Merge branch 'upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/netdev-2.6

336 files changed, 4125 insertions, 4198 deletions

diff --git a/Documentation/cpu-hotplug.txt b/Documentation/cpu-hotplug.txt
index 08c5d04f3086..57a09f99ecb0 100644
--- a/Documentation/cpu-hotplug.txt
+++ b/Documentation/cpu-hotplug.txt
@@ -11,6 +11,8 @@
                         Joel Schopp <jschopp@austin.ibm.com>
                 ia64/x86_64:
                         Ashok Raj <ashok.raj@intel.com>
+                s390:
+                        Heiko Carstens <heiko.carstens@de.ibm.com>
 
 Authors: Ashok Raj <ashok.raj@intel.com>
 Lots of feedback: Nathan Lynch <nathanl@austin.ibm.com>,
@@ -44,9 +46,28 @@ maxcpus=n    Restrict boot time cpus to n. Say if you have 4 cpus, using
              maxcpus=2 will only boot 2. You can choose to bring the
              other cpus later online, read FAQ's for more info.
 
-additional_cpus=n       [x86_64 only] use this to limit hotpluggable cpus.
-                        This option sets
-                        cpu_possible_map = cpu_present_map + additional_cpus
+additional_cpus*=n      Use this to limit hotpluggable cpus. This option sets
+                        cpu_possible_map = cpu_present_map + additional_cpus
+
+(*) Option valid only for following architectures
+- x86_64, ia64, s390
+
+ia64 and x86_64 use the number of disabled local apics in ACPI tables MADT
+to determine the number of potentially hot-pluggable cpus. The implementation
+should only rely on this to count the #of cpus, but *MUST* not rely on the
+apicid values in those tables for disabled apics. In the event BIOS doesnt
+mark such hot-pluggable cpus as disabled entries, one could use this
+parameter "additional_cpus=x" to represent those cpus in the cpu_possible_map.
+
+s390 uses the number of cpus it detects at IPL time to also the number of bits
+in cpu_possible_map. If it is desired to add additional cpus at a later time
+the number should be specified using this option or the possible_cpus option.
+
+possible_cpus=n         [s390 only] use this to set hotpluggable cpus.
+                        This option sets possible_cpus bits in
+                        cpu_possible_map. Thus keeping the numbers of bits set
+                        constant even if the machine gets rebooted.
+                        This option overrides additional_cpus.
 
 CPU maps and such
 -----------------
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 79f0ed9f60de..975e14e150ae 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -178,3 +178,12 @@ Why:	The ISA interface is faster and should be always available. The I2C
         probing is also known to cause trouble in at least one case (see
         bug #5889.)
 Who:    Jean Delvare <khali@linux-fr.org>
+
+---------------------------
+
+What:   mount/umount uevents
+When:   February 2007
+Why:    These events are not correct, and do not properly let userspace know
+        when a file system has been mounted or unmounted.  Userspace should
+        poll the /proc/mounts file instead to detect this properly.
+Who:    Greg Kroah-Hartman <gregkh@suse.de>
diff --git a/Documentation/filesystems/ntfs.txt b/Documentation/filesystems/ntfs.txt
index 614de3124901..251168587899 100644
--- a/Documentation/filesystems/ntfs.txt
+++ b/Documentation/filesystems/ntfs.txt
@@ -457,6 +457,12 @@ ChangeLog
 
 Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
 
+2.1.26:
+        - Implement support for sector sizes above 512 bytes (up to the maximum
+          supported by NTFS which is 4096 bytes).
+        - Enhance support for NTFS volumes which were supported by Windows but
+          not by Linux due to invalid attribute list attribute flags.
+        - A few minor updates and bug fixes.
 2.1.25:
         - Write support is now extended with write(2) being able to both
           overwrite existing file data and to extend files.  Also, if a write
diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
index dbe4d87d2615..1773106976a2 100644
--- a/Documentation/filesystems/tmpfs.txt
+++ b/Documentation/filesystems/tmpfs.txt
@@ -79,15 +79,27 @@ that instance in a system with many cpus making intensive use of it.
 
 
 tmpfs has a mount option to set the NUMA memory allocation policy for
-all files in that instance:
-mpol=interleave         prefers to allocate memory from each node in turn
-mpol=default            prefers to allocate memory from the local node
-mpol=bind               prefers to allocate from mpol_nodelist
-mpol=preferred          prefers to allocate from first node in mpol_nodelist
+all files in that instance (if CONFIG_NUMA is enabled) - which can be
+adjusted on the fly via 'mount -o remount ...'
 
-The following mount option is used in conjunction with mpol=interleave,
-mpol=bind or mpol=preferred:
-mpol_nodelist:  nodelist suitable for parsing with nodelist_parse.
+mpol=default             prefers to allocate memory from the local node
+mpol=prefer:Node         prefers to allocate memory from the given Node
+mpol=bind:NodeList       allocates memory only from nodes in NodeList
+mpol=interleave          prefers to allocate from each node in turn
+mpol=interleave:NodeList allocates from each node of NodeList in turn
+
+NodeList format is a comma-separated list of decimal numbers and ranges,
+a range being two hyphen-separated decimal numbers, the smallest and
+largest node numbers in the range.  For example, mpol=bind:0-3,5,7,9-15
+
+Note that trying to mount a tmpfs with an mpol option will fail if the
+running kernel does not support NUMA; and will fail if its nodelist
+specifies a node >= MAX_NUMNODES.  If your system relies on that tmpfs
+being mounted, but from time to time runs a kernel built without NUMA
+capability (perhaps a safe recovery kernel), or configured to support
+fewer nodes, then it is advisable to omit the mpol option from automatic
+mount options.  It can be added later, when the tmpfs is already mounted
+on MountPoint, by 'mount -o remount,mpol=Policy:NodeList MountPoint'.
 
 
 To specify the initial root directory you can use the following mount
@@ -109,4 +121,4 @@ RAM/SWAP in 10240 inodes and it is only accessible by root.
 Author:
    Christoph Rohland <cr@sap.com>, 1.12.01
 Updated:
-   Hugh Dickins <hugh@veritas.com>, 13 March 2005
+   Hugh Dickins <hugh@veritas.com>, 19 February 2006
diff --git a/Documentation/filesystems/v9fs.txt b/Documentation/filesystems/v9fs.txt
index 4e92feb6b507..24c7a9c41f0d 100644
--- a/Documentation/filesystems/v9fs.txt
+++ b/Documentation/filesystems/v9fs.txt
@@ -57,8 +57,6 @@ OPTIONS
 
   port=n        port to connect to on the remote server
 
-  timeout=n     request timeouts (in ms) (default 60000ms)
-
   noextend      force legacy mode (no 9P2000.u semantics)
 
   uid           attempt to mount as a particular uid
@@ -74,10 +72,16 @@ OPTIONS
 RESOURCES
 =========
 
-The Linux version of the 9P server, along with some client-side utilities
-can be found at http://v9fs.sf.net (along with a CVS repository of the
-development branch of this module).  There are user and developer mailing
-lists here, as well as a bug-tracker.
+The Linux version of the 9P server is now maintained under the npfs project
+on sourceforge (http://sourceforge.net/projects/npfs).
+
+There are user and developer mailing lists available through the v9fs project
+on sourceforge (http://sourceforge.net/projects/v9fs).
+
+News and other information is maintained on SWiK (http://swik.net/v9fs).
+
+Bug reports may be issued through the kernel.org bugzilla 
+(http://bugzilla.kernel.org)
 
 For more information on the Plan 9 Operating System check out
 http://plan9.bell-labs.com/plan9
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index ac75b57edf2e..b874771385cd 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1638,6 +1638,9 @@ running once the system is up.
                         Format:
                         <irq>,<irq_mask>,<io>,<full_duplex>,<do_sound>,<lockup_hack>[,<irq2>[,<irq3>[,<irq4>]]]
 
+        norandmaps      Don't use address space randomization
+                        Equivalent to echo 0 > /proc/sys/kernel/randomize_va_space
+
 
 ______________________________________________________________________
 Changelog:
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 9f11d36a8c10..b0c7ab93dcb9 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -16,6 +16,7 @@ before actually making adjustments.
 
 Currently, these files might (depending on your configuration)
 show up in /proc/sys/kernel:
+- acpi_video_flags
 - acct
 - core_pattern
 - core_uses_pid
@@ -57,6 +58,15 @@ show up in /proc/sys/kernel:
 
 ==============================================================
 
+acpi_video_flags:
+
+flags
+
+See Doc*/kernel/power/video.txt, it allows mode of video boot to be
+set during run time.
+
+==============================================================
+
 acct:
 
 highwater lowwater frequency
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 153740f460a6..1921353259ae 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -52,6 +52,10 @@ APICs
                  apicmaintimer. Useful when your PIT timer is totally
                  broken.
 
+   disable_8254_timer / enable_8254_timer
+                 Enable interrupt 0 timer routing over the 8254 in addition to over
+                 the IO-APIC. The kernel tries to set a sensible default.
+
 Early Console
 
    syntax: earlyprintk=vga
diff --git a/Makefile b/Makefile
index 48d569d46ae1..46eea76bc570 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 16
-EXTRAVERSION =-rc3
+EXTRAVERSION =-rc5
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
diff --git a/arch/arm/common/rtctime.c b/arch/arm/common/rtctime.c
index 48b1e19b131f..e851d86c212c 100644
--- a/arch/arm/common/rtctime.c
+++ b/arch/arm/common/rtctime.c
@@ -128,19 +128,27 @@ EXPORT_SYMBOL(rtc_tm_to_time);
 /*
  * Calculate the next alarm time given the requested alarm time mask
  * and the current time.
- *
- * FIXME: for now, we just copy the alarm time because we're lazy (and
- * is therefore buggy - setting a 10am alarm at 8pm will not result in
- * the alarm triggering.)
  */
 void rtc_next_alarm_time(struct rtc_time *next, struct rtc_time *now, struct rtc_time *alrm)
 {
+        unsigned long next_time;
+        unsigned long now_time;
+
         next->tm_year = now->tm_year;
         next->tm_mon = now->tm_mon;
         next->tm_mday = now->tm_mday;
         next->tm_hour = alrm->tm_hour;
         next->tm_min = alrm->tm_min;
         next->tm_sec = alrm->tm_sec;
+
+        rtc_tm_to_time(now, &now_time);
+        rtc_tm_to_time(next, &next_time);
+
+        if (next_time < now_time) {
+                /* Advance one day */
+                next_time += 60 * 60 * 24;
+                rtc_time_to_tm(next_time, next);
+        }
 }
 
 static inline int rtc_read_time(struct rtc_ops *ops, struct rtc_time *tm)
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 8c3035d5ffc9..3173924a9b60 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -111,7 +111,7 @@
                 CALL(sys_statfs)
 /* 100 */       CALL(sys_fstatfs)
                 CALL(sys_ni_syscall)
-                CALL(OBSOLETE(sys_socketcall))
+                CALL(OBSOLETE(ABI(sys_socketcall, sys_oabi_socketcall)))
                 CALL(sys_syslog)
                 CALL(sys_setitimer)
 /* 105 */       CALL(sys_getitimer)
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 964cd717506b..ec48d70c6d8b 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -566,7 +566,7 @@ ENTRY(__switch_to)
         ldr     r6, [r2, #TI_CPU_DOMAIN]!
 #endif
 #if __LINUX_ARM_ARCH__ >= 6
-#ifdef CONFIG_CPU_MPCORE
+#ifdef CONFIG_CPU_32v6K
         clrex
 #else
         strex   r5, r4, [ip]                    @ Clear exclusive monitor
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index c45d10d07bde..68273b4dc882 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -23,6 +23,7 @@
 #include <linux/root_dev.h>
 #include <linux/cpu.h>
 #include <linux/interrupt.h>
+#include <linux/smp.h>
 
 #include <asm/cpu.h>
 #include <asm/elf.h>
@@ -771,6 +772,10 @@ void __init setup_arch(char **cmdline_p)
         paging_init(&meminfo, mdesc);
         request_standard_resources(&meminfo, mdesc);
 
+#ifdef CONFIG_SMP
+        smp_init_cpus();
+#endif
+
         cpu_init();
 
         /*
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 7338948bd7d3..02aa300c4633 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -338,7 +338,6 @@ void __init smp_prepare_boot_cpu(void)
 
         per_cpu(cpu_data, cpu).idle = current;
 
-        cpu_set(cpu, cpu_possible_map);
         cpu_set(cpu, cpu_present_map);
         cpu_set(cpu, cpu_online_map);
 }
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 9d4b76409c64..8e2f9bc3368b 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -64,6 +64,7 @@
  * sys_connect:
  * sys_sendmsg:
  * sys_sendto:
+ * sys_socketcall:
  *
  *   struct sockaddr_un loses its padding with EABI.  Since the size of the
  *   structure is used as a validation test in unix_mkname(), we need to
@@ -78,6 +79,7 @@
 #include <linux/eventpoll.h>
 #include <linux/sem.h>
 #include <linux/socket.h>
+#include <linux/net.h>
 #include <asm/ipc.h>
 #include <asm/uaccess.h>
 
@@ -408,3 +410,31 @@ asmlinkage long sys_oabi_sendmsg(int fd, struct msghdr __user *msg, unsigned fla
         return sys_sendmsg(fd, msg, flags);
 }
 
+asmlinkage long sys_oabi_socketcall(int call, unsigned long __user *args)
+{
+        unsigned long r = -EFAULT, a[6];
+
+        switch (call) {
+        case SYS_BIND:
+                if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
+                        r = sys_oabi_bind(a[0], (struct sockaddr __user *)a[1], a[2]);
+                break;
+        case SYS_CONNECT:
+                if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
+                        r = sys_oabi_connect(a[0], (struct sockaddr __user *)a[1], a[2]);
+                break;
+        case SYS_SENDTO:
+                if (copy_from_user(a, args, 6 * sizeof(long)) == 0)
+                        r = sys_oabi_sendto(a[0], (void __user *)a[1], a[2], a[3],
+                                            (struct sockaddr __user *)a[4], a[5]);
+                break;
+        case SYS_SENDMSG:
+                if (copy_from_user(a, args, 3 * sizeof(long)) == 0)
+                        r = sys_oabi_sendmsg(a[0], (struct msghdr __user *)a[1], a[2]);
+                break;
+        default:
+                r = sys_socketcall(call, args);
+        }
+
+        return r;
+}
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 10235b01582e..03924bcc6129 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -19,6 +19,7 @@
 #include <linux/personality.h>
 #include <linux/ptrace.h>
 #include <linux/kallsyms.h>
+#include <linux/delay.h>
 #include <linux/init.h>
 
 #include <asm/atomic.h>
@@ -231,6 +232,13 @@ NORET_TYPE void die(const char *str, struct pt_regs *regs, int err)
         __die(str, err, thread, regs);
         bust_spinlocks(0);
         spin_unlock_irq(&die_lock);
+
+        if (panic_on_oops) {
+                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
+                ssleep(5);
+                panic("Fatal exception");
+        }
+
         do_exit(SIGSEGV);
 }
 
diff --git a/arch/arm/mach-at91rm9200/devices.c b/arch/arm/mach-at91rm9200/devices.c
index 8df3e5245651..57eedd5beaf6 100644
--- a/arch/arm/mach-at91rm9200/devices.c
+++ b/arch/arm/mach-at91rm9200/devices.c
@@ -100,8 +100,10 @@ void __init at91_add_device_udc(struct at91_udc_data *data)
                 at91_set_gpio_input(data->vbus_pin, 0);
                 at91_set_deglitch(data->vbus_pin, 1);
         }
-        if (data->pullup_pin)
+        if (data->pullup_pin) {
                 at91_set_gpio_output(data->pullup_pin, 0);
+                at91_set_multi_drive(data->pullup_pin, 1);
+        }
 
         udc_data = *data;
         platform_device_register(&at91rm9200_udc_device);
diff --git a/arch/arm/mach-at91rm9200/gpio.c b/arch/arm/mach-at91rm9200/gpio.c
index 2fd2ef583e4d..0e396feec468 100644
--- a/arch/arm/mach-at91rm9200/gpio.c
+++ b/arch/arm/mach-at91rm9200/gpio.c
@@ -159,6 +159,23 @@ int __init_or_module at91_set_deglitch(unsigned pin, int is_on)
 }
 EXPORT_SYMBOL(at91_set_deglitch);
 
+/*
+ * enable/disable the multi-driver; This is only valid for output and
+ * allows the output pin to run as an open collector output.
+ */
+int __init_or_module at91_set_multi_drive(unsigned pin, int is_on)
+{
+        void __iomem    *pio = pin_to_controller(pin);
+        unsigned        mask = pin_to_mask(pin);
+
+        if (!pio)
+                return -EINVAL;
+
+        __raw_writel(mask, pio + (is_on ? PIO_MDER : PIO_MDDR));
+        return 0;
+}
+EXPORT_SYMBOL(at91_set_multi_drive);
+
 /*--------------------------------------------------------------------------*/
 
 
@@ -257,8 +274,18 @@ static void gpio_irq_handler(unsigned irq, struct irqdesc *desc, struct pt_regs
                 gpio = &irq_desc[pin];
 
                 while (isr) {
-                        if (isr & 1)
-                                gpio->handle(pin, gpio, regs);
+                        if (isr & 1) {
+                                if (unlikely(gpio->disable_depth)) {
+                                        /*
+                                         * The core ARM interrupt handler lazily disables IRQs so
+                                         * another IRQ must be generated before it actually gets
+                                         * here to be disabled on the GPIO controller.
+                                         */
+                                        gpio_irq_mask(pin);
+                                }
+                                else
+                                        gpio->handle(pin, gpio, regs);
+                        }
                         pin++;
                         gpio++;
                         isr >>= 1;
diff --git a/arch/arm/mach-integrator/platsmp.c b/arch/arm/mach-integrator/platsmp.c
index ea10bd8c972c..1bc8534ef0c6 100644
--- a/arch/arm/mach-integrator/platsmp.c
+++ b/arch/arm/mach-integrator/platsmp.c
@@ -140,6 +140,18 @@ static void __init poke_milo(void)
         mb();
 }
 
+/*
+ * Initialise the CPU possible map early - this describes the CPUs
+ * which may be present or become present in the system.
+ */
+void __init smp_init_cpus(void)
+{
+        unsigned int i, ncores = get_core_count();
+
+        for (i = 0; i < ncores; i++)
+                cpu_set(i, cpu_possible_map);
+}
+
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned int ncores = get_core_count();
@@ -176,14 +188,11 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
                 max_cpus = ncores;
 
         /*
-         * Initialise the possible/present maps.
-         * cpu_possible_map describes the set of CPUs which may be present
-         * cpu_present_map describes the set of CPUs populated
+         * Initialise the present map, which describes the set of CPUs
+         * actually populated at the present time.
          */
-        for (i = 0; i < max_cpus; i++) {
-                cpu_set(i, cpu_possible_map);
+        for (i = 0; i < max_cpus; i++)
                 cpu_set(i, cpu_present_map);
-        }
 
         /*
          * Do we need any more CPUs? If so, then let them know where
diff --git a/arch/arm/mach-iop3xx/iop321-setup.c b/arch/arm/mach-iop3xx/iop321-setup.c
index e4f4c52d93d4..0ebbcb20c6ae 100644
--- a/arch/arm/mach-iop3xx/iop321-setup.c
+++ b/arch/arm/mach-iop3xx/iop321-setup.c
@@ -13,7 +13,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/config.h>
-#include <linux/init.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
diff --git a/arch/arm/mach-iop3xx/iop331-setup.c b/arch/arm/mach-iop3xx/iop331-setup.c
index 63585485123e..2d6abe5be14d 100644
--- a/arch/arm/mach-iop3xx/iop331-setup.c
+++ b/arch/arm/mach-iop3xx/iop331-setup.c
@@ -12,7 +12,6 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/config.h>
-#include <linux/init.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/platform_device.h>
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 4bdc9d4526cd..fbadf3021b9e 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -111,24 +111,30 @@ static int ixp4xx_set_irq_type(unsigned int irq, unsigned int type)
         if (line < 0)
                 return -EINVAL;
 
-        if (type & IRQT_BOTHEDGE) {
+        switch (type){
+        case IRQT_BOTHEDGE:
                 int_style = IXP4XX_GPIO_STYLE_TRANSITIONAL;
                 irq_type = IXP4XX_IRQ_EDGE;
-        } else  if (type & IRQT_RISING) {
+                break;
+        case IRQT_RISING:
                 int_style = IXP4XX_GPIO_STYLE_RISING_EDGE;
                 irq_type = IXP4XX_IRQ_EDGE;
-        } else if (type & IRQT_FALLING) {
+                break;
+        case IRQT_FALLING:
                 int_style = IXP4XX_GPIO_STYLE_FALLING_EDGE;
                 irq_type = IXP4XX_IRQ_EDGE;
-        } else if (type & IRQT_HIGH) {
+                break;
+        case IRQT_HIGH:
                 int_style = IXP4XX_GPIO_STYLE_ACTIVE_HIGH;
                 irq_type = IXP4XX_IRQ_LEVEL;
-        } else if (type & IRQT_LOW) {
+                break;
+        case IRQT_LOW:
                 int_style = IXP4XX_GPIO_STYLE_ACTIVE_LOW;
                 irq_type = IXP4XX_IRQ_LEVEL;
-        } else
+                break;
+        default:
                 return -EINVAL;
-
+        }
         ixp4xx_config_irq(irq, irq_type);
 
         if (line >= 8) {        /* pins 8-15 */
diff --git a/arch/arm/mach-ixp4xx/nslu2-power.c b/arch/arm/mach-ixp4xx/nslu2-power.c
index b0ad9e901f6e..d80c362bc539 100644
--- a/arch/arm/mach-ixp4xx/nslu2-power.c
+++ b/arch/arm/mach-ixp4xx/nslu2-power.c
@@ -77,6 +77,9 @@ static int __init nslu2_power_init(void)
 
 static void __exit nslu2_power_exit(void)
 {
+        if (!(machine_is_nslu2()))
+                return;
+
         free_irq(NSLU2_RB_IRQ, NULL);
         free_irq(NSLU2_PB_IRQ, NULL);
 }
diff --git a/arch/arm/mach-ixp4xx/nslu2-setup.c b/arch/arm/mach-ixp4xx/nslu2-setup.c
index da9340a53434..55411f21d838 100644
--- a/arch/arm/mach-ixp4xx/nslu2-setup.c
+++ b/arch/arm/mach-ixp4xx/nslu2-setup.c
@@ -27,8 +27,6 @@ static struct flash_platform_data nslu2_flash_data = {
 };
 
 static struct resource nslu2_flash_resource = {
-        .start                  = NSLU2_FLASH_BASE,
-        .end                    = NSLU2_FLASH_BASE + NSLU2_FLASH_SIZE,
         .flags                  = IORESOURCE_MEM,
 };
 
@@ -52,6 +50,12 @@ static struct platform_device nslu2_i2c_controller = {
         .num_resources          = 0,
 };
 
+static struct platform_device nslu2_beeper = {
+        .name                   = "ixp4xx-beeper",
+        .id                     = NSLU2_GPIO_BUZZ,
+        .num_resources          = 0,
+};
+
 static struct resource nslu2_uart_resources[] = {
         {
                 .start          = IXP4XX_UART1_BASE_PHYS,
@@ -99,6 +103,7 @@ static struct platform_device *nslu2_devices[] __initdata = {
         &nslu2_i2c_controller,
         &nslu2_flash,
         &nslu2_uart,
+        &nslu2_beeper,
 };
 
 static void nslu2_power_off(void)
@@ -116,6 +121,10 @@ static void __init nslu2_init(void)
 {
         ixp4xx_sys_init();
 
+        nslu2_flash_resource.start = IXP4XX_EXP_BUS_BASE(0);
+        nslu2_flash_resource.end =
+                IXP4XX_EXP_BUS_BASE(0) + ixp4xx_exp_bus_size - 1;
+
         pm_power_off = nslu2_power_off;
 
         platform_add_devices(nslu2_devices, ARRAY_SIZE(nslu2_devices));
diff --git a/arch/arm/mach-realview/platsmp.c b/arch/arm/mach-realview/platsmp.c
index a8fbd76d8be5..b8484e15dacb 100644
--- a/arch/arm/mach-realview/platsmp.c
+++ b/arch/arm/mach-realview/platsmp.c
@@ -143,6 +143,18 @@ static void __init poke_milo(void)
         mb();
 }
 
+/*
+ * Initialise the CPU possible map early - this describes the CPUs
+ * which may be present or become present in the system.
+ */
+void __init smp_init_cpus(void)
+{
+        unsigned int i, ncores = get_core_count();
+
+        for (i = 0; i < ncores; i++)
+                cpu_set(i, cpu_possible_map);
+}
+
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         unsigned int ncores = get_core_count();
@@ -179,14 +191,11 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         local_timer_setup(cpu);
 
         /*
-         * Initialise the possible/present maps.
-         * cpu_possible_map describes the set of CPUs which may be present
-         * cpu_present_map describes the set of CPUs populated
+         * Initialise the present map, which describes the set of CPUs
+         * actually populated at the present time.
          */
-        for (i = 0; i < max_cpus; i++) {
-                cpu_set(i, cpu_possible_map);
+        for (i = 0; i < max_cpus; i++)
                 cpu_set(i, cpu_present_map);
-        }
 
         /*
          * Do we need any more CPUs? If so, then let them know where
diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
index b80d57d51699..722fbabc9cfb 100644
--- a/arch/arm/mach-versatile/pci.c
+++ b/arch/arm/mach-versatile/pci.c
@@ -240,6 +240,14 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
         int i;
         int myslot = -1;
         unsigned long val;
+        void __iomem *local_pci_cfg_base;
+
+        val = __raw_readl(SYS_PCICTL);
+        if (!(val & 1)) {
+                printk("Not plugged into PCI backplane!\n");
+                ret = -EIO;
+                goto out;
+        }
 
         if (nr == 0) {
                 sys->mem_offset = 0;
@@ -253,48 +261,45 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
                 goto out;
         }
 
-        __raw_writel(VERSATILE_PCI_MEM_BASE0 >> 28,PCI_IMAP0);
-        __raw_writel(VERSATILE_PCI_MEM_BASE1 >> 28,PCI_IMAP1);
-        __raw_writel(VERSATILE_PCI_MEM_BASE2 >> 28,PCI_IMAP2);
-
-        __raw_writel(1, SYS_PCICTL);
-
-        val = __raw_readl(SYS_PCICTL);
-        if (!(val & 1)) {
-                printk("Not plugged into PCI backplane!\n");
-                ret = -EIO;
-                goto out;
-        }
-
         /*
          *  We need to discover the PCI core first to configure itself
          *  before the main PCI probing is performed
          */
-        for (i=0; i<32; i++) {
+        for (i=0; i<32; i++)
                 if ((__raw_readl(VERSATILE_PCI_VIRT_BASE+(i<<11)+DEVICE_ID_OFFSET) == VP_PCI_DEVICE_ID) &&
                     (__raw_readl(VERSATILE_PCI_VIRT_BASE+(i<<11)+CLASS_ID_OFFSET) == VP_PCI_CLASS_ID)) {
                         myslot = i;
-
-                        __raw_writel(myslot, PCI_SELFID);
-                        val = __raw_readl(VERSATILE_PCI_CFG_VIRT_BASE+(myslot<<11)+CSR_OFFSET);
-                        val |= (1<<2);
-                        __raw_writel(val, VERSATILE_PCI_CFG_VIRT_BASE+(myslot<<11)+CSR_OFFSET);
                         break;
                 }
-        }
 
         if (myslot == -1) {
                 printk("Cannot find PCI core!\n");
                 ret = -EIO;
-        } else {
-                printk("PCI core found (slot %d)\n",myslot);
-                /* Do not to map Versatile FPGA PCI device
-                   into memory space as we are short of
-                   mappable memory */
-                pci_slot_ignore |= (1 << myslot);
-                ret = 1;
+                goto out;
         }
 
+        printk("PCI core found (slot %d)\n",myslot);
+
+        __raw_writel(myslot, PCI_SELFID);
+        local_pci_cfg_base = (void *) VERSATILE_PCI_CFG_VIRT_BASE + (myslot << 11);
+
+        val = __raw_readl(local_pci_cfg_base + CSR_OFFSET);
+        val |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER | PCI_COMMAND_INVALIDATE;
+        __raw_writel(val, local_pci_cfg_base + CSR_OFFSET);
+
+        /*
+         * Configure the PCI inbound memory windows to be 1:1 mapped to SDRAM
+         */
+        __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_0);
+        __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_1);
+        __raw_writel(PHYS_OFFSET, local_pci_cfg_base + PCI_BASE_ADDRESS_2);
+
+        /*
+         * Do not to map Versatile FPGA PCI device into memory space
+         */
+        pci_slot_ignore |= (1 << myslot);
+        ret = 1;
+
  out:
         return ret;
 }
@@ -305,18 +310,18 @@ struct pci_bus *pci_versatile_scan_bus(int nr, struct pci_sys_data *sys)
         return pci_scan_bus(sys->busnr, &pci_versatile_ops, sys);
 }
 
-/*
- * V3_LB_BASE? - local bus address
- * V3_LB_MAP?  - pci bus address
- */
 void __init pci_versatile_preinit(void)
 {
-}
+        __raw_writel(VERSATILE_PCI_MEM_BASE0 >> 28, PCI_IMAP0);
+        __raw_writel(VERSATILE_PCI_MEM_BASE1 >> 28, PCI_IMAP1);
+        __raw_writel(VERSATILE_PCI_MEM_BASE2 >> 28, PCI_IMAP2);
 
-void __init pci_versatile_postinit(void)
-{
-}
+        __raw_writel(PHYS_OFFSET >> 28, PCI_SMAP0);
+        __raw_writel(PHYS_OFFSET >> 28, PCI_SMAP1);
+        __raw_writel(PHYS_OFFSET >> 28, PCI_SMAP2);
 
+        __raw_writel(1, SYS_PCICTL);
+}
 
 /*
  * map the specified device/slot/pin to an IRQ.   Different backplanes may need to modify this.
@@ -326,16 +331,15 @@ static int __init versatile_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
         int irq;
         int devslot = PCI_SLOT(dev->devfn);
 
-        /* slot,  pin,  irq
-            24    1     27
-            25    1     28      untested
-            26    1     29
-            27    1     30      untested
-        */
-
-        irq = 27 + ((slot + pin + 2) % 3);      /* Fudged */
+        /* slot,  pin,  irq
+         *  24     1     27
+         *  25     1     28
+         *  26     1     29
+         *  27     1     30
+         */
+        irq = 27 + ((slot + pin - 1) & 3);
 
-        printk("map irq: slot %d, pin %d, devslot %d, irq: %d\n",slot,pin,devslot,irq);
+        printk("PCI map irq: slot %d, pin %d, devslot %d, irq: %d\n",slot,pin,devslot,irq);
 
         return irq;
 }
@@ -347,7 +351,6 @@ static struct hw_pci versatile_pci __initdata = {
         .setup                  = pci_versatile_setup,
         .scan                   = pci_versatile_scan_bus,
         .preinit                = pci_versatile_preinit,
-        .postinit               = pci_versatile_postinit,
 };
 
 static int __init versatile_pci_init(void)
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index dbd346033122..8a7f65ba14b7 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -20,7 +20,7 @@
  */
         .align  5
 ENTRY(v6_early_abort)
-#ifdef CONFIG_CPU_MPCORE
+#ifdef CONFIG_CPU_32v6K
         clrex
 #else
         strex   r0, r1, [sp]                    @ Clear the exclusive monitor
diff --git a/arch/arm/plat-omap/pm.c b/arch/arm/plat-omap/pm.c
index 1a24e2c10714..093efd786f21 100644
--- a/arch/arm/plat-omap/pm.c
+++ b/arch/arm/plat-omap/pm.c
@@ -38,7 +38,6 @@
 #include <linux/pm.h>
 #include <linux/sched.h>
 #include <linux/proc_fs.h>
-#include <linux/pm.h>
 #include <linux/interrupt.h>
 
 #include <asm/io.h>
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index d0f9bb5e9023..8ab5300dcb94 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Mon Jan 9 12:56:42 2006
+# Last update: Mon Feb 20 10:18:02 2006
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -904,7 +904,7 @@ wg302v2			MACH_WG302V2		WG302V2			890
 eb42x                   MACH_EB42X              EB42X                   891
 iq331es                 MACH_IQ331ES            IQ331ES                 892
 cosydsp                 MACH_COSYDSP            COSYDSP                 893
-uplat7d                 MACH_UPLAT7D            UPLAT7D                 894
+uplat7d_proto           MACH_UPLAT7D            UPLAT7D                 894
 ptdavinci               MACH_PTDAVINCI          PTDAVINCI               895
 mbus                    MACH_MBUS               MBUS                    896
 nadia2vb                MACH_NADIA2VB           NADIA2VB                897
@@ -938,3 +938,34 @@ auckland		MACH_AUCKLAND		AUCKLAND		924
 ak3220m                 MACH_AK3320M            AK3320M                 925
 duramax                 MACH_DURAMAX            DURAMAX                 926
 n35                     MACH_N35                N35                     927
+pronghorn               MACH_PRONGHORN          PRONGHORN               928
+fundy                   MACH_FUNDY              FUNDY                   929
+logicpd_pxa270          MACH_LOGICPD_PXA270     LOGICPD_PXA270          930
+cpu777                  MACH_CPU777             CPU777                  931
+simicon9201             MACH_SIMICON9201        SIMICON9201             932
+leap2_hpm               MACH_LEAP2_HPM          LEAP2_HPM               933
+cm922txa10              MACH_CM922TXA10         CM922TXA10              934
+sandgate                MACH_PXA                PXA                     935
+sandgate2               MACH_SANDGATE2          SANDGATE2               936
+sandgate2g              MACH_SANDGATE2G         SANDGATE2G              937
+sandgate2p              MACH_SANDGATE2P         SANDGATE2P              938
+fred_jack               MACH_FRED_JACK          FRED_JACK               939
+ttg_color1              MACH_TTG_COLOR1         TTG_COLOR1              940
+nxeb500hmi              MACH_NXEB500HMI         NXEB500HMI              941
+netdcu8                 MACH_NETDCU8            NETDCU8                 942
+ml675050_cpu_boa        MACH_ML675050_CPU_BOA   ML675050_CPU_BOA        943
+ng_fvx538               MACH_NG_FVX538          NG_FVX538               944
+ng_fvs338               MACH_NG_FVS338          NG_FVS338               945
+pnx4103                 MACH_PNX4103            PNX4103                 946
+hesdb                   MACH_HESDB              HESDB                   947
+xsilo                   MACH_XSILO              XSILO                   948
+espresso                MACH_ESPRESSO           ESPRESSO                949
+emlc                    MACH_EMLC               EMLC                    950
+sisteron                MACH_SISTERON           SISTERON                951
+rx1950                  MACH_RX1950             RX1950                  952
+tsc_venus               MACH_TSC_VENUS          TSC_VENUS               953
+ds101j                  MACH_DS101J             DS101J                  954
+mxc300_30ads            MACH_MXC30030ADS        MXC30030ADS             955
+fujitsu_wimaxsoc        MACH_FUJITSU_WIMAXSOC   FUJITSU_WIMAXSOC        956
+dualpcmodem             MACH_DUALPCMODEM        DUALPCMODEM             957
+gesbc9312               MACH_GESBC9312          GESBC9312               958
diff --git a/arch/h8300/Kconfig.debug b/arch/h8300/Kconfig.debug
index 55034d08abff..e0e9bcb015a9 100644
--- a/arch/h8300/Kconfig.debug
+++ b/arch/h8300/Kconfig.debug
@@ -34,7 +34,7 @@ config GDB_DEBUG
         help
           gdb stub exception support
 
-config CONFIG_SH_STANDARD_BIOS
+config SH_STANDARD_BIOS
         bool "Use gdb protocol serial console"
         depends on (!H8300H_SIM && !H8S_SIM)
         help
diff --git a/arch/h8300/defconfig b/arch/h8300/defconfig
index 9d9b491cfc2c..8f1ec3297150 100644
--- a/arch/h8300/defconfig
+++ b/arch/h8300/defconfig
@@ -328,7 +328,7 @@ CONFIG_FULLDEBUG=y
 CONFIG_NO_KERNEL_MSG=y
 # CONFIG_SYSCALL_PRINT is not set
 # CONFIG_GDB_DEBUG is not set
-# CONFIG_CONFIG_SH_STANDARD_BIOS is not set
+# CONFIG_SH_STANDARD_BIOS is not set
 # CONFIG_DEFAULT_CMDLINE is not set
 # CONFIG_BLKDEV_RESERVE is not set
 
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index 0afec8566e7b..5b1a7d46d1d9 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -733,7 +733,7 @@ config PHYSICAL_START
 
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
-        depends on SMP && HOTPLUG && EXPERIMENTAL
+        depends on SMP && HOTPLUG && EXPERIMENTAL && !X86_VOYAGER
         ---help---
           Say Y here to experiment with turning CPUs off and on.  CPUs
           can be controlled through /sys/devices/system/cpu.
@@ -1060,6 +1060,7 @@ source "arch/i386/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/i386/kernel/Makefile b/arch/i386/kernel/Makefile
index 60c3f76dfca4..53bb9a79e274 100644
--- a/arch/i386/kernel/Makefile
+++ b/arch/i386/kernel/Makefile
@@ -7,7 +7,7 @@ extra-y := head.o init_task.o vmlinux.lds
 obj-y   := process.o semaphore.o signal.o entry.o traps.o irq.o \
                 ptrace.o time.o ioport.o ldt.o setup.o i8259.o sys_i386.o \
                 pci-dma.o i386_ksyms.o i387.o dmi_scan.o bootflag.o \
-                quirks.o i8237.o
+                quirks.o i8237.o topology.o
 
 obj-y                           += cpu/
 obj-y                           += timers/
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 79577f0ace98..8309a7b2cd63 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -44,9 +44,6 @@ extern void __init clustered_apic_check(void);
 extern int gsi_irq_sharing(int gsi);
 #include <asm/proto.h>
 
-static inline int acpi_madt_oem_check(char *oem_id, char *oem_table_id) { return 0; }
-
-
 #else                           /* X86 */
 
 #ifdef  CONFIG_X86_LOCAL_APIC
diff --git a/arch/i386/kernel/cpu/common.c b/arch/i386/kernel/cpu/common.c
index 7eb9213734a3..4ecd4b326ded 100644
--- a/arch/i386/kernel/cpu/common.c
+++ b/arch/i386/kernel/cpu/common.c
@@ -4,6 +4,7 @@
 #include <linux/smp.h>
 #include <linux/module.h>
 #include <linux/percpu.h>
+#include <linux/bootmem.h>
 #include <asm/semaphore.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
@@ -18,6 +19,9 @@
 
 #include "cpu.h"
 
+DEFINE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
+EXPORT_PER_CPU_SYMBOL(cpu_gdt_descr);
+
 DEFINE_PER_CPU(unsigned char, cpu_16bit_stack[CPU_16BIT_STACK_SIZE]);
 EXPORT_PER_CPU_SYMBOL(cpu_16bit_stack);
 
@@ -571,8 +575,9 @@ void __devinit cpu_init(void)
         int cpu = smp_processor_id();
         struct tss_struct * t = &per_cpu(init_tss, cpu);
         struct thread_struct *thread = &current->thread;
-        struct desc_struct *gdt = get_cpu_gdt_table(cpu);
+        struct desc_struct *gdt;
         __u32 stk16_off = (__u32)&per_cpu(cpu_16bit_stack, cpu);
+        struct Xgt_desc_struct *cpu_gdt_descr = &per_cpu(cpu_gdt_descr, cpu);
 
         if (cpu_test_and_set(cpu, cpu_initialized)) {
                 printk(KERN_WARNING "CPU#%d already initialized!\n", cpu);
@@ -590,6 +595,25 @@ void __devinit cpu_init(void)
         }
 
         /*
+         * This is a horrible hack to allocate the GDT.  The problem
+         * is that cpu_init() is called really early for the boot CPU
+         * (and hence needs bootmem) but much later for the secondary
+         * CPUs, when bootmem will have gone away
+         */
+        if (NODE_DATA(0)->bdata->node_bootmem_map) {
+                gdt = (struct desc_struct *)alloc_bootmem_pages(PAGE_SIZE);
+                /* alloc_bootmem_pages panics on failure, so no check */
+                memset(gdt, 0, PAGE_SIZE);
+        } else {
+                gdt = (struct desc_struct *)get_zeroed_page(GFP_KERNEL);
+                if (unlikely(!gdt)) {
+                        printk(KERN_CRIT "CPU%d failed to allocate GDT\n", cpu);
+                        for (;;)
+                                local_irq_enable();
+                }
+        }
+
+        /*
          * Initialize the per-CPU GDT with the boot GDT,
          * and set up the GDT descriptor:
          */
@@ -601,10 +625,10 @@ void __devinit cpu_init(void)
                 ((((__u64)stk16_off) << 32) & 0xff00000000000000ULL) |
                 (CPU_16BIT_STACK_SIZE - 1);
 
-        cpu_gdt_descr[cpu].size = GDT_SIZE - 1;
-        cpu_gdt_descr[cpu].address = (unsigned long)gdt;
+        cpu_gdt_descr->size = GDT_SIZE - 1;
+        cpu_gdt_descr->address = (unsigned long)gdt;
 
-        load_gdt(&cpu_gdt_descr[cpu]);
+        load_gdt(cpu_gdt_descr);
         load_idt(&idt_descr);
 
         /*
diff --git a/arch/i386/kernel/cpu/transmeta.c b/arch/i386/kernel/cpu/transmeta.c
index bdbeb77f4e22..7214c9b577ab 100644
--- a/arch/i386/kernel/cpu/transmeta.c
+++ b/arch/i386/kernel/cpu/transmeta.c
@@ -1,4 +1,5 @@
 #include <linux/kernel.h>
+#include <linux/mm.h>
 #include <linux/init.h>
 #include <asm/processor.h>
 #include <asm/msr.h>
diff --git a/arch/i386/kernel/efi.c b/arch/i386/kernel/efi.c
index ecad519fd395..e3e42fd62401 100644
--- a/arch/i386/kernel/efi.c
+++ b/arch/i386/kernel/efi.c
@@ -103,17 +103,19 @@ static void efi_call_phys_prelog(void)
          */
         local_flush_tlb();
 
-        cpu_gdt_descr[0].address = __pa(cpu_gdt_descr[0].address);
-        load_gdt((struct Xgt_desc_struct *) __pa(&cpu_gdt_descr[0]));
+        per_cpu(cpu_gdt_descr, 0).address =
+                                 __pa(per_cpu(cpu_gdt_descr, 0).address);
+        load_gdt((struct Xgt_desc_struct *)__pa(&per_cpu(cpu_gdt_descr, 0)));
 }
 
 static void efi_call_phys_epilog(void)
 {
         unsigned long cr4;
 
-        cpu_gdt_descr[0].address =
-                (unsigned long) __va(cpu_gdt_descr[0].address);
-        load_gdt(&cpu_gdt_descr[0]);
+        per_cpu(cpu_gdt_descr, 0).address =
+                        (unsigned long)__va(per_cpu(cpu_gdt_descr, 0).address);
+        load_gdt((struct Xgt_desc_struct *)__va(&per_cpu(cpu_gdt_descr, 0)));
+
         cr4 = read_cr4();
 
         if (cr4 & X86_CR4_PSE) {
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index 2bee6499edd9..e0b7c632efbc 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -534,5 +534,3 @@ ENTRY(cpu_gdt_table)
         .quad 0x0000000000000000        /* 0xf0 - unused */
         .quad 0x0000000000000000        /* 0xf8 - GDT entry 31: double-fault TSS */
 
-        /* Be sure this is zeroed to avoid false validations in Xen */
-        .fill PAGE_SIZE_asm / 8 - GDT_ENTRIES,8,0
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index 3999bec50c33..055325056a74 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -3,8 +3,6 @@
 #include <asm/checksum.h>
 #include <asm/desc.h>
 
-EXPORT_SYMBOL_GPL(cpu_gdt_descr);
-
 EXPORT_SYMBOL(__down_failed);
 EXPORT_SYMBOL(__down_failed_interruptible);
 EXPORT_SYMBOL(__down_failed_trylock);
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index f2dd218d88cb..235822b3f41b 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -2566,8 +2566,10 @@ int __init io_apic_get_unique_id (int ioapic, int apic_id)
                 spin_unlock_irqrestore(&ioapic_lock, flags);
 
                 /* Sanity check */
-                if (reg_00.bits.ID != apic_id)
-                        panic("IOAPIC[%d]: Unable change apic_id!\n", ioapic);
+                if (reg_00.bits.ID != apic_id) {
+                        printk("IOAPIC[%d]: Unable to change apic_id!\n", ioapic);
+                        return -1;
+                }
         }
 
         apic_printk(APIC_VERBOSE, KERN_INFO
diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index 6483eeb1a4e8..694a13997637 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -58,6 +58,11 @@ static inline int is_IF_modifier(kprobe_opcode_t opcode)
 
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
 {
+        /* insn: must be on special executable page on i386. */
+        p->ainsn.insn = get_insn_slot();
+        if (!p->ainsn.insn)
+                return -ENOMEM;
+
         memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
         p->opcode = *p->addr;
         return 0;
@@ -77,6 +82,13 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
                            (unsigned long) p->addr + sizeof(kprobe_opcode_t));
 }
 
+void __kprobes arch_remove_kprobe(struct kprobe *p)
+{
+        down(&kprobe_mutex);
+        free_insn_slot(p->ainsn.insn);
+        up(&kprobe_mutex);
+}
+
 static inline void save_previous_kprobe(struct kprobe_ctlblk *kcb)
 {
         kcb->prev_kprobe.kp = kprobe_running();
@@ -111,7 +123,7 @@ static inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
         if (p->opcode == BREAKPOINT_INSTRUCTION)
                 regs->eip = (unsigned long)p->addr;
         else
-                regs->eip = (unsigned long)&p->ainsn.insn;
+                regs->eip = (unsigned long)p->ainsn.insn;
 }
 
 /* Called with kretprobe_lock held */
@@ -351,7 +363,7 @@ static void __kprobes resume_execution(struct kprobe *p,
 {
         unsigned long *tos = (unsigned long *)&regs->esp;
         unsigned long next_eip = 0;
-        unsigned long copy_eip = (unsigned long)&p->ainsn.insn;
+        unsigned long copy_eip = (unsigned long)p->ainsn.insn;
         unsigned long orig_eip = (unsigned long)p->addr;
 
         switch (p->ainsn.insn[0]) {
diff --git a/arch/i386/kernel/mpparse.c b/arch/i386/kernel/mpparse.c
index 0102f3d50e57..e6e2f43db85e 100644
--- a/arch/i386/kernel/mpparse.c
+++ b/arch/i386/kernel/mpparse.c
@@ -710,7 +710,7 @@ void __init get_smp_config (void)
                  * Read the physical hardware table.  Anything here will
                  * override the defaults.
                  */
-                if (!smp_read_mpc((void *)mpf->mpf_physptr)) {
+                if (!smp_read_mpc(phys_to_virt(mpf->mpf_physptr))) {
                         smp_found_config = 0;
                         printk(KERN_ERR "BIOS bug, MP table errors detected!...\n");
                         printk(KERN_ERR "... disabling SMP support. (tell your hw vendor)\n");
@@ -915,6 +915,7 @@ void __init mp_register_ioapic (
         u32                     gsi_base)
 {
         int                     idx = 0;
+        int                     tmpid;
 
         if (nr_ioapics >= MAX_IO_APICS) {
                 printk(KERN_ERR "ERROR: Max # of I/O APICs (%d) exceeded "
@@ -935,9 +936,14 @@ void __init mp_register_ioapic (
 
         set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
         if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) && (boot_cpu_data.x86 < 15))
-                mp_ioapics[idx].mpc_apicid = io_apic_get_unique_id(idx, id);
+                tmpid = io_apic_get_unique_id(idx, id);
         else
-                mp_ioapics[idx].mpc_apicid = id;
+                tmpid = id;
+        if (tmpid == -1) {
+                nr_ioapics--;
+                return;
+        }
+        mp_ioapics[idx].mpc_apicid = tmpid;
         mp_ioapics[idx].mpc_apicver = io_apic_get_version(idx);
         
         /* 
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index fb00ab7b7612..eba7f53f8b4a 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -898,12 +898,6 @@ static int __devinit do_boot_cpu(int apicid, int cpu)
         unsigned long start_eip;
         unsigned short nmi_high = 0, nmi_low = 0;
 
-        if (!cpu_gdt_descr[cpu].address &&
-            !(cpu_gdt_descr[cpu].address = get_zeroed_page(GFP_KERNEL))) {
-                printk("Failed to allocate GDT for CPU %d\n", cpu);
-                return 1;
-        }
-
         ++cpucount;
 
         /*
diff --git a/arch/i386/mach-default/topology.c b/arch/i386/kernel/topology.c
index b64314069e78..67a0e1baa28b 100644
--- a/arch/i386/mach-default/topology.c
+++ b/arch/i386/kernel/topology.c
@@ -1,12 +1,12 @@
 /*
- * arch/i386/mach-generic/topology.c - Populate driverfs with topology information
+ * arch/i386/kernel/topology.c - Populate driverfs with topology information
  *
  * Written by: Matthew Dobson, IBM Corporation
  * Original Code: Paul Dorwin, IBM Corporation, Patrick Mochel, OSDL
  *
  * Copyright (C) 2002, IBM Corp.
  *
- * All rights reserved.          
+ * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -34,7 +34,7 @@ static struct i386_cpu cpu_devices[NR_CPUS];
 
 int arch_register_cpu(int num){
         struct node *parent = NULL;
-        
+
 #ifdef CONFIG_NUMA
         int node = cpu_to_node(num);
         if (node_online(node))
diff --git a/arch/i386/mach-default/Makefile b/arch/i386/mach-default/Makefile
index e95bb0237921..012fe34459e6 100644
--- a/arch/i386/mach-default/Makefile
+++ b/arch/i386/mach-default/Makefile
@@ -2,4 +2,4 @@
 # Makefile for the linux kernel.
 #
 
-obj-y                           := setup.o topology.o
+obj-y                           := setup.o
diff --git a/arch/i386/mach-voyager/voyager_basic.c b/arch/i386/mach-voyager/voyager_basic.c
index aa49a33a572c..b584060ec004 100644
--- a/arch/i386/mach-voyager/voyager_basic.c
+++ b/arch/i386/mach-voyager/voyager_basic.c
@@ -23,6 +23,8 @@
 #include <linux/delay.h>
 #include <linux/reboot.h>
 #include <linux/sysrq.h>
+#include <linux/smp.h>
+#include <linux/nodemask.h>
 #include <asm/io.h>
 #include <asm/voyager.h>
 #include <asm/vic.h>
@@ -328,4 +330,3 @@ void machine_power_off(void)
         if (pm_power_off)
                 pm_power_off();
 }
-
diff --git a/arch/i386/mach-voyager/voyager_smp.c b/arch/i386/mach-voyager/voyager_smp.c
index 6e4c3baef6cc..8165626a5c30 100644
--- a/arch/i386/mach-voyager/voyager_smp.c
+++ b/arch/i386/mach-voyager/voyager_smp.c
@@ -402,6 +402,7 @@ find_smp_config(void)
         cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 1) << 8;
         cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 2) << 16;
         cpus_addr(phys_cpu_present_map)[0] |= voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 3) << 24;
+        cpu_possible_map = phys_cpu_present_map;
         printk("VOYAGER SMP: phys_cpu_present_map = 0x%lx\n", cpus_addr(phys_cpu_present_map)[0]);
         /* Here we set up the VIC to enable SMP */
         /* enable the CPIs by writing the base vector to their register */
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 845cd0902a50..a85ea9d37f05 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -453,6 +453,7 @@ source "arch/ia64/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index d2702c419cf8..ecd44bdc8394 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -761,6 +761,59 @@ int acpi_map_cpu2node(acpi_handle handle, int cpu, long physid)
         return (0);
 }
 
+int additional_cpus __initdata = -1;
+
+static __init int setup_additional_cpus(char *s)
+{
+        if (s)
+                additional_cpus = simple_strtol(s, NULL, 0);
+
+        return 0;
+}
+
+early_param("additional_cpus", setup_additional_cpus);
+
+/*
+ * cpu_possible_map should be static, it cannot change as cpu's
+ * are onlined, or offlined. The reason is per-cpu data-structures
+ * are allocated by some modules at init time, and dont expect to
+ * do this dynamically on cpu arrival/departure.
+ * cpu_present_map on the other hand can change dynamically.
+ * In case when cpu_hotplug is not compiled, then we resort to current
+ * behaviour, which is cpu_possible == cpu_present.
+ * - Ashok Raj
+ *
+ * Three ways to find out the number of additional hotplug CPUs:
+ * - If the BIOS specified disabled CPUs in ACPI/mptables use that.
+ * - The user can overwrite it with additional_cpus=NUM
+ * - Otherwise don't reserve additional CPUs.
+ */
+__init void prefill_possible_map(void)
+{
+        int i;
+        int possible, disabled_cpus;
+
+        disabled_cpus = total_cpus - available_cpus;
+
+        if (additional_cpus == -1) {
+                if (disabled_cpus > 0)
+                        additional_cpus = disabled_cpus;
+                else
+                        additional_cpus = 0;
+        }
+
+        possible = available_cpus + additional_cpus;
+
+        if (possible > NR_CPUS)
+                possible = NR_CPUS;
+
+        printk(KERN_INFO "SMP: Allowing %d CPUs, %d hotplug CPUs\n",
+                possible, max((possible - available_cpus), 0));
+
+        for (i = 0; i < possible; i++)
+                cpu_set(i, cpu_possible_map);
+}
+
 int acpi_map_lsapic(acpi_handle handle, int *pcpu)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 27b222c277e4..930fdfca6ddb 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -569,7 +569,9 @@ GLOBAL_ENTRY(ia64_trace_syscall)
 .mem.offset 0,0; st8.spill [r2]=r8              // store return value in slot for r8
 .mem.offset 8,0; st8.spill [r3]=r10             // clear error indication in slot for r10
         br.call.sptk.many rp=syscall_trace_leave // give parent a chance to catch return value
-.ret3:  br.cond.sptk .work_pending_syscall_end
+.ret3:
+(pUStk) cmp.eq.unc p6,p0=r0,r0                  // p6 <- pUStk
+        br.cond.sptk .work_pending_syscall_end
 
 strace_error:
         ld8 r3=[r2]                             // load pt_regs.r8
diff --git a/arch/ia64/kernel/ia64_ksyms.c b/arch/ia64/kernel/ia64_ksyms.c
index e72de580ebbf..bbcfd08378a6 100644
--- a/arch/ia64/kernel/ia64_ksyms.c
+++ b/arch/ia64/kernel/ia64_ksyms.c
@@ -10,23 +10,8 @@
 
 #include <linux/string.h>
 EXPORT_SYMBOL(memset);
-EXPORT_SYMBOL(memchr);
-EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memcpy);
-EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
-EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strncmp);
-EXPORT_SYMBOL(strncpy);
-EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strstr);
-EXPORT_SYMBOL(strpbrk);
 
 #include <asm/checksum.h>
 EXPORT_SYMBOL(ip_fast_csum);            /* hand-coded assembly */
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index 35f7835294a3..3258e09278d0 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -430,6 +430,7 @@ setup_arch (char **cmdline_p)
         if (early_console_setup(*cmdline_p) == 0)
                 mark_bsp_online();
 
+        parse_early_param();
 #ifdef CONFIG_ACPI
         /* Initialize the ACPI boot-time table parser */
         acpi_table_init();
@@ -688,6 +689,9 @@ void
 setup_per_cpu_areas (void)
 {
         /* start_kernel() requires this... */
+#ifdef CONFIG_ACPI_HOTPLUG_CPU
+        prefill_possible_map();
+#endif
 }
 
 /*
diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c
index 8f44e7d2df66..b681ef34a86e 100644
--- a/arch/ia64/kernel/smpboot.c
+++ b/arch/ia64/kernel/smpboot.c
@@ -129,7 +129,7 @@ DEFINE_PER_CPU(int, cpu_state);
 /* Bitmasks of currently online, and possible CPUs */
 cpumask_t cpu_online_map;
 EXPORT_SYMBOL(cpu_online_map);
-cpumask_t cpu_possible_map;
+cpumask_t cpu_possible_map = CPU_MASK_NONE;
 EXPORT_SYMBOL(cpu_possible_map);
 
 cpumask_t cpu_core_map[NR_CPUS] __cacheline_aligned;
@@ -506,9 +506,6 @@ smp_build_cpu_map (void)
 
         for (cpu = 0; cpu < NR_CPUS; cpu++) {
                 ia64_cpu_to_sapicid[cpu] = -1;
-#ifdef CONFIG_HOTPLUG_CPU
-                cpu_set(cpu, cpu_possible_map);
-#endif
         }
 
         ia64_cpu_to_sapicid[0] = boot_cpu_id;
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index a094ec49ccfa..307d01e15b2e 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -250,32 +250,27 @@ time_init (void)
         set_normalized_timespec(&wall_to_monotonic, -xtime.tv_sec, -xtime.tv_nsec);
 }
 
-#define SMALLUSECS 100
-
-void
-udelay (unsigned long usecs)
+/*
+ * Generic udelay assumes that if preemption is allowed and the thread
+ * migrates to another CPU, that the ITC values are synchronized across
+ * all CPUs.
+ */
+static void
+ia64_itc_udelay (unsigned long usecs)
 {
-        unsigned long start;
-        unsigned long cycles;
-        unsigned long smallusecs;
+        unsigned long start = ia64_get_itc();
+        unsigned long end = start + usecs*local_cpu_data->cyc_per_usec;
 
-        /*
-         * Execute the non-preemptible delay loop (because the ITC might
-         * not be synchronized between CPUS) in relatively short time
-         * chunks, allowing preemption between the chunks.
-         */
-        while (usecs > 0) {
-                smallusecs = (usecs > SMALLUSECS) ? SMALLUSECS : usecs;
-                preempt_disable();
-                cycles = smallusecs*local_cpu_data->cyc_per_usec;
-                start = ia64_get_itc();
+        while (time_before(ia64_get_itc(), end))
+                cpu_relax();
+}
 
-                while (ia64_get_itc() - start < cycles)
-                        cpu_relax();
+void (*ia64_udelay)(unsigned long usecs) = &ia64_itc_udelay;
 
-                preempt_enable();
-                usecs -= smallusecs;
-        }
+void
+udelay (unsigned long usecs)
+{
+        (*ia64_udelay)(usecs);
 }
 EXPORT_SYMBOL(udelay);
 
diff --git a/arch/ia64/kernel/traps.c b/arch/ia64/kernel/traps.c
index 55391901b013..dabd6c32641e 100644
--- a/arch/ia64/kernel/traps.c
+++ b/arch/ia64/kernel/traps.c
@@ -16,6 +16,7 @@
 #include <linux/module.h>       /* for EXPORT_SYMBOL */
 #include <linux/hardirq.h>
 #include <linux/kprobes.h>
+#include <linux/delay.h>                /* for ssleep() */
 
 #include <asm/fpswa.h>
 #include <asm/ia32.h>
@@ -116,6 +117,13 @@ die (const char *str, struct pt_regs *regs, long err)
         bust_spinlocks(0);
         die.lock_owner = -1;
         spin_unlock_irq(&die.lock);
+
+        if (panic_on_oops) {
+                printk(KERN_EMERG "Fatal exception: panic in 5 seconds\n");
+                ssleep(5);
+                panic("Fatal exception");
+        }
+
         do_exit(SIGSEGV);
 }
 
diff --git a/arch/ia64/sn/kernel/io_init.c b/arch/ia64/sn/kernel/io_init.c
index 3437c2390429..3edef0d32f86 100644
--- a/arch/ia64/sn/kernel/io_init.c
+++ b/arch/ia64/sn/kernel/io_init.c
@@ -23,6 +23,10 @@
 #include "xtalk/hubdev.h"
 #include "xtalk/xwidgetdev.h"
 
+
+extern void sn_init_cpei_timer(void);
+extern void register_sn_procfs(void);
+
 static struct list_head sn_sysdata_list;
 
 /* sysdata list struct */
@@ -40,12 +44,12 @@ struct brick {
         struct slab_info slab_info[MAX_SLABS + 1];
 };
 
-int sn_ioif_inited = 0;         /* SN I/O infrastructure initialized? */
+int sn_ioif_inited;             /* SN I/O infrastructure initialized? */
 
 struct sn_pcibus_provider *sn_pci_provider[PCIIO_ASIC_MAX_TYPES];       /* indexed by asic type */
 
-static int max_segment_number = 0; /* Default highest segment number */
-static int max_pcibus_number = 255; /* Default highest pci bus number */
+static int max_segment_number;           /* Default highest segment number */
+static int max_pcibus_number = 255;     /* Default highest pci bus number */
 
 /*
  * Hooks and struct for unsupported pci providers
@@ -84,7 +88,6 @@ static inline u64
 sal_get_device_dmaflush_list(u64 nasid, u64 widget_num, u64 device_num,
                              u64 address)
 {
-
         struct ia64_sal_retval ret_stuff;
         ret_stuff.status = 0;
         ret_stuff.v0 = 0;
@@ -94,7 +97,6 @@ sal_get_device_dmaflush_list(u64 nasid, u64 widget_num, u64 device_num,
                         (u64) nasid, (u64) widget_num,
                         (u64) device_num, (u64) address, 0, 0, 0);
         return ret_stuff.status;
-
 }
 
 /*
@@ -102,7 +104,6 @@ sal_get_device_dmaflush_list(u64 nasid, u64 widget_num, u64 device_num,
  */
 static inline u64 sal_get_hubdev_info(u64 handle, u64 address)
 {
-
         struct ia64_sal_retval ret_stuff;
         ret_stuff.status = 0;
         ret_stuff.v0 = 0;
@@ -118,7 +119,6 @@ static inline u64 sal_get_hubdev_info(u64 handle, u64 address)
  */
 static inline u64 sal_get_pcibus_info(u64 segment, u64 busnum, u64 address)
 {
-
         struct ia64_sal_retval ret_stuff;
         ret_stuff.status = 0;
         ret_stuff.v0 = 0;
@@ -215,7 +215,7 @@ static void __init sn_fixup_ionodes(void)
         struct hubdev_info *hubdev;
         u64 status;
         u64 nasid;
-        int i, widget, device;
+        int i, widget, device, size;
 
         /*
          * Get SGI Specific HUB chipset information.
@@ -251,48 +251,37 @@ static void __init sn_fixup_ionodes(void)
                 if (!hubdev->hdi_flush_nasid_list.widget_p)
                         continue;
 
+                size = (HUB_WIDGET_ID_MAX + 1) *
+                        sizeof(struct sn_flush_device_kernel *);
                 hubdev->hdi_flush_nasid_list.widget_p =
-                    kmalloc((HUB_WIDGET_ID_MAX + 1) *
-                            sizeof(struct sn_flush_device_kernel *),
-                            GFP_KERNEL);
-                memset(hubdev->hdi_flush_nasid_list.widget_p, 0x0,
-                       (HUB_WIDGET_ID_MAX + 1) *
-                       sizeof(struct sn_flush_device_kernel *));
+                        kzalloc(size, GFP_KERNEL);
+                if (!hubdev->hdi_flush_nasid_list.widget_p)
+                        BUG();
 
                 for (widget = 0; widget <= HUB_WIDGET_ID_MAX; widget++) {
-                        sn_flush_device_kernel = kmalloc(DEV_PER_WIDGET *
-                                                         sizeof(struct
-                                                        sn_flush_device_kernel),
-                                                        GFP_KERNEL);
+                        size = DEV_PER_WIDGET *
+                                sizeof(struct sn_flush_device_kernel);
+                        sn_flush_device_kernel = kzalloc(size, GFP_KERNEL);
                         if (!sn_flush_device_kernel)
                                 BUG();
-                        memset(sn_flush_device_kernel, 0x0,
-                               DEV_PER_WIDGET *
-                               sizeof(struct sn_flush_device_kernel));
 
                         dev_entry = sn_flush_device_kernel;
                         for (device = 0; device < DEV_PER_WIDGET;
                              device++,dev_entry++) {
-                                dev_entry->common = kmalloc(sizeof(struct
-                                                        sn_flush_device_common),
-                                                            GFP_KERNEL);
+                                size = sizeof(struct sn_flush_device_common);
+                                dev_entry->common = kzalloc(size, GFP_KERNEL);
                                 if (!dev_entry->common)
                                         BUG();
-                                memset(dev_entry->common, 0x0, sizeof(struct
-                                                       sn_flush_device_common));
 
                                 if (sn_prom_feature_available(
                                                        PRF_DEVICE_FLUSH_LIST))
                                         status = sal_get_device_dmaflush_list(
-                                                                          nasid,
-                                                                         widget,
-                                                                         device,
-                                                      (u64)(dev_entry->common));
+                                                     nasid, widget, device,
+                                                     (u64)(dev_entry->common));
                                 else
                                         status = sn_device_fixup_war(nasid,
-                                                                     widget,
-                                                                     device,
-                                                             dev_entry->common);
+                                                     widget, device,
+                                                     dev_entry->common);
                                 if (status != SALRET_OK)
                                         panic("SAL call failed: %s\n",
                                               ia64_sal_strerror(status));
@@ -383,13 +372,12 @@ void sn_pci_fixup_slot(struct pci_dev *dev)
 
         pci_dev_get(dev); /* for the sysdata pointer */
         pcidev_info = kzalloc(sizeof(struct pcidev_info), GFP_KERNEL);
-        if (pcidev_info <= 0)
+        if (!pcidev_info)
                 BUG();          /* Cannot afford to run out of memory */
 
-        sn_irq_info = kmalloc(sizeof(struct sn_irq_info), GFP_KERNEL);
-        if (sn_irq_info <= 0)
+        sn_irq_info = kzalloc(sizeof(struct sn_irq_info), GFP_KERNEL);
+        if (!sn_irq_info)
                 BUG();          /* Cannot afford to run out of memory */
-        memset(sn_irq_info, 0, sizeof(struct sn_irq_info));
 
         /* Call to retrieve pci device information needed by kernel. */
         status = sal_get_pcidev_info((u64) segment, (u64) dev->bus->number, 
@@ -482,13 +470,13 @@ void sn_pci_fixup_slot(struct pci_dev *dev)
  */
 void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
 {
-        int status = 0;
+        int status;
         int nasid, cnode;
         struct pci_controller *controller;
         struct sn_pci_controller *sn_controller;
         struct pcibus_bussoft *prom_bussoft_ptr;
         struct hubdev_info *hubdev_info;
-        void *provider_soft = NULL;
+        void *provider_soft;
         struct sn_pcibus_provider *provider;
 
         status = sal_get_pcibus_info((u64) segment, (u64) busnum,
@@ -535,6 +523,8 @@ void sn_pci_controller_fixup(int segment, int busnum, struct pci_bus *bus)
         bus->sysdata = controller;
         if (provider->bus_fixup)
                 provider_soft = (*provider->bus_fixup) (prom_bussoft_ptr, controller);
+        else
+                provider_soft = NULL;
 
         if (provider_soft == NULL) {
                 /* fixup failed or not applicable */
@@ -638,13 +628,8 @@ void sn_bus_free_sysdata(void)
 
 static int __init sn_pci_init(void)
 {
-        int i = 0;
-        int j = 0;
+        int i, j;
         struct pci_dev *pci_dev = NULL;
-        extern void sn_init_cpei_timer(void);
-#ifdef CONFIG_PROC_FS
-        extern void register_sn_procfs(void);
-#endif
 
         if (!ia64_platform_is("sn2") || IS_RUNNING_ON_FAKE_PROM())
                 return 0;
@@ -700,32 +685,29 @@ static int __init sn_pci_init(void)
  */
 void hubdev_init_node(nodepda_t * npda, cnodeid_t node)
 {
-
         struct hubdev_info *hubdev_info;
+        int size;
+        pg_data_t *pg;
+
+        size = sizeof(struct hubdev_info);
 
         if (node >= num_online_nodes()) /* Headless/memless IO nodes */
-                hubdev_info =
-                    (struct hubdev_info *)alloc_bootmem_node(NODE_DATA(0),
-                                                             sizeof(struct
-                                                                    hubdev_info));
+                pg = NODE_DATA(0);
         else
-                hubdev_info =
-                    (struct hubdev_info *)alloc_bootmem_node(NODE_DATA(node),
-                                                             sizeof(struct
-                                                                    hubdev_info));
-        npda->pdinfo = (void *)hubdev_info;
+                pg = NODE_DATA(node);
 
+        hubdev_info = (struct hubdev_info *)alloc_bootmem_node(pg, size);
+
+        npda->pdinfo = (void *)hubdev_info;
 }
 
 geoid_t
 cnodeid_get_geoid(cnodeid_t cnode)
 {
-
         struct hubdev_info *hubdev;
 
         hubdev = (struct hubdev_info *)(NODEPDA(cnode)->pdinfo);
         return hubdev->hdi_geoid;
-
 }
 
 subsys_initcall(sn_pci_init);
@@ -734,3 +716,4 @@ EXPORT_SYMBOL(sn_pci_unfixup_slot);
 EXPORT_SYMBOL(sn_pci_controller_fixup);
 EXPORT_SYMBOL(sn_bus_store_sysdata);
 EXPORT_SYMBOL(sn_bus_free_sysdata);
+EXPORT_SYMBOL(sn_pcidev_info_get);
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index 48645ac120fc..5b84836c2171 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -75,7 +75,7 @@ EXPORT_SYMBOL(sn_rtc_cycles_per_second);
 DEFINE_PER_CPU(struct sn_hub_info_s, __sn_hub_info);
 EXPORT_PER_CPU_SYMBOL(__sn_hub_info);
 
-DEFINE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_NUMNODES]);
+DEFINE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_COMPACT_NODES]);
 EXPORT_PER_CPU_SYMBOL(__sn_cnodeid_to_nasid);
 
 DEFINE_PER_CPU(struct nodepda_s *, __sn_nodepda);
@@ -317,6 +317,7 @@ struct pcdp_vga_device {
 #define PCDP_PCI_TRANS_IOPORT   0x02
 #define PCDP_PCI_TRANS_MMIO     0x01
 
+#if defined(CONFIG_VT) && defined(CONFIG_VGA_CONSOLE)
 static void
 sn_scan_pcdp(void)
 {
@@ -358,6 +359,7 @@ sn_scan_pcdp(void)
                 break; /* once we find the primary, we're done */
         }
 }
+#endif
 
 static unsigned long sn2_rtc_initial;
 
diff --git a/arch/ia64/sn/kernel/sn2/prominfo_proc.c b/arch/ia64/sn/kernel/sn2/prominfo_proc.c
index 81c63b2f8ae9..6ae276d5d50c 100644
--- a/arch/ia64/sn/kernel/sn2/prominfo_proc.c
+++ b/arch/ia64/sn/kernel/sn2/prominfo_proc.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1999,2001-2004 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (C) 1999,2001-2004, 2006 Silicon Graphics, Inc.  All Rights Reserved.
  *
  * Module to export the system's Firmware Interface Tables, including
  * PROM revision numbers and banners, in /proc
@@ -190,7 +190,7 @@ static int
 read_version_entry(char *page, char **start, off_t off, int count, int *eof,
                    void *data)
 {
-        int len = 0;
+        int len;
 
         /* data holds the NASID of the node */
         len = dump_version(page, (unsigned long)data);
@@ -202,7 +202,7 @@ static int
 read_fit_entry(char *page, char **start, off_t off, int count, int *eof,
                void *data)
 {
-        int len = 0;
+        int len;
 
         /* data holds the NASID of the node */
         len = dump_fit(page, (unsigned long)data);
@@ -229,13 +229,16 @@ int __init prominfo_init(void)
         struct proc_dir_entry *p;
         cnodeid_t cnodeid;
         unsigned long nasid;
+        int size;
         char name[NODE_NAME_LEN];
 
         if (!ia64_platform_is("sn2"))
                 return 0;
 
-        proc_entries = kmalloc(num_online_nodes() * sizeof(struct proc_dir_entry *),
-                               GFP_KERNEL);
+        size = num_online_nodes() * sizeof(struct proc_dir_entry *);
+        proc_entries = kzalloc(size, GFP_KERNEL);
+        if (!proc_entries)
+                return -ENOMEM;
 
         sgi_prominfo_entry = proc_mkdir("sgi_prominfo", NULL);
 
@@ -244,14 +247,12 @@ int __init prominfo_init(void)
                 sprintf(name, "node%d", cnodeid);
                 *entp = proc_mkdir(name, sgi_prominfo_entry);
                 nasid = cnodeid_to_nasid(cnodeid);
-                p = create_proc_read_entry(
-                        "fit", 0, *entp, read_fit_entry,
-                        (void *)nasid);
+                p = create_proc_read_entry("fit", 0, *entp, read_fit_entry,
+                                           (void *)nasid);
                 if (p)
                         p->owner = THIS_MODULE;
-                p = create_proc_read_entry(
-                        "version", 0, *entp, read_version_entry,
-                        (void *)nasid);
+                p = create_proc_read_entry("version", 0, *entp,
+                                           read_version_entry, (void *)nasid);
                 if (p)
                         p->owner = THIS_MODULE;
                 entp++;
@@ -263,7 +264,7 @@ int __init prominfo_init(void)
 void __exit prominfo_exit(void)
 {
         struct proc_dir_entry **entp;
-        unsigned cnodeid;
+        unsigned int cnodeid;
         char name[NODE_NAME_LEN];
 
         entp = proc_entries;
diff --git a/arch/ia64/sn/kernel/sn2/sn2_smp.c b/arch/ia64/sn/kernel/sn2/sn2_smp.c
index f153a4c35c70..24eefb2fc55f 100644
--- a/arch/ia64/sn/kernel/sn2/sn2_smp.c
+++ b/arch/ia64/sn/kernel/sn2/sn2_smp.c
@@ -46,8 +46,14 @@ DECLARE_PER_CPU(struct ptc_stats, ptcstats);
 
 static  __cacheline_aligned DEFINE_SPINLOCK(sn2_global_ptc_lock);
 
-void sn2_ptc_deadlock_recovery(short *, short, short, int, volatile unsigned long *, unsigned long,
-        volatile unsigned long *, unsigned long);
+extern unsigned long
+sn2_ptc_deadlock_recovery_core(volatile unsigned long *, unsigned long,
+                               volatile unsigned long *, unsigned long,
+                               volatile unsigned long *, unsigned long);
+void
+sn2_ptc_deadlock_recovery(short *, short, short, int,
+                          volatile unsigned long *, unsigned long,
+                          volatile unsigned long *, unsigned long);
 
 /*
  * Note: some is the following is captured here to make degugging easier
@@ -59,16 +65,6 @@ void sn2_ptc_deadlock_recovery(short *, short, short, int, volatile unsigned lon
 #define reset_max_active_on_deadlock()  1
 #define PTC_LOCK(sh1)                   ((sh1) ? &sn2_global_ptc_lock : &sn_nodepda->ptc_lock)
 
-static inline void ptc_lock(int sh1, unsigned long *flagp)
-{
-        spin_lock_irqsave(PTC_LOCK(sh1), *flagp);
-}
-
-static inline void ptc_unlock(int sh1, unsigned long flags)
-{
-        spin_unlock_irqrestore(PTC_LOCK(sh1), flags);
-}
-
 struct ptc_stats {
         unsigned long ptc_l;
         unsigned long change_rid;
@@ -82,6 +78,8 @@ struct ptc_stats {
         unsigned long shub_ptc_flushes_not_my_mm;
 };
 
+#define sn2_ptctest     0
+
 static inline unsigned long wait_piowc(void)
 {
         volatile unsigned long *piows;
@@ -200,7 +198,7 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
         max_active = max_active_pio(shub1);
 
         itc = ia64_get_itc();
-        ptc_lock(shub1, &flags);
+        spin_lock_irqsave(PTC_LOCK(shub1), flags);
         itc2 = ia64_get_itc();
 
         __get_cpu_var(ptcstats).lock_itc_clocks += itc2 - itc;
@@ -258,7 +256,7 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
                 ia64_srlz_d();
         }
 
-        ptc_unlock(shub1, flags);
+        spin_unlock_irqrestore(PTC_LOCK(shub1), flags);
 
         preempt_enable();
 }
@@ -270,11 +268,12 @@ sn2_global_tlb_purge(struct mm_struct *mm, unsigned long start,
  * TLB flush transaction.  The recovery sequence is somewhat tricky & is
  * coded in assembly language.
  */
-void sn2_ptc_deadlock_recovery(short *nasids, short ib, short ie, int mynasid, volatile unsigned long *ptc0, unsigned long data0,
-        volatile unsigned long *ptc1, unsigned long data1)
+
+void
+sn2_ptc_deadlock_recovery(short *nasids, short ib, short ie, int mynasid,
+                          volatile unsigned long *ptc0, unsigned long data0,
+                          volatile unsigned long *ptc1, unsigned long data1)
 {
-        extern unsigned long sn2_ptc_deadlock_recovery_core(volatile unsigned long *, unsigned long,
-                volatile unsigned long *, unsigned long, volatile unsigned long *, unsigned long);
         short nasid, i;
         unsigned long *piows, zeroval, n;
 
diff --git a/arch/ia64/sn/kernel/sn2/sn_proc_fs.c b/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
index a06719d752a0..c686d9c12f7b 100644
--- a/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
+++ b/arch/ia64/sn/kernel/sn2/sn_proc_fs.c
@@ -6,11 +6,11 @@
  * Copyright (C) 2000-2005 Silicon Graphics, Inc. All rights reserved.
  */
 #include <linux/config.h>
-#include <asm/uaccess.h>
 
 #ifdef CONFIG_PROC_FS
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <asm/uaccess.h>
 #include <asm/sn/sn_sal.h>
 
 static int partition_id_show(struct seq_file *s, void *p)
@@ -90,10 +90,10 @@ static int coherence_id_open(struct inode *inode, struct file *file)
         return single_open(file, coherence_id_show, NULL);
 }
 
-static struct proc_dir_entry *sn_procfs_create_entry(
-        const char *name, struct proc_dir_entry *parent,
-        int (*openfunc)(struct inode *, struct file *),
-        int (*releasefunc)(struct inode *, struct file *))
+static struct proc_dir_entry
+*sn_procfs_create_entry(const char *name, struct proc_dir_entry *parent,
+                        int (*openfunc)(struct inode *, struct file *),
+                        int (*releasefunc)(struct inode *, struct file *))
 {
         struct proc_dir_entry *e = create_proc_entry(name, 0444, parent);
 
@@ -126,24 +126,24 @@ void register_sn_procfs(void)
                 return;
 
         sn_procfs_create_entry("partition_id", sgi_proc_dir,
-                partition_id_open, single_release);
+                               partition_id_open, single_release);
 
         sn_procfs_create_entry("system_serial_number", sgi_proc_dir,
-                system_serial_number_open, single_release);
+                               system_serial_number_open, single_release);
 
         sn_procfs_create_entry("licenseID", sgi_proc_dir, 
-                licenseID_open, single_release);
+                               licenseID_open, single_release);
 
         e = sn_procfs_create_entry("sn_force_interrupt", sgi_proc_dir, 
-                sn_force_interrupt_open, single_release);
+                                   sn_force_interrupt_open, single_release);
         if (e) 
                 e->proc_fops->write = sn_force_interrupt_write_proc;
 
         sn_procfs_create_entry("coherence_id", sgi_proc_dir, 
-                coherence_id_open, single_release);
+                               coherence_id_open, single_release);
         
         sn_procfs_create_entry("sn_topology", sgi_proc_dir,
-                sn_topology_open, sn_topology_release);
+                               sn_topology_open, sn_topology_release);
 }
 
 #endif /* CONFIG_PROC_FS */
diff --git a/arch/ia64/sn/kernel/sn2/timer.c b/arch/ia64/sn/kernel/sn2/timer.c
index deb9baf4d473..56a88b6df4b4 100644
--- a/arch/ia64/sn/kernel/sn2/timer.c
+++ b/arch/ia64/sn/kernel/sn2/timer.c
@@ -14,6 +14,7 @@
 
 #include <asm/hw_irq.h>
 #include <asm/system.h>
+#include <asm/timex.h>
 
 #include <asm/sn/leds.h>
 #include <asm/sn/shub_mmr.h>
@@ -28,9 +29,27 @@ static struct time_interpolator sn2_interpolator = {
         .source = TIME_SOURCE_MMIO64
 };
 
+/*
+ * sn udelay uses the RTC instead of the ITC because the ITC is not
+ * synchronized across all CPUs, and the thread may migrate to another CPU
+ * if preemption is enabled.
+ */
+static void
+ia64_sn_udelay (unsigned long usecs)
+{
+        unsigned long start = rtc_time();
+        unsigned long end = start +
+                        usecs * sn_rtc_cycles_per_second / 1000000;
+
+        while (time_before((unsigned long)rtc_time(), end))
+                cpu_relax();
+}
+
 void __init sn_timer_init(void)
 {
         sn2_interpolator.frequency = sn_rtc_cycles_per_second;
         sn2_interpolator.addr = RTC_COUNTER_ADDR;
         register_time_interpolator(&sn2_interpolator);
+
+        ia64_udelay = &ia64_sn_udelay;
 }
diff --git a/arch/ia64/sn/kernel/sn2/timer_interrupt.c b/arch/ia64/sn/kernel/sn2/timer_interrupt.c
index adf5db2e2afe..fa7f69945917 100644
--- a/arch/ia64/sn/kernel/sn2/timer_interrupt.c
+++ b/arch/ia64/sn/kernel/sn2/timer_interrupt.c
@@ -1,7 +1,7 @@
 /*
  *
  *
- * Copyright (c) 2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2005, 2006 Silicon Graphics, Inc.  All Rights Reserved.
  * 
  * This program is free software; you can redistribute it and/or modify it 
  * under the terms of version 2 of the GNU General Public License 
@@ -22,11 +22,6 @@
  * License along with this program; if not, write the Free Software 
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  * 
- * Contact information:  Silicon Graphics, Inc., 1600 Amphitheatre Pkwy, 
- * Mountain View, CA  94043, or:
- * 
- * http://www.sgi.com 
- * 
  * For further information regarding this notice, see: 
  * 
  * http://oss.sgi.com/projects/GenInfo/NoticeExplan
diff --git a/arch/ia64/sn/kernel/tiocx.c b/arch/ia64/sn/kernel/tiocx.c
index d263d3e8fbb9..8a56f8b5ffa2 100644
--- a/arch/ia64/sn/kernel/tiocx.c
+++ b/arch/ia64/sn/kernel/tiocx.c
@@ -284,12 +284,10 @@ struct sn_irq_info *tiocx_irq_alloc(nasid_t nasid, int widget, int irq,
         if ((nasid & 1) == 0)
                 return NULL;
 
-        sn_irq_info = kmalloc(sn_irq_size, GFP_KERNEL);
+        sn_irq_info = kzalloc(sn_irq_size, GFP_KERNEL);
         if (sn_irq_info == NULL)
                 return NULL;
 
-        memset(sn_irq_info, 0x0, sn_irq_size);
-
         status = tiocx_intr_alloc(nasid, widget, __pa(sn_irq_info), irq,
                                   req_nasid, slice);
         if (status) {
diff --git a/arch/ia64/sn/kernel/xpc_channel.c b/arch/ia64/sn/kernel/xpc_channel.c
index 36e5437a0fb6..cdf6856ce089 100644
--- a/arch/ia64/sn/kernel/xpc_channel.c
+++ b/arch/ia64/sn/kernel/xpc_channel.c
@@ -738,7 +738,9 @@ xpc_process_disconnect(struct xpc_channel *ch, unsigned long *irq_flags)
 
         /* make sure all activity has settled down first */
 
-        if (atomic_read(&ch->references) > 0) {
+        if (atomic_read(&ch->references) > 0 ||
+                        ((ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) &&
+                        !(ch->flags & XPC_C_DISCONNECTINGCALLOUT_MADE))) {
                 return;
         }
         DBUG_ON(atomic_read(&ch->kthreads_assigned) != 0);
@@ -775,7 +777,7 @@ xpc_process_disconnect(struct xpc_channel *ch, unsigned long *irq_flags)
 
         /* both sides are disconnected now */
 
-        if (ch->flags & XPC_C_CONNECTCALLOUT) {
+        if (ch->flags & XPC_C_DISCONNECTINGCALLOUT_MADE) {
                 spin_unlock_irqrestore(&ch->lock, *irq_flags);
                 xpc_disconnect_callout(ch, xpcDisconnected);
                 spin_lock_irqsave(&ch->lock, *irq_flags);
@@ -1300,7 +1302,7 @@ xpc_process_msg_IPI(struct xpc_partition *part, int ch_number)
                                 "delivered=%d, partid=%d, channel=%d\n",
                                 nmsgs_sent, ch->partid, ch->number);
 
-                        if (ch->flags & XPC_C_CONNECTCALLOUT) {
+                        if (ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) {
                                 xpc_activate_kthreads(ch, nmsgs_sent);
                         }
                 }
diff --git a/arch/ia64/sn/kernel/xpc_main.c b/arch/ia64/sn/kernel/xpc_main.c
index 9cd460dfe27e..8cbf16432570 100644
--- a/arch/ia64/sn/kernel/xpc_main.c
+++ b/arch/ia64/sn/kernel/xpc_main.c
@@ -750,12 +750,16 @@ xpc_daemonize_kthread(void *args)
                 /* let registerer know that connection has been established */
 
                 spin_lock_irqsave(&ch->lock, irq_flags);
-                if (!(ch->flags & XPC_C_CONNECTCALLOUT)) {
-                        ch->flags |= XPC_C_CONNECTCALLOUT;
+                if (!(ch->flags & XPC_C_CONNECTEDCALLOUT)) {
+                        ch->flags |= XPC_C_CONNECTEDCALLOUT;
                         spin_unlock_irqrestore(&ch->lock, irq_flags);
 
                         xpc_connected_callout(ch);
 
+                        spin_lock_irqsave(&ch->lock, irq_flags);
+                        ch->flags |= XPC_C_CONNECTEDCALLOUT_MADE;
+                        spin_unlock_irqrestore(&ch->lock, irq_flags);
+
                         /*
                          * It is possible that while the callout was being
                          * made that the remote partition sent some messages.
@@ -777,15 +781,17 @@ xpc_daemonize_kthread(void *args)
 
         if (atomic_dec_return(&ch->kthreads_assigned) == 0) {
                 spin_lock_irqsave(&ch->lock, irq_flags);
-                if ((ch->flags & XPC_C_CONNECTCALLOUT) &&
-                                !(ch->flags & XPC_C_DISCONNECTCALLOUT)) {
-                        ch->flags |= XPC_C_DISCONNECTCALLOUT;
+                if ((ch->flags & XPC_C_CONNECTEDCALLOUT_MADE) &&
+                                !(ch->flags & XPC_C_DISCONNECTINGCALLOUT)) {
+                        ch->flags |= XPC_C_DISCONNECTINGCALLOUT;
                         spin_unlock_irqrestore(&ch->lock, irq_flags);
 
                         xpc_disconnect_callout(ch, xpcDisconnecting);
-                } else {
-                        spin_unlock_irqrestore(&ch->lock, irq_flags);
+
+                        spin_lock_irqsave(&ch->lock, irq_flags);
+                        ch->flags |= XPC_C_DISCONNECTINGCALLOUT_MADE;
                 }
+                spin_unlock_irqrestore(&ch->lock, irq_flags);
                 if (atomic_dec_return(&part->nchannels_engaged) == 0) {
                         xpc_mark_partition_disengaged(part);
                         xpc_IPI_send_disengage(part);
diff --git a/arch/ia64/sn/pci/pci_dma.c b/arch/ia64/sn/pci/pci_dma.c
index 5a36292388eb..b4b84c269210 100644
--- a/arch/ia64/sn/pci/pci_dma.c
+++ b/arch/ia64/sn/pci/pci_dma.c
@@ -335,10 +335,10 @@ int sn_pci_legacy_read(struct pci_bus *bus, u16 port, u32 *val, u8 size)
          */
 
         SAL_CALL(isrv, SN_SAL_IOIF_PCI_SAFE,
-                pci_domain_nr(bus), bus->number,
-                0, /* io */
-                0, /* read */
-                port, size, __pa(val));
+                 pci_domain_nr(bus), bus->number,
+                 0, /* io */
+                 0, /* read */
+                 port, size, __pa(val));
 
         if (isrv.status == 0)
                 return size;
@@ -381,10 +381,10 @@ int sn_pci_legacy_write(struct pci_bus *bus, u16 port, u32 val, u8 size)
          */
 
         SAL_CALL(isrv, SN_SAL_IOIF_PCI_SAFE,
-                pci_domain_nr(bus), bus->number,
-                0, /* io */
-                1, /* write */
-                port, size, __pa(&val));
+                 pci_domain_nr(bus), bus->number,
+                 0, /* io */
+                 1, /* write */
+                 port, size, __pa(&val));
 
         if (isrv.status == 0)
                 return size;
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_ate.c b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
index aa3fa5152a32..1f0253bfe0a0 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_ate.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_ate.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2001-2004 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 2001-2006 Silicon Graphics, Inc. All rights reserved.
  */
 
 #include <linux/types.h>
@@ -12,7 +12,7 @@
 #include <asm/sn/pcibus_provider_defs.h>
 #include <asm/sn/pcidev.h>
 
-int pcibr_invalidate_ate = 0;   /* by default don't invalidate ATE on free */
+int pcibr_invalidate_ate;       /* by default don't invalidate ATE on free */
 
 /*
  * mark_ate: Mark the ate as either free or inuse.
@@ -20,14 +20,12 @@ int pcibr_invalidate_ate = 0;	/* by default don't invalidate ATE on free */
 static void mark_ate(struct ate_resource *ate_resource, int start, int number,
                      u64 value)
 {
-
         u64 *ate = ate_resource->ate;
         int index;
         int length = 0;
 
         for (index = start; length < number; index++, length++)
                 ate[index] = value;
-
 }
 
 /*
@@ -37,7 +35,6 @@ static void mark_ate(struct ate_resource *ate_resource, int start, int number,
 static int find_free_ate(struct ate_resource *ate_resource, int start,
                          int count)
 {
-
         u64 *ate = ate_resource->ate;
         int index;
         int start_free;
@@ -70,12 +67,10 @@ static int find_free_ate(struct ate_resource *ate_resource, int start,
 static inline void free_ate_resource(struct ate_resource *ate_resource,
                                      int start)
 {
-
         mark_ate(ate_resource, start, ate_resource->ate[start], 0);
         if ((ate_resource->lowest_free_index > start) ||
             (ate_resource->lowest_free_index < 0))
                 ate_resource->lowest_free_index = start;
-
 }
 
 /*
@@ -84,7 +79,6 @@ static inline void free_ate_resource(struct ate_resource *ate_resource,
 static inline int alloc_ate_resource(struct ate_resource *ate_resource,
                                      int ate_needed)
 {
-
         int start_index;
 
         /*
@@ -118,19 +112,12 @@ static inline int alloc_ate_resource(struct ate_resource *ate_resource,
  */
 int pcibr_ate_alloc(struct pcibus_info *pcibus_info, int count)
 {
-        int status = 0;
-        u64 flag;
+        int status;
+        unsigned long flags;
 
-        flag = pcibr_lock(pcibus_info);
+        spin_lock_irqsave(&pcibus_info->pbi_lock, flags);
         status = alloc_ate_resource(&pcibus_info->pbi_int_ate_resource, count);
-
-        if (status < 0) {
-                /* Failed to allocate */
-                pcibr_unlock(pcibus_info, flag);
-                return -1;
-        }
-
-        pcibr_unlock(pcibus_info, flag);
+        spin_unlock_irqrestore(&pcibus_info->pbi_lock, flags);
 
         return status;
 }
@@ -182,7 +169,7 @@ void pcibr_ate_free(struct pcibus_info *pcibus_info, int index)
                 ate_write(pcibus_info, index, count, (ate & ~PCI32_ATE_V));
         }
 
-        flags = pcibr_lock(pcibus_info);
+        spin_lock_irqsave(&pcibus_info->pbi_lock, flags);
         free_ate_resource(&pcibus_info->pbi_int_ate_resource, index);
-        pcibr_unlock(pcibus_info, flags);
+        spin_unlock_irqrestore(&pcibus_info->pbi_lock, flags);
 }
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
index 54ce5b7ceed2..9f86bb6519aa 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
@@ -137,14 +137,12 @@ pcibr_dmatrans_direct64(struct pcidev_info * info, u64 paddr,
                 pci_addr |= PCI64_ATTR_VIRTUAL;
 
         return pci_addr;
-
 }
 
 static dma_addr_t
 pcibr_dmatrans_direct32(struct pcidev_info * info,
                         u64 paddr, size_t req_size, u64 flags)
 {
-
         struct pcidev_info *pcidev_info = info->pdi_host_pcidev_info;
         struct pcibus_info *pcibus_info = (struct pcibus_info *)pcidev_info->
             pdi_pcibus_info;
@@ -171,7 +169,6 @@ pcibr_dmatrans_direct32(struct pcidev_info * info,
         }
 
         return PCI32_DIRECT_BASE | offset;
-
 }
 
 /*
@@ -218,9 +215,8 @@ void sn_dma_flush(u64 addr)
         u64 flags;
         u64 itte;
         struct hubdev_info *hubinfo;
-        volatile struct sn_flush_device_kernel *p;
-        volatile struct sn_flush_device_common *common;
-
+        struct sn_flush_device_kernel *p;
+        struct sn_flush_device_common *common;
         struct sn_flush_nasid_entry *flush_nasid_list;
 
         if (!sn_ioif_inited)
@@ -310,8 +306,7 @@ void sn_dma_flush(u64 addr)
                                              (common->sfdl_slot - 1));
                 }
         } else {
-                spin_lock_irqsave((spinlock_t *)&p->sfdl_flush_lock,
-                                  flags);
+                spin_lock_irqsave(&p->sfdl_flush_lock, flags);
                 *common->sfdl_flush_addr = 0;
 
                 /* force an interrupt. */
@@ -322,8 +317,7 @@ void sn_dma_flush(u64 addr)
                         cpu_relax();
 
                 /* okay, everything is synched up. */
-                spin_unlock_irqrestore((spinlock_t *)&p->sfdl_flush_lock,
-                                       flags);
+                spin_unlock_irqrestore(&p->sfdl_flush_lock, flags);
         }
         return;
 }
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_provider.c b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
index 2fac27049bf6..98f716bd92f0 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_provider.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_provider.c
@@ -163,9 +163,12 @@ pcibr_bus_fixup(struct pcibus_bussoft *prom_bussoft, struct pci_controller *cont
         /* Setup the PMU ATE map */
         soft->pbi_int_ate_resource.lowest_free_index = 0;
         soft->pbi_int_ate_resource.ate =
-            kmalloc(soft->pbi_int_ate_size * sizeof(u64), GFP_KERNEL);
-        memset(soft->pbi_int_ate_resource.ate, 0,
-               (soft->pbi_int_ate_size * sizeof(u64)));
+            kzalloc(soft->pbi_int_ate_size * sizeof(u64), GFP_KERNEL);
+
+        if (!soft->pbi_int_ate_resource.ate) {
+                kfree(soft);
+                return NULL;
+        }
 
         if (prom_bussoft->bs_asic_type == PCIIO_ASIC_TYPE_TIOCP) {
                 /* TIO PCI Bridge: find nearest node with CPUs */
diff --git a/arch/m32r/Makefile b/arch/m32r/Makefile
index 983d438b14b6..4b3c90ba926c 100644
--- a/arch/m32r/Makefile
+++ b/arch/m32r/Makefile
@@ -12,14 +12,14 @@ CFLAGS_MODULE += -mmodel=large
 
 ifdef CONFIG_CHIP_VDEC2
 cflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -Wa,-bitinst
-aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -Wa,-bitinst
+aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -O2 -Wa,-bitinst -Wa,-no-parallel
 else
 cflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2
-aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2
+aflags-$(CONFIG_ISA_M32R2)      += -DNO_FPU -m32r2 -O2
 endif
 
 cflags-$(CONFIG_ISA_M32R)       += -DNO_FPU
-aflags-$(CONFIG_ISA_M32R)       += -DNO_FPU -Wa,-no-bitinst
+aflags-$(CONFIG_ISA_M32R)       += -DNO_FPU -O2 -Wa,-no-bitinst
 
 CFLAGS += $(cflags-y)
 AFLAGS += $(aflags-y)
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index 71763f7a1d19..cb33097fefc4 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -36,7 +36,7 @@ int do_signal(struct pt_regs *, sigset_t *);
 asmlinkage int
 sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
                   unsigned long r2, unsigned long r3, unsigned long r4,
-                  unsigned long r5, unsigned long r6, struct pt_regs regs)
+                  unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
         sigset_t saveset, newset;
 
@@ -54,21 +54,21 @@ sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.r0 = -EINTR;
+        regs->r0 = -EINTR;
         while (1) {
                 current->state = TASK_INTERRUPTIBLE;
                 schedule();
-                if (do_signal(&regs, &saveset))
-                        return regs.r0;
+                if (do_signal(regs, &saveset))
+                        return regs->r0;
         }
 }
 
 asmlinkage int
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                 unsigned long r2, unsigned long r3, unsigned long r4,
-                unsigned long r5, unsigned long r6, struct pt_regs regs)
+                unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
-        return do_sigaltstack(uss, uoss, regs.spu);
+        return do_sigaltstack(uss, uoss, regs->spu);
 }
 
 
@@ -140,11 +140,10 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
 asmlinkage int
 sys_rt_sigreturn(unsigned long r0, unsigned long r1,
                  unsigned long r2, unsigned long r3, unsigned long r4,
-                 unsigned long r5, unsigned long r6, struct pt_regs regs)
+                 unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
-        struct rt_sigframe __user *frame = (struct rt_sigframe __user *)regs.spu;
+        struct rt_sigframe __user *frame = (struct rt_sigframe __user *)regs->spu;
         sigset_t set;
-        stack_t st;
         int result;
 
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -158,14 +157,11 @@ sys_rt_sigreturn(unsigned long r0, unsigned long r1,
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        if (restore_sigcontext(&regs, &frame->uc.uc_mcontext, &result))
+        if (restore_sigcontext(regs, &frame->uc.uc_mcontext, &result))
                 goto badframe;
 
-        if (__copy_from_user(&st, &frame->uc.uc_stack, sizeof(st)))
+        if (do_sigaltstack(&frame->uc.uc_stack, NULL, regs->spu) == -EFAULT)
                 goto badframe;
-        /* It is more difficult to avoid calling this function than to
-           call it and ignore errors.  */
-        do_sigaltstack(&st, NULL, regs.spu);
 
         return result;
 
diff --git a/arch/m32r/kernel/sys_m32r.c b/arch/m32r/kernel/sys_m32r.c
index fe55b28d3725..670cb49210af 100644
--- a/arch/m32r/kernel/sys_m32r.c
+++ b/arch/m32r/kernel/sys_m32r.c
@@ -29,28 +29,7 @@
 
 /*
  * sys_tas() - test-and-set
- * linuxthreads testing version
  */
-#ifndef CONFIG_SMP
-asmlinkage int sys_tas(int *addr)
-{
-        int oldval;
-        unsigned long flags;
-
-        if (!access_ok(VERIFY_WRITE, addr, sizeof (int)))
-                return -EFAULT;
-        local_irq_save(flags);
-        oldval = *addr;
-        if (!oldval)
-                *addr = 1;
-        local_irq_restore(flags);
-        return oldval;
-}
-#else /* CONFIG_SMP */
-#include <linux/spinlock.h>
-
-static DEFINE_SPINLOCK(tas_lock);
-
 asmlinkage int sys_tas(int *addr)
 {
         int oldval;
@@ -58,15 +37,43 @@ asmlinkage int sys_tas(int *addr)
         if (!access_ok(VERIFY_WRITE, addr, sizeof (int)))
                 return -EFAULT;
 
-        _raw_spin_lock(&tas_lock);
-        oldval = *addr;
-        if (!oldval)
-                *addr = 1;
-        _raw_spin_unlock(&tas_lock);
+        /* atomic operation:
+         *   oldval = *addr; *addr = 1;
+         */
+        __asm__ __volatile__ (
+                DCACHE_CLEAR("%0", "r4", "%1")
+                "       .fillinsn\n"
+                "1:\n"
+                "       lock    %0, @%1     ->  unlock  %2, @%1\n"
+                "2:\n"
+                /* NOTE:
+                 *   The m32r processor can accept interrupts only
+                 *   at the 32-bit instruction boundary.
+                 *   So, in the above code, the "unlock" instruction
+                 *   can be executed continuously after the "lock"
+                 *   instruction execution without any interruptions.
+                 */
+                ".section .fixup,\"ax\"\n"
+                "       .balign 4\n"
+                "3:     ldi     %0, #%3\n"
+                "       seth    r14, #high(2b)\n"
+                "       or3     r14, r14, #low(2b)\n"
+                "       jmp     r14\n"
+                ".previous\n"
+                ".section __ex_table,\"a\"\n"
+                "       .balign 4\n"
+                "       .long 1b,3b\n"
+                ".previous\n"
+                : "=&r" (oldval)
+                : "r" (addr), "r" (1), "i"(-EFAULT)
+                : "r14", "memory"
+#ifdef CONFIG_CHIP_M32700_TS1
+                  , "r4"
+#endif /* CONFIG_CHIP_M32700_TS1 */
+        );
 
         return oldval;
 }
-#endif /* CONFIG_SMP */
 
 /*
  * sys_pipe() is the normal C calling standard for creating
diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
index ce16bbe26a52..2d1dd2106c4d 100644
--- a/arch/m32r/lib/usercopy.c
+++ b/arch/m32r/lib/usercopy.c
@@ -64,7 +64,7 @@ do {									\
                 "       .balign 4\n"                                    \
                 "       .long 0b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(res), "=r"(count), "=&r" (__d0), "=&r" (__d1),   \
+                : "=&r"(res), "=&r"(count), "=&r" (__d0), "=&r" (__d1), \
                   "=&r" (__d2)                                          \
                 : "i"(-EFAULT), "0"(count), "1"(count), "3"(src),       \
                   "4"(dst)                                              \
@@ -101,7 +101,7 @@ do {									\
                 "       .balign 4\n"                                    \
                 "       .long 0b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(res), "=r"(count), "=&r" (__d0), "=&r" (__d1),   \
+                : "=&r"(res), "=&r"(count), "=&r" (__d0), "=&r" (__d1), \
                   "=&r" (__d2)                                          \
                 : "i"(-EFAULT), "0"(count), "1"(count), "3"(src),       \
                   "4"(dst)                                              \
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index 3f9cb55d0356..2d8ad0727b6b 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -129,6 +129,9 @@ void machine_power_off(void)
         for (;;);
 }
 
+void (*pm_power_off)(void) = machine_power_off;
+EXPORT_SYMBOL(pm_power_off);
+
 void show_regs(struct pt_regs * regs)
 {
         printk("\n");
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index e17d3adff021..58c22cd344d3 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc2
-# Thu Nov 24 01:06:21 2005
+# Linux kernel version: 2.6.16-rc4
+# Tue Feb 21 13:44:31 2006
 #
 CONFIG_MIPS=y
 
@@ -144,7 +144,6 @@ CONFIG_PREEMPT_BKL=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -250,6 +249,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -289,6 +289,7 @@ CONFIG_TCP_CONG_BIC=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -448,7 +449,7 @@ CONFIG_SCSI_SAS_ATTRS=m
 #
 # SCSI low-level drivers
 #
-CONFIG_ISCSI_TCP=m
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -774,6 +775,10 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
index d8e2674a1543..4a9f1ecefaf2 100644
--- a/arch/mips/kernel/binfmt_elfn32.c
+++ b/arch/mips/kernel/binfmt_elfn32.c
@@ -103,8 +103,9 @@ jiffies_to_compat_timeval(unsigned long jiffies, struct compat_timeval *value)
          * one divide.
          */
         u64 nsec = (u64)jiffies * TICK_NSEC;
-        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &value->tv_usec);
-        value->tv_usec /= NSEC_PER_USEC;
+        long rem;
+        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &rem);
+        value->tv_usec = rem / NSEC_PER_USEC;
 }
 
 #define ELF_CORE_EFLAGS EF_MIPS_ABI2
diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
index cec5f327e360..e31813779895 100644
--- a/arch/mips/kernel/binfmt_elfo32.c
+++ b/arch/mips/kernel/binfmt_elfo32.c
@@ -105,8 +105,9 @@ jiffies_to_compat_timeval(unsigned long jiffies, struct compat_timeval *value)
          * one divide.
          */
         u64 nsec = (u64)jiffies * TICK_NSEC;
-        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &value->tv_usec);
-        value->tv_usec /= NSEC_PER_USEC;
+        long rem;
+        value->tv_sec = div_long_long_rem(nsec, NSEC_PER_SEC, &rem);
+        value->tv_usec = rem / NSEC_PER_USEC;
 }
 
 #undef ELF_CORE_COPY_REGS
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 60353f5acc48..5f68b220c26d 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -230,6 +230,9 @@ sysn32_waitid(int which, compat_pid_t pid,
         long ret;
         mm_segment_t old_fs = get_fs();
 
+        if (!access_ok(VERIFY_WRITE, uinfo, sizeof(*uinfo)))
+                return -EFAULT;
+
         set_fs (KERNEL_DS);
         ret = sys_waitid(which, pid, uinfo, options,
                          uru ? (struct rusage __user *) &ru : NULL);
@@ -1450,25 +1453,6 @@ sys32_timer_create(u32 clock, struct sigevent32 __user *se32, timer_t __user *ti
         return sys_timer_create(clock, p, timer_id);
 }
 
-asmlinkage long
-sysn32_rt_sigtimedwait(const sigset_t __user *uthese,
-                       siginfo_t __user *uinfo,
-                       const struct compat_timespec __user *uts32,
-                       size_t sigsetsize)
-{
-        struct timespec __user *uts = NULL;
-
-        if (uts32) {
-                struct timespec ts;
-                uts = compat_alloc_user_space(sizeof(struct timespec));
-                if (get_user(ts.tv_sec, &uts32->tv_sec) ||
-                    get_user(ts.tv_nsec, &uts32->tv_nsec) ||
-                    copy_to_user (uts, &ts, sizeof (ts)))
-                        return -EFAULT;
-        }
-        return sys_rt_sigtimedwait(uthese, uinfo, uts, sigsetsize);
-}
-
 save_static_function(sys32_clone);
 __attribute_used__ noinline static int
 _sys32_clone(nabi_no_regargs struct pt_regs regs)
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index d83e033dbc87..2f2dc54b2e26 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -626,7 +626,7 @@ einval:	li	v0, -EINVAL
         sys     sys_fstatat64           4
         sys     sys_unlinkat            3
         sys     sys_renameat            4       /* 4295 */
-        sys     sys_linkat              4
+        sys     sys_linkat              5
         sys     sys_symlinkat           3
         sys     sys_readlinkat          4
         sys     sys_fchmodat            3
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index bc4980cefc8b..d87b5446fa13 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -245,9 +245,9 @@ EXPORT(sysn32_call_table)
         PTR     sys_capget
         PTR     sys_capset
         PTR     sys32_rt_sigpending             /* 6125 */
-        PTR     sysn32_rt_sigtimedwait
+        PTR     compat_sys_rt_sigtimedwait
         PTR     sys_rt_sigqueueinfo
-        PTR     sys32_rt_sigsuspend
+        PTR     sysn32_rt_sigsuspend
         PTR     sys32_sigaltstack
         PTR     compat_sys_utime                /* 6130 */
         PTR     sys_mknod
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 8a8b8dd90417..237cd8a2cd32 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -4,7 +4,7 @@
  * for more details.
  *
  * Copyright (C) 1991, 1992  Linus Torvalds
- * Copyright (C) 1994 - 2000  Ralf Baechle
+ * Copyright (C) 1994 - 2000, 2006  Ralf Baechle
  * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
  */
 #include <linux/cache.h>
@@ -106,8 +106,6 @@ typedef struct compat_siginfo {
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
-extern int do_signal32(sigset_t *oldset, struct pt_regs *regs);
-
 /* 32-bit compatibility types */
 
 #define _NSIG_BPW32     32
@@ -198,7 +196,7 @@ __attribute_used__ noinline static int
 _sys32_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
         compat_sigset_t *uset;
-        sigset_t newset, saveset;
+        sigset_t newset;
 
         uset = (compat_sigset_t *) regs.regs[4];
         if (get_sigset(&newset, uset))
@@ -206,19 +204,15 @@ _sys32_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal32(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 
 save_static_function(sys32_rt_sigsuspend);
@@ -226,8 +220,8 @@ __attribute_used__ noinline static int
 _sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
 {
         compat_sigset_t *uset;
-        sigset_t newset, saveset;
-        size_t sigsetsize;
+        sigset_t newset;
+        size_t sigsetsize;
 
         /* XXX Don't preclude handling different sized sigset_t's.  */
         sigsetsize = regs.regs[5];
@@ -240,19 +234,15 @@ _sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
         spin_lock_irq(&current->sighand->siglock);
-        saveset = current->blocked;
+        current->saved_sigmask = current->blocked;
         current->blocked = newset;
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        regs.regs[2] = EINTR;
-        regs.regs[7] = 1;
-        while (1) {
-                current->state = TASK_INTERRUPTIBLE;
-                schedule();
-                if (do_signal32(&saveset, &regs))
-                        return -EINTR;
-        }
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
 }
 
 asmlinkage int sys32_sigaction(int sig, const struct sigaction32 *act,
@@ -783,7 +773,7 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
                 regs->regs[2] = EINTR;
                 break;
         case ERESTARTSYS:
-                if(!(ka->sa.sa_flags & SA_RESTART)) {
+                if (!(ka->sa.sa_flags & SA_RESTART)) {
                         regs->regs[2] = EINTR;
                         break;
                 }
@@ -810,9 +800,10 @@ static inline int handle_signal(unsigned long sig, siginfo_t *info,
         return ret;
 }
 
-int do_signal32(sigset_t *oldset, struct pt_regs *regs)
+void do_signal32(struct pt_regs *regs)
 {
         struct k_sigaction ka;
+        sigset_t *oldset;
         siginfo_t info;
         int signr;
 
@@ -822,17 +813,30 @@ int do_signal32(sigset_t *oldset, struct pt_regs *regs)
          * if so.
          */
         if (!user_mode(regs))
-                return 1;
+                return;
 
         if (try_to_freeze())
                 goto no_signal;
 
-        if (!oldset)
+        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                oldset = &current->saved_sigmask;
+        else
                 oldset = &current->blocked;
 
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
-        if (signr > 0)
-                return handle_signal(signr, &info, &ka, oldset, regs);
+        if (signr > 0) {
+                /* Whee! Actually deliver the signal. */
+                if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
+                        /*
+                        * A signal was successfully delivered; the saved
+                        * sigmask will have been stored in the signal frame,
+                        * and will be restored by sigreturn, so we can simply
+                        * clear the TIF_RESTORE_SIGMASK flag.
+                        */
+                        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                }
+        }
 
 no_signal:
         /*
@@ -853,7 +857,15 @@ no_signal:
                         regs->cp0_epc -= 4;
                 }
         }
-        return 0;
+
+        /*
+        * If there's no signal to deliver, we just put the saved sigmask
+        * back
+        */
+        if (test_thread_flag(TIF_RESTORE_SIGMASK)) {
+                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+        }
 }
 
 asmlinkage int sys32_rt_sigaction(int sig, const struct sigaction32 *act,
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index 5a3776096f07..3e168c08a3a8 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -81,6 +81,39 @@ struct rt_sigframe_n32 {
 #endif
 };
 
+extern void sigset_from_compat (sigset_t *set, compat_sigset_t *compat);
+
+save_static_function(sysn32_rt_sigsuspend);
+__attribute_used__ noinline static int
+_sysn32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
+{
+        compat_sigset_t __user *unewset, uset;
+        size_t sigsetsize;
+        sigset_t newset;
+
+        /* XXX Don't preclude handling different sized sigset_t's.  */
+        sigsetsize = regs.regs[5];
+        if (sigsetsize != sizeof(sigset_t))
+                return -EINVAL;
+
+        unewset = (compat_sigset_t __user *) regs.regs[4];
+        if (copy_from_user(&uset, unewset, sizeof(uset)))
+                return -EFAULT;
+        sigset_from_compat (&newset, &uset);
+        sigdelsetmask(&newset, ~_BLOCKABLE);
+
+        spin_lock_irq(&current->sighand->siglock);
+        current->saved_sigmask = current->blocked;
+        current->blocked = newset;
+        recalc_sigpending();
+        spin_unlock_irq(&current->sighand->siglock);
+
+        current->state = TASK_INTERRUPTIBLE;
+        schedule();
+        set_thread_flag(TIF_RESTORE_SIGMASK);
+        return -ERESTARTNOHAND;
+}
+
 save_static_function(sysn32_rt_sigreturn);
 __attribute_used__ noinline static void
 _sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 25472fcaf715..5e189862e523 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -29,6 +29,7 @@
 #include <linux/timex.h>
 #include <linux/sched.h>
 #include <linux/cpumask.h>
+#include <linux/cpu.h>
 
 #include <asm/atomic.h>
 #include <asm/cpu.h>
@@ -424,6 +425,25 @@ void flush_tlb_one(unsigned long vaddr)
         local_flush_tlb_one(vaddr);
 }
 
+static DEFINE_PER_CPU(struct cpu, cpu_devices);
+
+static int __init topology_init(void)
+{
+        int cpu;
+        int ret;
+
+        for_each_cpu(cpu) {
+                ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu, NULL);
+                if (ret)
+                        printk(KERN_WARNING "topology_init: register_cpu %d "
+                               "failed (%d)\n", cpu, ret);
+        }
+
+        return 0;
+}
+
+subsys_initcall(topology_init);
+
 EXPORT_SYMBOL(flush_tlb_page);
 EXPORT_SYMBOL(flush_tlb_one);
 EXPORT_SYMBOL(cpu_data);
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index c9d2b5147ca3..005debbfbe84 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1994 - 1999, 2000, 01 Ralf Baechle
+ * Copyright (C) 1994 - 1999, 2000, 01, 06 Ralf Baechle
  * Copyright (C) 1995, 1996 Paul M. Antoine
  * Copyright (C) 1998 Ulf Carlsson
  * Copyright (C) 1999 Silicon Graphics, Inc.
@@ -548,6 +548,8 @@ asmlinkage void do_ov(struct pt_regs *regs)
 {
         siginfo_t info;
 
+        die_if_kernel("Integer overflow", regs);
+
         info.si_code = FPE_INTOVF;
         info.si_signo = SIGFPE;
         info.si_errno = 0;
diff --git a/arch/mips/mm/cex-sb1.S b/arch/mips/mm/cex-sb1.S
index 0e71580774ff..e54a62f2807c 100644
--- a/arch/mips/mm/cex-sb1.S
+++ b/arch/mips/mm/cex-sb1.S
@@ -64,7 +64,7 @@ LEAF(except_vec2_sb1)
         sd      k0,0x170($0)
         sd      k1,0x178($0)
 
-#if CONFIG_SB1_CEX_ALWAYS_FATAL
+#ifdef CONFIG_SB1_CEX_ALWAYS_FATAL
         j       handle_vec2_sb1
          nop
 #else
diff --git a/arch/mips/pmc-sierra/yosemite/smp.c b/arch/mips/pmc-sierra/yosemite/smp.c
index f17f575f58f0..7f8fda962190 100644
--- a/arch/mips/pmc-sierra/yosemite/smp.c
+++ b/arch/mips/pmc-sierra/yosemite/smp.c
@@ -94,7 +94,7 @@ void __init prom_prepare_cpus(unsigned int max_cpus)
 void prom_boot_secondary(int cpu, struct task_struct *idle)
 {
         unsigned long gp = (unsigned long) task_thread_info(idle);
-        unsigned long sp = __KSTK_TOP(idle);
+        unsigned long sp = __KSTK_TOS(idle);
 
         secondary_sp = sp;
         secondary_gp = gp;
diff --git a/arch/mips/sibyte/Kconfig b/arch/mips/sibyte/Kconfig
index de46f62ac462..816aee7fcd25 100644
--- a/arch/mips/sibyte/Kconfig
+++ b/arch/mips/sibyte/Kconfig
@@ -102,11 +102,11 @@ config SIMULATION
           Build a kernel suitable for running under the GDB simulator.
           Primarily adjusts the kernel's notion of time.
 
-config CONFIG_SB1_CEX_ALWAYS_FATAL
+config SB1_CEX_ALWAYS_FATAL
         bool "All cache exceptions considered fatal (no recovery attempted)"
         depends on SIBYTE_SB1xxx_SOC
 
-config CONFIG_SB1_CERR_STALL
+config SB1_CERR_STALL
         bool "Stall (rather than panic) on fatal cache error"
         depends on SIBYTE_SB1xxx_SOC
 
diff --git a/arch/mips/sibyte/bcm1480/irq.c b/arch/mips/sibyte/bcm1480/irq.c
index b2a1ba5d23df..9cf7d713b13c 100644
--- a/arch/mips/sibyte/bcm1480/irq.c
+++ b/arch/mips/sibyte/bcm1480/irq.c
@@ -139,7 +139,7 @@ void bcm1480_unmask_irq(int cpu, int irq)
 #ifdef CONFIG_SMP
 static void bcm1480_set_affinity(unsigned int irq, cpumask_t mask)
 {
-        int i = 0, old_cpu, cpu, int_on;
+        int i = 0, old_cpu, cpu, int_on, k;
         u64 cur_ints;
         irq_desc_t *desc = irq_desc + irq;
         unsigned long flags;
@@ -165,7 +165,6 @@ static void bcm1480_set_affinity(unsigned int irq, cpumask_t mask)
                 irq_dirty -= BCM1480_NR_IRQS_HALF;
         }
 
-        int k;
         for (k=0; k<2; k++) { /* Loop through high and low interrupt mask register */
                 cur_ints = ____raw_readq(IOADDR(A_BCM1480_IMR_MAPPER(old_cpu) + R_BCM1480_IMR_INTERRUPT_MASK_H + (k*BCM1480_IMR_HL_SPACING)));
                 int_on = !(cur_ints & (((u64) 1) << irq_dirty));
@@ -216,6 +215,7 @@ static void ack_bcm1480_irq(unsigned int irq)
 {
         u64 pending;
         unsigned int irq_dirty;
+        int k;
 
         /*
          * If the interrupt was an HT interrupt, now is the time to
@@ -227,7 +227,6 @@ static void ack_bcm1480_irq(unsigned int irq)
         if ((irq_dirty >= BCM1480_NR_IRQS_HALF) && (irq_dirty <= BCM1480_NR_IRQS)) {
                 irq_dirty -= BCM1480_NR_IRQS_HALF;
         }
-        int k;
         for (k=0; k<2; k++) { /* Loop through high and low LDT interrupts */
                 pending = __raw_readq(IOADDR(A_BCM1480_IMR_REGISTER(bcm1480_irq_owner[irq],
                                                 R_BCM1480_IMR_LDT_INTERRUPT_H + (k*BCM1480_IMR_HL_SPACING))));
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 80d114a3a837..a834f9e0bbb3 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -963,7 +963,7 @@ source "arch/powerpc/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
-        depends on PPC64
+        depends on PPC64 && EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index d6fed3f56580..2c3fd2007676 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:30 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb 10 17:33:08 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+# CONFIG_PPC_UDBG_16550 is not set
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -26,13 +30,12 @@ CONFIG_PPC_FPU=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
 CONFIG_SMP=y
-CONFIG_NR_CPUS=2
+CONFIG_NR_CPUS=4
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -47,8 +50,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
@@ -58,8 +59,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -68,8 +71,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -112,13 +117,12 @@ CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
 # CONFIG_PPC_RTAS is not set
 # CONFIG_MMIO_NVRAM is not set
+CONFIG_MPIC_BROKEN_U3=y
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -151,6 +155,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 # CONFIG_HOTPLUG_CPU is not set
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 # CONFIG_NUMA is not set
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -202,6 +207,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -239,6 +245,7 @@ CONFIG_NETFILTER=y
 # Core Netfilter Configuration
 #
 # CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -255,65 +262,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -324,6 +272,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -342,7 +295,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -545,13 +497,7 @@ CONFIG_SCSI_SATA_SVW=y
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -614,7 +560,6 @@ CONFIG_IEEE1394_SBP2=m
 CONFIG_IEEE1394_ETH1394=m
 CONFIG_IEEE1394_DV1394=m
 CONFIG_IEEE1394_RAWIO=y
-# CONFIG_IEEE1394_CMP is not set
 
 #
 # I2O device support
@@ -630,6 +575,7 @@ CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
 
 #
 # Network device support
@@ -682,8 +628,9 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
-CONFIG_TIGON3=m
+CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
 # CONFIG_MV643XX_ETH is not set
 
@@ -861,8 +808,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
-CONFIG_I2C_KEYWEST=y
-CONFIG_I2C_PMAC_SMU=y
+CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -895,6 +841,12 @@ CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -961,7 +913,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
@@ -1008,9 +959,10 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 
 #
 # Generic devices
@@ -1024,6 +976,8 @@ CONFIG_SND_GENERIC_DRIVER=y
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1032,39 +986,38 @@ CONFIG_SND_GENERIC_DRIVER=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_ALS4000 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # ALSA PowerMac devices
@@ -1136,13 +1089,16 @@ CONFIG_USB_STORAGE_DPCM=y
 CONFIG_USB_STORAGE_SDDR09=y
 CONFIG_USB_STORAGE_SDDR55=y
 CONFIG_USB_STORAGE_JUMPSHOT=y
+# CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 CONFIG_HID_FF=y
 CONFIG_HID_PID=y
 CONFIG_LOGITECH_FF=y
@@ -1159,6 +1115,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1207,6 +1164,7 @@ CONFIG_USB_SERIAL_GENERIC=y
 # CONFIG_USB_SERIAL_AIRPRIME is not set
 # CONFIG_USB_SERIAL_ANYDATA is not set
 CONFIG_USB_SERIAL_BELKIN=m
+# CONFIG_USB_SERIAL_WHITEHEAT is not set
 CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m
 # CONFIG_USB_SERIAL_CP2101 is not set
 CONFIG_USB_SERIAL_CYPRESS_M8=m
@@ -1288,6 +1246,10 @@ CONFIG_USB_EZUSB=y
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1317,6 +1279,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1357,6 +1320,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1426,6 +1390,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1481,10 +1446,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 
 #
 # Instrumentation Support
@@ -1497,24 +1458,31 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUGGER is not set
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 6f6c6bed1aa5..0362a70aa97c 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:38 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb 10 17:32:14 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+CONFIG_GENERIC_TBSYNC=y
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=32
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -48,8 +51,6 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
@@ -59,8 +60,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -69,8 +72,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 CONFIG_PPC_MAPLE=y
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_XICS=y
 CONFIG_U3_DART=y
 CONFIG_MPIC=y
@@ -124,8 +128,8 @@ CONFIG_RTAS_FLASH=m
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_MPIC_BROKEN_U3=y
 CONFIG_IBMVIO=y
+# CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
-CONFIG_GENERIC_TBSYNC=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -158,6 +162,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_PPC_SPLPAR=y
 CONFIG_EEH=y
@@ -178,6 +183,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 # CONFIG_PPC_64K_PAGES is not set
 # CONFIG_SCHED_SMT is not set
 CONFIG_PROC_DEVICETREE=y
@@ -221,6 +227,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -260,6 +267,7 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -277,65 +285,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-CONFIG_IP_NF_MATCH_DCCP=m
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -346,6 +295,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -364,7 +318,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -572,13 +525,7 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-CONFIG_SCSI_QLA6312=m
-CONFIG_SCSI_QLA24XX=m
+# CONFIG_SCSI_QLA_FC is not set
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -642,8 +589,6 @@ CONFIG_IEEE1394_SBP2=m
 CONFIG_IEEE1394_ETH1394=m
 CONFIG_IEEE1394_DV1394=m
 CONFIG_IEEE1394_RAWIO=y
-CONFIG_IEEE1394_CMP=m
-CONFIG_IEEE1394_AMDTP=m
 
 #
 # I2O device support
@@ -659,6 +604,7 @@ CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
+CONFIG_WINDFARM_PM112=y
 
 #
 # Network device support
@@ -731,6 +677,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -853,6 +800,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -880,6 +828,7 @@ CONFIG_HVCS=m
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
 CONFIG_GEN_RTC=y
+# CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -923,8 +872,7 @@ CONFIG_I2C_AMD8111=y
 # CONFIG_I2C_I801 is not set
 # CONFIG_I2C_I810 is not set
 # CONFIG_I2C_PIIX4 is not set
-CONFIG_I2C_KEYWEST=y
-CONFIG_I2C_PMAC_SMU=y
+CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
@@ -957,6 +905,12 @@ CONFIG_I2C_PMAC_SMU=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -1028,7 +982,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
@@ -1073,9 +1026,10 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
-CONFIG_SND_GENERIC_DRIVER=y
 
 #
 # Generic devices
@@ -1089,6 +1043,8 @@ CONFIG_SND_GENERIC_DRIVER=y
 #
 # PCI devices
 #
+# CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -1097,39 +1053,38 @@ CONFIG_SND_GENERIC_DRIVER=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-# CONFIG_SND_AD1889 is not set
-# CONFIG_SND_ALS4000 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # ALSA PowerMac devices
@@ -1201,13 +1156,16 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1221,6 +1179,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1307,6 +1266,10 @@ CONFIG_INFINIBAND_IPOIB=m
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1340,6 +1303,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1379,6 +1343,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1449,6 +1414,7 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
 # CONFIG_SUN_PARTITION is not set
+# CONFIG_KARMA_PARTITION is not set
 # CONFIG_EFI_PARTITION is not set
 
 #
@@ -1504,10 +1470,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 
 #
 # Instrumentation Support
@@ -1520,18 +1482,20 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1540,6 +1504,11 @@ CONFIG_XMON=y
 # CONFIG_XMON_DEFAULT is not set
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index aa9893a1f6e8..daaf038a1faa 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.15-rc5
-# Tue Dec 20 15:59:40 2005
+# Linux kernel version: 2.6.16-rc2
+# Fri Feb 10 17:33:32 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -16,6 +16,10 @@ CONFIG_COMPAT=y
 CONFIG_SYSVIPC_COMPAT=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_PPC_OF=y
+CONFIG_PPC_UDBG_16550=y
+# CONFIG_GENERIC_TBSYNC is not set
+# CONFIG_DEFAULT_UIMAGE is not set
 
 #
 # Processor support
@@ -33,7 +37,6 @@ CONFIG_NR_CPUS=128
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -49,8 +52,6 @@ CONFIG_POSIX_MQUEUE=y
 CONFIG_SYSCTL=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
@@ -60,8 +61,10 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -70,8 +73,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -113,7 +118,6 @@ CONFIG_PPC_PSERIES=y
 # CONFIG_PPC_PMAC is not set
 # CONFIG_PPC_MAPLE is not set
 # CONFIG_PPC_CELL is not set
-CONFIG_PPC_OF=y
 CONFIG_XICS=y
 # CONFIG_U3_DART is not set
 CONFIG_MPIC=y
@@ -123,8 +127,8 @@ CONFIG_RTAS_PROC=y
 CONFIG_RTAS_FLASH=m
 # CONFIG_MMIO_NVRAM is not set
 CONFIG_IBMVIO=y
+# CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
-# CONFIG_GENERIC_TBSYNC is not set
 # CONFIG_CPU_FREQ is not set
 # CONFIG_WANT_EARLY_SERIAL is not set
 
@@ -145,6 +149,7 @@ CONFIG_FORCE_MAX_ZONEORDER=13
 CONFIG_IOMMU_VMERGE=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_KEXEC=y
+# CONFIG_CRASH_DUMP is not set
 CONFIG_IRQ_ALL_CPUS=y
 CONFIG_PPC_SPLPAR=y
 CONFIG_EEH=y
@@ -165,6 +170,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_SPARSEMEM_EXTREME=y
 # CONFIG_MEMORY_HOTPLUG is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_MIGRATION=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
@@ -209,6 +215,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -248,6 +255,7 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -265,65 +273,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-CONFIG_IP_NF_MATCH_ADDRTYPE=m
-CONFIG_IP_NF_MATCH_REALM=m
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_CONNBYTES=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_STRING=m
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-CONFIG_IP_NF_TARGET_NFQUEUE=m
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-CONFIG_IP_NF_TARGET_TTL=m
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -334,6 +283,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -352,7 +306,6 @@ CONFIG_LLC=y
 # QoS and/or fair queueing
 #
 # CONFIG_NET_SCHED is not set
-CONFIG_NET_CLS_ROUTE=y
 
 #
 # Network testing
@@ -550,13 +503,7 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-CONFIG_SCSI_QLA21XX=m
-CONFIG_SCSI_QLA22XX=m
-CONFIG_SCSI_QLA2300=m
-CONFIG_SCSI_QLA2322=m
-CONFIG_SCSI_QLA6312=m
-CONFIG_SCSI_QLA24XX=m
+# CONFIG_SCSI_QLA_FC is not set
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -678,6 +625,7 @@ CONFIG_E1000=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -803,6 +751,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -909,6 +858,12 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_DEBUG_CHIP is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -976,7 +931,6 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
@@ -1061,12 +1015,15 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1080,6 +1037,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1167,6 +1125,10 @@ CONFIG_INFINIBAND_IPOIB=m
 #
 
 #
+# EDAC - error detection and reporting (RAS)
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1200,6 +1162,7 @@ CONFIG_XFS_EXPORT=y
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1240,6 +1203,7 @@ CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1351,10 +1315,6 @@ CONFIG_CRC32=y
 CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_TEXTSEARCH=y
-CONFIG_TEXTSEARCH_KMP=m
-CONFIG_TEXTSEARCH_BM=m
-CONFIG_TEXTSEARCH_FSM=m
 
 #
 # Instrumentation Support
@@ -1367,18 +1327,20 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
@@ -1387,6 +1349,11 @@ CONFIG_XMON=y
 CONFIG_XMON_DEFAULT=y
 CONFIG_IRQSTACKS=y
 # CONFIG_BOOTX_TEXT is not set
+# CONFIG_PPC_EARLY_DEBUG_LPAR is not set
+# CONFIG_PPC_EARLY_DEBUG_G5 is not set
+# CONFIG_PPC_EARLY_DEBUG_RTAS is not set
+# CONFIG_PPC_EARLY_DEBUG_MAPLE is not set
+# CONFIG_PPC_EARLY_DEBUG_ISERIES is not set
 
 #
 # Security options
diff --git a/arch/powerpc/kernel/crash.c b/arch/powerpc/kernel/crash.c
index 8c21d378f5d2..778f22fd85d2 100644
--- a/arch/powerpc/kernel/crash.c
+++ b/arch/powerpc/kernel/crash.c
@@ -134,8 +134,10 @@ static void crash_kexec_prepare_cpus(void)
          * the crash CPU will send an IPI and wait for other CPUs to
          * respond. If not, proceed the kexec boot even though we failed to
          * capture other CPU states.
+         * Delay of at least 10 seconds.
          */
-        msecs = 1000000;
+        printk(KERN_ALERT "Sending IPI to other cpus...\n");
+        msecs = 10000;
         while ((atomic_read(&waiting_for_crash_ipi) > 0) && (--msecs > 0)) {
                 barrier();
                 mdelay(1);
diff --git a/arch/powerpc/kernel/head_32.S b/arch/powerpc/kernel/head_32.S
index 03b25f9359f8..a0579e859b21 100644
--- a/arch/powerpc/kernel/head_32.S
+++ b/arch/powerpc/kernel/head_32.S
@@ -714,6 +714,7 @@ AltiVecUnavailable:
 #ifdef CONFIG_ALTIVEC
         bne     load_up_altivec         /* if from user, just load it up */
 #endif /* CONFIG_ALTIVEC */
+        addi    r3,r1,STACK_FRAME_OVERHEAD
         EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 
 PerformanceMonitor:
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 415659629394..11f2cd5af7dc 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -139,7 +139,7 @@ _GLOBAL(__secondary_hold)
         ori     r24,r24,MSR_RI
         mtmsrd  r24                     /* RI on */
 
-        /* Grab our linux cpu number */
+        /* Grab our physical cpu number */
         mr      r24,r3
 
         /* Tell the master cpu we're here */
@@ -153,12 +153,7 @@ _GLOBAL(__secondary_hold)
         cmpdi   0,r4,1
         bne     100b
 
-#ifdef CONFIG_HMT
-        SET_REG_IMMEDIATE(r4, .hmt_init)
-        mtctr   r4
-        bctr
-#else
-#ifdef CONFIG_SMP
+#if defined(CONFIG_SMP) || defined(CONFIG_KEXEC)
         LOAD_REG_IMMEDIATE(r4, .pSeries_secondary_smp_init)
         mtctr   r4
         mr      r3,r24
@@ -166,7 +161,6 @@ _GLOBAL(__secondary_hold)
 #else
         BUG_OPCODE
 #endif
-#endif
 
 /* This value is used to mark exception frames on the stack. */
         .section ".toc","aw"
@@ -321,7 +315,6 @@ exception_marker:
 label##_pSeries:                                        \
         HMT_MEDIUM;                                     \
         mtspr   SPRN_SPRG1,r13;         /* save r13 */  \
-        RUNLATCH_ON(r13);                               \
         EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, label##_common)
 
 #define STD_EXCEPTION_ISERIES(n, label, area)           \
@@ -329,7 +322,6 @@ label##_pSeries:					\
 label##_iSeries:                                        \
         HMT_MEDIUM;                                     \
         mtspr   SPRN_SPRG1,r13;         /* save r13 */  \
-        RUNLATCH_ON(r13);                               \
         EXCEPTION_PROLOG_ISERIES_1(area);               \
         EXCEPTION_PROLOG_ISERIES_2;                     \
         b       label##_common
@@ -339,7 +331,6 @@ label##_iSeries:					\
 label##_iSeries:                                                        \
         HMT_MEDIUM;                                                     \
         mtspr   SPRN_SPRG1,r13;         /* save r13 */                  \
-        RUNLATCH_ON(r13);                                               \
         EXCEPTION_PROLOG_ISERIES_1(PACA_EXGEN);                         \
         lbz     r10,PACAPROCENABLED(r13);                               \
         cmpwi   0,r10,0;                                                \
@@ -392,6 +383,7 @@ label##_common:						\
 label##_common:                                         \
         EXCEPTION_PROLOG_COMMON(trap, PACA_EXGEN);      \
         DISABLE_INTS;                                   \
+        bl      .ppc64_runlatch_on;                     \
         addi    r3,r1,STACK_FRAME_OVERHEAD;             \
         bl      hdlr;                                   \
         b       .ret_from_except_lite
@@ -409,7 +401,6 @@ __start_interrupts:
 _machine_check_pSeries:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
         EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
 
         . = 0x300
@@ -436,7 +427,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
 data_access_slb_pSeries:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13
-        RUNLATCH_ON(r13)
         mfspr   r13,SPRN_SPRG3          /* get paca address into r13 */
         std     r3,PACA_EXSLB+EX_R3(r13)
         mfspr   r3,SPRN_DAR
@@ -462,7 +452,6 @@ data_access_slb_pSeries:
 instruction_access_slb_pSeries:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13
-        RUNLATCH_ON(r13)
         mfspr   r13,SPRN_SPRG3          /* get paca address into r13 */
         std     r3,PACA_EXSLB+EX_R3(r13)
         mfspr   r3,SPRN_SRR0            /* SRR0 is faulting address */
@@ -493,7 +482,6 @@ instruction_access_slb_pSeries:
         .globl  system_call_pSeries
 system_call_pSeries:
         HMT_MEDIUM
-        RUNLATCH_ON(r9)
         mr      r9,r13
         mfmsr   r10
         mfspr   r13,SPRN_SPRG3
@@ -577,7 +565,6 @@ slb_miss_user_pseries:
 system_reset_fwnmi:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
         EXCEPTION_PROLOG_PSERIES(PACA_EXGEN, system_reset_common)
 
         .globl machine_check_fwnmi
@@ -585,7 +572,6 @@ system_reset_fwnmi:
 machine_check_fwnmi:
         HMT_MEDIUM
         mtspr   SPRN_SPRG1,r13          /* save r13 */
-        RUNLATCH_ON(r13)
         EXCEPTION_PROLOG_PSERIES(PACA_EXMC, machine_check_common)
 
 #ifdef CONFIG_PPC_ISERIES
@@ -896,7 +882,6 @@ unrecov_fer:
         .align  7
         .globl data_access_common
 data_access_common:
-        RUNLATCH_ON(r10)                /* It wont fit in the 0x300 handler */
         mfspr   r10,SPRN_DAR
         std     r10,PACA_EXGEN+EX_DAR(r13)
         mfspr   r10,SPRN_DSISR
@@ -1044,6 +1029,7 @@ hardware_interrupt_common:
         EXCEPTION_PROLOG_COMMON(0x500, PACA_EXGEN)
 hardware_interrupt_entry:
         DISABLE_INTS
+        bl      .ppc64_runlatch_on
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      .do_IRQ
         b       .ret_from_except_lite
@@ -1818,22 +1804,6 @@ _STATIC(start_here_multiplatform)
         ori     r6,r6,MSR_RI
         mtmsrd  r6                      /* RI on */
 
-#ifdef CONFIG_HMT
-        /* Start up the second thread on cpu 0 */
-        mfspr   r3,SPRN_PVR
-        srwi    r3,r3,16
-        cmpwi   r3,0x34                 /* Pulsar  */
-        beq     90f
-        cmpwi   r3,0x36                 /* Icestar */
-        beq     90f
-        cmpwi   r3,0x37                 /* SStar   */
-        beq     90f
-        b       91f                     /* HMT not supported */
-90:     li      r3,0
-        bl      .hmt_start_secondary
-91:
-#endif
-
         /* The following gets the stack and TOC set up with the regs */
         /* pointing to the real addr of the kernel stack.  This is   */
         /* all done to support the C function call below which sets  */
@@ -1947,77 +1917,8 @@ _STATIC(start_here_common)
 
         bl .start_kernel
 
-_GLOBAL(hmt_init)
-#ifdef CONFIG_HMT
-        LOAD_REG_IMMEDIATE(r5, hmt_thread_data)
-        mfspr   r7,SPRN_PVR
-        srwi    r7,r7,16
-        cmpwi   r7,0x34                 /* Pulsar  */
-        beq     90f
-        cmpwi   r7,0x36                 /* Icestar */
-        beq     91f
-        cmpwi   r7,0x37                 /* SStar   */
-        beq     91f
-        b       101f
-90:     mfspr   r6,SPRN_PIR
-        andi.   r6,r6,0x1f
-        b       92f
-91:     mfspr   r6,SPRN_PIR
-        andi.   r6,r6,0x3ff
-92:     sldi    r4,r24,3
-        stwx    r6,r5,r4
-        bl      .hmt_start_secondary
-        b       101f
-
-__hmt_secondary_hold:
-        LOAD_REG_IMMEDIATE(r5, hmt_thread_data)
-        clrldi  r5,r5,4
-        li      r7,0
-        mfspr   r6,SPRN_PIR
-        mfspr   r8,SPRN_PVR
-        srwi    r8,r8,16
-        cmpwi   r8,0x34
-        bne     93f
-        andi.   r6,r6,0x1f
-        b       103f
-93:     andi.   r6,r6,0x3f
-
-103:    lwzx    r8,r5,r7
-        cmpw    r8,r6
-        beq     104f
-        addi    r7,r7,8
-        b       103b
-
-104:    addi    r7,r7,4
-        lwzx    r9,r5,r7
-        mr      r24,r9
-101:
-#endif
-        mr      r3,r24
-        b       .pSeries_secondary_smp_init
-
-#ifdef CONFIG_HMT
-_GLOBAL(hmt_start_secondary)
-        LOAD_REG_IMMEDIATE(r4,__hmt_secondary_hold)
-        clrldi  r4,r4,4
-        mtspr   SPRN_NIADORM, r4
-        mfspr   r4, SPRN_MSRDORM
-        li      r5, -65
-        and     r4, r4, r5
-        mtspr   SPRN_MSRDORM, r4
-        lis     r4,0xffef
-        ori     r4,r4,0x7403
-        mtspr   SPRN_TSC, r4
-        li      r4,0x1f4
-        mtspr   SPRN_TST, r4
-        mfspr   r4, SPRN_HID0
-        ori     r4, r4, 0x1
-        mtspr   SPRN_HID0, r4
-        mfspr   r4, SPRN_CTRLF
-        oris    r4, r4, 0x40
-        mtspr   SPRN_CTRLT, r4
-        blr
-#endif
+        /* Not reached */
+        BUG_OPCODE
 
 /*
  * We put a few things here that have to be page-aligned.
diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
index 1ae96a8ed7e2..e789fef4eb8a 100644
--- a/arch/powerpc/kernel/lparcfg.c
+++ b/arch/powerpc/kernel/lparcfg.c
@@ -341,7 +341,7 @@ static int lparcfg_data(struct seq_file *m, void *v)
         const char *system_id = "";
         unsigned int *lp_index_ptr, lp_index = 0;
         struct device_node *rtas_node;
-        int *lrdrp;
+        int *lrdrp = NULL;
 
         rootdn = find_path_device("/");
         if (rootdn) {
@@ -362,7 +362,9 @@ static int lparcfg_data(struct seq_file *m, void *v)
         seq_printf(m, "partition_id=%d\n", (int)lp_index);
 
         rtas_node = find_path_device("/rtas");
-        lrdrp = (int *)get_property(rtas_node, "ibm,lrdr-capacity", NULL);
+        if (rtas_node)
+                lrdrp = (int *)get_property(rtas_node, "ibm,lrdr-capacity",
+                                            NULL);
 
         if (lrdrp == NULL) {
                 partition_potential_processors = vdso_data->processorCount;
diff --git a/arch/powerpc/kernel/machine_kexec_64.c b/arch/powerpc/kernel/machine_kexec_64.c
index d6431440c54f..ee166c586642 100644
--- a/arch/powerpc/kernel/machine_kexec_64.c
+++ b/arch/powerpc/kernel/machine_kexec_64.c
@@ -26,8 +26,6 @@
 #include <asm/prom.h>
 #include <asm/smp.h>
 
-#define HASH_GROUP_SIZE 0x80    /* size of each hash group, asm/mmu.h */
-
 int default_machine_kexec_prepare(struct kimage *image)
 {
         int i;
@@ -61,7 +59,7 @@ int default_machine_kexec_prepare(struct kimage *image)
          */
         if (htab_address) {
                 low = __pa(htab_address);
-                high = low + (htab_hash_mask + 1) * HASH_GROUP_SIZE;
+                high = low + htab_size_bytes;
 
                 for (i = 0; i < image->nr_segments; i++) {
                         begin = image->segment[i].mem;
@@ -294,7 +292,7 @@ void default_machine_kexec(struct kimage *image)
 }
 
 /* Values we need to export to the second kernel via the device tree. */
-static unsigned long htab_base, htab_size, kernel_end;
+static unsigned long htab_base, kernel_end;
 
 static struct property htab_base_prop = {
         .name = "linux,htab-base",
@@ -305,7 +303,7 @@ static struct property htab_base_prop = {
 static struct property htab_size_prop = {
         .name = "linux,htab-size",
         .length = sizeof(unsigned long),
-        .value = (unsigned char *)&htab_size,
+        .value = (unsigned char *)&htab_size_bytes,
 };
 
 static struct property kernel_end_prop = {
@@ -331,8 +329,6 @@ static void __init export_htab_values(void)
 
         htab_base = __pa(htab_address);
         prom_add_property(node, &htab_base_prop);
-
-        htab_size = 1UL << ppc64_pft_size;
         prom_add_property(node, &htab_size_prop);
 
  out:
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index d9a459c144d8..8a731ea877b7 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -79,15 +79,8 @@ EXPORT_SYMBOL(sys_sigreturn);
 EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strpbrk);
-EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strcasecmp);
 
 EXPORT_SYMBOL(csum_partial);
@@ -185,9 +178,6 @@ EXPORT_SYMBOL(adb_try_handler_change);
 EXPORT_SYMBOL(cuda_request);
 EXPORT_SYMBOL(cuda_poll);
 #endif /* CONFIG_ADB_CUDA */
-#ifdef CONFIG_PPC_PMAC
-EXPORT_SYMBOL(sys_ctrler);
-#endif
 #ifdef CONFIG_VT
 EXPORT_SYMBOL(kd_mksound);
 #endif
@@ -205,7 +195,6 @@ EXPORT_SYMBOL(__lshrdi3);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memchr);
 
@@ -214,7 +203,6 @@ EXPORT_SYMBOL(screen_info);
 #endif
 
 #ifdef CONFIG_PPC32
-EXPORT_SYMBOL(__delay);
 EXPORT_SYMBOL(timer_interrupt);
 EXPORT_SYMBOL(irq_desc);
 EXPORT_SYMBOL(tb_ticks_per_jiffy);
@@ -222,10 +210,6 @@ EXPORT_SYMBOL(console_drivers);
 EXPORT_SYMBOL(cacheable_memcpy);
 #endif
 
-EXPORT_SYMBOL(__up);
-EXPORT_SYMBOL(__down);
-EXPORT_SYMBOL(__down_interruptible);
-
 #ifdef  CONFIG_8xx
 EXPORT_SYMBOL(cpm_install_handler);
 EXPORT_SYMBOL(cpm_free_handler);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 57703994a063..c225cf154bfe 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -888,3 +888,35 @@ void dump_stack(void)
         show_stack(current, NULL);
 }
 EXPORT_SYMBOL(dump_stack);
+
+#ifdef CONFIG_PPC64
+void ppc64_runlatch_on(void)
+{
+        unsigned long ctrl;
+
+        if (cpu_has_feature(CPU_FTR_CTRL) && !test_thread_flag(TIF_RUNLATCH)) {
+                HMT_medium();
+
+                ctrl = mfspr(SPRN_CTRLF);
+                ctrl |= CTRL_RUNLATCH;
+                mtspr(SPRN_CTRLT, ctrl);
+
+                set_thread_flag(TIF_RUNLATCH);
+        }
+}
+
+void ppc64_runlatch_off(void)
+{
+        unsigned long ctrl;
+
+        if (cpu_has_feature(CPU_FTR_CTRL) && test_thread_flag(TIF_RUNLATCH)) {
+                HMT_medium();
+
+                clear_thread_flag(TIF_RUNLATCH);
+
+                ctrl = mfspr(SPRN_CTRLF);
+                ctrl &= ~CTRL_RUNLATCH;
+                mtspr(SPRN_CTRLT, ctrl);
+        }
+}
+#endif
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 294832a7e0a6..6dbd21726770 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -816,8 +816,6 @@ void __init unflatten_device_tree(void)
 {
         unsigned long start, mem, size;
         struct device_node **allnextp = &allnodes;
-        char *p = NULL;
-        int l = 0;
 
         DBG(" -> unflatten_device_tree()\n");
 
@@ -857,19 +855,6 @@ void __init unflatten_device_tree(void)
         if (of_chosen == NULL)
                 of_chosen = of_find_node_by_path("/chosen@0");
 
-        /* Retreive command line */
-        if (of_chosen != NULL) {
-                p = (char *)get_property(of_chosen, "bootargs", &l);
-                if (p != NULL && l > 0)
-                        strlcpy(cmd_line, p, min(l, COMMAND_LINE_SIZE));
-        }
-#ifdef CONFIG_CMDLINE
-        if (l == 0 || (l == 1 && (*p) == 0))
-                strlcpy(cmd_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE);
-#endif /* CONFIG_CMDLINE */
-
-        DBG("Command line is: %s\n", cmd_line);
-
         DBG(" <- unflatten_device_tree()\n");
 }
 
@@ -940,6 +925,8 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
 {
         u32 *prop;
         unsigned long *lprop;
+        unsigned long l;
+        char *p;
 
         DBG("search \"chosen\", depth: %d, uname: %s\n", depth, uname);
 
@@ -1004,6 +991,41 @@ static int __init early_init_dt_scan_chosen(unsigned long node,
                crashk_res.end = crashk_res.start + *lprop - 1;
 #endif
 
+        /* Retreive command line */
+        p = of_get_flat_dt_prop(node, "bootargs", &l);
+        if (p != NULL && l > 0)
+                strlcpy(cmd_line, p, min((int)l, COMMAND_LINE_SIZE));
+
+#ifdef CONFIG_CMDLINE
+        if (l == 0 || (l == 1 && (*p) == 0))
+                strlcpy(cmd_line, CONFIG_CMDLINE, COMMAND_LINE_SIZE);
+#endif /* CONFIG_CMDLINE */
+
+        DBG("Command line is: %s\n", cmd_line);
+
+        if (strstr(cmd_line, "mem=")) {
+                char *p, *q;
+                unsigned long maxmem = 0;
+
+                for (q = cmd_line; (p = strstr(q, "mem=")) != 0; ) {
+                        q = p + 4;
+                        if (p > cmd_line && p[-1] != ' ')
+                                continue;
+                        maxmem = simple_strtoul(q, &q, 0);
+                        if (*q == 'k' || *q == 'K') {
+                                maxmem <<= 10;
+                                ++q;
+                        } else if (*q == 'm' || *q == 'M') {
+                                maxmem <<= 20;
+                                ++q;
+                        } else if (*q == 'g' || *q == 'G') {
+                                maxmem <<= 30;
+                                ++q;
+                        }
+                }
+                memory_limit = maxmem;
+        }
+
         /* break now */
         return 1;
 }
@@ -1124,7 +1146,7 @@ static void __init early_reserve_mem(void)
                         size_32 = *(reserve_map_32++);
                         if (size_32 == 0)
                                 break;
-                        DBG("reserving: %lx -> %lx\n", base_32, size_32);
+                        DBG("reserving: %x -> %x\n", base_32, size_32);
                         lmb_reserve(base_32, size_32);
                 }
                 return;
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index ec7153f4d47c..d34fe537400e 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -205,14 +205,6 @@ static cell_t __initdata regbuf[1024];
 
 #define MAX_CPU_THREADS 2
 
-/* TO GO */
-#ifdef CONFIG_HMT
-struct {
-        unsigned int pir;
-        unsigned int threadid;
-} hmt_thread_data[NR_CPUS];
-#endif /* CONFIG_HMT */
-
 /*
  * Error results ... some OF calls will return "-1" on error, some
  * will return 0, some will return either. To simplify, here are
@@ -1319,10 +1311,6 @@ static void __init prom_hold_cpus(void)
          */
         *spinloop = 0;
 
-#ifdef CONFIG_HMT
-        for (i = 0; i < NR_CPUS; i++)
-                RELOC(hmt_thread_data)[i].pir = 0xdeadbeef;
-#endif
         /* look for cpus */
         for (node = 0; prom_next_node(&node); ) {
                 type[0] = 0;
@@ -1389,32 +1377,6 @@ static void __init prom_hold_cpus(void)
                 /* Reserve cpu #s for secondary threads.   They start later. */
                 cpuid += cpu_threads;
         }
-#ifdef CONFIG_HMT
-        /* Only enable HMT on processors that provide support. */
-        if (__is_processor(PV_PULSAR) || 
-            __is_processor(PV_ICESTAR) ||
-            __is_processor(PV_SSTAR)) {
-                prom_printf("    starting secondary threads\n");
-
-                for (i = 0; i < NR_CPUS; i += 2) {
-                        if (!cpu_online(i))
-                                continue;
-
-                        if (i == 0) {
-                                unsigned long pir = mfspr(SPRN_PIR);
-                                if (__is_processor(PV_PULSAR)) {
-                                        RELOC(hmt_thread_data)[i].pir = 
-                                                pir & 0x1f;
-                                } else {
-                                        RELOC(hmt_thread_data)[i].pir = 
-                                                pir & 0x3ff;
-                                }
-                        }
-                }
-        } else {
-                prom_printf("Processor is not HMT capable\n");
-        }
-#endif
 
         if (cpuid > NR_CPUS)
                 prom_printf("WARNING: maximum CPUs (" __stringify(NR_CPUS)
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index a717dff695ef..f96c49b03ba0 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -311,8 +311,6 @@ void smp_release_cpus(void)
 
         DBG(" <- smp_release_cpus()\n");
 }
-#else
-#define smp_release_cpus()
 #endif /* CONFIG_SMP || CONFIG_KEXEC */
 
 /*
@@ -473,10 +471,12 @@ void __init setup_system(void)
         check_smt_enabled();
         smp_setup_cpu_maps();
 
+#ifdef CONFIG_SMP
         /* Release secondary cpus out of their spinloops at 0x60 now that
          * we can map physical -> logical CPU ids
          */
         smp_release_cpus();
+#endif
 
         printk("Starting Linux PPC64 %s\n", system_utsname.version);
 
diff --git a/arch/powerpc/kernel/sys_ppc32.c b/arch/powerpc/kernel/sys_ppc32.c
index 475249dc2350..cd75ab2908fa 100644
--- a/arch/powerpc/kernel/sys_ppc32.c
+++ b/arch/powerpc/kernel/sys_ppc32.c
@@ -176,7 +176,6 @@ struct timex32 {
 };
 
 extern int do_adjtimex(struct timex *);
-extern void ppc_adjtimex(void);
 
 asmlinkage long compat_sys_adjtimex(struct timex32 __user *utp)
 {
@@ -209,9 +208,6 @@ asmlinkage long compat_sys_adjtimex(struct timex32 __user *utp)
 
         ret = do_adjtimex(&txc);
 
-        /* adjust the conversion of TB to time of day to track adjtimex */
-        ppc_adjtimex();
-
         if(put_user(txc.modes, &utp->modes) ||
            __put_user(txc.offset, &utp->offset) ||
            __put_user(txc.freq, &utp->freq) ||
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 1886045a2fd8..2a7ddc579379 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -50,6 +50,7 @@
 #include <linux/security.h>
 #include <linux/percpu.h>
 #include <linux/rtc.h>
+#include <linux/jiffies.h>
 
 #include <asm/io.h>
 #include <asm/processor.h>
@@ -99,7 +100,15 @@ EXPORT_SYMBOL(tb_ticks_per_usec);
 unsigned long tb_ticks_per_sec;
 u64 tb_to_xs;
 unsigned tb_to_us;
-unsigned long processor_freq;
+
+#define TICKLEN_SCALE   (SHIFT_SCALE - 10)
+u64 last_tick_len;      /* units are ns / 2^TICKLEN_SCALE */
+u64 ticklen_to_xs;      /* 0.64 fraction */
+
+/* If last_tick_len corresponds to about 1/HZ seconds, then
+   last_tick_len << TICKLEN_SHIFT will be about 2^63. */
+#define TICKLEN_SHIFT   (63 - 30 - TICKLEN_SCALE + SHIFT_HZ)
+
 DEFINE_SPINLOCK(rtc_lock);
 EXPORT_SYMBOL_GPL(rtc_lock);
 
@@ -113,10 +122,6 @@ extern unsigned long wall_jiffies;
 extern struct timezone sys_tz;
 static long timezone_offset;
 
-void ppc_adjtimex(void);
-
-static unsigned adjusting_time = 0;
-
 unsigned long ppc_proc_freq;
 unsigned long ppc_tb_freq;
 
@@ -178,8 +183,7 @@ static __inline__ void timer_check_rtc(void)
          */
         if (ppc_md.set_rtc_time && ntp_synced() &&
             xtime.tv_sec - last_rtc_update >= 659 &&
-            abs((xtime.tv_nsec/1000) - (1000000-1000000/HZ)) < 500000/HZ &&
-            jiffies - wall_jiffies == 1) {
+            abs((xtime.tv_nsec/1000) - (1000000-1000000/HZ)) < 500000/HZ) {
                 struct rtc_time tm;
                 to_tm(xtime.tv_sec + 1 + timezone_offset, &tm);
                 tm.tm_year -= 1900;
@@ -226,15 +230,14 @@ void do_gettimeofday(struct timeval *tv)
         if (__USE_RTC()) {
                 /* do this the old way */
                 unsigned long flags, seq;
-                unsigned int sec, nsec, usec, lost;
+                unsigned int sec, nsec, usec;
 
                 do {
                         seq = read_seqbegin_irqsave(&xtime_lock, flags);
                         sec = xtime.tv_sec;
                         nsec = xtime.tv_nsec + tb_ticks_since(tb_last_stamp);
-                        lost = jiffies - wall_jiffies;
                 } while (read_seqretry_irqrestore(&xtime_lock, seq, flags));
-                usec = nsec / 1000 + lost * (1000000 / HZ);
+                usec = nsec / 1000;
                 while (usec >= 1000000) {
                         usec -= 1000000;
                         ++sec;
@@ -248,23 +251,6 @@ void do_gettimeofday(struct timeval *tv)
 
 EXPORT_SYMBOL(do_gettimeofday);
 
-/* Synchronize xtime with do_gettimeofday */ 
-
-static inline void timer_sync_xtime(unsigned long cur_tb)
-{
-#ifdef CONFIG_PPC64
-        /* why do we do this? */
-        struct timeval my_tv;
-
-        __do_gettimeofday(&my_tv, cur_tb);
-
-        if (xtime.tv_sec <= my_tv.tv_sec) {
-                xtime.tv_sec = my_tv.tv_sec;
-                xtime.tv_nsec = my_tv.tv_usec * 1000;
-        }
-#endif
-}
-
 /*
  * There are two copies of tb_to_xs and stamp_xsec so that no
  * lock is needed to access and use these values in
@@ -323,15 +309,30 @@ static __inline__ void timer_recalc_offset(u64 cur_tb)
 {
         unsigned long offset;
         u64 new_stamp_xsec;
+        u64 tlen, t2x;
 
         if (__USE_RTC())
                 return;
+        tlen = current_tick_length();
         offset = cur_tb - do_gtod.varp->tb_orig_stamp;
-        if ((offset & 0x80000000u) == 0)
-                return;
-        new_stamp_xsec = do_gtod.varp->stamp_xsec
-                + mulhdu(offset, do_gtod.varp->tb_to_xs);
-        update_gtod(cur_tb, new_stamp_xsec, do_gtod.varp->tb_to_xs);
+        if (tlen == last_tick_len && offset < 0x80000000u) {
+                /* check that we're still in sync; if not, resync */
+                struct timeval tv;
+                __do_gettimeofday(&tv, cur_tb);
+                if (tv.tv_sec <= xtime.tv_sec &&
+                    (tv.tv_sec < xtime.tv_sec ||
+                     tv.tv_usec * 1000 <= xtime.tv_nsec))
+                        return;
+        }
+        if (tlen != last_tick_len) {
+                t2x = mulhdu(tlen << TICKLEN_SHIFT, ticklen_to_xs);
+                last_tick_len = tlen;
+        } else
+                t2x = do_gtod.varp->tb_to_xs;
+        new_stamp_xsec = (u64) xtime.tv_nsec * XSEC_PER_SEC;
+        do_div(new_stamp_xsec, 1000000000);
+        new_stamp_xsec += (u64) xtime.tv_sec * XSEC_PER_SEC;
+        update_gtod(cur_tb, new_stamp_xsec, t2x);
 }
 
 #ifdef CONFIG_SMP
@@ -462,13 +463,10 @@ void timer_interrupt(struct pt_regs * regs)
                 write_seqlock(&xtime_lock);
                 tb_last_jiffy += tb_ticks_per_jiffy;
                 tb_last_stamp = per_cpu(last_jiffy, cpu);
-                timer_recalc_offset(tb_last_jiffy);
                 do_timer(regs);
-                timer_sync_xtime(tb_last_jiffy);
+                timer_recalc_offset(tb_last_jiffy);
                 timer_check_rtc();
                 write_sequnlock(&xtime_lock);
-                if (adjusting_time && (time_adjust == 0))
-                        ppc_adjtimex();
         }
         
         next_dec = tb_ticks_per_jiffy - ticks;
@@ -492,16 +490,18 @@ void timer_interrupt(struct pt_regs * regs)
 
 void wakeup_decrementer(void)
 {
-        int i;
+        unsigned long ticks;
 
-        set_dec(tb_ticks_per_jiffy);
         /*
-         * We don't expect this to be called on a machine with a 601,
-         * so using get_tbl is fine.
+         * The timebase gets saved on sleep and restored on wakeup,
+         * so all we need to do is to reset the decrementer.
          */
-        tb_last_stamp = tb_last_jiffy = get_tb();
-        for_each_cpu(i)
-                per_cpu(last_jiffy, i) = tb_last_stamp;
+        ticks = tb_ticks_since(__get_cpu_var(last_jiffy));
+        if (ticks < tb_ticks_per_jiffy)
+                ticks = tb_ticks_per_jiffy - ticks;
+        else
+                ticks = 1;
+        set_dec(ticks);
 }
 
 #ifdef CONFIG_SMP
@@ -541,8 +541,8 @@ int do_settimeofday(struct timespec *tv)
         time_t wtm_sec, new_sec = tv->tv_sec;
         long wtm_nsec, new_nsec = tv->tv_nsec;
         unsigned long flags;
-        long int tb_delta;
-        u64 new_xsec, tb_delta_xs;
+        u64 new_xsec;
+        unsigned long tb_delta;
 
         if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
                 return -EINVAL;
@@ -563,9 +563,19 @@ int do_settimeofday(struct timespec *tv)
                 first_settimeofday = 0;
         }
 #endif
+
+        /*
+         * Subtract off the number of nanoseconds since the
+         * beginning of the last tick.
+         * Note that since we don't increment jiffies_64 anywhere other
+         * than in do_timer (since we don't have a lost tick problem),
+         * wall_jiffies will always be the same as jiffies,
+         * and therefore the (jiffies - wall_jiffies) computation
+         * has been removed.
+         */
         tb_delta = tb_ticks_since(tb_last_stamp);
-        tb_delta += (jiffies - wall_jiffies) * tb_ticks_per_jiffy;
-        tb_delta_xs = mulhdu(tb_delta, do_gtod.varp->tb_to_xs);
+        tb_delta = mulhdu(tb_delta, do_gtod.varp->tb_to_xs); /* in xsec */
+        new_nsec -= SCALE_XSEC(tb_delta, 1000000000);
 
         wtm_sec  = wall_to_monotonic.tv_sec + (xtime.tv_sec - new_sec);
         wtm_nsec = wall_to_monotonic.tv_nsec + (xtime.tv_nsec - new_nsec);
@@ -580,12 +590,12 @@ int do_settimeofday(struct timespec *tv)
 
         ntp_clear();
 
-        new_xsec = 0;
-        if (new_nsec != 0) {
-                new_xsec = (u64)new_nsec * XSEC_PER_SEC;
+        new_xsec = xtime.tv_nsec;
+        if (new_xsec != 0) {
+                new_xsec *= XSEC_PER_SEC;
                 do_div(new_xsec, NSEC_PER_SEC);
         }
-        new_xsec += (u64)new_sec * XSEC_PER_SEC - tb_delta_xs;
+        new_xsec += (u64)xtime.tv_sec * XSEC_PER_SEC;
         update_gtod(tb_last_jiffy, new_xsec, do_gtod.varp->tb_to_xs);
 
         vdso_data->tz_minuteswest = sys_tz.tz_minuteswest;
@@ -671,7 +681,7 @@ void __init time_init(void)
         unsigned long flags;
         unsigned long tm = 0;
         struct div_result res;
-        u64 scale;
+        u64 scale, x;
         unsigned shift;
 
         if (ppc_md.time_init != NULL)
@@ -693,11 +703,36 @@ void __init time_init(void)
         }
 
         tb_ticks_per_jiffy = ppc_tb_freq / HZ;
-        tb_ticks_per_sec = tb_ticks_per_jiffy * HZ;
+        tb_ticks_per_sec = ppc_tb_freq;
         tb_ticks_per_usec = ppc_tb_freq / 1000000;
         tb_to_us = mulhwu_scale_factor(ppc_tb_freq, 1000000);
-        div128_by_32(1024*1024, 0, tb_ticks_per_sec, &res);
-        tb_to_xs = res.result_low;
+
+        /*
+         * Calculate the length of each tick in ns.  It will not be
+         * exactly 1e9/HZ unless ppc_tb_freq is divisible by HZ.
+         * We compute 1e9 * tb_ticks_per_jiffy / ppc_tb_freq,
+         * rounded up.
+         */
+        x = (u64) NSEC_PER_SEC * tb_ticks_per_jiffy + ppc_tb_freq - 1;
+        do_div(x, ppc_tb_freq);
+        tick_nsec = x;
+        last_tick_len = x << TICKLEN_SCALE;
+
+        /*
+         * Compute ticklen_to_xs, which is a factor which gets multiplied
+         * by (last_tick_len << TICKLEN_SHIFT) to get a tb_to_xs value.
+         * It is computed as:
+         * ticklen_to_xs = 2^N / (tb_ticks_per_jiffy * 1e9)
+         * where N = 64 + 20 - TICKLEN_SCALE - TICKLEN_SHIFT
+         * so as to give the result as a 0.64 fixed-point fraction.
+         */
+        div128_by_32(1ULL << (64 + 20 - TICKLEN_SCALE - TICKLEN_SHIFT), 0,
+                     tb_ticks_per_jiffy, &res);
+        div128_by_32(res.result_high, res.result_low, NSEC_PER_SEC, &res);
+        ticklen_to_xs = res.result_low;
+
+        /* Compute tb_to_xs from tick_nsec */
+        tb_to_xs = mulhdu(last_tick_len << TICKLEN_SHIFT, ticklen_to_xs);
 
         /*
          * Compute scale factor for sched_clock.
@@ -724,6 +759,14 @@ void __init time_init(void)
                 tm = get_boot_time();
 
         write_seqlock_irqsave(&xtime_lock, flags);
+
+        /* If platform provided a timezone (pmac), we correct the time */
+        if (timezone_offset) {
+                sys_tz.tz_minuteswest = -timezone_offset / 60;
+                sys_tz.tz_dsttime = 0;
+                tm -= timezone_offset;
+        }
+
         xtime.tv_sec = tm;
         xtime.tv_nsec = 0;
         do_gtod.varp = &do_gtod.vars[0];
@@ -738,18 +781,11 @@ void __init time_init(void)
         vdso_data->tb_orig_stamp = tb_last_jiffy;
         vdso_data->tb_update_count = 0;
         vdso_data->tb_ticks_per_sec = tb_ticks_per_sec;
-        vdso_data->stamp_xsec = xtime.tv_sec * XSEC_PER_SEC;
+        vdso_data->stamp_xsec = (u64) xtime.tv_sec * XSEC_PER_SEC;
         vdso_data->tb_to_xs = tb_to_xs;
 
         time_freq = 0;
 
-        /* If platform provided a timezone (pmac), we correct the time */
-        if (timezone_offset) {
-                sys_tz.tz_minuteswest = -timezone_offset / 60;
-                sys_tz.tz_dsttime = 0;
-                xtime.tv_sec -= timezone_offset;
-        }
-
         last_rtc_update = xtime.tv_sec;
         set_normalized_timespec(&wall_to_monotonic,
                                 -xtime.tv_sec, -xtime.tv_nsec);
@@ -759,126 +795,6 @@ void __init time_init(void)
         set_dec(tb_ticks_per_jiffy);
 }
 
-/* 
- * After adjtimex is called, adjust the conversion of tb ticks
- * to microseconds to keep do_gettimeofday synchronized 
- * with ntpd.
- *
- * Use the time_adjust, time_freq and time_offset computed by adjtimex to 
- * adjust the frequency.
- */
-
-/* #define DEBUG_PPC_ADJTIMEX 1 */
-
-void ppc_adjtimex(void)
-{
-#ifdef CONFIG_PPC64
-        unsigned long den, new_tb_ticks_per_sec, tb_ticks, old_xsec,
-                new_tb_to_xs, new_xsec, new_stamp_xsec;
-        unsigned long tb_ticks_per_sec_delta;
-        long delta_freq, ltemp;
-        struct div_result divres; 
-        unsigned long flags;
-        long singleshot_ppm = 0;
-
-        /*
-         * Compute parts per million frequency adjustment to
-         * accomplish the time adjustment implied by time_offset to be
-         * applied over the elapsed time indicated by time_constant.
-         * Use SHIFT_USEC to get it into the same units as
-         * time_freq.
-         */
-        if ( time_offset < 0 ) {
-                ltemp = -time_offset;
-                ltemp <<= SHIFT_USEC - SHIFT_UPDATE;
-                ltemp >>= SHIFT_KG + time_constant;
-                ltemp = -ltemp;
-        } else {
-                ltemp = time_offset;
-                ltemp <<= SHIFT_USEC - SHIFT_UPDATE;
-                ltemp >>= SHIFT_KG + time_constant;
-        }
-        
-        /* If there is a single shot time adjustment in progress */
-        if ( time_adjust ) {
-#ifdef DEBUG_PPC_ADJTIMEX
-                printk("ppc_adjtimex: ");
-                if ( adjusting_time == 0 )
-                        printk("starting ");
-                printk("single shot time_adjust = %ld\n", time_adjust);
-#endif  
-        
-                adjusting_time = 1;
-                
-                /*
-                 * Compute parts per million frequency adjustment
-                 * to match time_adjust
-                 */
-                singleshot_ppm = tickadj * HZ;  
-                /*
-                 * The adjustment should be tickadj*HZ to match the code in
-                 * linux/kernel/timer.c, but experiments show that this is too
-                 * large. 3/4 of tickadj*HZ seems about right
-                 */
-                singleshot_ppm -= singleshot_ppm / 4;
-                /* Use SHIFT_USEC to get it into the same units as time_freq */
-                singleshot_ppm <<= SHIFT_USEC;
-                if ( time_adjust < 0 )
-                        singleshot_ppm = -singleshot_ppm;
-        }
-        else {
-#ifdef DEBUG_PPC_ADJTIMEX
-                if ( adjusting_time )
-                        printk("ppc_adjtimex: ending single shot time_adjust\n");
-#endif
-                adjusting_time = 0;
-        }
-        
-        /* Add up all of the frequency adjustments */
-        delta_freq = time_freq + ltemp + singleshot_ppm;
-        
-        /*
-         * Compute a new value for tb_ticks_per_sec based on
-         * the frequency adjustment
-         */
-        den = 1000000 * (1 << (SHIFT_USEC - 8));
-        if ( delta_freq < 0 ) {
-                tb_ticks_per_sec_delta = ( tb_ticks_per_sec * ( (-delta_freq) >> (SHIFT_USEC - 8))) / den;
-                new_tb_ticks_per_sec = tb_ticks_per_sec + tb_ticks_per_sec_delta;
-        }
-        else {
-                tb_ticks_per_sec_delta = ( tb_ticks_per_sec * ( delta_freq >> (SHIFT_USEC - 8))) / den;
-                new_tb_ticks_per_sec = tb_ticks_per_sec - tb_ticks_per_sec_delta;
-        }
-        
-#ifdef DEBUG_PPC_ADJTIMEX
-        printk("ppc_adjtimex: ltemp = %ld, time_freq = %ld, singleshot_ppm = %ld\n", ltemp, time_freq, singleshot_ppm);
-        printk("ppc_adjtimex: tb_ticks_per_sec - base = %ld  new = %ld\n", tb_ticks_per_sec, new_tb_ticks_per_sec);
-#endif
-
-        /*
-         * Compute a new value of tb_to_xs (used to convert tb to
-         * microseconds) and a new value of stamp_xsec which is the
-         * time (in 1/2^20 second units) corresponding to
-         * tb_orig_stamp.  This new value of stamp_xsec compensates
-         * for the change in frequency (implied by the new tb_to_xs)
-         * which guarantees that the current time remains the same.
-         */
-        write_seqlock_irqsave( &xtime_lock, flags );
-        tb_ticks = get_tb() - do_gtod.varp->tb_orig_stamp;
-        div128_by_32(1024*1024, 0, new_tb_ticks_per_sec, &divres);
-        new_tb_to_xs = divres.result_low;
-        new_xsec = mulhdu(tb_ticks, new_tb_to_xs);
-
-        old_xsec = mulhdu(tb_ticks, do_gtod.varp->tb_to_xs);
-        new_stamp_xsec = do_gtod.varp->stamp_xsec + old_xsec - new_xsec;
-
-        update_gtod(do_gtod.varp->tb_orig_stamp, new_stamp_xsec, new_tb_to_xs);
-
-        write_sequnlock_irqrestore( &xtime_lock, flags );
-#endif /* CONFIG_PPC64 */
-}
-
 
 #define FEBRUARY        2
 #define STARTOFTIME     1970
diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
index d96bcfe4c6f6..33654d1b1b43 100644
--- a/arch/powerpc/mm/hash_native_64.c
+++ b/arch/powerpc/mm/hash_native_64.c
@@ -403,12 +403,17 @@ static void native_hpte_clear(void)
                  */
                 hpte_v = hptep->v;
 
+                /*
+                 * Call __tlbie() here rather than tlbie() since we
+                 * already hold the native_tlbie_lock.
+                 */
                 if (hpte_v & HPTE_V_VALID) {
                         hptep->v = 0;
-                        tlbie(slot2va(hpte_v, slot), MMU_PAGE_4K, 0);
+                        __tlbie(slot2va(hpte_v, slot), MMU_PAGE_4K);
                 }
         }
 
+        asm volatile("eieio; tlbsync; ptesync":::"memory");
         spin_unlock(&native_tlbie_lock);
         local_irq_restore(flags);
 }
diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c
index 149351a84b94..b1f614c612dd 100644
--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -88,6 +88,7 @@ static unsigned long _SDR1;
 struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT];
 
 hpte_t *htab_address;
+unsigned long htab_size_bytes;
 unsigned long htab_hash_mask;
 int mmu_linear_psize = MMU_PAGE_4K;
 int mmu_virtual_psize = MMU_PAGE_4K;
@@ -399,7 +400,7 @@ void create_section_mapping(unsigned long start, unsigned long end)
 
 void __init htab_initialize(void)
 {
-        unsigned long table, htab_size_bytes;
+        unsigned long table;
         unsigned long pteg_count;
         unsigned long mode_rw;
         unsigned long base = 0, size = 0;
diff --git a/arch/powerpc/oprofile/Kconfig b/arch/powerpc/oprofile/Kconfig
index eb2dece76a54..d03c0e5ca870 100644
--- a/arch/powerpc/oprofile/Kconfig
+++ b/arch/powerpc/oprofile/Kconfig
@@ -1,4 +1,5 @@
 config PROFILING
+        depends on !PPC_ISERIES
         bool "Profiling support (EXPERIMENTAL)"
         help
           Say Y here to enable the extended profiling support mechanisms used
diff --git a/arch/powerpc/platforms/iseries/lpevents.c b/arch/powerpc/platforms/iseries/lpevents.c
index 0b885300d1d1..8ca7b9396355 100644
--- a/arch/powerpc/platforms/iseries/lpevents.c
+++ b/arch/powerpc/platforms/iseries/lpevents.c
@@ -184,6 +184,8 @@ void setup_hvlpevent_queue(void)
 {
         void *eventStack;
 
+        spin_lock_init(&hvlpevent_queue.lock);
+
         /* Allocate a page for the Event Stack. */
         eventStack = alloc_bootmem_pages(LpEventStackSize);
         memset(eventStack, 0, LpEventStackSize);
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index 3f8790146b00..3ecc4a652d82 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -648,6 +648,7 @@ static void yield_shared_processor(void)
          * here and let the timer_interrupt code sort out the actual time.
          */
         get_lppaca()->int_dword.fields.decr_int = 1;
+        ppc64_runlatch_on();
         process_iSeries_events();
 }
 
diff --git a/arch/powerpc/platforms/maple/pci.c b/arch/powerpc/platforms/maple/pci.c
index 7d4099a34f92..85d6c93659cc 100644
--- a/arch/powerpc/platforms/maple/pci.c
+++ b/arch/powerpc/platforms/maple/pci.c
@@ -435,8 +435,8 @@ void __init maple_pci_init(void)
                         PCI_DN(np)->busno = 0xf0;
         }
 
-        /* Tell pci.c to use the common resource allocation mecanism */
-        pci_probe_only = 0;
+        /* Tell pci.c to not change any resource allocations.  */
+        pci_probe_only = 1;
         
         /* Allow all IO */
         io_page_mask = -1;
diff --git a/arch/powerpc/platforms/powermac/feature.c b/arch/powerpc/platforms/powermac/feature.c
index 558dd0692092..34714d3ea69a 100644
--- a/arch/powerpc/platforms/powermac/feature.c
+++ b/arch/powerpc/platforms/powermac/feature.c
@@ -1646,10 +1646,10 @@ static void intrepid_shutdown(struct macio_chip *macio, int sleep_mode)
                   KL0_SCC_CELL_ENABLE);
 
         MACIO_BIC(KEYLARGO_FCR1,
-                  /*KL1_USB2_CELL_ENABLE |*/
                 KL1_I2S0_CELL_ENABLE | KL1_I2S0_CLK_ENABLE_BIT |
                 KL1_I2S0_ENABLE | KL1_I2S1_CELL_ENABLE |
-                KL1_I2S1_CLK_ENABLE_BIT | KL1_I2S1_ENABLE);
+                KL1_I2S1_CLK_ENABLE_BIT | KL1_I2S1_ENABLE |
+                KL1_EIDE0_ENABLE);
         if (pmac_mb.board_flags & PMAC_MB_MOBILE)
                 MACIO_BIC(KEYLARGO_FCR1, KL1_UIDE_RESET_N);
 
@@ -2183,7 +2183,7 @@ static struct pmac_mb_def pmac_mb_defs[] = {
         },
         {       "PowerMac10,1",                 "Mac mini",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER,
+                PMAC_MB_MAY_SLEEP,
         },
         {       "iMac,1",                       "iMac (first generation)",
                 PMAC_TYPE_ORIG_IMAC,            paddington_features,
@@ -2295,11 +2295,11 @@ static struct pmac_mb_def pmac_mb_defs[] = {
         },
         {       "PowerBook5,8",                 "PowerBook G4 15\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
+                PMAC_MB_MAY_SLEEP  | PMAC_MB_MOBILE,
         },
         {       "PowerBook5,9",                 "PowerBook G4 17\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_HAS_FW_POWER | PMAC_MB_MOBILE,
+                PMAC_MB_MAY_SLEEP | PMAC_MB_MOBILE,
         },
         {       "PowerBook6,1",                 "PowerBook G4 12\"",
                 PMAC_TYPE_UNKNOWN_INTREPID,     intrepid_features,
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index e3fc3407bb1f..4e5c8f8d869d 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -9,13 +9,6 @@ config PPC_SPLPAR
           processors, that is, which share physical processors between
           two or more partitions.
 
-config HMT
-        bool "Hardware multithreading"
-        depends on SMP && PPC_PSERIES && BROKEN
-        help
-          This option enables hardware multithreading on RS64 cpus.
-          pSeries systems p620 and p660 have such a cpu type.
-
 config EEH
         bool "PCI Extended Error Handling (EEH)" if EMBEDDED
         depends on PPC_PSERIES
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 8e6b1ed1396e..8d710af50756 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -292,7 +292,7 @@ static inline int __devinit smp_startup_cpu(unsigned int lcpu)
         if (start_cpu == RTAS_UNKNOWN_SERVICE)
                 return 1;
 
-        status = rtas_call(start_cpu, 3, 1, NULL, pcpu, start_here, lcpu);
+        status = rtas_call(start_cpu, 3, 1, NULL, pcpu, start_here, pcpu);
         if (status != 0) {
                 printk(KERN_ERR "start-cpu failed: %i\n", status);
                 return 0;
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index 4f26304d0263..7dcdfcb3c984 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -234,7 +234,7 @@ static void mpic_shutdown_ht_interrupt(struct mpic *mpic, unsigned int source,
         spin_lock_irqsave(&mpic->fixup_lock, flags);
         writeb(0x10 + 2 * fixup->index, fixup->base + 2);
         tmp = readl(fixup->base + 4);
-        tmp &= ~1U;
+        tmp |= 1;
         writel(tmp, fixup->base + 4);
         spin_unlock_irqrestore(&mpic->fixup_lock, flags);
 }
@@ -446,14 +446,15 @@ static unsigned int mpic_startup_irq(unsigned int irq)
 #ifdef CONFIG_MPIC_BROKEN_U3
         struct mpic *mpic = mpic_from_irq(irq);
         unsigned int src = irq - mpic->irq_offset;
+#endif /* CONFIG_MPIC_BROKEN_U3 */
+
+        mpic_enable_irq(irq);
 
+#ifdef CONFIG_MPIC_BROKEN_U3
         if (mpic_is_ht_interrupt(mpic, src))
                 mpic_startup_ht_interrupt(mpic, src, irq_desc[irq].status);
-
 #endif /* CONFIG_MPIC_BROKEN_U3 */
 
-        mpic_enable_irq(irq);
-
         return 0;
 }
 
diff --git a/arch/ppc/kernel/head.S b/arch/ppc/kernel/head.S
index c5a890dca9cf..53ea845fb911 100644
--- a/arch/ppc/kernel/head.S
+++ b/arch/ppc/kernel/head.S
@@ -751,6 +751,7 @@ AltiVecUnavailable:
 #ifdef CONFIG_ALTIVEC
         bne     load_up_altivec         /* if from user, just load it up */
 #endif /* CONFIG_ALTIVEC */
+        addi    r3,r1,STACK_FRAME_OVERHEAD
         EXC_XFER_EE_LITE(0xf20, altivec_unavailable_exception)
 
 #ifdef CONFIG_PPC64BRIDGE
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index 15bd9b448a48..82adb4601348 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -93,15 +93,8 @@ EXPORT_SYMBOL(test_and_change_bit);
 EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strpbrk);
-EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strcasecmp);
 EXPORT_SYMBOL(__div64_32);
 
@@ -253,7 +246,6 @@ EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(cacheable_memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memchr);
 
diff --git a/arch/ppc/xmon/adb.c b/arch/ppc/xmon/adb.c
deleted file mode 100644
index e91384dcccac..000000000000
--- a/arch/ppc/xmon/adb.c
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
- * Copyright (C) 1996 Paul Mackerras.
- */
-#include "nonstdio.h"
-#include "privinst.h"
-
-#define scanhex xmon_scanhex
-#define skipbl  xmon_skipbl
-
-#define ADB_B           (*(volatile unsigned char *)0xf3016000)
-#define ADB_SR          (*(volatile unsigned char *)0xf3017400)
-#define ADB_ACR         (*(volatile unsigned char *)0xf3017600)
-#define ADB_IFR         (*(volatile unsigned char *)0xf3017a00)
-
-static inline void eieio(void) { asm volatile ("eieio" : :); }
-
-#define N_ADB_LOG       1000
-struct adb_log {
-    unsigned char b;
-    unsigned char ifr;
-    unsigned char acr;
-    unsigned int time;
-} adb_log[N_ADB_LOG];
-int n_adb_log;
-
-void
-init_adb_log(void)
-{
-    adb_log[0].b = ADB_B;
-    adb_log[0].ifr = ADB_IFR;
-    adb_log[0].acr = ADB_ACR;
-    adb_log[0].time = get_dec();
-    n_adb_log = 0;
-}
-
-void
-dump_adb_log(void)
-{
-    unsigned t, t0;
-    struct adb_log *ap;
-    int i;
-
-    ap = adb_log;
-    t0 = ap->time;
-    for (i = 0; i <= n_adb_log; ++i, ++ap) {
-        t = t0 - ap->time;
-        printf("b=%x ifr=%x acr=%x at %d.%.7d\n", ap->b, ap->ifr, ap->acr,
-               t / 1000000000, (t % 1000000000) / 100);
-    }
-}
-
-void
-adb_chklog(void)
-{
-    struct adb_log *ap = &adb_log[n_adb_log + 1];
-
-    ap->b = ADB_B;
-    ap->ifr = ADB_IFR;
-    ap->acr = ADB_ACR;
-    if (ap->b != ap[-1].b || (ap->ifr & 4) != (ap[-1].ifr & 4)
-        || ap->acr != ap[-1].acr) {
-        ap->time = get_dec();
-        ++n_adb_log;
-    }
-}
-
-int
-adb_bitwait(int bmask, int bval, int fmask, int fval)
-{
-    int i;
-    struct adb_log *ap;
-
-    for (i = 10000; i > 0; --i) {
-        adb_chklog();
-        ap = &adb_log[n_adb_log];
-        if ((ap->b & bmask) == bval && (ap->ifr & fmask) == fval)
-            return 0;
-    }
-    return -1;
-}
-
-int
-adb_wait(void)
-{
-    if (adb_bitwait(0, 0, 4, 4) < 0) {
-        printf("adb: ready wait timeout\n");
-        return -1;
-    }
-    return 0;
-}
-
-void
-adb_readin(void)
-{
-    int i, j;
-    unsigned char d[64];
-
-    if (ADB_B & 8) {
-        printf("ADB_B: %x\n", ADB_B);
-        return;
-    }
-    i = 0;
-    adb_wait();
-    j = ADB_SR;
-    eieio();
-    ADB_B &= ~0x20;
-    eieio();
-    for (;;) {
-        if (adb_wait() < 0)
-            break;
-        d[i++] = ADB_SR;
-        eieio();
-        if (ADB_B & 8)
-            break;
-        ADB_B ^= 0x10;
-        eieio();
-    }
-    ADB_B |= 0x30;
-    if (adb_wait() == 0)
-        j = ADB_SR;
-    for (j = 0; j < i; ++j)
-        printf("%.2x ", d[j]);
-    printf("\n");
-}
-
-int
-adb_write(unsigned char *d, int i)
-{
-    int j;
-    unsigned x;
-
-    if ((ADB_B & 8) == 0) {
-        printf("r: ");
-        adb_readin();
-    }
-    for (;;) {
-        ADB_ACR = 0x1c;
-        eieio();
-        ADB_SR = d[0];
-        eieio();
-        ADB_B &= ~0x20;
-        eieio();
-        if (ADB_B & 8)
-            break;
-        ADB_ACR = 0xc;
-        eieio();
-        ADB_B |= 0x20;
-        eieio();
-        adb_readin();
-    }
-    adb_wait();
-    for (j = 1; j < i; ++j) {
-        ADB_SR = d[j];
-        eieio();
-        ADB_B ^= 0x10;
-        eieio();
-        if (adb_wait() < 0)
-            break;
-    }
-    ADB_ACR = 0xc;
-    eieio();
-    x = ADB_SR;
-    eieio();
-    ADB_B |= 0x30;
-    return j;
-}
-
-void
-adbcmds(void)
-{
-    char cmd;
-    unsigned rtcu, rtcl, dec, pdec, x;
-    int i, j;
-    unsigned char d[64];
-
-    cmd = skipbl();
-    switch (cmd) {
-    case 't':
-        for (;;) {
-            rtcl = get_rtcl();
-            rtcu = get_rtcu();
-            dec = get_dec();
-            printf("rtc u=%u l=%u dec=%x (%d = %d.%.7d)\n",
-                   rtcu, rtcl, dec, pdec - dec, (pdec - dec) / 1000000000,
-                   ((pdec - dec) % 1000000000) / 100);
-            pdec = dec;
-            if (cmd == 'x')
-                break;
-            while (xmon_read(stdin, &cmd, 1) != 1)
-                ;
-        }
-        break;
-    case 'r':
-        init_adb_log();
-        while (adb_bitwait(8, 0, 0, 0) == 0)
-            adb_readin();
-        break;
-    case 'w':
-        i = 0;
-        while (scanhex(&x))
-            d[i++] = x;
-        init_adb_log();
-        j = adb_write(d, i);
-        printf("sent %d bytes\n", j);
-        while (adb_bitwait(8, 0, 0, 0) == 0)
-            adb_readin();
-        break;
-    case 'l':
-        dump_adb_log();
-        break;
-    }
-}
diff --git a/arch/ppc/xmon/start.c b/arch/ppc/xmon/start.c
index 4344cbe9b5c5..ff86b2d814cb 100644
--- a/arch/ppc/xmon/start.c
+++ b/arch/ppc/xmon/start.c
@@ -6,16 +6,11 @@
 #include <asm/machdep.h>
 #include <asm/io.h>
 #include <asm/page.h>
-#include <linux/adb.h>
-#include <linux/pmu.h>
-#include <linux/cuda.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/sysrq.h>
 #include <linux/bitops.h>
 #include <asm/xmon.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
 #include <asm/machdep.h>
 #include <asm/errno.h>
 #include <asm/processor.h>
@@ -26,9 +21,7 @@ static volatile unsigned char *sccc, *sccd;
 unsigned int TXRDY, RXRDY, DLAB;
 static int xmon_expect(const char *str, unsigned int timeout);
 
-static int use_screen;
 static int via_modem;
-static int xmon_use_sccb;
 
 #define TB_SPEED        25000000
 
@@ -46,47 +39,6 @@ void buf_access(void)
                 sccd[3] &= ~DLAB;       /* reset DLAB */
 }
 
-extern int adb_init(void);
-
-#ifdef CONFIG_PPC_CHRP
-/*
- * This looks in the "ranges" property for the primary PCI host bridge
- * to find the physical address of the start of PCI/ISA I/O space.
- * It is basically a cut-down version of pci_process_bridge_OF_ranges.
- */
-static unsigned long chrp_find_phys_io_base(void)
-{
-        struct device_node *node;
-        unsigned int *ranges;
-        unsigned long base = CHRP_ISA_IO_BASE;
-        int rlen = 0;
-        int np;
-
-        node = find_devices("isa");
-        if (node != NULL) {
-                node = node->parent;
-                if (node == NULL || node->type == NULL
-                    || strcmp(node->type, "pci") != 0)
-                        node = NULL;
-        }
-        if (node == NULL)
-                node = find_devices("pci");
-        if (node == NULL)
-                return base;
-
-        ranges = (unsigned int *) get_property(node, "ranges", &rlen);
-        np = prom_n_addr_cells(node) + 5;
-        while ((rlen -= np * sizeof(unsigned int)) >= 0) {
-                if ((ranges[0] >> 24) == 1 && ranges[2] == 0) {
-                        /* I/O space starting at 0, grab the phys base */
-                        base = ranges[np - 3];
-                        break;
-                }
-                ranges += np;
-        }
-        return base;
-}
-#endif /* CONFIG_PPC_CHRP */
 
 #ifdef CONFIG_MAGIC_SYSRQ
 static void sysrq_handle_xmon(int key, struct pt_regs *regs,
@@ -109,22 +61,6 @@ xmon_map_scc(void)
 #ifdef CONFIG_PPC_MULTIPLATFORM
         volatile unsigned char *base;
 
-#ifdef CONFIG_PPC_CHRP
-        base = (volatile unsigned char *) isa_io_base;
-        if (_machine == _MACH_chrp)
-                base = (volatile unsigned char *)
-                        ioremap(chrp_find_phys_io_base(), 0x1000);
-
-        sccc = base + 0x3fd;
-        sccd = base + 0x3f8;
-        if (xmon_use_sccb) {
-                sccc -= 0x100;
-                sccd -= 0x100;
-        }
-        TXRDY = 0x20;
-        RXRDY = 1;
-        DLAB = 0x80;
-#endif /* CONFIG_PPC_CHRP */
 #elif defined(CONFIG_GEMINI)
         /* should already be mapped by the kernel boot */
         sccc = (volatile unsigned char *) 0xffeffb0d;
@@ -143,22 +79,9 @@ xmon_map_scc(void)
         register_sysrq_key('x', &sysrq_xmon_op);
 }
 
-static int scc_initialized = 0;
+static int scc_initialized;
 
 void xmon_init_scc(void);
-extern void cuda_poll(void);
-
-static inline void do_poll_adb(void)
-{
-#ifdef CONFIG_ADB_PMU
-        if (sys_ctrler == SYS_CTRLER_PMU)
-                pmu_poll_adb();
-#endif /* CONFIG_ADB_PMU */
-#ifdef CONFIG_ADB_CUDA
-        if (sys_ctrler == SYS_CTRLER_CUDA)
-                cuda_poll();
-#endif /* CONFIG_ADB_CUDA */
-}
 
 int
 xmon_write(void *handle, void *ptr, int nb)
@@ -176,20 +99,12 @@ xmon_write(void *handle, void *ptr, int nb)
                         break;
 #endif
 
-#ifdef CONFIG_BOOTX_TEXT
-        if (use_screen) {
-                /* write it on the screen */
-                for (i = 0; i < nb; ++i)
-                        btext_drawchar(*p++);
-                goto out;
-        }
-#endif
         if (!scc_initialized)
                 xmon_init_scc();
         ct = 0;
         for (i = 0; i < nb; ++i) {
                 while ((*sccc & TXRDY) == 0)
-                        do_poll_adb();
+                        ;
                 c = p[i];
                 if (c == '\n' && !ct) {
                         c = '\r';
@@ -203,7 +118,6 @@ xmon_write(void *handle, void *ptr, int nb)
                 eieio();
         }
 
- out:
 #ifdef CONFIG_SMP
         if (!locked)
                 clear_bit(0, &xmon_write_lock);
@@ -212,65 +126,7 @@ xmon_write(void *handle, void *ptr, int nb)
 }
 
 int xmon_wants_key;
-int xmon_adb_keycode;
-
-#ifdef CONFIG_BOOTX_TEXT
-static int xmon_adb_shiftstate;
-
-static unsigned char xmon_keytab[128] =
-        "asdfhgzxcv\000bqwer"                           /* 0x00 - 0x0f */
-        "yt123465=97-80]o"                              /* 0x10 - 0x1f */
-        "u[ip\rlj'k;\\,/nm."                            /* 0x20 - 0x2f */
-        "\t `\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-
-static unsigned char xmon_shift_keytab[128] =
-        "ASDFHGZXCV\000BQWER"                           /* 0x00 - 0x0f */
-        "YT!@#$^%+(&_*)}O"                              /* 0x10 - 0x1f */
-        "U{IP\rLJ\"K:|<?NM>"                            /* 0x20 - 0x2f */
-        "\t ~\177\0\033\0\0\0\0\0\0\0\0\0\0"            /* 0x30 - 0x3f */
-        "\0.\0*\0+\0\0\0\0\0/\r\0-\0"                   /* 0x40 - 0x4f */
-        "\0\0000123456789\0\0\0";                       /* 0x50 - 0x5f */
-
-static int
-xmon_get_adb_key(void)
-{
-        int k, t, on;
 
-        xmon_wants_key = 1;
-        for (;;) {
-                xmon_adb_keycode = -1;
-                t = 0;
-                on = 0;
-                do {
-                        if (--t < 0) {
-                                on = 1 - on;
-                                btext_drawchar(on? 0xdb: 0x20);
-                                btext_drawchar('\b');
-                                t = 200000;
-                        }
-                        do_poll_adb();
-                } while (xmon_adb_keycode == -1);
-                k = xmon_adb_keycode;
-                if (on)
-                        btext_drawstring(" \b");
-
-                /* test for shift keys */
-                if ((k & 0x7f) == 0x38 || (k & 0x7f) == 0x7b) {
-                        xmon_adb_shiftstate = (k & 0x80) == 0;
-                        continue;
-                }
-                if (k >= 0x80)
-                        continue;       /* ignore up transitions */
-                k = (xmon_adb_shiftstate? xmon_shift_keytab: xmon_keytab)[k];
-                if (k != 0)
-                        break;
-        }
-        xmon_wants_key = 0;
-        return k;
-}
-#endif /* CONFIG_BOOTX_TEXT */
 
 int
 xmon_read(void *handle, void *ptr, int nb)
@@ -278,18 +134,11 @@ xmon_read(void *handle, void *ptr, int nb)
     char *p = ptr;
     int i;
 
-#ifdef CONFIG_BOOTX_TEXT
-    if (use_screen) {
-        for (i = 0; i < nb; ++i)
-            *p++ = xmon_get_adb_key();
-        return i;
-    }
-#endif
     if (!scc_initialized)
         xmon_init_scc();
     for (i = 0; i < nb; ++i) {
         while ((*sccc & RXRDY) == 0)
-            do_poll_adb();
+            ;
         buf_access();
         *p++ = *sccd;
     }
@@ -300,7 +149,7 @@ int
 xmon_read_poll(void)
 {
         if ((*sccc & RXRDY) == 0) {
-                do_poll_adb();
+                ;
                 return -1;
         }
         buf_access();
@@ -310,15 +159,6 @@ xmon_read_poll(void)
 void
 xmon_init_scc(void)
 {
-        if ( _machine == _MACH_chrp )
-        {
-                sccd[3] = 0x83; eieio();        /* LCR = 8N1 + DLAB */
-                sccd[0] = 12; eieio();          /* DLL = 9600 baud */
-                sccd[1] = 0; eieio();
-                sccd[2] = 0; eieio();           /* FCR = 0 */
-                sccd[3] = 3; eieio();           /* LCR = 8N1 */
-                sccd[1] = 0; eieio();           /* IER = 0 */
-        }
         scc_initialized = 1;
         if (via_modem) {
                 for (;;) {
@@ -334,22 +174,6 @@ xmon_init_scc(void)
         }
 }
 
-#if 0
-extern int (*prom_entry)(void *);
-
-int
-xmon_exit(void)
-{
-    struct prom_args {
-        char *service;
-    } args;
-
-    for (;;) {
-        args.service = "exit";
-        (*prom_entry)(&args);
-    }
-}
-#endif
 
 void *xmon_stdin;
 void *xmon_stdout;
diff --git a/arch/ppc/xmon/xmon.c b/arch/ppc/xmon/xmon.c
index bdaf6597b4c2..06fa44b5c647 100644
--- a/arch/ppc/xmon/xmon.c
+++ b/arch/ppc/xmon/xmon.c
@@ -12,8 +12,6 @@
 #include <linux/kallsyms.h>
 #include <asm/ptrace.h>
 #include <asm/string.h>
-#include <asm/prom.h>
-#include <asm/bootx.h>
 #include <asm/machdep.h>
 #include <asm/xmon.h>
 #include "nonstdio.h"
@@ -101,9 +99,6 @@ void cacheflush(void);
 static void cpu_cmd(void);
 #endif /* CONFIG_SMP */
 static void csum(void);
-#ifdef CONFIG_BOOTX_TEXT
-static void vidcmds(void);
-#endif
 static void bootcmds(void);
 static void proccall(void);
 static void printtime(void);
@@ -522,11 +517,6 @@ cmds(struct pt_regs *excp)
                         cpu_cmd();
                         break;
 #endif /* CONFIG_SMP */
-#ifdef CONFIG_BOOTX_TEXT
-                case 'v':
-                        vidcmds();
-                        break;
-#endif
                 case 'z':
                         bootcmds();
                         break;
@@ -618,43 +608,6 @@ static void cpu_cmd(void)
 }
 #endif /* CONFIG_SMP */
 
-#ifdef CONFIG_BOOTX_TEXT
-extern boot_infos_t disp_bi;
-
-static void vidcmds(void)
-{
-        int c = inchar();
-        unsigned int val, w;
-        extern int boot_text_mapped;
-
-        if (!boot_text_mapped)
-                return;
-        if (c != '\n' && scanhex(&val)) {
-                switch (c) {
-                case 'd':
-                        w = disp_bi.dispDeviceRowBytes
-                                / (disp_bi.dispDeviceDepth >> 3);
-                        disp_bi.dispDeviceDepth = val;
-                        disp_bi.dispDeviceRowBytes = w * (val >> 3);
-                        return;
-                case 'p':
-                        disp_bi.dispDeviceRowBytes = val;
-                        return;
-                case 'w':
-                        disp_bi.dispDeviceRect[2] = val;
-                        return;
-                case 'h':
-                        disp_bi.dispDeviceRect[3] = val;
-                        return;
-                }
-        }
-        printf("W = %d (0x%x) H = %d (0x%x) D = %d (0x%x) P = %d (0x%x)\n",
-               disp_bi.dispDeviceRect[2], disp_bi.dispDeviceRect[2],
-               disp_bi.dispDeviceRect[3], disp_bi.dispDeviceRect[3],
-               disp_bi.dispDeviceDepth, disp_bi.dispDeviceDepth,
-               disp_bi.dispDeviceRowBytes, disp_bi.dispDeviceRowBytes);
-}
-#endif /* CONFIG_BOOTX_TEXT */
 
 static unsigned short fcstab[256] = {
         0x0000, 0x1189, 0x2312, 0x329b, 0x4624, 0x57ad, 0x6536, 0x74bf,
@@ -1020,7 +973,6 @@ dump_hash_table(void)
 }
 #else
 
-#ifndef CONFIG_PPC64BRIDGE
 static void
 dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
 {
@@ -1079,66 +1031,6 @@ dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
                 printf(" ... %x\n", last_va);
 }
 
-#else /* CONFIG_PPC64BRIDGE */
-static void
-dump_hash_table_seg(unsigned seg, unsigned start, unsigned end)
-{
-        extern void *Hash;
-        extern unsigned long Hash_size;
-        unsigned *htab = Hash;
-        unsigned hsize = Hash_size;
-        unsigned v, hmask, va, last_va;
-        int found, last_found, i;
-        unsigned *hg, w1, last_w2, last_va0;
-
-        last_found = 0;
-        hmask = hsize / 128 - 1;
-        va = start;
-        start = (start >> 12) & 0xffff;
-        end = (end >> 12) & 0xffff;
-        for (v = start; v < end; ++v) {
-                found = 0;
-                hg = htab + (((v ^ seg) & hmask) * 32);
-                w1 = 1 | (seg << 12) | ((v & 0xf800) >> 4);
-                for (i = 0; i < 8; ++i, hg += 4) {
-                        if (hg[1] == w1) {
-                                found = 1;
-                                break;
-                        }
-                }
-                if (!found) {
-                        w1 ^= 2;
-                        hg = htab + ((~(v ^ seg) & hmask) * 32);
-                        for (i = 0; i < 8; ++i, hg += 4) {
-                                if (hg[1] == w1) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                }
-                if (!(last_found && found && (hg[3] & ~0x180) == last_w2 + 4096)) {
-                        if (last_found) {
-                                if (last_va != last_va0)
-                                        printf(" ... %x", last_va);
-                                printf("\n");
-                        }
-                        if (found) {
-                                printf("%x to %x", va, hg[3]);
-                                last_va0 = va;
-                        }
-                        last_found = found;
-                }
-                if (found) {
-                        last_w2 = hg[3] & ~0x180;
-                        last_va = va;
-                }
-                va += 4096;
-        }
-        if (last_found)
-                printf(" ... %x\n", last_va);
-}
-#endif /* CONFIG_PPC64BRIDGE */
-
 static unsigned hash_ctx;
 static unsigned hash_start;
 static unsigned hash_end;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index b66602ad7b33..b7ca5bf9acfc 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -80,6 +80,10 @@ config HOTPLUG_CPU
           can be controlled through /sys/devices/system/cpu/cpu#.
           Say N if you want to disable CPU hotplug.
 
+config DEFAULT_MIGRATION_COST
+        int
+        default "1000000"
+
 config MATHEMU
         bool "IEEE FPU emulation"
         depends on MARCH_G5
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index 2d021626c1a6..cc058dc3bc8b 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -905,8 +905,8 @@ asmlinkage long sys32_fstat64(unsigned long fd, struct stat64_emu31 __user * sta
         return ret;
 }
 
-asmlinkage long sys32_fstatat(unsigned int dfd, char __user *filename,
-                              struct stat64_emu31 __user* statbuf, int flag)
+asmlinkage long sys32_fstatat64(unsigned int dfd, char __user *filename,
+                                struct stat64_emu31 __user* statbuf, int flag)
 {
         struct kstat stat;
         int error = -EINVAL;
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index dd2d6c3e8df8..50e80138e7ad 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1523,13 +1523,13 @@ compat_sys_futimesat_wrapper:
         llgtr   %r4,%r4                 # struct timeval *
         jg      compat_sys_futimesat
 
-        .globl sys32_fstatat_wrapper
-sys32_fstatat_wrapper:
+        .globl sys32_fstatat64_wrapper
+sys32_fstatat64_wrapper:
         llgfr   %r2,%r2                 # unsigned int
         llgtr   %r3,%r3                 # char *
         llgtr   %r4,%r4                 # struct stat64 *
         lgfr    %r5,%r5                 # int
-        jg      sys32_fstatat
+        jg      sys32_fstatat64
 
         .globl sys_unlinkat_wrapper
 sys_unlinkat_wrapper:
@@ -1552,6 +1552,7 @@ sys_linkat_wrapper:
         llgtr   %r3,%r3                 # const char *
         lgfr    %r4,%r4                 # int
         llgtr   %r5,%r5                 # const char *
+        lgfr    %r6,%r6                 # int
         jg      sys_linkat
 
         .globl sys_symlinkat_wrapper
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 008c74526fd3..da6fbae8df91 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -128,8 +128,10 @@ void default_idle(void)
         __ctl_set_bit(8, 15);
 
 #ifdef CONFIG_HOTPLUG_CPU
-        if (cpu_is_offline(cpu))
+        if (cpu_is_offline(cpu)) {
+                preempt_enable_no_resched();
                 cpu_die();
+        }
 #endif
 
         local_mcck_disable();
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index de8784267473..24f62f16c0e5 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -600,6 +600,7 @@ setup_arch(char **cmdline_p)
         init_mm.brk = (unsigned long) &_end;
 
         parse_cmdline_early(cmdline_p);
+        parse_early_param();
 
         setup_memory();
         setup_resources();
@@ -607,6 +608,7 @@ setup_arch(char **cmdline_p)
 
         cpu_init();
         __cpu_logical_map[0] = S390_lowcore.cpu_data.cpu_addr;
+        smp_setup_cpu_possible_map();
 
         /*
          * Create kernel page tables and switch to virtual addressing.
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 0d1ad5dbe2b1..7dbe00c76c6b 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -1,8 +1,7 @@
 /*
  *  arch/s390/kernel/smp.c
  *
- *  S390 version
- *    Copyright (C) 1999,2000 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Copyright (C) IBM Corp. 1999,2006
  *    Author(s): Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com),
  *               Martin Schwidefsky (schwidefsky@de.ibm.com)
  *               Heiko Carstens (heiko.carstens@de.ibm.com)
@@ -41,8 +40,6 @@
 #include <asm/cpcmd.h>
 #include <asm/tlbflush.h>
 
-/* prototypes */
-
 extern volatile int __cpu_logical_map[];
 
 /*
@@ -51,13 +48,11 @@ extern volatile int __cpu_logical_map[];
 
 struct _lowcore *lowcore_ptr[NR_CPUS];
 
-cpumask_t cpu_online_map;
-cpumask_t cpu_possible_map = CPU_MASK_ALL;
+cpumask_t cpu_online_map = CPU_MASK_NONE;
+cpumask_t cpu_possible_map = CPU_MASK_NONE;
 
 static struct task_struct *current_set[NR_CPUS];
 
-EXPORT_SYMBOL(cpu_online_map);
-
 /*
  * Reboot, halt and power_off routines for SMP.
  */
@@ -490,10 +485,10 @@ void smp_ctl_clear_bit(int cr, int bit) {
  * Lets check how many CPUs we have.
  */
 
-void
-__init smp_check_cpus(unsigned int max_cpus)
+static unsigned int
+__init smp_count_cpus(void)
 {
-        int cpu, num_cpus;
+        unsigned int cpu, num_cpus;
         __u16 boot_cpu_addr;
 
         /*
@@ -503,19 +498,20 @@ __init smp_check_cpus(unsigned int max_cpus)
         boot_cpu_addr = S390_lowcore.cpu_data.cpu_addr;
         current_thread_info()->cpu = 0;
         num_cpus = 1;
-        for (cpu = 0; cpu <= 65535 && num_cpus < max_cpus; cpu++) {
+        for (cpu = 0; cpu <= 65535; cpu++) {
                 if ((__u16) cpu == boot_cpu_addr)
                         continue;
-                __cpu_logical_map[num_cpus] = (__u16) cpu;
-                if (signal_processor(num_cpus, sigp_sense) ==
+                __cpu_logical_map[1] = (__u16) cpu;
+                if (signal_processor(1, sigp_sense) ==
                     sigp_not_operational)
                         continue;
-                cpu_set(num_cpus, cpu_present_map);
                 num_cpus++;
         }
 
         printk("Detected %d CPU's\n",(int) num_cpus);
         printk("Boot cpu address %2X\n", boot_cpu_addr);
+
+        return num_cpus;
 }
 
 /*
@@ -676,6 +672,44 @@ __cpu_up(unsigned int cpu)
         return 0;
 }
 
+static unsigned int __initdata additional_cpus;
+static unsigned int __initdata possible_cpus;
+
+void __init smp_setup_cpu_possible_map(void)
+{
+        unsigned int phy_cpus, pos_cpus, cpu;
+
+        phy_cpus = smp_count_cpus();
+        pos_cpus = min(phy_cpus + additional_cpus, (unsigned int) NR_CPUS);
+
+        if (possible_cpus)
+                pos_cpus = min(possible_cpus, (unsigned int) NR_CPUS);
+
+        for (cpu = 0; cpu < pos_cpus; cpu++)
+                cpu_set(cpu, cpu_possible_map);
+
+        phy_cpus = min(phy_cpus, pos_cpus);
+
+        for (cpu = 0; cpu < phy_cpus; cpu++)
+                cpu_set(cpu, cpu_present_map);
+}
+
+#ifdef CONFIG_HOTPLUG_CPU
+
+static int __init setup_additional_cpus(char *s)
+{
+        additional_cpus = simple_strtoul(s, NULL, 0);
+        return 0;
+}
+early_param("additional_cpus", setup_additional_cpus);
+
+static int __init setup_possible_cpus(char *s)
+{
+        possible_cpus = simple_strtoul(s, NULL, 0);
+        return 0;
+}
+early_param("possible_cpus", setup_possible_cpus);
+
 int
 __cpu_disable(void)
 {
@@ -744,6 +778,8 @@ cpu_die(void)
         for(;;);
 }
 
+#endif /* CONFIG_HOTPLUG_CPU */
+
 /*
  *      Cycle through the processors and setup structures.
  */
@@ -757,7 +793,6 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         /* request the 0x1201 emergency signal external interrupt */
         if (register_external_interrupt(0x1201, do_ext_call_interrupt) != 0)
                 panic("Couldn't request external interrupt 0x1201");
-        smp_check_cpus(max_cpus);
         memset(lowcore_ptr,0,sizeof(lowcore_ptr));  
         /*
          *  Initialize prefix pages and stacks for all possible cpus
@@ -806,7 +841,6 @@ void __devinit smp_prepare_boot_cpu(void)
         BUG_ON(smp_processor_id() != 0);
 
         cpu_set(0, cpu_online_map);
-        cpu_set(0, cpu_present_map);
         S390_lowcore.percpu_offset = __per_cpu_offset[0];
         current_set[0] = current;
 }
@@ -845,6 +879,7 @@ static int __init topology_init(void)
 
 subsys_initcall(topology_init);
 
+EXPORT_SYMBOL(cpu_online_map);
 EXPORT_SYMBOL(cpu_possible_map);
 EXPORT_SYMBOL(lowcore_ptr);
 EXPORT_SYMBOL(smp_ctl_set_bit);
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 84921fe8d266..7c88d85c3597 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -301,7 +301,7 @@ SYSCALL(sys_mkdirat,sys_mkdirat,sys_mkdirat_wrapper)
 SYSCALL(sys_mknodat,sys_mknodat,sys_mknodat_wrapper)    /* 290 */
 SYSCALL(sys_fchownat,sys_fchownat,sys_fchownat_wrapper)
 SYSCALL(sys_futimesat,sys_futimesat,compat_sys_futimesat_wrapper)
-SYSCALL(sys_fstatat64,sys_newfstatat,sys32_fstatat_wrapper)
+SYSCALL(sys_fstatat64,sys_newfstatat,sys32_fstatat64_wrapper)
 SYSCALL(sys_unlinkat,sys_unlinkat,sys_unlinkat_wrapper)
 SYSCALL(sys_renameat,sys_renameat,sys_renameat_wrapper) /* 295 */
 SYSCALL(sys_linkat,sys_linkat,sys_linkat_wrapper)
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 504d56f8ca7f..e73621d03a28 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -446,7 +446,7 @@ endmenu
 
 config ISA_DMA_API
         bool
-        depends on MPC1211
+        depends on SH_MPC1211
         default y
 
 menu "Kernel features"
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index ab733be9af08..4c0a50a76554 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -383,6 +383,7 @@ source "arch/sparc64/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index 054461e6946d..158bd31e15b7 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -542,6 +542,8 @@ void __init setup_arch(char **cmdline_p)
         }
 #endif
 
+        smp_setup_cpu_possible_map();
+
         paging_init();
 }
 
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 1fb6323e65a4..1f7ad8a69052 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -1079,18 +1079,12 @@ int setup_profiling_timer(unsigned int multiplier)
         return 0;
 }
 
+/* Constrain the number of cpus to max_cpus.  */
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
-        int instance, mid;
-
-        instance = 0;
-        while (!cpu_find_by_instance(instance, NULL, &mid)) {
-                if (mid < max_cpus)
-                        cpu_set(mid, phys_cpu_present_map);
-                instance++;
-        }
-
         if (num_possible_cpus() > max_cpus) {
+                int instance, mid;
+
                 instance = 0;
                 while (!cpu_find_by_instance(instance, NULL, &mid)) {
                         if (mid != boot_cpu_id) {
@@ -1105,6 +1099,22 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         smp_store_cpu_info(boot_cpu_id);
 }
 
+/* Set this up early so that things like the scheduler can init
+ * properly.  We use the same cpu mask for both the present and
+ * possible cpu map.
+ */
+void __init smp_setup_cpu_possible_map(void)
+{
+        int instance, mid;
+
+        instance = 0;
+        while (!cpu_find_by_instance(instance, NULL, &mid)) {
+                if (mid < NR_CPUS)
+                        cpu_set(mid, phys_cpu_present_map);
+                instance++;
+        }
+}
+
 void __devinit smp_prepare_boot_cpu(void)
 {
         if (hard_smp_processor_id() >= NR_CPUS) {
diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index dc36b222100b..04e3958266e0 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -46,7 +46,7 @@ extern int file_reader(__u64 offset, char *buf, int len, void *arg);
 extern int read_cow_header(int (*reader)(__u64, char *, int, void *),
                            void *arg, __u32 *version_out,
                            char **backing_file_out, time_t *mtime_out,
-                           unsigned long long *size_out, int *sectorsize_out,
+                           __u64 *size_out, int *sectorsize_out,
                            __u32 *align_out, int *bitmap_offset_out);
 
 extern int write_cow_header(char *cow_file, int fd, char *backing_file,
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index c83fc5d68936..94de4ead4f7a 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -23,17 +23,17 @@ static inline char *cow_strdup(char *str)
         return(uml_strdup(str));
 }
 
-static inline int cow_seek_file(int fd, unsigned long long offset)
+static inline int cow_seek_file(int fd, __u64 offset)
 {
         return(os_seek_file(fd, offset));
 }
 
-static inline int cow_file_size(char *file, unsigned long long *size_out)
+static inline int cow_file_size(char *file, __u64 *size_out)
 {
         return(os_file_size(file, size_out));
 }
 
-static inline int cow_write_file(int fd, char *buf, int size)
+static inline int cow_write_file(int fd, void *buf, int size)
 {
         return(os_write_file(fd, buf, size));
 }
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index fbe2217db5dd..61951b721268 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -176,7 +176,7 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
         err = -ENOMEM;
         header = cow_malloc(sizeof(*header));
         if(header == NULL){
-                cow_printf("Failed to allocate COW V3 header\n");
+                cow_printf("write_cow_header - failed to allocate COW V3 header\n");
                 goto out;
         }
         header->magic = htonl(COW_MAGIC);
@@ -196,15 +196,17 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
 
         err = os_file_modtime(header->backing_file, &modtime);
         if(err < 0){
-                cow_printf("Backing file '%s' mtime request failed, "
-                           "err = %d\n", header->backing_file, -err);
+                cow_printf("write_cow_header - backing file '%s' mtime "
+                           "request failed, err = %d\n", header->backing_file,
+                           -err);
                 goto out_free;
         }
 
         err = cow_file_size(header->backing_file, size);
         if(err < 0){
-                cow_printf("Couldn't get size of backing file '%s', "
-                           "err = %d\n", header->backing_file, -err);
+                cow_printf("write_cow_header - couldn't get size of "
+                           "backing file '%s', err = %d\n",
+                           header->backing_file, -err);
                 goto out_free;
         }
 
@@ -214,10 +216,11 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
         header->alignment = htonl(alignment);
         header->cow_format = COW_BITMAP;
 
-        err = os_write_file(fd, header, sizeof(*header));
+        err = cow_write_file(fd, header, sizeof(*header));
         if(err != sizeof(*header)){
-                cow_printf("Write of header to new COW file '%s' failed, "
-                           "err = %d\n", cow_file, -err);
+                cow_printf("write_cow_header - write of header to "
+                           "new COW file '%s' failed, err = %d\n", cow_file,
+                           -err);
                 goto out_free;
         }
         err = 0;
@@ -299,7 +302,7 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
         }
         else if(version == 3){
                 if(n < sizeof(header->v3)){
-                        cow_printf("read_cow_header - failed to read V2 "
+                        cow_printf("read_cow_header - failed to read V3 "
                                    "header\n");
                         goto out;
                 }
@@ -359,7 +362,8 @@ int init_cow_file(int fd, char *cow_file, char *backing_file, int sectorsize,
         if(err != sizeof(zero)){
                 cow_printf("Write of bitmap to new COW file '%s' failed, "
                            "err = %d\n", cow_file, -err);
-                err = -EINVAL;
+                if (err >= 0)
+                        err = -EINVAL;
                 goto out;
         }
 
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 098fa65981ab..0e2f06187ea7 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -47,10 +47,12 @@ void tap_check_ips(char *gate_addr, unsigned char *eth_addr)
         }
 }
 
+/* Do reliable error handling as this fails frequently enough. */
 void read_output(int fd, char *output, int len)
 {
-        int remain, n, actual;
+        int remain, ret, expected;
         char c;
+        char *str;
 
         if(output == NULL){
                 output = &c;
@@ -58,23 +60,31 @@ void read_output(int fd, char *output, int len)
         }
                 
         *output = '\0';
-        n = os_read_file(fd, &remain, sizeof(remain));
-        if(n != sizeof(remain)){
-                printk("read_output - read of length failed, err = %d\n", -n);
-                return;
+        ret = os_read_file(fd, &remain, sizeof(remain));
+
+        if (ret != sizeof(remain)) {
+                expected = sizeof(remain);
+                str = "length";
+                goto err;
         }
 
         while(remain != 0){
-                n = (remain < len) ? remain : len;
-                actual = os_read_file(fd, output, n);
-                if(actual != n){
-                        printk("read_output - read of data failed, "
-                               "err = %d\n", -actual);
-                        return;
+                expected = (remain < len) ? remain : len;
+                ret = os_read_file(fd, output, expected);
+                if (ret != expected) {
+                        str = "data";
+                        goto err;
                 }
-                remain -= actual;
+                remain -= ret;
         }
+
         return;
+
+err:
+        if (ret < 0)
+                printk("read_output - read of %s failed, errno = %d\n", str, -ret);
+        else
+                printk("read_output - read of %s failed, read only %d of %d bytes\n", str, ret, expected);
 }
 
 int net_read(int fd, void *buf, int len)
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 101efd26d467..fa617e0719ab 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -1135,7 +1135,7 @@ static int path_requires_switch(char *from_cmdline, char *from_cow, char *cow)
 static int backing_file_mismatch(char *file, __u64 size, time_t mtime)
 {
         unsigned long modtime;
-        long long actual;
+        unsigned long long actual;
         int err;
 
         err = os_file_modtime(file, &modtime);
diff --git a/arch/um/include/init.h b/arch/um/include/init.h
index cbd79a8d213d..d4de7c0120ce 100644
--- a/arch/um/include/init.h
+++ b/arch/um/include/init.h
@@ -122,7 +122,7 @@ extern struct uml_param __uml_setup_start, __uml_setup_end;
 
 #define __exitcall(fn) static exitcall_t __exitcall_##fn __exit_call = fn
 
-#define __init_call __attribute__ ((unused,__section__ (".initcall.init")))
+#define __init_call     __attribute_used__ __attribute__ ((__section__ (".initcall.init")))
 
 #endif
 
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index eb1710b81255..2a1c64d8d0bf 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -179,8 +179,11 @@ extern void os_stop_process(int pid);
 extern void os_kill_process(int pid, int reap_child);
 extern void os_kill_ptraced_process(int pid, int reap_child);
 extern void os_usr1_process(int pid);
+extern long os_ptrace_ldt(long pid, long addr, long data);
+
 extern int os_getpid(void);
 extern int os_getpgrp(void);
+
 extern void init_new_thread_stack(void *sig_stack, void (*usr1_handler)(int));
 extern void init_new_thread_signals(int altstack);
 extern int run_kernel_thread(int (*fn)(void *), void *arg, void **jmp_ptr);
diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c
index f55773c819e6..3bd10deea280 100644
--- a/arch/um/os-Linux/file.c
+++ b/arch/um/os-Linux/file.c
@@ -272,14 +272,23 @@ int os_connect_socket(char *name)
         snprintf(sock.sun_path, sizeof(sock.sun_path), "%s", name);
 
         fd = socket(AF_UNIX, SOCK_STREAM, 0);
-        if(fd < 0)
-                return(fd);
+        if(fd < 0) {
+                err = -errno;
+                goto out;
+        }
 
         err = connect(fd, (struct sockaddr *) &sock, sizeof(sock));
-        if(err)
-                return(-errno);
+        if(err) {
+                err = -errno;
+                goto out_close;
+        }
 
-        return(fd);
+        return fd;
+
+out_close:
+        close(fd);
+out:
+        return err;
 }
 
 void os_close_file(int fd)
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index 7f5e2dac2a35..d261888f39c4 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -19,6 +19,7 @@
 #include "irq_user.h"
 #include "kern_util.h"
 #include "longjmp.h"
+#include "skas_ptrace.h"
 
 #define ARBITRARY_ADDR -1
 #define FAILURE_PID    -1
@@ -100,6 +101,21 @@ void os_kill_process(int pid, int reap_child)
                 
 }
 
+/* This is here uniquely to have access to the userspace errno, i.e. the one
+ * used by ptrace in case of error.
+ */
+
+long os_ptrace_ldt(long pid, long addr, long data)
+{
+        int ret;
+
+        ret = ptrace(PTRACE_LDT, pid, addr, data);
+
+        if (ret < 0)
+                return -errno;
+        return ret;
+}
+
 /* Kill off a ptraced child by all means available.  kill it normally first,
  * then PTRACE_KILL it, then PTRACE_CONT it in case it's in a run state from
  * which it can't exit directly.
diff --git a/arch/um/sys-i386/ldt.c b/arch/um/sys-i386/ldt.c
index 1fa09a79a10b..fe0877b3509c 100644
--- a/arch/um/sys-i386/ldt.c
+++ b/arch/um/sys-i386/ldt.c
@@ -107,7 +107,7 @@ long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
                  * So we need to switch child's mm into our userspace, then
                  * later switch back.
                  *
-                 * Note: I'm unshure: should interrupts be disabled here?
+                 * Note: I'm unsure: should interrupts be disabled here?
                  */
                 if(!current->active_mm || current->active_mm == &init_mm ||
                    mm_idp != &current->active_mm->context.skas.id)
@@ -129,9 +129,7 @@ long write_ldt_entry(struct mm_id * mm_idp, int func, struct user_desc * desc,
                         pid = userspace_pid[cpu];
                 }
 
-                res = ptrace(PTRACE_LDT, pid, 0, (unsigned long) &ldt_op);
-                if(res)
-                        res = errno;
+                res = os_ptrace_ldt(pid, 0, (unsigned long) &ldt_op);
 
                 if(proc_mm)
                         put_cpu();
@@ -181,8 +179,7 @@ static long read_ldt_from_host(void __user * ptr, unsigned long bytecount)
          */
 
         cpu = get_cpu();
-        res = ptrace(PTRACE_LDT, userspace_pid[cpu], 0,
-                     (unsigned long) &ptrace_ldt);
+        res = os_ptrace_ldt(userspace_pid[cpu], 0, (unsigned long) &ptrace_ldt);
         put_cpu();
         if(res < 0)
                 goto out;
diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig
index 2f9deca31cc9..e18eb79bf855 100644
--- a/arch/x86_64/Kconfig
+++ b/arch/x86_64/Kconfig
@@ -354,21 +354,6 @@ config HPET_TIMER
           as it is off-chip.  You can find the HPET spec at
           <http://www.intel.com/hardwaredesign/hpetspec.htm>.
 
-config X86_PM_TIMER
-        bool "PM timer" if EMBEDDED
-        depends on ACPI
-        default y
-        help
-          Support the ACPI PM timer for time keeping. This is slow,
-          but is useful on some chipsets without HPET on systems with more
-          than one CPU. On a single processor or single socket multi core
-          system it is normally not required.
-          When the PM timer is active 64bit vsyscalls are disabled
-          and should not be enabled (/proc/sys/kernel/vsyscall64 should
-          not be changed).
-          The kernel selects the PM timer only as a last resort, so it is
-          useful to enable just in case.
-
 config HPET_EMULATE_RTC
         bool "Provide RTC interrupt"
         depends on HPET_TIMER && RTC=y
@@ -592,6 +577,7 @@ source "arch/x86_64/oprofile/Kconfig"
 
 config KPROBES
         bool "Kprobes (EXPERIMENTAL)"
+        depends on EXPERIMENTAL && MODULES
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 56832929a543..ce4de61ed85d 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc1-git2
-# Thu Jan 19 10:05:21 2006
+# Linux kernel version: 2.6.16-rc3-git9
+# Sat Feb 18 00:27:03 2006
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -21,7 +21,6 @@ CONFIG_DMI=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -267,6 +266,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -446,7 +446,6 @@ CONFIG_BLK_DEV_PIIX=y
 # CONFIG_BLK_DEV_NS87415 is not set
 # CONFIG_BLK_DEV_PDC202XX_OLD is not set
 CONFIG_BLK_DEV_PDC202XX_NEW=y
-# CONFIG_PDC202XX_FORCE is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
 # CONFIG_BLK_DEV_SIS5513 is not set
@@ -573,7 +572,33 @@ CONFIG_FUSION_MAX_SGE=128
 #
 # IEEE 1394 (FireWire) support
 #
-# CONFIG_IEEE1394 is not set
+CONFIG_IEEE1394=y
+
+#
+# Subsystem Options
+#
+# CONFIG_IEEE1394_VERBOSEDEBUG is not set
+# CONFIG_IEEE1394_OUI_DB is not set
+# CONFIG_IEEE1394_EXTRA_CONFIG_ROMS is not set
+# CONFIG_IEEE1394_EXPORT_FULL_API is not set
+
+#
+# Device Drivers
+#
+
+#
+# Texas Instruments PCILynx requires I2C
+#
+CONFIG_IEEE1394_OHCI1394=y
+
+#
+# Protocol Drivers
+#
+# CONFIG_IEEE1394_VIDEO1394 is not set
+# CONFIG_IEEE1394_SBP2 is not set
+# CONFIG_IEEE1394_ETH1394 is not set
+# CONFIG_IEEE1394_DV1394 is not set
+CONFIG_IEEE1394_RAWIO=y
 
 #
 # I2O device support
@@ -772,6 +797,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -871,6 +897,7 @@ CONFIG_HPET_MMAP=y
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_HDAPS is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
@@ -1101,7 +1128,6 @@ CONFIG_USB_MON=y
 # EDAC - error detection and reporting (RAS)
 #
 # CONFIG_EDAC is not set
-# CONFIG_EDAC_POLL is not set
 
 #
 # Firmware Drivers
@@ -1296,9 +1322,7 @@ CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_FORCED_INLINING is not set
-# CONFIG_UNWIND_INFO is not set
 # CONFIG_RCU_TORTURE_TEST is not set
-CONFIG_INIT_DEBUG=y
 # CONFIG_DEBUG_RODATA is not set
 # CONFIG_IOMMU_DEBUG is not set
 
diff --git a/arch/x86_64/kernel/Makefile b/arch/x86_64/kernel/Makefile
index 72fe60c20d39..a098a11e7755 100644
--- a/arch/x86_64/kernel/Makefile
+++ b/arch/x86_64/kernel/Makefile
@@ -43,7 +43,7 @@ CFLAGS_vsyscall.o		:= $(PROFILING) -g0
 
 bootflag-y                      += ../../i386/kernel/bootflag.o
 cpuid-$(subst m,y,$(CONFIG_X86_CPUID))  += ../../i386/kernel/cpuid.o
-topology-y                     += ../../i386/mach-default/topology.o
+topology-y                     += ../../i386/kernel/topology.o
 microcode-$(subst m,y,$(CONFIG_MICROCODE))  += ../../i386/kernel/microcode.o
 intel_cacheinfo-y               += ../../i386/kernel/cpu/intel_cacheinfo.o
 quirks-y                        += ../../i386/kernel/quirks.o
diff --git a/arch/x86_64/kernel/aperture.c b/arch/x86_64/kernel/aperture.c
index e4e2b7d01f89..a0f955b9995f 100644
--- a/arch/x86_64/kernel/aperture.c
+++ b/arch/x86_64/kernel/aperture.c
@@ -248,7 +248,7 @@ void __init iommu_hole_init(void)
                 /* Got the aperture from the AGP bridge */
         } else if (swiotlb && !valid_agp) {
                 /* Do nothing */
-        } else if ((!no_iommu && end_pfn >= MAX_DMA32_PFN) ||
+        } else if ((!no_iommu && end_pfn > MAX_DMA32_PFN) ||
                    force_iommu ||
                    valid_agp ||
                    fallback_aper_force) { 
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index 7a0a3e8d5d72..d70605eda333 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -962,12 +962,14 @@ void smp_apic_timer_interrupt(struct pt_regs *regs)
         irq_exit();
 }
 
+int __initdata unsync_tsc_on_multicluster;
+
 /*
  * oem_force_hpet_timer -- force HPET mode for some boxes.
  *
  * Thus far, the major user of this is IBM's Summit2 series:
  *
- * Clustered boxes may have unsynced TSC problems if they are
+ * Some clustered boxes may have unsynced TSC problems if they are
  * multi-chassis. Use available data to take a good guess.
  * If in doubt, go HPET.
  */
@@ -977,6 +979,11 @@ __cpuinit int oem_force_hpet_timer(void)
         unsigned id;
         DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
 
+        /* Only do this check on IBM machines - big Unisys systems
+           use multiple clusters too, but have synchronized TSC */
+        if (!unsync_tsc_on_multicluster)
+                return 0;
+
         bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
 
         for (i = 0; i < NR_CPUS; i++) {
@@ -1152,6 +1159,7 @@ __setup("noapicmaintimer", setup_noapicmaintimer);
 static __init int setup_apicpmtimer(char *s)
 {
         apic_calibrate_pmtmr = 1;
+        notsc_setup(NULL);
         return setup_apicmaintimer(NULL);
 }
 __setup("apicpmtimer", setup_apicpmtimer);
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index b150c87a08c6..7c10e9009d61 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -554,6 +554,7 @@ iret_label:
         /* running with kernel gs */
 bad_iret:
         movq $-9999,%rdi        /* better code? */
+        sti
         jmp do_exit                     
         .previous       
         
diff --git a/arch/x86_64/kernel/head.S b/arch/x86_64/kernel/head.S
index 692c737feddb..02fc7fa0ea28 100644
--- a/arch/x86_64/kernel/head.S
+++ b/arch/x86_64/kernel/head.S
@@ -213,6 +213,11 @@ ENTRY(early_idt_handler)
         cmpl $2,early_recursion_flag(%rip)
         jz  1f
         call dump_stack
+#ifdef CONFIG_KALLSYMS  
+        leaq early_idt_ripmsg(%rip),%rdi
+        movq 8(%rsp),%rsi       # get rip again
+        call __print_symbol
+#endif
 1:      hlt
         jmp 1b
 early_recursion_flag:
@@ -220,6 +225,8 @@ early_recursion_flag:
 
 early_idt_msg:
         .asciz "PANIC: early exception rip %lx error %lx cr2 %lx\n"
+early_idt_ripmsg:
+        .asciz "RIP %s\n"
 
 .code32
 ENTRY(no_long_mode)
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 4282d72b2a26..ffed464e6b12 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -30,6 +30,9 @@
 #include <linux/mc146818rtc.h>
 #include <linux/acpi.h>
 #include <linux/sysdev.h>
+#ifdef CONFIG_ACPI
+#include <acpi/acpi_bus.h>
+#endif
 
 #include <asm/io.h>
 #include <asm/smp.h>
@@ -47,6 +50,8 @@ static int no_timer_check;
 
 int disable_timer_pin_1 __initdata;
 
+int timer_over_8254 __initdata = 1;
+
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
@@ -248,6 +253,20 @@ static int __init enable_ioapic_setup(char *str)
 __setup("noapic", disable_ioapic_setup);
 __setup("apic", enable_ioapic_setup);
 
+static int __init setup_disable_8254_timer(char *s)
+{
+        timer_over_8254 = -1;
+        return 1;
+}
+static int __init setup_enable_8254_timer(char *s)
+{
+        timer_over_8254 = 2;
+        return 1;
+}
+
+__setup("disable_8254_timer", setup_disable_8254_timer);
+__setup("enable_8254_timer", setup_enable_8254_timer);
+
 #include <asm/pci-direct.h>
 #include <linux/pci_ids.h>
 #include <linux/pci.h>
@@ -260,6 +279,8 @@ __setup("apic", enable_ioapic_setup);
 
    And another hack to disable the IOMMU on VIA chipsets.
 
+   ... and others. Really should move this somewhere else.
+
    Kludge-O-Rama. */
 void __init check_ioapic(void) 
 { 
@@ -304,16 +325,20 @@ void __init check_ioapic(void)
 #endif
                                         /* RED-PEN skip them on mptables too? */
                                         return;
+
+                                /* This should be actually default, but
+                                   for 2.6.16 let's do it for ATI only where
+                                   it's really needed. */
                                 case PCI_VENDOR_ID_ATI:
-                                        if (apic_runs_main_timer != 0)
-                                                break;
+                                        if (timer_over_8254 == 1) {     
+                                                timer_over_8254 = 0;    
                                         printk(KERN_INFO
-             "ATI board detected. Using APIC/PM timer.\n");
-                                        apic_runs_main_timer = 1;
-                                        nohpet = 1;
+                "ATI board detected. Disabling timer routing over 8254.\n");
+                                        }       
                                         return;
                                 } 
 
+
                                 /* No multi-function device? */
                                 type = read_pci_config_byte(num,slot,func,
                                                             PCI_HEADER_TYPE);
@@ -1757,6 +1782,8 @@ static inline void unlock_ExtINT_logic(void)
  * a wide range of boards and BIOS bugs.  Fortunately only the timer IRQ
  * is so screwy.  Thanks to Brian Perkins for testing/hacking this beast
  * fanatically on his truly buggy board.
+ *
+ * FIXME: really need to revamp this for modern platforms only.
  */
 static inline void check_timer(void)
 {
@@ -1779,7 +1806,8 @@ static inline void check_timer(void)
          */
         apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
         init_8259A(1);
-        enable_8259A_irq(0);
+        if (timer_over_8254 > 0)
+                enable_8259A_irq(0);
 
         pin1  = find_isa_irq_pin(0, mp_INT);
         apic1 = find_isa_irq_apic(0, mp_INT);
@@ -1834,7 +1862,7 @@ static inline void check_timer(void)
         }
         printk(" failed.\n");
 
-        if (nmi_watchdog) {
+        if (nmi_watchdog == NMI_IO_APIC) {
                 printk(KERN_WARNING "timer doesn't work through the IO-APIC - disabling NMI Watchdog!\n");
                 nmi_watchdog = 0;
         }
diff --git a/arch/x86_64/kernel/mpparse.c b/arch/x86_64/kernel/mpparse.c
index dc49bfb6db0a..9013a90b5c2e 100644
--- a/arch/x86_64/kernel/mpparse.c
+++ b/arch/x86_64/kernel/mpparse.c
@@ -288,9 +288,9 @@ static int __init smp_read_mpc(struct mp_config_table *mpc)
 
         memcpy(str,mpc->mpc_productid,12);
         str[12]=0;
-        printk(KERN_INFO "Product ID: %s ",str);
+        printk("Product ID: %s ",str);
 
-        printk(KERN_INFO "APIC at: 0x%X\n",mpc->mpc_lapic);
+        printk("APIC at: 0x%X\n",mpc->mpc_lapic);
 
         /* save the local APIC address, it might be non-default */
         if (!acpi_lapic)
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index 8be407a1f62d..5bf17e41cd2d 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -236,6 +236,7 @@ static void enable_lapic_nmi_watchdog(void)
 {
         if (nmi_active < 0) {
                 nmi_watchdog = NMI_LOCAL_APIC;
+                touch_nmi_watchdog();
                 setup_apic_nmi_watchdog();
         }
 }
@@ -456,15 +457,17 @@ static DEFINE_PER_CPU(int, nmi_touch);
 
 void touch_nmi_watchdog (void)
 {
-        int i;
+        if (nmi_watchdog > 0) {
+                unsigned cpu;
 
-        /*
-         * Tell other CPUs to reset their alert counters. We cannot
-         * do it ourselves because the alert count increase is not
-         * atomic.
-         */
-        for (i = 0; i < NR_CPUS; i++)
-                per_cpu(nmi_touch, i) = 1;
+                /*
+                 * Tell other CPUs to reset their alert counters. We cannot
+                 * do it ourselves because the alert count increase is not
+                 * atomic.
+                 */
+                for_each_present_cpu (cpu)
+                        per_cpu(nmi_touch, cpu) = 1;
+        }
 
         touch_softlockup_watchdog();
 }
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index dd0718dc178b..0c3f052ba6ce 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -228,11 +228,6 @@ static inline int need_iommu(struct device *dev, unsigned long addr, size_t size
         int mmu = high;
         if (force_iommu) 
                 mmu = 1; 
-        if (no_iommu) { 
-                if (high) 
-                        panic("PCI-DMA: high address but no IOMMU.\n"); 
-                mmu = 0; 
-        }       
         return mmu; 
 }
 
@@ -241,11 +236,6 @@ static inline int nonforced_iommu(struct device *dev, unsigned long addr, size_t
         u64 mask = *dev->dma_mask;
         int high = addr + size >= mask;
         int mmu = high;
-        if (no_iommu) { 
-                if (high) 
-                        panic("PCI-DMA: high address but no IOMMU.\n"); 
-                mmu = 0; 
-        }       
         return mmu; 
 }
 
@@ -310,7 +300,7 @@ void gart_unmap_sg(struct device *dev, struct scatterlist *sg, int nents, int di
 
         for (i = 0; i < nents; i++) {
                 struct scatterlist *s = &sg[i];
-                if (!s->dma_length)
+                if (!s->dma_length || !s->length)
                         break;
                 dma_unmap_single(dev, s->dma_address, s->dma_length, dir);
         }
@@ -364,6 +354,7 @@ static int __dma_map_cont(struct scatterlist *sg, int start, int stopat,
                 
                 BUG_ON(i > start && s->offset);
                 if (i == start) {
+                        *sout = *s; 
                         sout->dma_address = iommu_bus_base;
                         sout->dma_address += iommu_page*PAGE_SIZE + s->offset;
                         sout->dma_length = s->length;
@@ -390,6 +381,7 @@ static inline int dma_map_cont(struct scatterlist *sg, int start, int stopat,
 {
         if (!need) { 
                 BUG_ON(stopat - start != 1);
+                *sout = sg[start]; 
                 sout->dma_length = sg[start].length; 
                 return 0;
         } 
@@ -632,17 +624,13 @@ static int __init pci_iommu_init(void)
                 (agp_copy_info(agp_bridge, &info) < 0);
 #endif  
 
-        if (swiotlb) { 
-                no_iommu = 1;
+        if (swiotlb)
                 return -1; 
-        } 
-        
+
         if (no_iommu ||
             (!force_iommu && end_pfn <= MAX_DMA32_PFN) ||
             !iommu_aperture ||
             (no_agp && init_k8_gatt(&info) < 0)) {
-                no_iommu = 1;
-                no_iommu_init();
                 printk(KERN_INFO "PCI-DMA: Disabling IOMMU.\n");
                 if (end_pfn > MAX_DMA32_PFN) {
                         printk(KERN_ERR "WARNING more than 4GB of memory "
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 9435ab7d6fb8..aa55e3cec665 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -423,6 +423,12 @@ static __init void parse_cmdline_early (char ** cmdline_p)
                 else if(!memcmp(from, "elfcorehdr=", 11))
                         elfcorehdr_addr = memparse(from+11, &from);
 #endif
+
+#ifdef CONFIG_HOTPLUG_CPU
+                else if (!memcmp(from, "additional_cpus=", 16))
+                        setup_additional_cpus(from+16);
+#endif
+
         next_char:
                 c = *(from++);
                 if (!c)
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index 67e4e28f4df8..66e98659d077 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -1152,8 +1152,6 @@ void __init smp_cpus_done(unsigned int max_cpus)
         setup_ioapic_dest();
 #endif
 
-        time_init_gtod();
-
         check_nmi_watchdog();
 }
 
@@ -1244,7 +1242,7 @@ void __cpu_die(unsigned int cpu)
         printk(KERN_ERR "CPU %u didn't die...\n", cpu);
 }
 
-static __init int setup_additional_cpus(char *s)
+__init int setup_additional_cpus(char *s)
 {
         return get_option(&s, &additional_cpus);
 }
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 3c58c30506a1..3080f84bf7b7 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -48,6 +48,8 @@ static void cpufreq_delayed_get(void);
 extern void i8254_timer_resume(void);
 extern int using_apic_timer;
 
+static char *time_init_gtod(void);
+
 DEFINE_SPINLOCK(rtc_lock);
 DEFINE_SPINLOCK(i8253_lock);
 
@@ -901,6 +903,7 @@ static struct irqaction irq0 = {
 void __init time_init(void)
 {
         char *timename;
+        char *gtod;
 
 #ifdef HPET_HACK_ENABLE_DANGEROUS
         if (!vxtime.hpet_address) {
@@ -945,21 +948,19 @@ void __init time_init(void)
                 timename = "PIT";
         }
 
-        printk(KERN_INFO "time.c: Using %ld.%06ld MHz %s timer.\n",
-               vxtime_hz / 1000000, vxtime_hz % 1000000, timename);
+        vxtime.mode = VXTIME_TSC;
+        gtod = time_init_gtod();
+
+        printk(KERN_INFO "time.c: Using %ld.%06ld MHz WALL %s GTOD %s timer.\n",
+               vxtime_hz / 1000000, vxtime_hz % 1000000, timename, gtod);
         printk(KERN_INFO "time.c: Detected %d.%03d MHz processor.\n",
                 cpu_khz / 1000, cpu_khz % 1000);
-        vxtime.mode = VXTIME_TSC;
         vxtime.quot = (1000000L << 32) / vxtime_hz;
         vxtime.tsc_quot = (1000L << 32) / cpu_khz;
         vxtime.last_tsc = get_cycles_sync();
         setup_irq(0, &irq0);
 
         set_cyc2ns_scale(cpu_khz);
-
-#ifndef CONFIG_SMP
-        time_init_gtod();
-#endif
 }
 
 /*
@@ -981,9 +982,9 @@ __cpuinit int unsynchronized_tsc(void)
 }
 
 /*
- * Decide after all CPUs are booted what mode gettimeofday should use.
+ * Decide what mode gettimeofday should use.
  */
-void __init time_init_gtod(void)
+__init static char *time_init_gtod(void)
 {
         char *timetype;
 
@@ -1011,8 +1012,7 @@ void __init time_init_gtod(void)
                 timetype = hpet_use_timer ? "HPET/TSC" : "PIT/TSC";
                 vxtime.mode = VXTIME_TSC;
         }
-
-        printk(KERN_INFO "time.c: Using %s based timekeeping.\n", timetype);
+        return timetype;
 }
 
 __setup("report_lost_ticks", time_setup);
@@ -1327,8 +1327,7 @@ static int __init nohpet_setup(char *s)
 
 __setup("nohpet", nohpet_setup);
 
-
-static int __init notsc_setup(char *s)
+int __init notsc_setup(char *s)
 {
         notsc = 1;
         return 0;
diff --git a/arch/x86_64/mm/k8topology.c b/arch/x86_64/mm/k8topology.c
index a5663e0bb01c..dd60e71fdba6 100644
--- a/arch/x86_64/mm/k8topology.c
+++ b/arch/x86_64/mm/k8topology.c
@@ -155,7 +155,7 @@ int __init k8_scan_nodes(unsigned long start, unsigned long end)
         if (!found)
                 return -1; 
 
-        memnode_shift = compute_hash_shift(nodes, numnodes);
+        memnode_shift = compute_hash_shift(nodes, 8);
         if (memnode_shift < 0) { 
                 printk(KERN_ERR "No NUMA node hash function found. Contact maintainer\n"); 
                 return -1; 
diff --git a/arch/x86_64/mm/srat.c b/arch/x86_64/mm/srat.c
index cd25300726fc..482c25767369 100644
--- a/arch/x86_64/mm/srat.c
+++ b/arch/x86_64/mm/srat.c
@@ -228,7 +228,8 @@ static int nodes_cover_memory(void)
         }
 
         e820ram = end_pfn - e820_hole_size(0, end_pfn);
-        if (pxmram < e820ram) {
+        /* We seem to lose 3 pages somewhere. Allow a bit of slack. */
+        if ((long)(e820ram - pxmram) >= 1*1024*1024) {
                 printk(KERN_ERR
         "SRAT: PXMs only cover %luMB of your %luMB e820 RAM. Not used.\n",
                         (pxmram << PAGE_SHIFT) >> 20,
@@ -270,7 +271,7 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
                 return -1;
         }
 
-        memnode_shift = compute_hash_shift(nodes, nodes_weight(nodes_parsed));
+        memnode_shift = compute_hash_shift(nodes, MAX_NUMNODES);
         if (memnode_shift < 0) {
                 printk(KERN_ERR
                      "SRAT: No NUMA node hash function found. Contact maintainer\n");
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 0cce28c4025b..33e2ca847a26 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -247,7 +247,7 @@ config ACPI_CUSTOM_DSDT_FILE
           Enter the full path name to the file wich includes the AmlCode declaration.
 
 config ACPI_BLACKLIST_YEAR
-        int "Disable ACPI for systems before Jan 1st this year" if X86
+        int "Disable ACPI for systems before Jan 1st this year" if X86_32
         default 0
         help
           enter a 4-digit year, eg. 2001 to disable ACPI by default
@@ -285,9 +285,8 @@ config ACPI_SYSTEM
           dump your ACPI DSDT table using /proc/acpi/dsdt.
 
 config X86_PM_TIMER
-        bool "Power Management Timer Support"
+        bool "Power Management Timer Support" if EMBEDDED
         depends on X86
-        depends on !X86_64
         default y
         help
           The Power Management Timer is available on all ACPI-capable,
@@ -298,9 +297,8 @@ config X86_PM_TIMER
           voltage scaling, unlike the commonly used Time Stamp Counter
           (TSC) timing source.
 
-          So, if you see messages like 'Losing too many ticks!' in the
-          kernel logs, and/or you are using this on a notebook which
-          does not yet have an HPET, you should say "Y" here.
+          You should nearly always say Y here because many modern
+          systems require this timer. 
 
 config ACPI_CONTAINER
         tristate "ACPI0004,PNP0A05 and PNP0A06 Container Driver (EXPERIMENTAL)"
diff --git a/drivers/acpi/resources/rscalc.c b/drivers/acpi/resources/rscalc.c
index 7d6481d9fbec..4038dbfa63a0 100644
--- a/drivers/acpi/resources/rscalc.c
+++ b/drivers/acpi/resources/rscalc.c
@@ -391,8 +391,7 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                          * Ensure a 32-bit boundary for the structure
                          */
                         extra_struct_bytes =
-                            ACPI_ROUND_UP_to_32_bITS(resource_length) -
-                            resource_length;
+                            ACPI_ROUND_UP_to_32_bITS(resource_length);
                         break;
 
                 case ACPI_RESOURCE_NAME_END_TAG:
@@ -408,8 +407,7 @@ acpi_rs_get_list_length(u8 * aml_buffer,
                          * Add vendor data and ensure a 32-bit boundary for the structure
                          */
                         extra_struct_bytes =
-                            ACPI_ROUND_UP_to_32_bITS(resource_length) -
-                            resource_length;
+                            ACPI_ROUND_UP_to_32_bITS(resource_length);
                         break;
 
                 case ACPI_RESOURCE_NAME_ADDRESS32:
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 93e44d0292ab..bc9b2bcd7dba 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -58,6 +58,7 @@
 #include <linux/suspend.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_ioctl.h>
+#include <scsi/scsi.h>
 
 #include <asm/uaccess.h>
 
@@ -380,6 +381,7 @@ static int pkt_generic_packet(struct pktcdvd_device *pd, struct packet_command *
         memcpy(rq->cmd, cgc->cmd, CDROM_PACKET_SIZE);
         if (sizeof(rq->cmd) > CDROM_PACKET_SIZE)
                 memset(rq->cmd + CDROM_PACKET_SIZE, 0, sizeof(rq->cmd) - CDROM_PACKET_SIZE);
+        rq->cmd_len = COMMAND_SIZE(rq->cmd[0]);
 
         rq->ref_count++;
         rq->flags |= REQ_NOMERGE;
@@ -1495,40 +1497,42 @@ static int pkt_set_write_settings(struct pktcdvd_device *pd)
 }
 
 /*
- * 0 -- we can write to this track, 1 -- we can't
+ * 1 -- we can write to this track, 0 -- we can't
  */
-static int pkt_good_track(track_information *ti)
+static int pkt_writable_track(struct pktcdvd_device *pd, track_information *ti)
 {
-        /*
-         * only good for CD-RW at the moment, not DVD-RW
-         */
+        switch (pd->mmc3_profile) {
+                case 0x1a: /* DVD+RW */
+                case 0x12: /* DVD-RAM */
+                        /* The track is always writable on DVD+RW/DVD-RAM */
+                        return 1;
+                default:
+                        break;
+        }
 
-        /*
-         * FIXME: only for FP
-         */
-        if (ti->fp == 0)
+        if (!ti->packet || !ti->fp)
                 return 0;
 
         /*
          * "good" settings as per Mt Fuji.
          */
-        if (ti->rt == 0 && ti->blank == 0 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 0 && ti->blank == 0)
+                return 1;
 
-        if (ti->rt == 0 && ti->blank == 1 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 0 && ti->blank == 1)
+                return 1;
 
-        if (ti->rt == 1 && ti->blank == 0 && ti->packet == 1)
-                return 0;
+        if (ti->rt == 1 && ti->blank == 0)
+                return 1;
 
         printk("pktcdvd: bad state %d-%d-%d\n", ti->rt, ti->blank, ti->packet);
-        return 1;
+        return 0;
 }
 
 /*
- * 0 -- we can write to this disc, 1 -- we can't
+ * 1 -- we can write to this disc, 0 -- we can't
  */
-static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
+static int pkt_writable_disc(struct pktcdvd_device *pd, disc_information *di)
 {
         switch (pd->mmc3_profile) {
                 case 0x0a: /* CD-RW */
@@ -1537,10 +1541,10 @@ static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
                 case 0x1a: /* DVD+RW */
                 case 0x13: /* DVD-RW */
                 case 0x12: /* DVD-RAM */
-                        return 0;
+                        return 1;
                 default:
                         VPRINTK("pktcdvd: Wrong disc profile (%x)\n", pd->mmc3_profile);
-                        return 1;
+                        return 0;
         }
 
         /*
@@ -1549,25 +1553,25 @@ static int pkt_good_disc(struct pktcdvd_device *pd, disc_information *di)
          */
         if (di->disc_type == 0xff) {
                 printk("pktcdvd: Unknown disc. No track?\n");
-                return 1;
+                return 0;
         }
 
         if (di->disc_type != 0x20 && di->disc_type != 0) {
                 printk("pktcdvd: Wrong disc type (%x)\n", di->disc_type);
-                return 1;
+                return 0;
         }
 
         if (di->erasable == 0) {
                 printk("pktcdvd: Disc not erasable\n");
-                return 1;
+                return 0;
         }
 
         if (di->border_status == PACKET_SESSION_RESERVED) {
                 printk("pktcdvd: Can't write to last track (reserved)\n");
-                return 1;
+                return 0;
         }
 
-        return 0;
+        return 1;
 }
 
 static int pkt_probe_settings(struct pktcdvd_device *pd)
@@ -1592,23 +1596,9 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 return ret;
         }
 
-        if (pkt_good_disc(pd, &di))
-                return -ENXIO;
+        if (!pkt_writable_disc(pd, &di))
+                return -EROFS;
 
-        switch (pd->mmc3_profile) {
-                case 0x1a: /* DVD+RW */
-                        printk("pktcdvd: inserted media is DVD+RW\n");
-                        break;
-                case 0x13: /* DVD-RW */
-                        printk("pktcdvd: inserted media is DVD-RW\n");
-                        break;
-                case 0x12: /* DVD-RAM */
-                        printk("pktcdvd: inserted media is DVD-RAM\n");
-                        break;
-                default:
-                        printk("pktcdvd: inserted media is CD-R%s\n", di.erasable ? "W" : "");
-                        break;
-        }
         pd->type = di.erasable ? PACKET_CDRW : PACKET_CDR;
 
         track = 1; /* (di.last_track_msb << 8) | di.last_track_lsb; */
@@ -1617,9 +1607,9 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                 return ret;
         }
 
-        if (pkt_good_track(&ti)) {
+        if (!pkt_writable_track(pd, &ti)) {
                 printk("pktcdvd: can't write to this track\n");
-                return -ENXIO;
+                return -EROFS;
         }
 
         /*
@@ -1633,7 +1623,7 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
         }
         if (pd->settings.size > PACKET_MAX_SECTORS) {
                 printk("pktcdvd: packet size is too big\n");
-                return -ENXIO;
+                return -EROFS;
         }
         pd->settings.fp = ti.fp;
         pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
@@ -1675,7 +1665,7 @@ static int pkt_probe_settings(struct pktcdvd_device *pd)
                         break;
                 default:
                         printk("pktcdvd: unknown data mode\n");
-                        return 1;
+                        return -EROFS;
         }
         return 0;
 }
@@ -1886,7 +1876,7 @@ static int pkt_open_write(struct pktcdvd_device *pd)
 
         if ((ret = pkt_probe_settings(pd))) {
                 VPRINTK("pktcdvd: %s failed probe\n", pd->name);
-                return -EROFS;
+                return ret;
         }
 
         if ((ret = pkt_set_write_settings(pd))) {
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 486ed8a11b59..a4d425d2dce2 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -15,22 +15,23 @@ config AGP
           due to kernel allocation issues), you could use PCI accesses
           and have up to a couple gigs of texture space.
 
-          Note that this is the only means to have XFree4/GLX use
+          Note that this is the only means to have X/GLX use
           write-combining with MTRR support on the AGP bus. Without it, OpenGL
           direct rendering will be a lot slower but still faster than PIO.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
-
           To compile this driver as a module, choose M here: the
           module will be called agpgart.
 
+          You should say Y here if you want to use GLX or DRI.
+
+          If unsure, say N.
+
 config AGP_ALI
         tristate "ALI chipset support"
         depends on AGP && X86_32
         ---help---
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on the following ALi chipsets.  The supported chipsets
+          X on the following ALi chipsets.  The supported chipsets
           include M1541, M1621, M1631, M1632, M1641,M1647,and M1651.
           For the ALi-chipset question, ALi suggests you refer to
           <http://www.ali.com.tw/eng/support/index.shtml>.
@@ -40,28 +41,19 @@ config AGP_ALI
           timing issues, this chipset cannot do AGP 2x with the G200.
           This is a hardware limitation. AGP 1x seems to be fine, though.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
-
 config AGP_ATI
         tristate "ATI chipset support"
         depends on AGP && X86_32
         ---help---
-      This option gives you AGP support for the GLX component of
-      XFree86 4.x on the ATI RadeonIGP family of chipsets.
-
-      You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-      use GLX or DRI.  If unsure, say N.
+          This option gives you AGP support for the GLX component of
+          X on the ATI RadeonIGP family of chipsets.
 
 config AGP_AMD
         tristate "AMD Irongate, 761, and 762 chipset support"
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on AMD Irongate, 761, and 762 chipsets.
-
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
+          X on AMD Irongate, 761, and 762 chipsets.
 
 config AGP_AMD64
         tristate "AMD Opteron/Athlon64 on-CPU GART support" if !GART_IOMMU
@@ -69,45 +61,38 @@ config AGP_AMD64
         default y if GART_IOMMU
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
+          X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
           You still need an external AGP bridge like the AMD 8151, VIA
           K8T400M, SiS755. It may also support other AGP bridges when loaded
           with agp_try_unsupported=1.
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say Y
 
 config AGP_INTEL
         tristate "Intel 440LX/BX/GX, I8xx and E7x05 chipset support"
         depends on AGP && X86
         help
-          This option gives you AGP support for the GLX component of XFree86 4.x
+          This option gives you AGP support for the GLX component of X
           on Intel 440LX/BX/GX, 815, 820, 830, 840, 845, 850, 860, 875,
-          E7205 and E7505 chipsets and full support for the 810, 815, 830M, 845G,
-          852GM, 855GM, 865G and I915 integrated graphics chipsets.
+          E7205 and E7505 chipsets and full support for the 810, 815, 830M,
+          845G, 852GM, 855GM, 865G and I915 integrated graphics chipsets.
+
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI, or if you have any Intel integrated graphics
-          chipsets.  If unsure, say Y.
 
 config AGP_NVIDIA
         tristate "NVIDIA nForce/nForce2 chipset support"
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on the following NVIDIA chipsets.  The supported chipsets
-          include nForce and nForce2
+          X on NVIDIA chipsets including nForce and nForce2
 
 config AGP_SIS
         tristate "SiS chipset support"
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on Silicon Integrated Systems [SiS] chipsets.
+          X on Silicon Integrated Systems [SiS] chipsets.
 
           Note that 5591/5592 AGP chipsets are NOT supported.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
 
 config AGP_SWORKS
         tristate "Serverworks LE/HE chipset support"
@@ -121,10 +106,7 @@ config AGP_VIA
         depends on AGP && X86_32
         help
           This option gives you AGP support for the GLX component of
-          XFree86 4.x on VIA MVP3/Apollo Pro chipsets.
-
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say N.
+          X on VIA MVP3/Apollo Pro chipsets.
 
 config AGP_I460
         tristate "Intel 460GX chipset support"
@@ -159,9 +141,6 @@ config AGP_EFFICEON
           This option gives you AGP support for the Transmeta Efficeon
           series processors with integrated northbridges.
 
-          You should say Y here if you use XFree86 3.3.6 or 4.x and want to
-          use GLX or DRI.  If unsure, say Y.
-
 config AGP_SGI_TIOCA
         tristate "SGI TIO chipset AGP support"
         depends on AGP && (IA64_SGI_SN2 || IA64_GENERIC)
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 9964c508c111..1251b2515bbe 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -516,8 +516,10 @@ static int __devinit nforce3_agp_init(struct pci_dev *pdev)
         pci_read_config_dword (hammers[0], AMD64_GARTAPERTUREBASE, &apbase);
 
         /* if x86-64 aperture base is beyond 4G, exit here */
-        if ( (apbase & 0x7fff) >> (32 - 25) )
-                 return -ENODEV;
+        if ( (apbase & 0x7fff) >> (32 - 25) ) {
+                printk(KERN_INFO PFX "aperture base > 4G\n");
+                return -ENODEV;
+        }
 
         apbase = (apbase & 0x7fff) << 25;
 
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 268f78d926d3..efef9999f1cf 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -468,9 +468,7 @@ static int __devinit agp_serverworks_probe(struct pci_dev *pdev,
 
         switch (pdev->device) {
         case 0x0006:
-                /* ServerWorks CNB20HE
-                Fail silently.*/
-                printk (KERN_ERR PFX "Detected ServerWorks CNB20HE chipset: No AGP present.\n");
+                printk (KERN_ERR PFX "ServerWorks CNB20HE is unsupported due to lack of documentation.\n");
                 return -ENODEV;
 
         case PCI_DEVICE_ID_SERVERWORKS_HE:
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index a1381c61aa63..d3879ac9970f 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -202,10 +202,15 @@ void i915_driver_irq_postinstall(drm_device_t * dev)
 void i915_driver_irq_uninstall(drm_device_t * dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        u16 temp;
+
         if (!dev_priv)
                 return;
 
         I915_WRITE16(I915REG_HWSTAM, 0xffff);
         I915_WRITE16(I915REG_INT_MASK_R, 0xffff);
         I915_WRITE16(I915REG_INT_ENABLE_R, 0x0);
+
+        temp = I915_READ16(I915REG_INT_IDENTITY_R);
+        I915_WRITE16(I915REG_INT_IDENTITY_R, temp);
 }
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index 291dbf4c8186..c08fa5076f05 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -161,6 +161,7 @@ void r300_init_reg_flags(void)
         ADD_RANGE(R300_VAP_PVS_CNTL_1, 3);
         ADD_RANGE(R300_GB_ENABLE, 1);
         ADD_RANGE(R300_GB_MSPOS0, 5);
+        ADD_RANGE(R300_TX_CNTL, 1);
         ADD_RANGE(R300_TX_ENABLE, 1);
         ADD_RANGE(0x4200, 4);
         ADD_RANGE(0x4214, 1);
@@ -489,6 +490,50 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
 
         return 0;
 }
+static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
+                                             drm_radeon_kcmd_buffer_t *cmdbuf)
+{
+        u32 *cmd = (u32 *) cmdbuf->buf;
+        int count, ret;
+        RING_LOCALS;
+
+        count=(cmd[0]>>16) & 0x3fff;
+
+        if (cmd[0] & 0x8000) {
+                u32 offset;
+
+                if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL 
+                              | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
+                        offset = cmd[2] << 10;
+                        ret = r300_check_offset(dev_priv, offset);
+                        if (ret) {
+                                DRM_ERROR("Invalid bitblt first offset is %08X\n", offset);
+                                return DRM_ERR(EINVAL);
+                        }
+                }
+
+                if ((cmd[1] & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
+                    (cmd[1] & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
+                        offset = cmd[3] << 10;
+                        ret = r300_check_offset(dev_priv, offset);
+                        if (ret) {
+                                DRM_ERROR("Invalid bitblt second offset is %08X\n", offset);
+                                return DRM_ERR(EINVAL);
+                        }
+                        
+                }
+        }
+
+        BEGIN_RING(count+2);
+        OUT_RING(cmd[0]);
+        OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
+        ADVANCE_RING();
+
+        cmdbuf->buf += (count+2)*4;
+        cmdbuf->bufsz -= (count+2)*4;
+
+        return 0;
+}
 
 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
                                             drm_radeon_kcmd_buffer_t *cmdbuf)
@@ -527,6 +572,9 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
         case RADEON_3D_LOAD_VBPNTR:     /* load vertex array pointers */
                 return r300_emit_3d_load_vbpntr(dev_priv, cmdbuf, header);
 
+        case RADEON_CNTL_BITBLT_MULTI:
+                return r300_emit_bitblt_multi(dev_priv, cmdbuf);
+
         case RADEON_CP_3D_DRAW_IMMD_2:  /* triggers drawing using in-packet vertex data */
         case RADEON_CP_3D_DRAW_VBUF_2:  /* triggers drawing of vertex buffers setup elsewhere */
         case RADEON_CP_3D_DRAW_INDX_2:  /* triggers drawing using indices to vertex buffer */
diff --git a/drivers/char/drm/r300_reg.h b/drivers/char/drm/r300_reg.h
index a0ed20e25221..d1e19954406b 100644
--- a/drivers/char/drm/r300_reg.h
+++ b/drivers/char/drm/r300_reg.h
@@ -451,6 +451,9 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 /* END */
 
 /* gap */
+/* Zero to flush caches. */
+#define R300_TX_CNTL                        0x4100
+
 /* The upper enable bits are guessed, based on fglrx reported limits. */
 #define R300_TX_ENABLE                      0x4104
 #       define R300_TX_ENABLE_0                  (1 << 0)
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index 498b19b1d641..1f7d2ab8c4fc 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -90,9 +90,10 @@
  * 1.19- Add support for gart table in FB memory and PCIE r300
  * 1.20- Add support for r300 texrect
  * 1.21- Add support for card type getparam
+ * 1.22- Add support for texture cache flushes (R300_TX_CNTL)
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            21
+#define DRIVER_MINOR            22
 #define DRIVER_PATCHLEVEL       0
 
 /*
diff --git a/drivers/char/hvc_console.c b/drivers/char/hvc_console.c
index 1994a92d4733..f65b2e14a485 100644
--- a/drivers/char/hvc_console.c
+++ b/drivers/char/hvc_console.c
@@ -335,6 +335,8 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
         } /* else count == 0 */
 
         tty->driver_data = hp;
+        tty->low_latency = 1; /* Makes flushes to ldisc synchronous. */
+
         hp->tty = tty;
         /* Save for request_irq outside of spin_lock. */
         irq = hp->irq;
@@ -633,9 +635,6 @@ static int hvc_poll(struct hvc_struct *hp)
                         tty_insert_flip_char(tty, buf[i], 0);
                 }
 
-                if (count)
-                        tty_schedule_flip(tty);
-
                 /*
                  * Account for the total amount read in one loop, and if above
                  * 64 bytes, we do a quick schedule loop to let the tty grok
@@ -656,6 +655,9 @@ static int hvc_poll(struct hvc_struct *hp)
  bail:
         spin_unlock_irqrestore(&hp->lock, flags);
 
+        if (read_total)
+                tty_flip_buffer_push(tty);
+        
         return poll_mask;
 }
 
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index c2490e270f1f..588e75ec1630 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -2173,15 +2173,17 @@ static int probe_si (struct sx_board *board)
         if ( IS_SI1_BOARD(board)) {
                 /* This should be an SI1 board, which has this
                    location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                         func_exit ();
                         return 0; 
+                }
         } else {
                 /* This should be an SI2 board, which has the bottom
                    3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                         func_exit ();
                         return 0; 
+                }
         }
 
         /* Now we're pretty much convinced that there is an SI board here, 
@@ -2192,15 +2194,17 @@ static int probe_si (struct sx_board *board)
         if ( IS_SI1_BOARD(board)) {
                 /* This should be an SI1 board, which has this
                    location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                         func_exit();
                         return 0; 
+                }
         } else {
                 /* This should be an SI2 board, which has the bottom
                    3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                         func_exit ();
                         return 0; 
+                }
         }
 
         printheader ();
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 5765f672e853..d58f82318853 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -243,7 +243,7 @@ static struct sysrq_key_op sysrq_term_op = {
 
 static void moom_callback(void *ignored)
 {
-        out_of_memory(GFP_KERNEL, 0);
+        out_of_memory(&NODE_DATA(0)->node_zonelists[ZONE_NORMAL], GFP_KERNEL, 0);
 }
 
 static DECLARE_WORK(moom_work, moom_callback, NULL);
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index ec7590951af5..24095f6ee6da 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -33,6 +33,7 @@
 static int TPM_INF_DATA;
 static int TPM_INF_ADDR;
 static int TPM_INF_BASE;
+static int TPM_INF_ADDR_LEN;
 static int TPM_INF_PORT_LEN;
 
 /* TPM header definitions */
@@ -195,6 +196,7 @@ static int tpm_inf_recv(struct tpm_chip *chip, u8 * buf, size_t count)
         int i;
         int ret;
         u32 size = 0;
+        number_of_wtx = 0;
 
 recv_begin:
         /* start receiving header */
@@ -378,24 +380,35 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
             !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
                 TPM_INF_ADDR = pnp_port_start(dev, 0);
+                TPM_INF_ADDR_LEN = pnp_port_len(dev, 0);
                 TPM_INF_DATA = (TPM_INF_ADDR + 1);
                 TPM_INF_BASE = pnp_port_start(dev, 1);
                 TPM_INF_PORT_LEN = pnp_port_len(dev, 1);
-                if (!TPM_INF_PORT_LEN)
-                        return -EINVAL;
+                if ((TPM_INF_PORT_LEN < 4) || (TPM_INF_ADDR_LEN < 2)) {
+                        rc = -EINVAL;
+                        goto err_last;
+                }
                 dev_info(&dev->dev, "Found %s with ID %s\n",
                          dev->name, dev_id->id);
-                if (!((TPM_INF_BASE >> 8) & 0xff))
-                        return -EINVAL;
+                if (!((TPM_INF_BASE >> 8) & 0xff)) {
+                        rc = -EINVAL;
+                        goto err_last;
+                }
                 /* publish my base address and request region */
                 tpm_inf.base = TPM_INF_BASE;
                 if (request_region
                     (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
-                        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto err_last;
+                }
+                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
+                                "tpm_infineon0") == NULL) {
+                        rc = -EINVAL;
+                        goto err_last;
                 }
         } else {
-                return -EINVAL;
+                rc = -EINVAL;
+                goto err_last;
         }
 
         /* query chip for its vendor, its version number a.s.o. */
@@ -443,8 +456,8 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         dev_err(&dev->dev,
                                 "Could not set IO-ports to 0x%lx\n",
                                 tpm_inf.base);
-                        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
-                        return -EIO;
+                        rc = -EIO;
+                        goto err_release_region;
                 }
 
                 /* activate register */
@@ -471,14 +484,21 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 rc = tpm_register_hardware(&dev->dev, &tpm_inf);
                 if (rc < 0) {
-                        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
-                        return -ENODEV;
+                        rc = -ENODEV;
+                        goto err_release_region;
                 }
                 return 0;
         } else {
-                dev_info(&dev->dev, "No Infineon TPM found!\n");
-                return -ENODEV;
+                rc = -ENODEV;
+                goto err_release_region;
         }
+
+err_release_region:
+        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
+
+err_last:
+        return rc;
 }
 
 static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
@@ -518,5 +538,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.6");
+MODULE_VERSION("1.7");
 MODULE_LICENSE("GPL");
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 64819aa7cac4..0c08c58252be 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -348,10 +348,10 @@ aes_set_key(void *ctx_arg, const uint8_t *in_key, unsigned int key_len, uint32_t
                 break;
 
         case 32:
-                E_KEY[4] = le32_to_cpu(in_key[4]);
-                E_KEY[5] = le32_to_cpu(in_key[5]);
-                E_KEY[6] = le32_to_cpu(in_key[6]);
-                t = E_KEY[7] = le32_to_cpu(in_key[7]);
+                E_KEY[4] = le32_to_cpu(key[4]);
+                E_KEY[5] = le32_to_cpu(key[5]);
+                E_KEY[6] = le32_to_cpu(key[6]);
+                t = E_KEY[7] = le32_to_cpu(key[7]);
                 for (i = 0; i < 7; ++i)
                         loop8 (i);
                 break;
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 5c8943509cc1..66d03f242d3c 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -1053,7 +1053,7 @@ static int fc_do_els(fc_channel *fc, unsigned int alpa, void *data, int len)
         int i;
 
         fcmd = &_fcmd;
-        memset(fcmd, 0, sizeof(fcmd));
+        memset(fcmd, 0, sizeof(fcp_cmnd));
         FCD(("PLOGI SID %d DID %d\n", fc->sid, alpa))
         fch = &fcmd->fch;
         FILL_FCHDR_RCTL_DID(fch, R_CTL_ELS_REQ, alpa);
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index 2b286e865163..43b96e298363 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -13,11 +13,6 @@
  * License along with this program; if not, write the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  *
- * Contact information:  Silicon Graphics, Inc., 1600 Amphitheatre Pkwy,
- * Mountain View, CA  94043, or:
- *
- * http://www.sgi.com
- *
  * For further information regarding this notice, see:
  *
  * http://oss.sgi.com/projects/GenInfo/NoticeExplan
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 18d7eda38851..eca92eb475a1 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -137,15 +137,15 @@ MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device (default = 1)"
 /*
  * SCSI inquiry hack for really badly behaved sbp2 devices. Turn this on
  * if your sbp2 device is not properly handling the SCSI inquiry command.
- * This hack makes the inquiry look more like a typical MS Windows
- * inquiry.
+ * This hack makes the inquiry look more like a typical MS Windows inquiry
+ * by enforcing 36 byte inquiry and avoiding access to mode_sense page 8.
  *
  * If force_inquiry_hack=1 is required for your device to work,
  * please submit the logged sbp2_firmware_revision value of this device to
  * the linux1394-devel mailing list.
  */
 static int force_inquiry_hack;
-module_param(force_inquiry_hack, int, 0444);
+module_param(force_inquiry_hack, int, 0644);
 MODULE_PARM_DESC(force_inquiry_hack, "Force SCSI inquiry hack (default = 0)");
 
 /*
@@ -264,18 +264,17 @@ static struct hpsb_protocol_driver sbp2_driver = {
         },
 };
 
-
-/* List of device firmware's that require a forced 36 byte inquiry.  */
+/*
+ * List of device firmwares that require the inquiry hack.
+ * Yields a few false positives but did not break other devices so far.
+ */
 static u32 sbp2_broken_inquiry_list[] = {
-        0x00002800,     /* Stefan Richter <richtest@bauwesen.tu-cottbus.de> */
+        0x00002800,     /* Stefan Richter <stefanr@s5r6.in-berlin.de> */
                         /* DViCO Momobay CX-1 */
         0x00000200      /* Andreas Plesch <plesch@fas.harvard.edu> */
                         /* QPS Fire DVDBurner */
 };
 
-#define NUM_BROKEN_INQUIRY_DEVS \
-        (sizeof(sbp2_broken_inquiry_list)/sizeof(*sbp2_broken_inquiry_list))
-
 /**************************************
  * General utility functions
  **************************************/
@@ -643,9 +642,15 @@ static int sbp2_remove(struct device *dev)
         if (!scsi_id)
                 return 0;
 
-        /* Trigger shutdown functions in scsi's highlevel. */
-        if (scsi_id->scsi_host)
+        if (scsi_id->scsi_host) {
+                /* Get rid of enqueued commands if there is no chance to
+                 * send them. */
+                if (!sbp2util_node_is_available(scsi_id))
+                        sbp2scsi_complete_all_commands(scsi_id, DID_NO_CONNECT);
+                /* scsi_remove_device() will trigger shutdown functions of SCSI
+                 * highlevel drivers which would deadlock if blocked. */
                 scsi_unblock_requests(scsi_id->scsi_host);
+        }
         sdev = scsi_id->sdev;
         if (sdev) {
                 scsi_id->sdev = NULL;
@@ -742,11 +747,6 @@ static struct scsi_id_instance_data *sbp2_alloc_device(struct unit_directory *ud
                 hi->host = ud->ne->host;
                 INIT_LIST_HEAD(&hi->scsi_ids);
 
-                /* Register our sbp2 status address space... */
-                hpsb_register_addrspace(&sbp2_highlevel, ud->ne->host, &sbp2_ops,
-                                        SBP2_STATUS_FIFO_ADDRESS,
-                                        SBP2_STATUS_FIFO_ADDRESS +
-                                        SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(SBP2_MAX_UDS_PER_NODE+1));
 #ifdef CONFIG_IEEE1394_SBP2_PHYS_DMA
                 /* Handle data movement if physical dma is not
                  * enabled/supportedon host controller */
@@ -759,6 +759,18 @@ static struct scsi_id_instance_data *sbp2_alloc_device(struct unit_directory *ud
 
         list_add_tail(&scsi_id->scsi_list, &hi->scsi_ids);
 
+        /* Register the status FIFO address range. We could use the same FIFO
+         * for targets at different nodes. However we need different FIFOs per
+         * target in order to support multi-unit devices. */
+        scsi_id->status_fifo_addr = hpsb_allocate_and_register_addrspace(
+                        &sbp2_highlevel, ud->ne->host, &sbp2_ops,
+                        sizeof(struct sbp2_status_block), sizeof(quadlet_t),
+                        ~0ULL, ~0ULL);
+        if (!scsi_id->status_fifo_addr) {
+                SBP2_ERR("failed to allocate status FIFO address range");
+                goto failed_alloc;
+        }
+
         /* Register our host with the SCSI stack. */
         scsi_host = scsi_host_alloc(&scsi_driver_template,
                                     sizeof(unsigned long));
@@ -997,6 +1009,10 @@ static void sbp2_remove_device(struct scsi_id_instance_data *scsi_id)
                 SBP2_DMA_FREE("single query logins data");
         }
 
+        if (scsi_id->status_fifo_addr)
+                hpsb_unregister_addrspace(&sbp2_highlevel, hi->host,
+                        scsi_id->status_fifo_addr);
+
         scsi_id->ud->device.driver_data = NULL;
 
         SBP2_DEBUG("SBP-2 device removed, SCSI ID = %d", scsi_id->ud->id);
@@ -1075,11 +1091,10 @@ static int sbp2_query_logins(struct scsi_id_instance_data *scsi_id)
                 ORB_SET_QUERY_LOGINS_RESP_LENGTH(sizeof(struct sbp2_query_logins_response));
         SBP2_DEBUG("sbp2_query_logins: reserved_resp_length initialized");
 
-        scsi_id->query_logins_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                                    SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->query_logins_orb->status_FIFO_hi = (ORB_SET_NODE_ID(hi->host->node_id) |
-                                                     SBP2_STATUS_FIFO_ADDRESS_HI);
-        SBP2_DEBUG("sbp2_query_logins: status FIFO initialized");
+        scsi_id->query_logins_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->query_logins_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         sbp2util_cpu_to_be32_buffer(scsi_id->query_logins_orb, sizeof(struct sbp2_query_logins_orb));
 
@@ -1184,11 +1199,10 @@ static int sbp2_login_device(struct scsi_id_instance_data *scsi_id)
                 ORB_SET_LOGIN_RESP_LENGTH(sizeof(struct sbp2_login_response));
         SBP2_DEBUG("sbp2_login_device: passwd_resp_lengths initialized");
 
-        scsi_id->login_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                             SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->login_orb->status_FIFO_hi = (ORB_SET_NODE_ID(hi->host->node_id) |
-                                              SBP2_STATUS_FIFO_ADDRESS_HI);
-        SBP2_DEBUG("sbp2_login_device: status FIFO initialized");
+        scsi_id->login_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->login_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         /*
          * Byte swap ORB if necessary
@@ -1301,10 +1315,10 @@ static int sbp2_logout_device(struct scsi_id_instance_data *scsi_id)
         scsi_id->logout_orb->login_ID_misc |= ORB_SET_NOTIFY(1);
 
         scsi_id->logout_orb->reserved5 = 0x0;
-        scsi_id->logout_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                              SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->logout_orb->status_FIFO_hi = (ORB_SET_NODE_ID(hi->host->node_id) |
-                                               SBP2_STATUS_FIFO_ADDRESS_HI);
+        scsi_id->logout_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->logout_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         /*
          * Byte swap ORB if necessary
@@ -1366,10 +1380,10 @@ static int sbp2_reconnect_device(struct scsi_id_instance_data *scsi_id)
         scsi_id->reconnect_orb->login_ID_misc |= ORB_SET_NOTIFY(1);
 
         scsi_id->reconnect_orb->reserved5 = 0x0;
-        scsi_id->reconnect_orb->status_FIFO_lo = SBP2_STATUS_FIFO_ADDRESS_LO +
-                                                 SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(scsi_id->ud->id);
-        scsi_id->reconnect_orb->status_FIFO_hi =
-                (ORB_SET_NODE_ID(hi->host->node_id) | SBP2_STATUS_FIFO_ADDRESS_HI);
+        scsi_id->reconnect_orb->status_fifo_hi =
+                ORB_SET_STATUS_FIFO_HI(scsi_id->status_fifo_addr, hi->host->node_id);
+        scsi_id->reconnect_orb->status_fifo_lo =
+                ORB_SET_STATUS_FIFO_LO(scsi_id->status_fifo_addr);
 
         /*
          * Byte swap ORB if necessary
@@ -1560,7 +1574,7 @@ static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,
         /* Check for a blacklisted set of devices that require us to force
          * a 36 byte host inquiry. This can be overriden as a module param
          * (to force all hosts).  */
-        for (i = 0; i < NUM_BROKEN_INQUIRY_DEVS; i++) {
+        for (i = 0; i < ARRAY_SIZE(sbp2_broken_inquiry_list); i++) {
                 if ((firmware_revision & 0xffff00) ==
                                 sbp2_broken_inquiry_list[i]) {
                         SBP2_WARN("Node " NODE_BUS_FMT ": Using 36byte inquiry workaround",
@@ -2007,18 +2021,6 @@ static int sbp2_send_command(struct scsi_id_instance_data *scsi_id,
         }
 
         /*
-         * The scsi stack sends down a request_bufflen which does not match the
-         * length field in the scsi cdb. This causes some sbp2 devices to
-         * reject this inquiry command. Fix the request_bufflen.
-         */
-        if (*cmd == INQUIRY) {
-                if (force_inquiry_hack || scsi_id->workarounds & SBP2_BREAKAGE_INQUIRY_HACK)
-                        request_bufflen = cmd[4] = 0x24;
-                else
-                        request_bufflen = cmd[4];
-        }
-
-        /*
          * Now actually fill in the comamnd orb and sbp2 s/g list
          */
         sbp2_create_command_orb(scsi_id, command, cmd, SCpnt->use_sg,
@@ -2082,9 +2084,7 @@ static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
 
         SBP2_DEBUG("sbp2_check_sbp2_response");
 
-        switch (SCpnt->cmnd[0]) {
-
-        case INQUIRY:
+        if (SCpnt->cmnd[0] == INQUIRY && (SCpnt->cmnd[1] & 3) == 0) {
                 /*
                  * Make sure data length is ok. Minimum length is 36 bytes
                  */
@@ -2097,13 +2097,7 @@ static void sbp2_check_sbp2_response(struct scsi_id_instance_data *scsi_id,
                  */
                 scsi_buf[2] |= 2;
                 scsi_buf[3] = (scsi_buf[3] & 0xf0) | 2;
-
-                break;
-
-        default:
-                break;
         }
-        return;
 }
 
 /*
@@ -2114,7 +2108,6 @@ static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int dest
 {
         struct sbp2scsi_host_info *hi;
         struct scsi_id_instance_data *scsi_id = NULL, *scsi_id_tmp;
-        u32 id;
         struct scsi_cmnd *SCpnt = NULL;
         u32 scsi_status = SBP2_SCSI_STATUS_GOOD;
         struct sbp2_command_info *command;
@@ -2137,12 +2130,12 @@ static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int dest
         }
 
         /*
-         * Find our scsi_id structure by looking at the status fifo address written to by
-         * the sbp2 device.
+         * Find our scsi_id structure by looking at the status fifo address
+         * written to by the sbp2 device.
          */
-        id = SBP2_STATUS_FIFO_OFFSET_TO_ENTRY((u32)(addr - SBP2_STATUS_FIFO_ADDRESS));
         list_for_each_entry(scsi_id_tmp, &hi->scsi_ids, scsi_list) {
-                if (scsi_id_tmp->ne->nodeid == nodeid && scsi_id_tmp->ud->id == id) {
+                if (scsi_id_tmp->ne->nodeid == nodeid &&
+                    scsi_id_tmp->status_fifo_addr == addr) {
                         scsi_id = scsi_id_tmp;
                         break;
                 }
@@ -2483,7 +2476,16 @@ static void sbp2scsi_complete_command(struct scsi_id_instance_data *scsi_id,
 
 static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
 {
-        ((struct scsi_id_instance_data *)sdev->host->hostdata[0])->sdev = sdev;
+        struct scsi_id_instance_data *scsi_id =
+                (struct scsi_id_instance_data *)sdev->host->hostdata[0];
+
+        scsi_id->sdev = sdev;
+
+        if (force_inquiry_hack ||
+            scsi_id->workarounds & SBP2_BREAKAGE_INQUIRY_HACK) {
+                sdev->inquiry_len = 36;
+                sdev->skip_ms_page_8 = 1;
+        }
         return 0;
 }
 
diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
index 900ea1d25e71..e2d357a9ea3a 100644
--- a/drivers/ieee1394/sbp2.h
+++ b/drivers/ieee1394/sbp2.h
@@ -33,15 +33,17 @@
 #define ORB_DIRECTION_NO_DATA_TRANSFER  0x2
 
 #define ORB_SET_NULL_PTR(value)                 ((value & 0x1) << 31)
-#define ORB_SET_NOTIFY(value)                   ((value & 0x1) << 31)
-#define ORB_SET_RQ_FMT(value)                   ((value & 0x3) << 29)   /* unused ? */
+#define ORB_SET_NOTIFY(value)                   ((value & 0x1) << 31)
+#define ORB_SET_RQ_FMT(value)                   ((value & 0x3) << 29)   /* unused ? */
 #define ORB_SET_NODE_ID(value)                  ((value & 0xffff) << 16)
-#define ORB_SET_DATA_SIZE(value)                (value & 0xffff)
-#define ORB_SET_PAGE_SIZE(value)                ((value & 0x7) << 16)
-#define ORB_SET_PAGE_TABLE_PRESENT(value)       ((value & 0x1) << 19)
-#define ORB_SET_MAX_PAYLOAD(value)              ((value & 0xf) << 20)
-#define ORB_SET_SPEED(value)                    ((value & 0x7) << 24)
-#define ORB_SET_DIRECTION(value)                ((value & 0x1) << 27)
+#define ORB_SET_STATUS_FIFO_HI(value, id)       (value >> 32 | ORB_SET_NODE_ID(id))
+#define ORB_SET_STATUS_FIFO_LO(value)           (value & 0xffffffff)
+#define ORB_SET_DATA_SIZE(value)                (value & 0xffff)
+#define ORB_SET_PAGE_SIZE(value)                ((value & 0x7) << 16)
+#define ORB_SET_PAGE_TABLE_PRESENT(value)       ((value & 0x1) << 19)
+#define ORB_SET_MAX_PAYLOAD(value)              ((value & 0xf) << 20)
+#define ORB_SET_SPEED(value)                    ((value & 0x7) << 24)
+#define ORB_SET_DIRECTION(value)                ((value & 0x1) << 27)
 
 struct sbp2_command_orb {
         volatile u32 next_ORB_hi;
@@ -76,8 +78,8 @@ struct sbp2_login_orb {
         u32 login_response_lo;
         u32 lun_misc;
         u32 passwd_resp_lengths;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 #define RESPONSE_GET_LOGIN_ID(value)            (value & 0xffff)
@@ -102,8 +104,8 @@ struct sbp2_query_logins_orb {
         u32 query_response_lo;
         u32 lun_misc;
         u32 reserved_resp_length;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 #define RESPONSE_GET_MAX_LOGINS(value)          (value & 0xffff)
@@ -123,8 +125,8 @@ struct sbp2_reconnect_orb {
         u32 reserved4;
         u32 login_ID_misc;
         u32 reserved5;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 struct sbp2_logout_orb {
@@ -134,8 +136,8 @@ struct sbp2_logout_orb {
         u32 reserved4;
         u32 login_ID_misc;
         u32 reserved5;
-        u32 status_FIFO_hi;
-        u32 status_FIFO_lo;
+        u32 status_fifo_hi;
+        u32 status_fifo_lo;
 };
 
 #define PAGE_TABLE_SET_SEGMENT_BASE_HI(value)   (value & 0xffff)
@@ -195,30 +197,6 @@ struct sbp2_status_block {
  * Miscellaneous SBP2 related config rom defines
  */
 
-/* The status fifo address definition below is used as a base for each
- * node, which a chunk seperately assigned to each unit directory in the
- * node.  For example, 0xfffe00000000ULL is used for the first sbp2 device
- * detected on node 0, 0xfffe00000020ULL for the next sbp2 device on node
- * 0, and so on.
- *
- * Note: We could use a single status fifo address for all sbp2 devices,
- * and figure out which sbp2 device the status belongs to by looking at
- * the source node id of the status write... but, using separate addresses
- * for each sbp2 unit directory allows for better code and the ability to
- * support multiple luns within a single 1394 node.
- *
- * Also note that we choose the address range below as it is a region
- * specified for write posting, where the ohci controller will
- * automatically send an ack_complete when the status is written by the
- * sbp2 device... saving a split transaction.   =)
- */
-#define SBP2_STATUS_FIFO_ADDRESS                                0xfffe00000000ULL
-#define SBP2_STATUS_FIFO_ADDRESS_HI                             0xfffe
-#define SBP2_STATUS_FIFO_ADDRESS_LO                             0x0
-
-#define SBP2_STATUS_FIFO_ENTRY_TO_OFFSET(entry)                 ((entry) << 5)
-#define SBP2_STATUS_FIFO_OFFSET_TO_ENTRY(offset)                ((offset) >> 5)
-
 #define SBP2_UNIT_DIRECTORY_OFFSET_KEY                          0xd1
 #define SBP2_CSR_OFFSET_KEY                                     0x54
 #define SBP2_UNIT_SPEC_ID_KEY                                   0x12
@@ -258,7 +236,6 @@ struct sbp2_status_block {
  */
 
 #define SBP2_MAX_SG_ELEMENT_LENGTH      0xf000
-#define SBP2_MAX_UDS_PER_NODE           16      /* Maximum scsi devices per node */
 #define SBP2_MAX_SECTORS                255     /* Max sectors supported */
 #define SBP2_MAX_CMDS                   8       /* This should be safe */
 
@@ -338,6 +315,11 @@ struct scsi_id_instance_data {
         u32 sbp2_firmware_revision;
 
         /*
+         * Address for the device to write status blocks to
+         */
+        u64 status_fifo_addr;
+
+        /*
          * Variable used for logins, reconnects, logouts, query logins
          */
         atomic_t sbp2_login_complete;
diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
index 3a32c59494f2..24e51d5e97fc 100644
--- a/drivers/macintosh/windfarm_smu_sat.c
+++ b/drivers/macintosh/windfarm_smu_sat.c
@@ -151,6 +151,7 @@ struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id,
         kfree(buf);
         return NULL;
 }
+EXPORT_SYMBOL_GPL(smu_sat_get_sdb_partition);
 
 /* refresh the cache */
 static int wf_sat_read_cache(struct wf_sat *sat)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index e9adeb9d172f..745ca1f67b14 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -849,10 +849,16 @@ static struct mapped_device *alloc_dev(unsigned int minor, int persistent)
 
 static void free_dev(struct mapped_device *md)
 {
-        free_minor(md->disk->first_minor);
+        unsigned int minor = md->disk->first_minor;
+
+        if (md->suspended_bdev) {
+                thaw_bdev(md->suspended_bdev, NULL);
+                bdput(md->suspended_bdev);
+        }
         mempool_destroy(md->tio_pool);
         mempool_destroy(md->io_pool);
         del_gendisk(md->disk);
+        free_minor(minor);
         put_disk(md->disk);
         blk_put_queue(md->queue);
         kfree(md);
diff --git a/drivers/mmc/mmci.c b/drivers/mmc/mmci.c
index 37ee7f8dc82f..9fef29d978b5 100644
--- a/drivers/mmc/mmci.c
+++ b/drivers/mmc/mmci.c
@@ -97,6 +97,13 @@ static void mmci_start_data(struct mmci_host *host, struct mmc_data *data)
         if (data->flags & MMC_DATA_READ) {
                 datactrl |= MCI_DPSM_DIRECTION;
                 irqmask = MCI_RXFIFOHALFFULLMASK;
+
+                /*
+                 * If we have less than a FIFOSIZE of bytes to transfer,
+                 * trigger a PIO interrupt as soon as any data is available.
+                 */
+                if (host->size < MCI_FIFOSIZE)
+                        irqmask |= MCI_RXDATAAVLBLMASK;
         } else {
                 /*
                  * We don't actually need to include "FIFO empty" here
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 69c04945591f..1c074d63ff3a 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -408,6 +408,7 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
                 cfi->chips[i].buffer_write_time = 1<<cfi->cfiq->BufWriteTimeoutTyp;
                 cfi->chips[i].erase_time = 1<<cfi->cfiq->BlockEraseTimeoutTyp;
                 cfi->chips[i].ref_point_counter = 0;
+                init_waitqueue_head(&(cfi->chips[i].wq));
         }
 
         map->fldrv = &cfi_intelext_chipdrv;
@@ -1019,8 +1020,8 @@ static void __xipram xip_udelay(struct map_info *map, struct flchip *chip,
 #define XIP_INVAL_CACHED_RANGE(map, from, size)  \
         INVALIDATE_CACHED_RANGE(map, from, size)
 
-#define INVALIDATE_CACHE_UDELAY(map, chip, adr, len, usec)  \
-        UDELAY(map, chip, adr, usec)
+#define INVALIDATE_CACHE_UDELAY(map, chip, cmd_adr, adr, len, usec)  \
+        UDELAY(map, chip, cmd_adr, usec)
 
 /*
  * Extra notes:
@@ -1052,7 +1053,7 @@ do {  \
         spin_lock(chip->mutex);  \
 } while (0)
 
-#define INVALIDATE_CACHE_UDELAY(map, chip, adr, len, usec)  \
+#define INVALIDATE_CACHE_UDELAY(map, chip, cmd_adr, adr, len, usec)  \
 do {  \
         spin_unlock(chip->mutex);  \
         INVALIDATE_CACHED_RANGE(map, adr, len);  \
@@ -1284,7 +1285,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
         map_write(map, datum, adr);
         chip->state = mode;
 
-        INVALIDATE_CACHE_UDELAY(map, chip,
+        INVALIDATE_CACHE_UDELAY(map, chip, adr,
                                 adr, map_bankwidth(map),
                                 chip->word_write_time);
 
@@ -1572,8 +1573,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         map_write(map, CMD(0xd0), cmd_adr);
         chip->state = FL_WRITING;
 
-        INVALIDATE_CACHE_UDELAY(map, chip,
-                                cmd_adr, len,
+        INVALIDATE_CACHE_UDELAY(map, chip, cmd_adr,
+                                adr, len,
                                 chip->buffer_write_time);
 
         timeo = jiffies + (HZ/2);
@@ -1744,7 +1745,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         chip->state = FL_ERASING;
         chip->erase_suspended = 0;
 
-        INVALIDATE_CACHE_UDELAY(map, chip,
+        INVALIDATE_CACHE_UDELAY(map, chip, adr,
                                 adr, len,
                                 chip->erase_time*1000/2);
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 47c72a63dfe1..e45a8f959719 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2020,8 +2020,8 @@ config SIS190
           will be called sis190.  This is recommended.
 
 config SKGE
-        tristate "New SysKonnect GigaEthernet support (EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
+        tristate "New SysKonnect GigaEthernet support"
+        depends on PCI
         select CRC32
         ---help---
           This driver support the Marvell Yukon or SysKonnect SK-98xx/SK-95xx
@@ -2082,7 +2082,6 @@ config SK98LIN
             - Allied Telesyn AT-2971SX Gigabit Ethernet Adapter
             - Allied Telesyn AT-2971T Gigabit Ethernet Adapter
             - Belkin Gigabit Desktop Card 10/100/1000Base-T Adapter, Copper RJ-45
-            - DGE-530T Gigabit Ethernet Adapter
             - EG1032 v2 Instant Gigabit Network Adapter
             - EG1064 v2 Instant Gigabit Network Adapter
             - Marvell 88E8001 Gigabit LOM Ethernet Adapter (Abit)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index e0f51afec778..bcf9f17daf0d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1581,6 +1581,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
                 printk(KERN_INFO DRV_NAME
                        ": %s: %s not enslaved\n",
                        bond_dev->name, slave_dev->name);
+                write_unlock_bh(&bond->lock);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 3682ec61e8a8..e7fc28b07e5a 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -102,6 +102,9 @@
  *      0.47: 26 Oct 2005: Add phyaddr 0 in phy scan.
  *      0.48: 24 Dec 2005: Disable TSO, bugfix for pci_map_single
  *      0.49: 10 Dec 2005: Fix tso for large buffers.
+ *      0.50: 20 Jan 2006: Add 8021pq tagging support.
+ *      0.51: 20 Jan 2006: Add 64bit consistent memory allocation for rings.
+ *      0.52: 20 Jan 2006: Add MSI/MSIX support.
  *
  * Known bugs:
  * We suspect that on some hardware no TX done interrupts are generated.
@@ -113,7 +116,7 @@
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
-#define FORCEDETH_VERSION               "0.49"
+#define FORCEDETH_VERSION               "0.52"
 #define DRV_NAME                        "forcedeth"
 
 #include <linux/module.h>
@@ -153,6 +156,9 @@
 #define DEV_HAS_LARGEDESC       0x0004  /* device supports jumbo frames and needs packet format 2 */
 #define DEV_HAS_HIGH_DMA        0x0008  /* device supports 64bit dma */
 #define DEV_HAS_CHECKSUM        0x0010  /* device supports tx and rx checksum offloads */
+#define DEV_HAS_VLAN            0x0020  /* device supports vlan tagging and striping */
+#define DEV_HAS_MSI             0x0040  /* device supports MSI */
+#define DEV_HAS_MSI_X           0x0080  /* device supports MSI-X */
 
 enum {
         NvRegIrqStatus = 0x000,
@@ -166,14 +172,17 @@ enum {
 #define NVREG_IRQ_TX_OK                 0x0010
 #define NVREG_IRQ_TIMER                 0x0020
 #define NVREG_IRQ_LINK                  0x0040
-#define NVREG_IRQ_TX_ERROR              0x0080
-#define NVREG_IRQ_TX1                   0x0100
+#define NVREG_IRQ_RX_FORCED             0x0080
+#define NVREG_IRQ_TX_FORCED             0x0100
 #define NVREG_IRQMASK_THROUGHPUT        0x00df
 #define NVREG_IRQMASK_CPU               0x0040
+#define NVREG_IRQ_TX_ALL                (NVREG_IRQ_TX_ERR|NVREG_IRQ_TX_OK|NVREG_IRQ_TX_FORCED)
+#define NVREG_IRQ_RX_ALL                (NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF|NVREG_IRQ_RX_FORCED)
+#define NVREG_IRQ_OTHER                 (NVREG_IRQ_TIMER|NVREG_IRQ_LINK)
 
 #define NVREG_IRQ_UNKNOWN       (~(NVREG_IRQ_RX_ERROR|NVREG_IRQ_RX|NVREG_IRQ_RX_NOBUF|NVREG_IRQ_TX_ERR| \
-                                        NVREG_IRQ_TX_OK|NVREG_IRQ_TIMER|NVREG_IRQ_LINK|NVREG_IRQ_TX_ERROR| \
-                                        NVREG_IRQ_TX1))
+                                        NVREG_IRQ_TX_OK|NVREG_IRQ_TIMER|NVREG_IRQ_LINK|NVREG_IRQ_RX_FORCED| \
+                                        NVREG_IRQ_TX_FORCED))
 
         NvRegUnknownSetupReg6 = 0x008,
 #define NVREG_UNKSETUP6_VAL             3
@@ -185,6 +194,10 @@ enum {
         NvRegPollingInterval = 0x00c,
 #define NVREG_POLL_DEFAULT_THROUGHPUT   970
 #define NVREG_POLL_DEFAULT_CPU  13
+        NvRegMSIMap0 = 0x020,
+        NvRegMSIMap1 = 0x024,
+        NvRegMSIIrqMask = 0x030,
+#define NVREG_MSI_VECTOR_0_ENABLED 0x01
         NvRegMisc1 = 0x080,
 #define NVREG_MISC1_HD          0x02
 #define NVREG_MISC1_FORCE       0x3b0f3c
@@ -254,6 +267,10 @@ enum {
 #define NVREG_TXRXCTL_DESC_1    0
 #define NVREG_TXRXCTL_DESC_2    0x02100
 #define NVREG_TXRXCTL_DESC_3    0x02200
+#define NVREG_TXRXCTL_VLANSTRIP 0x00040
+#define NVREG_TXRXCTL_VLANINS   0x00080
+        NvRegTxRingPhysAddrHigh = 0x148,
+        NvRegRxRingPhysAddrHigh = 0x14C,
         NvRegMIIStatus = 0x180,
 #define NVREG_MIISTAT_ERROR             0x0001
 #define NVREG_MIISTAT_LINKCHANGE        0x0008
@@ -303,6 +320,11 @@ enum {
 #define NVREG_POWERSTATE_D1             0x0001
 #define NVREG_POWERSTATE_D2             0x0002
 #define NVREG_POWERSTATE_D3             0x0003
+        NvRegVlanControl = 0x300,
+#define NVREG_VLANCONTROL_ENABLE        0x2000
+        NvRegMSIXMap0 = 0x3e0,
+        NvRegMSIXMap1 = 0x3e4,
+        NvRegMSIXIrqStatus = 0x3f0,
 };
 
 /* Big endian: should work, but is untested */
@@ -314,7 +336,7 @@ struct ring_desc {
 struct ring_desc_ex {
         u32 PacketBufferHigh;
         u32 PacketBufferLow;
-        u32 Reserved;
+        u32 TxVlan;
         u32 FlagLen;
 };
 
@@ -355,6 +377,8 @@ typedef union _ring_type {
 #define NV_TX2_CHECKSUM_L3      (1<<27)
 #define NV_TX2_CHECKSUM_L4      (1<<26)
 
+#define NV_TX3_VLAN_TAG_PRESENT (1<<18)
+
 #define NV_RX_DESCRIPTORVALID   (1<<16)
 #define NV_RX_MISSEDFRAME       (1<<17)
 #define NV_RX_SUBSTRACT1        (1<<18)
@@ -385,6 +409,9 @@ typedef union _ring_type {
 #define NV_RX2_ERROR            (1<<30)
 #define NV_RX2_AVAIL            (1<<31)
 
+#define NV_RX3_VLAN_TAG_PRESENT (1<<16)
+#define NV_RX3_VLAN_TAG_MASK    (0x0000FFFF)
+
 /* Miscelaneous hardware related defines: */
 #define NV_PCI_REGSZ            0x270
 
@@ -475,6 +502,18 @@ typedef union _ring_type {
 #define LPA_1000FULL    0x0800
 #define LPA_1000HALF    0x0400
 
+/* MSI/MSI-X defines */
+#define NV_MSI_X_MAX_VECTORS  8
+#define NV_MSI_X_VECTORS_MASK 0x000f
+#define NV_MSI_CAPABLE        0x0010
+#define NV_MSI_X_CAPABLE      0x0020
+#define NV_MSI_ENABLED        0x0040
+#define NV_MSI_X_ENABLED      0x0080
+
+#define NV_MSI_X_VECTOR_ALL   0x0
+#define NV_MSI_X_VECTOR_RX    0x0
+#define NV_MSI_X_VECTOR_TX    0x1
+#define NV_MSI_X_VECTOR_OTHER 0x2
 
 /*
  * SMP locking:
@@ -511,6 +550,7 @@ struct fe_priv {
         u32 irqmask;
         u32 desc_ver;
         u32 txrxctl_bits;
+        u32 vlanctl_bits;
 
         void __iomem *base;
 
@@ -525,6 +565,7 @@ struct fe_priv {
         unsigned int pkt_limit;
         struct timer_list oom_kick;
         struct timer_list nic_poll;
+        u32 nic_poll_irq;
 
         /* media detection workaround.
          * Locking: Within irq hander or disable_irq+spin_lock(&np->lock);
@@ -540,6 +581,13 @@ struct fe_priv {
         dma_addr_t tx_dma[TX_RING];
         unsigned int tx_dma_len[TX_RING];
         u32 tx_flags;
+
+        /* vlan fields */
+        struct vlan_group *vlangrp;
+
+        /* msi/msi-x fields */
+        u32 msi_flags;
+        struct msix_entry msi_x_entry[NV_MSI_X_MAX_VECTORS];
 };
 
 /*
@@ -567,6 +615,16 @@ static int optimization_mode = NV_OPTIMIZATION_MODE_THROUGHPUT;
  */
 static int poll_interval = -1;
 
+/*
+ * Disable MSI interrupts
+ */
+static int disable_msi = 0;
+
+/*
+ * Disable MSIX interrupts
+ */
+static int disable_msix = 0;
+
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
         return netdev_priv(dev);
@@ -612,6 +670,33 @@ static int reg_delay(struct net_device *dev, int offset, u32 mask, u32 target,
         return 0;
 }
 
+#define NV_SETUP_RX_RING 0x01
+#define NV_SETUP_TX_RING 0x02
+
+static void setup_hw_rings(struct net_device *dev, int rxtx_flags)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+
+        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
+                if (rxtx_flags & NV_SETUP_RX_RING) {
+                        writel((u32) cpu_to_le64(np->ring_addr), base + NvRegRxRingPhysAddr);
+                }
+                if (rxtx_flags & NV_SETUP_TX_RING) {
+                        writel((u32) cpu_to_le64(np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
+                }
+        } else {
+                if (rxtx_flags & NV_SETUP_RX_RING) {
+                        writel((u32) cpu_to_le64(np->ring_addr), base + NvRegRxRingPhysAddr);
+                        writel((u32) (cpu_to_le64(np->ring_addr) >> 32), base + NvRegRxRingPhysAddrHigh);
+                }
+                if (rxtx_flags & NV_SETUP_TX_RING) {
+                        writel((u32) cpu_to_le64(np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
+                        writel((u32) (cpu_to_le64(np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)) >> 32), base + NvRegTxRingPhysAddrHigh);
+                }
+        }
+}
+
 #define MII_READ        (-1)
 /* mii_rw: read/write a register on the PHY.
  *
@@ -903,14 +988,27 @@ static void nv_do_rx_refill(unsigned long data)
         struct net_device *dev = (struct net_device *) data;
         struct fe_priv *np = netdev_priv(dev);
 
-        disable_irq(dev->irq);
+
+        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+            ((np->msi_flags & NV_MSI_X_ENABLED) && 
+             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+                disable_irq(dev->irq);
+        } else {
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+        }
         if (nv_alloc_rx(dev)) {
                 spin_lock(&np->lock);
                 if (!np->in_shutdown)
                         mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
                 spin_unlock(&np->lock);
         }
-        enable_irq(dev->irq);
+        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+            ((np->msi_flags & NV_MSI_X_ENABLED) && 
+             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+                enable_irq(dev->irq);
+        } else {
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+        }
 }
 
 static void nv_init_rx(struct net_device *dev) 
@@ -965,7 +1063,7 @@ static int nv_release_txskb(struct net_device *dev, unsigned int skbnr)
         }
 
         if (np->tx_skbuff[skbnr]) {
-                dev_kfree_skb_irq(np->tx_skbuff[skbnr]);
+                dev_kfree_skb_any(np->tx_skbuff[skbnr]);
                 np->tx_skbuff[skbnr] = NULL;
                 return 1;
         } else {
@@ -1031,6 +1129,7 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
         u32 bcnt;
         u32 size = skb->len-skb->data_len;
         u32 entries = (size >> NV_TX2_TSO_MAX_SHIFT) + ((size & (NV_TX2_TSO_MAX_SIZE-1)) ? 1 : 0);
+        u32 tx_flags_vlan = 0;
 
         /* add fragments to entries count */
         for (i = 0; i < fragments; i++) {
@@ -1111,10 +1210,16 @@ static int nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
         tx_flags_extra = (skb->ip_summed == CHECKSUM_HW ? (NV_TX2_CHECKSUM_L3|NV_TX2_CHECKSUM_L4) : 0);
 
+        /* vlan tag */
+        if (np->vlangrp && vlan_tx_tag_present(skb)) {
+                tx_flags_vlan = NV_TX3_VLAN_TAG_PRESENT | vlan_tx_tag_get(skb);
+        }
+
         /* set tx flags */
         if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2) {
                 np->tx_ring.orig[start_nr].FlagLen |= cpu_to_le32(tx_flags | tx_flags_extra);
         } else {
+                np->tx_ring.ex[start_nr].TxVlan = cpu_to_le32(tx_flags_vlan);
                 np->tx_ring.ex[start_nr].FlagLen |= cpu_to_le32(tx_flags | tx_flags_extra);
         }       
 
@@ -1209,9 +1314,14 @@ static void nv_tx_timeout(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 status;
+
+        if (np->msi_flags & NV_MSI_X_ENABLED)
+                status = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQSTAT_MASK;
+        else
+                status = readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK;
 
-        printk(KERN_INFO "%s: Got tx_timeout. irq: %08x\n", dev->name,
-                        readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK);
+        printk(KERN_INFO "%s: Got tx_timeout. irq: %08x\n", dev->name, status);
 
         {
                 int i;
@@ -1273,10 +1383,7 @@ static void nv_tx_timeout(struct net_device *dev)
                 printk(KERN_DEBUG "%s: tx_timeout: dead entries!\n", dev->name);
                 nv_drain_tx(dev);
                 np->next_tx = np->nic_tx = 0;
-                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
-                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
-                else
-                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
+                setup_hw_rings(dev, NV_SETUP_TX_RING);
                 netif_wake_queue(dev);
         }
 
@@ -1342,6 +1449,8 @@ static void nv_rx_process(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u32 Flags;
+        u32 vlanflags = 0;
+
 
         for (;;) {
                 struct sk_buff *skb;
@@ -1357,6 +1466,7 @@ static void nv_rx_process(struct net_device *dev)
                 } else {
                         Flags = le32_to_cpu(np->rx_ring.ex[i].FlagLen);
                         len = nv_descr_getlength_ex(&np->rx_ring.ex[i], np->desc_ver);
+                        vlanflags = le32_to_cpu(np->rx_ring.ex[i].PacketBufferLow);
                 }
 
                 dprintk(KERN_DEBUG "%s: nv_rx_process: looking at packet %d, Flags 0x%x.\n",
@@ -1474,7 +1584,11 @@ static void nv_rx_process(struct net_device *dev)
                 skb->protocol = eth_type_trans(skb, dev);
                 dprintk(KERN_DEBUG "%s: nv_rx_process: packet %d with %d bytes, proto %d accepted.\n",
                                         dev->name, np->cur_rx, len, skb->protocol);
-                netif_rx(skb);
+                if (np->vlangrp && (vlanflags & NV_RX3_VLAN_TAG_PRESENT)) {
+                        vlan_hwaccel_rx(skb, np->vlangrp, vlanflags & NV_RX3_VLAN_TAG_MASK);
+                } else {
+                        netif_rx(skb);
+                }
                 dev->last_rx = jiffies;
                 np->stats.rx_packets++;
                 np->stats.rx_bytes += len;
@@ -1523,7 +1637,15 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                  * guessed, there is probably a simpler approach.
                  * Changing the MTU is a rare event, it shouldn't matter.
                  */
-                disable_irq(dev->irq);
+                if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+                    ((np->msi_flags & NV_MSI_X_ENABLED) && 
+                     ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+                        disable_irq(dev->irq);
+                } else {
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+                }
                 spin_lock_bh(&dev->xmit_lock);
                 spin_lock(&np->lock);
                 /* stop engines */
@@ -1544,11 +1666,7 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                 }
                 /* reinit nic view of the rx queue */
                 writel(np->rx_buf_sz, base + NvRegOffloadConfig);
-                writel((u32) np->ring_addr, base + NvRegRxRingPhysAddr);
-                if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
-                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
-                else
-                        writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
+                setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
                 writel( ((RX_RING-1) << NVREG_RINGSZ_RXSHIFT) + ((TX_RING-1) << NVREG_RINGSZ_TXSHIFT),
                         base + NvRegRingSizes);
                 pci_push(base);
@@ -1560,7 +1678,15 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                 nv_start_tx(dev);
                 spin_unlock(&np->lock);
                 spin_unlock_bh(&dev->xmit_lock);
-                enable_irq(dev->irq);
+                if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+                    ((np->msi_flags & NV_MSI_X_ENABLED) && 
+                     ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+                        enable_irq(dev->irq);
+                } else {
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+                }
         }
         return 0;
 }
@@ -1866,8 +1992,13 @@ static irqreturn_t nv_nic_irq(int foo, void *data, struct pt_regs *regs)
         dprintk(KERN_DEBUG "%s: nv_nic_irq\n", dev->name);
 
         for (i=0; ; i++) {
-                events = readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK;
-                writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
+                if (!(np->msi_flags & NV_MSI_X_ENABLED)) {
+                        events = readl(base + NvRegIrqStatus) & NVREG_IRQSTAT_MASK;
+                        writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
+                } else {
+                        events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQSTAT_MASK;
+                        writel(NVREG_IRQSTAT_MASK, base + NvRegMSIXIrqStatus);
+                }
                 pci_push(base);
                 dprintk(KERN_DEBUG "%s: irq: %08x\n", dev->name, events);
                 if (!(events & np->irqmask))
@@ -1907,11 +2038,16 @@ static irqreturn_t nv_nic_irq(int foo, void *data, struct pt_regs *regs)
                 if (i > max_interrupt_work) {
                         spin_lock(&np->lock);
                         /* disable interrupts on the nic */
-                        writel(0, base + NvRegIrqMask);
+                        if (!(np->msi_flags & NV_MSI_X_ENABLED))
+                                writel(0, base + NvRegIrqMask);
+                        else
+                                writel(np->irqmask, base + NvRegIrqMask);
                         pci_push(base);
 
-                        if (!np->in_shutdown)
+                        if (!np->in_shutdown) {
+                                np->nic_poll_irq = np->irqmask;
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
+                        }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq.\n", dev->name, i);
                         spin_unlock(&np->lock);
                         break;
@@ -1923,22 +2059,212 @@ static irqreturn_t nv_nic_irq(int foo, void *data, struct pt_regs *regs)
         return IRQ_RETVAL(i);
 }
 
+static irqreturn_t nv_nic_irq_tx(int foo, void *data, struct pt_regs *regs)
+{
+        struct net_device *dev = (struct net_device *) data;
+        struct fe_priv *np = netdev_priv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+        u32 events;
+        int i;
+
+        dprintk(KERN_DEBUG "%s: nv_nic_irq_tx\n", dev->name);
+
+        for (i=0; ; i++) {
+                events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_TX_ALL;
+                writel(NVREG_IRQ_TX_ALL, base + NvRegMSIXIrqStatus);
+                pci_push(base);
+                dprintk(KERN_DEBUG "%s: tx irq: %08x\n", dev->name, events);
+                if (!(events & np->irqmask))
+                        break;
+
+                spin_lock(&np->lock);
+                nv_tx_done(dev);
+                spin_unlock(&np->lock);
+                
+                if (events & (NVREG_IRQ_TX_ERR)) {
+                        dprintk(KERN_DEBUG "%s: received irq with events 0x%x. Probably TX fail.\n",
+                                                dev->name, events);
+                }
+                if (i > max_interrupt_work) {
+                        spin_lock(&np->lock);
+                        /* disable interrupts on the nic */
+                        writel(NVREG_IRQ_TX_ALL, base + NvRegIrqMask);
+                        pci_push(base);
+
+                        if (!np->in_shutdown) {
+                                np->nic_poll_irq |= NVREG_IRQ_TX_ALL;
+                                mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
+                        }
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
+                        spin_unlock(&np->lock);
+                        break;
+                }
+
+        }
+        dprintk(KERN_DEBUG "%s: nv_nic_irq_tx completed\n", dev->name);
+
+        return IRQ_RETVAL(i);
+}
+
+static irqreturn_t nv_nic_irq_rx(int foo, void *data, struct pt_regs *regs)
+{
+        struct net_device *dev = (struct net_device *) data;
+        struct fe_priv *np = netdev_priv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+        u32 events;
+        int i;
+
+        dprintk(KERN_DEBUG "%s: nv_nic_irq_rx\n", dev->name);
+
+        for (i=0; ; i++) {
+                events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_RX_ALL;
+                writel(NVREG_IRQ_RX_ALL, base + NvRegMSIXIrqStatus);
+                pci_push(base);
+                dprintk(KERN_DEBUG "%s: rx irq: %08x\n", dev->name, events);
+                if (!(events & np->irqmask))
+                        break;
+                
+                nv_rx_process(dev);
+                if (nv_alloc_rx(dev)) {
+                        spin_lock(&np->lock);
+                        if (!np->in_shutdown)
+                                mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
+                        spin_unlock(&np->lock);
+                }
+                
+                if (i > max_interrupt_work) {
+                        spin_lock(&np->lock);
+                        /* disable interrupts on the nic */
+                        writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask);
+                        pci_push(base);
+
+                        if (!np->in_shutdown) {
+                                np->nic_poll_irq |= NVREG_IRQ_RX_ALL;
+                                mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
+                        }
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
+                        spin_unlock(&np->lock);
+                        break;
+                }
+
+        }
+        dprintk(KERN_DEBUG "%s: nv_nic_irq_rx completed\n", dev->name);
+
+        return IRQ_RETVAL(i);
+}
+
+static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
+{
+        struct net_device *dev = (struct net_device *) data;
+        struct fe_priv *np = netdev_priv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+        u32 events;
+        int i;
+
+        dprintk(KERN_DEBUG "%s: nv_nic_irq_other\n", dev->name);
+
+        for (i=0; ; i++) {
+                events = readl(base + NvRegMSIXIrqStatus) & NVREG_IRQ_OTHER;
+                writel(NVREG_IRQ_OTHER, base + NvRegMSIXIrqStatus);
+                pci_push(base);
+                dprintk(KERN_DEBUG "%s: irq: %08x\n", dev->name, events);
+                if (!(events & np->irqmask))
+                        break;
+                
+                if (events & NVREG_IRQ_LINK) {
+                        spin_lock(&np->lock);
+                        nv_link_irq(dev);
+                        spin_unlock(&np->lock);
+                }
+                if (np->need_linktimer && time_after(jiffies, np->link_timeout)) {
+                        spin_lock(&np->lock);
+                        nv_linkchange(dev);
+                        spin_unlock(&np->lock);
+                        np->link_timeout = jiffies + LINK_TIMEOUT;
+                }
+                if (events & (NVREG_IRQ_UNKNOWN)) {
+                        printk(KERN_DEBUG "%s: received irq with unknown events 0x%x. Please report\n",
+                                                dev->name, events);
+                }
+                if (i > max_interrupt_work) {
+                        spin_lock(&np->lock);
+                        /* disable interrupts on the nic */
+                        writel(NVREG_IRQ_OTHER, base + NvRegIrqMask);
+                        pci_push(base);
+
+                        if (!np->in_shutdown) {
+                                np->nic_poll_irq |= NVREG_IRQ_OTHER;
+                                mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
+                        }
+                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
+                        spin_unlock(&np->lock);
+                        break;
+                }
+
+        }
+        dprintk(KERN_DEBUG "%s: nv_nic_irq_other completed\n", dev->name);
+
+        return IRQ_RETVAL(i);
+}
+
 static void nv_do_nic_poll(unsigned long data)
 {
         struct net_device *dev = (struct net_device *) data;
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 mask = 0;
 
-        disable_irq(dev->irq);
-        /* FIXME: Do we need synchronize_irq(dev->irq) here? */
         /*
+         * First disable irq(s) and then
          * reenable interrupts on the nic, we have to do this before calling
          * nv_nic_irq because that may decide to do otherwise
          */
-        writel(np->irqmask, base + NvRegIrqMask);
+
+        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+            ((np->msi_flags & NV_MSI_X_ENABLED) && 
+             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+                disable_irq(dev->irq);
+                mask = np->irqmask;
+        } else {
+                if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                        mask |= NVREG_IRQ_RX_ALL;
+                }
+                if (np->nic_poll_irq & NVREG_IRQ_TX_ALL) {
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                        mask |= NVREG_IRQ_TX_ALL;
+                }
+                if (np->nic_poll_irq & NVREG_IRQ_OTHER) {
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+                        mask |= NVREG_IRQ_OTHER;
+                }
+        }
+        np->nic_poll_irq = 0;
+
+        /* FIXME: Do we need synchronize_irq(dev->irq) here? */
+        
+        writel(mask, base + NvRegIrqMask);
         pci_push(base);
-        nv_nic_irq((int) 0, (void *) data, (struct pt_regs *) NULL);
-        enable_irq(dev->irq);
+
+        if (!(np->msi_flags & NV_MSI_X_ENABLED) || 
+            ((np->msi_flags & NV_MSI_X_ENABLED) && 
+             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+                nv_nic_irq((int) 0, (void *) data, (struct pt_regs *) NULL);
+                enable_irq(dev->irq);
+        } else {
+                if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
+                        nv_nic_irq_rx((int) 0, (void *) data, (struct pt_regs *) NULL);
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                }
+                if (np->nic_poll_irq & NVREG_IRQ_TX_ALL) {
+                        nv_nic_irq_tx((int) 0, (void *) data, (struct pt_regs *) NULL);
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                }
+                if (np->nic_poll_irq & NVREG_IRQ_OTHER) {
+                        nv_nic_irq_other((int) 0, (void *) data, (struct pt_regs *) NULL);
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+                }
+        }
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -2217,11 +2543,66 @@ static struct ethtool_ops ops = {
         .get_perm_addr = ethtool_op_get_perm_addr,
 };
 
+static void nv_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        spin_lock_irq(&np->lock);
+
+        /* save vlan group */
+        np->vlangrp = grp;
+
+        if (grp) {
+                /* enable vlan on MAC */
+                np->txrxctl_bits |= NVREG_TXRXCTL_VLANSTRIP | NVREG_TXRXCTL_VLANINS;
+        } else {
+                /* disable vlan on MAC */
+                np->txrxctl_bits &= ~NVREG_TXRXCTL_VLANSTRIP;
+                np->txrxctl_bits &= ~NVREG_TXRXCTL_VLANINS;
+        }
+
+        writel(np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
+
+        spin_unlock_irq(&np->lock);
+};
+
+static void nv_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
+{
+        /* nothing to do */
+};
+
+static void set_msix_vector_map(struct net_device *dev, u32 vector, u32 irqmask)
+{
+        u8 __iomem *base = get_hwbase(dev);
+        int i;
+        u32 msixmap = 0;
+
+        /* Each interrupt bit can be mapped to a MSIX vector (4 bits).
+         * MSIXMap0 represents the first 8 interrupts and MSIXMap1 represents
+         * the remaining 8 interrupts.
+         */
+        for (i = 0; i < 8; i++) {
+                if ((irqmask >> i) & 0x1) {
+                        msixmap |= vector << (i << 2);
+                }
+        }
+        writel(readl(base + NvRegMSIXMap0) | msixmap, base + NvRegMSIXMap0);
+
+        msixmap = 0;
+        for (i = 0; i < 8; i++) {
+                if ((irqmask >> (i + 8)) & 0x1) {
+                        msixmap |= vector << (i << 2);
+                }
+        }
+        writel(readl(base + NvRegMSIXMap1) | msixmap, base + NvRegMSIXMap1);
+}
+
 static int nv_open(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
-        int ret, oom, i;
+        int ret = 1;
+        int oom, i;
 
         dprintk(KERN_DEBUG "nv_open: begin\n");
 
@@ -2253,11 +2634,7 @@ static int nv_open(struct net_device *dev)
         nv_copy_mac_to_hw(dev);
 
         /* 4) give hw rings */
-        writel((u32) np->ring_addr, base + NvRegRxRingPhysAddr);
-        if (np->desc_ver == DESC_VER_1 || np->desc_ver == DESC_VER_2)
-                writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc)), base + NvRegTxRingPhysAddr);
-        else
-                writel((u32) (np->ring_addr + RX_RING*sizeof(struct ring_desc_ex)), base + NvRegTxRingPhysAddr);
+        setup_hw_rings(dev, NV_SETUP_RX_RING | NV_SETUP_TX_RING);
         writel( ((RX_RING-1) << NVREG_RINGSZ_RXSHIFT) + ((TX_RING-1) << NVREG_RINGSZ_TXSHIFT),
                 base + NvRegRingSizes);
 
@@ -2265,6 +2642,7 @@ static int nv_open(struct net_device *dev)
         writel(np->linkspeed, base + NvRegLinkSpeed);
         writel(NVREG_UNKSETUP3_VAL1, base + NvRegUnknownSetupReg3);
         writel(np->txrxctl_bits, base + NvRegTxRxControl);
+        writel(np->vlanctl_bits, base + NvRegVlanControl);
         pci_push(base);
         writel(NVREG_TXRXCTL_BIT1|np->txrxctl_bits, base + NvRegTxRxControl);
         reg_delay(dev, NvRegUnknownSetupReg5, NVREG_UNKSETUP5_BIT31, NVREG_UNKSETUP5_BIT31,
@@ -2315,9 +2693,77 @@ static int nv_open(struct net_device *dev)
         writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
         pci_push(base);
 
-        ret = request_irq(dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev);
-        if (ret)
-                goto out_drain;
+        if (np->msi_flags & NV_MSI_X_CAPABLE) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                        np->msi_x_entry[i].entry = i;
+                }
+                if ((ret = pci_enable_msix(np->pci_dev, np->msi_x_entry, (np->msi_flags & NV_MSI_X_VECTORS_MASK))) == 0) {
+                        np->msi_flags |= NV_MSI_X_ENABLED;
+                        if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT) {
+                                /* Request irq for rx handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector, &nv_nic_irq_rx, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for rx %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_drain;
+                                }
+                                /* Request irq for tx handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector, &nv_nic_irq_tx, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for tx %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_drain;
+                                }
+                                /* Request irq for link and timer handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector, &nv_nic_irq_other, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for link %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_drain;
+                                }
+
+                                /* map interrupts to their respective vector */
+                                writel(0, base + NvRegMSIXMap0);
+                                writel(0, base + NvRegMSIXMap1);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_RX, NVREG_IRQ_RX_ALL);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_TX, NVREG_IRQ_TX_ALL);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_OTHER, NVREG_IRQ_OTHER);
+                        } else {
+                                /* Request irq for all interrupts */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_drain;
+                                }
+
+                                /* map interrupts to vector 0 */
+                                writel(0, base + NvRegMSIXMap0);
+                                writel(0, base + NvRegMSIXMap1);
+                        }
+                }
+        }
+        if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+                if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+                        np->msi_flags |= NV_MSI_ENABLED;
+                        if (request_irq(np->pci_dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0) {
+                                printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                pci_disable_msi(np->pci_dev);
+                                np->msi_flags &= ~NV_MSI_ENABLED;
+                                goto out_drain;
+                        }
+
+                        /* map interrupts to vector 0 */
+                        writel(0, base + NvRegMSIMap0);
+                        writel(0, base + NvRegMSIMap1);
+                        /* enable msi vector 0 */
+                        writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+                }
+        }
+        if (ret != 0) {
+                if (request_irq(np->pci_dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0)
+                        goto out_drain;
+        }
 
         /* ask for interrupts */
         writel(np->irqmask, base + NvRegIrqMask);
@@ -2364,6 +2810,7 @@ static int nv_close(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base;
+        int i;
 
         spin_lock_irq(&np->lock);
         np->in_shutdown = 1;
@@ -2381,13 +2828,31 @@ static int nv_close(struct net_device *dev)
 
         /* disable interrupts on the nic or we will lock up */
         base = get_hwbase(dev);
-        writel(0, base + NvRegIrqMask);
+        if (np->msi_flags & NV_MSI_X_ENABLED) {
+                writel(np->irqmask, base + NvRegIrqMask);
+        } else {
+                if (np->msi_flags & NV_MSI_ENABLED)
+                        writel(0, base + NvRegMSIIrqMask);
+                writel(0, base + NvRegIrqMask);
+        }
         pci_push(base);
         dprintk(KERN_INFO "%s: Irqmask is zero again\n", dev->name);
 
         spin_unlock_irq(&np->lock);
 
-        free_irq(dev->irq, dev);
+        if (np->msi_flags & NV_MSI_X_ENABLED) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                        free_irq(np->msi_x_entry[i].vector, dev);
+                }
+                pci_disable_msix(np->pci_dev);
+                np->msi_flags &= ~NV_MSI_X_ENABLED;
+        } else {
+                free_irq(np->pci_dev->irq, dev);
+                if (np->msi_flags & NV_MSI_ENABLED) {
+                        pci_disable_msi(np->pci_dev);
+                        np->msi_flags &= ~NV_MSI_ENABLED;
+                }
+        }
 
         drain_ring(dev);
 
@@ -2471,7 +2936,14 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                         printk(KERN_INFO "forcedeth: 64-bit DMA failed, using 32-bit addressing for device %s.\n",
                                         pci_name(pci_dev));
                 } else {
-                        dev->features |= NETIF_F_HIGHDMA;
+                        if (pci_set_consistent_dma_mask(pci_dev, 0x0000007fffffffffULL)) {
+                                printk(KERN_INFO "forcedeth: 64-bit DMA (consistent) failed for device %s.\n",
+                                        pci_name(pci_dev));
+                                goto out_relreg;
+                        } else {
+                                dev->features |= NETIF_F_HIGHDMA;
+                                printk(KERN_INFO "forcedeth: using HIGHDMA\n");
+                        }
                 }
                 np->txrxctl_bits = NVREG_TXRXCTL_DESC_3;
         } else if (id->driver_data & DEV_HAS_LARGEDESC) {
@@ -2496,6 +2968,22 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 #endif
         }
 
+        np->vlanctl_bits = 0;
+        if (id->driver_data & DEV_HAS_VLAN) {
+                np->vlanctl_bits = NVREG_VLANCONTROL_ENABLE;
+                dev->features |= NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX;
+                dev->vlan_rx_register = nv_vlan_rx_register;
+                dev->vlan_rx_kill_vid = nv_vlan_rx_kill_vid;
+        }
+
+        np->msi_flags = 0;
+        if ((id->driver_data & DEV_HAS_MSI) && !disable_msi) {
+                np->msi_flags |= NV_MSI_CAPABLE;
+        }
+        if ((id->driver_data & DEV_HAS_MSI_X) && !disable_msix) {
+                np->msi_flags |= NV_MSI_X_CAPABLE;
+        }
+
         err = -ENOMEM;
         np->base = ioremap(addr, NV_PCI_REGSZ);
         if (!np->base)
@@ -2578,10 +3066,15 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         } else {
                 np->tx_flags = NV_TX2_VALID;
         }
-        if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT)
+        if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT) {
                 np->irqmask = NVREG_IRQMASK_THROUGHPUT;
-        else
+                if (np->msi_flags & NV_MSI_X_CAPABLE) /* set number of vectors */
+                        np->msi_flags |= 0x0003;
+        } else {
                 np->irqmask = NVREG_IRQMASK_CPU;
+                if (np->msi_flags & NV_MSI_X_CAPABLE) /* set number of vectors */
+                        np->msi_flags |= 0x0001;
+        }
 
         if (id->driver_data & DEV_NEED_TIMERIRQ)
                 np->irqmask |= NVREG_IRQ_TIMER;
@@ -2737,11 +3230,11 @@ static struct pci_device_id pci_tbl[] = {
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_14),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_15),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
         },
         {0,},
 };
@@ -2771,6 +3264,10 @@ module_param(optimization_mode, int, 0);
 MODULE_PARM_DESC(optimization_mode, "In throughput mode (0), every tx & rx packet will generate an interrupt. In CPU mode (1), interrupts are controlled by a timer.");
 module_param(poll_interval, int, 0);
 MODULE_PARM_DESC(poll_interval, "Interval determines how frequent timer interrupt is generated by [(time_in_micro_secs * 100) / (2^10)]. Min is 0 and Max is 65535.");
+module_param(disable_msi, int, 0);
+MODULE_PARM_DESC(disable_msi, "Disable MSI interrupts by setting to 1.");
+module_param(disable_msix, int, 0);
+MODULE_PARM_DESC(disable_msix, "Disable MSIX interrupts by setting to 1.");
 
 MODULE_AUTHOR("Manfred Spraul <manfred@colorfullife.com>");
 MODULE_DESCRIPTION("Reverse Engineered nForce ethernet driver");
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 1b699259b4ec..31fb2d75dc44 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -57,7 +57,7 @@ struct ifb_private {
         struct sk_buff_head     tq;
 };
 
-static int numifbs = 1;
+static int numifbs = 2;
 
 static void ri_tasklet(unsigned long dev);
 static int ifb_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index fa176ffb4ad5..8936058a3cce 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -108,6 +108,7 @@ static void irda_usb_close(struct irda_usb_cb *self);
 static void speed_bulk_callback(struct urb *urb, struct pt_regs *regs);
 static void write_bulk_callback(struct urb *urb, struct pt_regs *regs);
 static void irda_usb_receive(struct urb *urb, struct pt_regs *regs);
+static void irda_usb_rx_defer_expired(unsigned long data);
 static int irda_usb_net_open(struct net_device *dev);
 static int irda_usb_net_close(struct net_device *dev);
 static int irda_usb_net_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
@@ -677,6 +678,12 @@ static void irda_usb_net_timeout(struct net_device *netdev)
  * on the interrupt pipe and hang the Rx URB only when an interrupt is
  * received.
  * Jean II
+ *
+ * Note : don't read the above as what we are currently doing, but as
+ * something we could do with KC dongle. Also don't forget that the
+ * interrupt pipe is not part of the original standard, so this would
+ * need to be optional...
+ * Jean II
  */
 
 /*------------------------------------------------------------------*/
@@ -704,10 +711,8 @@ static void irda_usb_submit(struct irda_usb_cb *self, struct sk_buff *skb, struc
         /* Reinitialize URB */
         usb_fill_bulk_urb(urb, self->usbdev, 
                       usb_rcvbulkpipe(self->usbdev, self->bulk_in_ep), 
-                      skb->data, skb->truesize,
+                      skb->data, IRDA_SKB_MAX_MTU,
                       irda_usb_receive, skb);
-        /* Note : unlink *must* be synchronous because of the code in 
-         * irda_usb_net_close() -> free the skb - Jean II */
         urb->status = 0;
 
         /* Can be called from irda_usb_receive (irq handler) -> GFP_ATOMIC */
@@ -734,6 +739,7 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
         struct irda_skb_cb *cb;
         struct sk_buff *newskb;
         struct sk_buff *dataskb;
+        struct urb *next_urb;
         int             docopy;
 
         IRDA_DEBUG(2, "%s(), len=%d\n", __FUNCTION__, urb->actual_length);
@@ -755,20 +761,37 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
         if (urb->status != 0) {
                 switch (urb->status) {
                 case -EILSEQ:
-                        self->stats.rx_errors++;
                         self->stats.rx_crc_errors++;    
-                        break;
+                        /* Also precursor to a hot-unplug on UHCI. */
+                        /* Fallthrough... */
                 case -ECONNRESET:               /* -104 */
-                        IRDA_DEBUG(0, "%s(), Connection Reset (-104), transfer_flags 0x%04X \n", __FUNCTION__, urb->transfer_flags);
+                        /* Random error, if I remember correctly */
                         /* uhci_cleanup_unlink() is going to kill the Rx
                          * URB just after we return. No problem, at this
                          * point the URB will be idle ;-) - Jean II */
-                        break;
+                case -ESHUTDOWN:                /* -108 */
+                        /* That's usually a hot-unplug. Submit will fail... */
+                case -ETIMEDOUT:                /* -110 */
+                        /* Usually precursor to a hot-unplug on OHCI. */
                 default:
-                        IRDA_DEBUG(0, "%s(), RX status %d,transfer_flags 0x%04X \n", __FUNCTION__, urb->status, urb->transfer_flags);
+                        self->stats.rx_errors++;
+                        IRDA_DEBUG(0, "%s(), RX status %d, transfer_flags 0x%04X \n", __FUNCTION__, urb->status, urb->transfer_flags);
                         break;
                 }
-                goto done;
+                /* If we received an error, we don't want to resubmit the
+                 * Rx URB straight away but to give the USB layer a little
+                 * bit of breathing room.
+                 * We are in the USB thread context, therefore there is a
+                 * danger of recursion (new URB we submit fails, we come
+                 * back here).
+                 * With recent USB stack (2.6.15+), I'm seeing that on
+                 * hot unplug of the dongle...
+                 * Lowest effective timer is 10ms...
+                 * Jean II */
+                self->rx_defer_timer.function = &irda_usb_rx_defer_expired;
+                self->rx_defer_timer.data = (unsigned long) urb;
+                mod_timer(&self->rx_defer_timer, jiffies + (10 * HZ / 1000));
+                return;
         }
         
         /* Check for empty frames */
@@ -845,13 +868,45 @@ done:
          * idle slot....
          * Jean II */
         /* Note : with this scheme, we could submit the idle URB before
-         * processing the Rx URB. Another time... Jean II */
+         * processing the Rx URB. I don't think it would buy us anything as
+         * we are running in the USB thread context. Jean II */
+        next_urb = self->idle_rx_urb;
 
-        /* Submit the idle URB to replace the URB we've just received */
-        irda_usb_submit(self, skb, self->idle_rx_urb);
         /* Recycle Rx URB : Now, the idle URB is the present one */
         urb->context = NULL;
         self->idle_rx_urb = urb;
+
+        /* Submit the idle URB to replace the URB we've just received.
+         * Do it last to avoid race conditions... Jean II */
+        irda_usb_submit(self, skb, next_urb);
+}
+
+/*------------------------------------------------------------------*/
+/*
+ * In case of errors, we want the USB layer to have time to recover.
+ * Now, it is time to resubmit ouur Rx URB...
+ */
+static void irda_usb_rx_defer_expired(unsigned long data)
+{
+        struct urb *urb = (struct urb *) data;
+        struct sk_buff *skb = (struct sk_buff *) urb->context;
+        struct irda_usb_cb *self; 
+        struct irda_skb_cb *cb;
+        struct urb *next_urb;
+
+        IRDA_DEBUG(2, "%s()\n", __FUNCTION__);
+
+        /* Find ourselves */
+        cb = (struct irda_skb_cb *) skb->cb;
+        IRDA_ASSERT(cb != NULL, return;);
+        self = (struct irda_usb_cb *) cb->context;
+        IRDA_ASSERT(self != NULL, return;);
+
+        /* Same stuff as when Rx is done, see above... */
+        next_urb = self->idle_rx_urb;
+        urb->context = NULL;
+        self->idle_rx_urb = urb;
+        irda_usb_submit(self, skb, next_urb);
 }
 
 /*------------------------------------------------------------------*/
@@ -990,6 +1045,9 @@ static int irda_usb_net_close(struct net_device *netdev)
         /* Stop network Tx queue */
         netif_stop_queue(netdev);
 
+        /* Kill defered Rx URB */
+        del_timer(&self->rx_defer_timer);
+
         /* Deallocate all the Rx path buffers (URBs and skb) */
         for (i = 0; i < IU_MAX_RX_URBS; i++) {
                 struct urb *urb = self->rx_urb[i];
@@ -1365,6 +1423,7 @@ static int irda_usb_probe(struct usb_interface *intf,
         self = net->priv;
         self->netdev = net;
         spin_lock_init(&self->lock);
+        init_timer(&self->rx_defer_timer);
 
         /* Create all of the needed urbs */
         for (i = 0; i < IU_MAX_RX_URBS; i++) {
@@ -1498,6 +1557,9 @@ static void irda_usb_disconnect(struct usb_interface *intf)
          * This will stop/desactivate the Tx path. - Jean II */
         self->present = 0;
 
+        /* Kill defered Rx URB */
+        del_timer(&self->rx_defer_timer);
+
         /* We need to have irq enabled to unlink the URBs. That's OK,
          * at this point the Tx path is gone - Jean II */
         spin_unlock_irqrestore(&self->lock, flags);
@@ -1507,11 +1569,11 @@ static void irda_usb_disconnect(struct usb_interface *intf)
                 /* Accept no more transmissions */
                 /*netif_device_detach(self->netdev);*/
                 netif_stop_queue(self->netdev);
-                /* Stop all the receive URBs */
+                /* Stop all the receive URBs. Must be synchronous. */
                 for (i = 0; i < IU_MAX_RX_URBS; i++)
                         usb_kill_urb(self->rx_urb[i]);
                 /* Cancel Tx and speed URB.
-                 * Toggle flags to make sure it's synchronous. */
+                 * Make sure it's synchronous to avoid races. */
                 usb_kill_urb(self->tx_urb);
                 usb_kill_urb(self->speed_urb);
         }
diff --git a/drivers/net/irda/irda-usb.h b/drivers/net/irda/irda-usb.h
index bd8f66542322..4026af42dd47 100644
--- a/drivers/net/irda/irda-usb.h
+++ b/drivers/net/irda/irda-usb.h
@@ -136,8 +136,6 @@ struct irda_usb_cb {
         __u16 bulk_out_mtu;             /* Max Tx packet size in bytes */
         __u8  bulk_int_ep;              /* Interrupt Endpoint assignments */
 
-        wait_queue_head_t wait_q;       /* for timeouts */
-
         struct urb *rx_urb[IU_MAX_RX_URBS];     /* URBs used to receive data frames */
         struct urb *idle_rx_urb;        /* Pointer to idle URB in Rx path */
         struct urb *tx_urb;             /* URB used to send data frames */
@@ -147,17 +145,18 @@ struct irda_usb_cb {
         struct net_device_stats stats;
         struct irlap_cb   *irlap;       /* The link layer we are binded to */
         struct qos_info qos;
-        hashbin_t *tx_list;             /* Queued transmit skb's */
         char *speed_buff;               /* Buffer for speed changes */
 
         struct timeval stamp;
         struct timeval now;
 
-        spinlock_t lock;                /* For serializing operations */
+        spinlock_t lock;                /* For serializing Tx operations */
 
         __u16 xbofs;                    /* Current xbofs setting */
         __s16 new_xbofs;                /* xbofs we need to set */
         __u32 speed;                    /* Current speed */
         __s32 new_speed;                /* speed we need to set */
+
+        struct timer_list rx_defer_timer;       /* Wait for Rx error to clear */
 };
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 6e1018448eea..8cc0d0bbdf50 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -287,6 +287,20 @@ enum RTL8169_register_content {
         TxInterFrameGapShift = 24,
         TxDMAShift = 8, /* DMA burst value (0-7) is shift this many bits */
 
+        /* Config1 register p.24 */
+        PMEnable        = (1 << 0),     /* Power Management Enable */
+
+        /* Config3 register p.25 */
+        MagicPacket     = (1 << 5),     /* Wake up when receives a Magic Packet */
+        LinkUp          = (1 << 4),     /* Wake up when the cable connection is re-established */
+
+        /* Config5 register p.27 */
+        BWF             = (1 << 6),     /* Accept Broadcast wakeup frame */
+        MWF             = (1 << 5),     /* Accept Multicast wakeup frame */
+        UWF             = (1 << 4),     /* Accept Unicast wakeup frame */
+        LanWake         = (1 << 1),     /* LanWake enable/disable */
+        PMEStatus       = (1 << 0),     /* PME status can be reset by PCI RST# */
+
         /* TBICSR p.28 */
         TBIReset        = 0x80000000,
         TBILoopback     = 0x40000000,
@@ -433,6 +447,7 @@ struct rtl8169_private {
         unsigned int (*phy_reset_pending)(void __iomem *);
         unsigned int (*link_ok)(void __iomem *);
         struct work_struct task;
+        unsigned wol_enabled : 1;
 };
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -607,6 +622,80 @@ static void rtl8169_link_option(int idx, u8 *autoneg, u16 *speed, u8 *duplex)
         *duplex = p->duplex;
 }
 
+static void rtl8169_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        u8 options;
+
+        wol->wolopts = 0;
+
+#define WAKE_ANY (WAKE_PHY | WAKE_MAGIC | WAKE_UCAST | WAKE_BCAST | WAKE_MCAST)
+        wol->supported = WAKE_ANY;
+
+        spin_lock_irq(&tp->lock);
+
+        options = RTL_R8(Config1);
+        if (!(options & PMEnable))
+                goto out_unlock;
+
+        options = RTL_R8(Config3);
+        if (options & LinkUp)
+                wol->wolopts |= WAKE_PHY;
+        if (options & MagicPacket)
+                wol->wolopts |= WAKE_MAGIC;
+
+        options = RTL_R8(Config5);
+        if (options & UWF)
+                wol->wolopts |= WAKE_UCAST;
+        if (options & BWF)
+                wol->wolopts |= WAKE_BCAST;
+        if (options & MWF)
+                wol->wolopts |= WAKE_MCAST;
+
+out_unlock:
+        spin_unlock_irq(&tp->lock);
+}
+
+static int rtl8169_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+        int i;
+        static struct {
+                u32 opt;
+                u16 reg;
+                u8  mask;
+        } cfg[] = {
+                { WAKE_ANY,   Config1, PMEnable },
+                { WAKE_PHY,   Config3, LinkUp },
+                { WAKE_MAGIC, Config3, MagicPacket },
+                { WAKE_UCAST, Config5, UWF },
+                { WAKE_BCAST, Config5, BWF },
+                { WAKE_MCAST, Config5, MWF },
+                { WAKE_ANY,   Config5, LanWake }
+        };
+
+        spin_lock_irq(&tp->lock);
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
+
+        for (i = 0; i < ARRAY_SIZE(cfg); i++) {
+                u8 options = RTL_R8(cfg[i].reg) & ~cfg[i].mask;
+                if (wol->wolopts & cfg[i].opt)
+                        options |= cfg[i].mask;
+                RTL_W8(cfg[i].reg, options);
+        }
+
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
+        tp->wol_enabled = (wol->wolopts) ? 1 : 0;
+
+        spin_unlock_irq(&tp->lock);
+
+        return 0;
+}
+
 static void rtl8169_get_drvinfo(struct net_device *dev,
                                 struct ethtool_drvinfo *info)
 {
@@ -1025,6 +1114,8 @@ static struct ethtool_ops rtl8169_ethtool_ops = {
         .get_tso                = ethtool_op_get_tso,
         .set_tso                = ethtool_op_set_tso,
         .get_regs               = rtl8169_get_regs,
+        .get_wol                = rtl8169_get_wol,
+        .set_wol                = rtl8169_set_wol,
         .get_strings            = rtl8169_get_strings,
         .get_stats_count        = rtl8169_get_stats_count,
         .get_ethtool_stats      = rtl8169_get_ethtool_stats,
@@ -1442,6 +1533,11 @@ rtl8169_init_board(struct pci_dev *pdev, struct net_device **dev_out,
         }
         tp->chipset = i;
 
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
+        RTL_W8(Config1, RTL_R8(Config1) | PMEnable);
+        RTL_W8(Config5, RTL_R8(Config5) & PMEStatus);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
         *ioaddr_out = ioaddr;
         *dev_out = dev;
 out:
@@ -1612,49 +1708,6 @@ rtl8169_remove_one(struct pci_dev *pdev)
         pci_set_drvdata(pdev, NULL);
 }
 
-#ifdef CONFIG_PM
-
-static int rtl8169_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-        struct rtl8169_private *tp = netdev_priv(dev);
-        void __iomem *ioaddr = tp->mmio_addr;
-        unsigned long flags;
-
-        if (!netif_running(dev))
-                return 0;
-        
-        netif_device_detach(dev);
-        netif_stop_queue(dev);
-        spin_lock_irqsave(&tp->lock, flags);
-
-        /* Disable interrupts, stop Rx and Tx */
-        RTL_W16(IntrMask, 0);
-        RTL_W8(ChipCmd, 0);
-                
-        /* Update the error counts. */
-        tp->stats.rx_missed_errors += RTL_R32(RxMissed);
-        RTL_W32(RxMissed, 0);
-        spin_unlock_irqrestore(&tp->lock, flags);
-        
-        return 0;
-}
-
-static int rtl8169_resume(struct pci_dev *pdev)
-{
-        struct net_device *dev = pci_get_drvdata(pdev);
-
-        if (!netif_running(dev))
-            return 0;
-
-        netif_device_attach(dev);
-        rtl8169_hw_start(dev);
-
-        return 0;
-}
-                                                                                
-#endif /* CONFIG_PM */
-
 static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
                                   struct net_device *dev)
 {
@@ -2700,6 +2753,56 @@ static struct net_device_stats *rtl8169_get_stats(struct net_device *dev)
         return &tp->stats;
 }
 
+#ifdef CONFIG_PM
+
+static int rtl8169_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+        struct rtl8169_private *tp = netdev_priv(dev);
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        if (!netif_running(dev))
+                goto out;
+
+        netif_device_detach(dev);
+        netif_stop_queue(dev);
+
+        spin_lock_irq(&tp->lock);
+
+        rtl8169_asic_down(ioaddr);
+
+        tp->stats.rx_missed_errors += RTL_R32(RxMissed);
+        RTL_W32(RxMissed, 0);
+
+        spin_unlock_irq(&tp->lock);
+
+        pci_save_state(pdev);
+        pci_enable_wake(pdev, pci_choose_state(pdev, state), tp->wol_enabled);
+        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+out:
+        return 0;
+}
+
+static int rtl8169_resume(struct pci_dev *pdev)
+{
+        struct net_device *dev = pci_get_drvdata(pdev);
+
+        if (!netif_running(dev))
+                goto out;
+
+        netif_device_attach(dev);
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        pci_enable_wake(pdev, PCI_D0, 0);
+
+        rtl8169_schedule_work(dev, rtl8169_reset_task);
+out:
+        return 0;
+}
+
+#endif /* CONFIG_PM */
+
 static struct pci_driver rtl8169_pci_driver = {
         .name           = MODULENAME,
         .id_table       = rtl8169_pci_tbl,
diff --git a/drivers/net/sis190.c b/drivers/net/sis190.c
index b420182eec4b..ed4bc91638d2 100644
--- a/drivers/net/sis190.c
+++ b/drivers/net/sis190.c
@@ -1791,6 +1791,8 @@ static int __devinit sis190_init_one(struct pci_dev *pdev,
                 goto out;
         }
 
+        pci_set_drvdata(pdev, dev);
+
         tp = netdev_priv(dev);
         ioaddr = tp->mmio_addr;
 
@@ -1827,8 +1829,6 @@ static int __devinit sis190_init_one(struct pci_dev *pdev,
         if (rc < 0)
                 goto err_remove_mii;
 
-        pci_set_drvdata(pdev, dev);
-
         net_probe(tp, KERN_INFO "%s: %s at %p (IRQ: %d), "
                "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
                pci_name(pdev), sis_chip_info[ent->driver_data].name,
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index 3d95fa20cd88..7a952fe60be2 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -540,7 +540,7 @@ static int __devinit sis900_probe(struct pci_dev *pci_dev,
         printk("%2.2x.\n", net_dev->dev_addr[i]);
 
         /* Detect Wake on Lan support */
-        ret = inl(CFGPMC & PMESP);
+        ret = (inl(net_dev->base_addr + CFGPMC) & PMESP) >> 27;
         if (netif_msg_probe(sis_priv) && (ret & PME_D3C) == 0)
                 printk(KERN_INFO "%s: Wake on LAN only available from suspend to RAM.", net_dev->name);
 
@@ -2040,7 +2040,7 @@ static int sis900_set_wol(struct net_device *net_dev, struct ethtool_wolinfo *wo
 
         if (wol->wolopts == 0) {
                 pci_read_config_dword(sis_priv->pci_dev, CFGPMCSR, &cfgpmcsr);
-                cfgpmcsr |= ~PME_EN;
+                cfgpmcsr &= ~PME_EN;
                 pci_write_config_dword(sis_priv->pci_dev, CFGPMCSR, cfgpmcsr);
                 outl(pmctrl_bits, pmctrl_addr);
                 if (netif_msg_wol(sis_priv))
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index bf55a4cfb3d2..25e028b7ce48 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -879,13 +879,12 @@ static int __xm_phy_read(struct skge_hw *hw, int port, u16 reg, u16 *val)
         int i;
 
         xm_write16(hw, port, XM_PHY_ADDR, reg | hw->phy_addr);
-        xm_read16(hw, port, XM_PHY_DATA);
+        *val = xm_read16(hw, port, XM_PHY_DATA);
 
-        /* Need to wait for external PHY */
         for (i = 0; i < PHY_RETRIES; i++) {
-                udelay(1);
                 if (xm_read16(hw, port, XM_MMU_CMD) & XM_MMU_PHY_RDY)
                         goto ready;
+                udelay(1);
         }
 
         return -ETIMEDOUT;
@@ -918,7 +917,12 @@ static int xm_phy_write(struct skge_hw *hw, int port, u16 reg, u16 val)
 
  ready:
         xm_write16(hw, port, XM_PHY_DATA, val);
-        return 0;
+        for (i = 0; i < PHY_RETRIES; i++) {
+                if (!(xm_read16(hw, port, XM_MMU_CMD) & XM_MMU_PHY_BUSY))
+                        return 0;
+                udelay(1);
+        }
+        return -ETIMEDOUT;
 }
 
 static void genesis_init(struct skge_hw *hw)
@@ -1168,13 +1172,17 @@ static void genesis_mac_init(struct skge_hw *hw, int port)
         u32 r;
         const u8 zero[6]  = { 0 };
 
-        /* Clear MIB counters */
-        xm_write16(hw, port, XM_STAT_CMD,
-                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
-        /* Clear two times according to Errata #3 */
-        xm_write16(hw, port, XM_STAT_CMD,
-                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
+        for (i = 0; i < 10; i++) {
+                skge_write16(hw, SK_REG(port, TX_MFF_CTRL1),
+                             MFF_SET_MAC_RST);
+                if (skge_read16(hw, SK_REG(port, TX_MFF_CTRL1)) & MFF_SET_MAC_RST)
+                        goto reset_ok;
+                udelay(1);
+        }
 
+        printk(KERN_WARNING PFX "%s: genesis reset failed\n", dev->name);
+
+ reset_ok:
         /* Unreset the XMAC. */
         skge_write16(hw, SK_REG(port, TX_MFF_CTRL1), MFF_CLR_MAC_RST);
 
@@ -1191,7 +1199,7 @@ static void genesis_mac_init(struct skge_hw *hw, int port)
                 r |= GP_DIR_2|GP_IO_2;
 
         skge_write32(hw, B2_GP_IO, r);
-        skge_read32(hw, B2_GP_IO);
+
 
         /* Enable GMII interface */
         xm_write16(hw, port, XM_HW_CFG, XM_HW_GMII_MD);
@@ -1205,6 +1213,13 @@ static void genesis_mac_init(struct skge_hw *hw, int port)
         for (i = 1; i < 16; i++)
                 xm_outaddr(hw, port, XM_EXM(i), zero);
 
+        /* Clear MIB counters */
+        xm_write16(hw, port, XM_STAT_CMD,
+                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
+        /* Clear two times according to Errata #3 */
+        xm_write16(hw, port, XM_STAT_CMD,
+                        XM_SC_CLR_RXC | XM_SC_CLR_TXC);
+
         /* configure Rx High Water Mark (XM_RX_HI_WM) */
         xm_write16(hw, port, XM_RX_HI_WM, 1450);
 
@@ -1697,6 +1712,7 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
         skge_write32(hw, SK_REG(port, GPHY_CTRL), reg | GPC_RST_SET);
         skge_write32(hw, SK_REG(port, GPHY_CTRL), reg | GPC_RST_CLR);
         skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_ON | GMC_RST_CLR);
+
         if (skge->autoneg == AUTONEG_DISABLE) {
                 reg = GM_GPCR_AU_ALL_DIS;
                 gma_write16(hw, port, GM_GP_CTRL,
@@ -1704,16 +1720,23 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
 
                 switch (skge->speed) {
                 case SPEED_1000:
+                        reg &= ~GM_GPCR_SPEED_100;
                         reg |= GM_GPCR_SPEED_1000;
-                        /* fallthru */
+                        break;
                 case SPEED_100:
+                        reg &= ~GM_GPCR_SPEED_1000;
                         reg |= GM_GPCR_SPEED_100;
+                        break;
+                case SPEED_10:
+                        reg &= ~(GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100);
+                        break;
                 }
 
                 if (skge->duplex == DUPLEX_FULL)
                         reg |= GM_GPCR_DUP_FULL;
         } else
                 reg = GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100 | GM_GPCR_DUP_FULL;
+
         switch (skge->flow_control) {
         case FLOW_MODE_NONE:
                 skge_write32(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
@@ -2162,8 +2185,10 @@ static int skge_up(struct net_device *dev)
         skge->tx_avail = skge->tx_ring.count - 1;
 
         /* Enable IRQ from port */
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= portirqmask[port];
         skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         /* Initialize MAC */
         spin_lock_bh(&hw->phy_lock);
@@ -2221,8 +2246,10 @@ static int skge_down(struct net_device *dev)
         else
                 yukon_stop(skge);
 
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask &= ~portirqmask[skge->port];
         skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         /* Stop transmitter */
         skge_write8(hw, Q_ADDR(txqaddr[port], Q_CSR), CSR_STOP);
@@ -2670,8 +2697,7 @@ static int skge_poll(struct net_device *dev, int *budget)
 
         /* restart receiver */
         wmb();
-        skge_write8(hw, Q_ADDR(rxqaddr[skge->port], Q_CSR),
-                    CSR_START | CSR_IRQ_CL_F);
+        skge_write8(hw, Q_ADDR(rxqaddr[skge->port], Q_CSR), CSR_START);
 
         *budget -= work_done;
         dev->quota -= work_done;
@@ -2679,10 +2705,11 @@ static int skge_poll(struct net_device *dev, int *budget)
         if (work_done >=  to_do)
                 return 1; /* not done */
 
-        netif_rx_complete(dev);
-        hw->intr_mask |= portirqmask[skge->port];
-        skge_write32(hw, B0_IMSK, hw->intr_mask);
-        skge_read32(hw, B0_IMSK);
+        spin_lock_irq(&hw->hw_lock);
+        __netif_rx_complete(dev);
+        hw->intr_mask |= portirqmask[skge->port];
+        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 
         return 0;
 }
@@ -2842,18 +2869,10 @@ static void skge_extirq(unsigned long data)
         }
         spin_unlock(&hw->phy_lock);
 
-        local_irq_disable();
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= IS_EXT_REG;
         skge_write32(hw, B0_IMSK, hw->intr_mask);
-        local_irq_enable();
-}
-
-static inline void skge_wakeup(struct net_device *dev)
-{
-        struct skge_port *skge = netdev_priv(dev);
-
-        prefetch(skge->rx_ring.to_clean);
-        netif_rx_schedule(dev);
+        spin_unlock_irq(&hw->hw_lock);
 }
 
 static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
@@ -2864,15 +2883,17 @@ static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
         if (status == 0 || status == ~0) /* hotplug or shared irq */
                 return IRQ_NONE;
 
-        status &= hw->intr_mask;
+        spin_lock(&hw->hw_lock);
         if (status & IS_R1_F) {
+                skge_write8(hw, Q_ADDR(Q_R1, Q_CSR), CSR_IRQ_CL_F);
                 hw->intr_mask &= ~IS_R1_F;
-                skge_wakeup(hw->dev[0]);
+                netif_rx_schedule(hw->dev[0]);
         }
 
         if (status & IS_R2_F) {
+                skge_write8(hw, Q_ADDR(Q_R2, Q_CSR), CSR_IRQ_CL_F);
                 hw->intr_mask &= ~IS_R2_F;
-                skge_wakeup(hw->dev[1]);
+                netif_rx_schedule(hw->dev[1]);
         }
 
         if (status & IS_XA1_F)
@@ -2914,6 +2935,7 @@ static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
         }
 
         skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock(&hw->hw_lock);
 
         return IRQ_HANDLED;
 }
@@ -3282,6 +3304,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
 
         hw->pdev = pdev;
         spin_lock_init(&hw->phy_lock);
+        spin_lock_init(&hw->hw_lock);
         tasklet_init(&hw->ext_tasklet, skge_extirq, (unsigned long) hw);
 
         hw->regs = ioremap_nocache(pci_resource_start(pdev, 0), 0x4000);
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index 2efdacc290e5..941f12a333b6 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -2402,6 +2402,7 @@ struct skge_hw {
 
         struct tasklet_struct ext_tasklet;
         spinlock_t           phy_lock;
+        spinlock_t           hw_lock;
 };
 
 enum {
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index cae2edf23004..ca8160d68229 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -195,11 +195,11 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
         pr_debug("sky2_set_power_state %d\n", state);
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
 
-        pci_read_config_word(hw->pdev, hw->pm_cap + PCI_PM_PMC, &power_control);
+        power_control = sky2_pci_read16(hw, hw->pm_cap + PCI_PM_PMC);
         vaux = (sky2_read16(hw, B0_CTST) & Y2_VAUX_AVAIL) &&
                 (power_control & PCI_PM_CAP_PME_D3cold);
 
-        pci_read_config_word(hw->pdev, hw->pm_cap + PCI_PM_CTRL, &power_control);
+        power_control = sky2_pci_read16(hw, hw->pm_cap + PCI_PM_CTRL);
 
         power_control |= PCI_PM_CTRL_PME_STATUS;
         power_control &= ~(PCI_PM_CTRL_STATE_MASK);
@@ -223,7 +223,7 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                         sky2_write8(hw, B2_Y2_CLK_GATE, 0);
 
                 /* Turn off phy power saving */
-                pci_read_config_dword(hw->pdev, PCI_DEV_REG1, &reg1);
+                reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
                 reg1 &= ~(PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
 
                 /* looks like this XL is back asswards .. */
@@ -232,18 +232,28 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                         if (hw->ports > 1)
                                 reg1 |= PCI_Y2_PHY2_COMA;
                 }
-                pci_write_config_dword(hw->pdev, PCI_DEV_REG1, reg1);
+
+                if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
+                        sky2_pci_write32(hw, PCI_DEV_REG3, 0);
+                        reg1 = sky2_pci_read32(hw, PCI_DEV_REG4);
+                        reg1 &= P_ASPM_CONTROL_MSK;
+                        sky2_pci_write32(hw, PCI_DEV_REG4, reg1);
+                        sky2_pci_write32(hw, PCI_DEV_REG5, 0);
+                }
+
+                sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
+
                 break;
 
         case PCI_D3hot:
         case PCI_D3cold:
                 /* Turn on phy power saving */
-                pci_read_config_dword(hw->pdev, PCI_DEV_REG1, &reg1);
+                reg1 = sky2_pci_read32(hw, PCI_DEV_REG1);
                 if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
                         reg1 &= ~(PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
                 else
                         reg1 |= (PCI_Y2_PHY1_POWD | PCI_Y2_PHY2_POWD);
-                pci_write_config_dword(hw->pdev, PCI_DEV_REG1, reg1);
+                sky2_pci_write32(hw, PCI_DEV_REG1, reg1);
 
                 if (hw->chip_id == CHIP_ID_YUKON_XL && hw->chip_rev > 1)
                         sky2_write8(hw, B2_Y2_CLK_GATE, 0);
@@ -265,7 +275,7 @@ static int sky2_set_power_state(struct sky2_hw *hw, pci_power_t state)
                 ret = -1;
         }
 
-        pci_write_config_byte(hw->pdev, hw->pm_cap + PCI_PM_CTRL, power_control);
+        sky2_pci_write16(hw, hw->pm_cap + PCI_PM_CTRL, power_control);
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         return ret;
 }
@@ -463,16 +473,31 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 ledover |= PHY_M_LED_MO_RX(MO_LED_OFF);
         }
 
-        gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev >= 2) {
+                /* apply fixes in PHY AFE */
+                gm_phy_write(hw, port, 22, 255);
+                /* increase differential signal amplitude in 10BASE-T */
+                gm_phy_write(hw, port, 24, 0xaa99);
+                gm_phy_write(hw, port, 23, 0x2011);
 
-        if (sky2->autoneg == AUTONEG_DISABLE || sky2->speed == SPEED_100) {
-                /* turn on 100 Mbps LED (LED_LINK100) */
-                ledover |= PHY_M_LED_MO_100(MO_LED_ON);
-        }
+                /* fix for IEEE A/B Symmetry failure in 1000BASE-T */
+                gm_phy_write(hw, port, 24, 0xa204);
+                gm_phy_write(hw, port, 23, 0x2002);
 
-        if (ledover)
-                gm_phy_write(hw, port, PHY_MARV_LED_OVER, ledover);
+                /* set page register to 0 */
+                gm_phy_write(hw, port, 22, 0);
+        } else {
+                gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
+
+                if (sky2->autoneg == AUTONEG_DISABLE || sky2->speed == SPEED_100) {
+                        /* turn on 100 Mbps LED (LED_LINK100) */
+                        ledover |= PHY_M_LED_MO_100(MO_LED_ON);
+                }
+
+                if (ledover)
+                        gm_phy_write(hw, port, PHY_MARV_LED_OVER, ledover);
 
+        }
         /* Enable phy interrupt on auto-negotiation complete (or link up) */
         if (sky2->autoneg == AUTONEG_ENABLE)
                 gm_phy_write(hw, port, PHY_MARV_INT_MASK, PHY_M_IS_AN_COMPL);
@@ -520,10 +545,16 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
 
                 switch (sky2->speed) {
                 case SPEED_1000:
+                        reg &= ~GM_GPCR_SPEED_100;
                         reg |= GM_GPCR_SPEED_1000;
-                        /* fallthru */
+                        break;
                 case SPEED_100:
+                        reg &= ~GM_GPCR_SPEED_1000;
                         reg |= GM_GPCR_SPEED_100;
+                        break;
+                case SPEED_10:
+                        reg &= ~(GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100);
+                        break;
                 }
 
                 if (sky2->duplex == DUPLEX_FULL)
@@ -947,6 +978,12 @@ static int sky2_rx_start(struct sky2_port *sky2)
 
         sky2->rx_put = sky2->rx_next = 0;
         sky2_qset(hw, rxq);
+
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev >= 2) {
+                /* MAC Rx RAM Read is controlled by hardware */
+                sky2_write32(hw, Q_ADDR(rxq, Q_F), F_M_RX_RAM_DIS);
+        }
+
         sky2_prefetch_init(hw, rxq, sky2->rx_le_map, RX_LE_SIZE - 1);
 
         rx_set_checksum(sky2);
@@ -1029,9 +1066,10 @@ static int sky2_up(struct net_device *dev)
                     RB_RST_SET);
 
         sky2_qset(hw, txqaddr[port]);
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U)
-                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), 0x1a0);
 
+        /* Set almost empty threshold */
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == 1)
+                sky2_write16(hw, Q_ADDR(txqaddr[port], Q_AL), 0x1a0);
 
         sky2_prefetch_init(hw, txqaddr[port], sky2->tx_le_map,
                            TX_RING_SIZE - 1);
@@ -1041,8 +1079,10 @@ static int sky2_up(struct net_device *dev)
                 goto err_out;
 
         /* Enable interrupts from phy/mac for port */
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= (port == 0) ? Y2_IS_PORT_1 : Y2_IS_PORT_2;
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
         return 0;
 
 err_out:
@@ -1342,10 +1382,10 @@ static int sky2_down(struct net_device *dev)
         netif_stop_queue(dev);
 
         /* Disable port IRQ */
-        local_irq_disable();
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask &= ~((sky2->port == 0) ? Y2_IS_IRQ_PHY1 : Y2_IS_IRQ_PHY2);
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
-        local_irq_enable();
+        spin_unlock_irq(&hw->hw_lock);
 
         flush_scheduled_work();
 
@@ -1446,6 +1486,29 @@ static void sky2_link_up(struct sky2_port *sky2)
         sky2_write8(hw, SK_REG(port, GMAC_IRQ_MSK), GMAC_DEF_MSK);
 
         reg = gma_read16(hw, port, GM_GP_CTRL);
+        if (sky2->autoneg == AUTONEG_DISABLE) {
+                reg |= GM_GPCR_AU_ALL_DIS;
+
+                /* Is write/read necessary?  Copied from sky2_mac_init */
+                gma_write16(hw, port, GM_GP_CTRL, reg);
+                gma_read16(hw, port, GM_GP_CTRL);
+
+                switch (sky2->speed) {
+                case SPEED_1000:
+                        reg &= ~GM_GPCR_SPEED_100;
+                        reg |= GM_GPCR_SPEED_1000;
+                        break;
+                case SPEED_100:
+                        reg &= ~GM_GPCR_SPEED_1000;
+                        reg |= GM_GPCR_SPEED_100;
+                        break;
+                case SPEED_10:
+                        reg &= ~(GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100);
+                        break;
+                }
+        } else
+                reg &= ~GM_GPCR_AU_ALL_DIS;
+
         if (sky2->duplex == DUPLEX_FULL || sky2->autoneg == AUTONEG_ENABLE)
                 reg |= GM_GPCR_DUP_FULL;
 
@@ -1604,10 +1667,10 @@ static void sky2_phy_task(void *arg)
 out:
         up(&sky2->phy_sema);
 
-        local_irq_disable();
+        spin_lock_irq(&hw->hw_lock);
         hw->intr_mask |= (sky2->port == 0) ? Y2_IS_IRQ_PHY1 : Y2_IS_IRQ_PHY2;
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
-        local_irq_enable();
+        spin_unlock_irq(&hw->hw_lock);
 }
 
 
@@ -1834,6 +1897,17 @@ static int sky2_poll(struct net_device *dev0, int *budget)
 
         sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
 
+        /*
+         * Kick the STAT_LEV_TIMER_CTRL timer.
+         * This fixes my hangs on Yukon-EC (0xb6) rev 1.
+         * The if clause is there to start the timer only if it has been
+         * configured correctly and not been disabled via ethtool.
+         */
+        if (sky2_read8(hw, STAT_LEV_TIMER_CTRL) == TIM_START) {
+                sky2_write8(hw, STAT_LEV_TIMER_CTRL, TIM_STOP);
+                sky2_write8(hw, STAT_LEV_TIMER_CTRL, TIM_START);
+        }
+
         hwidx = sky2_read16(hw, STAT_PUT_IDX);
         BUG_ON(hwidx >= STATUS_RING_SIZE);
         rmb();
@@ -1916,16 +1990,19 @@ exit_loop:
         sky2_tx_check(hw, 0, tx_done[0]);
         sky2_tx_check(hw, 1, tx_done[1]);
 
+        if (sky2_read8(hw, STAT_TX_TIMER_CTRL) == TIM_START) {
+                sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_STOP);
+                sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START);
+        }
+
         if (likely(work_done < to_do)) {
-                /* need to restart TX timer */
-                if (is_ec_a1(hw)) {
-                        sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_STOP);
-                        sky2_write8(hw, STAT_TX_TIMER_CTRL, TIM_START);
-                }
+                spin_lock_irq(&hw->hw_lock);
+                __netif_rx_complete(dev0);
 
-                netif_rx_complete(dev0);
                 hw->intr_mask |= Y2_IS_STAT_BMU;
                 sky2_write32(hw, B0_IMSK, hw->intr_mask);
+                spin_unlock_irq(&hw->hw_lock);
+
                 return 0;
         } else {
                 *budget -= work_done;
@@ -1988,13 +2065,13 @@ static void sky2_hw_intr(struct sky2_hw *hw)
         if (status & (Y2_IS_MST_ERR | Y2_IS_IRQ_STAT)) {
                 u16 pci_err;
 
-                pci_read_config_word(hw->pdev, PCI_STATUS, &pci_err);
+                pci_err = sky2_pci_read16(hw, PCI_STATUS);
                 if (net_ratelimit())
                         printk(KERN_ERR PFX "%s: pci hw error (0x%x)\n",
                                pci_name(hw->pdev), pci_err);
 
                 sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-                pci_write_config_word(hw->pdev, PCI_STATUS,
+                sky2_pci_write16(hw, PCI_STATUS,
                                       pci_err | PCI_STATUS_ERROR_BITS);
                 sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
         }
@@ -2003,7 +2080,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
                 /* PCI-Express uncorrectable Error occurred */
                 u32 pex_err;
 
-                pci_read_config_dword(hw->pdev, PEX_UNC_ERR_STAT, &pex_err);
+                pex_err = sky2_pci_read32(hw, PEX_UNC_ERR_STAT);
 
                 if (net_ratelimit())
                         printk(KERN_ERR PFX "%s: pci express error (0x%x)\n",
@@ -2011,7 +2088,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
 
                 /* clear the interrupt */
                 sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-                pci_write_config_dword(hw->pdev, PEX_UNC_ERR_STAT,
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT,
                                        0xffffffffUL);
                 sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
@@ -2057,6 +2134,7 @@ static void sky2_phy_intr(struct sky2_hw *hw, unsigned port)
 
         hw->intr_mask &= ~(port == 0 ? Y2_IS_IRQ_PHY1 : Y2_IS_IRQ_PHY2);
         sky2_write32(hw, B0_IMSK, hw->intr_mask);
+
         schedule_work(&sky2->phy_task);
 }
 
@@ -2070,6 +2148,7 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
         if (status == 0 || status == ~0)
                 return IRQ_NONE;
 
+        spin_lock(&hw->hw_lock);
         if (status & Y2_IS_HW_ERR)
                 sky2_hw_intr(hw);
 
@@ -2098,7 +2177,7 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
 
         sky2_write32(hw, B0_Y2_SP_ICR, 2);
 
-        sky2_read32(hw, B0_IMSK);
+        spin_unlock(&hw->hw_lock);
 
         return IRQ_HANDLED;
 }
@@ -2141,7 +2220,7 @@ static int sky2_reset(struct sky2_hw *hw)
 {
         u16 status;
         u8 t8, pmd_type;
-        int i, err;
+        int i;
 
         sky2_write8(hw, B0_CTST, CS_RST_CLR);
 
@@ -2163,25 +2242,18 @@ static int sky2_reset(struct sky2_hw *hw)
         sky2_write8(hw, B0_CTST, CS_RST_CLR);
 
         /* clear PCI errors, if any */
-        err = pci_read_config_word(hw->pdev, PCI_STATUS, &status);
-        if (err)
-                goto pci_err;
+        status = sky2_pci_read16(hw, PCI_STATUS);
 
         sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-        err = pci_write_config_word(hw->pdev, PCI_STATUS,
-                                    status | PCI_STATUS_ERROR_BITS);
-        if (err)
-                goto pci_err;
+        sky2_pci_write16(hw, PCI_STATUS, status | PCI_STATUS_ERROR_BITS);
+
 
         sky2_write8(hw, B0_CTST, CS_MRST_CLR);
 
         /* clear any PEX errors */
-        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP)) {
-                err = pci_write_config_dword(hw->pdev, PEX_UNC_ERR_STAT,
-                                                 0xffffffffUL);
-                if (err)
-                        goto pci_err;
-        }
+        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP)) 
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT, 0xffffffffUL);
+
 
         pmd_type = sky2_read8(hw, B2_PMD_TYP);
         hw->copper = !(pmd_type == 'L' || pmd_type == 'S');
@@ -2280,8 +2352,7 @@ static int sky2_reset(struct sky2_hw *hw)
                         sky2_write8(hw, STAT_FIFO_ISR_WM, 16);
 
                 sky2_write32(hw, STAT_TX_TIMER_INI, sky2_us2clk(hw, 1000));
-                sky2_write32(hw, STAT_LEV_TIMER_INI, sky2_us2clk(hw, 100));
-                sky2_write32(hw, STAT_ISR_TIMER_INI, sky2_us2clk(hw, 20));
+                sky2_write32(hw, STAT_ISR_TIMER_INI, sky2_us2clk(hw, 7));
         }
 
         /* enable status unit */
@@ -2292,14 +2363,6 @@ static int sky2_reset(struct sky2_hw *hw)
         sky2_write8(hw, STAT_ISR_TIMER_CTRL, TIM_START);
 
         return 0;
-
-pci_err:
-        /* This is to catch a BIOS bug workaround where
-         * mmconfig table doesn't have other buses.
-         */
-        printk(KERN_ERR PFX "%s: can't access PCI config space\n",
-               pci_name(hw->pdev));
-        return err;
 }
 
 static u32 sky2_supported_modes(const struct sky2_hw *hw)
@@ -2823,11 +2886,11 @@ static int sky2_set_coalesce(struct net_device *dev,
             (ecmd->rx_coalesce_usecs_irq < tmin || ecmd->rx_coalesce_usecs_irq > tmax))
                 return -EINVAL;
 
-        if (ecmd->tx_max_coalesced_frames > 0xffff)
+        if (ecmd->tx_max_coalesced_frames >= TX_RING_SIZE-1)
                 return -EINVAL;
-        if (ecmd->rx_max_coalesced_frames > 0xff)
+        if (ecmd->rx_max_coalesced_frames > RX_MAX_PENDING)
                 return -EINVAL;
-        if (ecmd->rx_max_coalesced_frames_irq > 0xff)
+        if (ecmd->rx_max_coalesced_frames_irq >RX_MAX_PENDING)
                 return -EINVAL;
 
         if (ecmd->tx_coalesce_usecs == 0)
@@ -3169,17 +3232,6 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
                 }
         }
 
-#ifdef __BIG_ENDIAN
-        /* byte swap descriptors in hardware */
-        {
-                u32 reg;
-
-                pci_read_config_dword(pdev, PCI_DEV_REG2, &reg);
-                reg |= PCI_REV_DESC;
-                pci_write_config_dword(pdev, PCI_DEV_REG2, reg);
-        }
-#endif
-
         err = -ENOMEM;
         hw = kzalloc(sizeof(*hw), GFP_KERNEL);
         if (!hw) {
@@ -3197,6 +3249,18 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
                 goto err_out_free_hw;
         }
         hw->pm_cap = pm_cap;
+        spin_lock_init(&hw->hw_lock);
+
+#ifdef __BIG_ENDIAN
+        /* byte swap descriptors in hardware */
+        {
+                u32 reg;
+
+                reg = sky2_pci_read32(hw, PCI_DEV_REG2);
+                reg |= PCI_REV_DESC;
+                sky2_pci_write32(hw, PCI_DEV_REG2, reg);
+        }
+#endif
 
         /* ring for status responses */
         hw->st_le = pci_alloc_consistent(hw->pdev, STATUS_LE_BYTES,
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index fd12c289a238..3edb98075e0a 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -5,14 +5,22 @@
 #define _SKY2_H
 
 /* PCI config registers */
-#define PCI_DEV_REG1    0x40
-#define PCI_DEV_REG2    0x44
-#define PCI_DEV_STATUS  0x7c
-#define PCI_OS_PCI_X    (1<<26)
+enum {
+        PCI_DEV_REG1    = 0x40,
+        PCI_DEV_REG2    = 0x44,
+        PCI_DEV_STATUS  = 0x7c,
+        PCI_DEV_REG3    = 0x80,
+        PCI_DEV_REG4    = 0x84,
+        PCI_DEV_REG5    = 0x88,
+};
 
-#define PEX_LNK_STAT    0xf2
-#define PEX_UNC_ERR_STAT 0x104
-#define PEX_DEV_CTRL    0xe8
+enum {
+        PEX_DEV_CAP     = 0xe4,
+        PEX_DEV_CTRL    = 0xe8,
+        PEX_DEV_STA     = 0xea,
+        PEX_LNK_STAT    = 0xf2,
+        PEX_UNC_ERR_STAT= 0x104,
+};
 
 /* Yukon-2 */
 enum pci_dev_reg_1 {
@@ -37,6 +45,25 @@ enum pci_dev_reg_2 {
         PCI_USEDATA64   = 1<<0,         /* Use 64Bit Data bus ext */
 };
 
+/*      PCI_OUR_REG_4           32 bit  Our Register 4 (Yukon-ECU only) */
+enum pci_dev_reg_4 {
+                                        /* (Link Training & Status State Machine) */
+        P_TIMER_VALUE_MSK       = 0xffL<<16,    /* Bit 23..16:  Timer Value Mask */
+                                        /* (Active State Power Management) */
+        P_FORCE_ASPM_REQUEST    = 1<<15, /* Force ASPM Request (A1 only) */
+        P_ASPM_GPHY_LINK_DOWN   = 1<<14, /* GPHY Link Down (A1 only) */
+        P_ASPM_INT_FIFO_EMPTY   = 1<<13, /* Internal FIFO Empty (A1 only) */
+        P_ASPM_CLKRUN_REQUEST   = 1<<12, /* CLKRUN Request (A1 only) */
+
+        P_ASPM_FORCE_CLKREQ_ENA = 1<<4, /* Force CLKREQ Enable (A1b only) */
+        P_ASPM_CLKREQ_PAD_CTL   = 1<<3, /* CLKREQ PAD Control (A1 only) */
+        P_ASPM_A1_MODE_SELECT   = 1<<2, /* A1 Mode Select (A1 only) */
+        P_CLK_GATE_PEX_UNIT_ENA = 1<<1, /* Enable Gate PEX Unit Clock */
+        P_CLK_GATE_ROOT_COR_ENA = 1<<0, /* Enable Gate Root Core Clock */
+        P_ASPM_CONTROL_MSK      = P_FORCE_ASPM_REQUEST | P_ASPM_GPHY_LINK_DOWN
+                                  | P_ASPM_CLKRUN_REQUEST | P_ASPM_INT_FIFO_EMPTY,
+};
+
 
 #define PCI_STATUS_ERROR_BITS (PCI_STATUS_DETECTED_PARITY | \
                                PCI_STATUS_SIG_SYSTEM_ERROR | \
@@ -507,6 +534,16 @@ enum {
 };
 #define Q_ADDR(reg, offs) (B8_Q_REGS + (reg) + (offs))
 
+/*      Q_F                             32 bit  Flag Register */
+enum {
+        F_ALM_FULL      = 1<<27, /* Rx FIFO: almost full */
+        F_EMPTY         = 1<<27, /* Tx FIFO: empty flag */
+        F_FIFO_EOF      = 1<<26, /* Tag (EOF Flag) bit in FIFO */
+        F_WM_REACHED    = 1<<25, /* Watermark reached */
+        F_M_RX_RAM_DIS  = 1<<24, /* MAC Rx RAM Read Port disable */
+        F_FIFO_LEVEL    = 0x1fL<<16, /* Bit 23..16:     # of Qwords in FIFO */
+        F_WATER_MARK    = 0x0007ffL, /* Bit 10.. 0:     Watermark */
+};
 
 /* Queue Prefetch Unit Offsets, use Y2_QADDR() to address (Yukon-2 only)*/
 enum {
@@ -909,10 +946,12 @@ enum {
         PHY_BCOM_ID1_C0 = 0x6044,
         PHY_BCOM_ID1_C5 = 0x6047,
 
-        PHY_MARV_ID1_B0 = 0x0C23, /* Yukon (PHY 88E1011) */
+        PHY_MARV_ID1_B0 = 0x0C23, /* Yukon      (PHY 88E1011) */
         PHY_MARV_ID1_B2 = 0x0C25, /* Yukon-Plus (PHY 88E1011) */
-        PHY_MARV_ID1_C2 = 0x0CC2, /* Yukon-EC (PHY 88E1111) */
-        PHY_MARV_ID1_Y2 = 0x0C91, /* Yukon-2 (PHY 88E1112) */
+        PHY_MARV_ID1_C2 = 0x0CC2, /* Yukon-EC   (PHY 88E1111) */
+        PHY_MARV_ID1_Y2 = 0x0C91, /* Yukon-2    (PHY 88E1112) */
+        PHY_MARV_ID1_FE = 0x0C83, /* Yukon-FE   (PHY 88E3082 Rev.A1) */
+        PHY_MARV_ID1_ECU= 0x0CB0, /* Yukon-ECU  (PHY 88E1149 Rev.B2?) */
 };
 
 /* Advertisement register bits */
@@ -1837,8 +1876,9 @@ struct sky2_port {
 struct sky2_hw {
         void __iomem         *regs;
         struct pci_dev       *pdev;
-        u32                  intr_mask;
         struct net_device    *dev[2];
+        spinlock_t           hw_lock;
+        u32                  intr_mask;
 
         int                  pm_cap;
         int                  msi;
@@ -1912,4 +1952,25 @@ static inline void gma_set_addr(struct sky2_hw *hw, unsigned port, unsigned reg,
         gma_write16(hw, port, reg+4,(u16) addr[2] | ((u16) addr[3] << 8));
         gma_write16(hw, port, reg+8,(u16) addr[4] | ((u16) addr[5] << 8));
 }
+
+/* PCI config space access */
+static inline u32 sky2_pci_read32(const struct sky2_hw *hw, unsigned reg)
+{
+        return sky2_read32(hw, Y2_CFG_SPC + reg);
+}
+
+static inline u16 sky2_pci_read16(const struct sky2_hw *hw, unsigned reg)
+{
+        return sky2_read16(hw, Y2_CFG_SPC + reg);
+}
+
+static inline void sky2_pci_write32(struct sky2_hw *hw, unsigned reg, u32 val)
+{
+        sky2_write32(hw, Y2_CFG_SPC + reg, val);
+}
+
+static inline void sky2_pci_write16(struct sky2_hw *hw, unsigned reg, u16 val)
+{
+        sky2_write16(hw, Y2_CFG_SPC + reg, val);
+}
 #endif
diff --git a/drivers/net/tlan.c b/drivers/net/tlan.c
index c2506b56a186..12076f8f942c 100644
--- a/drivers/net/tlan.c
+++ b/drivers/net/tlan.c
@@ -536,6 +536,7 @@ static int __devinit TLan_probe1(struct pci_dev *pdev,
         u16                device_id;
         int                reg, rc = -ENODEV;
 
+#ifdef CONFIG_PCI
         if (pdev) {
                 rc = pci_enable_device(pdev);
                 if (rc)
@@ -547,6 +548,7 @@ static int __devinit TLan_probe1(struct pci_dev *pdev,
                         goto err_out;
                 }
         }
+#endif  /*  CONFIG_PCI  */
 
         dev = alloc_etherdev(sizeof(TLanPrivateInfo));
         if (dev == NULL) {
diff --git a/drivers/net/tokenring/smctr.h b/drivers/net/tokenring/smctr.h
index b306c7e4c793..88dfa2e01d6e 100644
--- a/drivers/net/tokenring/smctr.h
+++ b/drivers/net/tokenring/smctr.h
@@ -1042,7 +1042,7 @@ typedef struct net_local {
         __u16            functional_address[2];
         __u16            bitwise_group_address[2];
 
-        __u8            *ptr_ucode;
+        const __u8       *ptr_ucode;
 
         __u8            cleanup;
 
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 98a76f10a0f7..dfc24016ba81 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1872,7 +1872,7 @@ static int atmel_set_encodeext(struct net_device *dev,
         struct atmel_private *priv = netdev_priv(dev);
         struct iw_point *encoding = &wrqu->encoding;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
-        int idx, key_len;
+        int idx, key_len, alg = ext->alg, set_key = 1;
 
         /* Determine and validate the key index */
         idx = encoding->flags & IW_ENCODE_INDEX;
@@ -1883,39 +1883,42 @@ static int atmel_set_encodeext(struct net_device *dev,
         } else
                 idx = priv->default_key;
 
-        if ((encoding->flags & IW_ENCODE_DISABLED) ||
-            ext->alg == IW_ENCODE_ALG_NONE) {
-                priv->wep_is_on = 0;
-                priv->encryption_level = 0;
-                priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
-        }
+        if (encoding->flags & IW_ENCODE_DISABLED)
+            alg = IW_ENCODE_ALG_NONE;
 
-        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY)
+        if (ext->ext_flags & IW_ENCODE_EXT_SET_TX_KEY) {
                 priv->default_key = idx;
+                set_key = ext->key_len > 0 ? 1 : 0;
+        }
 
-        /* Set the requested key */
-        switch (ext->alg) {
-        case IW_ENCODE_ALG_NONE:
-                break;
-        case IW_ENCODE_ALG_WEP:
-                if (ext->key_len > 5) {
-                        priv->wep_key_len[idx] = 13;
-                        priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
-                        priv->encryption_level = 2;
-                } else if (ext->key_len > 0) {
-                        priv->wep_key_len[idx] = 5;
-                        priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
-                        priv->encryption_level = 1;
-                } else {
+        if (set_key) {
+                /* Set the requested key first */
+                switch (alg) {
+                case IW_ENCODE_ALG_NONE:
+                        priv->wep_is_on = 0;
+                        priv->encryption_level = 0;
+                        priv->pairwise_cipher_suite = CIPHER_SUITE_NONE;
+                        break;
+                case IW_ENCODE_ALG_WEP:
+                        if (ext->key_len > 5) {
+                                priv->wep_key_len[idx] = 13;
+                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_128;
+                                priv->encryption_level = 2;
+                        } else if (ext->key_len > 0) {
+                                priv->wep_key_len[idx] = 5;
+                                priv->pairwise_cipher_suite = CIPHER_SUITE_WEP_64;
+                                priv->encryption_level = 1;
+                        } else {
+                                return -EINVAL;
+                        }
+                        priv->wep_is_on = 1;
+                        memset(priv->wep_keys[idx], 0, 13);
+                        key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
+                        memcpy(priv->wep_keys[idx], ext->key, key_len);
+                        break;
+                default:
                         return -EINVAL;
                 }
-                priv->wep_is_on = 1;
-                memset(priv->wep_keys[idx], 0, 13);
-                key_len = min ((int)ext->key_len, priv->wep_key_len[idx]);
-                memcpy(priv->wep_keys[idx], ext->key, key_len);
-                break;
-        default:
-                return -EINVAL;
         }
 
         return -EINPROGRESS;
@@ -3061,17 +3064,26 @@ static void authenticate(struct atmel_private *priv, u16 frame_len)
         }
 
         if (status == C80211_MGMT_SC_Success && priv->wep_is_on) {
+                int should_associate = 0;
                 /* WEP */
                 if (trans_seq_no != priv->ExpectedAuthentTransactionSeqNum)
                         return;
 
-                if (trans_seq_no == 0x0002 &&
-                    auth->el_id == C80211_MGMT_ElementID_ChallengeText) {
-                        send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
-                        return;
+                if (system == C80211_MGMT_AAN_OPENSYSTEM) {
+                        if (trans_seq_no == 0x0002) {
+                                should_associate = 1;
+                        }
+                } else if (system == C80211_MGMT_AAN_SHAREDKEY) {
+                        if (trans_seq_no == 0x0002 &&
+                            auth->el_id == C80211_MGMT_ElementID_ChallengeText) {
+                                send_authentication_request(priv, system, auth->chall_text, auth->chall_text_len);
+                                return;
+                        } else if (trans_seq_no == 0x0004) {
+                                should_associate = 1;
+                        }
                 }
 
-                if (trans_seq_no == 0x0004) {
+                if (should_associate) {
                         if(priv->station_was_associated) {
                                 atmel_enter_state(priv, STATION_STATE_REASSOCIATING);
                                 send_association_request(priv, 1);
@@ -3084,11 +3096,13 @@ static void authenticate(struct atmel_private *priv, u16 frame_len)
                 }
         }
 
-        if (status == C80211_MGMT_SC_AuthAlgNotSupported) {
+        if (status == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
                 /* Do opensystem first, then try sharedkey */
-                if (system ==  C80211_MGMT_AAN_OPENSYSTEM) {
+                if (system == WLAN_AUTH_OPEN) {
                         priv->CurrentAuthentTransactionSeqNum = 0x001;
-                        send_authentication_request(priv, C80211_MGMT_AAN_SHAREDKEY, NULL, 0);
+                        priv->exclude_unencrypted = 1;
+                        send_authentication_request(priv, WLAN_AUTH_SHARED_KEY, NULL, 0);
+                        return;
                 } else if (priv->connect_to_any_BSS) {
                         int bss_index;
 
@@ -3439,10 +3453,13 @@ static void atmel_management_timer(u_long a)
                         priv->AuthenticationRequestRetryCnt = 0;
                         restart_search(priv);
                 } else {
+                        int auth = C80211_MGMT_AAN_OPENSYSTEM;
                         priv->AuthenticationRequestRetryCnt++;
                         priv->CurrentAuthentTransactionSeqNum = 0x0001;
                         mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
-                        send_authentication_request(priv, C80211_MGMT_AAN_OPENSYSTEM, NULL, 0);
+                        if (priv->wep_is_on && priv->exclude_unencrypted)
+                                auth = C80211_MGMT_AAN_SHAREDKEY;
+                        send_authentication_request(priv, auth, NULL, 0);
           }
           break;
 
@@ -3541,12 +3558,15 @@ static void atmel_command_irq(struct atmel_private *priv)
                                 priv->station_was_associated = priv->station_is_associated;
                                 atmel_enter_state(priv, STATION_STATE_READY);
                         } else {
+                                int auth = C80211_MGMT_AAN_OPENSYSTEM;
                                 priv->AuthenticationRequestRetryCnt = 0;
                                 atmel_enter_state(priv, STATION_STATE_AUTHENTICATING);
 
                                 mod_timer(&priv->management_timer, jiffies + MGMT_JIFFIES);
                                 priv->CurrentAuthentTransactionSeqNum = 0x0001;
-                                send_authentication_request(priv, C80211_MGMT_AAN_SHAREDKEY, NULL, 0);
+                                if (priv->wep_is_on && priv->exclude_unencrypted)
+                                        auth = C80211_MGMT_AAN_SHAREDKEY;
+                                send_authentication_request(priv, auth, NULL, 0);
                         }
                         return;
                 }
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 0702f0eeb784..44024c76d187 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -4636,9 +4636,9 @@ static void ipw_rx_notification(struct ipw_priv *priv,
                 }
 
         default:
-                IPW_ERROR("Unknown notification: "
-                          "subtype=%d,flags=0x%2x,size=%d\n",
-                          notif->subtype, notif->flags, notif->size);
+                IPW_DEBUG_NOTIF("Unknown notification: "
+                                "subtype=%d,flags=0x%2x,size=%d\n",
+                                notif->subtype, notif->flags, notif->size);
         }
 }
 
diff --git a/drivers/net/wireless/wavelan_cs.c b/drivers/net/wireless/wavelan_cs.c
index cf373625fc70..98122f3a4bc2 100644
--- a/drivers/net/wireless/wavelan_cs.c
+++ b/drivers/net/wireless/wavelan_cs.c
@@ -950,16 +950,8 @@ wv_82593_cmd(struct net_device *	dev,
 static inline int
 wv_diag(struct net_device *     dev)
 {
-  int           ret = FALSE;
-
-  if(wv_82593_cmd(dev, "wv_diag(): diagnose",
-                  OP0_DIAGNOSE, SR0_DIAGNOSE_PASSED))
-    ret = TRUE;
-
-#ifdef DEBUG_CONFIG_ERRORS
-  printk(KERN_INFO "wavelan_cs: i82593 Self Test failed!\n");
-#endif
-  return(ret);
+  return(wv_82593_cmd(dev, "wv_diag(): diagnose",
+                      OP0_DIAGNOSE, SR0_DIAGNOSE_PASSED));
 } /* wv_diag */
 
 /*------------------------------------------------------------------*/
@@ -3604,8 +3596,8 @@ wv_82593_config(struct net_device *	dev)
   cfblk.lin_prio = 0;           /* conform to 802.3 backoff algoritm */
   cfblk.exp_prio = 5;           /* conform to 802.3 backoff algoritm */
   cfblk.bof_met = 1;            /* conform to 802.3 backoff algoritm */
-  cfblk.ifrm_spc = 0x20;        /* 32 bit times interframe spacing */
-  cfblk.slottim_low = 0x20;     /* 32 bit times slot time */
+  cfblk.ifrm_spc = 0x20 >> 4;   /* 32 bit times interframe spacing */
+  cfblk.slottim_low = 0x20 >> 5;        /* 32 bit times slot time */
   cfblk.slottim_hi = 0x0;
   cfblk.max_retr = 15;
   cfblk.prmisc = ((lp->promiscuous) ? TRUE: FALSE);     /* Promiscuous mode */
diff --git a/drivers/s390/block/Kconfig b/drivers/s390/block/Kconfig
index 6912399d0937..6f50cc9323d9 100644
--- a/drivers/s390/block/Kconfig
+++ b/drivers/s390/block/Kconfig
@@ -55,21 +55,13 @@ config DASD_DIAG
           Disks under VM.  If you are not running under VM or unsure what it is,
           say "N".
 
-config DASD_EER
-        tristate "Extended error reporting (EER)"
-        depends on DASD
-        help
-          This driver provides a character device interface to the
-          DASD extended error reporting. This is only needed if you want to
-          use applications written for the EER facility.
-
 config DASD_CMB
         tristate "Compatibility interface for DASD channel measurement blocks"
         depends on DASD
         help
-          This driver provides an additional interface to the channel
-          measurement facility, which is normally accessed though sysfs, with
-          a set of ioctl functions specific to the dasd driver.
+          This driver provides an additional interface to the channel measurement
+          facility, which is normally accessed though sysfs, with a set of
+          ioctl functions specific to the dasd driver.
           This is only needed if you want to use applications written for
           linux-2.4 dasd channel measurement facility interface.
 
diff --git a/drivers/s390/block/Makefile b/drivers/s390/block/Makefile
index 0c0d871e8f51..58c6780134f7 100644
--- a/drivers/s390/block/Makefile
+++ b/drivers/s390/block/Makefile
@@ -5,7 +5,6 @@
 dasd_eckd_mod-objs := dasd_eckd.o dasd_3990_erp.o dasd_9343_erp.o
 dasd_fba_mod-objs  := dasd_fba.o dasd_3370_erp.o dasd_9336_erp.o
 dasd_diag_mod-objs := dasd_diag.o
-dasd_eer_mod-objs := dasd_eer.o
 dasd_mod-objs      := dasd.o dasd_ioctl.o dasd_proc.o dasd_devmap.o \
                         dasd_genhd.o dasd_erp.o
 
@@ -14,6 +13,5 @@ obj-$(CONFIG_DASD_DIAG) += dasd_diag_mod.o
 obj-$(CONFIG_DASD_ECKD) += dasd_eckd_mod.o
 obj-$(CONFIG_DASD_FBA)  += dasd_fba_mod.o
 obj-$(CONFIG_DASD_CMB)  += dasd_cmb.o
-obj-$(CONFIG_DASD_EER)  += dasd_eer.o
 obj-$(CONFIG_BLK_DEV_XPRAM) += xpram.o
 obj-$(CONFIG_DCSSBLK) += dcssblk.o
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 08c88fcd8963..af1d5b404cee 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -18,7 +18,6 @@
 #include <linux/slab.h>
 #include <linux/buffer_head.h>
 #include <linux/hdreg.h>
-#include <linux/notifier.h>
 
 #include <asm/ccwdev.h>
 #include <asm/ebcdic.h>
@@ -58,7 +57,6 @@ static void dasd_int_handler(struct ccw_device *, unsigned long, struct irb *);
 static void dasd_flush_ccw_queue(struct dasd_device *, int);
 static void dasd_tasklet(struct dasd_device *);
 static void do_kick_device(void *data);
-static void dasd_disable_eer(struct dasd_device *device);
 
 /*
  * SECTION: Operations on the device structure.
@@ -153,10 +151,13 @@ dasd_state_new_to_known(struct dasd_device *device)
 static inline void
 dasd_state_known_to_new(struct dasd_device * device)
 {
-        /* disable extended error reporting for this device */
-        dasd_disable_eer(device);
         /* Forget the discipline information. */
+        if (device->discipline)
+                module_put(device->discipline->owner);
         device->discipline = NULL;
+        if (device->base_discipline)
+                module_put(device->base_discipline->owner);
+        device->base_discipline = NULL;
         device->state = DASD_STATE_NEW;
 
         dasd_free_queue(device);
@@ -871,9 +872,6 @@ dasd_handle_state_change_pending(struct dasd_device *device)
         struct dasd_ccw_req *cqr;
         struct list_head *l, *n;
 
-        /* first of all call extended error reporting */
-        dasd_write_eer_trigger(DASD_EER_STATECHANGE, device, NULL);
-
         device->stopped &= ~DASD_STOPPED_PENDING;
 
         /* restart all 'running' IO on queue */
@@ -1093,19 +1091,6 @@ restart:
                         }
                         goto restart;
                 }
-
-                /* first of all call extended error reporting */
-                if (device->eer && cqr->status == DASD_CQR_FAILED) {
-                        dasd_write_eer_trigger(DASD_EER_FATALERROR,
-                                               device, cqr);
-
-                        /* restart request  */
-                        cqr->status = DASD_CQR_QUEUED;
-                        cqr->retries = 255;
-                        device->stopped |= DASD_STOPPED_QUIESCE;
-                        goto restart;
-                }
-
                 /* Process finished ERP request. */
                 if (cqr->refers) {
                         __dasd_process_erp(device, cqr);
@@ -1243,8 +1228,7 @@ __dasd_start_head(struct dasd_device * device)
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, list);
         /* check FAILFAST */
         if (device->stopped & ~DASD_STOPPED_PENDING &&
-            test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
-            (!device->eer)) {
+            test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags)) {
                 cqr->status = DASD_CQR_FAILED;
                 dasd_schedule_bh(device);
         }
@@ -1880,9 +1864,10 @@ dasd_generic_remove (struct ccw_device *cdev)
  */
 int
 dasd_generic_set_online (struct ccw_device *cdev,
-                         struct dasd_discipline *discipline)
+                         struct dasd_discipline *base_discipline)
 
 {
+        struct dasd_discipline *discipline;
         struct dasd_device *device;
         int rc;
 
@@ -1890,6 +1875,7 @@ dasd_generic_set_online (struct ccw_device *cdev,
         if (IS_ERR(device))
                 return PTR_ERR(device);
 
+        discipline = base_discipline;
         if (device->features & DASD_FEATURE_USEDIAG) {
                 if (!dasd_diag_discipline_pointer) {
                         printk (KERN_WARNING
@@ -1901,6 +1887,16 @@ dasd_generic_set_online (struct ccw_device *cdev,
                 }
                 discipline = dasd_diag_discipline_pointer;
         }
+        if (!try_module_get(base_discipline->owner)) {
+                dasd_delete_device(device);
+                return -EINVAL;
+        }
+        if (!try_module_get(discipline->owner)) {
+                module_put(base_discipline->owner);
+                dasd_delete_device(device);
+                return -EINVAL;
+        }
+        device->base_discipline = base_discipline;
         device->discipline = discipline;
 
         rc = discipline->check_device(device);
@@ -1909,6 +1905,8 @@ dasd_generic_set_online (struct ccw_device *cdev,
                         "dasd_generic couldn't online device %s "
                         "with discipline %s rc=%i\n",
                         cdev->dev.bus_id, discipline->name, rc);
+                module_put(discipline->owner);
+                module_put(base_discipline->owner);
                 dasd_delete_device(device);
                 return rc;
         }
@@ -1986,9 +1984,6 @@ dasd_generic_notify(struct ccw_device *cdev, int event)
         switch (event) {
         case CIO_GONE:
         case CIO_NO_PATH:
-                /* first of all call extended error reporting */
-                dasd_write_eer_trigger(DASD_EER_NOPATH, device, NULL);
-
                 if (device->state < DASD_STATE_BASIC)
                         break;
                 /* Device is active. We want to keep it. */
@@ -2046,51 +2041,6 @@ dasd_generic_auto_online (struct ccw_driver *dasd_discipline_driver)
         put_driver(drv);
 }
 
-/*
- * notifications for extended error reports
- */
-static struct notifier_block *dasd_eer_chain;
-
-int
-dasd_register_eer_notifier(struct notifier_block *nb)
-{
-        return notifier_chain_register(&dasd_eer_chain, nb);
-}
-
-int
-dasd_unregister_eer_notifier(struct notifier_block *nb)
-{
-        return notifier_chain_unregister(&dasd_eer_chain, nb);
-}
-
-/*
- * Notify the registered error reporting module of a problem
- */
-void
-dasd_write_eer_trigger(unsigned int id, struct dasd_device *device,
-                       struct dasd_ccw_req *cqr)
-{
-        if (device->eer) {
-                struct dasd_eer_trigger temp;
-                temp.id = id;
-                temp.device = device;
-                temp.cqr = cqr;
-                notifier_call_chain(&dasd_eer_chain, DASD_EER_TRIGGER,
-                                    (void *)&temp);
-        }
-}
-
-/*
- * Tell the registered error reporting module to disable error reporting for
- * a given device and to cleanup any private data structures on that device.
- */
-static void
-dasd_disable_eer(struct dasd_device *device)
-{
-        notifier_call_chain(&dasd_eer_chain, DASD_EER_DISABLE, (void *)device);
-}
-
-
 static int __init
 dasd_init(void)
 {
@@ -2172,11 +2122,6 @@ EXPORT_SYMBOL_GPL(dasd_generic_set_online);
 EXPORT_SYMBOL_GPL(dasd_generic_set_offline);
 EXPORT_SYMBOL_GPL(dasd_generic_auto_online);
 
-EXPORT_SYMBOL(dasd_register_eer_notifier);
-EXPORT_SYMBOL(dasd_unregister_eer_notifier);
-EXPORT_SYMBOL(dasd_write_eer_trigger);
-
-
 /*
  * Overrides for Emacs so that we follow Linus's tabbing style.
  * Emacs will notice this stuff at the end of the file and automatically
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index c811380b9079..4ee0f934e325 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -1108,9 +1108,6 @@ dasd_3990_handle_env_data(struct dasd_ccw_req * erp, char *sense)
                 case 0x0B:
                         DEV_MESSAGE(KERN_WARNING, device, "%s",
                                     "FORMAT F - Volume is suspended duplex");
-                        /* call extended error reporting (EER) */
-                        dasd_write_eer_trigger(DASD_EER_PPRCSUSPEND, device,
-                                               erp->refers);
                         break;
                 case 0x0C:
                         DEV_MESSAGE(KERN_WARNING, device, "%s",
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index e15dd7978050..bc3823d35223 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -29,7 +29,6 @@
 #define DASD_ECKD_CCW_PSF                0x27
 #define DASD_ECKD_CCW_RSSD               0x3e
 #define DASD_ECKD_CCW_LOCATE_RECORD      0x47
-#define DASD_ECKD_CCW_SNSS               0x54
 #define DASD_ECKD_CCW_DEFINE_EXTENT      0x63
 #define DASD_ECKD_CCW_WRITE_MT           0x85
 #define DASD_ECKD_CCW_READ_MT            0x86
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
deleted file mode 100644
index f70cd7716b24..000000000000
--- a/drivers/s390/block/dasd_eer.c
+++ /dev/null
@@ -1,1090 +0,0 @@
-/*
- *      character device driver for extended error reporting
- *
- *
- *      Copyright (C) 2005 IBM Corporation
- *      extended error reporting for DASD ECKD devices
- *      Author(s): Stefan Weinhuber <wein@de.ibm.com>
- *
- */
-
-#include <linux/init.h>
-#include <linux/fs.h>
-#include <linux/kernel.h>
-#include <linux/miscdevice.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/device.h>
-#include <linux/workqueue.h>
-#include <linux/poll.h>
-#include <linux/notifier.h>
-
-#include <asm/uaccess.h>
-#include <asm/semaphore.h>
-#include <asm/atomic.h>
-#include <asm/ebcdic.h>
-
-#include "dasd_int.h"
-#include "dasd_eckd.h"
-
-
-MODULE_LICENSE("GPL");
-
-MODULE_AUTHOR("Stefan Weinhuber <wein@de.ibm.com>");
-MODULE_DESCRIPTION("DASD extended error reporting module");
-
-
-#ifdef PRINTK_HEADER
-#undef PRINTK_HEADER
-#endif                          /* PRINTK_HEADER */
-#define PRINTK_HEADER "dasd(eer):"
-
-
-
-
-
-/*****************************************************************************/
-/*      the internal buffer                                                  */
-/*****************************************************************************/
-
-/*
- * The internal buffer is meant to store obaque blobs of data, so it doesn't
- * know of higher level concepts like triggers.
- * It consists of a number of pages that are used as a ringbuffer. Each data
- * blob is stored in a simple record that consists of an integer, which
- * contains the size of the following data, and the data bytes themselfes.
- *
- * To allow for multiple independent readers we create one internal buffer
- * each time the device is opened and destroy the buffer when the file is
- * closed again.
- *
- * One record can be written to a buffer by using the functions
- * - dasd_eer_start_record (one time per record to write the size to the buffer
- *                          and reserve the space for the data)
- * - dasd_eer_write_buffer (one or more times per record to write the data)
- * The data can be written in several steps but you will have to compute
- * the total size up front for the invocation of dasd_eer_start_record.
- * If the ringbuffer is full, dasd_eer_start_record will remove the required
- * number of old records.
- *
- * A record is typically read in two steps, first read the integer that
- * specifies the size of the following data, then read the data.
- * Both can be done by
- * - dasd_eer_read_buffer
- *
- * For all mentioned functions you need to get the bufferlock first and keep it
- * until a complete record is written or read.
- */
-
-
-/*
- * Alle information necessary to keep track of an internal buffer is kept in
- * a struct eerbuffer. The buffer specific to a file pointer is strored in
- * the private_data field of that file. To be able to write data to all
- * existing buffers, each buffer is also added to the bufferlist.
- * If the user doesn't want to read a complete record in one go, we have to
- * keep track of the rest of the record. residual stores the number of bytes
- * that are still to deliver. If the rest of the record is invalidated between
- * two reads then residual will be set to -1 so that the next read will fail.
- * All entries in the eerbuffer structure are protected with the bufferlock.
- * To avoid races between writing to a buffer on the one side and creating
- * and destroying buffers on the other side, the bufferlock must also be used
- * to protect the bufferlist.
- */
-
-struct eerbuffer {
-        struct list_head list;
-        char **buffer;
-        int buffersize;
-        int buffer_page_count;
-        int head;
-        int tail;
-        int residual;
-};
-
-LIST_HEAD(bufferlist);
-
-static spinlock_t bufferlock = SPIN_LOCK_UNLOCKED;
-
-DECLARE_WAIT_QUEUE_HEAD(dasd_eer_read_wait_queue);
-
-/*
- * How many free bytes are available on the buffer.
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_get_free_bytes(struct eerbuffer *eerb)
-{
-        if (eerb->head < eerb->tail) {
-                return eerb->tail - eerb->head - 1;
-        } else
-                return eerb->buffersize - eerb->head + eerb->tail -1;
-}
-
-/*
- * How many bytes of buffer space are used.
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_get_filled_bytes(struct eerbuffer *eerb)
-{
-
-        if (eerb->head >= eerb->tail) {
-                return eerb->head - eerb->tail;
-        } else
-                return eerb->buffersize - eerb->tail + eerb->head;
-}
-
-/*
- * The dasd_eer_write_buffer function just copies count bytes of data
- * to the buffer. Make sure to call dasd_eer_start_record first, to
- * make sure that enough free space is available.
- * needs to be called with bufferlock held
- */
-static void
-dasd_eer_write_buffer(struct eerbuffer *eerb, int count, char *data)
-{
-
-        unsigned long headindex,localhead;
-        unsigned long rest, len;
-        char *nextdata;
-
-        nextdata = data;
-        rest = count;
-        while (rest > 0) {
-                headindex = eerb->head / PAGE_SIZE;
-                localhead = eerb->head % PAGE_SIZE;
-                len = min(rest, (PAGE_SIZE - localhead));
-                memcpy(eerb->buffer[headindex]+localhead, nextdata, len);
-                nextdata += len;
-                rest -= len;
-                eerb->head += len;
-                if ( eerb->head == eerb->buffersize )
-                        eerb->head = 0; /* wrap around */
-                if (eerb->head > eerb->buffersize) {
-                        MESSAGE(KERN_ERR, "%s", "runaway buffer head.");
-                        BUG();
-                }
-        }
-}
-
-/*
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_read_buffer(struct eerbuffer *eerb, int count, char *data)
-{
-
-        unsigned long tailindex,localtail;
-        unsigned long rest, len, finalcount;
-        char *nextdata;
-
-        finalcount = min(count, dasd_eer_get_filled_bytes(eerb));
-        nextdata = data;
-        rest = finalcount;
-        while (rest > 0) {
-                tailindex = eerb->tail / PAGE_SIZE;
-                localtail = eerb->tail % PAGE_SIZE;
-                len = min(rest, (PAGE_SIZE - localtail));
-                memcpy(nextdata, eerb->buffer[tailindex]+localtail, len);
-                nextdata += len;
-                rest -= len;
-                eerb->tail += len;
-                if ( eerb->tail == eerb->buffersize )
-                        eerb->tail = 0; /* wrap around */
-                if (eerb->tail > eerb->buffersize) {
-                        MESSAGE(KERN_ERR, "%s", "runaway buffer tail.");
-                        BUG();
-                }
-        }
-        return finalcount;
-}
-
-/*
- * Whenever you want to write a blob of data to the internal buffer you
- * have to start by using this function first. It will write the number
- * of bytes that will be written to the buffer. If necessary it will remove
- * old records to make room for the new one.
- * needs to be called with bufferlock held
- */
-static int
-dasd_eer_start_record(struct eerbuffer *eerb, int count)
-{
-        int tailcount;
-        if (count + sizeof(count) > eerb->buffersize)
-                return -ENOMEM;
-        while (dasd_eer_get_free_bytes(eerb) < count + sizeof(count)) {
-                if (eerb->residual > 0) {
-                        eerb->tail += eerb->residual;
-                        if (eerb->tail >= eerb->buffersize)
-                                eerb->tail -= eerb->buffersize;
-                        eerb->residual = -1;
-                }
-                dasd_eer_read_buffer(eerb, sizeof(tailcount),
-                                     (char*)(&tailcount));
-                eerb->tail += tailcount;
-                if (eerb->tail >= eerb->buffersize)
-                        eerb->tail -= eerb->buffersize;
-        }
-        dasd_eer_write_buffer(eerb, sizeof(count), (char*)(&count));
-
-        return 0;
-};
-
-/*
- * release pages that are not used anymore
- */
-static void
-dasd_eer_free_buffer_pages(char **buf, int no_pages)
-{
-        int i;
-
-        for (i = 0; i < no_pages; ++i) {
-                free_page((unsigned long)buf[i]);
-        }
-}
-
-/*
- * allocate a new set of memory pages
- */
-static int
-dasd_eer_allocate_buffer_pages(char **buf, int no_pages)
-{
-        int i;
-
-        for (i = 0; i < no_pages; ++i) {
-                buf[i] = (char *) get_zeroed_page(GFP_KERNEL);
-                if (!buf[i]) {
-                        dasd_eer_free_buffer_pages(buf, i);
-                        return -ENOMEM;
-                }
-        }
-        return 0;
-}
-
-/*
- * empty the buffer by resetting head and tail
- * In case there is a half read data blob in the buffer, we set residual
- * to -1 to indicate that the remainder of the blob is lost.
- */
-static void
-dasd_eer_purge_buffer(struct eerbuffer *eerb)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&bufferlock, flags);
-        if (eerb->residual > 0)
-                eerb->residual = -1;
-        eerb->tail=0;
-        eerb->head=0;
-        spin_unlock_irqrestore(&bufferlock, flags);
-}
-
-/*
- * set the size of the buffer, newsize is the new number of pages to be used
- * we don't try to copy any data back an forth, so any resize will also purge
- * the buffer
- */
-static int
-dasd_eer_resize_buffer(struct eerbuffer *eerb, int newsize)
-{
-        int i, oldcount, reuse;
-        char **new;
-        char **old;
-        unsigned long flags;
-
-        if (newsize < 1)
-                return -EINVAL;
-        if (eerb->buffer_page_count == newsize) {
-                /* documented behaviour is that any successfull invocation
-                 * will purge all records */
-                dasd_eer_purge_buffer(eerb);
-                return 0;
-        }
-        new = kmalloc(newsize*sizeof(char*), GFP_KERNEL);
-        if (!new)
-                return -ENOMEM;
-
-        reuse=min(eerb->buffer_page_count, newsize);
-        for (i = 0; i < reuse; ++i) {
-                new[i] = eerb->buffer[i];
-        }
-        if (eerb->buffer_page_count < newsize) {
-                if (dasd_eer_allocate_buffer_pages(
-                            &new[eerb->buffer_page_count],
-                            newsize - eerb->buffer_page_count)) {
-                        kfree(new);
-                        return -ENOMEM;
-                }
-        }
-
-        spin_lock_irqsave(&bufferlock, flags);
-        old = eerb->buffer;
-        eerb->buffer = new;
-        if (eerb->residual > 0)
-                eerb->residual = -1;
-        eerb->tail = 0;
-        eerb->head = 0;
-        oldcount = eerb->buffer_page_count;
-        eerb->buffer_page_count = newsize;
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        if (oldcount > newsize) {
-                for (i = newsize; i < oldcount; ++i) {
-                        free_page((unsigned long)old[i]);
-                }
-        }
-        kfree(old);
-
-        return 0;
-}
-
-
-/*****************************************************************************/
-/*      The extended error reporting functionality                           */
-/*****************************************************************************/
-
-/*
- * When a DASD device driver wants to report an error, it calls the
- * function dasd_eer_write_trigger (via a notifier mechanism) and gives the
- * respective trigger ID as parameter.
- * Currently there are four kinds of triggers:
- *
- * DASD_EER_FATALERROR:  all kinds of unrecoverable I/O problems
- * DASD_EER_PPRCSUSPEND: PPRC was suspended
- * DASD_EER_NOPATH:      There is no path to the device left.
- * DASD_EER_STATECHANGE: The state of the device has changed.
- *
- * For the first three triggers all required information can be supplied by
- * the caller. For these triggers a record is written by the function
- * dasd_eer_write_standard_trigger.
- *
- * When dasd_eer_write_trigger is called to write a DASD_EER_STATECHANGE
- * trigger, we have to gather the necessary sense data first. We cannot queue
- * the necessary SNSS (sense subsystem status) request immediatly, since we
- * are likely to run in a deadlock situation. Instead, we schedule a
- * work_struct that calls the function dasd_eer_sense_subsystem_status to
- * create and start an SNSS  request asynchronously.
- *
- * To avoid memory allocations at runtime, the necessary memory is allocated
- * when the extended error reporting is enabled for a device (by
- * dasd_eer_probe). There is one private eer data structure for each eer
- * enabled DASD device. It contains memory for the work_struct, one SNSS cqr
- * and a flags field that is used to coordinate the use of the cqr. The call
- * to write a state change trigger can come in at any time, so we have one flag
- * CQR_IN_USE that protects the cqr itself. When this flag indicates that the
- * cqr is currently in use, dasd_eer_sense_subsystem_status cannot start a
- * second request but sets the SNSS_REQUESTED flag instead.
- *
- * When the request is finished, the callback function dasd_eer_SNSS_cb
- * is called. This function will invoke the function
- * dasd_eer_write_SNSS_trigger to finally write the trigger. It will also
- * check the SNSS_REQUESTED flag and if it is set it will call
- * dasd_eer_sense_subsystem_status again.
- *
- * To avoid race conditions during the handling of the lock, the flags must
- * be protected by the snsslock.
- */
-
-struct dasd_eer_private {
-        struct dasd_ccw_req *cqr;
-        unsigned long flags;
-        struct work_struct worker;
-};
-
-static void dasd_eer_destroy(struct dasd_device *device,
-                             struct dasd_eer_private *eer);
-static int
-dasd_eer_write_trigger(struct dasd_eer_trigger *trigger);
-static void dasd_eer_sense_subsystem_status(void *data);
-static int dasd_eer_notify(struct notifier_block *self,
-                           unsigned long action, void *data);
-
-struct workqueue_struct *dasd_eer_workqueue;
-
-#define SNSS_DATA_SIZE 44
-static spinlock_t snsslock = SPIN_LOCK_UNLOCKED;
-
-#define DASD_EER_BUSID_SIZE 10
-struct dasd_eer_header {
-        __u32 total_size;
-        __u32 trigger;
-        __u64 tv_sec;
-        __u64 tv_usec;
-        char busid[DASD_EER_BUSID_SIZE];
-} __attribute__ ((packed));
-
-static struct notifier_block dasd_eer_nb = {
-        .notifier_call = dasd_eer_notify,
-};
-
-/*
- * flags for use with dasd_eer_private
- */
-#define CQR_IN_USE     0
-#define SNSS_REQUESTED 1
-
-/*
- * This function checks if extended error reporting is available for a given
- * dasd_device. If yes, then it creates and returns a struct dasd_eer,
- * otherwise it returns an -EPERM error pointer.
- */
-struct dasd_eer_private *
-dasd_eer_probe(struct dasd_device *device)
-{
-        struct dasd_eer_private *private;
-
-        if (!(device && device->discipline
-              && !strcmp(device->discipline->name, "ECKD"))) {
-                return ERR_PTR(-EPERM);
-        }
-        /* allocate the private data structure */
-        private = (struct dasd_eer_private *)kmalloc(
-                sizeof(struct dasd_eer_private), GFP_KERNEL);
-        if (!private) {
-                return ERR_PTR(-ENOMEM);
-        }
-        INIT_WORK(&private->worker, dasd_eer_sense_subsystem_status,
-                  (void *)device);
-        private->cqr = dasd_kmalloc_request("ECKD",
-                                            1 /* SNSS */ ,
-                                            SNSS_DATA_SIZE ,
-                                            device);
-        if (!private->cqr) {
-                kfree(private);
-                return ERR_PTR(-ENOMEM);
-        }
-        private->flags = 0;
-        return private;
-};
-
-/*
- * If our private SNSS request is queued, remove it from the
- * dasd ccw queue so we can free the requests memory.
- */
-static void
-dasd_eer_dequeue_SNSS_request(struct dasd_device *device,
-                              struct dasd_eer_private *eer)
-{
-        struct list_head *lst, *nxt;
-        struct dasd_ccw_req *cqr, *erpcqr;
-        dasd_erp_fn_t erp_fn;
-
-        spin_lock_irq(get_ccwdev_lock(device->cdev));
-        list_for_each_safe(lst, nxt, &device->ccw_queue) {
-                cqr = list_entry(lst, struct dasd_ccw_req, list);
-                /* we are looking for two kinds or requests */
-                /* first kind: our SNSS request: */
-                if (cqr == eer->cqr) {
-                        if (cqr->status == DASD_CQR_IN_IO)
-                                device->discipline->term_IO(cqr);
-                        list_del(&cqr->list);
-                        break;
-                }
-                /* second kind: ERP requests for our SNSS request */
-                if (cqr->refers) {
-                        /* If this erp request chain ends in our cqr, then */
-                        /* cal the erp_postaction to clean it up  */
-                        erpcqr = cqr;
-                        while (erpcqr->refers) {
-                                erpcqr = erpcqr->refers;
-                        }
-                        if (erpcqr == eer->cqr) {
-                                erp_fn = device->discipline->erp_postaction(
-                                         cqr);
-                                erp_fn(cqr);
-                        }
-                        continue;
-                }
-        }
-        spin_unlock_irq(get_ccwdev_lock(device->cdev));
-}
-
-/*
- * This function dismantles a struct dasd_eer that was created by
- * dasd_eer_probe. Since we want to free our private data structure,
- * we must make sure that the memory is not in use anymore.
- * We have to flush the work queue and remove a possible SNSS request
- * from the dasd queue.
- */
-static void
-dasd_eer_destroy(struct dasd_device *device, struct dasd_eer_private *eer)
-{
-        flush_workqueue(dasd_eer_workqueue);
-        dasd_eer_dequeue_SNSS_request(device, eer);
-        dasd_kfree_request(eer->cqr, device);
-        kfree(eer);
-};
-
-/*
- * enable the extended error reporting for a particular device
- */
-static int
-dasd_eer_enable_on_device(struct dasd_device *device)
-{
-        void *eer;
-        if (!device)
-                return -ENODEV;
-        if (device->eer)
-                return 0;
-        if (!try_module_get(THIS_MODULE)) {
-                return -EINVAL;
-        }
-        eer = (void *)dasd_eer_probe(device);
-        if (IS_ERR(eer)) {
-                module_put(THIS_MODULE);
-                return PTR_ERR(eer);
-        }
-        device->eer = eer;
-        return 0;
-}
-
-/*
- * enable the extended error reporting for a particular device
- */
-static int
-dasd_eer_disable_on_device(struct dasd_device *device)
-{
-        struct dasd_eer_private *eer = device->eer;
-
-        if (!device)
-                return -ENODEV;
-        if (!device->eer)
-                return 0;
-        device->eer = NULL;
-        dasd_eer_destroy(device,eer);
-        module_put(THIS_MODULE);
-
-        return 0;
-}
-
-/*
- * Set extended error reporting (eer)
- * Note: This will be registered as a DASD ioctl, to be called on DASD devices.
- */
-static int
-dasd_ioctl_set_eer(struct block_device *bdev, int no, long args)
-{
-        struct dasd_device *device;
-        int intval;
-
-        if (!capable(CAP_SYS_ADMIN))
-                return -EACCES;
-        if (bdev != bdev->bd_contains)
-                /* Error-reporting is not allowed for partitions */
-                return -EINVAL;
-        if (get_user(intval, (int __user *) args))
-                return -EFAULT;
-        device =  bdev->bd_disk->private_data;
-        if (device == NULL)
-                return -ENODEV;
-
-        intval = (intval != 0);
-        DEV_MESSAGE (KERN_DEBUG, device,
-                     "set eer on device to %d", intval);
-        if (intval)
-                return dasd_eer_enable_on_device(device);
-        else
-                return dasd_eer_disable_on_device(device);
-}
-
-/*
- * Get value of extended error reporting.
- * Note: This will be registered as a DASD ioctl, to be called on DASD devices.
- */
-static int
-dasd_ioctl_get_eer(struct block_device *bdev, int no, long args)
-{
-        struct dasd_device *device;
-
-        device =  bdev->bd_disk->private_data;
-        if (device == NULL)
-                return -ENODEV;
-        return put_user((device->eer != NULL), (int __user *) args);
-}
-
-/*
- * The following function can be used for those triggers that have
- * all necessary data available when the function is called.
- * If the parameter cqr is not NULL, the chain of requests will be searched
- * for valid sense data, and all valid sense data sets will be added to
- * the triggers data.
- */
-static int
-dasd_eer_write_standard_trigger(int trigger, struct dasd_device *device,
-                                struct dasd_ccw_req *cqr)
-{
-        struct dasd_ccw_req *temp_cqr;
-        int data_size;
-        struct timeval tv;
-        struct dasd_eer_header header;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        /* go through cqr chain and count the valid sense data sets */
-        temp_cqr = cqr;
-        data_size = 0;
-        while (temp_cqr) {
-                if (temp_cqr->irb.esw.esw0.erw.cons)
-                        data_size += 32;
-                temp_cqr = temp_cqr->refers;
-        }
-
-        header.total_size = sizeof(header) + data_size + 4; /* "EOR" */
-        header.trigger = trigger;
-        do_gettimeofday(&tv);
-        header.tv_sec = tv.tv_sec;
-        header.tv_usec = tv.tv_usec;
-        strncpy(header.busid, device->cdev->dev.bus_id, DASD_EER_BUSID_SIZE);
-
-        spin_lock_irqsave(&bufferlock, flags);
-        list_for_each_entry(eerb, &bufferlist, list) {
-                dasd_eer_start_record(eerb, header.total_size);
-                dasd_eer_write_buffer(eerb, sizeof(header), (char*)(&header));
-                temp_cqr = cqr;
-                while (temp_cqr) {
-                        if (temp_cqr->irb.esw.esw0.erw.cons)
-                                dasd_eer_write_buffer(eerb, 32, cqr->irb.ecw);
-                        temp_cqr = temp_cqr->refers;
-                }
-                dasd_eer_write_buffer(eerb, 4,"EOR");
-        }
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        wake_up_interruptible(&dasd_eer_read_wait_queue);
-
-        return 0;
-}
-
-/*
- * This function writes a DASD_EER_STATECHANGE trigger.
- */
-static void
-dasd_eer_write_SNSS_trigger(struct dasd_device *device,
-                            struct dasd_ccw_req *cqr)
-{
-        int data_size;
-        int snss_rc;
-        struct timeval tv;
-        struct dasd_eer_header header;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        snss_rc = (cqr->status == DASD_CQR_FAILED) ? -EIO : 0;
-        if (snss_rc)
-                data_size = 0;
-        else
-                data_size = SNSS_DATA_SIZE;
-
-        header.total_size = sizeof(header) + data_size + 4; /* "EOR" */
-        header.trigger = DASD_EER_STATECHANGE;
-        do_gettimeofday(&tv);
-        header.tv_sec = tv.tv_sec;
-        header.tv_usec = tv.tv_usec;
-        strncpy(header.busid, device->cdev->dev.bus_id, DASD_EER_BUSID_SIZE);
-
-        spin_lock_irqsave(&bufferlock, flags);
-        list_for_each_entry(eerb, &bufferlist, list) {
-                dasd_eer_start_record(eerb, header.total_size);
-                dasd_eer_write_buffer(eerb, sizeof(header),(char*)(&header));
-                if (!snss_rc)
-                        dasd_eer_write_buffer(eerb, SNSS_DATA_SIZE, cqr->data);
-                dasd_eer_write_buffer(eerb, 4,"EOR");
-        }
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        wake_up_interruptible(&dasd_eer_read_wait_queue);
-}
-
-/*
- * callback function for use with SNSS request
- */
-static void
-dasd_eer_SNSS_cb(struct dasd_ccw_req *cqr, void *data)
-{
-        struct dasd_device *device;
-        struct dasd_eer_private *private;
-        unsigned long irqflags;
-
-        device = (struct dasd_device *)data;
-        private = (struct dasd_eer_private *)device->eer;
-        dasd_eer_write_SNSS_trigger(device, cqr);
-        spin_lock_irqsave(&snsslock, irqflags);
-        if(!test_and_clear_bit(SNSS_REQUESTED, &private->flags)) {
-                clear_bit(CQR_IN_USE, &private->flags);
-                spin_unlock_irqrestore(&snsslock, irqflags);
-                return;
-        };
-        clear_bit(CQR_IN_USE, &private->flags);
-        spin_unlock_irqrestore(&snsslock, irqflags);
-        dasd_eer_sense_subsystem_status(device);
-        return;
-}
-
-/*
- * clean a used cqr before using it again
- */
-static void
-dasd_eer_clean_SNSS_request(struct dasd_ccw_req *cqr)
-{
-        struct ccw1 *cpaddr = cqr->cpaddr;
-        void *data = cqr->data;
-
-        memset(cqr, 0, sizeof(struct dasd_ccw_req));
-        memset(cpaddr, 0, sizeof(struct ccw1));
-        memset(data, 0, SNSS_DATA_SIZE);
-        cqr->cpaddr = cpaddr;
-        cqr->data = data;
-        strncpy((char *) &cqr->magic, "ECKD", 4);
-        ASCEBC((char *) &cqr->magic, 4);
-        set_bit(DASD_CQR_FLAGS_USE_ERP, &cqr->flags);
-}
-
-/*
- * build and start an SNSS request
- * This function is called from a work queue so we have to
- * pass the dasd_device pointer as a void pointer.
- */
-static void
-dasd_eer_sense_subsystem_status(void *data)
-{
-        struct dasd_device *device;
-        struct dasd_eer_private *private;
-        struct dasd_ccw_req *cqr;
-        struct ccw1 *ccw;
-        unsigned long irqflags;
-
-        device = (struct dasd_device *)data;
-        private = (struct dasd_eer_private *)device->eer;
-        if (!private) /* device not eer enabled any more */
-                return;
-        cqr = private->cqr;
-        spin_lock_irqsave(&snsslock, irqflags);
-        if(test_and_set_bit(CQR_IN_USE, &private->flags)) {
-                set_bit(SNSS_REQUESTED, &private->flags);
-                spin_unlock_irqrestore(&snsslock, irqflags);
-                return;
-        };
-        spin_unlock_irqrestore(&snsslock, irqflags);
-        dasd_eer_clean_SNSS_request(cqr);
-        cqr->device = device;
-        cqr->retries = 255;
-        cqr->expires = 10 * HZ;
-
-        ccw = cqr->cpaddr;
-        ccw->cmd_code = DASD_ECKD_CCW_SNSS;
-        ccw->count = SNSS_DATA_SIZE;
-        ccw->flags = 0;
-        ccw->cda = (__u32)(addr_t)cqr->data;
-
-        cqr->buildclk = get_clock();
-        cqr->status = DASD_CQR_FILLED;
-        cqr->callback = dasd_eer_SNSS_cb;
-        cqr->callback_data = (void *)device;
-        dasd_add_request_head(cqr);
-
-        return;
-}
-
-/*
- * This function is called for all triggers. It calls the appropriate
- * function that writes the actual trigger records.
- */
-static int
-dasd_eer_write_trigger(struct dasd_eer_trigger *trigger)
-{
-        int rc;
-        struct dasd_eer_private *private = trigger->device->eer;
-
-        switch (trigger->id) {
-        case DASD_EER_FATALERROR:
-        case DASD_EER_PPRCSUSPEND:
-                rc = dasd_eer_write_standard_trigger(
-                        trigger->id, trigger->device, trigger->cqr);
-                break;
-        case DASD_EER_NOPATH:
-                rc = dasd_eer_write_standard_trigger(
-                        trigger->id, trigger->device, NULL);
-                break;
-        case DASD_EER_STATECHANGE:
-                if (queue_work(dasd_eer_workqueue, &private->worker)) {
-                        rc=0;
-                } else {
-                        /* If the work_struct was already queued, it can't
-                         * be queued again. But this is OK since we don't
-                         * need to have it queued twice.
-                         */
-                        rc = -EBUSY;
-                }
-                break;
-        default: /* unknown trigger, so we write it without any sense data */
-                rc = dasd_eer_write_standard_trigger(
-                        trigger->id, trigger->device, NULL);
-                break;
-        }
-        return rc;
-}
-
-/*
- * This function is registered with the dasd device driver and gets called
- * for all dasd eer notifications.
- */
-static int dasd_eer_notify(struct notifier_block *self,
-                            unsigned long action, void *data)
-{
-        switch (action) {
-        case DASD_EER_DISABLE:
-                dasd_eer_disable_on_device((struct dasd_device *)data);
-                break;
-        case DASD_EER_TRIGGER:
-                dasd_eer_write_trigger((struct dasd_eer_trigger *)data);
-                break;
-        }
-        return NOTIFY_OK;
-}
-
-
-/*****************************************************************************/
-/*      the device operations                                                */
-/*****************************************************************************/
-
-/*
- * On the one side we need a lock to access our internal buffer, on the
- * other side a copy_to_user can sleep. So we need to copy the data we have
- * to transfer in a readbuffer, which is protected by the readbuffer_mutex.
- */
-static char readbuffer[PAGE_SIZE];
-DECLARE_MUTEX(readbuffer_mutex);
-
-
-static int
-dasd_eer_open(struct inode *inp, struct file *filp)
-{
-        struct eerbuffer *eerb;
-        unsigned long flags;
-
-        eerb = kmalloc(sizeof(struct eerbuffer), GFP_KERNEL);
-        eerb->head = 0;
-        eerb->tail = 0;
-        eerb->residual = 0;
-        eerb->buffer_page_count = 1;
-        eerb->buffersize = eerb->buffer_page_count * PAGE_SIZE;
-        eerb->buffer = kmalloc(eerb->buffer_page_count*sizeof(char*),
-                               GFP_KERNEL);
-        if (!eerb->buffer)
-                return -ENOMEM;
-        if (dasd_eer_allocate_buffer_pages(eerb->buffer,
-                                           eerb->buffer_page_count)) {
-                kfree(eerb->buffer);
-                return -ENOMEM;
-        }
-        filp->private_data = eerb;
-        spin_lock_irqsave(&bufferlock, flags);
-        list_add(&eerb->list, &bufferlist);
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        return nonseekable_open(inp,filp);
-}
-
-static int
-dasd_eer_close(struct inode *inp, struct file *filp)
-{
-        struct eerbuffer *eerb;
-        unsigned long flags;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        spin_lock_irqsave(&bufferlock, flags);
-        list_del(&eerb->list);
-        spin_unlock_irqrestore(&bufferlock, flags);
-        dasd_eer_free_buffer_pages(eerb->buffer, eerb->buffer_page_count);
-        kfree(eerb->buffer);
-        kfree(eerb);
-
-        return 0;
-}
-
-static long
-dasd_eer_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-{
-        int intval;
-        struct eerbuffer *eerb;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        switch (cmd) {
-        case DASD_EER_PURGE:
-                dasd_eer_purge_buffer(eerb);
-                return 0;
-        case DASD_EER_SETBUFSIZE:
-                if (get_user(intval, (int __user *)arg))
-                        return -EFAULT;
-                return dasd_eer_resize_buffer(eerb, intval);
-        default:
-                return -ENOIOCTLCMD;
-        }
-}
-
-static ssize_t
-dasd_eer_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
-{
-        int tc,rc;
-        int tailcount,effective_count;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        if(down_interruptible(&readbuffer_mutex))
-                return -ERESTARTSYS;
-
-        spin_lock_irqsave(&bufferlock, flags);
-
-        if (eerb->residual < 0) { /* the remainder of this record */
-                                  /* has been deleted             */
-                eerb->residual = 0;
-                spin_unlock_irqrestore(&bufferlock, flags);
-                up(&readbuffer_mutex);
-                return -EIO;
-        } else if (eerb->residual > 0) {
-                /* OK we still have a second half of a record to deliver */
-                effective_count = min(eerb->residual, (int)count);
-                eerb->residual -= effective_count;
-        } else {
-                tc = 0;
-                while (!tc) {
-                        tc = dasd_eer_read_buffer(eerb,
-                                sizeof(tailcount), (char*)(&tailcount));
-                        if (!tc) {
-                                /* no data available */
-                                spin_unlock_irqrestore(&bufferlock, flags);
-                                up(&readbuffer_mutex);
-                                if (filp->f_flags & O_NONBLOCK)
-                                        return -EAGAIN;
-                                rc = wait_event_interruptible(
-                                        dasd_eer_read_wait_queue,
-                                        eerb->head != eerb->tail);
-                                if (rc) {
-                                        return rc;
-                                }
-                                if(down_interruptible(&readbuffer_mutex))
-                                        return -ERESTARTSYS;
-                                spin_lock_irqsave(&bufferlock, flags);
-                        }
-                }
-                WARN_ON(tc != sizeof(tailcount));
-                effective_count = min(tailcount,(int)count);
-                eerb->residual = tailcount - effective_count;
-        }
-
-        tc = dasd_eer_read_buffer(eerb, effective_count, readbuffer);
-        WARN_ON(tc != effective_count);
-
-        spin_unlock_irqrestore(&bufferlock, flags);
-
-        if (copy_to_user(buf, readbuffer, effective_count)) {
-                up(&readbuffer_mutex);
-                return -EFAULT;
-        }
-
-        up(&readbuffer_mutex);
-        return effective_count;
-}
-
-static unsigned int
-dasd_eer_poll (struct file *filp, poll_table *ptable)
-{
-        unsigned int mask;
-        unsigned long flags;
-        struct eerbuffer *eerb;
-
-        eerb = (struct eerbuffer *)filp->private_data;
-        poll_wait(filp, &dasd_eer_read_wait_queue, ptable);
-        spin_lock_irqsave(&bufferlock, flags);
-        if (eerb->head != eerb->tail)
-                mask = POLLIN | POLLRDNORM ;
-        else
-                mask = 0;
-        spin_unlock_irqrestore(&bufferlock, flags);
-        return mask;
-}
-
-static struct file_operations dasd_eer_fops = {
-        .open           = &dasd_eer_open,
-        .release        = &dasd_eer_close,
-        .unlocked_ioctl = &dasd_eer_ioctl,
-        .compat_ioctl   = &dasd_eer_ioctl,
-        .read           = &dasd_eer_read,
-        .poll           = &dasd_eer_poll,
-        .owner          = THIS_MODULE,
-};
-
-static struct miscdevice dasd_eer_dev = {
-        .minor      = MISC_DYNAMIC_MINOR,
-        .name       = "dasd_eer",
-        .fops       = &dasd_eer_fops,
-};
-
-
-/*****************************************************************************/
-/*      Init and exit                                                        */
-/*****************************************************************************/
-
-static int
-__init dasd_eer_init(void)
-{
-        int rc;
-
-        dasd_eer_workqueue = create_singlethread_workqueue("dasd_eer");
-        if (!dasd_eer_workqueue) {
-                MESSAGE(KERN_ERR , "%s", "dasd_eer_init could not "
-                       "create workqueue \n");
-                rc = -ENOMEM;
-                goto out;
-        }
-
-        rc = dasd_register_eer_notifier(&dasd_eer_nb);
-        if (rc) {
-                MESSAGE(KERN_ERR, "%s", "dasd_eer_init could not "
-                       "register error reporting");
-                goto queue;
-        }
-
-        dasd_ioctl_no_register(THIS_MODULE, BIODASDEERSET, dasd_ioctl_set_eer);
-        dasd_ioctl_no_register(THIS_MODULE, BIODASDEERGET, dasd_ioctl_get_eer);
-
-        /* we don't need our own character device,
-         * so we just register as misc device */
-        rc = misc_register(&dasd_eer_dev);
-        if (rc) {
-                MESSAGE(KERN_ERR, "%s", "dasd_eer_init could not "
-                       "register misc device");
-                goto unregister;
-        }
-
-        return 0;
-
-unregister:
-        dasd_unregister_eer_notifier(&dasd_eer_nb);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERSET,
-                                 dasd_ioctl_set_eer);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERGET,
-                                 dasd_ioctl_get_eer);
-queue:
-        destroy_workqueue(dasd_eer_workqueue);
-out:
-        return rc;
-
-}
-module_init(dasd_eer_init);
-
-static void
-__exit dasd_eer_exit(void)
-{
-        dasd_unregister_eer_notifier(&dasd_eer_nb);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERSET,
-                                 dasd_ioctl_set_eer);
-        dasd_ioctl_no_unregister(THIS_MODULE, BIODASDEERGET,
-                                 dasd_ioctl_get_eer);
-        destroy_workqueue(dasd_eer_workqueue);
-
-        WARN_ON(misc_deregister(&dasd_eer_dev) != 0);
-}
-module_exit(dasd_eer_exit);
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index d1b08fa13fd2..0592354cc604 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -275,34 +275,6 @@ struct dasd_discipline {
 
 extern struct dasd_discipline *dasd_diag_discipline_pointer;
 
-
-/*
- * Notification numbers for extended error reporting notifications:
- * The DASD_EER_DISABLE notification is sent before a dasd_device (and it's
- * eer pointer) is freed. The error reporting module needs to do all necessary
- * cleanup steps.
- * The DASD_EER_TRIGGER notification sends the actual error reports (triggers).
- */
-#define DASD_EER_DISABLE 0
-#define DASD_EER_TRIGGER 1
-
-/* Trigger IDs for extended error reporting DASD_EER_TRIGGER notification */
-#define DASD_EER_FATALERROR  1
-#define DASD_EER_NOPATH      2
-#define DASD_EER_STATECHANGE 3
-#define DASD_EER_PPRCSUSPEND 4
-
-/*
- * The dasd_eer_trigger structure contains all data that we need to send
- * along with an DASD_EER_TRIGGER notification.
- */
-struct dasd_eer_trigger {
-        unsigned int id;
-        struct dasd_device *device;
-        struct dasd_ccw_req *cqr;
-};
-
-
 struct dasd_device {
         /* Block device stuff. */
         struct gendisk *gdp;
@@ -316,11 +288,9 @@ struct dasd_device {
         unsigned long flags;            /* per device flags */
         unsigned short features;        /* copy of devmap-features (read-only!) */
 
-        /* extended error reporting stuff (eer) */
-        void *eer;
-
         /* Device discipline stuff. */
         struct dasd_discipline *discipline;
+        struct dasd_discipline *base_discipline;
         char *private;
 
         /* Device state and target state. */
@@ -519,12 +489,6 @@ int dasd_generic_set_online(struct ccw_device *, struct dasd_discipline *);
 int dasd_generic_set_offline (struct ccw_device *cdev);
 int dasd_generic_notify(struct ccw_device *, int);
 void dasd_generic_auto_online (struct ccw_driver *);
-int dasd_register_eer_notifier(struct notifier_block *);
-int dasd_unregister_eer_notifier(struct notifier_block *);
-void dasd_write_eer_trigger(unsigned int , struct dasd_device *,
-                        struct dasd_ccw_req *);
-
-
 
 /* externals in dasd_devmap.c */
 extern int dasd_max_devindex;
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 062fb100d94c..afc4e88551ad 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -359,7 +359,7 @@ ccw_device_set_online(struct ccw_device *cdev)
         else 
                 pr_debug("ccw_device_offline returned %d, device %s\n",
                          ret, cdev->dev.bus_id);
-        return (ret = 0) ? -ENODEV : ret;
+        return (ret == 0) ? -ENODEV : ret;
 }
 
 static ssize_t
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index d2a5b04d7cba..85b1020a1fcc 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -405,7 +405,7 @@ __ccw_device_disband_start(struct ccw_device *cdev)
                 cdev->private->iretry = 5;
                 cdev->private->imask >>= 1;
         }
-        ccw_device_verify_done(cdev, (sch->lpm != 0) ? 0 : -ENODEV);
+        ccw_device_disband_done(cdev, (sch->lpm != 0) ? 0 : -ENODEV);
 }
 
 /*
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index dad4dd9887c9..6c762b43f921 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -317,7 +317,6 @@ ccw_device_do_sense(struct ccw_device *cdev, struct irb *irb)
         /*
          * We have ending status but no sense information. Do a basic sense.
          */
-        sch = to_subchannel(cdev->dev.parent);
         sch->sense_ccw.cmd_code = CCW_CMD_BASIC_SENSE;
         sch->sense_ccw.cda = (__u32) __pa(cdev->private->irb.ecw);
         sch->sense_ccw.count = SENSE_MAX_COUNT;
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 45ce032772f4..9ed37dc9a1b0 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -165,8 +165,13 @@ qdio_do_eqbs(struct qdio_q *q, unsigned char *state,
         q_no = q->q_no;
         if(!q->is_input_q)
                 q_no += irq->no_input_qs;
+again:
         ccq = do_eqbs(irq->sch_token, state, q_no, start, cnt);
         rc = qdio_check_ccq(q, ccq);
+        if (rc == 1) {
+                QDIO_DBF_TEXT5(1,trace,"eqAGAIN");
+                goto again;
+        }
         if (rc < 0) {
                 QDIO_DBF_TEXT2(1,trace,"eqberr");
                 sprintf(dbf_text,"%2x,%2x,%d,%d",tmp_cnt, *cnt, ccq, q_no);
@@ -195,8 +200,13 @@ qdio_do_sqbs(struct qdio_q *q, unsigned char state,
         q_no = q->q_no;
         if(!q->is_input_q)
                 q_no += irq->no_input_qs;
+again:
         ccq = do_sqbs(irq->sch_token, state, q_no, start, cnt);
         rc = qdio_check_ccq(q, ccq);
+        if (rc == 1) {
+                QDIO_DBF_TEXT5(1,trace,"sqAGAIN");
+                goto again;
+        }
         if (rc < 0) {
                 QDIO_DBF_TEXT3(1,trace,"sqberr");
                 sprintf(dbf_text,"%2x,%2x,%d,%d",tmp_cnt,*cnt,ccq,q_no);
@@ -1187,8 +1197,7 @@ tiqdio_is_inbound_q_done(struct qdio_q *q)
 
         if (!no_used)
                 return 1;
-
-        if (!q->siga_sync)
+        if (!q->siga_sync && !irq->is_qebsm)
                 /* we'll check for more primed buffers in qeth_stop_polling */
                 return 0;
         if (irq->is_qebsm) {
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 6229ba4995ad..9cf88d7201d3 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -98,9 +98,9 @@ lcs_register_debug_facility(void)
                 return -ENOMEM;
         }
         debug_register_view(lcs_dbf_setup, &debug_hex_ascii_view);
-        debug_set_level(lcs_dbf_setup, 4);
+        debug_set_level(lcs_dbf_setup, 2);
         debug_register_view(lcs_dbf_trace, &debug_hex_ascii_view);
-        debug_set_level(lcs_dbf_trace, 4);
+        debug_set_level(lcs_dbf_trace, 2);
         return 0;
 }
 
@@ -1292,9 +1292,8 @@ lcs_set_multicast_list(struct net_device *dev)
         LCS_DBF_TEXT(4, trace, "setmulti");
         card = (struct lcs_card *) dev->priv;
 
-        if (!lcs_set_thread_start_bit(card, LCS_SET_MC_THREAD)) {
+        if (!lcs_set_thread_start_bit(card, LCS_SET_MC_THREAD)) 
                 schedule_work(&card->kernel_thread_starter);
-        }
 }
 
 #endif /* CONFIG_IP_MULTICAST */
@@ -1459,6 +1458,8 @@ lcs_txbuffer_cb(struct lcs_channel *channel, struct lcs_buffer *buffer)
         lcs_release_buffer(channel, buffer);
         card = (struct lcs_card *)
                 ((char *) channel - offsetof(struct lcs_card, write));
+        if (netif_queue_stopped(card->dev))
+                netif_wake_queue(card->dev);
         spin_lock(&card->lock);
         card->tx_emitted--;
         if (card->tx_emitted <= 0 && card->tx_buffer != NULL)
@@ -1478,6 +1479,7 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
                  struct net_device *dev)
 {
         struct lcs_header *header;
+        int rc = 0;
 
         LCS_DBF_TEXT(5, trace, "hardxmit");
         if (skb == NULL) {
@@ -1492,10 +1494,8 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
                 card->stats.tx_carrier_errors++;
                 return 0;
         }
-        if (netif_queue_stopped(dev) ) {
-                card->stats.tx_dropped++;
-                return -EBUSY;
-        }
+        netif_stop_queue(card->dev);
+        spin_lock(&card->lock);
         if (card->tx_buffer != NULL &&
             card->tx_buffer->count + sizeof(struct lcs_header) +
             skb->len + sizeof(u16) > LCS_IOBUFFERSIZE)
@@ -1506,7 +1506,8 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
                 card->tx_buffer = lcs_get_buffer(&card->write);
                 if (card->tx_buffer == NULL) {
                         card->stats.tx_dropped++;
-                        return -EBUSY;
+                        rc = -EBUSY;
+                        goto out;
                 }
                 card->tx_buffer->callback = lcs_txbuffer_cb;
                 card->tx_buffer->count = 0;
@@ -1518,13 +1519,18 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb,
         header->type = card->lan_type;
         header->slot = card->portno;
         memcpy(header + 1, skb->data, skb->len);
+        spin_unlock(&card->lock);
         card->stats.tx_bytes += skb->len;
         card->stats.tx_packets++;
         dev_kfree_skb(skb);
-        if (card->tx_emitted <= 0)
+        netif_wake_queue(card->dev);
+        spin_lock(&card->lock);
+        if (card->tx_emitted <= 0 && card->tx_buffer != NULL)
                 /* If this is the first tx buffer emit it immediately. */
                 __lcs_emit_txbuffer(card);
-        return 0;
+out:
+        spin_unlock(&card->lock);
+        return rc;
 }
 
 static int
@@ -1535,9 +1541,7 @@ lcs_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         LCS_DBF_TEXT(5, trace, "pktxmit");
         card = (struct lcs_card *) dev->priv;
-        spin_lock(&card->lock);
         rc = __lcs_start_xmit(card, skb, dev);
-        spin_unlock(&card->lock);
         return rc;
 }
 
@@ -2319,7 +2323,6 @@ __init lcs_init_module(void)
                 PRINT_ERR("Initialization failed\n");
                 return rc;
         }
-
         return 0;
 }
 
diff --git a/drivers/s390/net/lcs.h b/drivers/s390/net/lcs.h
index 08e60ad43916..2fad5e40c2e4 100644
--- a/drivers/s390/net/lcs.h
+++ b/drivers/s390/net/lcs.h
@@ -95,7 +95,7 @@ do {                                       \
  */
 #define LCS_ILLEGAL_OFFSET              0xffff
 #define LCS_IOBUFFERSIZE                0x5000
-#define LCS_NUM_BUFFS                   8       /* needs to be power of 2 */
+#define LCS_NUM_BUFFS                   32      /* needs to be power of 2 */
 #define LCS_MAC_LENGTH                  6
 #define LCS_INVALID_PORT_NO             -1
 #define LCS_LANCMD_TIMEOUT_DEFAULT      5
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 9a064d4727ad..4df0fcd7b10b 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -1076,16 +1076,6 @@ qeth_get_qdio_q_format(struct qeth_card *card)
 }
 
 static inline int
-qeth_isdigit(char * buf)
-{
-        while (*buf) {
-                if (!isdigit(*buf++))
-                        return 0;
-        }
-        return 1;
-}
-
-static inline int
 qeth_isxdigit(char * buf)
 {
         while (*buf) {
@@ -1104,33 +1094,17 @@ qeth_ipaddr4_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr4(const char *buf, __u8 *addr)
 {
-        const char *start, *end;
-        char abuf[4];
-        char *tmp;
-        int len;
-        int i;
-
-        start = buf;
-        for (i = 0; i < 4; i++) {
-                if (i == 3) {
-                        end = strchr(start,0xa);
-                        if (end)
-                                len = end - start;
-                        else            
-                                len = strlen(start);
-                }
-                else {
-                        end = strchr(start, '.');
-                        len = end - start;
-                }
-                if ((len <= 0) || (len > 3))
-                        return -EINVAL;
-                memset(abuf, 0, 4);
-                strncpy(abuf, start, len);
-                if (!qeth_isdigit(abuf))
+        int count = 0, rc = 0;
+        int in[4];
+
+        rc = sscanf(buf, "%d.%d.%d.%d%n", 
+                    &in[0], &in[1], &in[2], &in[3], &count);
+        if (rc != 4  || count) 
+                return -EINVAL;
+        for (count = 0; count < 4; count++) {
+                if (in[count] > 255)
                         return -EINVAL;
-                addr[i] = simple_strtoul(abuf, &tmp, 10);
-                start = end + 1;
+                addr[count] = in[count];
         }
         return 0;
 }
@@ -1149,36 +1123,44 @@ qeth_ipaddr6_to_string(const __u8 *addr, char *buf)
 static inline int
 qeth_string_to_ipaddr6(const char *buf, __u8 *addr)
 {
-        const char *start, *end;
-        u16 *tmp_addr;
-        char abuf[5];
-        char *tmp;
-        int len;
-        int i;
-
-        tmp_addr = (u16 *)addr;
-        start = buf;
-        for (i = 0; i < 8; i++) {
-                if (i == 7) {
-                        end = strchr(start,0xa);
-                        if (end)
-                                len = end - start;
-                        else
-                                len = strlen(start);
-                }
-                else {
-                        end = strchr(start, ':');
-                        len = end - start;
+        char *end, *start;
+        __u16 *in;
+        char num[5];
+        int num2, cnt, out, found, save_cnt;
+        unsigned short in_tmp[8] = {0, };
+
+        cnt = out = found = save_cnt = num2 = 0;
+        end = start = (char *) buf;
+        in = (__u16 *) addr;    
+        memset(in, 0, 16);
+        while (end) {
+                end = strchr(end,':');
+                if (end == NULL) {
+                        end = (char *)buf + (strlen(buf));
+                        out = 1;
+                }
+                if ((end - start)) { 
+                        memset(num, 0, 5);
+                        memcpy(num, start, end - start);
+                        if (!qeth_isxdigit(num))
+                                return -EINVAL;
+                        sscanf(start, "%x", &num2);
+                        if (found)
+                                in_tmp[save_cnt++] = num2;
+                        else
+                                in[cnt++] = num2;
+                        if (out)
+                                break;
+                } else {
+                        if (found)
+                                return -EINVAL;
+                        found = 1;
                 }
-                if ((len <= 0) || (len > 4))
-                        return -EINVAL;
-                memset(abuf, 0, 5);
-                strncpy(abuf, start, len);
-                if (!qeth_isxdigit(abuf))
-                        return -EINVAL;
-                tmp_addr[i] = simple_strtoul(abuf, &tmp, 16);
-                start = end + 1;
-        }
+                start = ++end;
+        }
+        cnt = 7;
+        while (save_cnt)
+                in[cnt--] = in_tmp[--save_cnt];
         return 0;
 }
 
diff --git a/drivers/s390/net/qeth_eddp.c b/drivers/s390/net/qeth_eddp.c
index b02313127780..82cb4af2f0e7 100644
--- a/drivers/s390/net/qeth_eddp.c
+++ b/drivers/s390/net/qeth_eddp.c
@@ -59,8 +59,7 @@ qeth_eddp_free_context(struct qeth_eddp_context *ctx)
         for (i = 0; i < ctx->num_pages; ++i)
                 free_page((unsigned long)ctx->pages[i]);
         kfree(ctx->pages);
-        if (ctx->elements != NULL)
-                kfree(ctx->elements);
+        kfree(ctx->elements);
         kfree(ctx);
 }
 
@@ -413,6 +412,13 @@ __qeth_eddp_fill_context_tcp(struct qeth_eddp_context *ctx,
         
         QETH_DBF_TEXT(trace, 5, "eddpftcp");
         eddp->skb_offset = sizeof(struct qeth_hdr) + eddp->nhl + eddp->thl;
+       if (eddp->qh.hdr.l2.id == QETH_HEADER_TYPE_LAYER2) {
+               eddp->skb_offset += sizeof(struct ethhdr);
+#ifdef CONFIG_QETH_VLAN
+               if (eddp->mac.h_proto == __constant_htons(ETH_P_8021Q))
+                       eddp->skb_offset += VLAN_HLEN;
+#endif /* CONFIG_QETH_VLAN */
+       }
         tcph = eddp->skb->h.th;
         while (eddp->skb_offset < eddp->skb->len) {
                 data_len = min((int)skb_shinfo(eddp->skb)->tso_size,
@@ -483,6 +489,7 @@ qeth_eddp_fill_context_tcp(struct qeth_eddp_context *ctx,
                 return -ENOMEM;
         }
         if (qhdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2) {
+                skb->mac.raw = (skb->data) + sizeof(struct qeth_hdr);
                 memcpy(&eddp->mac, eth_hdr(skb), ETH_HLEN);
 #ifdef CONFIG_QETH_VLAN
                 if (eddp->mac.h_proto == __constant_htons(ETH_P_8021Q)) {
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 410abeada6c4..dba7f7f02e79 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -516,7 +516,8 @@ __qeth_set_offline(struct ccwgroup_device *cgdev, int recovery_mode)
         QETH_DBF_TEXT(setup, 3, "setoffl");
         QETH_DBF_HEX(setup, 3, &card, sizeof(void *));
         
-        netif_carrier_off(card->dev);
+        if (card->dev && netif_carrier_ok(card->dev))
+                netif_carrier_off(card->dev);
         recover_flag = card->state;
         if (qeth_stop_card(card, recovery_mode) == -ERESTARTSYS){
                 PRINT_WARN("Stopping card %s interrupted by user!\n",
@@ -1679,6 +1680,7 @@ qeth_cmd_timeout(unsigned long data)
         spin_unlock_irqrestore(&reply->card->lock, flags);
 }
 
+
 static struct qeth_ipa_cmd *
 qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
 {
@@ -1699,7 +1701,8 @@ qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
                                            QETH_CARD_IFNAME(card),
                                            card->info.chpid);
                                 card->lan_online = 0;
-                                netif_carrier_off(card->dev);
+                                if (card->dev && netif_carrier_ok(card->dev))
+                                        netif_carrier_off(card->dev);
                                 return NULL;
                         case IPA_CMD_STARTLAN:
                                 PRINT_INFO("Link reestablished on %s "
@@ -5562,7 +5565,7 @@ qeth_set_multicast_list(struct net_device *dev)
         if (card->info.type == QETH_CARD_TYPE_OSN)
                 return ;
          
-        QETH_DBF_TEXT(trace,3,"setmulti");
+        QETH_DBF_TEXT(trace, 3, "setmulti");
         qeth_delete_mc_addresses(card);
         if (card->options.layer2) {
                 qeth_layer2_add_multicast(card);
@@ -5579,7 +5582,6 @@ out:
                 return;
         if (qeth_set_thread_start_bit(card, QETH_SET_PROMISC_MODE_THREAD)==0)
                 schedule_work(&card->kernel_thread_starter);
-
 }
 
 static int
@@ -7452,6 +7454,7 @@ qeth_softsetup_card(struct qeth_card *card)
                 card->lan_online = 1;
         if (card->info.type==QETH_CARD_TYPE_OSN)
                 goto out;
+        qeth_set_large_send(card, card->options.large_send);
         if (card->options.layer2) {
                 card->dev->features |=
                         NETIF_F_HW_VLAN_FILTER |
@@ -7468,12 +7471,6 @@ qeth_softsetup_card(struct qeth_card *card)
 #endif
                 goto out;
         }
-        if ((card->options.large_send == QETH_LARGE_SEND_EDDP) ||
-            (card->options.large_send == QETH_LARGE_SEND_TSO))
-                card->dev->features |= NETIF_F_TSO | NETIF_F_SG;
-        else
-                card->dev->features &= ~(NETIF_F_TSO | NETIF_F_SG);
-
         if ((rc = qeth_setadapter_parms(card)))
                 QETH_DBF_TEXT_(setup, 2, "2err%d", rc);
         if ((rc = qeth_start_ipassists(card)))
diff --git a/drivers/scsi/esp.c b/drivers/scsi/esp.c
index f6900538be90..87a8c3d2072c 100644
--- a/drivers/scsi/esp.c
+++ b/drivers/scsi/esp.c
@@ -2068,14 +2068,12 @@ static int esp_reset(struct scsi_cmnd *SCptr)
 {
         struct esp *esp = (struct esp *) SCptr->device->host->hostdata;
 
+        spin_lock_irq(esp->ehost->host_lock);
         (void) esp_do_resetbus(esp);
-
         spin_unlock_irq(esp->ehost->host_lock);
 
         wait_event(esp->reset_queue, (esp->resetting_bus == 0));
 
-        spin_lock_irq(esp->ehost->host_lock);
-
         return SUCCESS;
 }
 
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 46c4cdbaee86..5f1d7580218d 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -614,7 +614,7 @@ int ata_rwcmd_protocol(struct ata_queued_cmd *qc)
         } else if (lba48 && (qc->ap->flags & ATA_FLAG_PIO_LBA48)) {
                 /* Unable to use DMA due to host limitation */
                 tf->protocol = ATA_PROT_PIO;
-                index = dev->multi_count ? 0 : 4;
+                index = dev->multi_count ? 0 : 8;
         } else {
                 tf->protocol = ATA_PROT_DMA;
                 index = 16;
@@ -2514,7 +2514,7 @@ static void ata_sg_clean(struct ata_queued_cmd *qc)
         assert(sg != NULL);
 
         if (qc->flags & ATA_QCFLAG_SINGLE)
-                assert(qc->n_elem == 1);
+                assert(qc->n_elem <= 1);
 
         VPRINTK("unmapping %u sg elements\n", qc->n_elem);
 
@@ -2537,7 +2537,7 @@ static void ata_sg_clean(struct ata_queued_cmd *qc)
                         kunmap_atomic(addr, KM_IRQ0);
                 }
         } else {
-                if (sg_dma_len(&sg[0]) > 0)
+                if (qc->n_elem)
                         dma_unmap_single(ap->host_set->dev,
                                 sg_dma_address(&sg[0]), sg_dma_len(&sg[0]),
                                 dir);
@@ -2570,7 +2570,7 @@ static void ata_fill_sg(struct ata_queued_cmd *qc)
         unsigned int idx;
 
         assert(qc->__sg != NULL);
-        assert(qc->n_elem > 0);
+        assert(qc->n_elem > 0 || qc->pad_len > 0);
 
         idx = 0;
         ata_for_each_sg(sg, qc) {
@@ -2715,6 +2715,7 @@ static int ata_sg_setup_one(struct ata_queued_cmd *qc)
         int dir = qc->dma_dir;
         struct scatterlist *sg = qc->__sg;
         dma_addr_t dma_address;
+        int trim_sg = 0;
 
         /* we must lengthen transfers to end on a 32-bit boundary */
         qc->pad_len = sg->length & 3;
@@ -2734,13 +2735,15 @@ static int ata_sg_setup_one(struct ata_queued_cmd *qc)
                 sg_dma_len(psg) = ATA_DMA_PAD_SZ;
                 /* trim sg */
                 sg->length -= qc->pad_len;
+                if (sg->length == 0)
+                        trim_sg = 1;
 
                 DPRINTK("padding done, sg->length=%u pad_len=%u\n",
                         sg->length, qc->pad_len);
         }
 
-        if (!sg->length) {
-                sg_dma_address(sg) = 0;
+        if (trim_sg) {
+                qc->n_elem--;
                 goto skip_map;
         }
 
@@ -2753,9 +2756,9 @@ static int ata_sg_setup_one(struct ata_queued_cmd *qc)
         }
 
         sg_dma_address(sg) = dma_address;
-skip_map:
         sg_dma_len(sg) = sg->length;
 
+skip_map:
         DPRINTK("mapped buffer of %d bytes for %s\n", sg_dma_len(sg),
                 qc->tf.flags & ATA_TFLAG_WRITE ? "write" : "read");
 
@@ -3357,11 +3360,12 @@ static void ata_pio_error(struct ata_port *ap)
 {
         struct ata_queued_cmd *qc;
 
-        printk(KERN_WARNING "ata%u: PIO error\n", ap->id);
-
         qc = ata_qc_from_tag(ap, ap->active_tag);
         assert(qc != NULL);
 
+        if (qc->tf.command != ATA_CMD_PACKET)
+                printk(KERN_WARNING "ata%u: PIO error\n", ap->id);
+
         /* make sure qc->err_mask is available to 
          * know what's wrong and recover
          */
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index 6fddf17a3b70..2770005324b4 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -997,6 +997,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
         case ATA_CMD_READ_EXT:
         case ATA_CMD_WRITE:
         case ATA_CMD_WRITE_EXT:
+        case ATA_CMD_WRITE_FUA_EXT:
                 mv_crqb_pack_cmd(cw++, tf->hob_nsect, ATA_REG_NSECT, 0);
                 break;
 #ifdef LIBATA_NCQ               /* FIXME: remove this line when NCQ added */
diff --git a/drivers/scsi/sata_qstor.c b/drivers/scsi/sata_qstor.c
index de05e2883f9c..80480f0fb2b8 100644
--- a/drivers/scsi/sata_qstor.c
+++ b/drivers/scsi/sata_qstor.c
@@ -277,7 +277,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc)
         u8 *prd = pp->pkt + QS_CPB_BYTES;
 
         assert(qc->__sg != NULL);
-        assert(qc->n_elem > 0);
+        assert(qc->n_elem > 0 || qc->pad_len > 0);
 
         nelem = 0;
         ata_for_each_sg(sg, qc) {
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index 17f74d3c10e7..9face3c6aa21 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -49,11 +49,13 @@
 #define DRV_VERSION     "0.9"
 
 enum {
+        SIL_FLAG_RERR_ON_DMA_ACT = (1 << 29),
         SIL_FLAG_MOD15WRITE     = (1 << 30),
 
         sil_3112                = 0,
         sil_3112_m15w           = 1,
-        sil_3114                = 2,
+        sil_3512                = 2,
+        sil_3114                = 3,
 
         SIL_FIFO_R0             = 0x40,
         SIL_FIFO_W0             = 0x41,
@@ -90,7 +92,7 @@ static void sil_post_set_mode (struct ata_port *ap);
 static const struct pci_device_id sil_pci_tbl[] = {
         { 0x1095, 0x3112, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
         { 0x1095, 0x0240, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
-        { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112 },
+        { 0x1095, 0x3512, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3512 },
         { 0x1095, 0x3114, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3114 },
         { 0x1002, 0x436e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
         { 0x1002, 0x4379, PCI_ANY_ID, PCI_ANY_ID, 0, 0, sil_3112_m15w },
@@ -185,7 +187,8 @@ static const struct ata_port_info sil_port_info[] = {
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
                 .port_ops       = &sil_ops,
-        }, /* sil_3112_15w - keep it sync'd w/ sil_3112 */
+        },
+        /* sil_3112_15w - keep it sync'd w/ sil_3112 */
         {
                 .sht            = &sil_sht,
                 .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
@@ -195,11 +198,24 @@ static const struct ata_port_info sil_port_info[] = {
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
                 .port_ops       = &sil_ops,
-        }, /* sil_3114 */
+        },
+        /* sil_3512 */
         {
                 .sht            = &sil_sht,
                 .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
-                                  ATA_FLAG_SRST | ATA_FLAG_MMIO,
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_RERR_ON_DMA_ACT,
+                .pio_mask       = 0x1f,                 /* pio0-4 */
+                .mwdma_mask     = 0x07,                 /* mwdma0-2 */
+                .udma_mask      = 0x3f,                 /* udma0-5 */
+                .port_ops       = &sil_ops,
+        },
+        /* sil_3114 */
+        {
+                .sht            = &sil_sht,
+                .host_flags     = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
+                                  ATA_FLAG_SRST | ATA_FLAG_MMIO |
+                                  SIL_FLAG_RERR_ON_DMA_ACT,
                 .pio_mask       = 0x1f,                 /* pio0-4 */
                 .mwdma_mask     = 0x07,                 /* mwdma0-2 */
                 .udma_mask      = 0x3f,                 /* udma0-5 */
@@ -216,12 +232,13 @@ static const struct {
         unsigned long scr;      /* SATA control register block */
         unsigned long sien;     /* SATA Interrupt Enable register */
         unsigned long xfer_mode;/* data transfer mode register */
+        unsigned long sfis_cfg; /* SATA FIS reception config register */
 } sil_port[] = {
         /* port 0 ... */
-        { 0x80, 0x8A, 0x00, 0x100, 0x148, 0xb4 },
-        { 0xC0, 0xCA, 0x08, 0x180, 0x1c8, 0xf4 },
-        { 0x280, 0x28A, 0x200, 0x300, 0x348, 0x2b4 },
-        { 0x2C0, 0x2CA, 0x208, 0x380, 0x3c8, 0x2f4 },
+        { 0x80, 0x8A, 0x00, 0x100, 0x148, 0xb4, 0x14c },
+        { 0xC0, 0xCA, 0x08, 0x180, 0x1c8, 0xf4, 0x1cc },
+        { 0x280, 0x28A, 0x200, 0x300, 0x348, 0x2b4, 0x34c },
+        { 0x2C0, 0x2CA, 0x208, 0x380, 0x3c8, 0x2f4, 0x3cc },
         /* ... port 3 */
 };
 
@@ -471,6 +488,23 @@ static int sil_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 dev_printk(KERN_WARNING, &pdev->dev,
                          "cache line size not set.  Driver may not function\n");
 
+        /* Apply R_ERR on DMA activate FIS errata workaround */
+        if (probe_ent->host_flags & SIL_FLAG_RERR_ON_DMA_ACT) {
+                int cnt;
+
+                for (i = 0, cnt = 0; i < probe_ent->n_ports; i++) {
+                        tmp = readl(mmio_base + sil_port[i].sfis_cfg);
+                        if ((tmp & 0x3) != 0x01)
+                                continue;
+                        if (!cnt)
+                                dev_printk(KERN_INFO, &pdev->dev,
+                                           "Applying R_ERR on DMA activate "
+                                           "FIS errata fix\n");
+                        writel(tmp & ~0x3, mmio_base + sil_port[i].sfis_cfg);
+                        cnt++;
+                }
+        }
+
         if (ent->driver_data == sil_3114) {
                 irq_mask = SIL_MASK_4PORT;
 
diff --git a/drivers/scsi/sata_vsc.c b/drivers/scsi/sata_vsc.c
index 2e2c3b7acb0c..e484e8db6810 100644
--- a/drivers/scsi/sata_vsc.c
+++ b/drivers/scsi/sata_vsc.c
@@ -81,6 +81,19 @@
 /* Port stride */
 #define VSC_SATA_PORT_OFFSET            0x200
 
+/* Error interrupt status bit offsets */
+#define VSC_SATA_INT_ERROR_E_OFFSET     2
+#define VSC_SATA_INT_ERROR_P_OFFSET     4
+#define VSC_SATA_INT_ERROR_T_OFFSET     5
+#define VSC_SATA_INT_ERROR_M_OFFSET     1
+#define is_vsc_sata_int_err(port_idx, int_status) \
+         (int_status & ((1 << (VSC_SATA_INT_ERROR_E_OFFSET + (8 * port_idx))) | \
+                        (1 << (VSC_SATA_INT_ERROR_P_OFFSET + (8 * port_idx))) | \
+                        (1 << (VSC_SATA_INT_ERROR_T_OFFSET + (8 * port_idx))) | \
+                        (1 << (VSC_SATA_INT_ERROR_M_OFFSET + (8 * port_idx)))   \
+                       )\
+         )
+
 
 static u32 vsc_sata_scr_read (struct ata_port *ap, unsigned int sc_reg)
 {
@@ -201,13 +214,28 @@ static irqreturn_t vsc_sata_interrupt (int irq, void *dev_instance,
                         struct ata_port *ap;
 
                         ap = host_set->ports[i];
+
+                        if (is_vsc_sata_int_err(i, int_status)) {
+                                u32 err_status;
+                                printk(KERN_DEBUG "%s: ignoring interrupt(s)\n", __FUNCTION__);
+                                err_status = ap ? vsc_sata_scr_read(ap, SCR_ERROR) : 0;
+                                vsc_sata_scr_write(ap, SCR_ERROR, err_status);
+                                handled++;
+                        }
+
                         if (ap && !(ap->flags &
                                     (ATA_FLAG_PORT_DISABLED|ATA_FLAG_NOINTR))) {
                                 struct ata_queued_cmd *qc;
 
                                 qc = ata_qc_from_tag(ap, ap->active_tag);
-                                if (qc && (!(qc->tf.ctl & ATA_NIEN)))
+                                if (qc && (!(qc->tf.ctl & ATA_NIEN))) {
                                         handled += ata_host_intr(ap, qc);
+                                } else {
+                                        printk(KERN_DEBUG "%s: ignoring interrupt(s)\n", __FUNCTION__);
+                                        ata_chk_status(ap);
+                                        handled++;
+                                }
+
                         }
                 }
         }
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 930db398d107..9d9872347f56 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -89,6 +89,11 @@
 #define SD_MAX_RETRIES          5
 #define SD_PASSTHROUGH_RETRIES  1
 
+/*
+ * Size of the initial data buffer for mode and read capacity data
+ */
+#define SD_BUF_SIZE             512
+
 static void scsi_disk_release(struct kref *kref);
 
 struct scsi_disk {
@@ -1239,7 +1244,7 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage,
 
 /*
  * read write protect setting, if possible - called only in sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
  */
 static void
 sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
@@ -1297,7 +1302,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
 
 /*
  * sd_read_cache_type - called only from sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
  */
 static void
 sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
@@ -1342,6 +1347,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
 
         /* Take headers and block descriptors into account */
         len += data.header_length + data.block_descriptor_length;
+        if (len > SD_BUF_SIZE)
+                goto bad_sense;
 
         /* Get the data */
         res = sd_do_mode_sense(sdp, dbd, modepage, buffer, len, &data, &sshdr);
@@ -1354,6 +1361,12 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
                 int ct = 0;
                 int offset = data.header_length + data.block_descriptor_length;
 
+                if (offset >= SD_BUF_SIZE - 2) {
+                        printk(KERN_ERR "%s: malformed MODE SENSE response",
+                                diskname);
+                        goto defaults;
+                }
+
                 if ((buffer[offset] & 0x3f) != modepage) {
                         printk(KERN_ERR "%s: got wrong page\n", diskname);
                         goto defaults;
@@ -1398,6 +1411,7 @@ defaults:
                diskname);
         sdkp->WCE = 0;
         sdkp->RCD = 0;
+        sdkp->DPOFUA = 0;
 }
 
 /**
@@ -1421,7 +1435,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
         if (!scsi_device_online(sdp))
                 goto out;
 
-        buffer = kmalloc(512, GFP_KERNEL | __GFP_DMA);
+        buffer = kmalloc(SD_BUF_SIZE, GFP_KERNEL | __GFP_DMA);
         if (!buffer) {
                 printk(KERN_WARNING "(sd_revalidate_disk:) Memory allocation "
                        "failure.\n");
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index b1fc97d5f643..7aca22c9976d 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2198,7 +2198,7 @@ serial8250_console_write(struct console *co, const char *s, unsigned int count)
         touch_nmi_watchdog();
 
         /*
-         *      First save the UER then disable the interrupts
+         *      First save the IER then disable the interrupts
          */
         ier = serial_in(up, UART_IER);
 
@@ -2326,6 +2326,12 @@ static struct uart_driver serial8250_reg = {
         .cons                   = SERIAL8250_CONSOLE,
 };
 
+/*
+ * early_serial_setup - early registration for 8250 ports
+ *
+ * Setup an 8250 port structure prior to console initialisation.  Use
+ * after console initialisation will cause undefined behaviour.
+ */
 int __init early_serial_setup(struct uart_port *port)
 {
         if (port->line >= ARRAY_SIZE(serial8250_ports))
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 0f4361c8466b..b3c561abe3f6 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -902,8 +902,8 @@ config SERIAL_JSM
           something like this to connect more than two modems to your Linux
           box, for instance in order to become a dial-in server. This driver
           supports PCI boards only.
-          If you have a card like this, say Y here and read the file
-          <file:Documentation/jsm.txt>.
+
+          If you have a card like this, say Y here, otherwise say N.
 
           To compile this driver as a module, choose M here: the
           module will be called jsm.
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 791c4dc550ae..94f5e8ed83a7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -90,7 +90,7 @@ static int spi_suspend(struct device *dev, pm_message_t message)
         int                     value;
         struct spi_driver       *drv = to_spi_driver(dev->driver);
 
-        if (!drv->suspend)
+        if (!drv || !drv->suspend)
                 return 0;
 
         /* suspend will stop irqs and dma; no more i/o */
@@ -105,7 +105,7 @@ static int spi_resume(struct device *dev)
         int                     value;
         struct spi_driver       *drv = to_spi_driver(dev->driver);
 
-        if (!drv->resume)
+        if (!drv || !drv->resume)
                 return 0;
 
         /* resume may restart the i/o queue */
@@ -449,7 +449,6 @@ void spi_unregister_master(struct spi_master *master)
 {
         (void) device_for_each_child(master->cdev.dev, NULL, __unregister);
         class_device_unregister(&master->cdev);
-        master->cdev.dev = NULL;
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);
 
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index e64ed16bd42f..f5079c78ba4e 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -520,7 +520,7 @@ config FB_GBE
 config FB_GBE_MEM
         int "Video memory size in MB"
         depends on FB_GBE
-        default 8
+        default 4
         help
           This is the amount of memory reserved for the framebuffer,
           which can be any value between 1MB and 8MB.
diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index 69f75547865d..c924d81f7978 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -322,32 +322,29 @@ static int asiliantfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
         writeb(green, mmio_base + 0x791);
         writeb(blue, mmio_base + 0x791);
 
-        switch(p->var.bits_per_pixel) {
-        case 15:
-                if (regno < 16) {
+        if (regno < 16) {
+                switch(p->var.red.offset) {
+                case 10: /* RGB 555 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 ((red & 0xf8) << 7) |
                                 ((green & 0xf8) << 2) |
                                 ((blue & 0xf8) >> 3);
-                }
-                break;
-        case 16:
-                if (regno < 16) {
+                        break;
+                case 11: /* RGB 565 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 ((red & 0xf8) << 8) |
                                 ((green & 0xfc) << 3) |
                                 ((blue & 0xf8) >> 3);
-                }
-                break;
-        case 24:
-                if (regno < 24) {
+                        break;
+                case 16: /* RGB 888 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 (red << 16)  |
                                 (green << 8) |
                                 (blue);
+                        break;
                 }
-                break;
         }
+
         return 0;
 }
 
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 556895e99645..1f8d805c61e5 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -1321,8 +1321,6 @@ static void radeon_pm_full_reset_sdram(struct radeonfb_info *rinfo)
         mdelay( 15);
 }
 
-#ifdef CONFIG_PPC_OF
-
 static void radeon_pm_reset_pad_ctlr_strength(struct radeonfb_info *rinfo)
 {
         u32 tmp, tmp2;
@@ -1836,6 +1834,8 @@ static void radeon_reinitialize_M10(struct radeonfb_info *rinfo)
         radeon_pm_m10_enable_lvds_spread_spectrum(rinfo);
 }
 
+#ifdef CONFIG_PPC_OF
+
 static void radeon_pm_m9p_reconfigure_mc(struct radeonfb_info *rinfo)
 {
         OUTREG(MC_CNTL, rinfo->save_regs[46]);
@@ -2728,13 +2728,23 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
                 printk("radeonfb: Dynamic Clock Power Management disabled\n");
         }
 
+#if defined(CONFIG_PM)
         /* Check if we can power manage on suspend/resume. We can do
          * D2 on M6, M7 and M9, and we can resume from D3 cold a few other
          * "Mac" cards, but that's all. We need more infos about what the
          * BIOS does tho. Right now, all this PM stuff is pmac-only for that
          * reason. --BenH
          */
-#if defined(CONFIG_PM) && defined(CONFIG_PPC_PMAC)
+        /* Special case for Samsung P35 laptops
+         */
+        if ((rinfo->pdev->vendor == PCI_VENDOR_ID_ATI) &&
+            (rinfo->pdev->device == PCI_CHIP_RV350_NP) &&
+            (rinfo->pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG) &&
+            (rinfo->pdev->subsystem_device == 0xc00c)) {
+                rinfo->reinit_func = radeon_reinitialize_M10;
+                rinfo->pm_mode |= radeon_pm_off;
+        }
+#if defined(CONFIG_PPC_PMAC)
         if (_machine == _MACH_Pmac && rinfo->of_node) {
                 if (rinfo->is_mobility && rinfo->pm_reg &&
                     rinfo->family <= CHIP_FAMILY_RV250)
@@ -2778,7 +2788,8 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk)
                 OUTREG(TV_DAC_CNTL, INREG(TV_DAC_CNTL) | 0x07000000);
 #endif
         }
-#endif /* defined(CONFIG_PM) && defined(CONFIG_PPC_PMAC) */
+#endif /* defined(CONFIG_PPC_PMAC) */
+#endif /* defined(CONFIG_PM) */
 }
 
 void radeonfb_pm_exit(struct radeonfb_info *rinfo)
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index 2406899f1207..3d04b2def0f1 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -49,6 +49,7 @@
 #include <linux/interrupt.h>
 #include <linux/ctype.h>
 #include <linux/dma-mapping.h>
+#include <linux/platform_device.h>
 
 #include <asm/mach-au1x00/au1000.h>
 
@@ -406,7 +407,7 @@ int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
 
         vma->vm_flags |= VM_IO;
 
-        if (io_remap_page_range(vma, vma->vm_start, off,
+        if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
                                 vma->vm_end - vma->vm_start,
                                 vma->vm_page_prot)) {
                 return -EAGAIN;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 12d9329d1408..5a86978537d2 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -509,57 +509,60 @@ static int vgacon_doresize(struct vc_data *c,
 {
         unsigned long flags;
         unsigned int scanlines = height * c->vc_font.height;
-        u8 scanlines_lo, r7, vsync_end, mode, max_scan;
+        u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan;
 
         spin_lock_irqsave(&vga_lock, flags);
 
-        outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
-        max_scan = inb_p(vga_video_port_val);
-
-        if (max_scan & 0x80)
-                scanlines <<= 1;
-
         vgacon_xres = width * VGA_FONTWIDTH;
         vgacon_yres = height * c->vc_font.height;
-        outb_p(VGA_CRTC_MODE, vga_video_port_reg);
-        mode = inb_p(vga_video_port_val);
+        if (vga_video_type >= VIDEO_TYPE_VGAC) {
+                outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg);
+                max_scan = inb_p(vga_video_port_val);
 
-        if (mode & 0x04)
-                scanlines >>= 1;
+                if (max_scan & 0x80)
+                        scanlines <<= 1;
 
-        scanlines -= 1;
-        scanlines_lo = scanlines & 0xff;
+                outb_p(VGA_CRTC_MODE, vga_video_port_reg);
+                mode = inb_p(vga_video_port_val);
 
-        outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
-        r7 = inb_p(vga_video_port_val) & ~0x42;
+                if (mode & 0x04)
+                        scanlines >>= 1;
 
-        if (scanlines & 0x100)
-                r7 |= 0x02;
-        if (scanlines & 0x200)
-                r7 |= 0x40;
+                scanlines -= 1;
+                scanlines_lo = scanlines & 0xff;
 
-        /* deprotect registers */
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        vsync_end = inb_p(vga_video_port_val);
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        outb_p(vsync_end & ~0x80, vga_video_port_val);
+                outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                r7 = inb_p(vga_video_port_val) & ~0x42;
+
+                if (scanlines & 0x100)
+                        r7 |= 0x02;
+                if (scanlines & 0x200)
+                        r7 |= 0x40;
+
+                /* deprotect registers */
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                vsync_end = inb_p(vga_video_port_val);
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                outb_p(vsync_end & ~0x80, vga_video_port_val);
+        }
 
         outb_p(VGA_CRTC_H_DISP, vga_video_port_reg);
         outb_p(width - 1, vga_video_port_val);
         outb_p(VGA_CRTC_OFFSET, vga_video_port_reg);
         outb_p(width >> 1, vga_video_port_val);
 
-        outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
-        outb_p(scanlines_lo, vga_video_port_val);
-        outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
-        outb_p(r7,vga_video_port_val);
+        if (vga_video_type >= VIDEO_TYPE_VGAC) {
+                outb_p(VGA_CRTC_V_DISP_END, vga_video_port_reg);
+                outb_p(scanlines_lo, vga_video_port_val);
+                outb_p(VGA_CRTC_OVERFLOW, vga_video_port_reg);
+                outb_p(r7,vga_video_port_val);
 
-        /* reprotect registers */
-        outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
-        outb_p(vsync_end, vga_video_port_val);
+                /* reprotect registers */
+                outb_p(VGA_CRTC_V_SYNC_END, vga_video_port_reg);
+                outb_p(vsync_end, vga_video_port_val);
+        }
 
         spin_unlock_irqrestore(&vga_lock, flags);
-
         return 0;
 }
 
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index 38d22729b129..5e25b9860196 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -656,12 +656,15 @@ static int gbefb_set_par(struct fb_info *info)
         switch (bytesPerPixel) {
         case 1:
                 SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_I8);
+                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
                 break;
         case 2:
                 SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_ARGB5);
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                 break;
         case 4:
                 SET_GBE_FIELD(WID, TYP, val, GBE_CMODE_RGB8);
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
                 break;
         }
         SET_GBE_FIELD(WID, BUF, val, GBE_BMODE_BOTH);
@@ -1243,7 +1246,7 @@ static int __devexit gbefb_remove(struct platform_device* p_dev)
                           (void *)gbe_tiles.cpu, gbe_tiles.dma);
         release_mem_region(GBE_BASE, sizeof(struct sgi_gbe));
         iounmap(gbe);
-        gbefb_remove_sysfs(dev);
+        gbefb_remove_sysfs(&p_dev->dev);
         framebuffer_release(info);
 
         return 0;
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index d574dd3c9c8a..9451932fbaf2 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -82,7 +82,6 @@
 #include <linux/fb.h>
 #include <linux/init.h>
 #include <linux/dma-mapping.h>
-#include <linux/string.h>
 #include <linux/interrupt.h>
 #include <linux/workqueue.h>
 #include <linux/wait.h>
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 5250c428fc1f..ef3386549140 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -66,7 +66,7 @@ static match_table_t tokens = {
         {Opt_afid, "afid=%u"},
         {Opt_rfdno, "rfdno=%u"},
         {Opt_wfdno, "wfdno=%u"},
-        {Opt_debug, "debug=%u"},
+        {Opt_debug, "debug=%x"},
         {Opt_name, "name=%s"},
         {Opt_remotename, "aname=%s"},
         {Opt_unix, "proto=unix"},
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 1b117a441298..c2eac2a50bd2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -938,6 +938,11 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
                 kfree(elf_interpreter);
         } else {
                 elf_entry = loc->elf_ex.e_entry;
+                if (BAD_ADDR(elf_entry)) {
+                        send_sig(SIGSEGV, current, 0);
+                        retval = -ENOEXEC; /* Nobody gets to see this, but.. */
+                        goto out_free_dentry;
+                }
         }
 
         kfree(elf_phdata);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 217323b0c896..b41e8b379652 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1048,13 +1048,14 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon,
                         cifs_small_buf_release(iov[0].iov_base);
                 else if(resp_buf_type == CIFS_LARGE_BUFFER)
                         cifs_buf_release(iov[0].iov_base);
-        } else /* return buffer to caller to free */ /* BB FIXME how do we tell caller if it is not a large buffer */ {
-                *buf = iov[0].iov_base;
+        } else if(resp_buf_type != CIFS_NO_BUFFER) {
+                /* return buffer to caller to free */ 
+                *buf = iov[0].iov_base;         
                 if(resp_buf_type == CIFS_SMALL_BUFFER)
                         *pbuf_type = CIFS_SMALL_BUFFER;
                 else if(resp_buf_type == CIFS_LARGE_BUFFER)
                         *pbuf_type = CIFS_LARGE_BUFFER;
-        }
+        } /* else no valid buffer on return - leave as null */
 
         /* Note: On -EAGAIN error only caller can retry on handle based calls
                 since file handle passed in no longer valid */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index e488603fb1e7..ef5ae6f93c75 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1795,10 +1795,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                            conjunction with 52K kvec constraint on arch with 4K
                            page size  */
 
-                if(cifs_sb->rsize < PAGE_CACHE_SIZE) {
-                        cifs_sb->rsize = PAGE_CACHE_SIZE; 
-                        /* Windows ME does this */
-                        cFYI(1,("Attempt to set readsize for mount to less than one page (4096)"));
+                if(cifs_sb->rsize < 2048) {
+                        cifs_sb->rsize = 2048; 
+                        /* Windows ME may prefer this */
+                        cFYI(1,("readsize set to minimum 2048"));
                 }
                 cifs_sb->mnt_uid = volume_info.linux_uid;
                 cifs_sb->mnt_gid = volume_info.linux_gid;
diff --git a/fs/compat.c b/fs/compat.c
index a2ba78bdf7f7..5333c7d7427f 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1757,7 +1757,7 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
                         goto sticky;
                 rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
                 rtv.tv_sec = timeout;
-                if (compat_timeval_compare(&rtv, &tv) < 0)
+                if (compat_timeval_compare(&rtv, &tv) >= 0)
                         rtv = tv;
                 if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
@@ -1834,7 +1834,7 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
                         rts.tv_sec++;
                         rts.tv_nsec -= NSEC_PER_SEC;
                 }
-                if (compat_timespec_compare(&rts, &ts) < 0)
+                if (compat_timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
                 copy_to_user(tsp, &rts, sizeof(rts));
         }
@@ -1934,7 +1934,7 @@ asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
                 rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
                                         1000;
                 rts.tv_sec = timeout;
-                if (compat_timespec_compare(&rts, &ts) < 0)
+                if (compat_timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
                 if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 057e60217fc5..537ac70edfe5 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -2531,18 +2531,9 @@ static int rtc_ioctl(unsigned fd, unsigned cmd, unsigned long arg)
                 val32 = kval;
                 return put_user(val32, (unsigned int __user *)arg);
         case RTC_IRQP_SET32:
+                return sys_ioctl(fd, RTC_IRQP_SET, arg); 
         case RTC_EPOCH_SET32:
-                ret = get_user(val32, (unsigned int __user *)arg);
-                if (ret)
-                        return ret;
-                kval = val32;
-
-                set_fs(KERNEL_DS);
-                ret = sys_ioctl(fd, (cmd == RTC_IRQP_SET32) ?
-                                RTC_IRQP_SET : RTC_EPOCH_SET,
-                                (unsigned long)&kval);
-                set_fs(oldfs);
-                return ret;
+                return sys_ioctl(fd, RTC_EPOCH_SET, arg);
         default:
                 /* unreached */
                 return -ENOIOCTLCMD;
diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
index a2ca3107d475..86ae8e93adb9 100644
--- a/fs/ext2/xattr.c
+++ b/fs/ext2/xattr.c
@@ -792,18 +792,20 @@ ext2_xattr_delete_inode(struct inode *inode)
                 ext2_free_blocks(inode, EXT2_I(inode)->i_file_acl, 1);
                 get_bh(bh);
                 bforget(bh);
+                unlock_buffer(bh);
         } else {
                 HDR(bh)->h_refcount = cpu_to_le32(
                         le32_to_cpu(HDR(bh)->h_refcount) - 1);
                 if (ce)
                         mb_cache_entry_release(ce);
+                ea_bdebug(bh, "refcount now=%d",
+                        le32_to_cpu(HDR(bh)->h_refcount));
+                unlock_buffer(bh);
                 mark_buffer_dirty(bh);
                 if (IS_SYNC(inode))
                         sync_dirty_buffer(bh);
                 DQUOT_FREE_BLOCK(inode, 1);
         }
-        ea_bdebug(bh, "refcount now=%d", le32_to_cpu(HDR(bh)->h_refcount) - 1);
-        unlock_buffer(bh);
         EXT2_I(inode)->i_file_acl = 0;
 
 cleanup:
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index f556a0d5c0d3..0c9a2ee54c91 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -66,6 +66,12 @@ static void restore_sigs(sigset_t *oldset)
         sigprocmask(SIG_SETMASK, oldset, NULL);
 }
 
+/*
+ * Reset request, so that it can be reused
+ *
+ * The caller must be _very_ careful to make sure, that it is holding
+ * the only reference to req
+ */
 void fuse_reset_request(struct fuse_req *req)
 {
         int preallocated = req->preallocated;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 296351615b00..6f05379b0a0d 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -116,9 +116,14 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
 /* Special case for failed iget in CREATE */
 static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        u64 nodeid = req->in.h.nodeid;
-        fuse_reset_request(req);
-        fuse_send_forget(fc, req, nodeid, 1);
+        /* If called from end_io_requests(), req has more than one
+           reference and fuse_reset_request() cannot work */
+        if (fc->connected) {
+                u64 nodeid = req->in.h.nodeid;
+                fuse_reset_request(req);
+                fuse_send_forget(fc, req, nodeid, 1);
+        } else
+                fuse_put_request(fc, req);
 }
 
 void fuse_send_release(struct fuse_conn *fc, struct fuse_file *ff,
diff --git a/fs/namei.c b/fs/namei.c
index e28de846c591..557dcf395ca1 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2224,13 +2224,17 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
  * and other special files.  --ADM
  */
 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
-                           int newdfd, const char __user *newname)
+                           int newdfd, const char __user *newname,
+                           int flags)
 {
         struct dentry *new_dentry;
         struct nameidata nd, old_nd;
         int error;
         char * to;
 
+        if (flags != 0)
+                return -EINVAL;
+
         to = getname(newname);
         if (IS_ERR(to))
                 return PTR_ERR(to);
@@ -2263,7 +2267,7 @@ exit:
 
 asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
 {
-        return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname);
+        return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
 }
 
 /*
diff --git a/fs/ntfs/ChangeLog b/fs/ntfs/ChangeLog
index 02f44094bda9..9d8ffa89e2c2 100644
--- a/fs/ntfs/ChangeLog
+++ b/fs/ntfs/ChangeLog
@@ -1,9 +1,9 @@
 ToDo/Notes:
         - Find and fix bugs.
         - The only places in the kernel where a file is resized are
-          ntfs_file_write*() and ntfs_truncate() for both of which i_sem is
+          ntfs_file_write*() and ntfs_truncate() for both of which i_mutex is
           held.  Just have to be careful in read-/writepage and other helpers
-          not running under i_sem that we play nice...  Also need to be careful
+          not running under i_mutex that we play nice.  Also need to be careful
           with initialized_size extension in ntfs_file_write*() and writepage.
           UPDATE: The only things that need to be checked are the compressed
           write and the other attribute resize/write cases like index
@@ -19,6 +19,24 @@ ToDo/Notes:
         - Enable the code for setting the NT4 compatibility flag when we start
           making NTFS 1.2 specific modifications.
 
+2.1.26 - Minor bug fixes and updates.
+
+        - Fix a potential overflow in file.c where a cast to s64 was missing in
+          a left shift of a page index.
+        - The struct inode has had its i_sem semaphore changed to a mutex named
+          i_mutex.
+        - We have struct kmem_cache now so use it instead of the typedef
+          kmem_cache_t.  (Pekka Enberg)
+        - Implement support for sector sizes above 512 bytes (up to the maximum
+          supported by NTFS which is 4096 bytes).
+        - Do more detailed reporting of why we cannot mount read-write by
+          special casing the VOLUME_MODIFIED_BY_CHKDSK flag.
+        - Miscellaneous updates to layout.h.
+        - Cope with attribute list attribute having invalid flags.  Windows
+          copes with this and even chkdsk does not detect or fix this so we
+          have to cope with it, too.  Thanks to Pawel Kot for reporting the
+          problem.
+
 2.1.25 - (Almost) fully implement write(2) and truncate(2).
 
         - Change ntfs_map_runlist_nolock(), ntfs_attr_find_vcn_nolock() and
@@ -373,7 +391,7 @@ ToDo/Notes:
           single one of them had an mst error.  (Thanks to Ken MacFerrin for
           the bug report.)
         - Fix error handling in fs/ntfs/quota.c::ntfs_mark_quotas_out_of_date()
-          where we failed to release i_sem on the $Quota/$Q attribute inode.
+          where we failed to release i_mutex on the $Quota/$Q attribute inode.
         - Fix bug in handling of bad inodes in fs/ntfs/namei.c::ntfs_lookup().
         - Add mapping of unmapped buffers to all remaining code paths, i.e.
           fs/ntfs/aops.c::ntfs_write_mst_block(), mft.c::ntfs_sync_mft_mirror(),
@@ -874,7 +892,7 @@ ToDo/Notes:
           clusters. (Philipp Thomas)
         - attrib.c::load_attribute_list(): Fix bug when initialized_size is a
           multiple of the block_size but not the cluster size. (Szabolcs
-          Szakacsits <szaka@sienet.hu>)
+          Szakacsits)
 
 2.1.2 - Important bug fixes aleviating the hangs in statfs.
 
@@ -884,7 +902,7 @@ ToDo/Notes:
 
         - Add handling for initialized_size != data_size in compressed files.
         - Reduce function local stack usage from 0x3d4 bytes to just noise in
-          fs/ntfs/upcase.c. (Randy Dunlap <rdunlap@xenotime.net>)
+          fs/ntfs/upcase.c. (Randy Dunlap)
         - Remove compiler warnings for newer gcc.
         - Pages are no longer kmapped by mm/filemap.c::generic_file_write()
           around calls to ->{prepare,commit}_write.  Adapt NTFS appropriately
@@ -1201,11 +1219,11 @@ ToDo/Notes:
           the kernel. We probably want a kernel generic init_address_space()
           function...
         - Drop BKL from ntfs_readdir() after consultation with Al Viro. The
-          only caller of ->readdir() is vfs_readdir() which holds i_sem during
-          the call, and i_sem is sufficient protection against changes in the
-          directory inode (including ->i_size).
+          only caller of ->readdir() is vfs_readdir() which holds i_mutex
+          during the call, and i_mutex is sufficient protection against changes
+          in the directory inode (including ->i_size).
         - Use generic_file_llseek() for directories (as opposed to
-          default_llseek()) as this downs i_sem instead of the BKL which is
+          default_llseek()) as this downs i_mutex instead of the BKL which is
           what we now need for exclusion against ->f_pos changes considering we
           no longer take the BKL in ntfs_readdir().
 
diff --git a/fs/ntfs/Makefile b/fs/ntfs/Makefile
index d0d45d1c853a..d95fac7fdeb6 100644
--- a/fs/ntfs/Makefile
+++ b/fs/ntfs/Makefile
@@ -6,7 +6,7 @@ ntfs-objs := aops.o attrib.o collate.o compress.o debug.o dir.o file.o \
              index.o inode.o mft.o mst.o namei.o runlist.o super.o sysctl.o \
              unistr.o upcase.o
 
-EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.25\"
+EXTRA_CFLAGS = -DNTFS_VERSION=\"2.1.26\"
 
 ifeq ($(CONFIG_NTFS_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
diff --git a/fs/ntfs/aops.c b/fs/ntfs/aops.c
index 1c0a4315876a..7e361da770b3 100644
--- a/fs/ntfs/aops.c
+++ b/fs/ntfs/aops.c
@@ -2,7 +2,7 @@
  * aops.c - NTFS kernel address space operations and page cache handling.
  *          Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -200,8 +200,8 @@ static int ntfs_read_block(struct page *page)
         /* $MFT/$DATA must have its complete runlist in memory at all times. */
         BUG_ON(!ni->runlist.rl && !ni->mft_no && !NInoAttr(ni));
 
-        blocksize_bits = VFS_I(ni)->i_blkbits;
-        blocksize = 1 << blocksize_bits;
+        blocksize = vol->sb->s_blocksize;
+        blocksize_bits = vol->sb->s_blocksize_bits;
 
         if (!page_has_buffers(page)) {
                 create_empty_buffers(page, blocksize, 0);
@@ -569,10 +569,8 @@ static int ntfs_write_block(struct page *page, struct writeback_control *wbc)
 
         BUG_ON(!NInoNonResident(ni));
         BUG_ON(NInoMstProtected(ni));
-
-        blocksize_bits = vi->i_blkbits;
-        blocksize = 1 << blocksize_bits;
-
+        blocksize = vol->sb->s_blocksize;
+        blocksize_bits = vol->sb->s_blocksize_bits;
         if (!page_has_buffers(page)) {
                 BUG_ON(!PageUptodate(page));
                 create_empty_buffers(page, blocksize,
@@ -949,8 +947,8 @@ static int ntfs_write_mst_block(struct page *page,
          */
         BUG_ON(!(is_mft || S_ISDIR(vi->i_mode) ||
                         (NInoAttr(ni) && ni->type == AT_INDEX_ALLOCATION)));
-        bh_size_bits = vi->i_blkbits;
-        bh_size = 1 << bh_size_bits;
+        bh_size = vol->sb->s_blocksize;
+        bh_size_bits = vol->sb->s_blocksize_bits;
         max_bhs = PAGE_CACHE_SIZE / bh_size;
         BUG_ON(!max_bhs);
         BUG_ON(max_bhs > MAX_BUF_PER_PAGE);
@@ -1596,7 +1594,7 @@ void mark_ntfs_record_dirty(struct page *page, const unsigned int ofs) {
 
         BUG_ON(!PageUptodate(page));
         end = ofs + ni->itype.index.block_size;
-        bh_size = 1 << VFS_I(ni)->i_blkbits;
+        bh_size = VFS_I(ni)->i_sb->s_blocksize;
         spin_lock(&mapping->private_lock);
         if (unlikely(!page_has_buffers(page))) {
                 spin_unlock(&mapping->private_lock);
diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
index fb413d3d8618..5027d3d1b3fe 100644
--- a/fs/ntfs/file.c
+++ b/fs/ntfs/file.c
@@ -1,7 +1,7 @@
 /*
  * file.c - NTFS kernel file operations.  Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  *
  * This program/include file is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as published
@@ -248,7 +248,7 @@ do_non_resident_extend:
                  * enough to make ntfs_writepage() work.
                  */
                 write_lock_irqsave(&ni->size_lock, flags);
-                ni->initialized_size = (index + 1) << PAGE_CACHE_SHIFT;
+                ni->initialized_size = (s64)(index + 1) << PAGE_CACHE_SHIFT;
                 if (ni->initialized_size > new_init_size)
                         ni->initialized_size = new_init_size;
                 write_unlock_irqrestore(&ni->size_lock, flags);
@@ -529,8 +529,8 @@ static int ntfs_prepare_pages_for_non_resident_write(struct page **pages,
                         "index 0x%lx, nr_pages 0x%x, pos 0x%llx, bytes 0x%zx.",
                         vi->i_ino, ni->type, pages[0]->index, nr_pages,
                         (long long)pos, bytes);
-        blocksize_bits = vi->i_blkbits;
-        blocksize = 1 << blocksize_bits;
+        blocksize = vol->sb->s_blocksize;
+        blocksize_bits = vol->sb->s_blocksize_bits;
         u = 0;
         do {
                 struct page *page = pages[u];
@@ -1525,7 +1525,7 @@ static inline int ntfs_commit_pages_after_non_resident_write(
 
         vi = pages[0]->mapping->host;
         ni = NTFS_I(vi);
-        blocksize = 1 << vi->i_blkbits;
+        blocksize = vi->i_sb->s_blocksize;
         end = pos + bytes;
         u = 0;
         do {
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index ea1bd3feea1b..55263b7de9c0 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -677,13 +677,28 @@ static int ntfs_read_locked_inode(struct inode *vi)
                 ntfs_debug("Attribute list found in inode 0x%lx.", vi->i_ino);
                 NInoSetAttrList(ni);
                 a = ctx->attr;
-                if (a->flags & ATTR_IS_ENCRYPTED ||
-                                a->flags & ATTR_COMPRESSION_MASK ||
-                                a->flags & ATTR_IS_SPARSE) {
+                if (a->flags & ATTR_COMPRESSION_MASK) {
                         ntfs_error(vi->i_sb, "Attribute list attribute is "
-                                        "compressed/encrypted/sparse.");
+                                        "compressed.");
                         goto unm_err_out;
                 }
+                if (a->flags & ATTR_IS_ENCRYPTED ||
+                                a->flags & ATTR_IS_SPARSE) {
+                        if (a->non_resident) {
+                                ntfs_error(vi->i_sb, "Non-resident attribute "
+                                                "list attribute is encrypted/"
+                                                "sparse.");
+                                goto unm_err_out;
+                        }
+                        ntfs_warning(vi->i_sb, "Resident attribute list "
+                                        "attribute in inode 0x%lx is marked "
+                                        "encrypted/sparse which is not true.  "
+                                        "However, Windows allows this and "
+                                        "chkdsk does not detect or correct it "
+                                        "so we will just ignore the invalid "
+                                        "flags and pretend they are not set.",
+                                        vi->i_ino);
+                }
                 /* Now allocate memory for the attribute list. */
                 ni->attr_list_size = (u32)ntfs_attr_size(a);
                 ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
@@ -1809,19 +1824,33 @@ int ntfs_read_inode_mount(struct inode *vi)
         } else /* if (!err) */ {
                 ATTR_LIST_ENTRY *al_entry, *next_al_entry;
                 u8 *al_end;
+                static const char *es = "  Not allowed.  $MFT is corrupt.  "
+                                "You should run chkdsk.";
 
                 ntfs_debug("Attribute list attribute found in $MFT.");
                 NInoSetAttrList(ni);
                 a = ctx->attr;
-                if (a->flags & ATTR_IS_ENCRYPTED ||
-                                a->flags & ATTR_COMPRESSION_MASK ||
-                                a->flags & ATTR_IS_SPARSE) {
+                if (a->flags & ATTR_COMPRESSION_MASK) {
                         ntfs_error(sb, "Attribute list attribute is "
-                                        "compressed/encrypted/sparse. Not "
-                                        "allowed. $MFT is corrupt. You should "
-                                        "run chkdsk.");
+                                        "compressed.%s", es);
                         goto put_err_out;
                 }
+                if (a->flags & ATTR_IS_ENCRYPTED ||
+                                a->flags & ATTR_IS_SPARSE) {
+                        if (a->non_resident) {
+                                ntfs_error(sb, "Non-resident attribute list "
+                                                "attribute is encrypted/"
+                                                "sparse.%s", es);
+                                goto put_err_out;
+                        }
+                        ntfs_warning(sb, "Resident attribute list attribute "
+                                        "in $MFT system file is marked "
+                                        "encrypted/sparse which is not true.  "
+                                        "However, Windows allows this and "
+                                        "chkdsk does not detect or correct it "
+                                        "so we will just ignore the invalid "
+                                        "flags and pretend they are not set.");
+                }
                 /* Now allocate memory for the attribute list. */
                 ni->attr_list_size = (u32)ntfs_attr_size(a);
                 ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size);
diff --git a/fs/ntfs/layout.h b/fs/ntfs/layout.h
index f5678d5d7919..bb408d4dcbb0 100644
--- a/fs/ntfs/layout.h
+++ b/fs/ntfs/layout.h
@@ -838,15 +838,19 @@ enum {
            F_A_DEVICE, F_A_DIRECTORY, F_A_SPARSE_FILE, F_A_REPARSE_POINT,
            F_A_COMPRESSED, and F_A_ENCRYPTED and preserves the rest.  This mask
            is used to to obtain all flags that are valid for setting. */
-
         /*
-         * The following flags are only present in the FILE_NAME attribute (in
+         * The following flag is only present in the FILE_NAME attribute (in
          * the field file_attributes).
          */
         FILE_ATTR_DUP_FILE_NAME_INDEX_PRESENT   = const_cpu_to_le32(0x10000000),
         /* Note, this is a copy of the corresponding bit from the mft record,
            telling us whether this is a directory or not, i.e. whether it has
            an index root attribute or not. */
+        /*
+         * The following flag is present both in the STANDARD_INFORMATION
+         * attribute and in the FILE_NAME attribute (in the field
+         * file_attributes).
+         */
         FILE_ATTR_DUP_VIEW_INDEX_PRESENT        = const_cpu_to_le32(0x20000000),
         /* Note, this is a copy of the corresponding bit from the mft record,
            telling us whether this file has a view index present (eg. object id
@@ -1071,9 +1075,15 @@ typedef struct {
                                            modified. */
 /* 20*/ sle64 last_access_time;         /* Time this mft record was last
                                            accessed. */
-/* 28*/ sle64 allocated_size;           /* Byte size of allocated space for the
-                                           data attribute. NOTE: Is a multiple
-                                           of the cluster size. */
+/* 28*/ sle64 allocated_size;           /* Byte size of on-disk allocated space
+                                           for the data attribute.  So for
+                                           normal $DATA, this is the
+                                           allocated_size from the unnamed
+                                           $DATA attribute and for compressed
+                                           and/or sparse $DATA, this is the
+                                           compressed_size from the unnamed
+                                           $DATA attribute.  NOTE: This is a
+                                           multiple of the cluster size. */
 /* 30*/ sle64 data_size;                /* Byte size of actual data in data
                                            attribute. */
 /* 38*/ FILE_ATTR_FLAGS file_attributes;        /* Flags describing the file. */
@@ -1904,12 +1914,13 @@ enum {
         VOLUME_DELETE_USN_UNDERWAY      = const_cpu_to_le16(0x0010),
         VOLUME_REPAIR_OBJECT_ID         = const_cpu_to_le16(0x0020),
 
+        VOLUME_CHKDSK_UNDERWAY          = const_cpu_to_le16(0x4000),
         VOLUME_MODIFIED_BY_CHKDSK       = const_cpu_to_le16(0x8000),
 
-        VOLUME_FLAGS_MASK               = const_cpu_to_le16(0x803f),
+        VOLUME_FLAGS_MASK               = const_cpu_to_le16(0xc03f),
 
         /* To make our life easier when checking if we must mount read-only. */
-        VOLUME_MUST_MOUNT_RO_MASK       = const_cpu_to_le16(0x8027),
+        VOLUME_MUST_MOUNT_RO_MASK       = const_cpu_to_le16(0xc027),
 } __attribute__ ((__packed__));
 
 typedef le16 VOLUME_FLAGS;
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 0c65cbb8c5cf..6499aafc2258 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
  * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -473,7 +473,7 @@ int ntfs_sync_mft_mirror(ntfs_volume *vol, const unsigned long mft_no,
         runlist_element *rl;
         unsigned int block_start, block_end, m_start, m_end, page_ofs;
         int i_bhs, nr_bhs, err = 0;
-        unsigned char blocksize_bits = vol->mftmirr_ino->i_blkbits;
+        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
 
         ntfs_debug("Entering for inode 0x%lx.", mft_no);
         BUG_ON(!max_bhs);
@@ -672,8 +672,8 @@ int write_mft_record_nolock(ntfs_inode *ni, MFT_RECORD *m, int sync)
 {
         ntfs_volume *vol = ni->vol;
         struct page *page = ni->page;
-        unsigned char blocksize_bits = vol->mft_ino->i_blkbits;
-        unsigned int blocksize = 1 << blocksize_bits;
+        unsigned int blocksize = vol->sb->s_blocksize;
+        unsigned char blocksize_bits = vol->sb->s_blocksize_bits;
         int max_bhs = vol->mft_record_size / blocksize;
         struct buffer_head *bhs[max_bhs];
         struct buffer_head *bh, *head;
diff --git a/fs/ntfs/ntfs.h b/fs/ntfs/ntfs.h
index 446b5014115c..653d2a5c4899 100644
--- a/fs/ntfs/ntfs.h
+++ b/fs/ntfs/ntfs.h
@@ -50,11 +50,11 @@ typedef enum {
 /* Global variables. */
 
 /* Slab caches (from super.c). */
-extern kmem_cache_t *ntfs_name_cache;
-extern kmem_cache_t *ntfs_inode_cache;
-extern kmem_cache_t *ntfs_big_inode_cache;
-extern kmem_cache_t *ntfs_attr_ctx_cache;
-extern kmem_cache_t *ntfs_index_ctx_cache;
+extern struct kmem_cache *ntfs_name_cache;
+extern struct kmem_cache *ntfs_inode_cache;
+extern struct kmem_cache *ntfs_big_inode_cache;
+extern struct kmem_cache *ntfs_attr_ctx_cache;
+extern struct kmem_cache *ntfs_index_ctx_cache;
 
 /* The various operations structs defined throughout the driver files. */
 extern struct address_space_operations ntfs_aops;
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index c3a3f1a8310b..368a8ec10668 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1,7 +1,7 @@
 /*
  * super.c - NTFS kernel super block handling. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2001,2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@
 
 #include <linux/stddef.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/spinlock.h>
 #include <linux/blkdev.h>       /* For bdev_hardsect_size(). */
@@ -471,9 +472,16 @@ static int ntfs_remount(struct super_block *sb, int *flags, char *opt)
                         ntfs_error(sb, "Volume is dirty and read-only%s", es);
                         return -EROFS;
                 }
+                if (vol->vol_flags & VOLUME_MODIFIED_BY_CHKDSK) {
+                        ntfs_error(sb, "Volume has been modified by chkdsk "
+                                        "and is read-only%s", es);
+                        return -EROFS;
+                }
                 if (vol->vol_flags & VOLUME_MUST_MOUNT_RO_MASK) {
-                        ntfs_error(sb, "Volume has unsupported flags set and "
-                                        "is read-only%s", es);
+                        ntfs_error(sb, "Volume has unsupported flags set "
+                                        "(0x%x) and is read-only%s",
+                                        (unsigned)le16_to_cpu(vol->vol_flags),
+                                        es);
                         return -EROFS;
                 }
                 if (ntfs_set_volume_flags(vol, VOLUME_IS_DIRTY)) {
@@ -641,7 +649,7 @@ static struct buffer_head *read_ntfs_boot_sector(struct super_block *sb,
 {
         const char *read_err_str = "Unable to read %s boot sector.";
         struct buffer_head *bh_primary, *bh_backup;
-        long nr_blocks = NTFS_SB(sb)->nr_blocks;
+        sector_t nr_blocks = NTFS_SB(sb)->nr_blocks;
 
         /* Try to read primary boot sector. */
         if ((bh_primary = sb_bread(sb, 0))) {
@@ -688,13 +696,18 @@ hotfix_primary_boot_sector:
                 /*
                  * If we managed to read sector zero and the volume is not
                  * read-only, copy the found, valid backup boot sector to the
-                 * primary boot sector.
+                 * primary boot sector.  Note we only copy the actual boot
+                 * sector structure, not the actual whole device sector as that
+                 * may be bigger and would potentially damage the $Boot system
+                 * file (FIXME: Would be nice to know if the backup boot sector
+                 * on a large sector device contains the whole boot loader or
+                 * just the first 512 bytes).
                  */
                 if (!(sb->s_flags & MS_RDONLY)) {
                         ntfs_warning(sb, "Hot-fix: Recovering invalid primary "
                                         "boot sector from backup copy.");
                         memcpy(bh_primary->b_data, bh_backup->b_data,
-                                        sb->s_blocksize);
+                                        NTFS_BLOCK_SIZE);
                         mark_buffer_dirty(bh_primary);
                         sync_dirty_buffer(bh_primary);
                         if (buffer_uptodate(bh_primary)) {
@@ -733,9 +746,13 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
                         vol->sector_size);
         ntfs_debug("vol->sector_size_bits = %i (0x%x)", vol->sector_size_bits,
                         vol->sector_size_bits);
-        if (vol->sector_size != vol->sb->s_blocksize)
-                ntfs_warning(vol->sb, "The boot sector indicates a sector size "
-                                "different from the device sector size.");
+        if (vol->sector_size < vol->sb->s_blocksize) {
+                ntfs_error(vol->sb, "Sector size (%i) is smaller than the "
+                                "device block size (%lu).  This is not "
+                                "supported.  Sorry.", vol->sector_size,
+                                vol->sb->s_blocksize);
+                return FALSE;
+        }
         ntfs_debug("sectors_per_cluster = 0x%x", b->bpb.sectors_per_cluster);
         sectors_per_cluster_bits = ffs(b->bpb.sectors_per_cluster) - 1;
         ntfs_debug("sectors_per_cluster_bits = 0x%x",
@@ -748,16 +765,11 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         ntfs_debug("vol->cluster_size = %i (0x%x)", vol->cluster_size,
                         vol->cluster_size);
         ntfs_debug("vol->cluster_size_mask = 0x%x", vol->cluster_size_mask);
-        ntfs_debug("vol->cluster_size_bits = %i (0x%x)",
-                        vol->cluster_size_bits, vol->cluster_size_bits);
-        if (vol->sector_size > vol->cluster_size) {
-                ntfs_error(vol->sb, "Sector sizes above the cluster size are "
-                                "not supported.  Sorry.");
-                return FALSE;
-        }
-        if (vol->sb->s_blocksize > vol->cluster_size) {
-                ntfs_error(vol->sb, "Cluster sizes smaller than the device "
-                                "sector size are not supported.  Sorry.");
+        ntfs_debug("vol->cluster_size_bits = %i", vol->cluster_size_bits);
+        if (vol->cluster_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Cluster size (%i) is smaller than the "
+                                "sector size (%i).  This is not supported.  "
+                                "Sorry.", vol->cluster_size, vol->sector_size);
                 return FALSE;
         }
         clusters_per_mft_record = b->clusters_per_mft_record;
@@ -786,11 +798,18 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
          * we store $MFT/$DATA, the table of mft records in the page cache.
          */
         if (vol->mft_record_size > PAGE_CACHE_SIZE) {
-                ntfs_error(vol->sb, "Mft record size %i (0x%x) exceeds the "
-                                "page cache size on your system %lu (0x%lx).  "
+                ntfs_error(vol->sb, "Mft record size (%i) exceeds the "
+                                "PAGE_CACHE_SIZE on your system (%lu).  "
                                 "This is not supported.  Sorry.",
-                                vol->mft_record_size, vol->mft_record_size,
-                                PAGE_CACHE_SIZE, PAGE_CACHE_SIZE);
+                                vol->mft_record_size, PAGE_CACHE_SIZE);
+                return FALSE;
+        }
+        /* We cannot support mft record sizes below the sector size. */
+        if (vol->mft_record_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Mft record size (%i) is smaller than the "
+                                "sector size (%i).  This is not supported.  "
+                                "Sorry.", vol->mft_record_size,
+                                vol->sector_size);
                 return FALSE;
         }
         clusters_per_index_record = b->clusters_per_index_record;
@@ -816,6 +835,14 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         ntfs_debug("vol->index_record_size_bits = %i (0x%x)",
                         vol->index_record_size_bits,
                         vol->index_record_size_bits);
+        /* We cannot support index record sizes below the sector size. */
+        if (vol->index_record_size < vol->sector_size) {
+                ntfs_error(vol->sb, "Index record size (%i) is smaller than "
+                                "the sector size (%i).  This is not "
+                                "supported.  Sorry.", vol->index_record_size,
+                                vol->sector_size);
+                return FALSE;
+        }
         /*
          * Get the size of the volume in clusters and check for 64-bit-ness.
          * Windows currently only uses 32 bits to save the clusters so we do
@@ -845,15 +872,18 @@ static BOOL parse_ntfs_boot_sector(ntfs_volume *vol, const NTFS_BOOT_SECTOR *b)
         }
         ll = sle64_to_cpu(b->mft_lcn);
         if (ll >= vol->nr_clusters) {
-                ntfs_error(vol->sb, "MFT LCN is beyond end of volume.  Weird.");
+                ntfs_error(vol->sb, "MFT LCN (%lli, 0x%llx) is beyond end of "
+                                "volume.  Weird.", (unsigned long long)ll,
+                                (unsigned long long)ll);
                 return FALSE;
         }
         vol->mft_lcn = ll;
         ntfs_debug("vol->mft_lcn = 0x%llx", (long long)vol->mft_lcn);
         ll = sle64_to_cpu(b->mftmirr_lcn);
         if (ll >= vol->nr_clusters) {
-                ntfs_error(vol->sb, "MFTMirr LCN is beyond end of volume.  "
-                                "Weird.");
+                ntfs_error(vol->sb, "MFTMirr LCN (%lli, 0x%llx) is beyond end "
+                                "of volume.  Weird.", (unsigned long long)ll,
+                                (unsigned long long)ll);
                 return FALSE;
         }
         vol->mftmirr_lcn = ll;
@@ -1822,11 +1852,24 @@ get_ctx_vol_failed:
         /* Make sure that no unsupported volume flags are set. */
         if (vol->vol_flags & VOLUME_MUST_MOUNT_RO_MASK) {
                 static const char *es1a = "Volume is dirty";
-                static const char *es1b = "Volume has unsupported flags set";
-                static const char *es2 = ".  Run chkdsk and mount in Windows.";
-                const char *es1;
-                
-                es1 = vol->vol_flags & VOLUME_IS_DIRTY ? es1a : es1b;
+                static const char *es1b = "Volume has been modified by chkdsk";
+                static const char *es1c = "Volume has unsupported flags set";
+                static const char *es2a = ".  Run chkdsk and mount in Windows.";
+                static const char *es2b = ".  Mount in Windows.";
+                const char *es1, *es2;
+
+                es2 = es2a;
+                if (vol->vol_flags & VOLUME_IS_DIRTY)
+                        es1 = es1a;
+                else if (vol->vol_flags & VOLUME_MODIFIED_BY_CHKDSK) {
+                        es1 = es1b;
+                        es2 = es2b;
+                } else {
+                        es1 = es1c;
+                        ntfs_warning(sb, "Unsupported volume flags 0x%x "
+                                        "encountered.",
+                                        (unsigned)le16_to_cpu(vol->vol_flags));
+                }
                 /* If a read-write mount, convert it to a read-only mount. */
                 if (!(sb->s_flags & MS_RDONLY)) {
                         if (!(vol->on_errors & (ON_ERRORS_REMOUNT_RO |
@@ -2685,7 +2728,7 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
         ntfs_volume *vol;
         struct buffer_head *bh;
         struct inode *tmp_ino;
-        int result;
+        int blocksize, result;
 
         ntfs_debug("Entering.");
 #ifndef NTFS_RW
@@ -2724,60 +2767,85 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
         if (!parse_options(vol, (char*)opt))
                 goto err_out_now;
 
+        /* We support sector sizes up to the PAGE_CACHE_SIZE. */
+        if (bdev_hardsect_size(sb->s_bdev) > PAGE_CACHE_SIZE) {
+                if (!silent)
+                        ntfs_error(sb, "Device has unsupported sector size "
+                                        "(%i).  The maximum supported sector "
+                                        "size on this architecture is %lu "
+                                        "bytes.",
+                                        bdev_hardsect_size(sb->s_bdev),
+                                        PAGE_CACHE_SIZE);
+                goto err_out_now;
+        }
         /*
-         * TODO: Fail safety check. In the future we should really be able to
-         * cope with this being the case, but for now just bail out.
+         * Setup the device access block size to NTFS_BLOCK_SIZE or the hard
+         * sector size, whichever is bigger.
          */
-        if (bdev_hardsect_size(sb->s_bdev) > NTFS_BLOCK_SIZE) {
+        blocksize = sb_min_blocksize(sb, NTFS_BLOCK_SIZE);
+        if (blocksize < NTFS_BLOCK_SIZE) {
                 if (!silent)
-                        ntfs_error(sb, "Device has unsupported hardsect_size.");
+                        ntfs_error(sb, "Unable to set device block size.");
                 goto err_out_now;
         }
-
-        /* Setup the device access block size to NTFS_BLOCK_SIZE. */
-        if (sb_set_blocksize(sb, NTFS_BLOCK_SIZE) != NTFS_BLOCK_SIZE) {
+        BUG_ON(blocksize != sb->s_blocksize);
+        ntfs_debug("Set device block size to %i bytes (block size bits %i).",
+                        blocksize, sb->s_blocksize_bits);
+        /* Determine the size of the device in units of block_size bytes. */
+        if (!i_size_read(sb->s_bdev->bd_inode)) {
                 if (!silent)
-                        ntfs_error(sb, "Unable to set block size.");
+                        ntfs_error(sb, "Unable to determine device size.");
                 goto err_out_now;
         }
-
-        /* Get the size of the device in units of NTFS_BLOCK_SIZE bytes. */
         vol->nr_blocks = i_size_read(sb->s_bdev->bd_inode) >>
-                        NTFS_BLOCK_SIZE_BITS;
-
+                        sb->s_blocksize_bits;
         /* Read the boot sector and return unlocked buffer head to it. */
         if (!(bh = read_ntfs_boot_sector(sb, silent))) {
                 if (!silent)
                         ntfs_error(sb, "Not an NTFS volume.");
                 goto err_out_now;
         }
-
         /*
-         * Extract the data from the boot sector and setup the ntfs super block
+         * Extract the data from the boot sector and setup the ntfs volume
          * using it.
          */
         result = parse_ntfs_boot_sector(vol, (NTFS_BOOT_SECTOR*)bh->b_data);
-
-        /* Initialize the cluster and mft allocators. */
-        ntfs_setup_allocators(vol);
-
         brelse(bh);
-
         if (!result) {
                 if (!silent)
                         ntfs_error(sb, "Unsupported NTFS filesystem.");
                 goto err_out_now;
         }
-
         /*
-         * TODO: When we start coping with sector sizes different from
-         * NTFS_BLOCK_SIZE, we now probably need to set the blocksize of the
-         * device (probably to NTFS_BLOCK_SIZE).
+         * If the boot sector indicates a sector size bigger than the current
+         * device block size, switch the device block size to the sector size.
+         * TODO: It may be possible to support this case even when the set
+         * below fails, we would just be breaking up the i/o for each sector
+         * into multiple blocks for i/o purposes but otherwise it should just
+         * work.  However it is safer to leave disabled until someone hits this
+         * error message and then we can get them to try it without the setting
+         * so we know for sure that it works.
          */
-
+        if (vol->sector_size > blocksize) {
+                blocksize = sb_set_blocksize(sb, vol->sector_size);
+                if (blocksize != vol->sector_size) {
+                        if (!silent)
+                                ntfs_error(sb, "Unable to set device block "
+                                                "size to sector size (%i).",
+                                                vol->sector_size);
+                        goto err_out_now;
+                }
+                BUG_ON(blocksize != sb->s_blocksize);
+                vol->nr_blocks = i_size_read(sb->s_bdev->bd_inode) >>
+                                sb->s_blocksize_bits;
+                ntfs_debug("Changed device block size to %i bytes (block size "
+                                "bits %i) to match volume sector size.",
+                                blocksize, sb->s_blocksize_bits);
+        }
+        /* Initialize the cluster and mft allocators. */
+        ntfs_setup_allocators(vol);
         /* Setup remaining fields in the super block. */
         sb->s_magic = NTFS_SB_MAGIC;
-
         /*
          * Ntfs allows 63 bits for the file size, i.e. correct would be:
          *      sb->s_maxbytes = ~0ULL >> 1;
@@ -2787,9 +2855,8 @@ static int ntfs_fill_super(struct super_block *sb, void *opt, const int silent)
          * without overflowing the index or to 2^63 - 1, whichever is smaller.
          */
         sb->s_maxbytes = MAX_LFS_FILESIZE;
-
+        /* Ntfs measures time in 100ns intervals. */
         sb->s_time_gran = 100;
-
         /*
          * Now load the metadata required for the page cache and our address
          * space operations to function. We do this by setting up a specialised
@@ -2987,14 +3054,14 @@ err_out_now:
  * strings of the maximum length allowed by NTFS, which is NTFS_MAX_NAME_LEN
  * (255) Unicode characters + a terminating NULL Unicode character.
  */
-kmem_cache_t *ntfs_name_cache;
+struct kmem_cache *ntfs_name_cache;
 
 /* Slab caches for efficient allocation/deallocation of inodes. */
-kmem_cache_t *ntfs_inode_cache;
-kmem_cache_t *ntfs_big_inode_cache;
+struct kmem_cache *ntfs_inode_cache;
+struct kmem_cache *ntfs_big_inode_cache;
 
 /* Init once constructor for the inode slab cache. */
-static void ntfs_big_inode_init_once(void *foo, kmem_cache_t *cachep,
+static void ntfs_big_inode_init_once(void *foo, struct kmem_cache *cachep,
                 unsigned long flags)
 {
         ntfs_inode *ni = (ntfs_inode *)foo;
@@ -3008,8 +3075,8 @@ static void ntfs_big_inode_init_once(void *foo, kmem_cache_t *cachep,
  * Slab caches to optimize allocations and deallocations of attribute search
  * contexts and index contexts, respectively.
  */
-kmem_cache_t *ntfs_attr_ctx_cache;
-kmem_cache_t *ntfs_index_ctx_cache;
+struct kmem_cache *ntfs_attr_ctx_cache;
+struct kmem_cache *ntfs_index_ctx_cache;
 
 /* Driver wide semaphore. */
 DECLARE_MUTEX(ntfs_lock);
diff --git a/fs/ntfs/upcase.c b/fs/ntfs/upcase.c
index 879cdf1d5bd3..9101807dc81a 100644
--- a/fs/ntfs/upcase.c
+++ b/fs/ntfs/upcase.c
@@ -3,10 +3,7 @@
  *            Part of the Linux-NTFS project.
  *
  * Copyright (c) 2001 Richard Russon <ntfs@flatcap.org>
- * Copyright (c) 2001-2004 Anton Altaparmakov
- *
- * Modified for mkntfs inclusion 9 June 2001 by Anton Altaparmakov.
- * Modified for kernel inclusion 10 September 2001 by Anton Altparmakov.
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
@@ -75,12 +72,13 @@ ntfschar *generate_default_upcase(void)
         if (!uc)
                 return uc;
         memset(uc, 0, default_upcase_len * sizeof(ntfschar));
+        /* Generate the little endian Unicode upcase table used by ntfs. */
         for (i = 0; i < default_upcase_len; i++)
                 uc[i] = cpu_to_le16(i);
         for (r = 0; uc_run_table[r][0]; r++)
                 for (i = uc_run_table[r][0]; i < uc_run_table[r][1]; i++)
-                        uc[i] = cpu_to_le16((le16_to_cpu(uc[i]) +
-                                        uc_run_table[r][2]));
+                        uc[i] = cpu_to_le16(le16_to_cpu(uc[i]) +
+                                        uc_run_table[r][2]);
         for (r = 0; uc_dup_table[r][0]; r++)
                 for (i = uc_dup_table[r][0]; i < uc_dup_table[r][1]; i += 2)
                         uc[i + 1] = cpu_to_le16(le16_to_cpu(uc[i + 1]) - 1);
diff --git a/fs/ntfs/volume.h b/fs/ntfs/volume.h
index 375cd20a9f61..406ab55dfb32 100644
--- a/fs/ntfs/volume.h
+++ b/fs/ntfs/volume.h
@@ -2,7 +2,7 @@
  * volume.h - Defines for volume structures in NTFS Linux kernel driver. Part
  *            of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2005 Anton Altaparmakov
+ * Copyright (c) 2001-2006 Anton Altaparmakov
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -41,10 +41,8 @@ typedef struct {
          * structure has stabilized... (AIA)
          */
         /* Device specifics. */
-        struct super_block *sb;         /* Pointer back to the super_block,
-                                           so we don't have to get the offset
-                                           every time. */
-        LCN nr_blocks;                  /* Number of NTFS_BLOCK_SIZE bytes
+        struct super_block *sb;         /* Pointer back to the super_block. */
+        LCN nr_blocks;                  /* Number of sb->s_blocksize bytes
                                            sized blocks on the device. */
         /* Configuration provided by user at mount time. */
         unsigned long flags;            /* Miscellaneous flags, see below. */
@@ -141,8 +139,8 @@ typedef enum {
         NV_ShowSystemFiles,     /* 1: Return system files in ntfs_readdir(). */
         NV_CaseSensitive,       /* 1: Treat file names as case sensitive and
                                       create filenames in the POSIX namespace.
-                                      Otherwise be case insensitive and create
-                                      file names in WIN32 namespace. */
+                                      Otherwise be case insensitive but still
+                                      create file names in POSIX namespace. */
         NV_LogFileEmpty,        /* 1: $LogFile journal is empty. */
         NV_QuotaOutOfDate,      /* 1: $Quota is out of date. */
         NV_UsnJrnlStamped,      /* 1: $UsnJrnl has been stamped. */
@@ -153,7 +151,7 @@ typedef enum {
  * Macro tricks to expand the NVolFoo(), NVolSetFoo(), and NVolClearFoo()
  * functions.
  */
-#define NVOL_FNS(flag)                                  \
+#define DEFINE_NVOL_BIT_OPS(flag)                                       \
 static inline int NVol##flag(ntfs_volume *vol)          \
 {                                                       \
         return test_bit(NV_##flag, &(vol)->flags);      \
@@ -168,12 +166,12 @@ static inline void NVolClear##flag(ntfs_volume *vol)	\
 }
 
 /* Emit the ntfs volume bitops functions. */
-NVOL_FNS(Errors)
-NVOL_FNS(ShowSystemFiles)
-NVOL_FNS(CaseSensitive)
-NVOL_FNS(LogFileEmpty)
-NVOL_FNS(QuotaOutOfDate)
-NVOL_FNS(UsnJrnlStamped)
-NVOL_FNS(SparseEnabled)
+DEFINE_NVOL_BIT_OPS(Errors)
+DEFINE_NVOL_BIT_OPS(ShowSystemFiles)
+DEFINE_NVOL_BIT_OPS(CaseSensitive)
+DEFINE_NVOL_BIT_OPS(LogFileEmpty)
+DEFINE_NVOL_BIT_OPS(QuotaOutOfDate)
+DEFINE_NVOL_BIT_OPS(UsnJrnlStamped)
+DEFINE_NVOL_BIT_OPS(SparseEnabled)
 
 #endif /* _LINUX_NTFS_VOLUME_H */
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 6573f31f1fd9..075d3e945602 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -204,10 +204,6 @@ int proc_fill_super(struct super_block *s, void *data, int silent)
         root_inode = proc_get_inode(s, PROC_ROOT_INO, &proc_root);
         if (!root_inode)
                 goto out_no_root;
-        /*
-         * Fixup the root inode's nlink value
-         */
-        root_inode->i_nlink += nr_processes();
         root_inode->i_uid = 0;
         root_inode->i_gid = 0;
         s->s_root = d_alloc_root(root_inode);
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 68896283c8ae..c3fd3611112f 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -80,16 +80,16 @@ void __init proc_root_init(void)
         proc_bus = proc_mkdir("bus", NULL);
 }
 
-static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd)
+static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
+)
 {
-        /*
-         * nr_threads is actually protected by the tasklist_lock;
-         * however, it's conventional to do reads, especially for
-         * reporting, without any locking whatsoever.
-         */
-        if (dir->i_ino == PROC_ROOT_INO) /* check for safety... */
-                dir->i_nlink = proc_root.nlink + nr_threads;
+        generic_fillattr(dentry->d_inode, stat);
+        stat->nlink = proc_root.nlink + nr_processes();
+        return 0;
+}
 
+static struct dentry *proc_root_lookup(struct inode * dir, struct dentry * dentry, struct nameidata *nd)
+{
         if (!proc_lookup(dir, dentry, nd)) {
                 return NULL;
         }
@@ -134,6 +134,7 @@ static struct file_operations proc_root_operations = {
  */
 static struct inode_operations proc_root_inode_operations = {
         .lookup         = proc_root_lookup,
+        .getattr        = proc_root_getattr,
 };
 
 /*
diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c
index c66bd5e4c05c..cde5d48994ae 100644
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -27,6 +27,7 @@
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
+#include <linux/time.h>
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/smp_lock.h>
@@ -104,6 +105,7 @@ ramfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
                 d_instantiate(dentry, inode);
                 dget(dentry);   /* Extra count - pin the dentry in core */
                 error = 0;
+                dir->i_mtime = dir->i_ctime = CURRENT_TIME;
         }
         return error;
 }
diff --git a/fs/select.c b/fs/select.c
index 6ce68a9c8976..1815a57d2255 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -404,7 +404,7 @@ asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
                         goto sticky;
                 rtv.tv_usec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ));
                 rtv.tv_sec = timeout;
-                if (timeval_compare(&rtv, &tv) < 0)
+                if (timeval_compare(&rtv, &tv) >= 0)
                         rtv = tv;
                 if (copy_to_user(tvp, &rtv, sizeof(rtv))) {
 sticky:
@@ -471,7 +471,7 @@ asmlinkage long sys_pselect7(int n, fd_set __user *inp, fd_set __user *outp,
                 rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
                                                 1000;
                 rts.tv_sec = timeout;
-                if (timespec_compare(&rts, &ts) < 0)
+                if (timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
                 if (copy_to_user(tsp, &rts, sizeof(rts))) {
 sticky:
@@ -775,7 +775,7 @@ asmlinkage long sys_ppoll(struct pollfd __user *ufds, unsigned int nfds,
                 rts.tv_nsec = jiffies_to_usecs(do_div((*(u64*)&timeout), HZ)) *
                                                 1000;
                 rts.tv_sec = timeout;
-                if (timespec_compare(&rts, &ts) < 0)
+                if (timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
                 if (copy_to_user(tsp, &rts, sizeof(rts))) {
                 sticky:
diff --git a/fs/super.c b/fs/super.c
index 30294218fa63..e20b5580afd5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -666,6 +666,16 @@ static int test_bdev_super(struct super_block *s, void *data)
         return (void *)s->s_bdev == data;
 }
 
+static void bdev_uevent(struct block_device *bdev, enum kobject_action action)
+{
+        if (bdev->bd_disk) {
+                if (bdev->bd_part)
+                        kobject_uevent(&bdev->bd_part->kobj, action);
+                else
+                        kobject_uevent(&bdev->bd_disk->kobj, action);
+        }
+}
+
 struct super_block *get_sb_bdev(struct file_system_type *fs_type,
         int flags, const char *dev_name, void *data,
         int (*fill_super)(struct super_block *, void *, int))
@@ -707,8 +717,10 @@ struct super_block *get_sb_bdev(struct file_system_type *fs_type,
                         up_write(&s->s_umount);
                         deactivate_super(s);
                         s = ERR_PTR(error);
-                } else
+                } else {
                         s->s_flags |= MS_ACTIVE;
+                        bdev_uevent(bdev, KOBJ_MOUNT);
+                }
         }
 
         return s;
@@ -724,6 +736,7 @@ void kill_block_super(struct super_block *sb)
 {
         struct block_device *bdev = sb->s_bdev;
 
+        bdev_uevent(bdev, KOBJ_UMOUNT);
         generic_shutdown_super(sb);
         sync_blockdev(bdev);
         close_bdev_excl(bdev);
diff --git a/include/asm-arm/arch-at91rm9200/gpio.h b/include/asm-arm/arch-at91rm9200/gpio.h
index 0f0a61e2f129..6176ab2dc417 100644
--- a/include/asm-arm/arch-at91rm9200/gpio.h
+++ b/include/asm-arm/arch-at91rm9200/gpio.h
@@ -183,6 +183,7 @@ extern int at91_set_B_periph(unsigned pin, int use_pullup);
 extern int at91_set_gpio_input(unsigned pin, int use_pullup);
 extern int at91_set_gpio_output(unsigned pin, int value);
 extern int at91_set_deglitch(unsigned pin, int is_on);
+extern int at91_set_multi_drive(unsigned pin, int is_on);
 
 /* callable at any time */
 extern int at91_set_gpio_value(unsigned pin, int value);
diff --git a/include/asm-arm/arch-ixp4xx/nas100d.h b/include/asm-arm/arch-ixp4xx/nas100d.h
index 51ac0180427c..84467a5190d0 100644
--- a/include/asm-arm/arch-ixp4xx/nas100d.h
+++ b/include/asm-arm/arch-ixp4xx/nas100d.h
@@ -19,8 +19,8 @@
 #error "Do not include this directly, instead #include <asm/hardware.h>"
 #endif
 
-#define NAS100D_SDA_PIN         6
-#define NAS100D_SCL_PIN         5
+#define NAS100D_SDA_PIN         5
+#define NAS100D_SCL_PIN         6
 
 /*
  * NAS100D PCI IRQs
diff --git a/include/asm-arm/smp.h b/include/asm-arm/smp.h
index 5a72e50ca9fc..fe45f7f61223 100644
--- a/include/asm-arm/smp.h
+++ b/include/asm-arm/smp.h
@@ -42,6 +42,11 @@ extern void show_ipi_list(struct seq_file *p);
 asmlinkage void do_IPI(struct pt_regs *regs);
 
 /*
+ * Setup the SMP cpu_possible_map
+ */
+extern void smp_init_cpus(void);
+
+/*
  * Move global data into per-processor storage.
  */
 extern void smp_store_cpu_info(unsigned int cpuid);
diff --git a/include/asm-arm/unistd.h b/include/asm-arm/unistd.h
index 77430d6178ae..8f331bbd39a8 100644
--- a/include/asm-arm/unistd.h
+++ b/include/asm-arm/unistd.h
@@ -309,7 +309,7 @@
 #define __NR_mq_getsetattr              (__NR_SYSCALL_BASE+279)
 #define __NR_waitid                     (__NR_SYSCALL_BASE+280)
 
-#if 0 /* reserve these for un-muxing socketcall */
+#if defined(__ARM_EABI__)  /* reserve these for un-muxing socketcall */
 #define __NR_socket                     (__NR_SYSCALL_BASE+281)
 #define __NR_bind                       (__NR_SYSCALL_BASE+282)
 #define __NR_connect                    (__NR_SYSCALL_BASE+283)
@@ -329,7 +329,7 @@
 #define __NR_recvmsg                    (__NR_SYSCALL_BASE+297)
 #endif
 
-#if 0 /* reserve these for un-muxing ipc */
+#if defined(__ARM_EABI__)  /* reserve these for un-muxing ipc */
 #define __NR_semop                      (__NR_SYSCALL_BASE+298)
 #define __NR_semget                     (__NR_SYSCALL_BASE+299)
 #define __NR_semctl                     (__NR_SYSCALL_BASE+300)
@@ -347,7 +347,7 @@
 #define __NR_request_key                (__NR_SYSCALL_BASE+310)
 #define __NR_keyctl                     (__NR_SYSCALL_BASE+311)
 
-#if 0 /* reserved for un-muxing ipc */
+#if defined(__ARM_EABI__)  /* reserved for un-muxing ipc */
 #define __NR_semtimedop                 (__NR_SYSCALL_BASE+312)
 #endif
 
diff --git a/include/asm-i386/desc.h b/include/asm-i386/desc.h
index 494e73bca095..89b8b82c82b3 100644
--- a/include/asm-i386/desc.h
+++ b/include/asm-i386/desc.h
@@ -24,11 +24,13 @@ struct Xgt_desc_struct {
         unsigned short pad;
 } __attribute__ ((packed));
 
-extern struct Xgt_desc_struct idt_descr, cpu_gdt_descr[NR_CPUS];
+extern struct Xgt_desc_struct idt_descr;
+DECLARE_PER_CPU(struct Xgt_desc_struct, cpu_gdt_descr);
+
 
 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
 {
-        return ((struct desc_struct *)cpu_gdt_descr[cpu].address);
+        return (struct desc_struct *)per_cpu(cpu_gdt_descr, cpu).address;
 }
 
 #define load_TR_desc() __asm__ __volatile__("ltr %w0"::"q" (GDT_ENTRY_TSS*8))
diff --git a/include/asm-i386/kprobes.h b/include/asm-i386/kprobes.h
index 27cac050a60e..a0d2d74a7dda 100644
--- a/include/asm-i386/kprobes.h
+++ b/include/asm-i386/kprobes.h
@@ -27,6 +27,9 @@
 #include <linux/types.h>
 #include <linux/ptrace.h>
 
+#define  __ARCH_WANT_KPROBES_INSN_SLOT
+
+struct kprobe;
 struct pt_regs;
 
 typedef u8 kprobe_opcode_t;
@@ -40,14 +43,14 @@ typedef u8 kprobe_opcode_t;
 
 #define JPROBE_ENTRY(pentry)    (kprobe_opcode_t *)pentry
 #define ARCH_SUPPORTS_KRETPROBES
-#define arch_remove_kprobe(p)   do {} while (0)
 
+void arch_remove_kprobe(struct kprobe *p);
 void kretprobe_trampoline(void);
 
 /* Architecture specific copy of original instruction*/
 struct arch_specific_insn {
         /* copy of the original instruction */
-        kprobe_opcode_t insn[MAX_INSN_SIZE];
+        kprobe_opcode_t *insn;
 };
 
 struct prev_kprobe {
diff --git a/include/asm-i386/thread_info.h b/include/asm-i386/thread_info.h
index e20e99551d71..1f7d48c9ba3f 100644
--- a/include/asm-i386/thread_info.h
+++ b/include/asm-i386/thread_info.h
@@ -158,8 +158,8 @@ register unsigned long current_stack_pointer asm("esp") __attribute_used__;
 
 /* work to do on interrupt/exception return */
 #define _TIF_WORK_MASK \
-  (0x0000FFFF & ~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SINGLESTEP|\
-                  _TIF_SECCOMP|_TIF_SYSCALL_EMU))
+  (0x0000FFFF & ~(_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
+                  _TIF_SECCOMP | _TIF_SYSCALL_EMU))
 /* work to do on any return to u-space */
 #define _TIF_ALLWORK_MASK       (0x0000FFFF & ~_TIF_SECCOMP)
 
diff --git a/include/asm-ia64/acpi.h b/include/asm-ia64/acpi.h
index 3a544ffc5008..f7a517654308 100644
--- a/include/asm-ia64/acpi.h
+++ b/include/asm-ia64/acpi.h
@@ -106,6 +106,8 @@ extern unsigned int can_cpei_retarget(void);
 extern unsigned int is_cpu_cpei_target(unsigned int cpu);
 extern void set_cpei_target_cpu(unsigned int cpu);
 extern unsigned int get_cpei_target_cpu(void);
+extern void prefill_possible_map(void);
+extern int additional_cpus;
 
 #ifdef CONFIG_ACPI_NUMA
 /* Proximity bitmap length; _PXM is at most 255 (8 bit)*/
diff --git a/include/asm-ia64/machvec_sn2.h b/include/asm-ia64/machvec_sn2.h
index e1b6cd63f49e..03d00faf03b5 100644
--- a/include/asm-ia64/machvec_sn2.h
+++ b/include/asm-ia64/machvec_sn2.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002-2003 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2002-2003, 2006 Silicon Graphics, Inc.  All Rights Reserved.
  * 
  * This program is free software; you can redistribute it and/or modify it 
  * under the terms of version 2 of the GNU General Public License 
@@ -20,11 +20,6 @@
  * License along with this program; if not, write the Free Software 
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA.
  * 
- * Contact information:  Silicon Graphics, Inc., 1600 Amphitheatre Pkwy, 
- * Mountain View, CA  94043, or:
- * 
- * http://www.sgi.com 
- * 
  * For further information regarding this notice, see: 
  * 
  * http://oss.sgi.com/projects/GenInfo/NoticeExplan
diff --git a/include/asm-ia64/sn/arch.h b/include/asm-ia64/sn/arch.h
index 1a3831c04af6..91c31be87b13 100644
--- a/include/asm-ia64/sn/arch.h
+++ b/include/asm-ia64/sn/arch.h
@@ -70,7 +70,7 @@ DECLARE_PER_CPU(struct sn_hub_info_s, __sn_hub_info);
  * Compact node ID to nasid mappings kept in the per-cpu data areas of each
  * cpu.
  */
-DECLARE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_NUMNODES]);
+DECLARE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_COMPACT_NODES]);
 #define sn_cnodeid_to_nasid     (&__get_cpu_var(__sn_cnodeid_to_nasid[0]))
 
 
diff --git a/include/asm-ia64/sn/bte.h b/include/asm-ia64/sn/bte.h
index 01e5b4103235..5335d87ca5f8 100644
--- a/include/asm-ia64/sn/bte.h
+++ b/include/asm-ia64/sn/bte.h
@@ -46,7 +46,7 @@
 #define BTES_PER_NODE (is_shub2() ? 4 : 2)
 #define MAX_BTES_PER_NODE 4
 
-#define BTE2OFF_CTRL    (0)
+#define BTE2OFF_CTRL    0
 #define BTE2OFF_SRC     (SH2_BT_ENG_SRC_ADDR_0 - SH2_BT_ENG_CSR_0)
 #define BTE2OFF_DEST    (SH2_BT_ENG_DEST_ADDR_0 - SH2_BT_ENG_CSR_0)
 #define BTE2OFF_NOTIFY  (SH2_BT_ENG_NOTIF_ADDR_0 - SH2_BT_ENG_CSR_0)
@@ -75,11 +75,11 @@
                 : base + (BTEOFF_NOTIFY/8))
 
 /* Define hardware modes */
-#define BTE_NOTIFY (IBCT_NOTIFY)
+#define BTE_NOTIFY IBCT_NOTIFY
 #define BTE_NORMAL BTE_NOTIFY
 #define BTE_ZERO_FILL (BTE_NOTIFY | IBCT_ZFIL_MODE)
 /* Use a reserved bit to let the caller specify a wait for any BTE */
-#define BTE_WACQUIRE (0x4000)
+#define BTE_WACQUIRE 0x4000
 /* Use the BTE on the node with the destination memory */
 #define BTE_USE_DEST (BTE_WACQUIRE << 1)
 /* Use any available BTE interface on any node for the transfer */
diff --git a/include/asm-ia64/sn/pcibr_provider.h b/include/asm-ia64/sn/pcibr_provider.h
index 9334078b089a..a601d3af39b6 100644
--- a/include/asm-ia64/sn/pcibr_provider.h
+++ b/include/asm-ia64/sn/pcibr_provider.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1992-1997,2000-2004 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1992-1997,2000-2006 Silicon Graphics, Inc. All rights reserved.
  */
 #ifndef _ASM_IA64_SN_PCI_PCIBR_PROVIDER_H
 #define _ASM_IA64_SN_PCI_PCIBR_PROVIDER_H
@@ -115,18 +115,6 @@ struct pcibus_info {
         spinlock_t              pbi_lock;
 };
 
-/*
- * pcibus_info structure locking macros
- */
-inline static unsigned long
-pcibr_lock(struct pcibus_info *pcibus_info)
-{
-        unsigned long flag;
-        spin_lock_irqsave(&pcibus_info->pbi_lock, flag);
-        return(flag);
-}
-#define pcibr_unlock(pcibus_info, flag)  spin_unlock_irqrestore(&pcibus_info->pbi_lock, flag)
-
 extern int  pcibr_init_provider(void);
 extern void *pcibr_bus_fixup(struct pcibus_bussoft *, struct pci_controller *);
 extern dma_addr_t pcibr_dma_map(struct pci_dev *, unsigned long, size_t);
diff --git a/include/asm-ia64/sn/sn_feature_sets.h b/include/asm-ia64/sn/sn_feature_sets.h
index 9ca642cad338..ff33e3bd3f8e 100644
--- a/include/asm-ia64/sn/sn_feature_sets.h
+++ b/include/asm-ia64/sn/sn_feature_sets.h
@@ -12,9 +12,6 @@
  */
 
 
-#include <asm/types.h>
-#include <asm/bitops.h>
-
 /* --------------------- PROM Features -----------------------------*/
 extern int sn_prom_feature_available(int id);
 
diff --git a/include/asm-ia64/sn/xpc.h b/include/asm-ia64/sn/xpc.h
index 0c36928ffd8b..df7f5f4f3cde 100644
--- a/include/asm-ia64/sn/xpc.h
+++ b/include/asm-ia64/sn/xpc.h
@@ -508,19 +508,24 @@ struct xpc_channel {
 #define XPC_C_OPENREQUEST       0x00000010 /* local open channel request */
 
 #define XPC_C_SETUP             0x00000020 /* channel's msgqueues are alloc'd */
-#define XPC_C_CONNECTCALLOUT    0x00000040 /* channel connected callout made */
-#define XPC_C_CONNECTED         0x00000080 /* local channel is connected */
-#define XPC_C_CONNECTING        0x00000100 /* channel is being connected */
-
-#define XPC_C_RCLOSEREPLY       0x00000200 /* remote close channel reply */
-#define XPC_C_CLOSEREPLY        0x00000400 /* local close channel reply */
-#define XPC_C_RCLOSEREQUEST     0x00000800 /* remote close channel request */
-#define XPC_C_CLOSEREQUEST      0x00001000 /* local close channel request */
-
-#define XPC_C_DISCONNECTED      0x00002000 /* channel is disconnected */
-#define XPC_C_DISCONNECTING     0x00004000 /* channel is being disconnected */
-#define XPC_C_DISCONNECTCALLOUT 0x00008000 /* chan disconnected callout made */
-#define XPC_C_WDISCONNECT       0x00010000 /* waiting for channel disconnect */
+#define XPC_C_CONNECTEDCALLOUT  0x00000040 /* connected callout initiated */
+#define XPC_C_CONNECTEDCALLOUT_MADE \
+                                0x00000080 /* connected callout completed */
+#define XPC_C_CONNECTED         0x00000100 /* local channel is connected */
+#define XPC_C_CONNECTING        0x00000200 /* channel is being connected */
+
+#define XPC_C_RCLOSEREPLY       0x00000400 /* remote close channel reply */
+#define XPC_C_CLOSEREPLY        0x00000800 /* local close channel reply */
+#define XPC_C_RCLOSEREQUEST     0x00001000 /* remote close channel request */
+#define XPC_C_CLOSEREQUEST      0x00002000 /* local close channel request */
+
+#define XPC_C_DISCONNECTED      0x00004000 /* channel is disconnected */
+#define XPC_C_DISCONNECTING     0x00008000 /* channel is being disconnected */
+#define XPC_C_DISCONNECTINGCALLOUT \
+                                0x00010000 /* disconnecting callout initiated */
+#define XPC_C_DISCONNECTINGCALLOUT_MADE \
+                                0x00020000 /* disconnecting callout completed */
+#define XPC_C_WDISCONNECT       0x00040000 /* waiting for channel disconnect */
 
 
 
diff --git a/include/asm-ia64/timex.h b/include/asm-ia64/timex.h
index 414aae060440..05a6baf8a472 100644
--- a/include/asm-ia64/timex.h
+++ b/include/asm-ia64/timex.h
@@ -15,6 +15,8 @@
 
 typedef unsigned long cycles_t;
 
+extern void (*ia64_udelay)(unsigned long usecs);
+
 /*
  * For performance reasons, we don't want to define CLOCK_TICK_TRATE as
  * local_cpu_data->itc_rate.  Fortunately, we don't have to, either: according to George
diff --git a/include/asm-m32r/system.h b/include/asm-m32r/system.h
index 06c12a037cba..d6a2c613be68 100644
--- a/include/asm-m32r/system.h
+++ b/include/asm-m32r/system.h
@@ -239,7 +239,7 @@ __cmpxchg_u32(volatile unsigned int *p, unsigned int old, unsigned int new)
                 "       bra     2f;             \n"
                 "       .fillinsn               \n"
                 "1:"
-                        M32R_UNLOCK" %2, @%1;   \n"
+                        M32R_UNLOCK" %0, @%1;   \n"
                 "       .fillinsn               \n"
                 "2:"
                         : "=&r" (retval)
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index 0da7c47d2f01..e8ae61956a51 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -328,7 +328,7 @@ extern void __put_user_bad(void);
                 "       .long 1b,4b\n"                                  \
                 "       .long 2b,4b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                             \
                 : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                 : "r14", "memory")
 
@@ -353,7 +353,7 @@ extern void __put_user_bad(void);
                 "       .long 1b,4b\n"                                  \
                 "       .long 2b,4b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                            \
                 : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                 : "r14", "memory")
 #else
@@ -398,7 +398,7 @@ struct __large_struct { unsigned long buf[100]; };
                 "       .balign 4\n"                                    \
                 "       .long 1b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err)                                             \
+                : "=&r"(err)                                            \
                 : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
                 : "r14", "memory")
 
@@ -442,7 +442,7 @@ do {									\
                 "       .balign 4\n"                                    \
                 "       .long 1b,3b\n"                                  \
                 ".previous"                                             \
-                : "=r"(err), "=&r"(x)                                   \
+                : "=&r"(err), "=&r"(x)                                  \
                 : "r"(addr), "i"(-EFAULT), "0"(err)                     \
                 : "r14", "memory")
 
diff --git a/include/asm-m68k/irq.h b/include/asm-m68k/irq.h
index 325c86f8512d..9ac047c400c4 100644
--- a/include/asm-m68k/irq.h
+++ b/include/asm-m68k/irq.h
@@ -79,7 +79,7 @@ static __inline__ int irq_canonicalize(int irq)
 
 extern void (*enable_irq)(unsigned int);
 extern void (*disable_irq)(unsigned int);
-#define enable_irq_nosync       enable_irq
+#define disable_irq_nosync      disable_irq
 
 struct pt_regs;
 
diff --git a/include/asm-m68k/raw_io.h b/include/asm-m68k/raw_io.h
index 5439bcaa57c6..811ccd25d4a6 100644
--- a/include/asm-m68k/raw_io.h
+++ b/include/asm-m68k/raw_io.h
@@ -336,6 +336,7 @@ static inline void raw_outsw_swapw(volatile u16 __iomem *port, const u16 *buf,
                 : "d0", "a0", "a1", "d6");
 }
 
+#define __raw_writel raw_outl
 
 #endif /* __KERNEL__ */
 
diff --git a/include/asm-mips/uaccess.h b/include/asm-mips/uaccess.h
index 7a553e9d44d3..b96f3e0f3933 100644
--- a/include/asm-mips/uaccess.h
+++ b/include/asm-mips/uaccess.h
@@ -233,7 +233,7 @@ do {									\
 #define __get_user_check(x,ptr,size)                                    \
 ({                                                                      \
         long __gu_err = -EFAULT;                                        \
-        const void __user * __gu_ptr = (ptr);                           \
+        const __typeof__(*(ptr)) __user * __gu_ptr = (ptr);             \
                                                                         \
         if (likely(access_ok(VERIFY_READ,  __gu_ptr, size)))            \
                 __get_user_common((x), size, __gu_ptr);                 \
@@ -258,7 +258,7 @@ do {									\
         : "=r" (__gu_err), "=r" (__gu_tmp)                              \
         : "0" (0), "o" (__m(addr)), "i" (-EFAULT));                     \
                                                                         \
-        (val) = (__typeof__(val)) __gu_tmp;                             \
+        (val) = (__typeof__(*(addr))) __gu_tmp;                         \
 }
 
 /*
@@ -284,7 +284,7 @@ do {									\
         "       .previous                                       \n"     \
         : "=r" (__gu_err), "=&r" (__gu_tmp)                             \
         : "0" (0), "r" (addr), "i" (-EFAULT));                          \
-        (val) = __gu_tmp;                                               \
+        (val) = (__typeof__(*(addr))) __gu_tmp;                         \
 }
 
 /*
diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h
index 769305d20108..b5c78a4a0192 100644
--- a/include/asm-mips/unistd.h
+++ b/include/asm-mips/unistd.h
@@ -313,7 +313,7 @@
 #define __NR_mknodat                    (__NR_Linux + 290)
 #define __NR_fchownat                   (__NR_Linux + 291)
 #define __NR_futimesat                  (__NR_Linux + 292)
-#define __NR_newfstatat                 (__NR_Linux + 293)
+#define __NR_fstatat                    (__NR_Linux + 293)
 #define __NR_unlinkat                   (__NR_Linux + 294)
 #define __NR_renameat                   (__NR_Linux + 295)
 #define __NR_linkat                     (__NR_Linux + 296)
@@ -593,7 +593,7 @@
 #define __NR_mknodat                    (__NR_Linux + 249)
 #define __NR_fchownat                   (__NR_Linux + 250)
 #define __NR_futimesat                  (__NR_Linux + 251)
-#define __NR_newfstatat                 (__NR_Linux + 252)
+#define __NR_fstatat                    (__NR_Linux + 252)
 #define __NR_unlinkat                   (__NR_Linux + 253)
 #define __NR_renameat                   (__NR_Linux + 254)
 #define __NR_linkat                     (__NR_Linux + 255)
@@ -877,7 +877,7 @@
 #define __NR_mknodat                    (__NR_Linux + 253)
 #define __NR_fchownat                   (__NR_Linux + 254)
 #define __NR_futimesat                  (__NR_Linux + 255)
-#define __NR_newfstatat                 (__NR_Linux + 256)
+#define __NR_fstatat                    (__NR_Linux + 256)
 #define __NR_unlinkat                   (__NR_Linux + 257)
 #define __NR_renameat                   (__NR_Linux + 258)
 #define __NR_linkat                     (__NR_Linux + 259)
diff --git a/include/asm-powerpc/cputable.h b/include/asm-powerpc/cputable.h
index 64210549f56b..90d005bb4d1c 100644
--- a/include/asm-powerpc/cputable.h
+++ b/include/asm-powerpc/cputable.h
@@ -159,9 +159,11 @@ extern void do_cpu_ftr_fixups(unsigned long offset);
 #endif
 
 /* We need to mark all pages as being coherent if we're SMP or we
- * have a 74[45]x and an MPC107 host bridge.
+ * have a 74[45]x and an MPC107 host bridge. Also 83xx requires
+ * it for PCI "streaming/prefetch" to work properly.
  */
-#if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE)
+#if defined(CONFIG_SMP) || defined(CONFIG_MPC10X_BRIDGE) \
+        || defined(CONFIG_PPC_83xx)
 #define CPU_FTR_COMMON                  CPU_FTR_NEED_COHERENT
 #else
 #define CPU_FTR_COMMON                  0
@@ -277,7 +279,8 @@ enum {
         CPU_FTRS_G2_LE = CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_MAYBE_CAN_DOZE |
             CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
         CPU_FTRS_E300 = CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_MAYBE_CAN_DOZE |
-            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS,
+            CPU_FTR_USE_TB | CPU_FTR_MAYBE_CAN_NAP | CPU_FTR_HAS_HIGH_BATS |
+            CPU_FTR_COMMON,
         CPU_FTRS_CLASSIC32 = CPU_FTR_COMMON | CPU_FTR_SPLIT_ID_CACHE |
             CPU_FTR_USE_TB | CPU_FTR_HPTE_TABLE,
         CPU_FTRS_POWER3_32 = CPU_FTR_COMMON | CPU_FTR_SPLIT_ID_CACHE |
diff --git a/include/asm-powerpc/mmu.h b/include/asm-powerpc/mmu.h
index d096d9e76ad7..b0b9a3f8cdc2 100644
--- a/include/asm-powerpc/mmu.h
+++ b/include/asm-powerpc/mmu.h
@@ -112,6 +112,7 @@ typedef struct {
 } hpte_t;
 
 extern hpte_t *htab_address;
+extern unsigned long htab_size_bytes;
 extern unsigned long htab_hash_mask;
 
 /*
diff --git a/include/asm-powerpc/pgalloc.h b/include/asm-powerpc/pgalloc.h
index 9f5b052784a5..a00ee002cd11 100644
--- a/include/asm-powerpc/pgalloc.h
+++ b/include/asm-powerpc/pgalloc.h
@@ -146,7 +146,7 @@ extern void pgtable_free_tlb(struct mmu_gather *tlb, pgtable_free_t pgf);
         pgtable_free_tlb(tlb, pgtable_free_cache(pmd, \
                 PMD_CACHE_NUM, PMD_TABLE_SIZE-1))
 #ifndef CONFIG_PPC_64K_PAGES
-#define __pud_free_tlb(tlb, pmd)        \
+#define __pud_free_tlb(tlb, pud)        \
         pgtable_free_tlb(tlb, pgtable_free_cache(pud, \
                 PUD_CACHE_NUM, PUD_TABLE_SIZE-1))
 #endif /* CONFIG_PPC_64K_PAGES */
diff --git a/include/asm-powerpc/reg.h b/include/asm-powerpc/reg.h
index 12ecc9b9f285..72bfe3af0460 100644
--- a/include/asm-powerpc/reg.h
+++ b/include/asm-powerpc/reg.h
@@ -615,27 +615,9 @@
 #define proc_trap()     asm volatile("trap")
 
 #ifdef CONFIG_PPC64
-static inline void ppc64_runlatch_on(void)
-{
-        unsigned long ctrl;
-
-        if (cpu_has_feature(CPU_FTR_CTRL)) {
-                ctrl = mfspr(SPRN_CTRLF);
-                ctrl |= CTRL_RUNLATCH;
-                mtspr(SPRN_CTRLT, ctrl);
-        }
-}
-
-static inline void ppc64_runlatch_off(void)
-{
-        unsigned long ctrl;
-
-        if (cpu_has_feature(CPU_FTR_CTRL)) {
-                ctrl = mfspr(SPRN_CTRLF);
-                ctrl &= ~CTRL_RUNLATCH;
-                mtspr(SPRN_CTRLT, ctrl);
-        }
-}
+
+extern void ppc64_runlatch_on(void);
+extern void ppc64_runlatch_off(void);
 
 extern unsigned long scom970_read(unsigned int address);
 extern void scom970_write(unsigned int address, unsigned long value);
@@ -645,15 +627,6 @@ extern void scom970_write(unsigned int address, unsigned long value);
 #define __get_SP()      ({unsigned long sp; \
                         asm volatile("mr %0,1": "=r" (sp)); sp;})
 
-#else /* __ASSEMBLY__ */
-
-#define RUNLATCH_ON(REG)                        \
-BEGIN_FTR_SECTION                               \
-        mfspr   (REG),SPRN_CTRLF;               \
-        ori     (REG),(REG),CTRL_RUNLATCH;      \
-        mtspr   SPRN_CTRLT,(REG);               \
-END_FTR_SECTION_IFSET(CPU_FTR_CTRL)
-
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_REG_H */
diff --git a/include/asm-powerpc/thread_info.h b/include/asm-powerpc/thread_info.h
index c044ec16a879..237fc2b72974 100644
--- a/include/asm-powerpc/thread_info.h
+++ b/include/asm-powerpc/thread_info.h
@@ -113,7 +113,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_POLLING_NRFLAG      4       /* true if poll_idle() is polling
                                            TIF_NEED_RESCHED */
 #define TIF_32BIT               5       /* 32 bit binary */
-/* #define SPARE                6 */
+#define TIF_RUNLATCH            6       /* Is the runlatch enabled? */
 #define TIF_ABI_PENDING         7       /* 32/64 bit switch needed */
 #define TIF_SYSCALL_AUDIT       8       /* syscall auditing active */
 #define TIF_SINGLESTEP          9       /* singlestepping active */
@@ -131,7 +131,7 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_32BIT              (1<<TIF_32BIT)
-/* #define _SPARE               (1<<SPARE) */
+#define _TIF_RUNLATCH           (1<<TIF_RUNLATCH)
 #define _TIF_ABI_PENDING        (1<<TIF_ABI_PENDING)
 #define _TIF_SYSCALL_AUDIT      (1<<TIF_SYSCALL_AUDIT)
 #define _TIF_SINGLESTEP         (1<<TIF_SINGLESTEP)
diff --git a/include/asm-ppc/machdep.h b/include/asm-ppc/machdep.h
index 39200def8d11..a3e8a45e45a9 100644
--- a/include/asm-ppc/machdep.h
+++ b/include/asm-ppc/machdep.h
@@ -154,19 +154,6 @@ extern char cmd_line[COMMAND_LINE_SIZE];
 
 extern void setup_pci_ptrs(void);
 
-/*
- * Power macintoshes have either a CUDA or a PMU controlling
- * system reset, power, NVRAM, RTC.
- */
-typedef enum sys_ctrler_kind {
-        SYS_CTRLER_UNKNOWN = 0,
-        SYS_CTRLER_CUDA = 1,
-        SYS_CTRLER_PMU = 2,
-        SYS_CTRLER_SMU = 3,
-} sys_ctrler_t;
-
-extern sys_ctrler_t sys_ctrler;
-
 #ifdef CONFIG_SMP
 struct smp_ops_t {
         void  (*message_pass)(int target, int msg);
diff --git a/include/asm-s390/dasd.h b/include/asm-s390/dasd.h
index c744ff33b1df..1630c26e8f45 100644
--- a/include/asm-s390/dasd.h
+++ b/include/asm-s390/dasd.h
@@ -204,8 +204,7 @@ typedef struct attrib_data_t {
  *
  * Here ist how the ioctl-nr should be used:
  *    0 -   31   DASD driver itself
- *   32 -  229   still open
- *  230 -  239   DASD extended error reporting
+ *   32 -  239   still open
  *  240 -  255   reserved for EMC 
  *******************************************************************************/
 
@@ -237,22 +236,12 @@ typedef struct attrib_data_t {
 #define BIODASDPSRD    _IOR(DASD_IOCTL_LETTER,4,dasd_rssd_perf_stats_t)
 /* Get Attributes (cache operations) */
 #define BIODASDGATTR   _IOR(DASD_IOCTL_LETTER,5,attrib_data_t) 
-/* retrieve extended error-reporting value */
-#define BIODASDEERGET  _IOR(DASD_IOCTL_LETTER,6,int)
 
 
 /* #define BIODASDFORMAT  _IOW(IOCTL_LETTER,0,format_data_t) , deprecated */
 #define BIODASDFMT     _IOW(DASD_IOCTL_LETTER,1,format_data_t) 
 /* Set Attributes (cache operations) */
 #define BIODASDSATTR   _IOW(DASD_IOCTL_LETTER,2,attrib_data_t) 
-/* retrieve extended error-reporting value */
-#define BIODASDEERSET  _IOW(DASD_IOCTL_LETTER,3,int)
-
-
-/* remove all records from the eer buffer */
-#define DASD_EER_PURGE       _IO(DASD_IOCTL_LETTER,230)
-/* set the number of pages that are used for the internal eer buffer */
-#define DASD_EER_SETBUFSIZE  _IOW(DASD_IOCTL_LETTER,230,int)
 
 
 #endif                          /* DASD_H */
diff --git a/include/asm-s390/smp.h b/include/asm-s390/smp.h
index 9c6e9c300eb9..444dae5912e6 100644
--- a/include/asm-s390/smp.h
+++ b/include/asm-s390/smp.h
@@ -31,6 +31,7 @@ typedef struct
         __u16      cpu;
 } sigp_info;
 
+extern void smp_setup_cpu_possible_map(void);
 extern int smp_call_function_on(void (*func) (void *info), void *info,
                                 int nonatomic, int wait, int cpu);
 #define NO_PROC_ID              0xFF            /* No processor magic marker */
@@ -104,6 +105,7 @@ smp_call_function_on(void (*func) (void *info), void *info,
 #define smp_cpu_not_running(cpu)        1
 #define smp_get_cpu(cpu) ({ 0; })
 #define smp_put_cpu(cpu) ({ 0; })
+#define smp_setup_cpu_possible_map()
 #endif
 
 #endif
diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
index 6a332a9f099c..0caf60147e97 100644
--- a/include/asm-sparc64/futex.h
+++ b/include/asm-sparc64/futex.h
@@ -1,6 +1,86 @@
-#ifndef _ASM_FUTEX_H
-#define _ASM_FUTEX_H
+#ifndef _SPARC64_FUTEX_H
+#define _SPARC64_FUTEX_H
 
-#include <asm-generic/futex.h>
+#include <linux/futex.h>
+#include <asm/errno.h>
+#include <asm/system.h>
+#include <asm/uaccess.h>
 
-#endif
+#define __futex_cas_op(insn, ret, oldval, uaddr, oparg) \
+        __asm__ __volatile__(                           \
+        "\n1:   lduwa   [%3] %%asi, %2\n"               \
+        "       " insn "\n"                             \
+        "2:     casa    [%3] %%asi, %2, %1\n"           \
+        "       cmp     %2, %1\n"                       \
+        "       bne,pn  %%icc, 1b\n"                    \
+        "        mov    0, %0\n"                        \
+        "3:\n"                                          \
+        "       .section .fixup,#alloc,#execinstr\n"    \
+        "       .align  4\n"                            \
+        "4:     ba      3b\n"                           \
+        "        mov    %5, %0\n"                       \
+        "       .previous\n"                            \
+        "       .section __ex_table,#alloc\n"           \
+        "       .align  4\n"                            \
+        "       .word   1b, 4b\n"                       \
+        "       .word   2b, 4b\n"                       \
+        "       .previous\n"                            \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tem)      \
+        : "r" (uaddr), "r" (oparg), "i" (-EFAULT)       \
+        : "memory")
+
+static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
+{
+        int op = (encoded_op >> 28) & 7;
+        int cmp = (encoded_op >> 24) & 15;
+        int oparg = (encoded_op << 8) >> 20;
+        int cmparg = (encoded_op << 20) >> 20;
+        int oldval = 0, ret, tem;
+
+        if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(int))))
+                return -EFAULT;
+        if (unlikely((((unsigned long) uaddr) & 0x3UL)))
+                return -EINVAL;
+
+        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
+                oparg = 1 << oparg;
+
+        inc_preempt_count();
+
+        switch (op) {
+        case FUTEX_OP_SET:
+                __futex_cas_op("mov\t%4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_ADD:
+                __futex_cas_op("add\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_OR:
+                __futex_cas_op("or\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_ANDN:
+                __futex_cas_op("and\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        case FUTEX_OP_XOR:
+                __futex_cas_op("xor\t%2, %4, %1", ret, oldval, uaddr, oparg);
+                break;
+        default:
+                ret = -ENOSYS;
+        }
+
+        dec_preempt_count();
+
+        if (!ret) {
+                switch (cmp) {
+                case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
+                case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
+                case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
+                case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
+                case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
+                case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
+                default: ret = -ENOSYS;
+                }
+        }
+        return ret;
+}
+
+#endif /* !(_SPARC64_FUTEX_H) */
diff --git a/include/asm-sparc64/smp.h b/include/asm-sparc64/smp.h
index 110a2de89123..473edb2603ec 100644
--- a/include/asm-sparc64/smp.h
+++ b/include/asm-sparc64/smp.h
@@ -66,8 +66,14 @@ static __inline__ int hard_smp_processor_id(void)
 
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
+extern void smp_setup_cpu_possible_map(void);
+
 #endif /* !(__ASSEMBLY__) */
 
+#else
+
+#define smp_setup_cpu_possible_map() do { } while (0)
+
 #endif /* !(CONFIG_SMP) */
 
 #define NO_PROC_ID              0xFF
diff --git a/include/asm-x86_64/acpi.h b/include/asm-x86_64/acpi.h
index aa1c7b2e438c..e2b9923189a0 100644
--- a/include/asm-x86_64/acpi.h
+++ b/include/asm-x86_64/acpi.h
@@ -164,6 +164,20 @@ extern u8 x86_acpiid_to_apicid[];
 
 extern int acpi_skip_timer_override;
 
+extern int unsync_tsc_on_multicluster;
+
+static inline int acpi_madt_oem_check(char *oem, char *productid) 
+{ 
+        /* Copied from i386. Probably has too many entries. */
+        if (!strncmp(oem, "IBM ENSW", 8) && 
+                (!strncmp(productid, "VIGIL SMP", 9) 
+                        || !strncmp(productid, "EXA", 3)
+                        || !strncmp(productid, "RUTHLESS SMP", 12))) {
+                unsync_tsc_on_multicluster = 1;
+        }
+        return 0;
+}
+
 #endif /*__KERNEL__*/
 
 #endif /*_ASM_ACPI_H*/
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index fd03e15d7ea6..8a05af264d18 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -19,8 +19,6 @@ extern unsigned int pcibios_assign_all_busses(void);
 #endif
 #define pcibios_scan_all_fns(a, b)      0
 
-extern int no_iommu, force_iommu;
-
 extern unsigned long pci_mem_start;
 #define PCIBIOS_MIN_IO          0x1000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
diff --git a/include/asm-x86_64/pgtable.h b/include/asm-x86_64/pgtable.h
index 8fbf4dd72115..715fd94cf577 100644
--- a/include/asm-x86_64/pgtable.h
+++ b/include/asm-x86_64/pgtable.h
@@ -131,7 +131,7 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm, unsigned long
 #define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
 
-#define USER_PTRS_PER_PGD       (TASK_SIZE/PGDIR_SIZE)
+#define USER_PTRS_PER_PGD       ((TASK_SIZE-1)/PGDIR_SIZE+1)
 #define FIRST_USER_ADDRESS      0
 
 #ifndef __ASSEMBLY__
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index c99832e7bf3f..3ba8fd45fcb3 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -39,7 +39,6 @@ extern void config_acpi_tables(void);
 extern void ia32_syscall(void);
 extern void iommu_hole_init(void);
 
-extern void time_init_gtod(void);
 extern int pmtimer_mark_offset(void);
 extern void pmtimer_resume(void);
 extern void pmtimer_wait(unsigned);
@@ -133,6 +132,8 @@ extern int fix_aperture;
 extern int force_iommu;
 
 extern int reboot_force;
+extern int notsc_setup(char *);
+extern int setup_additional_cpus(char *);
 
 extern void smp_local_timer_interrupt(struct pt_regs * regs);
 
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 84d3d9f034ce..d3bc25e6d27d 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -427,7 +427,8 @@ extern int acpi_mp_config;
 extern struct acpi_table_mcfg_config *pci_mmcfg_config;
 extern int pci_mmcfg_config_num;
 
-extern int sbf_port ;
+extern int sbf_port;
+extern unsigned long acpi_video_flags;
 
 #else   /* !CONFIG_ACPI */
 
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index b49affa0ac5a..3b507bf05d09 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -326,12 +326,6 @@ struct sysinfo {
 /* Force a compilation error if condition is true */
 #define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
 
-#ifdef CONFIG_SYSCTL
-extern int randomize_va_space;
-#else
-#define randomize_va_space 1
-#endif
-
 /* Trap pasters of __FUNCTION__ at compile-time */
 #define __FUNCTION__ (__func__)
 
diff --git a/include/linux/kobject.h b/include/linux/kobject.h
index 2a8d8da70961..c374b5fa8d3b 100644
--- a/include/linux/kobject.h
+++ b/include/linux/kobject.h
@@ -41,8 +41,10 @@ enum kobject_action {
         KOBJ_ADD        = (__force kobject_action_t) 0x01,      /* exclusive to core */
         KOBJ_REMOVE     = (__force kobject_action_t) 0x02,      /* exclusive to core */
         KOBJ_CHANGE     = (__force kobject_action_t) 0x03,      /* device state change */
-        KOBJ_OFFLINE    = (__force kobject_action_t) 0x04,      /* device offline */
-        KOBJ_ONLINE     = (__force kobject_action_t) 0x05,      /* device online */
+        KOBJ_MOUNT      = (__force kobject_action_t) 0x04,      /* mount event for block devices (broken) */
+        KOBJ_UMOUNT     = (__force kobject_action_t) 0x05,      /* umount event for block devices (broken) */
+        KOBJ_OFFLINE    = (__force kobject_action_t) 0x06,      /* device offline */
+        KOBJ_ONLINE     = (__force kobject_action_t) 0x07,      /* device online */
 };
 
 struct kobject {
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 9e5db2949c58..c91be5e64ede 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -557,17 +557,29 @@ ata_sg_is_last(struct scatterlist *sg, struct ata_queued_cmd *qc)
 }
 
 static inline struct scatterlist *
+ata_qc_first_sg(struct ata_queued_cmd *qc)
+{
+        if (qc->n_elem)
+                return qc->__sg;
+        if (qc->pad_len)
+                return &qc->pad_sgent;
+        return NULL;
+}
+
+static inline struct scatterlist *
 ata_qc_next_sg(struct scatterlist *sg, struct ata_queued_cmd *qc)
 {
         if (sg == &qc->pad_sgent)
                 return NULL;
         if (++sg - qc->__sg < qc->n_elem)
                 return sg;
-        return qc->pad_len ? &qc->pad_sgent : NULL;
+        if (qc->pad_len)
+                return &qc->pad_sgent;
+        return NULL;
 }
 
 #define ata_for_each_sg(sg, qc) \
-        for (sg = qc->__sg; sg; sg = ata_qc_next_sg(sg, qc))
+        for (sg = ata_qc_first_sg(qc); sg; sg = ata_qc_next_sg(sg, qc))
 
 static inline unsigned int ata_tag_valid(unsigned int tag)
 {
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 75e9f0724997..498ff8778fb6 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1051,5 +1051,11 @@ int shrink_slab(unsigned long scanned, gfp_t gfp_mask,
 void drop_pagecache(void);
 void drop_slab(void);
 
+#ifndef CONFIG_MMU
+#define randomize_va_space 0
+#else
+extern int randomize_va_space;
+#endif
+
 #endif /* __KERNEL__ */
 #endif /* _LINUX_MM_H */
diff --git a/include/linux/mmc/mmc.h b/include/linux/mmc/mmc.h
index f38872abc126..bdc556d88498 100644
--- a/include/linux/mmc/mmc.h
+++ b/include/linux/mmc/mmc.h
@@ -49,7 +49,7 @@ struct mmc_command {
 /*
  * These are the command types.
  */
-#define mmc_cmd_type(cmd)       ((cmd)->flags & MMC_CMD_TYPE)
+#define mmc_cmd_type(cmd)       ((cmd)->flags & MMC_CMD_MASK)
 
         unsigned int            retries;        /* max number of retries */
         unsigned int            error;          /* command error */
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 547d649b274e..b4dc6e2e10c9 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -398,7 +398,7 @@ extern struct inode_operations nfs_symlink_inode_operations;
 extern int nfs_register_sysctl(void);
 extern void nfs_unregister_sysctl(void);
 #else
-#define nfs_register_sysctl() do { } while(0)
+#define nfs_register_sysctl() 0
 #define nfs_unregister_sysctl() do { } while(0)
 #endif
 
diff --git a/include/linux/serial_reg.h b/include/linux/serial_reg.h
index 6a2bb955844b..3c8a6aa77415 100644
--- a/include/linux/serial_reg.h
+++ b/include/linux/serial_reg.h
@@ -247,10 +247,10 @@
 #define UART_CTR        0xFF
 
 /*
- * The 16C950 Additional Control Reigster
+ * The 16C950 Additional Control Register
  */
 #define UART_ACR_RXDIS  0x01    /* Receiver disable */
-#define UART_ACR_TXDIS  0x02    /* Receiver disable */
+#define UART_ACR_TXDIS  0x02    /* Transmitter disable */
 #define UART_ACR_DSRFC  0x04    /* DSR Flow Control */
 #define UART_ACR_TLENB  0x20    /* 950 trigger levels enable */
 #define UART_ACR_ICRRD  0x40    /* ICR Read enable */
diff --git a/include/linux/swap.h b/include/linux/swap.h
index f3e17d5963c3..d572b19afb7d 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -147,7 +147,7 @@ struct swap_list_t {
 #define vm_swap_full() (nr_swap_pages*2 < total_swap_pages)
 
 /* linux/mm/oom_kill.c */
-extern void out_of_memory(gfp_t gfp_mask, int order);
+extern void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask, int order);
 
 /* linux/mm/memory.c */
 extern void swapin_readahead(swp_entry_t, unsigned long, struct vm_area_struct *);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index d73501ba7e44..b9ea44ac0ddb 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -543,7 +543,7 @@ asmlinkage long sys_unlinkat(int dfd, const char __user * pathname, int flag);
 asmlinkage long sys_symlinkat(const char __user * oldname,
                               int newdfd, const char __user * newname);
 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
-                           int newdfd, const char __user *newname);
+                           int newdfd, const char __user *newname, int flags);
 asmlinkage long sys_renameat(int olddfd, const char __user * oldname,
                              int newdfd, const char __user * newname);
 asmlinkage long sys_futimesat(int dfd, char __user *filename,
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 32a4139c4ad8..0e92bf7ec28e 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -146,6 +146,7 @@ enum
         KERN_RANDOMIZE=68, /* int: randomize virtual address space */
         KERN_SETUID_DUMPABLE=69, /* int: behaviour of dumps for setuid core */
         KERN_SPIN_RETRY=70,     /* int: number of spinlock retries */
+        KERN_ACPI_VIDEO_FLAGS=71, /* int: flags for setting up video after ACPI sleep */
 };
 
 
diff --git a/include/linux/timex.h b/include/linux/timex.h
index 04a4a8cb4ed3..b7ca1204e42a 100644
--- a/include/linux/timex.h
+++ b/include/linux/timex.h
@@ -345,6 +345,9 @@ time_interpolator_reset(void)
 
 #endif /* !CONFIG_TIME_INTERPOLATION */
 
+/* Returns how long ticks are at present, in ns / 2^(SHIFT_SCALE-10). */
+extern u64 current_tick_length(void);
+
 #endif /* KERNEL */
 
 #endif /* LINUX_TIMEX_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index d6111a2f0a23..004e645f3e18 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -403,6 +403,11 @@ unsigned xfrm_spi_hash(xfrm_address_t *addr, u32 spi, u8 proto, unsigned short f
 
 extern void __xfrm_state_destroy(struct xfrm_state *);
 
+static inline void __xfrm_state_put(struct xfrm_state *x)
+{
+        atomic_dec(&x->refcnt);
+}
+
 static inline void xfrm_state_put(struct xfrm_state *x)
 {
         if (atomic_dec_and_test(&x->refcnt))
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 685c25175d96..d7e7e637b92a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -841,7 +841,7 @@ static void audit_log_exit(struct audit_context *context, gfp_t gfp_mask)
 
         for (aux = context->aux; aux; aux = aux->next) {
 
-                ab = audit_log_start(context, GFP_KERNEL, aux->type);
+                ab = audit_log_start(context, gfp_mask, aux->type);
                 if (!ab)
                         continue; /* audit_panic has been called */
 
@@ -878,14 +878,14 @@ static void audit_log_exit(struct audit_context *context, gfp_t gfp_mask)
         }
 
         if (context->pwd && context->pwdmnt) {
-                ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
+                ab = audit_log_start(context, gfp_mask, AUDIT_CWD);
                 if (ab) {
                         audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
                         audit_log_end(ab);
                 }
         }
         for (i = 0; i < context->name_count; i++) {
-                ab = audit_log_start(context, GFP_KERNEL, AUDIT_PATH);
+                ab = audit_log_start(context, gfp_mask, AUDIT_PATH);
                 if (!ab)
                         continue; /* audit_panic has been called */
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 93cee3671332..531aadca5530 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -360,6 +360,9 @@ void daemonize(const char *name, ...)
         fs = init_task.fs;
         current->fs = fs;
         atomic_inc(&fs->count);
+        exit_namespace(current);
+        current->namespace = init_task.namespace;
+        get_namespace(current->namespace);
         exit_files(current);
         current->files = init_task.files;
         atomic_inc(&current->files->count);
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index 4e90905f0e87..2d9d08f72f76 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -153,13 +153,11 @@ static int swsusp_swap_check(void) /* This is called before saving image */
 {
         int i;
 
-        if (!swsusp_resume_device)
-                return -ENODEV;
         spin_lock(&swap_lock);
         for (i = 0; i < MAX_SWAPFILES; i++) {
                 if (!(swap_info[i].flags & SWP_WRITEOK))
                         continue;
-                if (is_resume_device(swap_info + i)) {
+                if (!swsusp_resume_device || is_resume_device(swap_info + i)) {
                         spin_unlock(&swap_lock);
                         root_swap = i;
                         return 0;
diff --git a/kernel/sched.c b/kernel/sched.c
index 66d957227de9..12d291bf3379 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -5058,7 +5058,18 @@ static void init_sched_build_groups(struct sched_group groups[], cpumask_t span,
 #define MAX_DOMAIN_DISTANCE 32
 
 static unsigned long long migration_cost[MAX_DOMAIN_DISTANCE] =
-                { [ 0 ... MAX_DOMAIN_DISTANCE-1 ] = -1LL };
+                { [ 0 ... MAX_DOMAIN_DISTANCE-1 ] =
+/*
+ * Architectures may override the migration cost and thus avoid
+ * boot-time calibration. Unit is nanoseconds. Mostly useful for
+ * virtualized hardware:
+ */
+#ifdef CONFIG_DEFAULT_MIGRATION_COST
+                        CONFIG_DEFAULT_MIGRATION_COST
+#else
+                        -1LL
+#endif
+};
 
 /*
  * Allow override of migration cost - in units of microseconds.
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 17313b99e53d..1067090db6b1 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -104,6 +104,8 @@ cond_syscall(sys_setreuid16);
 cond_syscall(sys_setuid16);
 cond_syscall(sys_vm86old);
 cond_syscall(sys_vm86);
+cond_syscall(compat_sys_ipc);
+cond_syscall(compat_sys_sysctl);
 
 /* arch-specific weak syscall entries */
 cond_syscall(sys_pciconfig_read);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 71dd6f62efec..c05a2b7125e1 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -44,14 +44,12 @@
 #include <linux/limits.h>
 #include <linux/dcache.h>
 #include <linux/syscalls.h>
+#include <linux/nfs_fs.h>
+#include <linux/acpi.h>
 
 #include <asm/uaccess.h>
 #include <asm/processor.h>
 
-#ifdef CONFIG_ROOT_NFS
-#include <linux/nfs_fs.h>
-#endif
-
 #if defined(CONFIG_SYSCTL)
 
 /* External variables not in a header file. */
@@ -126,8 +124,6 @@ extern int sysctl_hz_timer;
 extern int acct_parm[];
 #endif
 
-int randomize_va_space = 1;
-
 static int parse_table(int __user *, int, void __user *, size_t __user *, void __user *, size_t,
                        ctl_table *, void **);
 static int proc_doutsstring(ctl_table *table, int write, struct file *filp,
@@ -640,6 +636,7 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+#if defined(CONFIG_MMU)
         {
                 .ctl_name       = KERN_RANDOMIZE,
                 .procname       = "randomize_va_space",
@@ -648,6 +645,7 @@ static ctl_table kern_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec,
         },
+#endif
 #if defined(CONFIG_S390) && defined(CONFIG_SMP)
         {
                 .ctl_name       = KERN_SPIN_RETRY,
@@ -658,6 +656,16 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+#ifdef CONFIG_ACPI_SLEEP
+        {
+                .ctl_name       = KERN_ACPI_VIDEO_FLAGS,
+                .procname       = "acpi_video_flags",
+                .data           = &acpi_video_flags,
+                .maxlen         = sizeof (unsigned long),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec,
+        },
+#endif
         { .ctl_name = 0 }
 };
 
diff --git a/kernel/timer.c b/kernel/timer.c
index b9dad3994676..fe3a9a9f8328 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -717,12 +717,16 @@ static void second_overflow(void)
 #endif
 }
 
-/* in the NTP reference this is called "hardclock()" */
-static void update_wall_time_one_tick(void)
+/*
+ * Returns how many microseconds we need to add to xtime this tick
+ * in doing an adjustment requested with adjtime.
+ */
+static long adjtime_adjustment(void)
 {
-        long time_adjust_step, delta_nsec;
+        long time_adjust_step;
 
-        if ((time_adjust_step = time_adjust) != 0 ) {
+        time_adjust_step = time_adjust;
+        if (time_adjust_step) {
                 /*
                  * We are doing an adjtime thing.  Prepare time_adjust_step to
                  * be within bounds.  Note that a positive time_adjust means we
@@ -733,10 +737,19 @@ static void update_wall_time_one_tick(void)
                  */
                 time_adjust_step = min(time_adjust_step, (long)tickadj);
                 time_adjust_step = max(time_adjust_step, (long)-tickadj);
+        }
+        return time_adjust_step;
+}
 
+/* in the NTP reference this is called "hardclock()" */
+static void update_wall_time_one_tick(void)
+{
+        long time_adjust_step, delta_nsec;
+
+        time_adjust_step = adjtime_adjustment();
+        if (time_adjust_step)
                 /* Reduce by this step the amount of time left  */
                 time_adjust -= time_adjust_step;
-        }
         delta_nsec = tick_nsec + time_adjust_step * 1000;
         /*
          * Advance the phase, once it gets to one microsecond, then
@@ -759,6 +772,22 @@ static void update_wall_time_one_tick(void)
 }
 
 /*
+ * Return how long ticks are at the moment, that is, how much time
+ * update_wall_time_one_tick will add to xtime next time we call it
+ * (assuming no calls to do_adjtimex in the meantime).
+ * The return value is in fixed-point nanoseconds with SHIFT_SCALE-10
+ * bits to the right of the binary point.
+ * This function has no side-effects.
+ */
+u64 current_tick_length(void)
+{
+        long delta_nsec;
+
+        delta_nsec = tick_nsec + adjtime_adjustment() * 1000;
+        return ((u64) delta_nsec << (SHIFT_SCALE - 10)) + time_adj;
+}
+
+/*
  * Using a loop looks inefficient, but "ticks" is
  * usually just one (we shouldn't be losing ticks,
  * we're doing this this way mainly for interrupt
diff --git a/lib/iomap_copy.c b/lib/iomap_copy.c
index a6b1e271d53c..351045f4f63c 100644
--- a/lib/iomap_copy.c
+++ b/lib/iomap_copy.c
@@ -15,8 +15,8 @@
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
  */
 
-#include <linux/io.h>
 #include <linux/module.h>
+#include <linux/io.h>
 
 /**
  * __iowrite32_copy - copy data to MMIO space, in 32-bit units
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index 1b1985c136ec..086a0c6e888e 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -38,6 +38,10 @@ static char *action_to_string(enum kobject_action action)
                 return "remove";
         case KOBJ_CHANGE:
                 return "change";
+        case KOBJ_MOUNT:
+                return "mount";
+        case KOBJ_UMOUNT:
+                return "umount";
         case KOBJ_OFFLINE:
                 return "offline";
         case KOBJ_ONLINE:
diff --git a/mm/memory.c b/mm/memory.c
index 2bee1f21aa8a..9abc6008544b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -82,6 +82,16 @@ EXPORT_SYMBOL(num_physpages);
 EXPORT_SYMBOL(high_memory);
 EXPORT_SYMBOL(vmalloc_earlyreserve);
 
+int randomize_va_space __read_mostly = 1;
+
+static int __init disable_randmaps(char *s)
+{
+        randomize_va_space = 0;
+        return 0;
+}
+__setup("norandmaps", disable_randmaps);
+
+
 /*
  * If a p?d_bad entry is found while walking page tables, report
  * the error, before resetting entry to p?d_none.  Usually (but
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 3bd7fb7e4b75..67af4cea1e23 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -132,19 +132,29 @@ static int mpol_check_policy(int mode, nodemask_t *nodes)
         }
         return nodes_subset(*nodes, node_online_map) ? 0 : -EINVAL;
 }
+
 /* Generate a custom zonelist for the BIND policy. */
 static struct zonelist *bind_zonelist(nodemask_t *nodes)
 {
         struct zonelist *zl;
-        int num, max, nd;
+        int num, max, nd, k;
 
         max = 1 + MAX_NR_ZONES * nodes_weight(*nodes);
-        zl = kmalloc(sizeof(void *) * max, GFP_KERNEL);
+        zl = kmalloc(sizeof(struct zone *) * max, GFP_KERNEL);
         if (!zl)
                 return NULL;
         num = 0;
-        for_each_node_mask(nd, *nodes)
-                zl->zones[num++] = &NODE_DATA(nd)->node_zones[policy_zone];
+        /* First put in the highest zones from all nodes, then all the next 
+           lower zones etc. Avoid empty zones because the memory allocator
+           doesn't like them. If you implement node hot removal you
+           have to fix that. */
+        for (k = policy_zone; k >= 0; k--) { 
+                for_each_node_mask(nd, *nodes) { 
+                        struct zone *z = &NODE_DATA(nd)->node_zones[k];
+                        if (z->present_pages > 0) 
+                                zl->zones[num++] = z;
+                }
+        }
         zl->zones[num] = NULL;
         return zl;
 }
@@ -542,7 +552,7 @@ static void migrate_page_add(struct page *page, struct list_head *pagelist,
          */
         if ((flags & MPOL_MF_MOVE_ALL) || page_mapcount(page) == 1) {
                 if (isolate_lru_page(page))
-                        list_add(&page->lru, pagelist);
+                        list_add_tail(&page->lru, pagelist);
         }
 }
 
@@ -559,6 +569,7 @@ static int migrate_pages_to(struct list_head *pagelist,
         LIST_HEAD(moved);
         LIST_HEAD(failed);
         int err = 0;
+        unsigned long offset = 0;
         int nr_pages;
         struct page *page;
         struct list_head *p;
@@ -566,8 +577,21 @@ static int migrate_pages_to(struct list_head *pagelist,
 redo:
         nr_pages = 0;
         list_for_each(p, pagelist) {
-                if (vma)
-                        page = alloc_page_vma(GFP_HIGHUSER, vma, vma->vm_start);
+                if (vma) {
+                        /*
+                         * The address passed to alloc_page_vma is used to
+                         * generate the proper interleave behavior. We fake
+                         * the address here by an increasing offset in order
+                         * to get the proper distribution of pages.
+                         *
+                         * No decision has been made as to which page
+                         * a certain old page is moved to so we cannot
+                         * specify the correct address.
+                         */
+                        page = alloc_page_vma(GFP_HIGHUSER, vma,
+                                        offset + vma->vm_start);
+                        offset += PAGE_SIZE;
+                }
                 else
                         page = alloc_pages_node(dest, GFP_HIGHUSER, 0);
 
@@ -575,9 +599,9 @@ redo:
                         err = -ENOMEM;
                         goto out;
                 }
-                list_add(&page->lru, &newlist);
+                list_add_tail(&page->lru, &newlist);
                 nr_pages++;
-                if (nr_pages > MIGRATE_CHUNK_SIZE);
+                if (nr_pages > MIGRATE_CHUNK_SIZE)
                         break;
         }
         err = migrate_pages(pagelist, &newlist, &moved, &failed);
@@ -798,6 +822,8 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
         nodes_clear(*nodes);
         if (maxnode == 0 || !nmask)
                 return 0;
+        if (maxnode > PAGE_SIZE*BITS_PER_BYTE)
+                return -EINVAL;
 
         nlongs = BITS_TO_LONGS(maxnode);
         if ((maxnode % BITS_PER_LONG) == 0)
diff --git a/mm/nommu.c b/mm/nommu.c
index c10262d68232..99d21020ec9d 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -57,6 +57,8 @@ EXPORT_SYMBOL(vmalloc);
 EXPORT_SYMBOL(vfree);
 EXPORT_SYMBOL(vmalloc_to_page);
 EXPORT_SYMBOL(vmalloc_32);
+EXPORT_SYMBOL(vmap);
+EXPORT_SYMBOL(vunmap);
 
 /*
  * Handle all mappings that got truncated by a "truncate()"
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index b05ab8f2a562..8123fad5a485 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -58,15 +58,17 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
 
         /*
          * Processes which fork a lot of child processes are likely
-         * a good choice. We add the vmsize of the children if they
+         * a good choice. We add half the vmsize of the children if they
          * have an own mm. This prevents forking servers to flood the
-         * machine with an endless amount of children
+         * machine with an endless amount of children. In case a single
+         * child is eating the vast majority of memory, adding only half
+         * to the parents will make the child our kill candidate of choice.
          */
         list_for_each(tsk, &p->children) {
                 struct task_struct *chld;
                 chld = list_entry(tsk, struct task_struct, sibling);
                 if (chld->mm != p->mm && chld->mm)
-                        points += chld->mm->total_vm;
+                        points += chld->mm->total_vm/2 + 1;
         }
 
         /*
@@ -131,17 +133,47 @@ unsigned long badness(struct task_struct *p, unsigned long uptime)
 }
 
 /*
+ * Types of limitations to the nodes from which allocations may occur
+ */
+#define CONSTRAINT_NONE 1
+#define CONSTRAINT_MEMORY_POLICY 2
+#define CONSTRAINT_CPUSET 3
+
+/*
+ * Determine the type of allocation constraint.
+ */
+static inline int constrained_alloc(struct zonelist *zonelist, gfp_t gfp_mask)
+{
+#ifdef CONFIG_NUMA
+        struct zone **z;
+        nodemask_t nodes = node_online_map;
+
+        for (z = zonelist->zones; *z; z++)
+                if (cpuset_zone_allowed(*z, gfp_mask))
+                        node_clear((*z)->zone_pgdat->node_id,
+                                        nodes);
+                else
+                        return CONSTRAINT_CPUSET;
+
+        if (!nodes_empty(nodes))
+                return CONSTRAINT_MEMORY_POLICY;
+#endif
+
+        return CONSTRAINT_NONE;
+}
+
+/*
  * Simple selection loop. We chose the process with the highest
  * number of 'points'. We expect the caller will lock the tasklist.
  *
  * (not docbooked, we don't want this one cluttering up the manual)
  */
-static struct task_struct * select_bad_process(void)
+static struct task_struct *select_bad_process(unsigned long *ppoints)
 {
-        unsigned long maxpoints = 0;
         struct task_struct *g, *p;
         struct task_struct *chosen = NULL;
         struct timespec uptime;
+        *ppoints = 0;
 
         do_posix_clock_monotonic_gettime(&uptime);
         do_each_thread(g, p) {
@@ -169,9 +201,9 @@ static struct task_struct * select_bad_process(void)
                         return p;
 
                 points = badness(p, uptime.tv_sec);
-                if (points > maxpoints || !chosen) {
+                if (points > *ppoints || !chosen) {
                         chosen = p;
-                        maxpoints = points;
+                        *ppoints = points;
                 }
         } while_each_thread(g, p);
         return chosen;
@@ -182,7 +214,7 @@ static struct task_struct * select_bad_process(void)
  * CAP_SYS_RAW_IO set, send SIGTERM instead (but it's unlikely that
  * we select a process with CAP_SYS_RAW_IO set).
  */
-static void __oom_kill_task(task_t *p)
+static void __oom_kill_task(task_t *p, const char *message)
 {
         if (p->pid == 1) {
                 WARN_ON(1);
@@ -198,8 +230,8 @@ static void __oom_kill_task(task_t *p)
                 return;
         }
         task_unlock(p);
-        printk(KERN_ERR "Out of Memory: Killed process %d (%s).\n",
-                                                        p->pid, p->comm);
+        printk(KERN_ERR "%s: Killed process %d (%s).\n",
+                                message, p->pid, p->comm);
 
         /*
          * We give our sacrificial lamb high priority and access to
@@ -212,7 +244,7 @@ static void __oom_kill_task(task_t *p)
         force_sig(SIGKILL, p);
 }
 
-static struct mm_struct *oom_kill_task(task_t *p)
+static struct mm_struct *oom_kill_task(task_t *p, const char *message)
 {
         struct mm_struct *mm = get_task_mm(p);
         task_t * g, * q;
@@ -224,35 +256,38 @@ static struct mm_struct *oom_kill_task(task_t *p)
                 return NULL;
         }
 
-        __oom_kill_task(p);
+        __oom_kill_task(p, message);
         /*
          * kill all processes that share the ->mm (i.e. all threads),
          * but are in a different thread group
          */
         do_each_thread(g, q)
                 if (q->mm == mm && q->tgid != p->tgid)
-                        __oom_kill_task(q);
+                        __oom_kill_task(q, message);
         while_each_thread(g, q);
 
         return mm;
 }
 
-static struct mm_struct *oom_kill_process(struct task_struct *p)
+static struct mm_struct *oom_kill_process(struct task_struct *p,
+                                unsigned long points, const char *message)
 {
         struct mm_struct *mm;
         struct task_struct *c;
         struct list_head *tsk;
 
+        printk(KERN_ERR "Out of Memory: Kill process %d (%s) score %li and "
+                "children.\n", p->pid, p->comm, points);
         /* Try to kill a child first */
         list_for_each(tsk, &p->children) {
                 c = list_entry(tsk, struct task_struct, sibling);
                 if (c->mm == p->mm)
                         continue;
-                mm = oom_kill_task(c);
+                mm = oom_kill_task(c, message);
                 if (mm)
                         return mm;
         }
-        return oom_kill_task(p);
+        return oom_kill_task(p, message);
 }
 
 /**
@@ -263,10 +298,11 @@ static struct mm_struct *oom_kill_process(struct task_struct *p)
  * OR try to be smart about which process to kill. Note that we
  * don't have to be perfect here, we just have to be good.
  */
-void out_of_memory(gfp_t gfp_mask, int order)
+void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask, int order)
 {
         struct mm_struct *mm = NULL;
-        task_t * p;
+        task_t *p;
+        unsigned long points;
 
         if (printk_ratelimit()) {
                 printk("oom-killer: gfp_mask=0x%x, order=%d\n",
@@ -277,25 +313,48 @@ void out_of_memory(gfp_t gfp_mask, int order)
 
         cpuset_lock();
         read_lock(&tasklist_lock);
+
+        /*
+         * Check if there were limitations on the allocation (only relevant for
+         * NUMA) that may require different handling.
+         */
+        switch (constrained_alloc(zonelist, gfp_mask)) {
+        case CONSTRAINT_MEMORY_POLICY:
+                mm = oom_kill_process(current, points,
+                                "No available memory (MPOL_BIND)");
+                break;
+
+        case CONSTRAINT_CPUSET:
+                mm = oom_kill_process(current, points,
+                                "No available memory in cpuset");
+                break;
+
+        case CONSTRAINT_NONE:
 retry:
-        p = select_bad_process();
+                /*
+                 * Rambo mode: Shoot down a process and hope it solves whatever
+                 * issues we may have.
+                 */
+                p = select_bad_process(&points);
 
-        if (PTR_ERR(p) == -1UL)
-                goto out;
+                if (PTR_ERR(p) == -1UL)
+                        goto out;
 
-        /* Found nothing?!?! Either we hang forever, or we panic. */
-        if (!p) {
-                read_unlock(&tasklist_lock);
-                cpuset_unlock();
-                panic("Out of memory and no killable processes...\n");
-        }
+                /* Found nothing?!?! Either we hang forever, or we panic. */
+                if (!p) {
+                        read_unlock(&tasklist_lock);
+                        cpuset_unlock();
+                        panic("Out of memory and no killable processes...\n");
+                }
 
-        mm = oom_kill_process(p);
-        if (!mm)
-                goto retry;
+                mm = oom_kill_process(p, points, "Out of memory");
+                if (!mm)
+                        goto retry;
+
+                break;
+        }
 
- out:
-        read_unlock(&tasklist_lock);
+out:
         cpuset_unlock();
         if (mm)
                 mmput(mm);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 62c122528587..791690d7d3fa 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1015,7 +1015,7 @@ rebalance:
                 if (page)
                         goto got_pg;
 
-                out_of_memory(gfp_mask, order);
+                out_of_memory(zonelist, gfp_mask, order);
                 goto restart;
         }
 
@@ -1541,29 +1541,29 @@ static int __initdata node_load[MAX_NUMNODES];
  */
 static int __init find_next_best_node(int node, nodemask_t *used_node_mask)
 {
-        int i, n, val;
+        int n, val;
         int min_val = INT_MAX;
         int best_node = -1;
 
-        for_each_online_node(i) {
-                cpumask_t tmp;
+        /* Use the local node if we haven't already */
+        if (!node_isset(node, *used_node_mask)) {
+                node_set(node, *used_node_mask);
+                return node;
+        }
 
-                /* Start from local node */
-                n = (node+i) % num_online_nodes();
+        for_each_online_node(n) {
+                cpumask_t tmp;
 
                 /* Don't want a node to appear more than once */
                 if (node_isset(n, *used_node_mask))
                         continue;
 
-                /* Use the local node if we haven't already */
-                if (!node_isset(node, *used_node_mask)) {
-                        best_node = node;
-                        break;
-                }
-
                 /* Use the distance array to find the distance */
                 val = node_distance(node, n);
 
+                /* Penalize nodes under us ("prefer the next node") */
+                val += (n < node);
+
                 /* Give preference to headless and unused nodes */
                 tmp = node_to_cpumask(n);
                 if (!cpus_empty(tmp))
diff --git a/mm/shmem.c b/mm/shmem.c
index f7ac7b812f92..7c455fbaff7b 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -45,6 +45,7 @@
 #include <linux/swapops.h>
 #include <linux/mempolicy.h>
 #include <linux/namei.h>
+#include <linux/ctype.h>
 #include <asm/uaccess.h>
 #include <asm/div64.h>
 #include <asm/pgtable.h>
@@ -874,6 +875,51 @@ redirty:
 }
 
 #ifdef CONFIG_NUMA
+static int shmem_parse_mpol(char *value, int *policy, nodemask_t *policy_nodes)
+{
+        char *nodelist = strchr(value, ':');
+        int err = 1;
+
+        if (nodelist) {
+                /* NUL-terminate policy string */
+                *nodelist++ = '\0';
+                if (nodelist_parse(nodelist, *policy_nodes))
+                        goto out;
+        }
+        if (!strcmp(value, "default")) {
+                *policy = MPOL_DEFAULT;
+                /* Don't allow a nodelist */
+                if (!nodelist)
+                        err = 0;
+        } else if (!strcmp(value, "prefer")) {
+                *policy = MPOL_PREFERRED;
+                /* Insist on a nodelist of one node only */
+                if (nodelist) {
+                        char *rest = nodelist;
+                        while (isdigit(*rest))
+                                rest++;
+                        if (!*rest)
+                                err = 0;
+                }
+        } else if (!strcmp(value, "bind")) {
+                *policy = MPOL_BIND;
+                /* Insist on a nodelist */
+                if (nodelist)
+                        err = 0;
+        } else if (!strcmp(value, "interleave")) {
+                *policy = MPOL_INTERLEAVE;
+                /* Default to nodes online if no nodelist */
+                if (!nodelist)
+                        *policy_nodes = node_online_map;
+                err = 0;
+        }
+out:
+        /* Restore string for error message */
+        if (nodelist)
+                *--nodelist = ':';
+        return err;
+}
+
 static struct page *shmem_swapin_async(struct shared_policy *p,
                                        swp_entry_t entry, unsigned long idx)
 {
@@ -926,6 +972,11 @@ shmem_alloc_page(gfp_t gfp, struct shmem_inode_info *info,
         return page;
 }
 #else
+static inline int shmem_parse_mpol(char *value, int *policy, nodemask_t *policy_nodes)
+{
+        return 1;
+}
+
 static inline struct page *
 shmem_swapin(struct shmem_inode_info *info,swp_entry_t entry,unsigned long idx)
 {
@@ -1859,7 +1910,23 @@ static int shmem_parse_options(char *options, int *mode, uid_t *uid,
 {
         char *this_char, *value, *rest;
 
-        while ((this_char = strsep(&options, ",")) != NULL) {
+        while (options != NULL) {
+                this_char = options;
+                for (;;) {
+                        /*
+                         * NUL-terminate this option: unfortunately,
+                         * mount options form a comma-separated list,
+                         * but mpol's nodelist may also contain commas.
+                         */
+                        options = strchr(options, ',');
+                        if (options == NULL)
+                                break;
+                        options++;
+                        if (!isdigit(*options)) {
+                                options[-1] = '\0';
+                                break;
+                        }
+                }
                 if (!*this_char)
                         continue;
                 if ((value = strchr(this_char,'=')) != NULL) {
@@ -1910,18 +1977,8 @@ static int shmem_parse_options(char *options, int *mode, uid_t *uid,
                         if (*rest)
                                 goto bad_val;
                 } else if (!strcmp(this_char,"mpol")) {
-                        if (!strcmp(value,"default"))
-                                *policy = MPOL_DEFAULT;
-                        else if (!strcmp(value,"preferred"))
-                                *policy = MPOL_PREFERRED;
-                        else if (!strcmp(value,"bind"))
-                                *policy = MPOL_BIND;
-                        else if (!strcmp(value,"interleave"))
-                                *policy = MPOL_INTERLEAVE;
-                        else
+                        if (shmem_parse_mpol(value,policy,policy_nodes))
                                 goto bad_val;
-                } else if (!strcmp(this_char,"mpol_nodelist")) {
-                        nodelist_parse(value, *policy_nodes);
                 } else {
                         printk(KERN_ERR "tmpfs: Bad mount option %s\n",
                                this_char);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 1838c15ca4fd..b0af7593d01e 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1908,7 +1908,12 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                 sc.swap_cluster_max = SWAP_CLUSTER_MAX;
 
         cond_resched();
-        p->flags |= PF_MEMALLOC;
+        /*
+         * We need to be able to allocate from the reserves for RECLAIM_SWAP
+         * and we also need to be able to write out pages for RECLAIM_WRITE
+         * and RECLAIM_SWAP.
+         */
+        p->flags |= PF_MEMALLOC | PF_SWAPWRITE;
         reclaim_state.reclaimed_slab = 0;
         p->reclaim_state = &reclaim_state;
 
@@ -1932,11 +1937,10 @@ int zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                  * a long time.
                  */
                 shrink_slab(sc.nr_scanned, gfp_mask, order);
-                sc.nr_reclaimed = 1;    /* Avoid getting the off node timeout */
         }
 
         p->reclaim_state = NULL;
-        current->flags &= ~PF_MEMALLOC;
+        current->flags &= ~(PF_MEMALLOC | PF_SWAPWRITE);
 
         if (sc.nr_reclaimed == 0)
                 zone->last_unsuccessful_zone_reclaim = jiffies;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 6bb0c7eb1ef0..e060aad8624d 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -90,6 +90,7 @@ static struct rtable __fake_rtable = {
                         .dev                    = &__fake_net_device,
                         .path                   = &__fake_rtable.u.dst,
                         .metrics                = {[RTAX_MTU - 1] = 1500},
+                        .flags                  = DST_NOXFRM,
                 }
         },
         .rt_flags       = 0,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 6766f118f070..2144952d1c6c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -411,6 +411,9 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(pkt_type);
         C(ip_summed);
         C(priority);
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        C(ipvs_property);
+#endif
         C(protocol);
         n->destructor = NULL;
 #ifdef CONFIG_NETFILTER
@@ -422,13 +425,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(nfct_reasm);
         nf_conntrack_get_reasm(skb->nfct_reasm);
 #endif
-#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
-        C(ipvs_property);
-#endif
-#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
-        C(nfct_reasm);
-        nf_conntrack_get_reasm(skb->nfct_reasm);
-#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         C(nf_bridge);
         nf_bridge_get(skb->nf_bridge);
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 9890fd97e538..c971f14712ec 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -95,6 +95,12 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                 saddr = dev->dev_addr;
         memcpy(eth->h_source,saddr,dev->addr_len);
 
+        if(daddr)
+        {
+                memcpy(eth->h_dest,daddr,dev->addr_len);
+                return ETH_HLEN;
+        }
+        
         /*
          *      Anyway, the loopback-device should never use this function... 
          */
@@ -105,12 +111,6 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
                 return ETH_HLEN;
         }
         
-        if(daddr)
-        {
-                memcpy(eth->h_dest,daddr,dev->addr_len);
-                return ETH_HLEN;
-        }
-        
         return -ETH_HLEN;
 }
 
diff --git a/net/ipv4/netfilter/ip_nat_core.c b/net/ipv4/netfilter/ip_nat_core.c
index c1a61462507f..1741d555ad0d 100644
--- a/net/ipv4/netfilter/ip_nat_core.c
+++ b/net/ipv4/netfilter/ip_nat_core.c
@@ -434,6 +434,7 @@ int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
         } *inside;
         struct ip_conntrack_tuple inner, target;
         int hdrlen = (*pskb)->nh.iph->ihl * 4;
+        unsigned long statusbit;
 
         if (!skb_make_writable(pskb, hdrlen + sizeof(*inside)))
                 return 0;
@@ -495,17 +496,16 @@ int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
 
         /* Change outer to look the reply to an incoming packet
          * (proto 0 means don't invert per-proto part). */
+        if (manip == IP_NAT_MANIP_SRC)
+                statusbit = IPS_SRC_NAT;
+        else
+                statusbit = IPS_DST_NAT;
 
-        /* Obviously, we need to NAT destination IP, but source IP
-           should be NAT'ed only if it is from a NAT'd host.
+        /* Invert if this is reply dir. */
+        if (dir == IP_CT_DIR_REPLY)
+                statusbit ^= IPS_NAT_MASK;
 
-           Explanation: some people use NAT for anonymizing.  Also,
-           CERT recommends dropping all packets from private IP
-           addresses (although ICMP errors from internal links with
-           such addresses are not too uncommon, as Alan Cox points
-           out) */
-        if (manip != IP_NAT_MANIP_SRC
-            || ((*pskb)->nh.iph->saddr == ct->tuplehash[dir].tuple.src.ip)) {
+        if (ct->status & statusbit) {
                 invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
                 if (!manip_pkt(0, pskb, 0, &target, manip))
                         return 0;
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 7c3f7d380240..ab1f88fa21ec 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -200,20 +200,14 @@ ip_nat_in(unsigned int hooknum,
           const struct net_device *out,
           int (*okfn)(struct sk_buff *))
 {
-        struct ip_conntrack *ct;
-        enum ip_conntrack_info ctinfo;
         unsigned int ret;
+        u_int32_t daddr = (*pskb)->nh.iph->daddr;
 
         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
         if (ret != NF_DROP && ret != NF_STOLEN
-            && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (ct->tuplehash[dir].tuple.dst.ip !=
-                    ct->tuplehash[!dir].tuple.src.ip) {
-                        dst_release((*pskb)->dst);
-                        (*pskb)->dst = NULL;
-                }
+            && daddr != (*pskb)->nh.iph->daddr) {
+                dst_release((*pskb)->dst);
+                (*pskb)->dst = NULL;
         }
         return ret;
 }
@@ -276,7 +270,7 @@ ip_nat_local_fn(unsigned int hooknum,
                     ct->tuplehash[!dir].tuple.src.ip
 #ifdef CONFIG_XFRM
                     || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[dir].tuple.src.u.all
+                       ct->tuplehash[!dir].tuple.src.u.all
 #endif
                     )
                         return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d82c242ea704..fca5fe0cf94a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -835,7 +835,7 @@ static int rt_garbage_collect(void)
                                         int r;
 
                                         rthp = rt_remove_balanced_route(
-                                                &rt_hash_table[i].chain,
+                                                &rt_hash_table[k].chain,
                                                 rth,
                                                 &r);
                                         goal -= r;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 45f7ae58f2c0..f285bbf296e2 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -35,6 +35,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
+                    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
                     xfrm_bundle_ok(xdst, fl, AF_INET)) {
                         dst_clone(dst);
                         break;
@@ -61,7 +62,8 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 .nl_u = {
                         .ip4_u = {
                                 .saddr = local,
-                                .daddr = remote
+                                .daddr = remote,
+                                .tos = fl->fl4_tos
                         }
                 }
         };
@@ -230,6 +232,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
         fl->proto = iph->protocol;
         fl->fl4_dst = iph->daddr;
         fl->fl4_src = iph->saddr;
+        fl->fl4_tos = iph->tos;
 }
 
 static inline int xfrm4_garbage_collect(void)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index efa3e72cfcfa..f999edd846a9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -494,6 +494,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         struct net_device *dev;
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info*)skb->dst;
+        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
@@ -505,7 +506,12 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         hlen = ip6_find_1stfragopt(skb, &prevhdr);
         nexthdr = *prevhdr;
 
-        mtu = dst_mtu(&rt->u.dst) - hlen - sizeof(struct frag_hdr);
+        mtu = dst_mtu(&rt->u.dst);
+        if (np && np->frag_size < mtu) {
+                if (np->frag_size)
+                        mtu = np->frag_size;
+        }
+        mtu -= hlen + sizeof(struct frag_hdr);
 
         if (skb_shinfo(skb)->frag_list) {
                 int first_len = skb_pagelen(skb);
@@ -882,7 +888,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl = *fl;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                inet->cork.fragsize = mtu = dst_mtu(rt->u.dst.path);
+                mtu = dst_mtu(rt->u.dst.path);
+                if (np && np->frag_size < mtu) {
+                        if (np->frag_size)
+                                mtu = np->frag_size;
+                }
+                inet->cork.fragsize = mtu;
                 if (dst_allfrag(rt->u.dst.path))
                         inet->cork.flags |= IPCORK_ALLFRAG;
                 inet->cork.length = 0;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 92ead3cf956b..48597538db3f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -458,7 +458,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         mtu = IPV6_MIN_MTU;
                 t->dev->mtu = mtu;
 
-                if ((len = sizeof (*ipv6h) + ipv6h->payload_len) > mtu) {
+                if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
                         rel_type = ICMPV6_PKT_TOOBIG;
                         rel_code = 0;
                         rel_info = mtu;
@@ -884,6 +884,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
         t->parms.encap_limit = p->encap_limit;
         t->parms.flowinfo = p->flowinfo;
         t->parms.link = p->link;
+        ip6_tnl_dst_reset(t);
         ip6ip6_tnl_link_config(t);
         return 0;
 }
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ae86d237a456..b2d4d1dd2116 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1423,7 +1423,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr,
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                 goto out;
         }
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 98ec53bd3ac7..8206025d8e46 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -782,7 +782,7 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
         int nx = 0;
         int err;
         u32 genid;
-        u16 family = dst_orig->ops->family;
+        u16 family;
         u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
         u32 sk_sid = security_sk_sid(sk, fl, dir);
 restart:
@@ -796,13 +796,14 @@ restart:
                 if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
                         return 0;
 
-                policy = flow_cache_lookup(fl, sk_sid, family, dir,
-                                           xfrm_policy_lookup);
+                policy = flow_cache_lookup(fl, sk_sid, dst_orig->ops->family,
+                                           dir, xfrm_policy_lookup);
         }
 
         if (!policy)
                 return 0;
 
+        family = dst_orig->ops->family;
         policy->curlft.use_time = (unsigned long)xtime.tv_sec;
 
         switch (policy->action) {
@@ -885,8 +886,6 @@ restart:
                          * We can't enlist stable bundles either.
                          */
                         write_unlock_bh(&policy->lock);
-
-                        xfrm_pol_put(policy);
                         if (dst)
                                 dst_free(dst);
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e12d0be5f976..c656cbaf35e8 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -220,14 +220,14 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                 x->km.state = XFRM_STATE_DEAD;
                 spin_lock(&xfrm_state_lock);
                 list_del(&x->bydst);
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                 if (x->id.spi) {
                         list_del(&x->byspi);
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
                 }
                 spin_unlock(&xfrm_state_lock);
                 if (del_timer(&x->timer))
-                        atomic_dec(&x->refcnt);
+                        __xfrm_state_put(x);
 
                 /* The number two in this test is the reference
                  * mentioned in the comment below plus the reference
@@ -243,7 +243,7 @@ static int __xfrm_state_delete(struct xfrm_state *x)
                  * The xfrm_state_alloc call gives a reference, and that
                  * is what we are dropping here.
                  */
-                atomic_dec(&x->refcnt);
+                __xfrm_state_put(x);
                 err = 0;
         }
 
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ac87a09ba83e..7de17559249a 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -345,7 +345,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
-                xfrm_state_put(x);
+                __xfrm_state_put(x);
                 goto out;
         }
 
diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 418c6d4e5daf..a529b62972b4 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -167,7 +167,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
                         int *countp)
 {
         struct snd_kcontrol *kctl;
-        struct snd_ctl_elem_info info;
+        struct snd_ctl_elem_info *info;
         int err;
 
         down_read(&card->controls_rwsem);
@@ -176,13 +176,19 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
                 up_read(&card->controls_rwsem);
                 return -ENXIO;
         }
-        info.id = *id;
-        err = kctl->info(kctl, &info);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (info == NULL) {
+                up_read(&card->controls_rwsem);
+                return -ENOMEM;
+        }
+        info->id = *id;
+        err = kctl->info(kctl, info);
         up_read(&card->controls_rwsem);
         if (err >= 0) {
-                err = info.type;
-                *countp = info.count;
+                err = info->type;
+                *countp = info->count;
         }
+        kfree(info);
         return err;
 }
 
diff --git a/sound/drivers/opl3/opl3_oss.c b/sound/drivers/opl3/opl3_oss.c
index 31f1f2e25aa0..0345ae647681 100644
--- a/sound/drivers/opl3/opl3_oss.c
+++ b/sound/drivers/opl3/opl3_oss.c
@@ -146,7 +146,7 @@ void snd_opl3_init_seq_oss(struct snd_opl3 *opl3, char *name)
 void snd_opl3_free_seq_oss(struct snd_opl3 *opl3)
 {
         if (opl3->oss_seq_dev) {
-                snd_device_free(opl3->card, opl3->oss_seq_dev);
+                /* The instance should have been released in prior */
                 opl3->oss_seq_dev = NULL;
         }
 }
diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c
index 4fa431040564..99a42138bea0 100644
--- a/sound/isa/cs423x/cs4236.c
+++ b/sound/isa/cs423x/cs4236.c
@@ -414,7 +414,7 @@ static int __devinit snd_card_cs423x_pnpc(int dev, struct snd_card_cs4236 *acard
         }
         /* MPU initialization */
         if (acard->mpu && mpu_port[dev] > 0) {
-                if (snd_cs423x_pnp_init_mpu(dev, acard->ctrl, cfg) < 0)
+                if (snd_cs423x_pnp_init_mpu(dev, acard->mpu, cfg) < 0)
                         goto error;
         }
         kfree(cfg);