++, data++) {
+                if (addr == midpoint) {
+                        WRT_REG_WORD(&reg->nvram, NVR_SELECT);
+                        RD_REG_WORD(&reg->nvram);       /* PCI Posting. */
+                }
+
+                *data = qla2x00_read_flash_byte(ha, addr);
+        }
+        qla2x00_flash_disable(ha);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+        /* Resume HBA. */
+        qla2x00_resume_hba(ha);
+
+        return buf;
+}
+
+int
+qla2x00_write_optrom_data(struct scsi_qla_host *ha, uint8_t *buf,
+    uint32_t offset, uint32_t length)
+{
+
+        int rval;
+        unsigned long flags;
+        uint8_t man_id, flash_id, sec_number, data;
+        uint16_t wd;
+        uint32_t addr, liter, sec_mask, rest_addr;
+        struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
+
+        /* Suspend HBA. */
+        qla2x00_suspend_hba(ha);
+
+        rval = QLA_SUCCESS;
+        sec_number = 0;
+
+        /* Reset ISP chip. */
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        WRT_REG_WORD(&reg->ctrl_status, CSR_ISP_SOFT_RESET);
+        pci_read_config_word(ha->pdev, PCI_COMMAND, &wd);
+
+        /* Go with write. */
+        qla2x00_flash_enable(ha);
+        do {    /* Loop once to provide quick error exit */
+                /* Structure of flash memory based on manufacturer */
+                if (IS_OEM_001(ha)) {
+                        /* OEM variant with special flash part. */
+                        man_id = flash_id = 0;
+                        rest_addr = 0xffff;
+                        sec_mask   = 0x10000;
+                        goto update_flash;
+                }
+                qla2x00_get_flash_manufacturer(ha, &man_id, &flash_id);
+                switch (man_id) {
+                case 0x20: /* ST flash. */
+                        if (flash_id == 0xd2 || flash_id == 0xe3) {
+                                /*
+                                 * ST m29w008at part - 64kb sector size with
+                                 * 32kb,8kb,8kb,16kb sectors at memory address
+                                 * 0xf0000.
+                                 */
+                                rest_addr = 0xffff;
+                                sec_mask = 0x10000;
+                                break;   
+                        }
+                        /*
+                         * ST m29w010b part - 16kb sector size
+                         * Default to 16kb sectors
+                         */
+                        rest_addr = 0x3fff;
+                        sec_mask = 0x1c000;
+                        break;
+                case 0x40: /* Mostel flash. */
+                        /* Mostel v29c51001 part - 512 byte sector size. */
+                        rest_addr = 0x1ff;
+                        sec_mask = 0x1fe00;
+                        break;
+                case 0xbf: /* SST flash. */
+                        /* SST39sf10 part - 4kb sector size. */
+                        rest_addr = 0xfff;
+                        sec_mask = 0x1f000;
+                        break;
+                case 0xda: /* Winbond flash. */
+                        /* Winbond W29EE011 part - 256 byte sector size. */
+                        rest_addr = 0x7f;
+                        sec_mask = 0x1ff80;
+                        break;
+                case 0xc2: /* Macronix flash. */
+                        /* 64k sector size. */
+                        if (flash_id == 0x38 || flash_id == 0x4f) {
+                                rest_addr = 0xffff;
+                                sec_mask = 0x10000;
+                                break;
+                        }
+                        /* Fall through... */
+
+                case 0x1f: /* Atmel flash. */
+                        /* 512k sector size. */
+                        if (flash_id == 0x13) {
+                                rest_addr = 0x7fffffff;
+                                sec_mask =   0x80000000;
+                                break;
+                        }
+                        /* Fall through... */
+
+                case 0x01: /* AMD flash. */
+                        if (flash_id == 0x38 || flash_id == 0x40 ||
+                            flash_id == 0x4f) {
+                                /* Am29LV081 part - 64kb sector size. */
+                                /* Am29LV002BT part - 64kb sector size. */
+                                rest_addr = 0xffff;
+                                sec_mask = 0x10000;
+                                break;
+                        } else if (flash_id == 0x3e) {
+                                /*
+                                 * Am29LV008b part - 64kb sector size with
+                                 * 32kb,8kb,8kb,16kb sector at memory address
+                                 * h0xf0000.
+                                 */
+                                rest_addr = 0xffff;
+                                sec_mask = 0x10000;
+                                break;
+                        } else if (flash_id == 0x20 || flash_id == 0x6e) {
+                                /*
+                                 * Am29LV010 part or AM29f010 - 16kb sector
+                                 * size.
+                                 */
+                                rest_addr = 0x3fff;
+                                sec_mask = 0x1c000;
+                                break;
+                        } else if (flash_id == 0x6d) {
+                                /* Am29LV001 part - 8kb sector size. */
+                                rest_addr = 0x1fff;
+                                sec_mask = 0x1e000;
+                                break;
+                        }
+                default:
+                        /* Default to 16 kb sector size. */
+                        rest_addr = 0x3fff;
+                        sec_mask = 0x1c000;
+                        break;
+                }
+
+update_flash:
+                if (IS_QLA2322(ha) || IS_QLA6322(ha)) {
+                        if (qla2x00_erase_flash(ha, man_id, flash_id)) {
+                                rval = QLA_FUNCTION_FAILED;
+                                break;
+                        }
+                }
+
+                for (addr = offset, liter = 0; liter < length; liter++,
+                    addr++) {
+                        data = buf[liter];
+                        /* Are we at the beginning of a sector? */
+                        if ((addr & rest_addr) == 0) {
+                                if (IS_QLA2322(ha) || IS_QLA6322(ha)) {
+                                        if (addr >= 0x10000UL) {
+                                                if (((addr >> 12) & 0xf0) &&
+                                                    ((man_id == 0x01 &&
+                                                        flash_id == 0x3e) ||
+                                                     (man_id == 0x20 &&
+                                                         flash_id == 0xd2))) {
+                                                        sec_number++;
+                                                        if (sec_number == 1) {
+                                                                rest_addr =
+                                                                    0x7fff;
+                                                                sec_mask =
+                                                                    0x18000;
+                                                        } else if (
+                                                            sec_number == 2 ||
+                                                            sec_number == 3) {
+                                                                rest_addr =
+                                                                    0x1fff;
+                                                                sec_mask =
+                                                                    0x1e000;
+                                                        } else if (
+                                                            sec_number == 4) {
+                                                                rest_addr =
+                                                                    0x3fff;
+                                                                sec_mask =
+                                                                    0x1c000;
+                                                        }
+                                                }
+                                        }
+                                } else if (addr == ha->optrom_size / 2) {
+                                        WRT_REG_WORD(&reg->nvram, NVR_SELECT);
+                                        RD_REG_WORD(&reg->nvram);
+                                }
+
+                                if (flash_id == 0xda && man_id == 0xc1) {
+                                        qla2x00_write_flash_byte(ha, 0x5555,
+                                            0xaa);
+                                        qla2x00_write_flash_byte(ha, 0x2aaa,
+                                            0x55);
+                                        qla2x00_write_flash_byte(ha, 0x5555,
+                                            0xa0);
+                                } else if (!IS_QLA2322(ha) && !IS_QLA6322(ha)) {
+                                        /* Then erase it */
+                                        if (qla2x00_erase_flash_sector(ha,
+                                            addr, sec_mask, man_id,
+                                            flash_id)) {
+                                                rval = QLA_FUNCTION_FAILED;
+                                                break;
+                                        }
+                                        if (man_id == 0x01 && flash_id == 0x6d)
+                                                sec_number++;
+                                }
+                        }
+
+                        if (man_id == 0x01 && flash_id == 0x6d) {
+                                if (sec_number == 1 &&
+                                    addr == (rest_addr - 1)) {
+                                        rest_addr = 0x0fff;
+                                        sec_mask   = 0x1f000;
+                                } else if (sec_number == 3 && (addr & 0x7ffe)) {
+                                        rest_addr = 0x3fff;
+                                        sec_mask   = 0x1c000;
+                                }
+                        }
+
+                        if (qla2x00_program_flash_address(ha, addr, data,
+                            man_id, flash_id)) {
+                                rval = QLA_FUNCTION_FAILED;
+                                break;
+                        }
+                }
+        } while (0);
+        qla2x00_flash_disable(ha);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+        /* Resume HBA. */
+        qla2x00_resume_hba(ha);
+
+        return rval;
+}
+
+uint8_t *
+qla24xx_read_optrom_data(struct scsi_qla_host *ha, uint8_t *buf,
+    uint32_t offset, uint32_t length)
+{
+        /* Suspend HBA. */
+        scsi_block_requests(ha->host);
+        ha->isp_ops.disable_intrs(ha);
+        set_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
+
+        /* Go with read. */
+        qla24xx_read_flash_data(ha, (uint32_t *)buf, offset >> 2, length >> 2);
+
+        /* Resume HBA. */
+        clear_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
+        ha->isp_ops.enable_intrs(ha);
+        scsi_unblock_requests(ha->host);
+
+        return buf;
+}
+
+int
+qla24xx_write_optrom_data(struct scsi_qla_host *ha, uint8_t *buf,
+    uint32_t offset, uint32_t length)
+{
+        int rval;
+
+        /* Suspend HBA. */
+        scsi_block_requests(ha->host);
+        ha->isp_ops.disable_intrs(ha);
+        set_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
+
+        /* Go with write. */
+        rval = qla24xx_write_flash_data(ha, (uint32_t *)buf, offset >> 2,
+            length >> 2);
+
+        /* Resume HBA -- RISC reset needed. */
+        clear_bit(MBX_UPDATE_FLASH_ACTIVE, &ha->mbx_cmd_flags);
+        set_bit(ISP_ABORT_NEEDED, &ha->dpc_flags);
+        up(ha->dpc_wait);
+        qla2x00_wait_for_hba_online(ha);
+        scsi_unblock_requests(ha->host);
+
+        return rval;
+}
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index cd54244058b5..2770005324b4 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -510,6 +510,12 @@ static const struct mv_hw_ops mv6xxx_ops = {
 };
 
 /*
+ * module options
+ */
+static int msi;       /* Use PCI msi; either zero (off, default) or non-zero */
+
+
+/*
  * Functions
  */
 
@@ -991,6 +997,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
         case ATA_CMD_READ_EXT:
         case ATA_CMD_WRITE:
         case ATA_CMD_WRITE_EXT:
+        case ATA_CMD_WRITE_FUA_EXT:
                 mv_crqb_pack_cmd(cw++, tf->hob_nsect, ATA_REG_NSECT, 0);
                 break;
 #ifdef LIBATA_NCQ               /* FIXME: remove this line when NCQ added */
@@ -2191,7 +2198,7 @@ static int mv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
 
         /* Enable interrupts */
-        if (pci_enable_msi(pdev) == 0) {
+        if (msi && pci_enable_msi(pdev) == 0) {
                 hpriv->hp_flags |= MV_HP_FLAG_MSI;
         } else {
                 pci_intx(pdev, 1);
@@ -2246,5 +2253,8 @@ MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, mv_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
 
+module_param(msi, int, 0444);
+MODULE_PARM_DESC(msi, "Enable use of PCI MSI (0=off, 1=on)");
+
 module_init(mv_init);
 module_exit(mv_exit);
diff --git a/drivers/scsi/sata_qstor.c b/drivers/scsi/sata_qstor.c
index de05e2883f9c..80480f0fb2b8 100644
--- a/drivers/scsi/sata_qstor.c
+++ b/drivers/scsi/sata_qstor.c
@@ -277,7 +277,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc)
         u8 *prd = pp->pkt + QS_CPB_BYTES;
 
         assert(qc->__sg != NULL);
-        assert(qc->n_elem > 0);
+        assert(qc->n_elem > 0 || qc->pad_len > 0);
 
         nelem = 0;
         ata_for_each_sg(sg, qc) {
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index b017f85e6d6a..9face3c6aa21 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -49,11 +49,13 @@
 #define DRV_VERSION     "0.9"
 
 enum {
+        SIL_FLAG_RERR_ON_DMA_ACT = (1 << 29),
         SIL_FLAG_MOD15WRITE     = (1 << 30),
 
         sil_3112                = 0,
         sil_3112_m15w           = 1,
-        sil_3114                = 2,
+        sil_3512                = 2,
+        sil_3114                = 3,
 
         SIL_FIFO_R0             = 0x40,
         SIL_FIFO_W0             = 0x41,
@@ -90,7 +92,7 @@ static void sil_post_set_mode (struct ata_port *ap);
 static const struct pci_device_id sil_pci_tbl[] = {
         { 0x1095, 0x3112, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
         { 0x1095, 0x0240, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
-        { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
+        { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3512 },
         { 0x1095, 0x3114, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3114 },
         { 0x1002, 0x436e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
         { 0x1002, 0x4379, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
@@ -185,7 +187,8 @@ static const struct ata_port_info sil_port_info[] = {
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
                 .port_ops       = &sil_ops,
-        }, /* sil_3112_15w - keep it sync'd w/ sil_3112 */
+        },
+        /* sil_3112_15w - keep it sync'd w/ sil_3112 */
         {
                 .sht            = &sil_sht,
                 .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
@@ -195,11 +198,24 @@ static const struct ata_port_info sil_port_info[] = {
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
                 .port_ops       = &sil_ops,
-        }, /* sil_3114 */
+        },
+        /* sil_3512 */
         {
                 .sht            = &sil_sht,
                 .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
-                                  ATA_FLAG_SRST | ATA_FLAG_MMIO,
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_RERR_ON_DMA_ACT,
+                .pio_mask       = 0x1f,                 /* pio0-4 */
+                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
+                .udma_mask      = 0x3f,                 /* udma0-5 */
+                .port_ops       = &sil_ops,
+        },
+        /* sil_3114 */
+        {
+                .sht            = &sil_sht,
+                .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_RERR_ON_DMA_ACT,
                 .pio_mask       = 0x1f,                 /* pio0-4 */
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
@@ -216,12 +232,13 @@ static const struct {
         unsigned long scr;      /* SATA control register block */
         unsigned long sien;     /* SATA Interrupt Enable register */
         unsigned long xfer_mode;/* data transfer mode register */
+        unsigned long sfis_cfg; /* SATA FIS reception config register */
 } sil_port[] = {
         /* port 0 ... */
-        { 0x80, 0x8A, 0x00, 0x100, 0x148, 0xb4 },
-        { 0xC0, 0xCA, 0x08, 0x180, 0x1c8, 0xf4 },
-        { 0x280, 0x28A, 0x200, 0x300, 0x348, 0x2b4 },
-        { 0x2C0, 0x2CA, 0x208, 0x380, 0x3c8, 0x2f4 },
+        { 0x80, 0x8A, 0x00, 0x100, 0x148, 0xb4, 0x14c },
+        { 0xC0, 0xCA, 0x08, 0x180, 0x1c8, 0xf4, 0x1cc },
+        { 0x280, 0x28A, 0x200, 0x300, 0x348, 0x2b4, 0x34c },
+        { 0x2C0, 0x2CA, 0x208, 0x380, 0x3c8, 0x2f4, 0x3cc },
         /* ... port 3 */
 };
 
@@ -231,6 +248,10 @@ MODULE_LICENSE("GPL");
 MODULE_DEVICE_TABLE(pci, sil_pci_tbl);
 MODULE_VERSION(DRV_VERSION);
 
+static int slow_down = 0;
+module_param(slow_down, int, 0444);
+MODULE_PARM_DESC(slow_down, "Sledgehammer used to work around random problems, by limiting commands to 15 sectors (0=off, 1=on)");
+
 
 static unsigned char sil_get_device_cache_line(struct pci_dev *pdev)
 {
@@ -354,8 +375,10 @@ static void sil_dev_config(struct ata_port *ap, struct ata_device *dev)
                 }
 
         /* limit requests to 15 sectors */
-        if ((ap->flags & SIL_FLAG_MOD15WRITE) && (quirks & SIL_QUIRK_MOD15WRITE)) {
-                printk(KERN_INFO "ata%u(%u): applying Seagate errata fix\n",
+        if (slow_down ||
+            ((ap->flags & SIL_FLAG_MOD15WRITE) &&
+             (quirks & SIL_QUIRK_MOD15WRITE))) {
+                printk(KERN_INFO "ata%u(%u): applying Seagate errata fix (mod15write workaround)\n",
                        ap->id, dev->devno);
                 ap->host->max_sectors = 15;
                 ap->host->hostt->max_sectors = 15;
@@ -465,6 +488,23 @@ static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 dev_printk(KERN_WARNING, &pdev->dev,
                          "cache line size not set.  Driver may not function\n");
 
+        /* Apply R_ERR on DMA activate FIS errata workaround */
+        if (probe_ent->host_flags & SIL_FLAG_RERR_ON_DMA_ACT) {
+                int cnt;
+
+                for (i = 0, cnt = 0; i < probe_ent->n_ports; i++) {
+                        tmp = readl(mmio_base + sil_port[i].sfis_cfg);
+                        if ((tmp & 0x3) != 0x01)
+                                continue;
+                        if (!cnt)
+                                dev_printk(KERN_INFO, &pdev->dev,
+                                           "Applying R_ERR on DMA activate "
+                                           "FIS errata fix\n");
+                        writel(tmp & ~0x3, mmio_base + sil_port[i].sfis_cfg);
+                        cnt++;
+                }
+        }
+
         if (ent->driver_data == sil_3114) {
                 irq_mask = SIL_MASK_4PORT;
 
diff --git a/drivers/scsi/sata_vsc.c b/drivers/scsi/sata_vsc.c
index 2e2c3b7acb0c..e484e8db6810 100644
--- a/drivers/scsi/sata_vsc.c
+++ b/drivers/scsi/sata_vsc.c
@@ -81,6 +81,19 @@
 /* Port stride */
 #define VSC_SATA_PORT_OFFSET            0x200
 
+/* Error interrupt status bit offsets */
+#define VSC_SATA_INT_ERROR_E_OFFSET     2
+#define VSC_SATA_INT_ERROR_P_OFFSET     4
+#define VSC_SATA_INT_ERROR_T_OFFSET     5
+#define VSC_SATA_INT_ERROR_M_OFFSET     1
+#define is_vsc_sata_int_err(port_idx, int_status) \
+         (int_status & ((1 << (VSC_SATA_INT_ERROR_E_OFFSET + (8 * port_idx))) | \
+                        (1 << (VSC_SATA_INT_ERROR_P_OFFSET + (8 * port_idx))) | \
+                        (1 << (VSC_SATA_INT_ERROR_T_OFFSET + (8 * port_idx))) | \
+                        (1 << (VSC_SATA_INT_ERROR_M_OFFSET + (8 * port_idx)))   \
+                       )\
+         )
+
 
 static u32 vsc_sata_scr_read (struct ata_port *ap, unsigned int sc_reg)
 {
@@ -201,13 +214,28 @@ static irqreturn_t vsc_sata_interrupt (int irq, void *dev_instance,
                         struct ata_port *ap;
 
                         ap = host_set->ports[i];
+
+                        if (is_vsc_sata_int_err(i, int_status)) {
+                                u32 err_status;
+                                printk(KERN_DEBUG "%s: ignoring interrupt(s)\n", __FUNCTION__);
+                                err_status = ap ? vsc_sata_scr_read(ap, SCR_ERROR) : 0;
+                                vsc_sata_scr_write(ap, SCR_ERROR, err_status);
+                                handled++;
+                        }
+
                         if (ap && !(ap->flags &
                                     (ATA_FLAG_PORT_DISABLED|ATA_FLAG_NOINTR))) {
                                 struct ata_queued_cmd *qc;
 
                                 qc = ata_qc_from_tag(ap, ap->active_tag);
-                                if (qc && (!(qc->tf.ctl & ATA_NIEN)))
+                                if (qc && (!(qc->tf.ctl & ATA_NIEN))) {
                                         handled += ata_host_intr(ap, qc);
+                                } else {
+                                        printk(KERN_DEBUG "%s: ignoring interrupt(s)\n", __FUNCTION__);
+                                        ata_chk_status(ap);
+                                        handled++;
+                                }
+
                         }
                 }
         }
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 245ca99a641e..c551bb84dbfb 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1245,7 +1245,7 @@ static int __init init_scsi(void)
         if (error)
                 goto cleanup_sysctl;
 
-        for (i = 0; i < NR_CPUS; i++)
+        for_each_cpu(i)
                 INIT_LIST_HEAD(&per_cpu(scsi_done_q, i));
 
         devfs_mk_dir("scsi");
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index f01ec0a7c506..84c3937ae8fb 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -126,6 +126,7 @@ static struct {
         {"ADAPTEC", "Adaptec 5400S", NULL, BLIST_FORCELUN},
         {"AFT PRO", "-IX CF", "0.0>", BLIST_FORCELUN},
         {"BELKIN", "USB 2 HS-CF", "1.95",  BLIST_FORCELUN | BLIST_INQUIRY_36},
+        {"BROWNIE", "1600U3P", NULL, BLIST_NOREPORTLUN},
         {"CANON", "IPUBJD", NULL, BLIST_SPARSELUN},
         {"CBOX3", "USB Storage-SMC", "300A", BLIST_FORCELUN | BLIST_INQUIRY_36},
         {"CMD", "CRA-7280", NULL, BLIST_SPARSELUN},     /* CMD RAID Controller */
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 5cc97b721661..ff82ccfbb106 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1308,7 +1308,7 @@ int scsi_decide_disposition(struct scsi_cmnd *scmd)
          * the request was not marked fast fail.  Note that above,
          * even if the request is marked fast fail, we still requeue
          * for queue congestion conditions (QUEUE_FULL or BUSY) */
-        if ((++scmd->retries) < scmd->allowed 
+        if ((++scmd->retries) <= scmd->allowed
             && !blk_noretry_request(scmd->request)) {
                 return NEEDS_RETRY;
         } else {
@@ -1433,7 +1433,7 @@ static void scsi_eh_flush_done_q(struct list_head *done_q)
                 list_del_init(&scmd->eh_entry);
                 if (scsi_device_online(scmd->device) &&
                     !blk_noretry_request(scmd->request) &&
-                    (++scmd->retries < scmd->allowed)) {
+                    (++scmd->retries <= scmd->allowed)) {
                         SCSI_LOG_ERROR_RECOVERY(3, printk("%s: flush"
                                                           " retry cmd: %p\n",
                                                           current->comm,
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 4a602853a98e..701a328f7beb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -16,6 +16,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
+#include <linux/hardirq.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_dbg.h>
@@ -1497,7 +1498,7 @@ static void scsi_kill_request(struct request *req, request_queue_t *q)
 static void scsi_softirq_done(struct request *rq)
 {
         struct scsi_cmnd *cmd = rq->completion_data;
-        unsigned long wait_for = cmd->allowed * cmd->timeout_per_command;
+        unsigned long wait_for = (cmd->allowed + 1) * cmd->timeout_per_command;
         int disposition;
 
         INIT_LIST_HEAD(&cmd->eh_entry);
@@ -2248,3 +2249,61 @@ scsi_target_unblock(struct device *dev)
                 device_for_each_child(dev, NULL, target_unblock);
 }
 EXPORT_SYMBOL_GPL(scsi_target_unblock);
+
+
+struct work_queue_work {
+        struct work_struct      work;
+        void                    (*fn)(void *);
+        void                    *data;
+};
+
+static void execute_in_process_context_work(void *data)
+{
+        void (*fn)(void *data);
+        struct work_queue_work *wqw = data;
+
+        fn = wqw->fn;
+        data = wqw->data;
+
+        kfree(wqw);
+
+        fn(data);
+}
+
+/**
+ * scsi_execute_in_process_context - reliably execute the routine with user context
+ * @fn:         the function to execute
+ * @data:       data to pass to the function
+ *
+ * Executes the function immediately if process context is available,
+ * otherwise schedules the function for delayed execution.
+ *
+ * Returns:     0 - function was executed
+ *              1 - function was scheduled for execution
+ *              <0 - error
+ */
+int scsi_execute_in_process_context(void (*fn)(void *data), void *data)
+{
+        struct work_queue_work *wqw;
+
+        if (!in_interrupt()) {
+                fn(data);
+                return 0;
+        }
+
+        wqw = kmalloc(sizeof(struct work_queue_work), GFP_ATOMIC);
+
+        if (unlikely(!wqw)) {
+                printk(KERN_ERR "Failed to allocate memory\n");
+                WARN_ON(1);
+                return -ENOMEM;
+        }
+
+        INIT_WORK(&wqw->work, execute_in_process_context_work, wqw);
+        wqw->fn = fn;
+        wqw->data = data;
+        schedule_work(&wqw->work);
+
+        return 1;
+}
+EXPORT_SYMBOL_GPL(scsi_execute_in_process_context);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 752fb5da3de4..f9ecc3dea7df 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -387,19 +387,12 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
         return found_target;
 }
 
-struct work_queue_wrapper {
-        struct work_struct      work;
-        struct scsi_target      *starget;
-};
-
-static void scsi_target_reap_work(void *data) {
-        struct work_queue_wrapper *wqw = (struct work_queue_wrapper *)data;
-        struct scsi_target *starget = wqw->starget;
+static void scsi_target_reap_usercontext(void *data)
+{
+        struct scsi_target *starget = data;
         struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
         unsigned long flags;
 
-        kfree(wqw);
-
         spin_lock_irqsave(shost->host_lock, flags);
 
         if (--starget->reap_ref == 0 && list_empty(&starget->devices)) {
@@ -428,18 +421,7 @@ static void scsi_target_reap_work(void *data) {
  */
 void scsi_target_reap(struct scsi_target *starget)
 {
-        struct work_queue_wrapper *wqw = 
-                kzalloc(sizeof(struct work_queue_wrapper), GFP_ATOMIC);
-
-        if (!wqw) {
-                starget_printk(KERN_ERR, starget,
-                               "Failed to allocate memory in scsi_reap_target()\n");
-                return;
-        }
-
-        INIT_WORK(&wqw->work, scsi_target_reap_work, wqw);
-        wqw->starget = starget;
-        schedule_work(&wqw->work);
+        scsi_execute_in_process_context(scsi_target_reap_usercontext, starget);
 }
 
 /**
@@ -770,8 +752,20 @@ static int scsi_add_lun(struct scsi_device *sdev, char *inq_result, int *bflags)
 
         transport_configure_device(&sdev->sdev_gendev);
 
-        if (sdev->host->hostt->slave_configure)
-                sdev->host->hostt->slave_configure(sdev);
+        if (sdev->host->hostt->slave_configure) {
+                int ret = sdev->host->hostt->slave_configure(sdev);
+                if (ret) {
+                        /*
+                         * if LLDD reports slave not present, don't clutter
+                         * console with alloc failure messages
+                         */
+                        if (ret != -ENXIO) {
+                                sdev_printk(KERN_ERR, sdev,
+                                        "failed to configure device\n");
+                        }
+                        return SCSI_SCAN_NO_RESPONSE;
+                }
+        }
 
         /*
          * Ok, the device is now all set up, we can
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index a77b32deaf8f..902a5def8e62 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -217,8 +217,9 @@ static void scsi_device_cls_release(struct class_device *class_dev)
         put_device(&sdev->sdev_gendev);
 }
 
-static void scsi_device_dev_release(struct device *dev)
+static void scsi_device_dev_release_usercontext(void *data)
 {
+        struct device *dev = data;
         struct scsi_device *sdev;
         struct device *parent;
         struct scsi_target *starget;
@@ -237,6 +238,7 @@ static void scsi_device_dev_release(struct device *dev)
 
         if (sdev->request_queue) {
                 sdev->request_queue->queuedata = NULL;
+                /* user context needed to free queue */
                 scsi_free_queue(sdev->request_queue);
                 /* temporary expedient, try to catch use of queue lock
                  * after free of sdev */
@@ -252,6 +254,11 @@ static void scsi_device_dev_release(struct device *dev)
                 put_device(parent);
 }
 
+static void scsi_device_dev_release(struct device *dev)
+{
+        scsi_execute_in_process_context(scsi_device_dev_release_usercontext,    dev);
+}
+
 static struct class sdev_class = {
         .name           = "scsi_device",
         .release        = scsi_device_cls_release,
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index f2c9acf11bd0..13ea64119b73 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -223,7 +223,7 @@ static void fc_rport_terminate(struct fc_rport  *rport);
  */
 #define FC_STARGET_NUM_ATTRS    3
 #define FC_RPORT_NUM_ATTRS      9
-#define FC_HOST_NUM_ATTRS       16
+#define FC_HOST_NUM_ATTRS       17
 
 struct fc_internal {
         struct scsi_transport_template t;
@@ -1498,8 +1498,7 @@ fc_remote_port_add(struct Scsi_Host *shost, int channel,
         }
 
         /* Search the bindings array */
-        if (likely((ids->roles & FC_RPORT_ROLE_FCP_TARGET) &&
-                (fc_host_tgtid_bind_type(shost) != FC_TGTID_BIND_NONE))) {
+        if (fc_host_tgtid_bind_type(shost) != FC_TGTID_BIND_NONE) {
 
                 /* search for a matching consistent binding */
 
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 59a1c9d9d3bd..71e54a64adca 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -39,10 +39,6 @@ struct iscsi_internal {
         struct iscsi_transport *iscsi_transport;
         struct list_head list;
         /*
-         * List of sessions for this transport
-         */
-        struct list_head sessions;
-        /*
          * based on transport capabilities, at register time we set these
          * bits to tell the transport class it wants attributes displayed
          * in sysfs or that it can support different iSCSI Data-Path
@@ -164,9 +160,43 @@ static struct mempool_zone *z_reply;
 #define Z_MAX_ERROR     16
 #define Z_HIWAT_ERROR   12
 
+static LIST_HEAD(sesslist);
+static DEFINE_SPINLOCK(sesslock);
 static LIST_HEAD(connlist);
 static DEFINE_SPINLOCK(connlock);
 
+static struct iscsi_cls_session *iscsi_session_lookup(uint64_t handle)
+{
+        unsigned long flags;
+        struct iscsi_cls_session *sess;
+
+        spin_lock_irqsave(&sesslock, flags);
+        list_for_each_entry(sess, &sesslist, sess_list) {
+                if (sess == iscsi_ptr(handle)) {
+                        spin_unlock_irqrestore(&sesslock, flags);
+                        return sess;
+                }
+        }
+        spin_unlock_irqrestore(&sesslock, flags);
+        return NULL;
+}
+
+static struct iscsi_cls_conn *iscsi_conn_lookup(uint64_t handle)
+{
+        unsigned long flags;
+        struct iscsi_cls_conn *conn;
+
+        spin_lock_irqsave(&connlock, flags);
+        list_for_each_entry(conn, &connlist, conn_list) {
+                if (conn == iscsi_ptr(handle)) {
+                        spin_unlock_irqrestore(&connlock, flags);
+                        return conn;
+                }
+        }
+        spin_unlock_irqrestore(&connlock, flags);
+        return NULL;
+}
+
 /*
  * The following functions can be used by LLDs that allocate
  * their own scsi_hosts or by software iscsi LLDs
@@ -365,6 +395,7 @@ iscsi_transport_create_session(struct scsi_transport_template *scsit,
 {
         struct iscsi_cls_session *session;
         struct Scsi_Host *shost;
+        unsigned long flags;
 
         shost = scsi_host_alloc(transport->host_template,
                                 hostdata_privsize(transport));
@@ -389,6 +420,9 @@ iscsi_transport_create_session(struct scsi_transport_template *scsit,
                 goto remove_host;
 
         *(unsigned long*)shost->hostdata = (unsigned long)session;
+        spin_lock_irqsave(&sesslock, flags);
+        list_add(&session->sess_list, &sesslist);
+        spin_unlock_irqrestore(&sesslock, flags);
         return shost;
 
 remove_host:
@@ -410,9 +444,13 @@ EXPORT_SYMBOL_GPL(iscsi_transport_create_session);
 int iscsi_transport_destroy_session(struct Scsi_Host *shost)
 {
         struct iscsi_cls_session *session;
+        unsigned long flags;
 
         scsi_remove_host(shost);
         session = hostdata_session(shost->hostdata);
+        spin_lock_irqsave(&sesslock, flags);
+        list_del(&session->sess_list);
+        spin_unlock_irqrestore(&sesslock, flags);
         iscsi_destroy_session(session);
         /* ref from host alloc */
         scsi_host_put(shost);
@@ -424,22 +462,6 @@ EXPORT_SYMBOL_GPL(iscsi_transport_destroy_session);
 /*
  * iscsi interface functions
  */
-static struct iscsi_cls_conn*
-iscsi_if_find_conn(uint64_t key)
-{
-        unsigned long flags;
-        struct iscsi_cls_conn *conn;
-
-        spin_lock_irqsave(&connlock, flags);
-        list_for_each_entry(conn, &connlist, conn_list)
-                if (conn->connh == key) {
-                        spin_unlock_irqrestore(&connlock, flags);
-                        return conn;
-                }
-        spin_unlock_irqrestore(&connlock, flags);
-        return NULL;
-}
-
 static struct iscsi_internal *
 iscsi_if_transport_lookup(struct iscsi_transport *tt)
 {
@@ -463,7 +485,7 @@ static inline struct list_head *skb_to_lh(struct sk_buff *skb)
 }
 
 static void*
-mempool_zone_alloc_skb(unsigned int gfp_mask, void *pool_data)
+mempool_zone_alloc_skb(gfp_t gfp_mask, void *pool_data)
 {
         struct mempool_zone *zone = pool_data;
 
@@ -504,6 +526,12 @@ mempool_zone_init(unsigned max, unsigned size, unsigned hiwat)
         if (!zp)
                 return NULL;
 
+        zp->size = size;
+        zp->hiwat = hiwat;
+        INIT_LIST_HEAD(&zp->freequeue);
+        spin_lock_init(&zp->freelock);
+        atomic_set(&zp->allocated, 0);
+
         zp->pool = mempool_create(max, mempool_zone_alloc_skb,
                                   mempool_zone_free_skb, zp);
         if (!zp->pool) {
@@ -511,13 +539,6 @@ mempool_zone_init(unsigned max, unsigned size, unsigned hiwat)
                 return NULL;
         }
 
-        zp->size = size;
-        zp->hiwat = hiwat;
-
-        INIT_LIST_HEAD(&zp->freequeue);
-        spin_lock_init(&zp->freelock);
-        atomic_set(&zp->allocated, 0);
-
         return zp;
 }
 
@@ -559,25 +580,21 @@ iscsi_unicast_skb(struct mempool_zone *zone, struct sk_buff *skb)
         return 0;
 }
 
-int iscsi_recv_pdu(iscsi_connh_t connh, struct iscsi_hdr *hdr,
+int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
                    char *data, uint32_t data_size)
 {
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
         struct iscsi_uevent *ev;
-        struct iscsi_cls_conn *conn;
         char *pdu;
         int len = NLMSG_SPACE(sizeof(*ev) + sizeof(struct iscsi_hdr) +
                               data_size);
 
-        conn = iscsi_if_find_conn(connh);
-        BUG_ON(!conn);
-
         mempool_zone_complete(conn->z_pdu);
 
         skb = mempool_zone_get_skb(conn->z_pdu);
         if (!skb) {
-                iscsi_conn_error(connh, ISCSI_ERR_CONN_FAILED);
+                iscsi_conn_error(conn, ISCSI_ERR_CONN_FAILED);
                 dev_printk(KERN_ERR, &conn->dev, "iscsi: can not deliver "
                            "control PDU: OOM\n");
                 return -ENOMEM;
@@ -590,7 +607,7 @@ int iscsi_recv_pdu(iscsi_connh_t connh, struct iscsi_hdr *hdr,
         ev->type = ISCSI_KEVENT_RECV_PDU;
         if (atomic_read(&conn->z_pdu->allocated) >= conn->z_pdu->hiwat)
                 ev->iferror = -ENOMEM;
-        ev->r.recv_req.conn_handle = connh;
+        ev->r.recv_req.conn_handle = iscsi_handle(conn);
         pdu = (char*)ev + sizeof(*ev);
         memcpy(pdu, hdr, sizeof(struct iscsi_hdr));
         memcpy(pdu + sizeof(struct iscsi_hdr), data, data_size);
@@ -599,17 +616,13 @@ int iscsi_recv_pdu(iscsi_connh_t connh, struct iscsi_hdr *hdr,
 }
 EXPORT_SYMBOL_GPL(iscsi_recv_pdu);
 
-void iscsi_conn_error(iscsi_connh_t connh, enum iscsi_err error)
+void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error)
 {
         struct nlmsghdr *nlh;
         struct sk_buff  *skb;
         struct iscsi_uevent *ev;
-        struct iscsi_cls_conn *conn;
         int len = NLMSG_SPACE(sizeof(*ev));
 
-        conn = iscsi_if_find_conn(connh);
-        BUG_ON(!conn);
-
         mempool_zone_complete(conn->z_error);
 
         skb = mempool_zone_get_skb(conn->z_error);
@@ -626,7 +639,7 @@ void iscsi_conn_error(iscsi_connh_t connh, enum iscsi_err error)
         if (atomic_read(&conn->z_error->allocated) >= conn->z_error->hiwat)
                 ev->iferror = -ENOMEM;
         ev->r.connerror.error = error;
-        ev->r.connerror.conn_handle = connh;
+        ev->r.connerror.conn_handle = iscsi_handle(conn);
 
         iscsi_unicast_skb(conn->z_error, skb);
 
@@ -662,8 +675,7 @@ iscsi_if_send_reply(int pid, int seq, int type, int done, int multi,
 }
 
 static int
-iscsi_if_get_stats(struct iscsi_transport *transport, struct sk_buff *skb,
-                   struct nlmsghdr *nlh)
+iscsi_if_get_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh)
 {
         struct iscsi_uevent *ev = NLMSG_DATA(nlh);
         struct iscsi_stats *stats;
@@ -677,7 +689,7 @@ iscsi_if_get_stats(struct iscsi_transport *transport, struct sk_buff *skb,
                               ISCSI_STATS_CUSTOM_MAX);
         int err = 0;
 
-        conn = iscsi_if_find_conn(ev->u.get_stats.conn_handle);
+        conn = iscsi_conn_lookup(ev->u.get_stats.conn_handle);
         if (!conn)
                 return -EEXIST;
 
@@ -707,14 +719,14 @@ iscsi_if_get_stats(struct iscsi_transport *transport, struct sk_buff *skb,
                         ((char*)evstat + sizeof(*evstat));
                 memset(stats, 0, sizeof(*stats));
 
-                transport->get_stats(ev->u.get_stats.conn_handle, stats);
+                transport->get_stats(conn, stats);
                 actual_size = NLMSG_SPACE(sizeof(struct iscsi_uevent) +
                                           sizeof(struct iscsi_stats) +
                                           sizeof(struct iscsi_stats_custom) *
                                           stats->custom_length);
                 actual_size -= sizeof(*nlhstat);
                 actual_size = NLMSG_LENGTH(actual_size);
-                skb_trim(skb, NLMSG_ALIGN(actual_size));
+                skb_trim(skbstat, NLMSG_ALIGN(actual_size));
                 nlhstat->nlmsg_len = actual_size;
 
                 err = iscsi_unicast_skb(conn->z_pdu, skbstat);
@@ -727,58 +739,34 @@ static int
 iscsi_if_create_session(struct iscsi_internal *priv, struct iscsi_uevent *ev)
 {
         struct iscsi_transport *transport = priv->iscsi_transport;
-        struct Scsi_Host *shost;
-
-        if (!transport->create_session)
-                return -EINVAL;
+        struct iscsi_cls_session *session;
+        uint32_t sid;
 
-        shost = transport->create_session(&priv->t,
-                                          ev->u.c_session.initial_cmdsn);
-        if (!shost)
+        session = transport->create_session(&priv->t,
+                                            ev->u.c_session.initial_cmdsn,
+                                            &sid);
+        if (!session)
                 return -ENOMEM;
 
-        ev->r.c_session_ret.session_handle = iscsi_handle(iscsi_hostdata(shost->hostdata));
-        ev->r.c_session_ret.sid = shost->host_no;
+        ev->r.c_session_ret.session_handle = iscsi_handle(session);
+        ev->r.c_session_ret.sid = sid;
         return 0;
 }
 
 static int
-iscsi_if_destroy_session(struct iscsi_internal *priv, struct iscsi_uevent *ev)
+iscsi_if_create_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 {
-        struct iscsi_transport *transport = priv->iscsi_transport;
-
-        struct Scsi_Host *shost;
-
-        if (!transport->destroy_session)
-                return -EINVAL;
-
-        shost = scsi_host_lookup(ev->u.d_session.sid);
-        if (shost == ERR_PTR(-ENXIO))
-                return -EEXIST;
-
-        if (transport->destroy_session)
-                transport->destroy_session(shost);
-        /* ref from host lookup */
-        scsi_host_put(shost);
-        return 0;
-}
-
-static int
-iscsi_if_create_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev){
-        struct Scsi_Host *shost;
         struct iscsi_cls_conn *conn;
+        struct iscsi_cls_session *session;
         unsigned long flags;
 
-        if (!transport->create_conn)
+        session = iscsi_session_lookup(ev->u.c_conn.session_handle);
+        if (!session)
                 return -EINVAL;
 
-        shost = scsi_host_lookup(ev->u.c_conn.sid);
-        if (shost == ERR_PTR(-ENXIO))
-                return -EEXIST;
-
-        conn = transport->create_conn(shost, ev->u.c_conn.cid);
+        conn = transport->create_conn(session, ev->u.c_conn.cid);
         if (!conn)
-                goto release_ref;
+                return -ENOMEM;
 
         conn->z_pdu = mempool_zone_init(Z_MAX_PDU,
                         NLMSG_SPACE(sizeof(struct iscsi_uevent) +
@@ -800,14 +788,13 @@ iscsi_if_create_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev)
                 goto free_pdu_pool;
         }
 
-        ev->r.handle = conn->connh = iscsi_handle(conn->dd_data);
+        ev->r.handle = iscsi_handle(conn);
 
         spin_lock_irqsave(&connlock, flags);
         list_add(&conn->conn_list, &connlist);
         conn->active = 1;
         spin_unlock_irqrestore(&connlock, flags);
 
-        scsi_host_put(shost);
         return 0;
 
 free_pdu_pool:
@@ -815,8 +802,6 @@ free_pdu_pool:
 destroy_conn:
         if (transport->destroy_conn)
                 transport->destroy_conn(conn->dd_data);
-release_ref:
-        scsi_host_put(shost);
         return -ENOMEM;
 }
 
@@ -827,13 +812,9 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev
         struct iscsi_cls_conn *conn;
         struct mempool_zone *z_error, *z_pdu;
 
-        conn = iscsi_if_find_conn(ev->u.d_conn.conn_handle);
+        conn = iscsi_conn_lookup(ev->u.d_conn.conn_handle);
         if (!conn)
-                return -EEXIST;
-
-        if (!transport->destroy_conn)
                 return -EINVAL;
-
         spin_lock_irqsave(&connlock, flags);
         conn->active = 0;
         list_del(&conn->conn_list);
@@ -858,23 +839,27 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         struct iscsi_uevent *ev = NLMSG_DATA(nlh);
         struct iscsi_transport *transport = NULL;
         struct iscsi_internal *priv;
-
-        if (NETLINK_CREDS(skb)->uid)
-                return -EPERM;
+        struct iscsi_cls_session *session;
+        struct iscsi_cls_conn *conn;
 
         priv = iscsi_if_transport_lookup(iscsi_ptr(ev->transport_handle));
         if (!priv)
                 return -EINVAL;
         transport = priv->iscsi_transport;
 
-        daemon_pid = NETLINK_CREDS(skb)->pid;
+        if (!try_module_get(transport->owner))
+                return -EINVAL;
 
         switch (nlh->nlmsg_type) {
         case ISCSI_UEVENT_CREATE_SESSION:
                 err = iscsi_if_create_session(priv, ev);
                 break;
         case ISCSI_UEVENT_DESTROY_SESSION:
-                err = iscsi_if_destroy_session(priv, ev);
+                session = iscsi_session_lookup(ev->u.d_session.session_handle);
+                if (session)
+                        transport->destroy_session(session);
+                else
+                        err = -EINVAL;
                 break;
         case ISCSI_UEVENT_CREATE_CONN:
                 err = iscsi_if_create_conn(transport, ev);
@@ -883,56 +868,64 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                 err = iscsi_if_destroy_conn(transport, ev);
                 break;
         case ISCSI_UEVENT_BIND_CONN:
-                if (!iscsi_if_find_conn(ev->u.b_conn.conn_handle))
-                        return -EEXIST;
-                ev->r.retcode = transport->bind_conn(
-                        ev->u.b_conn.session_handle,
-                        ev->u.b_conn.conn_handle,
-                        ev->u.b_conn.transport_fd,
-                        ev->u.b_conn.is_leading);
+                session = iscsi_session_lookup(ev->u.b_conn.session_handle);
+                conn = iscsi_conn_lookup(ev->u.b_conn.conn_handle);
+
+                if (session && conn)
+                        ev->r.retcode = transport->bind_conn(session, conn,
+                                        ev->u.b_conn.transport_fd,
+                                        ev->u.b_conn.is_leading);
+                else
+                        err = -EINVAL;
                 break;
         case ISCSI_UEVENT_SET_PARAM:
-                if (!iscsi_if_find_conn(ev->u.set_param.conn_handle))
-                        return -EEXIST;
-                ev->r.retcode = transport->set_param(
-                        ev->u.set_param.conn_handle,
-                        ev->u.set_param.param, ev->u.set_param.value);
+                conn = iscsi_conn_lookup(ev->u.set_param.conn_handle);
+                if (conn)
+                        ev->r.retcode = transport->set_param(conn,
+                                ev->u.set_param.param, ev->u.set_param.value);
+                else
+                        err = -EINVAL;
                 break;
         case ISCSI_UEVENT_START_CONN:
-                if (!iscsi_if_find_conn(ev->u.start_conn.conn_handle))
-                        return -EEXIST;
-                ev->r.retcode = transport->start_conn(
-                        ev->u.start_conn.conn_handle);
+                conn = iscsi_conn_lookup(ev->u.start_conn.conn_handle);
+                if (conn)
+                        ev->r.retcode = transport->start_conn(conn);
+                else
+                        err = -EINVAL;
+
                 break;
         case ISCSI_UEVENT_STOP_CONN:
-                if (!iscsi_if_find_conn(ev->u.stop_conn.conn_handle))
-                        return -EEXIST;
-                transport->stop_conn(ev->u.stop_conn.conn_handle,
-                        ev->u.stop_conn.flag);
+                conn = iscsi_conn_lookup(ev->u.stop_conn.conn_handle);
+                if (conn)
+                        transport->stop_conn(conn, ev->u.stop_conn.flag);
+                else
+                        err = -EINVAL;
                 break;
         case ISCSI_UEVENT_SEND_PDU:
-                if (!iscsi_if_find_conn(ev->u.send_pdu.conn_handle))
-                        return -EEXIST;
-                ev->r.retcode = transport->send_pdu(
-                       ev->u.send_pdu.conn_handle,
-                       (struct iscsi_hdr*)((char*)ev + sizeof(*ev)),
-                       (char*)ev + sizeof(*ev) + ev->u.send_pdu.hdr_size,
-                        ev->u.send_pdu.data_size);
+                conn = iscsi_conn_lookup(ev->u.send_pdu.conn_handle);
+                if (conn)
+                        ev->r.retcode = transport->send_pdu(conn,
+                                (struct iscsi_hdr*)((char*)ev + sizeof(*ev)),
+                                (char*)ev + sizeof(*ev) + ev->u.send_pdu.hdr_size,
+                                ev->u.send_pdu.data_size);
+                else
+                        err = -EINVAL;
                 break;
         case ISCSI_UEVENT_GET_STATS:
-                err = iscsi_if_get_stats(transport, skb, nlh);
+                err = iscsi_if_get_stats(transport, nlh);
                 break;
         default:
                 err = -EINVAL;
                 break;
         }
 
+        module_put(transport->owner);
         return err;
 }
 
 /* Get message from skb (based on rtnetlink_rcv_skb).  Each message is
  * processed by iscsi_if_recv_msg.  Malformed skbs with wrong length are
- * discarded silently.  */
+ * or invalid creds discarded silently.  */
 static void
 iscsi_if_rx(struct sock *sk, int len)
 {
@@ -940,6 +933,12 @@ iscsi_if_rx(struct sock *sk, int len)
 
         mutex_lock(&rx_queue_mutex);
         while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+                if (NETLINK_CREDS(skb)->uid) {
+                        skb_pull(skb, skb->len);
+                        goto free_skb;
+                }
+                daemon_pid = NETLINK_CREDS(skb)->pid;
+
                 while (skb->len >= NLMSG_SPACE(0)) {
                         int err;
                         uint32_t rlen;
@@ -951,10 +950,12 @@ iscsi_if_rx(struct sock *sk, int len)
                             skb->len < nlh->nlmsg_len) {
                                 break;
                         }
+
                         ev = NLMSG_DATA(nlh);
                         rlen = NLMSG_ALIGN(nlh->nlmsg_len);
                         if (rlen > skb->len)
                                 rlen = skb->len;
+
                         err = iscsi_if_recv_msg(skb, nlh);
                         if (err) {
                                 ev->type = ISCSI_KEVENT_IF_ERROR;
@@ -978,6 +979,7 @@ iscsi_if_rx(struct sock *sk, int len)
                         } while (err < 0 && err != -ECONNREFUSED);
                         skb_pull(skb, rlen);
                 }
+free_skb:
                 kfree_skb(skb);
         }
         mutex_unlock(&rx_queue_mutex);
@@ -997,7 +999,7 @@ show_conn_int_param_##param(struct class_device *cdev, char *buf)	\
         struct iscsi_cls_conn *conn = iscsi_cdev_to_conn(cdev);         \
         struct iscsi_transport *t = conn->transport;                    \
                                                                         \
-        t->get_conn_param(conn->dd_data, param, &value);                \
+        t->get_conn_param(conn, param, &value);                         \
         return snprintf(buf, 20, format"\n", value);                    \
 }
 
@@ -1024,10 +1026,9 @@ show_session_int_param_##param(struct class_device *cdev, char *buf)	\
 {                                                                       \
         uint32_t value = 0;                                             \
         struct iscsi_cls_session *session = iscsi_cdev_to_session(cdev);        \
-        struct Scsi_Host *shost = iscsi_session_to_shost(session);      \
         struct iscsi_transport *t = session->transport;                 \
                                                                         \
-        t->get_session_param(shost, param, &value);                     \
+        t->get_session_param(session, param, &value);                   \
         return snprintf(buf, 20, format"\n", value);                    \
 }
 
@@ -1121,7 +1122,6 @@ iscsi_register_transport(struct iscsi_transport *tt)
                 return NULL;
         memset(priv, 0, sizeof(*priv));
         INIT_LIST_HEAD(&priv->list);
-        INIT_LIST_HEAD(&priv->sessions);
         priv->iscsi_transport = tt;
 
         priv->cdev.class = &iscsi_transport_class;
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 930db398d107..9d9872347f56 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -89,6 +89,11 @@
 #define SD_MAX_RETRIES          5
 #define SD_PASSTHROUGH_RETRIES  1
 
+/*
+ * Size of the initial data buffer for mode and read capacity data
+ */
+#define SD_BUF_SIZE             512
+
 static void scsi_disk_release(struct kref *kref);
 
 struct scsi_disk {
@@ -1239,7 +1244,7 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage,
 
 /*
  * read write protect setting, if possible - called only in sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
  */
 static void
 sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
@@ -1297,7 +1302,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
 
 /*
  * sd_read_cache_type - called only from sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
  */
 static void
 sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
@@ -1342,6 +1347,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
 
         /* Take headers and block descriptors into account */
         len += data.header_length + data.block_descriptor_length;
+        if (len > SD_BUF_SIZE)
+                goto bad_sense;
 
         /* Get the data */
         res = sd_do_mode_sense(sdp, dbd, modepage, buffer, len, &data, &sshdr);
@@ -1354,6 +1361,12 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
                 int ct = 0;
                 int offset = data.header_length + data.block_descriptor_length;
 
+                if (offset >= SD_BUF_SIZE - 2) {
+                        printk(KERN_ERR "%s: malformed MODE SENSE response",
+                                diskname);
+                        goto defaults;
+                }
+
                 if ((buffer[offset] & 0x3f) != modepage) {
                         printk(KERN_ERR "%s: got wrong page\n", diskname);
                         goto defaults;
@@ -1398,6 +1411,7 @@ defaults:
                diskname);
         sdkp->WCE = 0;
         sdkp->RCD = 0;
+        sdkp->DPOFUA = 0;
 }
 
 /**
@@ -1421,7 +1435,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
         if (!scsi_device_online(sdp))
                 goto out;
 
-        buffer = kmalloc(512, GFP_KERNEL | __GFP_DMA);
+        buffer = kmalloc(SD_BUF_SIZE, GFP_KERNEL | __GFP_DMA);
         if (!buffer) {
                 printk(KERN_WARNING "(sd_revalidate_disk:) Memory allocation "
                        "failure.\n");
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 7d0700091f3d..5a0a19322d01 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1679,7 +1679,7 @@ static int
 sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp, int tablesize)
 {
         int sg_bufflen = tablesize * sizeof(struct scatterlist);
-        unsigned int gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
+        gfp_t gfp_flags = GFP_ATOMIC | __GFP_NOWARN;
 
         /*
          * TODO: test without low_dma, we should not need it since
@@ -2162,7 +2162,7 @@ sg_link_reserve(Sg_fd * sfp, Sg_request * srp, int size)
 
         srp->res_used = 1;
         SCSI_LOG_TIMEOUT(4, printk("sg_link_reserve: size=%d\n", size));
-        rem = size = (size + 1) & (~1); /* round to even for aha1542 */
+        rem = size;
 
         for (k = 0; k < rsv_schp->k_use_sg; ++k, ++sg) {
                 num = sg->length;
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index 5d02ff4db6cc..b65462f76484 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -192,7 +192,7 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
         SDev = cd->device;
 
         if (!sense) {
-                sense = kmalloc(sizeof(*sense), GFP_KERNEL);
+                sense = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_KERNEL);
                 if (!sense) {
                         err = -ENOMEM;
                         goto out;
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
index 8260f040d39c..2627000ca653 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
@@ -919,6 +919,8 @@ static int sym_prepare_setting(struct Scsi_Host *shost, struct sym_hcb *np, stru
 
                 tp->usrflags |= (SYM_DISC_ENABLED | SYM_TAGS_ENABLED);
                 tp->usrtags = SYM_SETUP_MAX_TAG;
+                tp->usr_width = np->maxwide;
+                tp->usr_period = 9;
 
                 sym_nvram_setup_target(tp, i, nvram);
 
@@ -3588,7 +3590,7 @@ static int sym_evaluate_dp(struct sym_hcb *np, struct sym_ccb *cp, u32 scr, int
 
         if (pm) {
                 dp_scr  = scr_to_cpu(pm->ret);
-                dp_ofs -= scr_to_cpu(pm->sg.size);
+                dp_ofs -= scr_to_cpu(pm->sg.size) & 0x00ffffff;
         }
 
         /*
diff --git a/drivers/serial/21285.c b/drivers/serial/21285.c
index 7aef7518b0d1..8c5c276c5577 100644
--- a/drivers/serial/21285.c
+++ b/drivers/serial/21285.c
@@ -362,7 +362,7 @@ static struct uart_ops serial21285_ops = {
 
 static struct uart_port serial21285_port = {
         .mapbase        = 0x42000160,
-        .iotype         = SERIAL_IO_MEM,
+        .iotype         = UPIO_MEM,
         .irq            = NO_IRQ,
         .fifosize       = 16,
         .ops            = &serial21285_ops,
diff --git a/drivers/serial/68328serial.c b/drivers/serial/68328serial.c
index 8cbf0fc5a225..7f0f35a05dca 100644
--- a/drivers/serial/68328serial.c
+++ b/drivers/serial/68328serial.c
@@ -332,7 +332,7 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
                  * Make sure that we do not overflow the buffer
                  */
                 if (tty_request_buffer_room(tty, 1) == 0) {
-                        schedule_work(&tty->flip.work);
+                        tty_schedule_flip(tty);
                         return;
                 }
 
@@ -353,7 +353,7 @@ static _INLINE_ void receive_chars(struct m68k_serial *info, struct pt_regs *reg
         } while((rx = uart->urx.w) & URX_DATA_READY);
 #endif
 
-        schedule_work(&tty->flip.work);
+        tty_schedule_flip(tty);
 
 clear_and_exit:
         return;
diff --git a/drivers/serial/68360serial.c b/drivers/serial/68360serial.c
index 60f5a5dc17f1..9843ae3d420e 100644
--- a/drivers/serial/68360serial.c
+++ b/drivers/serial/68360serial.c
@@ -509,7 +509,7 @@ static _INLINE_ void receive_chars(ser_info_t *info)
 
         info->rx_cur = (QUICC_BD *)bdp;
 
-        schedule_work(&tty->flip.work);
+        tty_schedule_flip(tty);
 }
 
 static _INLINE_ void receive_break(ser_info_t *info)
@@ -521,7 +521,7 @@ static _INLINE_ void receive_break(ser_info_t *info)
          * the break.  If not, we exit now, losing the break.  FIXME
          */
         tty_insert_flip_char(tty, 0, TTY_BREAK);
-        schedule_work(&tty->flip.work);
+        tty_schedule_flip(tty);
 }
 
 static _INLINE_ void transmit_chars(ser_info_t *info)
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 179c1f065e60..7aca22c9976d 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2198,7 +2198,7 @@ serial8250_console_write(struct console *co, const char *s, unsigned int count)
         touch_nmi_watchdog();
 
         /*
-         *      First save the UER then disable the interrupts
+         *      First save the IER then disable the interrupts
          */
         ier = serial_in(up, UART_IER);
 
@@ -2229,6 +2229,7 @@ serial8250_console_write(struct console *co, const char *s, unsigned int count)
          *      and restore the IER
          */
         wait_for_xmitr(up, BOTH_EMPTY);
+        up->ier |= UART_IER_THRI;
         serial_out(up, UART_IER, ier | UART_IER_THRI);
 }
 
@@ -2325,6 +2326,12 @@ static struct uart_driver serial8250_reg = {
         .cons                   = SERIAL8250_CONSOLE,
 };
 
+/*
+ * early_serial_setup - early registration for 8250 ports
+ *
+ * Setup an 8250 port structure prior to console initialisation.  Use
+ * after console initialisation will cause undefined behaviour.
+ */
 int __init early_serial_setup(struct uart_port *port)
 {
         if (port->line >= ARRAY_SIZE(serial8250_ports))
diff --git a/drivers/serial/8250_au1x00.c b/drivers/serial/8250_au1x00.c
index 06ae8fbcc947..8d8d7a70d03e 100644
--- a/drivers/serial/8250_au1x00.c
+++ b/drivers/serial/8250_au1x00.c
@@ -56,7 +56,6 @@ static struct plat_serial8250_port au1x00_data[] = {
 #elif defined(CONFIG_SOC_AU1550)
         PORT(UART0_ADDR, AU1550_UART0_INT),
         PORT(UART1_ADDR, AU1550_UART1_INT),
-        PORT(UART2_ADDR, AU1550_UART2_INT),
         PORT(UART3_ADDR, AU1550_UART3_INT),
 #elif defined(CONFIG_SOC_AU1200)
         PORT(UART0_ADDR, AU1200_UART0_INT),
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 2a912153321e..94886c000d2a 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -439,6 +439,20 @@ static int pci_siig_init(struct pci_dev *dev)
         return -ENODEV;
 }
 
+static int pci_siig_setup(struct serial_private *priv,
+                          struct pciserial_board *board,
+                          struct uart_port *port, int idx)
+{
+        unsigned int bar = FL_GET_BASE(board->flags) + idx, offset = 0;
+
+        if (idx > 3) {
+                bar = 4;
+                offset = (idx - 4) * 8;
+        }
+
+        return setup_port(priv, port, bar, offset, 0);
+}
+
 /*
  * Timedia has an explosion of boards, and to avoid the PCI table from
  * growing *huge*, we use this function to collapse some 70 entries
@@ -748,7 +762,7 @@ static struct pci_serial_quirk pci_serial_quirks[] = {
                 .subvendor      = PCI_ANY_ID,
                 .subdevice      = PCI_ANY_ID,
                 .init           = pci_siig_init,
-                .setup          = pci_default_setup,
+                .setup          = pci_siig_setup,
         },
         /*
          * Titan cards
@@ -1868,6 +1882,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_SUBVENDOR_ID_CONNECT_TECH,
                 PCI_SUBDEVICE_ID_CONNECT_TECH_TITAN_4, 0, 0,
                 pbn_b0_4_1843200 },
+        {       PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI954,
+                PCI_VENDOR_ID_AFAVLAB,
+                PCI_SUBDEVICE_ID_AFAVLAB_P061, 0, 0,
+                pbn_b0_4_1152000 },
         {       PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152,
                 PCI_SUBVENDOR_ID_CONNECT_TECH,
                 PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_2_232, 0, 0,
@@ -2141,6 +2159,15 @@ static struct pci_device_id serial_pci_tbl[] = {
         {       PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_4S_20x_850,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
                 pbn_b0_bt_4_921600 },
+        {       PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_8S_20x_550,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_b0_bt_8_921600 },
+        {       PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_8S_20x_650,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_b0_bt_8_921600 },
+        {       PCI_VENDOR_ID_SIIG, PCI_DEVICE_ID_SIIG_8S_20x_850,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_b0_bt_8_921600 },
 
         /*
          * Computone devices submitted by Doug McNash dmcnash@computone.com
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index ee4265d7a8c9..b3c561abe3f6 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -98,6 +98,7 @@ config SERIAL_8250_NR_UARTS
 config SERIAL_8250_RUNTIME_UARTS
         int "Number of 8250/16550 serial ports to register at runtime"
         depends on SERIAL_8250
+        range 0 SERIAL_8250_NR_UARTS
         default "4"
         help
           Set this to the maximum number of serial ports you want
@@ -901,8 +902,8 @@ config SERIAL_JSM
           something like this to connect more than two modems to your Linux
           box, for instance in order to become a dial-in server. This driver
           supports PCI boards only.
-          If you have a card like this, say Y here and read the file
-          <file:Documentation/jsm.txt>.
+
+          If you have a card like this, say Y here, otherwise say N.
 
           To compile this driver as a module, choose M here: the
           module will be called jsm.
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 429de2723a1c..321a3b3a5728 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -561,7 +561,7 @@ static struct uart_amba_port amba_ports[UART_NR] = {
                 .port   = {
                         .membase        = (void *)IO_ADDRESS(INTEGRATOR_UART0_BASE),
                         .mapbase        = INTEGRATOR_UART0_BASE,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = IRQ_UARTINT0,
                         .uartclk        = 14745600,
                         .fifosize       = 16,
@@ -576,7 +576,7 @@ static struct uart_amba_port amba_ports[UART_NR] = {
                 .port   = {
                         .membase        = (void *)IO_ADDRESS(INTEGRATOR_UART1_BASE),
                         .mapbase        = INTEGRATOR_UART1_BASE,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = IRQ_UARTINT1,
                         .uartclk        = 14745600,
                         .fifosize       = 16,
diff --git a/drivers/serial/au1x00_uart.c b/drivers/serial/au1x00_uart.c
index ceb5d7f37bbd..344022fe53ef 100644
--- a/drivers/serial/au1x00_uart.c
+++ b/drivers/serial/au1x00_uart.c
@@ -892,7 +892,7 @@ serial8250_request_std_resource(struct uart_8250_port *up, struct resource **res
         int ret = 0;
 
         switch (up->port.iotype) {
-        case SERIAL_IO_MEM:
+        case UPIO_MEM:
                 if (up->port.mapbase) {
                         *res = request_mem_region(up->port.mapbase, size, "serial");
                         if (!*res)
@@ -900,8 +900,8 @@ serial8250_request_std_resource(struct uart_8250_port *up, struct resource **res
                 }
                 break;
 
-        case SERIAL_IO_HUB6:
-        case SERIAL_IO_PORT:
+        case UPIO_HUB6:
+        case UPIO_PORT:
                 *res = request_region(up->port.iobase, size, "serial");
                 if (!*res)
                         ret = -EBUSY;
@@ -919,7 +919,7 @@ static void serial8250_release_port(struct uart_port *port)
         size <<= up->port.regshift;
 
         switch (up->port.iotype) {
-        case SERIAL_IO_MEM:
+        case UPIO_MEM:
                 if (up->port.mapbase) {
                         /*
                          * Unmap the area.
@@ -935,8 +935,8 @@ static void serial8250_release_port(struct uart_port *port)
                 }
                 break;
 
-        case SERIAL_IO_HUB6:
-        case SERIAL_IO_PORT:
+        case UPIO_HUB6:
+        case UPIO_PORT:
                 start = up->port.iobase;
 
                 if (size)
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 16af5626c243..b7bf4c698a47 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -252,12 +252,9 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 /* If we have not enough room in tty flip buffer, then we try
                  * later, which will be the next rx-interrupt or a timeout
                  */
-                if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE) {
-                        tty->flip.work.func((void *)tty);
-                        if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE) {
-                                printk(KERN_WARNING "TTY_DONT_FLIP set\n");
-                                return;
-                        }
+                if(tty_buffer_request_room(tty, i) < i) {
+                        printk(KERN_WARNING "No room in flip buffer\n");
+                        return;
                 }
 
                 /* get pointer */
@@ -276,9 +273,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                                 continue;
 
                       error_return:
-                        *tty->flip.char_buf_ptr++ = ch;
-                        *tty->flip.flag_buf_ptr++ = flg;
-                        tty->flip.count++;
+                        tty_insert_flip_char(tty, ch, flg);
 
                 }               /* End while (i--) */
 
@@ -908,7 +903,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .port = {
                         .irq            = SMC1_IRQ,
                         .ops            = &cpm_uart_pops,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .lock           = SPIN_LOCK_UNLOCKED,
                 },
                 .flags = FLAG_SMC,
@@ -922,7 +917,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .port = {
                         .irq            = SMC2_IRQ,
                         .ops            = &cpm_uart_pops,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .lock           = SPIN_LOCK_UNLOCKED,
                 },
                 .flags = FLAG_SMC,
@@ -939,7 +934,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .port = {
                         .irq            = SCC1_IRQ,
                         .ops            = &cpm_uart_pops,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .lock           = SPIN_LOCK_UNLOCKED,
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
@@ -953,7 +948,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .port = {
                         .irq            = SCC2_IRQ,
                         .ops            = &cpm_uart_pops,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .lock           = SPIN_LOCK_UNLOCKED,
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
@@ -967,7 +962,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .port = {
                         .irq            = SCC3_IRQ,
                         .ops            = &cpm_uart_pops,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .lock           = SPIN_LOCK_UNLOCKED,
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
@@ -981,7 +976,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .port = {
                         .irq            = SCC4_IRQ,
                         .ops            = &cpm_uart_pops,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .lock           = SPIN_LOCK_UNLOCKED,
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
diff --git a/drivers/serial/dz.c b/drivers/serial/dz.c
index a64ba26a94e8..ba5541de673b 100644
--- a/drivers/serial/dz.c
+++ b/drivers/serial/dz.c
@@ -262,6 +262,7 @@ static inline void dz_receive_chars(struct dz_port *dport)
                 }
                 tty_insert_flip_char(tty, ch, flag);
               ignore_char:
+                        ;
         } while (status & DZ_DVAL);
 
         if (tty)
@@ -650,7 +651,7 @@ static void __init dz_init_ports(void)
         for (i = 0, dport = dz_ports; i < DZ_NB_PORT; i++, dport++) {
                 spin_lock_init(&dport->port.lock);
                 dport->port.membase     = (char *) base;
-                dport->port.iotype      = SERIAL_IO_PORT;
+                dport->port.iotype      = UPIO_PORT;
                 dport->port.irq         = dec_interrupt[DEC_IRQ_DZ11];
                 dport->port.line        = i;
                 dport->port.fifosize    = 1;
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 858048efe1ed..4d53fb5ca87b 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -668,7 +668,7 @@ static struct imx_port imx_ports[] = {
         .rtsirq = UART1_MINT_RTS,
         .port   = {
                 .type           = PORT_IMX,
-                .iotype         = SERIAL_IO_MEM,
+                .iotype         = UPIO_MEM,
                 .membase        = (void *)IMX_UART1_BASE,
                 .mapbase        = IMX_UART1_BASE, /* FIXME */
                 .irq            = UART1_MINT_RX,
@@ -684,7 +684,7 @@ static struct imx_port imx_ports[] = {
         .rtsirq = UART2_MINT_RTS,
         .port   = {
                 .type           = PORT_IMX,
-                .iotype         = SERIAL_IO_MEM,
+                .iotype         = UPIO_MEM,
                 .membase        = (void *)IMX_UART2_BASE,
                 .mapbase        = IMX_UART2_BASE, /* FIXME */
                 .irq            = UART2_MINT_RX,
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 1d85533d46d2..a37579ce6d76 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -1717,11 +1717,9 @@ ioc4_change_speed(struct uart_port *the_port,
         }
 
         if (cflag & CRTSCTS) {
-                info->flags |= ASYNC_CTS_FLOW;
                 port->ip_sscr |= IOC4_SSCR_HFC_EN;
         }
         else {
-                info->flags &= ~ASYNC_CTS_FLOW;
                 port->ip_sscr &= ~IOC4_SSCR_HFC_EN;
         }
         writel(port->ip_sscr, &port->ip_serial_regs->sscr);
@@ -1760,18 +1758,6 @@ static inline int ic4_startup_local(struct uart_port *the_port)
 
         info = the_port->info;
 
-        if (info->tty) {
-                set_bit(TTY_IO_ERROR, &info->tty->flags);
-                clear_bit(TTY_IO_ERROR, &info->tty->flags);
-                if ((info->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
-                        info->tty->alt_speed = 57600;
-                if ((info->flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
-                        info->tty->alt_speed = 115200;
-                if ((info->flags & ASYNC_SPD_MASK) == ASYNC_SPD_SHI)
-                        info->tty->alt_speed = 230400;
-                if ((info->flags & ASYNC_SPD_MASK) == ASYNC_SPD_WARP)
-                        info->tty->alt_speed = 460800;
-        }
         local_open(port);
 
         /* set the speed of the serial port */
@@ -2315,7 +2301,6 @@ static void receive_chars(struct uart_port *the_port)
         int read_count, request_count = IOC4_MAX_CHARS;
         struct uart_icount *icount;
         struct uart_info *info = the_port->info;
-        int flip = 0;
         unsigned long pflags;
 
         /* Make sure all the pointers are "good" ones */
@@ -2327,7 +2312,7 @@ static void receive_chars(struct uart_port *the_port)
         spin_lock_irqsave(&the_port->lock, pflags);
         tty = info->tty;
 
-        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS - 2);
+        request_count = tty_buffer_request_room(tty, IOC4_MAX_CHARS);
 
         if (request_count > 0) {
                 icount = &the_port->icount;
@@ -2340,8 +2325,7 @@ static void receive_chars(struct uart_port *the_port)
 
         spin_unlock_irqrestore(&the_port->lock, pflags);
 
-        if (flip)
-                tty_flip_buffer_push(tty);
+        tty_flip_buffer_push(tty);
 }
 
 /**
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index 66f117d15065..193722d680cf 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -215,7 +215,7 @@ static void __load_zsregs(struct zilog_channel *channel, unsigned char *regs)
         /* Lower and upper byte of baud rate generator divisor.  */
         write_zsreg(channel, R12, regs[R12]);
         write_zsreg(channel, R13, regs[R13]);
-        
+
         /* Now rewrite R14, with BRENAB (if set).  */
         write_zsreg(channel, R14, regs[R14]);
 
@@ -420,10 +420,8 @@ static void ip22zilog_transmit_chars(struct uart_ip22zilog_port *up,
         if (up->port.info == NULL)
                 goto ack_tx_int;
         xmit = &up->port.info->xmit;
-        if (uart_circ_empty(xmit)) {
-                uart_write_wakeup(&up->port);
+        if (uart_circ_empty(xmit))
                 goto ack_tx_int;
-        }
         if (uart_tx_stopped(&up->port))
                 goto ack_tx_int;
 
@@ -571,7 +569,7 @@ static void ip22zilog_set_mctrl(struct uart_port *port, unsigned int mctrl)
         else
                 clear_bits |= DTR;
 
-        /* NOTE: Not subject to 'transmitter active' rule.  */ 
+        /* NOTE: Not subject to 'transmitter active' rule.  */
         up->curregs[R5] |= set_bits;
         up->curregs[R5] &= ~clear_bits;
         write_zsreg(channel, R5, up->curregs[R5]);
@@ -654,7 +652,7 @@ static void ip22zilog_enable_ms(struct uart_port *port)
         if (new_reg != up->curregs[R15]) {
                 up->curregs[R15] = new_reg;
 
-                /* NOTE: Not subject to 'transmitter active' rule.  */ 
+                /* NOTE: Not subject to 'transmitter active' rule.  */
                 write_zsreg(channel, R15, up->curregs[R15]);
         }
 }
@@ -680,7 +678,7 @@ static void ip22zilog_break_ctl(struct uart_port *port, int break_state)
         if (new_reg != up->curregs[R5]) {
                 up->curregs[R5] = new_reg;
 
-                /* NOTE: Not subject to 'transmitter active' rule.  */ 
+                /* NOTE: Not subject to 'transmitter active' rule.  */
                 write_zsreg(channel, R5, up->curregs[R5]);
         }
 
diff --git a/drivers/serial/m32r_sio.c b/drivers/serial/m32r_sio.c
index b48066a64a7d..242a04104393 100644
--- a/drivers/serial/m32r_sio.c
+++ b/drivers/serial/m32r_sio.c
@@ -80,7 +80,7 @@
 #include <asm/serial.h>
 
 /* Standard COM flags */
-#define STD_COM_FLAGS (ASYNC_BOOT_AUTOCONF | ASYNC_SKIP_TEST)
+#define STD_COM_FLAGS (UPF_BOOT_AUTOCONF | UPF_SKIP_TEST)
 
 /*
  * SERIAL_PORT_DFNS tells us about built-in ports that have no
diff --git a/drivers/serial/m32r_sio.h b/drivers/serial/m32r_sio.h
index 07d0dd80aa3d..7c3ec24f7e50 100644
--- a/drivers/serial/m32r_sio.h
+++ b/drivers/serial/m32r_sio.h
@@ -37,7 +37,7 @@ struct old_serial_port {
         unsigned int irq;
         unsigned int flags;
         unsigned char io_type;
-        unsigned char *iomem_base;
+        unsigned char __iomem *iomem_base;
         unsigned short iomem_reg_shift;
 };
 
diff --git a/drivers/serial/mcfserial.c b/drivers/serial/mcfserial.c
index 0ef648fa4b2d..8cbbb954df2c 100644
--- a/drivers/serial/mcfserial.c
+++ b/drivers/serial/mcfserial.c
@@ -57,20 +57,16 @@ struct timer_list mcfrs_timer_struct;
  *      keep going.  Perhaps one day the cflag settings for the
  *      console can be used instead.
  */
-#if defined(CONFIG_ARNEWSH) || defined(CONFIG_FREESCALE) || \
-    defined(CONFIG_senTec) || defined(CONFIG_SNEHA)
-#define CONSOLE_BAUD_RATE       19200
-#define DEFAULT_CBAUD           B19200
-#endif
-
 #if defined(CONFIG_HW_FEITH)
 #define CONSOLE_BAUD_RATE       38400
 #define DEFAULT_CBAUD           B38400
-#endif
-
-#if defined(CONFIG_MOD5272) || defined(CONFIG_M5208EVB)
+#elif defined(CONFIG_MOD5272) || defined(CONFIG_M5208EVB)
 #define CONSOLE_BAUD_RATE       115200
 #define DEFAULT_CBAUD           B115200
+#elif defined(CONFIG_ARNEWSH) || defined(CONFIG_FREESCALE) || \
+      defined(CONFIG_senTec) || defined(CONFIG_SNEHA)
+#define CONSOLE_BAUD_RATE       19200
+#define DEFAULT_CBAUD           B19200
 #endif
 
 #ifndef CONSOLE_BAUD_RATE
@@ -350,7 +346,7 @@ static inline void receive_chars(struct mcf_serial *info)
                 }
                 tty_insert_flip_char(tty, ch, flag);
         }
-        tty_flip_buffer_push(tty);
+        tty_schedule_flip(tty);
         return;
 }
 
diff --git a/drivers/serial/mux.c b/drivers/serial/mux.c
index 4e49168c3176..868eaf4a1a68 100644
--- a/drivers/serial/mux.c
+++ b/drivers/serial/mux.c
@@ -462,7 +462,7 @@ static int __init mux_probe(struct parisc_device *dev)
                 port->mapbase   = dev->hpa.start + MUX_OFFSET +
                                                 (i * MUX_LINE_OFFSET);
                 port->membase   = ioremap(port->mapbase, MUX_LINE_OFFSET);
-                port->iotype    = SERIAL_IO_MEM;
+                port->iotype    = UPIO_MEM;
                 port->type      = PORT_MUX;
                 port->irq       = NO_IRQ;
                 port->uartclk   = 0;
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 4e03a87f3fb4..9b7ed58cb53b 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -1492,7 +1492,7 @@ no_dma:
         /*
          * Init remaining bits of "port" structure
          */
-        uap->port.iotype = SERIAL_IO_MEM;
+        uap->port.iotype = UPIO_MEM;
         uap->port.irq = np->intrs[0].line;
         uap->port.uartclk = ZS_CLOCK;
         uap->port.fifosize = 1;
diff --git a/drivers/serial/s3c2410.c b/drivers/serial/s3c2410.c
index 0a2dd6c5b95f..7410e093a6b9 100644
--- a/drivers/serial/s3c2410.c
+++ b/drivers/serial/s3c2410.c
@@ -161,7 +161,11 @@ s3c24xx_serial_dbg(const char *fmt, ...)
 
 /* we can support 3 uarts, but not always use them */
 
+#ifdef CONFIG_CPU_S3C2400
+#define NR_PORTS (2)
+#else
 #define NR_PORTS (3)
+#endif
 
 /* port irq numbers */
 
diff --git a/drivers/serial/sa1100.c b/drivers/serial/sa1100.c
index ff7b60b4de37..2c00b8625852 100644
--- a/drivers/serial/sa1100.c
+++ b/drivers/serial/sa1100.c
@@ -628,7 +628,7 @@ static void __init sa1100_init_ports(void)
                 sa1100_ports[i].port.ops       = &sa1100_pops;
                 sa1100_ports[i].port.fifosize  = 8;
                 sa1100_ports[i].port.line      = i;
-                sa1100_ports[i].port.iotype    = SERIAL_IO_MEM;
+                sa1100_ports[i].port.iotype    = UPIO_MEM;
                 init_timer(&sa1100_ports[i].timer);
                 sa1100_ports[i].timer.function = sa1100_timeout;
                 sa1100_ports[i].timer.data     = (unsigned long)&sa1100_ports[i];
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index 0717abfdae06..cc1faa31d124 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -71,6 +71,11 @@ static void uart_change_pm(struct uart_state *state, int pm_state);
 void uart_write_wakeup(struct uart_port *port)
 {
         struct uart_info *info = port->info;
+        /*
+         * This means you called this function _after_ the port was
+         * closed.  No cookie for you.
+         */
+        BUG_ON(!info);
         tasklet_schedule(&info->tlet);
 }
 
@@ -471,14 +476,26 @@ static void uart_flush_chars(struct tty_struct *tty)
 }
 
 static int
-uart_write(struct tty_struct *tty, const unsigned char * buf, int count)
+uart_write(struct tty_struct *tty, const unsigned char *buf, int count)
 {
         struct uart_state *state = tty->driver_data;
-        struct uart_port *port = state->port;
-        struct circ_buf *circ = &state->info->xmit;
+        struct uart_port *port;
+        struct circ_buf *circ;
         unsigned long flags;
         int c, ret = 0;
 
+        /*
+         * This means you called this function _after_ the port was
+         * closed.  No cookie for you.
+         */
+        if (!state || !state->info) {
+                WARN_ON(1);
+                return -EL3HLT;
+        }
+
+        port = state->port;
+        circ = &state->info->xmit;
+
         if (!circ->buf)
                 return 0;
 
@@ -521,6 +538,15 @@ static void uart_flush_buffer(struct tty_struct *tty)
         struct uart_port *port = state->port;
         unsigned long flags;
 
+        /*
+         * This means you called this function _after_ the port was
+         * closed.  No cookie for you.
+         */
+        if (!state || !state->info) {
+                WARN_ON(1);
+                return;
+        }
+
         DPRINTK("uart_flush_buffer(%d) called\n", tty->index);
 
         spin_lock_irqsave(&port->lock, flags);
@@ -2237,7 +2263,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *port)
          * If this port is a console, then the spinlock is already
          * initialised.
          */
-        if (!uart_console(port))
+        if (!(uart_console(port) && (port->cons->flags & CON_ENABLED)))
                 spin_lock_init(&port->lock);
 
         uart_configure_port(drv, state, port);
diff --git a/drivers/serial/serial_lh7a40x.c b/drivers/serial/serial_lh7a40x.c
index d0490f67f597..04186eaae227 100644
--- a/drivers/serial/serial_lh7a40x.c
+++ b/drivers/serial/serial_lh7a40x.c
@@ -501,7 +501,7 @@ static struct uart_port_lh7a40x lh7a40x_ports[DEV_NR] = {
                 .port = {
                         .membase        = (void*) io_p2v (UART1_PHYS),
                         .mapbase        = UART1_PHYS,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = IRQ_UART1INTR,
                         .uartclk        = 14745600/2,
                         .fifosize       = 16,
@@ -514,7 +514,7 @@ static struct uart_port_lh7a40x lh7a40x_ports[DEV_NR] = {
                 .port = {
                         .membase        = (void*) io_p2v (UART2_PHYS),
                         .mapbase        = UART2_PHYS,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = IRQ_UART2INTR,
                         .uartclk        = 14745600/2,
                         .fifosize       = 16,
@@ -527,7 +527,7 @@ static struct uart_port_lh7a40x lh7a40x_ports[DEV_NR] = {
                 .port = {
                         .membase        = (void*) io_p2v (UART3_PHYS),
                         .mapbase        = UART3_PHYS,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = IRQ_UART3INTR,
                         .uartclk        = 14745600/2,
                         .fifosize       = 16,
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 80737c131ce7..44f6bf79bbe1 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -1468,10 +1468,10 @@ static struct sci_port sci_ports[] = {
                 .port   = {
                         .membase        = (void *)0xff923000,
                         .mapbase        = 0xff923000,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = 61,
                         .ops            = &sci_uart_ops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 0,
                 },
                 .type           = PORT_SCIF,
@@ -1482,10 +1482,10 @@ static struct sci_port sci_ports[] = {
                 .port   = {
                         .membase        = (void *)0xff924000,
                         .mapbase        = 0xff924000,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = 62,
                         .ops            = &sci_uart_ops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 1,
                 },
                 .type           = PORT_SCIF,
@@ -1496,10 +1496,10 @@ static struct sci_port sci_ports[] = {
                 .port   = {
                         .membase        = (void *)0xff925000,
                         .mapbase        = 0xff925000,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = 63,
                         .ops            = &sci_uart_ops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 2,
                 },
                 .type           = PORT_SCIF,
@@ -1511,10 +1511,10 @@ static struct sci_port sci_ports[] = {
                 .port   = {
                         .membase        = (void *)0xffe00000,
                         .mapbase        = 0xffe00000,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = 43,
                         .ops            = &sci_uart_ops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 0,
                 },
                 .type           = PORT_SCIF,
@@ -1525,10 +1525,10 @@ static struct sci_port sci_ports[] = {
                 .port   = {
                         .membase        = (void *)0xffe10000,
                         .mapbase        = 0xffe10000,
-                        .iotype         = SERIAL_IO_MEM,
+                        .iotype         = UPIO_MEM,
                         .irq            = 79,
                         .ops            = &sci_uart_ops,
-                        .flags          = ASYNC_BOOT_AUTOCONF,
+                        .flags          = UPF_BOOT_AUTOCONF,
                         .line           = 1,
                 },
                 .type           = PORT_SCIF,
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index 43e67d6c29d4..60ea4a3f0713 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -820,7 +820,7 @@ static int __init sn_sal_module_init(void)
         int retval;
 
         if (!ia64_platform_is("sn2"))
-                return -ENODEV;
+                return 0;
 
         printk(KERN_INFO "sn_console: Console driver init\n");
 
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 8bcaebcc0ad7..85664228a0b6 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -1036,7 +1036,7 @@ static void __init sab_attach_callback(struct linux_ebus_device *edev, void *arg
                 up->port.irq = edev->irqs[0];
                 up->port.fifosize = SAB82532_XMIT_FIFO_SIZE;
                 up->port.mapbase = (unsigned long)up->regs;
-                up->port.iotype = SERIAL_IO_MEM;
+                up->port.iotype = UPIO_MEM;
 
                 writeb(SAB82532_IPC_IC_ACT_LOW, &up->regs->w.ipc);
 
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index bc67442c6b4c..4e453fa966ae 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -109,11 +109,11 @@ static _INLINE_ unsigned int serial_in(struct uart_sunsu_port *up, int offset)
         offset <<= up->port.regshift;
 
         switch (up->port.iotype) {
-        case SERIAL_IO_HUB6:
+        case UPIO_HUB6:
                 outb(up->port.hub6 - 1 + offset, up->port.iobase);
                 return inb(up->port.iobase + 1);
 
-        case SERIAL_IO_MEM:
+        case UPIO_MEM:
                 return readb(up->port.membase + offset);
 
         default:
@@ -139,12 +139,12 @@ serial_out(struct uart_sunsu_port *up, int offset, int value)
         offset <<= up->port.regshift;
 
         switch (up->port.iotype) {
-        case SERIAL_IO_HUB6:
+        case UPIO_HUB6:
                 outb(up->port.hub6 - 1 + offset, up->port.iobase);
                 outb(value, up->port.iobase + 1);
                 break;
 
-        case SERIAL_IO_MEM:
+        case UPIO_MEM:
                 writeb(value, up->port.membase + offset);
                 break;
 
@@ -299,13 +299,10 @@ static void sunsu_start_tx(struct uart_port *port)
 static void sunsu_stop_rx(struct uart_port *port)
 {
         struct uart_sunsu_port *up = (struct uart_sunsu_port *) port;
-        unsigned long flags;
 
-        spin_lock_irqsave(&up->port.lock, flags);
         up->ier &= ~UART_IER_RLSI;
         up->port.read_status_mask &= ~UART_LSR_DR;
         serial_out(up, UART_IER, up->ier);
-        spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
 static void sunsu_enable_ms(struct uart_port *port)
@@ -1052,7 +1049,7 @@ static void sunsu_autoconfig(struct uart_sunsu_port *up)
                 return;
 
         up->type_probed = PORT_UNKNOWN;
-        up->port.iotype = SERIAL_IO_MEM;
+        up->port.iotype = UPIO_MEM;
 
         /*
          * First we look for Ebus-bases su's
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 3c72484adea7..5cc4d4c2935c 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1487,7 +1487,7 @@ static void __init sunzilog_prepare(void)
                 up[(chip * 2) + 1].port.membase = (void __iomem *)&rp->channelB;
 
                 /* Channel A */
-                up[(chip * 2) + 0].port.iotype = SERIAL_IO_MEM;
+                up[(chip * 2) + 0].port.iotype = UPIO_MEM;
                 up[(chip * 2) + 0].port.irq = zilog_irq;
                 up[(chip * 2) + 0].port.uartclk = ZS_CLOCK;
                 up[(chip * 2) + 0].port.fifosize = 1;
@@ -1498,7 +1498,7 @@ static void __init sunzilog_prepare(void)
                 up[(chip * 2) + 0].flags |= SUNZILOG_FLAG_IS_CHANNEL_A;
 
                 /* Channel B */
-                up[(chip * 2) + 1].port.iotype = SERIAL_IO_MEM;
+                up[(chip * 2) + 1].port.iotype = UPIO_MEM;
                 up[(chip * 2) + 1].port.irq = zilog_irq;
                 up[(chip * 2) + 1].port.uartclk = ZS_CLOCK;
                 up[(chip * 2) + 1].port.fifosize = 1;
diff --git a/drivers/serial/v850e_uart.c b/drivers/serial/v850e_uart.c
index 9378895a8d56..df705fda4243 100644
--- a/drivers/serial/v850e_uart.c
+++ b/drivers/serial/v850e_uart.c
@@ -496,7 +496,7 @@ static int __init v850e_uart_init (void)
 
                         port->ops = &v850e_uart_ops;
                         port->line = chan;
-                        port->iotype = SERIAL_IO_MEM;
+                        port->iotype = UPIO_MEM;
                         port->flags = UPF_BOOT_AUTOCONF;
 
                         /* We actually use multiple IRQs, but the serial
diff --git a/drivers/sn/Kconfig b/drivers/sn/Kconfig
index d95265b187a3..a34731625877 100644
--- a/drivers/sn/Kconfig
+++ b/drivers/sn/Kconfig
@@ -3,10 +3,11 @@
 #
 
 menu "SN Devices"
+        depends on SGI_SN
 
 config SGI_IOC4
         tristate "SGI IOC4 Base IO support"
-        depends on (IA64_GENERIC || IA64_SGI_SN2) && MMTIMER
+        depends on MMTIMER
         default m
         ---help---
         This option enables basic support for the SGI IOC4-based Base IO
@@ -19,7 +20,6 @@ config SGI_IOC4
 
 config SGI_IOC3
         tristate "SGI IOC3 Base IO support"
-        depends on (IA64_GENERIC || IA64_SGI_SN2)
         default m
         ---help---
         This option enables basic support for the SGI IOC3-based Base IO
diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
index c70ae81b5d98..93449a1a0065 100644
--- a/drivers/sn/ioc3.c
+++ b/drivers/sn/ioc3.c
@@ -38,10 +38,10 @@ static inline unsigned mcr_pack(unsigned pulse, unsigned sample)
 
 static int nic_wait(struct ioc3_driver_data *idd)
 {
-        volatile unsigned mcr;
+        unsigned mcr;
 
         do {
-                mcr = (volatile unsigned)idd->vma->mcr;
+                mcr = readl(&idd->vma->mcr);
         } while (!(mcr & 2));
 
         return mcr & 1;
@@ -53,7 +53,7 @@ static int nic_reset(struct ioc3_driver_data *idd)
         unsigned long flags;
 
         local_irq_save(flags);
-        idd->vma->mcr = mcr_pack(500, 65);
+        writel(mcr_pack(500, 65), &idd->vma->mcr);
         presence = nic_wait(idd);
         local_irq_restore(flags);
 
@@ -62,13 +62,13 @@ static int nic_reset(struct ioc3_driver_data *idd)
         return presence;
 }
 
-static inline int nic_read_bit(struct ioc3_driver_data *idd)
+static int nic_read_bit(struct ioc3_driver_data *idd)
 {
         int result;
         unsigned long flags;
 
         local_irq_save(flags);
-        idd->vma->mcr = mcr_pack(6, 13);
+        writel(mcr_pack(6, 13), &idd->vma->mcr);
         result = nic_wait(idd);
         local_irq_restore(flags);
 
@@ -77,12 +77,12 @@ static inline int nic_read_bit(struct ioc3_driver_data *idd)
         return result;
 }
 
-static inline void nic_write_bit(struct ioc3_driver_data *idd, int bit)
+static void nic_write_bit(struct ioc3_driver_data *idd, int bit)
 {
         if (bit)
-                idd->vma->mcr = mcr_pack(6, 110);
+                writel(mcr_pack(6, 110), &idd->vma->mcr);
         else
-                idd->vma->mcr = mcr_pack(80, 30);
+                writel(mcr_pack(80, 30), &idd->vma->mcr);
 
         nic_wait(idd);
 }
@@ -337,7 +337,7 @@ static void probe_nic(struct ioc3_driver_data *idd)
         int save = 0, loops = 3;
         unsigned long first, addr;
 
-        idd->vma->gpcr_s = GPCR_MLAN_EN;
+        writel(GPCR_MLAN_EN, &idd->vma->gpcr_s);
 
         while(loops>0) {
                 idd->nic_part[0] = 0;
@@ -371,8 +371,7 @@ static void probe_nic(struct ioc3_driver_data *idd)
 
 /* Interrupts */
 
-static inline void
-write_ireg(struct ioc3_driver_data *idd, uint32_t val, int which)
+static void write_ireg(struct ioc3_driver_data *idd, uint32_t val, int which)
 {
         unsigned long flags;
 
@@ -408,7 +407,7 @@ static irqreturn_t ioc3_intr_io(int irq, void *arg, struct pt_regs *regs)
 
         read_lock_irqsave(&ioc3_submodules_lock, flags);
 
-        if(idd->dual_irq && idd->vma->eisr) {
+        if(idd->dual_irq && readb(&idd->vma->eisr)) {
                 /* send Ethernet IRQ to the driver */
                 if(ioc3_ethernet && idd->active[ioc3_ethernet->id] &&
                                                 ioc3_ethernet->intr) {
@@ -682,7 +681,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         idd->id = ioc3_counter++;
         up_write(&ioc3_devices_rwsem);
 
-        idd->gpdr_shadow = idd->vma->gpdr;
+        idd->gpdr_shadow = readl(&idd->vma->gpdr);
 
         /* Read IOC3 NIC contents */
         probe_nic(idd);
@@ -735,14 +734,12 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         }
 
         /* Add this IOC3 to all submodules */
-        read_lock(&ioc3_submodules_lock);
         for(id=0;id<IOC3_MAX_SUBMODULES;id++)
                 if(ioc3_submodules[id] && ioc3_submodules[id]->probe) {
                         idd->active[id] = 1;
                         idd->active[id] = !ioc3_submodules[id]->probe
                                                 (ioc3_submodules[id], idd);
                 }
-        read_unlock(&ioc3_submodules_lock);
 
         printk(KERN_INFO "IOC3 Master Driver loaded for %s\n", pci_name(pdev));
 
@@ -767,7 +764,6 @@ static void ioc3_remove(struct pci_dev *pdev)
         idd = pci_get_drvdata(pdev);
 
         /* Remove this IOC3 from all submodules */
-        read_lock(&ioc3_submodules_lock);
         for(id=0;id<IOC3_MAX_SUBMODULES;id++)
                 if(idd->active[id]) {
                         if(ioc3_submodules[id] && ioc3_submodules[id]->remove)
@@ -781,7 +777,6 @@ static void ioc3_remove(struct pci_dev *pdev)
                                                 pci_name(pdev));
                         idd->active[id] = 0;
                 }
-        read_unlock(&ioc3_submodules_lock);
 
         /* Clear and disable all IRQs */
         write_ireg(idd, ~0, IOC3_W_IEC);
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index b77dbd63e596..7a75faeb0526 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -75,16 +75,6 @@ config SPI_BUTTERFLY
           inexpensive battery powered microcontroller evaluation board.
           This same cable can be used to flash new firmware.
 
-config SPI_BUTTERFLY
-        tristate "Parallel port adapter for AVR Butterfly (DEVELOPMENT)"
-        depends on SPI_MASTER && PARPORT && EXPERIMENTAL
-        select SPI_BITBANG
-        help
-          This uses a custom parallel port cable to connect to an AVR
-          Butterfly <http://www.atmel.com/products/avr/butterfly>, an
-          inexpensive battery powered microcontroller evaluation board.
-          This same cable can be used to flash new firmware.
-
 #
 # Add new SPI master controllers in alphabetical order above this line
 #
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 791c4dc550ae..94f5e8ed83a7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -90,7 +90,7 @@ static int spi_suspend(struct device *dev, pm_message_t message)
         int                     value;
         struct spi_driver       *drv = to_spi_driver(dev->driver);
 
-        if (!drv->suspend)
+        if (!drv || !drv->suspend)
                 return 0;
 
         /* suspend will stop irqs and dma; no more i/o */
@@ -105,7 +105,7 @@ static int spi_resume(struct device *dev)
         int                     value;
         struct spi_driver       *drv = to_spi_driver(dev->driver);
 
-        if (!drv->resume)
+        if (!drv || !drv->resume)
                 return 0;
 
         /* resume may restart the i/o queue */
@@ -449,7 +449,6 @@ void spi_unregister_master(struct spi_master *master)
 {
         (void) device_for_each_child(master->cdev.dev, NULL, __unregister);
         class_device_unregister(&master->cdev);
-        master->cdev.dev = NULL;
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);
 
diff --git a/drivers/spi/spi_butterfly.c b/drivers/spi/spi_butterfly.c
index 79a3c59615ab..ff9e5faa4dc9 100644
--- a/drivers/spi/spi_butterfly.c
+++ b/drivers/spi/spi_butterfly.c
@@ -163,21 +163,20 @@ static void butterfly_chipselect(struct spi_device *spi, int value)
         struct butterfly        *pp = spidev_to_pp(spi);
 
         /* set default clock polarity */
-        if (value)
+        if (value != BITBANG_CS_INACTIVE)
                 setsck(spi, spi->mode & SPI_CPOL);
 
         /* no chipselect on this USI link config */
         if (is_usidev(spi))
                 return;
 
-        /* here, value == "activate or not" */
-
-        /* most PARPORT_CONTROL_* bits are negated */
+        /* here, value == "activate or not";
+         * most PARPORT_CONTROL_* bits are negated, so we must
+         * morph it to value == "bit value to write in control register"
+         */
         if (spi_cs_bit == PARPORT_CONTROL_INIT)
                 value = !value;
 
-        /* here, value == "bit value to write in control register"  */
-
         parport_frob_control(pp->port, spi_cs_bit, value ? spi_cs_bit : 0);
 }
 
@@ -202,7 +201,9 @@ butterfly_txrx_word_mode0(struct spi_device *spi,
 
 /* override default partitioning with cmdlinepart */
 static struct mtd_partition partitions[] = { {
-        /* JFFS2 wants partitions of 4*N blocks for this device ... */
+        /* JFFS2 wants partitions of 4*N blocks for this device,
+         * so sectors 0 and 1 can't be partitions by themselves.
+         */
 
         /* sector 0 = 8 pages * 264 bytes/page (1 block)
          * sector 1 = 248 pages * 264 bytes/page
@@ -316,8 +317,9 @@ static void butterfly_attach(struct parport *p)
         if (status < 0)
                 goto clean2;
 
-        /* Bus 1 lets us talk to at45db041b (firmware disables AVR)
-         * or AVR (firmware resets at45, acts as spi slave)
+        /* Bus 1 lets us talk to at45db041b (firmware disables AVR SPI), AVR
+         * (firmware resets at45, acts as spi slave) or neither (we ignore
+         * both, AVR uses AT45).  Here we expect firmware for the first option.
          */
         pp->info[0].max_speed_hz = 15 * 1000 * 1000;
         strcpy(pp->info[0].modalias, "mtd_dataflash");
@@ -330,7 +332,9 @@ static void butterfly_attach(struct parport *p)
                                 pp->dataflash->dev.bus_id);
 
 #ifdef  HAVE_USI
-        /* even more custom AVR firmware */
+        /* Bus 2 is only for talking to the AVR, and it can work no
+         * matter who masters bus 1; needs appropriate AVR firmware.
+         */
         pp->info[1].max_speed_hz = 10 /* ?? */ * 1000 * 1000;
         strcpy(pp->info[1].modalias, "butterfly");
         // pp->info[1].platform_data = ... TBD ... ;
@@ -378,13 +382,8 @@ static void butterfly_detach(struct parport *p)
         pp = butterfly;
         butterfly = NULL;
 
-#ifdef  HAVE_USI
-        spi_unregister_device(pp->butterfly);
-        pp->butterfly = NULL;
-#endif
-        spi_unregister_device(pp->dataflash);
-        pp->dataflash = NULL;
-
+        /* stop() unregisters child devices too */
+        pdev = to_platform_device(pp->bitbang.master->cdev.dev);
         status = spi_bitbang_stop(&pp->bitbang);
 
         /* turn off VCC */
@@ -394,8 +393,6 @@ static void butterfly_detach(struct parport *p)
         parport_release(pp->pd);
         parport_unregister_device(pp->pd);
 
-        pdev = to_platform_device(pp->bitbang.master->cdev.dev);
-
         (void) spi_master_put(pp->bitbang.master);
 
         platform_device_unregister(pdev);
@@ -420,4 +417,5 @@ static void __exit butterfly_exit(void)
 }
 module_exit(butterfly_exit);
 
+MODULE_DESCRIPTION("Parport Adapter driver for AVR Butterfly");
 MODULE_LICENSE("GPL");
diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
index a0e5af638e0e..4a51e56f85b6 100644
--- a/drivers/tc/tc.c
+++ b/drivers/tc/tc.c
@@ -17,7 +17,6 @@
 #include <linux/types.h>
 
 #include <asm/addrspace.h>
-#include <asm/bug.h>
 #include <asm/errno.h>
 #include <asm/io.h>
 #include <asm/paccess.h>
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 076462c8ba2a..dce9d987f0fc 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -378,7 +378,7 @@ const struct usb_device_id *usb_match_id(struct usb_interface *interface,
 
         return NULL;
 }
-EXPORT_SYMBOL_GPL(usb_match_id);
+EXPORT_SYMBOL(usb_match_id);
 
 int usb_device_match(struct device *dev, struct device_driver *drv)
 {
@@ -446,7 +446,7 @@ int usb_register_driver(struct usb_driver *new_driver, struct module *owner)
 
         return retval;
 }
-EXPORT_SYMBOL_GPL(usb_register_driver);
+EXPORT_SYMBOL(usb_register_driver);
 
 /**
  * usb_deregister - unregister a USB driver
@@ -469,4 +469,4 @@ void usb_deregister(struct usb_driver *driver)
 
         usbfs_update_special();
 }
-EXPORT_SYMBOL_GPL(usb_deregister);
+EXPORT_SYMBOL(usb_deregister);
diff --git a/drivers/usb/gadget/lh7a40x_udc.c b/drivers/usb/gadget/lh7a40x_udc.c
index e02fea5a5433..1a362c5e7f3d 100644
--- a/drivers/usb/gadget/lh7a40x_udc.c
+++ b/drivers/usb/gadget/lh7a40x_udc.c
@@ -1062,11 +1062,11 @@ static int lh7a40x_ep_enable(struct usb_ep *_ep,
         ep->pio_irqs = 0;
         ep->ep.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
 
+        spin_unlock_irqrestore(&ep->dev->lock, flags);
+
         /* Reset halt state (does flush) */
         lh7a40x_set_halt(_ep, 0);
 
-        spin_unlock_irqrestore(&ep->dev->lock, flags);
-
         DEBUG("%s: enabled %s\n", __FUNCTION__, _ep->name);
         return 0;
 }
@@ -1775,6 +1775,7 @@ static void lh7a40x_ep0_setup(struct lh7a40x_udc *dev, u32 csr)
                                         break;
 
                                 qep = &dev->ep[ep_num];
+                                spin_unlock(&dev->lock);
                                 if (ctrl.bRequest == USB_REQ_SET_FEATURE) {
                                         DEBUG_SETUP("SET_FEATURE (%d)\n",
                                                     ep_num);
@@ -1784,6 +1785,7 @@ static void lh7a40x_ep0_setup(struct lh7a40x_udc *dev, u32 csr)
                                                     ep_num);
                                         lh7a40x_set_halt(&qep->ep, 0);
                                 }
+                                spin_lock(&dev->lock);
                                 usb_set_index(0);
 
                                 /* Reply with a ZLP on next IN token */
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 9689efeb364c..6d6eaad73968 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -853,11 +853,14 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
         // DEBUG("%s: OID = %08X\n", __FUNCTION__, cpu_to_le32(buf->OID));
         if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
         
-        /* 
-         * we need more memory: 
-         * oid_supported_list is the largest answer 
+        /*
+         * we need more memory:
+         * gen_ndis_query_resp expects enough space for
+         * rndis_query_cmplt_type followed by data.
+         * oid_supported_list is the largest data reply
          */
-        r = rndis_add_response (configNr, sizeof (oid_supported_list));
+        r = rndis_add_response (configNr,
+                sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type));
         if (!r)
                 return -ENOMEM;
         resp = (rndis_query_cmplt_type *) r->buf;
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index e9e5bc178cef..9e81c26313f9 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -191,8 +191,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
                 }
                 if (wait_time <= 0)
                         printk(KERN_WARNING "%s %s: BIOS handoff "
-                                        "failed (BIOS bug ?)\n",
-                                        pdev->dev.bus_id, "OHCI");
+                                        "failed (BIOS bug ?) %08x\n",
+                                        pdev->dev.bus_id, "OHCI",
+                                        readl(base + OHCI_CONTROL));
 
                 /* reset controller, preserving RWC */
                 writel(control & OHCI_CTRL_RWC, base + OHCI_CONTROL);
@@ -243,6 +244,12 @@ static void __devinit quirk_usb_disable_ehci(struct pci_dev *pdev)
                                 pr_debug("%s %s: BIOS handoff\n",
                                                 pdev->dev.bus_id, "EHCI");
 
+#if 0
+/* aleksey_gorelov@phoenix.com reports that some systems need SMI forced on,
+ * but that seems dubious in general (the BIOS left it off intentionally)
+ * and is known to prevent some systems from booting.  so we won't do this
+ * unless maybe we can determine when we're on a system that needs SMI forced.
+ */
                                 /* BIOS workaround (?): be sure the
                                  * pre-Linux code receives the SMI
                                  */
@@ -252,12 +259,14 @@ static void __devinit quirk_usb_disable_ehci(struct pci_dev *pdev)
                                 pci_write_config_dword(pdev,
                                                 offset + EHCI_USBLEGCTLSTS,
                                                 val | EHCI_USBLEGCTLSTS_SOOE);
-                        }
+#endif
 
-                        /* always say Linux will own the hardware
-                         * by setting EHCI_USBLEGSUP_OS.
-                         */
-                        pci_write_config_byte(pdev, offset + 3, 1);
+                                /* some systems get upset if this semaphore is
+                                 * set for any other reason than forcing a BIOS
+                                 * handoff..
+                                 */
+                                pci_write_config_byte(pdev, offset + 3, 1);
+                        }
 
                         /* if boot firmware now owns EHCI, spin till
                          * it hands it over.
@@ -274,8 +283,8 @@ static void __devinit quirk_usb_disable_ehci(struct pci_dev *pdev)
                                  * it down, and hope nothing goes too wrong
                                  */
                                 printk(KERN_WARNING "%s %s: BIOS handoff "
-                                                "failed (BIOS bug ?)\n",
-                                        pdev->dev.bus_id, "EHCI");
+                                                "failed (BIOS bug ?) %08x\n",
+                                        pdev->dev.bus_id, "EHCI", cap);
                                 pci_write_config_byte(pdev, offset + 2, 0);
                         }
 
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index 466384d7c79f..134d2000128a 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -101,7 +101,7 @@ static struct resource resources[] = {
         },
 };
 
-extern struct device_driver sl811h_driver;
+extern struct platform_driver sl811h_driver;
 
 static struct platform_device platform_dev = {
         .id                     = -1,
@@ -132,7 +132,7 @@ static int sl811_hc_init(struct device *parent, ioaddr_t base_addr, int irq)
          * initialized already because of the link order dependency created
          * by referencing "sl811h_driver".
          */
-        platform_dev.name = sl811h_driver.name;
+        platform_dev.name = sl811h_driver.driver.name;
         return platform_device_register(&platform_dev);
 }
 
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 6f7a684c3e07..07a012f88772 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -1407,6 +1407,7 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_VENDOR_ID_WISEGROUP         0x0925
 #define USB_DEVICE_ID_1_PHIDGETSERVO_20 0x8101
 #define USB_DEVICE_ID_4_PHIDGETSERVO_20 0x8104
+#define USB_DEVICE_ID_DUAL_USB_JOYPAD   0x8866
 
 #define USB_VENDOR_ID_CODEMERCS         0x07c0
 #define USB_DEVICE_ID_CODEMERCS_IOW40   0x1500
@@ -1435,17 +1436,20 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_DEVICE_ID_VERNIER_CYCLOPS   0x0004
 
 #define USB_VENDOR_ID_LD                0x0f11
-#define USB_DEVICE_ID_CASSY             0x1000
-#define USB_DEVICE_ID_POCKETCASSY       0x1010
-#define USB_DEVICE_ID_MOBILECASSY       0x1020
-#define USB_DEVICE_ID_JWM               0x1080
-#define USB_DEVICE_ID_DMMP              0x1081
-#define USB_DEVICE_ID_UMIP              0x1090
-#define USB_DEVICE_ID_VIDEOCOM          0x1200
-#define USB_DEVICE_ID_COM3LAB           0x2000
-#define USB_DEVICE_ID_TELEPORT          0x2010
-#define USB_DEVICE_ID_NETWORKANALYSER   0x2020
-#define USB_DEVICE_ID_POWERCONTROL      0x2030
+#define USB_DEVICE_ID_LD_CASSY          0x1000
+#define USB_DEVICE_ID_LD_POCKETCASSY    0x1010
+#define USB_DEVICE_ID_LD_MOBILECASSY    0x1020
+#define USB_DEVICE_ID_LD_JWM            0x1080
+#define USB_DEVICE_ID_LD_DMMP           0x1081
+#define USB_DEVICE_ID_LD_UMIP           0x1090
+#define USB_DEVICE_ID_LD_XRAY1          0x1100
+#define USB_DEVICE_ID_LD_XRAY2          0x1101
+#define USB_DEVICE_ID_LD_VIDEOCOM       0x1200
+#define USB_DEVICE_ID_LD_COM3LAB        0x2000
+#define USB_DEVICE_ID_LD_TELEPORT       0x2010
+#define USB_DEVICE_ID_LD_NETWORKANALYSER 0x2020
+#define USB_DEVICE_ID_LD_POWERCONTROL   0x2030
+#define USB_DEVICE_ID_LD_MACHINETEST    0x2040
 
 #define USB_VENDOR_ID_APPLE             0x05ac
 #define USB_DEVICE_ID_APPLE_POWERMOUSE  0x0304
@@ -1491,17 +1495,20 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_POWERMATE, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_GRIFFIN, USB_DEVICE_ID_SOUNDKNOB, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_KBGEAR, USB_DEVICE_ID_KBGEAR_JAMSTUDIO, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_CASSY, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_POCKETCASSY, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_MOBILECASSY, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_JWM, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_DMMP, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_UMIP, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_VIDEOCOM, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_COM3LAB, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_TELEPORT, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_NETWORKANALYSER, HID_QUIRK_IGNORE },
-        { USB_VENDOR_ID_LD, USB_DEVICE_ID_POWERCONTROL, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOBILECASSY, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_XRAY1, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_XRAY2, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_VIDEOCOM, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_COM3LAB, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_TELEPORT, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_NETWORKANALYSER, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERCONTROL, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETEST, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1024LS, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_MCC, USB_DEVICE_ID_MCC_PMD1208LS, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_IGNORE },
@@ -1571,6 +1578,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_USBHUB_KB, HID_QUIRK_NOGET},
         { USB_VENDOR_ID_HP, USB_DEVICE_ID_HP_USBHUB_KB, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_TANGTOP, USB_DEVICE_ID_TANGTOP_USBPS2, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
 
         { USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_POWERMOUSE, HID_QUIRK_2WHEEL_POWERMOUSE },
         { USB_VENDOR_ID_A4TECH, USB_DEVICE_ID_A4TECH_WCP32PU, HID_QUIRK_2WHEEL_MOUSE_HACK_7 },
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index 6649531fa824..8ba6a701e9c1 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -141,7 +141,7 @@ source "drivers/usb/misc/sisusbvga/Kconfig"
 
 config USB_LD
         tristate "USB LD driver"
-        depends on USB && EXPERIMENTAL
+        depends on USB
         help
           This driver is for generic USB devices that use interrupt transfers,
           like LD Didactic's USB devices.
diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
index 331d4ae949ed..e2d1198623eb 100644
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -24,6 +24,7 @@
  * V0.1  (mh) Initial version
  * V0.11 (mh) Added raw support for HID 1.0 devices (no interrupt out endpoint)
  * V0.12 (mh) Added kmalloc check for string buffer
+ * V0.13 (mh) Added support for LD X-Ray and Machine Test System
  */
 
 #include <linux/config.h>
@@ -40,17 +41,20 @@
 
 /* Define these values to match your devices */
 #define USB_VENDOR_ID_LD                0x0f11  /* USB Vendor ID of LD Didactic GmbH */
-#define USB_DEVICE_ID_CASSY             0x1000  /* USB Product ID for all CASSY-S modules */
-#define USB_DEVICE_ID_POCKETCASSY       0x1010  /* USB Product ID for Pocket-CASSY */
-#define USB_DEVICE_ID_MOBILECASSY       0x1020  /* USB Product ID for Mobile-CASSY */
-#define USB_DEVICE_ID_JWM               0x1080  /* USB Product ID for Joule and Wattmeter */
-#define USB_DEVICE_ID_DMMP              0x1081  /* USB Product ID for Digital Multimeter P (reserved) */
-#define USB_DEVICE_ID_UMIP              0x1090  /* USB Product ID for UMI P */
-#define USB_DEVICE_ID_VIDEOCOM          0x1200  /* USB Product ID for VideoCom */
-#define USB_DEVICE_ID_COM3LAB           0x2000  /* USB Product ID for COM3LAB */
-#define USB_DEVICE_ID_TELEPORT          0x2010  /* USB Product ID for Terminal Adapter */
-#define USB_DEVICE_ID_NETWORKANALYSER   0x2020  /* USB Product ID for Network Analyser */
-#define USB_DEVICE_ID_POWERCONTROL      0x2030  /* USB Product ID for Controlling device for Power Electronics */
+#define USB_DEVICE_ID_LD_CASSY          0x1000  /* USB Product ID of CASSY-S */
+#define USB_DEVICE_ID_LD_POCKETCASSY    0x1010  /* USB Product ID of Pocket-CASSY */
+#define USB_DEVICE_ID_LD_MOBILECASSY    0x1020  /* USB Product ID of Mobile-CASSY */
+#define USB_DEVICE_ID_LD_JWM            0x1080  /* USB Product ID of Joule and Wattmeter */
+#define USB_DEVICE_ID_LD_DMMP           0x1081  /* USB Product ID of Digital Multimeter P (reserved) */
+#define USB_DEVICE_ID_LD_UMIP           0x1090  /* USB Product ID of UMI P */
+#define USB_DEVICE_ID_LD_XRAY1          0x1100  /* USB Product ID of X-Ray Apparatus */
+#define USB_DEVICE_ID_LD_XRAY2          0x1101  /* USB Product ID of X-Ray Apparatus */
+#define USB_DEVICE_ID_LD_VIDEOCOM       0x1200  /* USB Product ID of VideoCom */
+#define USB_DEVICE_ID_LD_COM3LAB        0x2000  /* USB Product ID of COM3LAB */
+#define USB_DEVICE_ID_LD_TELEPORT       0x2010  /* USB Product ID of Terminal Adapter */
+#define USB_DEVICE_ID_LD_NETWORKANALYSER 0x2020 /* USB Product ID of Network Analyser */
+#define USB_DEVICE_ID_LD_POWERCONTROL   0x2030  /* USB Product ID of Converter Control Unit */
+#define USB_DEVICE_ID_LD_MACHINETEST    0x2040  /* USB Product ID of Machine Test System */
 
 #define USB_VENDOR_ID_VERNIER           0x08f7
 #define USB_DEVICE_ID_VERNIER_LABPRO    0x0001
@@ -67,17 +71,20 @@
 
 /* table of devices that work with this driver */
 static struct usb_device_id ld_usb_table [] = {
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_CASSY) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_POCKETCASSY) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_MOBILECASSY) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_JWM) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_DMMP) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_UMIP) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_VIDEOCOM) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_COM3LAB) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_TELEPORT) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_NETWORKANALYSER) },
-        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_POWERCONTROL) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POCKETCASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MOBILECASSY) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_XRAY1) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_XRAY2) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_VIDEOCOM) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_COM3LAB) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_TELEPORT) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_NETWORKANALYSER) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERCONTROL) },
+        { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETEST) },
         { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_LABPRO) },
         { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_GOTEMP) },
         { USB_DEVICE(USB_VENDOR_ID_VERNIER, USB_DEVICE_ID_VERNIER_SKIP) },
@@ -85,7 +92,7 @@ static struct usb_device_id ld_usb_table [] = {
         { }                                     /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, ld_usb_table);
-MODULE_VERSION("V0.12");
+MODULE_VERSION("V0.13");
 MODULE_AUTHOR("Michael Hund <mhund@ld-didactic.de>");
 MODULE_DESCRIPTION("LD USB Driver");
 MODULE_LICENSE("GPL");
@@ -632,8 +639,8 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
 
         /* workaround for early firmware versions on fast computers */
         if ((le16_to_cpu(udev->descriptor.idVendor) == USB_VENDOR_ID_LD) &&
-            ((le16_to_cpu(udev->descriptor.idProduct) == USB_DEVICE_ID_CASSY) ||
-             (le16_to_cpu(udev->descriptor.idProduct) == USB_DEVICE_ID_COM3LAB)) &&
+            ((le16_to_cpu(udev->descriptor.idProduct) == USB_DEVICE_ID_LD_CASSY) ||
+             (le16_to_cpu(udev->descriptor.idProduct) == USB_DEVICE_ID_LD_COM3LAB)) &&
             (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x103)) {
                 buffer = kmalloc(256, GFP_KERNEL);
                 if (buffer == NULL) {
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index f2b4ca8692d8..c145e1ed8429 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -469,8 +469,14 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
         { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MHAM_KW_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MHAM_YS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MHAM_Y6_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MHAM_Y8_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MHAM_IC_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MHAM_DB9_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MHAM_RS232_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_MHAM_Y9_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TERATRONIK_VCP_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TERATRONIK_D2XX_PID) },
         { USB_DEVICE(EVOLUTION_VID, EVOLUTION_ER1_PID) },
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index ca40f16370f1..bdef3b8c731f 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -333,10 +333,18 @@
 
 /*
  * microHAM product IDs (http://www.microham.com).
- * Submitted by Justin Burket (KL1RL) <zorton@jtan.com>.
+ * Submitted by Justin Burket (KL1RL) <zorton@jtan.com>
+ * and Mike Studer (K6EEP) <k6eep@hamsoftware.org>.
+ * Ian Abbott <abbotti@mev.co.uk> added a few more from the driver INF file.
  */
+#define FTDI_MHAM_KW_PID 0xEEE8         /* USB-KW interface */
+#define FTDI_MHAM_YS_PID 0xEEE9         /* USB-YS interface */
 #define FTDI_MHAM_Y6_PID 0xEEEA         /* USB-Y6 interface */
 #define FTDI_MHAM_Y8_PID 0xEEEB         /* USB-Y8 interface */
+#define FTDI_MHAM_IC_PID 0xEEEC         /* USB-IC interface */
+#define FTDI_MHAM_DB9_PID 0xEEED        /* USB-DB9 interface */
+#define FTDI_MHAM_RS232_PID 0xEEEE      /* USB-RS232 interface */
+#define FTDI_MHAM_Y9_PID 0xEEEF         /* USB-Y9 interface */
 
 /*
  * Active Robots product ids.
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index e8e575e037c1..37c81c08faad 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -73,9 +73,10 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
         { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
         { USB_DEVICE(SYNTECH_VENDOR_ID, SYNTECH_PRODUCT_ID) },
-        { USB_DEVICE(NOKIA_CA42_VENDOR_ID, NOKIA_CA42_PRODUCT_ID ) },
-        { USB_DEVICE(CA_42_CA42_VENDOR_ID, CA_42_CA42_PRODUCT_ID ) },
+        { USB_DEVICE(NOKIA_CA42_VENDOR_ID, NOKIA_CA42_PRODUCT_ID) },
+        { USB_DEVICE(CA_42_CA42_VENDOR_ID, CA_42_CA42_PRODUCT_ID) },
         { USB_DEVICE(SAGEM_VENDOR_ID, SAGEM_PRODUCT_ID) },
+        { USB_DEVICE(LEADTEK_VENDOR_ID, LEADTEK_9531_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 1807087a76e3..9bc4755162ad 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -71,3 +71,7 @@
 
 #define SAGEM_VENDOR_ID         0x079b
 #define SAGEM_PRODUCT_ID        0x0027
+
+/* Leadtek GPS 9531 (ID 0413:2101) */
+#define LEADTEK_VENDOR_ID       0x0413
+#define LEADTEK_9531_PRODUCT_ID 0x2101
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 4dd6865d32b0..b5c96e74a903 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -242,8 +242,10 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
 
         down(&port->sem);
 
-        if (port->open_count == 0)
-                goto out;
+        if (port->open_count == 0) {
+                up(&port->sem);
+                return;
+        }
 
         --port->open_count;
         if (port->open_count == 0) {
@@ -260,10 +262,8 @@ static void serial_close(struct tty_struct *tty, struct file * filp)
                 module_put(port->serial->type->driver.owner);
         }
 
-        kref_put(&port->serial->kref, destroy_serial);
-
-out:
         up(&port->sem);
+        kref_put(&port->serial->kref, destroy_serial);
 }
 
 static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index bce3d55affd8..11a48d874752 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -69,6 +69,8 @@ static struct usb_device_id id_table [] = {
                 .driver_info = (kernel_ulong_t)&palm_os_4_probe },
         { USB_DEVICE(HANDSPRING_VENDOR_ID, HANDSPRING_TREO600_ID),
                 .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+        { USB_DEVICE(GSPDA_VENDOR_ID, GSPDA_XPLORE_M68_ID),
+                .driver_info = (kernel_ulong_t)&palm_os_4_probe },
         { USB_DEVICE(PALM_VENDOR_ID, PALM_M500_ID),
                 .driver_info = (kernel_ulong_t)&palm_os_4_probe },
         { USB_DEVICE(PALM_VENDOR_ID, PALM_M505_ID),
@@ -139,6 +141,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(HANDSPRING_VENDOR_ID, HANDSPRING_VISOR_ID) },
         { USB_DEVICE(HANDSPRING_VENDOR_ID, HANDSPRING_TREO_ID) },
         { USB_DEVICE(HANDSPRING_VENDOR_ID, HANDSPRING_TREO600_ID) },
+        { USB_DEVICE(GSPDA_VENDOR_ID, GSPDA_XPLORE_M68_ID) },
         { USB_DEVICE(PALM_VENDOR_ID, PALM_M500_ID) },
         { USB_DEVICE(PALM_VENDOR_ID, PALM_M505_ID) },
         { USB_DEVICE(PALM_VENDOR_ID, PALM_M515_ID) },
diff --git a/drivers/usb/serial/visor.h b/drivers/usb/serial/visor.h
index b84d1cb4c693..765118d83fb6 100644
--- a/drivers/usb/serial/visor.h
+++ b/drivers/usb/serial/visor.h
@@ -36,6 +36,9 @@
 #define PALM_ZIRE_ID                    0x0070
 #define PALM_M100_ID                    0x0080
 
+#define GSPDA_VENDOR_ID         0x115e
+#define GSPDA_XPLORE_M68_ID             0xf100
+
 #define SONY_VENDOR_ID                  0x054C
 #define SONY_CLIE_3_5_ID                0x0038
 #define SONY_CLIE_4_0_ID                0x0066
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index ee958f986eb8..31ca92056c27 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -106,6 +106,13 @@ UNUSUAL_DEV(  0x0411, 0x001c, 0x0113, 0x0113,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
+/* Reported by Christian Leber <christian@leber.de> */
+UNUSUAL_DEV(  0x0419, 0xaaf5, 0x0100, 0x0100,
+                "TrekStor",
+                "i.Beat 115 2.0",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE | US_FL_NOT_LOCKABLE ),
+
 /* Reported by Stefan Werner <dustbln@gmx.de> */
 UNUSUAL_DEV(  0x0419, 0xaaf6, 0x0100, 0x0100,
                 "TrekStor",
@@ -127,6 +134,14 @@ UNUSUAL_DEV(  0x0436, 0x0005, 0x0100, 0x0100,
                 US_SC_SCSI, US_PR_DPCM_USB, NULL, 0 ),
 #endif
 
+/* Patch submitted by Daniel Drake <dsd@gentoo.org>
+ * Device reports nonsense bInterfaceProtocol 6 when connected over USB2 */
+UNUSUAL_DEV(  0x0451, 0x5416, 0x0100, 0x0100,
+                "Neuros Audio",
+                "USB 2.0 HD 2.5",
+                US_SC_DEVICE, US_PR_BULK, NULL,
+                US_FL_NEED_OVERRIDE ),
+
 /*
  * Pete Zaitcev <zaitcev@yahoo.com>, from Patrick C. F. Ernzer, bz#162559.
  * The key does not actually break, but it returns zero sense which
@@ -137,13 +152,16 @@ UNUSUAL_DEV(  0x0457, 0x0150, 0x0100, 0x0100,
                 "USB Mass Storage Device",
                 US_SC_DEVICE, US_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ),
 
-/* Patch submitted by Daniel Drake <dsd@gentoo.org>
- * Device reports nonsense bInterfaceProtocol 6 when connected over USB2 */
-UNUSUAL_DEV(  0x0451, 0x5416, 0x0100, 0x0100,
-                "Neuros Audio",
-                "USB 2.0 HD 2.5",
-                US_SC_DEVICE, US_PR_BULK, NULL,
-                US_FL_NEED_OVERRIDE ),
+/*
+* Bohdan Linda <bohdan.linda@gmail.com>
+* 1GB USB sticks MyFlash High Speed. I have restricted
+* the revision to my model only
+*/
+UNUSUAL_DEV(  0x0457, 0x0151, 0x0100, 0x0100,
+                "USB 2.0",
+                "Flash Disk",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE ),
 
 UNUSUAL_DEV(  0x045a, 0x5210, 0x0101, 0x0101,
                 "Rio",
@@ -735,6 +753,13 @@ UNUSUAL_DEV(  0x0693, 0x0005, 0x0100, 0x0100,
                 "Flashgate",
                 US_SC_SCSI, US_PR_BULK, NULL, 0 ), 
 
+/* Reported by David Hamilton <niftimusmaximus@lycos.com> */
+UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
+                "Thomson Multimedia Inc.",
+                "RCA RD1080 MP3 Player",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY ),
+
 UNUSUAL_DEV(  0x0781, 0x0001, 0x0200, 0x0200, 
                 "Sandisk",
                 "ImageMate SDDR-05a",
@@ -946,6 +971,12 @@ UNUSUAL_DEV(  0x084d, 0x0011, 0x0110, 0x0110,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_BULK32),
 
+/* Submitted by Jan De Luyck <lkml@kcore.org> */
+UNUSUAL_DEV(  0x08bd, 0x1100, 0x0000, 0x0000,
+                "CITIZEN",
+                "X1DE-USB",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_SINGLE_LUN),
 
 /* Entry needed for flags. Moreover, all devices with this ID use
  * bulk-only transport, but _some_ falsely report Control/Bulk instead.
@@ -1085,6 +1116,13 @@ UNUSUAL_DEV(  0x0dda, 0x0301, 0x0012, 0x0012,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Jim McCloskey <mcclosk@ucsc.edu> */
+UNUSUAL_DEV( 0x0e21, 0x0520, 0x0100, 0x0100,
+                "Cowon Systems",
+                "iAUDIO M5",
+                US_SC_DEVICE, US_PR_BULK, NULL,
+                0 ),
+
 /* Submitted by Antoine Mairesse <antoine.mairesse@free.fr> */
 UNUSUAL_DEV( 0x0ed1, 0x6660, 0x0100, 0x0300,
                 "USB",
@@ -1162,6 +1200,13 @@ UNUSUAL_DEV(  0x55aa, 0xa103, 0x0000, 0x9999,
                 US_FL_SINGLE_LUN),
 #endif
 
+/* Reported by Andrew Simmons <andrew.simmons@gmail.com> */
+UNUSUAL_DEV(  0xed06, 0x4500, 0x0001, 0x0001,
+                "DataStor",
+                "USB4500 FW1.04",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_FIX_CAPACITY),
+
 /* Control/Bulk transport for all SubClass values */
 USUAL_DEV(US_SC_RBC, US_PR_CB, USB_US_TYPE_STOR),
 USUAL_DEV(US_SC_8020, US_PR_CB, USB_US_TYPE_STOR),
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 3e153d313bb0..f5079c78ba4e 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -520,16 +520,11 @@ config FB_GBE
 config FB_GBE_MEM
         int "Video memory size in MB"
         depends on FB_GBE
-        default 8
+        default 4
         help
           This is the amount of memory reserved for the framebuffer,
           which can be any value between 1MB and 8MB.
 
-config BUS_I2C
-        bool
-        depends on (FB = y) && VISWS
-        default y
-
 config FB_SUN3
         bool "Sun3 framebuffer support"
         depends on (FB = y) && (SUN3 || SUN3X) && BROKEN
diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
index df8e5667b348..466042808daf 100644
--- a/drivers/video/arcfb.c
+++ b/drivers/video/arcfb.c
@@ -253,7 +253,7 @@ static void arcfb_lcd_update_page(struct arcfb_par *par, unsigned int upper,
 {
         unsigned char *src;
         unsigned int xindex, yindex, chipindex, linesize;
-        int i, count;
+        int i;
         unsigned char val;
         unsigned char bitmask, rightshift;
 
@@ -282,7 +282,6 @@ static void arcfb_lcd_update_page(struct arcfb_par *par, unsigned int upper,
                 }
                 ks108_writeb_data(par, chipindex, val);
                 left++;
-                count++;
                 if (bitmask == 0x80) {
                         bitmask = 1;
                         src++;
@@ -460,11 +459,11 @@ static ssize_t arcfb_write(struct file *file, const char __user *buf, size_t cou
         inode = file->f_dentry->d_inode;
         fbidx = iminor(inode);
         info = registered_fb[fbidx];
-        par = info->par;
 
         if (!info || !info->screen_base)
                 return -ENODEV;
 
+        par = info->par;
         xres = info->var.xres;
         fbmemlength = (xres * info->var.yres)/8;
 
diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index 69f75547865d..c924d81f7978 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -322,32 +322,29 @@ static int asiliantfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
         writeb(green, mmio_base + 0x791);
         writeb(blue, mmio_base + 0x791);
 
-        switch(p->var.bits_per_pixel) {
-        case 15:
-                if (regno < 16) {
+        if (regno < 16) {
+                switch(p->var.red.offset) {
+                case 10: /* RGB 555 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 ((red & 0xf8) << 7) |
                                 ((green & 0xf8) << 2) |
                                 ((blue & 0xf8) >> 3);
-                }
-                break;
-        case 16:
-                if (regno < 16) {
+                        break;
+                case 11: /* RGB 565 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 ((red & 0xf8) << 8) |
                                 ((green & 0xfc) << 3) |
                                 ((blue & 0xf8) >> 3);
-                }
-                break;
-        case 24:
-                if (regno < 24) {
+                        break;
+                case 16: /* RGB 888 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 (red << 16)  |
                                 (green << 8) |
                                 (blue);
+                        break;
                 }
-                break;
         }
+
         return 0;
 }
 
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index bfc8a93b2c73..620c9a934e0e 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1326,7 +1326,7 @@ static int aty128_var_to_pll(u32 period_in_ps, struct aty128_pll *pll,
         unsigned char post_dividers[] = {1,2,4,8,3,6,12};
         u32 output_freq;
         u32 vclk;        /* in .01 MHz */
-        int i;
+        int i = 0;
         u32 n, d;
 
         vclk = 100000000 / period_in_ps;        /* convert units to 10 kHz */
@@ -1340,15 +1340,16 @@ static int aty128_var_to_pll(u32 period_in_ps, struct aty128_pll *pll,
         /* now, find an acceptable divider */
         for (i = 0; i < sizeof(post_dividers); i++) {
                 output_freq = post_dividers[i] * vclk;
-                if (output_freq >= c.ppll_min && output_freq <= c.ppll_max)
+                if (output_freq >= c.ppll_min && output_freq <= c.ppll_max) {
+                        pll->post_divider = post_dividers[i];
                         break;
+                }
         }
 
         /* calculate feedback divider */
         n = c.ref_divider * output_freq;
         d = c.ref_clk;
 
-        pll->post_divider = post_dividers[i];
         pll->feedback_divider = round_div(n, d);
         pll->vclk = vclk;
 
diff --git a/drivers/video/aty/radeon_monitor.c b/drivers/video/aty/radeon_monitor.c
index 7f9838dceab5..98c05bc0de44 100644
--- a/drivers/video/aty/radeon_monitor.c
+++ b/drivers/video/aty/radeon_monitor.c
@@ -396,6 +396,10 @@ static int __devinit radeon_parse_monitor_layout(struct radeonfb_info *rinfo,
                                 s1[i] = *s;
                         i++;
                 }
+
+                if (i > 4)
+                        i = 4;
+
         } while (*s++);
         if (second)
                 s2[i] = 0;
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 556895e99645..1f8d805c61e5 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -1321,8 +1321,6 @@ static void radeon_pm_full_reset_sdram(struct radeonfb_info *rinfo)
         mdelay( 15);
 }
 
-#ifdef CONFIG_PPC_OF
-
 static void radeon_pm_reset_pad_ctlr_strength(struct radeonfb_info *rinfo)
 {
         u32 tmp, tmp2;
@@ -1836,6 +1834,8 @@ static void radeon_reinitialize_M10(struct radeonfb_info *rinfo)
         radeon_pm_m10_enable_lvds_spread_spectrum(rinfo);
 }
 
+#ifdef CONFIG_PPC_OF
+
 static void radeon_pm_m9p_reconfigure_mc(struct radeonfb_info *rinfo)
 {
         OUTREG(MC_CNTL, rinfo->save_regs[46]);
@@ -2728,13 +2728,23 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
                 printk("radeonfb: Dynamic Clock Power Management disabled\n");
         }
 
+#if defined(CONFIG_PM)
         /* Check if we can power manage on suspend/resume. We can do
          * D2 on M6, M7 and M9, and we can resume from D3 cold a few other
          * "Mac" cards, but that's all. We need more infos about what the
          * BIOS does tho. Right now, all this PM stuff is pmac-only for that
          * reason. --BenH
          */
-#if defined(CONFIG_PM) && defined(CONFIG_PPC_PMAC)
+        /* Special case for Samsung P35 laptops
+         */
+        if ((rinfo->pdev->vendor == PCI_VENDOR_ID_ATI) &&
+            (rinfo->pdev->device == PCI_CHIP_RV350_NP) &&
+            (rinfo->pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG) &&
+            (rinfo->pdev->subsystem_device == 0xc00c)) {
+                rinfo->reinit_func = radeon_reinitialize_M10;
+                rinfo->pm_mode |= radeon_pm_off;
+        }
+#if defined(CONFIG_PPC_PMAC)
         if (_machine == _MACH_Pmac && rinfo->of_node) {
                 if (rinfo->is_mobility && rinfo->pm_reg &&
                     rinfo->family <= CHIP_FAMILY_RV250)
@@ -2778,7 +2788,8 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
                 OUTREG(TV_DAC_CNTL, INREG(TV_DAC_CNTL) | 0x07000000);
 #endif
         }
-#endif /* defined(CONFIG_PM) && defined(CONFIG_PPC_PMAC) */
+#endif /* defined(CONFIG_PPC_PMAC) */
+#endif /* defined(CONFIG_PM) */
 }
 
 void radeonfb_pm_exit(struct radeonfb_info *rinfo)
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index 2406899f1207..3d04b2def0f1 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -49,6 +49,7 @@
 #include <linux/interrupt.h>
 #include <linux/ctype.h>
 #include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
 
 #include <asm/mach-au1x00/au1000.h>
 
@@ -406,7 +407,7 @@ int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
 
         vma->vm_flags |= VM_IO;
 
-        if (io_remap_page_range(vma, vma->vm_start, off,
+        if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
                                 vma->vm_end - vma->vm_start,
                                 vma->vm_page_prot)) {
                 return -EAGAIN;
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 9d5015e99372..151fda8dded0 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -13,7 +13,6 @@
 #include <linux/ctype.h>
 #include <linux/err.h>
 #include <linux/fb.h>
-#include <asm/bug.h>
 
 static ssize_t backlight_show_power(struct class_device *cdev, char *buf)
 {
@@ -173,7 +172,7 @@ struct backlight_device *backlight_device_register(const char *name, void *devda
 
         new_bd = kmalloc(sizeof(struct backlight_device), GFP_KERNEL);
         if (unlikely(!new_bd))
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
 
         init_MUTEX(&new_bd->sem);
         new_bd->props = bp;
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index 68c690605aa7..86908a60c630 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -13,7 +13,6 @@
 #include <linux/ctype.h>
 #include <linux/err.h>
 #include <linux/fb.h>
-#include <asm/bug.h>
 
 static ssize_t lcd_show_power(struct class_device *cdev, char *buf)
 {
@@ -172,7 +171,7 @@ struct lcd_device *lcd_device_register(const char *name, void *devdata,
 
         new_ld = kmalloc(sizeof(struct lcd_device), GFP_KERNEL);
         if (unlikely(!new_ld))
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
 
         init_MUTEX(&new_ld->sem);
         new_ld->props = lp;
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index a7bcd17112c0..0339f5640a78 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -30,10 +30,11 @@
 
 #define STI_DRIVERVERSION "Version 0.9a"
 
-struct sti_struct *default_sti;
+struct sti_struct *default_sti __read_mostly;
 
-static int num_sti_roms;                          /* # of STI ROMS found */
-static struct sti_struct *sti_roms[MAX_STI_ROMS]; /* ptr to each sti_struct */
+/* number of STI ROMS found and their ptrs to each struct */
+static int num_sti_roms __read_mostly;
+static struct sti_struct *sti_roms[MAX_STI_ROMS] __read_mostly;
 
 
 /* The colour indices used by STI are
@@ -266,7 +267,7 @@ sti_rom_copy(unsigned long base, unsigned long count, void *dest)
 
 
 
-static char default_sti_path[21];
+static char default_sti_path[21] __read_mostly;
 
 #ifndef MODULE
 static int __init sti_setup(char *str)
@@ -414,10 +415,10 @@ sti_init_glob_cfg(struct sti_struct *sti,
         if (!sti->sti_mem_request)
                 sti->sti_mem_request = 256; /* STI default */
 
-        glob_cfg = kmalloc(sizeof(*sti->glob_cfg), GFP_KERNEL);
-        glob_cfg_ext = kmalloc(sizeof(*glob_cfg_ext), GFP_KERNEL);
-        save_addr = kmalloc(save_addr_size, GFP_KERNEL);
-        sti_mem_addr = kmalloc(sti->sti_mem_request, GFP_KERNEL);
+        glob_cfg = kzalloc(sizeof(*sti->glob_cfg), GFP_KERNEL);
+        glob_cfg_ext = kzalloc(sizeof(*glob_cfg_ext), GFP_KERNEL);
+        save_addr = kzalloc(save_addr_size, GFP_KERNEL);
+        sti_mem_addr = kzalloc(sti->sti_mem_request, GFP_KERNEL);
 
         if (!(glob_cfg && glob_cfg_ext && save_addr && sti_mem_addr)) {
                 kfree(glob_cfg);
@@ -427,11 +428,6 @@ sti_init_glob_cfg(struct sti_struct *sti,
                 return -ENOMEM;
         }
 
-        memset(glob_cfg, 0, sizeof(*glob_cfg));
-        memset(glob_cfg_ext, 0, sizeof(*glob_cfg_ext));
-        memset(save_addr, 0, save_addr_size);
-        memset(sti_mem_addr, 0, sti->sti_mem_request);
-
         glob_cfg->ext_ptr = STI_PTR(glob_cfg_ext);
         glob_cfg->save_addr = STI_PTR(save_addr);
         for (i=0; i<8; i++) {
@@ -502,9 +498,9 @@ sti_init_glob_cfg(struct sti_struct *sti,
 
 #ifdef CONFIG_FB
 struct sti_cooked_font * __init
-sti_select_fbfont( struct sti_cooked_rom *cooked_rom, char *fbfont_name )
+sti_select_fbfont(struct sti_cooked_rom *cooked_rom, const char *fbfont_name)
 {
-        struct font_desc *fbfont;
+        const struct font_desc *fbfont;
         unsigned int size, bpc;
         void *dest;
         struct sti_rom_font *nf;
@@ -525,10 +521,9 @@ sti_select_fbfont( struct sti_cooked_rom *cooked_rom, char *fbfont_name )
         size = bpc * 256;
         size += sizeof(struct sti_rom_font);
 
-        nf = kmalloc(size, GFP_KERNEL);
+        nf = kzalloc(size, GFP_KERNEL);
         if (!nf)
                 return NULL;
-        memset(nf, 0, size);
 
         nf->first_char = 0;
         nf->last_char = 255;
@@ -544,7 +539,7 @@ sti_select_fbfont( struct sti_cooked_rom *cooked_rom, char *fbfont_name )
         dest += sizeof(struct sti_rom_font);
         memcpy(dest, fbfont->data, bpc*256);
 
-        cooked_font = kmalloc(sizeof(*cooked_font), GFP_KERNEL);
+        cooked_font = kzalloc(sizeof(*cooked_font), GFP_KERNEL);
         if (!cooked_font) {
                 kfree(nf);
                 return NULL;
@@ -559,7 +554,7 @@ sti_select_fbfont( struct sti_cooked_rom *cooked_rom, char *fbfont_name )
 }
 #else
 struct sti_cooked_font * __init
-sti_select_fbfont(struct sti_cooked_rom *cooked_rom, char *fbfont_name)
+sti_select_fbfont(struct sti_cooked_rom *cooked_rom, const char *fbfont_name)
 {
         return NULL;
 }
@@ -617,7 +612,7 @@ sti_cook_fonts(struct sti_cooked_rom *cooked_rom,
         struct sti_rom_font *raw_font, *font_start;
         struct sti_cooked_font *cooked_font;
         
-        cooked_font = kmalloc(sizeof(*cooked_font), GFP_KERNEL);
+        cooked_font = kzalloc(sizeof(*cooked_font), GFP_KERNEL);
         if (!cooked_font)
                 return 0;
 
@@ -631,7 +626,7 @@ sti_cook_fonts(struct sti_cooked_rom *cooked_rom,
         while (raw_font->next_font) {
                 raw_font = ((void *)font_start) + (raw_font->next_font);
 
-                cooked_font->next_font = kmalloc(sizeof(*cooked_font), GFP_KERNEL);
+                cooked_font->next_font = kzalloc(sizeof(*cooked_font), GFP_KERNEL);
                 if (!cooked_font->next_font)
                         return 1;
 
@@ -668,10 +663,9 @@ sti_bmode_font_raw(struct sti_cooked_font *f)
         unsigned char *n, *p, *q;
         int size = f->raw->bytes_per_char*256+sizeof(struct sti_rom_font);
         
-        n = kmalloc (4*size, GFP_KERNEL);
+        n = kzalloc (4*size, GFP_KERNEL);
         if (!n)
                 return NULL;
-        memset (n, 0, 4*size);
         p = n + 3;
         q = (unsigned char *)f->raw;
         while (size--) {
@@ -816,13 +810,12 @@ sti_try_rom_generic(unsigned long address, unsigned long hpa, struct pci_dev *pd
                 return NULL;
         }
         
-        sti = kmalloc(sizeof(*sti), GFP_KERNEL);
+        sti = kzalloc(sizeof(*sti), GFP_KERNEL);
         if (!sti) {
                 printk(KERN_ERR "Not enough memory !\n");
                 return NULL;
         }
 
-        memset(sti, 0, sizeof(*sti));
         spin_lock_init(&sti->lock);
 
 test_rom:
@@ -1035,7 +1028,7 @@ static struct parisc_driver pa_sti_driver = {
  * sti_init_roms() - detects all STI ROMs and stores them in sti_roms[]
  */
 
-static int sticore_initialized;
+static int sticore_initialized __read_mostly;
 
 static void __init sti_init_roms(void)
 {
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 12d9329d1408..5a86978537d2 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -509,57 +509,60 @@ static int vgacon_doresize(struct vc_data *c,
 {
         unsigned long flags;
         unsigned int scanlines = height * c->vc_font.height;
-        u8 scanlines_lo, r7, vsync_end, mode, max_scan;
+        u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
 
         spin_lock_irqsave(&vga_lock, flags);
 
-        outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
-        max_scan = inb_p(vga_video_port_val);
-
-        if (max_scan & 0x80)
-                scanlines <<= 1;
-
         vgacon_xres = width * VGA_FONTWIDTH;
         vgacon_yres = height * c->vc_font.height;
-        outb_p(VGA_CRTC_MODE, vga_video_port_reg);
-        mode = inb_p(vga_video_port_val);
+        if (vga_video_type >= VIDEO_TYPE_VGAC) {
+                outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
+                max_scan = inb_p(vga_video_port_val);
 
-        if (mode & 0x04)
-                scanlines >>= 1;
+                if (max_scan & 0x80)
+                        scanlines <<= 1;
 
-        scanlines -= 1;
-        scanlines_lo = scanlines & 0xff;
+                outb_p(VGA_CRTC_MODE, vga_video_port_reg);
+                mode = inb_p(vga_video_port_val);
 
-        outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
-        r7 = inb_p(vga_video_port_val) & ~0x42;
+                if (mode & 0x04)
+                        scanlines >>= 1;
 
-        if (scanlines & 0x100)
-                r7 |= 0x02;
-        if (scanlines & 0x200)
-                r7 |= 0x40;
+                scanlines -= 1;
+                scanlines_lo = scanlines & 0xff;
 
-        /* deprotect registers */
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        vsync_end = inb_p(vga_video_port_val);
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        outb_p(vsync_end & ~0x80, vga_video_port_val);
+                outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                r7 = inb_p(vga_video_port_val) & ~0x42;
+
+                if (scanlines & 0x100)
+                        r7 |= 0x02;
+                if (scanlines & 0x200)
+                        r7 |= 0x40;
+
+                /* deprotect registers */
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                vsync_end = inb_p(vga_video_port_val);
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                outb_p(vsync_end & ~0x80, vga_video_port_val);
+        }
 
         outb_p(VGA_CRTC_H_DISP, vga_video_port_reg);
         outb_p(width - 1, vga_video_port_val);
         outb_p(VGA_CRTC_OFFSET, vga_video_port_reg);
         outb_p(width >> 1, vga_video_port_val);
 
-        outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
-        outb_p(scanlines_lo, vga_video_port_val);
-        outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
-        outb_p(r7,vga_video_port_val);
+        if (vga_video_type >= VIDEO_TYPE_VGAC) {
+                outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
+                outb_p(scanlines_lo, vga_video_port_val);
+                outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                outb_p(r7,vga_video_port_val);
 
-        /* reprotect registers */
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        outb_p(vsync_end, vga_video_port_val);
+                /* reprotect registers */
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                outb_p(vsync_end, vga_video_port_val);
+        }
 
         spin_unlock_irqrestore(&vga_lock, flags);
-
         return 0;
 }
 
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index d2dede6ed3e5..996c7b58564e 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1550,6 +1550,7 @@ int fb_get_options(char *name, char **option)
         return retval;
 }
 
+#ifndef MODULE
 /**
  *      video_setup - process command line options
  *      @options: string of options
@@ -1593,6 +1594,7 @@ static int __init video_setup(char *options)
         return 0;
 }
 __setup("video=", video_setup);
+#endif
 
     /*
      *  Visible symbols for modules
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index 38d22729b129..5e25b9860196 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -656,12 +656,15 @@ static int gbefb_set_par(struct fb_info *info)
         switch (bytesPerPixel) {
         case 1:
                 SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_I8);
+                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
                 break;
         case 2:
                 SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_ARGB5);
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                 break;
         case 4:
                 SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_RGB8);
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                 break;
         }
         SET_GBE_FIELD(WID, BUF, val, GBE_BMODE_BOTH);
@@ -1243,7 +1246,7 @@ static int __devexit gbefb_remove(struct platform_device* p_dev)
                           (void *)gbe_tiles.cpu, gbe_tiles.dma);
         release_mem_region(GBE_BASE, sizeof(struct sgi_gbe));
         iounmap(gbe);
-        gbefb_remove_sysfs(dev);
+        gbefb_remove_sysfs(&p_dev->dev);
         framebuffer_release(info);
 
         return 0;
diff --git a/drivers/video/imsttfb.c b/drivers/video/imsttfb.c
index ad416ae47596..7db42542eb19 100644
--- a/drivers/video/imsttfb.c
+++ b/drivers/video/imsttfb.c
@@ -1510,6 +1510,8 @@ imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 default:
                         printk(KERN_INFO "imsttfb: Device 0x%x unknown, "
                                          "contact maintainer.\n", pdev->device);
+                        release_mem_region(addr, size);
+                        framebuffer_release(info);
                         return -ENODEV;
         }
 
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 6b8bd3cdf9c0..995b47c165a7 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
         if (regno > 255)
                 return 1;
 
-        switch (dinfo->depth) {
-        case 8:
-                {
-                        red >>= 8;
-                        green >>= 8;
-                        blue >>= 8;
+        if (dinfo->depth == 8) {
+                red >>= 8;
+                green >>= 8;
+                blue >>= 8;
+
+                intelfbhw_setcolreg(dinfo, regno, red, green, blue,
+                                    transp);
+        }
 
-                        intelfbhw_setcolreg(dinfo, regno, red, green, blue,
-                                            transp);
+        if (regno < 16) {
+                switch (dinfo->depth) {
+                case 15:
+                        dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
+                                ((green & 0xf800) >>  6) |
+                                ((blue & 0xf800) >> 11);
+                        break;
+                case 16:
+                        dinfo->pseudo_palette[regno] = (red & 0xf800) |
+                                ((green & 0xfc00) >>  5) |
+                                ((blue  & 0xf800) >> 11);
+                        break;
+                case 24:
+                        dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
+                                (green & 0xff00) |
+                                ((blue  & 0xff00) >> 8);
+                        break;
                 }
-                break;
-        case 15:
-                dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
-                                               ((green & 0xf800) >>  6) |
-                                               ((blue & 0xf800) >> 11);
-                break;
-        case 16:
-                dinfo->pseudo_palette[regno] = (red & 0xf800) |
-                                               ((green & 0xfc00) >>  5) |
-                                               ((blue  & 0xf800) >> 11);
-                break;
-        case 24:
-                dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
-                                               (green & 0xff00) |
-                                               ((blue  & 0xff00) >> 8);
-                break;
         }
+
         return 0;
 }
 
diff --git a/drivers/video/kyro/STG4000VTG.c b/drivers/video/kyro/STG4000VTG.c
index 3690b04190af..bd389709d234 100644
--- a/drivers/video/kyro/STG4000VTG.c
+++ b/drivers/video/kyro/STG4000VTG.c
@@ -17,7 +17,7 @@
 void DisableVGA(volatile STG4000REG __iomem *pSTGReg)
 {
         u32 tmp;
-        volatile u32 count, i;
+        volatile u32 count = 0, i;
 
         /* Reset the VGA registers */
         tmp = STG_READ_REG(SoftwareReset);
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 747602aa5615..b961d5601bd9 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -486,10 +486,8 @@ static void vgaHWRestore(const struct fb_info *info,
 static inline int neo2200_sync(struct fb_info *info)
 {
         struct neofb_par *par = info->par;
-        int waitcycles;
 
-        while (readl(&par->neo2200->bltStat) & 1)
-                waitcycles++;
+        while (readl(&par->neo2200->bltStat) & 1);
         return 0;
 }
 
@@ -843,6 +841,9 @@ static int neofb_set_par(struct fb_info *info)
 
         par->SysIfaceCntl2 = 0xc0;      /* VESA Bios sets this to 0x80! */
 
+        /* Initialize: by default, we want display config register to be read */
+        par->PanelDispCntlRegRead = 1;
+
         /* Enable any user specified display devices. */
         par->PanelDispCntlReg1 = 0x00;
         if (par->internal_display)
@@ -1334,6 +1335,18 @@ static int neofb_blank(int blank_mode, struct fb_info *info)
         struct neofb_par *par = info->par;
         int seqflags, lcdflags, dpmsflags, reg;
 
+
+        /*
+         * Reload the value stored in the register, if sensible. It might have
+         * been changed via FN keystroke.
+         */
+        if (par->PanelDispCntlRegRead) {
+                neoUnlock();
+                par->PanelDispCntlReg1 = vga_rgfx(NULL, 0x20) & 0x03;
+                neoLock(&par->state);
+        }
+        par->PanelDispCntlRegRead = !blank_mode;
+
         switch (blank_mode) {
         case FB_BLANK_POWERDOWN:        /* powerdown - both sync lines down */
                 seqflags = VGA_SR01_SCREEN_OFF; /* Disable sequencer */
@@ -1366,7 +1379,7 @@ static int neofb_blank(int blank_mode, struct fb_info *info)
         case FB_BLANK_NORMAL:           /* just blank screen (backlight stays on) */
                 seqflags = VGA_SR01_SCREEN_OFF; /* Disable sequencer */
                 lcdflags = par->PanelDispCntlReg1 & 0x02; /* LCD normal */
-                dpmsflags = 0;                  /* no hsync/vsync suppression */
+                dpmsflags = 0x00;       /* no hsync/vsync suppression */
                 break;
         case FB_BLANK_UNBLANK:          /* unblank */
                 seqflags = 0;                   /* Enable sequencer */
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index dbcb8962e57d..a7c4e5e8ead6 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -138,6 +138,8 @@ static struct pci_device_id nvidiafb_pci_tbl[] = {
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         {PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_GEFORCE4_MX_420_8X,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        {PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_GEFORCE4_MX_4000,
+         PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         {PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_GEFORCE4_448_GO,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         {PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_GEFORCE4_488_GO,
diff --git a/drivers/video/pmag-ba-fb.c b/drivers/video/pmag-ba-fb.c
index f3927b6cda9d..f5361cd8ccce 100644
--- a/drivers/video/pmag-ba-fb.c
+++ b/drivers/video/pmag-ba-fb.c
@@ -30,7 +30,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 
-#include <asm/bug.h>
 #include <asm/io.h>
 #include <asm/system.h>
 
diff --git a/drivers/video/pmagb-b-fb.c b/drivers/video/pmagb-b-fb.c
index 25148de5fe67..eeeac924b500 100644
--- a/drivers/video/pmagb-b-fb.c
+++ b/drivers/video/pmagb-b-fb.c
@@ -27,7 +27,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 
-#include <asm/bug.h>
 #include <asm/io.h>
 #include <asm/system.h>
 
diff --git a/drivers/video/s1d13xxxfb.c b/drivers/video/s1d13xxxfb.c
index e5d0f92eeae3..feec47bdd479 100644
--- a/drivers/video/s1d13xxxfb.c
+++ b/drivers/video/s1d13xxxfb.c
@@ -588,6 +588,7 @@ s1d13xxxfb_probe(struct platform_device *pdev)
                 goto bail;
         }
 
+        platform_set_drvdata(pdev, info);
         default_par = info->par;
         default_par->regs = ioremap_nocache(pdev->resource[1].start,
                         pdev->resource[1].end - pdev->resource[1].start +1);
@@ -638,8 +639,6 @@ s1d13xxxfb_probe(struct platform_device *pdev)
                 goto bail;
         }
 
-        platform_set_drvdata(pdev, info);
-
         printk(KERN_INFO "fb%d: %s frame buffer device\n",
                info->node, info->fix.id);
 
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index d574dd3c9c8a..9451932fbaf2 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -82,7 +82,6 @@
 #include <linux/fb.h>
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
-#include <linux/string.h>
 #include <linux/interrupt.h>
 #include <linux/workqueue.h>
 #include <linux/wait.h>
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index ab727eaa7f43..10e6b3aab9ea 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -2021,8 +2021,8 @@ static int __devinit savagefb_probe (struct pci_dev* dev,
 #if defined(CONFIG_FB_SAVAGE_I2C)
         savagefb_create_i2c_busses(info);
         savagefb_probe_i2c_connector(info, &par->edid);
-        kfree(par->edid);
         fb_edid_to_monspecs(par->edid, &info->monspecs);
+        kfree(par->edid);
         fb_videomode_to_modelist(info->monspecs.modedb,
                                  info->monspecs.modedb_len,
                                  &info->modelist);
diff --git a/drivers/video/tdfxfb.c b/drivers/video/tdfxfb.c
index 3e7baf4c9fa8..5e5328d682db 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/tdfxfb.c
@@ -786,28 +786,32 @@ static int tdfxfb_setcolreg(unsigned regno, unsigned red, unsigned green,
         if (regno >= info->cmap.len || regno > 255) return 1;
    
         switch (info->fix.visual) {
-                case FB_VISUAL_PSEUDOCOLOR:
-                        rgbcol =(((u32)red   & 0xff00) << 8) |
-                                (((u32)green & 0xff00) << 0) |
-                                (((u32)blue  & 0xff00) >> 8);
-                        do_setpalentry(par, regno, rgbcol);
-                        break;
-                /* Truecolor has no hardware color palettes. */
-                case FB_VISUAL_TRUECOLOR:
+        case FB_VISUAL_PSEUDOCOLOR:
+                rgbcol =(((u32)red   & 0xff00) << 8) |
+                        (((u32)green & 0xff00) << 0) |
+                        (((u32)blue  & 0xff00) >> 8);
+                do_setpalentry(par, regno, rgbcol);
+                break;
+        /* Truecolor has no hardware color palettes. */
+        case FB_VISUAL_TRUECOLOR:
+                if (regno < 16) {
                         rgbcol = (CNVT_TOHW( red, info->var.red.length) <<
                                   info->var.red.offset) |
-                                 (CNVT_TOHW( green, info->var.green.length) <<
-                                  info->var.green.offset) |
-                                 (CNVT_TOHW( blue, info->var.blue.length) <<
-                                  info->var.blue.offset) |
-                                 (CNVT_TOHW( transp, info->var.transp.length) <<
-                                  info->var.transp.offset);
-                                par->palette[regno] = rgbcol;
-                        break;
-                default:
-                        DPRINTK("bad depth %u\n", info->var.bits_per_pixel);
-                        break;
+                                (CNVT_TOHW( green, info->var.green.length) <<
+                                 info->var.green.offset) |
+                                (CNVT_TOHW( blue, info->var.blue.length) <<
+                                 info->var.blue.offset) |
+                                (CNVT_TOHW( transp, info->var.transp.length) <<
+                                 info->var.transp.offset);
+                        par->palette[regno] = rgbcol;
+                }
+
+                break;
+        default:
+                DPRINTK("bad depth %u\n", info->var.bits_per_pixel);
+                break;
         }
+
         return 0;
 }
 
diff --git a/fs/9p/9p.c b/fs/9p/9p.c
index 1a6d08761f39..f86a28d1d6a6 100644
--- a/fs/9p/9p.c
+++ b/fs/9p/9p.c
@@ -111,7 +111,6 @@ static void v9fs_t_clunk_cb(void *a, struct v9fs_fcall *tc,
         if (!rc)
                 return;
 
-        dprintk(DEBUG_9P, "tcall id %d rcall id %d\n", tc->id, rc->id);
         v9ses = a;
         if (rc->id == RCLUNK)
                 v9fs_put_idpool(fid, &v9ses->fidpool);
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index eda449778fa5..c4d13bf904d2 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -1,7 +1,7 @@
 /*
  * V9FS FID Management
  *
- *  Copyright (C) 2005 by Eric Van Hensbergen <ericvh@gmail.com>
+ *  Copyright (C) 2005, 2006 by Eric Van Hensbergen <ericvh@gmail.com>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -40,7 +40,7 @@
  *
  */
 
-static int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry)
+int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry)
 {
         struct list_head *fid_list = (struct list_head *)dentry->d_fsdata;
         dprintk(DEBUG_9P, "fid %d (%p) dentry %s (%p)\n", fid->fid, fid,
@@ -57,7 +57,6 @@ static int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry)
         }
 
         fid->uid = current->uid;
-        fid->pid = current->pid;
         list_add(&fid->list, fid_list);
         return 0;
 }
@@ -68,14 +67,11 @@ static int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry)
  *
  */
 
-struct v9fs_fid *v9fs_fid_create(struct dentry *dentry,
-        struct v9fs_session_info *v9ses, int fid, int create)
+struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *v9ses, int fid)
 {
         struct v9fs_fid *new;
 
-        dprintk(DEBUG_9P, "fid create dentry %p, fid %d, create %d\n",
-                dentry, fid, create);
-
+        dprintk(DEBUG_9P, "fid create fid %d\n", fid);
         new = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
         if (new == NULL) {
                 dprintk(DEBUG_ERROR, "Out of Memory\n");
@@ -85,19 +81,13 @@ struct v9fs_fid *v9fs_fid_create(struct dentry *dentry,
         new->fid = fid;
         new->v9ses = v9ses;
         new->fidopen = 0;
-        new->fidcreate = create;
         new->fidclunked = 0;
         new->iounit = 0;
         new->rdir_pos = 0;
         new->rdir_fcall = NULL;
+        INIT_LIST_HEAD(&new->list);
 
-        if (v9fs_fid_insert(new, dentry) == 0)
-                return new;
-        else {
-                dprintk(DEBUG_ERROR, "Problems inserting to dentry\n");
-                kfree(new);
-                return NULL;
-        }
+        return new;
 }
 
 /**
@@ -113,140 +103,29 @@ void v9fs_fid_destroy(struct v9fs_fid *fid)
 }
 
 /**
- * v9fs_fid_walk_up - walks from the process current directory
- *      up to the specified dentry.
- */
-static struct v9fs_fid *v9fs_fid_walk_up(struct dentry *dentry)
-{
-        int fidnum, cfidnum, err;
-        struct v9fs_fid *cfid;
-        struct dentry *cde;
-        struct v9fs_session_info *v9ses;
-
-        v9ses = v9fs_inode2v9ses(current->fs->pwd->d_inode);
-        cfid = v9fs_fid_lookup(current->fs->pwd);
-        if (cfid == NULL) {
-                dprintk(DEBUG_ERROR, "process cwd doesn't have a fid\n");
-                return ERR_PTR(-ENOENT);
-        }
-
-        cfidnum = cfid->fid;
-        cde = current->fs->pwd;
-        /* TODO: take advantage of multiwalk */
-
-        fidnum = v9fs_get_idpool(&v9ses->fidpool);
-        if (fidnum < 0) {
-                dprintk(DEBUG_ERROR, "could not get a new fid num\n");
-                err = -ENOENT;
-                goto clunk_fid;
-        }
-
-        while (cde != dentry) {
-                if (cde == cde->d_parent) {
-                        dprintk(DEBUG_ERROR, "can't find dentry\n");
-                        err = -ENOENT;
-                        goto clunk_fid;
-                }
-
-                err = v9fs_t_walk(v9ses, cfidnum, fidnum, "..", NULL);
-                if (err < 0) {
-                        dprintk(DEBUG_ERROR, "problem walking to parent\n");
-                        goto clunk_fid;
-                }
-
-                cfidnum = fidnum;
-                cde = cde->d_parent;
-        }
-
-        return v9fs_fid_create(dentry, v9ses, fidnum, 0);
-
-clunk_fid:
-        v9fs_t_clunk(v9ses, fidnum);
-        return ERR_PTR(err);
-}
-
-/**
  * v9fs_fid_lookup - retrieve the right fid from a  particular dentry
  * @dentry: dentry to look for fid in
  * @type: intent of lookup (operation or traversal)
  *
- * search list of fids associated with a dentry for a fid with a matching
- * thread id or uid.  If that fails, look up the dentry's parents to see if you
- * can find a matching fid.
+ * find a fid in the dentry
+ *
+ * TODO: only match fids that have the same uid as current user
  *
  */
 
 struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry)
 {
         struct list_head *fid_list = (struct list_head *)dentry->d_fsdata;
-        struct v9fs_fid *current_fid = NULL;
-        struct v9fs_fid *temp = NULL;
         struct v9fs_fid *return_fid = NULL;
 
         dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);
 
-        if (fid_list) {
-                list_for_each_entry_safe(current_fid, temp, fid_list, list) {
-                        if (!current_fid->fidcreate) {
-                                return_fid = current_fid;
-                                break;
-                        }
-                }
-
-                if (!return_fid)
-                        return_fid = current_fid;
-        }
-
-        /* we are at the root but didn't match */
-        if ((!return_fid) && (dentry->d_parent == dentry)) {
-                /* TODO: clone attach with new uid */
-                return_fid = current_fid;
-        }
+        if (fid_list)
+                return_fid = list_entry(fid_list->next, struct v9fs_fid, list);
 
         if (!return_fid) {
-                struct dentry *par = current->fs->pwd->d_parent;
-                int count = 1;
-                while (par != NULL) {
-                        if (par == dentry)
-                                break;
-                        count++;
-                        if (par == par->d_parent) {
-                                dprintk(DEBUG_ERROR,
-                                        "got to root without finding dentry\n");
-                                break;
-                        }
-                        par = par->d_parent;
-                }
-
-/* XXX - there may be some duplication we can get rid of */
-                if (par == dentry) {
-                        return_fid = v9fs_fid_walk_up(dentry);
-                        if (IS_ERR(return_fid))
-                                return_fid = NULL;
-                }
+                dprintk(DEBUG_ERROR, "Couldn't find a fid in dentry\n");
         }
 
         return return_fid;
 }
-
-struct v9fs_fid *v9fs_fid_get_created(struct dentry *dentry)
-{
-        struct list_head *fid_list;
-        struct v9fs_fid *fid, *ftmp, *ret;
-
-        dprintk(DEBUG_9P, " dentry: %s (%p)\n", dentry->d_iname, dentry);
-        fid_list = (struct list_head *)dentry->d_fsdata;
-        ret = NULL;
-        if (fid_list) {
-                list_for_each_entry_safe(fid, ftmp, fid_list, list) {
-                        if (fid->fidcreate && fid->pid == current->pid) {
-                                list_del(&fid->list);
-                                ret = fid;
-                                break;
-                        }
-                }
-        }
-
-        dprintk(DEBUG_9P, "return %p\n", ret);
-        return ret;
-}
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index 84c673a44c83..1fc2dd08d75a 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -33,7 +33,6 @@ struct v9fs_fid {
 
         u32 fid;
         unsigned char fidopen;    /* set when fid is opened */
-        unsigned char fidcreate;  /* set when fid was just created */
         unsigned char fidclunked; /* set when fid has already been clunked */
 
         struct v9fs_qid qid;
@@ -45,7 +44,6 @@ struct v9fs_fid {
         struct v9fs_fcall *rdir_fcall;
 
         /* management stuff */
-        pid_t pid;              /* thread associated with this fid */
         uid_t uid;              /* user associated with this fid */
 
         /* private data */
@@ -56,5 +54,5 @@ struct v9fs_fid {
 struct v9fs_fid *v9fs_fid_lookup(struct dentry *dentry);
 struct v9fs_fid *v9fs_fid_get_created(struct dentry *);
 void v9fs_fid_destroy(struct v9fs_fid *fid);
-struct v9fs_fid *v9fs_fid_create(struct dentry *,
-        struct v9fs_session_info *v9ses, int fid, int create);
+struct v9fs_fid *v9fs_fid_create(struct v9fs_session_info *, int fid);
+int v9fs_fid_insert(struct v9fs_fid *fid, struct dentry *dentry);
diff --git a/fs/9p/trans_fd.c b/fs/9p/trans_fd.c
index 1a28ef97a3d1..5b2ce21b10fa 100644
--- a/fs/9p/trans_fd.c
+++ b/fs/9p/trans_fd.c
@@ -80,6 +80,7 @@ static int v9fs_fd_send(struct v9fs_transport *trans, void *v, int len)
         if (!trans || trans->status != Connected || !ts)
                 return -EIO;
 
+        oldfs = get_fs();
         set_fs(get_ds());
         /* The cast to a user pointer is valid due to the set_fs() */
         ret = vfs_write(ts->out_file, (void __user *)v, len, &ts->out_file->f_pos);
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 5250c428fc1f..61352491ba36 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -66,7 +66,7 @@ static match_table_t tokens = {
         {Opt_afid, "afid=%u"},
         {Opt_rfdno, "rfdno=%u"},
         {Opt_wfdno, "wfdno=%u"},
-        {Opt_debug, "debug=%u"},
+        {Opt_debug, "debug=%x"},
         {Opt_name, "name=%s"},
         {Opt_remotename, "aname=%s"},
         {Opt_unix, "proto=unix"},
@@ -397,6 +397,7 @@ v9fs_session_init(struct v9fs_session_info *v9ses,
         }
 
         if (v9ses->afid != ~0) {
+                dprintk(DEBUG_ERROR, "afid not equal to ~0\n");
                 if (v9fs_t_clunk(v9ses, v9ses->afid))
                         dprintk(DEBUG_ERROR, "clunk failed\n");
         }
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 69cf2905dc90..a759278acaae 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -51,3 +51,4 @@ int v9fs_dir_release(struct inode *inode, struct file *filp);
 int v9fs_file_open(struct inode *inode, struct file *file);
 void v9fs_inode2stat(struct inode *inode, struct v9fs_stat *stat);
 void v9fs_dentry_release(struct dentry *);
+int v9fs_uflags2omode(int uflags);
diff --git a/fs/9p/vfs_dentry.c b/fs/9p/vfs_dentry.c
index 2dd806dac9f1..12c9cc926b71 100644
--- a/fs/9p/vfs_dentry.c
+++ b/fs/9p/vfs_dentry.c
@@ -43,47 +43,18 @@
 #include "fid.h"
 
 /**
- * v9fs_dentry_validate - VFS dcache hook to validate cache
- * @dentry:  dentry that is being validated
- * @nd: path data
+ * v9fs_dentry_delete - called when dentry refcount equals 0
+ * @dentry:  dentry in question
  *
- * dcache really shouldn't be used for 9P2000 as at all due to
- * potential attached semantics to directory traversal (walk).
- *
- * FUTURE: look into how to use dcache to allow multi-stage
- * walks in Plan 9 & potential for better dcache operation which
- * would remain valid for Plan 9 semantics.  Older versions
- * had validation via stat for those interested.  However, since
- * stat has the same approximate overhead as walk there really
- * is no difference.  The only improvement would be from a
- * time-decay cache like NFS has and that undermines the
- * synchronous nature of 9P2000.
+ * By returning 1 here we should remove cacheing of unused
+ * dentry components.
  *
  */
 
-static int v9fs_dentry_validate(struct dentry *dentry, struct nameidata *nd)
+int v9fs_dentry_delete(struct dentry *dentry)
 {
-        struct dentry *dc = current->fs->pwd;
-
-        dprintk(DEBUG_VFS, "dentry: %s (%p)\n", dentry->d_iname, dentry);
-        if (v9fs_fid_lookup(dentry)) {
-                dprintk(DEBUG_VFS, "VALID\n");
-                return 1;
-        }
-
-        while (dc != NULL) {
-                if (dc == dentry) {
-                        dprintk(DEBUG_VFS, "VALID\n");
-                        return 1;
-                }
-                if (dc == dc->d_parent)
-                        break;
-
-                dc = dc->d_parent;
-        }
-
-        dprintk(DEBUG_VFS, "INVALID\n");
-        return 0;
+        dprintk(DEBUG_VFS, " dentry: %s (%p)\n", dentry->d_iname, dentry);
+        return 1;
 }
 
 /**
@@ -118,6 +89,6 @@ void v9fs_dentry_release(struct dentry *dentry)
 }
 
 struct dentry_operations v9fs_dentry_operations = {
-        .d_revalidate = v9fs_dentry_validate,
+        .d_delete = v9fs_dentry_delete,
         .d_release = v9fs_dentry_release,
 };
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index ae6d032b9b59..cd5eeb032d64 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -202,7 +202,6 @@ int v9fs_dir_release(struct inode *inode, struct file *filp)
                 filp->private_data = NULL;
         }
 
-        d_drop(filp->f_dentry);
         return 0;
 }
 
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index c7e14d917215..de3a129698da 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -53,94 +53,70 @@
 int v9fs_file_open(struct inode *inode, struct file *file)
 {
         struct v9fs_session_info *v9ses = v9fs_inode2v9ses(inode);
-        struct v9fs_fid *v9fid, *fid;
+        struct v9fs_fid *vfid;
         struct v9fs_fcall *fcall = NULL;
-        int open_mode = 0;
-        unsigned int iounit = 0;
-        int newfid = -1;
-        long result = -1;
+        int omode;
+        int fid = V9FS_NOFID;
+        int err;
 
         dprintk(DEBUG_VFS, "inode: %p file: %p \n", inode, file);
 
-        v9fid = v9fs_fid_get_created(file->f_dentry);
-        if (!v9fid)
-                v9fid = v9fs_fid_lookup(file->f_dentry);
-
-        if (!v9fid) {
+        vfid = v9fs_fid_lookup(file->f_dentry);
+        if (!vfid) {
                 dprintk(DEBUG_ERROR, "Couldn't resolve fid from dentry\n");
                 return -EBADF;
         }
 
-        if (!v9fid->fidcreate) {
-                fid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
-                if (fid == NULL) {
-                        dprintk(DEBUG_ERROR, "Out of Memory\n");
-                        return -ENOMEM;
-                }
-
-                fid->fidopen = 0;
-                fid->fidcreate = 0;
-                fid->fidclunked = 0;
-                fid->iounit = 0;
-                fid->v9ses = v9ses;
-
-                newfid = v9fs_get_idpool(&v9ses->fidpool);
-                if (newfid < 0) {
+        fid = v9fs_get_idpool(&v9ses->fidpool);
+        if (fid < 0) {
                         eprintk(KERN_WARNING, "newfid fails!\n");
                         return -ENOSPC;
                 }
 
-                result =
-                    v9fs_t_walk(v9ses, v9fid->fid, newfid, NULL, NULL);
-
-                if (result < 0) {
-                        v9fs_put_idpool(newfid, &v9ses->fidpool);
+        err = v9fs_t_walk(v9ses, vfid->fid, fid, NULL, NULL);
+        if (err < 0) {
                         dprintk(DEBUG_ERROR, "rewalk didn't work\n");
-                        return -EBADF;
+                goto put_fid;
+        }
+
+        vfid = kmalloc(sizeof(struct v9fs_fid), GFP_KERNEL);
+        if (vfid == NULL) {
+                dprintk(DEBUG_ERROR, "out of memory\n");
+                goto clunk_fid;
                 }
 
-                fid->fid = newfid;
-                v9fid = fid;
                 /* TODO: do special things for O_EXCL, O_NOFOLLOW, O_SYNC */
                 /* translate open mode appropriately */
-                open_mode = file->f_flags & 0x3;
+        omode = v9fs_uflags2omode(file->f_flags);
+        err = v9fs_t_open(v9ses, fid, omode, &fcall);
+        if (err < 0) {
+                PRINT_FCALL_ERROR("open failed", fcall);
+                goto destroy_vfid;
+        }
 
-                if (file->f_flags & O_EXCL)
-                        open_mode |= V9FS_OEXCL;
+        file->private_data = vfid;
+        vfid->fid = fid;
+        vfid->fidopen = 1;
+        vfid->fidclunked = 0;
+        vfid->iounit = fcall->params.ropen.iounit;
+        vfid->rdir_pos = 0;
+        vfid->rdir_fcall = NULL;
+        vfid->filp = file;
+        kfree(fcall);
 
-                if (v9ses->extended) {
-                        if (file->f_flags & O_TRUNC)
-                                open_mode |= V9FS_OTRUNC;
+        return 0;
 
-                        if (file->f_flags & O_APPEND)
-                                open_mode |= V9FS_OAPPEND;
-                }
+destroy_vfid:
+        v9fs_fid_destroy(vfid);
 
-                result = v9fs_t_open(v9ses, newfid, open_mode, &fcall);
-                if (result < 0) {
-                        PRINT_FCALL_ERROR("open failed", fcall);
-                        kfree(fcall);
-                        return result;
-                }
+clunk_fid:
+        v9fs_t_clunk(v9ses, fid);
 
-                iounit = fcall->params.ropen.iounit;
+put_fid:
+        v9fs_put_idpool(fid, &v9ses->fidpool);
                 kfree(fcall);
-        } else {
-                /* create case */
-                newfid = v9fid->fid;
-                iounit = v9fid->iounit;
-                v9fid->fidcreate = 0;
-        }
-
-        file->private_data = v9fid;
-
-        v9fid->rdir_pos = 0;
-        v9fid->rdir_fcall = NULL;
-        v9fid->fidopen = 1;
-        v9fid->filp = file;
-        v9fid->iounit = iounit;
 
-        return 0;
+        return err;
 }
 
 /**
@@ -289,9 +265,7 @@ v9fs_file_write(struct file *filp, const char __user * data,
                 total += result;
         } while (count);
 
-        if(inode->i_mapping->nrpages)
                 invalidate_inode_pages2(inode->i_mapping);
-
         return total;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 63e5b0398e8b..3ad8455f8577 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -125,6 +125,38 @@ static int p9mode2unixmode(struct v9fs_session_info *v9ses, int mode)
         return res;
 }
 
+int v9fs_uflags2omode(int uflags)
+{
+        int ret;
+
+        ret = 0;
+        switch (uflags&3) {
+        default:
+        case O_RDONLY:
+                ret = V9FS_OREAD;
+                break;
+
+        case O_WRONLY:
+                ret = V9FS_OWRITE;
+                break;
+
+        case O_RDWR:
+                ret = V9FS_ORDWR;
+                break;
+        }
+
+        if (uflags & O_EXCL)
+                ret |= V9FS_OEXCL;
+
+        if (uflags & O_TRUNC)
+                ret |= V9FS_OTRUNC;
+
+        if (uflags & O_APPEND)
+                ret |= V9FS_OAPPEND;
+
+        return ret;
+}
+
 /**
  * v9fs_blank_wstat - helper function to setup a 9P stat structure
  * @v9ses: 9P session info (for determining extended mode)
@@ -163,7 +195,7 @@ v9fs_blank_wstat(struct v9fs_wstat *wstat)
 
 struct inode *v9fs_get_inode(struct super_block *sb, int mode)
 {
-        struct inode *inode = NULL;
+        struct inode *inode;
         struct v9fs_session_info *v9ses = sb->s_fs_info;
 
         dprintk(DEBUG_VFS, "super block: %p mode: %o\n", sb, mode);
@@ -222,171 +254,133 @@ struct inode *v9fs_get_inode(struct super_block *sb, int mode)
         return inode;
 }
 
-/**
- * v9fs_create - helper function to create files and directories
- * @dir: directory inode file is being created in
- * @file_dentry: dentry file is being created in
- * @perm: permissions file is being created with
- * @open_mode: resulting open mode for file
- *
- */
-
 static int
-v9fs_create(struct inode *dir,
-            struct dentry *file_dentry,
-            unsigned int perm, unsigned int open_mode)
+v9fs_create(struct v9fs_session_info *v9ses, u32 pfid, char *name,
+        u32 perm, u8 mode, u32 *fidp, struct v9fs_qid *qid, u32 *iounit)
 {
-        struct v9fs_session_info *v9ses = v9fs_inode2v9ses(dir);
-        struct super_block *sb = dir->i_sb;
-        struct v9fs_fid *dirfid =
-            v9fs_fid_lookup(file_dentry->d_parent);
-        struct v9fs_fid *fid = NULL;
-        struct inode *file_inode = NULL;
-        struct v9fs_fcall *fcall = NULL;
-        struct v9fs_qid qid;
-        int dirfidnum = -1;
-        long newfid = -1;
-        int result = 0;
-        unsigned int iounit = 0;
-        int wfidno = -1;
+        u32 fid;
         int err;
+        struct v9fs_fcall *fcall;
 
-        perm = unixmode2p9mode(v9ses, perm);
-
-        dprintk(DEBUG_VFS, "dir: %p dentry: %p perm: %o mode: %o\n", dir,
-                file_dentry, perm, open_mode);
-
-        if (!dirfid)
-                return -EBADF;
-
-        dirfidnum = dirfid->fid;
-        if (dirfidnum < 0) {
-                dprintk(DEBUG_ERROR, "No fid for the directory #%lu\n",
-                        dir->i_ino);
-                return -EBADF;
-        }
-
-        if (file_dentry->d_inode) {
-                dprintk(DEBUG_ERROR,
-                        "Odd. There is an inode for dir %lu, name :%s:\n",
-                        dir->i_ino, file_dentry->d_name.name);
-                return -EEXIST;
-        }
-
-        newfid = v9fs_get_idpool(&v9ses->fidpool);
-        if (newfid < 0) {
+        fid = v9fs_get_idpool(&v9ses->fidpool);
+        if (fid < 0) {
                 eprintk(KERN_WARNING, "no free fids available\n");
                 return -ENOSPC;
         }
 
-        result = v9fs_t_walk(v9ses, dirfidnum, newfid, NULL, &fcall);
-        if (result < 0) {
+        err = v9fs_t_walk(v9ses, pfid, fid, NULL, &fcall);
+        if (err < 0) {
                 PRINT_FCALL_ERROR("clone error", fcall);
-                v9fs_put_idpool(newfid, &v9ses->fidpool);
-                newfid = -1;
-                goto CleanUpFid;
+                goto error;
         }
-
         kfree(fcall);
-        fcall = NULL;
 
-        result = v9fs_t_create(v9ses, newfid, (char *)file_dentry->d_name.name,
-                               perm, open_mode, &fcall);
-        if (result < 0) {
+        err = v9fs_t_create(v9ses, fid, name, perm, mode, &fcall);
+        if (err < 0) {
                 PRINT_FCALL_ERROR("create fails", fcall);
-                goto CleanUpFid;
+                goto error;
         }
 
-        iounit = fcall->params.rcreate.iounit;
-        qid = fcall->params.rcreate.qid;
+        if (iounit)
+                *iounit = fcall->params.rcreate.iounit;
+
+        if (qid)
+                *qid = fcall->params.rcreate.qid;
+
+        if (fidp)
+                *fidp = fid;
+
         kfree(fcall);
-        fcall = NULL;
+        return 0;
 
-        if (!(perm&V9FS_DMDIR)) {
-                fid = v9fs_fid_create(file_dentry, v9ses, newfid, 1);
-                dprintk(DEBUG_VFS, "fid %p %d\n", fid, fid->fidcreate);
-                if (!fid) {
-                        result = -ENOMEM;
-                        goto CleanUpFid;
-                }
+error:
+        if (fid >= 0)
+                v9fs_put_idpool(fid, &v9ses->fidpool);
 
-                fid->qid = qid;
-                fid->iounit = iounit;
-        } else {
-                err = v9fs_t_clunk(v9ses, newfid);
-                newfid = -1;
-                if (err < 0)
-                        dprintk(DEBUG_ERROR, "clunk for mkdir failed: %d\n", err);
-        }
+        kfree(fcall);
+        return err;
+}
+
+static struct v9fs_fid*
+v9fs_clone_walk(struct v9fs_session_info *v9ses, u32 fid, struct dentry *dentry)
+{
+        int err;
+        u32 nfid;
+        struct v9fs_fid *ret;
+        struct v9fs_fcall *fcall;
 
-        /* walk to the newly created file and put the fid in the dentry */
-        wfidno = v9fs_get_idpool(&v9ses->fidpool);
-        if (wfidno < 0) {
+        nfid = v9fs_get_idpool(&v9ses->fidpool);
+        if (nfid < 0) {
                 eprintk(KERN_WARNING, "no free fids available\n");
-                return -ENOSPC;
+                return ERR_PTR(-ENOSPC);
         }
 
-        result = v9fs_t_walk(v9ses, dirfidnum, wfidno,
-                (char *) file_dentry->d_name.name, &fcall);
-        if (result < 0) {
-                PRINT_FCALL_ERROR("clone error", fcall);
-                v9fs_put_idpool(wfidno, &v9ses->fidpool);
-                wfidno = -1;
-                goto CleanUpFid;
+        err = v9fs_t_walk(v9ses, fid, nfid, (char *) dentry->d_name.name,
+                &fcall);
+
+        if (err < 0) {
+                PRINT_FCALL_ERROR("walk error", fcall);
+                v9fs_put_idpool(nfid, &v9ses->fidpool);
+                goto error;
         }
+
         kfree(fcall);
         fcall = NULL;
+        ret = v9fs_fid_create(v9ses, nfid);
+        if (!ret) {
+                err = -ENOMEM;
+                goto clunk_fid;
+        }
 
-        if (!v9fs_fid_create(file_dentry, v9ses, wfidno, 0)) {
-                v9fs_put_idpool(wfidno, &v9ses->fidpool);
-
-                goto CleanUpFid;
+        err = v9fs_fid_insert(ret, dentry);
+        if (err < 0) {
+                v9fs_fid_destroy(ret);
+                goto clunk_fid;
         }
 
-        if ((perm & V9FS_DMSYMLINK) || (perm & V9FS_DMLINK) ||
-            (perm & V9FS_DMNAMEDPIPE) || (perm & V9FS_DMSOCKET) ||
-            (perm & V9FS_DMDEVICE))
-                return 0;
+        return ret;
 
-        result = v9fs_t_stat(v9ses, wfidno, &fcall);
-        if (result < 0) {
-                PRINT_FCALL_ERROR("stat error", fcall);
-                goto CleanUpFid;
-        }
+clunk_fid:
+        v9fs_t_clunk(v9ses, nfid);
 
+error:
+        kfree(fcall);
+        return ERR_PTR(err);
+}
 
-        file_inode = v9fs_get_inode(sb,
-                p9mode2unixmode(v9ses, fcall->params.rstat.stat.mode));
+struct inode *
+v9fs_inode_from_fid(struct v9fs_session_info *v9ses, u32 fid,
+        struct super_block *sb)
+{
+        int err, umode;
+        struct inode *ret;
+        struct v9fs_fcall *fcall;
 
-        if ((!file_inode) || IS_ERR(file_inode)) {
-                dprintk(DEBUG_ERROR, "create inode failed\n");
-                result = -EBADF;
-                goto CleanUpFid;
+        ret = NULL;
+        err = v9fs_t_stat(v9ses, fid, &fcall);
+        if (err) {
+                PRINT_FCALL_ERROR("stat error", fcall);
+                goto error;
         }
 
-        v9fs_stat2inode(&fcall->params.rstat.stat, file_inode, sb);
-        kfree(fcall);
-        fcall = NULL;
-        file_dentry->d_op = &v9fs_dentry_operations;
-        d_instantiate(file_dentry, file_inode);
+        umode = p9mode2unixmode(v9ses, fcall->params.rstat.stat.mode);
+        ret = v9fs_get_inode(sb, umode);
+        if (IS_ERR(ret)) {
+                err = PTR_ERR(ret);
+                ret = NULL;
+                goto error;
+        }
 
-        return 0;
+        v9fs_stat2inode(&fcall->params.rstat.stat, ret, sb);
+        kfree(fcall);
+        return ret;
 
-      CleanUpFid:
+error:
         kfree(fcall);
-        fcall = NULL;
+        if (ret)
+                iput(ret);
 
-        if (newfid >= 0) {
-                err = v9fs_t_clunk(v9ses, newfid);
-                if (err < 0)
-                        dprintk(DEBUG_ERROR, "clunk failed: %d\n", err);
-        }
-        if (wfidno >= 0) {
-                err = v9fs_t_clunk(v9ses, wfidno);
-                if (err < 0)
-                        dprintk(DEBUG_ERROR, "clunk failed: %d\n", err);
-        }
-        return result;
+        return ERR_PTR(err);
 }
 
 /**
@@ -440,20 +434,97 @@ static int v9fs_remove(struct inode *dir, struct dentry *file, int rmdir)
         return result;
 }
 
+static int
+v9fs_open_created(struct inode *inode, struct file *file)
+{
+        return 0;
+}
+
 /**
  * v9fs_vfs_create - VFS hook to create files
  * @inode: directory inode that is being deleted
  * @dentry:  dentry that is being deleted
- * @perm: create permissions
+ * @mode: create permissions
  * @nd: path information
  *
  */
 
 static int
-v9fs_vfs_create(struct inode *inode, struct dentry *dentry, int perm,
+v9fs_vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                 struct nameidata *nd)
 {
-        return v9fs_create(inode, dentry, perm, O_RDWR);
+        int err;
+        u32 fid, perm, iounit;
+        int flags;
+        struct v9fs_session_info *v9ses;
+        struct v9fs_fid *dfid, *vfid, *ffid;
+        struct inode *inode;
+        struct v9fs_qid qid;
+        struct file *filp;
+
+        inode = NULL;
+        vfid = NULL;
+        v9ses = v9fs_inode2v9ses(dir);
+        dfid = v9fs_fid_lookup(dentry->d_parent);
+        perm = unixmode2p9mode(v9ses, mode);
+
+        if (nd && nd->flags & LOOKUP_OPEN)
+                flags = nd->intent.open.flags - 1;
+        else
+                flags = O_RDWR;
+
+        err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
+                perm, v9fs_uflags2omode(flags), &fid, &qid, &iounit);
+
+        if (err)
+                goto error;
+
+        vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
+        if (IS_ERR(vfid)) {
+                err = PTR_ERR(vfid);
+                vfid = NULL;
+                goto error;
+        }
+
+        inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
+                inode = NULL;
+                goto error;
+        }
+
+        dentry->d_op = &v9fs_dentry_operations;
+        d_instantiate(dentry, inode);
+
+        if (nd && nd->flags & LOOKUP_OPEN) {
+                ffid = v9fs_fid_create(v9ses, fid);
+                if (!ffid)
+                        return -ENOMEM;
+
+                filp = lookup_instantiate_filp(nd, dentry, v9fs_open_created);
+                if (IS_ERR(filp)) {
+                        v9fs_fid_destroy(ffid);
+                        return PTR_ERR(filp);
+                }
+
+                ffid->rdir_pos = 0;
+                ffid->rdir_fcall = NULL;
+                ffid->fidopen = 1;
+                ffid->iounit = iounit;
+                ffid->filp = filp;
+                filp->private_data = ffid;
+        }
+
+        return 0;
+
+error:
+        if (vfid)
+                v9fs_fid_destroy(vfid);
+
+        if (inode)
+                iput(inode);
+
+        return err;
 }
 
 /**
@@ -464,9 +535,57 @@ v9fs_vfs_create(struct inode *inode, struct dentry *dentry, int perm,
  *
  */
 
-static int v9fs_vfs_mkdir(struct inode *inode, struct dentry *dentry, int mode)
+static int v9fs_vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 {
-        return v9fs_create(inode, dentry, mode | S_IFDIR, O_RDONLY);
+        int err;
+        u32 fid, perm;
+        struct v9fs_session_info *v9ses;
+        struct v9fs_fid *dfid, *vfid;
+        struct inode *inode;
+
+        inode = NULL;
+        vfid = NULL;
+        v9ses = v9fs_inode2v9ses(dir);
+        dfid = v9fs_fid_lookup(dentry->d_parent);
+        perm = unixmode2p9mode(v9ses, mode | S_IFDIR);
+
+        err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
+                perm, V9FS_OREAD, &fid, NULL, NULL);
+
+        if (err) {
+                dprintk(DEBUG_ERROR, "create error %d\n", err);
+                goto error;
+        }
+
+        err = v9fs_t_clunk(v9ses, fid);
+        if (err) {
+                dprintk(DEBUG_ERROR, "clunk error %d\n", err);
+                goto error;
+        }
+
+        vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
+        if (IS_ERR(vfid)) {
+                err = PTR_ERR(vfid);
+                vfid = NULL;
+                goto error;
+        }
+
+        inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
+                inode = NULL;
+                goto error;
+        }
+
+        dentry->d_op = &v9fs_dentry_operations;
+        d_instantiate(dentry, inode);
+        return 0;
+
+error:
+        if (vfid)
+                v9fs_fid_destroy(vfid);
+
+        return err;
 }
 
 /**
@@ -491,7 +610,7 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
         int result = 0;
 
         dprintk(DEBUG_VFS, "dir: %p dentry: (%s) %p nameidata: %p\n",
-                dir, dentry->d_iname, dentry, nameidata);
+                dir, dentry->d_name.name, dentry, nameidata);
 
         sb = dir->i_sb;
         v9ses = v9fs_inode2v9ses(dir);
@@ -516,9 +635,8 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
                 return ERR_PTR(-ENOSPC);
         }
 
-        result =
-            v9fs_t_walk(v9ses, dirfidnum, newfid, (char *)dentry->d_name.name,
-                        NULL);
+        result = v9fs_t_walk(v9ses, dirfidnum, newfid,
+                (char *)dentry->d_name.name, NULL);
         if (result < 0) {
                 v9fs_put_idpool(newfid, &v9ses->fidpool);
                 if (result == -ENOENT) {
@@ -551,13 +669,17 @@ static struct dentry *v9fs_vfs_lookup(struct inode *dir, struct dentry *dentry,
 
         inode->i_ino = v9fs_qid2ino(&fcall->params.rstat.stat.qid);
 
-        fid = v9fs_fid_create(dentry, v9ses, newfid, 0);
+        fid = v9fs_fid_create(v9ses, newfid);
         if (fid == NULL) {
                 dprintk(DEBUG_ERROR, "couldn't insert\n");
                 result = -ENOMEM;
                 goto FreeFcall;
         }
 
+        result = v9fs_fid_insert(fid, dentry);
+        if (result < 0)
+                goto FreeFcall;
+
         fid->qid = fcall->params.rstat.stat.qid;
 
         dentry->d_op = &v9fs_dentry_operations;
@@ -886,8 +1008,8 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
         }
 
         /* copy extension buffer into buffer */
-        if (fcall->params.rstat.stat.extension.len+1 < buflen)
-                buflen = fcall->params.rstat.stat.extension.len + 1;
+        if (fcall->params.rstat.stat.extension.len < buflen)
+                buflen = fcall->params.rstat.stat.extension.len;
 
         memcpy(buffer, fcall->params.rstat.stat.extension.str, buflen - 1);
         buffer[buflen-1] = 0;
@@ -951,7 +1073,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         if (!link)
                 link = ERR_PTR(-ENOMEM);
         else {
-                len = v9fs_readlink(dentry, link, PATH_MAX);
+                len = v9fs_readlink(dentry, link, strlen(link));
 
                 if (len < 0) {
                         __putname(link);
@@ -983,53 +1105,75 @@ static void v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void
 static int v9fs_vfs_mkspecial(struct inode *dir, struct dentry *dentry,
         int mode, const char *extension)
 {
-        int err, retval;
+        int err;
+        u32 fid, perm;
         struct v9fs_session_info *v9ses;
+        struct v9fs_fid *dfid, *vfid;
+        struct inode *inode;
         struct v9fs_fcall *fcall;
-        struct v9fs_fid *fid;
         struct v9fs_wstat wstat;
 
-        v9ses = v9fs_inode2v9ses(dir);
-        retval = -EPERM;
         fcall = NULL;
+        inode = NULL;
+        vfid = NULL;
+        v9ses = v9fs_inode2v9ses(dir);
+        dfid = v9fs_fid_lookup(dentry->d_parent);
+        perm = unixmode2p9mode(v9ses, mode);
 
         if (!v9ses->extended) {
                 dprintk(DEBUG_ERROR, "not extended\n");
-                goto free_mem;
+                return -EPERM;
         }
 
-        /* issue a create */
-        retval = v9fs_create(dir, dentry, mode, 0);
-        if (retval != 0)
-                goto free_mem;
+        err = v9fs_create(v9ses, dfid->fid, (char *) dentry->d_name.name,
+                perm, V9FS_OREAD, &fid, NULL, NULL);
 
-        fid = v9fs_fid_get_created(dentry);
-        if (!fid) {
-                dprintk(DEBUG_ERROR, "couldn't resolve fid from dentry\n");
-                goto free_mem;
+        if (err)
+                goto error;
+
+        err = v9fs_t_clunk(v9ses, fid);
+        if (err)
+                goto error;
+
+        vfid = v9fs_clone_walk(v9ses, dfid->fid, dentry);
+        if (IS_ERR(vfid)) {
+                err = PTR_ERR(vfid);
+                vfid = NULL;
+                goto error;
+        }
+
+        inode = v9fs_inode_from_fid(v9ses, vfid->fid, dir->i_sb);
+        if (IS_ERR(inode)) {
+                err = PTR_ERR(inode);
+                inode = NULL;
+                goto error;
         }
 
         /* issue a Twstat */
         v9fs_blank_wstat(&wstat);
         wstat.muid = v9ses->name;
         wstat.extension = (char *) extension;
-        retval = v9fs_t_wstat(v9ses, fid->fid, &wstat, &fcall);
-        if (retval < 0) {
-                PRINT_FCALL_ERROR("wstat error", fcall);
-                goto free_mem;
-        }
-
-        err = v9fs_t_clunk(v9ses, fid->fid);
+        err = v9fs_t_wstat(v9ses, vfid->fid, &wstat, &fcall);
         if (err < 0) {
-                dprintk(DEBUG_ERROR, "clunk failed: %d\n", err);
-                goto free_mem;
+                PRINT_FCALL_ERROR("wstat error", fcall);
+                goto error;
         }
 
-        d_drop(dentry);         /* FID - will this also clunk? */
+        kfree(fcall);
+        dentry->d_op = &v9fs_dentry_operations;
+        d_instantiate(dentry, inode);
+        return 0;
 
-free_mem:
+error:
         kfree(fcall);
-        return retval;
+        if (vfid)
+                v9fs_fid_destroy(vfid);
+
+        if (inode)
+                iput(inode);
+
+        return err;
+
 }
 
 /**
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index 2c4fa75be025..d05318fa684e 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -146,7 +146,6 @@ static struct super_block *v9fs_get_sb(struct file_system_type
         inode->i_gid = gid;
 
         root = d_alloc_root(inode);
-
         if (!root) {
                 retval = -ENOMEM;
                 goto put_back_sb;
@@ -158,15 +157,20 @@ static struct super_block *v9fs_get_sb(struct file_system_type
         if (stat_result < 0) {
                 dprintk(DEBUG_ERROR, "stat error\n");
                 v9fs_t_clunk(v9ses, newfid);
-                v9fs_put_idpool(newfid, &v9ses->fidpool);
         } else {
                 /* Setup the Root Inode */
-                root_fid = v9fs_fid_create(root, v9ses, newfid, 0);
+                root_fid = v9fs_fid_create(v9ses, newfid);
                 if (root_fid == NULL) {
                         retval = -ENOMEM;
                         goto put_back_sb;
                 }
 
+                retval = v9fs_fid_insert(root_fid, root);
+                if (retval < 0) {
+                        kfree(fcall);
+                        goto put_back_sb;
+                }
+
                 root_fid->qid = fcall->params.rstat.stat.qid;
                 root->d_inode->i_ino =
                     v9fs_qid2ino(&fcall->params.rstat.stat.qid);
diff --git a/fs/Kconfig b/fs/Kconfig
index 93b5dc4082ff..e9749b0eecd8 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -883,8 +883,6 @@ config CONFIGFS_FS
           Both sysfs and configfs can and should exist together on the
           same system. One is not a replacement for the other.
 
-          If unsure, say N.
-
 endmenu
 
 menu "Miscellaneous filesystems"
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 1b117a441298..c2eac2a50bd2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -938,6 +938,11 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                 kfree(elf_interpreter);
         } else {
                 elf_entry = loc->elf_ex.e_entry;
+                if (BAD_ADDR(elf_entry)) {
+                        send_sig(SIGSEGV, current, 0);
+                        retval = -ENOEXEC; /* Nobody gets to see this, but.. */
+                        goto out_free_dentry;
+                }
         }
 
         kfree(elf_phdata);
diff --git a/fs/buffer.c b/fs/buffer.c
index 62cfd17dc5fe..a9b399402007 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3060,6 +3060,7 @@ int buffer_migrate_page(struct page *newpage, struct page *page)
 {
         struct address_space *mapping = page->mapping;
         struct buffer_head *bh, *head;
+        int rc;
 
         if (!mapping)
                 return -EAGAIN;
@@ -3069,8 +3070,9 @@ int buffer_migrate_page(struct page *newpage, struct page *page)
 
         head = page_buffers(page);
 
-        if (migrate_page_remove_references(newpage, page, 3))
-                return -EAGAIN;
+        rc = migrate_page_remove_references(newpage, page, 3);
+        if (rc)
+                return rc;
 
         bh = head;
         do {
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 3c03aadaff0c..7b25463d3c14 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -52,7 +52,7 @@ extern int SendReceive2(const unsigned int /* xid */ , struct cifsSesInfo *,
                         int * /* type of buf returned */ , const int long_op);
 extern int checkSMBhdr(struct smb_hdr *smb, __u16 mid);
 extern int checkSMB(struct smb_hdr *smb, __u16 mid, int length);
-extern int is_valid_oplock_break(struct smb_hdr *smb);
+extern int is_valid_oplock_break(struct smb_hdr *smb, struct TCP_Server_Info *);
 extern int is_size_safe_to_change(struct cifsInodeInfo *);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *);
 extern unsigned int smbCalcSize(struct smb_hdr *ptr);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 217323b0c896..b41e8b379652 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1048,13 +1048,14 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon,
                         cifs_small_buf_release(iov[0].iov_base);
                 else if(resp_buf_type == CIFS_LARGE_BUFFER)
                         cifs_buf_release(iov[0].iov_base);
-        } else /* return buffer to caller to free */ /* BB FIXME how do we tell caller if it is not a large buffer */ {
-                *buf = iov[0].iov_base;
+        } else if(resp_buf_type != CIFS_NO_BUFFER) {
+                /* return buffer to caller to free */ 
+                *buf = iov[0].iov_base;         
                 if(resp_buf_type == CIFS_SMALL_BUFFER)
                         *pbuf_type = CIFS_SMALL_BUFFER;
                 else if(resp_buf_type == CIFS_LARGE_BUFFER)
                         *pbuf_type = CIFS_LARGE_BUFFER;
-        }
+        } /* else no valid buffer on return - leave as null */
 
         /* Note: On -EAGAIN error only caller can retry on handle based calls
                 since file handle passed in no longer valid */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e488603fb1e7..2a0c1f4ca0ae 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -630,7 +630,7 @@ multi_t2_fnd:
                                         smallbuf = NULL;
                         }
                         wake_up_process(task_to_wake);
-                } else if ((is_valid_oplock_break(smb_buffer) == FALSE)
+                } else if ((is_valid_oplock_break(smb_buffer, server) == FALSE)
                     && (isMultiRsp == FALSE)) {                          
                         cERROR(1, ("No task to wake, unknown frame rcvd!"));
                         cifs_dump_mem("Received Data is: ",(char *)smb_buffer,
@@ -1795,10 +1795,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                            conjunction with 52K kvec constraint on arch with 4K
                            page size  */
 
-                if(cifs_sb->rsize < PAGE_CACHE_SIZE) {
-                        cifs_sb->rsize = PAGE_CACHE_SIZE; 
-                        /* Windows ME does this */
-                        cFYI(1,("Attempt to set readsize for mount to less than one page (4096)"));
+                if(cifs_sb->rsize < 2048) {
+                        cifs_sb->rsize = 2048; 
+                        /* Windows ME may prefer this */
+                        cFYI(1,("readsize set to minimum 2048"));
                 }
                 cifs_sb->mnt_uid = volume_info.linux_uid;
                 cifs_sb->mnt_gid = volume_info.linux_gid;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index d17c97d07c80..675bd2568297 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1442,13 +1442,15 @@ ssize_t cifs_user_read(struct file *file, char __user *read_data,
                                          &bytes_read, &smb_read_data,
                                          &buf_type);
                         pSMBr = (struct smb_com_read_rsp *)smb_read_data;
-                        if (copy_to_user(current_offset, 
-                                         smb_read_data + 4 /* RFC1001 hdr */
-                                         + le16_to_cpu(pSMBr->DataOffset), 
-                                         bytes_read)) {
-                                rc = -EFAULT;
-                        }
                         if (smb_read_data) {
+                                if (copy_to_user(current_offset,
+                                                smb_read_data +
+                                                4 /* RFC1001 length field */ +
+                                                le16_to_cpu(pSMBr->DataOffset),
+                                                bytes_read)) {
+                                        rc = -EFAULT;
+                                }
+
                                 if(buf_type == CIFS_SMALL_BUFFER)
                                         cifs_small_buf_release(smb_read_data);
                                 else if(buf_type == CIFS_LARGE_BUFFER)
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 812c6bb0fe38..432ba15e2c2d 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -475,7 +475,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
         return 0;
 }
 int
-is_valid_oplock_break(struct smb_hdr *buf)
+is_valid_oplock_break(struct smb_hdr *buf, struct TCP_Server_Info *srv)
 {    
         struct smb_com_lock_req * pSMB = (struct smb_com_lock_req *)buf;
         struct list_head *tmp;
@@ -535,7 +535,7 @@ is_valid_oplock_break(struct smb_hdr *buf)
         read_lock(&GlobalSMBSeslock);
         list_for_each(tmp, &GlobalTreeConnectionList) {
                 tcon = list_entry(tmp, struct cifsTconInfo, cifsConnectionList);
-                if (tcon->tid == buf->Tid) {
+                if ((tcon->tid == buf->Tid) && (srv == tcon->ses->server)) {
                         cifs_stats_inc(&tcon->num_oplock_brks);
                         list_for_each(tmp1,&tcon->openFileList){
                                 netfile = list_entry(tmp1,struct cifsFileInfo,
diff --git a/fs/compat.c b/fs/compat.c
index 70c5af4cc270..5333c7d7427f 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1751,11 +1751,15 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
         ret = compat_core_sys_select(n, inp, outp, exp, &timeout);
 
         if (tvp) {
+                struct compat_timeval rtv;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
-                tv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
-                tv.tv_sec = timeout;
-                if (copy_to_user(tvp, &tv, sizeof(tv))) {
+                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
+                rtv.tv_sec = timeout;
+                if (compat_timeval_compare(&rtv, &tv) >= 0)
+                        rtv = tv;
+                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
                         /*
                          * If an application puts its timeval in read-only
@@ -1822,13 +1826,17 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
         } while (!ret && !timeout && tsp && (ts.tv_sec || ts.tv_nsec));
 
         if (tsp && !(current->personality & STICKY_TIMEOUTS)) {
-                ts.tv_sec += timeout / HZ;
-                ts.tv_nsec += (timeout % HZ) * (1000000000/HZ);
-                if (ts.tv_nsec >= 1000000000) {
-                        ts.tv_sec++;
-                        ts.tv_nsec -= 1000000000;
+                struct compat_timespec rts;
+
+                rts.tv_sec = timeout / HZ;
+                rts.tv_nsec = (timeout % HZ) * (NSEC_PER_SEC/HZ);
+                if (rts.tv_nsec >= NSEC_PER_SEC) {
+                        rts.tv_sec++;
+                        rts.tv_nsec -= NSEC_PER_SEC;
                 }
-                (void)copy_to_user(tsp, &ts, sizeof(ts));
+                if (compat_timespec_compare(&rts, &ts) >= 0)
+                        rts = ts;
+                copy_to_user(tsp, &rts, sizeof(rts));
         }
 
         if (ret == -ERESTARTNOHAND) {
@@ -1918,12 +1926,17 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                 sigprocmask(SIG_SETMASK, &sigsaved, NULL);
 
         if (tsp && timeout >= 0) {
+                struct compat_timespec rts;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
                 /* Yes, we know it's actually an s64, but it's also positive. */
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
-                ts.tv_sec = timeout;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
+                                        1000;
+                rts.tv_sec = timeout;
+                if (compat_timespec_compare(&rts, &ts) >= 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
                         /*
                          * If an application puts its timeval in read-only
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 5dd0207ffd46..c666769a875d 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -446,7 +446,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
         ifr = ifc.ifc_req;
         ifr32 = compat_ptr(ifc32.ifcbuf);
         for (i = 0, j = 0;
-             i + sizeof (struct ifreq32) < ifc32.ifc_len && j < ifc.ifc_len;
+             i + sizeof (struct ifreq32) <= ifc32.ifc_len && j < ifc.ifc_len;
              i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) {
                 if (copy_in_user(ifr32, ifr, sizeof (struct ifreq32)))
                         return -EFAULT;
@@ -931,8 +931,8 @@ struct compat_sg_req_info { /* used by SG_GET_REQUEST_TABLE ioctl() */
 static int sg_grt_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
         int err, i;
-        sg_req_info_t *r;
-        struct compat_sg_req_info *o = (struct compat_sg_req_info *)arg;
+        sg_req_info_t __user *r;
+        struct compat_sg_req_info __user *o = (void __user *)arg;
         r = compat_alloc_user_space(sizeof(sg_req_info_t)*SG_MAX_QUEUE);
         err = sys_ioctl(fd,cmd,(unsigned long)r);
         if (err < 0)
@@ -2531,18 +2531,9 @@ static int rtc_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
                 val32 = kval;
                 return put_user(val32, (unsigned int __user *)arg);
         case RTC_IRQP_SET32:
+                return sys_ioctl(fd, RTC_IRQP_SET, arg); 
         case RTC_EPOCH_SET32:
-                ret = get_user(val32, (unsigned int __user *)arg);
-                if (ret)
-                        return ret;
-                kval = val32;
-
-                set_fs(KERNEL_DS);
-                ret = sys_ioctl(fd, (cmd == RTC_IRQP_SET32) ?
-                                RTC_IRQP_SET : RTC_EPOCH_SET,
-                                (unsigned long)&kval);
-                set_fs(oldfs);
-                return ret;
+                return sys_ioctl(fd, RTC_EPOCH_SET, arg);
         default:
                 /* unreached */
                 return -ENOIOCTLCMD;
@@ -2739,8 +2730,8 @@ static int do_ncp_setprivatedata(unsigned int fd, unsigned int cmd, unsigned lon
 static int
 lp_timeout_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 {
-        struct compat_timeval *tc = (struct compat_timeval *)arg;
-        struct timeval *tn = compat_alloc_user_space(sizeof(struct timeval));
+        struct compat_timeval __user *tc = (struct compat_timeval __user *)arg;
+        struct timeval __user *tn = compat_alloc_user_space(sizeof(struct timeval));
         struct timeval ts;
         if (get_user(ts.tv_sec, &tc->tv_sec) ||
             get_user(ts.tv_usec, &tc->tv_usec) ||
diff --git a/fs/configfs/configfs_internal.h b/fs/configfs/configfs_internal.h
index 8899d9c5f6bf..f70e46951b37 100644
--- a/fs/configfs/configfs_internal.h
+++ b/fs/configfs/configfs_internal.h
@@ -36,6 +36,7 @@ struct configfs_dirent {
         int                     s_type;
         umode_t                 s_mode;
         struct dentry           * s_dentry;
+        struct iattr            * s_iattr;
 };
 
 #define CONFIGFS_ROOT           0x0001
@@ -48,10 +49,11 @@ struct configfs_dirent {
 #define CONFIGFS_NOT_PINNED     (CONFIGFS_ITEM_ATTR)
 
 extern struct vfsmount * configfs_mount;
+extern kmem_cache_t *configfs_dir_cachep;
 
 extern int configfs_is_root(struct config_item *item);
 
-extern struct inode * configfs_new_inode(mode_t mode);
+extern struct inode * configfs_new_inode(mode_t mode, struct configfs_dirent *);
 extern int configfs_create(struct dentry *, int mode, int (*init)(struct inode *));
 
 extern int configfs_create_file(struct config_item *, const struct configfs_attribute *);
@@ -63,6 +65,7 @@ extern void configfs_hash_and_remove(struct dentry * dir, const char * name);
 
 extern const unsigned char * configfs_get_name(struct configfs_dirent *sd);
 extern void configfs_drop_dentry(struct configfs_dirent *sd, struct dentry *parent);
+extern int configfs_setattr(struct dentry *dentry, struct iattr *iattr);
 
 extern int configfs_pin_fs(void);
 extern void configfs_release_fs(void);
@@ -120,8 +123,10 @@ static inline struct config_item *configfs_get_config_item(struct dentry *dentry
 
 static inline void release_configfs_dirent(struct configfs_dirent * sd)
 {
-        if (!(sd->s_type & CONFIGFS_ROOT))
-                kfree(sd);
+        if (!(sd->s_type & CONFIGFS_ROOT)) {
+                kfree(sd->s_iattr);
+                kmem_cache_free(configfs_dir_cachep, sd);
+        }
 }
 
 static inline struct configfs_dirent * configfs_get(struct configfs_dirent * sd)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index b668ec61527e..ca60e3abef45 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -72,7 +72,7 @@ static struct configfs_dirent *configfs_new_dirent(struct configfs_dirent * pare
 {
         struct configfs_dirent * sd;
 
-        sd = kmalloc(sizeof(*sd), GFP_KERNEL);
+        sd = kmem_cache_alloc(configfs_dir_cachep, GFP_KERNEL);
         if (!sd)
                 return NULL;
 
@@ -136,13 +136,19 @@ static int create_dir(struct config_item * k, struct dentry * p,
         int error;
         umode_t mode = S_IFDIR| S_IRWXU | S_IRUGO | S_IXUGO;
 
-        error = configfs_create(d, mode, init_dir);
+        error = configfs_make_dirent(p->d_fsdata, d, k, mode,
+                                     CONFIGFS_DIR);
         if (!error) {
-                error = configfs_make_dirent(p->d_fsdata, d, k, mode,
-                                           CONFIGFS_DIR);
+                error = configfs_create(d, mode, init_dir);
                 if (!error) {
                         p->d_inode->i_nlink++;
                         (d)->d_op = &configfs_dentry_ops;
+                } else {
+                        struct configfs_dirent *sd = d->d_fsdata;
+                        if (sd) {
+                                list_del_init(&sd->s_sibling);
+                                configfs_put(sd);
+                        }
                 }
         }
         return error;
@@ -182,12 +188,19 @@ int configfs_create_link(struct configfs_symlink *sl,
         int err = 0;
         umode_t mode = S_IFLNK | S_IRWXUGO;
 
-        err = configfs_create(dentry, mode, init_symlink);
+        err = configfs_make_dirent(parent->d_fsdata, dentry, sl, mode,
+                                   CONFIGFS_ITEM_LINK);
         if (!err) {
-                err = configfs_make_dirent(parent->d_fsdata, dentry, sl,
-                                         mode, CONFIGFS_ITEM_LINK);
+                err = configfs_create(dentry, mode, init_symlink);
                 if (!err)
                         dentry->d_op = &configfs_dentry_ops;
+                else {
+                        struct configfs_dirent *sd = dentry->d_fsdata;
+                        if (sd) {
+                                list_del_init(&sd->s_sibling);
+                                configfs_put(sd);
+                        }
+                }
         }
         return err;
 }
@@ -241,13 +254,15 @@ static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * den
         struct configfs_attribute * attr = sd->s_element;
         int error;
 
+        dentry->d_fsdata = configfs_get(sd);
+        sd->s_dentry = dentry;
         error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG, init_file);
-        if (error)
+        if (error) {
+                configfs_put(sd);
                 return error;
+        }
 
         dentry->d_op = &configfs_dentry_ops;
-        dentry->d_fsdata = configfs_get(sd);
-        sd->s_dentry = dentry;
         d_rehash(dentry);
 
         return 0;
@@ -839,6 +854,7 @@ struct inode_operations configfs_dir_inode_operations = {
         .symlink        = configfs_symlink,
         .unlink         = configfs_unlink,
         .lookup         = configfs_lookup,
+        .setattr        = configfs_setattr,
 };
 
 #if 0
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index c26cd61f13af..3921920d8716 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -26,7 +26,6 @@
 
 #include <linux/fs.h>
 #include <linux/module.h>
-#include <linux/dnotify.h>
 #include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/semaphore.h>
@@ -150,7 +149,7 @@ out:
 /**
  *      fill_write_buffer - copy buffer from userspace.
  *      @buffer:        data buffer for file.
- *      @userbuf:       data from user.
+ *      @buf:           data from user.
  *      @count:         number of bytes in @userbuf.
  *
  *      Allocate @buffer->page if it hasn't been already, then
@@ -177,8 +176,9 @@ fill_write_buffer(struct configfs_buffer * buffer, const char __user * buf, size
 
 /**
  *      flush_write_buffer - push buffer to config_item.
- *      @file:          file pointer.
+ *      @dentry:        dentry to the attribute
  *      @buffer:        data buffer for file.
+ *      @count:         number of bytes
  *
  *      Get the correct pointers for the config_item and the attribute we're
  *      dealing with, then call the store() method for the attribute,
@@ -217,15 +217,16 @@ static ssize_t
 configfs_write_file(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
         struct configfs_buffer * buffer = file->private_data;
+        ssize_t len;
 
         down(&buffer->sem);
-        count = fill_write_buffer(buffer,buf,count);
-        if (count > 0)
-                count = flush_write_buffer(file->f_dentry,buffer,count);
-        if (count > 0)
-                *ppos += count;
+        len = fill_write_buffer(buffer, buf, count);
+        if (len > 0)
+                len = flush_write_buffer(file->f_dentry, buffer, count);
+        if (len > 0)
+                *ppos += len;
         up(&buffer->sem);
-        return count;
+        return len;
 }
 
 static int check_perm(struct inode * inode, struct file * file)
diff --git a/fs/configfs/inode.c b/fs/configfs/inode.c
index 6577c588de9d..c153bd9534cb 100644
--- a/fs/configfs/inode.c
+++ b/fs/configfs/inode.c
@@ -31,6 +31,7 @@
 #include <linux/pagemap.h>
 #include <linux/namei.h>
 #include <linux/backing-dev.h>
+#include <linux/capability.h>
 
 #include <linux/configfs.h>
 #include "configfs_internal.h"
@@ -48,18 +49,107 @@ static struct backing_dev_info configfs_backing_dev_info = {
         .capabilities   = BDI_CAP_NO_ACCT_DIRTY | BDI_CAP_NO_WRITEBACK,
 };
 
-struct inode * configfs_new_inode(mode_t mode)
+static struct inode_operations configfs_inode_operations ={
+        .setattr        = configfs_setattr,
+};
+
+int configfs_setattr(struct dentry * dentry, struct iattr * iattr)
+{
+        struct inode * inode = dentry->d_inode;
+        struct configfs_dirent * sd = dentry->d_fsdata;
+        struct iattr * sd_iattr;
+        unsigned int ia_valid = iattr->ia_valid;
+        int error;
+
+        if (!sd)
+                return -EINVAL;
+
+        sd_iattr = sd->s_iattr;
+
+        error = inode_change_ok(inode, iattr);
+        if (error)
+                return error;
+
+        error = inode_setattr(inode, iattr);
+        if (error)
+                return error;
+
+        if (!sd_iattr) {
+                /* setting attributes for the first time, allocate now */
+                sd_iattr = kmalloc(sizeof(struct iattr), GFP_KERNEL);
+                if (!sd_iattr)
+                        return -ENOMEM;
+                /* assign default attributes */
+                memset(sd_iattr, 0, sizeof(struct iattr));
+                sd_iattr->ia_mode = sd->s_mode;
+                sd_iattr->ia_uid = 0;
+                sd_iattr->ia_gid = 0;
+                sd_iattr->ia_atime = sd_iattr->ia_mtime = sd_iattr->ia_ctime = CURRENT_TIME;
+                sd->s_iattr = sd_iattr;
+        }
+
+        /* attributes were changed atleast once in past */
+
+        if (ia_valid & ATTR_UID)
+                sd_iattr->ia_uid = iattr->ia_uid;
+        if (ia_valid & ATTR_GID)
+                sd_iattr->ia_gid = iattr->ia_gid;
+        if (ia_valid & ATTR_ATIME)
+                sd_iattr->ia_atime = timespec_trunc(iattr->ia_atime,
+                                                inode->i_sb->s_time_gran);
+        if (ia_valid & ATTR_MTIME)
+                sd_iattr->ia_mtime = timespec_trunc(iattr->ia_mtime,
+                                                inode->i_sb->s_time_gran);
+        if (ia_valid & ATTR_CTIME)
+                sd_iattr->ia_ctime = timespec_trunc(iattr->ia_ctime,
+                                                inode->i_sb->s_time_gran);
+        if (ia_valid & ATTR_MODE) {
+                umode_t mode = iattr->ia_mode;
+
+                if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
+                        mode &= ~S_ISGID;
+                sd_iattr->ia_mode = sd->s_mode = mode;
+        }
+
+        return error;
+}
+
+static inline void set_default_inode_attr(struct inode * inode, mode_t mode)
+{
+        inode->i_mode = mode;
+        inode->i_uid = 0;
+        inode->i_gid = 0;
+        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+}
+
+static inline void set_inode_attr(struct inode * inode, struct iattr * iattr)
+{
+        inode->i_mode = iattr->ia_mode;
+        inode->i_uid = iattr->ia_uid;
+        inode->i_gid = iattr->ia_gid;
+        inode->i_atime = iattr->ia_atime;
+        inode->i_mtime = iattr->ia_mtime;
+        inode->i_ctime = iattr->ia_ctime;
+}
+
+struct inode * configfs_new_inode(mode_t mode, struct configfs_dirent * sd)
 {
         struct inode * inode = new_inode(configfs_sb);
         if (inode) {
-                inode->i_mode = mode;
-                inode->i_uid = 0;
-                inode->i_gid = 0;
                 inode->i_blksize = PAGE_CACHE_SIZE;
                 inode->i_blocks = 0;
-                inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
                 inode->i_mapping->a_ops = &configfs_aops;
                 inode->i_mapping->backing_dev_info = &configfs_backing_dev_info;
+                inode->i_op = &configfs_inode_operations;
+
+                if (sd->s_iattr) {
+                        /* sysfs_dirent has non-default attributes
+                         * get them for the new inode from persistent copy
+                         * in sysfs_dirent
+                         */
+                        set_inode_attr(inode, sd->s_iattr);
+                } else
+                        set_default_inode_attr(inode, mode);
         }
         return inode;
 }
@@ -70,7 +160,8 @@ int configfs_create(struct dentry * dentry, int mode, int (*init)(struct inode *
         struct inode * inode = NULL;
         if (dentry) {
                 if (!dentry->d_inode) {
-                        if ((inode = configfs_new_inode(mode))) {
+                        struct configfs_dirent *sd = dentry->d_fsdata;
+                        if ((inode = configfs_new_inode(mode, sd))) {
                                 if (dentry->d_parent && dentry->d_parent->d_inode) {
                                         struct inode *p_inode = dentry->d_parent->d_inode;
                                         p_inode->i_mtime = p_inode->i_ctime = CURRENT_TIME;
@@ -103,10 +194,9 @@ int configfs_create(struct dentry * dentry, int mode, int (*init)(struct inode *
  */
 const unsigned char * configfs_get_name(struct configfs_dirent *sd)
 {
-        struct attribute * attr;
+        struct configfs_attribute *attr;
 
-        if (!sd || !sd->s_element)
-                BUG();
+        BUG_ON(!sd || !sd->s_element);
 
         /* These always have a dentry, so use that */
         if (sd->s_type & (CONFIGFS_DIR | CONFIGFS_ITEM_LINK))
@@ -114,7 +204,7 @@ const unsigned char * configfs_get_name(struct configfs_dirent *sd)
 
         if (sd->s_type & CONFIGFS_ITEM_ATTR) {
                 attr = sd->s_element;
-                return attr->name;
+                return attr->ca_name;
         }
         return NULL;
 }
@@ -130,13 +220,17 @@ void configfs_drop_dentry(struct configfs_dirent * sd, struct dentry * parent)
 
         if (dentry) {
                 spin_lock(&dcache_lock);
+                spin_lock(&dentry->d_lock);
                 if (!(d_unhashed(dentry) && dentry->d_inode)) {
                         dget_locked(dentry);
                         __d_drop(dentry);
+                        spin_unlock(&dentry->d_lock);
                         spin_unlock(&dcache_lock);
                         simple_unlink(parent->d_inode, dentry);
-                } else
+                } else {
+                        spin_unlock(&dentry->d_lock);
                         spin_unlock(&dcache_lock);
+                }
         }
 }
 
@@ -145,6 +239,10 @@ void configfs_hash_and_remove(struct dentry * dir, const char * name)
         struct configfs_dirent * sd;
         struct configfs_dirent * parent_sd = dir->d_fsdata;
 
+        if (dir->d_inode == NULL)
+                /* no inode means this hasn't been made visible yet */
+                return;
+
         mutex_lock(&dir->d_inode->i_mutex);
         list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
                 if (!sd->s_element)
diff --git a/fs/configfs/mount.c b/fs/configfs/mount.c
index 1a2f6f6a4d91..f920d30478e5 100644
--- a/fs/configfs/mount.c
+++ b/fs/configfs/mount.c
@@ -38,6 +38,7 @@
 
 struct vfsmount * configfs_mount = NULL;
 struct super_block * configfs_sb = NULL;
+kmem_cache_t *configfs_dir_cachep;
 static int configfs_mnt_count = 0;
 
 static struct super_operations configfs_ops = {
@@ -62,6 +63,7 @@ static struct configfs_dirent configfs_root = {
         .s_children     = LIST_HEAD_INIT(configfs_root.s_children),
         .s_element      = &configfs_root_group.cg_item,
         .s_type         = CONFIGFS_ROOT,
+        .s_iattr        = NULL,
 };
 
 static int configfs_fill_super(struct super_block *sb, void *data, int silent)
@@ -73,9 +75,11 @@ static int configfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
         sb->s_magic = CONFIGFS_MAGIC;
         sb->s_op = &configfs_ops;
+        sb->s_time_gran = 1;
         configfs_sb = sb;
 
-        inode = configfs_new_inode(S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO);
+        inode = configfs_new_inode(S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
+                                   &configfs_root);
         if (inode) {
                 inode->i_op = &configfs_dir_inode_operations;
                 inode->i_fop = &configfs_dir_operations;
@@ -128,19 +132,31 @@ static decl_subsys(config, NULL, NULL);
 
 static int __init configfs_init(void)
 {
-        int err;
+        int err = -ENOMEM;
+
+        configfs_dir_cachep = kmem_cache_create("configfs_dir_cache",
+                                                sizeof(struct configfs_dirent),
+                                                0, 0, NULL, NULL);
+        if (!configfs_dir_cachep)
+                goto out;
 
         kset_set_kset_s(&config_subsys, kernel_subsys);
         err = subsystem_register(&config_subsys);
-        if (err)
-                return err;
+        if (err) {
+                kmem_cache_destroy(configfs_dir_cachep);
+                configfs_dir_cachep = NULL;
+                goto out;
+        }
 
         err = register_filesystem(&configfs_fs_type);
         if (err) {
                 printk(KERN_ERR "configfs: Unable to register filesystem!\n");
                 subsystem_unregister(&config_subsys);
+                kmem_cache_destroy(configfs_dir_cachep);
+                configfs_dir_cachep = NULL;
         }
 
+out:
         return err;
 }
 
@@ -148,11 +164,13 @@ static void __exit configfs_exit(void)
 {
         unregister_filesystem(&configfs_fs_type);
         subsystem_unregister(&config_subsys);
+        kmem_cache_destroy(configfs_dir_cachep);
+        configfs_dir_cachep = NULL;
 }
 
 MODULE_AUTHOR("Oracle");
 MODULE_LICENSE("GPL");
-MODULE_VERSION("0.0.1");
+MODULE_VERSION("0.0.2");
 MODULE_DESCRIPTION("Simple RAM filesystem for user driven kernel subsystem configuration.");
 
 module_init(configfs_init);
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index 50f5840521a9..e5512e295cf2 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -162,8 +162,7 @@ int configfs_unlink(struct inode *dir, struct dentry *dentry)
         if (!(sd->s_type & CONFIGFS_ITEM_LINK))
                 goto out;
 
-        if (dentry->d_parent == configfs_sb->s_root)
-                BUG();
+        BUG_ON(dentry->d_parent == configfs_sb->s_root);
 
         sl = sd->s_element;
 
@@ -277,5 +276,6 @@ struct inode_operations configfs_symlink_inode_operations = {
         .follow_link = configfs_follow_link,
         .readlink = generic_readlink,
         .put_link = configfs_put_link,
+        .setattr = configfs_setattr,
 };
 
diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index 7fe85415ae7c..8ad52f5bf255 100644
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -36,7 +36,7 @@ static DECLARE_MUTEX(read_mutex);
 
 /* These two macros may change in future, to provide better st_ino
    semantics. */
-#define CRAMINO(x)      ((x)->offset?(x)->offset<<2:1)
+#define CRAMINO(x)      (((x)->offset && (x)->size)?(x)->offset<<2:1)
 #define OFFSET(x)       ((x)->i_ino)
 
 
@@ -66,8 +66,36 @@ static int cramfs_iget5_test(struct inode *inode, void *opaque)
 
 static int cramfs_iget5_set(struct inode *inode, void *opaque)
 {
+        static struct timespec zerotime;
         struct cramfs_inode *cramfs_inode = opaque;
+        inode->i_mode = cramfs_inode->mode;
+        inode->i_uid = cramfs_inode->uid;
+        inode->i_size = cramfs_inode->size;
+        inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
+        inode->i_blksize = PAGE_CACHE_SIZE;
+        inode->i_gid = cramfs_inode->gid;
+        /* Struct copy intentional */
+        inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
         inode->i_ino = CRAMINO(cramfs_inode);
+        /* inode->i_nlink is left 1 - arguably wrong for directories,
+           but it's the best we can do without reading the directory
+           contents.  1 yields the right result in GNU find, even
+           without -noleaf option. */
+        if (S_ISREG(inode->i_mode)) {
+                inode->i_fop = &generic_ro_fops;
+                inode->i_data.a_ops = &cramfs_aops;
+        } else if (S_ISDIR(inode->i_mode)) {
+                inode->i_op = &cramfs_dir_inode_operations;
+                inode->i_fop = &cramfs_directory_operations;
+        } else if (S_ISLNK(inode->i_mode)) {
+                inode->i_op = &page_symlink_inode_operations;
+                inode->i_data.a_ops = &cramfs_aops;
+        } else {
+                inode->i_size = 0;
+                inode->i_blocks = 0;
+                init_special_inode(inode, inode->i_mode,
+                        old_decode_dev(cramfs_inode->size));
+        }
         return 0;
 }
 
@@ -77,37 +105,7 @@ static struct inode *get_cramfs_inode(struct super_block *sb,
         struct inode *inode = iget5_locked(sb, CRAMINO(cramfs_inode),
                                             cramfs_iget5_test, cramfs_iget5_set,
                                             cramfs_inode);
-        static struct timespec zerotime;
-
         if (inode && (inode->i_state & I_NEW)) {
-                inode->i_mode = cramfs_inode->mode;
-                inode->i_uid = cramfs_inode->uid;
-                inode->i_size = cramfs_inode->size;
-                inode->i_blocks = (cramfs_inode->size - 1) / 512 + 1;
-                inode->i_blksize = PAGE_CACHE_SIZE;
-                inode->i_gid = cramfs_inode->gid;
-                /* Struct copy intentional */
-                inode->i_mtime = inode->i_atime = inode->i_ctime = zerotime;
-                inode->i_ino = CRAMINO(cramfs_inode);
-                /* inode->i_nlink is left 1 - arguably wrong for directories,
-                   but it's the best we can do without reading the directory
-                   contents.  1 yields the right result in GNU find, even
-                   without -noleaf option. */
-                if (S_ISREG(inode->i_mode)) {
-                        inode->i_fop = &generic_ro_fops;
-                        inode->i_data.a_ops = &cramfs_aops;
-                } else if (S_ISDIR(inode->i_mode)) {
-                        inode->i_op = &cramfs_dir_inode_operations;
-                        inode->i_fop = &cramfs_directory_operations;
-                } else if (S_ISLNK(inode->i_mode)) {
-                        inode->i_op = &page_symlink_inode_operations;
-                        inode->i_data.a_ops = &cramfs_aops;
-                } else {
-                        inode->i_size = 0;
-                        inode->i_blocks = 0;
-                        init_special_inode(inode, inode->i_mode,
-                                old_decode_dev(cramfs_inode->size));
-                }
                 unlock_new_inode(inode);
         }
         return inode;
diff --git a/fs/dcache.c b/fs/dcache.c
index a173bba32666..11dc83092d4a 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1736,7 +1736,7 @@ void __init vfs_caches_init(unsigned long mempages)
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
 
         filp_cachep = kmem_cache_create("filp", sizeof(struct file), 0,
-                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, filp_ctor, filp_dtor);
+                        SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
 
         dcache_init(mempages);
         inode_init(mempages);
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index efc97d9b7860..d575452cd9f7 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -56,7 +56,7 @@ static u64 debugfs_u8_get(void *data)
 DEFINE_SIMPLE_ATTRIBUTE(fops_u8, debugfs_u8_get, debugfs_u8_set, "%llu\n");
 
 /**
- * debugfs_create_u8 - create a file in the debugfs filesystem that is used to read and write a unsigned 8 bit value.
+ * debugfs_create_u8 - create a file in the debugfs filesystem that is used to read and write an unsigned 8 bit value.
  *
  * @name: a pointer to a string containing the name of the file to create.
  * @mode: the permission that the file should have
@@ -98,7 +98,7 @@ static u64 debugfs_u16_get(void *data)
 DEFINE_SIMPLE_ATTRIBUTE(fops_u16, debugfs_u16_get, debugfs_u16_set, "%llu\n");
 
 /**
- * debugfs_create_u16 - create a file in the debugfs filesystem that is used to read and write a unsigned 8 bit value.
+ * debugfs_create_u16 - create a file in the debugfs filesystem that is used to read and write an unsigned 16 bit value.
  *
  * @name: a pointer to a string containing the name of the file to create.
  * @mode: the permission that the file should have
@@ -140,7 +140,7 @@ static u64 debugfs_u32_get(void *data)
 DEFINE_SIMPLE_ATTRIBUTE(fops_u32, debugfs_u32_get, debugfs_u32_set, "%llu\n");
 
 /**
- * debugfs_create_u32 - create a file in the debugfs filesystem that is used to read and write a unsigned 8 bit value.
+ * debugfs_create_u32 - create a file in the debugfs filesystem that is used to read and write an unsigned 32 bit value.
  *
  * @name: a pointer to a string containing the name of the file to create.
  * @mode: the permission that the file should have
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 848044af7e16..27f3e787faca 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -1155,15 +1155,16 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode,
  * For writes, i_mutex is not held on entry; it is never taken.
  *
  * DIO_LOCKING (simple locking for regular files)
- * For writes we are called under i_mutex and return with i_mutex held, even though
- * it is internally dropped.
+ * For writes we are called under i_mutex and return with i_mutex held, even
+ * though it is internally dropped.
  * For reads, i_mutex is not held on entry, but it is taken and dropped before
  * returning.
  *
  * DIO_OWN_LOCKING (filesystem provides synchronisation and handling of
  *      uninitialised data, allowing parallel direct readers and writers)
  * For writes we are called without i_mutex, return without it, never touch it.
- * For reads, i_mutex is held on entry and will be released before returning.
+ * For reads we are called under i_mutex and return with i_mutex held, even
+ * though it may be internally dropped.
  *
  * Additional i_alloc_sem locking requirements described inline below.
  */
@@ -1182,7 +1183,8 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
         ssize_t retval = -EINVAL;
         loff_t end = offset;
         struct dio *dio;
-        int reader_with_isem = (rw == READ && dio_lock_type == DIO_OWN_LOCKING);
+        int release_i_mutex = 0;
+        int acquire_i_mutex = 0;
 
         if (rw & WRITE)
                 current->flags |= PF_SYNCWRITE;
@@ -1225,7 +1227,6 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
          *      writers need to grab i_alloc_sem only (i_mutex is already held)
          * For regular files using DIO_OWN_LOCKING,
          *      neither readers nor writers take any locks here
-         *      (i_mutex is already held and release for writers here)
          */
         dio->lock_type = dio_lock_type;
         if (dio_lock_type != DIO_NO_LOCKING) {
@@ -1236,7 +1237,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                         mapping = iocb->ki_filp->f_mapping;
                         if (dio_lock_type != DIO_OWN_LOCKING) {
                                 mutex_lock(&inode->i_mutex);
-                                reader_with_isem = 1;
+                                release_i_mutex = 1;
                         }
 
                         retval = filemap_write_and_wait_range(mapping, offset,
@@ -1248,7 +1249,7 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
 
                         if (dio_lock_type == DIO_OWN_LOCKING) {
                                 mutex_unlock(&inode->i_mutex);
-                                reader_with_isem = 0;
+                                acquire_i_mutex = 1;
                         }
                 }
 
@@ -1269,11 +1270,13 @@ __blockdev_direct_IO(int rw, struct kiocb *iocb, struct inode *inode,
                                 nr_segs, blkbits, get_blocks, end_io, dio);
 
         if (rw == READ && dio_lock_type == DIO_LOCKING)
-                reader_with_isem = 0;
+                release_i_mutex = 0;
 
 out:
-        if (reader_with_isem)
+        if (release_i_mutex)
                 mutex_unlock(&inode->i_mutex);
+        else if (acquire_i_mutex)
+                mutex_lock(&inode->i_mutex);
         if (rw & WRITE)
                 current->flags &= ~PF_SYNCWRITE;
         return retval;
diff --git a/fs/exec.c b/fs/exec.c
index 055378d2513e..0b515ac53134 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -885,6 +885,12 @@ int flush_old_exec(struct linux_binprm * bprm)
         current->flags &= ~PF_RANDOMIZE;
         flush_thread();
 
+        /* Set the new mm task size. We have to do that late because it may
+         * depend on TIF_32BIT which is only updated in flush_thread() on
+         * some architectures like powerpc
+         */
+        current->mm->task_size = TASK_SIZE;
+
         if (bprm->e_uid != current->euid || bprm->e_gid != current->egid || 
             file_permission(bprm->file, MAY_READ) ||
             (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
@@ -1403,7 +1409,7 @@ static void zap_threads (struct mm_struct *mm)
                 do_each_thread(g,p) {
                         if (mm == p->mm && p != tsk &&
                             p->ptrace && p->parent->mm == mm) {
-                                __ptrace_unlink(p);
+                                __ptrace_detach(p, 0);
                         }
                 } while_each_thread(g,p);
                 write_unlock_irq(&tasklist_lock);
diff --git a/fs/ext2/dir.c b/fs/ext2/dir.c
index 7442bdd1267a..b3dbd716cd3a 100644
--- a/fs/ext2/dir.c
+++ b/fs/ext2/dir.c
@@ -256,11 +256,10 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
         unsigned long npages = dir_pages(inode);
         unsigned chunk_mask = ~(ext2_chunk_size(inode)-1);
         unsigned char *types = NULL;
-        int need_revalidate = (filp->f_version != inode->i_version);
-        int ret;
+        int need_revalidate = filp->f_version != inode->i_version;
 
         if (pos > inode->i_size - EXT2_DIR_REC_LEN(1))
-                goto success;
+                return 0;
 
         if (EXT2_HAS_INCOMPAT_FEATURE(sb, EXT2_FEATURE_INCOMPAT_FILETYPE))
                 types = ext2_filetype_table;
@@ -275,12 +274,15 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                                    "bad page in #%lu",
                                    inode->i_ino);
                         filp->f_pos += PAGE_CACHE_SIZE - offset;
-                        ret = -EIO;
-                        goto done;
+                        return -EIO;
                 }
                 kaddr = page_address(page);
-                if (need_revalidate) {
-                        offset = ext2_validate_entry(kaddr, offset, chunk_mask);
+                if (unlikely(need_revalidate)) {
+                        if (offset) {
+                                offset = ext2_validate_entry(kaddr, offset, chunk_mask);
+                                filp->f_pos = (n<<PAGE_CACHE_SHIFT) + offset;
+                        }
+                        filp->f_version = inode->i_version;
                         need_revalidate = 0;
                 }
                 de = (ext2_dirent *)(kaddr+offset);
@@ -289,9 +291,8 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                         if (de->rec_len == 0) {
                                 ext2_error(sb, __FUNCTION__,
                                         "zero-length directory entry");
-                                ret = -EIO;
                                 ext2_put_page(page);
-                                goto done;
+                                return -EIO;
                         }
                         if (de->inode) {
                                 int over;
@@ -306,19 +307,14 @@ ext2_readdir (struct file * filp, void * dirent, filldir_t filldir)
                                                 le32_to_cpu(de->inode), d_type);
                                 if (over) {
                                         ext2_put_page(page);
-                                        goto success;
+                                        return 0;
                                 }
                         }
                         filp->f_pos += le16_to_cpu(de->rec_len);
                 }
                 ext2_put_page(page);
         }
-
-success:
-        ret = 0;
-done:
-        filp->f_version = inode->i_version;
-        return ret;
+        return 0;
 }
 
 /*
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index a2ca3107d475..86ae8e93adb9 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -792,18 +792,20 @@ ext2_xattr_delete_inode(struct inode *inode)
                 ext2_free_blocks(inode, EXT2_I(inode)->i_file_acl, 1);
                 get_bh(bh);
                 bforget(bh);
+                unlock_buffer(bh);
         } else {
                 HDR(bh)->h_refcount = cpu_to_le32(
                         le32_to_cpu(HDR(bh)->h_refcount) - 1);
                 if (ce)
                         mb_cache_entry_release(ce);
+                ea_bdebug(bh, "refcount now=%d",
+                        le32_to_cpu(HDR(bh)->h_refcount));
+                unlock_buffer(bh);
                 mark_buffer_dirty(bh);
                 if (IS_SYNC(inode))
                         sync_dirty_buffer(bh);
                 DQUOT_FREE_BLOCK(inode, 1);
         }
-        ea_bdebug(bh, "refcount now=%d", le32_to_cpu(HDR(bh)->h_refcount) - 1);
-        unlock_buffer(bh);
         EXT2_I(inode)->i_file_acl = 0;
 
 cleanup:
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 3fc4238e9703..0384e539b88f 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1624,15 +1624,14 @@ static int ext3_block_truncate_page(handle_t *handle, struct page *page,
          * For "nobh" option,  we can only work if we don't need to
          * read-in the page - otherwise we create buffers to do the IO.
          */
-        if (!page_has_buffers(page) && test_opt(inode->i_sb, NOBH)) {
-                if (PageUptodate(page)) {
-                        kaddr = kmap_atomic(page, KM_USER0);
-                        memset(kaddr + offset, 0, length);
-                        flush_dcache_page(page);
-                        kunmap_atomic(kaddr, KM_USER0);
-                        set_page_dirty(page);
-                        goto unlock;
-                }
+        if (!page_has_buffers(page) && test_opt(inode->i_sb, NOBH) &&
+             ext3_should_writeback_data(inode) && PageUptodate(page)) {
+                kaddr = kmap_atomic(page, KM_USER0);
+                memset(kaddr + offset, 0, length);
+                flush_dcache_page(page);
+                kunmap_atomic(kaddr, KM_USER0);
+                set_page_dirty(page);
+                goto unlock;
         }
 
         if (!page_has_buffers(page))
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 8bd8ac077704..b8f5cd1e540d 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -2141,7 +2141,8 @@ retry:
                  * We have a transaction open.  All is sweetness.  It also sets
                  * i_size in generic_commit_write().
                  */
-                err = page_symlink(inode, symname, l);
+                err = __page_symlink(inode, symname, l,
+                                mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
                 if (err) {
                         ext3_dec_count(handle, inode);
                         ext3_mark_inode_dirty(handle, inode);
diff --git a/fs/fifo.c b/fs/fifo.c
index 923371b753ab..d13fcd3ec803 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -34,10 +34,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
 {
         int ret;
 
-        ret = -ERESTARTSYS;
-        if (mutex_lock_interruptible(PIPE_MUTEX(*inode)))
-                goto err_nolock_nocleanup;
-
+        mutex_lock(PIPE_MUTEX(*inode));
         if (!inode->i_pipe) {
                 ret = -ENOMEM;
                 if(!pipe_new(inode))
@@ -140,8 +137,6 @@ err:
 
 err_nocleanup:
         mutex_unlock(PIPE_MUTEX(*inode));
-
-err_nolock_nocleanup:
         return ret;
 }
 
diff --git a/fs/file.c b/fs/file.c
index fd066b261c75..cea7cbea11d0 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -379,7 +379,6 @@ static void __devinit fdtable_defer_list_init(int cpu)
 void __init files_defer_init(void)
 {
         int i;
-        /* Really early - can't use for_each_cpu */
-        for (i = 0; i < NR_CPUS; i++)
+        for_each_cpu(i)
                 fdtable_defer_list_init(i);
 }
diff --git a/fs/file_table.c b/fs/file_table.c
index 768b58167543..44fabeaa9415 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -5,6 +5,7 @@
  *  Copyright (C) 1997 David S. Miller (davem@caip.rutgers.edu)
  */
 
+#include <linux/config.h>
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/file.h>
@@ -19,52 +20,67 @@
 #include <linux/capability.h>
 #include <linux/cdev.h>
 #include <linux/fsnotify.h>
+#include <linux/sysctl.h>
+#include <linux/percpu_counter.h>
+
+#include <asm/atomic.h>
 
 /* sysctl tunables... */
 struct files_stat_struct files_stat = {
         .max_files = NR_FILE
 };
 
-EXPORT_SYMBOL(files_stat); /* Needed by unix.o */
-
 /* public. Not pretty! */
- __cacheline_aligned_in_smp DEFINE_SPINLOCK(files_lock);
+__cacheline_aligned_in_smp DEFINE_SPINLOCK(files_lock);
 
-static DEFINE_SPINLOCK(filp_count_lock);
+static struct percpu_counter nr_files __cacheline_aligned_in_smp;
 
-/* slab constructors and destructors are called from arbitrary
- * context and must be fully threaded - use a local spinlock
- * to protect files_stat.nr_files
- */
-void filp_ctor(void *objp, struct kmem_cache *cachep, unsigned long cflags)
+static inline void file_free_rcu(struct rcu_head *head)
 {
-        if ((cflags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
-            SLAB_CTOR_CONSTRUCTOR) {
-                unsigned long flags;
-                spin_lock_irqsave(&filp_count_lock, flags);
-                files_stat.nr_files++;
-                spin_unlock_irqrestore(&filp_count_lock, flags);
-        }
+        struct file *f =  container_of(head, struct file, f_u.fu_rcuhead);
+        kmem_cache_free(filp_cachep, f);
 }
 
-void filp_dtor(void *objp, struct kmem_cache *cachep, unsigned long dflags)
+static inline void file_free(struct file *f)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&filp_count_lock, flags);
-        files_stat.nr_files--;
-        spin_unlock_irqrestore(&filp_count_lock, flags);
+        percpu_counter_dec(&nr_files);
+        call_rcu(&f->f_u.fu_rcuhead, file_free_rcu);
 }
 
-static inline void file_free_rcu(struct rcu_head *head)
+/*
+ * Return the total number of open files in the system
+ */
+static int get_nr_files(void)
 {
-        struct file *f =  container_of(head, struct file, f_u.fu_rcuhead);
-        kmem_cache_free(filp_cachep, f);
+        return percpu_counter_read_positive(&nr_files);
 }
 
-static inline void file_free(struct file *f)
+/*
+ * Return the maximum number of open files in the system
+ */
+int get_max_files(void)
 {
-        call_rcu(&f->f_u.fu_rcuhead, file_free_rcu);
+        return files_stat.max_files;
 }
+EXPORT_SYMBOL_GPL(get_max_files);
+
+/*
+ * Handle nr_files sysctl
+ */
+#if defined(CONFIG_SYSCTL) && defined(CONFIG_PROC_FS)
+int proc_nr_files(ctl_table *table, int write, struct file *filp,
+                     void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        files_stat.nr_files = get_nr_files();
+        return proc_dointvec(table, write, filp, buffer, lenp, ppos);
+}
+#else
+int proc_nr_files(ctl_table *table, int write, struct file *filp,
+                     void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        return -ENOSYS;
+}
+#endif
 
 /* Find an unused file structure and return a pointer to it.
  * Returns NULL, if there are no more free file structures or
@@ -78,14 +94,20 @@ struct file *get_empty_filp(void)
         /*
          * Privileged users can go above max_files
          */
-        if (files_stat.nr_files >= files_stat.max_files &&
-                                !capable(CAP_SYS_ADMIN))
-                goto over;
+        if (get_nr_files() >= files_stat.max_files && !capable(CAP_SYS_ADMIN)) {
+                /*
+                 * percpu_counters are inaccurate.  Do an expensive check before
+                 * we go and fail.
+                 */
+                if (percpu_counter_sum(&nr_files) >= files_stat.max_files)
+                        goto over;
+        }
 
         f = kmem_cache_alloc(filp_cachep, GFP_KERNEL);
         if (f == NULL)
                 goto fail;
 
+        percpu_counter_inc(&nr_files);
         memset(f, 0, sizeof(*f));
         if (security_file_alloc(f))
                 goto fail_sec;
@@ -101,10 +123,10 @@ struct file *get_empty_filp(void)
 
 over:
         /* Ran out of filps - report that */
-        if (files_stat.nr_files > old_max) {
+        if (get_nr_files() > old_max) {
                 printk(KERN_INFO "VFS: file-max limit %d reached\n",
-                                        files_stat.max_files);
-                old_max = files_stat.nr_files;
+                                        get_max_files());
+                old_max = get_nr_files();
         }
         goto fail;
 
@@ -276,4 +298,5 @@ void __init files_init(unsigned long mempages)
         if (files_stat.max_files < NR_FILE)
                 files_stat.max_files = NR_FILE;
         files_defer_init();
+        percpu_counter_init(&nr_files);
 } 
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 4526da8907c6..0c9a2ee54c91 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -66,6 +66,12 @@ static void restore_sigs(sigset_t *oldset)
         sigprocmask(SIG_SETMASK, oldset, NULL);
 }
 
+/*
+ * Reset request, so that it can be reused
+ *
+ * The caller must be _very_ careful to make sure, that it is holding
+ * the only reference to req
+ */
 void fuse_reset_request(struct fuse_req *req)
 {
         int preallocated = req->preallocated;
@@ -120,9 +126,9 @@ struct fuse_req *fuse_get_request(struct fuse_conn *fc)
         return do_get_request(fc);
 }
 
+/* Must be called with fuse_lock held */
 static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
 {
-        spin_lock(&fuse_lock);
         if (req->preallocated) {
                 atomic_dec(&fc->num_waiting);
                 list_add(&req->list, &fc->unused_list);
@@ -134,11 +140,19 @@ static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
                 fc->outstanding_debt--;
         else
                 up(&fc->outstanding_sem);
-        spin_unlock(&fuse_lock);
 }
 
 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 {
+        if (atomic_dec_and_test(&req->count)) {
+                spin_lock(&fuse_lock);
+                fuse_putback_request(fc, req);
+                spin_unlock(&fuse_lock);
+        }
+}
+
+static void fuse_put_request_locked(struct fuse_conn *fc, struct fuse_req *req)
+{
         if (atomic_dec_and_test(&req->count))
                 fuse_putback_request(fc, req);
 }
@@ -163,26 +177,36 @@ void fuse_release_background(struct fuse_req *req)
  * still waiting), the 'end' callback is called if given, else the
  * reference to the request is released
  *
+ * Releasing extra reference for foreground requests must be done
+ * within the same locked region as setting state to finished.  This
+ * is because fuse_reset_request() may be called after request is
+ * finished and it must be the sole possessor.  If request is
+ * interrupted and put in the background, it will return with an error
+ * and hence never be reset and reused.
+ *
  * Called with fuse_lock, unlocks it
  */
 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
-        req->end = NULL;
         list_del(&req->list);
         req->state = FUSE_REQ_FINISHED;
-        spin_unlock(&fuse_lock);
-        if (req->background) {
+        if (!req->background) {
+                wake_up(&req->waitq);
+                fuse_put_request_locked(fc, req);
+                spin_unlock(&fuse_lock);
+        } else {
+                void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
+                req->end = NULL;
+                spin_unlock(&fuse_lock);
                 down_read(&fc->sbput_sem);
                 if (fc->mounted)
                         fuse_release_background(req);
                 up_read(&fc->sbput_sem);
+                if (end)
+                        end(fc, req);
+                else
+                        fuse_put_request(fc, req);
         }
-        wake_up(&req->waitq);
-        if (end)
-                end(fc, req);
-        else
-                fuse_put_request(fc, req);
 }
 
 /*
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 21fd59c7bc24..c72a8a97935c 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -111,6 +111,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
 
                 /* Doesn't hurt to "reset" the validity timeout */
                 fuse_invalidate_entry_cache(entry);
+
+                /* For negative dentries, always do a fresh lookup */
                 if (!inode)
                         return 0;
 
@@ -122,6 +124,9 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 fuse_lookup_init(req, entry->d_parent->d_inode, entry, &outarg);
                 request_send(fc, req);
                 err = req->out.h.error;
+                /* Zero nodeid is same as -ENOENT */
+                if (!err && !outarg.nodeid)
+                        err = -ENOENT;
                 if (!err) {
                         struct fuse_inode *fi = get_fuse_inode(inode);
                         if (outarg.nodeid != get_node_id(inode)) {
@@ -190,8 +195,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
-        if (!err && ((outarg.nodeid && invalid_nodeid(outarg.nodeid)) ||
-                     !valid_mode(outarg.attr.mode)))
+        /* Zero nodeid is same as -ENOENT, but with valid timeout */
+        if (!err && outarg.nodeid &&
+            (invalid_nodeid(outarg.nodeid) || !valid_mode(outarg.attr.mode)))
                 err = -EIO;
         if (!err && outarg.nodeid) {
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 296351615b00..6f05379b0a0d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -116,9 +116,14 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
 /* Special case for failed iget in CREATE */
 static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        u64 nodeid = req->in.h.nodeid;
-        fuse_reset_request(req);
-        fuse_send_forget(fc, req, nodeid, 1);
+        /* If called from end_io_requests(), req has more than one
+           reference and fuse_reset_request() cannot work */
+        if (fc->connected) {
+                u64 nodeid = req->in.h.nodeid;
+                fuse_reset_request(req);
+                fuse_send_forget(fc, req, nodeid, 1);
+        } else
+                fuse_put_request(fc, req);
 }
 
 void fuse_send_release(struct fuse_conn *fc, struct fuse_file *ff,
diff --git a/fs/inotify.c b/fs/inotify.c
index 878ccca61213..3041503bde02 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -967,7 +967,7 @@ asmlinkage long sys_inotify_add_watch(int fd, const char __user *path, u32 mask)
                 mask_add = 1;
 
         /* don't let user-space set invalid bits: we don't want flags set */
-        mask &= IN_ALL_EVENTS;
+        mask &= IN_ALL_EVENTS | IN_ONESHOT;
         if (unlikely(!mask)) {
                 ret = -EINVAL;
                 goto out;
diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
index e6265a0b56b8..543ed543d1e5 100644
--- a/fs/jbd/checkpoint.c
+++ b/fs/jbd/checkpoint.c
@@ -24,75 +24,29 @@
 #include <linux/slab.h>
 
 /*
- * Unlink a buffer from a transaction checkpoint list.
+ * Unlink a buffer from a transaction.
  *
  * Called with j_list_lock held.
  */
 
-static void __buffer_unlink_first(struct journal_head *jh)
+static inline void __buffer_unlink(struct journal_head *jh)
 {
         transaction_t *transaction;
 
         transaction = jh->b_cp_transaction;
+        jh->b_cp_transaction = NULL;
 
         jh->b_cpnext->b_cpprev = jh->b_cpprev;
         jh->b_cpprev->b_cpnext = jh->b_cpnext;
-        if (transaction->t_checkpoint_list == jh) {
+        if (transaction->t_checkpoint_list == jh)
                 transaction->t_checkpoint_list = jh->b_cpnext;
-                if (transaction->t_checkpoint_list == jh)
-                        transaction->t_checkpoint_list = NULL;
-        }
-}
-
-/*
- * Unlink a buffer from a transaction checkpoint(io) list.
- *
- * Called with j_list_lock held.
- */
-
-static inline void __buffer_unlink(struct journal_head *jh)
-{
-        transaction_t *transaction;
-
-        transaction = jh->b_cp_transaction;
-
-        __buffer_unlink_first(jh);
-        if (transaction->t_checkpoint_io_list == jh) {
-                transaction->t_checkpoint_io_list = jh->b_cpnext;
-                if (transaction->t_checkpoint_io_list == jh)
-                        transaction->t_checkpoint_io_list = NULL;
-        }
-}
-
-/*
- * Move a buffer from the checkpoint list to the checkpoint io list
- *
- * Called with j_list_lock held
- */
-
-static inline void __buffer_relink_io(struct journal_head *jh)
-{
-        transaction_t *transaction;
-
-        transaction = jh->b_cp_transaction;
-        __buffer_unlink_first(jh);
-
-        if (!transaction->t_checkpoint_io_list) {
-                jh->b_cpnext = jh->b_cpprev = jh;
-        } else {
-                jh->b_cpnext = transaction->t_checkpoint_io_list;
-                jh->b_cpprev = transaction->t_checkpoint_io_list->b_cpprev;
-                jh->b_cpprev->b_cpnext = jh;
-                jh->b_cpnext->b_cpprev = jh;
-        }
-        transaction->t_checkpoint_io_list = jh;
+        if (transaction->t_checkpoint_list == jh)
+                transaction->t_checkpoint_list = NULL;
 }
 
 /*
  * Try to release a checkpointed buffer from its transaction.
- * Returns 1 if we released it and 2 if we also released the
- * whole transaction.
- *
+ * Returns 1 if we released it.
  * Requires j_list_lock
  * Called under jbd_lock_bh_state(jh2bh(jh)), and drops it
  */
@@ -103,11 +57,12 @@ static int __try_to_free_cp_buf(struct journal_head *jh)
 
         if (jh->b_jlist == BJ_None && !buffer_locked(bh) && !buffer_dirty(bh)) {
                 JBUFFER_TRACE(jh, "remove from checkpoint list");
-                ret = __journal_remove_checkpoint(jh) + 1;
+                __journal_remove_checkpoint(jh);
                 jbd_unlock_bh_state(bh);
                 journal_remove_journal_head(bh);
                 BUFFER_TRACE(bh, "release");
                 __brelse(bh);
+                ret = 1;
         } else {
                 jbd_unlock_bh_state(bh);
         }
@@ -162,53 +117,83 @@ static void jbd_sync_bh(journal_t *journal, struct buffer_head *bh)
 }
 
 /*
- * Clean up transaction's list of buffers submitted for io.
- * We wait for any pending IO to complete and remove any clean
- * buffers. Note that we take the buffers in the opposite ordering
- * from the one in which they were submitted for IO.
+ * Clean up a transaction's checkpoint list.
+ *
+ * We wait for any pending IO to complete and make sure any clean
+ * buffers are removed from the transaction.
+ *
+ * Return 1 if we performed any actions which might have destroyed the
+ * checkpoint.  (journal_remove_checkpoint() deletes the transaction when
+ * the last checkpoint buffer is cleansed)
  *
  * Called with j_list_lock held.
  */
-
-static void __wait_cp_io(journal_t *journal, transaction_t *transaction)
+static int __cleanup_transaction(journal_t *journal, transaction_t *transaction)
 {
-        struct journal_head *jh;
+        struct journal_head *jh, *next_jh, *last_jh;
         struct buffer_head *bh;
-        tid_t this_tid;
-        int released = 0;
-
-        this_tid = transaction->t_tid;
-restart:
-        /* Didn't somebody clean up the transaction in the meanwhile */
-        if (journal->j_checkpoint_transactions != transaction ||
-                transaction->t_tid != this_tid)
-                return;
-        while (!released && transaction->t_checkpoint_io_list) {
-                jh = transaction->t_checkpoint_io_list;
+        int ret = 0;
+
+        assert_spin_locked(&journal->j_list_lock);
+        jh = transaction->t_checkpoint_list;
+        if (!jh)
+                return 0;
+
+        last_jh = jh->b_cpprev;
+        next_jh = jh;
+        do {
+                jh = next_jh;
                 bh = jh2bh(jh);
-                if (!jbd_trylock_bh_state(bh)) {
-                        jbd_sync_bh(journal, bh);
-                        spin_lock(&journal->j_list_lock);
-                        goto restart;
-                }
                 if (buffer_locked(bh)) {
                         atomic_inc(&bh->b_count);
                         spin_unlock(&journal->j_list_lock);
-                        jbd_unlock_bh_state(bh);
                         wait_on_buffer(bh);
                         /* the journal_head may have gone by now */
                         BUFFER_TRACE(bh, "brelse");
                         __brelse(bh);
-                        spin_lock(&journal->j_list_lock);
-                        goto restart;
+                        goto out_return_1;
                 }
+
                 /*
-                 * Now in whatever state the buffer currently is, we know that
-                 * it has been written out and so we can drop it from the list
+                 * This is foul
                  */
-                released = __journal_remove_checkpoint(jh);
-                jbd_unlock_bh_state(bh);
-        }
+                if (!jbd_trylock_bh_state(bh)) {
+                        jbd_sync_bh(journal, bh);
+                        goto out_return_1;
+                }
+
+                if (jh->b_transaction != NULL) {
+                        transaction_t *t = jh->b_transaction;
+                        tid_t tid = t->t_tid;
+
+                        spin_unlock(&journal->j_list_lock);
+                        jbd_unlock_bh_state(bh);
+                        log_start_commit(journal, tid);
+                        log_wait_commit(journal, tid);
+                        goto out_return_1;
+                }
+
+                /*
+                 * AKPM: I think the buffer_jbddirty test is redundant - it
+                 * shouldn't have NULL b_transaction?
+                 */
+                next_jh = jh->b_cpnext;
+                if (!buffer_dirty(bh) && !buffer_jbddirty(bh)) {
+                        BUFFER_TRACE(bh, "remove from checkpoint");
+                        __journal_remove_checkpoint(jh);
+                        jbd_unlock_bh_state(bh);
+                        journal_remove_journal_head(bh);
+                        __brelse(bh);
+                        ret = 1;
+                } else {
+                        jbd_unlock_bh_state(bh);
+                }
+        } while (jh != last_jh);
+
+        return ret;
+out_return_1:
+        spin_lock(&journal->j_list_lock);
+        return 1;
 }
 
 #define NR_BATCH        64
@@ -218,7 +203,9 @@ __flush_batch(journal_t *journal, struct buffer_head **bhs, int *batch_count)
 {
         int i;
 
+        spin_unlock(&journal->j_list_lock);
         ll_rw_block(SWRITE, *batch_count, bhs);
+        spin_lock(&journal->j_list_lock);
         for (i = 0; i < *batch_count; i++) {
                 struct buffer_head *bh = bhs[i];
                 clear_buffer_jwrite(bh);
@@ -234,46 +221,19 @@ __flush_batch(journal_t *journal, struct buffer_head **bhs, int *batch_count)
  * Return 1 if something happened which requires us to abort the current
  * scan of the checkpoint list.  
  *
- * Called with j_list_lock held and drops it if 1 is returned
+ * Called with j_list_lock held.
  * Called under jbd_lock_bh_state(jh2bh(jh)), and drops it
  */
-static int __process_buffer(journal_t *journal, struct journal_head *jh,
-                        struct buffer_head **bhs, int *batch_count)
+static int __flush_buffer(journal_t *journal, struct journal_head *jh,
+                        struct buffer_head **bhs, int *batch_count,
+                        int *drop_count)
 {
         struct buffer_head *bh = jh2bh(jh);
         int ret = 0;
 
-        if (buffer_locked(bh)) {
-                get_bh(bh);
-                spin_unlock(&journal->j_list_lock);
-                jbd_unlock_bh_state(bh);
-                wait_on_buffer(bh);
-                /* the journal_head may have gone by now */
-                BUFFER_TRACE(bh, "brelse");
-                put_bh(bh);
-                ret = 1;
-        }
-        else if (jh->b_transaction != NULL) {
-                transaction_t *t = jh->b_transaction;
-                tid_t tid = t->t_tid;
+        if (buffer_dirty(bh) && !buffer_locked(bh) && jh->b_jlist == BJ_None) {
+                J_ASSERT_JH(jh, jh->b_transaction == NULL);
 
-                spin_unlock(&journal->j_list_lock);
-                jbd_unlock_bh_state(bh);
-                log_start_commit(journal, tid);
-                log_wait_commit(journal, tid);
-                ret = 1;
-        }
-        else if (!buffer_dirty(bh)) {
-                J_ASSERT_JH(jh, !buffer_jbddirty(bh));
-                BUFFER_TRACE(bh, "remove from checkpoint");
-                __journal_remove_checkpoint(jh);
-                spin_unlock(&journal->j_list_lock);
-                jbd_unlock_bh_state(bh);
-                journal_remove_journal_head(bh);
-                put_bh(bh);
-                ret = 1;
-        }
-        else {
                 /*
                  * Important: we are about to write the buffer, and
                  * possibly block, while still holding the journal lock.
@@ -286,30 +246,45 @@ static int __process_buffer(journal_t *journal, struct journal_head *jh,
                 J_ASSERT_BH(bh, !buffer_jwrite(bh));
                 set_buffer_jwrite(bh);
                 bhs[*batch_count] = bh;
-                __buffer_relink_io(jh);
                 jbd_unlock_bh_state(bh);
                 (*batch_count)++;
                 if (*batch_count == NR_BATCH) {
-                        spin_unlock(&journal->j_list_lock);
                         __flush_batch(journal, bhs, batch_count);
                         ret = 1;
                 }
+        } else {
+                int last_buffer = 0;
+                if (jh->b_cpnext == jh) {
+                        /* We may be about to drop the transaction.  Tell the
+                         * caller that the lists have changed.
+                         */
+                        last_buffer = 1;
+                }
+                if (__try_to_free_cp_buf(jh)) {
+                        (*drop_count)++;
+                        ret = last_buffer;
+                }
         }
         return ret;
 }
 
 /*
- * Perform an actual checkpoint. We take the first transaction on the
- * list of transactions to be checkpointed and send all its buffers
- * to disk. We submit larger chunks of data at once.
+ * Perform an actual checkpoint.  We don't write out only enough to
+ * satisfy the current blocked requests: rather we submit a reasonably
+ * sized chunk of the outstanding data to disk at once for
+ * efficiency.  __log_wait_for_space() will retry if we didn't free enough.
  * 
+ * However, we _do_ take into account the amount requested so that once
+ * the IO has been queued, we can return as soon as enough of it has
+ * completed to disk.
+ *
  * The journal should be locked before calling this function.
  */
 int log_do_checkpoint(journal_t *journal)
 {
-        transaction_t *transaction;
-        tid_t this_tid;
         int result;
+        int batch_count = 0;
+        struct buffer_head *bhs[NR_BATCH];
 
         jbd_debug(1, "Start checkpoint\n");
 
@@ -324,70 +299,79 @@ int log_do_checkpoint(journal_t *journal)
                 return result;
 
         /*
-         * OK, we need to start writing disk blocks.  Take one transaction
-         * and write it.
+         * OK, we need to start writing disk blocks.  Try to free up a
+         * quarter of the log in a single checkpoint if we can.
          */
-        spin_lock(&journal->j_list_lock);
-        if (!journal->j_checkpoint_transactions)
-                goto out;
-        transaction = journal->j_checkpoint_transactions;
-        this_tid = transaction->t_tid;
-restart:
         /*
-         * If someone cleaned up this transaction while we slept, we're
-         * done (maybe it's a new transaction, but it fell at the same
-         * address).
+         * AKPM: check this code.  I had a feeling a while back that it
+         * degenerates into a busy loop at unmount time.
          */
-        if (journal->j_checkpoint_transactions == transaction &&
-                        transaction->t_tid == this_tid) {
-                int batch_count = 0;
-                struct buffer_head *bhs[NR_BATCH];
-                struct journal_head *jh;
-                int retry = 0;
-
-                while (!retry && transaction->t_checkpoint_list) {
+        spin_lock(&journal->j_list_lock);
+        while (journal->j_checkpoint_transactions) {
+                transaction_t *transaction;
+                struct journal_head *jh, *last_jh, *next_jh;
+                int drop_count = 0;
+                int cleanup_ret, retry = 0;
+                tid_t this_tid;
+
+                transaction = journal->j_checkpoint_transactions;
+                this_tid = transaction->t_tid;
+                jh = transaction->t_checkpoint_list;
+                last_jh = jh->b_cpprev;
+                next_jh = jh;
+                do {
                         struct buffer_head *bh;
 
-                        jh = transaction->t_checkpoint_list;
+                        jh = next_jh;
+                        next_jh = jh->b_cpnext;
                         bh = jh2bh(jh);
                         if (!jbd_trylock_bh_state(bh)) {
                                 jbd_sync_bh(journal, bh);
+                                spin_lock(&journal->j_list_lock);
                                 retry = 1;
                                 break;
                         }
-                        retry = __process_buffer(journal, jh, bhs,
-                                                &batch_count);
-                        if (!retry &&
-                            lock_need_resched(&journal->j_list_lock)) {
-                                spin_unlock(&journal->j_list_lock);
+                        retry = __flush_buffer(journal, jh, bhs, &batch_count, &drop_count);
+                        if (cond_resched_lock(&journal->j_list_lock)) {
                                 retry = 1;
                                 break;
                         }
-                }
+                } while (jh != last_jh && !retry);
 
                 if (batch_count) {
-                        if (!retry) {
-                                spin_unlock(&journal->j_list_lock);
-                                retry = 1;
-                        }
                         __flush_batch(journal, bhs, &batch_count);
+                        retry = 1;
                 }
 
-                if (retry) {
-                        spin_lock(&journal->j_list_lock);
-                        goto restart;
-                }
                 /*
-                 * Now we have cleaned up the first transaction's checkpoint
-                 * list.  Let's clean up the second one.
+                 * If someone cleaned up this transaction while we slept, we're
+                 * done
+                 */
+                if (journal->j_checkpoint_transactions != transaction)
+                        break;
+                if (retry)
+                        continue;
+                /*
+                 * Maybe it's a new transaction, but it fell at the same
+                 * address
                  */
-                __wait_cp_io(journal, transaction);
+                if (transaction->t_tid != this_tid)
+                        continue;
+                /*
+                 * We have walked the whole transaction list without
+                 * finding anything to write to disk.  We had better be
+                 * able to make some progress or we are in trouble.
+                 */
+                cleanup_ret = __cleanup_transaction(journal, transaction);
+                J_ASSERT(drop_count != 0 || cleanup_ret != 0);
+                if (journal->j_checkpoint_transactions != transaction)
+                        break;
         }
-out:
         spin_unlock(&journal->j_list_lock);
         result = cleanup_journal_tail(journal);
         if (result < 0)
                 return result;
+
         return 0;
 }
 
@@ -472,91 +456,52 @@ int cleanup_journal_tail(journal_t *journal)
 /* Checkpoint list management */
 
 /*
- * journal_clean_one_cp_list
- *
- * Find all the written-back checkpoint buffers in the given list and release them.
- *
- * Called with the journal locked.
- * Called with j_list_lock held.
- * Returns number of bufers reaped (for debug)
- */
-
-static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
-{
-        struct journal_head *last_jh;
-        struct journal_head *next_jh = jh;
-        int ret, freed = 0;
-
-        *released = 0;
-        if (!jh)
-                return 0;
-
-        last_jh = jh->b_cpprev;
-        do {
-                jh = next_jh;
-                next_jh = jh->b_cpnext;
-                /* Use trylock because of the ranking */
-                if (jbd_trylock_bh_state(jh2bh(jh))) {
-                        ret = __try_to_free_cp_buf(jh);
-                        if (ret) {
-                                freed++;
-                                if (ret == 2) {
-                                        *released = 1;
-                                        return freed;
-                                }
-                        }
-                }
-                /*
-                 * This function only frees up some memory if possible so we
-                 * dont have an obligation to finish processing. Bail out if
-                 * preemption requested:
-                 */
-                if (need_resched())
-                        return freed;
-        } while (jh != last_jh);
-
-        return freed;
-}
-
-/*
  * journal_clean_checkpoint_list
  *
  * Find all the written-back checkpoint buffers in the journal and release them.
  *
  * Called with the journal locked.
  * Called with j_list_lock held.
- * Returns number of buffers reaped (for debug)
+ * Returns number of bufers reaped (for debug)
  */
 
 int __journal_clean_checkpoint_list(journal_t *journal)
 {
         transaction_t *transaction, *last_transaction, *next_transaction;
-        int ret = 0, released;
+        int ret = 0;
 
         transaction = journal->j_checkpoint_transactions;
-        if (!transaction)
+        if (transaction == 0)
                 goto out;
 
         last_transaction = transaction->t_cpprev;
         next_transaction = transaction;
         do {
+                struct journal_head *jh;
+
                 transaction = next_transaction;
                 next_transaction = transaction->t_cpnext;
-                ret += journal_clean_one_cp_list(transaction->
-                                t_checkpoint_list, &released);
-                if (need_resched())
-                        goto out;
-                if (released)
-                        continue;
-                /*
-                 * It is essential that we are as careful as in the case of
-                 * t_checkpoint_list with removing the buffer from the list as
-                 * we can possibly see not yet submitted buffers on io_list
-                 */
-                ret += journal_clean_one_cp_list(transaction->
-                                t_checkpoint_io_list, &released);
-                if (need_resched())
-                        goto out;
+                jh = transaction->t_checkpoint_list;
+                if (jh) {
+                        struct journal_head *last_jh = jh->b_cpprev;
+                        struct journal_head *next_jh = jh;
+
+                        do {
+                                jh = next_jh;
+                                next_jh = jh->b_cpnext;
+                                /* Use trylock because of the ranknig */
+                                if (jbd_trylock_bh_state(jh2bh(jh)))
+                                        ret += __try_to_free_cp_buf(jh);
+                                /*
+                                 * This function only frees up some memory
+                                 * if possible so we dont have an obligation
+                                 * to finish processing. Bail out if preemption
+                                 * requested:
+                                 */
+                                if (need_resched())
+                                        goto out;
+                        } while (jh != last_jh);
+                }
         } while (transaction != last_transaction);
 out:
         return ret;
@@ -571,22 +516,18 @@ out:
  * buffer updates committed in that transaction have safely been stored
  * elsewhere on disk.  To achieve this, all of the buffers in a
  * transaction need to be maintained on the transaction's checkpoint
- * lists until they have been rewritten, at which point this function is
+ * list until they have been rewritten, at which point this function is
  * called to remove the buffer from the existing transaction's
- * checkpoint lists.
- *
- * The function returns 1 if it frees the transaction, 0 otherwise.
+ * checkpoint list.
  *
  * This function is called with the journal locked.
  * This function is called with j_list_lock held.
- * This function is called with jbd_lock_bh_state(jh2bh(jh))
  */
 
-int __journal_remove_checkpoint(struct journal_head *jh)
+void __journal_remove_checkpoint(struct journal_head *jh)
 {
         transaction_t *transaction;
         journal_t *journal;
-        int ret = 0;
 
         JBUFFER_TRACE(jh, "entry");
 
@@ -597,10 +538,8 @@ int __journal_remove_checkpoint(struct journal_head *jh)
         journal = transaction->t_journal;
 
         __buffer_unlink(jh);
-        jh->b_cp_transaction = NULL;
 
-        if (transaction->t_checkpoint_list != NULL ||
-            transaction->t_checkpoint_io_list != NULL)
+        if (transaction->t_checkpoint_list != NULL)
                 goto out;
         JBUFFER_TRACE(jh, "transaction has no more buffers");
 
@@ -626,10 +565,8 @@ int __journal_remove_checkpoint(struct journal_head *jh)
         /* Just in case anybody was waiting for more transactions to be
            checkpointed... */
         wake_up(&journal->j_wait_logspace);
-        ret = 1;
 out:
         JBUFFER_TRACE(jh, "exit");
-        return ret;
 }
 
 /*
@@ -691,7 +628,6 @@ void __journal_drop_transaction(journal_t *journal, transaction_t *transaction)
         J_ASSERT(transaction->t_shadow_list == NULL);
         J_ASSERT(transaction->t_log_list == NULL);
         J_ASSERT(transaction->t_checkpoint_list == NULL);
-        J_ASSERT(transaction->t_checkpoint_io_list == NULL);
         J_ASSERT(transaction->t_updates == 0);
         J_ASSERT(journal->j_committing_transaction != transaction);
         J_ASSERT(journal->j_running_transaction != transaction);
diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
index 29e62d98bae6..002ad2bbc769 100644
--- a/fs/jbd/commit.c
+++ b/fs/jbd/commit.c
@@ -829,8 +829,7 @@ restart_loop:
         journal->j_committing_transaction = NULL;
         spin_unlock(&journal->j_state_lock);
 
-        if (commit_transaction->t_checkpoint_list == NULL &&
-            commit_transaction->t_checkpoint_io_list == NULL) {
+        if (commit_transaction->t_checkpoint_list == NULL) {
                 __journal_drop_transaction(journal, commit_transaction);
         } else {
                 if (journal->j_checkpoint_transactions == NULL) {
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index 429f4b263cf1..ca917973c2c0 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -1308,6 +1308,7 @@ int journal_stop(handle_t *handle)
         transaction_t *transaction = handle->h_transaction;
         journal_t *journal = transaction->t_journal;
         int old_handle_count, err;
+        pid_t pid;
 
         J_ASSERT(transaction->t_updates > 0);
         J_ASSERT(journal_current_handle() == handle);
@@ -1333,8 +1334,15 @@ int journal_stop(handle_t *handle)
          * It doesn't cost much - we're about to run a commit and sleep
          * on IO anyway.  Speeds up many-threaded, many-dir operations
          * by 30x or more...
+         *
+         * But don't do this if this process was the most recent one to
+         * perform a synchronous write.  We do this to detect the case where a
+         * single process is doing a stream of sync writes.  No point in waiting
+         * for joiners in that case.
          */
-        if (handle->h_sync) {
+        pid = current->pid;
+        if (handle->h_sync && journal->j_last_sync_writer != pid) {
+                journal->j_last_sync_writer = pid;
                 do {
                         old_handle_count = transaction->t_handle_count;
                         schedule_timeout_uninterruptible(1);
diff --git a/fs/jffs2/nodelist.c b/fs/jffs2/nodelist.c
index b635e167a3fa..d4d0c41490cd 100644
--- a/fs/jffs2/nodelist.c
+++ b/fs/jffs2/nodelist.c
@@ -406,7 +406,8 @@ static int check_node_data(struct jffs2_sb_info *c, struct jffs2_tmp_dnode_info
         int err = 0, pointed = 0;
         struct jffs2_eraseblock *jeb;
         unsigned char *buffer;
-        uint32_t crc, ofs, retlen, len;
+        uint32_t crc, ofs, len;
+        size_t retlen;
 
         BUG_ON(tn->csize == 0);
 
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 5f0652df5d47..f1695642d0f7 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -112,7 +112,7 @@ static struct jffs2_raw_node_ref *jffs2_first_valid_node(struct jffs2_raw_node_r
  *          negative error code on failure.
  */
 static inline int read_direntry(struct jffs2_sb_info *c, struct jffs2_raw_node_ref *ref,
-                                struct jffs2_raw_dirent *rd, uint32_t read, struct jffs2_full_dirent **fdp,
+                                struct jffs2_raw_dirent *rd, size_t read, struct jffs2_full_dirent **fdp,
                                 uint32_t *latest_mctime, uint32_t *mctime_ver)
 {
         struct jffs2_full_dirent *fd;
diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
index 3e51dd1da8aa..cf55b221fc2b 100644
--- a/fs/jffs2/scan.c
+++ b/fs/jffs2/scan.c
@@ -233,7 +233,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c)
                 c->nextblock->dirty_size = 0;
         }
 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
-        if (!jffs2_can_mark_obsolete(c) && c->nextblock && (c->nextblock->free_size % c->wbuf_pagesize)) {
+        if (!jffs2_can_mark_obsolete(c) && c->wbuf_pagesize && c->nextblock && (c->nextblock->free_size % c->wbuf_pagesize)) {
                 /* If we're going to start writing into a block which already
                    contains data, and the end of the data isn't page-aligned,
                    skip a little and align it. */
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 2967b7393415..79b5404db100 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -532,10 +532,10 @@ dbUpdatePMap(struct inode *ipbmap,
 
                 lastlblkno = lblkno;
 
+                LOGSYNC_LOCK(log, flags);
                 if (mp->lsn != 0) {
                         /* inherit older/smaller lsn */
                         logdiff(diffp, mp->lsn, log);
-                        LOGSYNC_LOCK(log, flags);
                         if (difft < diffp) {
                                 mp->lsn = lsn;
 
@@ -548,20 +548,17 @@ dbUpdatePMap(struct inode *ipbmap,
                         logdiff(diffp, mp->clsn, log);
                         if (difft > diffp)
                                 mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log, flags);
                 } else {
                         mp->log = log;
                         mp->lsn = lsn;
 
                         /* insert bp after tblock in logsync list */
-                        LOGSYNC_LOCK(log, flags);
-
                         log->count++;
                         list_add(&mp->synclist, &tblk->synclist);
 
                         mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log, flags);
                 }
+                LOGSYNC_UNLOCK(log, flags);
         }
 
         /* write the last buffer. */
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 31b4aa13dd4b..4efa0d0eec39 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -2844,11 +2844,11 @@ diUpdatePMap(struct inode *ipimap,
          */
         lsn = tblk->lsn;
         log = JFS_SBI(tblk->sb)->log;
+        LOGSYNC_LOCK(log, flags);
         if (mp->lsn != 0) {
                 /* inherit older/smaller lsn */
                 logdiff(difft, lsn, log);
                 logdiff(diffp, mp->lsn, log);
-                LOGSYNC_LOCK(log, flags);
                 if (difft < diffp) {
                         mp->lsn = lsn;
                         /* move mp after tblock in logsync list */
@@ -2860,17 +2860,15 @@ diUpdatePMap(struct inode *ipimap,
                 logdiff(diffp, mp->clsn, log);
                 if (difft > diffp)
                         mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log, flags);
         } else {
                 mp->log = log;
                 mp->lsn = lsn;
                 /* insert mp after tblock in logsync list */
-                LOGSYNC_LOCK(log, flags);
                 log->count++;
                 list_add(&mp->synclist, &tblk->synclist);
                 mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log, flags);
         }
+        LOGSYNC_UNLOCK(log, flags);
         write_metapage(mp);
         return (0);
 }
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 3eaf6e701087..da6354baa0b8 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -111,9 +111,10 @@ long nlmclnt_block(struct nlm_rqst *req, long timeout)
 /*
  * The server lockd has called us back to tell us the lock was granted
  */
-u32
-nlmclnt_grant(struct nlm_lock *lock)
+u32 nlmclnt_grant(const struct sockaddr_in *addr, const struct nlm_lock *lock)
 {
+        const struct file_lock *fl = &lock->fl;
+        const struct nfs_fh *fh = &lock->fh;
         struct nlm_wait *block;
         u32 res = nlm_lck_denied;
 
@@ -122,14 +123,20 @@ nlmclnt_grant(struct nlm_lock *lock)
          * Warning: must not use cookie to match it!
          */
         list_for_each_entry(block, &nlm_blocked, b_list) {
-                if (nlm_compare_locks(block->b_lock, &lock->fl)) {
-                        /* Alright, we found a lock. Set the return status
-                         * and wake up the caller
-                         */
-                        block->b_status = NLM_LCK_GRANTED;
-                        wake_up(&block->b_wait);
-                        res = nlm_granted;
-                }
+                struct file_lock *fl_blocked = block->b_lock;
+
+                if (!nlm_compare_locks(fl_blocked, fl))
+                        continue;
+                if (!nlm_cmp_addr(&block->b_host->h_addr, addr))
+                        continue;
+                if (nfs_compare_fh(NFS_FH(fl_blocked->fl_file->f_dentry->d_inode) ,fh) != 0)
+                        continue;
+                /* Alright, we found a lock. Set the return status
+                 * and wake up the caller
+                 */
+                block->b_status = NLM_LCK_GRANTED;
+                wake_up(&block->b_wait);
+                res = nlm_granted;
         }
         return res;
 }
diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
index 220058d8616d..970b6a6aa337 100644
--- a/fs/lockd/clntproc.c
+++ b/fs/lockd/clntproc.c
@@ -662,12 +662,18 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
          * reclaimed while we're stuck in the unlock call. */
         fl->fl_u.nfs_fl.flags &= ~NFS_LCK_GRANTED;
 
+        /*
+         * Note: the server is supposed to either grant us the unlock
+         * request, or to deny it with NLM_LCK_DENIED_GRACE_PERIOD. In either
+         * case, we want to unlock.
+         */
+        do_vfs_lock(fl);
+
         if (req->a_flags & RPC_TASK_ASYNC) {
                 status = nlmclnt_async_call(req, NLMPROC_UNLOCK,
                                         &nlmclnt_unlock_ops);
                 /* Hrmf... Do the unlock early since locks_remove_posix()
                  * really expects us to free the lock synchronously */
-                do_vfs_lock(fl);
                 if (status < 0) {
                         nlmclnt_release_lockargs(req);
                         kfree(req);
@@ -680,7 +686,6 @@ nlmclnt_unlock(struct nlm_rqst *req, struct file_lock *fl)
         if (status < 0)
                 return status;
 
-        do_vfs_lock(fl);
         if (resp->status == NLM_LCK_GRANTED)
                 return 0;
 
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index 4063095d849e..b10f913aa06a 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -228,7 +228,7 @@ nlm4svc_proc_granted(struct svc_rqst *rqstp, struct nlm_args *argp,
         resp->cookie = argp->cookie;
 
         dprintk("lockd: GRANTED       called\n");
-        resp->status = nlmclnt_grant(&argp->lock);
+        resp->status = nlmclnt_grant(&rqstp->rq_addr, &argp->lock);
         dprintk("lockd: GRANTED       status %d\n", ntohl(resp->status));
         return rpc_success;
 }
diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
index 3bc437e0cf5b..35681d9cf1fc 100644
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -256,7 +256,7 @@ nlmsvc_proc_granted(struct svc_rqst *rqstp, struct nlm_args *argp,
         resp->cookie = argp->cookie;
 
         dprintk("lockd: GRANTED       called\n");
-        resp->status = nlmclnt_grant(&argp->lock);
+        resp->status = nlmclnt_grant(&rqstp->rq_addr, &argp->lock);
         dprintk("lockd: GRANTED       status %d\n", ntohl(resp->status));
         return rpc_success;
 }
diff --git a/fs/namei.c b/fs/namei.c
index 7ac9fb4acb2c..8dc2b038d5d9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -790,7 +790,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
 
         inode = nd->dentry->d_inode;
         if (nd->depth)
-                lookup_flags = LOOKUP_FOLLOW;
+                lookup_flags = LOOKUP_FOLLOW | (nd->flags & LOOKUP_CONTINUE);
 
         /* At this point we know we have a real path component. */
         for(;;) {
@@ -885,7 +885,8 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
 last_with_slashes:
                 lookup_flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
 last_component:
-                nd->flags &= ~LOOKUP_CONTINUE;
+                /* Clear LOOKUP_CONTINUE iff it was previously unset */
+                nd->flags &= lookup_flags | ~LOOKUP_CONTINUE;
                 if (lookup_flags & LOOKUP_PARENT)
                         goto lookup_parent;
                 if (this.name[0] == '.') switch (this.len) {
@@ -1069,6 +1070,8 @@ static int fastcall do_path_lookup(int dfd, const char *name,
                                 unsigned int flags, struct nameidata *nd)
 {
         int retval = 0;
+        int fput_needed;
+        struct file *file;
 
         nd->last_type = LAST_ROOT; /* if there are only slashes... */
         nd->flags = flags;
@@ -1090,29 +1093,22 @@ static int fastcall do_path_lookup(int dfd, const char *name,
                 nd->mnt = mntget(current->fs->pwdmnt);
                 nd->dentry = dget(current->fs->pwd);
         } else {
-                struct file *file;
-                int fput_needed;
                 struct dentry *dentry;
 
                 file = fget_light(dfd, &fput_needed);
-                if (!file) {
-                        retval = -EBADF;
-                        goto out_fail;
-                }
+                retval = -EBADF;
+                if (!file)
+                        goto unlock_fail;
 
                 dentry = file->f_dentry;
 
-                if (!S_ISDIR(dentry->d_inode->i_mode)) {
-                        retval = -ENOTDIR;
-                        fput_light(file, fput_needed);
-                        goto out_fail;
-                }
+                retval = -ENOTDIR;
+                if (!S_ISDIR(dentry->d_inode->i_mode))
+                        goto fput_unlock_fail;
 
                 retval = file_permission(file, MAY_EXEC);
-                if (retval) {
-                        fput_light(file, fput_needed);
-                        goto out_fail;
-                }
+                if (retval)
+                        goto fput_unlock_fail;
 
                 nd->mnt = mntget(file->f_vfsmnt);
                 nd->dentry = dget(dentry);
@@ -1123,10 +1119,17 @@ static int fastcall do_path_lookup(int dfd, const char *name,
         current->total_link_count = 0;
         retval = link_path_walk(name, nd);
 out:
-        if (unlikely(current->audit_context
-                     && nd && nd->dentry && nd->dentry->d_inode))
+        if (likely(retval == 0)) {
+                if (unlikely(current->audit_context && nd && nd->dentry &&
+                                nd->dentry->d_inode))
                 audit_inode(name, nd->dentry->d_inode, flags);
-out_fail:
+        }
+        return retval;
+
+fput_unlock_fail:
+        fput_light(file, fput_needed);
+unlock_fail:
+        read_unlock(&current->fs->lock);
         return retval;
 }
 
@@ -2221,13 +2224,17 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
  * and other special files.  --ADM
  */
 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
-                           int newdfd, const char __user *newname)
+                           int newdfd, const char __user *newname,
+                           int flags)
 {
         struct dentry *new_dentry;
         struct nameidata nd, old_nd;
         int error;
         char * to;
 
+        if (flags != 0)
+                return -EINVAL;
+
         to = getname(newname);
         if (IS_ERR(to))
                 return PTR_ERR(to);
@@ -2260,7 +2267,7 @@ exit:
 
 asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
 {
-        return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname);
+        return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
 }
 
 /*
@@ -2606,13 +2613,15 @@ void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
         }
 }
 
-int page_symlink(struct inode *inode, const char *symname, int len)
+int __page_symlink(struct inode *inode, const char *symname, int len,
+                gfp_t gfp_mask)
 {
         struct address_space *mapping = inode->i_mapping;
-        struct page *page = grab_cache_page(mapping, 0);
+        struct page *page;
         int err = -ENOMEM;
         char *kaddr;
 
+        page = find_or_create_page(mapping, 0, gfp_mask);
         if (!page)
                 goto fail;
         err = mapping->a_ops->prepare_write(NULL, page, 0, len-1);
@@ -2647,6 +2656,12 @@ fail:
         return err;
 }
 
+int page_symlink(struct inode *inode, const char *symname, int len)
+{
+        return __page_symlink(inode, symname, len,
+                        mapping_gfp_mask(inode->i_mapping));
+}
+
 struct inode_operations page_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = page_follow_link_light,
@@ -2665,6 +2680,7 @@ EXPORT_SYMBOL(lookup_one_len);
 EXPORT_SYMBOL(page_follow_link_light);
 EXPORT_SYMBOL(page_put_link);
 EXPORT_SYMBOL(page_readlink);
+EXPORT_SYMBOL(__page_symlink);
 EXPORT_SYMBOL(page_symlink);
 EXPORT_SYMBOL(page_symlink_inode_operations);
 EXPORT_SYMBOL(path_lookup);
diff --git a/fs/namespace.c b/fs/namespace.c
index ce97becff461..39c81a8d6316 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -494,7 +494,7 @@ void umount_tree(struct vfsmount *mnt, int propagate, struct list_head *kill)
                 p->mnt_namespace = NULL;
                 list_del_init(&p->mnt_child);
                 if (p->mnt_parent != p)
-                        mnt->mnt_mountpoint->d_mounted--;
+                        p->mnt_mountpoint->d_mounted--;
                 change_mnt_propagation(p, MS_PRIVATE);
         }
 }
@@ -1325,30 +1325,20 @@ dput_out:
         return retval;
 }
 
-int copy_namespace(int flags, struct task_struct *tsk)
+/*
+ * Allocate a new namespace structure and populate it with contents
+ * copied from the namespace of the passed in task structure.
+ */
+struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
 {
         struct namespace *namespace = tsk->namespace;
         struct namespace *new_ns;
         struct vfsmount *rootmnt = NULL, *pwdmnt = NULL, *altrootmnt = NULL;
-        struct fs_struct *fs = tsk->fs;
         struct vfsmount *p, *q;
 
-        if (!namespace)
-                return 0;
-
-        get_namespace(namespace);
-
-        if (!(flags & CLONE_NEWNS))
-                return 0;
-
-        if (!capable(CAP_SYS_ADMIN)) {
-                put_namespace(namespace);
-                return -EPERM;
-        }
-
         new_ns = kmalloc(sizeof(struct namespace), GFP_KERNEL);
         if (!new_ns)
-                goto out;
+                return NULL;
 
         atomic_set(&new_ns->count, 1);
         INIT_LIST_HEAD(&new_ns->list);
@@ -1362,7 +1352,7 @@ int copy_namespace(int flags, struct task_struct *tsk)
         if (!new_ns->root) {
                 up_write(&namespace_sem);
                 kfree(new_ns);
-                goto out;
+                return NULL;
         }
         spin_lock(&vfsmount_lock);
         list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
@@ -1396,8 +1386,6 @@ int copy_namespace(int flags, struct task_struct *tsk)
         }
         up_write(&namespace_sem);
 
-        tsk->namespace = new_ns;
-
         if (rootmnt)
                 mntput(rootmnt);
         if (pwdmnt)
@@ -1405,12 +1393,39 @@ int copy_namespace(int flags, struct task_struct *tsk)
         if (altrootmnt)
                 mntput(altrootmnt);
 
-        put_namespace(namespace);
-        return 0;
+        return new_ns;
+}
+
+int copy_namespace(int flags, struct task_struct *tsk)
+{
+        struct namespace *namespace = tsk->namespace;
+        struct namespace *new_ns;
+        int err = 0;
+
+        if (!namespace)
+                return 0;
+
+        get_namespace(namespace);
+
+        if (!(flags & CLONE_NEWNS))
+                return 0;
+
+        if (!capable(CAP_SYS_ADMIN)) {
+                err = -EPERM;
+                goto out;
+        }
+
+        new_ns = dup_namespace(tsk, tsk->fs);
+        if (!new_ns) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        tsk->namespace = new_ns;
 
 out:
         put_namespace(namespace);
-        return -ENOMEM;
+        return err;
 }
 
 asmlinkage long sys_mount(char __user * dev_name, char __user * dir_name,
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 04ab2fc360e7..4e9b3a1b36c5 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -57,6 +57,7 @@
 #define NFSDBG_FACILITY         NFSDBG_VFS
 #define MAX_DIRECTIO_SIZE       (4096UL << PAGE_SHIFT)
 
+static void nfs_free_user_pages(struct page **pages, int npages, int do_dirty);
 static kmem_cache_t *nfs_direct_cachep;
 
 /*
@@ -107,6 +108,15 @@ nfs_get_user_pages(int rw, unsigned long user_addr, size_t size,
                                         page_count, (rw == READ), 0,
                                         *pages, NULL);
                 up_read(&current->mm->mmap_sem);
+                /*
+                 * If we got fewer pages than expected from get_user_pages(),
+                 * the user buffer runs off the end of a mapping; return EFAULT.
+                 */
+                if (result >= 0 && result < page_count) {
+                        nfs_free_user_pages(*pages, result, 0);
+                        *pages = NULL;
+                        result = -EFAULT;
+                }
         }
         return result;
 }
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 984ca3454d04..f8c0066e02e1 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1430,7 +1430,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
         if (status == 0)
                 status = nfs4_do_fsinfo(server, fhandle, info);
 out:
-        return status;
+        return nfs4_map_errors(status);
 }
 
 static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
index e897e00c2c9d..c0a754ecdee6 100644
--- a/fs/nfs/nfsroot.c
+++ b/fs/nfs/nfsroot.c
@@ -465,10 +465,11 @@ static int __init root_nfs_ports(void)
                                         "number from server, using default\n");
                         port = nfsd_port;
                 }
-                nfs_port = htons(port);
+                nfs_port = port;
                 dprintk("Root-NFS: Portmapper on server returned %d "
                         "as nfsd port\n", port);
         }
+        nfs_port = htons(nfs_port);
 
         if ((port = root_nfs_getport(NFS_MNT_PROGRAM, mountd_ver, proto)) < 0) {
                 printk(KERN_ERR "Root-NFS: Unable to get mountd port "
diff --git a/fs/nfsctl.c b/fs/nfsctl.c
index 0d4cf9486068..1c72c7f85ddc 100644
--- a/fs/nfsctl.c
+++ b/fs/nfsctl.c
@@ -98,10 +98,8 @@ asmlinkage sys_nfsservctl(int cmd, struct nfsctl_arg __user *arg, void __user *r
         if (copy_from_user(&version, &arg->ca_version, sizeof(int)))
                 return -EFAULT;
 
-        if (version != NFSCTL_VERSION) {
-                printk(KERN_WARNING "nfsd: incompatible version in syscall.\n");
+        if (version != NFSCTL_VERSION)
                 return -EINVAL;
-        }
 
         if (cmd < 0 || cmd >= sizeof(map)/sizeof(map[0]) || !map[cmd].name)
                 return -EINVAL;
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index a00fe8686293..6d63f1d9e5f5 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -195,10 +195,12 @@ nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open
 
         /* Openowner is now set, so sequence id will get bumped.  Now we need
          * these checks before we do any creates: */
+        status = nfserr_grace;
         if (nfs4_in_grace() && open->op_claim_type != NFS4_OPEN_CLAIM_PREVIOUS)
-                return nfserr_grace;
+                goto out;
+        status = nfserr_no_grace;
         if (!nfs4_in_grace() && open->op_claim_type == NFS4_OPEN_CLAIM_PREVIOUS)
-                return nfserr_no_grace;
+                goto out;
 
         switch (open->op_claim_type) {
                 case NFS4_OPEN_CLAIM_DELEGATE_CUR:
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 02f44094bda9..9d8ffa89e2c2 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -1,9 +1,9 @@
 ToDo/Notes:
         - Find and fix bugs.
         - The only places in the kernel where a file is resized are
-          ntfs_file_write*() and ntfs_truncate() for both of which i_sem is
+          ntfs_file_write*() and ntfs_truncate() for both of which i_mutex is
           held.  Just have to be careful in read-/writepage and other helpers
-          not running under i_sem that we play nice...  Also need to be careful
+          not running under i_mutex that we play nice.  Also need to be careful
           with initialized_size extension in ntfs_file_write*() and writepage.
           UPDATE: The only things that need to be checked are the compressed
           write and the other attribute resize/write cases like index
@@ -19,6 +19,24 @@ ToDo/Notes:
         - Enable the code for setting the NT4 compatibility flag when we start
           making NTFS 1.2 specific modifications.
 
+2.1.26 - Minor bug fixes and updates.
+
+        - Fix a potential overflow in file.c where a cast to s64 was missing in
+          a left shift of a page index.
+        - The struct inode has had its i_sem semaphore changed to a mutex named
+          i_mutex.
+        - We have struct kmem_cache now so use it instead of the typedef
+          kmem_cache_t.  (Pekka Enberg)
+        - Implement support for sector sizes above 512 bytes (up to the maximum
+          supported by NTFS which is 4096 bytes).
+        - Do more detailed reporting of why we cannot mount read-write by
+          special casing the VOLUME_MODIFIED_BY_CHKDSK flag.
+        - Miscellaneous updates to layout.h.
+        - Cope with attribute list attribute having invalid flags.  Windows
+          copes with this and even chkdsk does not detect or fix this so we
+          have to cope with it, too.  Thanks to Pawel Kot for reporting the
+          problem.
+
 2.1.25 - (Almost) fully implement write(2) and truncate(2).
 
         - Change ntfs_map_runlist_nolock(), ntfs_attr_find_vcn_nolock() and
@@ -373,7 +391,7 @@ ToDo/Notes:
           single one of them had an mst error.  (Thanks to Ken MacFerrin for
           the bug report.)
         - Fix error handling in fs/ntfs/quota.c::ntfs_mark_quotas_out_of_date()
-          where we failed to release i_sem on the $Quota/$Q attribute inode.
+          where we failed to release i_mutex on the $Quota/$Q attribute inode.
         - Fix bug in handling of bad inodes in fs/ntfs/namei.c::ntfs_lookup().
         - Add mapping of unmapped buffers to all remaining code paths, i.e.
           fs/ntfs/aops.c::ntfs_write_mst_block(), mft.c::ntfs_sync_mft_mirror(),
@@ -874,7 +892,7 @@ ToDo/Notes:
           clusters. (Philipp Thomas)
         - attrib.c::load_attribute_list(): Fix bug when initialized_size is a
           multiple of the block_size but not the cluster size. (Szabolcs
-          Szakacsits <szaka@sienet.hu>)
+          Szakacsits)
 
 2.1.2 - Important bug fixes aleviating the hangs in statfs.
 
@@ -884,7 +902,7 @@ ToDo/Notes:
 
         - Add handling for initialized_size != data_size in compressed files.
         - Reduce function local stack usage from 0x3d4 bytes to just noise in
-          fs/ntfs/upcase.c. (Randy Dunlap <rdunlap@xenotime.net>)
+          fs/ntfs/upcase.c. (Randy Dunlap)
         - Remove compiler warnings for newer gcc.
         - Pages are no longer kmapped by mm/filemap.c::generic_file_write()
           around calls to ->{prepare,commit}_write.  Adapt NTFS appropriately
@@ -1201,11 +1219,11 @@ ToDo/Notes:
           the kernel. We probably want a kernel generic init_address_space()
           function...
         - Drop BKL from ntfs_readdir() after consultation with Al Viro. The
-          only caller of ->readdir() is vfs_readdir() which holds i_sem during
-          the call, and i_sem is sufficient protection against changes in the
-          directory inode (including ->i_size).
+          only caller of ->readdir() is vfs_readdir() which holds i_mutex
+          during the call, and i_mutex is sufficient protection against changes
+          in the directory inode (including ->i_size).
         - Use generic_file_llseek() for directories (as opposed to
-          default_llseek()) as this downs i_sem instead of the BKL which is
+          default_llseek()) as this downs i_mutex instead of the BKL which is
           what we now need for exclusion against ->f_pos changes considering we
           no longer take the BKL in ntfs_readdir().
 
diff --git a/fs/ntfs/Makefile b/fs/ntfs/Makefile
index d0d45d1c853a..d95fac7fdeb6 100644
--- a/fs/ntfs/Makefile
+++ b/fs/ntfs/Makefile
@@ -6,7 +6,7 @@ ntfs-objs := aops.o attrib.o collate.o compress.o debug.o dir.o file.o \
              index.o inode.o mft.o mst.o namei.o runlist.o super.o sysctl.o \
              unistr.o upcase.o
 
-EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.25\"
+EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.26\"
 
 ifeq ($(CONFIG_NTFS_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index 1c0a4315876a..7e361da770b3 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -2,7 +2,7 @@
  * aops.c - NTFS kernel address space operations and page cache handling.
  *          Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -200,8 +200,8 @@ static int ntfs_read_block(struct page *page)
         /* $MFT/$DATA must have its complete runlist in memory at all times. */
         BUG_ON(!ni->runlist.rl && !ni->mft_no && !NInoAttr(ni));
 
-        blocksize_bits = VFS_I(ni)->i_blkbits;
-        blocksize = 1 << blocksize_bits;
+        blocksize = vol->sb->s_blocksize;
+        blocksize_bits = vol->sb->s_blocksize_bits;
 
         if (!page_has_buffers(page)) {
                 create_empty_buffers(page, blocksize, 0);
@@ -569,10 +569,8 @@ static int ntfs_write_block(struct page *page, struct writeback_control *wbc)
 
         BUG_ON(!NInoNonResident(ni));
         BUG_ON(NInoMstProtected(ni));
-
-        blocksize_bits = vi->i_blkbits;
-        blocksize = 1 << blocksize_bits;
-
+        blocksize = vol->sb->s_blocksize;
+        blocksize_bits = vol->sb->s_blocksize_bits;
         if (!page_has_buffers(page)) {
                 BUG_ON(!PageUptodate(page));
                 create_empty_buffers(page, blocksize,
@@ -949,8 +947,8 @@ static int ntfs_write_mst_block(struct page *page,
          */
         BUG_ON(!(is_mft || S_ISDIR(vi->i_mode) ||
                         (NInoAttr(ni) && ni->type == AT_INDEX_ALLOCATION)));
-        bh_size_bits = vi->i_blkbits;
-        bh_size = 1 << bh_size_bits;
+        bh_size = vol->sb->s_blocksize;
+        bh_size_bits = vol->sb->s_blocksize_bits;
         max_bhs = PAGE_CACHE_SIZE / bh_size;
         BUG_ON(!max_bhs);
         BUG_ON(max_bhs > MAX_BUF_PER_PAGE);
@@ -1596,7 +1594,7 @@ void mark_ntfs_record_dirty(struct page *page, const unsigned int ofs) {
 
         BUG_ON(!PageUptodate(page));
         end = ofs + ni->itype.index.block_size;
-        bh_size = 1 << VFS_I(ni)->i_blkbits;
+        bh_size = VFS_I(ni)->i_sb->s_blocksize;
         spin_lock(&mapping->private_lock);
         if (unlikely(!page_has_buffers(page))) {
                 spin_unlock(&mapping->private_lock);
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index fb413d3d8618..5027d3d1b3fe 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -1,7 +1,7 @@
 /*
  * file.c - NTFS kernel file operations.  Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -248,7 +248,7 @@ do_non_resident_extend:
                  * enough to make ntfs_writepage() work.
                  */
                 write_lock_irqsave(&ni->size_lock, flags);
-                ni->initialized_size = (index + 1) << PAGE_CACHE_SHIFT;
+                ni->initialized_size = (s64)(index + 1) << PAGE_CACHE_SHIFT;
                 if (ni->initialized_size > new_init_size)
                         ni->initialized_size = new_init_size;
                 write_unlock_irqrestore(&ni->size_lock, flags);
@@ -529,8 +529,8 @@ static int ntfs_prepare_pages_for_non_resident_write(struct page **pages,
                         "index 0x%lx, nr_pages 0x%x, pos 0x%llx, bytes 0x%zx.",
                         vi->i_ino, ni->type, pages[0]->index, nr_pages,
                         (long long)pos, bytes);
-        blocksize_bits = vi->i_blkbits;
-        blocksize = 1 << blocksize_bits;
+        blocksize = vol->sb->s_blocksize;
+        blocksize_bits = vol->sb->s_blocksize_bits;
         u = 0;
         do {
                 struct page *page = pages[u];
@@ -1525,7 +1525,7 @@ static inline int ntfs_commit_pages_after_non_resident_write(
 
         vi = pages[0]->mapping->host;
         ni = NTFS_I(vi);
-        blocksize = 1 << vi->i_blkbits;
+        blocksize = vi->i_sb->s_blocksize;
         end = pos + bytes;
         u = 0;
         do {
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index ea1bd3feea1b..55263b7de9c0 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -677,13 +677,28 @@ static int ntfs_read_locked_inode(struct inode *vi)
                 ntfs_debug("Attribute list found in inode 0x%lx.", vi->i_ino);
                 NInoSetAttrList(ni);
                 a = ctx->attr;
-                if (a->flags & ATTR_IS_ENCRYPTED ||
-                                a->flags & ATTR_COMPRESSION_MASK ||
-                                a->flags & ATTR_IS_SPARSE) {
+                if (a->flags & ATTR_COMPRESSION_MASK) {
                         ntfs_error(vi->i_sb, "Attribute list attribute is "
-                                        "compressed/encrypted/sparse.");
+                                        "compressed.");
                         goto unm_err_out;
                 }
+                if (a->flags & ATTR_IS_ENCRYPTED ||
+                                a->flags & ATTR_IS_SPARSE) {
+                        if (a->non_resident) {
+                                ntfs_error(vi->i_sb, "Non-resident attribute "
+                                                "list attribute is encrypted/"
+                                                "sparse.");
+                                goto unm_err_out;
+                        }
+                        ntfs_warning(vi->i_sb, "Resident attribute list "
+                                        "attribute in inode 0x%lx is marked "
+                                        "encrypted/sparse which is not true.  "
+                                        "However, Windows allows this and "
+                                        "chkdsk does not detect or correct it "
+                                        "so we will just ignore the invalid "
+                                        "flags and pretend they are not set.",
+                                        vi->i_ino);
+                }
                 /* Now allocate memory for the attribute list. */
                 ni->attr_list_size = (u32)ntfs_attr_size(a);
                 ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
@@ -1809,19 +1824,33 @@ int ntfs_read_inode_mount(struct inode *vi)
         } else /* if (!err) */ {
                 ATTR_LIST_ENTRY *al_entry, *next_al_entry;
                 u8 *al_end;
+                static const char *es = "  Not allowed.  $MFT is corrupt.  "
+                                "You should run chkdsk.";
 
                 ntfs_debug("Attribute list attribute found in $MFT.");
                 NInoSetAttrList(ni);
                 a = ctx->attr;
-                if (a->flags & ATTR_IS_ENCRYPTED ||
-                                a->flags & ATTR_COMPRESSION_MASK ||
-                                a->flags & ATTR_IS_SPARSE) {
+                if (a->flags & ATTR_COMPRESSION_MASK) {
                         ntfs_error(sb, "Attribute list attribute is "
-                                        "compressed/encrypted/sparse. Not "
-                                        "allowed. $MFT is corrupt. You should "
-                                        "run chkdsk.");
+                                        "compressed.%s", es);
                         goto put_err_out;
                 }
+                if (a->flags & ATTR_IS_ENCRYPTED ||
+                                a->flags & ATTR_IS_SPARSE) {
+                        if (a->non_resident) {
+                                ntfs_error(sb, "Non-resident attribute list "
+                                                "attribute is encrypted/"
+                                                "sparse.%s", es);
+                                goto put_err_out;
+                        }
+                        ntfs_warning(sb, "Resident attribute list attribute "
+                                        "in $MFT system file is marked "
+                                        "encrypted/sparse which is not true.  "
+                                        "However, Windows allows this and "
+                                        "chkdsk does not detect or correct it "
+                                        "so we will just ignore the invalid "
+                                        "flags and pretend they are not set.");
+                }
                 /* Now allocate memory for the attribute list. */
                 ni->attr_list_size = (u32)ntfs_attr_size(a);
                 ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
diff --git a/fs/ntfs/layout.h b/fs/ntfs/layout.h
index f5678d5d7919..bb408d4dcbb0 100644
--- a/fs/ntfs/layout.h
+++ b/fs/ntfs/layout.h
@@ -838,15 +838,19 @@ enum {
            F_A_DEVICE, F_A_DIRECTORY, F_A_SPARSE_FILE, F_A_REPARSE_POINT,
            F_A_COMPRESSED, and F_A_ENCRYPTED and preserves the rest.  This mask
            is used to to obtain all flags that are valid for setting. */
-
         /*
-         * The following flags are only present in the FILE_NAME attribute (in
+         * The following flag is only present in the FILE_NAME attribute (in
          * the field file_attributes).
          */
         FILE_ATTR_DUP_FILE_NAME_INDEX_PRESENT   = const_cpu_to_le32(0x10000000),
         /* Note, this is a copy of the corresponding bit from the mft record,
            telling us whether this is a directory or not, i.e. whether it has
            an index root attribute or not. */
+        /*
+         * The following flag is present both in the STANDARD_INFORMATION
+         * attribute and in the FILE_NAME attribute (in the field
+         * file_attributes).
+         */
         FILE_ATTR_DUP_VIEW_INDEX_PRESENT        = const_cpu_to_le32(0x20000000),
         /* Note, this is a copy of the corresponding bit from the mft record,
            telling us whether this file has a view index present (eg. object id
@@ -1071,9 +1075,15 @@ typedef struct {
                                            modified. */
 /* 20*/ sle64 last_access_time;         /* Time this mft record was last
                                            accessed. */
-/* 28*/ sle64 allocated_size;           /* Byte size of allocated space for the
-                                           data attribute. NOTE: Is a multiple
-                                           of the cluster size. */
+/* 28*/ sle64 allocated_size;           /* Byte size of on-disk allocated space
+                                           for the data attribute.  So for
+                                           normal $DATA, this is the
+                                           allocated_size from the unnamed
+                                           $DATA attribute and for compressed
+                                           and/or sparse $DATA, this is the
+                                           compressed_size from the unnamed
+                                           $DATA attribute.  NOTE: This is a
+                                           multiple of the cluster size. */
 /* 30*/ sle64 data_size;                /* Byte size of actual data in data
                                            attribute. */
 /* 38*/ FILE_ATTR_FLAGS file_attributes;        /* Flags describing the file. */
@@ -1904,12 +1914,13 @@ enum {
         VOLUME_DELETE_USN_UNDERWAY      = const_cpu_to_le16(0x0010),
         VOLUME_REPAIR_OBJECT_ID         = const_cpu_to_le16(0x0020),
 
+        VOLUME_CHKDSK_UNDERWAY          = const_cpu_to_le16(0x4000),
         VOLUME_MODIFIED_BY_CHKDSK       = const_cpu_to_le16(0x8000),
 
-        VOLUME_FLAGS_MASK               = const_cpu_to_le16(0x803f),
+        VOLUME_FLAGS_MASK               = const_cpu_to_le16(0xc03f),
 
         /* To make our life easier when checking if we must mount read-only. */
-        VOLUME_MUST_MOUNT_RO_MASK       = const_cpu_to_le16(0x8027),
+        VOLUME_MUST_MOUNT_RO_MASK       = const_cpu_to_le16(0xc027),
 } __attribute__ ((__packed__));
 
 typedef le16 VOLUME_FLAGS;
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 0c65cbb8c5cf..6499aafc2258 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
  * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -473,7 +473,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
         runlist_element *rl;
         unsigned int block_start, block_end, m_start, m_end, page_ofs;
         int i_bhs, nr_bhs, err = 0;
-        unsigned char blocksize_bits = vol->mftmirr_ino->i_blkbits;
+        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
 
         ntfs_debug("Entering for inode 0x%lx.", mft_no);
         BUG_ON(!max_bhs);
@@ -672,8 +672,8 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
 {
         ntfs_volume *vol = ni->vol;
         struct page *page = ni->page;
-        unsigned char blocksize_bits = vol->mft_ino->i_blkbits;
-        unsigned int blocksize = 1 << blocksize_bits;
+        unsigned int blocksize = vol->sb->s_blocksize;
+        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
         int max_bhs = vol->mft_record_size / blocksize;
         struct buffer_head *bhs[max_bhs];
         struct buffer_head *bh, *head;
diff --git a/fs/ntfs/ntfs.h b/fs/ntfs/ntfs.h
index 446b5014115c..653d2a5c4899 100644
--- a/fs/ntfs/ntfs.h
+++ b/fs/ntfs/ntfs.h
@@ -50,11 +50,11 @@ typedef enum {
 /* Global variables. */
 
 /* Slab caches (from super.c). */
-extern kmem_cache_t *ntfs_name_cache;
-extern kmem_cache_t *ntfs_inode_cache;
-extern kmem_cache_t *ntfs_big_inode_cache;
-extern kmem_cache_t *ntfs_attr_ctx_cache;
-extern kmem_cache_t *ntfs_index_ctx_cache;
+extern struct kmem_cache *ntfs_name_cache;
+extern struct kmem_cache *ntfs_inode_cache;
+extern struct kmem_cache *ntfs_big_inode_cache;
+extern struct kmem_cache *ntfs_attr_ctx_cache;
+extern struct kmem_cache *ntfs_index_ctx_cache;
 
 /* The various operations structs defined throughout the driver files. */
 extern struct address_space_operations ntfs_aops;
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index c3a3f1a8310b..368a8ec10668 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1,7 +1,7 @@
 /*
  * super.c - NTFS kernel super block handling. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2001,2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@
 
 #include <linux/stddef.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/spinlock.h>
 #include <linux/blkdev.h>       /* For bdev_hardsect_size(). */
@@ -471,9 +472,16 @@ static int ntfs_remount(struct super_block *sb, int *flags, char *opt)
                         ntfs_error(sb, "Volume is dirty and read-only%s", es);
                         return -EROFS;
                 }
+                if (vol->vol_flags & VOLUME_MODIFIED_BY_CHKDSK) {
+                        ntfs_error(sb, "Volume has been modified by chkdsk "
+                                        "and is read-only%s", es);
+                        return -EROFS;
+                }
                 if (vol->vol_flags & VOLUME_MUST_MOUNT_RO_MASK) {
-                        ntfs_error(sb, "Volume has unsupported flags set and "
-                                        "is read-only%s", es);
+                        ntfs_error(sb, "Volume has unsupported flags set "
+                                        "(0x%x) and is read-only%s",
+                                        (unsigned)le16_to_cpu(vol->vol_flags),
+                                        es);
                         return -EROFS;
                 }
                 if (ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY)) {
@@ -641,7 +649,7 @@ static struct buffer_head *read_ntfs_boot_sector(struct super_block *sb,
 {
         const char *read_err_str = "Unable to read %s boot sector.";
         struct buffer_head *bh_primary, *bh_backup;
-        long nr_blocks = NTFS_SB(sb)->nr_blocks;
+        sector_t nr_blocks = NTFS_SB(sb)->nr_blocks;
 
         /* Try to read primary boot sector. */
         if ((bh_primary = sb_bread(sb, 0))) {
@@ -688,13 +696,18 @@ hotfix_primary_boot_sector:
                 /*
                  * If we managed to read sector zero and the volume is not
                  * read-only, copy the found, valid backup boot sector to the
-                 * primary boot sector.
+                 * primary boot sector.  Note we only copy the actual boot
+                 * sector structure, not the actual whole device sector as that
+                 * may be bigger and would potentially damage the $Boot system
+                 * file (FIXME: Would be nice to know if the backup boot sector
+                 * on a large sector device contains the whole boot loader or
+                 * just the first 512 bytes).
                  */
                 if (!(sb->s_flags & MS_RDONLY)) {
                         ntfs_warning(sb, "Hot-fix: Recovering invalid primary "
                                         "boot sector from backup copy.");
                         memcpy(bh_primary->b_data, bh_backup->b_data,
-                                        sb->s_blocksize);
+                                        NTFS_BLOCK_SIZE);
                         mark_buffer_dirty(bh_primary);
                         sync_dirty_buffer(bh_primary);
                         if (buffer_uptodate(bh_primary)) {
@@ -733,9 +746,13 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
                         vol->sector_size);
         ntfs_debug("vol->sector_size_bits = %i (0x%x)", vol->sector_size_bits,
                         vol->sector_size_bits);
-        if (vol->sector_size != vol->sb->s_blocksize)
-                ntfs_warning(vol->sb, "The boot sector indicates a sector size "
-                                "different from the device sector size.");
+        if (vol->sector_size < vol->sb->s_blocksize) {
+                ntfs_error(vol->sb, "Sector size (%i) is smaller than the "
+                                "device block size (%lu).  This is not "
+                                "supported.  Sorry.", vol->sector_size,
+                                vol->sb->s_blocksize);
+                return FALSE;
+        }
         ntfs_debug("sectors_per_cluster = 0x%x", b->bpb.sectors_per_cluster);
         sectors_per_cluster_bits = ffs(b->bpb.sectors_per_cluster) - 1;
         ntfs_debug("sectors_per_cluster_bits = 0x%x",
@@ -748,16 +765,11 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         ntfs_debug("vol->cluster_size = %i (0x%x)", vol->cluster_size,
                         vol->cluster_size);
         ntfs_debug("vol->cluster_size_mask = 0x%x", vol->cluster_size_mask);
-        ntfs_debug("vol->cluster_size_bits = %i (0x%x)",
-                        vol->cluster_size_bits, vol->cluster_size_bits);
-        if (vol->sector_size > vol->cluster_size) {
-                ntfs_error(vol->sb, "Sector sizes above the cluster size are "
-                                "not supported.  Sorry.");
-                return FALSE;
-        }
-        if (vol->sb->s_blocksize > vol->cluster_size) {
-                ntfs_error(vol->sb, "Cluster sizes smaller than the device "
-                                "sector size are not supported.  Sorry.");
+        ntfs_debug("vol->cluster_size_bits = %i", vol->cluster_size_bits);
+        if (vol->cluster_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Cluster size (%i) is smaller than the "
+                                "sector size (%i).  This is not supported.  "
+                                "Sorry.", vol->cluster_size, vol->sector_size);
                 return FALSE;
         }
         clusters_per_mft_record = b->clusters_per_mft_record;
@@ -786,11 +798,18 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
          * we store $MFT/$DATA, the table of mft records in the page cache.
          */
         if (vol->mft_record_size > PAGE_CACHE_SIZE) {
-                ntfs_error(vol->sb, "Mft record size %i (0x%x) exceeds the "
-                                "page cache size on your system %lu (0x%lx).  "
+                ntfs_error(vol->sb, "Mft record size (%i) exceeds the "
+                                "PAGE_CACHE_SIZE on your system (%lu).  "
                                 "This is not supported.  Sorry.",
-                                vol->mft_record_size, vol->mft_record_size,
-                                PAGE_CACHE_SIZE, PAGE_CACHE_SIZE);
+                                vol->mft_record_size, PAGE_CACHE_SIZE);
+                return FALSE;
+        }
+        /* We cannot support mft record sizes below the sector size. */
+        if (vol->mft_record_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Mft record size (%i) is smaller than the "
+                                "sector size (%i).  This is not supported.  "
+                                "Sorry.", vol->mft_record_size,
+                                vol->sector_size);
                 return FALSE;
         }
         clusters_per_index_record = b->clusters_per_index_record;
@@ -816,6 +835,14 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         ntfs_debug("vol->index_record_size_bits = %i (0x%x)",
                         vol->index_record_size_bits,
                         vol->index_record_size_bits);
+        /* We cannot support index record sizes below the sector size. */
+        if (vol->index_record_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Index record size (%i) is smaller than "
+                                "the sector size (%i).  This is not "
+                                "supported.  Sorry.", vol->index_record_size,
+                                vol->sector_size);
+                return FALSE;
+        }
         /*
          * Get the size of the volume in clusters and check for 64-bit-ness.
          * Windows currently only uses 32 bits to save the clusters so we do
@@ -845,15 +872,18 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         }
         ll = sle64_to_cpu(b->mft_lcn);
         if (ll >= vol->nr_clusters) {
-                ntfs_error(vol->sb, "MFT LCN is beyond end of volume.  Weird.");
+                ntfs_error(vol->sb, "MFT LCN (%lli, 0x%llx) is beyond end of "
+                                "volume.  Weird.", (unsigned long long)ll,
+                                (unsigned long long)ll);
                 return FALSE;
         }
         vol->mft_lcn = ll;
         ntfs_debug("vol->mft_lcn = 0x%llx", (long long)vol->mft_lcn);
         ll = sle64_to_cpu(b->mftmirr_lcn);
         if (ll >= vol->nr_clusters) {
-                ntfs_error(vol->sb, "MFTMirr LCN is beyond end of volume.  "
-                                "Weird.");
+                ntfs_error(vol->sb, "MFTMirr LCN (%lli, 0x%llx) is beyond end "
+                                "of volume.  Weird.", (unsigned long long)ll,
+                                (unsigned long long)ll);
                 return FALSE;
         }
         vol->mftmirr_lcn = ll;
@@ -1822,11 +1852,24 @@ get_ctx_vol_failed:
         /* Make sure that no unsupported volume flags are set. */
         if (vol->vol_flags & VOLUME_MUST_MOUNT_RO_MASK) {
                 static const char *es1a = "Volume is dirty";
-                static const char *es1b = "Volume has unsupported flags set";
-                static const char *es2 = ".  Run chkdsk and mount in Windows.";
-                const char *es1;
-                
-                es1 = vol->vol_flags & VOLUME_IS_DIRTY ? es1a : es1b;
+                static const char *es1b = "Volume has been modified by chkdsk";
+                static const char *es1c = "Volume has unsupported flags set";
+                static const char *es2a = ".  Run chkdsk and mount in Windows.";
+                static const char *es2b = ".  Mount in Windows.";
+                const char *es1, *es2;
+
+                es2 = es2a;
+                if (vol->vol_flags & VOLUME_IS_DIRTY)
+                        es1 = es1a;
+                else if (vol->vol_flags & VOLUME_MODIFIED_BY_CHKDSK) {
+                        es1 = es1b;
+                        es2 = es2b;
+                } else {
+                        es1 = es1c;
+                        ntfs_warning(sb, "Unsupported volume flags 0x%x "
+                                        "encountered.",
+                                        (unsigned)le16_to_cpu(vol->vol_flags));
+                }
                 /* If a read-write mount, convert it to a read-only mount. */
                 if (!(sb->s_flags & MS_RDONLY)) {
                         if (!(vol->on_errors & (ON_ERRORS_REMOUNT_RO |
@@ -2685,7 +2728,7 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
         ntfs_volume *vol;
         struct buffer_head *bh;
         struct inode *tmp_ino;
-        int result;
+        int blocksize, result;
 
         ntfs_debug("Entering.");
 #ifndef NTFS_RW
@@ -2724,60 +2767,85 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
         if (!parse_options(vol, (char*)opt))
                 goto err_out_now;
 
+        /* We support sector sizes up to the PAGE_CACHE_SIZE. */
+        if (bdev_hardsect_size(sb->s_bdev) > PAGE_CACHE_SIZE) {
+                if (!silent)
+                        ntfs_error(sb, "Device has unsupported sector size "
+                                        "(%i).  The maximum supported sector "
+                                        "size on this architecture is %lu "
+                                        "bytes.",
+                                        bdev_hardsect_size(sb->s_bdev),
+                                        PAGE_CACHE_SIZE);
+                goto err_out_now;
+        }
         /*
-         * TODO: Fail safety check. In the future we should really be able to
-         * cope with this being the case, but for now just bail out.
+         * Setup the device access block size to NTFS_BLOCK_SIZE or the hard
+         * sector size, whichever is bigger.
          */
-        if (bdev_hardsect_size(sb->s_bdev) > NTFS_BLOCK_SIZE) {
+        blocksize = sb_min_blocksize(sb, NTFS_BLOCK_SIZE);
+        if (blocksize < NTFS_BLOCK_SIZE) {
                 if (!silent)
-                        ntfs_error(sb, "Device has unsupported hardsect_size.");
+                        ntfs_error(sb, "Unable to set device block size.");
                 goto err_out_now;
         }
-
-        /* Setup the device access block size to NTFS_BLOCK_SIZE. */
-        if (sb_set_blocksize(sb, NTFS_BLOCK_SIZE) != NTFS_BLOCK_SIZE) {
+        BUG_ON(blocksize != sb->s_blocksize);
+        ntfs_debug("Set device block size to %i bytes (block size bits %i).",
+                        blocksize, sb->s_blocksize_bits);
+        /* Determine the size of the device in units of block_size bytes. */
+        if (!i_size_read(sb->s_bdev->bd_inode)) {
                 if (!silent)
-                        ntfs_error(sb, "Unable to set block size.");
+                        ntfs_error(sb, "Unable to determine device size.");
                 goto err_out_now;
         }
-
-        /* Get the size of the device in units of NTFS_BLOCK_SIZE bytes. */
         vol->nr_blocks = i_size_read(sb->s_bdev->bd_inode) >>
-                        NTFS_BLOCK_SIZE_BITS;
-
+                        sb->s_blocksize_bits;
         /* Read the boot sector and return unlocked buffer head to it. */
         if (!(bh = read_ntfs_boot_sector(sb, silent))) {
                 if (!silent)
                         ntfs_error(sb, "Not an NTFS volume.");
                 goto err_out_now;
         }
-
         /*
-         * Extract the data from the boot sector and setup the ntfs super block
+         * Extract the data from the boot sector and setup the ntfs volume
          * using it.
          */
         result = parse_ntfs_boot_sector(vol, (NTFS_BOOT_SECTOR*)bh->b_data);
-
-        /* Initialize the cluster and mft allocators. */
-        ntfs_setup_allocators(vol);
-
         brelse(bh);
-
         if (!result) {
                 if (!silent)
                         ntfs_error(sb, "Unsupported NTFS filesystem.");
                 goto err_out_now;
         }
-
         /*
-         * TODO: When we start coping with sector sizes different from
-         * NTFS_BLOCK_SIZE, we now probably need to set the blocksize of the
-         * device (probably to NTFS_BLOCK_SIZE).
+         * If the boot sector indicates a sector size bigger than the current
+         * device block size, switch the device block size to the sector size.
+         * TODO: It may be possible to support this case even when the set
+         * below fails, we would just be breaking up the i/o for each sector
+         * into multiple blocks for i/o purposes but otherwise it should just
+         * work.  However it is safer to leave disabled until someone hits this
+         * error message and then we can get them to try it without the setting
+         * so we know for sure that it works.
          */
-
+        if (vol->sector_size > blocksize) {
+                blocksize = sb_set_blocksize(sb, vol->sector_size);
+                if (blocksize != vol->sector_size) {
+                        if (!silent)
+                                ntfs_error(sb, "Unable to set device block "
+                                                "size to sector size (%i).",
+                                                vol->sector_size);
+                        goto err_out_now;
+                }
+                BUG_ON(blocksize != sb->s_blocksize);
+                vol->nr_blocks = i_size_read(sb->s_bdev->bd_inode) >>
+                                sb->s_blocksize_bits;
+                ntfs_debug("Changed device block size to %i bytes (block size "
+                                "bits %i) to match volume sector size.",
+                                blocksize, sb->s_blocksize_bits);
+        }
+        /* Initialize the cluster and mft allocators. */
+        ntfs_setup_allocators(vol);
         /* Setup remaining fields in the super block. */
         sb->s_magic = NTFS_SB_MAGIC;
-
         /*
          * Ntfs allows 63 bits for the file size, i.e. correct would be:
          *      sb->s_maxbytes = ~0ULL >> 1;
@@ -2787,9 +2855,8 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
          * without overflowing the index or to 2^63 - 1, whichever is smaller.
          */
         sb->s_maxbytes = MAX_LFS_FILESIZE;
-
+        /* Ntfs measures time in 100ns intervals. */
         sb->s_time_gran = 100;
-
         /*
          * Now load the metadata required for the page cache and our address
          * space operations to function. We do this by setting up a specialised
@@ -2987,14 +3054,14 @@ err_out_now:
  * strings of the maximum length allowed by NTFS, which is NTFS_MAX_NAME_LEN
  * (255) Unicode characters + a terminating NULL Unicode character.
  */
-kmem_cache_t *ntfs_name_cache;
+struct kmem_cache *ntfs_name_cache;
 
 /* Slab caches for efficient allocation/deallocation of inodes. */
-kmem_cache_t *ntfs_inode_cache;
-kmem_cache_t *ntfs_big_inode_cache;
+struct kmem_cache *ntfs_inode_cache;
+struct kmem_cache *ntfs_big_inode_cache;
 
 /* Init once constructor for the inode slab cache. */
-static void ntfs_big_inode_init_once(void *foo, kmem_cache_t *cachep,
+static void ntfs_big_inode_init_once(void *foo, struct kmem_cache *cachep,
                 unsigned long flags)
 {
         ntfs_inode *ni = (ntfs_inode *)foo;
@@ -3008,8 +3075,8 @@ static void ntfs_big_inode_init_once(void *foo, kmem_cache_t *cachep,
  * Slab caches to optimize allocations and deallocations of attribute search
  * contexts and index contexts, respectively.
  */
-kmem_cache_t *ntfs_attr_ctx_cache;
-kmem_cache_t *ntfs_index_ctx_cache;
+struct kmem_cache *ntfs_attr_ctx_cache;
+struct kmem_cache *ntfs_index_ctx_cache;
 
 /* Driver wide semaphore. */
 DECLARE_MUTEX(ntfs_lock);
diff --git a/fs/ntfs/upcase.c b/fs/ntfs/upcase.c
index 879cdf1d5bd3..9101807dc81a 100644
--- a/fs/ntfs/upcase.c
+++ b/fs/ntfs/upcase.c
@@ -3,10 +3,7 @@
  *            Part of the Linux-NTFS project.
  *
  * Copyright (c) 2001 Richard Russon <ntfs@flatcap.org>
- * Copyright (c) 2001-2004 Anton Altaparmakov
- *
- * Modified for mkntfs inclusion 9 June 2001 by Anton Altaparmakov.
- * Modified for kernel inclusion 10 September 2001 by Anton Altparmakov.
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
@@ -75,12 +72,13 @@ ntfschar *generate_default_upcase(void)
         if (!uc)
                 return uc;
         memset(uc, 0, default_upcase_len * sizeof(ntfschar));
+        /* Generate the little endian Unicode upcase table used by ntfs. */
         for (i = 0; i < default_upcase_len; i++)
                 uc[i] = cpu_to_le16(i);
         for (r = 0; uc_run_table[r][0]; r++)
                 for (i = uc_run_table[r][0]; i < uc_run_table[r][1]; i++)
-                        uc[i] = cpu_to_le16((le16_to_cpu(uc[i]) +
-                                        uc_run_table[r][2]));
+                        uc[i] = cpu_to_le16(le16_to_cpu(uc[i]) +
+                                        uc_run_table[r][2]);
         for (r = 0; uc_dup_table[r][0]; r++)
                 for (i = uc_dup_table[r][0]; i < uc_dup_table[r][1]; i += 2)
                         uc[i + 1] = cpu_to_le16(le16_to_cpu(uc[i + 1]) - 1);
diff --git a/fs/ntfs/volume.h b/fs/ntfs/volume.h
index 375cd20a9f61..406ab55dfb32 100644
--- a/fs/ntfs/volume.h
+++ b/fs/ntfs/volume.h
@@ -2,7 +2,7 @@
  * volume.h - Defines for volume structures in NTFS Linux kernel driver. Part
  *            of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -41,10 +41,8 @@ typedef struct {
          * structure has stabilized... (AIA)
          */
         /* Device specifics. */
-        struct super_block *sb;         /* Pointer back to the super_block,
-                                           so we don't have to get the offset
-                                           every time. */
-        LCN nr_blocks;                  /* Number of NTFS_BLOCK_SIZE bytes
+        struct super_block *sb;         /* Pointer back to the super_block. */
+        LCN nr_blocks;                  /* Number of sb->s_blocksize bytes
                                            sized blocks on the device. */
         /* Configuration provided by user at mount time. */
         unsigned long flags;            /* Miscellaneous flags, see below. */
@@ -141,8 +139,8 @@ typedef enum {
         NV_ShowSystemFiles,     /* 1: Return system files in ntfs_readdir(). */
         NV_CaseSensitive,       /* 1: Treat file names as case sensitive and
                                       create filenames in the POSIX namespace.
-                                      Otherwise be case insensitive and create
-                                      file names in WIN32 namespace. */
+                                      Otherwise be case insensitive but still
+                                      create file names in POSIX namespace. */
         NV_LogFileEmpty,        /* 1: $LogFile journal is empty. */
         NV_QuotaOutOfDate,      /* 1: $Quota is out of date. */
         NV_UsnJrnlStamped,      /* 1: $UsnJrnl has been stamped. */
@@ -153,7 +151,7 @@ typedef enum {
  * Macro tricks to expand the NVolFoo(), NVolSetFoo(), and NVolClearFoo()
  * functions.
  */
-#define NVOL_FNS(flag)                                  \
+#define DEFINE_NVOL_BIT_OPS(flag)                                       \
 static inline int NVol##flag(ntfs_volume *vol)          \
 {                                                       \
         return test_bit(NV_##flag, &(vol)->flags);      \
@@ -168,12 +166,12 @@ static inline void NVolClear##flag(ntfs_volume *vol)	\
 }
 
 /* Emit the ntfs volume bitops functions. */
-NVOL_FNS(Errors)
-NVOL_FNS(ShowSystemFiles)
-NVOL_FNS(CaseSensitive)
-NVOL_FNS(LogFileEmpty)
-NVOL_FNS(QuotaOutOfDate)
-NVOL_FNS(UsnJrnlStamped)
-NVOL_FNS(SparseEnabled)
+DEFINE_NVOL_BIT_OPS(Errors)
+DEFINE_NVOL_BIT_OPS(ShowSystemFiles)
+DEFINE_NVOL_BIT_OPS(CaseSensitive)
+DEFINE_NVOL_BIT_OPS(LogFileEmpty)
+DEFINE_NVOL_BIT_OPS(QuotaOutOfDate)
+DEFINE_NVOL_BIT_OPS(UsnJrnlStamped)
+DEFINE_NVOL_BIT_OPS(SparseEnabled)
 
 #endif /* _LINUX_NTFS_VOLUME_H */
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index d424041b38e9..bae3d7548bea 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -58,7 +58,7 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh,
                 goto out;
         }
 
-        down(&OCFS2_I(inode)->ip_io_sem);
+        mutex_lock(&OCFS2_I(inode)->ip_io_mutex);
 
         lock_buffer(bh);
         set_buffer_uptodate(bh);
@@ -82,7 +82,7 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh,
                 brelse(bh);
         }
 
-        up(&OCFS2_I(inode)->ip_io_sem);
+        mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
 out:
         mlog_exit(ret);
         return ret;
@@ -125,13 +125,13 @@ int ocfs2_read_blocks(struct ocfs2_super *osb, u64 block, int nr,
                 flags &= ~OCFS2_BH_CACHED;
 
         if (inode)
-                down(&OCFS2_I(inode)->ip_io_sem);
+                mutex_lock(&OCFS2_I(inode)->ip_io_mutex);
         for (i = 0 ; i < nr ; i++) {
                 if (bhs[i] == NULL) {
                         bhs[i] = sb_getblk(sb, block++);
                         if (bhs[i] == NULL) {
                                 if (inode)
-                                        up(&OCFS2_I(inode)->ip_io_sem);
+                                        mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
                                 status = -EIO;
                                 mlog_errno(status);
                                 goto bail;
@@ -220,7 +220,7 @@ int ocfs2_read_blocks(struct ocfs2_super *osb, u64 block, int nr,
                         ocfs2_set_buffer_uptodate(inode, bh);
         }
         if (inode)
-                up(&OCFS2_I(inode)->ip_io_sem);
+                mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
 
         mlog(ML_BH_IO, "block=(%"MLFu64"), nr=(%d), cached=%s\n", block, nr,
              (!(flags & OCFS2_BH_CACHED) || ignore_cache) ? "no" : "yes");
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index 7307ba528913..d08971d29b63 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -917,8 +917,9 @@ static int o2hb_thread(void *data)
                 elapsed_msec = o2hb_elapsed_msecs(&before_hb, &after_hb);
 
                 mlog(0, "start = %lu.%lu, end = %lu.%lu, msec = %u\n",
-                     before_hb.tv_sec, before_hb.tv_usec,
-                     after_hb.tv_sec, after_hb.tv_usec, elapsed_msec);
+                     before_hb.tv_sec, (unsigned long) before_hb.tv_usec,
+                     after_hb.tv_sec, (unsigned long) after_hb.tv_usec,
+                     elapsed_msec);
 
                 if (elapsed_msec < reg->hr_timeout_ms) {
                         /* the kthread api has blocked signals for us so no
diff --git a/fs/ocfs2/cluster/masklog.c b/fs/ocfs2/cluster/masklog.c
index fd741cea5705..636593bf4d17 100644
--- a/fs/ocfs2/cluster/masklog.c
+++ b/fs/ocfs2/cluster/masklog.c
@@ -74,6 +74,7 @@ struct mlog_attribute {
 #define define_mask(_name) {                    \
         .attr = {                               \
                 .name = #_name,                 \
+                .owner = THIS_MODULE,           \
                 .mode = S_IRUGO | S_IWUSR,      \
         },                                      \
         .mask = ML_##_name,                     \
diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
index e8c56a3d9c64..2cadc3009c83 100644
--- a/fs/ocfs2/cluster/masklog.h
+++ b/fs/ocfs2/cluster/masklog.h
@@ -256,7 +256,7 @@ extern struct mlog_bits mlog_and_bits, mlog_not_bits;
         }                                                               \
 } while (0)
 
-#if (BITS_PER_LONG == 32) || defined(CONFIG_X86_64)
+#if (BITS_PER_LONG == 32) || defined(CONFIG_X86_64) || (defined(CONFIG_UML_X86) && defined(CONFIG_64BIT))
 #define MLFi64 "lld"
 #define MLFu64 "llu"
 #define MLFx64 "llx"
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index cf7828f23361..e1fceb8aa32d 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -756,7 +756,7 @@ static int __init init_o2nm(void)
         if (!ocfs2_table_header) {
                 printk(KERN_ERR "nodemanager: unable to register sysctl\n");
                 ret = -ENOMEM; /* or something. */
-                goto out;
+                goto out_o2net;
         }
 
         ret = o2net_register_hb_callbacks();
@@ -780,6 +780,8 @@ out_callbacks:
         o2net_unregister_hb_callbacks();
 out_sysctl:
         unregister_sysctl_table(ocfs2_table_header);
+out_o2net:
+        o2net_exit();
 out:
         return ret;
 }
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 35d92c01a972..0f60cc0d3985 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -1285,14 +1285,16 @@ static void o2net_idle_timer(unsigned long data)
         mlog(ML_NOTICE, "here are some times that might help debug the "
              "situation: (tmr %ld.%ld now %ld.%ld dr %ld.%ld adv "
              "%ld.%ld:%ld.%ld func (%08x:%u) %ld.%ld:%ld.%ld)\n",
-             sc->sc_tv_timer.tv_sec, sc->sc_tv_timer.tv_usec, 
-             now.tv_sec, now.tv_usec,
-             sc->sc_tv_data_ready.tv_sec, sc->sc_tv_data_ready.tv_usec, 
-             sc->sc_tv_advance_start.tv_sec, sc->sc_tv_advance_start.tv_usec, 
-             sc->sc_tv_advance_stop.tv_sec, sc->sc_tv_advance_stop.tv_usec, 
+             sc->sc_tv_timer.tv_sec, (long) sc->sc_tv_timer.tv_usec, 
+             now.tv_sec, (long) now.tv_usec,
+             sc->sc_tv_data_ready.tv_sec, (long) sc->sc_tv_data_ready.tv_usec,
+             sc->sc_tv_advance_start.tv_sec,
+             (long) sc->sc_tv_advance_start.tv_usec,
+             sc->sc_tv_advance_stop.tv_sec,
+             (long) sc->sc_tv_advance_stop.tv_usec,
              sc->sc_msg_key, sc->sc_msg_type,
-             sc->sc_tv_func_start.tv_sec, sc->sc_tv_func_start.tv_usec,
-             sc->sc_tv_func_stop.tv_sec, sc->sc_tv_func_stop.tv_usec);
+             sc->sc_tv_func_start.tv_sec, (long) sc->sc_tv_func_start.tv_usec,
+             sc->sc_tv_func_stop.tv_sec, (long) sc->sc_tv_func_stop.tv_usec);
 
         o2net_sc_queue_work(sc, &sc->sc_shutdown_work);
 }
@@ -1316,7 +1318,7 @@ static void o2net_start_connect(void *arg)
 {
         struct o2net_node *nn = arg;
         struct o2net_sock_container *sc = NULL;
-        struct o2nm_node *node = NULL;
+        struct o2nm_node *node = NULL, *mynode = NULL;
         struct socket *sock = NULL;
         struct sockaddr_in myaddr = {0, }, remoteaddr = {0, };
         int ret = 0;
@@ -1332,6 +1334,12 @@ static void o2net_start_connect(void *arg)
                 goto out;
         }
 
+        mynode = o2nm_get_node_by_num(o2nm_this_node());
+        if (mynode == NULL) {
+                ret = 0;
+                goto out;
+        }
+
         spin_lock(&nn->nn_lock);
         /* see if we already have one pending or have given up */
         if (nn->nn_sc || nn->nn_persistent_error)
@@ -1359,12 +1367,14 @@ static void o2net_start_connect(void *arg)
         sock->sk->sk_allocation = GFP_ATOMIC;
 
         myaddr.sin_family = AF_INET;
+        myaddr.sin_addr.s_addr = (__force u32)mynode->nd_ipv4_address;
         myaddr.sin_port = (__force u16)htons(0); /* any port */
 
         ret = sock->ops->bind(sock, (struct sockaddr *)&myaddr,
                               sizeof(myaddr));
         if (ret) {
-                mlog(0, "bind failed: %d\n", ret);
+                mlog(ML_ERROR, "bind failed with %d at address %u.%u.%u.%u\n",
+                     ret, NIPQUAD(mynode->nd_ipv4_address));
                 goto out;
         }
 
@@ -1405,6 +1415,8 @@ out:
                 sc_put(sc);
         if (node)
                 o2nm_node_put(node);
+        if (mynode)
+                o2nm_node_put(mynode);
 
         return;
 }
diff --git a/fs/ocfs2/cluster/tcp.h b/fs/ocfs2/cluster/tcp.h
index a6f4585501c8..616ff2b8434a 100644
--- a/fs/ocfs2/cluster/tcp.h
+++ b/fs/ocfs2/cluster/tcp.h
@@ -85,13 +85,10 @@ enum {
         O2NET_DRIVER_READY,
 };
 
-int o2net_init_tcp_sock(struct inode *inode);
 int o2net_send_message(u32 msg_type, u32 key, void *data, u32 len,
                        u8 target_node, int *status);
 int o2net_send_message_vec(u32 msg_type, u32 key, struct kvec *vec,
                            size_t veclen, u8 target_node, int *status);
-int o2net_broadcast_message(u32 msg_type, u32 key, void *data, u32 len,
-                            struct inode *group);
 
 int o2net_register_handler(u32 msg_type, u32 key, u32 max_len,
                            o2net_msg_handler_func *func, void *data,
@@ -107,7 +104,5 @@ void o2net_disconnect_node(struct o2nm_node *node);
 
 int o2net_init(void);
 void o2net_exit(void);
-int o2net_proc_init(struct proc_dir_entry *parent);
-void o2net_proc_exit(struct proc_dir_entry *parent);
 
 #endif /* O2CLUSTER_TCP_H */
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index 3fecba0a6023..9c772583744a 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -37,9 +37,7 @@
 #define DLM_THREAD_SHUFFLE_INTERVAL    5     // flush everything every 5 passes
 #define DLM_THREAD_MS                  200   // flush at least every 200 ms
 
-#define DLM_HASH_BITS     7
-#define DLM_HASH_SIZE     (1 << DLM_HASH_BITS)
-#define DLM_HASH_MASK     (DLM_HASH_SIZE - 1)
+#define DLM_HASH_BUCKETS     (PAGE_SIZE / sizeof(struct hlist_head))
 
 enum dlm_ast_type {
         DLM_AST = 0,
@@ -87,7 +85,7 @@ enum dlm_ctxt_state {
 struct dlm_ctxt
 {
         struct list_head list;
-        struct list_head *resources;
+        struct hlist_head *lockres_hash;
         struct list_head dirty_list;
         struct list_head purge_list;
         struct list_head pending_asts;
@@ -208,13 +206,16 @@ static inline void __dlm_set_joining_node(struct dlm_ctxt *dlm,
 #define DLM_LOCK_RES_IN_PROGRESS          0x00000010
 #define DLM_LOCK_RES_MIGRATING            0x00000020
 
+/* max milliseconds to wait to sync up a network failure with a node death */
+#define DLM_NODE_DEATH_WAIT_MAX (5 * 1000)
+
 #define DLM_PURGE_INTERVAL_MS   (8 * 1000)
 
 struct dlm_lock_resource
 {
         /* WARNING: Please see the comment in dlm_init_lockres before
          * adding fields here. */
-        struct list_head list;
+        struct hlist_node hash_node;
         struct kref      refs;
 
         /* please keep these next 3 in this order
@@ -657,6 +658,8 @@ void dlm_complete_thread(struct dlm_ctxt *dlm);
 int dlm_launch_recovery_thread(struct dlm_ctxt *dlm);
 void dlm_complete_recovery_thread(struct dlm_ctxt *dlm);
 void dlm_wait_for_recovery(struct dlm_ctxt *dlm);
+int dlm_is_node_dead(struct dlm_ctxt *dlm, u8 node);
+int dlm_wait_for_node_death(struct dlm_ctxt *dlm, u8 node, int timeout);
 
 void dlm_put(struct dlm_ctxt *dlm);
 struct dlm_ctxt *dlm_grab(struct dlm_ctxt *dlm);
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index 6001b22a997d..f66e2d818ccd 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -392,6 +392,11 @@ static enum dlm_status dlm_send_remote_convert_request(struct dlm_ctxt *dlm,
         } else {
                 mlog_errno(tmpret);
                 if (dlm_is_host_down(tmpret)) {
+                        /* instead of logging the same network error over
+                         * and over, sleep here and wait for the heartbeat
+                         * to notice the node is dead.  times out after 5s. */
+                        dlm_wait_for_node_death(dlm, res->owner, 
+                                                DLM_NODE_DEATH_WAIT_MAX);
                         ret = DLM_RECOVERING;
                         mlog(0, "node %u died so returning DLM_RECOVERING "
                              "from convert message!\n", res->owner);
@@ -421,7 +426,7 @@ int dlm_convert_lock_handler(struct o2net_msg *msg, u32 len, void *data)
         struct dlm_lockstatus *lksb;
         enum dlm_status status = DLM_NORMAL;
         u32 flags;
-        int call_ast = 0, kick_thread = 0;
+        int call_ast = 0, kick_thread = 0, ast_reserved = 0;
 
         if (!dlm_grab(dlm)) {
                 dlm_error(DLM_REJECTED);
@@ -490,6 +495,7 @@ int dlm_convert_lock_handler(struct o2net_msg *msg, u32 len, void *data)
         status = __dlm_lockres_state_to_status(res);
         if (status == DLM_NORMAL) {
                 __dlm_lockres_reserve_ast(res);
+                ast_reserved = 1;
                 res->state |= DLM_LOCK_RES_IN_PROGRESS;
                 status = __dlmconvert_master(dlm, res, lock, flags,
                                              cnv->requested_type,
@@ -512,10 +518,10 @@ leave:
         else
                 dlm_lock_put(lock);
 
-        /* either queue the ast or release it */
+        /* either queue the ast or release it, if reserved */
         if (call_ast)
                 dlm_queue_ast(dlm, lock);
-        else
+        else if (ast_reserved)
                 dlm_lockres_release_ast(dlm, res);
 
         if (kick_thread)
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index f339fe27975a..54f61b76ab51 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -117,8 +117,8 @@ EXPORT_SYMBOL_GPL(dlm_print_one_lock);
 void dlm_dump_lock_resources(struct dlm_ctxt *dlm)
 {
         struct dlm_lock_resource *res;
-        struct list_head *iter;
-        struct list_head *bucket;
+        struct hlist_node *iter;
+        struct hlist_head *bucket;
         int i;
 
         mlog(ML_NOTICE, "struct dlm_ctxt: %s, node=%u, key=%u\n",
@@ -129,12 +129,10 @@ void dlm_dump_lock_resources(struct dlm_ctxt *dlm)
         }
 
         spin_lock(&dlm->spinlock);
-        for (i=0; i<DLM_HASH_SIZE; i++) {
-                bucket = &(dlm->resources[i]);
-                list_for_each(iter, bucket) {
-                        res = list_entry(iter, struct dlm_lock_resource, list);
+        for (i=0; i<DLM_HASH_BUCKETS; i++) {
+                bucket = &(dlm->lockres_hash[i]);
+                hlist_for_each_entry(res, iter, bucket, hash_node)
                         dlm_print_one_lock_resource(res);
-                }
         }
         spin_unlock(&dlm->spinlock);
 }
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index da3c22045f89..8f3a9e3106fd 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -77,26 +77,26 @@ static void dlm_unregister_domain_handlers(struct dlm_ctxt *dlm);
 
 void __dlm_unhash_lockres(struct dlm_lock_resource *lockres)
 {
-        list_del_init(&lockres->list);
+        hlist_del_init(&lockres->hash_node);
         dlm_lockres_put(lockres);
 }
 
 void __dlm_insert_lockres(struct dlm_ctxt *dlm,
                        struct dlm_lock_resource *res)
 {
-        struct list_head *bucket;
+        struct hlist_head *bucket;
         struct qstr *q;
 
         assert_spin_locked(&dlm->spinlock);
 
         q = &res->lockname;
         q->hash = full_name_hash(q->name, q->len);
-        bucket = &(dlm->resources[q->hash & DLM_HASH_MASK]);
+        bucket = &(dlm->lockres_hash[q->hash % DLM_HASH_BUCKETS]);
 
         /* get a reference for our hashtable */
         dlm_lockres_get(res);
 
-        list_add_tail(&res->list, bucket);
+        hlist_add_head(&res->hash_node, bucket);
 }
 
 struct dlm_lock_resource * __dlm_lookup_lockres(struct dlm_ctxt *dlm,
@@ -104,9 +104,9 @@ struct dlm_lock_resource * __dlm_lookup_lockres(struct dlm_ctxt *dlm,
                                          unsigned int len)
 {
         unsigned int hash;
-        struct list_head *iter;
+        struct hlist_node *iter;
         struct dlm_lock_resource *tmpres=NULL;
-        struct list_head *bucket;
+        struct hlist_head *bucket;
 
         mlog_entry("%.*s\n", len, name);
 
@@ -114,11 +114,11 @@ struct dlm_lock_resource * __dlm_lookup_lockres(struct dlm_ctxt *dlm,
 
         hash = full_name_hash(name, len);
 
-        bucket = &(dlm->resources[hash & DLM_HASH_MASK]);
+        bucket = &(dlm->lockres_hash[hash % DLM_HASH_BUCKETS]);
 
         /* check for pre-existing lock */
-        list_for_each(iter, bucket) {
-                tmpres = list_entry(iter, struct dlm_lock_resource, list);
+        hlist_for_each(iter, bucket) {
+                tmpres = hlist_entry(iter, struct dlm_lock_resource, hash_node);
                 if (tmpres->lockname.len == len &&
                     memcmp(tmpres->lockname.name, name, len) == 0) {
                         dlm_lockres_get(tmpres);
@@ -193,8 +193,8 @@ static int dlm_wait_on_domain_helper(const char *domain)
 
 static void dlm_free_ctxt_mem(struct dlm_ctxt *dlm)
 {
-        if (dlm->resources)
-                free_page((unsigned long) dlm->resources);
+        if (dlm->lockres_hash)
+                free_page((unsigned long) dlm->lockres_hash);
 
         if (dlm->name)
                 kfree(dlm->name);
@@ -303,10 +303,10 @@ static void dlm_migrate_all_locks(struct dlm_ctxt *dlm)
         mlog(0, "Migrating locks from domain %s\n", dlm->name);
 restart:
         spin_lock(&dlm->spinlock);
-        for (i=0; i<DLM_HASH_SIZE; i++) {
-                while (!list_empty(&dlm->resources[i])) {
-                        res = list_entry(dlm->resources[i].next,
-                                     struct dlm_lock_resource, list);
+        for (i = 0; i < DLM_HASH_BUCKETS; i++) {
+                while (!hlist_empty(&dlm->lockres_hash[i])) {
+                        res = hlist_entry(dlm->lockres_hash[i].first,
+                                          struct dlm_lock_resource, hash_node);
                         /* need reference when manually grabbing lockres */
                         dlm_lockres_get(res);
                         /* this should unhash the lockres
@@ -573,8 +573,11 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data)
         spin_lock(&dlm_domain_lock);
         dlm = __dlm_lookup_domain_full(query->domain, query->name_len);
         /* Once the dlm ctxt is marked as leaving then we don't want
-         * to be put in someone's domain map. */
+         * to be put in someone's domain map. 
+         * Also, explicitly disallow joining at certain troublesome
+         * times (ie. during recovery). */
         if (dlm && dlm->dlm_state != DLM_CTXT_LEAVING) {
+                int bit = query->node_idx;
                 spin_lock(&dlm->spinlock);
 
                 if (dlm->dlm_state == DLM_CTXT_NEW &&
@@ -586,6 +589,19 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data)
                 } else if (dlm->joining_node != DLM_LOCK_RES_OWNER_UNKNOWN) {
                         /* Disallow parallel joins. */
                         response = JOIN_DISALLOW;
+                } else if (dlm->reco.state & DLM_RECO_STATE_ACTIVE) {
+                        mlog(ML_NOTICE, "node %u trying to join, but recovery "
+                             "is ongoing.\n", bit);
+                        response = JOIN_DISALLOW;
+                } else if (test_bit(bit, dlm->recovery_map)) {
+                        mlog(ML_NOTICE, "node %u trying to join, but it "
+                             "still needs recovery.\n", bit);
+                        response = JOIN_DISALLOW;
+                } else if (test_bit(bit, dlm->domain_map)) {
+                        mlog(ML_NOTICE, "node %u trying to join, but it "
+                             "is still in the domain! needs recovery?\n",
+                             bit);
+                        response = JOIN_DISALLOW;
                 } else {
                         /* Alright we're fully a part of this domain
                          * so we keep some state as to who's joining
@@ -1175,18 +1191,17 @@ static struct dlm_ctxt *dlm_alloc_ctxt(const char *domain,
                 goto leave;
         }
 
-        dlm->resources = (struct list_head *) __get_free_page(GFP_KERNEL);
-        if (!dlm->resources) {
+        dlm->lockres_hash = (struct hlist_head *) __get_free_page(GFP_KERNEL);
+        if (!dlm->lockres_hash) {
                 mlog_errno(-ENOMEM);
                 kfree(dlm->name);
                 kfree(dlm);
                 dlm = NULL;
                 goto leave;
         }
-        memset(dlm->resources, 0, PAGE_SIZE);
 
-        for (i=0; i<DLM_HASH_SIZE; i++)
-                INIT_LIST_HEAD(&dlm->resources[i]);
+        for (i=0; i<DLM_HASH_BUCKETS; i++)
+                INIT_HLIST_HEAD(&dlm->lockres_hash[i]);
 
         strcpy(dlm->name, domain);
         dlm->key = key;
diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
index d1a0038557a3..671d4ff222cc 100644
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -220,6 +220,17 @@ static enum dlm_status dlmlock_remote(struct dlm_ctxt *dlm,
                         dlm_error(status);
                 dlm_revert_pending_lock(res, lock);
                 dlm_lock_put(lock);
+        } else if (dlm_is_recovery_lock(res->lockname.name, 
+                                        res->lockname.len)) {
+                /* special case for the $RECOVERY lock.
+                 * there will never be an AST delivered to put
+                 * this lock on the proper secondary queue
+                 * (granted), so do it manually. */
+                mlog(0, "%s: $RECOVERY lock for this node (%u) is "
+                     "mastered by %u; got lock, manually granting (no ast)\n",
+                     dlm->name, dlm->node_num, res->owner);
+                list_del_init(&lock->list);
+                list_add_tail(&lock->list, &res->granted);
         }
         spin_unlock(&res->spinlock);
 
@@ -646,7 +657,19 @@ retry_lock:
                         mlog(0, "retrying lock with migration/"
                              "recovery/in progress\n");
                         msleep(100);
-                        dlm_wait_for_recovery(dlm);
+                        /* no waiting for dlm_reco_thread */
+                        if (recovery) {
+                                if (status == DLM_RECOVERING) {
+                                        mlog(0, "%s: got RECOVERING "
+                                             "for $REOCVERY lock, master "
+                                             "was %u\n", dlm->name, 
+                                             res->owner);
+                                        dlm_wait_for_node_death(dlm, res->owner, 
+                                                        DLM_NODE_DEATH_WAIT_MAX);
+                                }
+                        } else {
+                                dlm_wait_for_recovery(dlm);
+                        }
                         goto retry_lock;
                 }
 
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 27e984f7e4cd..847dd3cc4cf5 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -564,7 +564,7 @@ static void dlm_lockres_release(struct kref *kref)
 
         /* By the time we're ready to blow this guy away, we shouldn't
          * be on any lists. */
-        BUG_ON(!list_empty(&res->list));
+        BUG_ON(!hlist_unhashed(&res->hash_node));
         BUG_ON(!list_empty(&res->granted));
         BUG_ON(!list_empty(&res->converting));
         BUG_ON(!list_empty(&res->blocked));
@@ -605,7 +605,7 @@ static void dlm_init_lockres(struct dlm_ctxt *dlm,
 
         init_waitqueue_head(&res->wq);
         spin_lock_init(&res->spinlock);
-        INIT_LIST_HEAD(&res->list);
+        INIT_HLIST_NODE(&res->hash_node);
         INIT_LIST_HEAD(&res->granted);
         INIT_LIST_HEAD(&res->converting);
         INIT_LIST_HEAD(&res->blocked);
@@ -1050,17 +1050,10 @@ static int dlm_restart_lock_mastery(struct dlm_ctxt *dlm,
         node = dlm_bitmap_diff_iter_next(&bdi, &sc);
         while (node >= 0) {
                 if (sc == NODE_UP) {
-                        /* a node came up.  easy.  might not even need
-                         * to talk to it if its node number is higher
-                         * or if we are already blocked. */
-                        mlog(0, "node up! %d\n", node);
-                        if (blocked)
-                                goto next;
-
-                        if (node > dlm->node_num) {
-                                mlog(0, "node > this node. skipping.\n");
-                                goto next;
-                        }
+                        /* a node came up.  clear any old vote from
+                         * the response map and set it in the vote map
+                         * then restart the mastery. */
+                        mlog(ML_NOTICE, "node %d up while restarting\n", node);
 
                         /* redo the master request, but only for the new node */
                         mlog(0, "sending request to new node\n");
@@ -2005,6 +1998,15 @@ fail:
                                 break;
 
                         mlog(0, "timed out during migration\n");
+                        /* avoid hang during shutdown when migrating lockres 
+                         * to a node which also goes down */
+                        if (dlm_is_node_dead(dlm, target)) {
+                                mlog(0, "%s:%.*s: expected migration target %u "
+                                     "is no longer up.  restarting.\n",
+                                     dlm->name, res->lockname.len,
+                                     res->lockname.name, target);
+                                ret = -ERESTARTSYS;
+                        }
                 }
                 if (ret == -ERESTARTSYS) {
                         /* migration failed, detach and clean up mle */
@@ -2480,7 +2482,9 @@ top:
                                 atomic_set(&mle->woken, 1);
                                 spin_unlock(&mle->spinlock);
                                 wake_up(&mle->wq);
-                                /* final put will take care of list removal */
+                                /* do not need events any longer, so detach 
+                                 * from heartbeat */
+                                __dlm_mle_detach_hb_events(dlm, mle);
                                 __dlm_put_mle(mle);
                         }
                         continue;
@@ -2535,6 +2539,9 @@ top:
                         spin_unlock(&res->spinlock);
                         dlm_lockres_put(res);
 
+                        /* about to get rid of mle, detach from heartbeat */
+                        __dlm_mle_detach_hb_events(dlm, mle);
+
                         /* dump the mle */
                         spin_lock(&dlm->master_lock);
                         __dlm_put_mle(mle);
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 0c8eb1093f00..1e232000f3f7 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -39,6 +39,7 @@
 #include <linux/inet.h>
 #include <linux/timer.h>
 #include <linux/kthread.h>
+#include <linux/delay.h>
 
 
 #include "cluster/heartbeat.h"
@@ -256,6 +257,45 @@ static int dlm_recovery_thread(void *data)
         return 0;
 }
 
+/* returns true when the recovery master has contacted us */
+static int dlm_reco_master_ready(struct dlm_ctxt *dlm)
+{
+        int ready;
+        spin_lock(&dlm->spinlock);
+        ready = (dlm->reco.new_master != O2NM_INVALID_NODE_NUM);
+        spin_unlock(&dlm->spinlock);
+        return ready;
+}
+
+/* returns true if node is no longer in the domain
+ * could be dead or just not joined */
+int dlm_is_node_dead(struct dlm_ctxt *dlm, u8 node)
+{
+        int dead;
+        spin_lock(&dlm->spinlock);
+        dead = test_bit(node, dlm->domain_map);
+        spin_unlock(&dlm->spinlock);
+        return dead;
+}
+
+int dlm_wait_for_node_death(struct dlm_ctxt *dlm, u8 node, int timeout)
+{
+        if (timeout) {
+                mlog(ML_NOTICE, "%s: waiting %dms for notification of "
+                     "death of node %u\n", dlm->name, timeout, node);
+                wait_event_timeout(dlm->dlm_reco_thread_wq,
+                           dlm_is_node_dead(dlm, node),
+                           msecs_to_jiffies(timeout));
+        } else {
+                mlog(ML_NOTICE, "%s: waiting indefinitely for notification "
+                     "of death of node %u\n", dlm->name, node);
+                wait_event(dlm->dlm_reco_thread_wq,
+                           dlm_is_node_dead(dlm, node));
+        }
+        /* for now, return 0 */
+        return 0;
+}
+
 /* callers of the top-level api calls (dlmlock/dlmunlock) should
  * block on the dlm->reco.event when recovery is in progress.
  * the dlm recovery thread will set this state when it begins
@@ -297,6 +337,7 @@ static void dlm_end_recovery(struct dlm_ctxt *dlm)
 static int dlm_do_recovery(struct dlm_ctxt *dlm)
 {
         int status = 0;
+        int ret;
 
         spin_lock(&dlm->spinlock);
 
@@ -343,10 +384,13 @@ static int dlm_do_recovery(struct dlm_ctxt *dlm)
                 goto master_here;
 
         if (dlm->reco.new_master == O2NM_INVALID_NODE_NUM) {
-                /* choose a new master */
-                if (!dlm_pick_recovery_master(dlm)) {
+                /* choose a new master, returns 0 if this node
+                 * is the master, -EEXIST if it's another node.
+                 * this does not return until a new master is chosen
+                 * or recovery completes entirely. */
+                ret = dlm_pick_recovery_master(dlm);
+                if (!ret) {
                         /* already notified everyone.  go. */
-                        dlm->reco.new_master = dlm->node_num;
                         goto master_here;
                 }
                 mlog(0, "another node will master this recovery session.\n");
@@ -371,8 +415,13 @@ master_here:
         if (status < 0) {
                 mlog(ML_ERROR, "error %d remastering locks for node %u, "
                      "retrying.\n", status, dlm->reco.dead_node);
+                /* yield a bit to allow any final network messages
+                 * to get handled on remaining nodes */
+                msleep(100);
         } else {
                 /* success!  see if any other nodes need recovery */
+                mlog(0, "DONE mastering recovery of %s:%u here(this=%u)!\n",
+                     dlm->name, dlm->reco.dead_node, dlm->node_num);
                 dlm_reset_recovery(dlm);
         }
         dlm_end_recovery(dlm);
@@ -477,7 +526,7 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
                                         BUG();
                                         break;
                                 case DLM_RECO_NODE_DATA_DEAD:
-                                        mlog(0, "node %u died after "
+                                        mlog(ML_NOTICE, "node %u died after "
                                              "requesting recovery info for "
                                              "node %u\n", ndata->node_num,
                                              dead_node);
@@ -485,6 +534,19 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node)
                                         // start all over
                                         destroy = 1;
                                         status = -EAGAIN;
+                                        /* instead of spinning like crazy here,
+                                         * wait for the domain map to catch up
+                                         * with the network state.  otherwise this
+                                         * can be hit hundreds of times before
+                                         * the node is really seen as dead. */
+                                        wait_event_timeout(dlm->dlm_reco_thread_wq,
+                                                           dlm_is_node_dead(dlm,
+                                                                ndata->node_num),
+                                                           msecs_to_jiffies(1000));
+                                        mlog(0, "waited 1 sec for %u, "
+                                             "dead? %s\n", ndata->node_num,
+                                             dlm_is_node_dead(dlm, ndata->node_num) ?
+                                             "yes" : "no");
                                         goto leave;
                                 case DLM_RECO_NODE_DATA_RECEIVING:
                                 case DLM_RECO_NODE_DATA_REQUESTED:
@@ -678,11 +740,27 @@ static void dlm_request_all_locks_worker(struct dlm_work_item *item, void *data)
         dlm = item->dlm;
         dead_node = item->u.ral.dead_node;
         reco_master = item->u.ral.reco_master;
+        mres = (struct dlm_migratable_lockres *)data;
+
+        if (dead_node != dlm->reco.dead_node ||
+            reco_master != dlm->reco.new_master) {
+                /* show extra debug info if the recovery state is messed */
+                mlog(ML_ERROR, "%s: bad reco state: reco(dead=%u, master=%u), "
+                     "request(dead=%u, master=%u)\n",
+                     dlm->name, dlm->reco.dead_node, dlm->reco.new_master,
+                     dead_node, reco_master);
+                mlog(ML_ERROR, "%s: name=%.*s master=%u locks=%u/%u flags=%u "
+                     "entry[0]={c=%"MLFu64",l=%u,f=%u,t=%d,ct=%d,hb=%d,n=%u}\n",
+                     dlm->name, mres->lockname_len, mres->lockname, mres->master,
+                     mres->num_locks, mres->total_locks, mres->flags,
+                     mres->ml[0].cookie, mres->ml[0].list, mres->ml[0].flags,
+                     mres->ml[0].type, mres->ml[0].convert_type,
+                     mres->ml[0].highest_blocked, mres->ml[0].node);
+                BUG();
+        }
         BUG_ON(dead_node != dlm->reco.dead_node);
         BUG_ON(reco_master != dlm->reco.new_master);
 
-        mres = (struct dlm_migratable_lockres *)data;
-
         /* lock resources should have already been moved to the
          * dlm->reco.resources list.  now move items from that list
          * to a temp list if the dead owner matches.  note that the
@@ -757,15 +835,18 @@ int dlm_reco_data_done_handler(struct o2net_msg *msg, u32 len, void *data)
                         continue;
 
                 switch (ndata->state) {
+                        /* should have moved beyond INIT but not to FINALIZE yet */
                         case DLM_RECO_NODE_DATA_INIT:
                         case DLM_RECO_NODE_DATA_DEAD:
-                        case DLM_RECO_NODE_DATA_DONE:
                         case DLM_RECO_NODE_DATA_FINALIZE_SENT:
                                 mlog(ML_ERROR, "bad ndata state for node %u:"
                                      " state=%d\n", ndata->node_num,
                                      ndata->state);
                                 BUG();
                                 break;
+                        /* these states are possible at this point, anywhere along
+                         * the line of recovery */
+                        case DLM_RECO_NODE_DATA_DONE:
                         case DLM_RECO_NODE_DATA_RECEIVING:
                         case DLM_RECO_NODE_DATA_REQUESTED:
                         case DLM_RECO_NODE_DATA_REQUESTING:
@@ -799,13 +880,31 @@ static void dlm_move_reco_locks_to_list(struct dlm_ctxt *dlm,
 {
         struct dlm_lock_resource *res;
         struct list_head *iter, *iter2;
+        struct dlm_lock *lock;
 
         spin_lock(&dlm->spinlock);
         list_for_each_safe(iter, iter2, &dlm->reco.resources) {
                 res = list_entry (iter, struct dlm_lock_resource, recovering);
+                /* always prune any $RECOVERY entries for dead nodes,
+                 * otherwise hangs can occur during later recovery */
                 if (dlm_is_recovery_lock(res->lockname.name,
-                                         res->lockname.len))
+                                         res->lockname.len)) {
+                        spin_lock(&res->spinlock);
+                        list_for_each_entry(lock, &res->granted, list) {
+                                if (lock->ml.node == dead_node) {
+                                        mlog(0, "AHA! there was "
+                                             "a $RECOVERY lock for dead "
+                                             "node %u (%s)!\n", 
+                                             dead_node, dlm->name);
+                                        list_del_init(&lock->list);
+                                        dlm_lock_put(lock);
+                                        break;
+                                }
+                        }
+                        spin_unlock(&res->spinlock);
                         continue;
+                }
+
                 if (res->owner == dead_node) {
                         mlog(0, "found lockres owned by dead node while "
                                   "doing recovery for node %u. sending it.\n",
@@ -1179,7 +1278,7 @@ static void dlm_mig_lockres_worker(struct dlm_work_item *item, void *data)
 again:
                 ret = dlm_lockres_master_requery(dlm, res, &real_master);
                 if (ret < 0) {
-                        mlog(0, "dlm_lockres_master_requery failure: %d\n",
+                        mlog(0, "dlm_lockres_master_requery ret=%d\n",
                                   ret);
                         goto again;
                 }
@@ -1594,7 +1693,10 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
                                               u8 dead_node, u8 new_master)
 {
         int i;
-        struct list_head *iter, *iter2, *bucket;
+        struct list_head *iter, *iter2;
+        struct hlist_node *hash_iter;
+        struct hlist_head *bucket;
+
         struct dlm_lock_resource *res;
 
         mlog_entry_void();
@@ -1618,10 +1720,9 @@ static void dlm_finish_local_lockres_recovery(struct dlm_ctxt *dlm,
          * for now we need to run the whole hash, clear
          * the RECOVERING state and set the owner
          * if necessary */
-        for (i=0; i<DLM_HASH_SIZE; i++) {
-                bucket = &(dlm->resources[i]);
-                list_for_each(iter, bucket) {
-                        res = list_entry (iter, struct dlm_lock_resource, list);
+        for (i = 0; i < DLM_HASH_BUCKETS; i++) {
+                bucket = &(dlm->lockres_hash[i]);
+                hlist_for_each_entry(res, hash_iter, bucket, hash_node) {
                         if (res->state & DLM_LOCK_RES_RECOVERING) {
                                 if (res->owner == dead_node) {
                                         mlog(0, "(this=%u) res %.*s owner=%u "
@@ -1753,10 +1854,11 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
 
 static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
 {
-        struct list_head *iter;
+        struct hlist_node *iter;
         struct dlm_lock_resource *res;
         int i;
-        struct list_head *bucket;
+        struct hlist_head *bucket;
+        struct dlm_lock *lock;
 
 
         /* purge any stale mles */
@@ -1776,14 +1878,28 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
          *    can be kicked again to see if any ASTs or BASTs
          *    need to be fired as a result.
          */
-        for (i=0; i<DLM_HASH_SIZE; i++) {
-                bucket = &(dlm->resources[i]);
-                list_for_each(iter, bucket) {
-                        res = list_entry (iter, struct dlm_lock_resource, list);
+        for (i = 0; i < DLM_HASH_BUCKETS; i++) {
+                bucket = &(dlm->lockres_hash[i]);
+                hlist_for_each_entry(res, iter, bucket, hash_node) {
+                        /* always prune any $RECOVERY entries for dead nodes,
+                         * otherwise hangs can occur during later recovery */
                         if (dlm_is_recovery_lock(res->lockname.name,
-                                                 res->lockname.len))
+                                                 res->lockname.len)) {
+                                spin_lock(&res->spinlock);
+                                list_for_each_entry(lock, &res->granted, list) {
+                                        if (lock->ml.node == dead_node) {
+                                                mlog(0, "AHA! there was "
+                                                     "a $RECOVERY lock for dead "
+                                                     "node %u (%s)!\n",
+                                                     dead_node, dlm->name);
+                                                list_del_init(&lock->list);
+                                                dlm_lock_put(lock);
+                                                break;
+                                        }
+                                }
+                                spin_unlock(&res->spinlock);
                                 continue;
-                        
+                        }                       
                         spin_lock(&res->spinlock);
                         /* zero the lvb if necessary */
                         dlm_revalidate_lvb(dlm, res, dead_node);
@@ -1869,12 +1985,9 @@ void dlm_hb_node_up_cb(struct o2nm_node *node, int idx, void *data)
                 return;
 
         spin_lock(&dlm->spinlock);
-
         set_bit(idx, dlm->live_nodes_map);
-
-        /* notify any mles attached to the heartbeat events */
-        dlm_hb_event_notify_attached(dlm, idx, 1);
-
+        /* do NOT notify mle attached to the heartbeat events.
+         * new nodes are not interesting in mastery until joined. */
         spin_unlock(&dlm->spinlock);
 
         dlm_put(dlm);
@@ -1897,7 +2010,18 @@ static void dlm_reco_unlock_ast(void *astdata, enum dlm_status st)
         mlog(0, "unlockast for recovery lock fired!\n");
 }
 
-
+/*
+ * dlm_pick_recovery_master will continually attempt to use
+ * dlmlock() on the special "$RECOVERY" lockres with the
+ * LKM_NOQUEUE flag to get an EX.  every thread that enters
+ * this function on each node racing to become the recovery
+ * master will not stop attempting this until either:
+ * a) this node gets the EX (and becomes the recovery master),
+ * or b) dlm->reco.new_master gets set to some nodenum 
+ * != O2NM_INVALID_NODE_NUM (another node will do the reco).
+ * so each time a recovery master is needed, the entire cluster
+ * will sync at this point.  if the new master dies, that will
+ * be detected in dlm_do_recovery */
 static int dlm_pick_recovery_master(struct dlm_ctxt *dlm)
 {
         enum dlm_status ret;
@@ -1906,23 +2030,69 @@ static int dlm_pick_recovery_master(struct dlm_ctxt *dlm)
 
         mlog(0, "starting recovery of %s at %lu, dead=%u, this=%u\n",
              dlm->name, jiffies, dlm->reco.dead_node, dlm->node_num);
-retry:
+again:  
         memset(&lksb, 0, sizeof(lksb));
 
         ret = dlmlock(dlm, LKM_EXMODE, &lksb, LKM_NOQUEUE|LKM_RECOVERY,
                       DLM_RECOVERY_LOCK_NAME, dlm_reco_ast, dlm, dlm_reco_bast);
 
+        mlog(0, "%s: dlmlock($RECOVERY) returned %d, lksb=%d\n",
+             dlm->name, ret, lksb.status);
+
         if (ret == DLM_NORMAL) {
                 mlog(0, "dlm=%s dlmlock says I got it (this=%u)\n",
                      dlm->name, dlm->node_num);
-                /* I am master, send message to all nodes saying
-                 * that I am beginning a recovery session */
-                status = dlm_send_begin_reco_message(dlm,
-                                              dlm->reco.dead_node);
+                
+                /* got the EX lock.  check to see if another node 
+                 * just became the reco master */
+                if (dlm_reco_master_ready(dlm)) {
+                        mlog(0, "%s: got reco EX lock, but %u will "
+                             "do the recovery\n", dlm->name,
+                             dlm->reco.new_master);
+                        status = -EEXIST;
+                } else {
+                        status = 0;
+
+                        /* see if recovery was already finished elsewhere */
+                        spin_lock(&dlm->spinlock);
+                        if (dlm->reco.dead_node == O2NM_INVALID_NODE_NUM) {
+                                status = -EINVAL;       
+                                mlog(0, "%s: got reco EX lock, but "
+                                     "node got recovered already\n", dlm->name);
+                                if (dlm->reco.new_master != O2NM_INVALID_NODE_NUM) {
+                                        mlog(ML_ERROR, "%s: new master is %u "
+                                             "but no dead node!\n", 
+                                             dlm->name, dlm->reco.new_master);
+                                        BUG();
+                                }
+                        }
+                        spin_unlock(&dlm->spinlock);
+                }
+
+                /* if this node has actually become the recovery master,
+                 * set the master and send the messages to begin recovery */
+                if (!status) {
+                        mlog(0, "%s: dead=%u, this=%u, sending "
+                             "begin_reco now\n", dlm->name, 
+                             dlm->reco.dead_node, dlm->node_num);
+                        status = dlm_send_begin_reco_message(dlm,
+                                      dlm->reco.dead_node);
+                        /* this always succeeds */
+                        BUG_ON(status);
+
+                        /* set the new_master to this node */
+                        spin_lock(&dlm->spinlock);
+                        dlm->reco.new_master = dlm->node_num;
+                        spin_unlock(&dlm->spinlock);
+                }
 
                 /* recovery lock is a special case.  ast will not get fired,
                  * so just go ahead and unlock it. */
                 ret = dlmunlock(dlm, &lksb, 0, dlm_reco_unlock_ast, dlm);
+                if (ret == DLM_DENIED) {
+                        mlog(0, "got DLM_DENIED, trying LKM_CANCEL\n");
+                        ret = dlmunlock(dlm, &lksb, LKM_CANCEL, dlm_reco_unlock_ast, dlm);
+                }
                 if (ret != DLM_NORMAL) {
                         /* this would really suck. this could only happen
                          * if there was a network error during the unlock
@@ -1930,20 +2100,42 @@ retry:
                          * is actually "done" and the lock structure is
                          * even freed.  we can continue, but only
                          * because this specific lock name is special. */
-                        mlog(0, "dlmunlock returned %d\n", ret);
-                }
-
-                if (status < 0) {
-                        mlog(0, "failed to send recovery message. "
-                                   "must retry with new node map.\n");
-                        goto retry;
+                        mlog(ML_ERROR, "dlmunlock returned %d\n", ret);
                 }
         } else if (ret == DLM_NOTQUEUED) {
                 mlog(0, "dlm=%s dlmlock says another node got it (this=%u)\n",
                      dlm->name, dlm->node_num);
                 /* another node is master. wait on
-                 * reco.new_master != O2NM_INVALID_NODE_NUM */
+                 * reco.new_master != O2NM_INVALID_NODE_NUM 
+                 * for at most one second */
+                wait_event_timeout(dlm->dlm_reco_thread_wq,
+                                         dlm_reco_master_ready(dlm),
+                                         msecs_to_jiffies(1000));
+                if (!dlm_reco_master_ready(dlm)) {
+                        mlog(0, "%s: reco master taking awhile\n",
+                             dlm->name);
+                        goto again;
+                }
+                /* another node has informed this one that it is reco master */
+                mlog(0, "%s: reco master %u is ready to recover %u\n",
+                     dlm->name, dlm->reco.new_master, dlm->reco.dead_node);
                 status = -EEXIST;
+        } else {
+                struct dlm_lock_resource *res;
+
+                /* dlmlock returned something other than NOTQUEUED or NORMAL */
+                mlog(ML_ERROR, "%s: got %s from dlmlock($RECOVERY), "
+                     "lksb.status=%s\n", dlm->name, dlm_errname(ret),
+                     dlm_errname(lksb.status));
+                res = dlm_lookup_lockres(dlm, DLM_RECOVERY_LOCK_NAME,
+                                         DLM_RECOVERY_LOCK_NAME_LEN);
+                if (res) {
+                        dlm_print_one_lock_resource(res);
+                        dlm_lockres_put(res);
+                } else {
+                        mlog(ML_ERROR, "recovery lock not found\n");
+                }
+                BUG();
         }
 
         return status;
@@ -1982,7 +2174,7 @@ static int dlm_send_begin_reco_message(struct dlm_ctxt *dlm, u8 dead_node)
                         mlog(0, "not sending begin reco to self\n");
                         continue;
                 }
-
+retry:
                 ret = -EINVAL;
                 mlog(0, "attempting to send begin reco msg to %d\n",
                           nodenum);
@@ -1991,8 +2183,17 @@ static int dlm_send_begin_reco_message(struct dlm_ctxt *dlm, u8 dead_node)
                 /* negative status is handled ok by caller here */
                 if (ret >= 0)
                         ret = status;
+                if (dlm_is_host_down(ret)) {
+                        /* node is down.  not involved in recovery
+                         * so just keep going */
+                        mlog(0, "%s: node %u was down when sending "
+                             "begin reco msg (%d)\n", dlm->name, nodenum, ret);
+                        ret = 0;
+                }
                 if (ret < 0) {
                         struct dlm_lock_resource *res;
+                        /* this is now a serious problem, possibly ENOMEM 
+                         * in the network stack.  must retry */
                         mlog_errno(ret);
                         mlog(ML_ERROR, "begin reco of dlm %s to node %u "
                             " returned %d\n", dlm->name, nodenum, ret);
@@ -2004,7 +2205,10 @@ static int dlm_send_begin_reco_message(struct dlm_ctxt *dlm, u8 dead_node)
                         } else {
                                 mlog(ML_ERROR, "recovery lock not found\n");
                         }
-                        break;
+                        /* sleep for a bit in hopes that we can avoid 
+                         * another ENOMEM */
+                        msleep(100);
+                        goto retry;
                 }
         }
 
@@ -2027,19 +2231,34 @@ int dlm_begin_reco_handler(struct o2net_msg *msg, u32 len, void *data)
 
         spin_lock(&dlm->spinlock);
         if (dlm->reco.new_master != O2NM_INVALID_NODE_NUM) {
-                mlog(0, "new_master already set to %u!\n",
-                          dlm->reco.new_master);
+                if (test_bit(dlm->reco.new_master, dlm->recovery_map)) {
+                        mlog(0, "%s: new_master %u died, changing "
+                             "to %u\n", dlm->name, dlm->reco.new_master,
+                             br->node_idx);
+                } else {
+                        mlog(0, "%s: new_master %u NOT DEAD, changing "
+                             "to %u\n", dlm->name, dlm->reco.new_master,
+                             br->node_idx);
+                        /* may not have seen the new master as dead yet */
+                }
         }
         if (dlm->reco.dead_node != O2NM_INVALID_NODE_NUM) {
-                mlog(0, "dead_node already set to %u!\n",
-                          dlm->reco.dead_node);
+                mlog(ML_NOTICE, "%s: dead_node previously set to %u, "
+                     "node %u changing it to %u\n", dlm->name, 
+                     dlm->reco.dead_node, br->node_idx, br->dead_node);
         }
         dlm->reco.new_master = br->node_idx;
         dlm->reco.dead_node = br->dead_node;
         if (!test_bit(br->dead_node, dlm->recovery_map)) {
-                mlog(ML_ERROR, "recovery master %u sees %u as dead, but this "
+                mlog(0, "recovery master %u sees %u as dead, but this "
                      "node has not yet.  marking %u as dead\n",
                      br->node_idx, br->dead_node, br->dead_node);
+                if (!test_bit(br->dead_node, dlm->domain_map) ||
+                    !test_bit(br->dead_node, dlm->live_nodes_map))
+                        mlog(0, "%u not in domain/live_nodes map "
+                             "so setting it in reco map manually\n",
+                             br->dead_node);
+                set_bit(br->dead_node, dlm->recovery_map);
                 __dlm_hb_node_down(dlm, br->dead_node);
         }
         spin_unlock(&dlm->spinlock);
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index cec2ce1cd318..c95f08d2e925 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -188,6 +188,19 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                         actions &= ~(DLM_UNLOCK_REMOVE_LOCK|
                                      DLM_UNLOCK_REGRANT_LOCK|
                                      DLM_UNLOCK_CLEAR_CONVERT_TYPE);
+                } else if (status == DLM_RECOVERING || 
+                           status == DLM_MIGRATING || 
+                           status == DLM_FORWARD) {
+                        /* must clear the actions because this unlock
+                         * is about to be retried.  cannot free or do
+                         * any list manipulation. */
+                        mlog(0, "%s:%.*s: clearing actions, %s\n",
+                             dlm->name, res->lockname.len,
+                             res->lockname.name,
+                             status==DLM_RECOVERING?"recovering":
+                             (status==DLM_MIGRATING?"migrating":
+                              "forward"));
+                        actions = 0;
                 }
                 if (flags & LKM_CANCEL)
                         lock->cancel_pending = 0;
diff --git a/fs/ocfs2/dlm/userdlm.c b/fs/ocfs2/dlm/userdlm.c
index e1fdd288796e..c3764f4744ee 100644
--- a/fs/ocfs2/dlm/userdlm.c
+++ b/fs/ocfs2/dlm/userdlm.c
@@ -27,7 +27,7 @@
  * Boston, MA 021110-1307, USA.
  */
 
-#include <asm/signal.h>
+#include <linux/signal.h>
 
 #include <linux/module.h>
 #include <linux/fs.h>
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index f2fb40cd296a..e6f207eebab4 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -181,6 +181,12 @@ static int ocfs2_extent_map_find_leaf(struct inode *inode,
                         ret = -EBADR;
                         if (rec_end > OCFS2_I(inode)->ip_clusters) {
                                 mlog_errno(ret);
+                                ocfs2_error(inode->i_sb,
+                                            "Extent %d at e_blkno %"MLFu64" of inode %"MLFu64" goes past ip_clusters of %u\n",
+                                            i,
+                                            le64_to_cpu(rec->e_blkno),
+                                            OCFS2_I(inode)->ip_blkno,
+                                            OCFS2_I(inode)->ip_clusters);
                                 goto out_free;
                         }
 
@@ -226,6 +232,12 @@ static int ocfs2_extent_map_find_leaf(struct inode *inode,
                         ret = -EBADR;
                         if (blkno) {
                                 mlog_errno(ret);
+                                ocfs2_error(inode->i_sb,
+                                            "Multiple extents for (cpos = %u, clusters = %u) on inode %"MLFu64"; e_blkno %"MLFu64" and rec %d at e_blkno %"MLFu64"\n",
+                                            cpos, clusters,
+                                            OCFS2_I(inode)->ip_blkno,
+                                            blkno, i,
+                                            le64_to_cpu(rec->e_blkno));
                                 goto out_free;
                         }
 
@@ -238,6 +250,10 @@ static int ocfs2_extent_map_find_leaf(struct inode *inode,
                  */
                 ret = -EBADR;
                 if (!blkno) {
+                        ocfs2_error(inode->i_sb,
+                                    "No record found for (cpos = %u, clusters = %u) on inode %"MLFu64"\n",
+                                    cpos, clusters,
+                                    OCFS2_I(inode)->ip_blkno);
                         mlog_errno(ret);
                         goto out_free;
                 }
@@ -262,11 +278,24 @@ static int ocfs2_extent_map_find_leaf(struct inode *inode,
                 el = &eb->h_list;
         }
 
-        if (el->l_tree_depth)
-                BUG();
+        BUG_ON(el->l_tree_depth);
 
         for (i = 0; i < le16_to_cpu(el->l_next_free_rec); i++) {
                 rec = &el->l_recs[i];
+
+                if ((le32_to_cpu(rec->e_cpos) + le32_to_cpu(rec->e_clusters)) >
+                    OCFS2_I(inode)->ip_clusters) {
+                        ret = -EBADR;
+                        mlog_errno(ret);
+                        ocfs2_error(inode->i_sb,
+                                    "Extent %d at e_blkno %"MLFu64" of inode %"MLFu64" goes past ip_clusters of %u\n",
+                                    i,
+                                    le64_to_cpu(rec->e_blkno),
+                                    OCFS2_I(inode)->ip_blkno,
+                                    OCFS2_I(inode)->ip_clusters);
+                        return ret;
+                }
+
                 ret = ocfs2_extent_map_insert(inode, rec,
                                               le16_to_cpu(el->l_tree_depth));
                 if (ret) {
@@ -364,8 +393,8 @@ static int ocfs2_extent_map_lookup_read(struct inode *inode,
                 return ret;
         }
 
-        if (ent->e_tree_depth)
-                BUG();  /* FIXME: Make sure this isn't a corruption */
+        /* FIXME: Make sure this isn't a corruption */
+        BUG_ON(ent->e_tree_depth);
 
         *ret_ent = ent;
 
@@ -423,8 +452,7 @@ static int ocfs2_extent_map_try_insert(struct inode *inode,
                                           le32_to_cpu(rec->e_clusters), NULL,
                                           NULL);
 
-        if (!old_ent)
-                BUG();
+        BUG_ON(!old_ent);
 
         ret = -EEXIST;
         if (old_ent->e_tree_depth < tree_depth)
@@ -528,6 +556,10 @@ static int ocfs2_extent_map_insert(struct inode *inode,
                     OCFS2_I(inode)->ip_map.em_clusters) {
                         ret = -EBADR;
                         mlog_errno(ret);
+                        ocfs2_error(inode->i_sb,
+                                    "Zero e_clusters on non-tail extent record at e_blkno %"MLFu64" on inode %"MLFu64"\n",
+                                    le64_to_cpu(rec->e_blkno),
+                                    OCFS2_I(inode)->ip_blkno);
                         return ret;
                 }
 
@@ -590,12 +622,12 @@ static int ocfs2_extent_map_insert(struct inode *inode,
  * Existing record in the extent map:
  *
  *      cpos = 10, len = 10
- *      |---------|
+ *      |---------|
  *
  * New Record:
  *
  *      cpos = 10, len = 20
- *      |------------------|
+ *      |------------------|
  *
  * The passed record is the new on-disk record.  The new_clusters value
  * is how many clusters were added to the file.  If the append is a
@@ -988,7 +1020,7 @@ int __init init_ocfs2_extent_maps(void)
         return 0;
 }
 
-void __exit exit_ocfs2_extent_maps(void)
+void exit_ocfs2_extent_maps(void)
 {
         kmem_cache_destroy(ocfs2_em_ent_cachep);
 }
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index eaf33caa0a1f..8a4048b55fdc 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -933,9 +933,6 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
         struct file *filp = iocb->ki_filp;
         struct inode *inode = filp->f_dentry->d_inode;
         loff_t newsize, saved_pos;
-#ifdef OCFS2_ORACORE_WORKAROUNDS
-        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-#endif
 
         mlog_entry("(0x%p, 0x%p, %u, '%.*s')\n", filp, buf,
                    (unsigned int)count,
@@ -951,14 +948,6 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                 return -EIO;
         }
 
-#ifdef OCFS2_ORACORE_WORKAROUNDS
-        /* ugh, work around some applications which open everything O_DIRECT +
-         * O_APPEND and really don't mean to use O_DIRECT. */
-        if (osb->s_mount_opt & OCFS2_MOUNT_COMPAT_OCFS &&
-            (filp->f_flags & O_APPEND) && (filp->f_flags & O_DIRECT)) 
-                filp->f_flags &= ~O_DIRECT;
-#endif
-
         mutex_lock(&inode->i_mutex);
         /* to match setattr's i_mutex -> i_alloc_sem -> rw_lock ordering */
         if (filp->f_flags & O_DIRECT) {
@@ -1022,8 +1011,9 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                 }
                 newsize = count + saved_pos;
 
-                mlog(0, "pos=%lld newsize=%"MLFu64" cursize=%lld\n",
-                     saved_pos, newsize, i_size_read(inode));
+                mlog(0, "pos=%lld newsize=%lld cursize=%lld\n",
+                     (long long) saved_pos, (long long) newsize,
+                     (long long) i_size_read(inode));
 
                 /* No need for a higher level metadata lock if we're
                  * never going past i_size. */
@@ -1042,8 +1032,9 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
                 spin_unlock(&OCFS2_I(inode)->ip_lock);
 
                 mlog(0, "Writing at EOF, may need more allocation: "
-                     "i_size = %lld, newsize = %"MLFu64", need %u clusters\n",
-                     i_size_read(inode), newsize, clusters);
+                     "i_size = %lld, newsize = %lld, need %u clusters\n",
+                     (long long) i_size_read(inode), (long long) newsize,
+                     clusters);
 
                 /* We only want to continue the rest of this loop if
                  * our extend will actually require more
@@ -1077,27 +1068,7 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb,
         /* communicate with ocfs2_dio_end_io */
         ocfs2_iocb_set_rw_locked(iocb);
 
-#ifdef OCFS2_ORACORE_WORKAROUNDS
-        if (osb->s_mount_opt & OCFS2_MOUNT_COMPAT_OCFS &&
-            filp->f_flags & O_DIRECT) {
-                unsigned int saved_flags = filp->f_flags;
-                int sector_size = 1 << osb->s_sectsize_bits;
-
-                if ((saved_pos & (sector_size - 1)) ||
-                    (count & (sector_size - 1)) ||
-                    ((unsigned long)buf & (sector_size - 1))) {
-                        filp->f_flags |= O_SYNC;
-                        filp->f_flags &= ~O_DIRECT;
-                }
-
-                ret = generic_file_aio_write_nolock(iocb, &local_iov, 1,
-                                                    &iocb->ki_pos);
-
-                filp->f_flags = saved_flags;
-        } else
-#endif
-                ret = generic_file_aio_write_nolock(iocb, &local_iov, 1,
-                                                    &iocb->ki_pos);
+        ret = generic_file_aio_write_nolock(iocb, &local_iov, 1, &iocb->ki_pos);
 
         /* buffered aio wouldn't have proper lock coverage today */
         BUG_ON(ret == -EIOCBQUEUED && !(filp->f_flags & O_DIRECT));
@@ -1138,9 +1109,6 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
         int ret = 0, rw_level = -1, have_alloc_sem = 0;
         struct file *filp = iocb->ki_filp;
         struct inode *inode = filp->f_dentry->d_inode;
-#ifdef OCFS2_ORACORE_WORKAROUNDS
-        struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-#endif
 
         mlog_entry("(0x%p, 0x%p, %u, '%.*s')\n", filp, buf,
                    (unsigned int)count,
@@ -1153,21 +1121,6 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
                 goto bail;
         }
 
-#ifdef OCFS2_ORACORE_WORKAROUNDS
-        if (osb->s_mount_opt & OCFS2_MOUNT_COMPAT_OCFS) {
-                if (filp->f_flags & O_DIRECT) {
-                        int sector_size = 1 << osb->s_sectsize_bits;
-
-                        if ((pos & (sector_size - 1)) ||
-                            (count & (sector_size - 1)) ||
-                            ((unsigned long)buf & (sector_size - 1)) ||
-                            (i_size_read(inode) & (sector_size -1))) {
-                                filp->f_flags &= ~O_DIRECT;
-                        }
-                }
-        }
-#endif
-
         /* 
          * buffered reads protect themselves in ->readpage().  O_DIRECT reads
          * need locks to protect pending reads from racing with truncate.
diff --git a/fs/ocfs2/heartbeat.c b/fs/ocfs2/heartbeat.c
index 0bbd22f46c80..cbfd45a97a63 100644
--- a/fs/ocfs2/heartbeat.c
+++ b/fs/ocfs2/heartbeat.c
@@ -67,6 +67,7 @@ void ocfs2_init_node_maps(struct ocfs2_super *osb)
         ocfs2_node_map_init(&osb->mounted_map);
         ocfs2_node_map_init(&osb->recovery_map);
         ocfs2_node_map_init(&osb->umount_map);
+        ocfs2_node_map_init(&osb->osb_recovering_orphan_dirs);
 }
 
 static void ocfs2_do_node_down(int node_num,
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index d4ecc0627716..315472a5c192 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -41,6 +41,7 @@
 #include "dlmglue.h"
 #include "extent_map.h"
 #include "file.h"
+#include "heartbeat.h"
 #include "inode.h"
 #include "journal.h"
 #include "namei.h"
@@ -544,6 +545,42 @@ bail:
         return status;
 }
 
+/* 
+ * Serialize with orphan dir recovery. If the process doing
+ * recovery on this orphan dir does an iget() with the dir
+ * i_mutex held, we'll deadlock here. Instead we detect this
+ * and exit early - recovery will wipe this inode for us.
+ */
+static int ocfs2_check_orphan_recovery_state(struct ocfs2_super *osb,
+                                             int slot)
+{
+        int ret = 0;
+
+        spin_lock(&osb->osb_lock);
+        if (ocfs2_node_map_test_bit(osb, &osb->osb_recovering_orphan_dirs, slot)) {
+                mlog(0, "Recovery is happening on orphan dir %d, will skip "
+                     "this inode\n", slot);
+                ret = -EDEADLK;
+                goto out;
+        }
+        /* This signals to the orphan recovery process that it should
+         * wait for us to handle the wipe. */
+        osb->osb_orphan_wipes[slot]++;
+out:
+        spin_unlock(&osb->osb_lock);
+        return ret;
+}
+
+static void ocfs2_signal_wipe_completion(struct ocfs2_super *osb,
+                                         int slot)
+{
+        spin_lock(&osb->osb_lock);
+        osb->osb_orphan_wipes[slot]--;
+        spin_unlock(&osb->osb_lock);
+
+        wake_up(&osb->osb_wipe_event);
+}
+
 static int ocfs2_wipe_inode(struct inode *inode,
                             struct buffer_head *di_bh)
 {
@@ -555,6 +592,11 @@ static int ocfs2_wipe_inode(struct inode *inode,
         /* We've already voted on this so it should be readonly - no
          * spinlock needed. */
         orphaned_slot = OCFS2_I(inode)->ip_orphaned_slot;
+
+        status = ocfs2_check_orphan_recovery_state(osb, orphaned_slot);
+        if (status)
+                return status;
+
         orphan_dir_inode = ocfs2_get_system_file_inode(osb,
                                                        ORPHAN_DIR_SYSTEM_INODE,
                                                        orphaned_slot);
@@ -597,6 +639,7 @@ bail_unlock_dir:
         brelse(orphan_dir_bh);
 bail:
         iput(orphan_dir_inode);
+        ocfs2_signal_wipe_completion(osb, orphaned_slot);
 
         return status;
 }
@@ -822,7 +865,8 @@ void ocfs2_delete_inode(struct inode *inode)
 
         status = ocfs2_wipe_inode(inode, di_bh);
         if (status < 0) {
-                mlog_errno(status);
+                if (status != -EDEADLK)
+                        mlog_errno(status);
                 goto bail_unlock_inode;
         }
 
@@ -903,10 +947,10 @@ void ocfs2_clear_inode(struct inode *inode)
                         "Clear inode of %"MLFu64", inode is locked\n",
                         oi->ip_blkno);
 
-        mlog_bug_on_msg(down_trylock(&oi->ip_io_sem),
-                        "Clear inode of %"MLFu64", io_sem is locked\n",
+        mlog_bug_on_msg(!mutex_trylock(&oi->ip_io_mutex),
+                        "Clear inode of %"MLFu64", io_mutex is locked\n",
                         oi->ip_blkno);
-        up(&oi->ip_io_sem);
+        mutex_unlock(&oi->ip_io_mutex);
 
         /*
          * down_trylock() returns 0, down_write_trylock() returns 1
diff --git a/fs/ocfs2/inode.h b/fs/ocfs2/inode.h
index 9b0177433653..84c507961287 100644
--- a/fs/ocfs2/inode.h
+++ b/fs/ocfs2/inode.h
@@ -46,10 +46,10 @@ struct ocfs2_inode_info
         struct list_head                ip_io_markers;
         int                             ip_orphaned_slot;
 
-        struct semaphore                ip_io_sem;
+        struct mutex                    ip_io_mutex;
 
         /* Used by the journalling code to attach an inode to a
-         * handle.  These are protected by ip_io_sem in order to lock
+         * handle.  These are protected by ip_io_mutex in order to lock
          * out other I/O to the inode until we either commit or
          * abort. */
         struct list_head                ip_handle_list;
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 303c8d96457f..4be801f4559b 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -147,8 +147,7 @@ struct ocfs2_journal_handle *ocfs2_start_trans(struct ocfs2_super *osb,
 
         mlog_entry("(max_buffs = %d)\n", max_buffs);
 
-        if (!osb || !osb->journal->j_journal)
-                BUG();
+        BUG_ON(!osb || !osb->journal->j_journal);
 
         if (ocfs2_is_hard_readonly(osb)) {
                 ret = -EROFS;
@@ -401,7 +400,7 @@ int ocfs2_journal_access(struct ocfs2_journal_handle *handle,
          * j_trans_barrier for us. */
         ocfs2_set_inode_lock_trans(OCFS2_SB(inode->i_sb)->journal, inode);
 
-        down(&OCFS2_I(inode)->ip_io_sem);
+        mutex_lock(&OCFS2_I(inode)->ip_io_mutex);
         switch (type) {
         case OCFS2_JOURNAL_ACCESS_CREATE:
         case OCFS2_JOURNAL_ACCESS_WRITE:
@@ -416,7 +415,7 @@ int ocfs2_journal_access(struct ocfs2_journal_handle *handle,
                 status = -EINVAL;
                 mlog(ML_ERROR, "Uknown access type!\n");
         }
-        up(&OCFS2_I(inode)->ip_io_sem);
+        mutex_unlock(&OCFS2_I(inode)->ip_io_mutex);
 
         if (status < 0)
                 mlog(ML_ERROR, "Error %d getting %d access to buffer!\n",
@@ -561,7 +560,11 @@ int ocfs2_journal_init(struct ocfs2_journal *journal, int *dirty)
         SET_INODE_JOURNAL(inode);
         OCFS2_I(inode)->ip_open_count++;
 
-        status = ocfs2_meta_lock(inode, NULL, &bh, 1);
+        /* Skip recovery waits here - journal inode metadata never
+         * changes in a live cluster so it can be considered an
+         * exception to the rule. */
+        status = ocfs2_meta_lock_full(inode, NULL, &bh, 1,
+                                      OCFS2_META_LOCK_RECOVERY);
         if (status < 0) {
                 if (status != -ERESTARTSYS)
                         mlog(ML_ERROR, "Could not get lock on journal!\n");
@@ -672,8 +675,7 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
 
         mlog_entry_void();
 
-        if (!osb)
-                BUG();
+        BUG_ON(!osb);
 
         journal = osb->journal;
         if (!journal)
@@ -805,8 +807,7 @@ int ocfs2_journal_wipe(struct ocfs2_journal *journal, int full)
 
         mlog_entry_void();
 
-        if (!journal)
-                BUG();
+        BUG_ON(!journal);
 
         status = journal_wipe(journal->j_journal, full);
         if (status < 0) {
@@ -1072,10 +1073,10 @@ restart:
                                         NULL);
 
 bail:
-        down(&osb->recovery_lock);
+        mutex_lock(&osb->recovery_lock);
         if (!status &&
             !ocfs2_node_map_is_empty(osb, &osb->recovery_map)) {
-                up(&osb->recovery_lock);
+                mutex_unlock(&osb->recovery_lock);
                 goto restart;
         }
 
@@ -1083,7 +1084,7 @@ bail:
         mb(); /* sync with ocfs2_recovery_thread_running */
         wake_up(&osb->recovery_event);
 
-        up(&osb->recovery_lock);
+        mutex_unlock(&osb->recovery_lock);
 
         mlog_exit(status);
         /* no one is callint kthread_stop() for us so the kthread() api
@@ -1098,7 +1099,7 @@ void ocfs2_recovery_thread(struct ocfs2_super *osb, int node_num)
         mlog_entry("(node_num=%d, osb->node_num = %d)\n",
                    node_num, osb->node_num);
 
-        down(&osb->recovery_lock);
+        mutex_lock(&osb->recovery_lock);
         if (osb->disable_recovery)
                 goto out;
 
@@ -1120,7 +1121,7 @@ void ocfs2_recovery_thread(struct ocfs2_super *osb, int node_num)
         }
 
 out:
-        up(&osb->recovery_lock);
+        mutex_unlock(&osb->recovery_lock);
         wake_up(&osb->recovery_event);
 
         mlog_exit_void();
@@ -1271,8 +1272,7 @@ static int ocfs2_recover_node(struct ocfs2_super *osb,
 
         /* Should not ever be called to recover ourselves -- in that
          * case we should've called ocfs2_journal_load instead. */
-        if (osb->node_num == node_num)
-                BUG();
+        BUG_ON(osb->node_num == node_num);
 
         slot_num = ocfs2_node_num_to_slot(si, node_num);
         if (slot_num == OCFS2_INVALID_SLOT) {
@@ -1408,21 +1408,17 @@ bail:
         return status;
 }
 
-static int ocfs2_recover_orphans(struct ocfs2_super *osb,
-                                 int slot)
+static int ocfs2_queue_orphans(struct ocfs2_super *osb,
+                               int slot,
+                               struct inode **head)
 {
-        int status = 0;
-        int have_disk_lock = 0;
-        struct inode *inode = NULL;
-        struct inode *iter;
+        int status;
         struct inode *orphan_dir_inode = NULL;
+        struct inode *iter;
         unsigned long offset, blk, local;
         struct buffer_head *bh = NULL;
         struct ocfs2_dir_entry *de;
         struct super_block *sb = osb->sb;
-        struct ocfs2_inode_info *oi;
-
-        mlog(0, "Recover inodes from orphan dir in slot %d\n", slot);
 
         orphan_dir_inode = ocfs2_get_system_file_inode(osb,
                                                        ORPHAN_DIR_SYSTEM_INODE,
@@ -1430,17 +1426,15 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
         if  (!orphan_dir_inode) {
                 status = -ENOENT;
                 mlog_errno(status);
-                goto out;
-        }
+                return status;
+        }       
 
         mutex_lock(&orphan_dir_inode->i_mutex);
         status = ocfs2_meta_lock(orphan_dir_inode, NULL, NULL, 0);
         if (status < 0) {
-                mutex_unlock(&orphan_dir_inode->i_mutex);
                 mlog_errno(status);
                 goto out;
         }
-        have_disk_lock = 1;
 
         offset = 0;
         iter = NULL;
@@ -1451,11 +1445,10 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
                 if (!bh)
                         status = -EINVAL;
                 if (status < 0) {
-                        mutex_unlock(&orphan_dir_inode->i_mutex);
                         if (bh)
                                 brelse(bh);
                         mlog_errno(status);
-                        goto out;
+                        goto out_unlock;
                 }
 
                 local = 0;
@@ -1465,11 +1458,10 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
 
                         if (!ocfs2_check_dir_entry(orphan_dir_inode,
                                                   de, bh, local)) {
-                                mutex_unlock(&orphan_dir_inode->i_mutex);
                                 status = -EINVAL;
                                 mlog_errno(status);
                                 brelse(bh);
-                                goto out;
+                                goto out_unlock;
                         }
 
                         local += le16_to_cpu(de->rec_len);
@@ -1504,18 +1496,95 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
 
                         mlog(0, "queue orphan %"MLFu64"\n",
                              OCFS2_I(iter)->ip_blkno);
-                        OCFS2_I(iter)->ip_next_orphan = inode;
-                        inode = iter;
+                        /* No locking is required for the next_orphan
+                         * queue as there is only ever a single
+                         * process doing orphan recovery. */
+                        OCFS2_I(iter)->ip_next_orphan = *head;
+                        *head = iter;
                 }
                 brelse(bh);
         }
-        mutex_unlock(&orphan_dir_inode->i_mutex);
 
+out_unlock:
         ocfs2_meta_unlock(orphan_dir_inode, 0);
-        have_disk_lock = 0;
-
+out:
+        mutex_unlock(&orphan_dir_inode->i_mutex);
         iput(orphan_dir_inode);
-        orphan_dir_inode = NULL;
+        return status;
+}
+
+static int ocfs2_orphan_recovery_can_continue(struct ocfs2_super *osb,
+                                              int slot)
+{
+        int ret;
+
+        spin_lock(&osb->osb_lock);
+        ret = !osb->osb_orphan_wipes[slot];
+        spin_unlock(&osb->osb_lock);
+        return ret;
+}
+
+static void ocfs2_mark_recovering_orphan_dir(struct ocfs2_super *osb,
+                                             int slot)
+{
+        spin_lock(&osb->osb_lock);
+        /* Mark ourselves such that new processes in delete_inode()
+         * know to quit early. */
+        ocfs2_node_map_set_bit(osb, &osb->osb_recovering_orphan_dirs, slot);
+        while (osb->osb_orphan_wipes[slot]) {
+                /* If any processes are already in the middle of an
+                 * orphan wipe on this dir, then we need to wait for
+                 * them. */
+                spin_unlock(&osb->osb_lock);
+                wait_event_interruptible(osb->osb_wipe_event,
+                                         ocfs2_orphan_recovery_can_continue(osb, slot));
+                spin_lock(&osb->osb_lock);
+        }
+        spin_unlock(&osb->osb_lock);
+}
+
+static void ocfs2_clear_recovering_orphan_dir(struct ocfs2_super *osb,
+                                              int slot)
+{
+        ocfs2_node_map_clear_bit(osb, &osb->osb_recovering_orphan_dirs, slot);
+}
+
+/*
+ * Orphan recovery. Each mounted node has it's own orphan dir which we
+ * must run during recovery. Our strategy here is to build a list of
+ * the inodes in the orphan dir and iget/iput them. The VFS does
+ * (most) of the rest of the work.
+ *
+ * Orphan recovery can happen at any time, not just mount so we have a
+ * couple of extra considerations.
+ *
+ * - We grab as many inodes as we can under the orphan dir lock -
+ *   doing iget() outside the orphan dir risks getting a reference on
+ *   an invalid inode.
+ * - We must be sure not to deadlock with other processes on the
+ *   system wanting to run delete_inode(). This can happen when they go
+ *   to lock the orphan dir and the orphan recovery process attempts to
+ *   iget() inside the orphan dir lock. This can be avoided by
+ *   advertising our state to ocfs2_delete_inode().
+ */
+static int ocfs2_recover_orphans(struct ocfs2_super *osb,
+                                 int slot)
+{
+        int ret = 0;
+        struct inode *inode = NULL;
+        struct inode *iter;
+        struct ocfs2_inode_info *oi;
+
+        mlog(0, "Recover inodes from orphan dir in slot %d\n", slot);
+
+        ocfs2_mark_recovering_orphan_dir(osb, slot);
+        ret = ocfs2_queue_orphans(osb, slot, &inode);
+        ocfs2_clear_recovering_orphan_dir(osb, slot);
+
+        /* Error here should be noted, but we want to continue with as
+         * many queued inodes as we've got. */
+        if (ret)
+                mlog_errno(ret);
 
         while (inode) {
                 oi = OCFS2_I(inode);
@@ -1541,14 +1610,7 @@ static int ocfs2_recover_orphans(struct ocfs2_super *osb,
                 inode = iter;
         }
 
-out:
-        if (have_disk_lock)
-                ocfs2_meta_unlock(orphan_dir_inode, 0);
-
-        if (orphan_dir_inode)
-                iput(orphan_dir_inode);
-
-        return status;
+        return ret;
 }
 
 static int ocfs2_wait_on_mount(struct ocfs2_super *osb)
@@ -1584,10 +1646,9 @@ static int ocfs2_commit_thread(void *arg)
         while (!(kthread_should_stop() &&
                  atomic_read(&journal->j_num_trans) == 0)) {
 
-                wait_event_interruptible_timeout(osb->checkpoint_event,
-                                                 atomic_read(&journal->j_num_trans)
-                                                 || kthread_should_stop(),
-                                                 OCFS2_CHECKPOINT_INTERVAL);
+                wait_event_interruptible(osb->checkpoint_event,
+                                         atomic_read(&journal->j_num_trans)
+                                         || kthread_should_stop());
 
                 status = ocfs2_commit_cache(osb);
                 if (status < 0)
diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
index 7d0a816184fa..2f3a6acdac45 100644
--- a/fs/ocfs2/journal.h
+++ b/fs/ocfs2/journal.h
@@ -29,8 +29,6 @@
 #include <linux/fs.h>
 #include <linux/jbd.h>
 
-#define OCFS2_CHECKPOINT_INTERVAL        (8 * HZ)
-
 enum ocfs2_journal_state {
         OCFS2_JOURNAL_FREE = 0,
         OCFS2_JOURNAL_LOADED,
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index f468c600cf92..e89de9b6e491 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -33,6 +33,7 @@
 #include <linux/rbtree.h>
 #include <linux/workqueue.h>
 #include <linux/kref.h>
+#include <linux/mutex.h>
 
 #include "cluster/nodemanager.h"
 #include "cluster/heartbeat.h"
@@ -173,9 +174,6 @@ enum ocfs2_mount_options
         OCFS2_MOUNT_NOINTR  = 1 << 2,   /* Don't catch signals */
         OCFS2_MOUNT_ERRORS_PANIC = 1 << 3, /* Panic on errors */
         OCFS2_MOUNT_DATA_WRITEBACK = 1 << 4, /* No data ordering */
-#ifdef OCFS2_ORACORE_WORKAROUNDS
-        OCFS2_MOUNT_COMPAT_OCFS = 1 << 30, /* ocfs1 compatibility mode */
-#endif
 };
 
 #define OCFS2_OSB_SOFT_RO       0x0001
@@ -233,7 +231,7 @@ struct ocfs2_super
         struct proc_dir_entry *proc_sub_dir; /* points to /proc/fs/ocfs2/<maj_min> */
 
         atomic_t vol_state;
-        struct semaphore recovery_lock;
+        struct mutex recovery_lock;
         struct task_struct *recovery_thread_task;
         int disable_recovery;
         wait_queue_head_t checkpoint_event;
@@ -289,6 +287,10 @@ struct ocfs2_super
         struct inode                    *osb_tl_inode;
         struct buffer_head              *osb_tl_bh;
         struct work_struct              osb_truncate_log_wq;
+
+        struct ocfs2_node_map           osb_recovering_orphan_dirs;
+        unsigned int                    *osb_orphan_wipes;
+        wait_queue_head_t               osb_wipe_event;
 };
 
 #define OCFS2_SB(sb)        ((struct ocfs2_super *)(sb)->s_fs_info)
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index dfb8a5bedfc8..c5b1ac547c15 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -138,7 +138,6 @@
 
 /* Journal limits (in bytes) */
 #define OCFS2_MIN_JOURNAL_SIZE          (4 * 1024 * 1024)
-#define OCFS2_MAX_JOURNAL_SIZE          (500 * 1024 * 1024)
 
 struct ocfs2_system_inode_info {
         char    *si_name;
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 364d64bd5f10..8dd3aafec499 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -932,7 +932,7 @@ static void ocfs2_inode_init_once(void *data,
                 oi->ip_dir_start_lookup = 0;
 
                 init_rwsem(&oi->ip_alloc_sem);
-                init_MUTEX(&(oi->ip_io_sem));
+                mutex_init(&oi->ip_io_mutex);
 
                 oi->ip_blkno = 0ULL;
                 oi->ip_clusters = 0;
@@ -1137,9 +1137,9 @@ static void ocfs2_dismount_volume(struct super_block *sb, int mnt_err)
 
         /* disable any new recovery threads and wait for any currently
          * running ones to exit. Do this before setting the vol_state. */
-        down(&osb->recovery_lock);
+        mutex_lock(&osb->recovery_lock);
         osb->disable_recovery = 1;
-        up(&osb->recovery_lock);
+        mutex_unlock(&osb->recovery_lock);
         wait_event(osb->recovery_event, !ocfs2_recovery_thread_running(osb));
 
         /* At this point, we know that no more recovery threads can be
@@ -1254,8 +1254,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
         osb->sb = sb;
         /* Save off for ocfs2_rw_direct */
         osb->s_sectsize_bits = blksize_bits(sector_size);
-        if (!osb->s_sectsize_bits)
-                BUG();
+        BUG_ON(!osb->s_sectsize_bits);
 
         osb->net_response_ids = 0;
         spin_lock_init(&osb->net_response_lock);
@@ -1283,7 +1282,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
         snprintf(osb->dev_str, sizeof(osb->dev_str), "%u,%u",
                  MAJOR(osb->sb->s_dev), MINOR(osb->sb->s_dev));
 
-        init_MUTEX(&osb->recovery_lock);
+        mutex_init(&osb->recovery_lock);
 
         osb->disable_recovery = 0;
         osb->recovery_thread_task = NULL;
@@ -1326,6 +1325,16 @@ static int ocfs2_initialize_super(struct super_block *sb,
         }
         mlog(ML_NOTICE, "max_slots for this device: %u\n", osb->max_slots);
 
+        init_waitqueue_head(&osb->osb_wipe_event);
+        osb->osb_orphan_wipes = kcalloc(osb->max_slots,
+                                        sizeof(*osb->osb_orphan_wipes),
+                                        GFP_KERNEL);
+        if (!osb->osb_orphan_wipes) {
+                status = -ENOMEM;
+                mlog_errno(status);
+                goto bail;
+        }
+
         osb->s_feature_compat =
                 le32_to_cpu(OCFS2_RAW_SB(di)->s_feature_compat);
         osb->s_feature_ro_compat =
@@ -1639,6 +1648,7 @@ static void ocfs2_delete_osb(struct ocfs2_super *osb)
         if (osb->slot_info)
                 ocfs2_free_slot_info(osb->slot_info);
 
+        kfree(osb->osb_orphan_wipes);
         /* FIXME
          * This belongs in journal shutdown, but because we have to
          * allocate osb->journal at the start of ocfs2_initalize_osb(),
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index 600a8bc5b541..fc29cb7a437d 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -77,8 +77,7 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
         if (arr && ((inode = *arr) != NULL)) {
                 /* get a ref in addition to the array ref */
                 inode = igrab(inode);
-                if (!inode)
-                        BUG();
+                BUG_ON(!inode);
 
                 return inode;
         }
@@ -89,8 +88,7 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
         /* add one more if putting into array for first time */
         if (arr && inode) {
                 *arr = igrab(inode);
-                if (!*arr)
-                        BUG();
+                BUG_ON(!*arr);
         }
         return inode;
 }
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index 3a0458fd3e1b..300b5bedfb21 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -388,7 +388,7 @@ out_free:
         }
 }
 
-/* Item insertion is guarded by ip_io_sem, so the insertion path takes
+/* Item insertion is guarded by ip_io_mutex, so the insertion path takes
  * advantage of this by not rechecking for a duplicate insert during
  * the slow case. Additionally, if the cache needs to be bumped up to
  * a tree, the code will not recheck after acquiring the lock --
@@ -418,7 +418,7 @@ void ocfs2_set_buffer_uptodate(struct inode *inode,
              (unsigned long long) bh->b_blocknr);
 
         /* No need to recheck under spinlock - insertion is guarded by
-         * ip_io_sem */
+         * ip_io_mutex */
         spin_lock(&oi->ip_lock);
         if (ocfs2_insert_can_use_array(oi, ci)) {
                 /* Fast case - it's an array and there's a free
@@ -440,7 +440,7 @@ void ocfs2_set_buffer_uptodate(struct inode *inode,
 
 /* Called against a newly allocated buffer. Most likely nobody should
  * be able to read this sort of metadata while it's still being
- * allocated, but this is careful to take ip_io_sem anyway. */
+ * allocated, but this is careful to take ip_io_mutex anyway. */
 void ocfs2_set_new_buffer_uptodate(struct inode *inode,
                                    struct buffer_head *bh)
 {
@@ -451,9 +451,9 @@ void ocfs2_set_new_buffer_uptodate(struct inode *inode,
 
         set_buffer_uptodate(bh);
 
-        down(&oi->ip_io_sem);
+        mutex_lock(&oi->ip_io_mutex);
         ocfs2_set_buffer_uptodate(inode, bh);
-        up(&oi->ip_io_sem);
+        mutex_unlock(&oi->ip_io_mutex);
 }
 
 /* Requires ip_lock. */
@@ -537,7 +537,7 @@ int __init init_ocfs2_uptodate_cache(void)
         return 0;
 }
 
-void __exit exit_ocfs2_uptodate_cache(void)
+void exit_ocfs2_uptodate_cache(void)
 {
         if (ocfs2_uptodate_cachep)
                 kmem_cache_destroy(ocfs2_uptodate_cachep);
diff --git a/fs/ocfs2/uptodate.h b/fs/ocfs2/uptodate.h
index e5aacdf4eabf..01cd32d26b06 100644
--- a/fs/ocfs2/uptodate.h
+++ b/fs/ocfs2/uptodate.h
@@ -27,7 +27,7 @@
 #define OCFS2_UPTODATE_H
 
 int __init init_ocfs2_uptodate_cache(void);
-void __exit exit_ocfs2_uptodate_cache(void);
+void exit_ocfs2_uptodate_cache(void);
 
 void ocfs2_metadata_cache_init(struct inode *inode);
 void ocfs2_metadata_cache_purge(struct inode *inode);
diff --git a/fs/partitions/ibm.c b/fs/partitions/ibm.c
index 78010ad60e47..1e4a93835fed 100644
--- a/fs/partitions/ibm.c
+++ b/fs/partitions/ibm.c
@@ -52,6 +52,7 @@ int
 ibm_partition(struct parsed_partitions *state, struct block_device *bdev)
 {
         int blocksize, offset, size;
+        loff_t i_size;
         dasd_information_t *info;
         struct hd_geometry *geo;
         char type[5] = {0,};
@@ -63,6 +64,13 @@ ibm_partition(struct parsed_partitions *state, struct block_device *bdev)
         unsigned char *data;
         Sector sect;
 
+        blocksize = bdev_hardsect_size(bdev);
+        if (blocksize <= 0)
+                return 0;
+        i_size = i_size_read(bdev->bd_inode);
+        if (i_size == 0)
+                return 0;
+
         if ((info = kmalloc(sizeof(dasd_information_t), GFP_KERNEL)) == NULL)
                 goto out_noinfo;
         if ((geo = kmalloc(sizeof(struct hd_geometry), GFP_KERNEL)) == NULL)
@@ -73,9 +81,6 @@ ibm_partition(struct parsed_partitions *state, struct block_device *bdev)
         if (ioctl_by_bdev(bdev, BIODASDINFO, (unsigned long)info) != 0 ||
             ioctl_by_bdev(bdev, HDIO_GETGEO, (unsigned long)geo) != 0)
                 goto out_noioctl;
-        
-        if ((blocksize = bdev_hardsect_size(bdev)) <= 0)
-                goto out_badsect;
 
         /*
          * Get volume label, extract name and type.
@@ -111,7 +116,7 @@ ibm_partition(struct parsed_partitions *state, struct block_device *bdev)
                 } else {
                         printk("CMS1/%8s:", name);
                         offset = (info->label_block + 1);
-                        size = bdev->bd_inode->i_size >> 9;
+                        size = i_size >> 9;
                 }
                 put_partition(state, 1, offset*(blocksize >> 9),
                                  size-offset*(blocksize >> 9));
@@ -168,7 +173,7 @@ ibm_partition(struct parsed_partitions *state, struct block_device *bdev)
                 else
                         printk("(nonl)/%8s:", name);
                 offset = (info->label_block + 1);
-                size = (bdev->bd_inode->i_size >> 9);
+                size = i_size >> 9;
                 put_partition(state, 1, offset*(blocksize >> 9),
                                  size-offset*(blocksize >> 9));
         }
@@ -180,7 +185,6 @@ ibm_partition(struct parsed_partitions *state, struct block_device *bdev)
         return 1;
         
 out_readerr:
-out_badsect:
 out_noioctl:
         kfree(label);
 out_nolab:
diff --git a/fs/pipe.c b/fs/pipe.c
index d722579df79a..8aada8e426f4 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -605,7 +605,7 @@ struct file_operations rdwr_fifo_fops = {
         .fasync         = pipe_rdwr_fasync,
 };
 
-struct file_operations read_pipe_fops = {
+static struct file_operations read_pipe_fops = {
         .llseek         = no_llseek,
         .read           = pipe_read,
         .readv          = pipe_readv,
@@ -617,7 +617,7 @@ struct file_operations read_pipe_fops = {
         .fasync         = pipe_read_fasync,
 };
 
-struct file_operations write_pipe_fops = {
+static struct file_operations write_pipe_fops = {
         .llseek         = no_llseek,
         .read           = bad_pipe_r,
         .write          = pipe_write,
@@ -629,7 +629,7 @@ struct file_operations write_pipe_fops = {
         .fasync         = pipe_write_fasync,
 };
 
-struct file_operations rdwr_pipe_fops = {
+static struct file_operations rdwr_pipe_fops = {
         .llseek         = no_llseek,
         .read           = pipe_read,
         .readv          = pipe_readv,
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 6573f31f1fd9..075d3e945602 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -204,10 +204,6 @@ int proc_fill_super(struct super_block *s, void *data, int silent)
         root_inode = proc_get_inode(s, PROC_ROOT_INO, &proc_root);
         if (!root_inode)
                 goto out_no_root;
-        /*
-         * Fixup the root inode's nlink value
-         */
-        root_inode->i_nlink += nr_processes();
         root_inode->i_uid = 0;
         root_inode->i_gid = 0;
         s->s_root = d_alloc_root(root_inode);
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 68896283c8ae..c3fd3611112f 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -80,16 +80,16 @@ void __init proc_root_init(void)
         proc_bus = proc_mkdir("bus", NULL);
 }
 
-static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd)
+static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
+)
 {
-        /*
-         * nr_threads is actually protected by the tasklist_lock;
-         * however, it's conventional to do reads, especially for
-         * reporting, without any locking whatsoever.
-         */
-        if (dir->i_ino == PROC_ROOT_INO) /* check for safety... */
-                dir->i_nlink = proc_root.nlink + nr_threads;
+        generic_fillattr(dentry->d_inode, stat);
+        stat->nlink = proc_root.nlink + nr_processes();
+        return 0;
+}
 
+static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd)
+{
         if (!proc_lookup(dir, dentry, nd)) {
                 return NULL;
         }
@@ -134,6 +134,7 @@ static struct file_operations proc_root_operations = {
  */
 static struct inode_operations proc_root_inode_operations = {
         .lookup         = proc_root_lookup,
+        .getattr        = proc_root_getattr,
 };
 
 /*
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 0eaad41f4658..91b7c15ab373 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -204,7 +204,6 @@ static void smaps_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
 {
         pte_t *pte, ptent;
         spinlock_t *ptl;
-        unsigned long pfn;
         struct page *page;
 
         pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
@@ -214,12 +213,12 @@ static void smaps_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                         continue;
 
                 mss->resident += PAGE_SIZE;
-                pfn = pte_pfn(ptent);
-                if (!pfn_valid(pfn))
+
+                page = vm_normal_page(vma, addr, ptent);
+                if (!page)
                         continue;
 
-                page = pfn_to_page(pfn);
-                if (page_count(page) >= 2) {
+                if (page_mapcount(page) >= 2) {
                         if (pte_dirty(ptent))
                                 mss->shared_dirty += PAGE_SIZE;
                         else
@@ -289,7 +288,7 @@ static int show_smap(struct seq_file *m, void *v)
         struct mem_size_stats mss;
 
         memset(&mss, 0, sizeof mss);
-        if (vma->vm_mm)
+        if (vma->vm_mm && !is_vm_hugetlb_page(vma))
                 smaps_pgd_range(vma, vma->vm_start, vma->vm_end, &mss);
         return show_map_internal(m, v, &mss);
 }
diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c
index c66bd5e4c05c..14bd2246fb6d 100644
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -27,6 +27,7 @@
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
+#include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/smp_lock.h>
@@ -104,6 +105,7 @@ ramfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
                 d_instantiate(dentry, inode);
                 dget(dentry);   /* Extra count - pin the dentry in core */
                 error = 0;
+                dir->i_mtime = dir->i_ctime = CURRENT_TIME;
         }
         return error;
 }
@@ -135,6 +137,7 @@ static int ramfs_symlink(struct inode * dir, struct dentry *dentry, const char *
                                 inode->i_gid = dir->i_gid;
                         d_instantiate(dentry, inode);
                         dget(dentry);
+                        dir->i_mtime = dir->i_ctime = CURRENT_TIME;
                 } else
                         iput(inode);
         }
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index f3473176c83a..be12879bb179 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -1464,13 +1464,11 @@ static ssize_t reiserfs_file_write(struct file *file,	/* the file we are going t
                    partially overwritten pages, if needed. And lock the pages,
                    so that nobody else can access these until we are done.
                    We get number of actual blocks needed as a result. */
-                blocks_to_allocate =
-                    reiserfs_prepare_file_region_for_write(inode, pos,
-                                                           num_pages,
-                                                           write_bytes,
-                                                           prepared_pages);
-                if (blocks_to_allocate < 0) {
-                        res = blocks_to_allocate;
+                res = reiserfs_prepare_file_region_for_write(inode, pos,
+                                                             num_pages,
+                                                             write_bytes,
+                                                             prepared_pages);
+                if (res < 0) {
                         reiserfs_release_claimed_blocks(inode->i_sb,
                                                         num_pages <<
                                                         (PAGE_CACHE_SHIFT -
@@ -1478,6 +1476,8 @@ static ssize_t reiserfs_file_write(struct file *file,	/* the file we are going t
                         break;
                 }
 
+                blocks_to_allocate = res;
+
                 /* First we correct our estimate of how many blocks we need */
                 reiserfs_release_claimed_blocks(inode->i_sb,
                                                 (num_pages <<
diff --git a/fs/reiserfs/hashes.c b/fs/reiserfs/hashes.c
index a3ec238fd9e0..e664ac16fad9 100644
--- a/fs/reiserfs/hashes.c
+++ b/fs/reiserfs/hashes.c
@@ -21,7 +21,6 @@
 #include <linux/kernel.h>
 #include <linux/reiserfs_fs.h>
 #include <asm/types.h>
-#include <asm/bug.h>
 
 #define DELTA 0x9E3779B9
 #define FULLROUNDS 10           /* 32 is overkill, 16 is strong crypto */
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index b33d67bba2fd..d60f6238c66a 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -627,11 +627,6 @@ int reiserfs_get_block(struct inode *inode, sector_t block,
         reiserfs_write_lock(inode->i_sb);
         version = get_inode_item_key_version(inode);
 
-        if (block < 0) {
-                reiserfs_write_unlock(inode->i_sb);
-                return -EIO;
-        }
-
         if (!file_capable(inode, block)) {
                 reiserfs_write_unlock(inode->i_sb);
                 return -EFBIG;
@@ -934,12 +929,13 @@ int reiserfs_get_block(struct inode *inode, sector_t block,
                                      //pos_in_item * inode->i_sb->s_blocksize,
                                      TYPE_INDIRECT, 3); // key type is unimportant
 
+                        RFALSE(cpu_key_k_offset(&tmp_key) > cpu_key_k_offset(&key),
+                               "green-805: invalid offset");
                         blocks_needed =
                             1 +
                             ((cpu_key_k_offset(&key) -
                               cpu_key_k_offset(&tmp_key)) >> inode->i_sb->
                              s_blocksize_bits);
-                        RFALSE(blocks_needed < 0, "green-805: invalid offset");
 
                         if (blocks_needed == 1) {
                                 un = &unf_single;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index b7a179560ab4..5a9d2722fa0a 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2319,8 +2319,7 @@ static int journal_read(struct super_block *p_s_sb)
                 return 1;
         }
         jh = (struct reiserfs_journal_header *)(journal->j_header_bh->b_data);
-        if (le32_to_cpu(jh->j_first_unflushed_offset) >= 0 &&
-            le32_to_cpu(jh->j_first_unflushed_offset) <
+        if (le32_to_cpu(jh->j_first_unflushed_offset) <
             SB_ONDISK_JOURNAL_SIZE(p_s_sb)
             && le32_to_cpu(jh->j_last_flush_trans_id) > 0) {
                 oldest_start =
diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c
index c8123308e060..284f7852de8b 100644
--- a/fs/reiserfs/namei.c
+++ b/fs/reiserfs/namei.c
@@ -247,7 +247,7 @@ static int linear_search_in_dir_item(struct cpu_key *key,
                 /* mark, that this generation number is used */
                 if (de->de_gen_number_bit_string)
                         set_bit(GET_GENERATION_NUMBER(deh_offset(deh)),
-                                (unsigned long *)de->de_gen_number_bit_string);
+                                de->de_gen_number_bit_string);
 
                 // calculate pointer to name and namelen
                 de->de_entry_num = i;
@@ -431,7 +431,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
         struct reiserfs_de_head *deh;
         INITIALIZE_PATH(path);
         struct reiserfs_dir_entry de;
-        int bit_string[MAX_GENERATION_NUMBER / (sizeof(int) * 8) + 1];
+        DECLARE_BITMAP(bit_string, MAX_GENERATION_NUMBER + 1);
         int gen_number;
         char small_buf[32 + DEH_SIZE];  /* 48 bytes now and we avoid kmalloc
                                            if we create file with short name */
@@ -486,7 +486,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
 
         /* find the proper place for the new entry */
         memset(bit_string, 0, sizeof(bit_string));
-        de.de_gen_number_bit_string = (char *)bit_string;
+        de.de_gen_number_bit_string = bit_string;
         retval = reiserfs_find_entry(dir, name, namelen, &path, &de);
         if (retval != NAME_NOT_FOUND) {
                 if (buffer != small_buf)
@@ -508,7 +508,7 @@ static int reiserfs_add_entry(struct reiserfs_transaction_handle *th,
         }
 
         gen_number =
-            find_first_zero_bit((unsigned long *)bit_string,
+            find_first_zero_bit(bit_string,
                                 MAX_GENERATION_NUMBER + 1);
         if (gen_number > MAX_GENERATION_NUMBER) {
                 /* there is no free generation number */
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index ef5e5414e7a8..d63da756eb49 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1124,8 +1124,6 @@ static void handle_attrs(struct super_block *s)
                                          "reiserfs: cannot support attributes until flag is set in super-block");
                         REISERFS_SB(s)->s_mount_opt &= ~(1 << REISERFS_ATTRS);
                 }
-        } else if (le32_to_cpu(rs->s_flags) & reiserfs_attrs_cleared) {
-                REISERFS_SB(s)->s_mount_opt |= (1 << REISERFS_ATTRS);
         }
 }
 
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index 43de3ba83332..ab8894c3b9e5 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -228,7 +228,8 @@ struct posix_acl *reiserfs_get_acl(struct inode *inode, int type)
                 acl = ERR_PTR(retval);
         } else {
                 acl = posix_acl_from_disk(value, retval);
-                *p_acl = posix_acl_dup(acl);
+                if (!IS_ERR(acl))
+                        *p_acl = posix_acl_dup(acl);
         }
 
         kfree(value);
diff --git a/fs/select.c b/fs/select.c
index c0f02d36c60e..1815a57d2255 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -398,11 +398,15 @@ asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
         ret = core_sys_select(n, inp, outp, exp, &timeout);
 
         if (tvp) {
+                struct timeval rtv;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
-                tv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
-                tv.tv_sec = timeout;
-                if (copy_to_user(tvp, &tv, sizeof(tv))) {
+                rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
+                rtv.tv_sec = timeout;
+                if (timeval_compare(&rtv, &tv) >= 0)
+                        rtv = tv;
+                if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
                         /*
                          * If an application puts its timeval in read-only
@@ -460,11 +464,16 @@ asmlinkage long sys_pselect7(int n, fd_set __user *inp, fd_set __user *outp,
         ret = core_sys_select(n, inp, outp, exp, &timeout);
 
         if (tsp) {
+                struct timespec rts;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
-                ts.tv_sec = timeout;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
+                                                1000;
+                rts.tv_sec = timeout;
+                if (timespec_compare(&rts, &ts) >= 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
                         /*
                          * If an application puts its timeval in read-only
@@ -510,9 +519,9 @@ asmlinkage long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp,
 
         if (sig) {
                 if (!access_ok(VERIFY_READ, sig, sizeof(void *)+sizeof(size_t))
-                    || __get_user(up, (sigset_t * __user *)sig)
+                    || __get_user(up, (sigset_t __user * __user *)sig)
                     || __get_user(sigsetsize,
-                                (size_t * __user)(sig+sizeof(void *))))
+                                (size_t __user *)(sig+sizeof(void *))))
                         return -EFAULT;
         }
 
@@ -758,12 +767,17 @@ asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
                 sigprocmask(SIG_SETMASK, &sigsaved, NULL);
 
         if (tsp && timeout >= 0) {
+                struct timespec rts;
+
                 if (current->personality & STICKY_TIMEOUTS)
                         goto sticky;
                 /* Yes, we know it's actually an s64, but it's also positive. */
-                ts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) * 1000;
-                ts.tv_sec = timeout;
-                if (copy_to_user(tsp, &ts, sizeof(ts))) {
+                rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
+                                                1000;
+                rts.tv_sec = timeout;
+                if (timespec_compare(&rts, &ts) >= 0)
+                        rts = ts;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
                 sticky:
                         /*
                          * If an application puts its timeval in read-only
diff --git a/fs/stat.c b/fs/stat.c
index 24211b030f39..9948cc1685a4 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -261,6 +261,7 @@ asmlinkage long sys_newlstat(char __user *filename, struct stat __user *statbuf)
         return error;
 }
 
+#ifndef __ARCH_WANT_STAT64
 asmlinkage long sys_newfstatat(int dfd, char __user *filename,
                                 struct stat __user *statbuf, int flag)
 {
@@ -281,6 +282,7 @@ asmlinkage long sys_newfstatat(int dfd, char __user *filename,
 out:
         return error;
 }
+#endif
 
 asmlinkage long sys_newfstat(unsigned int fd, struct stat __user *statbuf)
 {
@@ -395,6 +397,26 @@ asmlinkage long sys_fstat64(unsigned long fd, struct stat64 __user * statbuf)
         return error;
 }
 
+asmlinkage long sys_fstatat64(int dfd, char __user *filename,
+                               struct stat64 __user *statbuf, int flag)
+{
+        struct kstat stat;
+        int error = -EINVAL;
+
+        if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
+                goto out;
+
+        if (flag & AT_SYMLINK_NOFOLLOW)
+                error = vfs_lstat_fd(dfd, filename, &stat);
+        else
+                error = vfs_stat_fd(dfd, filename, &stat);
+
+        if (!error)
+                error = cp_new_stat64(&stat, statbuf);
+
+out:
+        return error;
+}
 #endif /* __ARCH_WANT_STAT64 */
 
 void inode_add_bytes(struct inode *inode, loff_t bytes)
diff --git a/fs/super.c b/fs/super.c
index c177b92419c5..e20b5580afd5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -247,8 +247,9 @@ void generic_shutdown_super(struct super_block *sb)
 
                 /* Forget any remaining inodes */
                 if (invalidate_inodes(sb)) {
-                        printk("VFS: Busy inodes after unmount. "
-                           "Self-destruct in 5 seconds.  Have a nice day...\n");
+                        printk("VFS: Busy inodes after unmount of %s. "
+                           "Self-destruct in 5 seconds.  Have a nice day...\n",
+                           sb->s_id);
                 }
 
                 unlock_kernel();
@@ -665,6 +666,16 @@ static int test_bdev_super(struct super_block *s, void *data)
         return (void *)s->s_bdev == data;
 }
 
+static void bdev_uevent(struct block_device *bdev, enum kobject_action action)
+{
+        if (bdev->bd_disk) {
+                if (bdev->bd_part)
+                        kobject_uevent(&bdev->bd_part->kobj, action);
+                else
+                        kobject_uevent(&bdev->bd_disk->kobj, action);
+        }
+}
+
 struct super_block *get_sb_bdev(struct file_system_type *fs_type,
         int flags, const char *dev_name, void *data,
         int (*fill_super)(struct super_block *, void *, int))
@@ -706,8 +717,10 @@ struct super_block *get_sb_bdev(struct file_system_type *fs_type,
                         up_write(&s->s_umount);
                         deactivate_super(s);
                         s = ERR_PTR(error);
-                } else
+                } else {
                         s->s_flags |= MS_ACTIVE;
+                        bdev_uevent(bdev, KOBJ_MOUNT);
+                }
         }
 
         return s;
@@ -723,6 +736,7 @@ void kill_block_super(struct super_block *sb)
 {
         struct block_device *bdev = sb->s_bdev;
 
+        bdev_uevent(bdev, KOBJ_UMOUNT);
         generic_shutdown_super(sb);
         sync_blockdev(bdev);
         close_bdev_excl(bdev);
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 395e582ee542..d04cff2273b6 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1045,10 +1045,14 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
         }
 
         inode->i_uid = le32_to_cpu(fe->uid);
-        if ( inode->i_uid == -1 ) inode->i_uid = UDF_SB(inode->i_sb)->s_uid;
+        if (inode->i_uid == -1 || UDF_QUERY_FLAG(inode->i_sb,
+                                        UDF_FLAG_UID_IGNORE))
+                inode->i_uid = UDF_SB(inode->i_sb)->s_uid;
 
         inode->i_gid = le32_to_cpu(fe->gid);
-        if ( inode->i_gid == -1 ) inode->i_gid = UDF_SB(inode->i_sb)->s_gid;
+        if (inode->i_gid == -1 || UDF_QUERY_FLAG(inode->i_sb,
+                                        UDF_FLAG_GID_IGNORE))
+                inode->i_gid = UDF_SB(inode->i_sb)->s_gid;
 
         inode->i_nlink = le16_to_cpu(fe->fileLinkCount);
         if (!inode->i_nlink)
@@ -1335,10 +1339,14 @@ udf_update_inode(struct inode *inode, int do_sync)
                 return err;
         }
 
-        if (inode->i_uid != UDF_SB(inode->i_sb)->s_uid)
+        if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_UID_FORGET))
+                fe->uid = cpu_to_le32(-1);
+        else if (inode->i_uid != UDF_SB(inode->i_sb)->s_uid)
                 fe->uid = cpu_to_le32(inode->i_uid);
 
-        if (inode->i_gid != UDF_SB(inode->i_sb)->s_gid)
+        if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_GID_FORGET))
+                fe->gid = cpu_to_le32(-1);
+        else if (inode->i_gid != UDF_SB(inode->i_sb)->s_gid)
                 fe->gid = cpu_to_le32(inode->i_gid);
 
         udfperms =      ((inode->i_mode & S_IRWXO)     ) |
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 4a6f49adc609..368d8f81fe54 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -269,7 +269,7 @@ enum {
         Opt_gid, Opt_uid, Opt_umask, Opt_session, Opt_lastblock,
         Opt_anchor, Opt_volume, Opt_partition, Opt_fileset,
         Opt_rootdir, Opt_utf8, Opt_iocharset,
-        Opt_err
+        Opt_err, Opt_uforget, Opt_uignore, Opt_gforget, Opt_gignore
 };
 
 static match_table_t tokens = {
@@ -282,6 +282,10 @@ static match_table_t tokens = {
         {Opt_adinicb, "adinicb"},
         {Opt_shortad, "shortad"},
         {Opt_longad, "longad"},
+        {Opt_uforget, "uid=forget"},
+        {Opt_uignore, "uid=ignore"},
+        {Opt_gforget, "gid=forget"},
+        {Opt_gignore, "gid=ignore"},
         {Opt_gid, "gid=%u"},
         {Opt_uid, "uid=%u"},
         {Opt_umask, "umask=%o"},
@@ -414,6 +418,18 @@ udf_parse_options(char *options, struct udf_options *uopt)
                                 uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
                                 break;
 #endif
+                        case Opt_uignore:
+                                uopt->flags |= (1 << UDF_FLAG_UID_IGNORE);
+                                break;
+                        case Opt_uforget:
+                                uopt->flags |= (1 << UDF_FLAG_UID_FORGET);
+                                break;
+                        case Opt_gignore:
+                            uopt->flags |= (1 << UDF_FLAG_GID_IGNORE);
+                                break;
+                        case Opt_gforget:
+                            uopt->flags |= (1 << UDF_FLAG_GID_FORGET);
+                                break;
                         default:
                                 printk(KERN_ERR "udf: bad mount option \"%s\" "
                                                 "or missing value\n", p);
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
index 663669810be6..110f8d62616f 100644
--- a/fs/udf/udf_sb.h
+++ b/fs/udf/udf_sb.h
@@ -20,6 +20,10 @@
 #define UDF_FLAG_VARCONV                8
 #define UDF_FLAG_NLS_MAP                9
 #define UDF_FLAG_UTF8                   10
+#define UDF_FLAG_UID_FORGET     11    /* save -1 for uid to disk */
+#define UDF_FLAG_UID_IGNORE     12    /* use sb uid instead of on disk uid */
+#define UDF_FLAG_GID_FORGET     13
+#define UDF_FLAG_GID_IGNORE     14
 
 #define UDF_PART_FLAG_UNALLOC_BITMAP    0x0001
 #define UDF_PART_FLAG_UNALLOC_TABLE     0x0002
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 9892268e3005..74d8be87f983 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -540,7 +540,7 @@ xfs_probe_cluster(
 
         /* First sum forwards in this page */
         do {
-                if (mapped != buffer_mapped(bh))
+                if (!buffer_uptodate(bh) || (mapped != buffer_mapped(bh)))
                         return total;
                 total += bh->b_size;
         } while ((bh = bh->b_this_page) != head);
@@ -747,10 +747,11 @@ xfs_convert_page(
                         struct backing_dev_info *bdi;
 
                         bdi = inode->i_mapping->backing_dev_info;
+                        wbc->nr_to_write--;
                         if (bdi_write_congested(bdi)) {
                                 wbc->encountered_congestion = 1;
                                 done = 1;
-                        } else if (--wbc->nr_to_write <= 0) {
+                        } else if (wbc->nr_to_write <= 0) {
                                 done = 1;
                         }
                 }
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index eda7919b70a1..d7f6f2d8ac8e 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -673,6 +673,8 @@ linvfs_setattr(
         if (ia_valid & ATTR_ATIME) {
                 vattr.va_mask |= XFS_AT_ATIME;
                 vattr.va_atime = attr->ia_atime;
+                if (ia_valid & ATTR_ATIME_SET)
+                        inode->i_atime = attr->ia_atime;
         }
         if (ia_valid & ATTR_MTIME) {
                 vattr.va_mask |= XFS_AT_MTIME;
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 53a00fb217fa..7c0e39dc6189 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -68,6 +68,9 @@ kmem_zone_t	*qm_dqzone;
 kmem_zone_t     *qm_dqtrxzone;
 STATIC kmem_shaker_t    xfs_qm_shaker;
 
+STATIC cred_t   xfs_zerocr;
+STATIC xfs_inode_t      xfs_zeroino;
+
 STATIC void     xfs_qm_list_init(xfs_dqlist_t *, char *, int);
 STATIC void     xfs_qm_list_destroy(xfs_dqlist_t *);
 
@@ -1393,8 +1396,6 @@ xfs_qm_qino_alloc(
         xfs_trans_t     *tp;
         int             error;
         unsigned long   s;
-        cred_t          zerocr;
-        xfs_inode_t     zeroino;
         int             committed;
 
         tp = xfs_trans_alloc(mp, XFS_TRANS_QM_QINOCREATE);
@@ -1406,11 +1407,9 @@ xfs_qm_qino_alloc(
                 xfs_trans_cancel(tp, 0);
                 return error;
         }
-        memset(&zerocr, 0, sizeof(zerocr));
-        memset(&zeroino, 0, sizeof(zeroino));
 
-        if ((error = xfs_dir_ialloc(&tp, &zeroino, S_IFREG, 1, 0,
-                                   &zerocr, 0, 1, ip, &committed))) {
+        if ((error = xfs_dir_ialloc(&tp, &xfs_zeroino, S_IFREG, 1, 0,
+                                   &xfs_zerocr, 0, 1, ip, &committed))) {
                 xfs_trans_cancel(tp, XFS_TRANS_RELEASE_LOG_RES |
                                  XFS_TRANS_ABORT);
                 return error;
diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
index 06fc061c50fc..5b413946b1c5 100644
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -130,7 +130,8 @@ xfs_growfs_rt_alloc(
                 /*
                  * Lock the inode.
                  */
-                if ((error = xfs_trans_iget(mp, tp, ino, 0, XFS_ILOCK_EXCL, &ip)))
+                if ((error = xfs_trans_iget(mp, tp, ino, 0,
+                                                XFS_ILOCK_EXCL, &ip)))
                         goto error_exit;
                 XFS_BMAP_INIT(&flist, &firstblock);
                 /*
@@ -170,8 +171,8 @@ xfs_growfs_rt_alloc(
                         /*
                          * Lock the bitmap inode.
                          */
-                        if ((error = xfs_trans_iget(mp, tp, ino, 0, XFS_ILOCK_EXCL,
-                                        &ip)))
+                        if ((error = xfs_trans_iget(mp, tp, ino, 0,
+                                                        XFS_ILOCK_EXCL, &ip)))
                                 goto error_exit;
                         /*
                          * Get a buffer for the block.
@@ -2023,8 +2024,8 @@ xfs_growfs_rt(
                 /*
                  * Lock out other callers by grabbing the bitmap inode lock.
                  */
-                if ((error = xfs_trans_iget(mp, tp, 0, mp->m_sb.sb_rbmino,
-                                XFS_ILOCK_EXCL, &ip)))
+                if ((error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0,
+                                                XFS_ILOCK_EXCL, &ip)))
                         goto error_exit;
                 ASSERT(ip == mp->m_rbmip);
                 /*
@@ -2037,8 +2038,8 @@ xfs_growfs_rt(
                 /*
                  * Get the summary inode into the transaction.
                  */
-                if ((error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rsumino,
-                                0, XFS_ILOCK_EXCL, &ip)))
+                if ((error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rsumino, 0,
+                                                XFS_ILOCK_EXCL, &ip)))
                         goto error_exit;
                 ASSERT(ip == mp->m_rsumip);
                 /*
@@ -2158,10 +2159,9 @@ xfs_rtallocate_extent(
         /*
          * Lock out other callers by grabbing the bitmap inode lock.
          */
-        error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0, XFS_ILOCK_EXCL, &ip);
-        if (error) {
+        if ((error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0,
+                                        XFS_ILOCK_EXCL, &ip)))
                 return error;
-        }
         sumbp = NULL;
         /*
          * Allocate by size, or near another block, or exactly at some block.
@@ -2221,10 +2221,9 @@ xfs_rtfree_extent(
         /*
          * Synchronize by locking the bitmap inode.
          */
-        error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0, XFS_ILOCK_EXCL, &ip);
-        if (error) {
+        if ((error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0,
+                                        XFS_ILOCK_EXCL, &ip)))
                 return error;
-        }
 #if defined(__KERNEL__) && defined(DEBUG)
         /*
          * Check to see that this whole range is currently allocated.
@@ -2365,8 +2364,8 @@ xfs_rtpick_extent(
         __uint64_t      seq;            /* sequence number of file creation */
         __uint64_t      *seqp;          /* pointer to seqno in inode */
 
-        error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0, XFS_ILOCK_EXCL, &ip);
-        if (error)
+        if ((error = xfs_trans_iget(mp, tp, mp->m_sb.sb_rbmino, 0,
+                                        XFS_ILOCK_EXCL, &ip)))
                 return error;
         ASSERT(ip == mp->m_rbmip);
         seqp = (__uint64_t *)&ip->i_d.di_atime;
diff --git a/include/asm-alpha/mman.h b/include/asm-alpha/mman.h
index f6439532a262..5f24c755f577 100644
--- a/include/asm-alpha/mman.h
+++ b/include/asm-alpha/mman.h
@@ -42,7 +42,11 @@
 #define MADV_WILLNEED   3               /* will need these pages */
 #define MADV_SPACEAVAIL 5               /* ensure resources are available */
 #define MADV_DONTNEED   6               /* don't need these pages */
-#define MADV_REMOVE     7               /* remove these pages & resources */
+
+/* common/generic parameters */
+#define MADV_REMOVE     9               /* remove these pages & resources */
+#define MADV_DONTFORK   10              /* don't inherit across fork */
+#define MADV_DOFORK     11              /* do inherit across fork */
 
 /* compatibility flags */
 #define MAP_ANON        MAP_ANONYMOUS
diff --git a/include/asm-alpha/system.h b/include/asm-alpha/system.h
index cc9c7e8cced5..f3b7b1a59c56 100644
--- a/include/asm-alpha/system.h
+++ b/include/asm-alpha/system.h
@@ -572,7 +572,7 @@ __cmpxchg_u64(volatile long *m, unsigned long old, unsigned long new)
    if something tries to do an invalid cmpxchg().  */
 extern void __cmpxchg_called_with_bad_pointer(void);
 
-static inline unsigned long
+static __always_inline unsigned long
 __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
 {
         switch (size) {
diff --git a/include/asm-arm/arch-at91rm9200/gpio.h b/include/asm-arm/arch-at91rm9200/gpio.h
index 0f0a61e2f129..6176ab2dc417 100644
--- a/include/asm-arm/arch-at91rm9200/gpio.h
+++ b/include/asm-arm/arch-at91rm9200/gpio.h
@@ -183,6 +183,7 @@ extern int at91_set_B_periph(unsigned pin, int use_pullup);
 extern int at91_set_gpio_input(unsigned pin, int use_pullup);
 extern int at91_set_gpio_output(unsigned pin, int value);
 extern int at91_set_deglitch(unsigned pin, int is_on);
+extern int at91_set_multi_drive(unsigned pin, int is_on);
 
 /* callable at any time */
 extern int at91_set_gpio_value(unsigned pin, int value);
diff --git a/include/asm-arm/arch-ixp4xx/nas100d.h b/include/asm-arm/arch-ixp4xx/nas100d.h
index 51ac0180427c..84467a5190d0 100644
--- a/include/asm-arm/arch-ixp4xx/nas100d.h
+++ b/include/asm-arm/arch-ixp4xx/nas100d.h
@@ -19,8 +19,8 @@
 #error "Do not include this directly, instead #include <asm/hardware.h>"
 #endif
 
-#define NAS100D_SDA_PIN         6
-#define NAS100D_SCL_PIN         5
+#define NAS100D_SDA_PIN         5
+#define NAS100D_SCL_PIN         6
 
 /*
  * NAS100D PCI IRQs
diff --git a/include/asm-arm/arch-omap/io.h b/include/asm-arm/arch-omap/io.h
index f5bcc9a1aed6..b726acfcab14 100644
--- a/include/asm-arm/arch-omap/io.h
+++ b/include/asm-arm/arch-omap/io.h
@@ -116,7 +116,11 @@ typedef struct { volatile u32 offset[4096]; } __regbase32;
                                         ->offset[((vaddr)&4095)>>2]
 #define __REG32(paddr)          __REGV32(io_p2v(paddr))
 
-extern void omap_map_common_io(void);
+extern void omap1_map_common_io(void);
+extern void omap1_init_common_hw(void);
+
+extern void omap2_map_common_io(void);
+extern void omap2_init_common_hw(void);
 
 #else
 
diff --git a/include/asm-arm/arch-s3c2410/h1940-latch.h b/include/asm-arm/arch-s3c2410/h1940-latch.h
new file mode 100644
index 000000000000..c5802411f43d
--- /dev/null
+++ b/include/asm-arm/arch-s3c2410/h1940-latch.h
@@ -0,0 +1,64 @@
+/* linux/include/asm-arm/arch-s3c2410/h1940-latch.h
+ *
+ * (c) 2005 Simtec Electronics
+ *      http://armlinux.simtec.co.uk/
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ *  iPAQ H1940 series - latch definitions
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#ifndef __ASM_ARCH_H1940_LATCH_H
+#define __ASM_ARCH_H1940_LATCH_H
+
+
+#ifndef __ASSEMBLY__
+#define H1940_LATCH             ((void __iomem *)0xF8000000)
+#else
+#define H1940_LATCH             0xF8000000
+#endif
+
+#define H1940_PA_LATCH          (S3C2410_CS2)
+
+/* SD layer latch */
+
+#define H1940_LATCH_SDQ1                (1<<16)
+#define H1940_LATCH_LCD_P1              (1<<17)
+#define H1940_LATCH_LCD_P2              (1<<18)
+#define H1940_LATCH_LCD_P3              (1<<19)
+#define H1940_LATCH_MAX1698_nSHUTDOWN   (1<<20)         /* LCD backlight */
+#define H1940_LATCH_LED_RED             (1<<21)
+#define H1940_LATCH_SDQ7                (1<<22)
+#define H1940_LATCH_USB_DP              (1<<23)
+
+/* CPU layer latch */
+
+#define H1940_LATCH_UDA_POWER           (1<<24)
+#define H1940_LATCH_AUDIO_POWER         (1<<25)
+#define H1940_LATCH_SM803_ENABLE        (1<<26)
+#define H1940_LATCH_LCD_P4              (1<<27)
+#define H1940_LATCH_CPUQ5               (1<<28)         /* untraced */
+#define H1940_LATCH_BLUETOOTH_POWER     (1<<29)         /* active high */
+#define H1940_LATCH_LED_GREEN           (1<<30)
+#define H1940_LATCH_LED_FLASH           (1<<31)
+
+/* default settings */
+
+#define H1940_LATCH_DEFAULT             \
+        H1940_LATCH_LCD_P4              | \
+        H1940_LATCH_SM803_ENABLE        | \
+        H1940_LATCH_SDQ1                | \
+        H1940_LATCH_LCD_P1              | \
+        H1940_LATCH_LCD_P2              | \
+        H1940_LATCH_LCD_P3              | \
+        H1940_LATCH_MAX1698_nSHUTDOWN   | \
+        H1940_LATCH_CPUQ5
+
+/* control functions */
+
+extern void h1940_latch_control(unsigned int clear, unsigned int set);
+
+#endif /* __ASM_ARCH_H1940_LATCH_H */
diff --git a/include/asm-arm/arch-s3c2410/hardware.h b/include/asm-arm/arch-s3c2410/hardware.h
index 1c9de29cafef..a2330bf83695 100644
--- a/include/asm-arm/arch-s3c2410/hardware.h
+++ b/include/asm-arm/arch-s3c2410/hardware.h
@@ -17,6 +17,7 @@
  *  14-Sep-2004 BJD  Added misccr and getpin to gpio
  *  01-Oct-2004 BJD  Added the new gpio functions
  *  16-Oct-2004 BJD  Removed the clock variables
+ *  15-Jan-2006 LCVR Added s3c2400_gpio_getirq()
 */
 
 #ifndef __ASM_ARCH_HARDWARE_H
@@ -55,6 +56,12 @@ extern unsigned int s3c2410_gpio_getcfg(unsigned int pin);
 
 extern int s3c2410_gpio_getirq(unsigned int pin);
 
+#ifdef CONFIG_CPU_S3C2400
+
+extern int s3c2400_gpio_getirq(unsigned int pin);
+
+#endif /* CONFIG_CPU_S3C2400 */
+
 /* s3c2410_gpio_irqfilter
  *
  * set the irq filtering on the given pin
diff --git a/include/asm-arm/arch-s3c2410/regs-gpio.h b/include/asm-arm/arch-s3c2410/regs-gpio.h
index 7f1be48ad67e..9697f93afe74 100644
--- a/include/asm-arm/arch-s3c2410/regs-gpio.h
+++ b/include/asm-arm/arch-s3c2410/regs-gpio.h
@@ -22,6 +22,7 @@
  *    28-Mar-2005    LCVR    Fixed definition of GPB10
  *    26-Oct-2005    BJD     Added generic configuration types
  *    27-Nov-2005    LCVR    Added definitions to S3C2400 registers
+ *    15-Jan-2006    LCVR    Written S3C24XX_GPIO_BASE() macro
 */
 
 
@@ -39,6 +40,27 @@
 #define S3C2410_GPIO_BANKG   (32*6)
 #define S3C2410_GPIO_BANKH   (32*7)
 
+#ifdef CONFIG_CPU_S3C2400
+#define S3C24XX_GPIO_BASE(x)  S3C2400_GPIO_BASE(x)
+#define S3C24XX_MISCCR        S3C2400_MISCCR
+#else
+#define S3C24XX_GPIO_BASE(x)  S3C2410_GPIO_BASE(x)
+#define S3C24XX_MISCCR        S3C2410_MISCCR
+#endif /* CONFIG_CPU_S3C2400 */
+
+
+/* S3C2400 doesn't have a 1:1 mapping to S3C2410 gpio base pins */
+
+#define S3C2400_BANKNUM(pin)     (((pin) & ~31) / 32)
+#define S3C2400_BASEA2B(pin)     ((((pin) & ~31) >> 2))
+#define S3C2400_BASEC2H(pin)     ((S3C2400_BANKNUM(pin) * 10) + \
+                                 (2 * (S3C2400_BANKNUM(pin)-2)))
+
+#define S3C2400_GPIO_BASE(pin)   (pin < S3C2410_GPIO_BANKC ? \
+                                 S3C2400_BASEA2B(pin)+S3C24XX_VA_GPIO : \
+                                 S3C2400_BASEC2H(pin)+S3C24XX_VA_GPIO)
+
+
 #define S3C2410_GPIO_BASE(pin)   ((((pin) & ~31) >> 1) + S3C24XX_VA_GPIO)
 #define S3C2410_GPIO_OFFSET(pin) ((pin) & 31)
 
diff --git a/include/asm-arm/checksum.h b/include/asm-arm/checksum.h
index d4256d5f3a7c..747bdd31a74b 100644
--- a/include/asm-arm/checksum.h
+++ b/include/asm-arm/checksum.h
@@ -77,7 +77,7 @@ ip_fast_csum(unsigned char * iph, unsigned int ihl)
         mov     %0, %0, lsr #16"
         : "=r" (sum), "=r" (iph), "=r" (ihl), "=r" (tmp1)
         : "1" (iph), "2" (ihl)
-        : "cc");
+        : "cc", "memory");
         return sum;
 }
 
diff --git a/include/asm-arm/fpstate.h b/include/asm-arm/fpstate.h
index f7430e3aa55d..6246bf83627d 100644
--- a/include/asm-arm/fpstate.h
+++ b/include/asm-arm/fpstate.h
@@ -55,8 +55,10 @@ struct fp_soft_struct {
         unsigned int save[FP_SOFT_SIZE];                /* undefined information */
 };
 
+#define IWMMXT_SIZE     0x98
+
 struct iwmmxt_struct {
-        unsigned int save[0x98/sizeof(int) + 1];
+        unsigned int save[IWMMXT_SIZE / sizeof(unsigned int)];
 };
 
 union fp_state {
diff --git a/include/asm-arm/mman.h b/include/asm-arm/mman.h
index f0bebca2ac21..54570d2e95b7 100644
--- a/include/asm-arm/mman.h
+++ b/include/asm-arm/mman.h
@@ -1,19 +1,7 @@
 #ifndef __ARM_MMAN_H__
 #define __ARM_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,22 +11,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) page tables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __ARM_MMAN_H__ */
diff --git a/include/asm-arm/mutex.h b/include/asm-arm/mutex.h
index 6caa59f1f595..cb29d84e690d 100644
--- a/include/asm-arm/mutex.h
+++ b/include/asm-arm/mutex.h
@@ -23,72 +23,71 @@
  * simply bail out immediately through the slow path where the lock will be
  * reattempted until it succeeds.
  */
-#define __mutex_fastpath_lock(count, fail_fn)                           \
-do {                                                                    \
-        int __ex_flag, __res;                                           \
-                                                                        \
-        typecheck(atomic_t *, count);                                   \
-        typecheck_fn(fastcall void (*)(atomic_t *), fail_fn);           \
-                                                                        \
-        __asm__ (                                                       \
-                "ldrex  %0, [%2]        \n"                             \
-                "sub    %0, %0, #1      \n"                             \
-                "strex  %1, %0, [%2]    \n"                             \
-                                                                        \
-                : "=&r" (__res), "=&r" (__ex_flag)                      \
-                : "r" (&(count)->counter)                               \
-                : "cc","memory" );                                      \
-                                                                        \
-        if (unlikely(__res || __ex_flag))                               \
-                fail_fn(count);                                         \
-} while (0)
-
-#define __mutex_fastpath_lock_retval(count, fail_fn)                    \
-({                                                                      \
-        int __ex_flag, __res;                                           \
-                                                                        \
-        typecheck(atomic_t *, count);                                   \
-        typecheck_fn(fastcall int (*)(atomic_t *), fail_fn);            \
-                                                                        \
-        __asm__ (                                                       \
-                "ldrex  %0, [%2]        \n"                             \
-                "sub    %0, %0, #1      \n"                             \
-                "strex  %1, %0, [%2]    \n"                             \
-                                                                        \
-                : "=&r" (__res), "=&r" (__ex_flag)                      \
-                : "r" (&(count)->counter)                               \
-                : "cc","memory" );                                      \
-                                                                        \
-        __res |= __ex_flag;                                             \
-        if (unlikely(__res != 0))                                       \
-                __res = fail_fn(count);                                 \
-        __res;                                                          \
-})
+static inline void
+__mutex_fastpath_lock(atomic_t *count, fastcall void (*fail_fn)(atomic_t *))
+{
+        int __ex_flag, __res;
+
+        __asm__ (
+
+                "ldrex  %0, [%2]        \n\t"
+                "sub    %0, %0, #1      \n\t"
+                "strex  %1, %0, [%2]    "
+
+                : "=&r" (__res), "=&r" (__ex_flag)
+                : "r" (&(count)->counter)
+                : "cc","memory" );
+
+        __res |= __ex_flag;
+        if (unlikely(__res != 0))
+                fail_fn(count);
+}
+
+static inline int
+__mutex_fastpath_lock_retval(atomic_t *count, fastcall int (*fail_fn)(atomic_t *))
+{
+        int __ex_flag, __res;
+
+        __asm__ (
+
+                "ldrex  %0, [%2]        \n\t"
+                "sub    %0, %0, #1      \n\t"
+                "strex  %1, %0, [%2]    "
+
+                : "=&r" (__res), "=&r" (__ex_flag)
+                : "r" (&(count)->counter)
+                : "cc","memory" );
+
+        __res |= __ex_flag;
+        if (unlikely(__res != 0))
+                __res = fail_fn(count);
+        return __res;
+}
 
 /*
  * Same trick is used for the unlock fast path. However the original value,
  * rather than the result, is used to test for success in order to have
  * better generated assembly.
  */
-#define __mutex_fastpath_unlock(count, fail_fn)                         \
-do {                                                                    \
-        int __ex_flag, __res, __orig;                                   \
-                                                                        \
-        typecheck(atomic_t *, count);                                   \
-        typecheck_fn(fastcall void (*)(atomic_t *), fail_fn);           \
-                                                                        \
-        __asm__ (                                                       \
-                "ldrex  %0, [%3]        \n"                             \
-                "add    %1, %0, #1      \n"                             \
-                "strex  %2, %1, [%3]    \n"                             \
-                                                                        \
-                : "=&r" (__orig), "=&r" (__res), "=&r" (__ex_flag)      \
-                : "r" (&(count)->counter)                               \
-                : "cc","memory" );                                      \
-                                                                        \
-        if (unlikely(__orig || __ex_flag))                              \
-                fail_fn(count);                                         \
-} while (0)
+static inline void
+__mutex_fastpath_unlock(atomic_t *count, fastcall void (*fail_fn)(atomic_t *))
+{
+        int __ex_flag, __res, __orig;
+
+        __asm__ (
+
+                "ldrex  %0, [%3]        \n\t"
+                "add    %1, %0, #1      \n\t"
+                "strex  %2, %1, [%3]    "
+
+                : "=&r" (__orig), "=&r" (__res), "=&r" (__ex_flag)
+                : "r" (&(count)->counter)
+                : "cc","memory" );
+
+        __orig |= __ex_flag;
+        if (unlikely(__orig != 0))
+                fail_fn(count);
+}
 
 /*
  * If the unlock was done on a contended lock, or if the unlock simply fails
@@ -110,12 +109,12 @@ __mutex_fastpath_trylock(atomic_t *count, int (*fail_fn)(atomic_t *))
 
         __asm__ (
 
-                "1: ldrex       %0, [%3]        \n"
-                "subs           %1, %0, #1      \n"
-                "strexeq        %2, %1, [%3]    \n"
-                "movlt          %0, #0          \n"
-                "cmpeq          %2, #0          \n"
-                "bgt            1b              \n"
+                "1: ldrex       %0, [%3]        \n\t"
+                "subs           %1, %0, #1      \n\t"
+                "strexeq        %2, %1, [%3]    \n\t"
+                "movlt          %0, #0          \n\t"
+                "cmpeq          %2, #0          \n\t"
+                "bgt            1b              "
 
                 : "=&r" (__orig), "=&r" (__res), "=&r" (__ex_flag)
                 : "r" (&count->counter)
diff --git a/include/asm-arm/smp.h b/include/asm-arm/smp.h
index 5a72e50ca9fc..fe45f7f61223 100644
--- a/include/asm-arm/smp.h
+++ b/include/asm-arm/smp.h
@@ -42,6 +42,11 @@ extern void show_ipi_list(struct seq_file *p);
 asmlinkage void do_IPI(struct pt_regs *regs);
 
 /*
+ * Setup the SMP cpu_possible_map
+ */
+extern void smp_init_cpus(void);
+
+/*
  * Move global data into per-processor storage.
  */
 extern void smp_store_cpu_info(unsigned int cpuid);
diff --git a/include/asm-arm/system.h b/include/asm-arm/system.h
index eb2de8c10515..ec91d1ff032a 100644
--- a/include/asm-arm/system.h
+++ b/include/asm-arm/system.h
@@ -415,6 +415,9 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
         return ret;
 }
 
+extern void disable_hlt(void);
+extern void enable_hlt(void);
+
 #endif /* __ASSEMBLY__ */
 
 #define arch_align_stack(x) (x)
diff --git a/include/asm-arm/thread_info.h b/include/asm-arm/thread_info.h
index 33a33cbb6329..cfbccb63c67b 100644
--- a/include/asm-arm/thread_info.h
+++ b/include/asm-arm/thread_info.h
@@ -59,7 +59,7 @@ struct thread_info {
         struct cpu_context_save cpu_context;    /* cpu context */
         __u8                    used_cp[16];    /* thread used copro */
         unsigned long           tp_value;
-        union fp_state          fpstate;
+        union fp_state          fpstate __attribute__((aligned(8)));
         union vfp_state         vfpstate;
         struct restart_block    restart_block;
 };
diff --git a/include/asm-arm/tlbflush.h b/include/asm-arm/tlbflush.h
index 9387a5e1ffe0..0c2acc944a0a 100644
--- a/include/asm-arm/tlbflush.h
+++ b/include/asm-arm/tlbflush.h
@@ -340,6 +340,12 @@ static inline void local_flush_tlb_kernel_page(unsigned long kaddr)
                 asm("mcr%? p15, 0, %0, c8, c6, 1" : : "r" (kaddr));
         if (tlb_flag(TLB_V6_I_PAGE))
                 asm("mcr%? p15, 0, %0, c8, c5, 1" : : "r" (kaddr));
+
+        /* The ARM ARM states that the completion of a TLB maintenance
+         * operation is only guaranteed by a DSB instruction
+         */
+        if (tlb_flag(TLB_V6_U_PAGE | TLB_V6_D_PAGE | TLB_V6_I_PAGE))
+                asm("mcr%? p15, 0, %0, c7, c10, 4" : : "r" (zero));
 }
 
 /*
diff --git a/include/asm-arm/unistd.h b/include/asm-arm/unistd.h
index 77430d6178ae..8f331bbd39a8 100644
--- a/include/asm-arm/unistd.h
+++ b/include/asm-arm/unistd.h
@@ -309,7 +309,7 @@
 #define __NR_mq_getsetattr              (__NR_SYSCALL_BASE+279)
 #define __NR_waitid                     (__NR_SYSCALL_BASE+280)
 
-#if 0 /* reserve these for un-muxing socketcall */
+#if defined(__ARM_EABI__)  /* reserve these for un-muxing socketcall */
 #define __NR_socket                     (__NR_SYSCALL_BASE+281)
 #define __NR_bind                       (__NR_SYSCALL_BASE+282)
 #define __NR_connect                    (__NR_SYSCALL_BASE+283)
@@ -329,7 +329,7 @@
 #define __NR_recvmsg                    (__NR_SYSCALL_BASE+297)
 #endif
 
-#if 0 /* reserve these for un-muxing ipc */
+#if defined(__ARM_EABI__)  /* reserve these for un-muxing ipc */
 #define __NR_semop                      (__NR_SYSCALL_BASE+298)
 #define __NR_semget                     (__NR_SYSCALL_BASE+299)
 #define __NR_semctl                     (__NR_SYSCALL_BASE+300)
@@ -347,7 +347,7 @@
 #define __NR_request_key                (__NR_SYSCALL_BASE+310)
 #define __NR_keyctl                     (__NR_SYSCALL_BASE+311)
 
-#if 0 /* reserved for un-muxing ipc */
+#if defined(__ARM_EABI__)  /* reserved for un-muxing ipc */
 #define __NR_semtimedop                 (__NR_SYSCALL_BASE+312)
 #endif
 
diff --git a/include/asm-arm26/mman.h b/include/asm-arm26/mman.h
index 0ed7780541fa..4000a6c1b76b 100644
--- a/include/asm-arm26/mman.h
+++ b/include/asm-arm26/mman.h
@@ -1,19 +1,7 @@
 #ifndef __ARM_MMAN_H__
 #define __ARM_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,22 +11,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) page tables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __ARM_MMAN_H__ */
diff --git a/include/asm-cris/mman.h b/include/asm-cris/mman.h
index 5a382b8bf3f7..1c35e1b66b46 100644
--- a/include/asm-cris/mman.h
+++ b/include/asm-cris/mman.h
@@ -3,19 +3,7 @@
 
 /* verbatim copy of asm-i386/ version */
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -25,22 +13,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __CRIS_MMAN_H__ */
diff --git a/include/asm-frv/atomic.h b/include/asm-frv/atomic.h
index a59f684b4f33..5d9f84bfdcad 100644
--- a/include/asm-frv/atomic.h
+++ b/include/asm-frv/atomic.h
@@ -220,9 +220,9 @@ extern unsigned long atomic_test_and_XOR_mask(unsigned long mask, volatile unsig
         switch (sizeof(__xg_orig)) {                                            \
         case 4:                                                                 \
                 asm volatile(                                                   \
-                        "swap%I0 %2,%M0"                                        \
-                        : "+m"(*__xg_ptr), "=&r"(__xg_orig)                     \
-                        : "r"(x)                                                \
+                        "swap%I0 %M0,%1"                                        \
+                        : "+m"(*__xg_ptr), "=r"(__xg_orig)                      \
+                        : "1"(x)                                                \
                         : "memory"                                              \
                         );                                                      \
                 break;                                                          \
diff --git a/include/asm-frv/cacheflush.h b/include/asm-frv/cacheflush.h
index 3007deccb490..eaa5826bc1c8 100644
--- a/include/asm-frv/cacheflush.h
+++ b/include/asm-frv/cacheflush.h
@@ -87,5 +87,17 @@ static inline void flush_icache_page(struct vm_area_struct *vma, struct page *pa
         flush_icache_user_range(vma, page, page_to_phys(page), PAGE_SIZE);
 }
 
+/*
+ * permit ptrace to access another process's address space through the icache
+ * and the dcache
+ */
+#define copy_to_user_page(vma, page, vaddr, dst, src, len)      \
+do {                                                            \
+        memcpy((dst), (src), (len));                            \
+        flush_icache_user_range((vma), (page), (vaddr), (len)); \
+} while(0)
+
+#define copy_from_user_page(vma, page, vaddr, dst, src, len)    \
+        memcpy((dst), (src), (len))
 
 #endif /* _ASM_CACHEFLUSH_H */
diff --git a/include/asm-frv/io.h b/include/asm-frv/io.h
index 075369b1a34b..01247cb2bc39 100644
--- a/include/asm-frv/io.h
+++ b/include/asm-frv/io.h
@@ -251,7 +251,6 @@ static inline void writel(uint32_t datum, volatile void __iomem *addr)
 #define IOMAP_WRITETHROUGH              3
 
 extern void __iomem *__ioremap(unsigned long physaddr, unsigned long size, int cacheflag);
-extern void __iounmap(void __iomem *addr, unsigned long size);
 
 static inline void __iomem *ioremap(unsigned long physaddr, unsigned long size)
 {
diff --git a/include/asm-frv/mman.h b/include/asm-frv/mman.h
index 8af4a41c255e..b4371e928683 100644
--- a/include/asm-frv/mman.h
+++ b/include/asm-frv/mman.h
@@ -1,19 +1,7 @@
 #ifndef __ASM_MMAN_H__
 #define __ASM_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,23 +11,8 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __ASM_MMAN_H__ */
 
diff --git a/include/asm-frv/spr-regs.h b/include/asm-frv/spr-regs.h
index ef472f058d9c..c2a541ef828d 100644
--- a/include/asm-frv/spr-regs.h
+++ b/include/asm-frv/spr-regs.h
@@ -98,6 +98,7 @@
 #define TBR_TT_TRAP0            (0x80 << 4)
 #define TBR_TT_TRAP1            (0x81 << 4)
 #define TBR_TT_TRAP2            (0x82 << 4)
+#define TBR_TT_TRAP3            (0x83 << 4)
 #define TBR_TT_TRAP126          (0xfe << 4)
 #define TBR_TT_BREAK            (0xff << 4)
 
diff --git a/include/asm-frv/system.h b/include/asm-frv/system.h
index d2aea70a5f64..f72ff0c4dc0b 100644
--- a/include/asm-frv/system.h
+++ b/include/asm-frv/system.h
@@ -40,8 +40,84 @@ do {									\
 
 /*
  * interrupt flag manipulation
+ * - use virtual interrupt management since touching the PSR is slow
+ *   - ICC2.Z: T if interrupts virtually disabled
+ *   - ICC2.C: F if interrupts really disabled
+ * - if Z==1 upon interrupt:
+ *   - C is set to 0
+ *   - interrupts are really disabled
+ *   - entry.S returns immediately
+ * - uses TIHI (TRAP if Z==0 && C==0) #2 to really reenable interrupts
+ *   - if taken, the trap:
+ *     - sets ICC2.C
+ *     - enables interrupts
  */
-#define local_irq_disable()                             \
+#define local_irq_disable()                                     \
+do {                                                            \
+        /* set Z flag, but don't change the C flag */           \
+        asm volatile("  andcc   gr0,gr0,gr0,icc2        \n"     \
+                     :                                          \
+                     :                                          \
+                     : "memory", "icc2"                         \
+                     );                                         \
+} while(0)
+
+#define local_irq_enable()                                      \
+do {                                                            \
+        /* clear Z flag and then test the C flag */             \
+        asm volatile("  oricc   gr0,#1,gr0,icc2         \n"     \
+                     "  tihi    icc2,gr0,#2             \n"     \
+                     :                                          \
+                     :                                          \
+                     : "memory", "icc2"                         \
+                     );                                         \
+} while(0)
+
+#define local_save_flags(flags)                                 \
+do {                                                            \
+        typecheck(unsigned long, flags);                        \
+        asm volatile("movsg ccr,%0"                             \
+                     : "=r"(flags)                              \
+                     :                                          \
+                     : "memory");                               \
+                                                                \
+        /* shift ICC2.Z to bit 0 */                             \
+        flags >>= 26;                                           \
+                                                                \
+        /* make flags 1 if interrupts disabled, 0 otherwise */  \
+        flags &= 1UL;                                           \
+} while(0)
+
+#define irqs_disabled() \
+        ({unsigned long flags; local_save_flags(flags); flags; })
+
+#define local_irq_save(flags)                   \
+do {                                            \
+        typecheck(unsigned long, flags);        \
+        local_save_flags(flags);                \
+        local_irq_disable();                    \
+} while(0)
+
+#define local_irq_restore(flags)                                        \
+do {                                                                    \
+        typecheck(unsigned long, flags);                                \
+                                                                        \
+        /* load the Z flag by turning 1 if disabled into 0 if disabled  \
+         * and thus setting the Z flag but not the C flag */            \
+        asm volatile("  xoricc  %0,#1,gr0,icc2          \n"             \
+                     /* then test Z=0 and C=0 */                        \
+                     "  tihi    icc2,gr0,#2             \n"             \
+                     :                                                  \
+                     : "r"(flags)                                       \
+                     : "memory", "icc2"                                 \
+                     );                                                 \
+                                                                        \
+} while(0)
+
+/*
+ * real interrupt flag manipulation
+ */
+#define __local_irq_disable()                           \
 do {                                                    \
         unsigned long psr;                              \
         asm volatile("  movsg   psr,%0          \n"     \
@@ -53,7 +129,7 @@ do {							\
                      : "memory");                       \
 } while(0)
 
-#define local_irq_enable()                              \
+#define __local_irq_enable()                            \
 do {                                                    \
         unsigned long psr;                              \
         asm volatile("  movsg   psr,%0          \n"     \
@@ -64,7 +140,7 @@ do {							\
                      : "memory");                       \
 } while(0)
 
-#define local_save_flags(flags)                 \
+#define __local_save_flags(flags)               \
 do {                                            \
         typecheck(unsigned long, flags);        \
         asm("movsg psr,%0"                      \
@@ -73,7 +149,7 @@ do {						\
             : "memory");                        \
 } while(0)
 
-#define local_irq_save(flags)                           \
+#define __local_irq_save(flags)                         \
 do {                                                    \
         unsigned long npsr;                             \
         typecheck(unsigned long, flags);                \
@@ -86,7 +162,7 @@ do {							\
                      : "memory");                       \
 } while(0)
 
-#define local_irq_restore(flags)                        \
+#define __local_irq_restore(flags)                      \
 do {                                                    \
         typecheck(unsigned long, flags);                \
         asm volatile("  movgs   %0,psr          \n"     \
@@ -95,7 +171,7 @@ do {							\
                      : "memory");                       \
 } while(0)
 
-#define irqs_disabled() \
+#define __irqs_disabled() \
         ((__get_PSR() & PSR_PIL) >= PSR_PIL_14)
 
 /*
diff --git a/include/asm-frv/uaccess.h b/include/asm-frv/uaccess.h
index b6bcbe01f6ee..a1d140438863 100644
--- a/include/asm-frv/uaccess.h
+++ b/include/asm-frv/uaccess.h
@@ -306,7 +306,4 @@ extern long strnlen_user(const char *src, long count);
 
 extern unsigned long search_exception_table(unsigned long addr);
 
-#define copy_to_user_page(vma, page, vaddr, dst, src, len)      memcpy(dst, src, len)
-#define copy_from_user_page(vma, page, vaddr, dst, src, len)    memcpy(dst, src, len)
-
 #endif /* _ASM_UACCESS_H */
diff --git a/include/asm-frv/unistd.h b/include/asm-frv/unistd.h
index 4d994d2e99e3..322531caa484 100644
--- a/include/asm-frv/unistd.h
+++ b/include/asm-frv/unistd.h
@@ -295,13 +295,29 @@
 #define __NR_add_key            286
 #define __NR_request_key        287
 #define __NR_keyctl             288
-#define __NR_vperfctr_open      289
-#define __NR_vperfctr_control   (__NR_perfctr_info+1)
-#define __NR_vperfctr_unlink    (__NR_perfctr_info+2)
-#define __NR_vperfctr_iresume   (__NR_perfctr_info+3)
-#define __NR_vperfctr_read      (__NR_perfctr_info+4)
+#define __NR_ioprio_set         289
+#define __NR_ioprio_get         290
+#define __NR_inotify_init       291
+#define __NR_inotify_add_watch  292
+#define __NR_inotify_rm_watch   293
+#define __NR_migrate_pages      294
+#define __NR_openat             295
+#define __NR_mkdirat            296
+#define __NR_mknodat            297
+#define __NR_fchownat           298
+#define __NR_futimesat          299
+#define __NR_newfstatat         300
+#define __NR_unlinkat           301
+#define __NR_renameat           302
+#define __NR_linkat             303
+#define __NR_symlinkat          304
+#define __NR_readlinkat         305
+#define __NR_fchmodat           306
+#define __NR_faccessat          307
+#define __NR_pselect6           308
+#define __NR_ppoll              309
 
-#define NR_syscalls 294
+#define NR_syscalls 310
 
 /*
  * process the return value of a syscall, consigning it to one of two possible fates
diff --git a/include/asm-generic/mman.h b/include/asm-generic/mman.h
new file mode 100644
index 000000000000..3b41d2bb70da
--- /dev/null
+++ b/include/asm-generic/mman.h
@@ -0,0 +1,42 @@
+#ifndef _ASM_GENERIC_MMAN_H
+#define _ASM_GENERIC_MMAN_H
+
+/*
+ Author: Michael S. Tsirkin <mst@mellanox.co.il>, Mellanox Technologies Ltd.
+ Based on: asm-xxx/mman.h
+*/
+
+#define PROT_READ       0x1             /* page can be read */
+#define PROT_WRITE      0x2             /* page can be written */
+#define PROT_EXEC       0x4             /* page can be executed */
+#define PROT_SEM        0x8             /* page may be used for atomic ops */
+#define PROT_NONE       0x0             /* page can not be accessed */
+#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
+#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
+
+#define MAP_SHARED      0x01            /* Share changes */
+#define MAP_PRIVATE     0x02            /* Changes are private */
+#define MAP_TYPE        0x0f            /* Mask for type of mapping */
+#define MAP_FIXED       0x10            /* Interpret addr exactly */
+#define MAP_ANONYMOUS   0x20            /* don't use a file */
+
+#define MS_ASYNC        1               /* sync memory asynchronously */
+#define MS_INVALIDATE   2               /* invalidate the caches */
+#define MS_SYNC         4               /* synchronous memory sync */
+
+#define MADV_NORMAL     0               /* no further special treatment */
+#define MADV_RANDOM     1               /* expect random page references */
+#define MADV_SEQUENTIAL 2               /* expect sequential page references */
+#define MADV_WILLNEED   3               /* will need these pages */
+#define MADV_DONTNEED   4               /* don't need these pages */
+
+/* common parameters: try to keep these consistent across architectures */
+#define MADV_REMOVE     9               /* remove these pages & resources */
+#define MADV_DONTFORK   10              /* don't inherit across fork */
+#define MADV_DOFORK     11              /* do inherit across fork */
+
+/* compatibility flags */
+#define MAP_ANON        MAP_ANONYMOUS
+#define MAP_FILE        0
+
+#endif
diff --git a/include/asm-generic/unaligned.h b/include/asm-generic/unaligned.h
index 4dc8ddb401c1..09ec447fe2af 100644
--- a/include/asm-generic/unaligned.h
+++ b/include/asm-generic/unaligned.h
@@ -78,7 +78,7 @@ static inline void __ustw(__u16 val, __u16 *addr)
 
 #define __get_unaligned(ptr, size) ({           \
         const void *__gu_p = ptr;               \
-        __typeof__(*(ptr)) val;                 \
+        __u64 val;                              \
         switch (size) {                         \
         case 1:                                 \
                 val = *(const __u8 *)__gu_p;    \
@@ -95,7 +95,7 @@ static inline void __ustw(__u16 val, __u16 *addr)
         default:                                \
                 bad_unaligned_access_length();  \
         };                                      \
-        val;                                    \
+        (__typeof__(*(ptr)))val;                \
 })
 
 #define __put_unaligned(val, ptr, size)         \
diff --git a/include/asm-h8300/mman.h b/include/asm-h8300/mman.h
index 744a8fb485c2..b9f104f22a36 100644
--- a/include/asm-h8300/mman.h
+++ b/include/asm-h8300/mman.h
@@ -1,19 +1,7 @@
 #ifndef __H8300_MMAN_H__
 #define __H8300_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,22 +11,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __H8300_MMAN_H__ */
diff --git a/include/asm-i386/apic.h b/include/asm-i386/apic.h
index d30b8571573f..ff9ac8d19eb2 100644
--- a/include/asm-i386/apic.h
+++ b/include/asm-i386/apic.h
@@ -137,6 +137,8 @@ void switch_APIC_timer_to_ipi(void *cpumask);
 void switch_ipi_to_APIC_timer(void *cpumask);
 #define ARCH_APICTIMER_STOPS_ON_C3      1
 
+extern int timer_over_8254;
+
 #else /* !CONFIG_X86_LOCAL_APIC */
 static inline void lapic_shutdown(void) { }
 
diff --git a/include/asm-i386/desc.h b/include/asm-i386/desc.h
index 494e73bca095..89b8b82c82b3 100644
--- a/include/asm-i386/desc.h
+++ b/include/asm-i386/desc.h
@@ -24,11 +24,13 @@ struct Xgt_desc_struct {
         unsigned short pad;
 } __attribute__ ((packed));
 
-extern struct Xgt_desc_struct idt_descr, cpu_gdt_descr[NR_CPUS];
+extern struct Xgt_desc_struct idt_descr;
+DECLARE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
+
 
 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
 {
-        return ((struct desc_struct *)cpu_gdt_descr[cpu].address);
+        return (struct desc_struct *)per_cpu(cpu_gdt_descr, cpu).address;
 }
 
 #define load_TR_desc() __asm__ __volatile__("ltr %w0"::"q" (GDT_ENTRY_TSS*8))
diff --git a/include/asm-i386/kprobes.h b/include/asm-i386/kprobes.h
index 27cac050a60e..a0d2d74a7dda 100644
--- a/include/asm-i386/kprobes.h
+++ b/include/asm-i386/kprobes.h
@@ -27,6 +27,9 @@
 #include <linux/types.h>
 #include <linux/ptrace.h>
 
+#define  __ARCH_WANT_KPROBES_INSN_SLOT
+
+struct kprobe;
 struct pt_regs;
 
 typedef u8 kprobe_opcode_t;
@@ -40,14 +43,14 @@ typedef u8 kprobe_opcode_t;
 
 #define JPROBE_ENTRY(pentry)    (kprobe_opcode_t *)pentry
 #define ARCH_SUPPORTS_KRETPROBES
-#define arch_remove_kprobe(p)   do {} while (0)
 
+void arch_remove_kprobe(struct kprobe *p);
 void kretprobe_trampoline(void);
 
 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
         /* copy of the original instruction */
-        kprobe_opcode_t insn[MAX_INSN_SIZE];
+        kprobe_opcode_t *insn;
 };
 
 struct prev_kprobe {
diff --git a/include/asm-i386/mman.h b/include/asm-i386/mman.h
index ba4941e6f643..8fd9d7ab7faf 100644
--- a/include/asm-i386/mman.h
+++ b/include/asm-i386/mman.h
@@ -1,19 +1,7 @@
 #ifndef __I386_MMAN_H__
 #define __I386_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,22 +11,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __I386_MMAN_H__ */
diff --git a/include/asm-i386/system.h b/include/asm-i386/system.h
index 36a92ed6a9d0..399145a247f2 100644
--- a/include/asm-i386/system.h
+++ b/include/asm-i386/system.h
@@ -507,7 +507,7 @@ struct alt_instr {
 #define smp_rmb()       rmb()
 #define smp_wmb()       wmb()
 #define smp_read_barrier_depends()      read_barrier_depends()
-#define set_mb(var, value) do { xchg(&var, value); } while (0)
+#define set_mb(var, value) do { (void) xchg(&var, value); } while (0)
 #else
 #define smp_mb()        barrier()
 #define smp_rmb()       barrier()
diff --git a/include/asm-i386/thread_info.h b/include/asm-i386/thread_info.h
index e20e99551d71..1f7d48c9ba3f 100644
--- a/include/asm-i386/thread_info.h
+++ b/include/asm-i386/thread_info.h
@@ -158,8 +158,8 @@ register unsigned long current_stack_pointer asm("esp") __attribute_used__;
 
 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK \
-  (0x0000FFFF & ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SINGLESTEP|\
-                  _TIF_SECCOMP|_TIF_SYSCALL_EMU))
+  (0x0000FFFF & ~(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
+                  _TIF_SECCOMP | _TIF_SYSCALL_EMU))
 /* work to do on any return to u-space */
 #define _TIF_ALLWORK_MASK       (0x0000FFFF & ~_TIF_SECCOMP)
 
diff --git a/include/asm-i386/topology.h b/include/asm-i386/topology.h
index af503a122b23..aa958c6ee83e 100644
--- a/include/asm-i386/topology.h
+++ b/include/asm-i386/topology.h
@@ -27,7 +27,7 @@
 #ifndef _ASM_I386_TOPOLOGY_H
 #define _ASM_I386_TOPOLOGY_H
 
-#ifdef CONFIG_SMP
+#ifdef CONFIG_X86_HT
 #define topology_physical_package_id(cpu)                               \
         (phys_proc_id[cpu] == BAD_APICID ? -1 : phys_proc_id[cpu])
 #define topology_core_id(cpu)                                           \
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index 597496ed2aee..dc81a55dd94d 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -305,7 +305,7 @@
 #define __NR_mknodat            297
 #define __NR_fchownat           298
 #define __NR_futimesat          299
-#define __NR_newfstatat         300
+#define __NR_fstatat64          300
 #define __NR_unlinkat           301
 #define __NR_renameat           302
 #define __NR_linkat             303
@@ -315,8 +315,9 @@
 #define __NR_faccessat          307
 #define __NR_pselect6           308
 #define __NR_ppoll              309
+#define __NR_unshare            310
 
-#define NR_syscalls 310
+#define NR_syscalls 311
 
 /*
  * user-visible error numbers are in the range -1 - -128: see
diff --git a/include/asm-ia64/acpi.h b/include/asm-ia64/acpi.h
index 3a544ffc5008..f7a517654308 100644
--- a/include/asm-ia64/acpi.h
+++ b/include/asm-ia64/acpi.h
@@ -106,6 +106,8 @@ extern unsigned int can_cpei_retarget(void);
 extern unsigned int is_cpu_cpei_target(unsigned int cpu);
 extern void set_cpei_target_cpu(unsigned int cpu);
 extern unsigned int get_cpei_target_cpu(void);
+extern void prefill_possible_map(void);
+extern int additional_cpus;
 
 #ifdef CONFIG_ACPI_NUMA
 /* Proximity bitmap length; _PXM is at most 255 (8 bit)*/
diff --git a/include/asm-ia64/machvec_sn2.h b/include/asm-ia64/machvec_sn2.h
index e1b6cd63f49e..03d00faf03b5 100644
--- a/include/asm-ia64/machvec_sn2.h
+++ b/include/asm-ia64/machvec_sn2.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2003 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2002-2003, 2006 Silicon Graphics, Inc.  All Rights Reserved.
  * 
  * This program is free software; you can redistribute it and/or modify it 
  * under the terms of version 2 of the GNU General Public License 
@@ -20,11 +20,6 @@
  * License along with this program; if not, write the Free Software 
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  * 
- * Contact information:  Silicon Graphics, Inc., 1600 Amphitheatre Pkwy, 
- * Mountain View, CA  94043, or:
- * 
- * http://www.sgi.com 
- * 
  * For further information regarding this notice, see: 
  * 
  * http://oss.sgi.com/projects/GenInfo/NoticeExplan
diff --git a/include/asm-ia64/mman.h b/include/asm-ia64/mman.h
index 828beb24a20e..6ba179f12718 100644
--- a/include/asm-ia64/mman.h
+++ b/include/asm-ia64/mman.h
@@ -8,19 +8,7 @@
  *      David Mosberger-Tang <davidm@hpl.hp.com>, Hewlett-Packard Co
  */
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x00100         /* stack-like segment */
 #define MAP_GROWSUP     0x00200         /* register stack-like segment */
@@ -31,22 +19,7 @@
 #define MAP_POPULATE    0x08000         /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* _ASM_IA64_MMAN_H */
diff --git a/include/asm-ia64/processor.h b/include/asm-ia64/processor.h
index 09b99029ac1a..23c8e1be1911 100644
--- a/include/asm-ia64/processor.h
+++ b/include/asm-ia64/processor.h
@@ -559,6 +559,23 @@ ia64_eoi (void)
 
 #define cpu_relax()     ia64_hint(ia64_hint_pause)
 
+static inline int
+ia64_get_irr(unsigned int vector)
+{
+        unsigned int reg = vector / 64;
+        unsigned int bit = vector % 64;
+        u64 irr;
+
+        switch (reg) {
+        case 0: irr = ia64_getreg(_IA64_REG_CR_IRR0); break;
+        case 1: irr = ia64_getreg(_IA64_REG_CR_IRR1); break;
+        case 2: irr = ia64_getreg(_IA64_REG_CR_IRR2); break;
+        case 3: irr = ia64_getreg(_IA64_REG_CR_IRR3); break;
+        }
+
+        return test_bit(bit, &irr);
+}
+
 static inline void
 ia64_set_lrr0 (unsigned long val)
 {
diff --git a/include/asm-ia64/sal.h b/include/asm-ia64/sal.h
index 313cad0628d0..0b210abbe003 100644
--- a/include/asm-ia64/sal.h
+++ b/include/asm-ia64/sal.h
@@ -658,15 +658,7 @@ ia64_sal_freq_base (unsigned long which, unsigned long *ticks_per_second,
         return isrv.status;
 }
 
-/* Flush all the processor and platform level instruction and/or data caches */
-static inline s64
-ia64_sal_cache_flush (u64 cache_type)
-{
-        struct ia64_sal_retval isrv;
-        SAL_CALL(isrv, SAL_CACHE_FLUSH, cache_type, 0, 0, 0, 0, 0, 0);
-        return isrv.status;
-}
-
+extern s64 ia64_sal_cache_flush (u64 cache_type);
 
 /* Initialize all the processor and platform level instruction and data caches */
 static inline s64
diff --git a/include/asm-ia64/sn/arch.h b/include/asm-ia64/sn/arch.h
index 1a3831c04af6..16adc93d7a72 100644
--- a/include/asm-ia64/sn/arch.h
+++ b/include/asm-ia64/sn/arch.h
@@ -31,7 +31,8 @@
  *      to ACPI3.0, this limit will be removed. The notion of "compact nodes"
  *      should be deleted and TIOs should be included in MAX_NUMNODES.
  */
-#define MAX_COMPACT_NODES       512
+#define MAX_TIO_NODES           MAX_NUMNODES
+#define MAX_COMPACT_NODES       (MAX_NUMNODES + MAX_TIO_NODES)
 
 /*
  * Maximum number of nodes in all partitions and in all coherency domains.
@@ -70,7 +71,7 @@ DECLARE_PER_CPU(struct sn_hub_info_s, __sn_hub_info);
  * Compact node ID to nasid mappings kept in the per-cpu data areas of each
  * cpu.
  */
-DECLARE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_NUMNODES]);
+DECLARE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_COMPACT_NODES]);
 #define sn_cnodeid_to_nasid     (&__get_cpu_var(__sn_cnodeid_to_nasid[0]))
 
 
diff --git a/include/asm-ia64/sn/bte.h b/include/asm-ia64/sn/bte.h
index f50da3d91d07..5335d87ca5f8 100644
--- a/include/asm-ia64/sn/bte.h
+++ b/include/asm-ia64/sn/bte.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2000-2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 
@@ -46,7 +46,7 @@
 #define BTES_PER_NODE (is_shub2() ? 4 : 2)
 #define MAX_BTES_PER_NODE 4
 
-#define BTE2OFF_CTRL    (0)
+#define BTE2OFF_CTRL    0
 #define BTE2OFF_SRC     (SH2_BT_ENG_SRC_ADDR_0 - SH2_BT_ENG_CSR_0)
 #define BTE2OFF_DEST    (SH2_BT_ENG_DEST_ADDR_0 - SH2_BT_ENG_CSR_0)
 #define BTE2OFF_NOTIFY  (SH2_BT_ENG_NOTIF_ADDR_0 - SH2_BT_ENG_CSR_0)
@@ -75,11 +75,11 @@
                 : base + (BTEOFF_NOTIFY/8))
 
 /* Define hardware modes */
-#define BTE_NOTIFY (IBCT_NOTIFY)
+#define BTE_NOTIFY IBCT_NOTIFY
 #define BTE_NORMAL BTE_NOTIFY
 #define BTE_ZERO_FILL (BTE_NOTIFY | IBCT_ZFIL_MODE)
 /* Use a reserved bit to let the caller specify a wait for any BTE */
-#define BTE_WACQUIRE (0x4000)
+#define BTE_WACQUIRE 0x4000
 /* Use the BTE on the node with the destination memory */
 #define BTE_USE_DEST (BTE_WACQUIRE << 1)
 /* Use any available BTE interface on any node for the transfer */
@@ -100,13 +100,28 @@
 #define BTE_LNSTAT_STORE(_bte, _x)                                      \
                         HUB_S(_bte->bte_base_addr, (_x))
 #define BTE_SRC_STORE(_bte, _x)                                         \
-                        HUB_S(_bte->bte_source_addr, (_x))
+({                                                                      \
+                u64 __addr = ((_x) & ~AS_MASK);                         \
+                if (is_shub2())                                         \
+                        __addr = SH2_TIO_PHYS_TO_DMA(__addr);           \
+                HUB_S(_bte->bte_source_addr, __addr);                   \
+})
 #define BTE_DEST_STORE(_bte, _x)                                        \
-                        HUB_S(_bte->bte_destination_addr, (_x))
+({                                                                      \
+                u64 __addr = ((_x) & ~AS_MASK);                         \
+                if (is_shub2())                                         \
+                        __addr = SH2_TIO_PHYS_TO_DMA(__addr);           \
+                HUB_S(_bte->bte_destination_addr, __addr);              \
+})
 #define BTE_CTRL_STORE(_bte, _x)                                        \
                         HUB_S(_bte->bte_control_addr, (_x))
 #define BTE_NOTIF_STORE(_bte, _x)                                       \
-                        HUB_S(_bte->bte_notify_addr, (_x))
+({                                                                      \
+                u64 __addr = ia64_tpa((_x) & ~AS_MASK);                 \
+                if (is_shub2())                                         \
+                        __addr = SH2_TIO_PHYS_TO_DMA(__addr);           \
+                HUB_S(_bte->bte_notify_addr, __addr);                   \
+})
 
 #define BTE_START_TRANSFER(_bte, _len, _mode)                           \
         is_shub2() ? BTE_CTRL_STORE(_bte, IBLS_BUSY | (_mode << 24) | _len) \
diff --git a/include/asm-ia64/sn/intr.h b/include/asm-ia64/sn/intr.h
index a3431372c6e7..60a51a406eec 100644
--- a/include/asm-ia64/sn/intr.h
+++ b/include/asm-ia64/sn/intr.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1992 - 1997, 2000-2004 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1992 - 1997, 2000-2006 Silicon Graphics, Inc. All rights reserved.
  */
 
 #ifndef _ASM_IA64_SN_INTR_H
@@ -11,26 +11,26 @@
 
 #include <linux/rcupdate.h>
 
-#define SGI_UART_VECTOR         (0xe9)
+#define SGI_UART_VECTOR         0xe9
 
 /* Reserved IRQs : Note, not to exceed IA64_SN2_FIRST_DEVICE_VECTOR */
-#define SGI_XPC_ACTIVATE                (0x30)
-#define SGI_II_ERROR                    (0x31)
-#define SGI_XBOW_ERROR                  (0x32)
-#define SGI_PCIASIC_ERROR               (0x33)
-#define SGI_ACPI_SCI_INT                (0x34)
-#define SGI_TIOCA_ERROR                 (0x35)
-#define SGI_TIO_ERROR                   (0x36)
-#define SGI_TIOCX_ERROR                 (0x37)
-#define SGI_MMTIMER_VECTOR              (0x38)
-#define SGI_XPC_NOTIFY                  (0xe7)
-
-#define IA64_SN2_FIRST_DEVICE_VECTOR    (0x3c)
-#define IA64_SN2_LAST_DEVICE_VECTOR     (0xe6)
-
-#define SN2_IRQ_RESERVED        (0x1)
-#define SN2_IRQ_CONNECTED       (0x2)
-#define SN2_IRQ_SHARED          (0x4)
+#define SGI_XPC_ACTIVATE        0x30
+#define SGI_II_ERROR            0x31
+#define SGI_XBOW_ERROR          0x32
+#define SGI_PCIASIC_ERROR       0x33
+#define SGI_ACPI_SCI_INT        0x34
+#define SGI_TIOCA_ERROR         0x35
+#define SGI_TIO_ERROR           0x36
+#define SGI_TIOCX_ERROR         0x37
+#define SGI_MMTIMER_VECTOR      0x38
+#define SGI_XPC_NOTIFY          0xe7
+
+#define IA64_SN2_FIRST_DEVICE_VECTOR    0x3c
+#define IA64_SN2_LAST_DEVICE_VECTOR     0xe6
+
+#define SN2_IRQ_RESERVED        0x1
+#define SN2_IRQ_CONNECTED       0x2
+#define SN2_IRQ_SHARED          0x4
 
 // The SN PROM irq struct
 struct sn_irq_info {
diff --git a/include/asm-ia64/sn/pcibr_provider.h b/include/asm-ia64/sn/pcibr_provider.h
index 9334078b089a..a601d3af39b6 100644
--- a/include/asm-ia64/sn/pcibr_provider.h
+++ b/include/asm-ia64/sn/pcibr_provider.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1992-1997,2000-2004 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1992-1997,2000-2006 Silicon Graphics, Inc. All rights reserved.
  */
 #ifndef _ASM_IA64_SN_PCI_PCIBR_PROVIDER_H
 #define _ASM_IA64_SN_PCI_PCIBR_PROVIDER_H
@@ -115,18 +115,6 @@ struct pcibus_info {
         spinlock_t              pbi_lock;
 };
 
-/*
- * pcibus_info structure locking macros
- */
-inline static unsigned long
-pcibr_lock(struct pcibus_info *pcibus_info)
-{
-        unsigned long flag;
-        spin_lock_irqsave(&pcibus_info->pbi_lock, flag);
-        return(flag);
-}
-#define pcibr_unlock(pcibus_info, flag)  spin_unlock_irqrestore(&pcibus_info->pbi_lock, flag)
-
 extern int  pcibr_init_provider(void);
 extern void *pcibr_bus_fixup(struct pcibus_bussoft *, struct pci_controller *);
 extern dma_addr_t pcibr_dma_map(struct pci_dev *, unsigned long, size_t);
diff --git a/include/asm-ia64/sn/sn_feature_sets.h b/include/asm-ia64/sn/sn_feature_sets.h
index 9ca642cad338..ff33e3bd3f8e 100644
--- a/include/asm-ia64/sn/sn_feature_sets.h
+++ b/include/asm-ia64/sn/sn_feature_sets.h
@@ -12,9 +12,6 @@
  */
 
 
-#include <asm/types.h>
-#include <asm/bitops.h>
-
 /* --------------------- PROM Features -----------------------------*/
 extern int sn_prom_feature_available(int id);
 
diff --git a/include/asm-ia64/sn/xpc.h b/include/asm-ia64/sn/xpc.h
index 0c36928ffd8b..df7f5f4f3cde 100644
--- a/include/asm-ia64/sn/xpc.h
+++ b/include/asm-ia64/sn/xpc.h
@@ -508,19 +508,24 @@ struct xpc_channel {
 #define XPC_C_OPENREQUEST       0x00000010 /* local open channel request */
 
 #define XPC_C_SETUP             0x00000020 /* channel's msgqueues are alloc'd */
-#define XPC_C_CONNECTCALLOUT    0x00000040 /* channel connected callout made */
-#define XPC_C_CONNECTED         0x00000080 /* local channel is connected */
-#define XPC_C_CONNECTING        0x00000100 /* channel is being connected */
-
-#define XPC_C_RCLOSEREPLY       0x00000200 /* remote close channel reply */
-#define XPC_C_CLOSEREPLY        0x00000400 /* local close channel reply */
-#define XPC_C_RCLOSEREQUEST     0x00000800 /* remote close channel request */
-#define XPC_C_CLOSEREQUEST      0x00001000 /* local close channel request */
-
-#define XPC_C_DISCONNECTED      0x00002000 /* channel is disconnected */
-#define XPC_C_DISCONNECTING     0x00004000 /* channel is being disconnected */
-#define XPC_C_DISCONNECTCALLOUT 0x00008000 /* chan disconnected callout made */
-#define XPC_C_WDISCONNECT       0x00010000 /* waiting for channel disconnect */
+#define XPC_C_CONNECTEDCALLOUT  0x00000040 /* connected callout initiated */
+#define XPC_C_CONNECTEDCALLOUT_MADE \
+                                0x00000080 /* connected callout completed */
+#define XPC_C_CONNECTED         0x00000100 /* local channel is connected */
+#define XPC_C_CONNECTING        0x00000200 /* channel is being connected */
+
+#define XPC_C_RCLOSEREPLY       0x00000400 /* remote close channel reply */
+#define XPC_C_CLOSEREPLY        0x00000800 /* local close channel reply */
+#define XPC_C_RCLOSEREQUEST     0x00001000 /* remote close channel request */
+#define XPC_C_CLOSEREQUEST      0x00002000 /* local close channel request */
+
+#define XPC_C_DISCONNECTED      0x00004000 /* channel is disconnected */
+#define XPC_C_DISCONNECTING     0x00008000 /* channel is being disconnected */
+#define XPC_C_DISCONNECTINGCALLOUT \
+                                0x00010000 /* disconnecting callout initiated */
+#define XPC_C_DISCONNECTINGCALLOUT_MADE \
+                                0x00020000 /* disconnecting callout completed */
+#define XPC_C_WDISCONNECT       0x00040000 /* waiting for channel disconnect */
 
 
 
diff --git a/include/asm-ia64/system.h b/include/asm-ia64/system.h
index 80c5a234e259..062538715623 100644
--- a/include/asm-ia64/system.h
+++ b/include/asm-ia64/system.h
@@ -249,32 +249,7 @@ extern void ia64_load_extra (struct task_struct *task);
 # define switch_to(prev,next,last)      __switch_to(prev, next, last)
 #endif
 
-/*
- * On IA-64, we don't want to hold the runqueue's lock during the low-level context-switch,
- * because that could cause a deadlock.  Here is an example by Erich Focht:
- *
- * Example:
- * CPU#0:
- * schedule()
- *    -> spin_lock_irq(&rq->lock)
- *    -> context_switch()
- *       -> wrap_mmu_context()
- *          -> read_lock(&tasklist_lock)
- *
- * CPU#1:
- * sys_wait4() or release_task() or forget_original_parent()
- *    -> write_lock(&tasklist_lock)
- *    -> do_notify_parent()
- *       -> wake_up_parent()
- *          -> try_to_wake_up()
- *             -> spin_lock_irq(&parent_rq->lock)
- *
- * If the parent's rq happens to be on CPU#0, we'll wait for the rq->lock
- * of that CPU which will not be released, because there we wait for the
- * tasklist_lock to become available.
- */
 #define __ARCH_WANT_UNLOCKED_CTXSW
-
 #define ARCH_HAS_PREFETCH_SWITCH_STACK
 #define ia64_platform_is(x) (strcmp(x, platform_name) == 0)
 
diff --git a/include/asm-ia64/timex.h b/include/asm-ia64/timex.h
index 414aae060440..05a6baf8a472 100644
--- a/include/asm-ia64/timex.h
+++ b/include/asm-ia64/timex.h
@@ -15,6 +15,8 @@
 
 typedef unsigned long cycles_t;
 
+extern void (*ia64_udelay)(unsigned long usecs);
+
 /*
  * For performance reasons, we don't want to define CLOCK_TICK_TRATE as
  * local_cpu_data->itc_rate.  Fortunately, we don't have to, either: according to George
diff --git a/include/asm-ia64/unistd.h b/include/asm-ia64/unistd.h
index 962f9bd1bdff..019956c613e4 100644
--- a/include/asm-ia64/unistd.h
+++ b/include/asm-ia64/unistd.h
@@ -270,12 +270,27 @@
 #define __NR_inotify_add_watch          1278
 #define __NR_inotify_rm_watch           1279
 #define __NR_migrate_pages              1280
+#define __NR_openat                     1281
+#define __NR_mkdirat                    1282
+#define __NR_mknodat                    1283
+#define __NR_fchownat                   1284
+#define __NR_futimesat                  1285
+#define __NR_newfstatat                 1286
+#define __NR_unlinkat                   1287
+#define __NR_renameat                   1288
+#define __NR_linkat                     1289
+#define __NR_symlinkat                  1290
+#define __NR_readlinkat                 1291
+#define __NR_fchmodat                   1292
+#define __NR_faccessat                  1293
+/* 1294, 1295 reserved for pselect/ppoll */
+#define __NR_unshare                    1296
 
 #ifdef __KERNEL__
 
 #include <linux/config.h>
 
-#define NR_syscalls                     270 /* length of syscall table */
+#define NR_syscalls                     273 /* length of syscall table */
 
 #define __ARCH_WANT_SYS_RT_SIGACTION
 
diff --git a/include/asm-m32r/mman.h b/include/asm-m32r/mman.h
index 12e29747bc84..695a860c024f 100644
--- a/include/asm-m32r/mman.h
+++ b/include/asm-m32r/mman.h
@@ -1,21 +1,9 @@
 #ifndef __M32R_MMAN_H__
 #define __M32R_MMAN_H__
 
-/* orig : i386 2.6.0-test6 */
-
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
+#include <asm-generic/mman.h>
 
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+/* orig : i386 2.6.0-test6 */
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -25,22 +13,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __M32R_MMAN_H__ */
diff --git a/include/asm-m32r/system.h b/include/asm-m32r/system.h
index 06c12a037cba..d6a2c613be68 100644
--- a/include/asm-m32r/system.h
+++ b/include/asm-m32r/system.h
@@ -239,7 +239,7 @@ __cmpxchg_u32(volatile unsigned int *p, unsigned int old, unsigned int new)
                 "       bra     2f;             \n"
                 "       .fillinsn               \n"
                 "1:"
-                        M32R_UNLOCK" %2, @%1;   \n"
+                        M32R_UNLOCK" %0, @%1;   \n"
                 "       .fillinsn               \n"
                 "2:"
                         : "=&r" (retval)
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index 0da7c47d2f01..e8ae61956a51 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -328,7 +328,7 @@ extern void __put_user_bad(void);
                 "       .long 1b,4b\n"                                  \
                 "       .long 2b,4b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                             \
                 : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                 : "r14", "memory")
 
@@ -353,7 +353,7 @@ extern void __put_user_bad(void);
                 "       .long 1b,4b\n"                                  \
                 "       .long 2b,4b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                            \
                 : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                 : "r14", "memory")
 #else
@@ -398,7 +398,7 @@ struct __large_struct { unsigned long buf[100]; };
                 "       .balign 4\n"                                    \
                 "       .long 1b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                            \
                 : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                 : "r14", "memory")
 
@@ -442,7 +442,7 @@ do {									\
                 "       .balign 4\n"                                    \
                 "       .long 1b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err), "=&r"(x)                                   \
+                : "=&r"(err), "=&r"(x)                                  \
                 : "r"(addr), "i"(-EFAULT), "0"(err)                     \
                 : "r14", "memory")
 
diff --git a/include/asm-m68k/atomic.h b/include/asm-m68k/atomic.h
index a4a84d5c65d5..862e497c2645 100644
--- a/include/asm-m68k/atomic.h
+++ b/include/asm-m68k/atomic.h
@@ -55,6 +55,7 @@ static inline int atomic_inc_and_test(atomic_t *v)
 }
 
 #ifdef CONFIG_RMW_INSNS
+
 static inline int atomic_add_return(int i, atomic_t *v)
 {
         int t, tmp;
@@ -82,7 +83,12 @@ static inline int atomic_sub_return(int i, atomic_t *v)
                         : "g" (i), "2" (atomic_read(v)));
         return t;
 }
+
+#define atomic_cmpxchg(v, o, n) ((int)cmpxchg(&((v)->counter), (o), (n)))
+#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+
 #else /* !CONFIG_RMW_INSNS */
+
 static inline int atomic_add_return(int i, atomic_t * v)
 {
         unsigned long flags;
@@ -110,6 +116,32 @@ static inline int atomic_sub_return(int i, atomic_t * v)
 
         return t;
 }
+
+static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
+{
+        unsigned long flags;
+        int prev;
+
+        local_irq_save(flags);
+        prev = atomic_read(v);
+        if (prev == old)
+                atomic_set(v, new);
+        local_irq_restore(flags);
+        return prev;
+}
+
+static inline int atomic_xchg(atomic_t *v, int new)
+{
+        unsigned long flags;
+        int prev;
+
+        local_irq_save(flags);
+        prev = atomic_read(v);
+        atomic_set(v, new);
+        local_irq_restore(flags);
+        return prev;
+}
+
 #endif /* !CONFIG_RMW_INSNS */
 
 #define atomic_dec_return(v)    atomic_sub_return(1, (v))
@@ -139,9 +171,6 @@ static inline void atomic_set_mask(unsigned long mask, unsigned long *v)
         __asm__ __volatile__("orl %1,%0" : "+m" (*v) : "id" (mask));
 }
 
-#define atomic_cmpxchg(v, o, n) ((int)cmpxchg(&((v)->counter), (o), (n)))
-#define atomic_xchg(v, new) (xchg(&((v)->counter), new))
-
 #define atomic_add_unless(v, a, u)                              \
 ({                                                              \
         int c, old;                                             \
diff --git a/include/asm-m68k/irq.h b/include/asm-m68k/irq.h
index 325c86f8512d..9ac047c400c4 100644
--- a/include/asm-m68k/irq.h
+++ b/include/asm-m68k/irq.h
@@ -79,7 +79,7 @@ static __inline__ int irq_canonicalize(int irq)
 
 extern void (*enable_irq)(unsigned int);
 extern void (*disable_irq)(unsigned int);
-#define enable_irq_nosync       enable_irq
+#define disable_irq_nosync      disable_irq
 
 struct pt_regs;
 
diff --git a/include/asm-m68k/mman.h b/include/asm-m68k/mman.h
index ea262ab88b3b..1626d37f4898 100644
--- a/include/asm-m68k/mman.h
+++ b/include/asm-m68k/mman.h
@@ -1,19 +1,7 @@
 #ifndef __M68K_MMAN_H__
 #define __M68K_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,22 +11,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __M68K_MMAN_H__ */
diff --git a/include/asm-m68k/raw_io.h b/include/asm-m68k/raw_io.h
index 5439bcaa57c6..811ccd25d4a6 100644
--- a/include/asm-m68k/raw_io.h
+++ b/include/asm-m68k/raw_io.h
@@ -336,6 +336,7 @@ static inline void raw_outsw_swapw(volatile u16 __iomem *port, const u16 *buf,
                 : "d0", "a0", "a1", "d6");
 }
 
+#define __raw_writel raw_outl
 
 #endif /* __KERNEL__ */
 
diff --git a/include/asm-m68knommu/hardirq.h b/include/asm-m68knommu/hardirq.h
index e8659e739a64..476180f4cba2 100644
--- a/include/asm-m68knommu/hardirq.h
+++ b/include/asm-m68knommu/hardirq.h
@@ -4,6 +4,7 @@
 #include <linux/config.h>
 #include <linux/cache.h>
 #include <linux/threads.h>
+#include <asm/irq.h>
 
 typedef struct {
         unsigned int __softirq_pending;
diff --git a/include/asm-mips/abi.h b/include/asm-mips/abi.h
index 2e7e651c3e3f..1ce0518ace2e 100644
--- a/include/asm-mips/abi.h
+++ b/include/asm-mips/abi.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2005 by Ralf Baechle
+ * Copyright (C) 2005, 06 by Ralf Baechle (ralf@linux-mips.org)
  * Copyright (C) 2005 MIPS Technologies, Inc.
  */
 #ifndef _ASM_ABI_H
@@ -13,7 +13,7 @@
 #include <asm/siginfo.h>
 
 struct mips_abi {
-        int (* const do_signal)(sigset_t *oldset, struct pt_regs *regs);
+        void (* const do_signal)(struct pt_regs *regs);
         int (* const setup_frame)(struct k_sigaction * ka,
                                   struct pt_regs *regs, int signr,
                                   sigset_t *set);
diff --git a/include/asm-mips/atomic.h b/include/asm-mips/atomic.h
index 654b97d3e13a..2c8b853376c9 100644
--- a/include/asm-mips/atomic.h
+++ b/include/asm-mips/atomic.h
@@ -250,7 +250,10 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
                 "       subu    %0, %1, %3                              \n"
                 "       bltz    %0, 1f                                  \n"
                 "       sc      %0, %2                                  \n"
+                "       .set    noreorder                               \n"
                 "       beqzl   %0, 1b                                  \n"
+                "        subu   %0, %1, %3                              \n"
+                "       .set    reorder                                 \n"
                 "       sync                                            \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
@@ -266,7 +269,10 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
                 "       subu    %0, %1, %3                              \n"
                 "       bltz    %0, 1f                                  \n"
                 "       sc      %0, %2                                  \n"
+                "       .set    noreorder                               \n"
                 "       beqz    %0, 1b                                  \n"
+                "        subu   %0, %1, %3                              \n"
+                "       .set    reorder                                 \n"
                 "       sync                                            \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
@@ -598,7 +604,10 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
                 "       dsubu   %0, %1, %3                              \n"
                 "       bltz    %0, 1f                                  \n"
                 "       scd     %0, %2                                  \n"
+                "       .set    noreorder                               \n"
                 "       beqzl   %0, 1b                                  \n"
+                "        dsubu  %0, %1, %3                              \n"
+                "       .set    reorder                                 \n"
                 "       sync                                            \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
@@ -614,7 +623,10 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
                 "       dsubu   %0, %1, %3                              \n"
                 "       bltz    %0, 1f                                  \n"
                 "       scd     %0, %2                                  \n"
+                "       .set    noreorder                               \n"
                 "       beqz    %0, 1b                                  \n"
+                "        dsubu  %0, %1, %3                              \n"
+                "       .set    reorder                                 \n"
                 "       sync                                            \n"
                 "1:                                                     \n"
                 "       .set    mips0                                   \n"
diff --git a/include/asm-mips/bitops.h b/include/asm-mips/bitops.h
index 3b0c8aaf6e8b..8e802059fe67 100644
--- a/include/asm-mips/bitops.h
+++ b/include/asm-mips/bitops.h
@@ -644,20 +644,26 @@ static inline unsigned long ffz(unsigned long word)
 }
 
 /*
- * flz - find last zero in word.
+ * fls - find last bit set.
  * @word: The word to search
  *
- * Returns 0..SZLONG-1
- * Undefined if no zero exists, so code should check against ~0UL first.
+ * Returns 1..SZLONG
+ * Returns 0 if no bit exists
  */
-static inline unsigned long flz(unsigned long word)
+static inline unsigned long fls(unsigned long word)
 {
-#if defined(CONFIG_CPU_MIPS32) || defined(CONFIG_CPU_MIPS64)
-        return __ilog2(~word);
-#else
 #ifdef CONFIG_32BIT
-        int r = 31, s;
-        word = ~word;
+#ifdef CONFIG_CPU_MIPS32
+        __asm__ ("clz %0, %1" : "=r" (word) : "r" (word));
+
+        return 32 - word;
+#else
+        {
+        int r = 32, s;
+
+        if (word == 0)
+                return 0;
+
         s = 16; if ((word & 0xffff0000)) s = 0; r -= s; word <<= s;
         s = 8;  if ((word & 0xff000000)) s = 0; r -= s; word <<= s;
         s = 4;  if ((word & 0xf0000000)) s = 0; r -= s; word <<= s;
@@ -665,10 +671,23 @@ static inline unsigned long flz(unsigned long word)
         s = 1;  if ((word & 0x80000000)) s = 0; r -= s;
 
         return r;
+        }
 #endif
+#endif /* CONFIG_32BIT */
+
 #ifdef CONFIG_64BIT
-        int r = 63, s;
-        word = ~word;
+#ifdef CONFIG_CPU_MIPS64
+
+        __asm__ ("dclz %0, %1" : "=r" (word) : "r" (word));
+
+        return 64 - word;
+#else
+        {
+        int r = 64, s;
+
+        if (word == 0)
+                return 0;
+
         s = 32; if ((word & 0xffffffff00000000UL)) s = 0; r -= s; word <<= s;
         s = 16; if ((word & 0xffff000000000000UL)) s = 0; r -= s; word <<= s;
         s = 8;  if ((word & 0xff00000000000000UL)) s = 0; r -= s; word <<= s;
@@ -677,24 +696,11 @@ static inline unsigned long flz(unsigned long word)
         s = 1;  if ((word & 0x8000000000000000UL)) s = 0; r -= s;
 
         return r;
+        }
 #endif
-#endif
+#endif /* CONFIG_64BIT */
 }
 
-/*
- * fls - find last bit set.
- * @word: The word to search
- *
- * Returns 1..SZLONG
- * Returns 0 if no bit exists
- */
-static inline unsigned long fls(unsigned long word)
-{
-        if (word == 0)
-                return 0;
-
-        return flz(~word) + 1;
-}
 #define fls64(x)   generic_fls64(x)
 
 /*
diff --git a/include/asm-mips/byteorder.h b/include/asm-mips/byteorder.h
index d1fe9e5c62e4..584f8128fffd 100644
--- a/include/asm-mips/byteorder.h
+++ b/include/asm-mips/byteorder.h
@@ -8,10 +8,39 @@
 #ifndef _ASM_BYTEORDER_H
 #define _ASM_BYTEORDER_H
 
+#include <linux/config.h>
+#include <linux/compiler.h>
 #include <asm/types.h>
 
 #ifdef __GNUC__
 
+#ifdef CONFIG_CPU_MIPSR2
+
+static __inline__ __attribute_const__ __u16 ___arch__swab16(__u16 x)
+{
+        __asm__(
+        "       wsbh    %0, %1                  \n"
+        : "=r" (x)
+        : "r" (x));
+
+        return x;
+}
+#define __arch__swab16(x)       ___arch__swab16(x)
+
+static __inline__ __attribute_const__ __u32 ___arch__swab32(__u32 x)
+{
+        __asm__(
+        "       wsbh    %0, %1                  \n"
+        "       rotr    %0, %0, 16              \n"
+        : "=r" (x)
+        : "r" (x));
+
+        return x;
+}
+#define __arch__swab32(x)       ___arch__swab32(x)
+
+#endif /* CONFIG_CPU_MIPSR2 */
+
 #if !defined(__STRICT_ANSI__) || defined(__KERNEL__)
 #  define __BYTEORDER_HAS_U64__
 #  define __SWAB_64_THRU_32__
diff --git a/include/asm-mips/cacheflush.h b/include/asm-mips/cacheflush.h
index a18ba2edc0b6..aeae9fabf4a9 100644
--- a/include/asm-mips/cacheflush.h
+++ b/include/asm-mips/cacheflush.h
@@ -49,8 +49,7 @@ static inline void flush_dcache_page(struct page *page)
 
 extern void (*flush_icache_page)(struct vm_area_struct *vma,
         struct page *page);
-extern void (*flush_icache_range)(unsigned long __user start,
-        unsigned long __user end);
+extern void (*flush_icache_range)(unsigned long start, unsigned long end);
 #define flush_cache_vmap(start, end)            flush_cache_all()
 #define flush_cache_vunmap(start, end)          flush_cache_all()
 
diff --git a/include/asm-mips/cpu-features.h b/include/asm-mips/cpu-features.h
index 78c9cc2735d5..3f2b6d9ac45e 100644
--- a/include/asm-mips/cpu-features.h
+++ b/include/asm-mips/cpu-features.h
@@ -96,6 +96,9 @@
 #ifndef cpu_has_ic_fills_f_dc
 #define cpu_has_ic_fills_f_dc   (cpu_data[0].icache.flags & MIPS_CACHE_IC_F_DC)
 #endif
+#ifndef cpu_has_pindexed_dcache
+#define cpu_has_pindexed_dcache (cpu_data[0].dcache.flags & MIPS_CACHE_PINDEX)
+#endif
 
 /*
  * I-Cache snoops remote store.  This only matters on SMP.  Some multiprocessors
diff --git a/include/asm-mips/cpu-info.h b/include/asm-mips/cpu-info.h
index d5cf519f8fcc..140be1c67da7 100644
--- a/include/asm-mips/cpu-info.h
+++ b/include/asm-mips/cpu-info.h
@@ -39,6 +39,7 @@ struct cache_desc {
 #define MIPS_CACHE_ALIASES      0x00000004      /* Cache could have aliases */
 #define MIPS_CACHE_IC_F_DC      0x00000008      /* Ic can refill from D-cache */
 #define MIPS_IC_SNOOPS_REMOTE   0x00000010      /* Ic snoops remote stores */
+#define MIPS_CACHE_PINDEX       0x00000020      /* Physically indexed cache */
 
 struct cpuinfo_mips {
         unsigned long           udelay_val;
diff --git a/include/asm-mips/cpu.h b/include/asm-mips/cpu.h
index 934e063e79f1..818b9a97e214 100644
--- a/include/asm-mips/cpu.h
+++ b/include/asm-mips/cpu.h
@@ -204,9 +204,9 @@
  */
 #define MIPS_CPU_ISA_I          0x00000001
 #define MIPS_CPU_ISA_II         0x00000002
-#define MIPS_CPU_ISA_III        0x00000003
-#define MIPS_CPU_ISA_IV         0x00000004
-#define MIPS_CPU_ISA_V          0x00000005
+#define MIPS_CPU_ISA_III        0x00000004
+#define MIPS_CPU_ISA_IV         0x00000008
+#define MIPS_CPU_ISA_V          0x00000010
 #define MIPS_CPU_ISA_M32R1      0x00000020
 #define MIPS_CPU_ISA_M32R2      0x00000040
 #define MIPS_CPU_ISA_M64R1      0x00000080
diff --git a/include/asm-mips/gcc/sgidefs.h b/include/asm-mips/gcc/sgidefs.h
deleted file mode 100644
index 05994371a2af..000000000000
--- a/include/asm-mips/gcc/sgidefs.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * include/sgidefs.h
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 1996 by Ralf Baechle
- *
- * This file is here to satisfy GCC's expectations.
- */
-#ifndef __SGIDEFS_H
-#define __SGIDEFS_H
-
-#include <asm/sgidefs.h>
-
-#endif /* __SGIDEFS_H */
diff --git a/include/asm-mips/hazards.h b/include/asm-mips/hazards.h
index 2fc90632f88c..feb29a793888 100644
--- a/include/asm-mips/hazards.h
+++ b/include/asm-mips/hazards.h
@@ -3,7 +3,9 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2003, 2004 Ralf Baechle
+ * Copyright (C) 2003, 2004 Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) MIPS Technologies, Inc.
+ *   written by Ralf Baechle <ralf@linux-mips.org>
  */
 #ifndef _ASM_HAZARDS_H
 #define _ASM_HAZARDS_H
@@ -74,8 +76,7 @@
 #define irq_disable_hazard
         _ehb
 
-#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000) || \
-      defined(CONFIG_CPU_SB1)
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000)
 
 /*
  * R10000 rocks - all hazards handled in hardware, so this becomes a nobrainer.
@@ -99,13 +100,13 @@
 #else /* __ASSEMBLY__ */
 
 __asm__(
-        "       .macro  _ssnop                                  \n\t"
-        "       sll     $0, $2, 1                               \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro  _ehb                                    \n\t"
-        "       sll     $0, $0, 3                               \n\t"
-        "       .endm                                           \n\t");
+        "       .macro  _ssnop                                  \n"
+        "       sll     $0, $0, 1                               \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro  _ehb                                    \n"
+        "       sll     $0, $0, 3                               \n"
+        "       .endm                                           \n");
 
 #ifdef CONFIG_CPU_RM9000
 
@@ -117,17 +118,21 @@ __asm__(
 
 #define mtc0_tlbw_hazard()                                              \
         __asm__ __volatile__(                                           \
-                ".set\tmips32\n\t"                                      \
-                "_ssnop; _ssnop; _ssnop; _ssnop\n\t"                    \
-                ".set\tmips0")
+        "       .set    mips32                                  \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       .set    mips0                                   \n")
 
 #define tlbw_use_hazard()                                               \
         __asm__ __volatile__(                                           \
-                ".set\tmips32\n\t"                                      \
-                "_ssnop; _ssnop; _ssnop; _ssnop\n\t"                    \
-                ".set\tmips0")
-
-#define back_to_back_c0_hazard()        do { } while (0)
+        "       .set    mips32                                  \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       _ssnop                                          \n"     \
+        "       .set    mips0                                   \n")
 
 #else
 
@@ -136,15 +141,25 @@ __asm__(
  */
 #define mtc0_tlbw_hazard()                                              \
         __asm__ __volatile__(                                           \
-                ".set noreorder\n\t"                                    \
-                "nop; nop; nop; nop; nop; nop;\n\t"                     \
-                ".set reorder\n\t")
+        "       .set    noreorder                               \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       .set    reorder                                 \n")
 
 #define tlbw_use_hazard()                                               \
         __asm__ __volatile__(                                           \
-                ".set noreorder\n\t"                                    \
-                "nop; nop; nop; nop; nop; nop;\n\t"                     \
-                ".set reorder\n\t")
+        "       .set    noreorder                               \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       nop                                             \n"     \
+        "       .set    reorder                                 \n")
 
 #endif
 
@@ -156,49 +171,26 @@ __asm__(
 
 #ifdef CONFIG_CPU_MIPSR2
 
-__asm__(
-        "       .macro\tirq_enable_hazard                       \n\t"
-        "       _ehb                                            \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tirq_disable_hazard                      \n\t"
-        "       _ehb                                            \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tback_to_back_c0_hazard                  \n\t"
-        "       _ehb                                            \n\t"
-        "       .endm");
-
-#define irq_enable_hazard()                                             \
-        __asm__ __volatile__(                                           \
-        "irq_enable_hazard")
+__asm__("       .macro  irq_enable_hazard                       \n"
+        "       _ehb                                            \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro  irq_disable_hazard                      \n"
+        "       _ehb                                            \n"
+        "       .endm                                           \n");
 
-#define irq_disable_hazard()                                            \
-        __asm__ __volatile__(                                           \
-        "irq_disable_hazard")
-
-#define back_to_back_c0_hazard()                                        \
-        __asm__ __volatile__(                                           \
-        "back_to_back_c0_hazard")
-
-#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000) || \
-      defined(CONFIG_CPU_SB1)
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000)
 
 /*
  * R10000 rocks - all hazards handled in hardware, so this becomes a nobrainer.
  */
 
 __asm__(
-        "       .macro\tirq_enable_hazard                       \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tirq_disable_hazard                      \n\t"
-        "       .endm");
-
-#define irq_enable_hazard()     do { } while (0)
-#define irq_disable_hazard()    do { } while (0)
-
-#define back_to_back_c0_hazard()        do { } while (0)
+        "       .macro  irq_enable_hazard                       \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro  irq_disable_hazard                      \n"
+        "       .endm                                           \n");
 
 #else
 
@@ -209,29 +201,63 @@ __asm__(
  */
 
 __asm__(
-        "       #                                               \n\t"
-        "       # There is a hazard but we do not care          \n\t"
-        "       #                                               \n\t"
-        "       .macro\tirq_enable_hazard                       \n\t"
-        "       .endm                                           \n\t"
-        "                                                       \n\t"
-        "       .macro\tirq_disable_hazard                      \n\t"
-        "       _ssnop; _ssnop; _ssnop                          \n\t"
-        "       .endm");
+        "       #                                               \n"
+        "       # There is a hazard but we do not care          \n"
+        "       #                                               \n"
+        "       .macro\tirq_enable_hazard                       \n"
+        "       .endm                                           \n"
+        "                                                       \n"
+        "       .macro\tirq_disable_hazard                      \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       .endm                                           \n");
 
-#define irq_enable_hazard()     do { } while (0)
+#endif
+
+#define irq_enable_hazard()                                             \
+        __asm__ __volatile__("irq_enable_hazard")
 #define irq_disable_hazard()                                            \
-        __asm__ __volatile__(                                           \
-        "irq_disable_hazard")
+        __asm__ __volatile__("irq_disable_hazard")
 
-#define back_to_back_c0_hazard()                                        \
-        __asm__ __volatile__(                                           \
-        "       .set noreorder                          \n"             \
-        "       nop; nop; nop                           \n"             \
-        "       .set reorder                            \n")
+
+/*
+ * Back-to-back hazards -
+ *
+ * What is needed to separate a move to cp0 from a subsequent read from the
+ * same cp0 register?
+ */
+#ifdef CONFIG_CPU_MIPSR2
+
+__asm__("       .macro  back_to_back_c0_hazard                  \n"
+        "       _ehb                                            \n"
+        "       .endm                                           \n");
+
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_RM9000) || \
+      defined(CONFIG_CPU_SB1)
+
+__asm__("       .macro  back_to_back_c0_hazard                  \n"
+        "       .endm                                           \n");
+
+#else
+
+__asm__("       .macro  back_to_back_c0_hazard                  \n"
+        "       .set    noreorder                               \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       _ssnop                                          \n"
+        "       .set    reorder                                 \n"
+        "       .endm");
 
 #endif
 
+#define back_to_back_c0_hazard()                                        \
+        __asm__ __volatile__("back_to_back_c0_hazard")
+
+
+/*
+ * Instruction execution hazard
+ */
 #ifdef CONFIG_CPU_MIPSR2
 /*
  * gcc has a tradition of misscompiling the previous construct using the
diff --git a/include/asm-mips/interrupt.h b/include/asm-mips/interrupt.h
index abdf54ee64cf..774348734fa0 100644
--- a/include/asm-mips/interrupt.h
+++ b/include/asm-mips/interrupt.h
@@ -47,6 +47,17 @@ static inline void local_irq_enable(void)
  * R4000/R4400 need three nops, the R4600 two nops and the R10000 needs
  * no nops at all.
  */
+/*
+ * For TX49, operating only IE bit is not enough.
+ *
+ * If mfc0 $12 follows store and the mfc0 is last instruction of a
+ * page and fetching the next instruction causes TLB miss, the result
+ * of the mfc0 might wrongly contain EXL bit.
+ *
+ * ERT-TX49H2-027, ERT-TX49H3-012, ERT-TX49HL3-006, ERT-TX49H4-008
+ *
+ * Workaround: mask EXL bit of the result or place a nop before mfc0.
+ */
 __asm__ (
         "       .macro  local_irq_disable\n"
         "       .set    push                                            \n"
@@ -55,8 +66,8 @@ __asm__ (
         "       di                                                      \n"
 #else
         "       mfc0    $1,$12                                          \n"
-        "       ori     $1,1                                            \n"
-        "       xori    $1,1                                            \n"
+        "       ori     $1,0x1f                                         \n"
+        "       xori    $1,0x1f                                         \n"
         "       .set    noreorder                                       \n"
         "       mtc0    $1,$12                                          \n"
 #endif
@@ -96,8 +107,8 @@ __asm__ (
         "       andi    \\result, 1                                     \n"
 #else
         "       mfc0    \\result, $12                                   \n"
-        "       ori     $1, \\result, 1                                 \n"
-        "       xori    $1, 1                                           \n"
+        "       ori     $1, \\result, 0x1f                              \n"
+        "       xori    $1, 0x1f                                        \n"
         "       .set    noreorder                                       \n"
         "       mtc0    $1, $12                                         \n"
 #endif
@@ -114,6 +125,7 @@ __asm__ __volatile__(							\
 
 __asm__ (
         "       .macro  local_irq_restore flags                         \n"
+        "       .set    push                                            \n"
         "       .set    noreorder                                       \n"
         "       .set    noat                                            \n"
 #if defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
@@ -135,14 +147,13 @@ __asm__ (
 #else
         "       mfc0    $1, $12                                         \n"
         "       andi    \\flags, 1                                      \n"
-        "       ori     $1, 1                                           \n"
-        "       xori    $1, 1                                           \n"
+        "       ori     $1, 0x1f                                        \n"
+        "       xori    $1, 0x1f                                        \n"
         "       or      \\flags, $1                                     \n"
         "       mtc0    \\flags, $12                                    \n"
 #endif
         "       irq_disable_hazard                                      \n"
-        "       .set    at                                              \n"
-        "       .set    reorder                                         \n"
+        "       .set    pop                                             \n"
         "       .endm                                                   \n");
 
 #define local_irq_restore(flags)                                        \
diff --git a/include/asm-mips/io.h b/include/asm-mips/io.h
index d42685747e7d..ba1d7bbc15d2 100644
--- a/include/asm-mips/io.h
+++ b/include/asm-mips/io.h
@@ -4,7 +4,7 @@
  * for more details.
  *
  * Copyright (C) 1994, 1995 Waldorf GmbH
- * Copyright (C) 1994 - 2000 Ralf Baechle
+ * Copyright (C) 1994 - 2000, 06 Ralf Baechle
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  * Copyright (C) 2004, 2005  MIPS Technologies, Inc.  All rights reserved.
  *      Author: Maciej W. Rozycki <macro@mips.com>
@@ -18,7 +18,6 @@
 #include <linux/types.h>
 
 #include <asm/addrspace.h>
-#include <asm/bug.h>
 #include <asm/byteorder.h>
 #include <asm/cpu.h>
 #include <asm/cpu-features.h>
@@ -57,38 +56,38 @@
  * variations of functions: non-prefixed ones that preserve the value
  * and prefixed ones that preserve byte addresses.  The latters are
  * typically used for moving raw data between a peripheral and memory (cf.
- * string I/O functions), hence the "mem_" prefix.
+ * string I/O functions), hence the "__mem_" prefix.
  */
 #if defined(CONFIG_SWAP_IO_SPACE)
 
 # define ioswabb(x)             (x)
-# define mem_ioswabb(x)         (x)
+# define __mem_ioswabb(x)       (x)
 # ifdef CONFIG_SGI_IP22
 /*
  * IP22 seems braindead enough to swap 16bits values in hardware, but
  * not 32bits.  Go figure... Can't tell without documentation.
  */
 #  define ioswabw(x)            (x)
-#  define mem_ioswabw(x)        le16_to_cpu(x)
+#  define __mem_ioswabw(x)      le16_to_cpu(x)
 # else
 #  define ioswabw(x)            le16_to_cpu(x)
-#  define mem_ioswabw(x)        (x)
+#  define __mem_ioswabw(x)      (x)
 # endif
 # define ioswabl(x)             le32_to_cpu(x)
-# define mem_ioswabl(x)         (x)
+# define __mem_ioswabl(x)       (x)
 # define ioswabq(x)             le64_to_cpu(x)
-# define mem_ioswabq(x)         (x)
+# define __mem_ioswabq(x)       (x)
 
 #else
 
 # define ioswabb(x)             (x)
-# define mem_ioswabb(x)         (x)
+# define __mem_ioswabb(x)       (x)
 # define ioswabw(x)             (x)
-# define mem_ioswabw(x)         cpu_to_le16(x)
+# define __mem_ioswabw(x)       cpu_to_le16(x)
 # define ioswabl(x)             (x)
-# define mem_ioswabl(x)         cpu_to_le32(x)
+# define __mem_ioswabl(x)       cpu_to_le32(x)
 # define ioswabq(x)             (x)
-# define mem_ioswabq(x)         cpu_to_le32(x)
+# define __mem_ioswabq(x)       cpu_to_le32(x)
 
 #endif
 
@@ -104,8 +103,20 @@
  */
 extern const unsigned long mips_io_port_base;
 
-#define set_io_port_base(base)  \
-        do { * (unsigned long *) &mips_io_port_base = (base); } while (0)
+/*
+ * Gcc will generate code to load the value of mips_io_port_base after each
+ * function call which may be fairly wasteful in some cases.  So we don't
+ * play quite by the book.  We tell gcc mips_io_port_base is a long variable
+ * which solves the code generation issue.  Now we need to violate the
+ * aliasing rules a little to make initialization possible and finally we
+ * will need the barrier() to fight side effects of the aliasing chat.
+ * This trickery will eventually collapse under gcc's optimizer.  Oh well.
+ */
+static inline void set_io_port_base(unsigned long base)
+{
+        * (unsigned long *) &mips_io_port_base = base;
+        barrier();
+}
 
 /*
  * Thanks to James van Artsdalen for a better timing-fix than
@@ -284,6 +295,24 @@ static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
         __ioremap_mode((offset), (size), _CACHE_UNCACHED)
 
 /*
+ * ioremap_cachable -   map bus memory into CPU space
+ * @offset:         bus address of the memory
+ * @size:           size of the resource to map
+ *
+ * ioremap_nocache performs a platform specific sequence of operations to
+ * make bus memory CPU accessible via the readb/readw/readl/writeb/
+ * writew/writel functions and the other mmio helpers. The returned
+ * address is not guaranteed to be usable directly as a virtual
+ * address.
+ *
+ * This version of ioremap ensures that the memory is marked cachable by
+ * the CPU.  Also enables full write-combining.  Useful for some
+ * memory-like regions on I/O busses.
+ */
+#define ioremap_cachable(offset, size)                                  \
+        __ioremap_mode((offset), (size), PAGE_CACHABLE_DEFAULT)
+
+/*
  * These two are MIPS specific ioremap variant.  ioremap_cacheable_cow
  * requests a cachable mapping, ioremap_uncached_accelerated requests a
  * mapping using the uncached accelerated mode which isn't supported on
@@ -343,7 +372,7 @@ static inline void pfx##write##bwlq(type val,				\
                 BUG();                                                  \
 }                                                                       \
                                                                         \
-static inline type pfx##read##bwlq(volatile void __iomem *mem)          \
+static inline type pfx##read##bwlq(const volatile void __iomem *mem)    \
 {                                                                       \
         volatile type *__mem;                                           \
         type __val;                                                     \
@@ -418,7 +447,7 @@ __BUILD_MEMORY_SINGLE(bus, bwlq, type, 1)
                                                                         \
 __BUILD_MEMORY_PFX(__raw_, bwlq, type)                                  \
 __BUILD_MEMORY_PFX(, bwlq, type)                                        \
-__BUILD_MEMORY_PFX(mem_, bwlq, type)                                    \
+__BUILD_MEMORY_PFX(__mem_, bwlq, type)                                  \
 
 BUILDIO_MEM(b, u8)
 BUILDIO_MEM(w, u16)
@@ -431,7 +460,7 @@ BUILDIO_MEM(q, u64)
 
 #define BUILDIO_IOPORT(bwlq, type)                                      \
         __BUILD_IOPORT_PFX(, bwlq, type)                                \
-        __BUILD_IOPORT_PFX(mem_, bwlq, type)
+        __BUILD_IOPORT_PFX(__mem_, bwlq, type)
 
 BUILDIO_IOPORT(b, u8)
 BUILDIO_IOPORT(w, u16)
@@ -465,7 +494,7 @@ static inline void writes##bwlq(volatile void __iomem *mem,		\
         const volatile type *__addr = addr;                             \
                                                                         \
         while (count--) {                                               \
-                mem_write##bwlq(*__addr, mem);                          \
+                __mem_write##bwlq(*__addr, mem);                        \
                 __addr++;                                               \
         }                                                               \
 }                                                                       \
@@ -476,7 +505,7 @@ static inline void reads##bwlq(volatile void __iomem *mem, void *addr,	\
         volatile type *__addr = addr;                                   \
                                                                         \
         while (count--) {                                               \
-                *__addr = mem_read##bwlq(mem);                          \
+                *__addr = __mem_read##bwlq(mem);                        \
                 __addr++;                                               \
         }                                                               \
 }
@@ -489,7 +518,7 @@ static inline void outs##bwlq(unsigned long port, const void *addr,	\
         const volatile type *__addr = addr;                             \
                                                                         \
         while (count--) {                                               \
-                mem_out##bwlq(*__addr, port);                           \
+                __mem_out##bwlq(*__addr, port);                         \
                 __addr++;                                               \
         }                                                               \
 }                                                                       \
@@ -500,7 +529,7 @@ static inline void ins##bwlq(unsigned long port, void *addr,		\
         volatile type *__addr = addr;                                   \
                                                                         \
         while (count--) {                                               \
-                *__addr = mem_in##bwlq(port);                           \
+                *__addr = __mem_in##bwlq(port);                         \
                 __addr++;                                               \
         }                                                               \
 }
diff --git a/include/asm-mips/mach-au1x00/au1000.h b/include/asm-mips/mach-au1x00/au1000.h
index 8e1d7ed7d8e3..4686e17c206c 100644
--- a/include/asm-mips/mach-au1x00/au1000.h
+++ b/include/asm-mips/mach-au1x00/au1000.h
@@ -1198,7 +1198,11 @@ extern au1xxx_irq_map_t au1xxx_irq_map[];
 
 /* UARTS 0-3 */
 #define UART_BASE                 UART0_ADDR
+#ifdef  CONFIG_SOC_AU1200
+#define UART_DEBUG_BASE           UART1_ADDR
+#else
 #define UART_DEBUG_BASE           UART3_ADDR
+#endif
 
 #define UART_RX         0       /* Receive buffer */
 #define UART_TX         4       /* Transmit buffer */
diff --git a/include/asm-mips/cobalt/cobalt.h b/include/asm-mips/mach-cobalt/cobalt.h
index 78e1df2095fb..78e1df2095fb 100644
--- a/include/asm-mips/cobalt/cobalt.h
+++ b/include/asm-mips/mach-cobalt/cobalt.h
diff --git a/include/asm-mips/mach-cobalt/cpu-feature-overrides.h b/include/asm-mips/mach-cobalt/cpu-feature-overrides.h
new file mode 100644
index 000000000000..ace8c5ef9701
--- /dev/null
+++ b/include/asm-mips/mach-cobalt/cpu-feature-overrides.h
@@ -0,0 +1,56 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2006 Ralf Baechle (ralf@linux-mips.org)
+ */
+#ifndef __ASM_COBALT_CPU_FEATURE_OVERRIDES_H
+#define __ASM_COBALT_CPU_FEATURE_OVERRIDES_H
+
+#include <linux/config.h>
+
+#define cpu_has_tlb             1
+#define cpu_has_4kex            1
+#define cpu_has_3k_cache        0
+#define cpu_has_4k_cache        1
+#define cpu_has_tx39_cache      0
+#define cpu_has_sb1_cache       0
+#define cpu_has_fpu             1
+#define cpu_has_32fpr           1
+#define cpu_has_counter         1
+#define cpu_has_watch           0
+#define cpu_has_divec           1
+#define cpu_has_vce             0
+#define cpu_has_cache_cdex_p    0
+#define cpu_has_cache_cdex_s    0
+#define cpu_has_prefetch        0
+#define cpu_has_mcheck          0
+#define cpu_has_ejtag           0
+
+#define cpu_has_subset_pcaches  0
+#define cpu_dcache_line_size()  32
+#define cpu_icache_line_size()  32
+#define cpu_scache_line_size()  0
+
+#ifdef CONFIG_64BIT
+#define cpu_has_llsc            0
+#else
+#define cpu_has_llsc            1
+#endif
+
+#define cpu_has_mips16          0
+#define cpu_has_mdmx            0
+#define cpu_has_mips3d          0
+#define cpu_has_smartmips       0
+#define cpu_has_vtag_icache     0
+#define cpu_has_ic_fills_f_dc   0
+#define cpu_icache_snoops_remote_store  0
+#define cpu_has_dsp             0
+
+#define cpu_has_mips32r1        0
+#define cpu_has_mips32r2        0
+#define cpu_has_mips64r1        0
+#define cpu_has_mips64r2        0
+
+#endif /* __ASM_COBALT_CPU_FEATURE_OVERRIDES_H */
diff --git a/include/asm-mips/cobalt/mach-gt64120.h b/include/asm-mips/mach-cobalt/mach-gt64120.h
index 587fc4378f44..587fc4378f44 100644
--- a/include/asm-mips/cobalt/mach-gt64120.h
+++ b/include/asm-mips/mach-cobalt/mach-gt64120.h
diff --git a/include/asm-mips/mach-generic/timex.h b/include/asm-mips/mach-generic/timex.h
index c6a2e5f0574a..48b4cfaa0d50 100644
--- a/include/asm-mips/mach-generic/timex.h
+++ b/include/asm-mips/mach-generic/timex.h
@@ -3,20 +3,11 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2003 by Ralf Baechle
+ * Copyright (C) 2003, 2005 by Ralf Baechle
  */
 #ifndef __ASM_MACH_GENERIC_TIMEX_H
 #define __ASM_MACH_GENERIC_TIMEX_H
 
-#include <linux/config.h>
-
-/*
- * Last remaining user of the i8254 PIC, will be converted, too ...
- */
-#ifdef CONFIG_SNI_RM200_PCI
-#define CLOCK_TICK_RATE         1193182
-#else
 #define CLOCK_TICK_RATE         500000
-#endif
 
 #endif /* __ASM_MACH_GENERIC_TIMEX_H */
diff --git a/include/asm-mips/mach-ip32/cpu-feature-overrides.h b/include/asm-mips/mach-ip32/cpu-feature-overrides.h
index b80c30725cf6..36070b5654ab 100644
--- a/include/asm-mips/mach-ip32/cpu-feature-overrides.h
+++ b/include/asm-mips/mach-ip32/cpu-feature-overrides.h
@@ -18,7 +18,7 @@
  * so, for 64bit IP32 kernel we just don't use ll/sc.
  * This does not affect luserland.
  */
-#if defined(CONFIG_CPU_R5000) && defined(CONFIG_64BIT)
+#if (defined(CONFIG_CPU_R5000) || defined(CONFIG_CPU_NEVADA)) && defined(CONFIG_64BIT)
 #define cpu_has_llsc            0
 #else
 #define cpu_has_llsc            1
diff --git a/include/asm-mips/mach-rm200/timex.h b/include/asm-mips/mach-rm200/timex.h
new file mode 100644
index 000000000000..11ff6cb0f214
--- /dev/null
+++ b/include/asm-mips/mach-rm200/timex.h
@@ -0,0 +1,13 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2003, 2005 by Ralf Baechle
+ */
+#ifndef __ASM_MACH_RM200_TIMEX_H
+#define __ASM_MACH_RM200_TIMEX_H
+
+#define CLOCK_TICK_RATE         1193182
+
+#endif /* __ASM_MACH_RM200_TIMEX_H */
diff --git a/include/asm-mips/mman.h b/include/asm-mips/mman.h
index dd17c8bd62a1..046cf686bee7 100644
--- a/include/asm-mips/mman.h
+++ b/include/asm-mips/mman.h
@@ -60,15 +60,19 @@
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
+#define MADV_NORMAL     0               /* no further special treatment */
+#define MADV_RANDOM     1               /* expect random page references */
+#define MADV_SEQUENTIAL 2               /* expect sequential page references */
+#define MADV_WILLNEED   3               /* will need these pages */
+#define MADV_DONTNEED   4               /* don't need these pages */
+
+/* common parameters: try to keep these consistent across architectures */
+#define MADV_REMOVE     9               /* remove these pages & resources */
+#define MADV_DONTFORK   10              /* don't inherit across fork */
+#define MADV_DOFORK     11              /* do inherit across fork */
 
 /* compatibility flags */
-#define MAP_ANON       MAP_ANONYMOUS
-#define MAP_FILE       0
+#define MAP_ANON        MAP_ANONYMOUS
+#define MAP_FILE        0
 
 #endif /* _ASM_MMAN_H */
diff --git a/include/asm-mips/r4kcache.h b/include/asm-mips/r4kcache.h
index a5ea9d828aee..0bcb79a58ee9 100644
--- a/include/asm-mips/r4kcache.h
+++ b/include/asm-mips/r4kcache.h
@@ -14,6 +14,7 @@
 
 #include <asm/asm.h>
 #include <asm/cacheops.h>
+#include <asm/cpu-features.h>
 
 /*
  * This macro return a properly sign-extended address suitable as base address
@@ -78,22 +79,25 @@ static inline void flush_scache_line(unsigned long addr)
         cache_op(Hit_Writeback_Inv_SD, addr);
 }
 
+#define protected_cache_op(op,addr)                             \
+        __asm__ __volatile__(                                   \
+        "       .set    push                    \n"             \
+        "       .set    noreorder               \n"             \
+        "       .set    mips3                   \n"             \
+        "1:     cache   %0, (%1)                \n"             \
+        "2:     .set    pop                     \n"             \
+        "       .section __ex_table,\"a\"       \n"             \
+        "       "STR(PTR)" 1b, 2b               \n"             \
+        "       .previous"                                      \
+        :                                                       \
+        : "i" (op), "r" (addr))
+
 /*
  * The next two are for badland addresses like signal trampolines.
  */
 static inline void protected_flush_icache_line(unsigned long addr)
 {
-        __asm__ __volatile__(
-                "       .set    push                    \n"
-                "       .set    noreorder               \n"
-                "       .set    mips3                   \n"
-                "1:     cache   %0, (%1)                \n"
-                "2:     .set    pop                     \n"
-                "       .section __ex_table,\"a\"       \n"
-                "       "STR(PTR)" 1b, 2b               \n"
-                "       .previous"
-                :
-                : "i" (Hit_Invalidate_I), "r" (addr));
+        protected_cache_op(Hit_Invalidate_I, addr);
 }
 
 /*
@@ -104,32 +108,12 @@ static inline void protected_flush_icache_line(unsigned long addr)
  */
 static inline void protected_writeback_dcache_line(unsigned long addr)
 {
-        __asm__ __volatile__(
-                "       .set    push                    \n"
-                "       .set    noreorder               \n"
-                "       .set    mips3                   \n"
-                "1:     cache   %0, (%1)                \n"
-                "2:     .set    pop                     \n"
-                "       .section __ex_table,\"a\"       \n"
-                "       "STR(PTR)" 1b, 2b               \n"
-                "       .previous"
-                :
-                : "i" (Hit_Writeback_Inv_D), "r" (addr));
+        protected_cache_op(Hit_Writeback_Inv_D, addr);
 }
 
 static inline void protected_writeback_scache_line(unsigned long addr)
 {
-        __asm__ __volatile__(
-                "       .set    push                    \n"
-                "       .set    noreorder               \n"
-                "       .set    mips3                   \n"
-                "1:     cache   %0, (%1)                \n"
-                "2:     .set    pop                     \n"
-                "       .section __ex_table,\"a\"       \n"
-                "       "STR(PTR)" 1b, 2b               \n"
-                "       .previous"
-                :
-                : "i" (Hit_Writeback_Inv_SD), "r" (addr));
+        protected_cache_op(Hit_Writeback_Inv_SD, addr);
 }
 
 /*
@@ -166,123 +150,6 @@ static inline void invalidate_tcache_page(unsigned long addr)
                 : "r" (base),                                           \
                   "i" (op));
 
-static inline void blast_dcache16(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.dcache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
-        unsigned long ws_end = current_cpu_data.dcache.ways <<
-                               current_cpu_data.dcache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x200)
-                        cache16_unroll32(addr|ws,Index_Writeback_Inv_D);
-}
-
-static inline void blast_dcache16_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-
-        do {
-                cache16_unroll32(start,Hit_Writeback_Inv_D);
-                start += 0x200;
-        } while (start < end);
-}
-
-static inline void blast_dcache16_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
-        unsigned long ws_end = current_cpu_data.dcache.ways <<
-                               current_cpu_data.dcache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x200)
-                        cache16_unroll32(addr|ws,Index_Writeback_Inv_D);
-}
-
-static inline void blast_icache16(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.icache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
-        unsigned long ws_end = current_cpu_data.icache.ways <<
-                               current_cpu_data.icache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x200)
-                        cache16_unroll32(addr|ws,Index_Invalidate_I);
-}
-
-static inline void blast_icache16_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-
-        do {
-                cache16_unroll32(start,Hit_Invalidate_I);
-                start += 0x200;
-        } while (start < end);
-}
-
-static inline void blast_icache16_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
-        unsigned long ws_end = current_cpu_data.icache.ways <<
-                               current_cpu_data.icache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x200)
-                        cache16_unroll32(addr|ws,Index_Invalidate_I);
-}
-
-static inline void blast_scache16(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.scache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x200)
-                        cache16_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
-static inline void blast_scache16_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = page + PAGE_SIZE;
-
-        do {
-                cache16_unroll32(start,Hit_Writeback_Inv_SD);
-                start += 0x200;
-        } while (start < end);
-}
-
-static inline void blast_scache16_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x200)
-                        cache16_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
 #define cache32_unroll32(base,op)                                       \
         __asm__ __volatile__(                                           \
         "       .set push                                       \n"     \
@@ -309,123 +176,6 @@ static inline void blast_scache16_page_indexed(unsigned long page)
                 : "r" (base),                                           \
                   "i" (op));
 
-static inline void blast_dcache32(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.dcache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
-        unsigned long ws_end = current_cpu_data.dcache.ways <<
-                               current_cpu_data.dcache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x400)
-                        cache32_unroll32(addr|ws,Index_Writeback_Inv_D);
-}
-
-static inline void blast_dcache32_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-
-        do {
-                cache32_unroll32(start,Hit_Writeback_Inv_D);
-                start += 0x400;
-        } while (start < end);
-}
-
-static inline void blast_dcache32_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
-        unsigned long ws_end = current_cpu_data.dcache.ways <<
-                               current_cpu_data.dcache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x400)
-                        cache32_unroll32(addr|ws,Index_Writeback_Inv_D);
-}
-
-static inline void blast_icache32(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.icache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
-        unsigned long ws_end = current_cpu_data.icache.ways <<
-                               current_cpu_data.icache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x400)
-                        cache32_unroll32(addr|ws,Index_Invalidate_I);
-}
-
-static inline void blast_icache32_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-
-        do {
-                cache32_unroll32(start,Hit_Invalidate_I);
-                start += 0x400;
-        } while (start < end);
-}
-
-static inline void blast_icache32_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
-        unsigned long ws_end = current_cpu_data.icache.ways <<
-                               current_cpu_data.icache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x400)
-                        cache32_unroll32(addr|ws,Index_Invalidate_I);
-}
-
-static inline void blast_scache32(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.scache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x400)
-                        cache32_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
-static inline void blast_scache32_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = page + PAGE_SIZE;
-
-        do {
-                cache32_unroll32(start,Hit_Writeback_Inv_SD);
-                start += 0x400;
-        } while (start < end);
-}
-
-static inline void blast_scache32_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x400)
-                        cache32_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
 #define cache64_unroll32(base,op)                                       \
         __asm__ __volatile__(                                           \
         "       .set push                                       \n"     \
@@ -452,84 +202,6 @@ static inline void blast_scache32_page_indexed(unsigned long page)
                 : "r" (base),                                           \
                   "i" (op));
 
-static inline void blast_icache64(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.icache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
-        unsigned long ws_end = current_cpu_data.icache.ways <<
-                               current_cpu_data.icache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x800)
-                        cache64_unroll32(addr|ws,Index_Invalidate_I);
-}
-
-static inline void blast_icache64_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-
-        do {
-                cache64_unroll32(start,Hit_Invalidate_I);
-                start += 0x800;
-        } while (start < end);
-}
-
-static inline void blast_icache64_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.icache.waybit;
-        unsigned long ws_end = current_cpu_data.icache.ways <<
-                               current_cpu_data.icache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x800)
-                        cache64_unroll32(addr|ws,Index_Invalidate_I);
-}
-
-static inline void blast_scache64(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.scache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x800)
-                        cache64_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
-static inline void blast_scache64_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = page + PAGE_SIZE;
-
-        do {
-                cache64_unroll32(start,Hit_Writeback_Inv_SD);
-                start += 0x800;
-        } while (start < end);
-}
-
-static inline void blast_scache64_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x800)
-                        cache64_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
 #define cache128_unroll32(base,op)                                      \
         __asm__ __volatile__(                                           \
         "       .set push                                       \n"     \
@@ -556,43 +228,80 @@ static inline void blast_scache64_page_indexed(unsigned long page)
                 : "r" (base),                                           \
                   "i" (op));
 
-static inline void blast_scache128(void)
-{
-        unsigned long start = INDEX_BASE;
-        unsigned long end = start + current_cpu_data.scache.waysize;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x1000)
-                        cache128_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
-
-static inline void blast_scache128_page(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = page + PAGE_SIZE;
-
-        do {
-                cache128_unroll32(start,Hit_Writeback_Inv_SD);
-                start += 0x1000;
-        } while (start < end);
-}
-
-static inline void blast_scache128_page_indexed(unsigned long page)
-{
-        unsigned long start = page;
-        unsigned long end = start + PAGE_SIZE;
-        unsigned long ws_inc = 1UL << current_cpu_data.scache.waybit;
-        unsigned long ws_end = current_cpu_data.scache.ways <<
-                               current_cpu_data.scache.waybit;
-        unsigned long ws, addr;
-
-        for (ws = 0; ws < ws_end; ws += ws_inc)
-                for (addr = start; addr < end; addr += 0x1000)
-                        cache128_unroll32(addr|ws,Index_Writeback_Inv_SD);
-}
+/* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
+#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize) \
+static inline void blast_##pfx##cache##lsize(void)                      \
+{                                                                       \
+        unsigned long start = INDEX_BASE;                               \
+        unsigned long end = start + current_cpu_data.desc.waysize;      \
+        unsigned long ws_inc = 1UL << current_cpu_data.desc.waybit;     \
+        unsigned long ws_end = current_cpu_data.desc.ways <<            \
+                               current_cpu_data.desc.waybit;            \
+        unsigned long ws, addr;                                         \
+                                                                        \
+        for (ws = 0; ws < ws_end; ws += ws_inc)                         \
+                for (addr = start; addr < end; addr += lsize * 32)      \
+                        cache##lsize##_unroll32(addr|ws,indexop);       \
+}                                                                       \
+                                                                        \
+static inline void blast_##pfx##cache##lsize##_page(unsigned long page) \
+{                                                                       \
+        unsigned long start = page;                                     \
+        unsigned long end = page + PAGE_SIZE;                           \
+                                                                        \
+        do {                                                            \
+                cache##lsize##_unroll32(start,hitop);                   \
+                start += lsize * 32;                                    \
+        } while (start < end);                                          \
+}                                                                       \
+                                                                        \
+static inline void blast_##pfx##cache##lsize##_page_indexed(unsigned long page) \
+{                                                                       \
+        unsigned long indexmask = current_cpu_data.desc.waysize - 1;    \
+        unsigned long start = INDEX_BASE + (page & indexmask);          \
+        unsigned long end = start + PAGE_SIZE;                          \
+        unsigned long ws_inc = 1UL << current_cpu_data.desc.waybit;     \
+        unsigned long ws_end = current_cpu_data.desc.ways <<            \
+                               current_cpu_data.desc.waybit;            \
+        unsigned long ws, addr;                                         \
+                                                                        \
+        for (ws = 0; ws < ws_end; ws += ws_inc)                         \
+                for (addr = start; addr < end; addr += lsize * 32)      \
+                        cache##lsize##_unroll32(addr|ws,indexop);       \
+}
+
+__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16)
+__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128)
+
+/* build blast_xxx_range, protected_blast_xxx_range */
+#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot) \
+static inline void prot##blast_##pfx##cache##_range(unsigned long start, \
+                                                    unsigned long end)  \
+{                                                                       \
+        unsigned long lsize = cpu_##desc##_line_size();                 \
+        unsigned long addr = start & ~(lsize - 1);                      \
+        unsigned long aend = (end - 1) & ~(lsize - 1);                  \
+        while (1) {                                                     \
+                prot##cache_op(hitop, addr);                            \
+                if (addr == aend)                                       \
+                        break;                                          \
+                addr += lsize;                                          \
+        }                                                               \
+}
+
+__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_)
+__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_)
+__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_)
+__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, )
+__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, )
+/* blast_inv_dcache_range */
+__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, )
 
 #endif /* _ASM_R4KCACHE_H */
diff --git a/include/asm-mips/reboot.h b/include/asm-mips/reboot.h
index 2f10ebcbe141..e48c0bfab257 100644
--- a/include/asm-mips/reboot.h
+++ b/include/asm-mips/reboot.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1997, 1999, 2001 by Ralf Baechle
+ * Copyright (C) 1997, 1999, 2001, 06 by Ralf Baechle
  * Copyright (C) 2001 MIPS Technologies, Inc.
  */
 #ifndef _ASM_REBOOT_H
@@ -11,6 +11,5 @@
 
 extern void (*_machine_restart)(char *command);
 extern void (*_machine_halt)(void);
-extern void (*_machine_power_off)(void);
 
 #endif /* _ASM_REBOOT_H */
diff --git a/include/asm-mips/sibyte/sb1250.h b/include/asm-mips/sibyte/sb1250.h
index a474c29cd701..b09e16c93ca0 100644
--- a/include/asm-mips/sibyte/sb1250.h
+++ b/include/asm-mips/sibyte/sb1250.h
@@ -45,8 +45,8 @@ extern unsigned int soc_type;
 extern unsigned int periph_rev;
 extern unsigned int zbbus_mhz;
 
+extern void sb1250_hpt_setup(void);
 extern void sb1250_time_init(void);
-extern unsigned long sb1250_gettimeoffset(void);
 extern void sb1250_mask_irq(int cpu, int irq);
 extern void sb1250_unmask_irq(int cpu, int irq);
 extern void sb1250_smp_finish(void);
diff --git a/include/asm-mips/sibyte/sb1250_scd.h b/include/asm-mips/sibyte/sb1250_scd.h
index a667bc14a7cd..f4178bdcfcb0 100644
--- a/include/asm-mips/sibyte/sb1250_scd.h
+++ b/include/asm-mips/sibyte/sb1250_scd.h
@@ -359,14 +359,15 @@
  */
 
 #define V_SCD_TIMER_FREQ            1000000
+#define V_SCD_TIMER_WIDTH           23
 
 #define S_SCD_TIMER_INIT            0
-#define M_SCD_TIMER_INIT            _SB_MAKEMASK(20,S_SCD_TIMER_INIT)
+#define M_SCD_TIMER_INIT            _SB_MAKEMASK(V_SCD_TIMER_WIDTH,S_SCD_TIMER_INIT)
 #define V_SCD_TIMER_INIT(x)         _SB_MAKEVALUE(x,S_SCD_TIMER_INIT)
 #define G_SCD_TIMER_INIT(x)         _SB_GETVALUE(x,S_SCD_TIMER_INIT,M_SCD_TIMER_INIT)
 
 #define S_SCD_TIMER_CNT             0
-#define M_SCD_TIMER_CNT             _SB_MAKEMASK(20,S_SCD_TIMER_CNT)
+#define M_SCD_TIMER_CNT             _SB_MAKEMASK(V_SCD_TIMER_WIDTH,S_SCD_TIMER_CNT)
 #define V_SCD_TIMER_CNT(x)         _SB_MAKEVALUE(x,S_SCD_TIMER_CNT)
 #define G_SCD_TIMER_CNT(x)         _SB_GETVALUE(x,S_SCD_TIMER_CNT,M_SCD_TIMER_CNT)
 
diff --git a/include/asm-mips/smp.h b/include/asm-mips/smp.h
index 5618f1e12f40..75c6fe7c2126 100644
--- a/include/asm-mips/smp.h
+++ b/include/asm-mips/smp.h
@@ -58,7 +58,9 @@ static inline int num_booting_cpus(void)
         return cpus_weight(cpu_callout_map);
 }
 
-/* These are defined by the board-specific code. */
+/*
+ * These are defined by the board-specific code.
+ */
 
 /*
  * Cause the function described by call_data to be executed on the passed
@@ -79,7 +81,12 @@ extern void prom_boot_secondary(int cpu, struct task_struct *idle);
 extern void prom_init_secondary(void);
 
 /*
- * Detect available CPUs, populate phys_cpu_present_map before smp_init
+ * Populate cpu_possible_map before smp_init, called from setup_arch.
+ */
+extern void plat_smp_setup(void);
+
+/*
+ * Called after init_IRQ but before __cpu_up.
  */
 extern void prom_prepare_cpus(unsigned int max_cpus);
 
diff --git a/include/asm-mips/string.h b/include/asm-mips/string.h
index 5a06f6d13899..907da600fddd 100644
--- a/include/asm-mips/string.h
+++ b/include/asm-mips/string.h
@@ -141,26 +141,4 @@ extern void *memcpy(void *__to, __const__ void *__from, size_t __n);
 #define __HAVE_ARCH_MEMMOVE
 extern void *memmove(void *__dest, __const__ void *__src, size_t __n);
 
-#ifdef CONFIG_32BIT
-#define __HAVE_ARCH_MEMSCAN
-static __inline__ void *memscan(void *__addr, int __c, size_t __size)
-{
-        char *__end = (char *)__addr + __size;
-        unsigned char __uc = (unsigned char) __c;
-
-        __asm__(".set\tpush\n\t"
-                ".set\tnoat\n\t"
-                ".set\treorder\n\t"
-                "1:\tbeq\t%0,%1,2f\n\t"
-                "addiu\t%0,1\n\t"
-                "lbu\t$1,-1(%0)\n\t"
-                "bne\t$1,%z4,1b\n"
-                "2:\t.set\tpop"
-                : "=r" (__addr), "=r" (__end)
-                : "0" (__addr), "1" (__end), "Jr" (__uc));
-
-        return __addr;
-}
-#endif /* CONFIG_32BIT */
-
 #endif /* _ASM_STRING_H */
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index e8e5d4143377..ddae9bae31af 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -322,7 +322,7 @@ static inline unsigned long __cmpxchg_u32(volatile int * m, unsigned long old,
 #endif
                 "2:                                                     \n"
                 "       .set    pop                                     \n"
-                : "=&r" (retval), "=m" (*m)
+                : "=&r" (retval), "=R" (*m)
                 : "R" (*m), "Jr" (old), "Jr" (new)
                 : "memory");
         } else if (cpu_has_llsc) {
@@ -342,7 +342,7 @@ static inline unsigned long __cmpxchg_u32(volatile int * m, unsigned long old,
 #endif
                 "2:                                                     \n"
                 "       .set    pop                                     \n"
-                : "=&r" (retval), "=m" (*m)
+                : "=&r" (retval), "=R" (*m)
                 : "R" (*m), "Jr" (old), "Jr" (new)
                 : "memory");
         } else {
@@ -379,7 +379,7 @@ static inline unsigned long __cmpxchg_u64(volatile int * m, unsigned long old,
 #endif
                 "2:                                                     \n"
                 "       .set    pop                                     \n"
-                : "=&r" (retval), "=m" (*m)
+                : "=&r" (retval), "=R" (*m)
                 : "R" (*m), "Jr" (old), "Jr" (new)
                 : "memory");
         } else if (cpu_has_llsc) {
@@ -397,7 +397,7 @@ static inline unsigned long __cmpxchg_u64(volatile int * m, unsigned long old,
 #endif
                 "2:                                                     \n"
                 "       .set    pop                                     \n"
-                : "=&r" (retval), "=m" (*m)
+                : "=&r" (retval), "=R" (*m)
                 : "R" (*m), "Jr" (old), "Jr" (new)
                 : "memory");
         } else {
diff --git a/include/asm-mips/thread_info.h b/include/asm-mips/thread_info.h
index 1612b3fe1080..fa193f861e71 100644
--- a/include/asm-mips/thread_info.h
+++ b/include/asm-mips/thread_info.h
@@ -114,6 +114,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_NEED_RESCHED        3       /* rescheduling necessary */
 #define TIF_SYSCALL_AUDIT       4       /* syscall auditing active */
 #define TIF_SECCOMP             5       /* secure computing */
+#define TIF_RESTORE_SIGMASK     9       /* restore signal mask in do_signal() */
 #define TIF_USEDFPU             16      /* FPU was used by this task this quantum (SMP) */
 #define TIF_POLLING_NRFLAG      17      /* true if poll_idle() is polling TIF_NEED_RESCHED */
 #define TIF_MEMDIE              18
@@ -125,6 +126,7 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
 #define _TIF_SECCOMP            (1<<TIF_SECCOMP)
+#define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
 #define _TIF_USEDFPU            (1<<TIF_USEDFPU)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 
diff --git a/include/asm-mips/tx4927/tx4927.h b/include/asm-mips/tx4927/tx4927.h
index 3bb7f0087d68..de85bd2245f7 100644
--- a/include/asm-mips/tx4927/tx4927.h
+++ b/include/asm-mips/tx4927/tx4927.h
@@ -2,7 +2,7 @@
  * Author: MontaVista Software, Inc.
  *         source@mvista.com
  *
- * Copyright 2001-2002 MontaVista Software Inc.
+ * Copyright 2001-2006 MontaVista Software Inc.
  *
  *  This program is free software; you can redistribute it and/or modify it
  *  under the terms of the GNU General Public License as published by the
@@ -30,10 +30,10 @@
 #include <asm/tx4927/tx4927_mips.h>
 
 /*
- This register naming came from the intergrate cpu/controoler name TX4927
+ This register naming came from the integrated CPU/controller name TX4927
  followed by the device name from table 4.2.2 on page 4-3 and then followed
  by the register name from table 4.2.3 on pages 4-4 to 4-8.  The manaul
- used is "TMPR4927BT Preliminary Rev 0.1 20.Jul.2001".
+ used was "TMPR4927BT Preliminary Rev 0.1 20.Jul.2001".
  */
 
 #define TX4927_SIO_0_BASE
@@ -251,8 +251,8 @@
 
 /* TX4927 Timer 0 (32-bit registers) */
 #define TX4927_TMR0_BASE                0xf000
-#define TX4927_TMR0_TMTCR0              0xf004
-#define TX4927_TMR0_TMTISR0             0xf008
+#define TX4927_TMR0_TMTCR0              0xf000
+#define TX4927_TMR0_TMTISR0             0xf004
 #define TX4927_TMR0_TMCPRA0             0xf008
 #define TX4927_TMR0_TMCPRB0             0xf00c
 #define TX4927_TMR0_TMITMR0             0xf010
@@ -264,8 +264,8 @@
 
 /* TX4927 Timer 1 (32-bit registers) */
 #define TX4927_TMR1_BASE                0xf100
-#define TX4927_TMR1_TMTCR1              0xf104
-#define TX4927_TMR1_TMTISR1             0xf108
+#define TX4927_TMR1_TMTCR1              0xf100
+#define TX4927_TMR1_TMTISR1             0xf104
 #define TX4927_TMR1_TMCPRA1             0xf108
 #define TX4927_TMR1_TMCPRB1             0xf10c
 #define TX4927_TMR1_TMITMR1             0xf110
@@ -277,13 +277,12 @@
 
 /* TX4927 Timer 2 (32-bit registers) */
 #define TX4927_TMR2_BASE                0xf200
-#define TX4927_TMR2_TMTCR2              0xf104
-#define TX4927_TMR2_TMTISR2             0xf208
+#define TX4927_TMR2_TMTCR2              0xf200
+#define TX4927_TMR2_TMTISR2             0xf204
 #define TX4927_TMR2_TMCPRA2             0xf208
-#define TX4927_TMR2_TMCPRB2             0xf20c
 #define TX4927_TMR2_TMITMR2             0xf210
 #define TX4927_TMR2_TMCCDR2             0xf220
-#define TX4927_TMR2_TMPGMR2             0xf230
+#define TX4927_TMR2_TMWTMR2             0xf240
 #define TX4927_TMR2_TMTRR2              0xf2f0
 #define TX4927_TMR2_LIMIT               0xf2ff
 
diff --git a/include/asm-mips/tx4927/tx4927_pci.h b/include/asm-mips/tx4927/tx4927_pci.h
index 165f6b8b217f..66c064690f41 100644
--- a/include/asm-mips/tx4927/tx4927_pci.h
+++ b/include/asm-mips/tx4927/tx4927_pci.h
@@ -253,6 +253,16 @@ struct tx4927_pcic_reg {
 #define TX4927_CCFG_PCIDIVMODE_5        0x00001000
 #define TX4927_CCFG_PCIDIVMODE_6        0x00001800
 
+#define TX4937_CCFG_PCIDIVMODE_MASK     0x00001c00
+#define TX4937_CCFG_PCIDIVMODE_8        0x00000000
+#define TX4937_CCFG_PCIDIVMODE_4        0x00000400
+#define TX4937_CCFG_PCIDIVMODE_9        0x00000800
+#define TX4937_CCFG_PCIDIVMODE_4_5      0x00000c00
+#define TX4937_CCFG_PCIDIVMODE_10       0x00001000
+#define TX4937_CCFG_PCIDIVMODE_5        0x00001400
+#define TX4937_CCFG_PCIDIVMODE_11       0x00001800
+#define TX4937_CCFG_PCIDIVMODE_5_5      0x00001c00
+
 /* PCFG : Pin Configuration */
 #define TX4927_PCFG_PCICLKEN_ALL        0x003f0000
 #define TX4927_PCFG_PCICLKEN(ch)        (0x00010000<<(ch))
diff --git a/include/asm-mips/uaccess.h b/include/asm-mips/uaccess.h
index 41bb96bb2120..b96f3e0f3933 100644
--- a/include/asm-mips/uaccess.h
+++ b/include/asm-mips/uaccess.h
@@ -202,49 +202,49 @@ struct __large_struct { unsigned long buf[100]; };
  * Yuck.  We need two variants, one for 64bit operation and one
  * for 32 bit mode and old iron.
  */
-#ifdef __mips64
-#define __GET_USER_DW(ptr) __get_user_asm("ld", ptr)
-#else
-#define __GET_USER_DW(ptr) __get_user_asm_ll32(ptr)
+#ifdef CONFIG_32BIT
+#define __GET_USER_DW(val, ptr) __get_user_asm_ll32(val, ptr)
+#endif
+#ifdef CONFIG_64BIT
+#define __GET_USER_DW(val, ptr) __get_user_asm(val, "ld", ptr)
 #endif
 
-#define __get_user_nocheck(x,ptr,size)                                  \
-({                                                                      \
-        __typeof(*(ptr)) __gu_val =  (__typeof(*(ptr))) 0;              \
-        long __gu_err = 0;                                              \
-                                                                        \
+extern void __get_user_unknown(void);
+
+#define __get_user_common(val, size, ptr)                               \
+do {                                                                    \
         switch (size) {                                                 \
-        case 1: __get_user_asm("lb", ptr); break;                       \
-        case 2: __get_user_asm("lh", ptr); break;                       \
-        case 4: __get_user_asm("lw", ptr); break;                       \
-        case 8: __GET_USER_DW(ptr); break;                              \
+        case 1: __get_user_asm(val, "lb", ptr); break;                  \
+        case 2: __get_user_asm(val, "lh", ptr); break;                  \
+        case 4: __get_user_asm(val, "lw", ptr); break;                  \
+        case 8: __GET_USER_DW(val, ptr); break;                         \
         default: __get_user_unknown(); break;                           \
         }                                                               \
-        (x) = (__typeof__(*(ptr))) __gu_val;                            \
+} while (0)
+
+#define __get_user_nocheck(x,ptr,size)                                  \
+({                                                                      \
+        long __gu_err;                                                  \
+                                                                        \
+        __get_user_common((x), size, ptr);                              \
         __gu_err;                                                       \
 })
 
 #define __get_user_check(x,ptr,size)                                    \
 ({                                                                      \
-        const __typeof__(*(ptr)) __user * __gu_addr = (ptr);            \
-        __typeof__(*(ptr)) __gu_val = 0;                                \
         long __gu_err = -EFAULT;                                        \
+        const __typeof__(*(ptr)) __user * __gu_ptr = (ptr);             \
+                                                                        \
+        if (likely(access_ok(VERIFY_READ,  __gu_ptr, size)))            \
+                __get_user_common((x), size, __gu_ptr);                 \
                                                                         \
-        if (likely(access_ok(VERIFY_READ,  __gu_addr, size))) {         \
-                switch (size) {                                         \
-                case 1: __get_user_asm("lb", __gu_addr); break;         \
-                case 2: __get_user_asm("lh", __gu_addr); break;         \
-                case 4: __get_user_asm("lw", __gu_addr); break;         \
-                case 8: __GET_USER_DW(__gu_addr); break;                \
-                default: __get_user_unknown(); break;                   \
-                }                                                       \
-        }                                                               \
-        (x) = (__typeof__(*(ptr))) __gu_val;                            \
         __gu_err;                                                       \
 })
 
-#define __get_user_asm(insn, addr)                                      \
+#define __get_user_asm(val, insn, addr)                                 \
 {                                                                       \
+        long __gu_tmp;                                                  \
+                                                                        \
         __asm__ __volatile__(                                           \
         "1:     " insn "        %1, %3                          \n"     \
         "2:                                                     \n"     \
@@ -255,15 +255,19 @@ struct __large_struct { unsigned long buf[100]; };
         "       .section __ex_table,\"a\"                       \n"     \
         "       "__UA_ADDR "\t1b, 3b                            \n"     \
         "       .previous                                       \n"     \
-        : "=r" (__gu_err), "=r" (__gu_val)                              \
+        : "=r" (__gu_err), "=r" (__gu_tmp)                              \
         : "0" (0), "o" (__m(addr)), "i" (-EFAULT));                     \
+                                                                        \
+        (val) = (__typeof__(*(addr))) __gu_tmp;                         \
 }
 
 /*
  * Get a long long 64 using 32 bit registers.
  */
-#define __get_user_asm_ll32(addr)                                       \
+#define __get_user_asm_ll32(val, addr)                                  \
 {                                                                       \
+        unsigned long long __gu_tmp;                                    \
+                                                                        \
         __asm__ __volatile__(                                           \
         "1:     lw      %1, (%3)                                \n"     \
         "2:     lw      %D1, 4(%3)                              \n"     \
@@ -278,21 +282,21 @@ struct __large_struct { unsigned long buf[100]; };
         "       " __UA_ADDR "   1b, 4b                          \n"     \
         "       " __UA_ADDR "   2b, 4b                          \n"     \
         "       .previous                                       \n"     \
-        : "=r" (__gu_err), "=&r" (__gu_val)                             \
+        : "=r" (__gu_err), "=&r" (__gu_tmp)                             \
         : "0" (0), "r" (addr), "i" (-EFAULT));                          \
+        (val) = (__typeof__(*(addr))) __gu_tmp;                         \
 }
 
-extern void __get_user_unknown(void);
-
 /*
  * Yuck.  We need two variants, one for 64bit operation and one
  * for 32 bit mode and old iron.
  */
-#ifdef __mips64
-#define __PUT_USER_DW(ptr) __put_user_asm("sd", ptr)
-#else
+#ifdef CONFIG_32BIT
 #define __PUT_USER_DW(ptr) __put_user_asm_ll32(ptr)
 #endif
+#ifdef CONFIG_64BIT
+#define __PUT_USER_DW(ptr) __put_user_asm("sd", ptr)
+#endif
 
 #define __put_user_nocheck(x,ptr,size)                                  \
 ({                                                                      \
diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h
index 89ea8b60e945..b5c78a4a0192 100644
--- a/include/asm-mips/unistd.h
+++ b/include/asm-mips/unistd.h
@@ -307,17 +307,33 @@
 #define __NR_inotify_init               (__NR_Linux + 284)
 #define __NR_inotify_add_watch          (__NR_Linux + 285)
 #define __NR_inotify_rm_watch           (__NR_Linux + 286)
-
+#define __NR_migrate_pages              (__NR_Linux + 287)
+#define __NR_openat                     (__NR_Linux + 288)
+#define __NR_mkdirat                    (__NR_Linux + 289)
+#define __NR_mknodat                    (__NR_Linux + 290)
+#define __NR_fchownat                   (__NR_Linux + 291)
+#define __NR_futimesat                  (__NR_Linux + 292)
+#define __NR_fstatat                    (__NR_Linux + 293)
+#define __NR_unlinkat                   (__NR_Linux + 294)
+#define __NR_renameat                   (__NR_Linux + 295)
+#define __NR_linkat                     (__NR_Linux + 296)
+#define __NR_symlinkat                  (__NR_Linux + 297)
+#define __NR_readlinkat                 (__NR_Linux + 298)
+#define __NR_fchmodat                   (__NR_Linux + 299)
+#define __NR_faccessat                  (__NR_Linux + 300)
+#define __NR_pselect6                   (__NR_Linux + 301)
+#define __NR_ppoll                      (__NR_Linux + 302)
+#define __NR_unshare                    (__NR_Linux + 303)
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             286
+#define __NR_Linux_syscalls             303
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         283
+#define __NR_O32_Linux_syscalls         303
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -571,16 +587,33 @@
 #define __NR_inotify_init               (__NR_Linux + 243)
 #define __NR_inotify_add_watch          (__NR_Linux + 244)
 #define __NR_inotify_rm_watch           (__NR_Linux + 245)
+#define __NR_migrate_pages              (__NR_Linux + 246)
+#define __NR_openat                     (__NR_Linux + 247)
+#define __NR_mkdirat                    (__NR_Linux + 248)
+#define __NR_mknodat                    (__NR_Linux + 249)
+#define __NR_fchownat                   (__NR_Linux + 250)
+#define __NR_futimesat                  (__NR_Linux + 251)
+#define __NR_fstatat                    (__NR_Linux + 252)
+#define __NR_unlinkat                   (__NR_Linux + 253)
+#define __NR_renameat                   (__NR_Linux + 254)
+#define __NR_linkat                     (__NR_Linux + 255)
+#define __NR_symlinkat                  (__NR_Linux + 256)
+#define __NR_readlinkat                 (__NR_Linux + 257)
+#define __NR_fchmodat                   (__NR_Linux + 258)
+#define __NR_faccessat                  (__NR_Linux + 259)
+#define __NR_pselect6                   (__NR_Linux + 260)
+#define __NR_ppoll                      (__NR_Linux + 261)
+#define __NR_unshare                    (__NR_Linux + 262)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             245
+#define __NR_Linux_syscalls             262
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          242
+#define __NR_64_Linux_syscalls          262
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -838,16 +871,33 @@
 #define __NR_inotify_init               (__NR_Linux + 247)
 #define __NR_inotify_add_watch          (__NR_Linux + 248)
 #define __NR_inotify_rm_watch           (__NR_Linux + 249)
+#define __NR_migrate_pages              (__NR_Linux + 250)
+#define __NR_openat                     (__NR_Linux + 251)
+#define __NR_mkdirat                    (__NR_Linux + 252)
+#define __NR_mknodat                    (__NR_Linux + 253)
+#define __NR_fchownat                   (__NR_Linux + 254)
+#define __NR_futimesat                  (__NR_Linux + 255)
+#define __NR_fstatat                    (__NR_Linux + 256)
+#define __NR_unlinkat                   (__NR_Linux + 257)
+#define __NR_renameat                   (__NR_Linux + 258)
+#define __NR_linkat                     (__NR_Linux + 259)
+#define __NR_symlinkat                  (__NR_Linux + 260)
+#define __NR_readlinkat                 (__NR_Linux + 261)
+#define __NR_fchmodat                   (__NR_Linux + 262)
+#define __NR_faccessat                  (__NR_Linux + 263)
+#define __NR_pselect6                   (__NR_Linux + 264)
+#define __NR_ppoll                      (__NR_Linux + 265)
+#define __NR_unshare                    (__NR_Linux + 266)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             249
+#define __NR_Linux_syscalls             266
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         246
+#define __NR_N32_Linux_syscalls         266
 
 #ifndef __ASSEMBLY__
 
@@ -1134,10 +1184,8 @@ type name (atype a,btype b,ctype c,dtype d,etype e,ftype f) \
 #define __ARCH_WANT_SYS_SIGPENDING
 #define __ARCH_WANT_SYS_SIGPROCMASK
 #define __ARCH_WANT_SYS_RT_SIGACTION
-# ifndef __mips64
-#  define __ARCH_WANT_STAT64
-# endif
 # ifdef CONFIG_32BIT
+#  define __ARCH_WANT_STAT64
 #  define __ARCH_WANT_SYS_TIME
 # endif
 # ifdef CONFIG_MIPS32_O32
diff --git a/include/asm-mips/vga.h b/include/asm-mips/vga.h
index ca5cec97e167..34755c0a6398 100644
--- a/include/asm-mips/vga.h
+++ b/include/asm-mips/vga.h
@@ -26,6 +26,9 @@
  *  <linux/vt_buffer.h> has already done the right job for us.
  */
 
+#undef scr_writew
+#undef scr_readw
+
 static inline void scr_writew(u16 val, volatile u16 *addr)
 {
         *addr = cpu_to_le16(val);
diff --git a/include/asm-parisc/atomic.h b/include/asm-parisc/atomic.h
index 2ca56d34aaad..4dc7253ff5d0 100644
--- a/include/asm-parisc/atomic.h
+++ b/include/asm-parisc/atomic.h
@@ -1,9 +1,13 @@
+/* Copyright (C) 2000 Philipp Rumpf <prumpf@tux.org>
+ * Copyright (C) 2006 Kyle McMartin <kyle@parisc-linux.org>
+ */
+
 #ifndef _ASM_PARISC_ATOMIC_H_
 #define _ASM_PARISC_ATOMIC_H_
 
 #include <linux/config.h>
+#include <linux/types.h>
 #include <asm/system.h>
-/* Copyright (C) 2000 Philipp Rumpf <prumpf@tux.org>.  */
 
 /*
  * Atomic operations that C can't guarantee us.  Useful for
@@ -46,15 +50,6 @@ extern raw_spinlock_t __atomic_hash[ATOMIC_HASH_SIZE] __lock_aligned;
 #  define _atomic_spin_unlock_irqrestore(l,f) do { local_irq_restore(f); } while (0)
 #endif
 
-/* Note that we need not lock read accesses - aligned word writes/reads
- * are atomic, so a reader never sees unconsistent values.
- *
- * Cache-line alignment would conflict with, for example, linux/module.h
- */
-
-typedef struct { volatile int counter; } atomic_t;
-
-
 /* This should get optimized out since it's never called.
 ** Or get a link error if xchg is used "wrong".
 */
@@ -69,10 +64,9 @@ extern unsigned long __xchg64(unsigned long, unsigned long *);
 #endif
 
 /* optimizer better get rid of switch since size is a constant */
-static __inline__ unsigned long __xchg(unsigned long x, __volatile__ void * ptr,
-                                       int size)
+static __inline__ unsigned long
+__xchg(unsigned long x, __volatile__ void * ptr, int size)
 {
-
         switch(size) {
 #ifdef __LP64__
         case 8: return __xchg64(x,(unsigned long *) ptr);
@@ -129,7 +123,13 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new_, int size)
                                     (unsigned long)_n_, sizeof(*(ptr))); \
   })
 
+/* Note that we need not lock read accesses - aligned word writes/reads
+ * are atomic, so a reader never sees unconsistent values.
+ *
+ * Cache-line alignment would conflict with, for example, linux/module.h
+ */
 
+typedef struct { volatile int counter; } atomic_t;
 
 /* It's possible to reduce all atomic operations to either
  * __atomic_add_return, atomic_set and atomic_read (the latter
@@ -210,12 +210,66 @@ static __inline__ int atomic_read(const atomic_t *v)
 
 #define atomic_dec_and_test(v)  (atomic_dec_return(v) == 0)
 
-#define ATOMIC_INIT(i)  { (i) }
+#define ATOMIC_INIT(i)  ((atomic_t) { (i) })
 
 #define smp_mb__before_atomic_dec()     smp_mb()
 #define smp_mb__after_atomic_dec()      smp_mb()
 #define smp_mb__before_atomic_inc()     smp_mb()
 #define smp_mb__after_atomic_inc()      smp_mb()
 
+#ifdef __LP64__
+
+typedef struct { volatile s64 counter; } atomic64_t;
+
+#define ATOMIC64_INIT(i) ((atomic64_t) { (i) })
+
+static __inline__ int
+__atomic64_add_return(s64 i, atomic64_t *v)
+{
+        int ret;
+        unsigned long flags;
+        _atomic_spin_lock_irqsave(v, flags);
+
+        ret = (v->counter += i);
+
+        _atomic_spin_unlock_irqrestore(v, flags);
+        return ret;
+}
+
+static __inline__ void
+atomic64_set(atomic64_t *v, s64 i)
+{
+        unsigned long flags;
+        _atomic_spin_lock_irqsave(v, flags);
+
+        v->counter = i;
+
+        _atomic_spin_unlock_irqrestore(v, flags);
+}
+
+static __inline__ s64
+atomic64_read(const atomic64_t *v)
+{
+        return v->counter;
+}
+
+#define atomic64_add(i,v)       ((void)(__atomic64_add_return( ((s64)i),(v))))
+#define atomic64_sub(i,v)       ((void)(__atomic64_add_return(-((s64)i),(v))))
+#define atomic64_inc(v)         ((void)(__atomic64_add_return(   1,(v))))
+#define atomic64_dec(v)         ((void)(__atomic64_add_return(  -1,(v))))
+
+#define atomic64_add_return(i,v)        (__atomic64_add_return( ((s64)i),(v)))
+#define atomic64_sub_return(i,v)        (__atomic64_add_return(-((s64)i),(v)))
+#define atomic64_inc_return(v)          (__atomic64_add_return(   1,(v)))
+#define atomic64_dec_return(v)          (__atomic64_add_return(  -1,(v)))
+
+#define atomic64_add_negative(a, v)     (atomic64_add_return((a), (v)) < 0)
+
+#define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
+#define atomic64_dec_and_test(v)        (atomic64_dec_return(v) == 0)
+
+#endif /* __LP64__ */
+
 #include <asm-generic/atomic.h>
-#endif
+
+#endif /* _ASM_PARISC_ATOMIC_H_ */
diff --git a/include/asm-parisc/cacheflush.h b/include/asm-parisc/cacheflush.h
index 1bc3c83ee74b..c53af9ff41b5 100644
--- a/include/asm-parisc/cacheflush.h
+++ b/include/asm-parisc/cacheflush.h
@@ -183,4 +183,10 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
                 __flush_cache_page(vma, vmaddr);
 
 }
+
+#ifdef CONFIG_DEBUG_RODATA
+void mark_rodata_ro(void);
 #endif
+
+#endif /* _PARISC_CACHEFLUSH_H */
+
diff --git a/include/asm-parisc/compat_ucontext.h b/include/asm-parisc/compat_ucontext.h
index a1228a3d2071..2f7292afde3c 100644
--- a/include/asm-parisc/compat_ucontext.h
+++ b/include/asm-parisc/compat_ucontext.h
@@ -1,8 +1,7 @@
 #ifndef _ASM_PARISC_COMPAT_UCONTEXT_H
 #define _ASM_PARISC_COMPAT_UCONTEXT_H
 
-#include<linux/compat.h>
-#include<asm/compat_signal.h>
+#include <linux/compat.h>
 
 /* 32-bit ucontext as seen from an 64-bit kernel */
 struct compat_ucontext {
diff --git a/include/asm-parisc/grfioctl.h b/include/asm-parisc/grfioctl.h
index 6a910311b56b..671e06042b40 100644
--- a/include/asm-parisc/grfioctl.h
+++ b/include/asm-parisc/grfioctl.h
@@ -58,7 +58,7 @@
 #define CRT_ID_ELK_1024DB       0x27849CA5      /* Elk 1024x768 double buffer */
 #define CRT_ID_ELK_GS           S9000_ID_A1924A /* Elk 1280x1024 GreyScale    */
 #define CRT_ID_CRX24            S9000_ID_A1439A /* Piranha */
-#define CRT_ID_VISUALIZE_EG     0x2D08C0A7      /* Graffiti (built-in B132+/B160L) */
+#define CRT_ID_VISUALIZE_EG     0x2D08C0A7      /* Graffiti, A4450A (built-in B132+/B160L) */
 #define CRT_ID_THUNDER          0x2F23E5FC      /* Thunder 1 VISUALIZE 48*/
 #define CRT_ID_THUNDER2         0x2F8D570E      /* Thunder 2 VISUALIZE 48 XP*/
 #define CRT_ID_HCRX             S9000_ID_HCRX   /* Hyperdrive HCRX */
diff --git a/include/asm-parisc/mman.h b/include/asm-parisc/mman.h
index 736b0abcac05..0ef15ee0f17e 100644
--- a/include/asm-parisc/mman.h
+++ b/include/asm-parisc/mman.h
@@ -38,7 +38,11 @@
 #define MADV_SPACEAVAIL 5               /* insure that resources are reserved */
 #define MADV_VPS_PURGE  6               /* Purge pages from VM page cache */
 #define MADV_VPS_INHERIT 7              /* Inherit parents page size */
-#define MADV_REMOVE     8               /* remove these pages & resources */
+
+/* common/generic parameters */
+#define MADV_REMOVE     9               /* remove these pages & resources */
+#define MADV_DONTFORK   10              /* don't inherit across fork */
+#define MADV_DOFORK     11              /* do inherit across fork */
 
 /* The range 12-64 is reserved for page size specification. */
 #define MADV_4K_PAGES   12              /* Use 4K pages  */
diff --git a/include/asm-parisc/pci.h b/include/asm-parisc/pci.h
index f277254159b7..fe7f6a2f5aa7 100644
--- a/include/asm-parisc/pci.h
+++ b/include/asm-parisc/pci.h
@@ -18,6 +18,18 @@
 */
 #define PCI_MAX_BUSSES  256
 
+
+/* To be used as: mdelay(pci_post_reset_delay);
+ *
+ * post_reset is the time the kernel should stall to prevent anyone from
+ * accessing the PCI bus once #RESET is de-asserted. 
+ * PCI spec somewhere says 1 second but with multi-PCI bus systems,
+ * this makes the boot time much longer than necessary.
+ * 20ms seems to work for all the HP PCI implementations to date.
+ */
+#define pci_post_reset_delay 50
+
+
 /*
 ** pci_hba_data (aka H2P_OBJECT in HP/UX)
 **
@@ -83,7 +95,7 @@ static __inline__  int pci_is_lmmio(struct pci_hba_data *hba, unsigned long a)
 
 /*
 ** Convert between PCI (IO_VIEW) addresses and processor (PA_VIEW) addresses.
-** See pcibios.c for more conversions used by Generic PCI code.
+** See pci.c for more conversions used by Generic PCI code.
 **
 ** Platform characteristics/firmware guarantee that
 **      (1) PA_VIEW - IO_VIEW = lmmio_offset for both LMMIO and ELMMIO
@@ -191,9 +203,6 @@ struct pci_bios_ops {
 */
 extern struct pci_port_ops *pci_port;
 extern struct pci_bios_ops *pci_bios;
-extern int pci_post_reset_delay;        /* delay after de-asserting #RESET */
-extern int pci_hba_count;
-extern struct pci_hba_data *parisc_pci_hba[];
 
 #ifdef CONFIG_PCI
 extern void pcibios_register_hba(struct pci_hba_data *);
diff --git a/include/asm-parisc/pgalloc.h b/include/asm-parisc/pgalloc.h
index 6291d6692e5d..3122fad38a1b 100644
--- a/include/asm-parisc/pgalloc.h
+++ b/include/asm-parisc/pgalloc.h
@@ -137,7 +137,6 @@ static inline void pte_free_kernel(pte_t *pte)
 
 #define pte_free(page)  pte_free_kernel(page_address(page))
 
-extern int do_check_pgt_cache(int, int);
 #define check_pgt_cache()       do { } while (0)
 
 #endif
diff --git a/include/asm-parisc/pgtable.h b/include/asm-parisc/pgtable.h
index b4554711c3e7..4e34c6b44059 100644
--- a/include/asm-parisc/pgtable.h
+++ b/include/asm-parisc/pgtable.h
@@ -213,7 +213,7 @@ extern  void *vmalloc_start;
 #define PAGE_COPY       PAGE_EXECREAD
 #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
 #define PAGE_KERNEL     __pgprot(_PAGE_KERNEL)
-#define PAGE_KERNEL_RO  __pgprot(_PAGE_PRESENT | _PAGE_EXEC | _PAGE_READ | _PAGE_DIRTY | _PAGE_ACCESSED)
+#define PAGE_KERNEL_RO  __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
 #define PAGE_GATEWAY    __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_ACCESSED | _PAGE_GATEWAY| _PAGE_READ)
 #define PAGE_FLUSH      __pgprot(_PAGE_FLUSH)
diff --git a/include/asm-parisc/rt_sigframe.h b/include/asm-parisc/rt_sigframe.h
index 5623c032b64c..f0dd3b30f6c4 100644
--- a/include/asm-parisc/rt_sigframe.h
+++ b/include/asm-parisc/rt_sigframe.h
@@ -1,10 +1,6 @@
 #ifndef _ASM_PARISC_RT_SIGFRAME_H
 #define _ASM_PARISC_RT_SIGFRAME_H
 
-#ifdef CONFIG_COMPAT
-#include <asm/compat_rt_sigframe.h>
-#endif
-
 #define SIGRETURN_TRAMP 4
 #define SIGRESTARTBLOCK_TRAMP 5 
 #define TRAMP_SIZE (SIGRETURN_TRAMP + SIGRESTARTBLOCK_TRAMP)
diff --git a/include/asm-parisc/unistd.h b/include/asm-parisc/unistd.h
index 80b7b98c70a1..c56fccbf34ad 100644
--- a/include/asm-parisc/unistd.h
+++ b/include/asm-parisc/unistd.h
@@ -761,8 +761,27 @@
 #define __NR_keyctl             (__NR_Linux + 266)
 #define __NR_ioprio_set         (__NR_Linux + 267)
 #define __NR_ioprio_get         (__NR_Linux + 268)
+#define __NR_inotify_init       (__NR_Linux + 269)
+#define __NR_inotify_add_watch  (__NR_Linux + 270)
+#define __NR_inotify_rm_watch   (__NR_Linux + 271)
+#define __NR_migrate_pages      (__NR_Linux + 272)
+#define __NR_pselect6           (__NR_Linux + 273)
+#define __NR_ppoll              (__NR_Linux + 274)
+#define __NR_openat             (__NR_Linux + 275)
+#define __NR_mkdirat            (__NR_Linux + 276)
+#define __NR_mknodat            (__NR_Linux + 277)
+#define __NR_fchownat           (__NR_Linux + 278)
+#define __NR_futimesat          (__NR_Linux + 279)
+#define __NR_newfstatat         (__NR_Linux + 280)
+#define __NR_unlinkat           (__NR_Linux + 281)
+#define __NR_renameat           (__NR_Linux + 282)
+#define __NR_linkat             (__NR_Linux + 283)
+#define __NR_symlinkat          (__NR_Linux + 284)
+#define __NR_readlinkat         (__NR_Linux + 285)
+#define __NR_fchmodat           (__NR_Linux + 286)
+#define __NR_faccessat          (__NR_Linux + 287)
 
-#define __NR_Linux_syscalls     269
+#define __NR_Linux_syscalls     288
 
 #define HPUX_GATEWAY_ADDR       0xC0000004
 #define LINUX_GATEWAY_ADDR      0x100
diff --git a/include/asm-powerpc/compat.h b/include/asm-powerpc/compat.h
index accb80c9a339..aacaabd28ac1 100644
--- a/include/asm-powerpc/compat.h
+++ b/include/asm-powerpc/compat.h
@@ -126,6 +126,11 @@ static inline void __user *compat_ptr(compat_uptr_t uptr)
         return (void __user *)(unsigned long)uptr;
 }
 
+static inline compat_uptr_t ptr_to_compat(void __user *uptr)
+{
+        return (u32)(unsigned long)uptr;
+}
+
 static inline void __user *compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = current->thread.regs;
diff --git a/include/asm-powerpc/cputable.h b/include/asm-powerpc/cputable.h
index 64210549f56b..5638518968c3 100644
--- a/include/asm-powerpc/cputable.h
+++ b/include/asm-powerpc/cputable.h
@@ -20,6 +20,8 @@
 #define PPC_FEATURE_POWER5_PLUS         0x00020000
 #define PPC_FEATURE_CELL                0x00010000
 #define PPC_FEATURE_BOOKE               0x00008000
+#define PPC_FEATURE_SMT                 0x00004000
+#define PPC_FEATURE_ICACHE_SNOOP        0x00002000
 
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
@@ -159,9 +161,11 @@ extern void do_cpu_ftr_fixups(unsigned long offset);
 #endif
 
 /* We need to mark all pages as being coherent if we're SMP or we
- * have a 74[45]x and an MPC107 host bridge.
+ * have a 74[45]x and an MPC107 host bridge. Also 83xx requires
+ * it for PCI "streaming/prefetch" to work properly.
  */
-#if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE)
+#if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE) \
+        || defined(CONFIG_PPC_83xx)
 #define CPU_FTR_COMMON                  CPU_FTR_NEED_COHERENT
 #else
 #define CPU_FTR_COMMON                  0
@@ -277,7 +281,8 @@ enum {
         CPU_FTRS_G2_LE = CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_MAYBE_CAN_DOZE |
             CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
         CPU_FTRS_E300 = CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_MAYBE_CAN_DOZE |
-            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
+            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS |
+            CPU_FTR_COMMON,
         CPU_FTRS_CLASSIC32 = CPU_FTR_COMMON | CPU_FTR_SPLIT_ID_CACHE |
             CPU_FTR_USE_TB | CPU_FTR_HPTE_TABLE,
         CPU_FTRS_POWER3_32 = CPU_FTR_COMMON | CPU_FTR_SPLIT_ID_CACHE |
diff --git a/include/asm-powerpc/dma-mapping.h b/include/asm-powerpc/dma-mapping.h
index 837756ab7dc7..2ac63f569592 100644
--- a/include/asm-powerpc/dma-mapping.h
+++ b/include/asm-powerpc/dma-mapping.h
@@ -15,7 +15,6 @@
 #include <linux/mm.h>
 #include <asm/scatterlist.h>
 #include <asm/io.h>
-#include <asm/bug.h>
 
 #define DMA_ERROR_CODE          (~(dma_addr_t)0x0)
 
diff --git a/include/asm-powerpc/eeh.h b/include/asm-powerpc/eeh.h
index b263fb2fa6e4..5207758a6dd9 100644
--- a/include/asm-powerpc/eeh.h
+++ b/include/asm-powerpc/eeh.h
@@ -27,6 +27,7 @@
 #include <linux/string.h>
 
 struct pci_dev;
+struct pci_bus;
 struct device_node;
 
 #ifdef CONFIG_EEH
@@ -60,8 +61,9 @@ void __init pci_addr_cache_build(void);
  * to finish the eeh setup for this device.
  */
 void eeh_add_device_early(struct device_node *);
+void eeh_add_device_late(struct pci_dev *dev);
 void eeh_add_device_tree_early(struct device_node *);
-void eeh_add_device_late(struct pci_dev *);
+void eeh_add_device_tree_late(struct pci_bus *);
 
 /**
  * eeh_remove_device - undo EEH setup for the indicated pci device
@@ -122,6 +124,8 @@ static inline void eeh_remove_device(struct pci_dev *dev) { }
 
 static inline void eeh_add_device_tree_early(struct device_node *dn) { }
 
+static inline void eeh_add_device_tree_late(struct pci_bus *bus) { }
+
 static inline void eeh_remove_bus_device(struct pci_dev *dev) { }
 #define EEH_POSSIBLE_ERROR(val, type) (0)
 #define EEH_IO_ERROR_VALUE(size) (-1UL)
diff --git a/include/asm-powerpc/kexec.h b/include/asm-powerpc/kexec.h
index bda2f217e6fe..6a2af2f6853b 100644
--- a/include/asm-powerpc/kexec.h
+++ b/include/asm-powerpc/kexec.h
@@ -93,7 +93,8 @@ static inline void crash_setup_regs(struct pt_regs *newregs,
                         "mfxer  %0\n"
                         "std    %0, 296(%2)\n"
                         : "=&r" (tmp1), "=&r" (tmp2)
-                        : "b" (newregs));
+                        : "b" (newregs)
+                        : "memory");
         }
 }
 #else
diff --git a/include/asm-powerpc/mman.h b/include/asm-powerpc/mman.h
index a2e34c21b44f..24cf664a8295 100644
--- a/include/asm-powerpc/mman.h
+++ b/include/asm-powerpc/mman.h
@@ -1,6 +1,8 @@
 #ifndef _ASM_POWERPC_MMAN_H
 #define _ASM_POWERPC_MMAN_H
 
+#include <asm-generic/mman.h>
+
 /*
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -8,19 +10,6 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
 #define MAP_RENAME      MAP_ANONYMOUS   /* In SunOS terminology */
 #define MAP_NORESERVE   0x40            /* don't reserve swap pages */
 #define MAP_LOCKED      0x80
@@ -29,25 +18,10 @@
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
 #define MAP_EXECUTABLE  0x1000          /* mark it as an executable */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     0x2000          /* lock all currently mapped pages */
 #define MCL_FUTURE      0x4000          /* lock all additions to address space */
 
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif  /* _ASM_POWERPC_MMAN_H */
diff --git a/include/asm-powerpc/mmu.h b/include/asm-powerpc/mmu.h
index d096d9e76ad7..b0b9a3f8cdc2 100644
--- a/include/asm-powerpc/mmu.h
+++ b/include/asm-powerpc/mmu.h
@@ -112,6 +112,7 @@ typedef struct {
 } hpte_t;
 
 extern hpte_t *htab_address;
+extern unsigned long htab_size_bytes;
 extern unsigned long htab_hash_mask;
 
 /*
diff --git a/include/asm-powerpc/pgalloc.h b/include/asm-powerpc/pgalloc.h
index 9f5b052784a5..a00ee002cd11 100644
--- a/include/asm-powerpc/pgalloc.h
+++ b/include/asm-powerpc/pgalloc.h
@@ -146,7 +146,7 @@ extern void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf);
         pgtable_free_tlb(tlb, pgtable_free_cache(pmd, \
                 PMD_CACHE_NUM, PMD_TABLE_SIZE-1))
 #ifndef CONFIG_PPC_64K_PAGES
-#define __pud_free_tlb(tlb, pmd)        \
+#define __pud_free_tlb(tlb, pud)        \
         pgtable_free_tlb(tlb, pgtable_free_cache(pud, \
                 PUD_CACHE_NUM, PUD_TABLE_SIZE-1))
 #endif /* CONFIG_PPC_64K_PAGES */
diff --git a/include/asm-powerpc/pgtable-4k.h b/include/asm-powerpc/pgtable-4k.h
index e9590c06ad92..80a7832d2721 100644
--- a/include/asm-powerpc/pgtable-4k.h
+++ b/include/asm-powerpc/pgtable-4k.h
@@ -88,4 +88,4 @@
     (((addr) >> PUD_SHIFT) & (PTRS_PER_PUD - 1)))
 
 #define pud_ERROR(e) \
-        printk("%s:%d: bad pmd %08lx.\n", __FILE__, __LINE__, pud_val(e))
+        printk("%s:%d: bad pud %08lx.\n", __FILE__, __LINE__, pud_val(e))
diff --git a/include/asm-powerpc/ppc-pci.h b/include/asm-powerpc/ppc-pci.h
index f80482c7231f..cf79bc7ebb55 100644
--- a/include/asm-powerpc/ppc-pci.h
+++ b/include/asm-powerpc/ppc-pci.h
@@ -38,6 +38,7 @@ void *traverse_pci_devices(struct device_node *start, traverse_func pre,
 
 void pci_devs_phb_init(void);
 void pci_devs_phb_init_dynamic(struct pci_controller *phb);
+int setup_phb(struct device_node *dev, struct pci_controller *phb);
 void __devinit scan_phb(struct pci_controller *hose);
 
 /* From rtas_pci.h */
diff --git a/include/asm-powerpc/prom.h b/include/asm-powerpc/prom.h
index 5b2bd4eefb01..cbd297f44cce 100644
--- a/include/asm-powerpc/prom.h
+++ b/include/asm-powerpc/prom.h
@@ -222,5 +222,7 @@ extern int of_address_to_resource(struct device_node *dev, int index,
 extern int of_pci_address_to_resource(struct device_node *dev, int bar,
                                       struct resource *r);
 
+extern void kdump_move_device_tree(void);
+
 #endif /* __KERNEL__ */
 #endif /* _POWERPC_PROM_H */
diff --git a/include/asm-powerpc/reg.h b/include/asm-powerpc/reg.h
index 12ecc9b9f285..72bfe3af0460 100644
--- a/include/asm-powerpc/reg.h
+++ b/include/asm-powerpc/reg.h
@@ -615,27 +615,9 @@
 #define proc_trap()     asm volatile("trap")
 
 #ifdef CONFIG_PPC64
-static inline void ppc64_runlatch_on(void)
-{
-        unsigned long ctrl;
-
-        if (cpu_has_feature(CPU_FTR_CTRL)) {
-                ctrl = mfspr(SPRN_CTRLF);
-                ctrl |= CTRL_RUNLATCH;
-                mtspr(SPRN_CTRLT, ctrl);
-        }
-}
-
-static inline void ppc64_runlatch_off(void)
-{
-        unsigned long ctrl;
-
-        if (cpu_has_feature(CPU_FTR_CTRL)) {
-                ctrl = mfspr(SPRN_CTRLF);
-                ctrl &= ~CTRL_RUNLATCH;
-                mtspr(SPRN_CTRLT, ctrl);
-        }
-}
+
+extern void ppc64_runlatch_on(void);
+extern void ppc64_runlatch_off(void);
 
 extern unsigned long scom970_read(unsigned int address);
 extern void scom970_write(unsigned int address, unsigned long value);
@@ -645,15 +627,6 @@ extern void scom970_write(unsigned int address, unsigned long value);
 #define __get_SP()      ({unsigned long sp; \
                         asm volatile("mr %0,1": "=r" (sp)); sp;})
 
-#else /* __ASSEMBLY__ */
-
-#define RUNLATCH_ON(REG)                        \
-BEGIN_FTR_SECTION                               \
-        mfspr   (REG),SPRN_CTRLF;               \
-        ori     (REG),(REG),CTRL_RUNLATCH;      \
-        mtspr   SPRN_CTRLT,(REG);               \
-END_FTR_SECTION_IFSET(CPU_FTR_CTRL)
-
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_REG_H */
diff --git a/include/asm-powerpc/smu.h b/include/asm-powerpc/smu.h
index 82ce47607774..2dc93632f210 100644
--- a/include/asm-powerpc/smu.h
+++ b/include/asm-powerpc/smu.h
@@ -521,6 +521,11 @@ struct smu_sdbp_cpupiddata {
 extern struct smu_sdbp_header *smu_get_sdb_partition(int id,
                                         unsigned int *size);
 
+/* Get "sdb" partition data from an SMU satellite */
+extern struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id,
+                                        int id, unsigned int *size);
+
+
 #endif /* __KERNEL__ */
 
 
diff --git a/include/asm-powerpc/thread_info.h b/include/asm-powerpc/thread_info.h
index 67cdaf3ae9fc..ffc7462d77ba 100644
--- a/include/asm-powerpc/thread_info.h
+++ b/include/asm-powerpc/thread_info.h
@@ -37,7 +37,6 @@ struct thread_info {
         int             preempt_count;          /* 0 => preemptable,
                                                    <0 => BUG */
         struct restart_block restart_block;
-        void *nvgprs_frame;
         /* low level flags - has atomic operations done on it */
         unsigned long   flags ____cacheline_aligned_in_smp;
 };
@@ -113,14 +112,13 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_POLLING_NRFLAG      4       /* true if poll_idle() is polling
                                            TIF_NEED_RESCHED */
 #define TIF_32BIT               5       /* 32 bit binary */
-/* #define SPARE                6 */
+#define TIF_RUNLATCH            6       /* Is the runlatch enabled? */
 #define TIF_ABI_PENDING         7       /* 32/64 bit switch needed */
 #define TIF_SYSCALL_AUDIT       8       /* syscall auditing active */
 #define TIF_SINGLESTEP          9       /* singlestepping active */
 #define TIF_MEMDIE              10
 #define TIF_SECCOMP             11      /* secure computing */
 #define TIF_RESTOREALL          12      /* Restore all regs (implies NOERROR) */
-#define TIF_SAVE_NVGPRS         13      /* Save r14-r31 in signal frame */
 #define TIF_NOERROR             14      /* Force successful syscall return */
 #define TIF_RESTORE_SIGMASK     15      /* Restore signal mask in do_signal */
 
@@ -131,21 +129,19 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_32BIT              (1<<TIF_32BIT)
-/* #define _SPARE               (1<<SPARE) */
+#define _TIF_RUNLATCH           (1<<TIF_RUNLATCH)
 #define _TIF_ABI_PENDING        (1<<TIF_ABI_PENDING)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
 #define _TIF_SINGLESTEP         (1<<TIF_SINGLESTEP)
 #define _TIF_SECCOMP            (1<<TIF_SECCOMP)
 #define _TIF_RESTOREALL         (1<<TIF_RESTOREALL)
-#define _TIF_SAVE_NVGPRS        (1<<TIF_SAVE_NVGPRS)
 #define _TIF_NOERROR            (1<<TIF_NOERROR)
 #define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
 #define _TIF_SYSCALL_T_OR_A     (_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SECCOMP)
 
 #define _TIF_USER_WORK_MASK     (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | \
-                                 _TIF_NEED_RESCHED | _TIF_RESTOREALL | \
-                                 _TIF_RESTORE_SIGMASK)
-#define _TIF_PERSYSCALL_MASK    (_TIF_RESTOREALL|_TIF_NOERROR|_TIF_SAVE_NVGPRS)
+                                 _TIF_NEED_RESCHED | _TIF_RESTORE_SIGMASK)
+#define _TIF_PERSYSCALL_MASK    (_TIF_RESTOREALL|_TIF_NOERROR)
 
 #endif /* __KERNEL__ */
 
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index a40cdff21a88..35556993f066 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -300,8 +300,9 @@
 #define __NR_spu_create         279
 #define __NR_pselect6           280
 #define __NR_ppoll              281
+#define __NR_unshare            282
 
-#define __NR_syscalls           282
+#define __NR_syscalls           283
 
 #ifdef __KERNEL__
 #define __NR__exit __NR_exit
diff --git a/include/asm-ppc/machdep.h b/include/asm-ppc/machdep.h
index 39200def8d11..a3e8a45e45a9 100644
--- a/include/asm-ppc/machdep.h
+++ b/include/asm-ppc/machdep.h
@@ -154,19 +154,6 @@ extern char cmd_line[COMMAND_LINE_SIZE];
 
 extern void setup_pci_ptrs(void);
 
-/*
- * Power macintoshes have either a CUDA or a PMU controlling
- * system reset, power, NVRAM, RTC.
- */
-typedef enum sys_ctrler_kind {
-        SYS_CTRLER_UNKNOWN = 0,
-        SYS_CTRLER_CUDA = 1,
-        SYS_CTRLER_PMU = 2,
-        SYS_CTRLER_SMU = 3,
-} sys_ctrler_t;
-
-extern sys_ctrler_t sys_ctrler;
-
 #ifdef CONFIG_SMP
 struct smp_ops_t {
         void  (*message_pass)(int target, int msg);
diff --git a/include/asm-s390/bitops.h b/include/asm-s390/bitops.h
index 61232760cc3b..3628899f48bb 100644
--- a/include/asm-s390/bitops.h
+++ b/include/asm-s390/bitops.h
@@ -518,8 +518,8 @@ static inline int __test_bit(unsigned long nr, const volatile unsigned long *ptr
 
 static inline int 
 __constant_test_bit(unsigned long nr, const volatile unsigned long *addr) {
-    return ((((volatile char *) addr)
-            [(nr^(__BITOPS_WORDSIZE-8))>>3] & (1<<(nr&7)))) != 0;
+    return (((volatile char *) addr)
+            [(nr^(__BITOPS_WORDSIZE-8))>>3] & (1<<(nr&7))) != 0;
 }
 
 #define test_bit(nr,addr) \
diff --git a/include/asm-s390/dasd.h b/include/asm-s390/dasd.h
index c744ff33b1df..1630c26e8f45 100644
--- a/include/asm-s390/dasd.h
+++ b/include/asm-s390/dasd.h
@@ -204,8 +204,7 @@ typedef struct attrib_data_t {
  *
  * Here ist how the ioctl-nr should be used:
  *    0 -   31   DASD driver itself
- *   32 -  229   still open
- *  230 -  239   DASD extended error reporting
+ *   32 -  239   still open
  *  240 -  255   reserved for EMC 
  *******************************************************************************/
 
@@ -237,22 +236,12 @@ typedef struct attrib_data_t {
 #define BIODASDPSRD    _IOR(DASD_IOCTL_LETTER,4,dasd_rssd_perf_stats_t)
 /* Get Attributes (cache operations) */
 #define BIODASDGATTR   _IOR(DASD_IOCTL_LETTER,5,attrib_data_t) 
-/* retrieve extended error-reporting value */
-#define BIODASDEERGET  _IOR(DASD_IOCTL_LETTER,6,int)
 
 
 /* #define BIODASDFORMAT  _IOW(IOCTL_LETTER,0,format_data_t) , deprecated */
 #define BIODASDFMT     _IOW(DASD_IOCTL_LETTER,1,format_data_t) 
 /* Set Attributes (cache operations) */
 #define BIODASDSATTR   _IOW(DASD_IOCTL_LETTER,2,attrib_data_t) 
-/* retrieve extended error-reporting value */
-#define BIODASDEERSET  _IOW(DASD_IOCTL_LETTER,3,int)
-
-
-/* remove all records from the eer buffer */
-#define DASD_EER_PURGE       _IO(DASD_IOCTL_LETTER,230)
-/* set the number of pages that are used for the internal eer buffer */
-#define DASD_EER_SETBUFSIZE  _IOW(DASD_IOCTL_LETTER,230,int)
 
 
 #endif                          /* DASD_H */
diff --git a/include/asm-s390/mman.h b/include/asm-s390/mman.h
index c8d5409b5d56..7839767d837e 100644
--- a/include/asm-s390/mman.h
+++ b/include/asm-s390/mman.h
@@ -9,19 +9,7 @@
 #ifndef __S390_MMAN_H__
 #define __S390_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -31,22 +19,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL    0x0              /* default page-in behavior */
-#define MADV_RANDOM    0x1              /* page-in minimum required */
-#define MADV_SEQUENTIAL        0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED  0x3              /* pre-fault pages */
-#define MADV_DONTNEED  0x4              /* discard these pages */
-#define MADV_REMOVE    0x5              /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __S390_MMAN_H__ */
diff --git a/include/asm-s390/setup.h b/include/asm-s390/setup.h
index 348a88137445..da3fd4a7bb32 100644
--- a/include/asm-s390/setup.h
+++ b/include/asm-s390/setup.h
@@ -8,6 +8,8 @@
 #ifndef _ASM_S390_SETUP_H
 #define _ASM_S390_SETUP_H
 
+#ifdef __KERNEL__
+
 #include <asm/types.h>
 
 #define PARMAREA                0x10400
@@ -114,7 +116,7 @@ extern u16 ipl_devno;
                                  IPL_PARMBLOCK_ORIGIN)
 #define IPL_PARMBLOCK_SIZE      (IPL_PARMBLOCK_START->hdr.length)
 
-#else 
+#else /* __ASSEMBLY__ */
 
 #ifndef __s390x__
 #define IPL_DEVICE        0x10404
@@ -127,6 +129,6 @@ extern u16 ipl_devno;
 #endif /* __s390x__ */
 #define COMMAND_LINE      0x10480
 
-#endif
-
-#endif
+#endif /* __ASSEMBLY__ */
+#endif /* __KERNEL__ */
+#endif /* _ASM_S390_SETUP_H */
diff --git a/include/asm-s390/smp.h b/include/asm-s390/smp.h
index a2ae7628bbaa..444dae5912e6 100644
--- a/include/asm-s390/smp.h
+++ b/include/asm-s390/smp.h
@@ -31,6 +31,7 @@ typedef struct
         __u16      cpu;
 } sigp_info;
 
+extern void smp_setup_cpu_possible_map(void);
 extern int smp_call_function_on(void (*func) (void *info), void *info,
                                 int nonatomic, int wait, int cpu);
 #define NO_PROC_ID              0xFF            /* No processor magic marker */
@@ -101,8 +102,10 @@ smp_call_function_on(void (*func) (void *info), void *info,
         func(info);
         return 0;
 }
+#define smp_cpu_not_running(cpu)        1
 #define smp_get_cpu(cpu) ({ 0; })
 #define smp_put_cpu(cpu) ({ 0; })
+#define smp_setup_cpu_possible_map()
 #endif
 
 #endif
diff --git a/include/asm-s390/system.h b/include/asm-s390/system.h
index b2e65e8bf812..6a89dbb03c1e 100644
--- a/include/asm-s390/system.h
+++ b/include/asm-s390/system.h
@@ -118,6 +118,8 @@ static inline void sched_cacheflush(void)
 extern void account_vtime(struct task_struct *);
 extern void account_tick_vtime(struct task_struct *);
 extern void account_system_vtime(struct task_struct *);
+#else
+#define account_vtime(x) do { /* empty */ } while (0)
 #endif
 
 #define finish_arch_switch(prev) do {                                        \
diff --git a/include/asm-s390/uaccess.h b/include/asm-s390/uaccess.h
index be104f21c70a..0b7c0ca4c3d7 100644
--- a/include/asm-s390/uaccess.h
+++ b/include/asm-s390/uaccess.h
@@ -61,7 +61,7 @@
 #define segment_eq(a,b) ((a).ar4 == (b).ar4)
 
 
-static inline int __access_ok(const void *addr, unsigned long size)
+static inline int __access_ok(const void __user *addr, unsigned long size)
 {
         return 1;
 }
@@ -208,25 +208,25 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         case 1: {                                               \
                 unsigned char __x;                              \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 2: {                                               \
                 unsigned short __x;                             \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 4: {                                               \
                 unsigned int __x;                               \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 8: {                                               \
                 unsigned long long __x;                         \
                 __get_user_asm(__x, ptr, __gu_err);             \
-                (x) = *(__typeof__(*(ptr)) *) &__x;             \
+                (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         default:                                                \
diff --git a/include/asm-s390/unistd.h b/include/asm-s390/unistd.h
index 29a9f357eb9e..657d582e8149 100644
--- a/include/asm-s390/unistd.h
+++ b/include/asm-s390/unistd.h
@@ -285,7 +285,7 @@
 #define __NR_mknodat            290
 #define __NR_fchownat           291
 #define __NR_futimesat          292
-#define __NR_newfstatat         293
+#define __NR_fstatat64          293
 #define __NR_unlinkat           294
 #define __NR_renameat           295
 #define __NR_linkat             296
@@ -295,8 +295,9 @@
 #define __NR_faccessat          300
 #define __NR_pselect6           301
 #define __NR_ppoll              302
+#define __NR_unshare            303
 
-#define NR_syscalls 303
+#define NR_syscalls 304
 
 /* 
  * There are some system calls that are not present on 64 bit, some
@@ -358,6 +359,7 @@
 #undef  __NR_fcntl64
 #undef  __NR_sendfile64
 #undef  __NR_fadvise64_64
+#undef  __NR_fstatat64
 
 #define __NR_select             142
 #define __NR_getrlimit          191     /* SuS compliant getrlimit */
@@ -380,6 +382,7 @@
 #define __NR_setgid             214
 #define __NR_setfsuid           215
 #define __NR_setfsgid           216
+#define __NR_newfstatat         293
 
 #endif
 
diff --git a/include/asm-sh/mman.h b/include/asm-sh/mman.h
index 693bd55a3710..156eb0225cf6 100644
--- a/include/asm-sh/mman.h
+++ b/include/asm-sh/mman.h
@@ -1,19 +1,7 @@
 #ifndef __ASM_SH_MMAN_H
 #define __ASM_SH_MMAN_H
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -23,22 +11,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) page tables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __ASM_SH_MMAN_H */
diff --git a/include/asm-sparc/mman.h b/include/asm-sparc/mman.h
index 98435ad8619e..88d1886abf3b 100644
--- a/include/asm-sparc/mman.h
+++ b/include/asm-sparc/mman.h
@@ -2,21 +2,10 @@
 #ifndef __SPARC_MMAN_H__
 #define __SPARC_MMAN_H__
 
+#include <asm-generic/mman.h>
+
 /* SunOS'ified... */
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
 #define MAP_RENAME      MAP_ANONYMOUS   /* In SunOS terminology */
 #define MAP_NORESERVE   0x40            /* don't reserve swap pages */
 #define MAP_INHERIT     0x80            /* SunOS doesn't do this, but... */
@@ -27,10 +16,6 @@
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
 #define MAP_EXECUTABLE  0x1000          /* mark it as an executable */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     0x2000          /* lock all currently mapped pages */
 #define MCL_FUTURE      0x4000          /* lock all additions to address space */
 
@@ -48,16 +33,6 @@
 #define MC_LOCKAS       5  /* Lock an entire address space of the calling process */
 #define MC_UNLOCKAS     6  /* Unlock entire address space of calling process */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
 #define MADV_FREE       0x5             /* (Solaris) contents can be freed */
-#define MADV_REMOVE     0x6             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
 
 #endif /* __SPARC_MMAN_H__ */
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index 2ac64e65e336..64ec640a40ee 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -305,7 +305,7 @@
 #define __NR_mknodat            286
 #define __NR_fchownat           287
 #define __NR_futimesat          288
-#define __NR_newfstatat         289
+#define __NR_fstatat64          289
 #define __NR_unlinkat           290
 #define __NR_renameat           291
 #define __NR_linkat             292
@@ -315,11 +315,12 @@
 #define __NR_faccessat          296
 #define __NR_pselect6           297
 #define __NR_ppoll              298
+#define __NR_unshare            299
 
-/* WARNING: You MAY NOT add syscall numbers larger than 298, since
+/* WARNING: You MAY NOT add syscall numbers larger than 299, since
  *          all of the syscall tables in the Sparc kernel are
- *          sized to have 298 entries (starting at zero).  Therefore
- *          find a free slot in the 0-298 range.
+ *          sized to have 299 entries (starting at zero).  Therefore
+ *          find a free slot in the 0-299 range.
  */
 
 #define _syscall0(type,name) \
diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
index 6a332a9f099c..34c4b43d3f98 100644
--- a/include/asm-sparc64/futex.h
+++ b/include/asm-sparc64/futex.h
@@ -1,6 +1,86 @@
-#ifndef _ASM_FUTEX_H
-#define _ASM_FUTEX_H
+#ifndef _SPARC64_FUTEX_H
+#define _SPARC64_FUTEX_H
 
-#include <asm-generic/futex.h>
+#include <linux/futex.h>
+#include <asm/errno.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
 
-#endif
+#define __futex_cas_op(insn, ret, oldval, uaddr, oparg) \
+        __asm__ __volatile__(                           \
+        "\n1:   lduwa   [%3] %%asi, %2\n"               \
+        "       " insn "\n"                             \
+        "2:     casa    [%3] %%asi, %2, %1\n"           \
+        "       cmp     %2, %1\n"                       \
+        "       bne,pn  %%icc, 1b\n"                    \
+        "        mov    0, %0\n"                        \
+        "3:\n"                                          \
+        "       .section .fixup,#alloc,#execinstr\n"    \
+        "       .align  4\n"                            \
+        "4:     ba      3b\n"                           \
+        "        mov    %5, %0\n"                       \
+        "       .previous\n"                            \
+        "       .section __ex_table,\"a\"\n"            \
+        "       .align  4\n"                            \
+        "       .word   1b, 4b\n"                       \
+        "       .word   2b, 4b\n"                       \
+        "       .previous\n"                            \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tem)      \
+        : "r" (uaddr), "r" (oparg), "i" (-EFAULT)       \
+        : "memory")
+
+static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
+{
+        int op = (encoded_op >> 28) & 7;
+        int cmp = (encoded_op >> 24) & 15;
+        int oparg = (encoded_op << 8) >> 20;
+        int cmparg = (encoded_op << 20) >> 20;
+        int oldval = 0, ret, tem;
+
+        if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(int))))
+                return -EFAULT;
+        if (unlikely((((unsigned long) uaddr) & 0x3UL)))
+                return -EINVAL;
+
+        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
+                oparg = 1 << oparg;
+
+        inc_preempt_count();
+
+        switch (op) {
+        case FUTEX_OP_SET:
+                __futex_cas_op("mov\t%4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_ADD:
+                __futex_cas_op("add\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_OR:
+                __futex_cas_op("or\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_ANDN:
+                __futex_cas_op("and\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_XOR:
+                __futex_cas_op("xor\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        default:
+                ret = -ENOSYS;
+        }
+
+        dec_preempt_count();
+
+        if (!ret) {
+                switch (cmp) {
+                case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
+                case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
+                case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
+                case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
+                case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
+                case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
+                default: ret = -ENOSYS;
+                }
+        }
+        return ret;
+}
+
+#endif /* !(_SPARC64_FUTEX_H) */
diff --git a/include/asm-sparc64/mman.h b/include/asm-sparc64/mman.h
index cb4b6156194d..6fd878e61435 100644
--- a/include/asm-sparc64/mman.h
+++ b/include/asm-sparc64/mman.h
@@ -2,21 +2,10 @@
 #ifndef __SPARC64_MMAN_H__
 #define __SPARC64_MMAN_H__
 
+#include <asm-generic/mman.h>
+
 /* SunOS'ified... */
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_SEM        0x8             /* page may be used for atomic ops */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
 #define MAP_RENAME      MAP_ANONYMOUS   /* In SunOS terminology */
 #define MAP_NORESERVE   0x40            /* don't reserve swap pages */
 #define MAP_INHERIT     0x80            /* SunOS doesn't do this, but... */
@@ -27,10 +16,6 @@
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
 #define MAP_EXECUTABLE  0x1000          /* mark it as an executable */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     0x2000          /* lock all currently mapped pages */
 #define MCL_FUTURE      0x4000          /* lock all additions to address space */
 
@@ -48,16 +33,6 @@
 #define MC_LOCKAS       5  /* Lock an entire address space of the calling process */
 #define MC_UNLOCKAS     6  /* Unlock entire address space of calling process */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
 #define MADV_FREE       0x5             /* (Solaris) contents can be freed */
-#define MADV_REMOVE     0x6             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
 
 #endif /* __SPARC64_MMAN_H__ */
diff --git a/include/asm-sparc64/smp.h b/include/asm-sparc64/smp.h
index 110a2de89123..473edb2603ec 100644
--- a/include/asm-sparc64/smp.h
+++ b/include/asm-sparc64/smp.h
@@ -66,8 +66,14 @@ static __inline__ int hard_smp_processor_id(void)
 
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
+extern void smp_setup_cpu_possible_map(void);
+
 #endif /* !(__ASSEMBLY__) */
 
+#else
+
+#define smp_setup_cpu_possible_map() do { } while (0)
+
 #endif /* !(CONFIG_SMP) */
 
 #define NO_PROC_ID              0xFF
diff --git a/include/asm-sparc64/uaccess.h b/include/asm-sparc64/uaccess.h
index 203e8eee6351..c91d1e38eac6 100644
--- a/include/asm-sparc64/uaccess.h
+++ b/include/asm-sparc64/uaccess.h
@@ -136,7 +136,7 @@ __asm__ __volatile__(							\
         "b      2b\n\t"                                                 \
         " mov   %3, %0\n\n\t"                                           \
         ".previous\n\t"                                                 \
-        ".section __ex_table,#alloc\n\t"                                \
+        ".section __ex_table,\"a\"\n\t"                                 \
         ".align 4\n\t"                                                  \
         ".word  1b, 3b\n\t"                                             \
         ".previous\n\n\t"                                               \
@@ -148,7 +148,7 @@ if (__builtin_constant_p(ret) && ret == -EFAULT)			\
 __asm__ __volatile__(                                                   \
         "/* Put user asm ret, inline. */\n"                             \
 "1:\t"  "st"#size "a %1, [%2] %%asi\n\n\t"                              \
-        ".section __ex_table,#alloc\n\t"                                \
+        ".section __ex_table,\"a\"\n\t"                                 \
         ".align 4\n\t"                                                  \
         ".word  1b, __ret_efault\n\n\t"                                 \
         ".previous\n\n\t"                                               \
@@ -163,7 +163,7 @@ __asm__ __volatile__(							\
         "ret\n\t"                                                       \
         " restore %%g0, %3, %%o0\n\n\t"                                 \
         ".previous\n\t"                                                 \
-        ".section __ex_table,#alloc\n\t"                                \
+        ".section __ex_table,\"a\"\n\t"                                 \
         ".align 4\n\t"                                                  \
         ".word  1b, 3b\n\n\t"                                           \
         ".previous\n\n\t"                                               \
@@ -206,7 +206,7 @@ __asm__ __volatile__(							\
         "b      2b\n\t"                                                 \
         " mov   %3, %0\n\n\t"                                           \
         ".previous\n\t"                                                 \
-        ".section __ex_table,#alloc\n\t"                                \
+        ".section __ex_table,\"a\"\n\t"                                 \
         ".align 4\n\t"                                                  \
         ".word  1b, 3b\n\n\t"                                           \
         ".previous\n\t"                                                 \
@@ -218,7 +218,7 @@ if (__builtin_constant_p(retval) && retval == -EFAULT)			\
 __asm__ __volatile__(                                                   \
         "/* Get user asm ret, inline. */\n"                             \
 "1:\t"  "ld"#size "a [%1] %%asi, %0\n\n\t"                              \
-        ".section __ex_table,#alloc\n\t"                                \
+        ".section __ex_table,\"a\"\n\t"                                 \
         ".align 4\n\t"                                                  \
         ".word  1b,__ret_efault\n\n\t"                                  \
         ".previous\n\t"                                                 \
@@ -233,7 +233,7 @@ __asm__ __volatile__(							\
         "ret\n\t"                                                       \
         " restore %%g0, %2, %%o0\n\n\t"                                 \
         ".previous\n\t"                                                 \
-        ".section __ex_table,#alloc\n\t"                                \
+        ".section __ex_table,\"a\"\n\t"                                 \
         ".align 4\n\t"                                                  \
         ".word  1b, 3b\n\n\t"                                           \
         ".previous\n\t"                                                 \
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index 84ac2bdb0902..a284986b1541 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -307,7 +307,7 @@
 #define __NR_mknodat            286
 #define __NR_fchownat           287
 #define __NR_futimesat          288
-#define __NR_newfstatat         289
+#define __NR_fstatat64          289
 #define __NR_unlinkat           290
 #define __NR_renameat           291
 #define __NR_linkat             292
@@ -317,11 +317,12 @@
 #define __NR_faccessat          296
 #define __NR_pselect6           297
 #define __NR_ppoll              298
+#define __NR_unshare            299
 
-/* WARNING: You MAY NOT add syscall numbers larger than 298, since
+/* WARNING: You MAY NOT add syscall numbers larger than 299, since
  *          all of the syscall tables in the Sparc kernel are
- *          sized to have 298 entries (starting at zero).  Therefore
- *          find a free slot in the 0-298 range.
+ *          sized to have 299 entries (starting at zero).  Therefore
+ *          find a free slot in the 0-299 range.
  */
 
 #define _syscall0(type,name) \
diff --git a/include/asm-v850/mman.h b/include/asm-v850/mman.h
index edc79965193a..edbf6edbfb37 100644
--- a/include/asm-v850/mman.h
+++ b/include/asm-v850/mman.h
@@ -1,18 +1,7 @@
 #ifndef __V850_MMAN_H__
 #define __V850_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
-
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
+#include <asm-generic/mman.h>
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
 #define MAP_DENYWRITE   0x0800          /* ETXTBSY */
@@ -20,22 +9,7 @@
 #define MAP_LOCKED      0x2000          /* pages are locked */
 #define MAP_NORESERVE   0x4000          /* don't check for reservations */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif /* __V850_MMAN_H__ */
diff --git a/include/asm-x86_64/apic.h b/include/asm-x86_64/apic.h
index 4f6a4dc455bb..bdbd8935612a 100644
--- a/include/asm-x86_64/apic.h
+++ b/include/asm-x86_64/apic.h
@@ -17,6 +17,7 @@
 #define APIC_DEBUG   2
 
 extern int apic_verbosity;
+extern int apic_runs_main_timer;
 
 /*
  * Define the default level of output to be very little
diff --git a/include/asm-x86_64/cpufeature.h b/include/asm-x86_64/cpufeature.h
index 41c0ac8559be..76bb6193ae91 100644
--- a/include/asm-x86_64/cpufeature.h
+++ b/include/asm-x86_64/cpufeature.h
@@ -61,7 +61,7 @@
 #define X86_FEATURE_K6_MTRR     (3*32+ 1) /* AMD K6 nonstandard MTRRs */
 #define X86_FEATURE_CYRIX_ARR   (3*32+ 2) /* Cyrix ARRs (= MTRRs) */
 #define X86_FEATURE_CENTAUR_MCR (3*32+ 3) /* Centaur MCRs (= MTRRs) */
-/* 4 free */
+#define X86_FEATURE_REP_GOOD    (3*32+ 4) /* rep microcode works well on this CPU */
 #define X86_FEATURE_CONSTANT_TSC (3*32+5) /* TSC runs at constant rate */
 #define X86_FEATURE_SYNC_RDTSC  (3*32+6)  /* RDTSC syncs CPU core */
 
diff --git a/include/asm-x86_64/hardirq.h b/include/asm-x86_64/hardirq.h
index 8661b476fb40..8689951e3503 100644
--- a/include/asm-x86_64/hardirq.h
+++ b/include/asm-x86_64/hardirq.h
@@ -16,23 +16,6 @@
 #define set_softirq_pending(x) write_pda(__softirq_pending, (x))
 #define or_softirq_pending(x)  or_pda(__softirq_pending, (x))
 
-/*
- * 'what should we do if we get a hw irq event on an illegal vector'.
- * each architecture has to answer this themselves.
- */
-static inline void ack_bad_irq(unsigned int irq)
-{
-        printk("unexpected IRQ trap at vector %02x\n", irq);
-#ifdef CONFIG_X86_LOCAL_APIC
-        /*
-         * Currently unexpected vectors happen only on SMP and APIC.
-         * We _must_ ack these because every local APIC has only N
-         * irq slots per priority level, and a 'hanging, unacked' IRQ
-         * holds up an irq slot - in excessive cases (when multiple
-         * unexpected vectors occur) that might lock up the APIC
-         * completely.
-         */
-        ack_APIC_irq();
-#endif
-}
+extern void ack_bad_irq(unsigned int irq);
+
 #endif /* __ASM_HARDIRQ_H */
diff --git a/include/asm-x86_64/hpet.h b/include/asm-x86_64/hpet.h
index c20c28f5c7a0..08b75c15269a 100644
--- a/include/asm-x86_64/hpet.h
+++ b/include/asm-x86_64/hpet.h
@@ -55,6 +55,8 @@ extern int is_hpet_enabled(void);
 extern int hpet_rtc_timer_init(void);
 extern int oem_force_hpet_timer(void);
 
+extern int hpet_use_timer;
+
 #ifdef CONFIG_HPET_EMULATE_RTC
 extern int hpet_mask_rtc_irq_bit(unsigned long bit_mask);
 extern int hpet_set_rtc_irq_bit(unsigned long bit_mask);
diff --git a/include/asm-x86_64/ia32_unistd.h b/include/asm-x86_64/ia32_unistd.h
index 9afc0c7d3661..eeb2bcd635de 100644
--- a/include/asm-x86_64/ia32_unistd.h
+++ b/include/asm-x86_64/ia32_unistd.h
@@ -305,7 +305,7 @@
 #define __NR_ia32_mknodat               297
 #define __NR_ia32_fchownat              298
 #define __NR_ia32_futimesat             299
-#define __NR_ia32_newfstatat            300
+#define __NR_ia32_fstatat64             300
 #define __NR_ia32_unlinkat              301
 #define __NR_ia32_renameat              302
 #define __NR_ia32_linkat                303
@@ -313,7 +313,10 @@
 #define __NR_ia32_readlinkat            305
 #define __NR_ia32_fchmodat              306
 #define __NR_ia32_faccessat             307
+#define __NR_ia32_pselect6              308
+#define __NR_ia32_ppoll                 309
+#define __NR_ia32_unshare               310
 
-#define IA32_NR_syscalls 308    /* must be > than biggest syscall! */
+#define IA32_NR_syscalls 315    /* must be > than biggest syscall! */
 
 #endif /* _ASM_X86_64_IA32_UNISTD_H_ */
diff --git a/include/asm-x86_64/mman.h b/include/asm-x86_64/mman.h
index d0e97b74f735..dd5cb0534d37 100644
--- a/include/asm-x86_64/mman.h
+++ b/include/asm-x86_64/mman.h
@@ -1,19 +1,8 @@
 #ifndef __X8664_MMAN_H__
 #define __X8664_MMAN_H__
 
-#define PROT_READ       0x1             /* page can be read */
-#define PROT_WRITE      0x2             /* page can be written */
-#define PROT_EXEC       0x4             /* page can be executed */
-#define PROT_NONE       0x0             /* page can not be accessed */
-#define PROT_SEM        0x8
-#define PROT_GROWSDOWN  0x01000000      /* mprotect flag: extend change to start of growsdown vma */
-#define PROT_GROWSUP    0x02000000      /* mprotect flag: extend change to end of growsup vma */
+#include <asm-generic/mman.h>
 
-#define MAP_SHARED      0x01            /* Share changes */
-#define MAP_PRIVATE     0x02            /* Changes are private */
-#define MAP_TYPE        0x0f            /* Mask for type of mapping */
-#define MAP_FIXED       0x10            /* Interpret addr exactly */
-#define MAP_ANONYMOUS   0x20            /* don't use a file */
 #define MAP_32BIT       0x40            /* only give out 32bit addresses */
 
 #define MAP_GROWSDOWN   0x0100          /* stack-like segment */
@@ -24,22 +13,7 @@
 #define MAP_POPULATE    0x8000          /* populate (prefault) pagetables */
 #define MAP_NONBLOCK    0x10000         /* do not block on IO */
 
-#define MS_ASYNC        1               /* sync memory asynchronously */
-#define MS_INVALIDATE   2               /* invalidate the caches */
-#define MS_SYNC         4               /* synchronous memory sync */
-
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
-
-/* compatibility flags */
-#define MAP_ANON        MAP_ANONYMOUS
-#define MAP_FILE        0
-
 #endif
diff --git a/include/asm-x86_64/numa.h b/include/asm-x86_64/numa.h
index 34e434ce3268..dffe276ca2df 100644
--- a/include/asm-x86_64/numa.h
+++ b/include/asm-x86_64/numa.h
@@ -22,8 +22,15 @@ extern void numa_set_node(int cpu, int node);
 extern unsigned char apicid_to_node[256];
 #ifdef CONFIG_NUMA
 extern void __init init_cpu_to_node(void);
+
+static inline void clear_node_cpumask(int cpu)
+{
+        clear_bit(cpu, &node_to_cpumask[cpu_to_node(cpu)]);
+}
+
 #else
 #define init_cpu_to_node() do {} while (0)
+#define clear_node_cpumask(cpu) do {} while (0)
 #endif
 
 #define NUMA_NO_NODE 0xff
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index fd03e15d7ea6..8a05af264d18 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -19,8 +19,6 @@ extern unsigned int pcibios_assign_all_busses(void);
 #endif
 #define pcibios_scan_all_fns(a, b)      0
 
-extern int no_iommu, force_iommu;
-
 extern unsigned long pci_mem_start;
 #define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
diff --git a/include/asm-x86_64/pgtable.h b/include/asm-x86_64/pgtable.h
index 8fbf4dd72115..715fd94cf577 100644
--- a/include/asm-x86_64/pgtable.h
+++ b/include/asm-x86_64/pgtable.h
@@ -131,7 +131,7 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, unsigned long
 #define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
 
-#define USER_PTRS_PER_PGD       (TASK_SIZE/PGDIR_SIZE)
+#define USER_PTRS_PER_PGD       ((TASK_SIZE-1)/PGDIR_SIZE+1)
 #define FIRST_USER_ADDRESS      0
 
 #ifndef __ASSEMBLY__
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index 115e496c6139..3ba8fd45fcb3 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -39,12 +39,19 @@ extern void config_acpi_tables(void);
 extern void ia32_syscall(void);
 extern void iommu_hole_init(void);
 
-extern void time_init_gtod(void);
 extern int pmtimer_mark_offset(void);
+extern void pmtimer_resume(void);
+extern void pmtimer_wait(unsigned);
 extern unsigned int do_gettimeoffset_pm(void);
+#ifdef CONFIG_X86_PM_TIMER
 extern u32 pmtmr_ioport;
+#else
+#define pmtmr_ioport 0
+#endif
 extern unsigned long long monotonic_base;
 extern int sysctl_vsyscall;
+extern int nohpet;
+extern unsigned long vxtime_hz;
 
 extern void do_softirq_thunk(void);
 
@@ -65,6 +72,9 @@ extern void free_bootmem_generic(unsigned long phys, unsigned len);
 
 extern void load_gs_index(unsigned gs);
 
+extern void stop_timer_interrupt(void);
+extern void main_timer_handler(struct pt_regs *regs);
+
 extern unsigned long end_pfn_map; 
 
 extern void show_trace(unsigned long * rsp);
@@ -122,6 +132,8 @@ extern int fix_aperture;
 extern int force_iommu;
 
 extern int reboot_force;
+extern int notsc_setup(char *);
+extern int setup_additional_cpus(char *);
 
 extern void smp_local_timer_interrupt(struct pt_regs * regs);
 
diff --git a/include/asm-x86_64/system.h b/include/asm-x86_64/system.h
index a73f0c789d8b..b7f66034ae7a 100644
--- a/include/asm-x86_64/system.h
+++ b/include/asm-x86_64/system.h
@@ -327,7 +327,7 @@ static inline unsigned long __cmpxchg(volatile void *ptr, unsigned long old,
 #define wmb()   asm volatile("" ::: "memory")
 #endif
 #define read_barrier_depends()  do {} while(0)
-#define set_mb(var, value) do { xchg(&var, value); } while (0)
+#define set_mb(var, value) do { (void) xchg(&var, value); } while (0)
 #define set_wmb(var, value) do { var = value; wmb(); } while (0)
 
 #define warn_if_not_ulong(x) do { unsigned long foo; (void) (&(x) == &foo); } while (0)
diff --git a/include/asm-x86_64/unistd.h b/include/asm-x86_64/unistd.h
index 436d099b5b6b..da0341c57949 100644
--- a/include/asm-x86_64/unistd.h
+++ b/include/asm-x86_64/unistd.h
@@ -599,8 +599,14 @@ __SYSCALL(__NR_readlinkat, sys_readlinkat)
 __SYSCALL(__NR_fchmodat, sys_fchmodat)
 #define __NR_faccessat          269
 __SYSCALL(__NR_faccessat, sys_faccessat)
-
-#define __NR_syscall_max __NR_faccessat
+#define __NR_pselect6           270
+__SYSCALL(__NR_pselect6, sys_ni_syscall)        /* for now */
+#define __NR_ppoll              271
+__SYSCALL(__NR_ppoll,   sys_ni_syscall)         /* for now */
+#define __NR_unshare            272
+__SYSCALL(__NR_unshare, sys_unshare)
+
+#define __NR_syscall_max __NR_unshare
 
 #ifndef __NO_STUBS
 
diff --git a/include/asm-xtensa/mman.h b/include/asm-xtensa/mman.h
index 082a7504925e..ba394cbb4807 100644
--- a/include/asm-xtensa/mman.h
+++ b/include/asm-xtensa/mman.h
@@ -67,15 +67,19 @@
 #define MCL_CURRENT     1               /* lock all current mappings */
 #define MCL_FUTURE      2               /* lock all future mappings */
 
-#define MADV_NORMAL     0x0             /* default page-in behavior */
-#define MADV_RANDOM     0x1             /* page-in minimum required */
-#define MADV_SEQUENTIAL 0x2             /* read-ahead aggressively */
-#define MADV_WILLNEED   0x3             /* pre-fault pages */
-#define MADV_DONTNEED   0x4             /* discard these pages */
-#define MADV_REMOVE     0x5             /* remove these pages & resources */
+#define MADV_NORMAL     0               /* no further special treatment */
+#define MADV_RANDOM     1               /* expect random page references */
+#define MADV_SEQUENTIAL 2               /* expect sequential page references */
+#define MADV_WILLNEED   3               /* will need these pages */
+#define MADV_DONTNEED   4               /* don't need these pages */
+
+/* common parameters: try to keep these consistent across architectures */
+#define MADV_REMOVE     9               /* remove these pages & resources */
+#define MADV_DONTFORK   10              /* don't inherit across fork */
+#define MADV_DOFORK     11              /* do inherit across fork */
 
 /* compatibility flags */
-#define MAP_ANON       MAP_ANONYMOUS
-#define MAP_FILE       0
+#define MAP_ANON        MAP_ANONYMOUS
+#define MAP_FILE        0
 
 #endif /* _XTENSA_MMAN_H */
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 84d3d9f034ce..d3bc25e6d27d 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -427,7 +427,8 @@ extern int acpi_mp_config;
 extern struct acpi_table_mcfg_config *pci_mmcfg_config;
 extern int pci_mmcfg_config_num;
 
-extern int sbf_port ;
+extern int sbf_port;
+extern unsigned long acpi_video_flags;
 
 #else   /* !CONFIG_ACPI */
 
diff --git a/include/linux/compat.h b/include/linux/compat.h
index f9ca534787e2..c9ab2a26348c 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -161,5 +161,25 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *to, siginfo_t *from);
 int get_compat_sigevent(struct sigevent *event,
                 const struct compat_sigevent __user *u_event);
 
+static inline int compat_timeval_compare(struct compat_timeval *lhs,
+                                        struct compat_timeval *rhs)
+{
+        if (lhs->tv_sec < rhs->tv_sec)
+                return -1;
+        if (lhs->tv_sec > rhs->tv_sec)
+                return 1;
+        return lhs->tv_usec - rhs->tv_usec;
+}
+
+static inline int compat_timespec_compare(struct compat_timespec *lhs,
+                                        struct compat_timespec *rhs)
+{
+        if (lhs->tv_sec < rhs->tv_sec)
+                return -1;
+        if (lhs->tv_sec > rhs->tv_sec)
+                return 1;
+        return lhs->tv_nsec - rhs->tv_nsec;
+}
+
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/compat_ioctl.h b/include/linux/compat_ioctl.h
index 8fad50f8e389..ae7dfb790df3 100644
--- a/include/linux/compat_ioctl.h
+++ b/include/linux/compat_ioctl.h
@@ -696,6 +696,8 @@ COMPATIBLE_IOCTL(MEMLOCK)
 COMPATIBLE_IOCTL(MEMUNLOCK)
 COMPATIBLE_IOCTL(MEMGETREGIONCOUNT)
 COMPATIBLE_IOCTL(MEMGETREGIONINFO)
+COMPATIBLE_IOCTL(MEMGETBADBLOCK)
+COMPATIBLE_IOCTL(MEMSETBADBLOCK)
 /* NBD */
 ULONG_IOCTL(NBD_SET_SOCK)
 ULONG_IOCTL(NBD_SET_BLKSIZE)
diff --git a/include/linux/configfs.h b/include/linux/configfs.h
index acffb8c9073a..a7f015027535 100644
--- a/include/linux/configfs.h
+++ b/include/linux/configfs.h
@@ -126,7 +126,7 @@ extern struct config_item *config_group_find_obj(struct config_group *, const ch
 
 
 struct configfs_attribute {
-        char                    *ca_name;
+        const char              *ca_name;
         struct module           *ca_owner;
         mode_t                  ca_mode;
 };
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index 13e9f4a3ab26..60e56c6e03dd 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -84,7 +84,6 @@
 #include <linux/kernel.h>
 #include <linux/threads.h>
 #include <linux/bitmap.h>
-#include <asm/bug.h>
 
 typedef struct { DECLARE_BITMAP(bits, NR_CPUS); } cpumask_t;
 extern cpumask_t _unused_cpumask_arg_;
@@ -329,7 +328,7 @@ static inline void __cpus_remap(cpumask_t *dstp, const cpumask_t *srcp,
  * bitmap of size NR_CPUS.
  *
  *  #ifdef CONFIG_HOTPLUG_CPU
- *     cpu_possible_map - all NR_CPUS bits set
+ *     cpu_possible_map - has bit 'cpu' set iff cpu is populatable
  *     cpu_present_map  - has bit 'cpu' set iff cpu is populated
  *     cpu_online_map   - has bit 'cpu' set iff cpu available to scheduler
  *  #else
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index a3f09947940e..4361f3789975 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -8,7 +8,6 @@
 #include <linux/spinlock.h>
 #include <linux/cache.h>
 #include <linux/rcupdate.h>
-#include <asm/bug.h>
 
 struct nameidata;
 struct vfsmount;
diff --git a/include/linux/dvb/video.h b/include/linux/dvb/video.h
index b1999bfeaa56..b81e58b2ebf8 100644
--- a/include/linux/dvb/video.h
+++ b/include/linux/dvb/video.h
@@ -135,7 +135,7 @@ typedef struct video_spu {
 
 typedef struct video_spu_palette {      /* SPU Palette information */
         int length;
-        uint8_t *palette;
+        uint8_t __user *palette;
 } video_spu_palette_t;
 
 
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 23fe746a1d51..18cf1f3e1184 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -82,6 +82,7 @@ struct elevator_queue
 extern void elv_dispatch_sort(request_queue_t *, struct request *);
 extern void elv_add_request(request_queue_t *, struct request *, int, int);
 extern void __elv_add_request(request_queue_t *, struct request *, int, int);
+extern void elv_insert(request_queue_t *, struct request *, int);
 extern int elv_merge(request_queue_t *, struct request **, struct bio *);
 extern void elv_merge_requests(request_queue_t *, struct request *,
                                struct request *);
diff --git a/include/linux/file.h b/include/linux/file.h
index 418b6101b59a..9901b850f2e4 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -60,8 +60,6 @@ extern void put_filp(struct file *);
 extern int get_unused_fd(void);
 extern void FASTCALL(put_unused_fd(unsigned int fd));
 struct kmem_cache;
-extern void filp_ctor(void * objp, struct kmem_cache *cachep, unsigned long cflags);
-extern void filp_dtor(void * objp, struct kmem_cache *cachep, unsigned long dflags);
 
 extern struct file ** alloc_fd_array(int);
 extern void free_fd_array(struct file **, int);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index e059da947007..128d0082522c 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -35,6 +35,7 @@ struct files_stat_struct {
         int max_files;          /* tunable */
 };
 extern struct files_stat_struct files_stat;
+extern int get_max_files(void);
 
 struct inodes_stat_t {
         int nr_inodes;
@@ -1418,9 +1419,6 @@ extern int is_bad_inode(struct inode *);
 extern struct file_operations read_fifo_fops;
 extern struct file_operations write_fifo_fops;
 extern struct file_operations rdwr_fifo_fops;
-extern struct file_operations read_pipe_fops;
-extern struct file_operations write_pipe_fops;
-extern struct file_operations rdwr_pipe_fops;
 
 extern int fs_may_remount_ro(struct super_block *);
 
@@ -1666,6 +1664,8 @@ extern int vfs_follow_link(struct nameidata *, const char *);
 extern int page_readlink(struct dentry *, char __user *, int);
 extern void *page_follow_link_light(struct dentry *, struct nameidata *);
 extern void page_put_link(struct dentry *, struct nameidata *, void *);
+extern int __page_symlink(struct inode *inode, const char *symname, int len,
+                gfp_t gfp_mask);
 extern int page_symlink(struct inode *inode, const char *symname, int len);
 extern struct inode_operations page_symlink_inode_operations;
 extern int generic_readlink(struct dentry *, char __user *, int);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 20f9148e38d9..7851e6b520cf 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -157,9 +157,9 @@ extern void FASTCALL(free_cold_page(struct page *page));
 
 void page_alloc_init(void);
 #ifdef CONFIG_NUMA
-void drain_remote_pages(void);
+void drain_node_pages(int node);
 #else
-static inline void drain_remote_pages(void) { };
+static inline void drain_node_pages(int node) { };
 #endif
 
 #endif /* __LINUX_GFP_H */
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 6361544bb6ae..6401c31d6add 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -116,6 +116,10 @@ extern int hrtimer_try_to_cancel(struct hrtimer *timer);
 extern ktime_t hrtimer_get_remaining(const struct hrtimer *timer);
 extern int hrtimer_get_res(const clockid_t which_clock, struct timespec *tp);
 
+#ifdef CONFIG_NO_IDLE_HZ
+extern ktime_t hrtimer_get_next_event(void);
+#endif
+
 static inline int hrtimer_active(const struct hrtimer *timer)
 {
         return timer->state == HRTIMER_PENDING;
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index 7863a59bd598..63f1d63cc1d8 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -100,6 +100,9 @@ extern s32 i2c_smbus_write_block_data(struct i2c_client * client,
 /* Returns the number of read bytes */
 extern s32 i2c_smbus_read_i2c_block_data(struct i2c_client * client,
                                          u8 command, u8 *values);
+extern s32 i2c_smbus_write_i2c_block_data(struct i2c_client * client,
+                                          u8 command, u8 length,
+                                          u8 *values);
 
 /*
  * A driver is capable of handling one or more physical devices present on
diff --git a/include/linux/ioc3.h b/include/linux/ioc3.h
index e7906a72a4f1..da7c09e4ede6 100644
--- a/include/linux/ioc3.h
+++ b/include/linux/ioc3.h
@@ -27,7 +27,7 @@ struct ioc3_driver_data {
         int id;                         /* IOC3 sequence number */
         /* PCI mapping */
         unsigned long pma;              /* physical address */
-        struct __iomem ioc3 *vma;       /* pointer to registers */
+        struct ioc3 __iomem *vma;       /* pointer to registers */
         struct pci_dev *pdev;           /* PCI device */
         /* IRQ stuff */
         int dual_irq;                   /* set if separate IRQs are used */
diff --git a/include/linux/jbd.h b/include/linux/jbd.h
index 558cb4c26ec9..41ee79962bb2 100644
--- a/include/linux/jbd.h
+++ b/include/linux/jbd.h
@@ -23,6 +23,7 @@
 #define jfs_debug jbd_debug
 #else
 
+#include <linux/types.h>
 #include <linux/buffer_head.h>
 #include <linux/journal-head.h>
 #include <linux/stddef.h>
@@ -238,7 +239,6 @@ typedef struct journal_superblock_s
 
 #include <linux/fs.h>
 #include <linux/sched.h>
-#include <asm/bug.h>
 
 #define JBD_ASSERTIONS
 #ifdef JBD_ASSERTIONS
@@ -498,12 +498,6 @@ struct transaction_s
         struct journal_head     *t_checkpoint_list;
 
         /*
-         * Doubly-linked circular list of all buffers submitted for IO while
-         * checkpointing. [j_list_lock]
-         */
-        struct journal_head     *t_checkpoint_io_list;
-
-        /*
          * Doubly-linked circular list of temporary buffers currently undergoing
          * IO in the log [j_list_lock]
          */
@@ -618,6 +612,7 @@ struct transaction_s
  * @j_wbuf: array of buffer_heads for journal_commit_transaction
  * @j_wbufsize: maximum number of buffer_heads allowed in j_wbuf, the
  *      number that will fit in j_blocksize
+ * @j_last_sync_writer: most recent pid which did a synchronous write
  * @j_private: An opaque pointer to fs-private information.
  */
 
@@ -807,6 +802,8 @@ struct journal_s
         struct buffer_head      **j_wbuf;
         int                     j_wbufsize;
 
+        pid_t                   j_last_sync_writer;
+
         /*
          * An opaque pointer to fs-private information.  ext3 puts its
          * superblock pointer here
@@ -849,7 +846,7 @@ extern void journal_commit_transaction(journal_t *);
 
 /* Checkpoint list management */
 int __journal_clean_checkpoint_list(journal_t *journal);
-int __journal_remove_checkpoint(struct journal_head *);
+void __journal_remove_checkpoint(struct journal_head *);
 void __journal_insert_checkpoint(struct journal_head *, transaction_t *);
 
 /* Buffer IO */
diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
index 3aed37314ab8..e87c32a5c86a 100644
--- a/include/linux/kbd_kern.h
+++ b/include/linux/kbd_kern.h
@@ -153,8 +153,10 @@ static inline void con_schedule_flip(struct tty_struct *t)
 {
         unsigned long flags;
         spin_lock_irqsave(&t->buf.lock, flags);
-        if (t->buf.tail != NULL)
+        if (t->buf.tail != NULL) {
                 t->buf.tail->active = 0;
+                t->buf.tail->commit = t->buf.tail->used;
+        }
         spin_unlock_irqrestore(&t->buf.lock, flags);
         schedule_work(&t->buf.work);
 }
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index b49affa0ac5a..3b507bf05d09 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -326,12 +326,6 @@ struct sysinfo {
 /* Force a compilation error if condition is true */
 #define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
 
-#ifdef CONFIG_SYSCTL
-extern int randomize_va_space;
-#else
-#define randomize_va_space 1
-#endif
-
 /* Trap pasters of __FUNCTION__ at compile-time */
 #define __FUNCTION__ (__func__)
 
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index a311f58c8a7c..cfb3410e32b1 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -6,6 +6,7 @@
 #include <linux/list.h>
 #include <linux/linkage.h>
 #include <linux/compat.h>
+#include <linux/ioport.h>
 #include <asm/kexec.h>
 
 /* Verify architecture specific macros are defined */
diff --git a/include/linux/kmalloc_sizes.h b/include/linux/kmalloc_sizes.h
index d82d4c05c12d..bda23e00ed71 100644
--- a/include/linux/kmalloc_sizes.h
+++ b/include/linux/kmalloc_sizes.h
@@ -19,8 +19,10 @@
         CACHE(32768)
         CACHE(65536)
         CACHE(131072)
-#ifndef CONFIG_MMU
+#if (NR_CPUS > 512) || (MAX_NUMNODES > 256) || !defined(CONFIG_MMU)
         CACHE(262144)
+#endif
+#ifndef CONFIG_MMU
         CACHE(524288)
         CACHE(1048576)
 #ifdef CONFIG_LARGE_ALLOCS
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index 2a8d8da70961..c374b5fa8d3b 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -41,8 +41,10 @@ enum kobject_action {
         KOBJ_ADD        = (__force kobject_action_t) 0x01,      /* exclusive to core */
         KOBJ_REMOVE     = (__force kobject_action_t) 0x02,      /* exclusive to core */
         KOBJ_CHANGE     = (__force kobject_action_t) 0x03,      /* device state change */
-        KOBJ_OFFLINE    = (__force kobject_action_t) 0x04,      /* device offline */
-        KOBJ_ONLINE     = (__force kobject_action_t) 0x05,      /* device online */
+        KOBJ_MOUNT      = (__force kobject_action_t) 0x04,      /* mount event for block devices (broken) */
+        KOBJ_UMOUNT     = (__force kobject_action_t) 0x05,      /* umount event for block devices (broken) */
+        KOBJ_OFFLINE    = (__force kobject_action_t) 0x06,      /* device offline */
+        KOBJ_ONLINE     = (__force kobject_action_t) 0x07,      /* device online */
 };
 
 struct kobject {
diff --git a/include/linux/ktime.h b/include/linux/ktime.h
index 6aca67a569a2..f3dec45ef874 100644
--- a/include/linux/ktime.h
+++ b/include/linux/ktime.h
@@ -96,10 +96,16 @@ static inline ktime_t ktime_set(const long secs, const unsigned long nsecs)
                 ({ (ktime_t){ .tv64 = (kt).tv64 + (nsval) }; })
 
 /* convert a timespec to ktime_t format: */
-#define timespec_to_ktime(ts)           ktime_set((ts).tv_sec, (ts).tv_nsec)
+static inline ktime_t timespec_to_ktime(struct timespec ts)
+{
+        return ktime_set(ts.tv_sec, ts.tv_nsec);
+}
 
 /* convert a timeval to ktime_t format: */
-#define timeval_to_ktime(tv)            ktime_set((tv).tv_sec, (tv).tv_usec * 1000)
+static inline ktime_t timeval_to_ktime(struct timeval tv)
+{
+        return ktime_set(tv.tv_sec, tv.tv_usec * NSEC_PER_USEC);
+}
 
 /* Map the ktime_t to timespec conversion to ns_to_timespec function */
 #define ktime_to_timespec(kt)           ns_to_timespec((kt).tv64)
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 9e5db2949c58..c91be5e64ede 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -557,17 +557,29 @@ ata_sg_is_last(struct scatterlist *sg, struct ata_queued_cmd *qc)
 }
 
 static inline struct scatterlist *
+ata_qc_first_sg(struct ata_queued_cmd *qc)
+{
+        if (qc->n_elem)
+                return qc->__sg;
+        if (qc->pad_len)
+                return &qc->pad_sgent;
+        return NULL;
+}
+
+static inline struct scatterlist *
 ata_qc_next_sg(struct scatterlist *sg, struct ata_queued_cmd *qc)
 {
         if (sg == &qc->pad_sgent)
                 return NULL;
         if (++sg - qc->__sg < qc->n_elem)
                 return sg;
-        return qc->pad_len ? &qc->pad_sgent : NULL;
+        if (qc->pad_len)
+                return &qc->pad_sgent;
+        return NULL;
 }
 
 #define ata_for_each_sg(sg, qc) \
-        for (sg = qc->__sg; sg; sg = ata_qc_next_sg(sg, qc))
+        for (sg = ata_qc_first_sg(qc); sg; sg = ata_qc_next_sg(sg, qc))
 
 static inline unsigned int ata_tag_valid(unsigned int tag)
 {
diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
index 920766cea79c..ef21ed296039 100644
--- a/include/linux/lockd/lockd.h
+++ b/include/linux/lockd/lockd.h
@@ -149,7 +149,7 @@ struct nlm_rqst * nlmclnt_alloc_call(void);
 int               nlmclnt_prepare_block(struct nlm_rqst *req, struct nlm_host *host, struct file_lock *fl);
 void              nlmclnt_finish_block(struct nlm_rqst *req);
 long              nlmclnt_block(struct nlm_rqst *req, long timeout);
-u32               nlmclnt_grant(struct nlm_lock *);
+u32               nlmclnt_grant(const struct sockaddr_in *addr, const struct nlm_lock *);
 void              nlmclnt_recovery(struct nlm_host *, u32);
 int               nlmclnt_reclaim(struct nlm_host *, struct file_lock *);
 int               nlmclnt_setgrantargs(struct nlm_rqst *, struct nlm_lock *);
@@ -204,7 +204,7 @@ nlmsvc_file_inode(struct nlm_file *file)
  * Compare two host addresses (needs modifying for ipv6)
  */
 static __inline__ int
-nlm_cmp_addr(struct sockaddr_in *sin1, struct sockaddr_in *sin2)
+nlm_cmp_addr(const struct sockaddr_in *sin1, const struct sockaddr_in *sin2)
 {
         return sin1->sin_addr.s_addr == sin2->sin_addr.s_addr;
 }
@@ -214,7 +214,7 @@ nlm_cmp_addr(struct sockaddr_in *sin1, struct sockaddr_in *sin2)
  * When the second lock is of type F_UNLCK, this acts like a wildcard.
  */
 static __inline__ int
-nlm_compare_locks(struct file_lock *fl1, struct file_lock *fl2)
+nlm_compare_locks(const struct file_lock *fl1, const struct file_lock *fl2)
 {
         return  fl1->fl_pid   == fl2->fl_pid
              && fl1->fl_start == fl2->fl_start
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 01f03bc06eff..968b1aa3732c 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -6,6 +6,10 @@
 #include <linux/mmzone.h>
 #include <linux/notifier.h>
 
+struct page;
+struct zone;
+struct pglist_data;
+
 #ifdef CONFIG_MEMORY_HOTPLUG
 /*
  * pgdat resizing functions
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 85854b867463..498ff8778fb6 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -303,7 +303,7 @@ struct page {
  */
 #define put_page_testzero(p)                            \
         ({                                              \
-                BUG_ON(page_count(p) == 0);             \
+                BUG_ON(atomic_read(&(p)->_count) == -1);\
                 atomic_add_negative(-1, &(p)->_count);  \
         })
 
@@ -1051,5 +1051,11 @@ int shrink_slab(unsigned long scanned, gfp_t gfp_mask,
 void drop_pagecache(void);
 void drop_slab(void);
 
+#ifndef CONFIG_MMU
+#define randomize_va_space 0
+#else
+extern int randomize_va_space;
+#endif
+
 #endif /* __KERNEL__ */
 #endif /* _LINUX_MM_H */
diff --git a/include/linux/mmc/mmc.h b/include/linux/mmc/mmc.h
index ccd3e13de1e8..bdc556d88498 100644
--- a/include/linux/mmc/mmc.h
+++ b/include/linux/mmc/mmc.h
@@ -21,24 +21,35 @@ struct mmc_command {
         u32                     arg;
         u32                     resp[4];
         unsigned int            flags;          /* expected response type */
-#define MMC_RSP_NONE    (0 << 0)
-#define MMC_RSP_SHORT   (1 << 0)
-#define MMC_RSP_LONG    (2 << 0)
-#define MMC_RSP_MASK    (3 << 0)
-#define MMC_RSP_CRC     (1 << 3)                /* expect valid crc */
-#define MMC_RSP_BUSY    (1 << 4)                /* card may send busy */
-#define MMC_RSP_OPCODE  (1 << 5)                /* response contains opcode */
+#define MMC_RSP_PRESENT (1 << 0)
+#define MMC_RSP_136     (1 << 1)                /* 136 bit response */
+#define MMC_RSP_CRC     (1 << 2)                /* expect valid crc */
+#define MMC_RSP_BUSY    (1 << 3)                /* card may send busy */
+#define MMC_RSP_OPCODE  (1 << 4)                /* response contains opcode */
+#define MMC_CMD_MASK    (3 << 5)                /* command type */
+#define MMC_CMD_AC      (0 << 5)
+#define MMC_CMD_ADTC    (1 << 5)
+#define MMC_CMD_BC      (2 << 5)
+#define MMC_CMD_BCR     (3 << 5)
 
 /*
  * These are the response types, and correspond to valid bit
  * patterns of the above flags.  One additional valid pattern
  * is all zeros, which means we don't expect a response.
  */
-#define MMC_RSP_R1      (MMC_RSP_SHORT|MMC_RSP_CRC|MMC_RSP_OPCODE)
-#define MMC_RSP_R1B     (MMC_RSP_SHORT|MMC_RSP_CRC|MMC_RSP_OPCODE|MMC_RSP_BUSY)
-#define MMC_RSP_R2      (MMC_RSP_LONG|MMC_RSP_CRC)
-#define MMC_RSP_R3      (MMC_RSP_SHORT)
-#define MMC_RSP_R6      (MMC_RSP_SHORT|MMC_RSP_CRC)
+#define MMC_RSP_NONE    (0)
+#define MMC_RSP_R1      (MMC_RSP_PRESENT|MMC_RSP_CRC|MMC_RSP_OPCODE)
+#define MMC_RSP_R1B     (MMC_RSP_PRESENT|MMC_RSP_CRC|MMC_RSP_OPCODE|MMC_RSP_BUSY)
+#define MMC_RSP_R2      (MMC_RSP_PRESENT|MMC_RSP_136|MMC_RSP_CRC)
+#define MMC_RSP_R3      (MMC_RSP_PRESENT)
+#define MMC_RSP_R6      (MMC_RSP_PRESENT|MMC_RSP_CRC)
+
+#define mmc_resp_type(cmd)      ((cmd)->flags & (MMC_RSP_PRESENT|MMC_RSP_136|MMC_RSP_CRC|MMC_RSP_BUSY|MMC_RSP_OPCODE))
+
+/*
+ * These are the command types.
+ */
+#define mmc_cmd_type(cmd)       ((cmd)->flags & MMC_CMD_MASK)
 
         unsigned int            retries;        /* max number of retries */
         unsigned int            error;          /* command error */
diff --git a/include/linux/mmc/protocol.h b/include/linux/mmc/protocol.h
index a14dc306545b..81c3f77f652c 100644
--- a/include/linux/mmc/protocol.h
+++ b/include/linux/mmc/protocol.h
@@ -79,7 +79,7 @@
 /* SD commands                           type  argument     response */
   /* class 8 */
 /* This is basically the same command as for MMC with some quirks. */
-#define SD_SEND_RELATIVE_ADDR     3   /* ac                      R6  */
+#define SD_SEND_RELATIVE_ADDR     3   /* bcr                     R6  */
 
   /* Application commands */
 #define SD_APP_SET_BUS_WIDTH      6   /* ac   [1:0] bus width    R1  */
diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
index fedfbc8a287f..7dfd6e1fcde7 100644
--- a/include/linux/mtd/map.h
+++ b/include/linux/mtd/map.h
@@ -15,7 +15,6 @@
 #include <asm/unaligned.h>
 #include <asm/system.h>
 #include <asm/io.h>
-#include <asm/bug.h>
 
 #ifdef CONFIG_MTD_MAP_BANK_WIDTH_1
 #define map_bankwidth(map) 1
diff --git a/include/linux/namespace.h b/include/linux/namespace.h
index 6731977c4c13..3abc8e3b4879 100644
--- a/include/linux/namespace.h
+++ b/include/linux/namespace.h
@@ -15,6 +15,7 @@ struct namespace {
 
 extern int copy_namespace(int, struct task_struct *);
 extern void __put_namespace(struct namespace *namespace);
+extern struct namespace *dup_namespace(struct task_struct *, struct fs_struct *);
 
 static inline void put_namespace(struct namespace *namespace)
 {
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 4cf6088625c1..468896939843 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -184,8 +184,11 @@ static inline int nf_hook_thresh(int pf, unsigned int hook,
                                  struct sk_buff **pskb,
                                  struct net_device *indev,
                                  struct net_device *outdev,
-                                 int (*okfn)(struct sk_buff *), int thresh)
+                                 int (*okfn)(struct sk_buff *), int thresh,
+                                 int cond)
 {
+        if (!cond)
+                return 1;
 #ifndef CONFIG_NETFILTER_DEBUG
         if (list_empty(&nf_hooks[pf][hook]))
                 return 1;
@@ -197,7 +200,7 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
                           struct net_device *indev, struct net_device *outdev,
                           int (*okfn)(struct sk_buff *))
 {
-        return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN);
+        return nf_hook_thresh(pf, hook, pskb, indev, outdev, okfn, INT_MIN, 1);
 }
                    
 /* Activate hook; either okfn or kfree_skb called, unless a hook
@@ -224,7 +227,13 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
 
 #define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh)             \
 ({int __ret;                                                                   \
-if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh)) == 1)\
+if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, thresh, 1)) == 1)\
+        __ret = (okfn)(skb);                                                   \
+__ret;})
+
+#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond)                 \
+({int __ret;                                                                   \
+if ((__ret=nf_hook_thresh(pf, hook, &(skb), indev, outdev, okfn, INT_MIN, cond)) == 1)\
         __ret = (okfn)(skb);                                                   \
 __ret;})
 
@@ -295,11 +304,13 @@ extern struct proc_dir_entry *proc_net_netfilter;
 
 #else /* !CONFIG_NETFILTER */
 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)
+#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) (okfn)(skb)
 static inline int nf_hook_thresh(int pf, unsigned int hook,
                                  struct sk_buff **pskb,
                                  struct net_device *indev,
                                  struct net_device *outdev,
-                                 int (*okfn)(struct sk_buff *), int thresh)
+                                 int (*okfn)(struct sk_buff *), int thresh,
+                                 int cond)
 {
         return okfn(*pskb);
 }
@@ -307,7 +318,7 @@ static inline int nf_hook(int pf, unsigned int hook, struct sk_buff **pskb,
                           struct net_device *indev, struct net_device *outdev,
                           int (*okfn)(struct sk_buff *))
 {
-        return okfn(*pskb);
+        return 1;
 }
 static inline void nf_ct_attach(struct sk_buff *new, struct sk_buff *skb) {}
 struct flowi;
diff --git a/include/linux/netfilter_bridge/ebt_log.h b/include/linux/netfilter_bridge/ebt_log.h
index 358fbc84fb59..96e231ae7554 100644
--- a/include/linux/netfilter_bridge/ebt_log.h
+++ b/include/linux/netfilter_bridge/ebt_log.h
@@ -3,6 +3,7 @@
 
 #define EBT_LOG_IP 0x01 /* if the frame is made by ip, log the ip information */
 #define EBT_LOG_ARP 0x02
+#define EBT_LOG_NFLOG 0x04
 #define EBT_LOG_MASK (EBT_LOG_IP | EBT_LOG_ARP)
 #define EBT_LOG_PREFIX_SIZE 30
 #define EBT_LOG_WATCHER "log"
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index fdc4a9527343..43c09d790b83 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -79,7 +79,7 @@ enum nf_ip_hook_priorities {
 
 #ifdef __KERNEL__
 extern int ip_route_me_harder(struct sk_buff **pskb);
-
+extern int ip_xfrm_me_harder(struct sk_buff **pskb);
 #endif /*__KERNEL__*/
 
 #endif /*__LINUX_IP_NETFILTER_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_LOG.h b/include/linux/netfilter_ipv4/ipt_LOG.h
index 22d16177319b..892f9a33fea8 100644
--- a/include/linux/netfilter_ipv4/ipt_LOG.h
+++ b/include/linux/netfilter_ipv4/ipt_LOG.h
@@ -6,7 +6,8 @@
 #define IPT_LOG_TCPOPT          0x02    /* Log TCP options */
 #define IPT_LOG_IPOPT           0x04    /* Log IP options */
 #define IPT_LOG_UID             0x08    /* Log UID owning local socket */
-#define IPT_LOG_MASK            0x0f
+#define IPT_LOG_NFLOG           0x10    /* Log using nf_log backend */
+#define IPT_LOG_MASK            0x1f
 
 struct ipt_log_info {
         unsigned char level;
diff --git a/include/linux/netfilter_ipv4/ipt_connbytes.h b/include/linux/netfilter_ipv4/ipt_connbytes.h
index b04dfa3083c9..f63e6ee91113 100644
--- a/include/linux/netfilter_ipv4/ipt_connbytes.h
+++ b/include/linux/netfilter_ipv4/ipt_connbytes.h
@@ -1,10 +1,10 @@
 #ifndef _IPT_CONNBYTES_H
 #define _IPT_CONNBYTES_H
 
-#include <net/netfilter/xt_connbytes.h>
+#include <linux/netfilter/xt_connbytes.h>
 #define ipt_connbytes_what xt_connbytes_what
 
-#define IPT_CONNBYTES_PKTS      XT_CONNBYTES_PACKETS
+#define IPT_CONNBYTES_PKTS      XT_CONNBYTES_PKTS
 #define IPT_CONNBYTES_BYTES     XT_CONNBYTES_BYTES
 #define IPT_CONNBYTES_AVGPKT    XT_CONNBYTES_AVGPKT
 
diff --git a/include/linux/netfilter_ipv4/ipt_policy.h b/include/linux/netfilter_ipv4/ipt_policy.h
index 7fd1bec453f1..a3f6eff39d33 100644
--- a/include/linux/netfilter_ipv4/ipt_policy.h
+++ b/include/linux/netfilter_ipv4/ipt_policy.h
@@ -27,16 +27,22 @@ struct ipt_policy_spec
                         reqid:1;
 };
 
+union ipt_policy_addr
+{
+        struct in_addr  a4;
+        struct in6_addr a6;
+};
+
 struct ipt_policy_elem
 {
-        u_int32_t       saddr;
-        u_int32_t       smask;
-        u_int32_t       daddr;
-        u_int32_t       dmask;
-        u_int32_t       spi;
-        u_int32_t       reqid;
-        u_int8_t        proto;
-        u_int8_t        mode;
+        union ipt_policy_addr   saddr;
+        union ipt_policy_addr   smask;
+        union ipt_policy_addr   daddr;
+        union ipt_policy_addr   dmask;
+        u_int32_t               spi;
+        u_int32_t               reqid;
+        u_int8_t                proto;
+        u_int8_t                mode;
 
         struct ipt_policy_spec  match;
         struct ipt_policy_spec  invert;
diff --git a/include/linux/netfilter_ipv6/ip6t_LOG.h b/include/linux/netfilter_ipv6/ip6t_LOG.h
index 9008ff5c40ae..060c1a1c6c60 100644
--- a/include/linux/netfilter_ipv6/ip6t_LOG.h
+++ b/include/linux/netfilter_ipv6/ip6t_LOG.h
@@ -6,7 +6,8 @@
 #define IP6T_LOG_TCPOPT         0x02    /* Log TCP options */
 #define IP6T_LOG_IPOPT          0x04    /* Log IP options */
 #define IP6T_LOG_UID            0x08    /* Log UID owning local socket */
-#define IP6T_LOG_MASK           0x0f
+#define IP6T_LOG_NFLOG          0x10    /* Log using nf_log backend */
+#define IP6T_LOG_MASK           0x1f
 
 struct ip6t_log_info {
         unsigned char level;
diff --git a/include/linux/netfilter_ipv6/ip6t_policy.h b/include/linux/netfilter_ipv6/ip6t_policy.h
index 5a93afcd2ff1..671bd818300f 100644
--- a/include/linux/netfilter_ipv6/ip6t_policy.h
+++ b/include/linux/netfilter_ipv6/ip6t_policy.h
@@ -27,16 +27,22 @@ struct ip6t_policy_spec
                         reqid:1;
 };
 
+union ip6t_policy_addr
+{
+        struct in_addr  a4;
+        struct in6_addr a6;
+};
+
 struct ip6t_policy_elem
 {
-        struct in6_addr saddr;
-        struct in6_addr smask;
-        struct in6_addr daddr;
-        struct in6_addr dmask;
-        u_int32_t       spi;
-        u_int32_t       reqid;
-        u_int8_t        proto;
-        u_int8_t        mode;
+        union ip6t_policy_addr  saddr;
+        union ip6t_policy_addr  smask;
+        union ip6t_policy_addr  daddr;
+        union ip6t_policy_addr  dmask;
+        u_int32_t               spi;
+        u_int32_t               reqid;
+        u_int8_t                proto;
+        u_int8_t                mode;
 
         struct ip6t_policy_spec match;
         struct ip6t_policy_spec invert;
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 6a2ccf78a356..c256ebe2a7b4 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -160,7 +160,8 @@ extern int netlink_unregister_notifier(struct notifier_block *nb);
 
 /* finegrained unicast helpers: */
 struct sock *netlink_getsockbyfilp(struct file *filp);
-int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long timeo);
+int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+                long timeo, struct sock *ssk);
 void netlink_detachskb(struct sock *sk, struct sk_buff *skb);
 int netlink_sendskb(struct sock *sk, struct sk_buff *skb, int protocol);
 
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 547d649b274e..b4dc6e2e10c9 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -398,7 +398,7 @@ extern struct inode_operations nfs_symlink_inode_operations;
 extern int nfs_register_sysctl(void);
 extern void nfs_unregister_sysctl(void);
 #else
-#define nfs_register_sysctl() do { } while(0)
+#define nfs_register_sysctl() 0
 #define nfs_unregister_sysctl() do { } while(0)
 #endif
 
diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
index 4726ef7ba8e8..b959a4525cbd 100644
--- a/include/linux/nodemask.h
+++ b/include/linux/nodemask.h
@@ -84,7 +84,6 @@
 #include <linux/threads.h>
 #include <linux/bitmap.h>
 #include <linux/numa.h>
-#include <asm/bug.h>
 
 typedef struct { DECLARE_BITMAP(bits, MAX_NUMNODES); } nodemask_t;
 extern nodemask_t _unused_nodemask_arg_;
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index b0b908f583c5..751eea58bde8 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1087,6 +1087,7 @@
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_MX_440_8X 0x0181
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_MX_440SE_8X 0x0182
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_MX_420_8X 0x0183
+#define PCI_DEVICE_ID_NVIDIA_GEFORCE4_MX_4000   0x0185
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_448_GO    0x0186
 #define PCI_DEVICE_ID_NVIDIA_GEFORCE4_488_GO    0x0187
 #define PCI_DEVICE_ID_NVIDIA_QUADRO4_580_XGL    0x0188
@@ -1364,6 +1365,7 @@
 #define PCI_DEVICE_ID_SERVERWORKS_HE      0x0008
 #define PCI_DEVICE_ID_SERVERWORKS_LE      0x0009
 #define PCI_DEVICE_ID_SERVERWORKS_GCNB_LE 0x0017
+#define PCI_DEVICE_ID_SERVERWORKS_EPB     0x0103
 #define PCI_DEVICE_ID_SERVERWORKS_OSB4    0x0200
 #define PCI_DEVICE_ID_SERVERWORKS_CSB5    0x0201
 #define PCI_DEVICE_ID_SERVERWORKS_CSB6    0x0203
@@ -1670,6 +1672,9 @@
 #define PCI_DEVICE_ID_SIIG_2S1P_20x_550 0x2060
 #define PCI_DEVICE_ID_SIIG_2S1P_20x_650 0x2061
 #define PCI_DEVICE_ID_SIIG_2S1P_20x_850 0x2062
+#define PCI_DEVICE_ID_SIIG_8S_20x_550   0x2080
+#define PCI_DEVICE_ID_SIIG_8S_20x_650   0x2081
+#define PCI_DEVICE_ID_SIIG_8S_20x_850   0x2082
 #define PCI_SUBDEVICE_ID_SIIG_QUARTET_SERIAL    0x2050
 
 #define PCI_VENDOR_ID_RADISYS           0x1331
@@ -1748,6 +1753,8 @@
 #define PCI_DEVICE_ID_CCD_B00B          0xb00b
 #define PCI_DEVICE_ID_CCD_B00C          0xb00c
 #define PCI_DEVICE_ID_CCD_B100          0xb100
+#define PCI_DEVICE_ID_CCD_B700          0xb700
+#define PCI_DEVICE_ID_CCD_B701          0xb701
 
 #define PCI_VENDOR_ID_EXAR              0x13a8
 #define PCI_DEVICE_ID_EXAR_XR17C152     0x0152
@@ -1829,6 +1836,7 @@
 #define PCI_VENDOR_ID_AFAVLAB           0x14db
 #define PCI_DEVICE_ID_AFAVLAB_P028      0x2180
 #define PCI_DEVICE_ID_AFAVLAB_P030      0x2182
+#define PCI_SUBDEVICE_ID_AFAVLAB_P061           0x2150
 
 #define PCI_VENDOR_ID_BROADCOM          0x14e4
 #define PCI_DEVICE_ID_TIGON3_5752       0x1600
diff --git a/include/linux/percpu_counter.h b/include/linux/percpu_counter.h
index bd6708e2c027..682525511c9e 100644
--- a/include/linux/percpu_counter.h
+++ b/include/linux/percpu_counter.h
@@ -39,6 +39,7 @@ static inline void percpu_counter_destroy(struct percpu_counter *fbc)
 }
 
 void percpu_counter_mod(struct percpu_counter *fbc, long amount);
+long percpu_counter_sum(struct percpu_counter *fbc);
 
 static inline long percpu_counter_read(struct percpu_counter *fbc)
 {
@@ -92,6 +93,11 @@ static inline long percpu_counter_read_positive(struct percpu_counter *fbc)
         return fbc->count;
 }
 
+static inline long percpu_counter_sum(struct percpu_counter *fbc)
+{
+        return percpu_counter_read_positive(fbc);
+}
+
 #endif  /* CONFIG_SMP */
 
 static inline void percpu_counter_inc(struct percpu_counter *fbc)
diff --git a/include/linux/pktcdvd.h b/include/linux/pktcdvd.h
index 2c177e4c8f22..8a94c717c266 100644
--- a/include/linux/pktcdvd.h
+++ b/include/linux/pktcdvd.h
@@ -114,7 +114,7 @@ struct pkt_ctrl_command {
 
 struct packet_settings
 {
-        __u8                    size;           /* packet size in (512 byte) sectors */
+        __u32                   size;           /* packet size in (512 byte) sectors */
         __u8                    fp;             /* fixed packets */
         __u8                    link_loss;      /* the rest is specified
                                                  * as per Mt Fuji */
@@ -169,8 +169,8 @@ struct packet_iosched
 #if (PAGE_SIZE % CD_FRAMESIZE) != 0
 #error "PAGE_SIZE must be a multiple of CD_FRAMESIZE"
 #endif
-#define PACKET_MAX_SIZE         32
-#define PAGES_PER_PACKET        (PACKET_MAX_SIZE * CD_FRAMESIZE / PAGE_SIZE)
+#define PACKET_MAX_SIZE         128
+#define FRAMES_PER_PAGE         (PAGE_SIZE / CD_FRAMESIZE)
 #define PACKET_MAX_SECTORS      (PACKET_MAX_SIZE * CD_FRAMESIZE >> 9)
 
 enum packet_data_state {
@@ -219,7 +219,7 @@ struct packet_data
         atomic_t                io_errors;      /* Number of read/write errors during IO */
 
         struct bio              *r_bios[PACKET_MAX_SIZE]; /* bios to use during data gathering */
-        struct page             *pages[PAGES_PER_PACKET];
+        struct page             *pages[PACKET_MAX_SIZE / FRAMES_PER_PAGE];
 
         int                     cache_valid;    /* If non-zero, the data for the zone defined */
                                                 /* by the sector variable is completely cached */
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 9d5cd106b344..0d36750fc0f1 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -84,6 +84,7 @@ extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __us
 extern int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len);
 extern int ptrace_attach(struct task_struct *tsk);
 extern int ptrace_detach(struct task_struct *, unsigned int);
+extern void __ptrace_detach(struct task_struct *, unsigned int);
 extern void ptrace_disable(struct task_struct *);
 extern int ptrace_check_attach(struct task_struct *task, int kill);
 extern int ptrace_request(struct task_struct *child, long request, long addr, long data);
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index b87aefa082e2..c2ec6c77874e 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -98,13 +98,17 @@ struct rcu_data {
         long            batch;           /* Batch # for current RCU batch */
         struct rcu_head *nxtlist;
         struct rcu_head **nxttail;
-        long            count; /* # of queued items */
+        long            qlen;            /* # of queued callbacks */
         struct rcu_head *curlist;
         struct rcu_head **curtail;
         struct rcu_head *donelist;
         struct rcu_head **donetail;
+        long            blimit;          /* Upper limit on a processed batch */
         int cpu;
         struct rcu_head barrier;
+#ifdef CONFIG_SMP
+        long            last_rs_qlen;    /* qlen during the last resched */
+#endif
 };
 
 DECLARE_PER_CPU(struct rcu_data, rcu_data);
diff --git a/include/linux/reiserfs_acl.h b/include/linux/reiserfs_acl.h
index 0a3605099c44..806ec5b06707 100644
--- a/include/linux/reiserfs_acl.h
+++ b/include/linux/reiserfs_acl.h
@@ -58,9 +58,13 @@ extern struct reiserfs_xattr_handler posix_acl_default_handler;
 extern struct reiserfs_xattr_handler posix_acl_access_handler;
 #else
 
-#define reiserfs_get_acl NULL
 #define reiserfs_cache_default_acl(inode) 0
 
+static inline struct posix_acl *reiserfs_get_acl(struct inode *inode, int type)
+{
+        return NULL;
+}
+
 static inline int reiserfs_xattr_posix_acl_init(void)
 {
         return 0;
diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
index 7d51149bd793..dad78cecfd20 100644
--- a/include/linux/reiserfs_fs.h
+++ b/include/linux/reiserfs_fs.h
@@ -1052,7 +1052,7 @@ struct reiserfs_dir_entry {
         int de_entrylen;
         int de_namelen;
         char *de_name;
-        char *de_gen_number_bit_string;
+        unsigned long *de_gen_number_bit_string;
 
         __u32 de_dir_id;
         __u32 de_objectid;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 0cfcd1c7865e..62e6314382f0 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -298,8 +298,9 @@ struct mm_struct {
                                 unsigned long addr, unsigned long len,
                                 unsigned long pgoff, unsigned long flags);
         void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
-        unsigned long mmap_base;                /* base of mmap area */
-        unsigned long cached_hole_size;         /* if non-zero, the largest hole below free_area_cache */
+        unsigned long mmap_base;                /* base of mmap area */
+        unsigned long task_size;                /* size of task vm space */
+        unsigned long cached_hole_size;         /* if non-zero, the largest hole below free_area_cache */
         unsigned long free_area_cache;          /* first hole of size cached_hole_size or larger */
         pgd_t * pgd;
         atomic_t mm_users;                      /* How many users with user space? */
@@ -697,12 +698,9 @@ struct task_struct {
 
         int lock_depth;         /* BKL lock depth */
 
-#if defined(CONFIG_SMP)
-        int last_waker_cpu;     /* CPU that last woke this task up */
-#if defined(__ARCH_WANT_UNLOCKED_CTXSW)
+#if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
         int oncpu;
 #endif
-#endif
         int prio, static_prio;
         struct list_head run_list;
         prio_array_t *array;
@@ -894,7 +892,6 @@ static inline int pid_alive(struct task_struct *p)
 }
 
 extern void free_task(struct task_struct *tsk);
-extern void __put_task_struct(struct task_struct *tsk);
 #define get_task_struct(tsk) do { atomic_inc(&(tsk)->usage); } while(0)
 
 extern void __put_task_struct_cb(struct rcu_head *rhp);
@@ -1098,7 +1095,7 @@ extern struct sigqueue *sigqueue_alloc(void);
 extern void sigqueue_free(struct sigqueue *);
 extern int send_sigqueue(int, struct sigqueue *,  struct task_struct *);
 extern int send_group_sigqueue(int, struct sigqueue *,  struct task_struct *);
-extern int do_sigaction(int, const struct k_sigaction *, struct k_sigaction *);
+extern int do_sigaction(int, struct k_sigaction *, struct k_sigaction *);
 extern int do_sigaltstack(const stack_t __user *, stack_t __user *, unsigned long);
 
 /* These can be the second arg to send_sig_info/send_group_sig_info.  */
diff --git a/include/linux/security.h b/include/linux/security.h
index bb1da86747c7..7cbef482e13a 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1499,15 +1499,11 @@ static inline void security_sb_post_pivotroot (struct nameidata *old_nd,
 
 static inline int security_inode_alloc (struct inode *inode)
 {
-        if (unlikely (IS_PRIVATE (inode)))
-                return 0;
         return security_ops->inode_alloc_security (inode);
 }
 
 static inline void security_inode_free (struct inode *inode)
 {
-        if (unlikely (IS_PRIVATE (inode)))
-                return;
         security_ops->inode_free_security (inode);
 }
 
diff --git a/include/linux/serial_reg.h b/include/linux/serial_reg.h
index 6a2bb955844b..3c8a6aa77415 100644
--- a/include/linux/serial_reg.h
+++ b/include/linux/serial_reg.h
@@ -247,10 +247,10 @@
 #define UART_CTR        0xFF
 
 /*
- * The 16C950 Additional Control Reigster
+ * The 16C950 Additional Control Register
  */
 #define UART_ACR_RXDIS  0x01    /* Receiver disable */
-#define UART_ACR_TXDIS  0x02    /* Receiver disable */
+#define UART_ACR_TXDIS  0x02    /* Transmitter disable */
 #define UART_ACR_DSRFC  0x04    /* DSR Flow Control */
 #define UART_ACR_TLENB  0x20    /* 950 trigger levels enable */
 #define UART_ACR_ICRRD  0x40    /* ICR Read enable */
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 9dfa3ee769ae..44153fdf73fc 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -17,7 +17,6 @@ extern void cpu_idle(void);
 #include <linux/compiler.h>
 #include <linux/thread_info.h>
 #include <asm/smp.h>
-#include <asm/bug.h>
 
 /*
  * main cross-CPU interfaces, handles INIT, TLB flush, STOP, etc.
diff --git a/include/linux/suspend.h b/include/linux/suspend.h
index 43bcd13eb1ec..37c1c76fd547 100644
--- a/include/linux/suspend.h
+++ b/include/linux/suspend.h
@@ -42,13 +42,21 @@ extern void mark_free_pages(struct zone *zone);
 #ifdef CONFIG_PM
 /* kernel/power/swsusp.c */
 extern int software_suspend(void);
+
+#if defined(CONFIG_VT) && defined(CONFIG_VT_CONSOLE)
+extern int pm_prepare_console(void);
+extern void pm_restore_console(void);
+#else
+static inline int pm_prepare_console(void) { return 0; }
+static inline void pm_restore_console(void) {}
+#endif /* defined(CONFIG_VT) && defined(CONFIG_VT_CONSOLE) */
 #else
 static inline int software_suspend(void)
 {
         printk("Warning: fake suspend called\n");
         return -EPERM;
 }
-#endif
+#endif /* CONFIG_PM */
 
 #ifdef CONFIG_SUSPEND_SMP
 extern void disable_nonboot_cpus(void);
diff --git a/include/linux/swap.h b/include/linux/swap.h
index f3e17d5963c3..d572b19afb7d 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -147,7 +147,7 @@ struct swap_list_t {
 #define vm_swap_full() (nr_swap_pages*2 < total_swap_pages)
 
 /* linux/mm/oom_kill.c */
-extern void out_of_memory(gfp_t gfp_mask, int order);
+extern void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask, int order);
 
 /* linux/mm/memory.c */
 extern void swapin_readahead(swp_entry_t, unsigned long, struct vm_area_struct *);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 3877209d23c3..b9ea44ac0ddb 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -543,7 +543,7 @@ asmlinkage long sys_unlinkat(int dfd, const char __user * pathname, int flag);
 asmlinkage long sys_symlinkat(const char __user * oldname,
                               int newdfd, const char __user * newname);
 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
-                           int newdfd, const char __user *newname);
+                           int newdfd, const char __user *newname, int flags);
 asmlinkage long sys_renameat(int olddfd, const char __user * oldname,
                              int newdfd, const char __user * newname);
 asmlinkage long sys_futimesat(int dfd, char __user *filename,
@@ -557,6 +557,8 @@ asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
                            int mode);
 asmlinkage long sys_newfstatat(int dfd, char __user *filename,
                                struct stat __user *statbuf, int flag);
+asmlinkage long sys_fstatat64(int dfd, char __user *filename,
+                               struct stat64 __user *statbuf, int flag);
 asmlinkage long sys_readlinkat(int dfd, const char __user *path, char __user *buf,
                                int bufsiz);
 asmlinkage long compat_sys_futimesat(unsigned int dfd, char __user *filename,
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 32a4139c4ad8..bac61db26456 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -146,6 +146,8 @@ enum
         KERN_RANDOMIZE=68, /* int: randomize virtual address space */
         KERN_SETUID_DUMPABLE=69, /* int: behaviour of dumps for setuid core */
         KERN_SPIN_RETRY=70,     /* int: number of spinlock retries */
+        KERN_ACPI_VIDEO_FLAGS=71, /* int: flags for setting up video after ACPI sleep */
+        KERN_IA64_UNALIGNED=72, /* int: ia64 unaligned userland trap enable */
 };
 
 
diff --git a/include/linux/time.h b/include/linux/time.h
index 7b4dc36532bb..d9cdba54b789 100644
--- a/include/linux/time.h
+++ b/include/linux/time.h
@@ -33,11 +33,34 @@ struct timezone {
 #define NSEC_PER_SEC            1000000000L
 #define NSEC_PER_USEC           1000L
 
-static __inline__ int timespec_equal(struct timespec *a, struct timespec *b)
+static inline int timespec_equal(struct timespec *a, struct timespec *b)
 {
         return (a->tv_sec == b->tv_sec) && (a->tv_nsec == b->tv_nsec);
 }
 
+/*
+ * lhs < rhs:  return <0
+ * lhs == rhs: return 0
+ * lhs > rhs:  return >0
+ */
+static inline int timespec_compare(struct timespec *lhs, struct timespec *rhs)
+{
+        if (lhs->tv_sec < rhs->tv_sec)
+                return -1;
+        if (lhs->tv_sec > rhs->tv_sec)
+                return 1;
+        return lhs->tv_nsec - rhs->tv_nsec;
+}
+
+static inline int timeval_compare(struct timeval *lhs, struct timeval *rhs)
+{
+        if (lhs->tv_sec < rhs->tv_sec)
+                return -1;
+        if (lhs->tv_sec > rhs->tv_sec)
+                return 1;
+        return lhs->tv_usec - rhs->tv_usec;
+}
+
 extern unsigned long mktime(const unsigned int year, const unsigned int mon,
                             const unsigned int day, const unsigned int hour,
                             const unsigned int min, const unsigned int sec);
diff --git a/include/linux/timex.h b/include/linux/timex.h
index 04a4a8cb4ed3..b7ca1204e42a 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -345,6 +345,9 @@ time_interpolator_reset(void)
 
 #endif /* !CONFIG_TIME_INTERPOLATION */
 
+/* Returns how long ticks are at present, in ns / 2^(SHIFT_SCALE-10). */
+extern u64 current_tick_length(void);
+
 #endif /* KERNEL */
 
 #endif /* LINUX_TIMEX_H */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index a7bd3b4558d2..f45cd74e6f24 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -58,6 +58,8 @@ struct tty_buffer {
         int used;
         int size;
         int active;
+        int commit;
+        int read;
         /* Data points here */
         unsigned long data[0];
 };
diff --git a/include/linux/tty_flip.h b/include/linux/tty_flip.h
index 82961eb19888..222faf97d5f9 100644
--- a/include/linux/tty_flip.h
+++ b/include/linux/tty_flip.h
@@ -29,8 +29,10 @@ _INLINE_ void tty_schedule_flip(struct tty_struct *tty)
 {
         unsigned long flags;
         spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL)
+        if (tty->buf.tail != NULL) {
                 tty->buf.tail->active = 0;
+                tty->buf.tail->commit = tty->buf.tail->used;
+        }
         spin_unlock_irqrestore(&tty->buf.lock, flags);
         schedule_delayed_work(&tty->buf.work, 1);
 }
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index 6f6c69777648..5208b12d5550 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -549,7 +549,7 @@ struct v4l2_framebuffer
 struct v4l2_clip
 {
         struct v4l2_rect        c;
-        struct v4l2_clip        *next;
+        struct v4l2_clip        __user *next;
 };
 
 struct v4l2_window
@@ -629,6 +629,7 @@ typedef __u64 v4l2_std_id;
 #define V4L2_STD_NTSC_M         ((v4l2_std_id)0x00001000)
 #define V4L2_STD_NTSC_M_JP      ((v4l2_std_id)0x00002000)
 #define V4L2_STD_NTSC_443       ((v4l2_std_id)0x00004000)
+#define V4L2_STD_NTSC_M_KR      ((v4l2_std_id)0x00008000)
 
 #define V4L2_STD_SECAM_B        ((v4l2_std_id)0x00010000)
 #define V4L2_STD_SECAM_D        ((v4l2_std_id)0x00020000)
@@ -661,7 +662,8 @@ typedef __u64 v4l2_std_id;
                                  V4L2_STD_PAL_H         |\
                                  V4L2_STD_PAL_I)
 #define V4L2_STD_NTSC           (V4L2_STD_NTSC_M        |\
-                                 V4L2_STD_NTSC_M_JP)
+                                 V4L2_STD_NTSC_M_JP     |\
+                                 V4L2_STD_NTSC_M_KR)
 #define V4L2_STD_SECAM_DK       (V4L2_STD_SECAM_D       |\
                                  V4L2_STD_SECAM_K       |\
                                  V4L2_STD_SECAM_K1)
diff --git a/include/net/ax25.h b/include/net/ax25.h
index 2250a18b0cbb..d052b221dbcd 100644
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -110,8 +110,15 @@ enum {
 enum {
         AX25_PROTO_STD_SIMPLEX,
         AX25_PROTO_STD_DUPLEX,
+#ifdef CONFIG_AX25_DAMA_SLAVE
         AX25_PROTO_DAMA_SLAVE,
-        AX25_PROTO_DAMA_MASTER
+#ifdef CONFIG_AX25_DAMA_MASTER
+        AX25_PROTO_DAMA_MASTER,
+#define AX25_PROTO_MAX AX25_PROTO_DAMA_MASTER
+#endif
+#endif
+        __AX25_PROTO_MAX,
+        AX25_PROTO_MAX = __AX25_PROTO_MAX -1
 };
 
 enum {
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index bbfac86734ec..89d743cfdfdf 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -33,7 +33,7 @@
 #define RFCOMM_DEFAULT_MTU      127
 #define RFCOMM_DEFAULT_CREDITS  7
 
-#define RFCOMM_MAX_L2CAP_MTU    1024
+#define RFCOMM_MAX_L2CAP_MTU    1013
 #define RFCOMM_MAX_CREDITS      40
 
 #define RFCOMM_SKB_HEAD_RESERVE 8
diff --git a/include/net/ip.h b/include/net/ip.h
index 8de0697b364c..fab3d5b3ab1c 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -41,6 +41,7 @@ struct inet_skb_parm
 #define IPSKB_XFRM_TUNNEL_SIZE  2
 #define IPSKB_XFRM_TRANSFORMED  4
 #define IPSKB_FRAG_COMPLETE     8
+#define IPSKB_REROUTED          16
 };
 
 struct ipcm_cookie
diff --git a/include/net/irda/irda.h b/include/net/irda/irda.h
index 05a840837fe7..1880e46ecc9b 100644
--- a/include/net/irda/irda.h
+++ b/include/net/irda/irda.h
@@ -82,9 +82,9 @@ do { if(!(expr)) { \
 #define IRDA_ASSERT_LABEL(label)
 #endif /* CONFIG_IRDA_DEBUG */
 
-#define IRDA_WARNING(args...) printk(KERN_WARNING args)
-#define IRDA_MESSAGE(args...) printk(KERN_INFO args)
-#define IRDA_ERROR(args...)   printk(KERN_ERR args)
+#define IRDA_WARNING(args...) do { if (net_ratelimit()) printk(KERN_WARNING args); } while (0)
+#define IRDA_MESSAGE(args...) do { if (net_ratelimit()) printk(KERN_INFO args); } while (0)
+#define IRDA_ERROR(args...)   do { if (net_ratelimit()) printk(KERN_ERR args); } while (0)
 
 /*
  *  Magic numbers used by Linux-IrDA. Random numbers which must be unique to 
diff --git a/include/net/irda/irlap.h b/include/net/irda/irlap.h
index f55e86e75030..2127cae1e0a6 100644
--- a/include/net/irda/irlap.h
+++ b/include/net/irda/irlap.h
@@ -50,6 +50,9 @@
 /* May be different when we get VFIR */
 #define LAP_MAX_HEADER (LAP_ADDR_HEADER + LAP_CTRL_HEADER)
 
+/* Each IrDA device gets a random 32 bits IRLAP device address */
+#define LAP_ALEN 4
+
 #define BROADCAST  0xffffffff /* Broadcast device address */
 #define CBROADCAST 0xfe       /* Connection broadcast address */
 #define XID_FORMAT 0x01       /* Discovery XID format */
diff --git a/include/net/netfilter/nf_conntrack_l3proto.h b/include/net/netfilter/nf_conntrack_l3proto.h
index 67856eb93b43..dac43b15a5b0 100644
--- a/include/net/netfilter/nf_conntrack_l3proto.h
+++ b/include/net/netfilter/nf_conntrack_l3proto.h
@@ -88,12 +88,6 @@ extern struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX];
 extern int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto);
 extern void nf_conntrack_l3proto_unregister(struct nf_conntrack_l3proto *proto);
 
-static inline struct nf_conntrack_l3proto *
-__nf_ct_l3proto_find(u_int16_t l3proto)
-{
-        return nf_ct_l3protos[l3proto];
-}
-
 extern struct nf_conntrack_l3proto *
 nf_ct_l3proto_find_get(u_int16_t l3proto);
 
@@ -103,4 +97,13 @@ extern void nf_ct_l3proto_put(struct nf_conntrack_l3proto *p);
 extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4;
 extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;
 extern struct nf_conntrack_l3proto nf_conntrack_generic_l3proto;
+
+static inline struct nf_conntrack_l3proto *
+__nf_ct_l3proto_find(u_int16_t l3proto)
+{
+        if (unlikely(l3proto >= AF_MAX))
+                return &nf_conntrack_generic_l3proto;
+        return nf_ct_l3protos[l3proto];
+}
+
 #endif /*_NF_CONNTRACK_L3PROTO_H*/
diff --git a/include/net/sock.h b/include/net/sock.h
index 30758035d616..f63d0d56712c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -478,9 +478,9 @@ static inline void sk_add_backlog(struct sock *sk, struct sk_buff *skb)
         rc = __condition;                                       \
         if (!rc) {                                              \
                 *(__timeo) = schedule_timeout(*(__timeo));      \
-                rc = __condition;                               \
         }                                                       \
         lock_sock(__sk);                                        \
+        rc = __condition;                                       \
         rc;                                                     \
 })
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index d09ca0e7d139..8d362c49b8a9 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -233,7 +233,6 @@ struct xfrm_type
         int                     (*init_state)(struct xfrm_state *x);
         void                    (*destructor)(struct xfrm_state *);
         int                     (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
-        int                     (*post_input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
         /* Estimate maximal size of result of transformation of a dgram */
         u32                     (*get_max_size)(struct xfrm_state *, int size);
@@ -403,6 +402,11 @@ unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short f
 
 extern void __xfrm_state_destroy(struct xfrm_state *);
 
+static inline void __xfrm_state_put(struct xfrm_state *x)
+{
+        atomic_dec(&x->refcnt);
+}
+
 static inline void xfrm_state_put(struct xfrm_state *x)
 {
         if (atomic_dec_and_test(&x->refcnt))
@@ -866,7 +870,6 @@ extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
 extern int xfrm_init_state(struct xfrm_state *x);
 extern int xfrm4_rcv(struct sk_buff *skb);
 extern int xfrm4_output(struct sk_buff *skb);
-extern int xfrm4_output_finish(struct sk_buff *skb);
 extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler);
 extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler);
 extern int xfrm6_rcv_spi(struct sk_buff **pskb, u32 spi);
diff --git a/include/pcmcia/device_id.h b/include/pcmcia/device_id.h
index 346d81ece287..e04e0b0d9a25 100644
--- a/include/pcmcia/device_id.h
+++ b/include/pcmcia/device_id.h
@@ -72,6 +72,15 @@
         .prod_id = { (v1), (v2), (v3), (v4) }, \
         .prod_id_hash = { (vh1), (vh2), (vh3), (vh4) }, }
 
+#define PCMCIA_DEVICE_MANF_CARD_PROD_ID1(manf, card, v1, vh1) { \
+        .match_flags = PCMCIA_DEV_ID_MATCH_MANF_ID| \
+                        PCMCIA_DEV_ID_MATCH_CARD_ID| \
+                        PCMCIA_DEV_ID_MATCH_PROD_ID1, \
+        .manf_id = (manf), \
+        .card_id = (card), \
+        .prod_id = { (v1), NULL, NULL, NULL }, \
+        .prod_id_hash = { (vh1), 0, 0, 0 }, }
+
 
 /* multi-function devices */
 
diff --git a/include/scsi/iscsi_if.h b/include/scsi/iscsi_if.h
index 3e5cb5ab2d34..e5618b90996e 100644
--- a/include/scsi/iscsi_if.h
+++ b/include/scsi/iscsi_if.h
@@ -163,9 +163,6 @@ enum iscsi_param {
 };
 #define ISCSI_PARAM_MAX                 14
 
-typedef uint64_t iscsi_sessionh_t;      /* iSCSI Data-Path session handle */
-typedef uint64_t iscsi_connh_t;         /* iSCSI Data-Path connection handle */
-
 #define iscsi_ptr(_handle) ((void*)(unsigned long)_handle)
 #define iscsi_handle(_ptr) ((uint64_t)(unsigned long)_ptr)
 #define hostdata_session(_hostdata) (iscsi_ptr(*(unsigned long *)_hostdata))
diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
index c60b8ff2f5e4..9c331258bc27 100644
--- a/include/scsi/scsi.h
+++ b/include/scsi/scsi.h
@@ -433,4 +433,6 @@ struct scsi_lun {
 /* Used to obtain the PCI location of a device */
 #define SCSI_IOCTL_GET_PCI              0x5387
 
+int scsi_execute_in_process_context(void (*fn)(void *data), void *data);
+
 #endif /* _SCSI_SCSI_H */
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 16602a547a63..b41cf077e54b 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -63,25 +63,28 @@ struct iscsi_transport {
         int max_lun;
         unsigned int max_conn;
         unsigned int max_cmd_len;
-        struct Scsi_Host *(*create_session) (struct scsi_transport_template *t,
-                                             uint32_t initial_cmdsn);
-        void (*destroy_session) (struct Scsi_Host *shost);
-        struct iscsi_cls_conn *(*create_conn) (struct Scsi_Host *shost,
+        struct iscsi_cls_session *(*create_session)
+                (struct scsi_transport_template *t, uint32_t sn, uint32_t *sid);
+        void (*destroy_session) (struct iscsi_cls_session *session);
+        struct iscsi_cls_conn *(*create_conn) (struct iscsi_cls_session *sess,
                                 uint32_t cid);
-        int (*bind_conn) (iscsi_sessionh_t session, iscsi_connh_t conn,
+        int (*bind_conn) (struct iscsi_cls_session *session,
+                          struct iscsi_cls_conn *cls_conn,
                           uint32_t transport_fd, int is_leading);
-        int (*start_conn) (iscsi_connh_t conn);
-        void (*stop_conn) (iscsi_connh_t conn, int flag);
+        int (*start_conn) (struct iscsi_cls_conn *conn);
+        void (*stop_conn) (struct iscsi_cls_conn *conn, int flag);
         void (*destroy_conn) (struct iscsi_cls_conn *conn);
-        int (*set_param) (iscsi_connh_t conn, enum iscsi_param param,
+        int (*set_param) (struct iscsi_cls_conn *conn, enum iscsi_param param,
                           uint32_t value);
-        int (*get_conn_param) (void *conndata, enum iscsi_param param,
+        int (*get_conn_param) (struct iscsi_cls_conn *conn,
+                               enum iscsi_param param,
                                uint32_t *value);
-        int (*get_session_param) (struct Scsi_Host *shost,
+        int (*get_session_param) (struct iscsi_cls_session *session,
                                   enum iscsi_param param, uint32_t *value);
-        int (*send_pdu) (iscsi_connh_t conn, struct iscsi_hdr *hdr,
+        int (*send_pdu) (struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
                          char *data, uint32_t data_size);
-        void (*get_stats) (iscsi_connh_t conn, struct iscsi_stats *stats);
+        void (*get_stats) (struct iscsi_cls_conn *conn,
+                           struct iscsi_stats *stats);
 };
 
 /*
@@ -93,15 +96,14 @@ extern int iscsi_unregister_transport(struct iscsi_transport *tt);
 /*
  * control plane upcalls
  */
-extern void iscsi_conn_error(iscsi_connh_t conn, enum iscsi_err error);
-extern int iscsi_recv_pdu(iscsi_connh_t conn, struct iscsi_hdr *hdr,
+extern void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error);
+extern int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
                           char *data, uint32_t data_size);
 
 struct iscsi_cls_conn {
         struct list_head conn_list;     /* item in connlist */
         void *dd_data;                  /* LLD private data */
         struct iscsi_transport *transport;
-        iscsi_connh_t connh;
         int active;                     /* must be accessed with the connlock */
         struct device dev;              /* sysfs transport/container device */
         struct mempool_zone *z_error;
@@ -113,7 +115,7 @@ struct iscsi_cls_conn {
         container_of(_dev, struct iscsi_cls_conn, dev)
 
 struct iscsi_cls_session {
-        struct list_head list;  /* item in session_list */
+        struct list_head sess_list;             /* item in session_list */
         struct iscsi_transport *transport;
         struct device dev;      /* sysfs transport/container device */
 };
diff --git a/include/video/neomagic.h b/include/video/neomagic.h
index 1d69049bd4c1..78b1f15a538f 100644
--- a/include/video/neomagic.h
+++ b/include/video/neomagic.h
@@ -159,6 +159,7 @@ struct neofb_par {
         unsigned char PanelDispCntlReg1;
         unsigned char PanelDispCntlReg2;
         unsigned char PanelDispCntlReg3;
+        unsigned char PanelDispCntlRegRead;
         unsigned char PanelVertCenterReg1;
         unsigned char PanelVertCenterReg2;
         unsigned char PanelVertCenterReg3;
diff --git a/init/Kconfig b/init/Kconfig
index 8b7abae87bf9..38416a199def 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -169,7 +169,6 @@ config SYSCTL
 config AUDIT
         bool "Auditing support"
         depends on NET
-        default y if SECURITY_SELINUX
         help
           Enable auditing infrastructure that can be used with another
           kernel subsystem, such as SELinux (which requires this for
diff --git a/init/initramfs.c b/init/initramfs.c
index 0c5d9a3f951b..637344b05981 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -466,10 +466,32 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len, int check_only)
 extern char __initramfs_start[], __initramfs_end[];
 #ifdef CONFIG_BLK_DEV_INITRD
 #include <linux/initrd.h>
+#include <linux/kexec.h>
 
 static void __init free_initrd(void)
 {
-        free_initrd_mem(initrd_start, initrd_end);
+#ifdef CONFIG_KEXEC
+        unsigned long crashk_start = (unsigned long)__va(crashk_res.start);
+        unsigned long crashk_end   = (unsigned long)__va(crashk_res.end);
+
+        /*
+         * If the initrd region is overlapped with crashkernel reserved region,
+         * free only memory that is not part of crashkernel region.
+         */
+        if (initrd_start < crashk_end && initrd_end > crashk_start) {
+                /*
+                 * Initialize initrd memory region since the kexec boot does
+                 * not do.
+                 */
+                memset((void *)initrd_start, 0, initrd_end - initrd_start);
+                if (initrd_start < crashk_start)
+                        free_initrd_mem(initrd_start, crashk_start);
+                if (initrd_end > crashk_end)
+                        free_initrd_mem(crashk_end, initrd_end);
+        } else
+#endif
+                free_initrd_mem(initrd_start, initrd_end);
+
         initrd_start = 0;
         initrd_end = 0;
 }
diff --git a/init/main.c b/init/main.c
index 7c79da57d3a2..4c194c47395f 100644
--- a/init/main.c
+++ b/init/main.c
@@ -668,7 +668,6 @@ static int init(void * unused)
          */
         child_reaper = current;
 
-        /* Sets up cpus_possible() */
         smp_prepare_cpus(max_cpus);
 
         do_pre_smp_initcalls();
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 59302fc3643b..fd2e26b6f966 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -1018,7 +1018,8 @@ retry:
                                 goto out;
                         }
 
-                        ret = netlink_attachskb(sock, nc, 0, MAX_SCHEDULE_TIMEOUT);
+                        ret = netlink_attachskb(sock, nc, 0,
+                                        MAX_SCHEDULE_TIMEOUT, NULL);
                         if (ret == 1)
                                 goto retry;
                         if (ret) {
diff --git a/ipc/shm.c b/ipc/shm.c
index 4c28d2d8e305..9162123a7b23 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -870,6 +870,7 @@ asmlinkage long sys_shmdt(char __user *shmaddr)
          * could possibly have landed at. Also cast things to loff_t to
          * prevent overflows and make comparisions vs. equal-width types.
          */
+        size = PAGE_ALIGN(size);
         while (vma && (loff_t)(vma->vm_end - addr) <= size) {
                 next = vma->vm_next;
 
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 685c25175d96..d7e7e637b92a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -841,7 +841,7 @@ static void audit_log_exit(struct audit_context *context, gfp_t gfp_mask)
 
         for (aux = context->aux; aux; aux = aux->next) {
 
-                ab = audit_log_start(context, GFP_KERNEL, aux->type);
+                ab = audit_log_start(context, gfp_mask, aux->type);
                 if (!ab)
                         continue; /* audit_panic has been called */
 
@@ -878,14 +878,14 @@ static void audit_log_exit(struct audit_context *context, gfp_t gfp_mask)
         }
 
         if (context->pwd && context->pwdmnt) {
-                ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
+                ab = audit_log_start(context, gfp_mask, AUDIT_CWD);
                 if (ab) {
                         audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
                         audit_log_end(ab);
                 }
         }
         for (i = 0; i < context->name_count; i++) {
-                ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
+                ab = audit_log_start(context, gfp_mask, AUDIT_PATH);
                 if (!ab)
                         continue; /* audit_panic has been called */
 
diff --git a/kernel/compat.c b/kernel/compat.c
index 1867290c37e3..8c9cd88b6785 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -23,7 +23,6 @@
 #include <linux/security.h>
 
 #include <asm/uaccess.h>
-#include <asm/bug.h>
 
 int get_compat_timespec(struct timespec *ts, const struct compat_timespec __user *cts)
 {
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index ba42b0a76961..12815d3f1a05 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1977,6 +1977,39 @@ void cpuset_fork(struct task_struct *child)
  * We don't need to task_lock() this reference to tsk->cpuset,
  * because tsk is already marked PF_EXITING, so attach_task() won't
  * mess with it, or task is a failed fork, never visible to attach_task.
+ *
+ * Hack:
+ *
+ *    Set the exiting tasks cpuset to the root cpuset (top_cpuset).
+ *
+ *    Don't leave a task unable to allocate memory, as that is an
+ *    accident waiting to happen should someone add a callout in
+ *    do_exit() after the cpuset_exit() call that might allocate.
+ *    If a task tries to allocate memory with an invalid cpuset,
+ *    it will oops in cpuset_update_task_memory_state().
+ *
+ *    We call cpuset_exit() while the task is still competent to
+ *    handle notify_on_release(), then leave the task attached to
+ *    the root cpuset (top_cpuset) for the remainder of its exit.
+ *
+ *    To do this properly, we would increment the reference count on
+ *    top_cpuset, and near the very end of the kernel/exit.c do_exit()
+ *    code we would add a second cpuset function call, to drop that
+ *    reference.  This would just create an unnecessary hot spot on
+ *    the top_cpuset reference count, to no avail.
+ *
+ *    Normally, holding a reference to a cpuset without bumping its
+ *    count is unsafe.   The cpuset could go away, or someone could
+ *    attach us to a different cpuset, decrementing the count on
+ *    the first cpuset that we never incremented.  But in this case,
+ *    top_cpuset isn't going away, and either task has PF_EXITING set,
+ *    which wards off any attach_task() attempts, or task is a failed
+ *    fork, never visible to attach_task.
+ *
+ *    Another way to do this would be to set the cpuset pointer
+ *    to NULL here, and check in cpuset_update_task_memory_state()
+ *    for a NULL pointer.  This hack avoids that NULL check, for no
+ *    cost (other than this way too long comment ;).
  **/
 
 void cpuset_exit(struct task_struct *tsk)
@@ -1984,7 +2017,7 @@ void cpuset_exit(struct task_struct *tsk)
         struct cpuset *cs;
 
         cs = tsk->cpuset;
-        tsk->cpuset = NULL;
+        tsk->cpuset = &top_cpuset;      /* Hack - see comment above */
 
         if (notify_on_release(cs)) {
                 char *pathbuf = NULL;
diff --git a/kernel/exit.c b/kernel/exit.c
index 93cee3671332..531aadca5530 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -360,6 +360,9 @@ void daemonize(const char *name, ...)
         fs = init_task.fs;
         current->fs = fs;
         atomic_inc(&fs->count);
+        exit_namespace(current);
+        current->namespace = init_task.namespace;
+        get_namespace(current->namespace);
         exit_files(current);
         current->files = init_task.files;
         atomic_inc(&current->files->count);
diff --git a/kernel/fork.c b/kernel/fork.c
index 7f0ab5ee948c..b373322ca497 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -108,8 +108,10 @@ void free_task(struct task_struct *tsk)
 }
 EXPORT_SYMBOL(free_task);
 
-void __put_task_struct(struct task_struct *tsk)
+void __put_task_struct_cb(struct rcu_head *rhp)
 {
+        struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
+
         WARN_ON(!(tsk->exit_state & (EXIT_DEAD | EXIT_ZOMBIE)));
         WARN_ON(atomic_read(&tsk->usage));
         WARN_ON(tsk == current);
@@ -446,6 +448,55 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         }
 }
 
+/*
+ * Allocate a new mm structure and copy contents from the
+ * mm structure of the passed in task structure.
+ */
+static struct mm_struct *dup_mm(struct task_struct *tsk)
+{
+        struct mm_struct *mm, *oldmm = current->mm;
+        int err;
+
+        if (!oldmm)
+                return NULL;
+
+        mm = allocate_mm();
+        if (!mm)
+                goto fail_nomem;
+
+        memcpy(mm, oldmm, sizeof(*mm));
+
+        if (!mm_init(mm))
+                goto fail_nomem;
+
+        if (init_new_context(tsk, mm))
+                goto fail_nocontext;
+
+        err = dup_mmap(mm, oldmm);
+        if (err)
+                goto free_pt;
+
+        mm->hiwater_rss = get_mm_rss(mm);
+        mm->hiwater_vm = mm->total_vm;
+
+        return mm;
+
+free_pt:
+        mmput(mm);
+
+fail_nomem:
+        return NULL;
+
+fail_nocontext:
+        /*
+         * If init_new_context() failed, we cannot use mmput() to free the mm
+         * because it calls destroy_context()
+         */
+        mm_free_pgd(mm);
+        free_mm(mm);
+        return NULL;
+}
+
 static int copy_mm(unsigned long clone_flags, struct task_struct * tsk)
 {
         struct mm_struct * mm, *oldmm;
@@ -473,43 +524,17 @@ static int copy_mm(unsigned long clone_flags, struct task_struct * tsk)
         }
 
         retval = -ENOMEM;
-        mm = allocate_mm();
+        mm = dup_mm(tsk);
         if (!mm)
                 goto fail_nomem;
 
-        /* Copy the current MM stuff.. */
-        memcpy(mm, oldmm, sizeof(*mm));
-        if (!mm_init(mm))
-                goto fail_nomem;
-
-        if (init_new_context(tsk,mm))
-                goto fail_nocontext;
-
-        retval = dup_mmap(mm, oldmm);
-        if (retval)
-                goto free_pt;
-
-        mm->hiwater_rss = get_mm_rss(mm);
-        mm->hiwater_vm = mm->total_vm;
-
 good_mm:
         tsk->mm = mm;
         tsk->active_mm = mm;
         return 0;
 
-free_pt:
-        mmput(mm);
 fail_nomem:
         return retval;
-
-fail_nocontext:
-        /*
-         * If init_new_context() failed, we cannot use mmput() to free the mm
-         * because it calls destroy_context()
-         */
-        mm_free_pgd(mm);
-        free_mm(mm);
-        return retval;
 }
 
 static inline struct fs_struct *__copy_fs_struct(struct fs_struct *old)
@@ -597,32 +622,17 @@ out:
         return newf;
 }
 
-static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
+/*
+ * Allocate a new files structure and copy contents from the
+ * passed in files structure.
+ */
+static struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
 {
-        struct files_struct *oldf, *newf;
+        struct files_struct *newf;
         struct file **old_fds, **new_fds;
-        int open_files, size, i, error = 0, expand;
+        int open_files, size, i, expand;
         struct fdtable *old_fdt, *new_fdt;
 
-        /*
-         * A background process may not have any files ...
-         */
-        oldf = current->files;
-        if (!oldf)
-                goto out;
-
-        if (clone_flags & CLONE_FILES) {
-                atomic_inc(&oldf->count);
-                goto out;
-        }
-
-        /*
-         * Note: we may be using current for both targets (See exec.c)
-         * This works because we cache current->files (old) as oldf. Don't
-         * break this.
-         */
-        tsk->files = NULL;
-        error = -ENOMEM;
         newf = alloc_files();
         if (!newf)
                 goto out;
@@ -651,9 +661,9 @@ static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
         if (expand) {
                 spin_unlock(&oldf->file_lock);
                 spin_lock(&newf->file_lock);
-                error = expand_files(newf, open_files-1);
+                *errorp = expand_files(newf, open_files-1);
                 spin_unlock(&newf->file_lock);
-                if (error < 0)
+                if (*errorp < 0)
                         goto out_release;
                 new_fdt = files_fdtable(newf);
                 /*
@@ -702,10 +712,8 @@ static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
                 memset(&new_fdt->close_on_exec->fds_bits[start], 0, left);
         }
 
-        tsk->files = newf;
-        error = 0;
 out:
-        return error;
+        return newf;
 
 out_release:
         free_fdset (new_fdt->close_on_exec, new_fdt->max_fdset);
@@ -715,6 +723,40 @@ out_release:
         goto out;
 }
 
+static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
+{
+        struct files_struct *oldf, *newf;
+        int error = 0;
+
+        /*
+         * A background process may not have any files ...
+         */
+        oldf = current->files;
+        if (!oldf)
+                goto out;
+
+        if (clone_flags & CLONE_FILES) {
+                atomic_inc(&oldf->count);
+                goto out;
+        }
+
+        /*
+         * Note: we may be using current for both targets (See exec.c)
+         * This works because we cache current->files (old) as oldf. Don't
+         * break this.
+         */
+        tsk->files = NULL;
+        error = -ENOMEM;
+        newf = dup_fd(oldf, &error);
+        if (!newf)
+                goto out;
+
+        tsk->files = newf;
+        error = 0;
+out:
+        return error;
+}
+
 /*
  *      Helper to unshare the files of the current task.
  *      We don't want to expose copy_files internals to
@@ -1020,6 +1062,12 @@ static task_t *copy_process(unsigned long clone_flags,
         p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr: NULL;
 
         /*
+         * sigaltstack should be cleared when sharing the same VM
+         */
+        if ((clone_flags & (CLONE_VM|CLONE_VFORK)) == CLONE_VM)
+                p->sas_ss_sp = p->sas_ss_size = 0;
+
+        /*
          * Syscall tracing should be turned off in the child regardless
          * of CLONE_PTRACE.
          */
@@ -1083,8 +1131,8 @@ static task_t *copy_process(unsigned long clone_flags,
                 p->real_parent = current;
         p->parent = p->real_parent;
 
+        spin_lock(&current->sighand->siglock);
         if (clone_flags & CLONE_THREAD) {
-                spin_lock(&current->sighand->siglock);
                 /*
                  * Important: if an exit-all has been started then
                  * do not create this new thread - the whole thread
@@ -1122,8 +1170,6 @@ static task_t *copy_process(unsigned long clone_flags,
                          */
                         p->it_prof_expires = jiffies_to_cputime(1);
                 }
-
-                spin_unlock(&current->sighand->siglock);
         }
 
         /*
@@ -1135,8 +1181,6 @@ static task_t *copy_process(unsigned long clone_flags,
         if (unlikely(p->ptrace & PT_PTRACED))
                 __ptrace_link(p, current->parent);
 
-        attach_pid(p, PIDTYPE_PID, p->pid);
-        attach_pid(p, PIDTYPE_TGID, p->tgid);
         if (thread_group_leader(p)) {
                 p->signal->tty = current->signal->tty;
                 p->signal->pgrp = process_group(current);
@@ -1146,9 +1190,12 @@ static task_t *copy_process(unsigned long clone_flags,
                 if (p->pid)
                         __get_cpu_var(process_counts)++;
         }
+        attach_pid(p, PIDTYPE_TGID, p->tgid);
+        attach_pid(p, PIDTYPE_PID, p->pid);
 
         nr_threads++;
         total_forks++;
+        spin_unlock(&current->sighand->siglock);
         write_unlock_irq(&tasklist_lock);
         proc_fork_connector(p);
         return p;
@@ -1323,3 +1370,247 @@ void __init proc_caches_init(void)
                         sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
                         SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
 }
+
+
+/*
+ * Check constraints on flags passed to the unshare system call and
+ * force unsharing of additional process context as appropriate.
+ */
+static inline void check_unshare_flags(unsigned long *flags_ptr)
+{
+        /*
+         * If unsharing a thread from a thread group, must also
+         * unshare vm.
+         */
+        if (*flags_ptr & CLONE_THREAD)
+                *flags_ptr |= CLONE_VM;
+
+        /*
+         * If unsharing vm, must also unshare signal handlers.
+         */
+        if (*flags_ptr & CLONE_VM)
+                *flags_ptr |= CLONE_SIGHAND;
+
+        /*
+         * If unsharing signal handlers and the task was created
+         * using CLONE_THREAD, then must unshare the thread
+         */
+        if ((*flags_ptr & CLONE_SIGHAND) &&
+            (atomic_read(&current->signal->count) > 1))
+                *flags_ptr |= CLONE_THREAD;
+
+        /*
+         * If unsharing namespace, must also unshare filesystem information.
+         */
+        if (*flags_ptr & CLONE_NEWNS)
+                *flags_ptr |= CLONE_FS;
+}
+
+/*
+ * Unsharing of tasks created with CLONE_THREAD is not supported yet
+ */
+static int unshare_thread(unsigned long unshare_flags)
+{
+        if (unshare_flags & CLONE_THREAD)
+                return -EINVAL;
+
+        return 0;
+}
+
+/*
+ * Unshare the filesystem structure if it is being shared
+ */
+static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+{
+        struct fs_struct *fs = current->fs;
+
+        if ((unshare_flags & CLONE_FS) &&
+            (fs && atomic_read(&fs->count) > 1)) {
+                *new_fsp = __copy_fs_struct(current->fs);
+                if (!*new_fsp)
+                        return -ENOMEM;
+        }
+
+        return 0;
+}
+
+/*
+ * Unshare the namespace structure if it is being shared
+ */
+static int unshare_namespace(unsigned long unshare_flags, struct namespace **new_nsp, struct fs_struct *new_fs)
+{
+        struct namespace *ns = current->namespace;
+
+        if ((unshare_flags & CLONE_NEWNS) &&
+            (ns && atomic_read(&ns->count) > 1)) {
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+
+                *new_nsp = dup_namespace(current, new_fs ? new_fs : current->fs);
+                if (!*new_nsp)
+                        return -ENOMEM;
+        }
+
+        return 0;
+}
+
+/*
+ * Unsharing of sighand for tasks created with CLONE_SIGHAND is not
+ * supported yet
+ */
+static int unshare_sighand(unsigned long unshare_flags, struct sighand_struct **new_sighp)
+{
+        struct sighand_struct *sigh = current->sighand;
+
+        if ((unshare_flags & CLONE_SIGHAND) &&
+            (sigh && atomic_read(&sigh->count) > 1))
+                return -EINVAL;
+        else
+                return 0;
+}
+
+/*
+ * Unshare vm if it is being shared
+ */
+static int unshare_vm(unsigned long unshare_flags, struct mm_struct **new_mmp)
+{
+        struct mm_struct *mm = current->mm;
+
+        if ((unshare_flags & CLONE_VM) &&
+            (mm && atomic_read(&mm->mm_users) > 1)) {
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+/*
+ * Unshare file descriptor table if it is being shared
+ */
+static int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp)
+{
+        struct files_struct *fd = current->files;
+        int error = 0;
+
+        if ((unshare_flags & CLONE_FILES) &&
+            (fd && atomic_read(&fd->count) > 1)) {
+                *new_fdp = dup_fd(fd, &error);
+                if (!*new_fdp)
+                        return error;
+        }
+
+        return 0;
+}
+
+/*
+ * Unsharing of semundo for tasks created with CLONE_SYSVSEM is not
+ * supported yet
+ */
+static int unshare_semundo(unsigned long unshare_flags, struct sem_undo_list **new_ulistp)
+{
+        if (unshare_flags & CLONE_SYSVSEM)
+                return -EINVAL;
+
+        return 0;
+}
+
+/*
+ * unshare allows a process to 'unshare' part of the process
+ * context which was originally shared using clone.  copy_*
+ * functions used by do_fork() cannot be used here directly
+ * because they modify an inactive task_struct that is being
+ * constructed. Here we are modifying the current, active,
+ * task_struct.
+ */
+asmlinkage long sys_unshare(unsigned long unshare_flags)
+{
+        int err = 0;
+        struct fs_struct *fs, *new_fs = NULL;
+        struct namespace *ns, *new_ns = NULL;
+        struct sighand_struct *sigh, *new_sigh = NULL;
+        struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL;
+        struct files_struct *fd, *new_fd = NULL;
+        struct sem_undo_list *new_ulist = NULL;
+
+        check_unshare_flags(&unshare_flags);
+
+        if ((err = unshare_thread(unshare_flags)))
+                goto bad_unshare_out;
+        if ((err = unshare_fs(unshare_flags, &new_fs)))
+                goto bad_unshare_cleanup_thread;
+        if ((err = unshare_namespace(unshare_flags, &new_ns, new_fs)))
+                goto bad_unshare_cleanup_fs;
+        if ((err = unshare_sighand(unshare_flags, &new_sigh)))
+                goto bad_unshare_cleanup_ns;
+        if ((err = unshare_vm(unshare_flags, &new_mm)))
+                goto bad_unshare_cleanup_sigh;
+        if ((err = unshare_fd(unshare_flags, &new_fd)))
+                goto bad_unshare_cleanup_vm;
+        if ((err = unshare_semundo(unshare_flags, &new_ulist)))
+                goto bad_unshare_cleanup_fd;
+
+        if (new_fs || new_ns || new_sigh || new_mm || new_fd || new_ulist) {
+
+                task_lock(current);
+
+                if (new_fs) {
+                        fs = current->fs;
+                        current->fs = new_fs;
+                        new_fs = fs;
+                }
+
+                if (new_ns) {
+                        ns = current->namespace;
+                        current->namespace = new_ns;
+                        new_ns = ns;
+                }
+
+                if (new_sigh) {
+                        sigh = current->sighand;
+                        rcu_assign_pointer(current->sighand, new_sigh);
+                        new_sigh = sigh;
+                }
+
+                if (new_mm) {
+                        mm = current->mm;
+                        active_mm = current->active_mm;
+                        current->mm = new_mm;
+                        current->active_mm = new_mm;
+                        activate_mm(active_mm, new_mm);
+                        new_mm = mm;
+                }
+
+                if (new_fd) {
+                        fd = current->files;
+                        current->files = new_fd;
+                        new_fd = fd;
+                }
+
+                task_unlock(current);
+        }
+
+bad_unshare_cleanup_fd:
+        if (new_fd)
+                put_files_struct(new_fd);
+
+bad_unshare_cleanup_vm:
+        if (new_mm)
+                mmput(new_mm);
+
+bad_unshare_cleanup_sigh:
+        if (new_sigh)
+                if (atomic_dec_and_test(&new_sigh->count))
+                        kmem_cache_free(sighand_cachep, new_sigh);
+
+bad_unshare_cleanup_ns:
+        if (new_ns)
+                put_namespace(new_ns);
+
+bad_unshare_cleanup_fs:
+        if (new_fs)
+                put_fs_struct(new_fs);
+
+bad_unshare_cleanup_thread:
+bad_unshare_out:
+        return err;
+}
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 2b6e1757aedd..14bc9cfa6399 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -418,8 +418,19 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
         /* Switch the timer base, if necessary: */
         new_base = switch_hrtimer_base(timer, base);
 
-        if (mode == HRTIMER_REL)
+        if (mode == HRTIMER_REL) {
                 tim = ktime_add(tim, new_base->get_time());
+                /*
+                 * CONFIG_TIME_LOW_RES is a temporary way for architectures
+                 * to signal that they simply return xtime in
+                 * do_gettimeoffset(). In this case we want to round up by
+                 * resolution when starting a relative timer, to avoid short
+                 * timeouts. This will go away with the GTOD framework.
+                 */
+#ifdef CONFIG_TIME_LOW_RES
+                tim = ktime_add(tim, base->resolution);
+#endif
+        }
         timer->expires = tim;
 
         enqueue_hrtimer(timer, new_base);
@@ -494,6 +505,41 @@ ktime_t hrtimer_get_remaining(const struct hrtimer *timer)
         return rem;
 }
 
+#ifdef CONFIG_NO_IDLE_HZ
+/**
+ * hrtimer_get_next_event - get the time until next expiry event
+ *
+ * Returns the delta to the next expiry event or KTIME_MAX if no timer
+ * is pending.
+ */
+ktime_t hrtimer_get_next_event(void)
+{
+        struct hrtimer_base *base = __get_cpu_var(hrtimer_bases);
+        ktime_t delta, mindelta = { .tv64 = KTIME_MAX };
+        unsigned long flags;
+        int i;
+
+        for (i = 0; i < MAX_HRTIMER_BASES; i++, base++) {
+                struct hrtimer *timer;
+
+                spin_lock_irqsave(&base->lock, flags);
+                if (!base->first) {
+                        spin_unlock_irqrestore(&base->lock, flags);
+                        continue;
+                }
+                timer = rb_entry(base->first, struct hrtimer, node);
+                delta.tv64 = timer->expires.tv64;
+                spin_unlock_irqrestore(&base->lock, flags);
+                delta = ktime_sub(delta, base->get_time());
+                if (delta.tv64 < mindelta.tv64)
+                        mindelta.tv64 = delta.tv64;
+        }
+        if (mindelta.tv64 < 0)
+                mindelta.tv64 = 0;
+        return mindelta;
+}
+#endif
+
 /**
  * hrtimer_init - initialize a timer to the given clock
  *
diff --git a/kernel/intermodule.c b/kernel/intermodule.c
index 0cbe633420fb..55b1e5b85db9 100644
--- a/kernel/intermodule.c
+++ b/kernel/intermodule.c
@@ -179,3 +179,6 @@ EXPORT_SYMBOL(inter_module_register);
 EXPORT_SYMBOL(inter_module_unregister);
 EXPORT_SYMBOL(inter_module_get_request);
 EXPORT_SYMBOL(inter_module_put);
+
+MODULE_LICENSE("GPL");
+
diff --git a/kernel/module.c b/kernel/module.c
index e058aedf6b93..5aad477ddc79 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1670,6 +1670,9 @@ static struct module *load_module(void __user *umod,
                 goto free_mod;
         }
 
+        /* Userspace could have altered the string after the strlen_user() */
+        args[arglen - 1] = '\0';
+
         if (find_module(mod->name)) {
                 err = -EEXIST;
                 goto free_mod;
diff --git a/kernel/panic.c b/kernel/panic.c
index c5c4ab255834..126dc43f1c74 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -130,6 +130,7 @@ NORET_TYPE void panic(const char * fmt, ...)
 #endif
         local_irq_enable();
         for (i = 0;;) {
+                touch_softlockup_watchdog();
                 i += panic_blink(i);
                 mdelay(1);
                 i++;
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 216f574b5ffb..fa895fc2ecf5 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -353,6 +353,7 @@ static int posix_timer_fn(void *data)
                                 hrtimer_forward(&timr->it.real.timer,
                                                 timr->it.real.interval);
                         ret = HRTIMER_RESTART;
+                        ++timr->it_requeue_pending;
                 }
         }
 
diff --git a/kernel/power/console.c b/kernel/power/console.c
index 579d239d129f..623786d44159 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -9,7 +9,9 @@
 #include <linux/console.h>
 #include "power.h"
 
-#ifdef SUSPEND_CONSOLE
+#if defined(CONFIG_VT) && defined(CONFIG_VT_CONSOLE)
+#define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
+
 static int orig_fgconsole, orig_kmsg;
 
 int pm_prepare_console(void)
diff --git a/kernel/power/power.h b/kernel/power/power.h
index d8f0d1a76bae..388dba680841 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -1,14 +1,6 @@
 #include <linux/suspend.h>
 #include <linux/utsname.h>
 
-/* With SUSPEND_CONSOLE defined suspend looks *really* cool, but
-   we probably do not take enough locks for switching consoles, etc,
-   so bad things might happen.
-*/
-#if defined(CONFIG_VT) && defined(CONFIG_VT_CONSOLE)
-#define SUSPEND_CONSOLE (MAX_NR_CONSOLES-1)
-#endif
-
 struct swsusp_info {
         struct new_utsname      uts;
         u32                     version_code;
@@ -42,14 +34,6 @@ static struct subsys_attribute _name##_attr = {	\
 
 extern struct subsystem power_subsys;
 
-#ifdef SUSPEND_CONSOLE
-extern int pm_prepare_console(void);
-extern void pm_restore_console(void);
-#else
-static int pm_prepare_console(void) { return 0; }
-static void pm_restore_console(void) {}
-#endif
-
 /* References to section boundaries */
 extern const void __nosave_begin, __nosave_end;
 
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 41f66365f0d8..8d5a5986d621 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -91,10 +91,8 @@ static int save_highmem_zone(struct zone *zone)
                  * corrected eventually when the cases giving rise to this
                  * are better understood.
                  */
-                if (PageReserved(page)) {
-                        printk("highmem reserved page?!\n");
+                if (PageReserved(page))
                         continue;
-                }
                 BUG_ON(PageNosave(page));
                 if (PageNosaveFree(page))
                         continue;
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index 59c91c148e82..2d9d08f72f76 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -153,13 +153,11 @@ static int swsusp_swap_check(void) /* This is called before saving image */
 {
         int i;
 
-        if (!swsusp_resume_device)
-                return -ENODEV;
         spin_lock(&swap_lock);
         for (i = 0; i < MAX_SWAPFILES; i++) {
                 if (!(swap_info[i].flags & SWP_WRITEOK))
                         continue;
-                if (is_resume_device(swap_info + i)) {
+                if (!swsusp_resume_device || is_resume_device(swap_info + i)) {
                         spin_unlock(&swap_lock);
                         root_swap = i;
                         return 0;
@@ -743,7 +741,6 @@ static int submit(int rw, pgoff_t page_off, void *page)
         if (!bio)
                 return -ENOMEM;
         bio->bi_sector = page_off * (PAGE_SIZE >> 9);
-        bio_get(bio);
         bio->bi_bdev = resume_bdev;
         bio->bi_end_io = end_io;
 
@@ -753,14 +750,13 @@ static int submit(int rw, pgoff_t page_off, void *page)
                 goto Done;
         }
 
-        if (rw == WRITE)
-                bio_set_pages_dirty(bio);
 
         atomic_set(&io_done, 1);
         submit_bio(rw | (1 << BIO_RW_SYNC), bio);
         while (atomic_read(&io_done))
                 yield();
-
+        if (rw == READ)
+                bio_set_pages_dirty(bio);
  Done:
         bio_put(bio);
         return error;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 5f33cdb6fff5..d95a72c9279d 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -72,8 +72,8 @@ void ptrace_untrace(task_t *child)
  */
 void __ptrace_unlink(task_t *child)
 {
-        if (!child->ptrace)
-                BUG();
+        BUG_ON(!child->ptrace);
+
         child->ptrace = 0;
         if (!list_empty(&child->ptrace_list)) {
                 list_del_init(&child->ptrace_list);
@@ -184,22 +184,27 @@ bad:
         return retval;
 }
 
+void __ptrace_detach(struct task_struct *child, unsigned int data)
+{
+        child->exit_code = data;
+        /* .. re-parent .. */
+        __ptrace_unlink(child);
+        /* .. and wake it up. */
+        if (child->exit_state != EXIT_ZOMBIE)
+                wake_up_process(child);
+}
+
 int ptrace_detach(struct task_struct *child, unsigned int data)
 {
         if (!valid_signal(data))
-                return  -EIO;
+                return -EIO;
 
         /* Architecture-specific hardware disable .. */
         ptrace_disable(child);
 
-        /* .. re-parent .. */
-        child->exit_code = data;
-
         write_lock_irq(&tasklist_lock);
-        __ptrace_unlink(child);
-        /* .. and wake it up. */
-        if (child->exit_state != EXIT_ZOMBIE)
-                wake_up_process(child);
+        if (child->ptrace)
+                __ptrace_detach(child, data);
         write_unlock_irq(&tasklist_lock);
 
         return 0;
@@ -242,8 +247,7 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in
                 if (write) {
                         copy_to_user_page(vma, page, addr,
                                           maddr + offset, buf, bytes);
-                        if (!PageCompound(page))
-                                set_page_dirty_lock(page);
+                        set_page_dirty_lock(page);
                 } else {
                         copy_from_user_page(vma, page, addr,
                                             buf, maddr + offset, bytes);
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 0cf8146bd585..8cf15a569fcd 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -67,7 +67,43 @@ DEFINE_PER_CPU(struct rcu_data, rcu_bh_data) = { 0L };
 
 /* Fake initialization required by compiler */
 static DEFINE_PER_CPU(struct tasklet_struct, rcu_tasklet) = {NULL};
-static int maxbatch = 10000;
+static int blimit = 10;
+static int qhimark = 10000;
+static int qlowmark = 100;
+#ifdef CONFIG_SMP
+static int rsinterval = 1000;
+#endif
+
+static atomic_t rcu_barrier_cpu_count;
+static struct semaphore rcu_barrier_sema;
+static struct completion rcu_barrier_completion;
+
+#ifdef CONFIG_SMP
+static void force_quiescent_state(struct rcu_data *rdp,
+                        struct rcu_ctrlblk *rcp)
+{
+        int cpu;
+        cpumask_t cpumask;
+        set_need_resched();
+        if (unlikely(rdp->qlen - rdp->last_rs_qlen > rsinterval)) {
+                rdp->last_rs_qlen = rdp->qlen;
+                /*
+                 * Don't send IPI to itself. With irqs disabled,
+                 * rdp->cpu is the current cpu.
+                 */
+                cpumask = rcp->cpumask;
+                cpu_clear(rdp->cpu, cpumask);
+                for_each_cpu_mask(cpu, cpumask)
+                        smp_send_reschedule(cpu);
+        }
+}
+#else
+static inline void force_quiescent_state(struct rcu_data *rdp,
+                        struct rcu_ctrlblk *rcp)
+{
+        set_need_resched();
+}
+#endif
 
 /**
  * call_rcu - Queue an RCU callback for invocation after a grace period.
@@ -92,17 +128,13 @@ void fastcall call_rcu(struct rcu_head *head,
         rdp = &__get_cpu_var(rcu_data);
         *rdp->nxttail = head;
         rdp->nxttail = &head->next;
-
-        if (unlikely(++rdp->count > 10000))
-                set_need_resched();
-
+        if (unlikely(++rdp->qlen > qhimark)) {
+                rdp->blimit = INT_MAX;
+                force_quiescent_state(rdp, &rcu_ctrlblk);
+        }
         local_irq_restore(flags);
 }
 
-static atomic_t rcu_barrier_cpu_count;
-static struct semaphore rcu_barrier_sema;
-static struct completion rcu_barrier_completion;
-
 /**
  * call_rcu_bh - Queue an RCU for invocation after a quicker grace period.
  * @head: structure to be used for queueing the RCU updates.
@@ -131,12 +163,12 @@ void fastcall call_rcu_bh(struct rcu_head *head,
         rdp = &__get_cpu_var(rcu_bh_data);
         *rdp->nxttail = head;
         rdp->nxttail = &head->next;
-        rdp->count++;
-/*
- *  Should we directly call rcu_do_batch() here ?
- *  if (unlikely(rdp->count > 10000))
- *      rcu_do_batch(rdp);
- */
+
+        if (unlikely(++rdp->qlen > qhimark)) {
+                rdp->blimit = INT_MAX;
+                force_quiescent_state(rdp, &rcu_bh_ctrlblk);
+        }
+
         local_irq_restore(flags);
 }
 
@@ -199,10 +231,12 @@ static void rcu_do_batch(struct rcu_data *rdp)
                 next = rdp->donelist = list->next;
                 list->func(list);
                 list = next;
-                rdp->count--;
-                if (++count >= maxbatch)
+                rdp->qlen--;
+                if (++count >= rdp->blimit)
                         break;
         }
+        if (rdp->blimit == INT_MAX && rdp->qlen <= qlowmark)
+                rdp->blimit = blimit;
         if (!rdp->donelist)
                 rdp->donetail = &rdp->donelist;
         else
@@ -473,6 +507,7 @@ static void rcu_init_percpu_data(int cpu, struct rcu_ctrlblk *rcp,
         rdp->quiescbatch = rcp->completed;
         rdp->qs_pending = 0;
         rdp->cpu = cpu;
+        rdp->blimit = blimit;
 }
 
 static void __devinit rcu_online_cpu(int cpu)
@@ -567,7 +602,12 @@ void synchronize_kernel(void)
         synchronize_rcu();
 }
 
-module_param(maxbatch, int, 0);
+module_param(blimit, int, 0);
+module_param(qhimark, int, 0);
+module_param(qlowmark, int, 0);
+#ifdef CONFIG_SMP
+module_param(rsinterval, int, 0);
+#endif
 EXPORT_SYMBOL_GPL(rcu_batches_completed);
 EXPORT_SYMBOL(call_rcu);  /* WARNING: GPL-only in April 2006. */
 EXPORT_SYMBOL(call_rcu_bh);  /* WARNING: GPL-only in April 2006. */
diff --git a/kernel/sched.c b/kernel/sched.c
index f77f23f8f479..4d46e90f59c3 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -178,13 +178,6 @@ static unsigned int task_timeslice(task_t *p)
 #define task_hot(p, now, sd) ((long long) ((now) - (p)->last_ran)       \
                                 < (long long) (sd)->cache_hot_time)
 
-void __put_task_struct_cb(struct rcu_head *rhp)
-{
-        __put_task_struct(container_of(rhp, struct task_struct, rcu));
-}
-
-EXPORT_SYMBOL_GPL(__put_task_struct_cb);
-
 /*
  * These are the runqueue data structures:
  */
@@ -215,7 +208,6 @@ struct runqueue {
          */
         unsigned long nr_running;
 #ifdef CONFIG_SMP
-        unsigned long prio_bias;
         unsigned long cpu_load[3];
 #endif
         unsigned long long nr_switches;
@@ -669,68 +661,13 @@ static int effective_prio(task_t *p)
         return prio;
 }
 
-#ifdef CONFIG_SMP
-static inline void inc_prio_bias(runqueue_t *rq, int prio)
-{
-        rq->prio_bias += MAX_PRIO - prio;
-}
-
-static inline void dec_prio_bias(runqueue_t *rq, int prio)
-{
-        rq->prio_bias -= MAX_PRIO - prio;
-}
-
-static inline void inc_nr_running(task_t *p, runqueue_t *rq)
-{
-        rq->nr_running++;
-        if (rt_task(p)) {
-                if (p != rq->migration_thread)
-                        /*
-                         * The migration thread does the actual balancing. Do
-                         * not bias by its priority as the ultra high priority
-                         * will skew balancing adversely.
-                         */
-                        inc_prio_bias(rq, p->prio);
-        } else
-                inc_prio_bias(rq, p->static_prio);
-}
-
-static inline void dec_nr_running(task_t *p, runqueue_t *rq)
-{
-        rq->nr_running--;
-        if (rt_task(p)) {
-                if (p != rq->migration_thread)
-                        dec_prio_bias(rq, p->prio);
-        } else
-                dec_prio_bias(rq, p->static_prio);
-}
-#else
-static inline void inc_prio_bias(runqueue_t *rq, int prio)
-{
-}
-
-static inline void dec_prio_bias(runqueue_t *rq, int prio)
-{
-}
-
-static inline void inc_nr_running(task_t *p, runqueue_t *rq)
-{
-        rq->nr_running++;
-}
-
-static inline void dec_nr_running(task_t *p, runqueue_t *rq)
-{
-        rq->nr_running--;
-}
-#endif
-
 /*
  * __activate_task - move a task to the runqueue.
  */
 static inline void __activate_task(task_t *p, runqueue_t *rq)
 {
         enqueue_task(p, rq->active);
-        inc_nr_running(p, rq);
+        rq->nr_running++;
 }
 
 /*
@@ -739,7 +676,7 @@ static inline void __activate_task(task_t *p, runqueue_t *rq)
 static inline void __activate_idle_task(task_t *p, runqueue_t *rq)
 {
         enqueue_task_head(p, rq->active);
-        inc_nr_running(p, rq);
+        rq->nr_running++;
 }
 
 static int recalc_task_prio(task_t *p, unsigned long long now)
@@ -863,7 +800,7 @@ static void activate_task(task_t *p, runqueue_t *rq, int local)
  */
 static void deactivate_task(struct task_struct *p, runqueue_t *rq)
 {
-        dec_nr_running(p, rq);
+        rq->nr_running--;
         dequeue_task(p, p->array);
         p->array = NULL;
 }
@@ -1007,61 +944,27 @@ void kick_process(task_t *p)
  * We want to under-estimate the load of migration sources, to
  * balance conservatively.
  */
-static unsigned long __source_load(int cpu, int type, enum idle_type idle)
+static inline unsigned long source_load(int cpu, int type)
 {
         runqueue_t *rq = cpu_rq(cpu);
-        unsigned long running = rq->nr_running;
-        unsigned long source_load, cpu_load = rq->cpu_load[type-1],
-                load_now = running * SCHED_LOAD_SCALE;
-
+        unsigned long load_now = rq->nr_running * SCHED_LOAD_SCALE;
         if (type == 0)
-                source_load = load_now;
-        else
-                source_load = min(cpu_load, load_now);
-
-        if (running > 1 || (idle == NOT_IDLE && running))
-                /*
-                 * If we are busy rebalancing the load is biased by
-                 * priority to create 'nice' support across cpus. When
-                 * idle rebalancing we should only bias the source_load if
-                 * there is more than one task running on that queue to
-                 * prevent idle rebalance from trying to pull tasks from a
-                 * queue with only one running task.
-                 */
-                source_load = source_load * rq->prio_bias / running;
-
-        return source_load;
-}
+                return load_now;
 
-static inline unsigned long source_load(int cpu, int type)
-{
-        return __source_load(cpu, type, NOT_IDLE);
+        return min(rq->cpu_load[type-1], load_now);
 }
 
 /*
  * Return a high guess at the load of a migration-target cpu
  */
-static inline unsigned long __target_load(int cpu, int type, enum idle_type idle)
+static inline unsigned long target_load(int cpu, int type)
 {
         runqueue_t *rq = cpu_rq(cpu);
-        unsigned long running = rq->nr_running;
-        unsigned long target_load, cpu_load = rq->cpu_load[type-1],
-                load_now = running * SCHED_LOAD_SCALE;
-
+        unsigned long load_now = rq->nr_running * SCHED_LOAD_SCALE;
         if (type == 0)
-                target_load = load_now;
-        else
-                target_load = max(cpu_load, load_now);
-
-        if (running > 1 || (idle == NOT_IDLE && running))
-                target_load = target_load * rq->prio_bias / running;
+                return load_now;
 
-        return target_load;
-}
-
-static inline unsigned long target_load(int cpu, int type)
-{
-        return __target_load(cpu, type, NOT_IDLE);
+        return max(rq->cpu_load[type-1], load_now);
 }
 
 /*
@@ -1294,9 +1197,6 @@ static int try_to_wake_up(task_t *p, unsigned int state, int sync)
                 }
         }
 
-        if (p->last_waker_cpu != this_cpu)
-                goto out_set_cpu;
-
         if (unlikely(!cpu_isset(this_cpu, p->cpus_allowed)))
                 goto out_set_cpu;
 
@@ -1367,8 +1267,6 @@ out_set_cpu:
                 cpu = task_cpu(p);
         }
 
-        p->last_waker_cpu = this_cpu;
-
 out_activate:
 #endif /* CONFIG_SMP */
         if (old_state == TASK_UNINTERRUPTIBLE) {
@@ -1450,12 +1348,9 @@ void fastcall sched_fork(task_t *p, int clone_flags)
 #ifdef CONFIG_SCHEDSTATS
         memset(&p->sched_info, 0, sizeof(p->sched_info));
 #endif
-#if defined(CONFIG_SMP)
-        p->last_waker_cpu = cpu;
-#if defined(__ARCH_WANT_UNLOCKED_CTXSW)
+#if defined(CONFIG_SMP) && defined(__ARCH_WANT_UNLOCKED_CTXSW)
         p->oncpu = 0;
 #endif
-#endif
 #ifdef CONFIG_PREEMPT
         /* Want to start with kernel preemption disabled. */
         task_thread_info(p)->preempt_count = 1;
@@ -1530,7 +1425,7 @@ void fastcall wake_up_new_task(task_t *p, unsigned long clone_flags)
                                 list_add_tail(&p->run_list, &current->run_list);
                                 p->array = current->array;
                                 p->array->nr_active++;
-                                inc_nr_running(p, rq);
+                                rq->nr_running++;
                         }
                         set_need_resched();
                 } else
@@ -1875,9 +1770,9 @@ void pull_task(runqueue_t *src_rq, prio_array_t *src_array, task_t *p,
                runqueue_t *this_rq, prio_array_t *this_array, int this_cpu)
 {
         dequeue_task(p, src_array);
-        dec_nr_running(p, src_rq);
+        src_rq->nr_running--;
         set_task_cpu(p, this_cpu);
-        inc_nr_running(p, this_rq);
+        this_rq->nr_running++;
         enqueue_task(p, this_array);
         p->timestamp = (p->timestamp - src_rq->timestamp_last_tick)
                                 + this_rq->timestamp_last_tick;
@@ -2056,9 +1951,9 @@ find_busiest_group(struct sched_domain *sd, int this_cpu,
 
                         /* Bias balancing toward cpus of our domain */
                         if (local_group)
-                                load = __target_load(i, load_idx, idle);
+                                load = target_load(i, load_idx);
                         else
-                                load = __source_load(i, load_idx, idle);
+                                load = source_load(i, load_idx);
 
                         avg_load += load;
                 }
@@ -2171,7 +2066,7 @@ static runqueue_t *find_busiest_queue(struct sched_group *group,
         int i;
 
         for_each_cpu_mask(i, group->cpumask) {
-                load = __source_load(i, 0, idle);
+                load = source_load(i, 0);
 
                 if (load > max_load) {
                         max_load = load;
@@ -3571,10 +3466,8 @@ void set_user_nice(task_t *p, long nice)
                 goto out_unlock;
         }
         array = p->array;
-        if (array) {
+        if (array)
                 dequeue_task(p, array);
-                dec_prio_bias(rq, p->static_prio);
-        }
 
         old_prio = p->prio;
         new_prio = NICE_TO_PRIO(nice);
@@ -3584,7 +3477,6 @@ void set_user_nice(task_t *p, long nice)
 
         if (array) {
                 enqueue_task(p, array);
-                inc_prio_bias(rq, p->static_prio);
                 /*
                  * If the task increased its priority or is running and
                  * lowered its priority, then reschedule its CPU:
@@ -4129,6 +4021,8 @@ static inline void __cond_resched(void)
          */
         if (unlikely(preempt_count()))
                 return;
+        if (unlikely(system_state != SYSTEM_RUNNING))
+                return;
         do {
                 add_preempt_count(PREEMPT_ACTIVE);
                 schedule();
@@ -4434,6 +4328,7 @@ void __devinit init_idle(task_t *idle, int cpu)
         runqueue_t *rq = cpu_rq(cpu);
         unsigned long flags;
 
+        idle->timestamp = sched_clock();
         idle->sleep_avg = 0;
         idle->array = NULL;
         idle->prio = MAX_PRIO;
@@ -5159,7 +5054,18 @@ static void init_sched_build_groups(struct sched_group groups[], cpumask_t span,
 #define MAX_DOMAIN_DISTANCE 32
 
 static unsigned long long migration_cost[MAX_DOMAIN_DISTANCE] =
-                { [ 0 ... MAX_DOMAIN_DISTANCE-1 ] = -1LL };
+                { [ 0 ... MAX_DOMAIN_DISTANCE-1 ] =
+/*
+ * Architectures may override the migration cost and thus avoid
+ * boot-time calibration. Unit is nanoseconds. Mostly useful for
+ * virtualized hardware:
+ */
+#ifdef CONFIG_DEFAULT_MIGRATION_COST
+                        CONFIG_DEFAULT_MIGRATION_COST
+#else
+                        -1LL
+#endif
+};
 
 /*
  * Allow override of migration cost - in units of microseconds.
@@ -5551,13 +5457,15 @@ static void calibrate_migration_costs(const cpumask_t *cpu_map)
                         -1
 #endif
                 );
-        printk("migration_cost=");
-        for (distance = 0; distance <= max_distance; distance++) {
-                if (distance)
-                        printk(",");
-                printk("%ld", (long)migration_cost[distance] / 1000);
+        if (system_state == SYSTEM_BOOTING) {
+                printk("migration_cost=");
+                for (distance = 0; distance <= max_distance; distance++) {
+                        if (distance)
+                                printk(",");
+                        printk("%ld", (long)migration_cost[distance] / 1000);
+                }
+                printk("\n");
         }
-        printk("\n");
         j1 = jiffies;
         if (migration_debug)
                 printk("migration: %ld seconds\n", (j1-j0)/HZ);
@@ -6109,7 +6017,7 @@ void __init sched_init(void)
         runqueue_t *rq;
         int i, j, k;
 
-        for (i = 0; i < NR_CPUS; i++) {
+        for_each_cpu(i) {
                 prio_array_t *array;
 
                 rq = cpu_rq(i);
diff --git a/kernel/signal.c b/kernel/signal.c
index b373fc2420da..ea154104a00b 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2430,7 +2430,7 @@ sys_rt_sigqueueinfo(int pid, int sig, siginfo_t __user *uinfo)
 }
 
 int
-do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
+do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
 {
         struct k_sigaction *k;
         sigset_t mask;
@@ -2454,6 +2454,8 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
                 *oact = *k;
 
         if (act) {
+                sigdelsetmask(&act->sa.sa_mask,
+                              sigmask(SIGKILL) | sigmask(SIGSTOP));
                 /*
                  * POSIX 3.3.1.3:
                  *  "Setting a signal action to SIG_IGN for a signal that is
@@ -2479,8 +2481,6 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
                         read_lock(&tasklist_lock);
                         spin_lock_irq(&t->sighand->siglock);
                         *k = *act;
-                        sigdelsetmask(&k->sa.sa_mask,
-                                      sigmask(SIGKILL) | sigmask(SIGSTOP));
                         sigemptyset(&mask);
                         sigaddset(&mask, sig);
                         rm_from_queue_full(&mask, &t->signal->shared_pending);
@@ -2495,8 +2495,6 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
                 }
 
                 *k = *act;
-                sigdelsetmask(&k->sa.sa_mask,
-                              sigmask(SIGKILL) | sigmask(SIGSTOP));
         }
 
         spin_unlock_irq(&current->sighand->siglock);
@@ -2702,6 +2700,7 @@ sys_signal(int sig, __sighandler_t handler)
 
         new_sa.sa.sa_handler = handler;
         new_sa.sa.sa_flags = SA_ONESHOT | SA_NOMASK;
+        sigemptyset(&new_sa.sa.sa_mask);
 
         ret = do_sigaction(sig, &new_sa, &old_sa);
 
diff --git a/kernel/sys.c b/kernel/sys.c
index 0929c698affc..f91218a5463e 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -428,7 +428,7 @@ void kernel_kexec(void)
 {
 #ifdef CONFIG_KEXEC
         struct kimage *image;
-        image = xchg(&kexec_image, 0);
+        image = xchg(&kexec_image, NULL);
         if (!image) {
                 return;
         }
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 17313b99e53d..1067090db6b1 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -104,6 +104,8 @@ cond_syscall(sys_setreuid16);
 cond_syscall(sys_setuid16);
 cond_syscall(sys_vm86old);
 cond_syscall(sys_vm86);
+cond_syscall(compat_sys_ipc);
+cond_syscall(compat_sys_sysctl);
 
 /* arch-specific weak syscall entries */
 cond_syscall(sys_pciconfig_read);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 71dd6f62efec..32b48e8ee36e 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -44,13 +44,14 @@
 #include <linux/limits.h>
 #include <linux/dcache.h>
 #include <linux/syscalls.h>
+#include <linux/nfs_fs.h>
+#include <linux/acpi.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>
 
-#ifdef CONFIG_ROOT_NFS
-#include <linux/nfs_fs.h>
-#endif
+extern int proc_nr_files(ctl_table *table, int write, struct file *filp,
+                     void __user *buffer, size_t *lenp, loff_t *ppos);
 
 #if defined(CONFIG_SYSCTL)
 
@@ -126,7 +127,9 @@ extern int sysctl_hz_timer;
 extern int acct_parm[];
 #endif
 
-int randomize_va_space = 1;
+#ifdef CONFIG_IA64
+extern int no_unaligned_warning;
+#endif
 
 static int parse_table(int __user *, int, void __user *, size_t __user *, void __user *, size_t,
                        ctl_table *, void **);
@@ -640,6 +643,7 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+#if defined(CONFIG_MMU)
         {
                 .ctl_name       = KERN_RANDOMIZE,
                 .procname       = "randomize_va_space",
@@ -648,6 +652,7 @@ static ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
         },
+#endif
 #if defined(CONFIG_S390) && defined(CONFIG_SMP)
         {
                 .ctl_name       = KERN_SPIN_RETRY,
@@ -658,6 +663,26 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+#ifdef CONFIG_ACPI_SLEEP
+        {
+                .ctl_name       = KERN_ACPI_VIDEO_FLAGS,
+                .procname       = "acpi_video_flags",
+                .data           = &acpi_video_flags,
+                .maxlen         = sizeof (unsigned long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_minmax,
+        },
+#endif
+#ifdef CONFIG_IA64
+        {
+                .ctl_name       = KERN_IA64_UNALIGNED,
+                .procname       = "ignore-unaligned-usertrap",
+                .data           = &no_unaligned_warning,
+                .maxlen         = sizeof (int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
+#endif
         { .ctl_name = 0 }
 };
 
@@ -921,7 +946,7 @@ static ctl_table fs_table[] = {
                 .data           = &files_stat,
                 .maxlen         = 3*sizeof(int),
                 .mode           = 0444,
-                .proc_handler   = &proc_dointvec,
+                .proc_handler   = &proc_nr_files,
         },
         {
                 .ctl_name       = FS_MAXFILE,
diff --git a/kernel/timer.c b/kernel/timer.c
index 4f1cb0ab5251..2410c18dbeb1 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -489,13 +489,25 @@ unsigned long next_timer_interrupt(void)
         struct list_head *list;
         struct timer_list *nte;
         unsigned long expires;
+        unsigned long hr_expires = MAX_JIFFY_OFFSET;
+        ktime_t hr_delta;
         tvec_t *varray[4];
         int i, j;
 
+        hr_delta = hrtimer_get_next_event();
+        if (hr_delta.tv64 != KTIME_MAX) {
+                struct timespec tsdelta;
+                tsdelta = ktime_to_timespec(hr_delta);
+                hr_expires = timespec_to_jiffies(&tsdelta);
+                if (hr_expires < 3)
+                        return hr_expires + jiffies;
+        }
+        hr_expires += jiffies;
+
         base = &__get_cpu_var(tvec_bases);
         spin_lock(&base->t_base.lock);
         expires = base->timer_jiffies + (LONG_MAX >> 1);
-        list = 0;
+        list = NULL;
 
         /* Look for timer events in tv1. */
         j = base->timer_jiffies & TVR_MASK;
@@ -542,6 +554,10 @@ found:
                 }
         }
         spin_unlock(&base->t_base.lock);
+
+        if (time_before(hr_expires, expires))
+                return hr_expires;
+
         return expires;
 }
 #endif
@@ -717,12 +733,16 @@ static void second_overflow(void)
 #endif
 }
 
-/* in the NTP reference this is called "hardclock()" */
-static void update_wall_time_one_tick(void)
+/*
+ * Returns how many microseconds we need to add to xtime this tick
+ * in doing an adjustment requested with adjtime.
+ */
+static long adjtime_adjustment(void)
 {
-        long time_adjust_step, delta_nsec;
+        long time_adjust_step;
 
-        if ((time_adjust_step = time_adjust) != 0 ) {
+        time_adjust_step = time_adjust;
+        if (time_adjust_step) {
                 /*
                  * We are doing an adjtime thing.  Prepare time_adjust_step to
                  * be within bounds.  Note that a positive time_adjust means we
@@ -733,10 +753,19 @@ static void update_wall_time_one_tick(void)
                  */
                 time_adjust_step = min(time_adjust_step, (long)tickadj);
                 time_adjust_step = max(time_adjust_step, (long)-tickadj);
+        }
+        return time_adjust_step;
+}
 
+/* in the NTP reference this is called "hardclock()" */
+static void update_wall_time_one_tick(void)
+{
+        long time_adjust_step, delta_nsec;
+
+        time_adjust_step = adjtime_adjustment();
+        if (time_adjust_step)
                 /* Reduce by this step the amount of time left  */
                 time_adjust -= time_adjust_step;
-        }
         delta_nsec = tick_nsec + time_adjust_step * 1000;
         /*
          * Advance the phase, once it gets to one microsecond, then
@@ -759,6 +788,22 @@ static void update_wall_time_one_tick(void)
 }
 
 /*
+ * Return how long ticks are at the moment, that is, how much time
+ * update_wall_time_one_tick will add to xtime next time we call it
+ * (assuming no calls to do_adjtimex in the meantime).
+ * The return value is in fixed-point nanoseconds with SHIFT_SCALE-10
+ * bits to the right of the binary point.
+ * This function has no side-effects.
+ */
+u64 current_tick_length(void)
+{
+        long delta_nsec;
+
+        delta_nsec = tick_nsec + adjtime_adjustment() * 1000;
+        return ((u64) delta_nsec << (SHIFT_SCALE - 10)) + time_adj;
+}
+
+/*
  * Using a loop looks inefficient, but "ticks" is
  * usually just one (we shouldn't be losing ticks,
  * we're doing this this way mainly for interrupt
@@ -896,6 +941,8 @@ static inline void update_times(void)
 void do_timer(struct pt_regs *regs)
 {
         jiffies_64++;
+        /* prevent loading jiffies before storing new jiffies_64 value. */
+        barrier();
         update_times();
         softlockup_tick(regs);
 }
@@ -1307,8 +1354,8 @@ void __init init_timers(void)
 
 #ifdef CONFIG_TIME_INTERPOLATION
 
-struct time_interpolator *time_interpolator;
-static struct time_interpolator *time_interpolator_list;
+struct time_interpolator *time_interpolator __read_mostly;
+static struct time_interpolator *time_interpolator_list __read_mostly;
 static DEFINE_SPINLOCK(time_interpolator_lock);
 
 static inline u64 time_interpolator_get_cycles(unsigned int src)
@@ -1322,10 +1369,10 @@ static inline u64 time_interpolator_get_cycles(unsigned int src)
                         return x();
 
                 case TIME_SOURCE_MMIO64 :
-                        return readq((void __iomem *) time_interpolator->addr);
+                        return readq_relaxed((void __iomem *)time_interpolator->addr);
 
                 case TIME_SOURCE_MMIO32 :
-                        return readl((void __iomem *) time_interpolator->addr);
+                        return readl_relaxed((void __iomem *)time_interpolator->addr);
 
                 default: return get_cycles();
         }
diff --git a/lib/iomap_copy.c b/lib/iomap_copy.c
index a6b1e271d53c..351045f4f63c 100644
--- a/lib/iomap_copy.c
+++ b/lib/iomap_copy.c
@@ -15,8 +15,8 @@
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
  */
 
-#include <linux/io.h>
 #include <linux/module.h>
+#include <linux/io.h>
 
 /**
  * __iowrite32_copy - copy data to MMIO space, in 32-bit units
diff --git a/lib/kobject.c b/lib/kobject.c
index 7a0e6809490d..efe67fa96a71 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -72,6 +72,8 @@ static int get_kobj_path_length(struct kobject *kobj)
          * Add 1 to strlen for leading '/' of each level.
          */
         do {
+                if (kobject_name(parent) == NULL)
+                        return 0;
                 length += strlen(kobject_name(parent)) + 1;
                 parent = parent->parent;
         } while (parent);
@@ -107,6 +109,8 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask)
         int len;
 
         len = get_kobj_path_length(kobj);
+        if (len == 0)
+                return NULL;
         path = kmalloc(len, gfp_mask);
         if (!path)
                 return NULL;
@@ -162,6 +166,11 @@ int kobject_add(struct kobject * kobj)
                 return -ENOENT;
         if (!kobj->k_name)
                 kobj->k_name = kobj->name;
+        if (!kobj->k_name) {
+                pr_debug("kobject attempted to be registered with no name!\n");
+                WARN_ON(1);
+                return -EINVAL;
+        }
         parent = kobject_get(kobj->parent);
 
         pr_debug("kobject %s: registering. parent: %s, set: %s\n",
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index f56e27ae9d52..086a0c6e888e 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -22,7 +22,7 @@
 #include <linux/kobject.h>
 #include <net/sock.h>
 
-#define BUFFER_SIZE     1024    /* buffer for the variables */
+#define BUFFER_SIZE     2048    /* buffer for the variables */
 #define NUM_ENVP        32      /* number of env pointers */
 
 #if defined(CONFIG_HOTPLUG) && defined(CONFIG_NET)
@@ -38,6 +38,10 @@ static char *action_to_string(enum kobject_action action)
                 return "remove";
         case KOBJ_CHANGE:
                 return "change";
+        case KOBJ_MOUNT:
+                return "mount";
+        case KOBJ_UMOUNT:
+                return "umount";
         case KOBJ_OFFLINE:
                 return "offline";
         case KOBJ_ONLINE:
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index c0bd4a914803..1e5b17dc7e3d 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -752,12 +752,14 @@ void *radix_tree_delete(struct radix_tree_root *root, unsigned long index)
          */
         nr_cleared_tags = 0;
         for (tag = 0; tag < RADIX_TREE_TAGS; tag++) {
+                tags[tag] = 1;
                 if (tag_get(pathp->node, tag, pathp->offset)) {
                         tag_clear(pathp->node, tag, pathp->offset);
-                        tags[tag] = 0;
-                        nr_cleared_tags++;
-                } else
-                        tags[tag] = 1;
+                        if (!any_tag_set(pathp->node, tag)) {
+                                tags[tag] = 0;
+                                nr_cleared_tags++;
+                        }
+                }
         }
 
         for (pathp--; nr_cleared_tags && pathp->node; pathp--) {
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index c8bb8cc899d7..d8b6bb419d49 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -72,9 +72,9 @@ static void __spin_lock_debug(spinlock_t *lock)
 
         for (;;) {
                 for (i = 0; i < loops_per_jiffy * HZ; i++) {
-                        cpu_relax();
                         if (__raw_spin_trylock(&lock->raw_lock))
                                 return;
+                        __delay(1);
                 }
                 /* lockup suspected: */
                 if (print_once) {
@@ -144,9 +144,9 @@ static void __read_lock_debug(rwlock_t *lock)
 
         for (;;) {
                 for (i = 0; i < loops_per_jiffy * HZ; i++) {
-                        cpu_relax();
                         if (__raw_read_trylock(&lock->raw_lock))
                                 return;
+                        __delay(1);
                 }
                 /* lockup suspected: */
                 if (print_once) {
@@ -217,9 +217,9 @@ static void __write_lock_debug(rwlock_t *lock)
 
         for (;;) {
                 for (i = 0; i < loops_per_jiffy * HZ; i++) {
-                        cpu_relax();
                         if (__raw_write_trylock(&lock->raw_lock))
                                 return;
+                        __delay(1);
                 }
                 /* lockup suspected: */
                 if (print_once) {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b21d78c941b5..508707704d2c 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -85,7 +85,7 @@ void free_huge_page(struct page *page)
         BUG_ON(page_count(page));
 
         INIT_LIST_HEAD(&page->lru);
-        page[1].mapping = NULL;
+        page[1].lru.next = NULL;                        /* reset dtor */
 
         spin_lock(&hugetlb_lock);
         enqueue_huge_page(page);
@@ -105,9 +105,9 @@ struct page *alloc_huge_page(struct vm_area_struct *vma, unsigned long addr)
         }
         spin_unlock(&hugetlb_lock);
         set_page_count(page, 1);
-        page[1].mapping = (void *)free_huge_page;
+        page[1].lru.next = (void *)free_huge_page;      /* set dtor */
         for (i = 0; i < (HPAGE_SIZE/PAGE_SIZE); ++i)
-                clear_highpage(&page[i]);
+                clear_user_highpage(&page[i], addr);
         return page;
 }
 
@@ -391,12 +391,7 @@ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
 
         if (!new_page) {
                 page_cache_release(old_page);
-
-                /* Logically this is OOM, not a SIGBUS, but an OOM
-                 * could cause the kernel to go killing other
-                 * processes which won't help the hugepage situation
-                 * at all (?) */
-                return VM_FAULT_SIGBUS;
+                return VM_FAULT_OOM;
         }
 
         spin_unlock(&mm->page_table_lock);
@@ -444,6 +439,7 @@ retry:
                 page = alloc_huge_page(vma, address);
                 if (!page) {
                         hugetlb_put_quota(mapping);
+                        ret = VM_FAULT_OOM;
                         goto out;
                 }
 
diff --git a/mm/madvise.c b/mm/madvise.c
index ae0ae3ea299a..af3d573b0141 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -22,16 +22,23 @@ static long madvise_behavior(struct vm_area_struct * vma,
         struct mm_struct * mm = vma->vm_mm;
         int error = 0;
         pgoff_t pgoff;
-        int new_flags = vma->vm_flags & ~VM_READHINTMASK;
+        int new_flags = vma->vm_flags;
 
         switch (behavior) {
+        case MADV_NORMAL:
+                new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
+                break;
         case MADV_SEQUENTIAL:
-                new_flags |= VM_SEQ_READ;
+                new_flags = (new_flags & ~VM_RAND_READ) | VM_SEQ_READ;
                 break;
         case MADV_RANDOM:
-                new_flags |= VM_RAND_READ;
+                new_flags = (new_flags & ~VM_SEQ_READ) | VM_RAND_READ;
                 break;
-        default:
+        case MADV_DONTFORK:
+                new_flags |= VM_DONTCOPY;
+                break;
+        case MADV_DOFORK:
+                new_flags &= ~VM_DONTCOPY;
                 break;
         }
 
@@ -177,6 +184,12 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
         long error;
 
         switch (behavior) {
+        case MADV_DOFORK:
+                if (vma->vm_flags & VM_IO) {
+                        error = -EINVAL;
+                        break;
+                }
+        case MADV_DONTFORK:
         case MADV_NORMAL:
         case MADV_SEQUENTIAL:
         case MADV_RANDOM:
diff --git a/mm/memory.c b/mm/memory.c
index 2bee1f21aa8a..85e80a57db29 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -82,6 +82,16 @@ EXPORT_SYMBOL(num_physpages);
 EXPORT_SYMBOL(high_memory);
 EXPORT_SYMBOL(vmalloc_earlyreserve);
 
+int randomize_va_space __read_mostly = 1;
+
+static int __init disable_randmaps(char *s)
+{
+        randomize_va_space = 0;
+        return 0;
+}
+__setup("norandmaps", disable_randmaps);
+
+
 /*
  * If a p?d_bad entry is found while walking page tables, report
  * the error, before resetting entry to p?d_none.  Usually (but
@@ -613,11 +623,12 @@ static unsigned long zap_pte_range(struct mmu_gather *tlb,
                         (*zap_work)--;
                         continue;
                 }
+
+                (*zap_work) -= PAGE_SIZE;
+
                 if (pte_present(ptent)) {
                         struct page *page;
 
-                        (*zap_work) -= PAGE_SIZE;
-
                         page = vm_normal_page(vma, addr, ptent);
                         if (unlikely(details) && page) {
                                 /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index a918f77f02f3..1fe76d963ac2 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -130,6 +130,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
                 onlined_pages++;
         }
         zone->present_pages += onlined_pages;
+        zone->zone_pgdat->node_present_pages += onlined_pages;
 
         setup_per_zone_pages_min();
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 27da6d5c77ba..b21869a39f0b 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -132,19 +132,29 @@ static int mpol_check_policy(int mode, nodemask_t *nodes)
         }
         return nodes_subset(*nodes, node_online_map) ? 0 : -EINVAL;
 }
+
 /* Generate a custom zonelist for the BIND policy. */
 static struct zonelist *bind_zonelist(nodemask_t *nodes)
 {
         struct zonelist *zl;
-        int num, max, nd;
+        int num, max, nd, k;
 
         max = 1 + MAX_NR_ZONES * nodes_weight(*nodes);
-        zl = kmalloc(sizeof(void *) * max, GFP_KERNEL);
+        zl = kmalloc(sizeof(struct zone *) * max, GFP_KERNEL);
         if (!zl)
                 return NULL;
         num = 0;
-        for_each_node_mask(nd, *nodes)
-                zl->zones[num++] = &NODE_DATA(nd)->node_zones[policy_zone];
+        /* First put in the highest zones from all nodes, then all the next 
+           lower zones etc. Avoid empty zones because the memory allocator
+           doesn't like them. If you implement node hot removal you
+           have to fix that. */
+        for (k = policy_zone; k >= 0; k--) { 
+                for_each_node_mask(nd, *nodes) { 
+                        struct zone *z = &NODE_DATA(nd)->node_zones[k];
+                        if (z->present_pages > 0) 
+                                zl->zones[num++] = z;
+                }
+        }
         zl->zones[num] = NULL;
         return zl;
 }
@@ -187,7 +197,7 @@ static struct mempolicy *mpol_new(int mode, nodemask_t *nodes)
         return policy;
 }
 
-static void gather_stats(struct page *, void *);
+static void gather_stats(struct page *, void *, int pte_dirty);
 static void migrate_page_add(struct page *page, struct list_head *pagelist,
                                 unsigned long flags);
 
@@ -229,7 +239,7 @@ static int check_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
                         continue;
 
                 if (flags & MPOL_MF_STATS)
-                        gather_stats(page, private);
+                        gather_stats(page, private, pte_dirty(*pte));
                 else if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
                         migrate_page_add(page, private, flags);
                 else
@@ -320,9 +330,19 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
         int err;
         struct vm_area_struct *first, *vma, *prev;
 
-        /* Clear the LRU lists so pages can be isolated */
-        if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
+        if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+                /* Must have swap device for migration */
+                if (nr_swap_pages <= 0)
+                        return ERR_PTR(-ENODEV);
+
+                /*
+                 * Clear the LRU lists so pages can be isolated.
+                 * Note that pages may be moved off the LRU after we have
+                 * drained them. Those pages will fail to migrate like other
+                 * pages that may be busy.
+                 */
                 lru_add_drain_all();
+        }
 
         first = find_vma(mm, start);
         if (!first)
@@ -542,7 +562,7 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
          */
         if ((flags & MPOL_MF_MOVE_ALL) || page_mapcount(page) == 1) {
                 if (isolate_lru_page(page))
-                        list_add(&page->lru, pagelist);
+                        list_add_tail(&page->lru, pagelist);
         }
 }
 
@@ -559,6 +579,7 @@ static int migrate_pages_to(struct list_head *pagelist,
         LIST_HEAD(moved);
         LIST_HEAD(failed);
         int err = 0;
+        unsigned long offset = 0;
         int nr_pages;
         struct page *page;
         struct list_head *p;
@@ -566,8 +587,21 @@ static int migrate_pages_to(struct list_head *pagelist,
 redo:
         nr_pages = 0;
         list_for_each(p, pagelist) {
-                if (vma)
-                        page = alloc_page_vma(GFP_HIGHUSER, vma, vma->vm_start);
+                if (vma) {
+                        /*
+                         * The address passed to alloc_page_vma is used to
+                         * generate the proper interleave behavior. We fake
+                         * the address here by an increasing offset in order
+                         * to get the proper distribution of pages.
+                         *
+                         * No decision has been made as to which page
+                         * a certain old page is moved to so we cannot
+                         * specify the correct address.
+                         */
+                        page = alloc_page_vma(GFP_HIGHUSER, vma,
+                                        offset + vma->vm_start);
+                        offset += PAGE_SIZE;
+                }
                 else
                         page = alloc_pages_node(dest, GFP_HIGHUSER, 0);
 
@@ -575,9 +609,9 @@ redo:
                         err = -ENOMEM;
                         goto out;
                 }
-                list_add(&page->lru, &newlist);
+                list_add_tail(&page->lru, &newlist);
                 nr_pages++;
-                if (nr_pages > MIGRATE_CHUNK_SIZE);
+                if (nr_pages > MIGRATE_CHUNK_SIZE)
                         break;
         }
         err = migrate_pages(pagelist, &newlist, &moved, &failed);
@@ -724,7 +758,7 @@ long do_mbind(unsigned long start, unsigned long len,
                                       MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
             || mode > MPOL_MAX)
                 return -EINVAL;
-        if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_RESOURCE))
+        if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_NICE))
                 return -EPERM;
 
         if (start & ~PAGE_MASK)
@@ -798,6 +832,8 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
         nodes_clear(*nodes);
         if (maxnode == 0 || !nmask)
                 return 0;
+        if (maxnode > PAGE_SIZE*BITS_PER_BYTE)
+                return -EINVAL;
 
         nlongs = BITS_TO_LONGS(maxnode);
         if ((maxnode % BITS_PER_LONG) == 0)
@@ -916,19 +952,20 @@ asmlinkage long sys_migrate_pages(pid_t pid, unsigned long maxnode,
          */
         if ((current->euid != task->suid) && (current->euid != task->uid) &&
             (current->uid != task->suid) && (current->uid != task->uid) &&
-            !capable(CAP_SYS_ADMIN)) {
+            !capable(CAP_SYS_NICE)) {
                 err = -EPERM;
                 goto out;
         }
 
         task_nodes = cpuset_mems_allowed(task);
         /* Is the user allowed to access the target nodes? */
-        if (!nodes_subset(new, task_nodes) && !capable(CAP_SYS_ADMIN)) {
+        if (!nodes_subset(new, task_nodes) && !capable(CAP_SYS_NICE)) {
                 err = -EPERM;
                 goto out;
         }
 
-        err = do_migrate_pages(mm, &old, &new, MPOL_MF_MOVE);
+        err = do_migrate_pages(mm, &old, &new,
+                capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
 out:
         mmput(mm);
         return err;
@@ -1159,6 +1196,7 @@ static inline unsigned interleave_nid(struct mempolicy *pol,
                 return interleave_nodes(pol);
 }
 
+#ifdef CONFIG_HUGETLBFS
 /* Return a zonelist suitable for a huge page allocation. */
 struct zonelist *huge_zonelist(struct vm_area_struct *vma, unsigned long addr)
 {
@@ -1172,6 +1210,7 @@ struct zonelist *huge_zonelist(struct vm_area_struct *vma, unsigned long addr)
         }
         return zonelist_policy(GFP_HIGHUSER, pol);
 }
+#endif
 
 /* Allocate a page in interleaved policy.
    Own path because it needs to do special accounting. */
@@ -1724,66 +1763,145 @@ static inline int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
 struct numa_maps {
         unsigned long pages;
         unsigned long anon;
-        unsigned long mapped;
+        unsigned long active;
+        unsigned long writeback;
         unsigned long mapcount_max;
+        unsigned long dirty;
+        unsigned long swapcache;
         unsigned long node[MAX_NUMNODES];
 };
 
-static void gather_stats(struct page *page, void *private)
+static void gather_stats(struct page *page, void *private, int pte_dirty)
 {
         struct numa_maps *md = private;
         int count = page_mapcount(page);
 
-        if (count)
-                md->mapped++;
+        md->pages++;
+        if (pte_dirty || PageDirty(page))
+                md->dirty++;
 
-        if (count > md->mapcount_max)
-                md->mapcount_max = count;
+        if (PageSwapCache(page))
+                md->swapcache++;
 
-        md->pages++;
+        if (PageActive(page))
+                md->active++;
+
+        if (PageWriteback(page))
+                md->writeback++;
 
         if (PageAnon(page))
                 md->anon++;
 
+        if (count > md->mapcount_max)
+                md->mapcount_max = count;
+
         md->node[page_to_nid(page)]++;
         cond_resched();
 }
 
+#ifdef CONFIG_HUGETLB_PAGE
+static void check_huge_range(struct vm_area_struct *vma,
+                unsigned long start, unsigned long end,
+                struct numa_maps *md)
+{
+        unsigned long addr;
+        struct page *page;
+
+        for (addr = start; addr < end; addr += HPAGE_SIZE) {
+                pte_t *ptep = huge_pte_offset(vma->vm_mm, addr & HPAGE_MASK);
+                pte_t pte;
+
+                if (!ptep)
+                        continue;
+
+                pte = *ptep;
+                if (pte_none(pte))
+                        continue;
+
+                page = pte_page(pte);
+                if (!page)
+                        continue;
+
+                gather_stats(page, md, pte_dirty(*ptep));
+        }
+}
+#else
+static inline void check_huge_range(struct vm_area_struct *vma,
+                unsigned long start, unsigned long end,
+                struct numa_maps *md)
+{
+}
+#endif
+
 int show_numa_map(struct seq_file *m, void *v)
 {
         struct task_struct *task = m->private;
         struct vm_area_struct *vma = v;
         struct numa_maps *md;
+        struct file *file = vma->vm_file;
+        struct mm_struct *mm = vma->vm_mm;
         int n;
         char buffer[50];
 
-        if (!vma->vm_mm)
+        if (!mm)
                 return 0;
 
         md = kzalloc(sizeof(struct numa_maps), GFP_KERNEL);
         if (!md)
                 return 0;
 
-        check_pgd_range(vma, vma->vm_start, vma->vm_end,
-                    &node_online_map, MPOL_MF_STATS, md);
+        mpol_to_str(buffer, sizeof(buffer),
+                        get_vma_policy(task, vma, vma->vm_start));
 
-        if (md->pages) {
-                mpol_to_str(buffer, sizeof(buffer),
-                            get_vma_policy(task, vma, vma->vm_start));
+        seq_printf(m, "%08lx %s", vma->vm_start, buffer);
 
-                seq_printf(m, "%08lx %s pages=%lu mapped=%lu maxref=%lu",
-                           vma->vm_start, buffer, md->pages,
-                           md->mapped, md->mapcount_max);
+        if (file) {
+                seq_printf(m, " file=");
+                seq_path(m, file->f_vfsmnt, file->f_dentry, "\n\t= ");
+        } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
+                seq_printf(m, " heap");
+        } else if (vma->vm_start <= mm->start_stack &&
+                        vma->vm_end >= mm->start_stack) {
+                seq_printf(m, " stack");
+        }
+
+        if (is_vm_hugetlb_page(vma)) {
+                check_huge_range(vma, vma->vm_start, vma->vm_end, md);
+                seq_printf(m, " huge");
+        } else {
+                check_pgd_range(vma, vma->vm_start, vma->vm_end,
+                                &node_online_map, MPOL_MF_STATS, md);
+        }
 
-                if (md->anon)
-                        seq_printf(m," anon=%lu",md->anon);
+        if (!md->pages)
+                goto out;
 
-                for_each_online_node(n)
-                        if (md->node[n])
-                                seq_printf(m, " N%d=%lu", n, md->node[n]);
+        if (md->anon)
+                seq_printf(m," anon=%lu",md->anon);
 
-                seq_putc(m, '\n');
-        }
+        if (md->dirty)
+                seq_printf(m," dirty=%lu",md->dirty);
+
+        if (md->pages != md->anon && md->pages != md->dirty)
+                seq_printf(m, " mapped=%lu", md->pages);
+
+        if (md->mapcount_max > 1)
+                seq_printf(m, " mapmax=%lu", md->mapcount_max);
+
+        if (md->swapcache)
+                seq_printf(m," swapcache=%lu", md->swapcache);
+
+        if (md->active < md->pages && !is_vm_hugetlb_page(vma))
+                seq_printf(m," active=%lu", md->active);
+
+        if (md->writeback)
+                seq_printf(m," writeback=%lu", md->writeback);
+
+        for_each_online_node(n)
+                if (md->node[n])
+                        seq_printf(m, " N%d=%lu", n, md->node[n]);
+out:
+        seq_putc(m, '\n');
         kfree(md);
 
         if (m->count < m->size)
diff --git a/mm/nommu.c b/mm/nommu.c
index c10262d68232..4951f4786f28 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -53,10 +53,11 @@ DECLARE_RWSEM(nommu_vma_sem);
 struct vm_operations_struct generic_file_vm_ops = {
 };
 
-EXPORT_SYMBOL(vmalloc);
 EXPORT_SYMBOL(vfree);
 EXPORT_SYMBOL(vmalloc_to_page);
 EXPORT_SYMBOL(vmalloc_32);
+EXPORT_SYMBOL(vmap);
+EXPORT_SYMBOL(vunmap);
 
 /*
  * Handle all mappings that got truncated by a "truncate()"
@@ -203,6 +204,13 @@ void *vmalloc(unsigned long size)
 {
        return __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL);
 }
+EXPORT_SYMBOL(vmalloc);
+
+void *vmalloc_node(unsigned long size, int node)
+{
+        return vmalloc(size);
+}
+EXPORT_SYMBOL(vmalloc_node);
 
 /*
  *      vmalloc_32  -  allocate virtually continguos memory (32bit addressable)
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b05ab8f2a562..78747afad6b0 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -58,15 +58,17 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
 
         /*
          * Processes which fork a lot of child processes are likely
-         * a good choice. We add the vmsize of the children if they
+         * a good choice. We add half the vmsize of the children if they
          * have an own mm. This prevents forking servers to flood the
-         * machine with an endless amount of children
+         * machine with an endless amount of children. In case a single
+         * child is eating the vast majority of memory, adding only half
+         * to the parents will make the child our kill candidate of choice.
          */
         list_for_each(tsk, &p->children) {
                 struct task_struct *chld;
                 chld = list_entry(tsk, struct task_struct, sibling);
                 if (chld->mm != p->mm && chld->mm)
-                        points += chld->mm->total_vm;
+                        points += chld->mm->total_vm/2 + 1;
         }
 
         /*
@@ -131,17 +133,47 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
 }
 
 /*
+ * Types of limitations to the nodes from which allocations may occur
+ */
+#define CONSTRAINT_NONE 1
+#define CONSTRAINT_MEMORY_POLICY 2
+#define CONSTRAINT_CPUSET 3
+
+/*
+ * Determine the type of allocation constraint.
+ */
+static inline int constrained_alloc(struct zonelist *zonelist, gfp_t gfp_mask)
+{
+#ifdef CONFIG_NUMA
+        struct zone **z;
+        nodemask_t nodes = node_online_map;
+
+        for (z = zonelist->zones; *z; z++)
+                if (cpuset_zone_allowed(*z, gfp_mask))
+                        node_clear((*z)->zone_pgdat->node_id,
+                                        nodes);
+                else
+                        return CONSTRAINT_CPUSET;
+
+        if (!nodes_empty(nodes))
+                return CONSTRAINT_MEMORY_POLICY;
+#endif
+
+        return CONSTRAINT_NONE;
+}
+
+/*
  * Simple selection loop. We chose the process with the highest
  * number of 'points'. We expect the caller will lock the tasklist.
  *
  * (not docbooked, we don't want this one cluttering up the manual)
  */
-static struct task_struct * select_bad_process(void)
+static struct task_struct *select_bad_process(unsigned long *ppoints)
 {
-        unsigned long maxpoints = 0;
         struct task_struct *g, *p;
         struct task_struct *chosen = NULL;
         struct timespec uptime;
+        *ppoints = 0;
 
         do_posix_clock_monotonic_gettime(&uptime);
         do_each_thread(g, p) {
@@ -169,9 +201,9 @@ static struct task_struct * select_bad_process(void)
                         return p;
 
                 points = badness(p, uptime.tv_sec);
-                if (points > maxpoints || !chosen) {
+                if (points > *ppoints || !chosen) {
                         chosen = p;
-                        maxpoints = points;
+                        *ppoints = points;
                 }
         } while_each_thread(g, p);
         return chosen;
@@ -182,7 +214,7 @@ static struct task_struct * select_bad_process(void)
  * CAP_SYS_RAW_IO set, send SIGTERM instead (but it's unlikely that
  * we select a process with CAP_SYS_RAW_IO set).
  */
-static void __oom_kill_task(task_t *p)
+static void __oom_kill_task(task_t *p, const char *message)
 {
         if (p->pid == 1) {
                 WARN_ON(1);
@@ -198,8 +230,8 @@ static void __oom_kill_task(task_t *p)
                 return;
         }
         task_unlock(p);
-        printk(KERN_ERR "Out of Memory: Killed process %d (%s).\n",
-                                                        p->pid, p->comm);
+        printk(KERN_ERR "%s: Killed process %d (%s).\n",
+                                message, p->pid, p->comm);
 
         /*
          * We give our sacrificial lamb high priority and access to
@@ -212,7 +244,7 @@ static void __oom_kill_task(task_t *p)
         force_sig(SIGKILL, p);
 }
 
-static struct mm_struct *oom_kill_task(task_t *p)
+static struct mm_struct *oom_kill_task(task_t *p, const char *message)
 {
         struct mm_struct *mm = get_task_mm(p);
         task_t * g, * q;
@@ -224,35 +256,38 @@ static struct mm_struct *oom_kill_task(task_t *p)
                 return NULL;
         }
 
-        __oom_kill_task(p);
+        __oom_kill_task(p, message);
         /*
          * kill all processes that share the ->mm (i.e. all threads),
          * but are in a different thread group
          */
         do_each_thread(g, q)
                 if (q->mm == mm && q->tgid != p->tgid)
-                        __oom_kill_task(q);
+                        __oom_kill_task(q, message);
         while_each_thread(g, q);
 
         return mm;
 }
 
-static struct mm_struct *oom_kill_process(struct task_struct *p)
+static struct mm_struct *oom_kill_process(struct task_struct *p,
+                                unsigned long points, const char *message)
 {
         struct mm_struct *mm;
         struct task_struct *c;
         struct list_head *tsk;
 
+        printk(KERN_ERR "Out of Memory: Kill process %d (%s) score %li and "
+                "children.\n", p->pid, p->comm, points);
         /* Try to kill a child first */
         list_for_each(tsk, &p->children) {
                 c = list_entry(tsk, struct task_struct, sibling);
                 if (c->mm == p->mm)
                         continue;
-                mm = oom_kill_task(c);
+                mm = oom_kill_task(c, message);
                 if (mm)
                         return mm;
         }
-        return oom_kill_task(p);
+        return oom_kill_task(p, message);
 }
 
 /**
@@ -263,10 +298,11 @@ static struct mm_struct *oom_kill_process(struct task_struct *p)
  * OR try to be smart about which process to kill. Note that we
  * don't have to be perfect here, we just have to be good.
  */
-void out_of_memory(gfp_t gfp_mask, int order)
+void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask, int order)
 {
         struct mm_struct *mm = NULL;
-        task_t * p;
+        task_t *p;
+        unsigned long points = 0;
 
         if (printk_ratelimit()) {
                 printk("oom-killer: gfp_mask=0x%x, order=%d\n",
@@ -277,24 +313,48 @@ void out_of_memory(gfp_t gfp_mask, int order)
 
         cpuset_lock();
         read_lock(&tasklist_lock);
+
+        /*
+         * Check if there were limitations on the allocation (only relevant for
+         * NUMA) that may require different handling.
+         */
+        switch (constrained_alloc(zonelist, gfp_mask)) {
+        case CONSTRAINT_MEMORY_POLICY:
+                mm = oom_kill_process(current, points,
+                                "No available memory (MPOL_BIND)");
+                break;
+
+        case CONSTRAINT_CPUSET:
+                mm = oom_kill_process(current, points,
+                                "No available memory in cpuset");
+                break;
+
+        case CONSTRAINT_NONE:
 retry:
-        p = select_bad_process();
+                /*
+                 * Rambo mode: Shoot down a process and hope it solves whatever
+                 * issues we may have.
+                 */
+                p = select_bad_process(&points);
 
-        if (PTR_ERR(p) == -1UL)
-                goto out;
+                if (PTR_ERR(p) == -1UL)
+                        goto out;
 
-        /* Found nothing?!?! Either we hang forever, or we panic. */
-        if (!p) {
-                read_unlock(&tasklist_lock);
-                cpuset_unlock();
-                panic("Out of memory and no killable processes...\n");
-        }
+                /* Found nothing?!?! Either we hang forever, or we panic. */
+                if (!p) {
+                        read_unlock(&tasklist_lock);
+                        cpuset_unlock();
+                        panic("Out of memory and no killable processes...\n");
+                }
 
-        mm = oom_kill_process(p);
-        if (!mm)
-                goto retry;
+                mm = oom_kill_process(p, points, "Out of memory");
+                if (!mm)
+                        goto retry;
+
+                break;
+        }
 
- out:
+out:
         read_unlock(&tasklist_lock);
         cpuset_unlock();
         if (mm)
@@ -305,5 +365,5 @@ retry:
          * retry to allocate memory unless "p" is current
          */
         if (!test_thread_flag(TIF_MEMDIE))
-                schedule_timeout_interruptible(1);
+                schedule_timeout_uninterruptible(1);
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 44b4eb4202d9..234bd4895d14 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -56,6 +56,7 @@ long nr_swap_pages;
 int percpu_pagelist_fraction;
 
 static void fastcall free_hot_cold_page(struct page *page, int cold);
+static void __free_pages_ok(struct page *page, unsigned int order);
 
 /*
  * results with 256, 32 in the lowmem_reserve sysctl:
@@ -169,20 +170,23 @@ static void bad_page(struct page *page)
  * All pages have PG_compound set.  All pages have their ->private pointing at
  * the head page (even the head page has this).
  *
- * The first tail page's ->mapping, if non-zero, holds the address of the
- * compound page's put_page() function.
- *
- * The order of the allocation is stored in the first tail page's ->index
- * This is only for debug at present.  This usage means that zero-order pages
- * may not be compound.
+ * The first tail page's ->lru.next holds the address of the compound page's
+ * put_page() function.  Its ->lru.prev holds the order of allocation.
+ * This usage means that zero-order pages may not be compound.
  */
+
+static void free_compound_page(struct page *page)
+{
+        __free_pages_ok(page, (unsigned long)page[1].lru.prev);
+}
+
 static void prep_compound_page(struct page *page, unsigned long order)
 {
         int i;
         int nr_pages = 1 << order;
 
-        page[1].mapping = NULL;
-        page[1].index = order;
+        page[1].lru.next = (void *)free_compound_page;  /* set dtor */
+        page[1].lru.prev = (void *)order;
         for (i = 0; i < nr_pages; i++) {
                 struct page *p = page + i;
 
@@ -196,7 +200,7 @@ static void destroy_compound_page(struct page *page, unsigned long order)
         int i;
         int nr_pages = 1 << order;
 
-        if (unlikely(page[1].index != order))
+        if (unlikely((unsigned long)page[1].lru.prev != order))
                 bad_page(page);
 
         for (i = 0; i < nr_pages; i++) {
@@ -586,21 +590,20 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
 }
 
 #ifdef CONFIG_NUMA
-/* Called from the slab reaper to drain remote pagesets */
-void drain_remote_pages(void)
+/*
+ * Called from the slab reaper to drain pagesets on a particular node that
+ * belong to the currently executing processor.
+ */
+void drain_node_pages(int nodeid)
 {
-        struct zone *zone;
-        int i;
+        int i, z;
         unsigned long flags;
 
         local_irq_save(flags);
-        for_each_zone(zone) {
+        for (z = 0; z < MAX_NR_ZONES; z++) {
+                struct zone *zone = NODE_DATA(nodeid)->node_zones + z;
                 struct per_cpu_pageset *pset;
 
-                /* Do not drain local pagesets */
-                if (zone->zone_pgdat->node_id == numa_node_id())
-                        continue;
-
                 pset = zone_pcp(zone, smp_processor_id());
                 for (i = 0; i < ARRAY_SIZE(pset->pcp); i++) {
                         struct per_cpu_pages *pcp;
@@ -1011,7 +1014,7 @@ rebalance:
                 if (page)
                         goto got_pg;
 
-                out_of_memory(gfp_mask, order);
+                out_of_memory(zonelist, gfp_mask, order);
                 goto restart;
         }
 
@@ -1213,18 +1216,21 @@ static void __get_page_state(struct page_state *ret, int nr, cpumask_t *cpumask)
 {
         int cpu = 0;
 
-        memset(ret, 0, sizeof(*ret));
+        memset(ret, 0, nr * sizeof(unsigned long));
         cpus_and(*cpumask, *cpumask, cpu_online_map);
 
         cpu = first_cpu(*cpumask);
         while (cpu < NR_CPUS) {
                 unsigned long *in, *out, off;
 
+                if (!cpu_isset(cpu, *cpumask))
+                        continue;
+
                 in = (unsigned long *)&per_cpu(page_states, cpu);
 
                 cpu = next_cpu(cpu, *cpumask);
 
-                if (cpu < NR_CPUS)
+                if (likely(cpu < NR_CPUS))
                         prefetch(&per_cpu(page_states, cpu));
 
                 out = (unsigned long *)ret;
@@ -1534,29 +1540,29 @@ static int __initdata node_load[MAX_NUMNODES];
  */
 static int __init find_next_best_node(int node, nodemask_t *used_node_mask)
 {
-        int i, n, val;
+        int n, val;
         int min_val = INT_MAX;
         int best_node = -1;
 
-        for_each_online_node(i) {
-                cpumask_t tmp;
+        /* Use the local node if we haven't already */
+        if (!node_isset(node, *used_node_mask)) {
+                node_set(node, *used_node_mask);
+                return node;
+        }
 
-                /* Start from local node */
-                n = (node+i) % num_online_nodes();
+        for_each_online_node(n) {
+                cpumask_t tmp;
 
                 /* Don't want a node to appear more than once */
                 if (node_isset(n, *used_node_mask))
                         continue;
 
-                /* Use the local node if we haven't already */
-                if (!node_isset(node, *used_node_mask)) {
-                        best_node = node;
-                        break;
-                }
-
                 /* Use the distance array to find the distance */
                 val = node_distance(node, n);
 
+                /* Penalize nodes under us ("prefer the next node") */
+                val += (n < node);
+
                 /* Give preference to headless and unused nodes */
                 tmp = node_to_cpumask(n);
                 if (!cpus_empty(tmp))
@@ -1886,8 +1892,7 @@ static void setup_pagelist_highmark(struct per_cpu_pageset *p,
  * not check if the processor is online before following the pageset pointer.
  * Other parts of the kernel may not check if the zone is available.
  */
-static struct per_cpu_pageset
-        boot_pageset[NR_CPUS];
+static struct per_cpu_pageset boot_pageset[NR_CPUS];
 
 /*
  * Dynamically allocate memory for the
diff --git a/mm/rmap.c b/mm/rmap.c
index df2c41c2a9a2..67f0e20b101f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -212,25 +212,33 @@ out:
  * through real pte's pointing to valid pages and then releasing
  * the page from the swap cache.
  *
- * Must hold page lock on page.
+ * Must hold page lock on page and mmap_sem of one vma that contains
+ * the page.
  */
 void remove_from_swap(struct page *page)
 {
         struct anon_vma *anon_vma;
         struct vm_area_struct *vma;
+        unsigned long mapping;
 
-        if (!PageAnon(page) || !PageSwapCache(page))
+        if (!PageSwapCache(page))
                 return;
 
-        anon_vma = page_lock_anon_vma(page);
-        if (!anon_vma)
+        mapping = (unsigned long)page->mapping;
+
+        if (!mapping || (mapping & PAGE_MAPPING_ANON) == 0)
                 return;
 
+        /*
+         * We hold the mmap_sem lock. So no need to call page_lock_anon_vma.
+         */
+        anon_vma = (struct anon_vma *) (mapping - PAGE_MAPPING_ANON);
+        spin_lock(&anon_vma->lock);
+
         list_for_each_entry(vma, &anon_vma->head, anon_vma_node)
                 remove_vma_swap(vma, page);
 
         spin_unlock(&anon_vma->lock);
-
         delete_from_swap_cache(page);
 }
 EXPORT_SYMBOL(remove_from_swap);
@@ -529,9 +537,6 @@ void page_add_new_anon_rmap(struct page *page,
  */
 void page_add_file_rmap(struct page *page)
 {
-        BUG_ON(PageAnon(page));
-        BUG_ON(!pfn_valid(page_to_pfn(page)));
-
         if (atomic_inc_and_test(&page->_mapcount))
                 __inc_page_state(nr_mapped);
 }
diff --git a/mm/shmem.c b/mm/shmem.c
index f7ac7b812f92..7c455fbaff7b 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -45,6 +45,7 @@
 #include <linux/swapops.h>
 #include <linux/mempolicy.h>
 #include <linux/namei.h>
+#include <linux/ctype.h>
 #include <asm/uaccess.h>
 #include <asm/div64.h>
 #include <asm/pgtable.h>
@@ -874,6 +875,51 @@ redirty:
 }
 
 #ifdef CONFIG_NUMA
+static int shmem_parse_mpol(char *value, int *policy, nodemask_t *policy_nodes)
+{
+        char *nodelist = strchr(value, ':');
+        int err = 1;
+
+        if (nodelist) {
+                /* NUL-terminate policy string */
+                *nodelist++ = '\0';
+                if (nodelist_parse(nodelist, *policy_nodes))
+                        goto out;
+        }
+        if (!strcmp(value, "default")) {
+                *policy = MPOL_DEFAULT;
+                /* Don't allow a nodelist */
+                if (!nodelist)
+                        err = 0;
+        } else if (!strcmp(value, "prefer")) {
+                *policy = MPOL_PREFERRED;
+                /* Insist on a nodelist of one node only */
+                if (nodelist) {
+                        char *rest = nodelist;
+                        while (isdigit(*rest))
+                                rest++;
+                        if (!*rest)
+                                err = 0;
+                }
+        } else if (!strcmp(value, "bind")) {
+                *policy = MPOL_BIND;
+                /* Insist on a nodelist */
+                if (nodelist)
+                        err = 0;
+        } else if (!strcmp(value, "interleave")) {
+                *policy = MPOL_INTERLEAVE;
+                /* Default to nodes online if no nodelist */
+                if (!nodelist)
+                        *policy_nodes = node_online_map;
+                err = 0;
+        }
+out:
+        /* Restore string for error message */
+        if (nodelist)
+                *--nodelist = ':';
+        return err;
+}
+
 static struct page *shmem_swapin_async(struct shared_policy *p,
                                        swp_entry_t entry, unsigned long idx)
 {
@@ -926,6 +972,11 @@ shmem_alloc_page(gfp_t gfp, struct shmem_inode_info *info,
         return page;
 }
 #else
+static inline int shmem_parse_mpol(char *value, int *policy, nodemask_t *policy_nodes)
+{
+        return 1;
+}
+
 static inline struct page *
 shmem_swapin(struct shmem_inode_info *info,swp_entry_t entry,unsigned long idx)
 {
@@ -1859,7 +1910,23 @@ static int shmem_parse_options(char *options, int *mode, uid_t *uid,
 {
         char *this_char, *value, *rest;
 
-        while ((this_char = strsep(&options, ",")) != NULL) {
+        while (options != NULL) {
+                this_char = options;
+                for (;;) {
+                        /*
+                         * NUL-terminate this option: unfortunately,
+                         * mount options form a comma-separated list,
+                         * but mpol's nodelist may also contain commas.
+                         */
+                        options = strchr(options, ',');
+                        if (options == NULL)
+                                break;
+                        options++;
+                        if (!isdigit(*options)) {
+                                options[-1] = '\0';
+                                break;
+                        }
+                }
                 if (!*this_char)
                         continue;
                 if ((value = strchr(this_char,'=')) != NULL) {
@@ -1910,18 +1977,8 @@ static int shmem_parse_options(char *options, int *mode, uid_t *uid,
                         if (*rest)
                                 goto bad_val;
                 } else if (!strcmp(this_char,"mpol")) {
-                        if (!strcmp(value,"default"))
-                                *policy = MPOL_DEFAULT;
-                        else if (!strcmp(value,"preferred"))
-                                *policy = MPOL_PREFERRED;
-                        else if (!strcmp(value,"bind"))
-                                *policy = MPOL_BIND;
-                        else if (!strcmp(value,"interleave"))
-                                *policy = MPOL_INTERLEAVE;
-                        else
+                        if (shmem_parse_mpol(value,policy,policy_nodes))
                                 goto bad_val;
-                } else if (!strcmp(this_char,"mpol_nodelist")) {
-                        nodelist_parse(value, *policy_nodes);
                 } else {
                         printk(KERN_ERR "tmpfs: Bad mount option %s\n",
                                this_char);
diff --git a/mm/slab.c b/mm/slab.c
index 71370256a7eb..d0bd7f07ab04 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -294,6 +294,7 @@ struct kmem_list3 {
         unsigned long next_reap;
         int free_touched;
         unsigned int free_limit;
+        unsigned int colour_next;       /* Per-node cache coloring */
         spinlock_t list_lock;
         struct array_cache *shared;     /* shared per node */
         struct array_cache **alien;     /* on other nodes */
@@ -344,6 +345,7 @@ static void kmem_list3_init(struct kmem_list3 *parent)
         INIT_LIST_HEAD(&parent->slabs_free);
         parent->shared = NULL;
         parent->alien = NULL;
+        parent->colour_next = 0;
         spin_lock_init(&parent->list_lock);
         parent->free_objects = 0;
         parent->free_touched = 0;
@@ -390,7 +392,6 @@ struct kmem_cache {
 
         size_t colour;          /* cache colouring range */
         unsigned int colour_off;        /* colour offset */
-        unsigned int colour_next;       /* cache colouring */
         struct kmem_cache *slabp_cache;
         unsigned int slab_size;
         unsigned int dflags;    /* dynamic flags */
@@ -788,6 +789,47 @@ static void __slab_error(const char *function, struct kmem_cache *cachep, char *
         dump_stack();
 }
 
+#ifdef CONFIG_NUMA
+/*
+ * Special reaping functions for NUMA systems called from cache_reap().
+ * These take care of doing round robin flushing of alien caches (containing
+ * objects freed on different nodes from which they were allocated) and the
+ * flushing of remote pcps by calling drain_node_pages.
+ */
+static DEFINE_PER_CPU(unsigned long, reap_node);
+
+static void init_reap_node(int cpu)
+{
+        int node;
+
+        node = next_node(cpu_to_node(cpu), node_online_map);
+        if (node == MAX_NUMNODES)
+                node = 0;
+
+        __get_cpu_var(reap_node) = node;
+}
+
+static void next_reap_node(void)
+{
+        int node = __get_cpu_var(reap_node);
+
+        /*
+         * Also drain per cpu pages on remote zones
+         */
+        if (node != numa_node_id())
+                drain_node_pages(node);
+
+        node = next_node(node, node_online_map);
+        if (unlikely(node >= MAX_NUMNODES))
+                node = first_node(node_online_map);
+        __get_cpu_var(reap_node) = node;
+}
+
+#else
+#define init_reap_node(cpu) do { } while (0)
+#define next_reap_node(void) do { } while (0)
+#endif
+
 /*
  * Initiate the reap timer running on the target CPU.  We run at around 1 to 2Hz
  * via the workqueue/eventd.
@@ -805,6 +847,7 @@ static void __devinit start_cpu_timer(int cpu)
          * at that time.
          */
         if (keventd_up() && reap_work->func == NULL) {
+                init_reap_node(cpu);
                 INIT_WORK(reap_work, cache_reap, NULL);
                 schedule_delayed_work_on(cpu, reap_work, HZ + 3 * cpu);
         }
@@ -883,14 +926,31 @@ static void __drain_alien_cache(struct kmem_cache *cachep,
         }
 }
 
-static void drain_alien_cache(struct kmem_cache *cachep, struct kmem_list3 *l3)
+/*
+ * Called from cache_reap() to regularly drain alien caches round robin.
+ */
+static void reap_alien(struct kmem_cache *cachep, struct kmem_list3 *l3)
+{
+        int node = __get_cpu_var(reap_node);
+
+        if (l3->alien) {
+                struct array_cache *ac = l3->alien[node];
+                if (ac && ac->avail) {
+                        spin_lock_irq(&ac->lock);
+                        __drain_alien_cache(cachep, ac, node);
+                        spin_unlock_irq(&ac->lock);
+                }
+        }
+}
+
+static void drain_alien_cache(struct kmem_cache *cachep, struct array_cache **alien)
 {
         int i = 0;
         struct array_cache *ac;
         unsigned long flags;
 
         for_each_online_node(i) {
-                ac = l3->alien[i];
+                ac = alien[i];
                 if (ac) {
                         spin_lock_irqsave(&ac->lock, flags);
                         __drain_alien_cache(cachep, ac, i);
@@ -899,9 +959,19 @@ static void drain_alien_cache(struct kmem_cache *cachep, struct kmem_list3 *l3)
         }
 }
 #else
-#define alloc_alien_cache(node, limit) do { } while (0)
-#define free_alien_cache(ac_ptr) do { } while (0)
-#define drain_alien_cache(cachep, l3) do { } while (0)
+
+#define drain_alien_cache(cachep, alien) do { } while (0)
+#define reap_alien(cachep, l3) do { } while (0)
+
+static inline struct array_cache **alloc_alien_cache(int node, int limit)
+{
+        return (struct array_cache **) 0x01020304ul;
+}
+
+static inline void free_alien_cache(struct array_cache **ac_ptr)
+{
+}
+
 #endif
 
 static int __devinit cpuup_callback(struct notifier_block *nfb,
@@ -935,6 +1005,11 @@ static int __devinit cpuup_callback(struct notifier_block *nfb,
                                 l3->next_reap = jiffies + REAPTIMEOUT_LIST3 +
                                     ((unsigned long)cachep) % REAPTIMEOUT_LIST3;
 
+                                /*
+                                 * The l3s don't come and go as CPUs come and
+                                 * go.  cache_chain_mutex is sufficient
+                                 * protection here.
+                                 */
                                 cachep->nodelists[node] = l3;
                         }
 
@@ -949,26 +1024,46 @@ static int __devinit cpuup_callback(struct notifier_block *nfb,
                    & array cache's */
                 list_for_each_entry(cachep, &cache_chain, next) {
                         struct array_cache *nc;
+                        struct array_cache *shared;
+                        struct array_cache **alien;
 
                         nc = alloc_arraycache(node, cachep->limit,
-                                              cachep->batchcount);
+                                                cachep->batchcount);
                         if (!nc)
                                 goto bad;
+                        shared = alloc_arraycache(node,
+                                        cachep->shared * cachep->batchcount,
+                                        0xbaadf00d);
+                        if (!shared)
+                                goto bad;
+
+                        alien = alloc_alien_cache(node, cachep->limit);
+                        if (!alien)
+                                goto bad;
                         cachep->array[cpu] = nc;
 
                         l3 = cachep->nodelists[node];
                         BUG_ON(!l3);
-                        if (!l3->shared) {
-                                if (!(nc = alloc_arraycache(node,
-                                                            cachep->shared *
-                                                            cachep->batchcount,
-                                                            0xbaadf00d)))
-                                        goto bad;
 
-                                /* we are serialised from CPU_DEAD or
-                                   CPU_UP_CANCELLED by the cpucontrol lock */
-                                l3->shared = nc;
+                        spin_lock_irq(&l3->list_lock);
+                        if (!l3->shared) {
+                                /*
+                                 * We are serialised from CPU_DEAD or
+                                 * CPU_UP_CANCELLED by the cpucontrol lock
+                                 */
+                                l3->shared = shared;
+                                shared = NULL;
                         }
+#ifdef CONFIG_NUMA
+                        if (!l3->alien) {
+                                l3->alien = alien;
+                                alien = NULL;
+                        }
+#endif
+                        spin_unlock_irq(&l3->list_lock);
+
+                        kfree(shared);
+                        free_alien_cache(alien);
                 }
                 mutex_unlock(&cache_chain_mutex);
                 break;
@@ -977,25 +1072,34 @@ static int __devinit cpuup_callback(struct notifier_block *nfb,
                 break;
 #ifdef CONFIG_HOTPLUG_CPU
         case CPU_DEAD:
+                /*
+                 * Even if all the cpus of a node are down, we don't free the
+                 * kmem_list3 of any cache. This to avoid a race between
+                 * cpu_down, and a kmalloc allocation from another cpu for
+                 * memory from the node of the cpu going down.  The list3
+                 * structure is usually allocated from kmem_cache_create() and
+                 * gets destroyed at kmem_cache_destroy().
+                 */
                 /* fall thru */
         case CPU_UP_CANCELED:
                 mutex_lock(&cache_chain_mutex);
 
                 list_for_each_entry(cachep, &cache_chain, next) {
                         struct array_cache *nc;
+                        struct array_cache *shared;
+                        struct array_cache **alien;
                         cpumask_t mask;
 
                         mask = node_to_cpumask(node);
-                        spin_lock_irq(&cachep->spinlock);
                         /* cpu is dead; no one can alloc from it. */
                         nc = cachep->array[cpu];
                         cachep->array[cpu] = NULL;
                         l3 = cachep->nodelists[node];
 
                         if (!l3)
-                                goto unlock_cache;
+                                goto free_array_cache;
 
-                        spin_lock(&l3->list_lock);
+                        spin_lock_irq(&l3->list_lock);
 
                         /* Free limit for this kmem_list3 */
                         l3->free_limit -= cachep->batchcount;
@@ -1003,34 +1107,44 @@ static int __devinit cpuup_callback(struct notifier_block *nfb,
                                 free_block(cachep, nc->entry, nc->avail, node);
 
                         if (!cpus_empty(mask)) {
-                                spin_unlock(&l3->list_lock);
-                                goto unlock_cache;
+                                spin_unlock_irq(&l3->list_lock);
+                                goto free_array_cache;
                         }
 
-                        if (l3->shared) {
+                        shared = l3->shared;
+                        if (shared) {
                                 free_block(cachep, l3->shared->entry,
                                            l3->shared->avail, node);
-                                kfree(l3->shared);
                                 l3->shared = NULL;
                         }
-                        if (l3->alien) {
-                                drain_alien_cache(cachep, l3);
-                                free_alien_cache(l3->alien);
-                                l3->alien = NULL;
-                        }
 
-                        /* free slabs belonging to this node */
-                        if (__node_shrink(cachep, node)) {
-                                cachep->nodelists[node] = NULL;
-                                spin_unlock(&l3->list_lock);
-                                kfree(l3);
-                        } else {
-                                spin_unlock(&l3->list_lock);
+                        alien = l3->alien;
+                        l3->alien = NULL;
+
+                        spin_unlock_irq(&l3->list_lock);
+
+                        kfree(shared);
+                        if (alien) {
+                                drain_alien_cache(cachep, alien);
+                                free_alien_cache(alien);
                         }
-                      unlock_cache:
-                        spin_unlock_irq(&cachep->spinlock);
+free_array_cache:
                         kfree(nc);
                 }
+                /*
+                 * In the previous loop, all the objects were freed to
+                 * the respective cache's slabs,  now we can go ahead and
+                 * shrink each nodelist to its limit.
+                 */
+                list_for_each_entry(cachep, &cache_chain, next) {
+                        l3 = cachep->nodelists[node];
+                        if (!l3)
+                                continue;
+                        spin_lock_irq(&l3->list_lock);
+                        /* free slabs belonging to this node */
+                        __node_shrink(cachep, node);
+                        spin_unlock_irq(&l3->list_lock);
+                }
                 mutex_unlock(&cache_chain_mutex);
                 break;
 #endif
@@ -1070,6 +1184,7 @@ void __init kmem_cache_init(void)
         struct cache_sizes *sizes;
         struct cache_names *names;
         int i;
+        int order;
 
         for (i = 0; i < NUM_INIT_LISTS; i++) {
                 kmem_list3_init(&initkmem_list3[i]);
@@ -1113,13 +1228,16 @@ void __init kmem_cache_init(void)
 
         cache_cache.buffer_size = ALIGN(cache_cache.buffer_size, cache_line_size());
 
-        cache_estimate(0, cache_cache.buffer_size, cache_line_size(), 0,
-                       &left_over, &cache_cache.num);
+        for (order = 0; order < MAX_ORDER; order++) {
+                cache_estimate(order, cache_cache.buffer_size,
+                        cache_line_size(), 0, &left_over, &cache_cache.num);
+                if (cache_cache.num)
+                        break;
+        }
         if (!cache_cache.num)
                 BUG();
-
+        cache_cache.gfporder = order;
         cache_cache.colour = left_over / cache_cache.colour_off;
-        cache_cache.colour_next = 0;
         cache_cache.slab_size = ALIGN(cache_cache.num * sizeof(kmem_bufctl_t) +
                                       sizeof(struct slab), cache_line_size());
 
@@ -1575,36 +1693,44 @@ static inline size_t calculate_slab_order(struct kmem_cache *cachep,
                         size_t size, size_t align, unsigned long flags)
 {
         size_t left_over = 0;
+        int gfporder;
 
-        for (;; cachep->gfporder++) {
+        for (gfporder = 0 ; gfporder <= MAX_GFP_ORDER; gfporder++) {
                 unsigned int num;
                 size_t remainder;
 
-                if (cachep->gfporder > MAX_GFP_ORDER) {
-                        cachep->num = 0;
-                        break;
-                }
-
-                cache_estimate(cachep->gfporder, size, align, flags,
-                               &remainder, &num);
+                cache_estimate(gfporder, size, align, flags, &remainder, &num);
                 if (!num)
                         continue;
+
                 /* More than offslab_limit objects will cause problems */
-                if (flags & CFLGS_OFF_SLAB && cachep->num > offslab_limit)
+                if ((flags & CFLGS_OFF_SLAB) && num > offslab_limit)
                         break;
 
+                /* Found something acceptable - save it away */
                 cachep->num = num;
+                cachep->gfporder = gfporder;
                 left_over = remainder;
 
                 /*
+                 * A VFS-reclaimable slab tends to have most allocations
+                 * as GFP_NOFS and we really don't want to have to be allocating
+                 * higher-order pages when we are unable to shrink dcache.
+                 */
+                if (flags & SLAB_RECLAIM_ACCOUNT)
+                        break;
+
+                /*
                  * Large number of objects is good, but very large slabs are
                  * currently bad for the gfp()s.
                  */
-                if (cachep->gfporder >= slab_break_gfp_order)
+                if (gfporder >= slab_break_gfp_order)
                         break;
 
-                if ((left_over * 8) <= (PAGE_SIZE << cachep->gfporder))
-                        /* Acceptable internal fragmentation */
+                /*
+                 * Acceptable internal fragmentation?
+                 */
+                if ((left_over * 8) <= (PAGE_SIZE << gfporder))
                         break;
         }
         return left_over;
@@ -1664,6 +1790,12 @@ kmem_cache_create (const char *name, size_t size, size_t align,
                 BUG();
         }
 
+        /*
+         * Prevent CPUs from coming and going.
+         * lock_cpu_hotplug() nests outside cache_chain_mutex
+         */
+        lock_cpu_hotplug();
+
         mutex_lock(&cache_chain_mutex);
 
         list_for_each(p, &cache_chain) {
@@ -1810,17 +1942,7 @@ kmem_cache_create (const char *name, size_t size, size_t align,
 
         size = ALIGN(size, align);
 
-        if ((flags & SLAB_RECLAIM_ACCOUNT) && size <= PAGE_SIZE) {
-                /*
-                 * A VFS-reclaimable slab tends to have most allocations
-                 * as GFP_NOFS and we really don't want to have to be allocating
-                 * higher-order pages when we are unable to shrink dcache.
-                 */
-                cachep->gfporder = 0;
-                cache_estimate(cachep->gfporder, size, align, flags,
-                               &left_over, &cachep->num);
-        } else
-                left_over = calculate_slab_order(cachep, size, align, flags);
+        left_over = calculate_slab_order(cachep, size, align, flags);
 
         if (!cachep->num) {
                 printk("kmem_cache_create: couldn't create cache %s.\n", name);
@@ -1865,8 +1987,6 @@ kmem_cache_create (const char *name, size_t size, size_t align,
         cachep->dtor = dtor;
         cachep->name = name;
 
-        /* Don't let CPUs to come and go */
-        lock_cpu_hotplug();
 
         if (g_cpucache_up == FULL) {
                 enable_cpucache(cachep);
@@ -1925,12 +2045,12 @@ kmem_cache_create (const char *name, size_t size, size_t align,
 
         /* cache setup completed, link it into the list */
         list_add(&cachep->next, &cache_chain);
-        unlock_cpu_hotplug();
       oops:
         if (!cachep && (flags & SLAB_PANIC))
                 panic("kmem_cache_create(): failed to create slab `%s'\n",
                       name);
         mutex_unlock(&cache_chain_mutex);
+        unlock_cpu_hotplug();
         return cachep;
 }
 EXPORT_SYMBOL(kmem_cache_create);
@@ -2011,18 +2131,16 @@ static void drain_cpu_caches(struct kmem_cache *cachep)
 
         smp_call_function_all_cpus(do_drain, cachep);
         check_irq_on();
-        spin_lock_irq(&cachep->spinlock);
         for_each_online_node(node) {
                 l3 = cachep->nodelists[node];
                 if (l3) {
-                        spin_lock(&l3->list_lock);
+                        spin_lock_irq(&l3->list_lock);
                         drain_array_locked(cachep, l3->shared, 1, node);
-                        spin_unlock(&l3->list_lock);
+                        spin_unlock_irq(&l3->list_lock);
                         if (l3->alien)
-                                drain_alien_cache(cachep, l3);
+                                drain_alien_cache(cachep, l3->alien);
                 }
         }
-        spin_unlock_irq(&cachep->spinlock);
 }
 
 static int __node_shrink(struct kmem_cache *cachep, int node)
@@ -2324,20 +2442,20 @@ static int cache_grow(struct kmem_cache *cachep, gfp_t flags, int nodeid)
                  */
                 ctor_flags |= SLAB_CTOR_ATOMIC;
 
-        /* About to mess with non-constant members - lock. */
+        /* Take the l3 list lock to change the colour_next on this node */
         check_irq_off();
-        spin_lock(&cachep->spinlock);
+        l3 = cachep->nodelists[nodeid];
+        spin_lock(&l3->list_lock);
 
         /* Get colour for the slab, and cal the next value. */
-        offset = cachep->colour_next;
-        cachep->colour_next++;
-        if (cachep->colour_next >= cachep->colour)
-                cachep->colour_next = 0;
-        offset *= cachep->colour_off;
+        offset = l3->colour_next;
+        l3->colour_next++;
+        if (l3->colour_next >= cachep->colour)
+                l3->colour_next = 0;
+        spin_unlock(&l3->list_lock);
 
-        spin_unlock(&cachep->spinlock);
+        offset *= cachep->colour_off;
 
-        check_irq_off();
         if (local_flags & __GFP_WAIT)
                 local_irq_enable();
 
@@ -2367,7 +2485,6 @@ static int cache_grow(struct kmem_cache *cachep, gfp_t flags, int nodeid)
         if (local_flags & __GFP_WAIT)
                 local_irq_disable();
         check_irq_off();
-        l3 = cachep->nodelists[nodeid];
         spin_lock(&l3->list_lock);
 
         /* Make slab active. */
@@ -2500,7 +2617,7 @@ static void check_slabp(struct kmem_cache *cachep, struct slab *slabp)
                        "slab: Internal list corruption detected in cache '%s'(%d), slabp %p(%d). Hexdump:\n",
                        cachep->name, cachep->num, slabp, slabp->inuse);
                 for (i = 0;
-                     i < sizeof(slabp) + cachep->num * sizeof(kmem_bufctl_t);
+                     i < sizeof(*slabp) + cachep->num * sizeof(kmem_bufctl_t);
                      i++) {
                         if ((i % 16) == 0)
                                 printk("\n%03x:", i);
@@ -2725,6 +2842,7 @@ static void *__cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int node
         BUG_ON(!l3);
 
       retry:
+        check_irq_off();
         spin_lock(&l3->list_lock);
         entry = l3->slabs_partial.next;
         if (entry == &l3->slabs_partial) {
@@ -3304,11 +3422,11 @@ static int do_tune_cpucache(struct kmem_cache *cachep, int limit, int batchcount
         smp_call_function_all_cpus(do_ccupdate_local, (void *)&new);
 
         check_irq_on();
-        spin_lock_irq(&cachep->spinlock);
+        spin_lock(&cachep->spinlock);
         cachep->batchcount = batchcount;
         cachep->limit = limit;
         cachep->shared = shared;
-        spin_unlock_irq(&cachep->spinlock);
+        spin_unlock(&cachep->spinlock);
 
         for_each_online_cpu(i) {
                 struct array_cache *ccold = new.new[i];
@@ -3439,8 +3557,7 @@ static void cache_reap(void *unused)
                 check_irq_on();
 
                 l3 = searchp->nodelists[numa_node_id()];
-                if (l3->alien)
-                        drain_alien_cache(searchp, l3);
+                reap_alien(searchp, l3);
                 spin_lock_irq(&l3->list_lock);
 
                 drain_array_locked(searchp, cpu_cache_get(searchp), 0,
@@ -3490,7 +3607,7 @@ static void cache_reap(void *unused)
         }
         check_irq_on();
         mutex_unlock(&cache_chain_mutex);
-        drain_remote_pages();
+        next_reap_node();
         /* Setup the next iteration */
         schedule_delayed_work(&__get_cpu_var(reap_work), REAPTIMEOUT_CPUC);
 }
@@ -3564,8 +3681,7 @@ static int s_show(struct seq_file *m, void *p)
         int node;
         struct kmem_list3 *l3;
 
-        check_irq_on();
-        spin_lock_irq(&cachep->spinlock);
+        spin_lock(&cachep->spinlock);
         active_objs = 0;
         num_slabs = 0;
         for_each_online_node(node) {
@@ -3573,7 +3689,8 @@ static int s_show(struct seq_file *m, void *p)
                 if (!l3)
                         continue;
 
-                spin_lock(&l3->list_lock);
+                check_irq_on();
+                spin_lock_irq(&l3->list_lock);
 
                 list_for_each(q, &l3->slabs_full) {
                         slabp = list_entry(q, struct slab, list);
@@ -3598,9 +3715,10 @@ static int s_show(struct seq_file *m, void *p)
                         num_slabs++;
                 }
                 free_objects += l3->free_objects;
-                shared_avail += l3->shared->avail;
+                if (l3->shared)
+                        shared_avail += l3->shared->avail;
 
-                spin_unlock(&l3->list_lock);
+                spin_unlock_irq(&l3->list_lock);
         }
         num_slabs += active_slabs;
         num_objs = num_slabs * cachep->num;
@@ -3644,7 +3762,7 @@ static int s_show(struct seq_file *m, void *p)
         }
 #endif
         seq_putc(m, '\n');
-        spin_unlock_irq(&cachep->spinlock);
+        spin_unlock(&cachep->spinlock);
         return 0;
 }
 
diff --git a/mm/slob.c b/mm/slob.c
index 1c240c4b71d9..a1f42bdc0245 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -336,7 +336,7 @@ EXPORT_SYMBOL(slab_reclaim_pages);
 
 #ifdef CONFIG_SMP
 
-void *__alloc_percpu(size_t size, size_t align)
+void *__alloc_percpu(size_t size)
 {
         int i;
         struct percpu_data *pdata = kmalloc(sizeof (*pdata), GFP_KERNEL);
diff --git a/mm/swap.c b/mm/swap.c
index bc2442a7b0ee..b524ea90bddb 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -34,19 +34,22 @@
 /* How many pages do we try to swap or page in/out together? */
 int page_cluster;
 
-void put_page(struct page *page)
+static void put_compound_page(struct page *page)
 {
-        if (unlikely(PageCompound(page))) {
-                page = (struct page *)page_private(page);
-                if (put_page_testzero(page)) {
-                        void (*dtor)(struct page *page);
+        page = (struct page *)page_private(page);
+        if (put_page_testzero(page)) {
+                void (*dtor)(struct page *page);
 
-                        dtor = (void (*)(struct page *))page[1].mapping;
-                        (*dtor)(page);
-                }
-                return;
+                dtor = (void (*)(struct page *))page[1].lru.next;
+                (*dtor)(page);
         }
-        if (put_page_testzero(page))
+}
+
+void put_page(struct page *page)
+{
+        if (unlikely(PageCompound(page)))
+                put_compound_page(page);
+        else if (put_page_testzero(page))
                 __page_cache_release(page);
 }
 EXPORT_SYMBOL(put_page);
@@ -244,6 +247,15 @@ void release_pages(struct page **pages, int nr, int cold)
                 struct page *page = pages[i];
                 struct zone *pagezone;
 
+                if (unlikely(PageCompound(page))) {
+                        if (zone) {
+                                spin_unlock_irq(&zone->lru_lock);
+                                zone = NULL;
+                        }
+                        put_compound_page(page);
+                        continue;
+                }
+
                 if (!put_page_testzero(page))
                         continue;
 
@@ -381,7 +393,8 @@ void pagevec_strip(struct pagevec *pvec)
                 struct page *page = pvec->pages[i];
 
                 if (PagePrivate(page) && !TestSetPageLocked(page)) {
-                        try_to_release_page(page, 0);
+                        if (PagePrivate(page))
+                                try_to_release_page(page, 0);
                         unlock_page(page);
                 }
         }
@@ -477,13 +490,34 @@ void percpu_counter_mod(struct percpu_counter *fbc, long amount)
         if (count >= FBC_BATCH || count <= -FBC_BATCH) {
                 spin_lock(&fbc->lock);
                 fbc->count += count;
+                *pcount = 0;
                 spin_unlock(&fbc->lock);
-                count = 0;
+        } else {
+                *pcount = count;
         }
-        *pcount = count;
         put_cpu();
 }
 EXPORT_SYMBOL(percpu_counter_mod);
+
+/*
+ * Add up all the per-cpu counts, return the result.  This is a more accurate
+ * but much slower version of percpu_counter_read_positive()
+ */
+long percpu_counter_sum(struct percpu_counter *fbc)
+{
+        long ret;
+        int cpu;
+
+        spin_lock(&fbc->lock);
+        ret = fbc->count;
+        for_each_cpu(cpu) {
+                long *pcount = per_cpu_ptr(fbc->counters, cpu);
+                ret += *pcount;
+        }
+        spin_unlock(&fbc->lock);
+        return ret < 0 ? 0 : ret;
+}
+EXPORT_SYMBOL(percpu_counter_sum);
 #endif
 
 /*
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 5a610804cd06..4fe7e3aa02e2 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -443,6 +443,10 @@ static int shrink_list(struct list_head *page_list, struct scan_control *sc)
                 BUG_ON(PageActive(page));
 
                 sc->nr_scanned++;
+
+                if (!sc->may_swap && page_mapped(page))
+                        goto keep_locked;
+
                 /* Double the slab pressure for mapped and swapcache pages */
                 if (page_mapped(page) || PageSwapCache(page))
                         sc->nr_scanned++;
@@ -632,7 +636,7 @@ static int swap_page(struct page *page)
         struct address_space *mapping = page_mapping(page);
 
         if (page_mapped(page) && mapping)
-                if (try_to_unmap(page, 0) != SWAP_SUCCESS)
+                if (try_to_unmap(page, 1) != SWAP_SUCCESS)
                         goto unlock_retry;
 
         if (PageDirty(page)) {
@@ -696,7 +700,7 @@ int migrate_page_remove_references(struct page *newpage,
          * the page.
          */
         if (!mapping || page_mapcount(page) + nr_refs != page_count(page))
-                return 1;
+                return -EAGAIN;
 
         /*
          * Establish swap ptes for anonymous pages or destroy pte
@@ -717,13 +721,15 @@ int migrate_page_remove_references(struct page *newpage,
          * If the page was not migrated then the PageSwapCache bit
          * is still set and the operation may continue.
          */
-        try_to_unmap(page, 1);
+        if (try_to_unmap(page, 1) == SWAP_FAIL)
+                /* A vma has VM_LOCKED set -> Permanent failure */
+                return -EPERM;
 
         /*
          * Give up if we were unable to remove all mappings.
          */
         if (page_mapcount(page))
-                return 1;
+                return -EAGAIN;
 
         write_lock_irq(&mapping->tree_lock);
 
@@ -734,7 +740,7 @@ int migrate_page_remove_references(struct page *newpage,
         if (!page_mapping(page) || page_count(page) != nr_refs ||
                         *radix_pointer != page) {
                 write_unlock_irq(&mapping->tree_lock);
-                return 1;
+                return -EAGAIN;
         }
 
         /*
@@ -809,10 +815,14 @@ EXPORT_SYMBOL(migrate_page_copy);
  */
 int migrate_page(struct page *newpage, struct page *page)
 {
+        int rc;
+
         BUG_ON(PageWriteback(page));    /* Writeback must be complete */
 
-        if (migrate_page_remove_references(newpage, page, 2))
-                return -EAGAIN;
+        rc = migrate_page_remove_references(newpage, page, 2);
+
+        if (rc)
+                return rc;
 
         migrate_page_copy(newpage, page);
 
@@ -839,7 +849,7 @@ EXPORT_SYMBOL(migrate_page);
  * pages are swapped out.
  *
  * The function returns after 10 attempts or if no pages
- * are movable anymore because t has become empty
+ * are movable anymore because to has become empty
  * or no retryable pages exist anymore.
  *
  * Return: Number of pages not migrated when "to" ran empty.
@@ -928,12 +938,21 @@ redo:
                         goto unlock_both;
 
                 if (mapping->a_ops->migratepage) {
+                        /*
+                         * Most pages have a mapping and most filesystems
+                         * should provide a migration function. Anonymous
+                         * pages are part of swap space which also has its
+                         * own migration function. This is the most common
+                         * path for page migration.
+                         */
                         rc = mapping->a_ops->migratepage(newpage, page);
                         goto unlock_both;
                 }
 
                 /*
-                 * Trigger writeout if page is dirty
+                 * Default handling if a filesystem does not provide
+                 * a migration function. We can only migrate clean
+                 * pages so try to write out any dirty pages first.
                  */
                 if (PageDirty(page)) {
                         switch (pageout(page, mapping)) {
@@ -949,9 +968,10 @@ redo:
                                 ; /* try to migrate the page below */
                         }
                 }
+
                 /*
-                 * If we have no buffer or can release the buffer
-                 * then do a simple migration.
+                 * Buffers are managed in a filesystem specific way.
+                 * We must have no buffers or drop them.
                  */
                 if (!page_has_buffers(page) ||
                     try_to_release_page(page, GFP_KERNEL)) {
@@ -966,6 +986,11 @@ redo:
                  * swap them out.
                  */
                 if (pass > 4) {
+                        /*
+                         * Persistently unable to drop buffers..... As a
+                         * measure of last resort we fall back to
+                         * swap_page().
+                         */
                         unlock_page(newpage);
                         newpage = NULL;
                         rc = swap_page(page);
@@ -1176,9 +1201,47 @@ refill_inactive_zone(struct zone *zone, struct scan_control *sc)
         struct page *page;
         struct pagevec pvec;
         int reclaim_mapped = 0;
-        long mapped_ratio;
-        long distress;
-        long swap_tendency;
+
+        if (unlikely(sc->may_swap)) {
+                long mapped_ratio;
+                long distress;
+                long swap_tendency;
+
+                /*
+                 * `distress' is a measure of how much trouble we're having
+                 * reclaiming pages.  0 -> no problems.  100 -> great trouble.
+                 */
+                distress = 100 >> zone->prev_priority;
+
+                /*
+                 * The point of this algorithm is to decide when to start
+                 * reclaiming mapped memory instead of just pagecache.  Work out
+                 * how much memory
+                 * is mapped.
+                 */
+                mapped_ratio = (sc->nr_mapped * 100) / total_memory;
+
+                /*
+                 * Now decide how much we really want to unmap some pages.  The
+                 * mapped ratio is downgraded - just because there's a lot of
+                 * mapped memory doesn't necessarily mean that page reclaim
+                 * isn't succeeding.
+                 *
+                 * The distress ratio is important - we don't want to start
+                 * going oom.
+                 *
+                 * A 100% value of vm_swappiness overrides this algorithm
+                 * altogether.
+                 */
+                swap_tendency = mapped_ratio / 2 + distress + vm_swappiness;
+
+                /*
+                 * Now use this metric to decide whether to start moving mapped
+                 * memory onto the inactive list.
+                 */
+                if (swap_tendency >= 100)
+                        reclaim_mapped = 1;
+        }
 
         lru_add_drain();
         spin_lock_irq(&zone->lru_lock);
@@ -1188,37 +1251,6 @@ refill_inactive_zone(struct zone *zone, struct scan_control *sc)
         zone->nr_active -= pgmoved;
         spin_unlock_irq(&zone->lru_lock);
 
-        /*
-         * `distress' is a measure of how much trouble we're having reclaiming
-         * pages.  0 -> no problems.  100 -> great trouble.
-         */
-        distress = 100 >> zone->prev_priority;
-
-        /*
-         * The point of this algorithm is to decide when to start reclaiming
-         * mapped memory instead of just pagecache.  Work out how much memory
-         * is mapped.
-         */
-        mapped_ratio = (sc->nr_mapped * 100) / total_memory;
-
-        /*
-         * Now decide how much we really want to unmap some pages.  The mapped
-         * ratio is downgraded - just because there's a lot of mapped memory
-         * doesn't necessarily mean that page reclaim isn't succeeding.
-         *
-         * The distress ratio is important - we don't want to start going oom.
-         *
-         * A 100% value of vm_swappiness overrides this algorithm altogether.
-         */
-        swap_tendency = mapped_ratio / 2 + distress + vm_swappiness;
-
-        /*
-         * Now use this metric to decide whether to start moving mapped memory
-         * onto the inactive list.
-         */
-        if (swap_tendency >= 100)
-                reclaim_mapped = 1;
-
         while (!list_empty(&l_hold)) {
                 cond_resched();
                 page = lru_to_page(&l_hold);
@@ -1595,9 +1627,7 @@ scan:
                         sc.nr_reclaimed = 0;
                         sc.priority = priority;
                         sc.swap_cluster_max = nr_pages? nr_pages : SWAP_CLUSTER_MAX;
-                        atomic_inc(&zone->reclaim_in_progress);
                         shrink_zone(zone, &sc);
-                        atomic_dec(&zone->reclaim_in_progress);
                         reclaim_state->reclaimed_slab = 0;
                         nr_slab = shrink_slab(sc.nr_scanned, GFP_KERNEL,
                                                 lru_pages);
@@ -1859,7 +1889,8 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
 
         if (!(gfp_mask & __GFP_WAIT) ||
                 zone->all_unreclaimable ||
-                atomic_read(&zone->reclaim_in_progress) > 0)
+                atomic_read(&zone->reclaim_in_progress) > 0 ||
+                (p->flags & PF_MEMALLOC))
                         return 0;
 
         node_id = zone->zone_pgdat->node_id;
@@ -1884,7 +1915,12 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                 sc.swap_cluster_max = SWAP_CLUSTER_MAX;
 
         cond_resched();
-        p->flags |= PF_MEMALLOC;
+        /*
+         * We need to be able to allocate from the reserves for RECLAIM_SWAP
+         * and we also need to be able to write out pages for RECLAIM_WRITE
+         * and RECLAIM_SWAP.
+         */
+        p->flags |= PF_MEMALLOC | PF_SWAPWRITE;
         reclaim_state.reclaimed_slab = 0;
         p->reclaim_state = &reclaim_state;
 
@@ -1908,11 +1944,10 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                  * a long time.
                  */
                 shrink_slab(sc.nr_scanned, gfp_mask, order);
-                sc.nr_reclaimed = 1;    /* Avoid getting the off node timeout */
         }
 
         p->reclaim_state = NULL;
-        current->flags &= ~PF_MEMALLOC;
+        current->flags &= ~(PF_MEMALLOC | PF_SWAPWRITE);
 
         if (sc.nr_reclaimed == 0)
                 zone->last_unsuccessful_zone_reclaim = jiffies;
diff --git a/net/802/p8023.c b/net/802/p8023.c
index d23e906456eb..53cf05709283 100644
--- a/net/802/p8023.c
+++ b/net/802/p8023.c
@@ -59,3 +59,5 @@ void destroy_8023_client(struct datalink_proto *dl)
 
 EXPORT_SYMBOL(destroy_8023_client);
 EXPORT_SYMBOL(make_8023_client);
+
+MODULE_LICENSE("GPL");
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index e7211a7f382c..31d98b57e1de 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -39,24 +39,19 @@ static DECLARE_WAIT_QUEUE_HEAD(sigd_sleep);
 static void sigd_put_skb(struct sk_buff *skb)
 {
 #ifdef WAIT_FOR_DEMON
-        static unsigned long silence;
         DECLARE_WAITQUEUE(wait,current);
 
         add_wait_queue(&sigd_sleep,&wait);
         while (!sigd) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
-                if (time_after(jiffies, silence) || silence == 0) {
-                        printk(KERN_INFO "atmsvc: waiting for signaling demon "
-                            "...\n");
-                        silence = (jiffies+30*HZ)|1;
-                }
+                DPRINTK("atmsvc: waiting for signaling demon...\n");
                 schedule();
         }
         current->state = TASK_RUNNING;
         remove_wait_queue(&sigd_sleep,&wait);
 #else
         if (!sigd) {
-                printk(KERN_WARNING "atmsvc: no signaling demon\n");
+                DPRINTK("atmsvc: no signaling demon\n");
                 kfree_skb(skb);
                 return;
         }
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index f67711f2ee96..894a22558d9d 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -24,7 +24,7 @@ static int min_t3[1],   		max_t3[] = {3600 * HZ};
 static int min_idle[1],                 max_idle[] = {65535 * HZ};
 static int min_n2[] = {1},              max_n2[] = {31};
 static int min_paclen[] = {1},          max_paclen[] = {512};
-static int min_proto[1],                max_proto[] = {3};
+static int min_proto[1],                max_proto[] = { AX25_PROTO_MAX };
 static int min_ds_timeout[1],           max_ds_timeout[] = {65535 * HZ};
 
 static struct ctl_table_header *ax25_table_header;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index bdb6458c6bd5..97bdec73d17e 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -143,13 +143,15 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 static int hci_sock_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
-        struct hci_dev *hdev = hci_pi(sk)->hdev;
+        struct hci_dev *hdev;
 
         BT_DBG("sock %p sk %p", sock, sk);
 
         if (!sk)
                 return 0;
 
+        hdev = hci_pi(sk)->hdev;
+
         bt_sock_unlink(&hci_sk_list, sk);
 
         if (hdev) {
@@ -311,14 +313,18 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *add
 {
         struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
         struct sock *sk = sock->sk;
+        struct hci_dev *hdev = hci_pi(sk)->hdev;
 
         BT_DBG("sock %p sk %p", sock, sk);
 
+        if (!hdev)
+                return -EBADFD;
+
         lock_sock(sk);
 
         *addr_len = sizeof(*haddr);
         haddr->hci_family = AF_BLUETOOTH;
-        haddr->hci_dev    = hci_pi(sk)->hdev->id;
+        haddr->hci_dev    = hdev->id;
 
         release_sock(sk);
         return 0;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 0d89d6434136..5b4253c61f62 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -46,13 +46,15 @@
 #include <net/bluetooth/l2cap.h>
 #include <net/bluetooth/rfcomm.h>
 
-#define VERSION "1.6"
-
 #ifndef CONFIG_BT_RFCOMM_DEBUG
 #undef  BT_DBG
 #define BT_DBG(D...)
 #endif
 
+#define VERSION "1.7"
+
+static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
+
 static struct task_struct *rfcomm_thread;
 
 static DECLARE_MUTEX(rfcomm_sem);
@@ -623,7 +625,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         /* Set L2CAP options */
         sk = sock->sk;
         lock_sock(sk);
-        l2cap_pi(sk)->imtu = RFCOMM_MAX_L2CAP_MTU;
+        l2cap_pi(sk)->imtu = l2cap_mtu;
         release_sock(sk);
 
         s = rfcomm_session_add(sock, BT_BOUND);
@@ -1868,7 +1870,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         /* Set L2CAP options */
         sk = sock->sk;
         lock_sock(sk);
-        l2cap_pi(sk)->imtu = RFCOMM_MAX_L2CAP_MTU;
+        l2cap_pi(sk)->imtu = l2cap_mtu;
         release_sock(sk);
 
         /* Start listening on the socket */
@@ -2070,6 +2072,9 @@ static void __exit rfcomm_exit(void)
 module_init(rfcomm_init);
 module_exit(rfcomm_exit);
 
+module_param(l2cap_mtu, uint, 0644);
+MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
+
 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
 MODULE_VERSION(VERSION);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index da687c8dc6ff..f36b35edd60c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -79,37 +79,57 @@ static int port_cost(struct net_device *dev)
  */
 static void port_carrier_check(void *arg)
 {
-        struct net_bridge_port *p = arg;
+        struct net_device *dev = arg;
+        struct net_bridge_port *p;
+        struct net_bridge *br;
 
         rtnl_lock();
-        if (netif_carrier_ok(p->dev)) {
-                u32 cost = port_cost(p->dev);
+        p = dev->br_port;
+        if (!p)
+                goto done;
+        br = p->br;
 
-                spin_lock_bh(&p->br->lock);
-                if (p->state == BR_STATE_DISABLED) {
-                        p->path_cost = cost;
-                        br_stp_enable_port(p);
+        if (netif_carrier_ok(dev))
+                p->path_cost = port_cost(dev);
+
+        if (br->dev->flags & IFF_UP) {
+                spin_lock_bh(&br->lock);
+                if (netif_carrier_ok(dev)) {
+                        if (p->state == BR_STATE_DISABLED)
+                                br_stp_enable_port(p);
+                } else {
+                        if (p->state != BR_STATE_DISABLED)
+                                br_stp_disable_port(p);
                 }
-                spin_unlock_bh(&p->br->lock);
-        } else {
-                spin_lock_bh(&p->br->lock);
-                if (p->state != BR_STATE_DISABLED)
-                        br_stp_disable_port(p);
-                spin_unlock_bh(&p->br->lock);
+                spin_unlock_bh(&br->lock);
         }
+done:
         rtnl_unlock();
 }
 
+static void release_nbp(struct kobject *kobj)
+{
+        struct net_bridge_port *p
+                = container_of(kobj, struct net_bridge_port, kobj);
+        kfree(p);
+}
+
+static struct kobj_type brport_ktype = {
+#ifdef CONFIG_SYSFS
+        .sysfs_ops = &brport_sysfs_ops,
+#endif
+        .release = release_nbp,
+};
+
 static void destroy_nbp(struct net_bridge_port *p)
 {
         struct net_device *dev = p->dev;
 
-        dev->br_port = NULL;
         p->br = NULL;
         p->dev = NULL;
         dev_put(dev);
 
-        br_sysfs_freeif(p);
+        kobject_put(&p->kobj);
 }
 
 static void destroy_nbp_rcu(struct rcu_head *head)
@@ -133,24 +153,25 @@ static void del_nbp(struct net_bridge_port *p)
         struct net_bridge *br = p->br;
         struct net_device *dev = p->dev;
 
-        /* Race between RTNL notify and RCU callback */
-        if (p->deleted)
-                return;
+        sysfs_remove_link(&br->ifobj, dev->name);
 
         dev_set_promiscuity(dev, -1);
 
         cancel_delayed_work(&p->carrier_check);
-        flush_scheduled_work();
 
         spin_lock_bh(&br->lock);
         br_stp_disable_port(p);
-        p->deleted = 1;
         spin_unlock_bh(&br->lock);
 
         br_fdb_delete_by_port(br, p);
 
         list_del_rcu(&p->list);
 
+        rcu_assign_pointer(dev->br_port, NULL);
+
+        kobject_uevent(&p->kobj, KOBJ_REMOVE);
+        kobject_del(&p->kobj);
+
         call_rcu(&p->rcu, destroy_nbp_rcu);
 }
 
@@ -160,7 +181,6 @@ static void del_br(struct net_bridge *br)
         struct net_bridge_port *p, *n;
 
         list_for_each_entry_safe(p, n, &br->port_list, list) {
-                br_sysfs_removeif(p);
                 del_nbp(p);
         }
 
@@ -254,12 +274,17 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         p->dev = dev;
         p->path_cost = port_cost(dev);
         p->priority = 0x8000 >> BR_PORT_BITS;
-        dev->br_port = p;
         p->port_no = index;
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
-        INIT_WORK(&p->carrier_check, port_carrier_check, p);
+        INIT_WORK(&p->carrier_check, port_carrier_check, dev);
+        br_stp_port_timer_init(p);
+
         kobject_init(&p->kobj);
+        kobject_set_name(&p->kobj, SYSFS_BRIDGE_PORT_ATTR);
+        p->kobj.ktype = &brport_ktype;
+        p->kobj.parent = &(dev->class_dev.kobj);
+        p->kobj.kset = NULL;
 
         return p;
 }
@@ -388,30 +413,43 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         if (dev->br_port != NULL)
                 return -EBUSY;
 
-        if (IS_ERR(p = new_nbp(br, dev)))
+        p = new_nbp(br, dev);
+        if (IS_ERR(p))
                 return PTR_ERR(p);
 
-        if ((err = br_fdb_insert(br, p, dev->dev_addr)))
-                destroy_nbp(p);
- 
-        else if ((err = br_sysfs_addif(p)))
-                del_nbp(p);
-        else {
-                dev_set_promiscuity(dev, 1);
+        err = kobject_add(&p->kobj);
+        if (err)
+                goto err0;
 
-                list_add_rcu(&p->list, &br->port_list);
+        err = br_fdb_insert(br, p, dev->dev_addr);
+        if (err)
+                goto err1;
 
-                spin_lock_bh(&br->lock);
-                br_stp_recalculate_bridge_id(br);
-                br_features_recompute(br);
-                if ((br->dev->flags & IFF_UP) 
-                    && (dev->flags & IFF_UP) && netif_carrier_ok(dev))
-                        br_stp_enable_port(p);
-                spin_unlock_bh(&br->lock);
+        err = br_sysfs_addif(p);
+        if (err)
+                goto err2;
 
-                dev_set_mtu(br->dev, br_min_mtu(br));
-        }
+        rcu_assign_pointer(dev->br_port, p);
+        dev_set_promiscuity(dev, 1);
 
+        list_add_rcu(&p->list, &br->port_list);
+
+        spin_lock_bh(&br->lock);
+        br_stp_recalculate_bridge_id(br);
+        br_features_recompute(br);
+        schedule_delayed_work(&p->carrier_check, BR_PORT_DEBOUNCE);
+        spin_unlock_bh(&br->lock);
+
+        dev_set_mtu(br->dev, br_min_mtu(br));
+        kobject_uevent(&p->kobj, KOBJ_ADD);
+
+        return 0;
+err2:
+        br_fdb_delete_by_port(br, p);
+err1:
+        kobject_del(&p->kobj);
+err0:
+        kobject_put(&p->kobj);
         return err;
 }
 
@@ -423,7 +461,6 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         if (!p || p->br != br) 
                 return -EINVAL;
 
-        br_sysfs_removeif(p);
         del_nbp(p);
 
         spin_lock_bh(&br->lock);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index e3a73cead6b6..4eef83755315 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -45,18 +45,20 @@ static void br_pass_frame_up(struct net_bridge *br, struct sk_buff *skb)
 int br_handle_frame_finish(struct sk_buff *skb)
 {
         const unsigned char *dest = eth_hdr(skb)->h_dest;
-        struct net_bridge_port *p = skb->dev->br_port;
-        struct net_bridge *br = p->br;
+        struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
+        struct net_bridge *br;
         struct net_bridge_fdb_entry *dst;
         int passedup = 0;
 
+        if (!p || p->state == BR_STATE_DISABLED)
+                goto drop;
+
         /* insert into forwarding database after filtering to avoid spoofing */
-        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+        br = p->br;
+        br_fdb_update(br, p, eth_hdr(skb)->h_source);
 
-        if (p->state == BR_STATE_LEARNING) {
-                kfree_skb(skb);
-                goto out;
-        }
+        if (p->state == BR_STATE_LEARNING)
+                goto drop;
 
         if (br->dev->flags & IFF_PROMISC) {
                 struct sk_buff *skb2;
@@ -93,6 +95,9 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
 out:
         return 0;
+drop:
+        kfree_skb(skb);
+        goto out;
 }
 
 /*
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 7cac3fb9f809..e060aad8624d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -51,9 +51,6 @@
 #define store_orig_dstaddr(skb)  (skb_origaddr(skb) = (skb)->nh.iph->daddr)
 #define dnat_took_place(skb)     (skb_origaddr(skb) != (skb)->nh.iph->daddr)
 
-#define has_bridge_parent(device)       ((device)->br_port != NULL)
-#define bridge_parent(device)           ((device)->br_port->br->dev)
-
 #ifdef CONFIG_SYSCTL
 static struct ctl_table_header *brnf_sysctl_header;
 static int brnf_call_iptables = 1;
@@ -93,11 +90,18 @@ static struct rtable __fake_rtable = {
                         .dev                    = &__fake_net_device,
                         .path                   = &__fake_rtable.u.dst,
                         .metrics                = {[RTAX_MTU - 1] = 1500},
+                        .flags                  = DST_NOXFRM,
                 }
         },
         .rt_flags       = 0,
 };
 
+static inline struct net_device *bridge_parent(const struct net_device *dev)
+{
+        struct net_bridge_port *port = rcu_dereference(dev->br_port);
+
+        return port ? port->br->dev : NULL;
+}
 
 /* PF_BRIDGE/PRE_ROUTING *********************************************/
 /* Undo the changes made for ip6tables PREROUTING and continue the
@@ -189,11 +193,15 @@ static int br_nf_pre_routing_finish_bridge(struct sk_buff *skb)
         skb->nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
 
         skb->dev = bridge_parent(skb->dev);
-        if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
-                skb_pull(skb, VLAN_HLEN);
-                skb->nh.raw += VLAN_HLEN;
+        if (!skb->dev)
+                kfree_skb(skb);
+        else {
+                if (skb->protocol == __constant_htons(ETH_P_8021Q)) {
+                        skb_pull(skb, VLAN_HLEN);
+                        skb->nh.raw += VLAN_HLEN;
+                }
+                skb->dst->output(skb);
         }
-        skb->dst->output(skb);
         return 0;
 }
 
@@ -270,7 +278,7 @@ bridged_dnat:
 }
 
 /* Some common code for IPv4/IPv6 */
-static void setup_pre_routing(struct sk_buff *skb)
+static struct net_device *setup_pre_routing(struct sk_buff *skb)
 {
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
 
@@ -282,6 +290,8 @@ static void setup_pre_routing(struct sk_buff *skb)
         nf_bridge->mask |= BRNF_NF_BRIDGE_PREROUTING;
         nf_bridge->physindev = skb->dev;
         skb->dev = bridge_parent(skb->dev);
+
+        return skb->dev;
 }
 
 /* We only check the length. A bridge shouldn't do any hop-by-hop stuff anyway */
@@ -376,7 +386,8 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
         nf_bridge_put(skb->nf_bridge);
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
-        setup_pre_routing(skb);
+        if (!setup_pre_routing(skb))
+                return NF_DROP;
 
         NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
                 br_nf_pre_routing_finish_ipv6);
@@ -465,7 +476,8 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
         nf_bridge_put(skb->nf_bridge);
         if ((nf_bridge = nf_bridge_alloc(skb)) == NULL)
                 return NF_DROP;
-        setup_pre_routing(skb);
+        if (!setup_pre_routing(skb))
+                return NF_DROP;
         store_orig_dstaddr(skb);
 
         NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
@@ -539,11 +551,16 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
         struct sk_buff *skb = *pskb;
         struct nf_bridge_info *nf_bridge;
         struct vlan_ethhdr *hdr = vlan_eth_hdr(skb);
+        struct net_device *parent;
         int pf;
 
         if (!skb->nf_bridge)
                 return NF_ACCEPT;
 
+        parent = bridge_parent(out);
+        if (!parent)
+                return NF_DROP;
+
         if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
                 pf = PF_INET;
         else
@@ -564,8 +581,8 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff **pskb,
         nf_bridge->mask |= BRNF_BRIDGED;
         nf_bridge->physoutdev = skb->dev;
 
-        NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in),
-                bridge_parent(out), br_nf_forward_finish);
+        NF_HOOK(pf, NF_IP_FORWARD, skb, bridge_parent(in), parent,
+                br_nf_forward_finish);
 
         return NF_STOLEN;
 }
@@ -688,6 +705,8 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
                 goto out;
         }
         realoutdev = bridge_parent(skb->dev);
+        if (!realoutdev)
+                return NF_DROP;
 
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
         /* iptables should match -o br0.x */
@@ -701,9 +720,11 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff **pskb,
         /* IP forwarded traffic has a physindev, locally
          * generated traffic hasn't. */
         if (realindev != NULL) {
-                if (!(nf_bridge->mask & BRNF_DONT_TAKE_PARENT) &&
-                    has_bridge_parent(realindev))
-                        realindev = bridge_parent(realindev);
+                if (!(nf_bridge->mask & BRNF_DONT_TAKE_PARENT) ) {
+                        struct net_device *parent = bridge_parent(realindev);
+                        if (parent)
+                                realindev = parent;
+                }
 
                 NF_HOOK_THRESH(pf, NF_IP_FORWARD, skb, realindev,
                                realoutdev, br_nf_local_out_finish,
@@ -743,6 +764,9 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
         if (!nf_bridge)
                 return NF_ACCEPT;
 
+        if (!realoutdev)
+                return NF_DROP;
+
         if (skb->protocol == __constant_htons(ETH_P_IP) || IS_VLAN_IP)
                 pf = PF_INET;
         else
@@ -782,8 +806,8 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
 print_error:
         if (skb->dev != NULL) {
                 printk("[%s]", skb->dev->name);
-                if (has_bridge_parent(skb->dev))
-                        printk("[%s]", bridge_parent(skb->dev)->name);
+                if (realoutdev)
+                        printk("[%s]", realoutdev->name);
         }
         printk(" head:%p, raw:%p, data:%p\n", skb->head, skb->mac.raw,
                                               skb->data);
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index e330b17b6d81..8f10e09f251b 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -68,7 +68,6 @@ struct net_bridge_port
         /* STP */
         u8                              priority;
         u8                              state;
-        u8                              deleted;
         u16                             port_no;
         unsigned char                   topology_change_ack;
         unsigned char                   config_pending;
@@ -233,9 +232,8 @@ extern void (*br_fdb_put_hook)(struct net_bridge_fdb_entry *ent);
 
 #ifdef CONFIG_SYSFS
 /* br_sysfs_if.c */
+extern struct sysfs_ops brport_sysfs_ops;
 extern int br_sysfs_addif(struct net_bridge_port *p);
-extern void br_sysfs_removeif(struct net_bridge_port *p);
-extern void br_sysfs_freeif(struct net_bridge_port *p);
 
 /* br_sysfs_br.c */
 extern int br_sysfs_addbr(struct net_device *dev);
@@ -244,8 +242,6 @@ extern void br_sysfs_delbr(struct net_device *dev);
 #else
 
 #define br_sysfs_addif(p)       (0)
-#define br_sysfs_removeif(p)    do { } while(0)
-#define br_sysfs_freeif(p)      kfree(p)
 #define br_sysfs_addbr(dev)     (0)
 #define br_sysfs_delbr(dev)     do { } while(0)
 #endif /* CONFIG_SYSFS */
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index d071f1c9ad0b..296f6a487c52 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -133,29 +133,35 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
 
 static const unsigned char header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
 
-/* NO locks */
+/* NO locks, but rcu_read_lock (preempt_disabled)  */
 int br_stp_handle_bpdu(struct sk_buff *skb)
 {
-        struct net_bridge_port *p = skb->dev->br_port;
-        struct net_bridge *br = p->br;
+        struct net_bridge_port *p = rcu_dereference(skb->dev->br_port);
+        struct net_bridge *br;
         unsigned char *buf;
 
+        if (!p)
+                goto err;
+
+        br = p->br;
+        spin_lock(&br->lock);
+
+        if (p->state == BR_STATE_DISABLED || !(br->dev->flags & IFF_UP))
+                goto out;
+
         /* insert into forwarding database after filtering to avoid spoofing */
-        br_fdb_update(p->br, p, eth_hdr(skb)->h_source);
+        br_fdb_update(br, p, eth_hdr(skb)->h_source);
+
+        if (!br->stp_enabled)
+                goto out;
 
         /* need at least the 802 and STP headers */
         if (!pskb_may_pull(skb, sizeof(header)+1) ||
             memcmp(skb->data, header, sizeof(header)))
-                goto err;
+                goto out;
 
         buf = skb_pull(skb, sizeof(header));
 
-        spin_lock_bh(&br->lock);
-        if (p->state == BR_STATE_DISABLED 
-            || !(br->dev->flags & IFF_UP)
-            || !br->stp_enabled)
-                goto out;
-
         if (buf[0] == BPDU_TYPE_CONFIG) {
                 struct br_config_bpdu bpdu;
 
@@ -201,7 +207,7 @@ int br_stp_handle_bpdu(struct sk_buff *skb)
                 br_received_tcn_bpdu(p);
         }
  out:
-        spin_unlock_bh(&br->lock);
+        spin_unlock(&br->lock);
  err:
         kfree_skb(skb);
         return 0;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index cc047f7fb6ef..23dea1422c9a 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -39,8 +39,6 @@ void br_init_port(struct net_bridge_port *p)
         p->state = BR_STATE_BLOCKING;
         p->topology_change_ack = 0;
         p->config_pending = 0;
-
-        br_stp_port_timer_init(p);
 }
 
 /* called under bridge lock */
@@ -67,7 +65,7 @@ void br_stp_disable_bridge(struct net_bridge *br)
 {
         struct net_bridge_port *p;
 
-        spin_lock(&br->lock);
+        spin_lock_bh(&br->lock);
         list_for_each_entry(p, &br->port_list, list) {
                 if (p->state != BR_STATE_DISABLED)
                         br_stp_disable_port(p);
@@ -76,7 +74,7 @@ void br_stp_disable_bridge(struct net_bridge *br)
 
         br->topology_change = 0;
         br->topology_change_detected = 0;
-        spin_unlock(&br->lock);
+        spin_unlock_bh(&br->lock);
 
         del_timer_sync(&br->hello_timer);
         del_timer_sync(&br->topology_change_timer);
diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
index 0ac0355d16dd..c51c9e42aeb3 100644
--- a/net/bridge/br_sysfs_if.c
+++ b/net/bridge/br_sysfs_if.c
@@ -195,23 +195,11 @@ static ssize_t brport_store(struct kobject * kobj,
         return ret;
 }
 
-/* called from kobject_put when port ref count goes to zero. */
-static void brport_release(struct kobject *kobj)
-{
-        kfree(container_of(kobj, struct net_bridge_port, kobj));
-}
-
-static struct sysfs_ops brport_sysfs_ops = {
+struct sysfs_ops brport_sysfs_ops = {
         .show = brport_show,
         .store = brport_store,
 };
 
-static struct kobj_type brport_ktype = {
-        .sysfs_ops = &brport_sysfs_ops,
-        .release = brport_release,
-};
-
-
 /*
  * Add sysfs entries to ethernet device added to a bridge.
  * Creates a brport subdirectory with bridge attributes.
@@ -223,17 +211,6 @@ int br_sysfs_addif(struct net_bridge_port *p)
         struct brport_attribute **a;
         int err;
 
-        ASSERT_RTNL();
-
-        kobject_set_name(&p->kobj, SYSFS_BRIDGE_PORT_ATTR);
-        p->kobj.ktype = &brport_ktype;
-        p->kobj.parent = &(p->dev->class_dev.kobj);
-        p->kobj.kset = NULL;
-
-        err = kobject_add(&p->kobj);
-        if(err)
-                goto out1;
-
         err = sysfs_create_link(&p->kobj, &br->dev->class_dev.kobj, 
                                 SYSFS_BRIDGE_PORT_LINK);
         if (err)
@@ -245,28 +222,7 @@ int br_sysfs_addif(struct net_bridge_port *p)
                         goto out2;
         }
 
-        err = sysfs_create_link(&br->ifobj, &p->kobj, p->dev->name);
-        if (err)
-                goto out2;
-
-        kobject_uevent(&p->kobj, KOBJ_ADD);
-        return 0;
- out2:
-        kobject_del(&p->kobj);
- out1:
+        err= sysfs_create_link(&br->ifobj, &p->kobj, p->dev->name);
+out2:
         return err;
 }
-
-void br_sysfs_removeif(struct net_bridge_port *p)
-{
-        pr_debug("br_sysfs_removeif\n");
-        sysfs_remove_link(&p->br->ifobj, p->dev->name);
-        kobject_uevent(&p->kobj, KOBJ_REMOVE);
-        kobject_del(&p->kobj);
-}
-
-void br_sysfs_freeif(struct net_bridge_port *p)
-{
-        pr_debug("br_sysfs_freeif\n");
-        kobject_put(&p->kobj);
-}
diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
index 8bf6d9f6e9d3..905087e0d485 100644
--- a/net/bridge/netfilter/Makefile
+++ b/net/bridge/netfilter/Makefile
@@ -29,4 +29,4 @@ obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 
 # watchers
 obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
-obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_ulog.o
+obj-$(CONFIG_BRIDGE_EBT_ULOG) += ebt_ulog.o
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 0128fbbe2328..288ff1d4ccc4 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -166,7 +166,12 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
         li.u.log.level = info->loglevel;
         li.u.log.logflags = info->bitmask;
 
-        nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li, info->prefix);
+        if (info->bitmask & EBT_LOG_NFLOG)
+                nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
+                              info->prefix);
+        else
+                ebt_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li,
+                               info->prefix);
 }
 
 static struct ebt_watcher log =
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index ce617b3dbbb8..802baf755ef4 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -46,7 +46,7 @@
 #define PRINTR(format, args...) do { if (net_ratelimit()) \
                                 printk(format , ## args); } while (0)
 
-static unsigned int nlbufsiz = 4096;
+static unsigned int nlbufsiz = NLMSG_GOODSIZE;
 module_param(nlbufsiz, uint, 0600);
 MODULE_PARM_DESC(nlbufsiz, "netlink buffer size (number of bytes) "
                            "(defaults to 4096)");
@@ -98,12 +98,14 @@ static void ulog_timer(unsigned long data)
 static struct sk_buff *ulog_alloc_skb(unsigned int size)
 {
         struct sk_buff *skb;
+        unsigned int n;
 
-        skb = alloc_skb(nlbufsiz, GFP_ATOMIC);
+        n = max(size, nlbufsiz);
+        skb = alloc_skb(n, GFP_ATOMIC);
         if (!skb) {
                 PRINTR(KERN_ERR "ebt_ulog: can't alloc whole buffer "
-                       "of size %ub!\n", nlbufsiz);
-                if (size < nlbufsiz) {
+                       "of size %ub!\n", n);
+                if (n > size) {
                         /* try to allocate only as much as we need for
                          * current packet */
                         skb = alloc_skb(size, GFP_ATOMIC);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 00729b3604f8..cbd4020cc84d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -934,6 +934,13 @@ static int do_replace(void __user *user, unsigned int len)
                 BUGPRINT("Entries_size never zero\n");
                 return -EINVAL;
         }
+        /* overflow check */
+        if (tmp.nentries >= ((INT_MAX - sizeof(struct ebt_table_info)) / NR_CPUS -
+                        SMP_CACHE_BYTES) / sizeof(struct ebt_counter))
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
+                return -ENOMEM;
+
         countersize = COUNTER_OFFSET(tmp.nentries) * 
                                         (highest_possible_processor_id()+1);
         newinfo = (struct ebt_table_info *)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index f8d322e1ea92..b8ce6bf81188 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -247,49 +247,74 @@ EXPORT_SYMBOL(skb_kill_datagram);
 int skb_copy_datagram_iovec(const struct sk_buff *skb, int offset,
                             struct iovec *to, int len)
 {
-        int i, err, fraglen, end = 0;
-        struct sk_buff *next = skb_shinfo(skb)->frag_list;
+        int start = skb_headlen(skb);
+        int i, copy = start - offset;
 
-        if (!len)
-                return 0;
+        /* Copy header. */
+        if (copy > 0) {
+                if (copy > len)
+                        copy = len;
+                if (memcpy_toiovec(to, skb->data + offset, copy))
+                        goto fault;
+                if ((len -= copy) == 0)
+                        return 0;
+                offset += copy;
+        }
 
-next_skb:
-        fraglen = skb_headlen(skb);
-        i = -1;
+        /* Copy paged appendix. Hmm... why does this look so complicated? */
+        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+                int end;
 
-        while (1) {
-                int start = end;
+                BUG_TRAP(start <= offset + len);
 
-                if ((end += fraglen) > offset) {
-                        int copy = end - offset, o = offset - start;
+                end = start + skb_shinfo(skb)->frags[i].size;
+                if ((copy = end - offset) > 0) {
+                        int err;
+                        u8  *vaddr;
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+                        struct page *page = frag->page;
 
                         if (copy > len)
                                 copy = len;
-                        if (i == -1)
-                                err = memcpy_toiovec(to, skb->data + o, copy);
-                        else {
-                                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
-                                struct page *page = frag->page;
-                                void *p = kmap(page) + frag->page_offset + o;
-                                err = memcpy_toiovec(to, p, copy);
-                                kunmap(page);
-                        }
+                        vaddr = kmap(page);
+                        err = memcpy_toiovec(to, vaddr + frag->page_offset +
+                                             offset - start, copy);
+                        kunmap(page);
                         if (err)
                                 goto fault;
                         if (!(len -= copy))
                                 return 0;
                         offset += copy;
                 }
-                if (++i >= skb_shinfo(skb)->nr_frags)
-                        break;
-                fraglen = skb_shinfo(skb)->frags[i].size;
+                start = end;
         }
-        if (next) {
-                skb = next;
-                BUG_ON(skb_shinfo(skb)->frag_list);
-                next = skb->next;
-                goto next_skb;
+
+        if (skb_shinfo(skb)->frag_list) {
+                struct sk_buff *list = skb_shinfo(skb)->frag_list;
+
+                for (; list; list = list->next) {
+                        int end;
+
+                        BUG_TRAP(start <= offset + len);
+
+                        end = start + list->len;
+                        if ((copy = end - offset) > 0) {
+                                if (copy > len)
+                                        copy = len;
+                                if (skb_copy_datagram_iovec(list,
+                                                            offset - start,
+                                                            to, copy))
+                                        goto fault;
+                                if ((len -= copy) == 0)
+                                        return 0;
+                                offset += copy;
+                        }
+                        start = end;
+                }
         }
+        if (!len)
+                return 0;
+
 fault:
         return -EFAULT;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index ffb82073056e..2afb0de95329 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3237,7 +3237,7 @@ static int __init net_dev_init(void)
          *      Initialise the packet receive queues.
          */
 
-        for (i = 0; i < NR_CPUS; i++) {
+        for_each_cpu(i) {
                 struct softnet_data *queue;
 
                 queue = &per_cpu(softnet_data, i);
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index b8203de5ff07..98f0fc923f91 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -52,7 +52,6 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
         get_random_bytes(&lopt->hash_rnd, sizeof(lopt->hash_rnd));
         rwlock_init(&queue->syn_wait_lock);
         queue->rskq_accept_head = queue->rskq_accept_head = NULL;
-        queue->rskq_defer_accept = 0;
         lopt->nr_table_entries = nr_table_entries;
 
         write_lock_bh(&queue->syn_wait_lock);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 8700379685e0..eca2976abb25 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -455,7 +455,7 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
         if (!skb)
                 return;
 
-        if (rtnetlink_fill_ifinfo(skb, dev, type, current->pid, 0, change, 0) < 0) {
+        if (rtnetlink_fill_ifinfo(skb, dev, type, 0, 0, change, 0) < 0) {
                 kfree_skb(skb);
                 return;
         }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6766f118f070..2144952d1c6c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -411,6 +411,9 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(pkt_type);
         C(ip_summed);
         C(priority);
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        C(ipvs_property);
+#endif
         C(protocol);
         n->destructor = NULL;
 #ifdef CONFIG_NETFILTER
@@ -422,13 +425,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(nfct_reasm);
         nf_conntrack_get_reasm(skb->nfct_reasm);
 #endif
-#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
-        C(ipvs_property);
-#endif
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-        C(nfct_reasm);
-        nf_conntrack_get_reasm(skb->nfct_reasm);
-#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         C(nf_bridge);
         nf_bridge_get(skb->nf_bridge);
diff --git a/net/core/utils.c b/net/core/utils.c
index ac1d1fcf8673..fdc4f38bc46c 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -121,7 +121,7 @@ void __init net_random_init(void)
 {
         int i;
 
-        for (i = 0; i < NR_CPUS; i++) {
+        for_each_cpu(i) {
                 struct nrnd_state *state = &per_cpu(net_rand_state,i);
                 __net_srandom(state, i+jiffies);
         }
@@ -133,7 +133,7 @@ static int net_random_reseed(void)
         unsigned long seed[NR_CPUS];
 
         get_random_bytes(seed, sizeof(seed));
-        for (i = 0; i < NR_CPUS; i++) {
+        for_each_cpu(i) {
                 struct nrnd_state *state = &per_cpu(net_rand_state,i);
                 __net_srandom(state, seed[i]);
         }
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index aa68e0ab274d..35d1d347541c 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -2,7 +2,7 @@
  *  net/dccp/ccids/ccid3.c
  *
  *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
+ *  Copyright (c) 2005-6 Ian McDonald <imcdnzl@gmail.com>
  *
  *  An implementation of the DCCP protocol
  *
@@ -1033,9 +1033,13 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
         p_prev = hcrx->ccid3hcrx_p;
         
         /* Calculate loss event rate */
-        if (!list_empty(&hcrx->ccid3hcrx_li_hist))
+        if (!list_empty(&hcrx->ccid3hcrx_li_hist)) {
+                u32 i_mean = dccp_li_hist_calc_i_mean(&hcrx->ccid3hcrx_li_hist);
+
                 /* Scaling up by 1000000 as fixed decimal */
-                hcrx->ccid3hcrx_p = 1000000 / dccp_li_hist_calc_i_mean(&hcrx->ccid3hcrx_li_hist);
+                if (i_mean != 0)
+                        hcrx->ccid3hcrx_p = 1000000 / i_mean;
+        }
 
         if (hcrx->ccid3hcrx_p > p_prev) {
                 ccid3_hc_rx_send_feedback(sk);
diff --git a/net/dccp/ccids/lib/tfrc_equation.c b/net/dccp/ccids/lib/tfrc_equation.c
index d2b5933b4510..add3cae65e2d 100644
--- a/net/dccp/ccids/lib/tfrc_equation.c
+++ b/net/dccp/ccids/lib/tfrc_equation.c
@@ -15,7 +15,6 @@
 #include <linux/config.h>
 #include <linux/module.h>
 
-#include <asm/bug.h>
 #include <asm/div64.h>
 
 #include "tfrc.h"
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 9890fd97e538..c971f14712ec 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -95,6 +95,12 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                 saddr = dev->dev_addr;
         memcpy(eth->h_source,saddr,dev->addr_len);
 
+        if(daddr)
+        {
+                memcpy(eth->h_dest,daddr,dev->addr_len);
+                return ETH_HLEN;
+        }
+        
         /*
          *      Anyway, the loopback-device should never use this function... 
          */
@@ -105,12 +111,6 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                 return ETH_HLEN;
         }
         
-        if(daddr)
-        {
-                memcpy(eth->h_dest,daddr,dev->addr_len);
-                return ETH_HLEN;
-        }
-        
         return -ETH_HLEN;
 }
 
diff --git a/net/ieee80211/ieee80211_crypt_ccmp.c b/net/ieee80211/ieee80211_crypt_ccmp.c
index 470221728503..3840d1911f2b 100644
--- a/net/ieee80211/ieee80211_crypt_ccmp.c
+++ b/net/ieee80211/ieee80211_crypt_ccmp.c
@@ -131,7 +131,7 @@ static void ccmp_init_blocks(struct crypto_tfm *tfm,
         a4_included = ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
                        (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS));
         qc_included = ((WLAN_FC_GET_TYPE(fc) == IEEE80211_FTYPE_DATA) &&
-                       (WLAN_FC_GET_STYPE(fc) & 0x08));
+                       (WLAN_FC_GET_STYPE(fc) & IEEE80211_STYPE_QOS_DATA));
         aad_len = 22;
         if (a4_included)
                 aad_len += 6;
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 960aa78cdb97..7ac6a7165d9c 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -1301,7 +1301,7 @@ static void update_network(struct ieee80211_network *dst,
         /* dst->last_associate is not overwritten */
 }
 
-static inline int is_beacon(int fc)
+static inline int is_beacon(__le16 fc)
 {
         return (WLAN_FC_GET_STYPE(le16_to_cpu(fc)) == IEEE80211_STYPE_BEACON);
 }
@@ -1348,9 +1348,7 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                                      escape_essid(info_element->data,
                                                   info_element->len),
                                      MAC_ARG(beacon->header.addr3),
-                                     is_beacon(le16_to_cpu
-                                               (beacon->header.
-                                                frame_ctl)) ?
+                                     is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
                 return;
         }
@@ -1400,9 +1398,7 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                                      escape_essid(network.ssid,
                                                   network.ssid_len),
                                      MAC_ARG(network.bssid),
-                                     is_beacon(le16_to_cpu
-                                               (beacon->header.
-                                                frame_ctl)) ?
+                                     is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
 #endif
                 memcpy(target, &network, sizeof(*target));
@@ -1412,21 +1408,19 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                                      escape_essid(target->ssid,
                                                   target->ssid_len),
                                      MAC_ARG(target->bssid),
-                                     is_beacon(le16_to_cpu
-                                               (beacon->header.
-                                                frame_ctl)) ?
+                                     is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
                 update_network(target, &network);
         }
 
         spin_unlock_irqrestore(&ieee->lock, flags);
 
-        if (is_beacon(le16_to_cpu(beacon->header.frame_ctl))) {
+        if (is_beacon(beacon->header.frame_ctl)) {
                 if (ieee->handle_beacon != NULL)
-                        ieee->handle_beacon(dev, beacon, &network);
+                        ieee->handle_beacon(dev, beacon, target);
         } else {
                 if (ieee->handle_probe_response != NULL)
-                        ieee->handle_probe_response(dev, beacon, &network);
+                        ieee->handle_probe_response(dev, beacon, target);
         }
 }
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 95b9d81ac488..3ffa60dadc0c 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1135,7 +1135,7 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa)
 
         if (!skb)
                 netlink_set_err(rtnl, 0, RTNLGRP_IPV4_IFADDR, ENOBUFS);
-        else if (inet_fill_ifaddr(skb, ifa, current->pid, 0, event, 0) < 0) {
+        else if (inet_fill_ifaddr(skb, ifa, 0, 0, event, 0) < 0) {
                 kfree_skb(skb);
                 netlink_set_err(rtnl, 0, RTNLGRP_IPV4_IFADDR, EINVAL);
         } else {
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 73bfcae8af9c..09590f356086 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -12,13 +12,6 @@
 #include <net/protocol.h>
 #include <net/udp.h>
 
-/* decapsulation data for use when post-processing */
-struct esp_decap_data {
-        xfrm_address_t  saddr;
-        __u16           sport;
-        __u8            proto;
-};
-
 static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
@@ -150,6 +143,10 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
         int elen = skb->len - sizeof(struct ip_esp_hdr) - esp->conf.ivlen - alen;
         int nfrags;
         int encap_len = 0;
+        u8 nexthdr[2];
+        struct scatterlist *sg;
+        u8 workbuf[60];
+        int padlen;
 
         if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr)))
                 goto out;
@@ -185,122 +182,82 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
         if (esp->conf.ivlen)
                 crypto_cipher_set_iv(esp->conf.tfm, esph->enc_data, crypto_tfm_alg_ivsize(esp->conf.tfm));
 
-        {
-                u8 nexthdr[2];
-                struct scatterlist *sg = &esp->sgbuf[0];
-                u8 workbuf[60];
-                int padlen;
-
-                if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
-                        sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
-                        if (!sg)
-                                goto out;
-                }
-                skb_to_sgvec(skb, sg, sizeof(struct ip_esp_hdr) + esp->conf.ivlen, elen);
-                crypto_cipher_decrypt(esp->conf.tfm, sg, sg, elen);
-                if (unlikely(sg != &esp->sgbuf[0]))
-                        kfree(sg);
-
-                if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2))
-                        BUG();
+        sg = &esp->sgbuf[0];
 
-                padlen = nexthdr[0];
-                if (padlen+2 >= elen)
+        if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
+                sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
+                if (!sg)
                         goto out;
-
-                /* ... check padding bits here. Silly. :-) */ 
-
-                if (x->encap && decap && decap->decap_type) {
-                        struct esp_decap_data *encap_data;
-                        struct udphdr *uh = (struct udphdr *) (iph+1);
-
-                        encap_data = (struct esp_decap_data *) (decap->decap_data);
-                        encap_data->proto = 0;
-
-                        switch (decap->decap_type) {
-                        case UDP_ENCAP_ESPINUDP:
-                        case UDP_ENCAP_ESPINUDP_NON_IKE:
-                                encap_data->proto = AF_INET;
-                                encap_data->saddr.a4 = iph->saddr;
-                                encap_data->sport = uh->source;
-                                encap_len = (void*)esph - (void*)uh;
-                                break;
-
-                        default:
-                                goto out;
-                        }
-                }
-
-                iph->protocol = nexthdr[1];
-                pskb_trim(skb, skb->len - alen - padlen - 2);
-                memcpy(workbuf, skb->nh.raw, iph->ihl*4);
-                skb->h.raw = skb_pull(skb, sizeof(struct ip_esp_hdr) + esp->conf.ivlen);
-                skb->nh.raw += encap_len + sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
-                memcpy(skb->nh.raw, workbuf, iph->ihl*4);
-                skb->nh.iph->tot_len = htons(skb->len);
         }
+        skb_to_sgvec(skb, sg, sizeof(struct ip_esp_hdr) + esp->conf.ivlen, elen);
+        crypto_cipher_decrypt(esp->conf.tfm, sg, sg, elen);
+        if (unlikely(sg != &esp->sgbuf[0]))
+                kfree(sg);
 
-        return 0;
+        if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2))
+                BUG();
 
-out:
-        return -EINVAL;
-}
+        padlen = nexthdr[0];
+        if (padlen+2 >= elen)
+                goto out;
 
-static int esp_post_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
-{
-  
-        if (x->encap) {
-                struct xfrm_encap_tmpl *encap;
-                struct esp_decap_data *decap_data;
+        /* ... check padding bits here. Silly. :-) */ 
 
-                encap = x->encap;
-                decap_data = (struct esp_decap_data *)(decap->decap_data);
+        if (x->encap) {
+                struct xfrm_encap_tmpl *encap = x->encap;
+                struct udphdr *uh;
 
-                /* first, make sure that the decap type == the encap type */
                 if (encap->encap_type != decap->decap_type)
-                        return -EINVAL;
+                        goto out;
 
-                switch (encap->encap_type) {
-                default:
-                case UDP_ENCAP_ESPINUDP:
-                case UDP_ENCAP_ESPINUDP_NON_IKE:
-                        /*
-                         * 1) if the NAT-T peer's IP or port changed then
-                         *    advertize the change to the keying daemon.
-                         *    This is an inbound SA, so just compare
-                         *    SRC ports.
-                         */
-                        if (decap_data->proto == AF_INET &&
-                            (decap_data->saddr.a4 != x->props.saddr.a4 ||
-                             decap_data->sport != encap->encap_sport)) {
-                                xfrm_address_t ipaddr;
-
-                                ipaddr.a4 = decap_data->saddr.a4;
-                                km_new_mapping(x, &ipaddr, decap_data->sport);
-                                        
-                                /* XXX: perhaps add an extra
-                                 * policy check here, to see
-                                 * if we should allow or
-                                 * reject a packet from a
-                                 * different source
-                                 * address/port.
-                                 */
-                        }
-                
-                        /*
-                         * 2) ignore UDP/TCP checksums in case
-                         *    of NAT-T in Transport Mode, or
-                         *    perform other post-processing fixes
-                         *    as per * draft-ietf-ipsec-udp-encaps-06,
-                         *    section 3.1.2
+                uh = (struct udphdr *)(iph + 1);
+                encap_len = (void*)esph - (void*)uh;
+
+                /*
+                 * 1) if the NAT-T peer's IP or port changed then
+                 *    advertize the change to the keying daemon.
+                 *    This is an inbound SA, so just compare
+                 *    SRC ports.
+                 */
+                if (iph->saddr != x->props.saddr.a4 ||
+                    uh->source != encap->encap_sport) {
+                        xfrm_address_t ipaddr;
+
+                        ipaddr.a4 = iph->saddr;
+                        km_new_mapping(x, &ipaddr, uh->source);
+                                
+                        /* XXX: perhaps add an extra
+                         * policy check here, to see
+                         * if we should allow or
+                         * reject a packet from a
+                         * different source
+                         * address/port.
                          */
-                        if (!x->props.mode)
-                                skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-                        break;
                 }
+        
+                /*
+                 * 2) ignore UDP/TCP checksums in case
+                 *    of NAT-T in Transport Mode, or
+                 *    perform other post-processing fixes
+                 *    as per draft-ietf-ipsec-udp-encaps-06,
+                 *    section 3.1.2
+                 */
+                if (!x->props.mode)
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
+
+        iph->protocol = nexthdr[1];
+        pskb_trim(skb, skb->len - alen - padlen - 2);
+        memcpy(workbuf, skb->nh.raw, iph->ihl*4);
+        skb->h.raw = skb_pull(skb, sizeof(struct ip_esp_hdr) + esp->conf.ivlen);
+        skb->nh.raw += encap_len + sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
+        memcpy(skb->nh.raw, workbuf, iph->ihl*4);
+        skb->nh.iph->tot_len = htons(skb->len);
+
         return 0;
+
+out:
+        return -EINVAL;
 }
 
 static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
@@ -458,7 +415,6 @@ static struct xfrm_type esp_type =
         .destructor     = esp_destroy,
         .get_max_size   = esp4_get_max_size,
         .input          = esp_input,
-        .post_input     = esp_post_input,
         .output         = esp_output
 };
 
@@ -470,15 +426,6 @@ static struct net_protocol esp4_protocol = {
 
 static int __init esp4_init(void)
 {
-        struct xfrm_decap_state decap;
-
-        if (sizeof(struct esp_decap_data)  >
-            sizeof(decap.decap_data)) {
-                extern void decap_data_too_small(void);
-
-                decap_data_too_small();
-        }
-
         if (xfrm_register_type(&esp_type, AF_INET) < 0) {
                 printk(KERN_INFO "ip esp init: can't add xfrm type\n");
                 return -EAGAIN;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index ef4724de7350..0f4145babb14 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1045,7 +1045,7 @@ fib_convert_rtentry(int cmd, struct nlmsghdr *nl, struct rtmsg *rtm,
         }
 
         nl->nlmsg_flags = NLM_F_REQUEST;
-        nl->nlmsg_pid = current->pid;
+        nl->nlmsg_pid = 0;
         nl->nlmsg_seq = 0;
         nl->nlmsg_len = NLMSG_LENGTH(sizeof(*rtm));
         if (cmd == SIOCDELRT) {
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 6bc0887b0834..e7bbff4340bb 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -192,7 +192,7 @@ int sysctl_icmp_echo_ignore_all;
 int sysctl_icmp_echo_ignore_broadcasts = 1;
 
 /* Control parameter - ignore bogus broadcast responses? */
-int sysctl_icmp_ignore_bogus_error_responses;
+int sysctl_icmp_ignore_bogus_error_responses = 1;
 
 /*
  *      Configurable global rate limit.
@@ -524,7 +524,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, u32 info)
                                           iph->tos;
 
         if (ip_options_echo(&icmp_param.replyopts, skb_in))
-                goto ende;
+                goto out_unlock;
 
 
         /*
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 0b4e95f93dad..64ce52bf0485 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1578,7 +1578,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                         new_in = psf->sf_count[MCAST_INCLUDE] != 0;
                 if (new_in) {
                         if (!psf->sf_oldin) {
-                                struct ip_sf_list *prev = 0;
+                                struct ip_sf_list *prev = NULL;
 
                                 for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next) {
                                         if (dpsf->sf_inaddr == psf->sf_inaddr)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index abe23923e4e7..9981dcd68f11 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -830,7 +830,8 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         skb->h.raw = skb->nh.raw;
         skb->nh.raw = skb_push(skb, gre_hlen);
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE|IPSKB_XFRM_TRANSFORMED);
+        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
+                              IPSKB_REROUTED);
         dst_release(skb->dst);
         skb->dst = &rt->u.dst;
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3324fbfe528a..8ee4d016740d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -207,8 +207,10 @@ static inline int ip_finish_output(struct sk_buff *skb)
 {
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
         /* Policy lookup after SNAT yielded a new policy */
-        if (skb->dst->xfrm != NULL)
-                return xfrm4_output_finish(skb);
+        if (skb->dst->xfrm != NULL) {
+                IPCB(skb)->flags |= IPSKB_REROUTED;
+                return dst_output(skb);
+        }
 #endif
         if (skb->len > dst_mtu(skb->dst) &&
             !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
@@ -271,8 +273,9 @@ int ip_mc_output(struct sk_buff *skb)
                                 newskb->dev, ip_dev_loopback_xmit);
         }
 
-        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev,
-                       ip_finish_output);
+        return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dev,
+                            ip_finish_output,
+                            !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
 int ip_output(struct sk_buff *skb)
@@ -284,8 +287,9 @@ int ip_output(struct sk_buff *skb)
         skb->dev = dev;
         skb->protocol = htons(ETH_P_IP);
 
-        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
-                       ip_finish_output);
+        return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev,
+                            ip_finish_output,
+                            !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
 int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
@@ -843,10 +847,11 @@ int ip_append_data(struct sock *sk,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
                         (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip_ufo_append_data(sk, getfrag, from, length, hh_len,
-                               fragheaderlen, transhdrlen, mtu, flags))
+                err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                         fragheaderlen, transhdrlen, mtu,
+                                         flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index e5cbe72c6b80..03d13742a4b8 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -622,7 +622,8 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         skb->h.raw = skb->nh.raw;
         skb->nh.raw = skb_push(skb, sizeof(struct iphdr));
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE|IPSKB_XFRM_TRANSFORMED);
+        IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
+                              IPSKB_REROUTED);
         dst_release(skb->dst);
         skb->dst = &rt->u.dst;
 
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 52a3d7c57907..ed42cdc57cd9 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -78,6 +78,47 @@ int ip_route_me_harder(struct sk_buff **pskb)
 }
 EXPORT_SYMBOL(ip_route_me_harder);
 
+#ifdef CONFIG_XFRM
+int ip_xfrm_me_harder(struct sk_buff **pskb)
+{
+        struct flowi fl;
+        unsigned int hh_len;
+        struct dst_entry *dst;
+
+        if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
+                return 0;
+        if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
+                return -1;
+
+        dst = (*pskb)->dst;
+        if (dst->xfrm)
+                dst = ((struct xfrm_dst *)dst)->route;
+        dst_hold(dst);
+
+        if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
+                return -1;
+
+        dst_release((*pskb)->dst);
+        (*pskb)->dst = dst;
+
+        /* Change in oif may mean change in hh_len. */
+        hh_len = (*pskb)->dst->dev->hard_header_len;
+        if (skb_headroom(*pskb) < hh_len) {
+                struct sk_buff *nskb;
+
+                nskb = skb_realloc_headroom(*pskb, hh_len);
+                if (!nskb)
+                        return -1;
+                if ((*pskb)->sk)
+                        skb_set_owner_w(nskb, (*pskb)->sk);
+                kfree_skb(*pskb);
+                *pskb = nskb;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ip_xfrm_me_harder);
+#endif
+
 void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
 EXPORT_SYMBOL(ip_nat_decode_session);
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index afe3d8f8177d..7d7ab94a7a2e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -771,7 +771,7 @@ static int get_entries(const struct arpt_get_entries *entries,
         struct arpt_table *t;
 
         t = xt_find_table_lock(NF_ARP, entries->name);
-        if (t || !IS_ERR(t)) {
+        if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n",
                          private->number);
@@ -807,6 +807,13 @@ static int do_replace(void __user *user, unsigned int len)
         if (len != sizeof(tmp) + tmp.size)
                 return -ENOPROTOOPT;
 
+        /* overflow check */
+        if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
+                        SMP_CACHE_BYTES)
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+                return -ENOMEM;
+
         newinfo = xt_alloc_table_info(tmp.size);
         if (!newinfo)
                 return -ENOMEM;
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index c9ebbe0d2d9c..e0b5926c76f9 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -1216,7 +1216,7 @@ static int ctnetlink_expect_event(struct notifier_block *this,
 
         b = skb->tail;
 
-        type |= NFNL_SUBSYS_CTNETLINK << 8;
+        type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
         nlh   = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
         nfmsg = NLMSG_DATA(nlh);
 
@@ -1567,6 +1567,7 @@ static struct nfnetlink_subsystem ctnl_exp_subsys = {
 };
 
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
+MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
 
 static int __init ctnetlink_init(void)
 {
diff --git a/net/ipv4/netfilter/ip_conntrack_tftp.c b/net/ipv4/netfilter/ip_conntrack_tftp.c
index d3c5a371f993..4ba4463cec28 100644
--- a/net/ipv4/netfilter/ip_conntrack_tftp.c
+++ b/net/ipv4/netfilter/ip_conntrack_tftp.c
@@ -71,6 +71,7 @@ static int tftp_help(struct sk_buff **pskb,
 
                 exp->tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
                 exp->mask.src.ip = 0xffffffff;
+                exp->mask.src.u.udp.port = 0;
                 exp->mask.dst.ip = 0xffffffff;
                 exp->mask.dst.u.udp.port = 0xffff;
                 exp->mask.dst.protonum = 0xff;
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index c1a61462507f..1741d555ad0d 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -434,6 +434,7 @@ int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
         } *inside;
         struct ip_conntrack_tuple inner, target;
         int hdrlen = (*pskb)->nh.iph->ihl * 4;
+        unsigned long statusbit;
 
         if (!skb_make_writable(pskb, hdrlen + sizeof(*inside)))
                 return 0;
@@ -495,17 +496,16 @@ int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
 
         /* Change outer to look the reply to an incoming packet
          * (proto 0 means don't invert per-proto part). */
+        if (manip == IP_NAT_MANIP_SRC)
+                statusbit = IPS_SRC_NAT;
+        else
+                statusbit = IPS_DST_NAT;
 
-        /* Obviously, we need to NAT destination IP, but source IP
-           should be NAT'ed only if it is from a NAT'd host.
+        /* Invert if this is reply dir. */
+        if (dir == IP_CT_DIR_REPLY)
+                statusbit ^= IPS_NAT_MASK;
 
-           Explanation: some people use NAT for anonymizing.  Also,
-           CERT recommends dropping all packets from private IP
-           addresses (although ICMP errors from internal links with
-           such addresses are not too uncommon, as Alan Cox points
-           out) */
-        if (manip != IP_NAT_MANIP_SRC
-            || ((*pskb)->nh.iph->saddr == ct->tuplehash[dir].tuple.src.ip)) {
+        if (ct->status & statusbit) {
                 invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
                 if (!manip_pkt(0, pskb, 0, &target, manip))
                         return 0;
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index ad438fb185b8..ab1f88fa21ec 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -200,20 +200,14 @@ ip_nat_in(unsigned int hooknum,
           const struct net_device *out,
           int (*okfn)(struct sk_buff *))
 {
-        struct ip_conntrack *ct;
-        enum ip_conntrack_info ctinfo;
         unsigned int ret;
+        u_int32_t daddr = (*pskb)->nh.iph->daddr;
 
         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
         if (ret != NF_DROP && ret != NF_STOLEN
-            && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (ct->tuplehash[dir].tuple.src.ip !=
-                    ct->tuplehash[!dir].tuple.dst.ip) {
-                        dst_release((*pskb)->dst);
-                        (*pskb)->dst = NULL;
-                }
+            && daddr != (*pskb)->nh.iph->daddr) {
+                dst_release((*pskb)->dst);
+                (*pskb)->dst = NULL;
         }
         return ret;
 }
@@ -235,19 +229,19 @@ ip_nat_out(unsigned int hooknum,
                 return NF_ACCEPT;
 
         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
+#ifdef CONFIG_XFRM
         if (ret != NF_DROP && ret != NF_STOLEN
             && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if (ct->tuplehash[dir].tuple.src.ip !=
                     ct->tuplehash[!dir].tuple.dst.ip
-#ifdef CONFIG_XFRM
                     || ct->tuplehash[dir].tuple.src.u.all !=
                        ct->tuplehash[!dir].tuple.dst.u.all
-#endif
                     )
-                        return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
+                        return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
         }
+#endif
         return ret;
 }
 
@@ -276,7 +270,7 @@ ip_nat_local_fn(unsigned int hooknum,
                     ct->tuplehash[!dir].tuple.src.ip
 #ifdef CONFIG_XFRM
                     || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[dir].tuple.src.u.all
+                       ct->tuplehash[!dir].tuple.src.u.all
 #endif
                     )
                         return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 36339eb39e17..08f80e2ea2aa 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -524,7 +524,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         write_unlock_bh(&queue_lock);
         
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  skblen - NLMSG_LENGTH(0));
+                                  nlmsglen - NLMSG_LENGTH(0));
         if (status < 0)
                 RCV_SKB_FAIL(status);
                 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 2371b2062c2d..16f47c675fef 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -921,6 +921,13 @@ do_replace(void __user *user, unsigned int len)
         if (len != sizeof(tmp) + tmp.size)
                 return -ENOPROTOOPT;
 
+        /* overflow check */
+        if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
+                        SMP_CACHE_BYTES)
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+                return -ENOMEM;
+
         newinfo = xt_alloc_table_info(tmp.size);
         if (!newinfo)
                 return -ENOMEM;
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 6606ddb66a29..cc27545ff97f 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -425,7 +425,12 @@ ipt_log_target(struct sk_buff **pskb,
         li.u.log.level = loginfo->level;
         li.u.log.logflags = loginfo->logflags;
 
-        nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li, loginfo->prefix);
+        if (loginfo->logflags & IPT_LOG_NFLOG)
+                nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
+                              loginfo->prefix);
+        else
+                ipt_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
+                               loginfo->prefix);
 
         return IPT_CONTINUE;
 }
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 641dbc477650..180a9ea57b69 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -35,6 +35,10 @@
  * each nlgroup you are using, so the total kernel memory usage increases
  * by that factor.
  *
+ * Actually you should use nlbufsiz a bit smaller than PAGE_SIZE, since
+ * nlbufsiz is used with alloc_skb, which adds another
+ * sizeof(struct skb_shared_info).  Use NLMSG_GOODSIZE instead.
+ *
  * flushtimeout:
  *   Specify, after how many hundredths of a second the queue should be
  *   flushed even if it is not full yet.
@@ -76,7 +80,7 @@ MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NFLOG);
 
 #define PRINTR(format, args...) do { if (net_ratelimit()) printk(format , ## args); } while (0)
 
-static unsigned int nlbufsiz = 4096;
+static unsigned int nlbufsiz = NLMSG_GOODSIZE;
 module_param(nlbufsiz, uint, 0400);
 MODULE_PARM_DESC(nlbufsiz, "netlink buffer size");
 
@@ -143,22 +147,26 @@ static void ulog_timer(unsigned long data)
 static struct sk_buff *ulog_alloc_skb(unsigned int size)
 {
         struct sk_buff *skb;
+        unsigned int n;
 
         /* alloc skb which should be big enough for a whole
          * multipart message. WARNING: has to be <= 131000
          * due to slab allocator restrictions */
 
-        skb = alloc_skb(nlbufsiz, GFP_ATOMIC);
+        n = max(size, nlbufsiz);
+        skb = alloc_skb(n, GFP_ATOMIC);
         if (!skb) {
-                PRINTR("ipt_ULOG: can't alloc whole buffer %ub!\n",
-                        nlbufsiz);
+                PRINTR("ipt_ULOG: can't alloc whole buffer %ub!\n", n);
 
-                /* try to allocate only as much as we need for 
-                 * current packet */
+                if (n > size) {
+                        /* try to allocate only as much as we need for 
+                         * current packet */
 
-                skb = alloc_skb(size, GFP_ATOMIC);
-                if (!skb)
-                        PRINTR("ipt_ULOG: can't even allocate %ub\n", size);
+                        skb = alloc_skb(size, GFP_ATOMIC);
+                        if (!skb)
+                                PRINTR("ipt_ULOG: can't even allocate %ub\n",
+                                       size);
+                }
         }
 
         return skb;
diff --git a/net/ipv4/netfilter/ipt_policy.c b/net/ipv4/netfilter/ipt_policy.c
index 18ca8258a1c5..5a7a265280f9 100644
--- a/net/ipv4/netfilter/ipt_policy.c
+++ b/net/ipv4/netfilter/ipt_policy.c
@@ -26,10 +26,13 @@ MODULE_LICENSE("GPL");
 static inline int
 match_xfrm_state(struct xfrm_state *x, const struct ipt_policy_elem *e)
 {
-#define MATCH(x,y)      (!e->match.x || ((e->x == (y)) ^ e->invert.x))
+#define MATCH_ADDR(x,y,z)       (!e->match.x ||                              \
+                                 ((e->x.a4.s_addr == (e->y.a4.s_addr & (z))) \
+                                  ^ e->invert.x))
+#define MATCH(x,y)              (!e->match.x || ((e->x == (y)) ^ e->invert.x))
 
-        return MATCH(saddr, x->props.saddr.a4 & e->smask) &&
-               MATCH(daddr, x->id.daddr.a4 & e->dmask) &&
+        return MATCH_ADDR(saddr, smask, x->props.saddr.a4) &&
+               MATCH_ADDR(daddr, dmask, x->id.daddr.a4) &&
                MATCH(proto, x->id.proto) &&
                MATCH(mode, x->props.mode) &&
                MATCH(spi, x->id.spi) &&
@@ -89,7 +92,7 @@ match_policy_out(const struct sk_buff *skb, const struct ipt_policy_info *info)
                         return 0;
         }
 
-        return strict ? 1 : 0;
+        return strict ? i == info->len : 0;
 }
 
 static int match(const struct sk_buff *skb,
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 167619f638c6..6c8624a54933 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -529,15 +529,10 @@ static int init_or_cleanup(int init)
                 goto cleanup_localinops;
         }
 #endif
-
-        /* For use by REJECT target */
-        ip_ct_attach = __nf_conntrack_attach;
-
         return ret;
 
  cleanup:
         synchronize_net();
-        ip_ct_attach = NULL;
 #ifdef CONFIG_SYSCTL
         unregister_sysctl_table(nf_ct_ipv4_sysctl_header);
  cleanup_localinops:
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 39d49dc333a7..1b167c4bb3be 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -49,7 +49,7 @@ static int fold_prot_inuse(struct proto *proto)
         int res = 0;
         int cpu;
 
-        for (cpu = 0; cpu < NR_CPUS; cpu++)
+        for_each_cpu(cpu)
                 res += proto->stats[cpu].inuse;
 
         return res;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d82c242ea704..fca5fe0cf94a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -835,7 +835,7 @@ static int rt_garbage_collect(void)
                                         int r;
 
                                         rthp = rt_remove_balanced_route(
-                                                &rt_hash_table[i].chain,
+                                                &rt_hash_table[k].chain,
                                                 rth,
                                                 &r);
                                         goal -= r;
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 63cf7e540847..e0e9d1383c7c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                 /* Update AIMD parameters */
                 if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-                               ca->ai < HSTCP_AIMD_MAX)
+                               ca->ai < HSTCP_AIMD_MAX - 1)
                                 ca->ai++;
                 } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a97ed5416c28..e9a54ae7d690 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -456,7 +456,8 @@ void tcp_rcv_space_adjust(struct sock *sk)
 
                 tp->rcvq_space.space = space;
 
-                if (sysctl_tcp_moderate_rcvbuf) {
+                if (sysctl_tcp_moderate_rcvbuf &&
+                    !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) {
                         int new_clamp = space;
 
                         /* Receive space grows, normalize in order to
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a7623ead39a8..9f498a6c8895 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1036,6 +1036,10 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         limit = min(send_win, cong_win);
 
+        /* If a full-sized TSO skb can be sent, do it. */
+        if (limit >= 65536)
+                return 0;
+
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index d4df0ddd424b..32ad229b4fed 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -152,10 +152,16 @@ error_nolock:
         goto out_exit;
 }
 
-int xfrm4_output_finish(struct sk_buff *skb)
+static int xfrm4_output_finish(struct sk_buff *skb)
 {
         int err;
 
+#ifdef CONFIG_NETFILTER
+        if (!skb->dst->xfrm) {
+                IPCB(skb)->flags |= IPSKB_REROUTED;
+                return dst_output(skb);
+        }
+#endif
         while (likely((err = xfrm4_output_one(skb)) == 0)) {
                 nf_reset(skb);
 
@@ -178,6 +184,7 @@ int xfrm4_output_finish(struct sk_buff *skb)
 
 int xfrm4_output(struct sk_buff *skb)
 {
-        return NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
-                       xfrm4_output_finish);
+        return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
+                            xfrm4_output_finish,
+                            !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 42196ba3b0b9..f285bbf296e2 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -8,7 +8,6 @@
  *      
  */
 
-#include <asm/bug.h>
 #include <linux/compiler.h>
 #include <linux/config.h>
 #include <linux/inetdevice.h>
@@ -36,6 +35,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
+                    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
                     xfrm_bundle_ok(xdst, fl, AF_INET)) {
                         dst_clone(dst);
                         break;
@@ -62,7 +62,8 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 .nl_u = {
                         .ip4_u = {
                                 .saddr = local,
-                                .daddr = remote
+                                .daddr = remote,
+                                .tos = fl->fl4_tos
                         }
                 }
         };
@@ -231,6 +232,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
         fl->proto = iph->protocol;
         fl->fl4_dst = iph->daddr;
         fl->fl4_src = iph->saddr;
+        fl->fl4_tos = iph->tos;
 }
 
 static inline int xfrm4_garbage_collect(void)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1db50487916b..19727d941962 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -822,7 +822,7 @@ struct ipv6_saddr_score {
         int             addr_type;
         unsigned int    attrs;
         int             matchlen;
-        unsigned int    scope;
+        int             scope;
         unsigned int    rule;
 };
 
@@ -2165,6 +2165,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                         dev->name);
                                 break;
                         }
+
+                        if (idev)
+                                idev->if_flags |= IF_READY;
                 } else {
                         if (!netif_carrier_ok(dev)) {
                                 /* device is still not ready. */
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c7932cb420a5..84963749ab77 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -279,7 +279,7 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
                 goto out;
         memcpy(tmp_hdr, skb->nh.raw, hdr_len);
         if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
-                goto out;
+                goto free_out;
         skb->nh.ipv6h->priority    = 0;
         skb->nh.ipv6h->flow_lbl[0] = 0;
         skb->nh.ipv6h->flow_lbl[1] = 0;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index fcf883183cef..21eb725e885f 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -42,6 +42,7 @@
 #include <linux/net.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
+#include <linux/netfilter.h>
 
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
@@ -255,6 +256,7 @@ out:
 struct icmpv6_msg {
         struct sk_buff  *skb;
         int             offset;
+        uint8_t         type;
 };
 
 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
@@ -266,6 +268,8 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
         csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
                                       to, len, csum);
         skb->csum = csum_block_add(skb->csum, csum, odd);
+        if (!(msg->type & ICMPV6_INFOMSG_MASK))
+                nf_ct_attach(skb, org_skb);
         return 0;
 }
 
@@ -403,6 +407,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 
         msg.skb = skb;
         msg.offset = skb->nh.raw - skb->data;
+        msg.type = type;
 
         len = skb->len - msg.offset;
         len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr));
@@ -500,6 +505,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         msg.skb = skb;
         msg.offset = 0;
+        msg.type = ICMPV6_ECHO_REPLY;
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
                                 sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl,
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 4154f3a8b6cf..bb8ffb8a14c5 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -87,7 +87,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
                                      struct inet_timewait_sock **twp)
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const struct inet_sock *inet = inet_sk(sk);
+        struct inet_sock *inet = inet_sk(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
@@ -129,6 +129,10 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         }
 
 unique:
+        /* Must record num and sport now. Otherwise we will see
+         * in hash table socket with a funny identity. */
+        inet->num = lport;
+        inet->sport = htons(lport);
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index efa3e72cfcfa..5bf70b1442ea 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -494,6 +494,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         struct net_device *dev;
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info*)skb->dst;
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
@@ -505,7 +506,12 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         hlen = ip6_find_1stfragopt(skb, &prevhdr);
         nexthdr = *prevhdr;
 
-        mtu = dst_mtu(&rt->u.dst) - hlen - sizeof(struct frag_hdr);
+        mtu = dst_mtu(&rt->u.dst);
+        if (np && np->frag_size < mtu) {
+                if (np->frag_size)
+                        mtu = np->frag_size;
+        }
+        mtu -= hlen + sizeof(struct frag_hdr);
 
         if (skb_shinfo(skb)->frag_list) {
                 int first_len = skb_pagelen(skb);
@@ -882,7 +888,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl = *fl;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                inet->cork.fragsize = mtu = dst_mtu(rt->u.dst.path);
+                mtu = dst_mtu(rt->u.dst.path);
+                if (np && np->frag_size < mtu) {
+                        if (np->frag_size)
+                                mtu = np->frag_size;
+                }
+                inet->cork.fragsize = mtu;
                 if (dst_allfrag(rt->u.dst.path))
                         inet->cork.flags |= IPCORK_ALLFRAG;
                 inet->cork.length = 0;
@@ -933,10 +944,11 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
-                                fragheaderlen, transhdrlen, mtu, flags))
+                err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                          fragheaderlen, transhdrlen, mtu,
+                                          flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 92ead3cf956b..48597538db3f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -458,7 +458,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         mtu = IPV6_MIN_MTU;
                 t->dev->mtu = mtu;
 
-                if ((len = sizeof (*ipv6h) + ipv6h->payload_len) > mtu) {
+                if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
                         rel_type = ICMPV6_PKT_TOOBIG;
                         rel_code = 0;
                         rel_info = mtu;
@@ -884,6 +884,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
         t->parms.encap_limit = p->encap_limit;
         t->parms.flowinfo = p->flowinfo;
         t->parms.link = p->link;
+        ip6_tnl_dst_reset(t);
         ip6ip6_tnl_link_config(t);
         return 0;
 }
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 4420948a1bfe..807c021d64a2 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1978,7 +1978,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
                         new_in = psf->sf_count[MCAST_INCLUDE] != 0;
                 if (new_in) {
                         if (!psf->sf_oldin) {
-                                struct ip6_sf_list *prev = 0;
+                                struct ip6_sf_list *prev = NULL;
 
                                 for (dpsf=pmc->mca_tomb; dpsf;
                                      dpsf=dpsf->sf_next) {
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5027bbe6415e..af0635084df8 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -522,7 +522,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         write_unlock_bh(&queue_lock);
         
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  skblen - NLMSG_LENGTH(0));
+                                  nlmsglen - NLMSG_LENGTH(0));
         if (status < 0)
                 RCV_SKB_FAIL(status);
                 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 847068fd3367..74ff56c322f4 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -978,6 +978,13 @@ do_replace(void __user *user, unsigned int len)
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
 
+        /* overflow check */
+        if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
+                        SMP_CACHE_BYTES)
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+                return -ENOMEM;
+
         newinfo = xt_alloc_table_info(tmp.size);
         if (!newinfo)
                 return -ENOMEM;
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 77c725832dec..6b930efa9fb9 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -436,7 +436,12 @@ ip6t_log_target(struct sk_buff **pskb,
         li.u.log.level = loginfo->level;
         li.u.log.logflags = loginfo->logflags;
 
-        nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li, loginfo->prefix);
+        if (loginfo->logflags & IP6T_LOG_NFLOG)
+                nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
+                              loginfo->prefix);
+        else
+                ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
+                                loginfo->prefix);
 
         return IP6T_CONTINUE;
 }
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index c745717b4ce2..0e6d1d4bbd5c 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -160,6 +160,8 @@ static void send_reset(struct sk_buff *oldskb)
                                       csum_partial((char *)tcph,
                                                    sizeof(struct tcphdr), 0));
 
+        nf_ct_attach(nskb, oldskb);
+
         NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
                 dst_output);
 }
diff --git a/net/ipv6/netfilter/ip6t_policy.c b/net/ipv6/netfilter/ip6t_policy.c
index afe1cc4c18a5..3d39ec924041 100644
--- a/net/ipv6/netfilter/ip6t_policy.c
+++ b/net/ipv6/netfilter/ip6t_policy.c
@@ -26,8 +26,9 @@ MODULE_LICENSE("GPL");
 static inline int
 match_xfrm_state(struct xfrm_state *x, const struct ip6t_policy_elem *e)
 {
-#define MATCH_ADDR(x,y,z)       (!e->match.x || \
-                                 ((ip6_masked_addrcmp((z), &e->x, &e->y)) == 0) ^ e->invert.x)
+#define MATCH_ADDR(x,y,z)       (!e->match.x ||                                \
+                                 ((!ip6_masked_addrcmp(&e->x.a6, &e->y.a6, z)) \
+                                  ^ e->invert.x))
 #define MATCH(x,y)              (!e->match.x || ((e->x == (y)) ^ e->invert.x))
         
         return MATCH_ADDR(saddr, smask, (struct in6_addr *)&x->props.saddr.a6) &&
@@ -91,7 +92,7 @@ match_policy_out(const struct sk_buff *skb, const struct ip6t_policy_info *info)
                         return 0;
         }
 
-        return strict ? 1 : 0;
+        return strict ? i == info->len : 0;
 }
 
 static int match(const struct sk_buff *skb,
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 50a13e75d70e..4238b1ed8860 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -38,7 +38,7 @@ static int fold_prot_inuse(struct proto *proto)
         int res = 0;
         int cpu;
 
-        for (cpu=0; cpu<NR_CPUS; cpu++)
+        for_each_cpu(cpu)
                 res += proto->stats[cpu].inuse;
 
         return res;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 66f1d12ea578..ae20a0ec9bd8 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -35,7 +35,6 @@
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
-#include <asm/bug.h>
 
 #include <net/ip.h>
 #include <net/sock.h>
@@ -804,10 +803,7 @@ back_from_confirm:
                         err = rawv6_push_pending_frames(sk, &fl, rp);
         }
 done:
-        ip6_dst_store(sk, dst,
-                      ipv6_addr_equal(&fl.fl6_dst, &np->daddr) ?
-                      &np->daddr : NULL);
-
+        dst_release(dst);
         release_sock(sk);
 out:    
         fl6_sock_release(flowlabel);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 69bd957380e7..91cce8b2d7a5 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -11,7 +11,6 @@
  * 
  */
 
-#include <asm/bug.h>
 #include <linux/compiler.h>
 #include <linux/config.h>
 #include <linux/netdevice.h>
diff --git a/net/irda/irda_device.c b/net/irda/irda_device.c
index 890bac0d4a56..e3debbdb67f5 100644
--- a/net/irda/irda_device.c
+++ b/net/irda/irda_device.c
@@ -343,12 +343,12 @@ static void irda_task_timer_expired(void *data)
 static void irda_device_setup(struct net_device *dev)
 {
         dev->hard_header_len = 0;
-        dev->addr_len        = 0;
+        dev->addr_len        = LAP_ALEN;
 
         dev->type            = ARPHRD_IRDA;
         dev->tx_queue_len    = 8; /* Window size + 1 s-frame */
 
-        memset(dev->broadcast, 0xff, 4);
+        memset(dev->broadcast, 0xff, LAP_ALEN);
 
         dev->mtu = 2048;
         dev->flags = IFF_NOARP;
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index 07ec326c71f5..f65c7a83bc5c 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -696,7 +696,7 @@ irnet_daddr_to_dname(irnet_socket *	self)
         {
           /* Yes !!! Get it.. */
           strlcpy(self->rname, discoveries[i].info, sizeof(self->rname));
-          self->rname[NICKNAME_MAX_LEN + 1] = '\0';
+          self->rname[sizeof(self->rname) - 1] = '\0';
           DEBUG(IRDA_SERV_INFO, "Device 0x%08x is in fact ``%s''.\n",
                 self->daddr, self->rname);
           kfree(discoveries);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ae86d237a456..b2d4d1dd2116 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1423,7 +1423,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                 goto out;
         }
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 99c0a0fa4a97..a8e5544da93e 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -102,8 +102,6 @@ config NF_CT_NETLINK
         help
           This option enables support for a netlink-based userspace interface
 
-endmenu
-
 config NETFILTER_XTABLES
         tristate "Netfilter Xtables support (required for ip_tables)"
         help
@@ -128,7 +126,7 @@ config NETFILTER_XT_TARGET_CONNMARK
         tristate  '"CONNMARK" target support'
         depends on NETFILTER_XTABLES
         depends on IP_NF_MANGLE || IP6_NF_MANGLE
-        depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK_IPV4)
+        depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
         help
           This option adds a `CONNMARK' target, which allows one to manipulate
           the connection mark value.  Similar to the MARK target, but
@@ -189,7 +187,7 @@ config NETFILTER_XT_MATCH_COMMENT
 config NETFILTER_XT_MATCH_CONNBYTES
         tristate  '"connbytes" per-connection counter match support'
         depends on NETFILTER_XTABLES
-        depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || NF_CT_ACCT
+        depends on (IP_NF_CONNTRACK && IP_NF_CT_ACCT) || (NF_CT_ACCT && NF_CONNTRACK)
         help
           This option adds a `connbytes' match, which allows you to match the
           number of bytes and/or packets for each direction within a connection.
@@ -200,7 +198,7 @@ config NETFILTER_XT_MATCH_CONNBYTES
 config NETFILTER_XT_MATCH_CONNMARK
         tristate  '"connmark" connection mark match support'
         depends on NETFILTER_XTABLES
-        depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || NF_CONNTRACK_MARK
+        depends on (IP_NF_CONNTRACK && IP_NF_CONNTRACK_MARK) || (NF_CONNTRACK_MARK && NF_CONNTRACK)
         help
           This option adds a `connmark' match, which allows you to match the
           connection mark value previously set for the session by `CONNMARK'. 
@@ -361,3 +359,5 @@ config NETFILTER_XT_MATCH_TCPMSS
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+endmenu
+
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 62bb509f05d4..d622ddf08bb0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -188,7 +188,7 @@ extern struct nf_conntrack_protocol nf_conntrack_generic_protocol;
 struct nf_conntrack_protocol *
 __nf_ct_proto_find(u_int16_t l3proto, u_int8_t protocol)
 {
-        if (unlikely(nf_ct_protos[l3proto] == NULL))
+        if (unlikely(l3proto >= AF_MAX || nf_ct_protos[l3proto] == NULL))
                 return &nf_conntrack_generic_protocol;
 
         return nf_ct_protos[l3proto][protocol];
@@ -1556,6 +1556,8 @@ void nf_conntrack_cleanup(void)
 {
         int i;
 
+        ip_ct_attach = NULL;
+
         /* This makes sure all current packets have passed through
            netfilter framework.  Roll on, two-stage module
            delete... */
@@ -1715,6 +1717,9 @@ int __init nf_conntrack_init(void)
                 nf_ct_l3protos[i] = &nf_conntrack_generic_l3proto;
         write_unlock_bh(&nf_conntrack_lock);
 
+        /* For use by REJECT target */
+        ip_ct_attach = __nf_conntrack_attach;
+
         /* Set up fake conntrack:
             - to never be deleted, not in any hashes */
         atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index ab0c920f0d30..6f210f399762 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -657,8 +657,6 @@ static int __init init(void)
         /* FIXME should be configurable whether IPv4 and IPv6 FTP connections
                  are tracked or not - YK */
         for (i = 0; i < ports_c; i++) {
-                memset(&ftp[i], 0, sizeof(struct nf_conntrack_helper));
-
                 ftp[i][0].tuple.src.l3num = PF_INET;
                 ftp[i][1].tuple.src.l3num = PF_INET6;
                 for (j = 0; j < 2; j++) {
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 73ab16bc7d40..9ff3463037e1 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1232,7 +1232,7 @@ static int ctnetlink_expect_event(struct notifier_block *this,
 
         b = skb->tail;
 
-        type |= NFNL_SUBSYS_CTNETLINK << 8;
+        type |= NFNL_SUBSYS_CTNETLINK_EXP << 8;
         nlh   = NLMSG_PUT(skb, 0, 0, type, sizeof(struct nfgenmsg));
         nfmsg = NLMSG_DATA(nlh);
 
@@ -1589,6 +1589,7 @@ static struct nfnetlink_subsystem ctnl_exp_subsys = {
 };
 
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK);
+MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTNETLINK_EXP);
 
 static int __init ctnetlink_init(void)
 {
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index df99138c3b3b..6492ed66fb3c 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -864,7 +864,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff)
 {
         return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
                                skb->len - dataoff, IPPROTO_TCP,
-                               skb->ip_summed == CHECKSUM_HW ? skb->csum
+                               skb->ip_summed == CHECKSUM_HW
+                               ? csum_sub(skb->csum,
+                                          skb_checksum(skb, 0, dataoff, 0))
                                : skb_checksum(skb, dataoff, skb->len - dataoff,
                                               0));
 }
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 4264dd079a16..831d206344e0 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -161,7 +161,9 @@ static int csum6(const struct sk_buff *skb, unsigned int dataoff)
 {
         return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
                                skb->len - dataoff, IPPROTO_UDP,
-                               skb->ip_summed == CHECKSUM_HW ? skb->csum
+                               skb->ip_summed == CHECKSUM_HW
+                               ? csum_sub(skb->csum,
+                                          skb_checksum(skb, 0, dataoff, 0))
                                : skb_checksum(skb, dataoff, skb->len - dataoff,
                                               0));
 }
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index d3a4f30a7f22..d9f0d7ef103b 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -6,6 +6,7 @@
 #include <linux/skbuff.h>
 #include <linux/netfilter.h>
 #include <linux/seq_file.h>
+#include <linux/rcupdate.h>
 #include <net/protocol.h>
 
 #include "nf_internals.h"
@@ -16,7 +17,7 @@
  * for queueing and must reinject all packets it receives, no matter what.
  */
 static struct nf_queue_handler *queue_handler[NPROTO];
-static struct nf_queue_rerouter *queue_rerouter;
+static struct nf_queue_rerouter *queue_rerouter[NPROTO];
 
 static DEFINE_RWLOCK(queue_handler_lock);
 
@@ -64,7 +65,7 @@ int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
                 return -EINVAL;
 
         write_lock_bh(&queue_handler_lock);
-        memcpy(&queue_rerouter[pf], rer, sizeof(queue_rerouter[pf]));
+        rcu_assign_pointer(queue_rerouter[pf], rer);
         write_unlock_bh(&queue_handler_lock);
 
         return 0;
@@ -77,8 +78,9 @@ int nf_unregister_queue_rerouter(int pf)
                 return -EINVAL;
 
         write_lock_bh(&queue_handler_lock);
-        memset(&queue_rerouter[pf], 0, sizeof(queue_rerouter[pf]));
+        rcu_assign_pointer(queue_rerouter[pf], NULL);
         write_unlock_bh(&queue_handler_lock);
+        synchronize_rcu();
         return 0;
 }
 EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
@@ -114,16 +116,17 @@ int nf_queue(struct sk_buff **skb,
         struct net_device *physindev = NULL;
         struct net_device *physoutdev = NULL;
 #endif
+        struct nf_queue_rerouter *rerouter;
 
         /* QUEUE == DROP if noone is waiting, to be safe. */
         read_lock(&queue_handler_lock);
-        if (!queue_handler[pf] || !queue_handler[pf]->outfn) {
+        if (!queue_handler[pf]) {
                 read_unlock(&queue_handler_lock);
                 kfree_skb(*skb);
                 return 1;
         }
 
-        info = kmalloc(sizeof(*info)+queue_rerouter[pf].rer_size, GFP_ATOMIC);
+        info = kmalloc(sizeof(*info)+queue_rerouter[pf]->rer_size, GFP_ATOMIC);
         if (!info) {
                 if (net_ratelimit())
                         printk(KERN_ERR "OOM queueing packet %p\n",
@@ -155,15 +158,13 @@ int nf_queue(struct sk_buff **skb,
                 if (physoutdev) dev_hold(physoutdev);
         }
 #endif
-        if (queue_rerouter[pf].save)
-                queue_rerouter[pf].save(*skb, info);
+        rerouter = rcu_dereference(queue_rerouter[pf]);
+        if (rerouter)
+                rerouter->save(*skb, info);
 
         status = queue_handler[pf]->outfn(*skb, info, queuenum,
                                           queue_handler[pf]->data);
 
-        if (status >= 0 && queue_rerouter[pf].reroute)
-                status = queue_rerouter[pf].reroute(skb, info);
-
         read_unlock(&queue_handler_lock);
 
         if (status < 0) {
@@ -189,6 +190,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 {
         struct list_head *elem = &info->elem->list;
         struct list_head *i;
+        struct nf_queue_rerouter *rerouter;
 
         rcu_read_lock();
 
@@ -212,7 +214,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
                         break;
         }
   
-        if (elem == &nf_hooks[info->pf][info->hook]) {
+        if (i == &nf_hooks[info->pf][info->hook]) {
                 /* The module which sent it to userspace is gone. */
                 NFDEBUG("%s: module disappeared, dropping packet.\n",
                         __FUNCTION__);
@@ -226,6 +228,12 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
         }
 
         if (verdict == NF_ACCEPT) {
+                rerouter = rcu_dereference(queue_rerouter[info->pf]);
+                if (rerouter && rerouter->reroute(&skb, info) < 0)
+                        verdict = NF_DROP;
+        }
+
+        if (verdict == NF_ACCEPT) {
         next_hook:
                 verdict = nf_iterate(&nf_hooks[info->pf][info->hook],
                                      &skb, info->hook, 
@@ -322,22 +330,12 @@ int __init netfilter_queue_init(void)
 {
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *pde;
-#endif
-        queue_rerouter = kmalloc(NPROTO * sizeof(struct nf_queue_rerouter),
-                                 GFP_KERNEL);
-        if (!queue_rerouter)
-                return -ENOMEM;
 
-#ifdef CONFIG_PROC_FS
         pde = create_proc_entry("nf_queue", S_IRUGO, proc_net_netfilter);
-        if (!pde) {
-                kfree(queue_rerouter);
+        if (!pde)
                 return -1;
-        }
         pde->proc_fops = &nfqueue_file_ops;
 #endif
-        memset(queue_rerouter, 0, NPROTO * sizeof(struct nf_queue_rerouter));
-
         return 0;
 }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index e10512e229b6..3b3c781b40c0 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -37,7 +37,7 @@
 #include "../bridge/br_private.h"
 #endif
 
-#define NFULNL_NLBUFSIZ_DEFAULT 4096
+#define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
 #define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
 
@@ -314,24 +314,28 @@ static struct sk_buff *nfulnl_alloc_skb(unsigned int inst_size,
                                         unsigned int pkt_size)
 {
         struct sk_buff *skb;
+        unsigned int n;
 
         UDEBUG("entered (%u, %u)\n", inst_size, pkt_size);
 
         /* alloc skb which should be big enough for a whole multipart
          * message.  WARNING: has to be <= 128k due to slab restrictions */
 
-        skb = alloc_skb(inst_size, GFP_ATOMIC);
+        n = max(inst_size, pkt_size);
+        skb = alloc_skb(n, GFP_ATOMIC);
         if (!skb) {
                 PRINTR("nfnetlink_log: can't alloc whole buffer (%u bytes)\n",
                         inst_size);
 
-                /* try to allocate only as much as we need for current
-                 * packet */
+                if (n > pkt_size) {
+                        /* try to allocate only as much as we need for current
+                         * packet */
 
-                skb = alloc_skb(pkt_size, GFP_ATOMIC);
-                if (!skb)
-                        PRINTR("nfnetlink_log: can't even alloc %u bytes\n",
-                                pkt_size);
+                        skb = alloc_skb(pkt_size, GFP_ATOMIC);
+                        if (!skb)
+                                PRINTR("nfnetlink_log: can't even alloc %u "
+                                       "bytes\n", pkt_size);
+                }
         }
 
         return skb;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 18ed9c5d209c..2cf5fb8322c4 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -825,7 +825,8 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
         }
 
         if (nfqa[NFQA_MARK-1])
-                skb->nfmark = ntohl(*(u_int32_t *)NFA_DATA(nfqa[NFQA_MARK-1]));
+                entry->skb->nfmark = ntohl(*(u_int32_t *)
+                                           NFA_DATA(nfqa[NFQA_MARK-1]));
                 
         issue_verdict(entry, verdict);
         instance_put(queue);
@@ -927,8 +928,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
 
         if (nfqa[NFQA_CFG_PARAMS-1]) {
                 struct nfqnl_msg_config_params *params;
-                params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
 
+                if (!queue) {
+                        ret = -ENOENT;
+                        goto out_put;
+                }
+                params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
                 nfqnl_set_mode(queue, params->copy_mode,
                                 ntohl(params->copy_range));
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 2101b45d2ec6..59dc7d140600 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -702,7 +702,8 @@ struct sock *netlink_getsockbyfilp(struct file *filp)
  * 0: continue
  * 1: repeat lookup - reference dropped while waiting for socket memory.
  */
-int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long timeo)
+int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock,
+                long timeo, struct sock *ssk)
 {
         struct netlink_sock *nlk;
 
@@ -712,7 +713,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, int nonblock, long t
             test_bit(0, &nlk->state)) {
                 DECLARE_WAITQUEUE(wait, current);
                 if (!timeo) {
-                        if (!nlk->pid)
+                        if (!ssk || nlk_sk(ssk)->pid == 0)
                                 netlink_overrun(sk);
                         sock_put(sk);
                         kfree_skb(skb);
@@ -797,7 +798,7 @@ retry:
                 kfree_skb(skb);
                 return PTR_ERR(sk);
         }
-        err = netlink_attachskb(sk, skb, nonblock, timeo);
+        err = netlink_attachskb(sk, skb, nonblock, timeo, ssk);
         if (err == 1)
                 goto retry;
         if (err)
@@ -1193,6 +1194,9 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
                 msg->msg_namelen = sizeof(*addr);
         }
 
+        if (nlk->flags & NETLINK_RECV_PKTINFO)
+                netlink_cmsg_recv_pktinfo(msg, skb);
+
         if (NULL == siocb->scm) {
                 memset(&scm, 0, sizeof(scm));
                 siocb->scm = &scm;
@@ -1204,8 +1208,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
                 netlink_dump(sk);
 
         scm_recv(sock, msg, siocb->scm, flags);
-        if (nlk->flags & NETLINK_RECV_PKTINFO)
-                netlink_cmsg_recv_pktinfo(msg, skb);
 
 out:
         netlink_rcv_wake(sk);
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 4ae1538c54a9..43e72419c868 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -238,7 +238,7 @@ int genl_register_family(struct genl_family *family)
                                         sizeof(struct nlattr *), GFP_KERNEL);
                 if (family->attrbuf == NULL) {
                         err = -ENOMEM;
-                        goto errout;
+                        goto errout_locked;
                 }
         } else
                 family->attrbuf = NULL;
@@ -288,7 +288,7 @@ int genl_unregister_family(struct genl_family *family)
         return -ENOENT;
 }
 
-static inline int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
                                int *errp)
 {
         struct genl_ops *ops;
@@ -375,7 +375,7 @@ static void genl_rcv(struct sock *sk, int len)
         do {
                 if (genl_trylock())
                         return;
-                netlink_run_queue(sk, &qlen, &genl_rcv_msg);
+                netlink_run_queue(sk, &qlen, genl_rcv_msg);
                 genl_unlock();
         } while (qlen && genl_sock && genl_sock->sk_receive_queue.qlen);
 }
@@ -549,10 +549,8 @@ static int __init genl_init(void)
         netlink_set_nonroot(NETLINK_GENERIC, NL_NONROOT_RECV);
         genl_sock = netlink_kernel_create(NETLINK_GENERIC, GENL_MAX_ID,
                                           genl_rcv, THIS_MODULE);
-        if (genl_sock == NULL) {
+        if (genl_sock == NULL)
                 panic("GENL: Cannot initialize generic netlink\n");
-                return -ENOMEM;
-        }
 
         return 0;
 
@@ -560,7 +558,6 @@ errout_register:
         genl_unregister_family(&genl_ctrl);
 errout:
         panic("GENL: Cannot register controller: %d\n", err);
-        return err;
 }
 
 subsys_initcall(genl_init);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 792ce59940ec..2ffa11c6e8de 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -707,7 +707,7 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
 
 rtattr_failure:
 nlmsg_failure:
-        skb_trim(skb, b - skb->data);
+        kfree_skb(skb);
         return -1;
 }
 
diff --git a/net/socket.c b/net/socket.c
index b38a263853c3..a00851f981db 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2078,7 +2078,7 @@ void socket_seq_show(struct seq_file *seq)
         int cpu;
         int counter = 0;
 
-        for (cpu = 0; cpu < NR_CPUS; cpu++)
+        for_each_cpu(cpu)
                 counter += per_cpu(sockets_in_use, cpu);
 
         /* It can be negative, by the way. 8) */
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d2f0550c4ba0..d78479782045 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -113,7 +113,7 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
 
         err = -EINVAL;
         if (!xprt)
-                goto out_err;
+                goto out_no_xprt;
         if (vers >= program->nrvers || !(version = program->version[vers]))
                 goto out_err;
 
@@ -182,6 +182,7 @@ out_no_path:
         kfree(clnt);
 out_err:
         xprt_destroy(xprt);
+out_no_xprt:
         return ERR_PTR(err);
 }
 
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 802d4fe0f55c..e838d042f7f5 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-        struct rpc_task *task;
-
+        struct rpc_task *task, *next;
         struct list_head *head;
+
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                while (!list_empty(head)) {
-                        task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
+                list_for_each_entry_safe(task, next, head, u.tk_wait.list)
                         __rpc_wake_up_task(task);
-                }
                 if (head == &queue->tasks[0])
                         break;
                 head--;
@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
+        struct rpc_task *task, *next;
         struct list_head *head;
-        struct rpc_task *task;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                while (!list_empty(head)) {
-                        task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
+                list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
                         task->tk_status = status;
                         __rpc_wake_up_task(task);
                 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 1b5989b1b670..c323cc6a28b0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -547,7 +547,7 @@ static struct sock * unix_create1(struct socket *sock)
         struct sock *sk = NULL;
         struct unix_sock *u;
 
-        if (atomic_read(&unix_nr_socks) >= 2*files_stat.max_files)
+        if (atomic_read(&unix_nr_socks) >= 2*get_max_files())
                 goto out;
 
         sk = sk_alloc(PF_UNIX, GFP_KERNEL, &unix_proto, 1);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 077bbf9fb9b7..ae62054a9fc4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -13,7 +13,6 @@
  *
  */
 
-#include <asm/bug.h>
 #include <linux/config.h>
 #include <linux/slab.h>
 #include <linux/kmod.h>
@@ -783,7 +782,7 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
         int nx = 0;
         int err;
         u32 genid;
-        u16 family = dst_orig->ops->family;
+        u16 family;
         u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
         u32 sk_sid = security_sk_sid(sk, fl, dir);
 restart:
@@ -797,13 +796,14 @@ restart:
                 if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
                         return 0;
 
-                policy = flow_cache_lookup(fl, sk_sid, family, dir,
-                                           xfrm_policy_lookup);
+                policy = flow_cache_lookup(fl, sk_sid, dst_orig->ops->family,
+                                           dir, xfrm_policy_lookup);
         }
 
         if (!policy)
                 return 0;
 
+        family = dst_orig->ops->family;
         policy->curlft.use_time = (unsigned long)xtime.tv_sec;
 
         switch (policy->action) {
@@ -886,11 +886,11 @@ restart:
                          * We can't enlist stable bundles either.
                          */
                         write_unlock_bh(&policy->lock);
-
-                        xfrm_pol_put(policy);
                         if (dst)
                                 dst_free(dst);
-                        goto restart;
+
+                        err = -EHOSTUNREACH;
+                        goto error;
                 }
                 dst->next = policy->bundles;
                 policy->bundles = dst;
@@ -996,13 +996,6 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                         struct sec_decap_state *xvec = &(skb->sp->x[i]);
                         if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
                                 return 0;
-
-                        /* If there is a post_input processor, try running it */
-                        if (xvec->xvec->type->post_input &&
-                            (xvec->xvec->type->post_input)(xvec->xvec,
-                                                           &(xvec->decap),
-                                                           skb) != 0)
-                                return 0;
                 }
         }
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e12d0be5f976..c656cbaf35e8 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -220,14 +220,14 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                 x->km.state = XFRM_STATE_DEAD;
                 spin_lock(&xfrm_state_lock);
                 list_del(&x->bydst);
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                 if (x->id.spi) {
                         list_del(&x->byspi);
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
                 }
                 spin_unlock(&xfrm_state_lock);
                 if (del_timer(&x->timer))
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
 
                 /* The number two in this test is the reference
                  * mentioned in the comment below plus the reference
@@ -243,7 +243,7 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                  * The xfrm_state_alloc call gives a reference, and that
                  * is what we are dropping here.
                  */
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                 err = 0;
         }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ac87a09ba83e..7de17559249a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -345,7 +345,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                 goto out;
         }
 
diff --git a/scripts/kconfig/lxdialog/Makefile b/scripts/kconfig/lxdialog/Makefile
index fae3e29fc924..bbf4887cff74 100644
--- a/scripts/kconfig/lxdialog/Makefile
+++ b/scripts/kconfig/lxdialog/Makefile
@@ -2,8 +2,11 @@
 #
 
 check-lxdialog  := $(srctree)/$(src)/check-lxdialog.sh
-HOST_EXTRACFLAGS:= $(shell $(CONFIG_SHELL) $(check-lxdialog) -ccflags)
-HOST_LOADLIBES  := $(shell $(CONFIG_SHELL) $(check-lxdialog) -ldflags $(HOSTCC))
+
+# Use reursively expanded variables so we do not call gcc unless
+# we really need to do so. (Do not call gcc as part of make mrproper)
+HOST_EXTRACFLAGS = $(shell $(CONFIG_SHELL) $(check-lxdialog) -ccflags)
+HOST_LOADLIBES   = $(shell $(CONFIG_SHELL) $(check-lxdialog) -ldflags $(HOSTCC))
  
 HOST_EXTRACFLAGS += -DLOCALE 
 
diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh
index 448e353923f3..120d624e672c 100644
--- a/scripts/kconfig/lxdialog/check-lxdialog.sh
+++ b/scripts/kconfig/lxdialog/check-lxdialog.sh
@@ -4,17 +4,17 @@
 # What library to link
 ldflags()
 {
-        echo "main() {}" | $cc -lncursesw -xc - -o /dev/null 2> /dev/null
+        $cc -print-file-name=libncursesw.so | grep -q /
         if [ $? -eq 0 ]; then
                 echo '-lncursesw'
                 exit
         fi
-        echo "main() {}" | $cc -lncurses -xc - -o /dev/null 2> /dev/null
+        $cc -print-file-name=libncurses.so | grep -q /
         if [ $? -eq 0 ]; then
                 echo '-lncurses'
                 exit
         fi
-        echo "main() {}" | $cc -lcurses -xc - -o /dev/null 2> /dev/null
+        $cc -print-file-name=libcurses.so | grep -q /
         if [ $? -eq 0 ]; then
                 echo '-lcurses'
                 exit
@@ -36,10 +36,13 @@ ccflags()
         fi
 }
 
-compiler=""
+# Temp file, try to clean up after us
+tmp=.lxdialog.tmp
+trap "rm -f $tmp" 0 1 2 3 15
+
 # Check if we can link to ncurses
 check() {
-        echo "main() {}" | $cc -xc - -o /dev/null 2> /dev/null
+        echo "main() {}" | $cc -xc - -o $tmp 2> /dev/null
         if [ $? != 0 ]; then
                 echo " *** Unable to find the ncurses libraries."          1>&2
                 echo " *** make menuconfig require the ncurses libraries"  1>&2
@@ -59,6 +62,7 @@ if [ $# == 0 ]; then
         exit 1
 fi
 
+cc=""
 case "$1" in
         "-check")
                 shift
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index be97caf664bb..c164b230ad6f 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -246,7 +246,7 @@ static int do_ccw_entry(const char *filename,
             id->cu_model);
         ADD(alias, "dt", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_TYPE,
             id->dev_type);
-        ADD(alias, "dm", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_TYPE,
+        ADD(alias, "dm", id->match_flags&CCW_DEVICE_ID_MATCH_DEVICE_MODEL,
             id->dev_model);
         return 1;
 }
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index f70ff13d4818..b8b2a560b26b 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -508,12 +508,7 @@ buf_printf(struct buffer *buf, const char *fmt, ...)
         
         va_start(ap, fmt);
         len = vsnprintf(tmp, SZ, fmt, ap);
-        if (buf->size - buf->pos < len + 1) {
-                buf->size += 128;
-                buf->p = realloc(buf->p, buf->size);
-        }
-        strncpy(buf->p + buf->pos, tmp, len + 1);
-        buf->pos += len;
+        buf_write(buf, tmp, len);
         va_end(ap);
 }
 
@@ -521,7 +516,7 @@ void
 buf_write(struct buffer *buf, const char *s, int len)
 {
         if (buf->size - buf->pos < len) {
-                buf->size += len;
+                buf->size += len + SZ;
                 buf->p = realloc(buf->p, buf->size);
         }
         strncpy(buf->p + buf->pos, s, len);
diff --git a/security/selinux/Kconfig b/security/selinux/Kconfig
index b59582b92283..f636f53ca544 100644
--- a/security/selinux/Kconfig
+++ b/security/selinux/Kconfig
@@ -1,6 +1,6 @@
 config SECURITY_SELINUX
         bool "NSA SELinux Support"
-        depends on SECURITY && NET && INET
+        depends on SECURITY_NETWORK && AUDIT && NET && INET
         default n
         help
           This selects NSA Security-Enhanced Linux (SELinux).
diff --git a/security/selinux/Makefile b/security/selinux/Makefile
index 06d54d9d20a5..688c0a267b62 100644
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -4,9 +4,7 @@
 
 obj-$(CONFIG_SECURITY_SELINUX) := selinux.o ss/
 
-selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o
-
-selinux-$(CONFIG_SECURITY_NETWORK) += netif.o
+selinux-y := avc.o hooks.o selinuxfs.o netlink.o nlmsgtab.o netif.o
 
 selinux-$(CONFIG_SECURITY_NETWORK_XFRM) += xfrm.o
 
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 53d6c7bbf564..ac5d69bb3377 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -43,13 +43,11 @@ static const struct av_perm_to_string
 #undef S_
 };
 
-#ifdef CONFIG_AUDIT
 static const char *class_to_string[] = {
 #define S_(s) s,
 #include "class_to_string.h"
 #undef S_
 };
-#endif
 
 #define TB_(s) static const char * s [] = {
 #define TE_(s) };
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4ae834d89bce..b65c201e9ff5 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -232,7 +232,6 @@ static void superblock_free_security(struct super_block *sb)
         kfree(sbsec);
 }
 
-#ifdef CONFIG_SECURITY_NETWORK
 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 {
         struct sk_security_struct *ssec;
@@ -261,7 +260,6 @@ static void sk_free_security(struct sock *sk)
         sk->sk_security = NULL;
         kfree(ssec);
 }
-#endif  /* CONFIG_SECURITY_NETWORK */
 
 /* The security server must be initialized before
    any labeling or access decisions can be provided. */
@@ -1264,7 +1262,7 @@ static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
 
         rc = task_has_perm(parent, child, PROCESS__PTRACE);
         /* Save the SID of the tracing process for later use in apply_creds. */
-        if (!rc)
+        if (!(child->ptrace & PT_PTRACED) && !rc)
                 csec->ptrace_sid = psec->sid;
         return rc;
 }
@@ -2736,8 +2734,6 @@ static void selinux_task_to_inode(struct task_struct *p,
         return;
 }
 
-#ifdef CONFIG_SECURITY_NETWORK
-
 /* Returns error only if unable to parse addresses */
 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
 {
@@ -3556,15 +3552,6 @@ static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
 
 #endif  /* CONFIG_NETFILTER */
 
-#else
-
-static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
-{
-        return 0;
-}
-
-#endif  /* CONFIG_SECURITY_NETWORK */
-
 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
         struct task_security_struct *tsec;
@@ -4340,7 +4327,6 @@ static struct security_operations selinux_ops = {
         .getprocattr =                  selinux_getprocattr,
         .setprocattr =                  selinux_setprocattr,
 
-#ifdef CONFIG_SECURITY_NETWORK
         .unix_stream_connect =          selinux_socket_unix_stream_connect,
         .unix_may_send =                selinux_socket_unix_may_send,
 
@@ -4362,7 +4348,6 @@ static struct security_operations selinux_ops = {
         .sk_alloc_security =            selinux_sk_alloc_security,
         .sk_free_security =             selinux_sk_free_security,
         .sk_getsid =                    selinux_sk_getsid_security,
-#endif
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
@@ -4440,7 +4425,7 @@ next_sb:
    all processes and objects when they are created. */
 security_initcall(selinux_init);
 
-#if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
+#if defined(CONFIG_NETFILTER)
 
 static struct nf_hook_ops selinux_ipv4_op = {
         .hook =         selinux_ipv4_postroute_last,
@@ -4501,13 +4486,13 @@ static void selinux_nf_ip_exit(void)
 }
 #endif
 
-#else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
+#else /* CONFIG_NETFILTER */
 
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 #define selinux_nf_ip_exit()
 #endif
 
-#endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
+#endif /* CONFIG_NETFILTER */
 
 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
 int selinux_disable(void)
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 54147c1f6361..149feb410654 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -882,14 +882,20 @@ static int __devinit aaci_probe(struct amba_device *dev, void *id)
         writel(0x1fff, aaci->base + AACI_INTCLR);
         writel(aaci->maincr, aaci->base + AACI_MAINCR);
 
+        ret = aaci_probe_ac97(aaci);
+        if (ret)
+                goto out;
+
         /*
-         * Size the FIFOs.
+         * Size the FIFOs (must be multiple of 16).
          */
         aaci->fifosize = aaci_size_fifo(aaci);
-
-        ret = aaci_probe_ac97(aaci);
-        if (ret)
+        if (aaci->fifosize & 15) {
+                printk(KERN_WARNING "AACI: fifosize = %d not supported\n",
+                       aaci->fifosize);
+                ret = -ENODEV;
                 goto out;
+        }
 
         ret = aaci_init_pcm(aaci);
         if (ret)
diff --git a/sound/core/control.c b/sound/core/control.c
index abd62f943726..0c29679a8576 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -959,17 +959,15 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
         kctl.private_free = snd_ctl_elem_user_free;
         _kctl = snd_ctl_new(&kctl, access);
         if (_kctl == NULL) {
-                kfree(_kctl->private_data);
+                kfree(ue);
                 return -ENOMEM;
         }
         _kctl->private_data = ue;
         for (idx = 0; idx < _kctl->count; idx++)
                 _kctl->vd[idx].owner = file;
         err = snd_ctl_add(card, _kctl);
-        if (err < 0) {
-                snd_ctl_free_one(_kctl);
+        if (err < 0)
                 return err;
-        }
 
         down_write(&card->controls_rwsem);
         card->user_ctl_count++;
diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 418c6d4e5daf..a529b62972b4 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -167,7 +167,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
                         int *countp)
 {
         struct snd_kcontrol *kctl;
-        struct snd_ctl_elem_info info;
+        struct snd_ctl_elem_info *info;
         int err;
 
         down_read(&card->controls_rwsem);
@@ -176,13 +176,19 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
                 up_read(&card->controls_rwsem);
                 return -ENXIO;
         }
-        info.id = *id;
-        err = kctl->info(kctl, &info);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (info == NULL) {
+                up_read(&card->controls_rwsem);
+                return -ENOMEM;
+        }
+        info->id = *id;
+        err = kctl->info(kctl, info);
         up_read(&card->controls_rwsem);
         if (err >= 0) {
-                err = info.type;
-                *countp = info.count;
+                err = info->type;
+                *countp = info->count;
         }
+        kfree(info);
         return err;
 }
 
diff --git a/sound/drivers/opl3/opl3_oss.c b/sound/drivers/opl3/opl3_oss.c
index 31f1f2e25aa0..0345ae647681 100644
--- a/sound/drivers/opl3/opl3_oss.c
+++ b/sound/drivers/opl3/opl3_oss.c
@@ -146,7 +146,7 @@ void snd_opl3_init_seq_oss(struct snd_opl3 *opl3, char *name)
 void snd_opl3_free_seq_oss(struct snd_opl3 *opl3)
 {
         if (opl3->oss_seq_dev) {
-                snd_device_free(opl3->card, opl3->oss_seq_dev);
+                /* The instance should have been released in prior */
                 opl3->oss_seq_dev = NULL;
         }
 }
diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
index 4fa431040564..99a42138bea0 100644
--- a/sound/isa/cs423x/cs4236.c
+++ b/sound/isa/cs423x/cs4236.c
@@ -414,7 +414,7 @@ static int __devinit snd_card_cs423x_pnpc(int dev, struct snd_card_cs4236 *acard
         }
         /* MPU initialization */
         if (acard->mpu && mpu_port[dev] > 0) {
-                if (snd_cs423x_pnp_init_mpu(dev, acard->ctrl, cfg) < 0)
+                if (snd_cs423x_pnp_init_mpu(dev, acard->mpu, cfg) < 0)
                         goto error;
         }
         kfree(cfg);
diff --git a/sound/oss/dmasound/tas_common.h b/sound/oss/dmasound/tas_common.h
index 3a6d48666db0..0741c28e56ce 100644
--- a/sound/oss/dmasound/tas_common.h
+++ b/sound/oss/dmasound/tas_common.h
@@ -178,10 +178,10 @@ tas_write_register(	struct tas_data_t *self,
         if (write_mode & WRITE_SHADOW)
                 memcpy(self->shadow[reg_num],data,reg_width);
         if (write_mode & WRITE_HW) {
-                rc=i2c_smbus_write_block_data(self->client,
-                                              reg_num,
-                                              reg_width,
-                                              data);
+                rc=i2c_smbus_write_i2c_block_data(self->client,
+                                                  reg_num,
+                                                  reg_width,
+                                                  data);
                 if (rc < 0) {
                         printk("tas: I2C block write failed \n");  
                         return rc; 
@@ -199,10 +199,10 @@ tas_sync_register(	struct tas_data_t *self,
 
         if (reg_width==0 || self==NULL)
                 return -EINVAL;
-        rc=i2c_smbus_write_block_data(self->client,
-                                      reg_num,
-                                      reg_width,
-                                      self->shadow[reg_num]);
+        rc=i2c_smbus_write_i2c_block_data(self->client,
+                                          reg_num,
+                                          reg_width,
+                                          self->shadow[reg_num]);
         if (rc < 0) {
                 printk("tas: I2C block write failed \n");
                 return rc;
diff --git a/sound/oss/emu10k1/recmgr.c b/sound/oss/emu10k1/recmgr.c
index 67c3fd04cfdd..2ce56180e7d4 100644
--- a/sound/oss/emu10k1/recmgr.c
+++ b/sound/oss/emu10k1/recmgr.c
@@ -29,7 +29,7 @@
  **********************************************************************
  */
 
-#include <asm/delay.h>
+#include <linux/delay.h>
 #include "8010.h"
 #include "recmgr.h"
 
diff --git a/sound/ppc/pmac.c b/sound/ppc/pmac.c
index 4988f873a7ba..aa57170101fd 100644
--- a/sound/ppc/pmac.c
+++ b/sound/ppc/pmac.c
@@ -66,7 +66,7 @@ static int snd_pmac_dbdma_alloc(struct snd_pmac *chip, struct pmac_dbdma *rec, i
 
 static void snd_pmac_dbdma_free(struct snd_pmac *chip, struct pmac_dbdma *rec)
 {
-        if (rec) {
+        if (rec->space) {
                 unsigned int rsize = sizeof(struct dbdma_cmd) * (rec->size + 1);
 
                 dma_free_coherent(&chip->pdev->dev, rsize, rec->space, rec->dma_base);
@@ -881,6 +881,7 @@ static int __init snd_pmac_detect(struct snd_pmac *chip)
         chip->can_capture = 1;
         chip->num_freqs = ARRAY_SIZE(awacs_freqs);
         chip->freq_table = awacs_freqs;
+        chip->pdev = NULL;
 
         chip->control_mask = MASK_IEPC | MASK_IEE | 0x11; /* default */
 
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 15c63cb2ccba..838fc113c441 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -239,8 +239,8 @@ static int tumbler_set_master_volume(struct pmac_tumbler *mix)
         block[4] = (right_vol >> 8)  & 0xff;
         block[5] = (right_vol >> 0)  & 0xff;
   
-        if (i2c_smbus_write_block_data(mix->i2c.client, TAS_REG_VOL,
-                                       6, block) < 0) {
+        if (i2c_smbus_write_i2c_block_data(mix->i2c.client, TAS_REG_VOL, 6,
+                                           block) < 0) {
                 snd_printk("failed to set volume \n");
                 return -EINVAL;
         }
@@ -345,8 +345,8 @@ static int tumbler_set_drc(struct pmac_tumbler *mix)
                 val[1] = 0;
         }
 
-        if (i2c_smbus_write_block_data(mix->i2c.client, TAS_REG_DRC,
-                                       2, val) < 0) {
+        if (i2c_smbus_write_i2c_block_data(mix->i2c.client, TAS_REG_DRC,
+                                           2, val) < 0) {
                 snd_printk("failed to set DRC\n");
                 return -EINVAL;
         }
@@ -381,8 +381,8 @@ static int snapper_set_drc(struct pmac_tumbler *mix)
         val[4] = 0x60;
         val[5] = 0xa0;
 
-        if (i2c_smbus_write_block_data(mix->i2c.client, TAS_REG_DRC,
-                                       6, val) < 0) {
+        if (i2c_smbus_write_i2c_block_data(mix->i2c.client, TAS_REG_DRC,
+                                           6, val) < 0) {
                 snd_printk("failed to set DRC\n");
                 return -EINVAL;
         }
@@ -492,8 +492,8 @@ static int tumbler_set_mono_volume(struct pmac_tumbler *mix,
         vol = info->table[vol];
         for (i = 0; i < info->bytes; i++)
                 block[i] = (vol >> ((info->bytes - i - 1) * 8)) & 0xff;
-        if (i2c_smbus_write_block_data(mix->i2c.client, info->reg,
-                                       info->bytes, block) < 0) {
+        if (i2c_smbus_write_i2c_block_data(mix->i2c.client, info->reg,
+                                           info->bytes, block) < 0) {
                 snd_printk("failed to set mono volume %d\n", info->index);
                 return -EINVAL;
         }
@@ -625,7 +625,8 @@ static int snapper_set_mix_vol1(struct pmac_tumbler *mix, int idx, int ch, int r
                 for (j = 0; j < 3; j++)
                         block[i * 3 + j] = (vol >> ((2 - j) * 8)) & 0xff;
         }
-        if (i2c_smbus_write_block_data(mix->i2c.client, reg, 9, block) < 0) {
+        if (i2c_smbus_write_i2c_block_data(mix->i2c.client, reg,
+                                           9, block) < 0) {
                 snd_printk("failed to set mono volume %d\n", reg);
                 return -EINVAL;
         }