Merge with temp tree to get David's gdb inferior calls patch

642 files changed, 10422 insertions, 7521 deletions

diff --git a/Documentation/Changes b/Documentation/Changes
index caa6a5529b6b..57542bc25edd 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -357,14 +357,14 @@ Quota-tools
 ----------
 o  <http://sourceforge.net/projects/linuxquota/>
 
-Jade
-----
-o  <ftp://ftp.jclark.com/pub/jade/jade-1.2.1.tar.gz>
-
 DocBook Stylesheets
 -------------------
 o  <http://nwalsh.com/docbook/dsssl/>
 
+XMLTO XSLT Frontend
+-------------------
+o  <http://cyberelk.net/tim/xmlto/>
+
 Intel P6 microcode
 ------------------
 o  <http://www.urbanmyth.org/microcode/>
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index a221039ee4c9..e69b3d2e7884 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -7,10 +7,9 @@
 # list of DOCBOOKS.
 
 DOCBOOKS := wanbook.xml z8530book.xml mcabook.xml videobook.xml \
-            kernel-hacking.xml kernel-locking.xml via-audio.xml \
-            deviceiobook.xml procfs-guide.xml tulip-user.xml \
-            writing_usb_driver.xml scsidrivers.xml sis900.xml \
-            kernel-api.xml journal-api.xml lsm.xml usb.xml \
+            kernel-hacking.xml kernel-locking.xml deviceiobook.xml \
+            procfs-guide.xml writing_usb_driver.xml scsidrivers.xml \
+            sis900.xml kernel-api.xml journal-api.xml lsm.xml usb.xml \
             gadget.xml libata.xml mtdnand.xml librs.xml
 
 ###
@@ -42,14 +41,16 @@ MAN := $(patsubst %.xml, %.9, $(BOOKS))
 mandocs: $(MAN)
 
 installmandocs: mandocs
-        $(MAKEMAN) install Documentation/DocBook/man
+        mkdir -p /usr/local/man/man9/
+        install Documentation/DocBook/man/*.9.gz /usr/local/man/man9/
 
 ###
 #External programs used
 KERNELDOC = scripts/kernel-doc
 DOCPROC   = scripts/basic/docproc
-SPLITMAN  = $(PERL) $(srctree)/scripts/split-man
-MAKEMAN   = $(PERL) $(srctree)/scripts/makeman
+
+XMLTOFLAGS = -m Documentation/DocBook/stylesheet.xsl
+#XMLTOFLAGS += --skip-validation
 
 ###
 # DOCPROC is used for two purposes:
@@ -96,45 +97,44 @@ $(obj)/procfs-guide.xml: $(C-procfs-example2)
 # Rules to generate postscript, PDF and HTML
 # db2html creates a directory. Generate a html file used for timestamp
 
-quiet_cmd_db2ps = DB2PS   $@
-      cmd_db2ps = db2ps -o $(dir $@) $<
+quiet_cmd_db2ps = XMLTO    $@
+      cmd_db2ps = xmlto ps $(XMLTOFLAGS) -o $(dir $@) $<
 %.ps : %.xml
-        @(which db2ps > /dev/null 2>&1) || \
-         (echo "*** You need to install DocBook stylesheets ***"; \
+        @(which xmlto > /dev/null 2>&1) || \
+         (echo "*** You need to install xmlto ***"; \
           exit 1)
         $(call cmd,db2ps)
 
-quiet_cmd_db2pdf = DB2PDF  $@
-      cmd_db2pdf = db2pdf -o $(dir $@) $<
+quiet_cmd_db2pdf = XMLTO   $@
+      cmd_db2pdf = xmlto pdf $(XMLTOFLAGS) -o $(dir $@) $<
 %.pdf : %.xml
-        @(which db2pdf > /dev/null 2>&1) || \
-         (echo "*** You need to install DocBook stylesheets ***"; \
+        @(which xmlto > /dev/null 2>&1) || \
+         (echo "*** You need to install xmlto ***"; \
           exit 1)
         $(call cmd,db2pdf)
 
-quiet_cmd_db2html = DB2HTML $@
-      cmd_db2html = db2html -o $(patsubst %.html,%,$@) $< &&                  \
-                echo '<a HREF="$(patsubst %.html,%,$(notdir $@))/book1.html"> \
+quiet_cmd_db2html = XMLTO  $@
+      cmd_db2html = xmlto xhtml $(XMLTOFLAGS) -o $(patsubst %.html,%,$@) $< && \
+                echo '<a HREF="$(patsubst %.html,%,$(notdir $@))/index.html"> \
          Goto $(patsubst %.html,%,$(notdir $@))</a><p>' > $@
 
 %.html: %.xml
-        @(which db2html > /dev/null 2>&1) || \
-         (echo "*** You need to install DocBook stylesheets ***"; \
+        @(which xmlto > /dev/null 2>&1) || \
+         (echo "*** You need to install xmlto ***"; \
           exit 1)
         @rm -rf $@ $(patsubst %.html,%,$@)
         $(call cmd,db2html)
         @if [ ! -z "$(PNG-$(basename $(notdir $@)))" ]; then \
             cp $(PNG-$(basename $(notdir $@))) $(patsubst %.html,%,$@); fi
 
-###
-# Rule to generate man files - output is placed in the man subdirectory
-
-%.9:    %.xml
-ifneq ($(KBUILD_SRC),)
-        $(Q)mkdir -p $(objtree)/Documentation/DocBook/man
-endif
-        $(SPLITMAN) $< $(objtree)/Documentation/DocBook/man "$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)"
-        $(MAKEMAN) convert $(objtree)/Documentation/DocBook/man $<
+quiet_cmd_db2man = XMLTO   $@
+      cmd_db2man = if grep -q refentry $<; then xmlto man $(XMLTOFLAGS) -o $(obj)/man $< ; gzip -f $(obj)/man/*.9; fi
+%.9 : %.xml
+        @(which xmlto > /dev/null 2>&1) || \
+         (echo "*** You need to install xmlto ***"; \
+          exit 1)
+        $(call cmd,db2man)
+        @touch $@
 
 ###
 # Rules to generate postscripts and PNG imgages from .fig format files
diff --git a/Documentation/DocBook/kernel-api.tmpl b/Documentation/DocBook/kernel-api.tmpl
index 1bd20c860285..757cef8f8491 100644
--- a/Documentation/DocBook/kernel-api.tmpl
+++ b/Documentation/DocBook/kernel-api.tmpl
@@ -49,13 +49,33 @@
 !Iinclude/asm-i386/unaligned.h
      </sect1>
 
-<!-- FIXME:
-  kernel/sched.c has no docs, which stuffs up the sgml.  Comment
-  out until somebody adds docs.  KAO
      <sect1><title>Delaying, scheduling, and timer routines</title>
-X!Ekernel/sched.c
+!Iinclude/linux/sched.h
+!Ekernel/sched.c
+!Ekernel/timer.c
      </sect1>
-KAO -->
+     <sect1><title>Internal Functions</title>
+!Ikernel/exit.c
+!Ikernel/signal.c
+     </sect1>
+
+     <sect1><title>Kernel objects manipulation</title>
+<!--
+X!Iinclude/linux/kobject.h
+-->
+!Elib/kobject.c
+     </sect1>
+
+     <sect1><title>Kernel utility functions</title>
+!Iinclude/linux/kernel.h
+<!-- This needs to clean up to make kernel-doc happy
+X!Ekernel/printk.c
+ -->
+!Ekernel/panic.c
+!Ekernel/sys.c
+!Ekernel/rcupdate.c
+     </sect1>
+
   </chapter>
 
   <chapter id="adt">
@@ -81,7 +101,9 @@ KAO -->
 !Elib/vsprintf.c
      </sect1>
      <sect1><title>String Manipulation</title>
-!Ilib/string.c
+<!-- All functions are exported at now
+X!Ilib/string.c
+ -->
 !Elib/string.c
      </sect1>
      <sect1><title>Bit Operations</title>
@@ -98,6 +120,25 @@ KAO -->
 !Iinclude/asm-i386/uaccess.h
 !Iarch/i386/lib/usercopy.c
      </sect1>
+     <sect1><title>More Memory Management Functions</title>
+!Iinclude/linux/rmap.h
+!Emm/readahead.c
+!Emm/filemap.c
+!Emm/memory.c
+!Emm/vmalloc.c
+!Emm/mempool.c
+!Emm/page-writeback.c
+!Emm/truncate.c
+     </sect1>
+  </chapter>
+
+
+  <chapter id="ipc">
+     <title>Kernel IPC facilities</title>
+
+     <sect1><title>IPC utilities</title>
+!Iipc/util.c
+     </sect1>
   </chapter>
 
   <chapter id="kfifo">
@@ -114,6 +155,10 @@ KAO -->
      <sect1><title>sysctl interface</title>
 !Ekernel/sysctl.c
      </sect1>
+
+     <sect1><title>proc filesystem interface</title>
+!Ifs/proc/base.c
+     </sect1>
   </chapter>
 
   <chapter id="debugfs">
@@ -127,6 +172,10 @@ KAO -->
 
   <chapter id="vfs">
      <title>The Linux VFS</title>
+     <sect1><title>The Filesystem types</title>
+!Iinclude/linux/fs.h
+!Einclude/linux/fs.h
+     </sect1>
      <sect1><title>The Directory Cache</title>
 !Efs/dcache.c
 !Iinclude/linux/dcache.h
@@ -142,13 +191,31 @@ KAO -->
 !Efs/locks.c
 !Ifs/locks.c
      </sect1>
+     <sect1><title>Other Functions</title>
+!Efs/mpage.c
+!Efs/namei.c
+!Efs/buffer.c
+!Efs/bio.c
+!Efs/seq_file.c
+!Efs/filesystems.c
+!Efs/fs-writeback.c
+!Efs/block_dev.c
+     </sect1>
   </chapter>
 
   <chapter id="netcore">
      <title>Linux Networking</title>
+     <sect1><title>Networking Base Types</title>
+!Iinclude/linux/net.h
+     </sect1>
      <sect1><title>Socket Buffer Functions</title>
 !Iinclude/linux/skbuff.h
+!Iinclude/net/sock.h
+!Enet/socket.c
 !Enet/core/skbuff.c
+!Enet/core/sock.c
+!Enet/core/datagram.c
+!Enet/core/stream.c
      </sect1>
      <sect1><title>Socket Filter</title>
 !Enet/core/filter.c
@@ -158,6 +225,14 @@ KAO -->
 !Enet/core/gen_stats.c
 !Enet/core/gen_estimator.c
      </sect1>
+     <sect1><title>SUN RPC subsystem</title>
+<!-- The !D functionality is not perfect, garbage has to be protected by comments
+!Dnet/sunrpc/sunrpc_syms.c
+-->
+!Enet/sunrpc/xdr.c
+!Enet/sunrpc/svcsock.c
+!Enet/sunrpc/sched.c
+     </sect1>
   </chapter>
 
   <chapter id="netdev">
@@ -194,11 +269,26 @@ X!Ekernel/module.c
 !Iarch/i386/kernel/irq.c
      </sect1>
 
+     <sect1><title>Resources Management</title>
+!Ekernel/resource.c
+     </sect1>
+
      <sect1><title>MTRR Handling</title>
 !Earch/i386/kernel/cpu/mtrr/main.c
      </sect1>
      <sect1><title>PCI Support Library</title>
 !Edrivers/pci/pci.c
+!Edrivers/pci/pci-driver.c
+!Edrivers/pci/remove.c
+!Edrivers/pci/pci-acpi.c
+<!-- kerneldoc does not understand to __devinit
+X!Edrivers/pci/search.c
+ -->
+!Edrivers/pci/msi.c
+!Edrivers/pci/bus.c
+!Edrivers/pci/hotplug.c
+!Edrivers/pci/probe.c
+!Edrivers/pci/rom.c
      </sect1>
      <sect1><title>PCI Hotplug Support Library</title>
 !Edrivers/pci/hotplug/pci_hotplug_core.c
@@ -223,6 +313,14 @@ X!Earch/i386/kernel/mca.c
 !Efs/devfs/base.c
   </chapter>
 
+  <chapter id="sysfs">
+     <title>The Filesystem for Exporting Kernel Objects</title>
+!Efs/sysfs/file.c
+!Efs/sysfs/dir.c
+!Efs/sysfs/symlink.c
+!Efs/sysfs/bin.c
+  </chapter>
+
   <chapter id="security">
      <title>Security Framework</title>
 !Esecurity/security.c
@@ -233,6 +331,61 @@ X!Earch/i386/kernel/mca.c
 !Ekernel/power/pm.c
   </chapter>
 
+  <chapter id="devdrivers">
+     <title>Device drivers infrastructure</title>
+     <sect1><title>Device Drivers Base</title>
+<!--
+X!Iinclude/linux/device.h
+-->
+!Edrivers/base/driver.c
+!Edrivers/base/class_simple.c
+!Edrivers/base/core.c
+!Edrivers/base/firmware_class.c
+!Edrivers/base/transport_class.c
+!Edrivers/base/dmapool.c
+<!-- Cannot be included, because
+     attribute_container_add_class_device_adapter
+ and attribute_container_classdev_to_container
+     exceed allowed 44 characters maximum
+X!Edrivers/base/attribute_container.c
+-->
+!Edrivers/base/sys.c
+<!--
+X!Edrivers/base/interface.c
+-->
+!Edrivers/base/platform.c
+!Edrivers/base/bus.c
+     </sect1>
+     <sect1><title>Device Drivers Power Management</title>
+!Edrivers/base/power/main.c
+!Edrivers/base/power/resume.c
+!Edrivers/base/power/suspend.c
+     </sect1>
+     <sect1><title>Device Drivers ACPI Support</title>
+<!-- Internal functions only
+X!Edrivers/acpi/sleep/main.c
+X!Edrivers/acpi/sleep/wakeup.c
+X!Edrivers/acpi/motherboard.c
+X!Edrivers/acpi/bus.c
+-->
+!Edrivers/acpi/scan.c
+<!-- No correct structured comments
+X!Edrivers/acpi/pci_bind.c
+-->
+     </sect1>
+     <sect1><title>Device drivers PnP support</title>
+!Edrivers/pnp/core.c
+<!-- No correct structured comments
+X!Edrivers/pnp/system.c
+ -->
+!Edrivers/pnp/card.c
+!Edrivers/pnp/driver.c
+!Edrivers/pnp/manager.c
+!Edrivers/pnp/support.c
+     </sect1>
+  </chapter>
+
+
   <chapter id="blkdev">
      <title>Block Devices</title>
 !Edrivers/block/ll_rw_blk.c
@@ -250,7 +403,23 @@ X!Earch/i386/kernel/mca.c
 
   <chapter id="snddev">
      <title>Sound Devices</title>
+!Iinclude/sound/core.h
 !Esound/sound_core.c
+!Iinclude/sound/pcm.h
+!Esound/core/pcm.c
+!Esound/core/device.c
+!Esound/core/info.c
+!Esound/core/rawmidi.c
+!Esound/core/sound.c
+!Esound/core/memory.c
+!Esound/core/pcm_memory.c
+!Esound/core/init.c
+!Esound/core/isadma.c
+!Esound/core/control.c
+!Esound/core/pcm_lib.c
+!Esound/core/hwdep.c
+!Esound/core/pcm_native.c
+!Esound/core/memalloc.c
 <!-- FIXME: Removed for now since no structured comments in source
 X!Isound/sound_firmware.c
 -->
@@ -258,6 +427,7 @@ X!Isound/sound_firmware.c
 
   <chapter id="uart16x50">
      <title>16x50 UART Driver</title>
+!Iinclude/linux/serial_core.h
 !Edrivers/serial/serial_core.c
 !Edrivers/serial/8250.c
   </chapter>
@@ -310,9 +480,11 @@ X!Isound/sound_firmware.c
      <sect1><title>Frame Buffer Memory</title>
 !Edrivers/video/fbmem.c
      </sect1>
+<!--
      <sect1><title>Frame Buffer Console</title>
-!Edrivers/video/console/fbcon.c
+X!Edrivers/video/console/fbcon.c
      </sect1>
+-->
      <sect1><title>Frame Buffer Colormap</title>
 !Edrivers/video/fbcmap.c
      </sect1>
diff --git a/Documentation/DocBook/stylesheet.xsl b/Documentation/DocBook/stylesheet.xsl
new file mode 100644
index 000000000000..e14c21dda403
--- /dev/null
+++ b/Documentation/DocBook/stylesheet.xsl
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<stylesheet xmlns="http://www.w3.org/1999/XSL/Transform" version="1.0">
+<param name="chunk.quietly">1</param>
+<param name="funcsynopsis.style">ansi</param>
+</stylesheet>
diff --git a/Documentation/DocBook/tulip-user.tmpl b/Documentation/DocBook/tulip-user.tmpl
deleted file mode 100644
index 6520d7a1b132..000000000000
--- a/Documentation/DocBook/tulip-user.tmpl
+++ /dev/null
@@ -1,327 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
-        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
-
-<book id="TulipUserGuide">
- <bookinfo>
-  <title>Tulip Driver User's Guide</title>
-  
-  <authorgroup>
-   <author>
-    <firstname>Jeff</firstname>
-    <surname>Garzik</surname>
-    <affiliation>
-     <address>
-      <email>jgarzik@pobox.com</email>
-     </address>
-    </affiliation>
-   </author>
-  </authorgroup>
-
-  <copyright>
-   <year>2001</year>
-   <holder>Jeff Garzik</holder>
-  </copyright>
-
-  <legalnotice>
-   <para>
-     This documentation is free software; you can redistribute
-     it and/or modify it under the terms of the GNU General Public
-     License as published by the Free Software Foundation; either
-     version 2 of the License, or (at your option) any later
-     version.
-   </para>
-      
-   <para>
-     This program is distributed in the hope that it will be
-     useful, but WITHOUT ANY WARRANTY; without even the implied
-     warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-     See the GNU General Public License for more details.
-   </para>
-      
-   <para>
-     You should have received a copy of the GNU General Public
-     License along with this program; if not, write to the Free
-     Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-     MA 02111-1307 USA
-   </para>
-      
-   <para>
-     For more details see the file COPYING in the source
-     distribution of Linux.
-   </para>
-  </legalnotice>
- </bookinfo>
-
- <toc></toc>
-
-  <chapter id="intro">
-    <title>Introduction</title>
-<para>
-The Tulip Ethernet Card Driver
-is maintained by Jeff Garzik (<email>jgarzik@pobox.com</email>).
-</para>
-
-<para>
-The Tulip driver was developed by Donald Becker and changed by
-Jeff Garzik, Takashi Manabe and a cast of thousands.
-</para>
-
-<para>
-For 2.4.x and later kernels, the Linux Tulip driver is available at
-<ulink url="http://sourceforge.net/projects/tulip/">http://sourceforge.net/projects/tulip/</ulink>
-</para>
-
-<para>
-        This driver is for the Digital "Tulip" Ethernet adapter interface.
-        It should work with most DEC 21*4*-based chips/ethercards, as well as
-        with work-alike chips from Lite-On (PNIC) and Macronix (MXIC) and ASIX.
-</para>
-
-<para>
-        The original author may be reached as becker@scyld.com, or C/O
-        Scyld Computing Corporation,
-        410 Severn Ave., Suite 210,
-        Annapolis MD 21403
-</para>
-
-<para>
-        Additional information on Donald Becker's tulip.c
-        is available at <ulink url="http://www.scyld.com/network/tulip.html">http://www.scyld.com/network/tulip.html</ulink>
-</para>
-
-  </chapter>
-
-  <chapter id="drvr-compat">
-    <title>Driver Compatibility</title>
-
-<para>
-This device driver is designed for the DECchip "Tulip", Digital's
-single-chip ethernet controllers for PCI (now owned by Intel).
-Supported members of the family
-are the 21040, 21041, 21140, 21140A, 21142, and 21143.  Similar work-alike
-chips from Lite-On, Macronics, ASIX, Compex and other listed below are also
-supported.
-</para>
-
-<para>
-These chips are used on at least 140 unique PCI board designs.  The great
-number of chips and board designs supported is the reason for the
-driver size and complexity.  Almost of the increasing complexity is in the
-board configuration and media selection code.  There is very little
-increasing in the operational critical path length.
-</para>
-  </chapter>
-
-  <chapter id="board-settings">
-    <title>Board-specific Settings</title>
-
-<para>
-PCI bus devices are configured by the system at boot time, so no jumpers
-need to be set on the board.  The system BIOS preferably should assign the
-PCI INTA signal to an otherwise unused system IRQ line.
-</para>
-
-<para>
-Some boards have EEPROMs tables with default media entry.  The factory default
-is usually "autoselect".  This should only be overridden when using
-transceiver connections without link beat e.g. 10base2 or AUI, or (rarely!)
-for forcing full-duplex when used with old link partners that do not do
-autonegotiation.
-</para>
-  </chapter>
-
-  <chapter id="driver-operation">
-    <title>Driver Operation</title>
-
-<sect1><title>Ring buffers</title>
-
-<para>
-The Tulip can use either ring buffers or lists of Tx and Rx descriptors.
-This driver uses statically allocated rings of Rx and Tx descriptors, set at
-compile time by RX/TX_RING_SIZE.  This version of the driver allocates skbuffs
-for the Rx ring buffers at open() time and passes the skb->data field to the
-Tulip as receive data buffers.  When an incoming frame is less than
-RX_COPYBREAK bytes long, a fresh skbuff is allocated and the frame is
-copied to the new skbuff.  When the incoming frame is larger, the skbuff is
-passed directly up the protocol stack and replaced by a newly allocated
-skbuff.
-</para>
-
-<para>
-The RX_COPYBREAK value is chosen to trade-off the memory wasted by
-using a full-sized skbuff for small frames vs. the copying costs of larger
-frames.  For small frames the copying cost is negligible (esp. considering
-that we are pre-loading the cache with immediately useful header
-information).  For large frames the copying cost is non-trivial, and the
-larger copy might flush the cache of useful data.  A subtle aspect of this
-choice is that the Tulip only receives into longword aligned buffers, thus
-the IP header at offset 14 isn't longword aligned for further processing.
-Copied frames are put into the new skbuff at an offset of "+2", thus copying
-has the beneficial effect of aligning the IP header and preloading the
-cache.
-</para>
-
-</sect1>
-
-<sect1><title>Synchronization</title>
-<para>
-The driver runs as two independent, single-threaded flows of control.  One
-is the send-packet routine, which enforces single-threaded use by the
-dev->tbusy flag.  The other thread is the interrupt handler, which is single
-threaded by the hardware and other software.
-</para>
-
-<para>
-The send packet thread has partial control over the Tx ring and 'dev->tbusy'
-flag.  It sets the tbusy flag whenever it's queuing a Tx packet. If the next
-queue slot is empty, it clears the tbusy flag when finished otherwise it sets
-the 'tp->tx_full' flag.
-</para>
-
-<para>
-The interrupt handler has exclusive control over the Rx ring and records stats
-from the Tx ring.  (The Tx-done interrupt can't be selectively turned off, so
-we can't avoid the interrupt overhead by having the Tx routine reap the Tx
-stats.)  After reaping the stats, it marks the queue entry as empty by setting
-the 'base' to zero.      Iff the 'tp->tx_full' flag is set, it clears both the
-tx_full and tbusy flags.
-</para>
-
-</sect1>
-
-  </chapter>
-
-  <chapter id="errata">
-    <title>Errata</title>
-
-<para>
-The old DEC databooks were light on details.
-The 21040 databook claims that CSR13, CSR14, and CSR15 should each be the last
-register of the set CSR12-15 written.  Hmmm, now how is that possible?
-</para>
-
-<para>
-The DEC SROM format is very badly designed not precisely defined, leading to
-part of the media selection junkheap below.  Some boards do not have EEPROM
-media tables and need to be patched up.  Worse, other boards use the DEC
-design kit media table when it isn't correct for their board.
-</para>
-
-<para>
-We cannot use MII interrupts because there is no defined GPIO pin to attach
-them.  The MII transceiver status is polled using an kernel timer.
-</para>
-  </chapter>
-
-  <chapter id="changelog">
-    <title>Driver Change History</title>
-
-    <sect1><title>Version 0.9.14 (February 20, 2001)</title>
-    <itemizedlist>
-    <listitem><para>Fix PNIC problems (Manfred Spraul)</para></listitem>
-    <listitem><para>Add new PCI id for Accton comet</para></listitem>
-    <listitem><para>Support Davicom tulips</para></listitem>
-    <listitem><para>Fix oops in eeprom parsing</para></listitem>
-    <listitem><para>Enable workarounds for early PCI chipsets</para></listitem>
-    <listitem><para>IA64, hppa csr0 support</para></listitem>
-    <listitem><para>Support media types 5, 6</para></listitem>
-    <listitem><para>Interpret a bit more of the 21142 SROM extended media type 3</para></listitem>
-    <listitem><para>Add missing delay in eeprom reading</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.11 (November 3, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Eliminate extra bus accesses when sharing interrupts (prumpf)</para></listitem>
-    <listitem><para>Barrier following ownership descriptor bit flip (prumpf)</para></listitem>
-    <listitem><para>Endianness fixes for >14 addresses in setup frames (prumpf)</para></listitem>
-    <listitem><para>Report link beat to kernel/userspace via netif_carrier_*. (kuznet)</para></listitem>
-    <listitem><para>Better spinlocking in set_rx_mode.</para></listitem>
-    <listitem><para>Fix I/O resource request failure error messages (DaveM catch)</para></listitem>
-    <listitem><para>Handle DMA allocation failure.</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.10 (September 6, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Simple interrupt mitigation (via jamal)</para></listitem>
-    <listitem><para>More PCI ids</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.9 (August 11, 2000)</title>
-    <itemizedlist>
-    <listitem><para>More PCI ids</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.8 (July 13, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Correct signed/unsigned comparison for dummy frame index</para></listitem>
-    <listitem><para>Remove outdated references to struct enet_statistics</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.7 (June 17, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Timer cleanups (Andrew Morton)</para></listitem>
-    <listitem><para>Alpha compile fix (somebody?)</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.6 (May 31, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Revert 21143-related support flag patch</para></listitem>
-    <listitem><para>Add HPPA/media-table debugging printk</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.5 (May 30, 2000)</title>
-    <itemizedlist>
-    <listitem><para>HPPA support (willy@puffingroup)</para></listitem>
-    <listitem><para>CSR6 bits and tulip.h cleanup (Chris Smith)</para></listitem>
-    <listitem><para>Improve debugging messages a bit</para></listitem>
-    <listitem><para>Add delay after CSR13 write in t21142_start_nway</para></listitem>
-    <listitem><para>Remove unused ETHER_STATS code</para></listitem>
-    <listitem><para>Convert 'extern inline' to 'static inline' in tulip.h (Chris Smith)</para></listitem>
-    <listitem><para>Update DS21143 support flags in tulip_chip_info[]</para></listitem>
-    <listitem><para>Use spin_lock_irq, not _irqsave/restore, in tulip_start_xmit()</para></listitem>
-    <listitem><para>Add locking to set_rx_mode()</para></listitem>
-    <listitem><para>Fix race with chip setting DescOwned bit (Hal Murray)</para></listitem>
-    <listitem><para>Request 100% of PIO and MMIO resource space assigned to card</para></listitem>
-    <listitem><para>Remove error message from pci_enable_device failure</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.4.3 (April 14, 2000)</title>
-    <itemizedlist>
-    <listitem><para>mod_timer fix (Hal Murray)</para></listitem>
-    <listitem><para>PNIC2 resuscitation (Chris Smith)</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.4.2 (March 21, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Fix 21041 CSR7, CSR13/14/15 handling</para></listitem>
-    <listitem><para>Merge some PCI ids from tulip 0.91x</para></listitem>
-    <listitem><para>Merge some HAS_xxx flags and flag settings from tulip 0.91x</para></listitem>
-    <listitem><para>asm/io.h fix (submitted by many) and cleanup</para></listitem>
-    <listitem><para>s/HAS_NWAY143/HAS_NWAY/</para></listitem>
-    <listitem><para>Cleanup 21041 mode reporting</para></listitem>
-    <listitem><para>Small code cleanups</para></listitem>
-    </itemizedlist>
-    </sect1>
-
-    <sect1><title>Version 0.9.4.1 (March 18, 2000)</title>
-    <itemizedlist>
-    <listitem><para>Finish PCI DMA conversion (davem)</para></listitem>
-    <listitem><para>Do not netif_start_queue() at end of tulip_tx_timeout() (kuznet)</para></listitem>
-    <listitem><para>PCI DMA fix (kuznet)</para></listitem>
-    <listitem><para>eeprom.c code cleanup</para></listitem>
-    <listitem><para>Remove Xircom Tulip crud</para></listitem>
-    </itemizedlist>
-    </sect1>
-  </chapter>
-
-</book>
diff --git a/Documentation/DocBook/via-audio.tmpl b/Documentation/DocBook/via-audio.tmpl
deleted file mode 100644
index 36e642147d6b..000000000000
--- a/Documentation/DocBook/via-audio.tmpl
+++ /dev/null
@@ -1,597 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
-        "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
-
-<book id="ViaAudioGuide">
- <bookinfo>
-  <title>Via 686 Audio Driver for Linux</title>
-  
-  <authorgroup>
-   <author>
-    <firstname>Jeff</firstname>
-    <surname>Garzik</surname>
-   </author>
-  </authorgroup>
-
-  <copyright>
-   <year>1999-2001</year>
-   <holder>Jeff Garzik</holder>
-  </copyright>
-
-  <legalnotice>
-   <para>
-     This documentation is free software; you can redistribute
-     it and/or modify it under the terms of the GNU General Public
-     License as published by the Free Software Foundation; either
-     version 2 of the License, or (at your option) any later
-     version.
-   </para>
-      
-   <para>
-     This program is distributed in the hope that it will be
-     useful, but WITHOUT ANY WARRANTY; without even the implied
-     warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-     See the GNU General Public License for more details.
-   </para>
-      
-   <para>
-     You should have received a copy of the GNU General Public
-     License along with this program; if not, write to the Free
-     Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
-     MA 02111-1307 USA
-   </para>
-      
-   <para>
-     For more details see the file COPYING in the source
-     distribution of Linux.
-   </para>
-  </legalnotice>
- </bookinfo>
-
-<toc></toc>
-
-  <chapter id="intro">
-      <title>Introduction</title>
-  <para>
-        The Via VT82C686A "super southbridge" chips contain
-        AC97-compatible audio logic which features dual 16-bit stereo
-        PCM sound channels (full duplex), plus a third PCM channel intended for use
-        in hardware-assisted FM synthesis.
-  </para>
-  <para>
-        The current Linux kernel audio driver for this family of chips
-        supports audio playback and recording, but hardware-assisted
-        FM features, and hardware buffer direct-access (mmap)
-        support are not yet available.
-  </para>
-  <para>
-        This driver supports any Linux kernel version after 2.4.10.
-  </para>
-  <para>
-        Please send bug reports to the mailing list <email>linux-via@gtf.org</email>.
-        To subscribe, e-mail <email>majordomo@gtf.org</email> with
-  </para>
-  <programlisting>
-        subscribe linux-via
-  </programlisting>
-  <para>
-        in the body of the message.
-  </para>
-  </chapter>
-  
-  <chapter id="install">
-      <title>Driver Installation</title>
-  <para>
-        To use this audio driver, select the
-        CONFIG_SOUND_VIA82CXXX option in the section Sound during kernel configuration.
-        Follow the usual kernel procedures for rebuilding the kernel,
-        or building and installing driver modules.
-  </para>
-  <para>
-        To make this driver the default audio driver, you can add the
-        following to your /etc/conf.modules file:
-  </para>
-  <programlisting>
-        alias sound via82cxxx_audio
-  </programlisting>
-  <para>
-        Note that soundcore and ac97_codec support modules
-        are also required for working audio, in addition to
-        the via82cxxx_audio module itself.
-  </para>
-  </chapter>
-  
-  <chapter id="reportbug">
-      <title>Submitting a bug report</title>
-  <sect1 id="bugrepdesc"><title>Description of problem</title>
-  <para>
-        Describe the application you were using to play/record sound, and how
-        to reproduce the problem.
-  </para>
-  </sect1>
-  <sect1 id="bugrepdiag"><title>Diagnostic output</title>
-  <para>
-        Obtain the via-audio-diag diagnostics program from
-        http://sf.net/projects/gkernel/ and provide a dump of the
-        audio chip's registers while the problem is occurring.  Sample command line:
-  </para>
-  <programlisting>
-        ./via-audio-diag -aps > diag-output.txt
-  </programlisting>
-  </sect1>
-  <sect1 id="bugrepdebug"><title>Driver debug output</title>
-  <para>
-        Define <constant>VIA_DEBUG</constant> at the beginning of the driver, then capture and email
-        the kernel log output.  This can be viewed in the system kernel log (if
-        enabled), or via the dmesg program.  Sample command line:
-  </para>
-  <programlisting>
-        dmesg > /tmp/dmesg-output.txt
-  </programlisting>
-  </sect1>
-  <sect1 id="bugrepprintk"><title>Bigger kernel message buffer</title>
-  <para>
-        If you wish to increase the size of the buffer displayed by dmesg, then
-        change the <constant>LOG_BUF_LEN</constant> macro at the top of linux/kernel/printk.c, recompile
-        your kernel, and pass the <constant>LOG_BUF_LEN</constant> value to dmesg.  Sample command line with
-        <constant>LOG_BUF_LEN</constant> == 32768:
-  </para>
-  <programlisting>
-        dmesg -s 32768 > /tmp/dmesg-output.txt
-  </programlisting>
-  </sect1>
-  </chapter>
-  
-  <chapter id="bugs">
-     <title>Known Bugs And Assumptions</title>
-  <para>
-  <variablelist>
-    <varlistentry><term>Low volume</term>
-    <listitem>
-    <para>
-        Volume too low on many systems.  Workaround:  use mixer program
-        such as xmixer to increase volume.
-    </para>
-    </listitem></varlistentry>
-
-  </variablelist>
-        
-  </para>
-  </chapter>
-
-  <chapter id="thanks">
-      <title>Thanks</title>
-  <para>
-        Via for providing e-mail support, specs, and NDA'd source code.
-  </para>
-  <para>
-        MandrakeSoft for providing hacking time.
-  </para>
-  <para>
-        AC97 mixer interface fixes and debugging by Ron Cemer <email>roncemer@gte.net</email>.
-  </para>
-  <para>
-        Rui Sousa <email>rui.sousa@conexant.com</email>, for bugfixing
-        MMAP support, and several other notable fixes that resulted from
-        his hard work and testing.
-  </para>
-  <para>
-        Adrian Cox <email>adrian@humboldt.co.uk</email>, for bugfixing
-        MMAP support, and several other notable fixes that resulted from
-        his hard work and testing.
-  </para>
-  <para>
-        Thomas Sailer for further bugfixes.
-  </para>
-  </chapter>
-  
-  <chapter id="notes">
-     <title>Random Notes</title>
-  <para>
-        Two /proc pseudo-files provide diagnostic information.  This is generally
-        not useful to most users.  Power users can disable CONFIG_SOUND_VIA82CXXX_PROCFS,
-        and remove the /proc support code.  Once
-        version 2.0.0 is released, the /proc support code will be disabled by
-        default.  Available /proc pseudo-files:
-  </para>
-  <programlisting>
-        /proc/driver/via/0/info
-        /proc/driver/via/0/ac97
-  </programlisting>
-  <para>
-        This driver by default supports all PCI audio devices which report
-        a vendor id of 0x1106, and a device id of 0x3058.  Subsystem vendor
-        and device ids are not examined.
-  </para>
-  <para>
-        GNU indent formatting options:
-  <programlisting>
--kr -i8 -ts8 -br -ce -bap -sob -l80 -pcs -cs -ss -bs -di1 -nbc -lp -psl
-  </programlisting>
-  </para>
-  <para>
-        Via has graciously donated e-mail support and source code to help further
-        the development of this driver.  Their assistance has been invaluable
-        in the design and coding of the next major version of this driver.
-  </para>
-  <para>
-        The Via audio chip apparently provides a second PCM scatter-gather
-        DMA channel just for FM data, but does not have a full hardware MIDI
-        processor.  I haven't put much thought towards a solution here, but it
-        might involve using SoftOSS midi wave table, or simply disabling MIDI
-        support altogether and using the FM PCM channel as a second (input? output?)
-  </para>
-  </chapter>
-
-  <chapter id="changelog">
-      <title>Driver ChangeLog</title>
-
-<sect1 id="version191"><title>
-Version 1.9.1
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    DSP read/write bugfixes from Thomas Sailer.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Add new PCI id for single-channel use of Via 8233.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Other bug fixes, tweaks, new ioctls.
-    </para>
-   </listitem>
-
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version1115"><title>
-Version 1.1.15
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    Support for variable fragment size and variable fragment number (Rui
-    Sousa)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Fixes for the SPEED, STEREO, CHANNELS, FMT ioctls when in read &amp;
-    write mode (Rui Sousa)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Mmaped sound is now fully functional. (Rui Sousa)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Make sure to enable PCI device before reading any of its PCI
-    config information. (fixes potential hotplug problems)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Clean up code a bit and add more internal function documentation.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    AC97 codec access fixes (Adrian Cox)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Big endian fixes (Adrian Cox)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    MIDI support (Adrian Cox)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Detect and report locked-rate AC97 codecs.  If your hardware only
-    supports 48Khz (locked rate), then your recording/playback software
-    must upsample or downsample accordingly.  The hardware cannot do it.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Use new pci_request_regions and pci_disable_device functions in
-    kernel 2.4.6.
-    </para>
-   </listitem>
-
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version1114"><title>
-Version 1.1.14
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    Use VM_RESERVE when available, to eliminate unnecessary page faults.
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version1112"><title>
-Version 1.1.12
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    mmap bug fixes from Linus.
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version1111"><title>
-Version 1.1.11
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    Many more bug fixes.  mmap enabled by default, but may still be buggy.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Uses new and spiffy method of mmap'ing the DMA buffer, based
-    on a suggestion from Linus.
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version1110"><title>
-Version 1.1.10
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    Many bug fixes.  mmap enabled by default, but may still be buggy.
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version119"><title>
-Version 1.1.9
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-    Redesign and rewrite audio playback implementation.  (faster and smaller, hopefully)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Implement recording and full duplex (DSP_CAP_DUPLEX) support.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Make procfs support optional.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Quick interrupt status check, to lessen overhead in interrupt
-    sharing situations.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Add mmap(2) support.  Disabled for now, it is still buggy and experimental.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Surround all syscalls with a semaphore for cheap and easy SMP protection.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Fix bug in channel shutdown (hardware channel reset) code.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Remove unnecessary spinlocks (better performance).
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Eliminate "unknown AFMT" message by using a different method
-    of selecting the best AFMT_xxx sound sample format for use.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Support for realtime hardware pointer position reporting
-    (DSP_CAP_REALTIME, SNDCTL_DSP_GETxPTR ioctls)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Support for capture/playback triggering
-    (DSP_CAP_TRIGGER, SNDCTL_DSP_SETTRIGGER ioctls)
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    SNDCTL_DSP_SETDUPLEX and SNDCTL_DSP_POST ioctls now handled.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Rewrite open(2) and close(2) logic to allow only one user at
-    a time.  All other open(2) attempts will sleep until they succeed.
-    FIXME: open(O_RDONLY) and open(O_WRONLY) should be allowed to succeed.
-    </para>
-   </listitem>
-
-   <listitem>
-    <para>
-    Reviewed code to ensure that SMP and multiple audio devices
-    are fully supported.
-    </para>
-   </listitem>
-
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version118"><title>
-Version 1.1.8
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
-        Clean up interrupt handler output.  Fixes the following kernel error message:
-    </para>
-        <programlisting>
-        unhandled interrupt ...
-        </programlisting>
-   </listitem>
-
-   <listitem>
-    <para>
-        Convert documentation to DocBook, so that PDF, HTML and PostScript (.ps) output is readily
-        available.
-    </para>
-   </listitem>
-
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version117"><title>
-Version 1.1.7
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
- Fix module unload bug where mixer device left registered
-  after driver exit
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version116"><title>
-Version 1.1.6
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
- Rewrite via_set_rate to mimic ALSA basic AC97 rate setting
-    </para>
-   </listitem>
-   <listitem>
-    <para>
- Remove much dead code
-    </para>
-   </listitem>
-   <listitem>
-    <para>
- Complete spin_lock_irqsave -> spin_lock_irq conversion in via_dsp_ioctl
-    </para>
-   </listitem>
-   <listitem>
-    <para>
- Fix build problem in via_dsp_ioctl
-    </para>
-   </listitem>
-   <listitem>
-    <para>
- Optimize included headers to eliminate headers found in linux/sound
-        </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version115"><title>
-Version 1.1.5
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
- Disable some overly-verbose debugging code
-    </para>
-   </listitem>
-   <listitem>
-    <para>
- Remove unnecessary sound locks
-   </para>
-   </listitem>
-   <listitem>
-    <para>
- Fix some ioctls for better time resolution
-    </para>
-   </listitem>
-   <listitem>
-    <para>
- Begin spin_lock_irqsave -> spin_lock_irq conversion in via_dsp_ioctl
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-<sect1 id="version114"><title>
-Version 1.1.4
-</title>
-  <itemizedlist spacing="compact">
-   <listitem>
-    <para>
- Completed rewrite of driver.  Eliminated SoundBlaster compatibility
-  completely, and now uses the much-faster scatter-gather DMA engine.
-    </para>
-   </listitem>
-  </itemizedlist>
-</sect1>
-
-  </chapter>
-  
-  <chapter id="intfunctions">
-     <title>Internal Functions</title>
-!Isound/oss/via82cxxx_audio.c
-  </chapter>
-
-</book>
-
-
diff --git a/Documentation/RCU/RTFP.txt b/Documentation/RCU/RTFP.txt
index 12250b342e1f..9c6d450138ea 100644
--- a/Documentation/RCU/RTFP.txt
+++ b/Documentation/RCU/RTFP.txt
@@ -108,8 +108,9 @@ year saw a paper describing an RCU implementation of System V IPC
 2004 has seen a Linux-Journal article on use of RCU in dcache
 [McKenney04a], a performance comparison of locking to RCU on several
 different CPUs [McKenney04b], a dissertation describing use of RCU in a
-number of operating-system kernels [PaulEdwardMcKenneyPhD], and a paper
-describing how to make RCU safe for soft-realtime applications [Sarma04c].
+number of operating-system kernels [PaulEdwardMcKenneyPhD], a paper
+describing how to make RCU safe for soft-realtime applications [Sarma04c],
+and a paper describing SELinux performance with RCU [JamesMorris04b].
 
 
 Bibtex Entries
@@ -341,6 +342,17 @@ Dipankar Sarma"
 ,pages="18-26"
 }
 
+@techreport{Friedberg03a
+,author="Stuart A. Friedberg"
+,title="Lock-Free Wild Card Search Data Structure and Method"
+,institution="US Patent and Trademark Office"
+,address="Washington, DC"
+,year="2003"
+,number="US Patent 6,662,184 (contributed under GPL)"
+,month="December"
+,pages="112"
+}
+
 @article{McKenney04a
 ,author="Paul E. McKenney and Dipankar Sarma and Maneesh Soni"
 ,title="Scaling dcache with {RCU}"
@@ -373,6 +385,9 @@ in Operating System Kernels"
 ,school="OGI School of Science and Engineering at
 Oregon Health and Sciences University"
 ,year="2004"
+,note="Available:
+\url{http://www.rdrop.com/users/paulmck/RCU/RCUdissertation.2004.07.14e1.pdf}
+[Viewed October 15, 2004]"
 }
 
 @Conference{Sarma04c
@@ -385,3 +400,13 @@ Oregon Health and Sciences University"
 ,month="June"
 ,pages="182-191"
 }
+
+@unpublished{JamesMorris04b
+,Author="James Morris"
+,Title="Recent Developments in {SELinux} Kernel Performance"
+,month="December"
+,year="2004"
+,note="Available:
+\url{http://www.livejournal.com/users/james_morris/2153.html}
+[Viewed December 10, 2004]"
+}
diff --git a/Documentation/RCU/UP.txt b/Documentation/RCU/UP.txt
index 551a803d82a8..3bfb84b3b7db 100644
--- a/Documentation/RCU/UP.txt
+++ b/Documentation/RCU/UP.txt
@@ -2,11 +2,11 @@ RCU on Uniprocessor Systems
 
 
 A common misconception is that, on UP systems, the call_rcu() primitive
-may immediately invoke its function, and that the synchronize_kernel
+may immediately invoke its function, and that the synchronize_rcu()
 primitive may return immediately.  The basis of this misconception
 is that since there is only one CPU, it should not be necessary to
 wait for anything else to get done, since there are no other CPUs for
-anything else to be happening on.  Although this approach will sort of
+anything else to be happening on.  Although this approach will -sort- -of-
 work a surprising amount of the time, it is a very bad idea in general.
 This document presents two examples that demonstrate exactly how bad an
 idea this is.
@@ -44,14 +44,14 @@ its arguments would cause it to fail to make the fundamental guarantee
 underlying RCU, namely that call_rcu() defers invoking its arguments until
 all RCU read-side critical sections currently executing have completed.
 
-Quick Quiz: why is it -not- legal to invoke synchronize_kernel() in
+Quick Quiz: why is it -not- legal to invoke synchronize_rcu() in
 this case?
 
 
 Summary
 
 Permitting call_rcu() to immediately invoke its arguments or permitting
-synchronize_kernel() to immediately return breaks RCU, even on a UP system.
+synchronize_rcu() to immediately return breaks RCU, even on a UP system.
 So do not do it!  Even on a UP system, the RCU infrastructure -must-
 respect grace periods.
 
diff --git a/Documentation/RCU/checklist.txt b/Documentation/RCU/checklist.txt
index b3a568abe6b1..8f3fb77c9cd3 100644
--- a/Documentation/RCU/checklist.txt
+++ b/Documentation/RCU/checklist.txt
@@ -32,7 +32,10 @@ over a rather long period of time, but improvements are always welcome!
         them -- even x86 allows reads to be reordered), and be prepared
         to explain why this added complexity is worthwhile.  If you
         choose #c, be prepared to explain how this single task does not
-        become a major bottleneck on big multiprocessor machines.
+        become a major bottleneck on big multiprocessor machines (for
+        example, if the task is updating information relating to itself
+        that other tasks can read, there by definition can be no
+        bottleneck).
 
 2.      Do the RCU read-side critical sections make proper use of
         rcu_read_lock() and friends?  These primitives are needed
@@ -89,27 +92,34 @@ over a rather long period of time, but improvements are always welcome!
                 "_rcu()" list-traversal primitives, such as the
                 list_for_each_entry_rcu().
 
-        b.      If the list macros are being used, the list_del_rcu(),
-                list_add_tail_rcu(), and list_del_rcu() primitives must
-                be used in order to prevent weakly ordered machines from
-                misordering structure initialization and pointer planting.
+        b.      If the list macros are being used, the list_add_tail_rcu()
+                and list_add_rcu() primitives must be used in order
+                to prevent weakly ordered machines from misordering
+                structure initialization and pointer planting.
                 Similarly, if the hlist macros are being used, the
-                hlist_del_rcu() and hlist_add_head_rcu() primitives
-                are required.
+                hlist_add_head_rcu() primitive is required.
 
-        c.      Updates must ensure that initialization of a given
+        c.      If the list macros are being used, the list_del_rcu()
+                primitive must be used to keep list_del()'s pointer
+                poisoning from inflicting toxic effects on concurrent
+                readers.  Similarly, if the hlist macros are being used,
+                the hlist_del_rcu() primitive is required.
+
+                The list_replace_rcu() primitive may be used to
+                replace an old structure with a new one in an
+                RCU-protected list.
+
+        d.      Updates must ensure that initialization of a given
                 structure happens before pointers to that structure are
                 publicized.  Use the rcu_assign_pointer() primitive
                 when publicizing a pointer to a structure that can
                 be traversed by an RCU read-side critical section.
 
-                [The rcu_assign_pointer() primitive is in process.]
-
 5.      If call_rcu(), or a related primitive such as call_rcu_bh(),
         is used, the callback function must be written to be called
         from softirq context.  In particular, it cannot block.
 
-6.      Since synchronize_kernel() blocks, it cannot be called from
+6.      Since synchronize_rcu() can block, it cannot be called from
         any sort of irq context.
 
 7.      If the updater uses call_rcu(), then the corresponding readers
@@ -125,9 +135,9 @@ over a rather long period of time, but improvements are always welcome!
         such cases is a must, of course!  And the jury is still out on
         whether the increased speed is worth it.
 
-8.      Although synchronize_kernel() is a bit slower than is call_rcu(),
+8.      Although synchronize_rcu() is a bit slower than is call_rcu(),
         it usually results in simpler code.  So, unless update performance
-        is important or the updaters cannot block, synchronize_kernel()
+        is important or the updaters cannot block, synchronize_rcu()
         should be used in preference to call_rcu().
 
 9.      All RCU list-traversal primitives, which include
@@ -155,3 +165,14 @@ over a rather long period of time, but improvements are always welcome!
         you -must- use the "_rcu()" variants of the list macros.
         Failing to do so will break Alpha and confuse people reading
         your code.
+
+11.     Note that synchronize_rcu() -only- guarantees to wait until
+        all currently executing rcu_read_lock()-protected RCU read-side
+        critical sections complete.  It does -not- necessarily guarantee
+        that all currently running interrupts, NMIs, preempt_disable()
+        code, or idle loops will complete.  Therefore, if you do not have
+        rcu_read_lock()-protected read-side critical sections, do -not-
+        use synchronize_rcu().
+
+        If you want to wait for some of these other things, you might
+        instead need to use synchronize_irq() or synchronize_sched().
diff --git a/Documentation/RCU/listRCU.txt b/Documentation/RCU/listRCU.txt
index bda6ead69bd0..f8a54fa0d8ab 100644
--- a/Documentation/RCU/listRCU.txt
+++ b/Documentation/RCU/listRCU.txt
@@ -32,6 +32,7 @@ implementation of audit_filter_task() might be as follows:
                 enum audit_state   state;
 
                 read_lock(&auditsc_lock);
+                /* Note: audit_netlink_sem held by caller. */
                 list_for_each_entry(e, &audit_tsklist, list) {
                         if (audit_filter_rules(tsk, &e->rule, NULL, &state)) {
                                 read_unlock(&auditsc_lock);
@@ -55,6 +56,7 @@ This means that RCU can be easily applied to the read side, as follows:
                 enum audit_state   state;
 
                 rcu_read_lock();
+                /* Note: audit_netlink_sem held by caller. */
                 list_for_each_entry_rcu(e, &audit_tsklist, list) {
                         if (audit_filter_rules(tsk, &e->rule, NULL, &state)) {
                                 rcu_read_unlock();
@@ -139,12 +141,15 @@ Normally, the write_lock() and write_unlock() would be replaced by
 a spin_lock() and a spin_unlock(), but in this case, all callers hold
 audit_netlink_sem, so no additional locking is required.  The auditsc_lock
 can therefore be eliminated, since use of RCU eliminates the need for
-writers to exclude readers.
+writers to exclude readers.  Normally, the write_lock() calls would
+be converted into spin_lock() calls.
 
 The list_del(), list_add(), and list_add_tail() primitives have been
 replaced by list_del_rcu(), list_add_rcu(), and list_add_tail_rcu().
 The _rcu() list-manipulation primitives add memory barriers that are
-needed on weakly ordered CPUs (most of them!).
+needed on weakly ordered CPUs (most of them!).  The list_del_rcu()
+primitive omits the pointer poisoning debug-assist code that would
+otherwise cause concurrent readers to fail spectacularly.
 
 So, when readers can tolerate stale data and when entries are either added
 or deleted, without in-place modification, it is very easy to use RCU!
@@ -166,6 +171,7 @@ otherwise, the added fields would need to be filled in):
                 struct audit_newentry *ne;
 
                 write_lock(&auditsc_lock);
+                /* Note: audit_netlink_sem held by caller. */
                 list_for_each_entry(e, list, list) {
                         if (!audit_compare_rule(rule, &e->rule)) {
                                 e->rule.action = newaction;
@@ -199,8 +205,7 @@ RCU ("read-copy update") its name.  The RCU code is as follows:
                                 audit_copy_rule(&ne->rule, &e->rule);
                                 ne->rule.action = newaction;
                                 ne->rule.file_count = newfield_count;
-                                list_add_rcu(ne, e);
-                                list_del(e);
+                                list_replace_rcu(e, ne);
                                 call_rcu(&e->rcu, audit_free_rule, e);
                                 return 0;
                         }
diff --git a/Documentation/RCU/rcu.txt b/Documentation/RCU/rcu.txt
index 7e0c2ab6f2bd..eb444006683e 100644
--- a/Documentation/RCU/rcu.txt
+++ b/Documentation/RCU/rcu.txt
@@ -43,7 +43,9 @@ o	If I am running on a uniprocessor kernel, which can only do one
 
 o       How can I see where RCU is currently used in the Linux kernel?
 
-        Search for "rcu_read_lock", "call_rcu", and "synchronize_kernel".
+        Search for "rcu_read_lock", "rcu_read_unlock", "call_rcu",
+        "rcu_read_lock_bh", "rcu_read_unlock_bh", "call_rcu_bh",
+        "synchronize_rcu", and "synchronize_net".
 
 o       What guidelines should I follow when writing code that uses RCU?
 
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
index 734fcc87db25..7c2496426ab9 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -1,137 +1,137 @@
-.*
+*.a
+*.aux
+*.bin
+*.cpio
+*.css
+*.dvi
+*.eps
+*.gif
+*.grep
+*.grp
+*.gz
+*.html
+*.jpeg
+*.ko
+*.log
+*.lst
+*.mod.c
+*.o
+*.orig
+*.out
+*.pdf
+*.png
+*.ps
+*.rej
+*.s
+*.sgml
+*.so
+*.tex
+*.ver
+*_MODULES
+*_vga16.c
+*cscope*
 *~
+.*
+.cscope
+53c700_d.h
 53c8xx_d.h*
-*.a
+BitKeeper
+COPYING
+CREDITS
+CVS
+ChangeSet
+Kerntypes
+MODS.txt
+Module.symvers
+PENDING
+SCCS
+System.map*
+TAGS
 aic7*reg.h*
-aic7*seq.h*
 aic7*reg_print.c*
-53c700_d.h
+aic7*seq.h*
 aicasm
 aicdb.h*
 asm
 asm_offsets.*
 autoconf.h*
-*.aux
 bbootsect
-*.bin
 bin2c
 binkernel.spec
-BitKeeper
 bootsect
 bsetup
 btfixupprep
 build
 bvmlinux
 bzImage*
-ChangeSet
 classlist.h*
-compile.h*
 comp*.log
+compile.h*
 config
 config-*
 config_data.h*
 conmakehash
 consolemap_deftbl.c*
-COPYING
-CREDITS
-.cscope
-*cscope*
+crc32table.h*
 cscope.*
-*.out
-*.css
-CVS
 defkeymap.c*
 devlist.h*
 docproc
 dummy_sym.c*
-*.dvi
-*.eps
+elfconfig.h*
 filelist
 fixdep
 fore200e_mkfirm
 fore200e_pca_fw.c*
 gen-devlist
-gen_init_cpio
-gen_crc32table
-crc32table.h*
-*.cpio
 gen-kdb_cmds.c*
-gentbl
+gen_crc32table
+gen_init_cpio
 genksyms
-*.gif
-*.gz
-*.html
+gentbl
 ikconfig.h*
 initramfs_list
-*.jpeg
+kallsyms
 kconfig
 kconfig.tk
-Kerntypes
 keywords.c*
 ksym.c*
 ksym.h*
-kallsyms
-mk_elfconfig
-elfconfig.h*
-modpost
-pnmtologo
-logo_*.c
-*.log
 lex.c*
+logo_*.c
 logo_*_clut224.c
 logo_*_mono.c
 lxdialog
 make_times_h
 map
+maui_boot.h
+mk_elfconfig
 mkdep
-*_MODULES
-MODS.txt
+mktables
+modpost
 modversions.h*
-Module.symvers
-*.mod.c
-*.o
-*.ko
-*.orig
-*.lst
-*.grp
-*.grep
 oui.c*
-mktables
-raid6tables.c
-raid6int*.c
-raid6altivec*.c
-wanxlfw.inc
-maui_boot.h
-pss_boot.h
-trix_boot.h
-*.pdf
 parse.c*
 parse.h*
-PENDING
+pnmtologo
 ppc_defs.h*
 promcon_tbl.c*
-*.png
-*.ps
-*.rej
-SCCS
+pss_boot.h
+raid6altivec*.c
+raid6int*.c
+raid6tables.c
 setup
-*.s
-*.so
-*.sgml
 sim710_d.h*
 sm_tbl*
 split-include
-System.map*
 tags
-TAGS
-*.tex
 times.h*
 tkparse
-*.ver
+trix_boot.h
 version.h*
-*_vga16.c
 vmlinux
-vmlinux.lds
 vmlinux-*
+vmlinux.lds
 vsyscall.lds
+wanxlfw.inc
 zImage
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 56627c1546de..d3c52dd24a2a 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -48,3 +48,18 @@ When:	April 2005
 Why:    Replaced by ->compat_ioctl in file_operations and other method
         vecors.
 Who:    Andi Kleen <ak@muc.de>, Christoph Hellwig <hch@lst.de>
+
+---------------------------
+
+What:   RCU API moves to EXPORT_SYMBOL_GPL
+When:   April 2006
+Files:  include/linux/rcupdate.h, kernel/rcupdate.c
+Why:    Outside of Linux, the only implementations of anything even
+        vaguely resembling RCU that I am aware of are in DYNIX/ptx,
+        VM/XA, Tornado, and K42.  I do not expect anyone to port binary
+        drivers or kernel modules from any of these, since the first two
+        are owned by IBM and the last two are open-source research OSes.
+        So these will move to GPL after a grace period to allow
+        people, who might be using implementations that I am not aware
+        of, to adjust to this upcoming change.
+Who:    Paul E. McKenney <paulmck@us.ibm.com>
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index a934baeeb33a..1045da582b9b 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -219,8 +219,12 @@ This may also be done to avoid internal deadlocks, but rarely.
 If the filesytem is called for sync then it must wait on any
 in-progress I/O and then start new I/O.
 
-The filesystem should unlock the page synchronously, before returning
-to the caller.
+The filesystem should unlock the page synchronously, before returning to the
+caller, unless ->writepage() returns special WRITEPAGE_ACTIVATE
+value. WRITEPAGE_ACTIVATE means that page cannot really be written out
+currently, and VM should stop calling ->writepage() on this page for some
+time. VM does this by moving page to the head of the active list, hence the
+name.
 
 Unless the filesystem is going to redirty_page_for_writepage(), unlock the page
 and return zero, writepage *must* run set_page_writeback() against the page,
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index cbe85c17176b..6c98f2bd421e 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -909,16 +909,6 @@ nr_free_inodes
 Represents the  number of free inodes. Ie. The number of inuse inodes is
 (nr_inodes - nr_free_inodes).
 
-super-nr and super-max
-----------------------
-
-Again, super  block structures are allocated by the kernel, but not freed. The
-file super-max  contains  the  maximum  number  of super block handlers, where
-super-nr shows the number of currently allocated ones.
-
-Every mounted file system needs a super block, so if you plan to mount lots of
-file systems, you may want to increase these numbers.
-
 aio-nr and aio-max-nr
 ---------------------
 
diff --git a/Documentation/i386/zero-page.txt b/Documentation/i386/zero-page.txt
index 67c053a099ed..df28c7416781 100644
--- a/Documentation/i386/zero-page.txt
+++ b/Documentation/i386/zero-page.txt
@@ -79,6 +79,6 @@ Offset	Type		Description
 0x22c   unsigned long   ramdisk_max
 0x230   16 bytes        trampoline
 0x290 - 0x2cf           EDD_MBR_SIG_BUFFER (edd.S)
-0x2d0 - 0x600           E820MAP
-0x600 - 0x7ff           EDDBUF (edd.S) for disk signature read sector
-0x600 - 0x7eb           EDDBUF (edd.S) for edd data
+0x2d0 - 0xd00           E820MAP
+0xd00 - 0xeff           EDDBUF (edd.S) for disk signature read sector
+0xd00 - 0xeeb           EDDBUF (edd.S) for edd data
diff --git a/Documentation/s390/cds.txt b/Documentation/s390/cds.txt
index d9397170fb36..f0be389c7116 100644
--- a/Documentation/s390/cds.txt
+++ b/Documentation/s390/cds.txt
@@ -56,12 +56,16 @@ read_dev_chars()
    read device characteristics
    
 read_conf_data()
+read_conf_data_lpm()
    read configuration data.
 
 ccw_device_get_ciw()
    get commands from extended sense data.
 
 ccw_device_start()      
+ccw_device_start_timeout()
+ccw_device_start_key()
+ccw_device_start_key_timeout()
    initiate an I/O request.
 
 ccw_device_resume()
@@ -197,19 +201,21 @@ The read_dev_chars() function returns :
           operational.
 
 
-read_conf_data() - Read Configuration Data
+read_conf_data(), read_conf_data_lpm() - Read Configuration Data
 
 Retrieve the device dependent configuration data. Please have a look at your 
 device dependent I/O commands for the device specific layout of the node 
-descriptor elements. 
+descriptor elements. read_conf_data_lpm() will retrieve the configuration data
+for a specific path.
 
-The function is meant to be called with an irq handler in place; that is,
+The function is meant to be called with the device already enabled; that is,
 at earliest during set_online() processing.
 
 The function may be called enabled or disabled, but the device must not be
 locked
 
-int read_conf_data(struct ccw_device, void **buffer, int *length, __u8 lpm);
+int read_conf_data(struct ccw_device, void **buffer, int *length);
+int read_conf_data_lpm(struct ccw_device, void **buffer, int *length, __u8 lpm);
 
 cdev   - the ccw_device the data is requested for.
 buffer - Pointer to a buffer pointer. The read_conf_data() routine
@@ -263,6 +269,25 @@ int ccw_device_start(struct ccw_device *cdev,
                      unsigned long intparm,
                      __u8 lpm,
                      unsigned long flags);
+int ccw_device_start_timeout(struct ccw_device *cdev,
+                             struct ccw1 *cpa,
+                             unsigned long intparm,
+                             __u8 lpm,
+                             unsigned long flags,
+                             int expires);
+int ccw_device_start_key(struct ccw_device *cdev,
+                         struct ccw1 *cpa,
+                         unsigned long intparm,
+                         __u8 lpm,
+                         __u8 key,
+                         unsigned long flags);
+int ccw_device_start_key_timeout(struct ccw_device *cdev,
+                                 struct ccw1 *cpa,
+                                 unsigned long intparm,
+                                 __u8 lpm,
+                                 __u8 key,
+                                 unsigned long flags,
+                                 int expires);
 
 cdev         : ccw_device the I/O is destined for
 cpa          : logical start address of channel program
@@ -272,7 +297,12 @@ user_intparm : user specific interrupt information; will be presented
                particular I/O request.
 lpm          : defines the channel path to be used for a specific I/O
                request. A value of 0 will make cio use the opm.
+key          : the storage key to use for the I/O (useful for operating on a
+               storage with a storage key != default key)
 flag         : defines the action to be performed for I/O processing
+expires      : timeout value in jiffies. The common I/O layer will terminate
+               the running program after this and call the interrupt handler
+               with ERR_PTR(-ETIMEDOUT) as irb.
 
 Possible flag values are :
 
@@ -327,6 +357,13 @@ current (last) I/O request. In case of a delayed status notification no special
 interrupt will be presented to indicate I/O completion as the I/O request was
 never started, even though ccw_device_start() returned with successful completion.
 
+The irb may contain an error value, and the device driver should check for this
+first:
+
+-ETIMEDOUT: the common I/O layer terminated the request after the specified
+            timeout value
+-EIO:       the common I/O layer terminated the request due to an error state
+
 If the concurrent sense flag in the extended status word in the irb is set, the
 field irb->scsw.count describes the numer of device specific sense bytes
 available in the extended control word irb->scsw.ecw[0]. No device sensing by
diff --git a/MAINTAINERS b/MAINTAINERS
index 4333b69e56bd..f384a9758fc0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2113,6 +2113,13 @@ M:	perex@suse.cz
 L:      alsa-devel@alsa-project.org
 S:      Maintained
 
+TPM DEVICE DRIVER
+P:      Kylene Hall
+M:      kjhall@us.ibm.com
+W:      http://tpmdd.sourceforge.net
+L:      tpmdd-devel@lists.sourceforge.net
+S:      Maintained
+
 UltraSPARC (sparc64):
 P:      David S. Miller
 M:      davem@davemloft.net
diff --git a/Makefile b/Makefile
index 8da3a306d0c0..f7eb55878f11 100644
--- a/Makefile
+++ b/Makefile
@@ -332,9 +332,7 @@ KALLSYMS	= scripts/kallsyms
 PERL            = perl
 CHECK           = sparse
 
-NOSTDINC_FLAGS  = -nostdinc -isystem $(shell $(CC) -print-file-name=include)
 CHECKFLAGS     := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__
-CHECKFLAGS     += $(NOSTDINC_FLAGS)
 MODFLAGS        = -DMODULE
 CFLAGS_MODULE   = $(MODFLAGS)
 AFLAGS_MODULE   = $(MODFLAGS)
@@ -531,6 +529,10 @@ endif
 
 include $(srctree)/arch/$(ARCH)/Makefile
 
+# arch Makefile may override CC so keep this after arch Makefile is included
+NOSTDINC_FLAGS := -nostdinc -isystem $(shell $(CC) -print-file-name=include)
+CHECKFLAGS     += $(NOSTDINC_FLAGS)
+
 # warn about C99 declaration after statement
 CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
 
@@ -1188,8 +1190,8 @@ cmd_TAGS = $(all-sources) | etags -
 quiet_cmd_tags = MAKE   $@
 define cmd_tags
         rm -f $@; \
-        CTAGSF=`ctags --version | grep -i exuberant >/dev/null && echo "-I __initdata,__exitdata,EXPORT_SYMBOL,EXPORT_SYMBOL_GPL"`; \
-        $(all-sources) | xargs ctags $$CTAGSF -a --extra=+f
+        CTAGSF=`ctags --version | grep -i exuberant >/dev/null && echo "-I __initdata,__exitdata,EXPORT_SYMBOL,EXPORT_SYMBOL_GPL --extra=+f"`; \
+        $(all-sources) | xargs ctags $$CTAGSF -a
 endef
 
 TAGS: FORCE
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index b5d0fd2bb10a..64e450dddb49 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -457,22 +457,6 @@ osf_getdomainname(char __user *name, int namelen)
         return 0;
 }
 
-asmlinkage long
-osf_shmat(int shmid, void __user *shmaddr, int shmflg)
-{
-        unsigned long raddr;
-        long err;
-
-        err = do_shmat(shmid, shmaddr, shmflg, &raddr);
-
-        /*
-         * This works because all user-level addresses are
-         * non-negative longs!
-         */
-        return err ? err : (long)raddr;
-}
-
-
 /*
  * The following stuff should move into a header file should it ever
  * be labeled "officially supported."  Right now, there is just enough
diff --git a/arch/alpha/kernel/ptrace.c b/arch/alpha/kernel/ptrace.c
index d00583161574..bbd37536d14e 100644
--- a/arch/alpha/kernel/ptrace.c
+++ b/arch/alpha/kernel/ptrace.c
@@ -14,6 +14,7 @@
 #include <linux/user.h>
 #include <linux/slab.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -335,7 +336,7 @@ do_sys_ptrace(long request, long pid, long addr, long data,
                 /* continue and stop at next (return from) syscall */
         case PTRACE_CONT:    /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -365,7 +366,7 @@ do_sys_ptrace(long request, long pid, long addr, long data,
 
         case PTRACE_SINGLESTEP:  /* execute single instruction. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 /* Mark single stepping.  */
                 child->thread_info->bpt_nsaved = -1;
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index 3864b33562ee..052120882876 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -227,7 +227,7 @@ sys_call_table:
         .quad sys_semop
         .quad osf_utsname
         .quad sys_lchown
-        .quad osf_shmat
+        .quad sys_shmat
         .quad sys_shmctl                        /* 210 */
         .quad sys_shmdt
         .quad sys_shmget
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index c0e7aff3dec2..7c7f475e213e 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -18,48 +18,30 @@
  * Please select one of the following when turning on debugging.
  */
 #ifdef DEBUG
-#if defined(CONFIG_DEBUG_DC21285_PORT)
-                .macro  loadsp, rb
-                mov     \rb, #0x42000000
-                .endm
-                .macro  writeb, rb
-                str     \rb, [r3, #0x160]
-                .endm
-#elif defined(CONFIG_DEBUG_ICEDCC)
+
+#include <asm/arch/debug-macro.S>
+
+#if defined(CONFIG_DEBUG_ICEDCC)
                 .macro  loadsp, rb
                 .endm
-                .macro writeb, rb
-                mcr     p14, 0, \rb, c0, c1, 0
-                .endm
-#elif defined(CONFIG_FOOTBRIDGE)
-                .macro  loadsp, rb
-                mov     \rb, #0x7c000000
+                .macro writeb, ch, rb
+                mcr     p14, 0, \ch, c0, c1, 0
                 .endm
-                .macro  writeb, rb
-                strb    \rb, [r3, #0x3f8]
+#else
+                .macro  writeb, ch, rb
+                senduart \ch, \rb
                 .endm
-#elif defined(CONFIG_ARCH_RPC)
+
+#if defined(CONFIG_FOOTBRIDGE) || \
+    defined(CONFIG_ARCH_RPC) || \
+    defined(CONFIG_ARCH_INTEGRATOR) || \
+    defined(CONFIG_ARCH_PXA) || \
+    defined(CONFIG_ARCH_IXP4XX) || \
+    defined(CONFIG_ARCH_IXP2000) || \
+    defined(CONFIG_ARCH_LH7A40X) || \
+    defined(CONFIG_ARCH_OMAP)
                 .macro  loadsp, rb
-                mov     \rb, #0x03000000
-                orr     \rb, \rb, #0x00010000
-                .endm
-                .macro  writeb, rb
-                strb    \rb, [r3, #0x3f8 << 2]
-                .endm
-#elif defined(CONFIG_ARCH_INTEGRATOR)
-                .macro  loadsp, rb
-                mov     \rb, #0x16000000
-                .endm
-                .macro  writeb, rb
-                strb    \rb, [r3, #0]
-                .endm
-#elif defined(CONFIG_ARCH_PXA) /* Xscale-type */
-                .macro  loadsp, rb
-                mov     \rb, #0x40000000
-                orr     \rb, \rb, #0x00100000
-                .endm
-                .macro  writeb, rb
-                strb    \rb, [r3, #0]
+                addruart \rb
                 .endm
 #elif defined(CONFIG_ARCH_SA1100)
                 .macro  loadsp, rb
@@ -70,65 +52,22 @@
                 add     \rb, \rb, #0x00010000   @ Ser1
 #  endif
                 .endm
-                .macro  writeb, rb
-                str     \rb, [r3, #0x14]        @ UTDR
-                .endm
-#elif defined(CONFIG_ARCH_IXP4XX)
-                .macro  loadsp, rb
-                mov     \rb, #0xc8000000
-                .endm
-                .macro  writeb, rb
-                str     \rb, [r3, #0]
-#elif defined(CONFIG_ARCH_IXP2000)
-                .macro  loadsp, rb
-                mov     \rb, #0xc0000000
-                orr     \rb, \rb, #0x00030000
-                .endm
-                .macro  writeb, rb
-                str     \rb, [r3, #0]
-                .endm
-#elif defined(CONFIG_ARCH_LH7A40X)
-                .macro  loadsp, rb
-                ldr     \rb, =0x80000700        @ UART2 UARTBASE
-                .endm
-                .macro  writeb, rb
-                strb    \rb, [r3, #0]
-                .endm
-#elif defined(CONFIG_ARCH_OMAP)
-                .macro  loadsp, rb
-                mov     \rb, #0xff000000        @ physical base address
-                add     \rb, \rb, #0x00fb0000
-#if defined(CONFIG_OMAP_LL_DEBUG_UART2) || defined(CONFIG_OMAP_LL_DEBUG_UART3)
-                add     \rb, \rb, #0x00000800
-#endif
-#ifdef CONFIG_OMAP_LL_DEBUG_UART3
-                add     \rb, \rb, #0x00009000
-#endif
-                .endm
-                .macro  writeb, rb
-                strb    \rb, [r3]
-                .endm
 #elif defined(CONFIG_ARCH_IOP331)
                 .macro loadsp, rb
                 mov     \rb, #0xff000000
                 orr     \rb, \rb, #0x00ff0000
                 orr     \rb, \rb, #0x0000f700   @ location of the UART
                 .endm
-                .macro  writeb, rb
-                str     \rb, [r3, #0]
-                .endm
 #elif defined(CONFIG_ARCH_S3C2410)
-                        .macro loadsp, rb
+                .macro loadsp, rb
                 mov     \rb, #0x50000000
                 add     \rb, \rb, #0x4000 * CONFIG_S3C2410_LOWLEVEL_UART_PORT
                 .endm
-                .macro  writeb, rb
-                strb    \rb, [r3, #0x20]
-                .endm
 #else
 #error no serial architecture defined
 #endif
 #endif
+#endif
 
                 .macro  kputc,val
                 mov     r0, \val
@@ -734,7 +673,7 @@ puts:		loadsp	r3
 1:              ldrb    r2, [r0], #1
                 teq     r2, #0
                 moveq   pc, lr
-2:              writeb  r2
+2:              writeb  r2, r3
                 mov     r1, #0x00020000
 3:              subs    r1, r1, #1
                 bne     3b
diff --git a/arch/arm/common/rtctime.c b/arch/arm/common/rtctime.c
index c397e71f938d..72b03f201eb9 100644
--- a/arch/arm/common/rtctime.c
+++ b/arch/arm/common/rtctime.c
@@ -141,10 +141,10 @@ void rtc_next_alarm_time(struct rtc_time *next, struct rtc_time *now, struct rtc
         next->tm_sec = alrm->tm_sec;
 }
 
-static inline void rtc_read_time(struct rtc_ops *ops, struct rtc_time *tm)
+static inline int rtc_read_time(struct rtc_ops *ops, struct rtc_time *tm)
 {
         memset(tm, 0, sizeof(struct rtc_time));
-        ops->read_time(tm);
+        return ops->read_time(tm);
 }
 
 static inline int rtc_set_time(struct rtc_ops *ops, struct rtc_time *tm)
@@ -163,8 +163,7 @@ static inline int rtc_read_alarm(struct rtc_ops *ops, struct rtc_wkalrm *alrm)
         int ret = -EINVAL;
         if (ops->read_alarm) {
                 memset(alrm, 0, sizeof(struct rtc_wkalrm));
-                ops->read_alarm(alrm);
-                ret = 0;
+                ret = ops->read_alarm(alrm);
         }
         return ret;
 }
@@ -283,7 +282,9 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                 break;
 
         case RTC_RD_TIME:
-                rtc_read_time(ops, &tm);
+                ret = rtc_read_time(ops, &tm);
+                if (ret)
+                        break;
                 ret = copy_to_user(uarg, &tm, sizeof(tm));
                 if (ret)
                         ret = -EFAULT;
@@ -424,15 +425,15 @@ static int rtc_read_proc(char *page, char **start, off_t off, int count, int *eo
         struct rtc_time tm;
         char *p = page;
 
-        rtc_read_time(ops, &tm);
-
-        p += sprintf(p,
-                "rtc_time\t: %02d:%02d:%02d\n"
-                "rtc_date\t: %04d-%02d-%02d\n"
-                "rtc_epoch\t: %04lu\n",
-                tm.tm_hour, tm.tm_min, tm.tm_sec,
-                tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
-                rtc_epoch);
+        if (rtc_read_time(ops, &tm) == 0) {
+                p += sprintf(p,
+                        "rtc_time\t: %02d:%02d:%02d\n"
+                        "rtc_date\t: %04d-%02d-%02d\n"
+                        "rtc_epoch\t: %04lu\n",
+                        tm.tm_hour, tm.tm_min, tm.tm_sec,
+                        tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,
+                        rtc_epoch);
+        }
 
         if (rtc_read_alarm(ops, &alrm) == 0) {
                 p += sprintf(p, "alrm_time\t: ");
diff --git a/arch/arm/configs/ixdp2800_defconfig b/arch/arm/configs/ixdp2800_defconfig
index d36f99192962..7be3521f91fc 100644
--- a/arch/arm/configs/ixdp2800_defconfig
+++ b/arch/arm/configs/ixdp2800_defconfig
@@ -133,7 +133,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="console=ttyS0,9600 root=/dev/nfs ip=bootp mem=64M@0x0 pci=firmware"
+CONFIG_CMDLINE="console=ttyS0,9600 root=/dev/nfs ip=bootp mem=64M@0x0"
 # CONFIG_XIP_KERNEL is not set
 
 #
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 2a5c3fe09a95..080df907f242 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -269,6 +269,12 @@ __pabt_svc:
         add     r5, sp, #S_PC
         ldmia   r7, {r2 - r4}                   @ Get USR pc, cpsr
 
+#if __LINUX_ARM_ARCH__ < 6
+        @ make sure our user space atomic helper is aborted
+        cmp     r2, #VIRT_OFFSET
+        bichs   r3, r3, #PSR_Z_BIT
+#endif
+
         @
         @ We are now ready to fill in the remaining blanks on the stack:
         @
@@ -499,8 +505,12 @@ ENTRY(__switch_to)
         mra     r4, r5, acc0
         stmia   ip, {r4, r5}
 #endif
+#ifdef CONFIG_HAS_TLS_REG
+        mcr     p15, 0, r3, c13, c0, 3          @ set TLS register
+#else
         mov     r4, #0xffff0fff
-        str     r3, [r4, #-3]                   @ Set TLS ptr
+        str     r3, [r4, #-15]                  @ TLS val at 0xffff0ff0
+#endif
         mcr     p15, 0, r6, c3, c0, 0           @ Set domain register
 #ifdef CONFIG_VFP
         @ Always disable VFP so we can lazily save/restore the old
@@ -519,6 +529,207 @@ ENTRY(__switch_to)
         ldmib   r2, {r4 - sl, fp, sp, pc}       @ Load all regs saved previously
 
         __INIT
+
+/*
+ * User helpers.
+ *
+ * These are segment of kernel provided user code reachable from user space
+ * at a fixed address in kernel memory.  This is used to provide user space
+ * with some operations which require kernel help because of unimplemented
+ * native feature and/or instructions in many ARM CPUs. The idea is for
+ * this code to be executed directly in user mode for best efficiency but
+ * which is too intimate with the kernel counter part to be left to user
+ * libraries.  In fact this code might even differ from one CPU to another
+ * depending on the available  instruction set and restrictions like on
+ * SMP systems.  In other words, the kernel reserves the right to change
+ * this code as needed without warning. Only the entry points and their
+ * results are guaranteed to be stable.
+ *
+ * Each segment is 32-byte aligned and will be moved to the top of the high
+ * vector page.  New segments (if ever needed) must be added in front of
+ * existing ones.  This mechanism should be used only for things that are
+ * really small and justified, and not be abused freely.
+ *
+ * User space is expected to implement those things inline when optimizing
+ * for a processor that has the necessary native support, but only if such
+ * resulting binaries are already to be incompatible with earlier ARM
+ * processors due to the use of unsupported instructions other than what
+ * is provided here.  In other words don't make binaries unable to run on
+ * earlier processors just for the sake of not using these kernel helpers
+ * if your compiled code is not going to use the new instructions for other
+ * purpose.
+ */
+
+        .align  5
+        .globl  __kuser_helper_start
+__kuser_helper_start:
+
+/*
+ * Reference prototype:
+ *
+ *      int __kernel_cmpxchg(int oldval, int newval, int *ptr)
+ *
+ * Input:
+ *
+ *      r0 = oldval
+ *      r1 = newval
+ *      r2 = ptr
+ *      lr = return address
+ *
+ * Output:
+ *
+ *      r0 = returned value (zero or non-zero)
+ *      C flag = set if r0 == 0, clear if r0 != 0
+ *
+ * Clobbered:
+ *
+ *      r3, ip, flags
+ *
+ * Definition and user space usage example:
+ *
+ *      typedef int (__kernel_cmpxchg_t)(int oldval, int newval, int *ptr);
+ *      #define __kernel_cmpxchg (*(__kernel_cmpxchg_t *)0xffff0fc0)
+ *
+ * Atomically store newval in *ptr if *ptr is equal to oldval for user space.
+ * Return zero if *ptr was changed or non-zero if no exchange happened.
+ * The C flag is also set if *ptr was changed to allow for assembly
+ * optimization in the calling code.
+ *
+ * For example, a user space atomic_add implementation could look like this:
+ *
+ * #define atomic_add(ptr, val) \
+ *      ({ register unsigned int *__ptr asm("r2") = (ptr); \
+ *         register unsigned int __result asm("r1"); \
+ *         asm volatile ( \
+ *             "1: @ atomic_add\n\t" \
+ *             "ldr     r0, [r2]\n\t" \
+ *             "mov     r3, #0xffff0fff\n\t" \
+ *             "add     lr, pc, #4\n\t" \
+ *             "add     r1, r0, %2\n\t" \
+ *             "add     pc, r3, #(0xffff0fc0 - 0xffff0fff)\n\t" \
+ *             "bcc     1b" \
+ *             : "=&r" (__result) \
+ *             : "r" (__ptr), "rIL" (val) \
+ *             : "r0","r3","ip","lr","cc","memory" ); \
+ *         __result; })
+ */
+
+__kuser_cmpxchg:                                @ 0xffff0fc0
+
+#if __LINUX_ARM_ARCH__ < 6
+
+#ifdef CONFIG_SMP  /* sanity check */
+#error "CONFIG_SMP on a machine supporting pre-ARMv6 processors?"
+#endif
+
+        /*
+         * Theory of operation:
+         *
+         * We set the Z flag before loading oldval. If ever an exception
+         * occurs we can not be sure the loaded value will still be the same
+         * when the exception returns, therefore the user exception handler
+         * will clear the Z flag whenever the interrupted user code was
+         * actually from the kernel address space (see the usr_entry macro).
+         *
+         * The post-increment on the str is used to prevent a race with an
+         * exception happening just after the str instruction which would
+         * clear the Z flag although the exchange was done.
+         */
+        teq     ip, ip                  @ set Z flag
+        ldr     ip, [r2]                @ load current val
+        add     r3, r2, #1              @ prepare store ptr
+        teqeq   ip, r0                  @ compare with oldval if still allowed
+        streq   r1, [r3, #-1]!          @ store newval if still allowed
+        subs    r0, r2, r3              @ if r2 == r3 the str occured
+        mov     pc, lr
+
+#else
+
+        ldrex   r3, [r2]
+        subs    r3, r3, r0
+        strexeq r3, r1, [r2]
+        rsbs    r0, r3, #0
+        mov     pc, lr
+
+#endif
+
+        .align  5
+
+/*
+ * Reference prototype:
+ *
+ *      int __kernel_get_tls(void)
+ *
+ * Input:
+ *
+ *      lr = return address
+ *
+ * Output:
+ *
+ *      r0 = TLS value
+ *
+ * Clobbered:
+ *
+ *      the Z flag might be lost
+ *
+ * Definition and user space usage example:
+ *
+ *      typedef int (__kernel_get_tls_t)(void);
+ *      #define __kernel_get_tls (*(__kernel_get_tls_t *)0xffff0fe0)
+ *
+ * Get the TLS value as previously set via the __ARM_NR_set_tls syscall.
+ *
+ * This could be used as follows:
+ *
+ * #define __kernel_get_tls() \
+ *      ({ register unsigned int __val asm("r0"); \
+ *         asm( "mov r0, #0xffff0fff; mov lr, pc; sub pc, r0, #31" \
+ *              : "=r" (__val) : : "lr","cc" ); \
+ *         __val; })
+ */
+
+__kuser_get_tls:                                @ 0xffff0fe0
+
+#ifndef CONFIG_HAS_TLS_REG
+
+#ifdef CONFIG_SMP  /* sanity check */
+#error "CONFIG_SMP without CONFIG_HAS_TLS_REG is wrong"
+#endif
+
+        ldr     r0, [pc, #(16 - 8)]             @ TLS stored at 0xffff0ff0
+        mov     pc, lr
+
+#else
+
+        mrc     p15, 0, r0, c13, c0, 3          @ read TLS register
+        mov     pc, lr
+
+#endif
+
+        .rep    5
+        .word   0                       @ pad up to __kuser_helper_version
+        .endr
+
+/*
+ * Reference declaration:
+ *
+ *      extern unsigned int __kernel_helper_version;
+ *
+ * Definition and user space usage example:
+ *
+ *      #define __kernel_helper_version (*(unsigned int *)0xffff0ffc)
+ *
+ * User space may read this to determine the curent number of helpers
+ * available.
+ */
+
+__kuser_helper_version:                         @ 0xffff0ffc
+        .word   ((__kuser_helper_end - __kuser_helper_start) >> 5)
+
+        .globl  __kuser_helper_end
+__kuser_helper_end:
+
+
 /*
  * Vector stubs.
  *
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index efd7a341614b..cd99b83f14c2 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -19,6 +19,7 @@
 #include <linux/user.h>
 #include <linux/security.h>
 #include <linux/init.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -693,7 +694,7 @@ static int do_ptrace(int request, struct task_struct *child, long addr, long dat
                 case PTRACE_SYSCALL:
                 case PTRACE_CONT:
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         if (request == PTRACE_SYSCALL)
                                 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -728,7 +729,7 @@ static int do_ptrace(int request, struct task_struct *child, long addr, long dat
                  */
                 case PTRACE_SINGLESTEP:
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         child->ptrace |= PT_SINGLESTEP;
                         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
index 7ba6342cf93d..ef32577da304 100644
--- a/arch/arm/kernel/sys_arm.c
+++ b/arch/arm/kernel/sys_arm.c
@@ -227,18 +227,6 @@ asmlinkage int sys_ipc(uint call, int first, int second, int third,
         }
 }
 
-asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg,
-                          unsigned long __user *addr)
-{
-        unsigned long ret;
-        long err;
-
-        err = do_shmat(shmid, shmaddr, shmflg, &ret);
-        if (err == 0)
-                err = put_user(ret, addr);
-        return err;
-}
-
 /* Fork a new task - this creates a new program thread.
  * This is called indirectly via a small wrapper
  */
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 0078aeb85737..3a001fe5540b 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -450,13 +450,17 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
 
         case NR(set_tls):
                 thread->tp_value = regs->ARM_r0;
+#ifdef CONFIG_HAS_TLS_REG
+                asm ("mcr p15, 0, %0, c13, c0, 3" : : "r" (regs->ARM_r0) );
+#else
                 /*
-                 * Our user accessible TLS ptr is located at 0xffff0ffc.
-                 * On SMP read access to this address must raise a fault
-                 * and be emulated from the data abort handler.
-                 * m
+                 * User space must never try to access this directly.
+                 * Expect your app to break eventually if you do so.
+                 * The user helper at 0xffff0fe0 must be used instead.
+                 * (see entry-armv.S for details)
                  */
-                *((unsigned long *)0xffff0ffc) = thread->tp_value;
+                *((unsigned int *)0xffff0ff0) = regs->ARM_r0;
+#endif
                 return 0;
 
         default:
@@ -493,6 +497,41 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
         return 0;
 }
 
+#if defined(CONFIG_CPU_32v6) && !defined(CONFIG_HAS_TLS_REG)
+
+/*
+ * We might be running on an ARMv6+ processor which should have the TLS
+ * register, but for some reason we can't use it and have to emulate it.
+ */
+
+static int get_tp_trap(struct pt_regs *regs, unsigned int instr)
+{
+        int reg = (instr >> 12) & 15;
+        if (reg == 15)
+                return 1;
+        regs->uregs[reg] = current_thread_info()->tp_value;
+        regs->ARM_pc += 4;
+        return 0;
+}
+
+static struct undef_hook arm_mrc_hook = {
+        .instr_mask     = 0x0fff0fff,
+        .instr_val      = 0x0e1d0f70,
+        .cpsr_mask      = PSR_T_BIT,
+        .cpsr_val       = 0,
+        .fn             = get_tp_trap,
+};
+
+static int __init arm_mrc_hook_init(void)
+{
+        register_undef_hook(&arm_mrc_hook);
+        return 0;
+}
+
+late_initcall(arm_mrc_hook_init);
+
+#endif
+
 void __bad_xchg(volatile void *ptr, int size)
 {
         printk("xchg: bad data size: pc 0x%p, ptr 0x%p, size %d\n",
@@ -580,14 +619,17 @@ void __init trap_init(void)
 {
         extern char __stubs_start[], __stubs_end[];
         extern char __vectors_start[], __vectors_end[];
+        extern char __kuser_helper_start[], __kuser_helper_end[];
+        int kuser_sz = __kuser_helper_end - __kuser_helper_start;
 
         /*
-         * Copy the vectors and stubs (in entry-armv.S) into the
-         * vector page, mapped at 0xffff0000, and ensure these are
-         * visible to the instruction stream.
+         * Copy the vectors, stubs and kuser helpers (in entry-armv.S)
+         * into the vector page, mapped at 0xffff0000, and ensure these
+         * are visible to the instruction stream.
          */
         memcpy((void *)0xffff0000, __vectors_start, __vectors_end - __vectors_start);
         memcpy((void *)0xffff0200, __stubs_start, __stubs_end - __stubs_start);
+        memcpy((void *)0xffff1000 - kuser_sz, __kuser_helper_start, kuser_sz);
         flush_icache_range(0xffff0000, 0xffff0000 + PAGE_SIZE);
         modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
 }
diff --git a/arch/arm/mach-imx/generic.c b/arch/arm/mach-imx/generic.c
index 54377d0f578c..41e5849ae8da 100644
--- a/arch/arm/mach-imx/generic.c
+++ b/arch/arm/mach-imx/generic.c
@@ -26,6 +26,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <asm/arch/imxfb.h>
 #include <asm/hardware.h>
 
 #include <asm/mach/map.h>
@@ -228,6 +229,14 @@ static struct platform_device imx_uart2_device = {
         .resource       = imx_uart2_resources,
 };
 
+static struct imxfb_mach_info imx_fb_info;
+
+void __init set_imx_fb_info(struct imxfb_mach_info *hard_imx_fb_info)
+{
+        memcpy(&imx_fb_info,hard_imx_fb_info,sizeof(struct imxfb_mach_info));
+}
+EXPORT_SYMBOL(set_imx_fb_info);
+
 static struct resource imxfb_resources[] = {
         [0] = {
                 .start  = 0x00205000,
@@ -241,9 +250,16 @@ static struct resource imxfb_resources[] = {
         },
 };
 
+static u64 fb_dma_mask = ~(u64)0;
+
 static struct platform_device imxfb_device = {
         .name           = "imx-fb",
         .id             = 0,
+        .dev            = {
+                .platform_data  = &imx_fb_info,
+                .dma_mask       = &fb_dma_mask,
+                .coherent_dma_mask = 0xffffffff,
+        },
         .num_resources  = ARRAY_SIZE(imxfb_resources),
         .resource       = imxfb_resources,
 };
diff --git a/arch/arm/mach-integrator/core.c b/arch/arm/mach-integrator/core.c
index 86c50c3889b7..bd17b5154311 100644
--- a/arch/arm/mach-integrator/core.c
+++ b/arch/arm/mach-integrator/core.c
@@ -216,7 +216,9 @@ integrator_timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 
         write_seqlock(&xtime_lock);
 
-        // ...clear the interrupt
+        /*
+         * clear the interrupt
+         */
         timer1->TimerClear = 1;
 
         timer_tick(regs);
@@ -264,7 +266,7 @@ void __init integrator_time_init(unsigned long reload, unsigned int ctrl)
         timer1->TimerValue   = timer_reload;
         timer1->TimerControl = timer_ctrl;
 
-        /* 
+        /*
          * Make irqs happen for the system timer
          */
         setup_irq(IRQ_TIMERINT1, &integrator_timer_irq);
diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
index 68e15c36e336..3b948e8c2751 100644
--- a/arch/arm/mach-integrator/integrator_cp.c
+++ b/arch/arm/mach-integrator/integrator_cp.c
@@ -420,7 +420,22 @@ static struct clcd_panel vga = {
  */
 static void cp_clcd_enable(struct clcd_fb *fb)
 {
-        cm_control(CM_CTRL_LCDMUXSEL_MASK, CM_CTRL_LCDMUXSEL_VGA);
+        u32 val;
+
+        if (fb->fb.var.bits_per_pixel <= 8)
+                val = CM_CTRL_LCDMUXSEL_VGA_8421BPP;
+        else if (fb->fb.var.bits_per_pixel <= 16)
+                val = CM_CTRL_LCDMUXSEL_VGA_16BPP;
+        else
+                val = 0; /* no idea for this, don't trust the docs */
+
+        cm_control(CM_CTRL_LCDMUXSEL_MASK|
+                   CM_CTRL_LCDEN0|
+                   CM_CTRL_LCDEN1|
+                   CM_CTRL_STATIC1|
+                   CM_CTRL_STATIC2|
+                   CM_CTRL_STATIC|
+                   CM_CTRL_n24BITEN, val);
 }
 
 static unsigned long framesize = SZ_1M;
diff --git a/arch/arm/mach-integrator/leds.c b/arch/arm/mach-integrator/leds.c
index 9d182b77b312..d2c0ab21150c 100644
--- a/arch/arm/mach-integrator/leds.c
+++ b/arch/arm/mach-integrator/leds.c
@@ -37,7 +37,7 @@ static void integrator_leds_event(led_event_t ledevt)
         unsigned long flags;
         const unsigned int dbg_base = IO_ADDRESS(INTEGRATOR_DBG_BASE);
         unsigned int update_alpha_leds;
-        
+
         // yup, change the LEDs
         local_irq_save(flags);
         update_alpha_leds = 0;
diff --git a/arch/arm/mach-integrator/time.c b/arch/arm/mach-integrator/time.c
index 20729de2af28..1a844ca139e0 100644
--- a/arch/arm/mach-integrator/time.c
+++ b/arch/arm/mach-integrator/time.c
@@ -40,25 +40,32 @@ static int integrator_set_rtc(void)
         return 1;
 }
 
-static void rtc_read_alarm(struct rtc_wkalrm *alrm)
+static int rtc_read_alarm(struct rtc_wkalrm *alrm)
 {
         rtc_time_to_tm(readl(rtc_base + RTC_MR), &alrm->time);
+        return 0;
 }
 
-static int rtc_set_alarm(struct rtc_wkalrm *alrm)
+static inline int rtc_set_alarm(struct rtc_wkalrm *alrm)
 {
         unsigned long time;
         int ret;
 
-        ret = rtc_tm_to_time(&alrm->time, &time);
+        /*
+         * At the moment, we can only deal with non-wildcarded alarm times.
+         */
+        ret = rtc_valid_tm(&alrm->time);
+        if (ret == 0)
+                ret = rtc_tm_to_time(&alrm->time, &time);
         if (ret == 0)
                 writel(time, rtc_base + RTC_MR);
         return ret;
 }
 
-static void rtc_read_time(struct rtc_time *tm)
+static int rtc_read_time(struct rtc_time *tm)
 {
         rtc_time_to_tm(readl(rtc_base + RTC_DR), tm);
+        return 0;
 }
 
 /*
@@ -69,7 +76,7 @@ static void rtc_read_time(struct rtc_time *tm)
  * edge of the 1Hz clock, we must write the time one second
  * in advance.
  */
-static int rtc_set_time(struct rtc_time *tm)
+static inline int rtc_set_time(struct rtc_time *tm)
 {
         unsigned long time;
         int ret;
diff --git a/arch/arm/mach-ixp2000/ixdp2800.c b/arch/arm/mach-ixp2000/ixdp2800.c
index c4683aaff84a..aec13c7108a9 100644
--- a/arch/arm/mach-ixp2000/ixdp2800.c
+++ b/arch/arm/mach-ixp2000/ixdp2800.c
@@ -65,19 +65,102 @@ static struct sys_timer ixdp2800_timer = {
 /*************************************************************************
  * IXDP2800 PCI
  *************************************************************************/
+static void __init ixdp2800_slave_disable_pci_master(void)
+{
+        *IXP2000_PCI_CMDSTAT &= ~(PCI_COMMAND_MASTER | PCI_COMMAND_MEMORY);
+}
+
+static void __init ixdp2800_master_wait_for_slave(void)
+{
+        volatile u32 *addr;
+
+        printk(KERN_INFO "IXDP2800: waiting for slave NPU to configure "
+                         "its BAR sizes\n");
+
+        addr = ixp2000_pci_config_addr(0, IXDP2X00_SLAVE_NPU_DEVFN,
+                                        PCI_BASE_ADDRESS_1);
+        do {
+                *addr = 0xffffffff;
+                cpu_relax();
+        } while (*addr != 0xfe000008);
+
+        addr = ixp2000_pci_config_addr(0, IXDP2X00_SLAVE_NPU_DEVFN,
+                                        PCI_BASE_ADDRESS_2);
+        do {
+                *addr = 0xffffffff;
+                cpu_relax();
+        } while (*addr != 0xc0000008);
+
+        /*
+         * Configure the slave's SDRAM BAR by hand.
+         */
+        *addr = 0x40000008;
+}
+
+static void __init ixdp2800_slave_wait_for_master_enable(void)
+{
+        printk(KERN_INFO "IXDP2800: waiting for master NPU to enable us\n");
+
+        while ((*IXP2000_PCI_CMDSTAT & PCI_COMMAND_MASTER) == 0)
+                cpu_relax();
+}
+
 void __init ixdp2800_pci_preinit(void)
 {
         printk("ixdp2x00_pci_preinit called\n");
 
-        *IXP2000_PCI_ADDR_EXT =  0x0000e000;
+        *IXP2000_PCI_ADDR_EXT = 0x0001e000;
+
+        if (!ixdp2x00_master_npu())
+                ixdp2800_slave_disable_pci_master();
 
-        *IXP2000_PCI_DRAM_BASE_ADDR_MASK = (0x40000000 - 1) & ~0xfffff;
         *IXP2000_PCI_SRAM_BASE_ADDR_MASK = (0x2000000 - 1) & ~0x3ffff;
+        *IXP2000_PCI_DRAM_BASE_ADDR_MASK = (0x40000000 - 1) & ~0xfffff;
 
         ixp2000_pci_preinit();
+
+        if (ixdp2x00_master_npu()) {
+                /*
+                 * Wait until the slave set its SRAM/SDRAM BAR sizes
+                 * correctly before we proceed to scan and enumerate
+                 * the bus.
+                 */
+                ixdp2800_master_wait_for_slave();
+
+                /*
+                 * We configure the SDRAM BARs by hand because they
+                 * are 1G and fall outside of the regular allocated
+                 * PCI address space.
+                 */
+                *IXP2000_PCI_SDRAM_BAR = 0x00000008;
+        } else {
+                /*
+                 * Wait for the master to complete scanning the bus
+                 * and assigning resources before we proceed to scan
+                 * the bus ourselves.  Set pci=firmware to honor the
+                 * master's resource assignment.
+                 */
+                ixdp2800_slave_wait_for_master_enable();
+                pcibios_setup("firmware");
+        }
 }
 
-int ixdp2800_pci_setup(int nr, struct pci_sys_data *sys)
+/*
+ * We assign the SDRAM BARs for the two IXP2800 CPUs by hand, outside
+ * of the regular PCI window, because there's only 512M of outbound PCI
+ * memory window on each IXP, while we need 1G for each of the BARs.
+ */
+static void __devinit ixp2800_pci_fixup(struct pci_dev *dev)
+{
+        if (machine_is_ixdp2800()) {
+                dev->resource[2].start = 0;
+                dev->resource[2].end   = 0;
+                dev->resource[2].flags = 0;
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IXP2800, ixp2800_pci_fixup);
+
+static int __init ixdp2800_pci_setup(int nr, struct pci_sys_data *sys)
 {
         sys->mem_offset = 0x00000000;
 
@@ -129,22 +212,47 @@ static int __init ixdp2800_pci_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
         } else return IRQ_IXP2000_PCIB; /* Slave NIC interrupt */
 }
 
-static void ixdp2800_pci_postinit(void)
+static void __init ixdp2800_master_enable_slave(void)
 {
-        struct pci_dev *dev;
+        volatile u32 *addr;
 
-        if (ixdp2x00_master_npu()) {
-                dev = pci_find_slot(1, IXDP2800_SLAVE_ENET_DEVFN);
-                pci_remove_bus_device(dev);
-        } else {
-                dev = pci_find_slot(1, IXDP2800_MASTER_ENET_DEVFN);
-                pci_remove_bus_device(dev);
+        printk(KERN_INFO "IXDP2800: enabling slave NPU\n");
+
+        addr = (volatile u32 *)ixp2000_pci_config_addr(0,
+                                        IXDP2X00_SLAVE_NPU_DEVFN,
+                                        PCI_COMMAND);
+
+        *addr |= PCI_COMMAND_MASTER;
+}
 
+static void __init ixdp2800_master_wait_for_slave_bus_scan(void)
+{
+        volatile u32 *addr;
+
+        printk(KERN_INFO "IXDP2800: waiting for slave to finish bus scan\n");
+
+        addr = (volatile u32 *)ixp2000_pci_config_addr(0,
+                                        IXDP2X00_SLAVE_NPU_DEVFN,
+                                        PCI_COMMAND);
+        while ((*addr & PCI_COMMAND_MEMORY) == 0)
+                cpu_relax();
+}
+
+static void __init ixdp2800_slave_signal_bus_scan_completion(void)
+{
+        printk(KERN_INFO "IXDP2800: bus scan done, signaling master\n");
+        *IXP2000_PCI_CMDSTAT |= PCI_COMMAND_MEMORY;
+}
+
+static void __init ixdp2800_pci_postinit(void)
+{
+        if (!ixdp2x00_master_npu()) {
                 ixdp2x00_slave_pci_postinit();
+                ixdp2800_slave_signal_bus_scan_completion();
         }
 }
 
-struct hw_pci ixdp2800_pci __initdata = {
+struct __initdata hw_pci ixdp2800_pci __initdata = {
         .nr_controllers = 1,
         .setup          = ixdp2800_pci_setup,
         .preinit        = ixdp2800_pci_preinit,
@@ -155,8 +263,21 @@ struct hw_pci ixdp2800_pci __initdata = {
 
 int __init ixdp2800_pci_init(void)
 {
-        if (machine_is_ixdp2800())
+        if (machine_is_ixdp2800()) {
+                struct pci_dev *dev;
+
                 pci_common_init(&ixdp2800_pci);
+                if (ixdp2x00_master_npu()) {
+                        dev = pci_find_slot(1, IXDP2800_SLAVE_ENET_DEVFN);
+                        pci_remove_bus_device(dev);
+
+                        ixdp2800_master_enable_slave();
+                        ixdp2800_master_wait_for_slave_bus_scan();
+                } else {
+                        dev = pci_find_slot(1, IXDP2800_MASTER_ENET_DEVFN);
+                        pci_remove_bus_device(dev);
+                }
+        }
 
         return 0;
 }
diff --git a/arch/arm/mach-ixp2000/pci.c b/arch/arm/mach-ixp2000/pci.c
index 831f8ffb6b61..5ff2f2718c58 100644
--- a/arch/arm/mach-ixp2000/pci.c
+++ b/arch/arm/mach-ixp2000/pci.c
@@ -37,7 +37,7 @@ static int pci_master_aborts = 0;
 
 static int clear_master_aborts(void);
 
-static u32 *
+u32 *
 ixp2000_pci_config_addr(unsigned int bus_nr, unsigned int devfn, int where)
 {
         u32 *paddress;
@@ -208,15 +208,15 @@ ixp2000_pci_preinit(void)
  * use our own resource space.
  */
 static struct resource ixp2000_pci_mem_space = {
-        .start  = 0x00000000,
+        .start  = 0xe0000000,
         .end    = 0xffffffff,
         .flags  = IORESOURCE_MEM,
         .name   = "PCI Mem Space"
 };
 
 static struct resource ixp2000_pci_io_space = {
-        .start  = 0x00000000,
-        .end    = 0xffffffff,
+        .start  = 0x00010000,
+        .end    = 0x0001ffff,
         .flags  = IORESOURCE_IO,
         .name   = "PCI I/O Space"
 };
diff --git a/arch/arm/mach-pxa/generic.c b/arch/arm/mach-pxa/generic.c
index b1575b8dc1cd..a45aaa115a76 100644
--- a/arch/arm/mach-pxa/generic.c
+++ b/arch/arm/mach-pxa/generic.c
@@ -220,6 +220,30 @@ static struct platform_device stuart_device = {
         .id             = 2,
 };
 
+static struct resource i2c_resources[] = {
+        {
+                .start  = 0x40301680,
+                .end    = 0x403016a3,
+                .flags  = IORESOURCE_MEM,
+        }, {
+                .start  = IRQ_I2C,
+                .end    = IRQ_I2C,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device i2c_device = {
+        .name           = "pxa2xx-i2c",
+        .id             = 0,
+        .resource       = i2c_resources,
+        .num_resources  = ARRAY_SIZE(i2c_resources),
+};
+
+void __init pxa_set_i2c_info(struct i2c_pxa_platform_data *info)
+{
+        i2c_device.dev.platform_data = info;
+}
+
 static struct platform_device *devices[] __initdata = {
         &pxamci_device,
         &udc_device,
@@ -227,6 +251,7 @@ static struct platform_device *devices[] __initdata = {
         &ffuart_device,
         &btuart_device,
         &stuart_device,
+        &i2c_device,
 };
 
 static int __init pxa_init(void)
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 5b670c9ac5ef..27892e34b060 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -409,3 +409,18 @@ config CPU_BPREDICT_DISABLE
         depends on CPU_ARM1020
         help
           Say Y here to disable branch prediction.  If unsure, say N.
+
+config HAS_TLS_REG
+        bool
+        depends on CPU_32v6 && !CPU_32v5 && !CPU_32v4 && !CPU_32v3
+        default y
+        help
+          This selects support for the CP15 thread register.
+          It is defined to be available on ARMv6 or later.  However
+          if the kernel is configured to support multiple CPUs including
+          a pre-ARMv6 processors, or if a given ARMv6 processor doesn't
+          implement the thread register for some reason, then access to
+          this register from user space must be trapped and emulated.
+          If user space is relying on the __kuser_get_tls code then
+          there should not be any impact.
+
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index 38b2cbb89beb..8f76f3df7b4c 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -1,5 +1,6 @@
 #include <linux/linkage.h>
 #include <asm/assembler.h>
+#include "abort-macro.S"
 /*
  * Function: v6_early_abort
  *
@@ -13,11 +14,26 @@
  *         : sp = pointer to registers
  *
  * Purpose : obtain information about current aborted instruction.
+ * Note: we read user space.  This means we might cause a data
+ * abort here if the I-TLB and D-TLB aren't seeing the same
+ * picture.  Unfortunately, this does happen.  We live with it.
  */
         .align  5
 ENTRY(v6_early_abort)
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
+/*
+ * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR.
+ * The test below covers all the write situations, including Java bytecodes
+ */
+        bic     r1, r1, #1 << 11 | 1 << 10      @ clear bits 11 and 10 of FSR
+        tst     r3, #PSR_J_BIT                  @ Java?
+        movne   pc, lr
+        do_thumb_abort
+        ldreq   r3, [r2]                        @ read aborted ARM instruction
+        do_ldrd_abort
+        tst     r3, #1 << 20                    @ L = 0 -> write
+        orreq   r1, r1, #1 << 11                @ yes.
         mov     pc, lr
 
 
diff --git a/arch/arm/mm/mm-armv.c b/arch/arm/mm/mm-armv.c
index f5a87db8b498..585dfb8e20b9 100644
--- a/arch/arm/mm/mm-armv.c
+++ b/arch/arm/mm/mm-armv.c
@@ -411,9 +411,10 @@ static void __init build_mem_type_table(void)
                 mem_types[MT_MEMORY].prot_sect &= ~PMD_BIT4;
                 mem_types[MT_ROM].prot_sect &= ~PMD_BIT4;
                 /*
-                 * Mark cache clean areas read only from SVC mode
-                 * and no access from userspace.
+                 * Mark cache clean areas and XIP ROM read only
+                 * from SVC mode and no access from userspace.
                  */
+                mem_types[MT_ROM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
                 mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
                 mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
         }
diff --git a/arch/arm26/kernel/ptrace.c b/arch/arm26/kernel/ptrace.c
index 2a137146a77c..8a52124de0e1 100644
--- a/arch/arm26/kernel/ptrace.c
+++ b/arch/arm26/kernel/ptrace.c
@@ -18,6 +18,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -591,7 +592,7 @@ static int do_ptrace(int request, struct task_struct *child, long addr, long dat
                 case PTRACE_SYSCALL:
                 case PTRACE_CONT:
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         if (request == PTRACE_SYSCALL)
                                 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -626,7 +627,7 @@ static int do_ptrace(int request, struct task_struct *child, long addr, long dat
                  */
                 case PTRACE_SINGLESTEP:
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         child->ptrace |= PT_SINGLESTEP;
                         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/arm26/mm/small_page.c b/arch/arm26/mm/small_page.c
index 77be86cca789..30447106c25f 100644
--- a/arch/arm26/mm/small_page.c
+++ b/arch/arm26/mm/small_page.c
@@ -92,8 +92,7 @@ static unsigned long __get_small_page(int priority, struct order *order)
                 page = list_entry(order->queue.next, struct page, lru);
 again:
 #ifdef PEDANTIC
-                if (USED_MAP(page) & ~order->all_used)
-                        PAGE_BUG(page);
+                BUG_ON(USED_MAP(page) & ~order->all_used);
 #endif
                 offset = ffz(USED_MAP(page));
                 SET_USED(page, offset);
@@ -141,8 +140,7 @@ static void __free_small_page(unsigned long spage, struct order *order)
                         goto non_small;
 
 #ifdef PEDANTIC
-                if (USED_MAP(page) & ~order->all_used)
-                        PAGE_BUG(page);
+                BUG_ON(USED_MAP(page) & ~order->all_used);
 #endif
 
                 spage = spage >> order->shift;
diff --git a/arch/cris/arch-v10/kernel/ptrace.c b/arch/cris/arch-v10/kernel/ptrace.c
index da15db8ae482..581ecabaae53 100644
--- a/arch/cris/arch-v10/kernel/ptrace.c
+++ b/arch/cris/arch-v10/kernel/ptrace.c
@@ -10,6 +10,7 @@
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -184,7 +185,7 @@ sys_ptrace(long request, long pid, long addr, long data)
                 case PTRACE_CONT:
                         ret = -EIO;
                         
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         
                         if (request == PTRACE_SYSCALL) {
@@ -219,7 +220,7 @@ sys_ptrace(long request, long pid, long addr, long data)
                 case PTRACE_SINGLESTEP:
                         ret = -EIO;
                         
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         
                         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/frv/kernel/ptrace.c b/arch/frv/kernel/ptrace.c
index 2a0efb739adc..cbe03cba9f02 100644
--- a/arch/frv/kernel/ptrace.c
+++ b/arch/frv/kernel/ptrace.c
@@ -20,6 +20,7 @@
 #include <linux/user.h>
 #include <linux/config.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -239,7 +240,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -267,7 +268,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 
         case PTRACE_SINGLESTEP:  /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 ptrace_enable(child);
diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c
index 5f19d774a288..05c15e869777 100644
--- a/arch/h8300/kernel/ptrace.c
+++ b/arch/h8300/kernel/ptrace.c
@@ -24,6 +24,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/config.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -171,7 +172,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                 case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
                 case PTRACE_CONT: { /* restart after signal. */
                         ret = -EIO;
-                        if ((unsigned long) data >= _NSIG)
+                        if (!valid_signal(data))
                                 break ;
                         if (request == PTRACE_SYSCALL)
                                 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -202,7 +203,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 
                 case PTRACE_SINGLESTEP: {  /* set the trap flag. */
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                         child->exit_code = data;
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index 17a0cbce6f30..99b4f294a52d 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -653,6 +653,24 @@ config I8K
           Say Y if you intend to run this kernel on a Dell Inspiron 8000.
           Say N otherwise.
 
+config X86_REBOOTFIXUPS
+        bool "Enable X86 board specific fixups for reboot"
+        depends on X86
+        default n
+        ---help---
+          This enables chipset and/or board specific fixups to be done
+          in order to get reboot to work correctly. This is only needed on
+          some combinations of hardware and BIOS. The symptom, for which
+          this config is intended, is when reboot ends with a stalled/hung
+          system.
+
+          Currently, the only fixup is for the Geode GX1/CS5530A/TROM2.1.
+          combination.
+
+          Say Y if you want to enable the fixup. Currently, it's safe to
+          enable this option even if you don't need it.
+          Say N otherwise.
+
 config MICROCODE
         tristate "/dev/cpu/microcode - Intel IA32 CPU microcode support"
         ---help---
diff --git a/arch/i386/Makefile b/arch/i386/Makefile
index 314c7146e9bf..04783ceb050c 100644
--- a/arch/i386/Makefile
+++ b/arch/i386/Makefile
@@ -123,7 +123,7 @@ AFLAGS += $(mflags-y)
 boot := arch/i386/boot
 
 .PHONY: zImage bzImage compressed zlilo bzlilo \
-        zdisk bzdisk fdimage fdimage144 fdimage288 install
+        zdisk bzdisk fdimage fdimage144 fdimage288 install kernel_install
 
 all: bzImage
 
@@ -145,8 +145,9 @@ zdisk bzdisk: vmlinux
 fdimage fdimage144 fdimage288: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) BOOTIMAGE=$(KBUILD_IMAGE) $@
 
-install:
-        $(Q)$(MAKE) $(build)=$(boot) BOOTIMAGE=$(KBUILD_IMAGE) $@
+install: vmlinux
+install kernel_install:
+        $(Q)$(MAKE) $(build)=$(boot) BOOTIMAGE=$(KBUILD_IMAGE) install
 
 prepare: include/asm-$(ARCH)/asm_offsets.h
 CLEAN_FILES += include/asm-$(ARCH)/asm_offsets.h
diff --git a/arch/i386/boot/compressed/misc.c b/arch/i386/boot/compressed/misc.c
index fa67045234a3..cedc55cc47de 100644
--- a/arch/i386/boot/compressed/misc.c
+++ b/arch/i386/boot/compressed/misc.c
@@ -12,7 +12,6 @@
 #include <linux/linkage.h>
 #include <linux/vmalloc.h>
 #include <linux/tty.h>
-#include <video/edid.h>
 #include <asm/io.h>
 
 /*
diff --git a/arch/i386/boot/setup.S b/arch/i386/boot/setup.S
index a934ab32bf8e..caa1fde6904e 100644
--- a/arch/i386/boot/setup.S
+++ b/arch/i386/boot/setup.S
@@ -164,7 +164,7 @@ ramdisk_max:	.long (-__PAGE_OFFSET-(512 << 20)-1) & 0x7fffffff
 trampoline:     call    start_of_setup
                 .align 16
                                         # The offset at this point is 0x240
-                .space  (0x7ff-0x240+1) # E820 & EDD space (ending at 0x7ff)
+                .space  (0xeff-0x240+1) # E820 & EDD space (ending at 0xeff)
 # End of setup header #####################################################
 
 start_of_setup:
@@ -333,9 +333,9 @@ jmpe820:
         # sizeof(e820rec).
         #
 good820:
-        movb    (E820NR), %al                   # up to 32 entries
+        movb    (E820NR), %al                   # up to 128 entries
         cmpb    $E820MAX, %al
-        jnl     bail820
+        jae     bail820
 
         incb    (E820NR)
         movw    %di, %ax
diff --git a/arch/i386/kernel/Makefile b/arch/i386/kernel/Makefile
index aacdae6f372d..0fbcfe00dd8d 100644
--- a/arch/i386/kernel/Makefile
+++ b/arch/i386/kernel/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_X86_TRAMPOLINE)	+= trampoline.o
 obj-$(CONFIG_X86_MPPARSE)       += mpparse.o
 obj-$(CONFIG_X86_LOCAL_APIC)    += apic.o nmi.o
 obj-$(CONFIG_X86_IO_APIC)       += io_apic.o
+obj-$(CONFIG_X86_REBOOTFIXUPS)  += reboot_fixups.o
 obj-$(CONFIG_X86_NUMAQ)         += numaq.o
 obj-$(CONFIG_X86_SUMMIT_NUMA)   += summit.o
 obj-$(CONFIG_KPROBES)           += kprobes.o
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index e3879f7625c2..d509836b70c3 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -1265,8 +1265,6 @@ int __init APIC_init_uniprocessor (void)
 
         setup_local_APIC();
 
-        if (nmi_watchdog == NMI_LOCAL_APIC)
-                check_nmi_watchdog();
 #ifdef CONFIG_X86_IO_APIC
         if (smp_found_config)
                 if (!skip_ioapic_setup && nr_ioapics)
diff --git a/arch/i386/kernel/cpu/mtrr/generic.c b/arch/i386/kernel/cpu/mtrr/generic.c
index 9f7a7ea6388d..f468a979e9aa 100644
--- a/arch/i386/kernel/cpu/mtrr/generic.c
+++ b/arch/i386/kernel/cpu/mtrr/generic.c
@@ -124,8 +124,8 @@ int generic_get_free_region(unsigned long base, unsigned long size)
         return -ENOSPC;
 }
 
-void generic_get_mtrr(unsigned int reg, unsigned long *base,
-                      unsigned int *size, mtrr_type * type)
+static void generic_get_mtrr(unsigned int reg, unsigned long *base,
+                             unsigned int *size, mtrr_type * type)
 {
         unsigned int mask_lo, mask_hi, base_lo, base_hi;
 
diff --git a/arch/i386/kernel/cpu/mtrr/main.c b/arch/i386/kernel/cpu/mtrr/main.c
index 54999e4c55fd..e1c2042b9b7e 100644
--- a/arch/i386/kernel/cpu/mtrr/main.c
+++ b/arch/i386/kernel/cpu/mtrr/main.c
@@ -72,17 +72,21 @@ void set_mtrr_ops(struct mtrr_ops * ops)
 static int have_wrcomb(void)
 {
         struct pci_dev *dev;
+        u8 rev;
         
         if ((dev = pci_get_class(PCI_CLASS_BRIDGE_HOST << 8, NULL)) != NULL) {
-                /* ServerWorks LE chipsets have problems with write-combining 
+                /* ServerWorks LE chipsets < rev 6 have problems with write-combining
                    Don't allow it and leave room for other chipsets to be tagged */
                 if (dev->vendor == PCI_VENDOR_ID_SERVERWORKS &&
                     dev->device == PCI_DEVICE_ID_SERVERWORKS_LE) {
-                        printk(KERN_INFO "mtrr: Serverworks LE detected. Write-combining disabled.\n");
-                        pci_dev_put(dev);
-                        return 0;
+                        pci_read_config_byte(dev, PCI_CLASS_REVISION, &rev);
+                        if (rev <= 5) {
+                                printk(KERN_INFO "mtrr: Serverworks LE rev < 6 detected. Write-combining disabled.\n");
+                                pci_dev_put(dev);
+                                return 0;
+                        }
                 }
-                /* Intel 450NX errata # 23. Non ascending cachline evictions to
+                /* Intel 450NX errata # 23. Non ascending cacheline evictions to
                    write combining memory may resulting in data corruption */
                 if (dev->vendor == PCI_VENDOR_ID_INTEL &&
                     dev->device == PCI_DEVICE_ID_INTEL_82451NX) {
diff --git a/arch/i386/kernel/cpu/proc.c b/arch/i386/kernel/cpu/proc.c
index 4f28eba7fb8a..7323c19f354e 100644
--- a/arch/i386/kernel/cpu/proc.c
+++ b/arch/i386/kernel/cpu/proc.c
@@ -25,7 +25,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 "fxsr", "sse", "sse2", "ss", "ht", "tm", "ia64", "pbe",
 
                 /* AMD-defined */
-                "pni", NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, "syscall", NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, "mp", "nx", NULL, "mmxext", NULL,
                 NULL, "fxsr_opt", NULL, NULL, NULL, "lm", "3dnowext", "3dnow",
diff --git a/arch/i386/kernel/entry.S b/arch/i386/kernel/entry.S
index 3c73dc865ead..a991d4e5edd2 100644
--- a/arch/i386/kernel/entry.S
+++ b/arch/i386/kernel/entry.S
@@ -260,11 +260,9 @@ restore_nocheck:
 .section .fixup,"ax"
 iret_exc:
         sti
-        movl $__USER_DS, %edx
-        movl %edx, %ds
-        movl %edx, %es
-        movl $11,%eax
-        call do_exit
+        pushl $0                        # no error code
+        pushl $do_iret_error
+        jmp error_code
 .previous
 .section __ex_table,"a"
         .align 4
@@ -516,8 +514,6 @@ debug_stack_correct:
         xorl %edx,%edx                  # error code 0
         movl %esp,%eax                  # pt_regs pointer
         call do_debug
-        testl %eax,%eax
-        jnz restore_all
         jmp ret_from_exception
 
 /*
@@ -598,8 +594,6 @@ ENTRY(int3)
         xorl %edx,%edx          # zero error code
         movl %esp,%eax          # pt_regs pointer
         call do_int3
-        testl %eax,%eax
-        jnz restore_all
         jmp ret_from_exception
 
 ENTRY(overflow)
@@ -658,296 +652,6 @@ ENTRY(spurious_interrupt_bug)
         pushl $do_spurious_interrupt_bug
         jmp error_code
 
-.data
-ENTRY(sys_call_table)
-        .long sys_restart_syscall       /* 0 - old "setup()" system call, used for restarting */
-        .long sys_exit
-        .long sys_fork
-        .long sys_read
-        .long sys_write
-        .long sys_open          /* 5 */
-        .long sys_close
-        .long sys_waitpid
-        .long sys_creat
-        .long sys_link
-        .long sys_unlink        /* 10 */
-        .long sys_execve
-        .long sys_chdir
-        .long sys_time
-        .long sys_mknod
-        .long sys_chmod         /* 15 */
-        .long sys_lchown16
-        .long sys_ni_syscall    /* old break syscall holder */
-        .long sys_stat
-        .long sys_lseek
-        .long sys_getpid        /* 20 */
-        .long sys_mount
-        .long sys_oldumount
-        .long sys_setuid16
-        .long sys_getuid16
-        .long sys_stime         /* 25 */
-        .long sys_ptrace
-        .long sys_alarm
-        .long sys_fstat
-        .long sys_pause
-        .long sys_utime         /* 30 */
-        .long sys_ni_syscall    /* old stty syscall holder */
-        .long sys_ni_syscall    /* old gtty syscall holder */
-        .long sys_access
-        .long sys_nice
-        .long sys_ni_syscall    /* 35 - old ftime syscall holder */
-        .long sys_sync
-        .long sys_kill
-        .long sys_rename
-        .long sys_mkdir
-        .long sys_rmdir         /* 40 */
-        .long sys_dup
-        .long sys_pipe
-        .long sys_times
-        .long sys_ni_syscall    /* old prof syscall holder */
-        .long sys_brk           /* 45 */
-        .long sys_setgid16
-        .long sys_getgid16
-        .long sys_signal
-        .long sys_geteuid16
-        .long sys_getegid16     /* 50 */
-        .long sys_acct
-        .long sys_umount        /* recycled never used phys() */
-        .long sys_ni_syscall    /* old lock syscall holder */
-        .long sys_ioctl
-        .long sys_fcntl         /* 55 */
-        .long sys_ni_syscall    /* old mpx syscall holder */
-        .long sys_setpgid
-        .long sys_ni_syscall    /* old ulimit syscall holder */
-        .long sys_olduname
-        .long sys_umask         /* 60 */
-        .long sys_chroot
-        .long sys_ustat
-        .long sys_dup2
-        .long sys_getppid
-        .long sys_getpgrp       /* 65 */
-        .long sys_setsid
-        .long sys_sigaction
-        .long sys_sgetmask
-        .long sys_ssetmask
-        .long sys_setreuid16    /* 70 */
-        .long sys_setregid16
-        .long sys_sigsuspend
-        .long sys_sigpending
-        .long sys_sethostname
-        .long sys_setrlimit     /* 75 */
-        .long sys_old_getrlimit
-        .long sys_getrusage
-        .long sys_gettimeofday
-        .long sys_settimeofday
-        .long sys_getgroups16   /* 80 */
-        .long sys_setgroups16
-        .long old_select
-        .long sys_symlink
-        .long sys_lstat
-        .long sys_readlink      /* 85 */
-        .long sys_uselib
-        .long sys_swapon
-        .long sys_reboot
-        .long old_readdir
-        .long old_mmap          /* 90 */
-        .long sys_munmap
-        .long sys_truncate
-        .long sys_ftruncate
-        .long sys_fchmod
-        .long sys_fchown16      /* 95 */
-        .long sys_getpriority
-        .long sys_setpriority
-        .long sys_ni_syscall    /* old profil syscall holder */
-        .long sys_statfs
-        .long sys_fstatfs       /* 100 */
-        .long sys_ioperm
-        .long sys_socketcall
-        .long sys_syslog
-        .long sys_setitimer
-        .long sys_getitimer     /* 105 */
-        .long sys_newstat
-        .long sys_newlstat
-        .long sys_newfstat
-        .long sys_uname
-        .long sys_iopl          /* 110 */
-        .long sys_vhangup
-        .long sys_ni_syscall    /* old "idle" system call */
-        .long sys_vm86old
-        .long sys_wait4
-        .long sys_swapoff       /* 115 */
-        .long sys_sysinfo
-        .long sys_ipc
-        .long sys_fsync
-        .long sys_sigreturn
-        .long sys_clone         /* 120 */
-        .long sys_setdomainname
-        .long sys_newuname
-        .long sys_modify_ldt
-        .long sys_adjtimex
-        .long sys_mprotect      /* 125 */
-        .long sys_sigprocmask
-        .long sys_ni_syscall    /* old "create_module" */ 
-        .long sys_init_module
-        .long sys_delete_module
-        .long sys_ni_syscall    /* 130: old "get_kernel_syms" */
-        .long sys_quotactl
-        .long sys_getpgid
-        .long sys_fchdir
-        .long sys_bdflush
-        .long sys_sysfs         /* 135 */
-        .long sys_personality
-        .long sys_ni_syscall    /* reserved for afs_syscall */
-        .long sys_setfsuid16
-        .long sys_setfsgid16
-        .long sys_llseek        /* 140 */
-        .long sys_getdents
-        .long sys_select
-        .long sys_flock
-        .long sys_msync
-        .long sys_readv         /* 145 */
-        .long sys_writev
-        .long sys_getsid
-        .long sys_fdatasync
-        .long sys_sysctl
-        .long sys_mlock         /* 150 */
-        .long sys_munlock
-        .long sys_mlockall
-        .long sys_munlockall
-        .long sys_sched_setparam
-        .long sys_sched_getparam   /* 155 */
-        .long sys_sched_setscheduler
-        .long sys_sched_getscheduler
-        .long sys_sched_yield
-        .long sys_sched_get_priority_max
-        .long sys_sched_get_priority_min  /* 160 */
-        .long sys_sched_rr_get_interval
-        .long sys_nanosleep
-        .long sys_mremap
-        .long sys_setresuid16
-        .long sys_getresuid16   /* 165 */
-        .long sys_vm86
-        .long sys_ni_syscall    /* Old sys_query_module */
-        .long sys_poll
-        .long sys_nfsservctl
-        .long sys_setresgid16   /* 170 */
-        .long sys_getresgid16
-        .long sys_prctl
-        .long sys_rt_sigreturn
-        .long sys_rt_sigaction
-        .long sys_rt_sigprocmask        /* 175 */
-        .long sys_rt_sigpending
-        .long sys_rt_sigtimedwait
-        .long sys_rt_sigqueueinfo
-        .long sys_rt_sigsuspend
-        .long sys_pread64       /* 180 */
-        .long sys_pwrite64
-        .long sys_chown16
-        .long sys_getcwd
-        .long sys_capget
-        .long sys_capset        /* 185 */
-        .long sys_sigaltstack
-        .long sys_sendfile
-        .long sys_ni_syscall    /* reserved for streams1 */
-        .long sys_ni_syscall    /* reserved for streams2 */
-        .long sys_vfork         /* 190 */
-        .long sys_getrlimit
-        .long sys_mmap2
-        .long sys_truncate64
-        .long sys_ftruncate64
-        .long sys_stat64        /* 195 */
-        .long sys_lstat64
-        .long sys_fstat64
-        .long sys_lchown
-        .long sys_getuid
-        .long sys_getgid        /* 200 */
-        .long sys_geteuid
-        .long sys_getegid
-        .long sys_setreuid
-        .long sys_setregid
-        .long sys_getgroups     /* 205 */
-        .long sys_setgroups
-        .long sys_fchown
-        .long sys_setresuid
-        .long sys_getresuid
-        .long sys_setresgid     /* 210 */
-        .long sys_getresgid
-        .long sys_chown
-        .long sys_setuid
-        .long sys_setgid
-        .long sys_setfsuid      /* 215 */
-        .long sys_setfsgid
-        .long sys_pivot_root
-        .long sys_mincore
-        .long sys_madvise
-        .long sys_getdents64    /* 220 */
-        .long sys_fcntl64
-        .long sys_ni_syscall    /* reserved for TUX */
-        .long sys_ni_syscall
-        .long sys_gettid
-        .long sys_readahead     /* 225 */
-        .long sys_setxattr
-        .long sys_lsetxattr
-        .long sys_fsetxattr
-        .long sys_getxattr
-        .long sys_lgetxattr     /* 230 */
-        .long sys_fgetxattr
-        .long sys_listxattr
-        .long sys_llistxattr
-        .long sys_flistxattr
-        .long sys_removexattr   /* 235 */
-        .long sys_lremovexattr
-        .long sys_fremovexattr
-        .long sys_tkill
-        .long sys_sendfile64
-        .long sys_futex         /* 240 */
-        .long sys_sched_setaffinity
-        .long sys_sched_getaffinity
-        .long sys_set_thread_area
-        .long sys_get_thread_area
-        .long sys_io_setup      /* 245 */
-        .long sys_io_destroy
-        .long sys_io_getevents
-        .long sys_io_submit
-        .long sys_io_cancel
-        .long sys_fadvise64     /* 250 */
-        .long sys_ni_syscall
-        .long sys_exit_group
-        .long sys_lookup_dcookie
-        .long sys_epoll_create
-        .long sys_epoll_ctl     /* 255 */
-        .long sys_epoll_wait
-        .long sys_remap_file_pages
-        .long sys_set_tid_address
-        .long sys_timer_create
-        .long sys_timer_settime         /* 260 */
-        .long sys_timer_gettime
-        .long sys_timer_getoverrun
-        .long sys_timer_delete
-        .long sys_clock_settime
-        .long sys_clock_gettime         /* 265 */
-        .long sys_clock_getres
-        .long sys_clock_nanosleep
-        .long sys_statfs64
-        .long sys_fstatfs64     
-        .long sys_tgkill        /* 270 */
-        .long sys_utimes
-        .long sys_fadvise64_64
-        .long sys_ni_syscall    /* sys_vserver */
-        .long sys_mbind
-        .long sys_get_mempolicy
-        .long sys_set_mempolicy
-        .long sys_mq_open
-        .long sys_mq_unlink
-        .long sys_mq_timedsend
-        .long sys_mq_timedreceive       /* 280 */
-        .long sys_mq_notify
-        .long sys_mq_getsetattr
-        .long sys_ni_syscall            /* reserved for kexec */
-        .long sys_waitid
-        .long sys_ni_syscall            /* 285 */ /* available */
-        .long sys_add_key
-        .long sys_request_key
-        .long sys_keyctl
+#include "syscall_table.S"
 
 syscall_table_size=(.-sys_call_table)
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index d273fd746192..e966fc8c44c4 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -380,6 +380,7 @@ rp_sidt:
         ALIGN
 ignore_int:
         cld
+#ifdef CONFIG_PRINTK
         pushl %eax
         pushl %ecx
         pushl %edx
@@ -400,6 +401,7 @@ ignore_int:
         popl %edx
         popl %ecx
         popl %eax
+#endif
         iret
 
 /*
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index 5e0d55be5435..7a324e8b86f9 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -2175,7 +2175,6 @@ static inline void check_timer(void)
                                 disable_8259A_irq(0);
                                 setup_nmi();
                                 enable_8259A_irq(0);
-                                check_nmi_watchdog();
                         }
                         return;
                 }
@@ -2198,7 +2197,6 @@ static inline void check_timer(void)
                                 add_pin_to_irq(0, 0, pin2);
                         if (nmi_watchdog == NMI_IO_APIC) {
                                 setup_nmi();
-                                check_nmi_watchdog();
                         }
                         return;
                 }
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 2f89d000f954..2c0ee9c2d020 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -102,20 +102,21 @@ int nmi_active;
         (P4_CCCR_OVF_PMI0|P4_CCCR_THRESHOLD(15)|P4_CCCR_COMPLEMENT|     \
          P4_CCCR_COMPARE|P4_CCCR_REQUIRED|P4_CCCR_ESCR_SELECT(4)|P4_CCCR_ENABLE)
 
-int __init check_nmi_watchdog (void)
+static int __init check_nmi_watchdog(void)
 {
         unsigned int prev_nmi_count[NR_CPUS];
         int cpu;
 
-        printk(KERN_INFO "testing NMI watchdog ... ");
+        if (nmi_watchdog == NMI_NONE)
+                return 0;
+
+        printk(KERN_INFO "Testing NMI watchdog ... ");
 
         for (cpu = 0; cpu < NR_CPUS; cpu++)
                 prev_nmi_count[cpu] = per_cpu(irq_stat, cpu).__nmi_count;
         local_irq_enable();
         mdelay((10*1000)/nmi_hz); // wait 10 ticks
 
-        /* FIXME: Only boot CPU is online at this stage.  Check CPUs
-           as they come up. */
         for (cpu = 0; cpu < NR_CPUS; cpu++) {
 #ifdef CONFIG_SMP
                 /* Check cpu_callin_map here because that is set
@@ -139,6 +140,8 @@ int __init check_nmi_watchdog (void)
 
         return 0;
 }
+/* This needs to happen later in boot so counters are working */
+late_initcall(check_nmi_watchdog);
 
 static int __init setup_nmi_watchdog(char *str)
 {
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index b2203e21acb3..85bd56d44314 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -611,8 +611,8 @@ struct task_struct fastcall * __switch_to(struct task_struct *prev_p, struct tas
          * Save away %fs and %gs. No need to save %es and %ds, as
          * those are always kernel segments while inside the kernel.
          */
-        asm volatile("movl %%fs,%0":"=m" (*(int *)&prev->fs));
-        asm volatile("movl %%gs,%0":"=m" (*(int *)&prev->gs));
+        asm volatile("mov %%fs,%0":"=m" (prev->fs));
+        asm volatile("mov %%gs,%0":"=m" (prev->gs));
 
         /*
          * Restore %fs and %gs if needed.
diff --git a/arch/i386/kernel/ptrace.c b/arch/i386/kernel/ptrace.c
index b2f17640ceff..e8c965ce86eb 100644
--- a/arch/i386/kernel/ptrace.c
+++ b/arch/i386/kernel/ptrace.c
@@ -16,6 +16,7 @@
 #include <linux/security.h>
 #include <linux/audit.h>
 #include <linux/seccomp.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -511,7 +512,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL:    /* continue and stop at next (return from) syscall */
         case PTRACE_CONT:       /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL) {
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -543,7 +544,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
 
         case PTRACE_SINGLESTEP: /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 set_singlestep(child);
diff --git a/arch/i386/kernel/reboot.c b/arch/i386/kernel/reboot.c
index 3d7e994563df..6dc27eb70ee7 100644
--- a/arch/i386/kernel/reboot.c
+++ b/arch/i386/kernel/reboot.c
@@ -13,6 +13,7 @@
 #include <asm/uaccess.h>
 #include <asm/apic.h>
 #include "mach_reboot.h"
+#include <linux/reboot_fixups.h>
 
 /*
  * Power off function, if any
@@ -348,6 +349,7 @@ void machine_restart(char * __unused)
                 /* rebooting needs to touch the page at absolute addr 0 */
                 *((unsigned short *)__va(0x472)) = reboot_mode;
                 for (;;) {
+                        mach_reboot_fixups(); /* for board specific fixups */
                         mach_reboot();
                         /* That didn't work - force a triple fault.. */
                         __asm__ __volatile__("lidt %0": :"m" (no_idt));
diff --git a/arch/i386/kernel/reboot_fixups.c b/arch/i386/kernel/reboot_fixups.c
new file mode 100644
index 000000000000..1b183b378c2c
--- /dev/null
+++ b/arch/i386/kernel/reboot_fixups.c
@@ -0,0 +1,56 @@
+/*
+ * linux/arch/i386/kernel/reboot_fixups.c
+ *
+ * This is a good place to put board specific reboot fixups.
+ *
+ * List of supported fixups:
+ * geode-gx1/cs5530a - Jaya Kumar <jayalk@intworks.biz>
+ *
+ */
+
+#include <asm/delay.h>
+#include <linux/pci.h>
+
+static void cs5530a_warm_reset(struct pci_dev *dev)
+{
+        /* writing 1 to the reset control register, 0x44 causes the
+        cs5530a to perform a system warm reset */
+        pci_write_config_byte(dev, 0x44, 0x1);
+        udelay(50); /* shouldn't get here but be safe and spin-a-while */
+        return;
+}
+
+struct device_fixup {
+        unsigned int vendor;
+        unsigned int device;
+        void (*reboot_fixup)(struct pci_dev *);
+};
+
+static struct device_fixup fixups_table[] = {
+{ PCI_VENDOR_ID_CYRIX, PCI_DEVICE_ID_CYRIX_5530_LEGACY, cs5530a_warm_reset },
+};
+
+/*
+ * we see if any fixup is available for our current hardware. if there
+ * is a fixup, we call it and we expect to never return from it. if we
+ * do return, we keep looking and then eventually fall back to the
+ * standard mach_reboot on return.
+ */
+void mach_reboot_fixups(void)
+{
+        struct device_fixup *cur;
+        struct pci_dev *dev;
+        int i;
+
+        for (i=0; i < (sizeof(fixups_table)/sizeof(fixups_table[0])); i++) {
+                cur = &(fixups_table[i]);
+                dev = pci_get_device(cur->vendor, cur->device, 0);
+                if (!dev)
+                        continue;
+
+                cur->reboot_fixup(dev);
+        }
+
+        printk(KERN_WARNING "No reboot fixup found for your hardware\n");
+}
+
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index fd36d2f65f88..cbea7ac582e5 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -1089,9 +1089,6 @@ static void __init smp_boot_cpus(unsigned int max_cpus)
                 }
         }
 
-        if (nmi_watchdog == NMI_LOCAL_APIC)
-                check_nmi_watchdog();
-
         smpboot_setup_io_apic();
 
         setup_boot_APIC_clock();
diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
new file mode 100644
index 000000000000..6cd1ed311f02
--- /dev/null
+++ b/arch/i386/kernel/syscall_table.S
@@ -0,0 +1,291 @@
+.data
+ENTRY(sys_call_table)
+        .long sys_restart_syscall       /* 0 - old "setup()" system call, used for restarting */
+        .long sys_exit
+        .long sys_fork
+        .long sys_read
+        .long sys_write
+        .long sys_open          /* 5 */
+        .long sys_close
+        .long sys_waitpid
+        .long sys_creat
+        .long sys_link
+        .long sys_unlink        /* 10 */
+        .long sys_execve
+        .long sys_chdir
+        .long sys_time
+        .long sys_mknod
+        .long sys_chmod         /* 15 */
+        .long sys_lchown16
+        .long sys_ni_syscall    /* old break syscall holder */
+        .long sys_stat
+        .long sys_lseek
+        .long sys_getpid        /* 20 */
+        .long sys_mount
+        .long sys_oldumount
+        .long sys_setuid16
+        .long sys_getuid16
+        .long sys_stime         /* 25 */
+        .long sys_ptrace
+        .long sys_alarm
+        .long sys_fstat
+        .long sys_pause
+        .long sys_utime         /* 30 */
+        .long sys_ni_syscall    /* old stty syscall holder */
+        .long sys_ni_syscall    /* old gtty syscall holder */
+        .long sys_access
+        .long sys_nice
+        .long sys_ni_syscall    /* 35 - old ftime syscall holder */
+        .long sys_sync
+        .long sys_kill
+        .long sys_rename
+        .long sys_mkdir
+        .long sys_rmdir         /* 40 */
+        .long sys_dup
+        .long sys_pipe
+        .long sys_times
+        .long sys_ni_syscall    /* old prof syscall holder */
+        .long sys_brk           /* 45 */
+        .long sys_setgid16
+        .long sys_getgid16
+        .long sys_signal
+        .long sys_geteuid16
+        .long sys_getegid16     /* 50 */
+        .long sys_acct
+        .long sys_umount        /* recycled never used phys() */
+        .long sys_ni_syscall    /* old lock syscall holder */
+        .long sys_ioctl
+        .long sys_fcntl         /* 55 */
+        .long sys_ni_syscall    /* old mpx syscall holder */
+        .long sys_setpgid
+        .long sys_ni_syscall    /* old ulimit syscall holder */
+        .long sys_olduname
+        .long sys_umask         /* 60 */
+        .long sys_chroot
+        .long sys_ustat
+        .long sys_dup2
+        .long sys_getppid
+        .long sys_getpgrp       /* 65 */
+        .long sys_setsid
+        .long sys_sigaction
+        .long sys_sgetmask
+        .long sys_ssetmask
+        .long sys_setreuid16    /* 70 */
+        .long sys_setregid16
+        .long sys_sigsuspend
+        .long sys_sigpending
+        .long sys_sethostname
+        .long sys_setrlimit     /* 75 */
+        .long sys_old_getrlimit
+        .long sys_getrusage
+        .long sys_gettimeofday
+        .long sys_settimeofday
+        .long sys_getgroups16   /* 80 */
+        .long sys_setgroups16
+        .long old_select
+        .long sys_symlink
+        .long sys_lstat
+        .long sys_readlink      /* 85 */
+        .long sys_uselib
+        .long sys_swapon
+        .long sys_reboot
+        .long old_readdir
+        .long old_mmap          /* 90 */
+        .long sys_munmap
+        .long sys_truncate
+        .long sys_ftruncate
+        .long sys_fchmod
+        .long sys_fchown16      /* 95 */
+        .long sys_getpriority
+        .long sys_setpriority
+        .long sys_ni_syscall    /* old profil syscall holder */
+        .long sys_statfs
+        .long sys_fstatfs       /* 100 */
+        .long sys_ioperm
+        .long sys_socketcall
+        .long sys_syslog
+        .long sys_setitimer
+        .long sys_getitimer     /* 105 */
+        .long sys_newstat
+        .long sys_newlstat
+        .long sys_newfstat
+        .long sys_uname
+        .long sys_iopl          /* 110 */
+        .long sys_vhangup
+        .long sys_ni_syscall    /* old "idle" system call */
+        .long sys_vm86old
+        .long sys_wait4
+        .long sys_swapoff       /* 115 */
+        .long sys_sysinfo
+        .long sys_ipc
+        .long sys_fsync
+        .long sys_sigreturn
+        .long sys_clone         /* 120 */
+        .long sys_setdomainname
+        .long sys_newuname
+        .long sys_modify_ldt
+        .long sys_adjtimex
+        .long sys_mprotect      /* 125 */
+        .long sys_sigprocmask
+        .long sys_ni_syscall    /* old "create_module" */
+        .long sys_init_module
+        .long sys_delete_module
+        .long sys_ni_syscall    /* 130: old "get_kernel_syms" */
+        .long sys_quotactl
+        .long sys_getpgid
+        .long sys_fchdir
+        .long sys_bdflush
+        .long sys_sysfs         /* 135 */
+        .long sys_personality
+        .long sys_ni_syscall    /* reserved for afs_syscall */
+        .long sys_setfsuid16
+        .long sys_setfsgid16
+        .long sys_llseek        /* 140 */
+        .long sys_getdents
+        .long sys_select
+        .long sys_flock
+        .long sys_msync
+        .long sys_readv         /* 145 */
+        .long sys_writev
+        .long sys_getsid
+        .long sys_fdatasync
+        .long sys_sysctl
+        .long sys_mlock         /* 150 */
+        .long sys_munlock
+        .long sys_mlockall
+        .long sys_munlockall
+        .long sys_sched_setparam
+        .long sys_sched_getparam   /* 155 */
+        .long sys_sched_setscheduler
+        .long sys_sched_getscheduler
+        .long sys_sched_yield
+        .long sys_sched_get_priority_max
+        .long sys_sched_get_priority_min  /* 160 */
+        .long sys_sched_rr_get_interval
+        .long sys_nanosleep
+        .long sys_mremap
+        .long sys_setresuid16
+        .long sys_getresuid16   /* 165 */
+        .long sys_vm86
+        .long sys_ni_syscall    /* Old sys_query_module */
+        .long sys_poll
+        .long sys_nfsservctl
+        .long sys_setresgid16   /* 170 */
+        .long sys_getresgid16
+        .long sys_prctl
+        .long sys_rt_sigreturn
+        .long sys_rt_sigaction
+        .long sys_rt_sigprocmask        /* 175 */
+        .long sys_rt_sigpending
+        .long sys_rt_sigtimedwait
+        .long sys_rt_sigqueueinfo
+        .long sys_rt_sigsuspend
+        .long sys_pread64       /* 180 */
+        .long sys_pwrite64
+        .long sys_chown16
+        .long sys_getcwd
+        .long sys_capget
+        .long sys_capset        /* 185 */
+        .long sys_sigaltstack
+        .long sys_sendfile
+        .long sys_ni_syscall    /* reserved for streams1 */
+        .long sys_ni_syscall    /* reserved for streams2 */
+        .long sys_vfork         /* 190 */
+        .long sys_getrlimit
+        .long sys_mmap2
+        .long sys_truncate64
+        .long sys_ftruncate64
+        .long sys_stat64        /* 195 */
+        .long sys_lstat64
+        .long sys_fstat64
+        .long sys_lchown
+        .long sys_getuid
+        .long sys_getgid        /* 200 */
+        .long sys_geteuid
+        .long sys_getegid
+        .long sys_setreuid
+        .long sys_setregid
+        .long sys_getgroups     /* 205 */
+        .long sys_setgroups
+        .long sys_fchown
+        .long sys_setresuid
+        .long sys_getresuid
+        .long sys_setresgid     /* 210 */
+        .long sys_getresgid
+        .long sys_chown
+        .long sys_setuid
+        .long sys_setgid
+        .long sys_setfsuid      /* 215 */
+        .long sys_setfsgid
+        .long sys_pivot_root
+        .long sys_mincore
+        .long sys_madvise
+        .long sys_getdents64    /* 220 */
+        .long sys_fcntl64
+        .long sys_ni_syscall    /* reserved for TUX */
+        .long sys_ni_syscall
+        .long sys_gettid
+        .long sys_readahead     /* 225 */
+        .long sys_setxattr
+        .long sys_lsetxattr
+        .long sys_fsetxattr
+        .long sys_getxattr
+        .long sys_lgetxattr     /* 230 */
+        .long sys_fgetxattr
+        .long sys_listxattr
+        .long sys_llistxattr
+        .long sys_flistxattr
+        .long sys_removexattr   /* 235 */
+        .long sys_lremovexattr
+        .long sys_fremovexattr
+        .long sys_tkill
+        .long sys_sendfile64
+        .long sys_futex         /* 240 */
+        .long sys_sched_setaffinity
+        .long sys_sched_getaffinity
+        .long sys_set_thread_area
+        .long sys_get_thread_area
+        .long sys_io_setup      /* 245 */
+        .long sys_io_destroy
+        .long sys_io_getevents
+        .long sys_io_submit
+        .long sys_io_cancel
+        .long sys_fadvise64     /* 250 */
+        .long sys_ni_syscall
+        .long sys_exit_group
+        .long sys_lookup_dcookie
+        .long sys_epoll_create
+        .long sys_epoll_ctl     /* 255 */
+        .long sys_epoll_wait
+        .long sys_remap_file_pages
+        .long sys_set_tid_address
+        .long sys_timer_create
+        .long sys_timer_settime         /* 260 */
+        .long sys_timer_gettime
+        .long sys_timer_getoverrun
+        .long sys_timer_delete
+        .long sys_clock_settime
+        .long sys_clock_gettime         /* 265 */
+        .long sys_clock_getres
+        .long sys_clock_nanosleep
+        .long sys_statfs64
+        .long sys_fstatfs64
+        .long sys_tgkill        /* 270 */
+        .long sys_utimes
+        .long sys_fadvise64_64
+        .long sys_ni_syscall    /* sys_vserver */
+        .long sys_mbind
+        .long sys_get_mempolicy
+        .long sys_set_mempolicy
+        .long sys_mq_open
+        .long sys_mq_unlink
+        .long sys_mq_timedsend
+        .long sys_mq_timedreceive       /* 280 */
+        .long sys_mq_notify
+        .long sys_mq_getsetattr
+        .long sys_ni_syscall            /* reserved for kexec */
+        .long sys_waitid
+        .long sys_ni_syscall            /* 285 */ /* available */
+        .long sys_add_key
+        .long sys_request_key
+        .long sys_keyctl
diff --git a/arch/i386/kernel/time.c b/arch/i386/kernel/time.c
index 4d75b373f90e..a0dcb7c87c30 100644
--- a/arch/i386/kernel/time.c
+++ b/arch/i386/kernel/time.c
@@ -441,7 +441,7 @@ static void __init hpet_time_init(void)
         set_normalized_timespec(&wall_to_monotonic,
                 -xtime.tv_sec, -xtime.tv_nsec);
 
-        if (hpet_enable() >= 0) {
+        if ((hpet_enable() >= 0) && hpet_use_timer) {
                 printk("Using HPET for base-timer\n");
         }
 
diff --git a/arch/i386/kernel/time_hpet.c b/arch/i386/kernel/time_hpet.c
index 244a31b04be7..10a0cbb88e75 100644
--- a/arch/i386/kernel/time_hpet.c
+++ b/arch/i386/kernel/time_hpet.c
@@ -26,6 +26,7 @@
 static unsigned long hpet_period;       /* fsecs / HPET clock */
 unsigned long hpet_tick;                /* hpet clks count per tick */
 unsigned long hpet_address;             /* hpet memory map physical address */
+int hpet_use_timer;
 
 static int use_hpet;            /* can be used for runtime check of hpet */
 static int boot_hpet_disable;   /* boottime override for HPET timer */
@@ -73,27 +74,30 @@ static int hpet_timer_stop_set_go(unsigned long tick)
         hpet_writel(0, HPET_COUNTER);
         hpet_writel(0, HPET_COUNTER + 4);
 
-        /*
-         * Set up timer 0, as periodic with first interrupt to happen at
-         * hpet_tick, and period also hpet_tick.
-         */
-        cfg = hpet_readl(HPET_T0_CFG);
-        cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC |
-               HPET_TN_SETVAL | HPET_TN_32BIT;
-        hpet_writel(cfg, HPET_T0_CFG);
-
-        /*
-         * The first write after writing TN_SETVAL to the config register sets
-         * the counter value, the second write sets the threshold.
-         */
-        hpet_writel(tick, HPET_T0_CMP);
-        hpet_writel(tick, HPET_T0_CMP);
+        if (hpet_use_timer) {
+                /*
+                 * Set up timer 0, as periodic with first interrupt to happen at
+                 * hpet_tick, and period also hpet_tick.
+                 */
+                cfg = hpet_readl(HPET_T0_CFG);
+                cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC |
+                       HPET_TN_SETVAL | HPET_TN_32BIT;
+                hpet_writel(cfg, HPET_T0_CFG);
 
+                /*
+                 * The first write after writing TN_SETVAL to the config register sets
+                 * the counter value, the second write sets the threshold.
+                 */
+                hpet_writel(tick, HPET_T0_CMP);
+                hpet_writel(tick, HPET_T0_CMP);
+        }
         /*
          * Go!
          */
         cfg = hpet_readl(HPET_CFG);
-        cfg |= HPET_CFG_ENABLE | HPET_CFG_LEGACY;
+        if (hpet_use_timer)
+                cfg |= HPET_CFG_LEGACY;
+        cfg |= HPET_CFG_ENABLE;
         hpet_writel(cfg, HPET_CFG);
 
         return 0;
@@ -128,12 +132,11 @@ int __init hpet_enable(void)
          * However, we can do with one timer otherwise using the
          * the single HPET timer for system time.
          */
-        if (
 #ifdef CONFIG_HPET_EMULATE_RTC
-                !(id & HPET_ID_NUMBER) ||
-#endif
-            !(id & HPET_ID_LEGSUP))
+        if (!(id & HPET_ID_NUMBER))
                 return -1;
+#endif
+
 
         hpet_period = hpet_readl(HPET_PERIOD);
         if ((hpet_period < HPET_MIN_PERIOD) || (hpet_period > HPET_MAX_PERIOD))
@@ -152,6 +155,8 @@ int __init hpet_enable(void)
         if (hpet_tick_rem > (hpet_period >> 1))
                 hpet_tick++; /* rounding the result */
 
+        hpet_use_timer = id & HPET_ID_LEGSUP;
+
         if (hpet_timer_stop_set_go(hpet_tick))
                 return -1;
 
@@ -202,7 +207,8 @@ int __init hpet_enable(void)
 #endif
 
 #ifdef CONFIG_X86_LOCAL_APIC
-        wait_timer_tick = wait_hpet_tick;
+        if (hpet_use_timer)
+                wait_timer_tick = wait_hpet_tick;
 #endif
         return 0;
 }
diff --git a/arch/i386/kernel/timers/timer_hpet.c b/arch/i386/kernel/timers/timer_hpet.c
index 713134e71844..f778f471a09a 100644
--- a/arch/i386/kernel/timers/timer_hpet.c
+++ b/arch/i386/kernel/timers/timer_hpet.c
@@ -79,7 +79,7 @@ static unsigned long get_offset_hpet(void)
 
         eax = hpet_readl(HPET_COUNTER);
         eax -= hpet_last;       /* hpet delta */
-
+        eax = min(hpet_tick, eax);
         /*
          * Time offset = (hpet delta) * ( usecs per HPET clock )
          *             = (hpet delta) * ( usecs per tick / HPET clocks per tick)
@@ -105,9 +105,12 @@ static void mark_offset_hpet(void)
         last_offset = ((unsigned long long)last_tsc_high<<32)|last_tsc_low;
         rdtsc(last_tsc_low, last_tsc_high);
 
-        offset = hpet_readl(HPET_T0_CMP) - hpet_tick;
-        if (unlikely(((offset - hpet_last) > hpet_tick) && (hpet_last != 0))) {
-                int lost_ticks = (offset - hpet_last) / hpet_tick;
+        if (hpet_use_timer)
+                offset = hpet_readl(HPET_T0_CMP) - hpet_tick;
+        else
+                offset = hpet_readl(HPET_COUNTER);
+        if (unlikely(((offset - hpet_last) >= (2*hpet_tick)) && (hpet_last != 0))) {
+                int lost_ticks = ((offset - hpet_last) / hpet_tick) - 1;
                 jiffies_64 += lost_ticks;
         }
         hpet_last = offset;
diff --git a/arch/i386/kernel/timers/timer_tsc.c b/arch/i386/kernel/timers/timer_tsc.c
index a685994e5c8e..7926d967be00 100644
--- a/arch/i386/kernel/timers/timer_tsc.c
+++ b/arch/i386/kernel/timers/timer_tsc.c
@@ -477,7 +477,7 @@ static int __init init_tsc(char* override)
         if (cpu_has_tsc) {
                 unsigned long tsc_quotient;
 #ifdef CONFIG_HPET_TIMER
-                if (is_hpet_enabled()){
+                if (is_hpet_enabled() && hpet_use_timer) {
                         unsigned long result, remain;
                         printk("Using TSC for gettimeofday\n");
                         tsc_quotient = calibrate_tsc_hpet(NULL);
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 6c0e383915b6..00c63419c06f 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -451,6 +451,7 @@ DO_ERROR(10, SIGSEGV, "invalid TSS", invalid_TSS)
 DO_ERROR(11, SIGBUS,  "segment not present", segment_not_present)
 DO_ERROR(12, SIGBUS,  "stack segment", stack_segment)
 DO_ERROR_INFO(17, SIGBUS, "alignment check", alignment_check, BUS_ADRALN, 0)
+DO_ERROR_INFO(32, SIGSEGV, "iret exception", iret_error, ILL_BADSTK, 0)
 
 fastcall void do_general_protection(struct pt_regs * regs, long error_code)
 {
@@ -642,16 +643,15 @@ void unset_nmi_callback(void)
 }
 
 #ifdef CONFIG_KPROBES
-fastcall int do_int3(struct pt_regs *regs, long error_code)
+fastcall void do_int3(struct pt_regs *regs, long error_code)
 {
         if (notify_die(DIE_INT3, "int3", regs, error_code, 3, SIGTRAP)
                         == NOTIFY_STOP)
-                return 1;
+                return;
         /* This is an interrupt gate, because kprobes wants interrupts
         disabled.  Normal trap handlers don't. */
         restore_interrupts(regs);
         do_trap(3, SIGTRAP, "int3", 1, regs, error_code, NULL);
-        return 0;
 }
 #endif
 
diff --git a/arch/i386/kernel/vm86.c b/arch/i386/kernel/vm86.c
index 2f3d52dacff7..ec0f68ce6886 100644
--- a/arch/i386/kernel/vm86.c
+++ b/arch/i386/kernel/vm86.c
@@ -222,7 +222,7 @@ asmlinkage int sys_vm86(struct pt_regs regs)
                         goto out;
                 case VM86_PLUS_INSTALL_CHECK:
                         /* NOTE: on old vm86 stuff this will return the error
-                           from verify_area(), because the subfunction is
+                           from access_ok(), because the subfunction is
                            interpreted as (invalid) address to vm86_struct.
                            So the installation check works.
                          */
@@ -294,8 +294,8 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
  */
         info->regs32->eax = 0;
         tsk->thread.saved_esp0 = tsk->thread.esp0;
-        asm volatile("movl %%fs,%0":"=m" (tsk->thread.saved_fs));
-        asm volatile("movl %%gs,%0":"=m" (tsk->thread.saved_gs));
+        asm volatile("mov %%fs,%0":"=m" (tsk->thread.saved_fs));
+        asm volatile("mov %%gs,%0":"=m" (tsk->thread.saved_gs));
 
         tss = &per_cpu(init_tss, get_cpu());
         tsk->thread.esp0 = (unsigned long) &info->VM86_TSS_ESP0;
@@ -717,12 +717,12 @@ static irqreturn_t irq_handler(int intno, void *dev_id, struct pt_regs * regs)
         irqbits |= irq_bit;
         if (vm86_irqs[intno].sig)
                 send_sig(vm86_irqs[intno].sig, vm86_irqs[intno].tsk, 1);
-        spin_unlock_irqrestore(&irqbits_lock, flags);
         /*
          * IRQ will be re-enabled when user asks for the irq (whether
          * polling or as a result of the signal)
          */
-        disable_irq(intno);
+        disable_irq_nosync(intno);
+        spin_unlock_irqrestore(&irqbits_lock, flags);
         return IRQ_HANDLED;
 
 out:
@@ -754,17 +754,20 @@ static inline int get_and_reset_irq(int irqnumber)
 {
         int bit;
         unsigned long flags;
+        int ret = 0;
         
         if (invalid_vm86_irq(irqnumber)) return 0;
         if (vm86_irqs[irqnumber].tsk != current) return 0;
         spin_lock_irqsave(&irqbits_lock, flags);        
         bit = irqbits & (1 << irqnumber);
         irqbits &= ~bit;
+        if (bit) {
+                enable_irq(irqnumber);
+                ret = 1;
+        }
+
         spin_unlock_irqrestore(&irqbits_lock, flags);   
-        if (!bit)
-                return 0;
-        enable_irq(irqnumber);
-        return 1;
+        return ret;
 }
 
 
diff --git a/arch/i386/oprofile/nmi_timer_int.c b/arch/i386/oprofile/nmi_timer_int.c
index b2e462abf337..c58d0c14f274 100644
--- a/arch/i386/oprofile/nmi_timer_int.c
+++ b/arch/i386/oprofile/nmi_timer_int.c
@@ -36,7 +36,7 @@ static void timer_stop(void)
 {
         enable_timer_nmi_watchdog();
         unset_nmi_callback();
-        synchronize_kernel();
+        synchronize_sched();  /* Allow already-started NMIs to complete. */
 }
 
 
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index e07589d04f64..d6598da4b67b 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -495,6 +495,8 @@ static __init int intel_router_probe(struct irq_router *r, struct pci_dev *route
                 case PCI_DEVICE_ID_INTEL_ICH6_1:
                 case PCI_DEVICE_ID_INTEL_ICH7_0:
                 case PCI_DEVICE_ID_INTEL_ICH7_1:
+                case PCI_DEVICE_ID_INTEL_ICH7_30:
+                case PCI_DEVICE_ID_INTEL_ICH7_31:
                 case PCI_DEVICE_ID_INTEL_ESB2_0:
                         r->name = "PIIX/ICH";
                         r->get = pirq_piix_get;
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 4517d4ab5ef1..9353adc18956 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1411,7 +1411,7 @@ sys_call_table:
         data8 sys_msgrcv
         data8 sys_msgctl
         data8 sys_shmget
-        data8 ia64_shmat
+        data8 sys_shmat
         data8 sys_shmdt                         // 1115
         data8 sys_shmctl
         data8 sys_syslog
diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c
index 55789fcd7210..9e730c7bf0cd 100644
--- a/arch/ia64/kernel/ptrace.c
+++ b/arch/ia64/kernel/ptrace.c
@@ -17,6 +17,7 @@
 #include <linux/user.h>
 #include <linux/security.h>
 #include <linux/audit.h>
+#include <linux/signal.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -704,12 +705,32 @@ convert_to_non_syscall (struct task_struct *child, struct pt_regs  *pt,
                         break;
         }
 
+        /*
+         * Note: at the time of this call, the target task is blocked
+         * in notify_resume_user() and by clearling PRED_LEAVE_SYSCALL
+         * (aka, "pLvSys") we redirect execution from
+         * .work_pending_syscall_end to .work_processed_kernel.
+         */
         unw_get_pr(&prev_info, &pr);
-        pr &= ~(1UL << PRED_SYSCALL);
+        pr &= ~((1UL << PRED_SYSCALL) | (1UL << PRED_LEAVE_SYSCALL));
         pr |=  (1UL << PRED_NON_SYSCALL);
         unw_set_pr(&prev_info, pr);
 
         pt->cr_ifs = (1UL << 63) | cfm;
+        /*
+         * Clear the memory that is NOT written on syscall-entry to
+         * ensure we do not leak kernel-state to user when execution
+         * resumes.
+         */
+        pt->r2 = 0;
+        pt->r3 = 0;
+        pt->r14 = 0;
+        memset(&pt->r16, 0, 16*8);      /* clear r16-r31 */
+        memset(&pt->f6, 0, 6*16);       /* clear f6-f11 */
+        pt->b7 = 0;
+        pt->ar_ccv = 0;
+        pt->ar_csd = 0;
+        pt->ar_ssd = 0;
 }
 
 static int
@@ -1481,7 +1502,7 @@ sys_ptrace (long request, pid_t pid, unsigned long addr, unsigned long data)
               case PTRACE_CONT:
                 /* restart after signal. */
                 ret = -EIO;
-                if (data > _NSIG)
+                if (!valid_signal(data))
                         goto out_tsk;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -1520,7 +1541,7 @@ sys_ptrace (long request, pid_t pid, unsigned long addr, unsigned long data)
                 /* let child execute for one instruction */
               case PTRACE_SINGLEBLOCK:
                 ret = -EIO;
-                if (data > _NSIG)
+                if (!valid_signal(data))
                         goto out_tsk;
 
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
index 3ac216e1c8bb..a8cf6d8a509c 100644
--- a/arch/ia64/kernel/sys_ia64.c
+++ b/arch/ia64/kernel/sys_ia64.c
@@ -93,20 +93,6 @@ sys_getpagesize (void)
 }
 
 asmlinkage unsigned long
-ia64_shmat (int shmid, void __user *shmaddr, int shmflg)
-{
-        unsigned long raddr;
-        int retval;
-
-        retval = do_shmat(shmid, shmaddr, shmflg, &raddr);
-        if (retval < 0)
-                return retval;
-
-        force_successful_syscall_return();
-        return raddr;
-}
-
-asmlinkage unsigned long
 ia64_brk (unsigned long brk)
 {
         unsigned long rlim, retval, newbrk, oldbrk;
diff --git a/arch/m32r/kernel/ptrace.c b/arch/m32r/kernel/ptrace.c
index 8b40f362dd6f..124f7c1b775e 100644
--- a/arch/m32r/kernel/ptrace.c
+++ b/arch/m32r/kernel/ptrace.c
@@ -24,6 +24,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/string.h>
+#include <linux/signal.h>
 
 #include <asm/cacheflush.h>
 #include <asm/io.h>
@@ -665,7 +666,7 @@ do_ptrace(long request, struct task_struct *child, long addr, long data)
         case PTRACE_SYSCALL:
         case PTRACE_CONT:
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -700,7 +701,7 @@ do_ptrace(long request, struct task_struct *child, long addr, long data)
                 unsigned long pc, insn;
 
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 if ((child->ptrace & PT_DTRACE) == 0) {
diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c
index 0beb53333ba3..f4e1e5eb8e12 100644
--- a/arch/m68k/kernel/ptrace.c
+++ b/arch/m68k/kernel/ptrace.c
@@ -19,6 +19,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/config.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -251,7 +252,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                         long tmp;
 
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         if (request == PTRACE_SYSCALL) {
                                         child->thread.work.syscall_trace = ~0;
@@ -292,7 +293,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                         long tmp;
 
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         child->thread.work.syscall_trace = 0;
                         tmp = get_reg(child, PT_SR) | (TRACE_BITS << 16);
diff --git a/arch/m68knommu/kernel/ptrace.c b/arch/m68knommu/kernel/ptrace.c
index 15cf79080b15..9724e1cd82e5 100644
--- a/arch/m68knommu/kernel/ptrace.c
+++ b/arch/m68knommu/kernel/ptrace.c
@@ -19,6 +19,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/config.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -240,7 +241,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                         long tmp;
 
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         if (request == PTRACE_SYSCALL)
                                 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -278,7 +279,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                         long tmp;
 
                         ret = -EIO;
-                        if ((unsigned long) data > _NSIG)
+                        if (!valid_signal(data))
                                 break;
                         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                         tmp = get_reg(child, PT_SR) | (TRACE_BITS << 16);
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 92f2c39afe27..a2f899c2f4d4 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -26,6 +26,7 @@
 #include <linux/smp_lock.h>
 #include <linux/user.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/cpu.h>
 #include <asm/fpu.h>
@@ -257,7 +258,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL) {
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
index 611dee919d50..eee207969c21 100644
--- a/arch/mips/kernel/ptrace32.c
+++ b/arch/mips/kernel/ptrace32.c
@@ -24,6 +24,7 @@
 #include <linux/smp_lock.h>
 #include <linux/user.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/cpu.h>
 #include <asm/fpu.h>
@@ -241,7 +242,7 @@ asmlinkage int sys32_ptrace(int request, int pid, int addr, int data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned int) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL) {
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 598bfe7426a2..ae2a1312d4ef 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -374,22 +374,6 @@ asmlinkage int sys_ipc (uint call, int first, int second,
 }
 
 /*
- * Native ABI that is O32 or N64 version
- */
-asmlinkage long sys_shmat(int shmid, char __user *shmaddr,
-                          int shmflg, unsigned long *addr)
-{
-        unsigned long raddr;
-        int err;
-
-        err = do_shmat(shmid, shmaddr, shmflg, &raddr);
-        if (err)
-                return err;
-
-        return put_user(raddr, addr);
-}
-
-/*
  * No implemented yet ...
  */
 asmlinkage int sys_cachectl(char *addr, int nbytes, int op)
diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
index 2937a9236384..c07db9dff7cd 100644
--- a/arch/parisc/kernel/ptrace.c
+++ b/arch/parisc/kernel/ptrace.c
@@ -17,6 +17,7 @@
 #include <linux/personality.h>
 #include <linux/security.h>
 #include <linux/compat.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -285,7 +286,7 @@ long sys_ptrace(long request, pid_t pid, long addr, long data)
                 ret = -EIO;
                 DBG("sys_ptrace(%s)\n",
                         request == PTRACE_SYSCALL ? "SYSCALL" : "CONT");
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         goto out_tsk;
                 child->ptrace &= ~(PT_SINGLESTEP|PT_BLOCKSTEP);
                 if (request == PTRACE_SYSCALL) {
@@ -311,7 +312,7 @@ long sys_ptrace(long request, pid_t pid, long addr, long data)
         case PTRACE_SINGLEBLOCK:
                 DBG("sys_ptrace(SINGLEBLOCK)\n");
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         goto out_tsk;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 child->ptrace &= ~PT_SINGLESTEP;
@@ -328,7 +329,7 @@ long sys_ptrace(long request, pid_t pid, long addr, long data)
         case PTRACE_SINGLESTEP:
                 DBG("sys_ptrace(SINGLESTEP)\n");
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         goto out_tsk;
 
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 7958cd8c8bf8..d15a1d53e101 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -161,17 +161,6 @@ asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
         }
 }
 
-long sys_shmat_wrapper(int shmid, char __user *shmaddr, int shmflag)
-{
-        unsigned long raddr;
-        int r;
-
-        r = do_shmat(shmid, shmaddr, shmflag, &raddr);
-        if (r < 0)
-                return r;
-        return raddr;
-}
-
 /* Fucking broken ABI */
 
 #ifdef CONFIG_64BIT
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 779b537100ec..dcfa4d3d0e7d 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -297,7 +297,7 @@
         ENTRY_DIFF(msgrcv)
         ENTRY_SAME(msgget)              /* 190 */
         ENTRY_SAME(msgctl)
-        ENTRY_SAME(shmat_wrapper)
+        ENTRY_SAME(shmat)
         ENTRY_SAME(shmdt)
         ENTRY_SAME(shmget)
         ENTRY_SAME(shmctl)              /* 195 */
diff --git a/arch/ppc/Kconfig b/arch/ppc/Kconfig
index 74aa1e92a395..c3d941345e3d 100644
--- a/arch/ppc/Kconfig
+++ b/arch/ppc/Kconfig
@@ -53,6 +53,7 @@ choice
 
 config 6xx
         bool "6xx/7xx/74xx/52xx/82xx/83xx"
+        select PPC_FPU
         help
           There are four types of PowerPC chips supported.  The more common
           types (601, 603, 604, 740, 750, 7400), the Motorola embedded
@@ -86,6 +87,9 @@ config E500
 
 endchoice
 
+config PPC_FPU
+        bool
+
 config BOOKE
         bool
         depends on E500
diff --git a/arch/ppc/Makefile b/arch/ppc/Makefile
index 73cbdda5b597..0432a25b4735 100644
--- a/arch/ppc/Makefile
+++ b/arch/ppc/Makefile
@@ -53,6 +53,7 @@ head-$(CONFIG_FSL_BOOKE)	:= arch/ppc/kernel/head_fsl_booke.o
 
 head-$(CONFIG_6xx)              += arch/ppc/kernel/idle_6xx.o
 head-$(CONFIG_POWER4)           += arch/ppc/kernel/idle_power4.o
+head-$(CONFIG_PPC_FPU)          += arch/ppc/kernel/fpu.o
 
 core-y                          += arch/ppc/kernel/ arch/ppc/platforms/ \
                                    arch/ppc/mm/ arch/ppc/lib/ arch/ppc/syslib/
diff --git a/arch/ppc/boot/images/Makefile b/arch/ppc/boot/images/Makefile
index 774de8e23871..f850fb0fb511 100644
--- a/arch/ppc/boot/images/Makefile
+++ b/arch/ppc/boot/images/Makefile
@@ -20,8 +20,9 @@ quiet_cmd_uimage = UIMAGE  $@
 
 targets += uImage
 $(obj)/uImage: $(obj)/vmlinux.gz
+        $(Q)rm -f $@
         $(call if_changed,uimage)
-        @echo '  Image $@ is ready'
+        @echo '  Image: $@' $(if $(wildcard $@),'is ready','not made')
 
 # Files generated that shall be removed upon make clean
 clean-files     := sImage vmapus vmlinux* miboot* zImage* uImage
diff --git a/arch/ppc/kernel/Makefile b/arch/ppc/kernel/Makefile
index 86bc878cb3ee..b284451802c9 100644
--- a/arch/ppc/kernel/Makefile
+++ b/arch/ppc/kernel/Makefile
@@ -9,6 +9,7 @@ extra-$(CONFIG_FSL_BOOKE)	:= head_fsl_booke.o
 extra-$(CONFIG_8xx)             := head_8xx.o
 extra-$(CONFIG_6xx)             += idle_6xx.o
 extra-$(CONFIG_POWER4)          += idle_power4.o
+extra-$(CONFIG_PPC_FPU)         += fpu.o
 extra-y                         += vmlinux.lds
 
 obj-y                           := entry.o traps.o irq.o idle.o time.o misc.o \
diff --git a/arch/ppc/kernel/align.c b/arch/ppc/kernel/align.c
index 79c929475037..ff81da9598d8 100644
--- a/arch/ppc/kernel/align.c
+++ b/arch/ppc/kernel/align.c
@@ -290,6 +290,10 @@ fix_alignment(struct pt_regs *regs)
                         /* lwm, stmw */
                         nb = (32 - reg) * 4;
                 }
+
+                if (!access_ok((flags & ST? VERIFY_WRITE: VERIFY_READ), addr, nb+nb0))
+                        return -EFAULT; /* bad address */
+
                 rptr = (unsigned char *) &regs->gpr[reg];
                 if (flags & LD) {
                         for (i = 0; i < nb; ++i)
@@ -368,16 +372,24 @@ fix_alignment(struct pt_regs *regs)
 
         /* Single-precision FP load and store require conversions... */
         case LD+F+S:
+#ifdef CONFIG_PPC_FPU
                 preempt_disable();
                 enable_kernel_fp();
                 cvt_fd(&data.f, &data.d, &current->thread.fpscr);
                 preempt_enable();
+#else
+                return 0;
+#endif
                 break;
         case ST+F+S:
+#ifdef CONFIG_PPC_FPU
                 preempt_disable();
                 enable_kernel_fp();
                 cvt_df(&data.d, &data.f, &current->thread.fpscr);
                 preempt_enable();
+#else
+                return 0;
+#endif
                 break;
         }
 
diff --git a/arch/ppc/kernel/cpu_setup_6xx.S b/arch/ppc/kernel/cpu_setup_6xx.S
index 74f781b486a3..468721d9ebd2 100644
--- a/arch/ppc/kernel/cpu_setup_6xx.S
+++ b/arch/ppc/kernel/cpu_setup_6xx.S
@@ -30,12 +30,14 @@ _GLOBAL(__setup_cpu_604)
         blr
 _GLOBAL(__setup_cpu_750)
         mflr    r4
+        bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         mtlr    r4
         blr
 _GLOBAL(__setup_cpu_750cx)
         mflr    r4
+        bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750cx
@@ -43,6 +45,7 @@ _GLOBAL(__setup_cpu_750cx)
         blr
 _GLOBAL(__setup_cpu_750fx)
         mflr    r4
+        bl      __init_fpu_registers
         bl      setup_common_caches
         bl      setup_750_7400_hid0
         bl      setup_750fx
@@ -50,6 +53,7 @@ _GLOBAL(__setup_cpu_750fx)
         blr
 _GLOBAL(__setup_cpu_7400)
         mflr    r4
+        bl      __init_fpu_registers
         bl      setup_7400_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
@@ -57,6 +61,7 @@ _GLOBAL(__setup_cpu_7400)
         blr
 _GLOBAL(__setup_cpu_7410)
         mflr    r4
+        bl      __init_fpu_registers
         bl      setup_7410_workarounds
         bl      setup_common_caches
         bl      setup_750_7400_hid0
@@ -80,7 +85,7 @@ setup_common_caches:
         bne     1f                      /* don't invalidate the D-cache */
         ori     r8,r8,HID0_DCI          /* unless it wasn't enabled */
 1:      sync
-        mtspr   SPRN_HID0,r8                    /* enable and invalidate caches */
+        mtspr   SPRN_HID0,r8            /* enable and invalidate caches */
         sync
         mtspr   SPRN_HID0,r11           /* enable caches */
         sync
@@ -152,9 +157,13 @@ setup_7410_workarounds:
 setup_750_7400_hid0:
         mfspr   r11,SPRN_HID0
         ori     r11,r11,HID0_SGE | HID0_ABE | HID0_BHTE | HID0_BTIC
+        oris    r11,r11,HID0_DPM@h
 BEGIN_FTR_SECTION
-        oris    r11,r11,HID0_DPM@h      /* enable dynamic power mgmt */
-END_FTR_SECTION_IFCLR(CPU_FTR_NO_DPM)
+        xori    r11,r11,HID0_BTIC
+END_FTR_SECTION_IFSET(CPU_FTR_NO_BTIC)
+BEGIN_FTR_SECTION
+        xoris   r11,r11,HID0_DPM@h      /* disable dynamic power mgmt */
+END_FTR_SECTION_IFSET(CPU_FTR_NO_DPM)
         li      r3,HID0_SPD
         andc    r11,r11,r3              /* clear SPD: enable speculative */
         li      r3,0
@@ -218,13 +227,15 @@ setup_745x_specifics:
 
         /* All of the bits we have to set.....
          */
-        ori     r11,r11,HID0_SGE | HID0_FOLD | HID0_BHTE | HID0_LRSTK | HID0_BTIC
+        ori     r11,r11,HID0_SGE | HID0_FOLD | HID0_BHTE
+        ori     r11,r11,HID0_LRSTK | HID0_BTIC
+        oris    r11,r11,HID0_DPM@h
 BEGIN_FTR_SECTION
         xori    r11,r11,HID0_BTIC
 END_FTR_SECTION_IFSET(CPU_FTR_NO_BTIC)
 BEGIN_FTR_SECTION
-        oris    r11,r11,HID0_DPM@h      /* enable dynamic power mgmt */
-END_FTR_SECTION_IFCLR(CPU_FTR_NO_DPM)
+        xoris   r11,r11,HID0_DPM@h      /* disable dynamic power mgmt */
+END_FTR_SECTION_IFSET(CPU_FTR_NO_DPM)
 
         /* All of the bits we have to clear....
          */
@@ -248,6 +259,25 @@ END_FTR_SECTION_IFCLR(CPU_FTR_NO_DPM)
         isync
         blr
 
+/*
+ * Initialize the FPU registers. This is needed to work around an errata
+ * in some 750 cpus where using a not yet initialized FPU register after
+ * power on reset may hang the CPU
+ */
+_GLOBAL(__init_fpu_registers)
+        mfmsr   r10
+        ori     r11,r10,MSR_FP
+        mtmsr   r11
+        isync
+        addis   r9,r3,empty_zero_page@ha
+        addi    r9,r9,empty_zero_page@l
+        REST_32FPRS(0,r9)
+        sync
+        mtmsr   r10
+        isync
+        blr
+
+
 /* Definitions for the table use to save CPU states */
 #define CS_HID0         0
 #define CS_HID1         4
diff --git a/arch/ppc/kernel/entry.S b/arch/ppc/kernel/entry.S
index 035217d6c0f1..5f075dbc4ee7 100644
--- a/arch/ppc/kernel/entry.S
+++ b/arch/ppc/kernel/entry.S
@@ -563,6 +563,65 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
         addi    r1,r1,INT_FRAME_SIZE
         blr
 
+        .globl  fast_exception_return
+fast_exception_return:
+#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
+        andi.   r10,r9,MSR_RI           /* check for recoverable interrupt */
+        beq     1f                      /* if not, we've got problems */
+#endif
+
+2:      REST_4GPRS(3, r11)
+        lwz     r10,_CCR(r11)
+        REST_GPR(1, r11)
+        mtcr    r10
+        lwz     r10,_LINK(r11)
+        mtlr    r10
+        REST_GPR(10, r11)
+        mtspr   SPRN_SRR1,r9
+        mtspr   SPRN_SRR0,r12
+        REST_GPR(9, r11)
+        REST_GPR(12, r11)
+        lwz     r11,GPR11(r11)
+        SYNC
+        RFI
+
+#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
+/* check if the exception happened in a restartable section */
+1:      lis     r3,exc_exit_restart_end@ha
+        addi    r3,r3,exc_exit_restart_end@l
+        cmplw   r12,r3
+        bge     3f
+        lis     r4,exc_exit_restart@ha
+        addi    r4,r4,exc_exit_restart@l
+        cmplw   r12,r4
+        blt     3f
+        lis     r3,fee_restarts@ha
+        tophys(r3,r3)
+        lwz     r5,fee_restarts@l(r3)
+        addi    r5,r5,1
+        stw     r5,fee_restarts@l(r3)
+        mr      r12,r4          /* restart at exc_exit_restart */
+        b       2b
+
+        .comm   fee_restarts,4
+
+/* aargh, a nonrecoverable interrupt, panic */
+/* aargh, we don't know which trap this is */
+/* but the 601 doesn't implement the RI bit, so assume it's OK */
+3:
+BEGIN_FTR_SECTION
+        b       2b
+END_FTR_SECTION_IFSET(CPU_FTR_601)
+        li      r10,-1
+        stw     r10,TRAP(r11)
+        addi    r3,r1,STACK_FRAME_OVERHEAD
+        lis     r10,MSR_KERNEL@h
+        ori     r10,r10,MSR_KERNEL@l
+        bl      transfer_to_handler_full
+        .long   nonrecoverable_exception
+        .long   ret_from_except
+#endif
+
         .globl  sigreturn_exit
 sigreturn_exit:
         subi    r1,r3,STACK_FRAME_OVERHEAD
diff --git a/arch/ppc/kernel/fpu.S b/arch/ppc/kernel/fpu.S
new file mode 100644
index 000000000000..6189b26f640f
--- /dev/null
+++ b/arch/ppc/kernel/fpu.S
@@ -0,0 +1,133 @@
+/*
+ *  FPU support code, moved here from head.S so that it can be used
+ *  by chips which use other head-whatever.S files.
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <linux/config.h>
+#include <asm/processor.h>
+#include <asm/page.h>
+#include <asm/mmu.h>
+#include <asm/pgtable.h>
+#include <asm/cputable.h>
+#include <asm/cache.h>
+#include <asm/thread_info.h>
+#include <asm/ppc_asm.h>
+#include <asm/offsets.h>
+
+/*
+ * This task wants to use the FPU now.
+ * On UP, disable FP for the task which had the FPU previously,
+ * and save its floating-point registers in its thread_struct.
+ * Load up this task's FP registers from its thread_struct,
+ * enable the FPU for the current task and return to the task.
+ */
+        .globl  load_up_fpu
+load_up_fpu:
+        mfmsr   r5
+        ori     r5,r5,MSR_FP
+#ifdef CONFIG_PPC64BRIDGE
+        clrldi  r5,r5,1                 /* turn off 64-bit mode */
+#endif /* CONFIG_PPC64BRIDGE */
+        SYNC
+        MTMSRD(r5)                      /* enable use of fpu now */
+        isync
+/*
+ * For SMP, we don't do lazy FPU switching because it just gets too
+ * horrendously complex, especially when a task switches from one CPU
+ * to another.  Instead we call giveup_fpu in switch_to.
+ */
+#ifndef CONFIG_SMP
+        tophys(r6,0)                    /* get __pa constant */
+        addis   r3,r6,last_task_used_math@ha
+        lwz     r4,last_task_used_math@l(r3)
+        cmpwi   0,r4,0
+        beq     1f
+        add     r4,r4,r6
+        addi    r4,r4,THREAD            /* want last_task_used_math->thread */
+        SAVE_32FPRS(0, r4)
+        mffs    fr0
+        stfd    fr0,THREAD_FPSCR-4(r4)
+        lwz     r5,PT_REGS(r4)
+        add     r5,r5,r6
+        lwz     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+        li      r10,MSR_FP|MSR_FE0|MSR_FE1
+        andc    r4,r4,r10               /* disable FP for previous task */
+        stw     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+1:
+#endif /* CONFIG_SMP */
+        /* enable use of FP after return */
+        mfspr   r5,SPRN_SPRG3           /* current task's THREAD (phys) */
+        lwz     r4,THREAD_FPEXC_MODE(r5)
+        ori     r9,r9,MSR_FP            /* enable FP for current */
+        or      r9,r9,r4
+        lfd     fr0,THREAD_FPSCR-4(r5)
+        mtfsf   0xff,fr0
+        REST_32FPRS(0, r5)
+#ifndef CONFIG_SMP
+        subi    r4,r5,THREAD
+        sub     r4,r4,r6
+        stw     r4,last_task_used_math@l(r3)
+#endif /* CONFIG_SMP */
+        /* restore registers and return */
+        /* we haven't used ctr or xer or lr */
+        b       fast_exception_return
+
+/*
+ * FP unavailable trap from kernel - print a message, but let
+ * the task use FP in the kernel until it returns to user mode.
+ */
+        .globl  KernelFP
+KernelFP:
+        lwz     r3,_MSR(r1)
+        ori     r3,r3,MSR_FP
+        stw     r3,_MSR(r1)             /* enable use of FP after return */
+        lis     r3,86f@h
+        ori     r3,r3,86f@l
+        mr      r4,r2                   /* current */
+        lwz     r5,_NIP(r1)
+        bl      printk
+        b       ret_from_except
+86:     .string "floating point used in kernel (task=%p, pc=%x)\n"
+        .align  4,0
+
+/*
+ * giveup_fpu(tsk)
+ * Disable FP for the task given as the argument,
+ * and save the floating-point registers in its thread_struct.
+ * Enables the FPU for use in the kernel on return.
+ */
+        .globl  giveup_fpu
+giveup_fpu:
+        mfmsr   r5
+        ori     r5,r5,MSR_FP
+        SYNC_601
+        ISYNC_601
+        MTMSRD(r5)                      /* enable use of fpu now */
+        SYNC_601
+        isync
+        cmpwi   0,r3,0
+        beqlr-                          /* if no previous owner, done */
+        addi    r3,r3,THREAD            /* want THREAD of task */
+        lwz     r5,PT_REGS(r3)
+        cmpwi   0,r5,0
+        SAVE_32FPRS(0, r3)
+        mffs    fr0
+        stfd    fr0,THREAD_FPSCR-4(r3)
+        beq     1f
+        lwz     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+        li      r3,MSR_FP|MSR_FE0|MSR_FE1
+        andc    r4,r4,r3                /* disable FP for previous task */
+        stw     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
+1:
+#ifndef CONFIG_SMP
+        li      r5,0
+        lis     r4,last_task_used_math@ha
+        stw     r5,last_task_used_math@l(r4)
+#endif /* CONFIG_SMP */
+        blr
diff --git a/arch/ppc/kernel/head.S b/arch/ppc/kernel/head.S
index 1a89a71e0acc..a931d773715f 100644
--- a/arch/ppc/kernel/head.S
+++ b/arch/ppc/kernel/head.S
@@ -775,133 +775,6 @@ InstructionSegment:
         EXC_XFER_STD(0x480, UnknownException)
 #endif /* CONFIG_PPC64BRIDGE */
 
-/*
- * This task wants to use the FPU now.
- * On UP, disable FP for the task which had the FPU previously,
- * and save its floating-point registers in its thread_struct.
- * Load up this task's FP registers from its thread_struct,
- * enable the FPU for the current task and return to the task.
- */
-load_up_fpu:
-        mfmsr   r5
-        ori     r5,r5,MSR_FP
-#ifdef CONFIG_PPC64BRIDGE
-        clrldi  r5,r5,1                 /* turn off 64-bit mode */
-#endif /* CONFIG_PPC64BRIDGE */
-        SYNC
-        MTMSRD(r5)                      /* enable use of fpu now */
-        isync
-/*
- * For SMP, we don't do lazy FPU switching because it just gets too
- * horrendously complex, especially when a task switches from one CPU
- * to another.  Instead we call giveup_fpu in switch_to.
- */
-#ifndef CONFIG_SMP
-        tophys(r6,0)                    /* get __pa constant */
-        addis   r3,r6,last_task_used_math@ha
-        lwz     r4,last_task_used_math@l(r3)
-        cmpwi   0,r4,0
-        beq     1f
-        add     r4,r4,r6
-        addi    r4,r4,THREAD            /* want last_task_used_math->thread */
-        SAVE_32FPRS(0, r4)
-        mffs    fr0
-        stfd    fr0,THREAD_FPSCR-4(r4)
-        lwz     r5,PT_REGS(r4)
-        add     r5,r5,r6
-        lwz     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-        li      r10,MSR_FP|MSR_FE0|MSR_FE1
-        andc    r4,r4,r10               /* disable FP for previous task */
-        stw     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-1:
-#endif /* CONFIG_SMP */
-        /* enable use of FP after return */
-        mfspr   r5,SPRN_SPRG3           /* current task's THREAD (phys) */
-        lwz     r4,THREAD_FPEXC_MODE(r5)
-        ori     r9,r9,MSR_FP            /* enable FP for current */
-        or      r9,r9,r4
-        lfd     fr0,THREAD_FPSCR-4(r5)
-        mtfsf   0xff,fr0
-        REST_32FPRS(0, r5)
-#ifndef CONFIG_SMP
-        subi    r4,r5,THREAD
-        sub     r4,r4,r6
-        stw     r4,last_task_used_math@l(r3)
-#endif /* CONFIG_SMP */
-        /* restore registers and return */
-        /* we haven't used ctr or xer or lr */
-        /* fall through to fast_exception_return */
-
-        .globl  fast_exception_return
-fast_exception_return:
-        andi.   r10,r9,MSR_RI           /* check for recoverable interrupt */
-        beq     1f                      /* if not, we've got problems */
-2:      REST_4GPRS(3, r11)
-        lwz     r10,_CCR(r11)
-        REST_GPR(1, r11)
-        mtcr    r10
-        lwz     r10,_LINK(r11)
-        mtlr    r10
-        REST_GPR(10, r11)
-        mtspr   SPRN_SRR1,r9
-        mtspr   SPRN_SRR0,r12
-        REST_GPR(9, r11)
-        REST_GPR(12, r11)
-        lwz     r11,GPR11(r11)
-        SYNC
-        RFI
-
-/* check if the exception happened in a restartable section */
-1:      lis     r3,exc_exit_restart_end@ha
-        addi    r3,r3,exc_exit_restart_end@l
-        cmplw   r12,r3
-        bge     3f
-        lis     r4,exc_exit_restart@ha
-        addi    r4,r4,exc_exit_restart@l
-        cmplw   r12,r4
-        blt     3f
-        lis     r3,fee_restarts@ha
-        tophys(r3,r3)
-        lwz     r5,fee_restarts@l(r3)
-        addi    r5,r5,1
-        stw     r5,fee_restarts@l(r3)
-        mr      r12,r4          /* restart at exc_exit_restart */
-        b       2b
-
-        .comm   fee_restarts,4
-
-/* aargh, a nonrecoverable interrupt, panic */
-/* aargh, we don't know which trap this is */
-/* but the 601 doesn't implement the RI bit, so assume it's OK */
-3:
-BEGIN_FTR_SECTION
-        b       2b
-END_FTR_SECTION_IFSET(CPU_FTR_601)
-        li      r10,-1
-        stw     r10,TRAP(r11)
-        addi    r3,r1,STACK_FRAME_OVERHEAD
-        li      r10,MSR_KERNEL
-        bl      transfer_to_handler_full
-        .long   nonrecoverable_exception
-        .long   ret_from_except
-
-/*
- * FP unavailable trap from kernel - print a message, but let
- * the task use FP in the kernel until it returns to user mode.
- */
-KernelFP:
-        lwz     r3,_MSR(r1)
-        ori     r3,r3,MSR_FP
-        stw     r3,_MSR(r1)             /* enable use of FP after return */
-        lis     r3,86f@h
-        ori     r3,r3,86f@l
-        mr      r4,r2                   /* current */
-        lwz     r5,_NIP(r1)
-        bl      printk
-        b       ret_from_except
-86:     .string "floating point used in kernel (task=%p, pc=%x)\n"
-        .align  4,0
-
 #ifdef CONFIG_ALTIVEC
 /* Note that the AltiVec support is closely modeled after the FP
  * support.  Changes to one are likely to be applicable to the
@@ -1016,42 +889,6 @@ giveup_altivec:
 #endif /* CONFIG_ALTIVEC */
 
 /*
- * giveup_fpu(tsk)
- * Disable FP for the task given as the argument,
- * and save the floating-point registers in its thread_struct.
- * Enables the FPU for use in the kernel on return.
- */
-        .globl  giveup_fpu
-giveup_fpu:
-        mfmsr   r5
-        ori     r5,r5,MSR_FP
-        SYNC_601
-        ISYNC_601
-        MTMSRD(r5)                      /* enable use of fpu now */
-        SYNC_601
-        isync
-        cmpwi   0,r3,0
-        beqlr-                          /* if no previous owner, done */
-        addi    r3,r3,THREAD            /* want THREAD of task */
-        lwz     r5,PT_REGS(r3)
-        cmpwi   0,r5,0
-        SAVE_32FPRS(0, r3)
-        mffs    fr0
-        stfd    fr0,THREAD_FPSCR-4(r3)
-        beq     1f
-        lwz     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-        li      r3,MSR_FP|MSR_FE0|MSR_FE1
-        andc    r4,r4,r3                /* disable FP for previous task */
-        stw     r4,_MSR-STACK_FRAME_OVERHEAD(r5)
-1:
-#ifndef CONFIG_SMP
-        li      r5,0
-        lis     r4,last_task_used_math@ha
-        stw     r5,last_task_used_math@l(r4)
-#endif /* CONFIG_SMP */
-        blr
-
-/*
  * This code is jumped to from the startup code to copy
  * the kernel image to physical address 0.
  */
diff --git a/arch/ppc/kernel/head_44x.S b/arch/ppc/kernel/head_44x.S
index 9ed8165a3d6c..9b6a8e513657 100644
--- a/arch/ppc/kernel/head_44x.S
+++ b/arch/ppc/kernel/head_44x.S
@@ -426,7 +426,11 @@ interrupt_base:
         PROGRAM_EXCEPTION
 
         /* Floating Point Unavailable Interrupt */
+#ifdef CONFIG_PPC_FPU
+        FP_UNAVAILABLE_EXCEPTION
+#else
         EXCEPTION(0x2010, FloatingPointUnavailable, UnknownException, EXC_XFER_EE)
+#endif
 
         /* System Call Interrupt */
         START_EXCEPTION(SystemCall)
@@ -686,8 +690,10 @@ _GLOBAL(giveup_altivec)
  *
  * The 44x core does not have an FPU.
  */
+#ifndef CONFIG_PPC_FPU
 _GLOBAL(giveup_fpu)
         blr
+#endif
 
 /*
  * extern void abort(void)
diff --git a/arch/ppc/kernel/head_booke.h b/arch/ppc/kernel/head_booke.h
index 884dac916bce..f213d12eec08 100644
--- a/arch/ppc/kernel/head_booke.h
+++ b/arch/ppc/kernel/head_booke.h
@@ -337,4 +337,11 @@ label:
         addi    r3,r1,STACK_FRAME_OVERHEAD;                                   \
         EXC_XFER_LITE(0x0900, timer_interrupt)
 
+#define FP_UNAVAILABLE_EXCEPTION                                              \
+        START_EXCEPTION(FloatingPointUnavailable)                             \
+        NORMAL_EXCEPTION_PROLOG;                                              \
+        bne     load_up_fpu;            /* if from user, just load it up */   \
+        addi    r3,r1,STACK_FRAME_OVERHEAD;                                   \
+        EXC_XFER_EE_LITE(0x800, KernelFP)
+
 #endif /* __HEAD_BOOKE_H__ */
diff --git a/arch/ppc/kernel/head_fsl_booke.S b/arch/ppc/kernel/head_fsl_booke.S
index d64bf61d2b1f..f22ddce36135 100644
--- a/arch/ppc/kernel/head_fsl_booke.S
+++ b/arch/ppc/kernel/head_fsl_booke.S
@@ -504,7 +504,11 @@ interrupt_base:
         PROGRAM_EXCEPTION
 
         /* Floating Point Unavailable Interrupt */
+#ifdef CONFIG_PPC_FPU
+        FP_UNAVAILABLE_EXCEPTION
+#else
         EXCEPTION(0x0800, FloatingPointUnavailable, UnknownException, EXC_XFER_EE)
+#endif
 
         /* System Call Interrupt */
         START_EXCEPTION(SystemCall)
@@ -916,10 +920,12 @@ _GLOBAL(giveup_spe)
 /*
  * extern void giveup_fpu(struct task_struct *prev)
  *
- * The e500 core does not have an FPU.
+ * Not all FSL Book-E cores have an FPU
  */
+#ifndef CONFIG_PPC_FPU
 _GLOBAL(giveup_fpu)
         blr
+#endif
 
 /*
  * extern void abort(void)
diff --git a/arch/ppc/kernel/misc.S b/arch/ppc/kernel/misc.S
index 73f7c23b0dd4..e4f1615ec13f 100644
--- a/arch/ppc/kernel/misc.S
+++ b/arch/ppc/kernel/misc.S
@@ -1096,17 +1096,7 @@ _GLOBAL(_get_SP)
  * and exceptions as if the cpu had performed the load or store.
  */
 
-#if defined(CONFIG_4xx) || defined(CONFIG_E500)
-_GLOBAL(cvt_fd)
-        lfs     0,0(r3)
-        stfd    0,0(r4)
-        blr
-
-_GLOBAL(cvt_df)
-        lfd     0,0(r3)
-        stfs    0,0(r4)
-        blr
-#else
+#ifdef CONFIG_PPC_FPU
 _GLOBAL(cvt_fd)
         lfd     0,-4(r5)        /* load up fpscr value */
         mtfsf   0xff,0
diff --git a/arch/ppc/kernel/ptrace.c b/arch/ppc/kernel/ptrace.c
index 426b6f7d9de3..59d59a8dc249 100644
--- a/arch/ppc/kernel/ptrace.c
+++ b/arch/ppc/kernel/ptrace.c
@@ -26,6 +26,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -356,7 +357,7 @@ int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL) {
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -389,7 +390,7 @@ int sys_ptrace(long request, long pid, long addr, long data)
 
         case PTRACE_SINGLESTEP: {  /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 set_single_step(child);
diff --git a/arch/ppc/kernel/traps.c b/arch/ppc/kernel/traps.c
index 361865c4bc84..f8e7e324a173 100644
--- a/arch/ppc/kernel/traps.c
+++ b/arch/ppc/kernel/traps.c
@@ -176,7 +176,7 @@ static inline int check_io_access(struct pt_regs *regs)
 #else
 #define get_mc_reason(regs)     (mfspr(SPRN_MCSR))
 #endif
-#define REASON_FP               0
+#define REASON_FP               ESR_FP
 #define REASON_ILLEGAL          ESR_PIL
 #define REASON_PRIVILEGED       ESR_PPR
 #define REASON_TRAP             ESR_PTR
diff --git a/arch/ppc/platforms/pmac_cache.S b/arch/ppc/platforms/pmac_cache.S
index da34a9bc9299..fb977de6b704 100644
--- a/arch/ppc/platforms/pmac_cache.S
+++ b/arch/ppc/platforms/pmac_cache.S
@@ -64,27 +64,39 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
         mtspr   SPRN_HID0,r4            /* Disable DPM */
         sync
 
-        /* disp-flush L1 */
-        li      r4,0x4000
-        mtctr   r4
+        /* Disp-flush L1. We have a weird problem here that I never
+         * totally figured out. On 750FX, using the ROM for the flush
+         * results in a non-working flush. We use that workaround for
+         * now until I finally understand what's going on. --BenH
+         */
+
+        /* ROM base by default */
         lis     r4,0xfff0
-1:      lwzx    r0,r0,r4
+        mfpvr   r3
+        srwi    r3,r3,16
+        cmplwi  cr0,r3,0x7000
+        bne+    1f
+        /* RAM base on 750FX */
+        li      r4,0
+1:      li      r4,0x4000
+        mtctr   r4
+1:      lwz     r0,0(r4)
         addi    r4,r4,32
         bdnz    1b
         sync
         isync
 
-        /* disable / invalidate / enable L1 data */
+        /* Disable / invalidate / enable L1 data */
         mfspr   r3,SPRN_HID0
-        rlwinm  r0,r0,0,~HID0_DCE
+        rlwinm  r3,r3,0,~(HID0_DCE | HID0_ICE)
         mtspr   SPRN_HID0,r3
         sync
         isync
-        ori     r3,r3,HID0_DCE|HID0_DCI
+        ori     r3,r3,(HID0_DCE|HID0_DCI|HID0_ICE|HID0_ICFI)
         sync
         isync
         mtspr   SPRN_HID0,r3
-        xori    r3,r3,HID0_DCI
+        xori    r3,r3,(HID0_DCI|HID0_ICFI)
         mtspr   SPRN_HID0,r3
         sync
 
@@ -110,11 +122,20 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
         lis     r4,2
         mtctr   r4
         lis     r4,0xfff0
-1:      lwzx    r0,r0,r4
+1:      lwz     r0,0(r4)
+        addi    r4,r4,32
+        bdnz    1b
+        sync
+        isync
+        lis     r4,2
+        mtctr   r4
+        lis     r4,0xfff0
+1:      dcbf    0,r4
         addi    r4,r4,32
         bdnz    1b
         sync
         isync
+
         /* now disable L2 */
         rlwinm  r5,r5,0,~L2CR_L2E
         b       2f
@@ -135,6 +156,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
         mtspr   SPRN_L2CR,r4
         sync
         isync
+
+        /* Wait for the invalidation to complete */
+1:      mfspr   r3,SPRN_L2CR
+        rlwinm. r0,r3,0,31,31
+        bne     1b
+
+        /* Clear L2I */
         xoris   r4,r4,L2CR_L2I@h
         sync
         mtspr   SPRN_L2CR,r4
@@ -142,14 +170,16 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 
         /* now disable the L1 data cache */
         mfspr   r0,SPRN_HID0
-        rlwinm  r0,r0,0,~HID0_DCE
+        rlwinm  r0,r0,0,~(HID0_DCE|HID0_ICE)
         mtspr   SPRN_HID0,r0
         sync
         isync
 
         /* Restore HID0[DPM] to whatever it was before */
         sync
-        mtspr   SPRN_HID0,r8
+        mfspr   r0,SPRN_HID0
+        rlwimi  r0,r8,0,11,11           /* Turn back HID0[DPM] */
+        mtspr   SPRN_HID0,r0
         sync
 
         /* restore DR and EE */
@@ -201,7 +231,7 @@ flush_disable_745x:
         mtctr   r4
         li      r4,0
 1:
-        lwzx    r0,r0,r4
+        lwz     r0,0(r4)
         addi    r4,r4,32                /* Go to start of next cache line */
         bdnz    1b
         isync
diff --git a/arch/ppc/platforms/pmac_feature.c b/arch/ppc/platforms/pmac_feature.c
index 46cbf36722db..867336ad5d36 100644
--- a/arch/ppc/platforms/pmac_feature.c
+++ b/arch/ppc/platforms/pmac_feature.c
@@ -1590,6 +1590,114 @@ intrepid_shutdown(struct macio_chip* macio, int sleep_mode)
         mdelay(10);
 }
 
+
+void __pmac pmac_tweak_clock_spreading(int enable)
+{
+        struct macio_chip* macio = &macio_chips[0];
+
+        /* Hack for doing clock spreading on some machines PowerBooks and
+         * iBooks. This implements the "platform-do-clockspreading" OF
+         * property as decoded manually on various models. For safety, we also
+         * check the product ID in the device-tree in cases we'll whack the i2c
+         * chip to make reasonably sure we won't set wrong values in there
+         *
+         * Of course, ultimately, we have to implement a real parser for
+         * the platform-do-* stuff...
+         */
+
+        if (macio->type == macio_intrepid) {
+                if (enable)
+                        UN_OUT(UNI_N_CLOCK_SPREADING, 2);
+                else
+                        UN_OUT(UNI_N_CLOCK_SPREADING, 0);
+                mdelay(40);
+        }
+
+        while (machine_is_compatible("PowerBook5,2") ||
+               machine_is_compatible("PowerBook5,3") ||
+               machine_is_compatible("PowerBook6,2") ||
+               machine_is_compatible("PowerBook6,3")) {
+                struct device_node *ui2c = of_find_node_by_type(NULL, "i2c");
+                struct device_node *dt = of_find_node_by_name(NULL, "device-tree");
+                u8 buffer[9];
+                u32 *productID;
+                int i, rc, changed = 0;
+
+                if (dt == NULL)
+                        break;
+                productID = (u32 *)get_property(dt, "pid#", NULL);
+                if (productID == NULL)
+                        break;
+                while(ui2c) {
+                        struct device_node *p = of_get_parent(ui2c);
+                        if (p && !strcmp(p->name, "uni-n"))
+                                break;
+                        ui2c = of_find_node_by_type(ui2c, "i2c");
+                }
+                if (ui2c == NULL)
+                        break;
+                DBG("Trying to bump clock speed for PID: %08x...\n", *productID);
+                rc = pmac_low_i2c_open(ui2c, 1);
+                if (rc != 0)
+                        break;
+                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_combined);
+                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_read, 0x80, buffer, 9);
+                DBG("read result: %d,", rc);
+                if (rc != 0) {
+                        pmac_low_i2c_close(ui2c);
+                        break;
+                }
+                for (i=0; i<9; i++)
+                        DBG(" %02x", buffer[i]);
+                DBG("\n");
+
+                switch(*productID) {
+                case 0x1182:    /* AlBook 12" rev 2 */
+                case 0x1183:    /* iBook G4 12" */
+                        buffer[0] = (buffer[0] & 0x8f) | 0x70;
+                        buffer[2] = (buffer[2] & 0x7f) | 0x00;
+                        buffer[5] = (buffer[5] & 0x80) | 0x31;
+                        buffer[6] = (buffer[6] & 0x40) | 0xb0;
+                        buffer[7] = (buffer[7] & 0x00) | (enable ? 0xc0 : 0xba);
+                        buffer[8] = (buffer[8] & 0x00) | 0x30;
+                        changed = 1;
+                        break;
+                case 0x3142:    /* AlBook 15" (ATI M10) */
+                case 0x3143:    /* AlBook 17" (ATI M10) */
+                        buffer[0] = (buffer[0] & 0xaf) | 0x50;
+                        buffer[2] = (buffer[2] & 0x7f) | 0x00;
+                        buffer[5] = (buffer[5] & 0x80) | 0x31;
+                        buffer[6] = (buffer[6] & 0x40) | 0xb0;
+                        buffer[7] = (buffer[7] & 0x00) | (enable ? 0xd0 : 0xc0);
+                        buffer[8] = (buffer[8] & 0x00) | 0x30;
+                        changed = 1;
+                        break;
+                default:
+                        DBG("i2c-hwclock: Machine model not handled\n");
+                        break;
+                }
+                if (!changed) {
+                        pmac_low_i2c_close(ui2c);
+                        break;
+                }
+                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_stdsub);
+                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_write, 0x80, buffer, 9);
+                DBG("write result: %d,", rc);
+                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_combined);
+                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_read, 0x80, buffer, 9);
+                DBG("read result: %d,", rc);
+                if (rc != 0) {
+                        pmac_low_i2c_close(ui2c);
+                        break;
+                }
+                for (i=0; i<9; i++)
+                        DBG(" %02x", buffer[i]);
+                pmac_low_i2c_close(ui2c);
+                break;
+        }
+}
+
+
 static int __pmac
 core99_sleep(void)
 {
@@ -1601,12 +1709,6 @@ core99_sleep(void)
             macio->type != macio_intrepid)
                 return -ENODEV;
 
-        /* The device-tree contains that in the hwclock node */
-        if (macio->type == macio_intrepid) {
-                UN_OUT(UNI_N_CLOCK_SPREADING, 0);
-                mdelay(40);
-        }
-
         /* We power off the wireless slot in case it was not done
          * by the driver. We don't power it on automatically however
          */
@@ -1749,12 +1851,6 @@ core99_wake_up(void)
         UN_OUT(UNI_N_CLOCK_CNTL, save_unin_clock_ctl);
         udelay(100);
 
-        /* Restore clock spreading */
-        if (macio->type == macio_intrepid) {
-                UN_OUT(UNI_N_CLOCK_SPREADING, 2);
-                mdelay(40);
-        }
-
         return 0;
 }
 
@@ -2149,7 +2245,7 @@ static struct pmac_mb_def pmac_mb_defs[] __pmacdata = {
         },
         {       "PowerBook1,1",                 "PowerBook 101 (Lombard)",
                 PMAC_TYPE_101_PBOOK,            paddington_features,
-                PMAC_MB_MAY_SLEEP | PMAC_MB_MOBILE
+                PMAC_MB_CAN_SLEEP | PMAC_MB_MOBILE
         },
         {       "PowerBook2,1",                 "iBook (first generation)",
                 PMAC_TYPE_ORIG_IBOOK,           core99_features,
@@ -2718,97 +2814,11 @@ set_initial_features(void)
                 MACIO_BIC(HEATHROW_FCR, HRW_SOUND_POWER_N);
         }
 
-        /* Hack for bumping clock speed on the new PowerBooks and the
-         * iBook G4. This implements the "platform-do-clockspreading" OF
-         * property. For safety, we also check the product ID in the
-         * device-tree to make reasonably sure we won't set wrong values
-         * in the clock chip.
-         *
-         * Of course, ultimately, we have to implement a real parser for
-         * the platform-do-* stuff...
+        /* Some machine models need the clock chip to be properly setup for
+         * clock spreading now. This should be a platform function but we
+         * don't do these at the moment
          */
-        while (machine_is_compatible("PowerBook5,2") ||
-               machine_is_compatible("PowerBook5,3") ||
-               machine_is_compatible("PowerBook6,2") ||
-               machine_is_compatible("PowerBook6,3")) {
-                struct device_node *ui2c = of_find_node_by_type(NULL, "i2c");
-                struct device_node *dt = of_find_node_by_name(NULL, "device-tree");
-                u8 buffer[9];
-                u32 *productID;
-                int i, rc, changed = 0;
-                
-                if (dt == NULL)
-                        break;
-                productID = (u32 *)get_property(dt, "pid#", NULL);
-                if (productID == NULL)
-                        break;
-                while(ui2c) {
-                        struct device_node *p = of_get_parent(ui2c);
-                        if (p && !strcmp(p->name, "uni-n"))
-                                break;
-                        ui2c = of_find_node_by_type(ui2c, "i2c");
-                }
-                if (ui2c == NULL)
-                        break;
-                DBG("Trying to bump clock speed for PID: %08x...\n", *productID);
-                rc = pmac_low_i2c_open(ui2c, 1);
-                if (rc != 0)
-                        break;
-                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_combined);
-                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_read, 0x80, buffer, 9);
-                DBG("read result: %d,", rc);
-                if (rc != 0) {
-                        pmac_low_i2c_close(ui2c);
-                        break;
-                }
-                for (i=0; i<9; i++)
-                        DBG(" %02x", buffer[i]);
-                DBG("\n");
-                
-                switch(*productID) {
-                case 0x1182:    /* AlBook 12" rev 2 */
-                case 0x1183:    /* iBook G4 12" */
-                        buffer[0] = (buffer[0] & 0x8f) | 0x70;
-                        buffer[2] = (buffer[2] & 0x7f) | 0x00;
-                        buffer[5] = (buffer[5] & 0x80) | 0x31;
-                        buffer[6] = (buffer[6] & 0x40) | 0xb0;
-                        buffer[7] = (buffer[7] & 0x00) | 0xc0;
-                        buffer[8] = (buffer[8] & 0x00) | 0x30;
-                        changed = 1;
-                        break;
-                case 0x3142:    /* AlBook 15" (ATI M10) */
-                case 0x3143:    /* AlBook 17" (ATI M10) */
-                        buffer[0] = (buffer[0] & 0xaf) | 0x50;
-                        buffer[2] = (buffer[2] & 0x7f) | 0x00;
-                        buffer[5] = (buffer[5] & 0x80) | 0x31;
-                        buffer[6] = (buffer[6] & 0x40) | 0xb0;
-                        buffer[7] = (buffer[7] & 0x00) | 0xd0;
-                        buffer[8] = (buffer[8] & 0x00) | 0x30;
-                        changed = 1;
-                        break;
-                default:
-                        DBG("i2c-hwclock: Machine model not handled\n");
-                        break;
-                }
-                if (!changed) {
-                        pmac_low_i2c_close(ui2c);
-                        break;
-                }
-                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_stdsub);
-                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_write, 0x80, buffer, 9);
-                DBG("write result: %d,", rc);
-                pmac_low_i2c_setmode(ui2c, pmac_low_i2c_mode_combined);
-                rc = pmac_low_i2c_xfer(ui2c, 0xd2 | pmac_low_i2c_read, 0x80, buffer, 9);
-                DBG("read result: %d,", rc);
-                if (rc != 0) {
-                        pmac_low_i2c_close(ui2c);
-                        break;
-                }
-                for (i=0; i<9; i++)
-                        DBG(" %02x", buffer[i]);
-                pmac_low_i2c_close(ui2c);
-                break;
-        }
+        pmac_tweak_clock_spreading(1);
 
 #endif /* CONFIG_POWER4 */
 
diff --git a/arch/ppc/platforms/pmac_sleep.S b/arch/ppc/platforms/pmac_sleep.S
index 3139b6766ad3..f459ade1bd63 100644
--- a/arch/ppc/platforms/pmac_sleep.S
+++ b/arch/ppc/platforms/pmac_sleep.S
@@ -267,6 +267,10 @@ grackle_wake_up:
         /* Restore various CPU config stuffs */
         bl      __restore_cpu_setup
 
+        /* Make sure all FPRs have been initialized */
+        bl      reloc_offset
+        bl      __init_fpu_registers
+
         /* Invalidate & enable L1 cache, we don't care about
          * whatever the ROM may have tried to write to memory
          */
diff --git a/arch/ppc/platforms/radstone_ppc7d.c b/arch/ppc/platforms/radstone_ppc7d.c
index 2a99b43737a8..c30607a972d8 100644
--- a/arch/ppc/platforms/radstone_ppc7d.c
+++ b/arch/ppc/platforms/radstone_ppc7d.c
@@ -68,6 +68,7 @@
 #define PPC7D_RST_PIN                   17      /* GPP17 */
 
 extern u32 mv64360_irq_base;
+extern spinlock_t rtc_lock;
 
 static struct mv64x60_handle bh;
 static int ppc7d_has_alma;
@@ -75,6 +76,11 @@ static int ppc7d_has_alma;
 extern void gen550_progress(char *, unsigned short);
 extern void gen550_init(int, struct uart_port *);
 
+/* FIXME - move to h file */
+extern int ds1337_do_command(int id, int cmd, void *arg);
+#define DS1337_GET_DATE         0
+#define DS1337_SET_DATE         1
+
 /* residual data */
 unsigned char __res[sizeof(bd_t)];
 
@@ -253,6 +259,8 @@ static int ppc7d_show_cpuinfo(struct seq_file *m)
         u8 val1, val2;
         static int flash_sizes[4] = { 64, 32, 0, 16 };
         static int flash_banks[4] = { 4, 3, 2, 1 };
+        static int sdram_bank_sizes[4] = { 128, 256, 512, 1 };
+        int sdram_num_banks = 2;
         static char *pci_modes[] = { "PCI33", "PCI66",
                 "Unknown", "Unknown",
                 "PCIX33", "PCIX66",
@@ -279,13 +287,17 @@ static int ppc7d_show_cpuinfo(struct seq_file *m)
                    (val1 == PPC7D_CPLD_MB_TYPE_PLL_100) ? 100 :
                    (val1 == PPC7D_CPLD_MB_TYPE_PLL_64) ? 64 : 0);
 
+        val = inb(PPC7D_CPLD_MEM_CONFIG);
+        if (val & PPC7D_CPLD_SDRAM_BANK_NUM_MASK) sdram_num_banks--;
+
         val = inb(PPC7D_CPLD_MEM_CONFIG_EXTEND);
-        val1 = val & PPC7D_CPLD_SDRAM_BANK_SIZE_MASK;
-        seq_printf(m, "SDRAM\t\t: %d%c",
-                   (val1 == PPC7D_CPLD_SDRAM_BANK_SIZE_128M) ? 128 :
-                   (val1 == PPC7D_CPLD_SDRAM_BANK_SIZE_256M) ? 256 :
-                   (val1 == PPC7D_CPLD_SDRAM_BANK_SIZE_512M) ? 512 : 1,
-                   (val1 == PPC7D_CPLD_SDRAM_BANK_SIZE_1G) ? 'G' : 'M');
+        val1 = (val & PPC7D_CPLD_SDRAM_BANK_SIZE_MASK) >> 6;
+        seq_printf(m, "SDRAM\t\t: %d banks of %d%c, total %d%c",
+                   sdram_num_banks,
+                   sdram_bank_sizes[val1],
+                   (sdram_bank_sizes[val1] < 128) ? 'G' : 'M',
+                   sdram_num_banks * sdram_bank_sizes[val1],
+                   (sdram_bank_sizes[val1] < 128) ? 'G' : 'M');
         if (val2 & PPC7D_CPLD_MB_TYPE_ECC_FITTED_MASK) {
                 seq_printf(m, " [ECC %sabled]",
                            (val2 & PPC7D_CPLD_MB_TYPE_ECC_ENABLE_MASK) ? "en" :
@@ -1236,6 +1248,38 @@ static void __init ppc7d_setup_arch(void)
         printk(KERN_INFO "Radstone Technology PPC7D\n");
         if (ppc_md.progress)
                 ppc_md.progress("ppc7d_setup_arch: exit", 0);
+
+}
+
+/* Real Time Clock support.
+ * PPC7D has a DS1337 accessed by I2C.
+ */
+static ulong ppc7d_get_rtc_time(void)
+{
+        struct rtc_time tm;
+        int result;
+
+        spin_lock(&rtc_lock);
+        result = ds1337_do_command(0, DS1337_GET_DATE, &tm);
+        spin_unlock(&rtc_lock);
+
+        if (result == 0)
+                result = mktime(tm.tm_year, tm.tm_mon, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec);
+
+        return result;
+}
+
+static int ppc7d_set_rtc_time(unsigned long nowtime)
+{
+        struct rtc_time tm;
+        int result;
+
+        spin_lock(&rtc_lock);
+        to_tm(nowtime, &tm);
+        result = ds1337_do_command(0, DS1337_SET_DATE, &tm);
+        spin_unlock(&rtc_lock);
+
+        return result;
 }
 
 /* This kernel command line parameter can be used to have the target
@@ -1293,6 +1337,10 @@ static void ppc7d_init2(void)
         data8 |= 0x07;
         outb(data8, PPC7D_CPLD_LEDS);
 
+        /* Hook up RTC. We couldn't do this earlier because we need the I2C subsystem */
+        ppc_md.set_rtc_time = ppc7d_set_rtc_time;
+        ppc_md.get_rtc_time = ppc7d_get_rtc_time;
+
         pr_debug("%s: exit\n", __FUNCTION__);
 }
 
diff --git a/arch/ppc/platforms/radstone_ppc7d.h b/arch/ppc/platforms/radstone_ppc7d.h
index 4546fff2b0c3..938375510be4 100644
--- a/arch/ppc/platforms/radstone_ppc7d.h
+++ b/arch/ppc/platforms/radstone_ppc7d.h
@@ -240,6 +240,7 @@
 #define PPC7D_CPLD_FLASH_CNTL                   0x086E
 
 /* MEMORY_CONFIG_EXTEND */
+#define PPC7D_CPLD_SDRAM_BANK_NUM_MASK          0x02
 #define PPC7D_CPLD_SDRAM_BANK_SIZE_MASK         0xc0
 #define PPC7D_CPLD_SDRAM_BANK_SIZE_128M         0
 #define PPC7D_CPLD_SDRAM_BANK_SIZE_256M         0x40
diff --git a/arch/ppc/syslib/cpm2_pic.c b/arch/ppc/syslib/cpm2_pic.c
index 954b07fc1df3..c867be6981cb 100644
--- a/arch/ppc/syslib/cpm2_pic.c
+++ b/arch/ppc/syslib/cpm2_pic.c
@@ -107,6 +107,11 @@ static void cpm2_end_irq(unsigned int irq_nr)
                 simr = &(cpm2_immr->im_intctl.ic_simrh);
                 ppc_cached_irq_mask[word] |= 1 << bit;
                 simr[word] = ppc_cached_irq_mask[word];
+                /*
+                 * Work around large numbers of spurious IRQs on PowerPC 82xx
+                 * systems.
+                 */
+                mb();
         }
 }
 
diff --git a/arch/ppc64/Makefile b/arch/ppc64/Makefile
index d33e20bcc52f..691f3008e698 100644
--- a/arch/ppc64/Makefile
+++ b/arch/ppc64/Makefile
@@ -56,13 +56,20 @@ LDFLAGS_vmlinux	:= -Bstatic -e $(KERNELLOAD) -Ttext $(KERNELLOAD)
 CFLAGS          += -msoft-float -pipe -mminimal-toc -mtraceback=none \
                    -mcall-aixdesc
 
+GCC_VERSION     := $(call cc-version)
+GCC_BROKEN_VEC  := $(shell if [ $(GCC_VERSION) -lt 0400 ] ; then echo "y"; fi ;)
+
 ifeq ($(CONFIG_POWER4_ONLY),y)
 ifeq ($(CONFIG_ALTIVEC),y)
+ifeq ($(GCC_BROKEN_VEC),y)
         CFLAGS += $(call cc-option,-mcpu=970)
 else
         CFLAGS += $(call cc-option,-mcpu=power4)
 endif
 else
+        CFLAGS += $(call cc-option,-mcpu=power4)
+endif
+else
         CFLAGS += $(call cc-option,-mtune=power4)
 endif
 
diff --git a/arch/ppc64/boot/addnote.c b/arch/ppc64/boot/addnote.c
index 66ff8103bf4d..719663a694bb 100644
--- a/arch/ppc64/boot/addnote.c
+++ b/arch/ppc64/boot/addnote.c
@@ -19,6 +19,7 @@
 #include <unistd.h>
 #include <string.h>
 
+/* CHRP note section */
 char arch[] = "PowerPC";
 
 #define N_DESCR 6
@@ -31,6 +32,29 @@ unsigned int descr[N_DESCR] = {
         0x4000,                 /* load-base */
 };
 
+/* RPA note section */
+char rpaname[] = "IBM,RPA-Client-Config";
+
+/*
+ * Note: setting ignore_my_client_config *should* mean that OF ignores
+ * all the other fields, but there is a firmware bug which means that
+ * it looks at the splpar field at least.  So these values need to be
+ * reasonable.
+ */
+#define N_RPA_DESCR     8
+unsigned int rpanote[N_RPA_DESCR] = {
+        0,                      /* lparaffinity */
+        64,                     /* min_rmo_size */
+        0,                      /* min_rmo_percent */
+        40,                     /* max_pft_size */
+        1,                      /* splpar */
+        -1,                     /* min_load */
+        0,                      /* new_mem_def */
+        1,                      /* ignore_my_client_config */
+};
+
+#define ROUNDUP(len)    (((len) + 3) & ~3)
+
 unsigned char buf[512];
 
 #define GET_16BE(off)   ((buf[off] << 8) + (buf[(off)+1]))
@@ -69,7 +93,7 @@ main(int ac, char **av)
 {
         int fd, n, i;
         int ph, ps, np;
-        int nnote, ns;
+        int nnote, nnote2, ns;
 
         if (ac != 2) {
                 fprintf(stderr, "Usage: %s elf-file\n", av[0]);
@@ -81,7 +105,8 @@ main(int ac, char **av)
                 exit(1);
         }
 
-        nnote = strlen(arch) + 1 + (N_DESCR + 3) * 4;
+        nnote = 12 + ROUNDUP(strlen(arch) + 1) + sizeof(descr);
+        nnote2 = 12 + ROUNDUP(strlen(rpaname) + 1) + sizeof(rpanote);
 
         n = read(fd, buf, sizeof(buf));
         if (n < 0) {
@@ -104,7 +129,7 @@ main(int ac, char **av)
         np = GET_16BE(E_PHNUM);
         if (ph < E_HSIZE || ps < PH_HSIZE || np < 1)
                 goto notelf;
-        if (ph + (np + 1) * ps + nnote > n)
+        if (ph + (np + 2) * ps + nnote + nnote2 > n)
                 goto nospace;
 
         for (i = 0; i < np; ++i) {
@@ -117,12 +142,12 @@ main(int ac, char **av)
         }
 
         /* XXX check that the area we want to use is all zeroes */
-        for (i = 0; i < ps + nnote; ++i)
+        for (i = 0; i < 2 * ps + nnote + nnote2; ++i)
                 if (buf[ph + i] != 0)
                         goto nospace;
 
         /* fill in the program header entry */
-        ns = ph + ps;
+        ns = ph + 2 * ps;
         PUT_32BE(ph + PH_TYPE, PT_NOTE);
         PUT_32BE(ph + PH_OFFSET, ns);
         PUT_32BE(ph + PH_FILESZ, nnote);
@@ -134,11 +159,26 @@ main(int ac, char **av)
         PUT_32BE(ns + 8, 0x1275);
         strcpy(&buf[ns + 12], arch);
         ns += 12 + strlen(arch) + 1;
-        for (i = 0; i < N_DESCR; ++i)
-                PUT_32BE(ns + i * 4, descr[i]);
+        for (i = 0; i < N_DESCR; ++i, ns += 4)
+                PUT_32BE(ns, descr[i]);
+
+        /* fill in the second program header entry and the RPA note area */
+        ph += ps;
+        PUT_32BE(ph + PH_TYPE, PT_NOTE);
+        PUT_32BE(ph + PH_OFFSET, ns);
+        PUT_32BE(ph + PH_FILESZ, nnote2);
+
+        /* fill in the note area we point to */
+        PUT_32BE(ns, strlen(rpaname) + 1);
+        PUT_32BE(ns + 4, sizeof(rpanote));
+        PUT_32BE(ns + 8, 0x12759999);
+        strcpy(&buf[ns + 12], rpaname);
+        ns += 12 + ROUNDUP(strlen(rpaname) + 1);
+        for (i = 0; i < N_RPA_DESCR; ++i, ns += 4)
+                PUT_32BE(ns, rpanote[i]);
 
         /* Update the number of program headers */
-        PUT_16BE(E_PHNUM, np + 1);
+        PUT_16BE(E_PHNUM, np + 2);
 
         /* write back */
         lseek(fd, (long) 0, SEEK_SET);
@@ -155,11 +195,11 @@ main(int ac, char **av)
         exit(0);
 
  notelf:
-        fprintf(stderr, "%s does not appear to be an ELF file\n", av[0]);
+        fprintf(stderr, "%s does not appear to be an ELF file\n", av[1]);
         exit(1);
 
  nospace:
         fprintf(stderr, "sorry, I can't find space in %s to put the note\n",
-                av[0]);
+                av[1]);
         exit(1);
 }
diff --git a/arch/ppc64/kernel/HvLpEvent.c b/arch/ppc64/kernel/HvLpEvent.c
index 9802beefa217..f8f19637f73f 100644
--- a/arch/ppc64/kernel/HvLpEvent.c
+++ b/arch/ppc64/kernel/HvLpEvent.c
@@ -45,7 +45,7 @@ int HvLpEvent_unregisterHandler( HvLpEvent_Type eventType )
                         /* We now sleep until all other CPUs have scheduled. This ensures that
                          * the deletion is seen by all other CPUs, and that the deleted handler
                          * isn't still running on another CPU when we return. */
-                        synchronize_kernel();
+                        synchronize_rcu();
                 }
         }
         return rc;
diff --git a/arch/ppc64/kernel/nvram.c b/arch/ppc64/kernel/nvram.c
index b9069c2d1933..4e71781a4414 100644
--- a/arch/ppc64/kernel/nvram.c
+++ b/arch/ppc64/kernel/nvram.c
@@ -339,9 +339,9 @@ static int nvram_remove_os_partition(void)
 static int nvram_create_os_partition(void)
 {
         struct list_head * p;
-        struct nvram_partition * part;
-        struct nvram_partition * new_part = NULL;
-        struct nvram_partition * free_part = NULL;
+        struct nvram_partition *part = NULL;
+        struct nvram_partition *new_part = NULL;
+        struct nvram_partition *free_part = NULL;
         int seq_init[2] = { 0, 0 };
         loff_t tmp_index;
         long size = 0;
@@ -364,13 +364,11 @@ static int nvram_create_os_partition(void)
                         free_part = part;
                 }
         }
-        if (!size) {
+        if (!size)
                 return -ENOSPC;
-        }
         
         /* Create our OS partition */
-        new_part = (struct nvram_partition *)
-                kmalloc(sizeof(struct nvram_partition), GFP_KERNEL);
+        new_part = kmalloc(sizeof(*new_part), GFP_KERNEL);
         if (!new_part) {
                 printk(KERN_ERR "nvram_create_os_partition: kmalloc failed\n");
                 return -ENOMEM;
@@ -379,7 +377,7 @@ static int nvram_create_os_partition(void)
         new_part->index = free_part->index;
         new_part->header.signature = NVRAM_SIG_OS;
         new_part->header.length = size;
-        sprintf(new_part->header.name, "ppc64,linux");
+        strcpy(new_part->header.name, "ppc64,linux");
         new_part->header.checksum = nvram_checksum(&new_part->header);
 
         rc = nvram_write_header(new_part);
@@ -394,7 +392,8 @@ static int nvram_create_os_partition(void)
         tmp_index = new_part->index + NVRAM_HEADER_LEN;
         rc = ppc_md.nvram_write((char *)&seq_init, sizeof(seq_init), &tmp_index);
         if (rc <= 0) {
-                printk(KERN_ERR "nvram_create_os_partition: nvram_write failed (%d)\n", rc);
+                printk(KERN_ERR "nvram_create_os_partition: nvram_write "
+                                "failed (%d)\n", rc);
                 return rc;
         }
         
diff --git a/arch/ppc64/kernel/pSeries_hvCall.S b/arch/ppc64/kernel/pSeries_hvCall.S
index 0715d3038019..176e8da76466 100644
--- a/arch/ppc64/kernel/pSeries_hvCall.S
+++ b/arch/ppc64/kernel/pSeries_hvCall.S
@@ -28,6 +28,8 @@
                         unsigned long *out3);           R10
  */
 _GLOBAL(plpar_hcall)
+        HMT_MEDIUM
+
         mfcr    r0
 
         std     r8,STK_PARM(r8)(r1)     /* Save out ptrs */
@@ -53,6 +55,8 @@ _GLOBAL(plpar_hcall)
 
 /* Simple interface with no output values (other than status) */
 _GLOBAL(plpar_hcall_norets)
+        HMT_MEDIUM
+
         mfcr    r0
         stw     r0,8(r1)
 
@@ -75,6 +79,8 @@ _GLOBAL(plpar_hcall_norets)
                         unsigned long *out1);           120(R1)
  */
 _GLOBAL(plpar_hcall_8arg_2ret)
+        HMT_MEDIUM
+
         mfcr    r0
         ld      r11,STK_PARM(r11)(r1)   /* put arg8 in R11 */
         stw     r0,8(r1)
@@ -99,6 +105,8 @@ _GLOBAL(plpar_hcall_8arg_2ret)
                         unsigned long *out4);           112(R1)
  */
 _GLOBAL(plpar_hcall_4out)
+        HMT_MEDIUM
+
         mfcr    r0
         stw     r0,8(r1)
 
diff --git a/arch/ppc64/kernel/prom.c b/arch/ppc64/kernel/prom.c
index 45a4ad08fbc2..fe2946c58314 100644
--- a/arch/ppc64/kernel/prom.c
+++ b/arch/ppc64/kernel/prom.c
@@ -321,6 +321,10 @@ static int __devinit finish_node_interrupts(struct device_node *np,
                         char *name = get_property(ic->parent, "name", NULL);
                         if (name && !strcmp(name, "u3"))
                                 np->intrs[intrcount].line += 128;
+                        else if (!(name && !strcmp(name, "mac-io")))
+                                /* ignore other cascaded controllers, such as
+                                   the k2-sata-root */
+                                break;
                 }
                 np->intrs[intrcount].sense = 1;
                 if (n > 1)
diff --git a/arch/ppc64/kernel/prom_init.c b/arch/ppc64/kernel/prom_init.c
index 8dffa9ae2623..35ec42de962e 100644
--- a/arch/ppc64/kernel/prom_init.c
+++ b/arch/ppc64/kernel/prom_init.c
@@ -493,6 +493,113 @@ static void __init early_cmdline_parse(void)
 }
 
 /*
+ * To tell the firmware what our capabilities are, we have to pass
+ * it a fake 32-bit ELF header containing a couple of PT_NOTE sections
+ * that contain structures that contain the actual values.
+ */
+static struct fake_elf {
+        Elf32_Ehdr      elfhdr;
+        Elf32_Phdr      phdr[2];
+        struct chrpnote {
+                u32     namesz;
+                u32     descsz;
+                u32     type;
+                char    name[8];        /* "PowerPC" */
+                struct chrpdesc {
+                        u32     real_mode;
+                        u32     real_base;
+                        u32     real_size;
+                        u32     virt_base;
+                        u32     virt_size;
+                        u32     load_base;
+                } chrpdesc;
+        } chrpnote;
+        struct rpanote {
+                u32     namesz;
+                u32     descsz;
+                u32     type;
+                char    name[24];       /* "IBM,RPA-Client-Config" */
+                struct rpadesc {
+                        u32     lpar_affinity;
+                        u32     min_rmo_size;
+                        u32     min_rmo_percent;
+                        u32     max_pft_size;
+                        u32     splpar;
+                        u32     min_load;
+                        u32     new_mem_def;
+                        u32     ignore_me;
+                } rpadesc;
+        } rpanote;
+} fake_elf = {
+        .elfhdr = {
+                .e_ident = { 0x7f, 'E', 'L', 'F',
+                             ELFCLASS32, ELFDATA2MSB, EV_CURRENT },
+                .e_type = ET_EXEC,      /* yeah right */
+                .e_machine = EM_PPC,
+                .e_version = EV_CURRENT,
+                .e_phoff = offsetof(struct fake_elf, phdr),
+                .e_phentsize = sizeof(Elf32_Phdr),
+                .e_phnum = 2
+        },
+        .phdr = {
+                [0] = {
+                        .p_type = PT_NOTE,
+                        .p_offset = offsetof(struct fake_elf, chrpnote),
+                        .p_filesz = sizeof(struct chrpnote)
+                }, [1] = {
+                        .p_type = PT_NOTE,
+                        .p_offset = offsetof(struct fake_elf, rpanote),
+                        .p_filesz = sizeof(struct rpanote)
+                }
+        },
+        .chrpnote = {
+                .namesz = sizeof("PowerPC"),
+                .descsz = sizeof(struct chrpdesc),
+                .type = 0x1275,
+                .name = "PowerPC",
+                .chrpdesc = {
+                        .real_mode = ~0U,       /* ~0 means "don't care" */
+                        .real_base = ~0U,
+                        .real_size = ~0U,
+                        .virt_base = ~0U,
+                        .virt_size = ~0U,
+                        .load_base = ~0U
+                },
+        },
+        .rpanote = {
+                .namesz = sizeof("IBM,RPA-Client-Config"),
+                .descsz = sizeof(struct rpadesc),
+                .type = 0x12759999,
+                .name = "IBM,RPA-Client-Config",
+                .rpadesc = {
+                        .lpar_affinity = 0,
+                        .min_rmo_size = 64,     /* in megabytes */
+                        .min_rmo_percent = 0,
+                        .max_pft_size = 48,     /* 2^48 bytes max PFT size */
+                        .splpar = 1,
+                        .min_load = ~0U,
+                        .new_mem_def = 0
+                }
+        }
+};
+
+static void __init prom_send_capabilities(void)
+{
+        unsigned long offset = reloc_offset();
+        ihandle elfloader;
+        int ret;
+
+        elfloader = call_prom("open", 1, 1, ADDR("/packages/elf-loader"));
+        if (elfloader == 0) {
+                prom_printf("couldn't open /packages/elf-loader\n");
+                return;
+        }
+        ret = call_prom("call-method", 3, 1, ADDR("process-elf-header"),
+                        elfloader, ADDR(&fake_elf));
+        call_prom("close", 1, 0, elfloader);
+}
+
+/*
  * Memory allocation strategy... our layout is normally:
  *
  *  at 14Mb or more we vmlinux, then a gap and initrd. In some rare cases, initrd
@@ -1448,6 +1555,12 @@ static void __init scan_dt_build_strings(phandle node, unsigned long *mem_start,
         }
 }
 
+/*
+ * The Open Firmware 1275 specification states properties must be 31 bytes or
+ * less, however not all firmwares obey this. Make it 64 bytes to be safe.
+ */
+#define MAX_PROPERTY_NAME 64
+
 static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
                                         unsigned long *mem_end)
 {
@@ -1457,7 +1570,7 @@ static void __init scan_dt_build_struct(phandle node, unsigned long *mem_start,
         unsigned long soff;
         unsigned char *valp;
         unsigned long offset = reloc_offset();
-        char pname[32];
+        char pname[MAX_PROPERTY_NAME];
         char *path;
 
         path = RELOC(prom_scratch);
diff --git a/arch/ppc64/kernel/ptrace.c b/arch/ppc64/kernel/ptrace.c
index 354a287c67eb..5a846324ca8c 100644
--- a/arch/ppc64/kernel/ptrace.c
+++ b/arch/ppc64/kernel/ptrace.c
@@ -28,6 +28,7 @@
 #include <linux/security.h>
 #include <linux/audit.h>
 #include <linux/seccomp.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -162,7 +163,7 @@ int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -194,7 +195,7 @@ int sys_ptrace(long request, long pid, long addr, long data)
 
         case PTRACE_SINGLESTEP: {  /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 set_single_step(child);
diff --git a/arch/ppc64/kernel/ptrace32.c b/arch/ppc64/kernel/ptrace32.c
index ee81b1b776cc..16436426c7e2 100644
--- a/arch/ppc64/kernel/ptrace32.c
+++ b/arch/ppc64/kernel/ptrace32.c
@@ -26,6 +26,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -293,7 +294,7 @@ int sys32_ptrace(long request, long pid, unsigned long addr, unsigned long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -325,7 +326,7 @@ int sys32_ptrace(long request, long pid, unsigned long addr, unsigned long data)
 
         case PTRACE_SINGLESTEP: {  /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 set_single_step(child);
diff --git a/arch/ppc64/kernel/signal32.c b/arch/ppc64/kernel/signal32.c
index b0e167db6af9..3c2fa5c284c0 100644
--- a/arch/ppc64/kernel/signal32.c
+++ b/arch/ppc64/kernel/signal32.c
@@ -657,7 +657,7 @@ static int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
 
         /* Save user registers on the stack */
         frame = &rt_sf->uc.uc_mcontext;
-        if (put_user(regs->gpr[1], (unsigned long __user *)newsp))
+        if (put_user(regs->gpr[1], (u32 __user *)newsp))
                 goto badframe;
 
         if (vdso32_rt_sigtramp && current->thread.vdso_base) {
@@ -842,7 +842,7 @@ static int handle_signal32(unsigned long sig, struct k_sigaction *ka,
                 regs->link = (unsigned long) frame->mctx.tramp;
         }
 
-        if (put_user(regs->gpr[1], (unsigned long __user *)newsp))
+        if (put_user(regs->gpr[1], (u32 __user *)newsp))
                 goto badframe;
         regs->gpr[1] = (unsigned long) newsp;
         regs->gpr[3] = sig;
diff --git a/arch/ppc64/kernel/smp.c b/arch/ppc64/kernel/smp.c
index 1c92da3e4525..3b906cd94037 100644
--- a/arch/ppc64/kernel/smp.c
+++ b/arch/ppc64/kernel/smp.c
@@ -125,7 +125,7 @@ void __devinit smp_generic_kick_cpu(int nr)
          * the processor will continue on to secondary_start
          */
         paca[nr].cpu_start = 1;
-        mb();
+        smp_mb();
 }
 
 #endif /* CONFIG_PPC_MULTIPLATFORM */
@@ -256,7 +256,7 @@ int smp_call_function (void (*func) (void *info), void *info, int nonatomic,
         }
 
         call_data = &data;
-        wmb();
+        smp_wmb();
         /* Send a message to all other CPUs and wait for them to respond */
         smp_ops->message_pass(MSG_ALL_BUT_SELF, PPC_MSG_CALL_FUNCTION);
 
@@ -431,7 +431,7 @@ int generic_cpu_enable(unsigned int cpu)
 
         /* get the target out of it's holding state */
         per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
-        wmb();
+        smp_wmb();
 
         while (!cpu_online(cpu))
                 cpu_relax();
@@ -447,7 +447,7 @@ void generic_cpu_die(unsigned int cpu)
         int i;
 
         for (i = 0; i < 100; i++) {
-                rmb();
+                smp_rmb();
                 if (per_cpu(cpu_state, cpu) == CPU_DEAD)
                         return;
                 msleep(100);
@@ -463,7 +463,7 @@ void generic_mach_cpu_die(void)
         cpu = smp_processor_id();
         printk(KERN_DEBUG "CPU%d offline\n", cpu);
         __get_cpu_var(cpu_state) = CPU_DEAD;
-        wmb();
+        smp_wmb();
         while (__get_cpu_var(cpu_state) != CPU_UP_PREPARE)
                 cpu_relax();
 
@@ -515,7 +515,7 @@ int __devinit __cpu_up(unsigned int cpu)
          * be written out to main store before we release
          * the processor.
          */
-        mb();
+        smp_mb();
 
         /* wake up cpus */
         DBG("smp: kicking cpu %d\n", cpu);
diff --git a/arch/ppc64/kernel/time.c b/arch/ppc64/kernel/time.c
index 77ded5a363b6..772a465b49f9 100644
--- a/arch/ppc64/kernel/time.c
+++ b/arch/ppc64/kernel/time.c
@@ -221,15 +221,15 @@ static __inline__ void timer_recalc_offset(unsigned long cur_tb)
         temp_varp->tb_to_xs = do_gtod.varp->tb_to_xs;
         temp_varp->tb_orig_stamp = new_tb_orig_stamp;
         temp_varp->stamp_xsec = new_stamp_xsec;
-        mb();
+        smp_mb();
         do_gtod.varp = temp_varp;
         do_gtod.var_idx = temp_idx;
 
         ++(systemcfg->tb_update_count);
-        wmb();
+        smp_wmb();
         systemcfg->tb_orig_stamp = new_tb_orig_stamp;
         systemcfg->stamp_xsec = new_stamp_xsec;
-        wmb();
+        smp_wmb();
         ++(systemcfg->tb_update_count);
 }
 
@@ -648,7 +648,7 @@ void ppc_adjtimex(void)
         temp_varp->tb_to_xs = new_tb_to_xs;
         temp_varp->stamp_xsec = new_stamp_xsec;
         temp_varp->tb_orig_stamp = do_gtod.varp->tb_orig_stamp;
-        mb();
+        smp_mb();
         do_gtod.varp = temp_varp;
         do_gtod.var_idx = temp_idx;
 
@@ -662,10 +662,10 @@ void ppc_adjtimex(void)
          * loops back and reads them again until this criteria is met.
          */
         ++(systemcfg->tb_update_count);
-        wmb();
+        smp_wmb();
         systemcfg->tb_to_xs = new_tb_to_xs;
         systemcfg->stamp_xsec = new_stamp_xsec;
-        wmb();
+        smp_wmb();
         ++(systemcfg->tb_update_count);
 
         write_sequnlock_irqrestore( &xtime_lock, flags );
diff --git a/arch/ppc64/kernel/vdso32/Makefile b/arch/ppc64/kernel/vdso32/Makefile
index ede2f7e477c2..0b1b0df973eb 100644
--- a/arch/ppc64/kernel/vdso32/Makefile
+++ b/arch/ppc64/kernel/vdso32/Makefile
@@ -1,7 +1,7 @@
 
 # List of files in the vdso, has to be asm only for now
 
-obj-vdso32 = sigtramp.o gettimeofday.o datapage.o cacheflush.o
+obj-vdso32 = sigtramp.o gettimeofday.o datapage.o cacheflush.o note.o
 
 # Build rules
 
diff --git a/arch/ppc64/kernel/vdso32/cacheflush.S b/arch/ppc64/kernel/vdso32/cacheflush.S
index c74fddb6afd4..0ed7ea721715 100644
--- a/arch/ppc64/kernel/vdso32/cacheflush.S
+++ b/arch/ppc64/kernel/vdso32/cacheflush.S
@@ -47,6 +47,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache)
         addi    r6,r6,128
         bdnz    1b
         isync
+        li      r3,0
         blr
   .cfi_endproc
 V_FUNCTION_END(__kernel_sync_dicache)
@@ -59,6 +60,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache_p5)
   .cfi_startproc
         sync
         isync
+        li      r3,0
         blr
   .cfi_endproc
 V_FUNCTION_END(__kernel_sync_dicache_p5)
diff --git a/arch/ppc64/kernel/vdso32/gettimeofday.S b/arch/ppc64/kernel/vdso32/gettimeofday.S
index ca7f415195c4..2b48bf1fb109 100644
--- a/arch/ppc64/kernel/vdso32/gettimeofday.S
+++ b/arch/ppc64/kernel/vdso32/gettimeofday.S
@@ -58,6 +58,7 @@ V_FUNCTION_BEGIN(__kernel_gettimeofday)
         stw     r5,TZONE_TZ_DSTTIME(r11)
 
 1:      mtlr    r12
+        li      r3,0
         blr
 
 2:      mr      r3,r10
diff --git a/arch/ppc64/kernel/vdso32/note.S b/arch/ppc64/kernel/vdso32/note.S
new file mode 100644
index 000000000000..d4b5be4f3d5f
--- /dev/null
+++ b/arch/ppc64/kernel/vdso32/note.S
@@ -0,0 +1,25 @@
+/*
+ * This supplies .note.* sections to go into the PT_NOTE inside the vDSO text.
+ * Here we can supply some information useful to userland.
+ */
+
+#include <linux/uts.h>
+#include <linux/version.h>
+
+#define ASM_ELF_NOTE_BEGIN(name, flags, vendor, type)                         \
+        .section name, flags;                                                 \
+        .balign 4;                                                            \
+        .long 1f - 0f;          /* name length */                             \
+        .long 3f - 2f;          /* data length */                             \
+        .long type;             /* note type */                               \
+0:      .asciz vendor;          /* vendor name */                             \
+1:      .balign 4;                                                            \
+2:
+
+#define ASM_ELF_NOTE_END                                                      \
+3:      .balign 4;              /* pad out section */                         \
+        .previous
+
+        ASM_ELF_NOTE_BEGIN(".note.kernel-version", "a", UTS_SYSNAME, 0)
+        .long LINUX_VERSION_CODE
+        ASM_ELF_NOTE_END
diff --git a/arch/ppc64/kernel/vdso32/vdso32.lds.S b/arch/ppc64/kernel/vdso32/vdso32.lds.S
index cca27bd03a57..11290c902ba3 100644
--- a/arch/ppc64/kernel/vdso32/vdso32.lds.S
+++ b/arch/ppc64/kernel/vdso32/vdso32.lds.S
@@ -20,6 +20,8 @@ SECTIONS
   .gnu.version_d  : { *(.gnu.version_d) }
   .gnu.version_r  : { *(.gnu.version_r) }
 
+  .note           : { *(.note.*) }                      :text   :note
+
   . = ALIGN (16);
   .text :
   {
@@ -87,6 +89,7 @@ SECTIONS
 PHDRS
 {
   text PT_LOAD FILEHDR PHDRS FLAGS(5); /* PF_R|PF_X */
+  note PT_NOTE FLAGS(4); /* PF_R */
   dynamic PT_DYNAMIC FLAGS(4); /* PF_R */
   eh_frame_hdr 0x6474e550; /* PT_GNU_EH_FRAME, but ld doesn't match the name */
 }
diff --git a/arch/ppc64/kernel/vdso64/Makefile b/arch/ppc64/kernel/vdso64/Makefile
index bd3f70b1a384..ab39988452cc 100644
--- a/arch/ppc64/kernel/vdso64/Makefile
+++ b/arch/ppc64/kernel/vdso64/Makefile
@@ -1,6 +1,6 @@
 # List of files in the vdso, has to be asm only for now
 
-obj-vdso64 = sigtramp.o gettimeofday.o datapage.o cacheflush.o
+obj-vdso64 = sigtramp.o gettimeofday.o datapage.o cacheflush.o note.o
 
 # Build rules
 
diff --git a/arch/ppc64/kernel/vdso64/cacheflush.S b/arch/ppc64/kernel/vdso64/cacheflush.S
index d9696ffcf334..e0725b7b7003 100644
--- a/arch/ppc64/kernel/vdso64/cacheflush.S
+++ b/arch/ppc64/kernel/vdso64/cacheflush.S
@@ -47,6 +47,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache)
         addi    r6,r6,128
         bdnz    1b
         isync
+        li      r3,0
         blr
   .cfi_endproc
 V_FUNCTION_END(__kernel_sync_dicache)
@@ -59,6 +60,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache_p5)
   .cfi_startproc
         sync
         isync
+        li      r3,0
         blr
   .cfi_endproc
 V_FUNCTION_END(__kernel_sync_dicache_p5)
diff --git a/arch/ppc64/kernel/vdso64/note.S b/arch/ppc64/kernel/vdso64/note.S
new file mode 100644
index 000000000000..dc2a509f7e8a
--- /dev/null
+++ b/arch/ppc64/kernel/vdso64/note.S
@@ -0,0 +1 @@
+#include "../vdso32/note.S"
diff --git a/arch/ppc64/kernel/vdso64/vdso64.lds.S b/arch/ppc64/kernel/vdso64/vdso64.lds.S
index 942c815c7bc7..9cb28181da80 100644
--- a/arch/ppc64/kernel/vdso64/vdso64.lds.S
+++ b/arch/ppc64/kernel/vdso64/vdso64.lds.S
@@ -18,12 +18,14 @@ SECTIONS
   .gnu.version_d  : { *(.gnu.version_d) }
   .gnu.version_r  : { *(.gnu.version_r) }
 
+  .note           : { *(.note.*) }              :text   :note
+
   . = ALIGN (16);
   .text           :
   {
     *(.text .stub .text.* .gnu.linkonce.t.*)
     *(.sfpr .glink)
-  }
+  }                                             :text
   PROVIDE (__etext = .);
   PROVIDE (_etext = .);
   PROVIDE (etext = .);
@@ -88,6 +90,7 @@ SECTIONS
 PHDRS
 {
   text PT_LOAD FILEHDR PHDRS FLAGS(5); /* PF_R|PF_X */
+  note PT_NOTE FLAGS(4); /* PF_R */
   dynamic PT_DYNAMIC FLAGS(4); /* PF_R */
   eh_frame_hdr 0x6474e550; /* PT_GNU_EH_FRAME, but ld doesn't match the name */
 }
diff --git a/arch/ppc64/mm/hash_low.S b/arch/ppc64/mm/hash_low.S
index 8c0156a37001..c23d46956dd9 100644
--- a/arch/ppc64/mm/hash_low.S
+++ b/arch/ppc64/mm/hash_low.S
@@ -85,7 +85,10 @@ _GLOBAL(__hash_page)
         bne-    htab_wrong_access
         /* Check if PTE is busy */
         andi.   r0,r31,_PAGE_BUSY
-        bne-    1b
+        /* If so, just bail out and refault if needed. Someone else
+         * is changing this PTE anyway and might hash it.
+         */
+        bne-    bail_ok
         /* Prepare new PTE value (turn access RW into DIRTY, then
          * add BUSY,HASHPTE and ACCESSED)
          */
@@ -215,6 +218,10 @@ _GLOBAL(htab_call_hpte_remove)
         /* Try all again */
         b       htab_insert_pte 
 
+bail_ok:
+        li      r3,0
+        b       bail
+
 htab_pte_insert_ok:
         /* Insert slot number & secondary bit in PTE */
         rldimi  r30,r3,12,63-15
diff --git a/arch/ppc64/mm/hugetlbpage.c b/arch/ppc64/mm/hugetlbpage.c
index 390296efe3e0..d3bf86a5c1ad 100644
--- a/arch/ppc64/mm/hugetlbpage.c
+++ b/arch/ppc64/mm/hugetlbpage.c
@@ -42,7 +42,7 @@ static inline int hugepgd_index(unsigned long addr)
         return (addr & ~REGION_MASK) >> HUGEPGDIR_SHIFT;
 }
 
-static pgd_t *hugepgd_offset(struct mm_struct *mm, unsigned long addr)
+static pud_t *hugepgd_offset(struct mm_struct *mm, unsigned long addr)
 {
         int index;
 
@@ -52,21 +52,21 @@ static pgd_t *hugepgd_offset(struct mm_struct *mm, unsigned long addr)
 
         index = hugepgd_index(addr);
         BUG_ON(index >= PTRS_PER_HUGEPGD);
-        return mm->context.huge_pgdir + index;
+        return (pud_t *)(mm->context.huge_pgdir + index);
 }
 
-static inline pte_t *hugepte_offset(pgd_t *dir, unsigned long addr)
+static inline pte_t *hugepte_offset(pud_t *dir, unsigned long addr)
 {
         int index;
 
-        if (pgd_none(*dir))
+        if (pud_none(*dir))
                 return NULL;
 
         index = (addr >> HPAGE_SHIFT) % PTRS_PER_HUGEPTE;
-        return (pte_t *)pgd_page(*dir) + index;
+        return (pte_t *)pud_page(*dir) + index;
 }
 
-static pgd_t *hugepgd_alloc(struct mm_struct *mm, unsigned long addr)
+static pud_t *hugepgd_alloc(struct mm_struct *mm, unsigned long addr)
 {
         BUG_ON(! in_hugepage_area(mm->context, addr));
 
@@ -90,10 +90,9 @@ static pgd_t *hugepgd_alloc(struct mm_struct *mm, unsigned long addr)
         return hugepgd_offset(mm, addr);
 }
 
-static pte_t *hugepte_alloc(struct mm_struct *mm, pgd_t *dir,
-                            unsigned long addr)
+static pte_t *hugepte_alloc(struct mm_struct *mm, pud_t *dir, unsigned long addr)
 {
-        if (! pgd_present(*dir)) {
+        if (! pud_present(*dir)) {
                 pte_t *new;
 
                 spin_unlock(&mm->page_table_lock);
@@ -104,7 +103,7 @@ static pte_t *hugepte_alloc(struct mm_struct *mm, pgd_t *dir,
                  * Because we dropped the lock, we should re-check the
                  * entry, as somebody else could have populated it..
                  */
-                if (pgd_present(*dir)) {
+                if (pud_present(*dir)) {
                         if (new)
                                 kmem_cache_free(zero_cache, new);
                 } else {
@@ -115,7 +114,7 @@ static pte_t *hugepte_alloc(struct mm_struct *mm, pgd_t *dir,
                         ptepage = virt_to_page(new);
                         ptepage->mapping = (void *) mm;
                         ptepage->index = addr & HUGEPGDIR_MASK;
-                        pgd_populate(mm, dir, new);
+                        pud_populate(mm, dir, new);
                 }
         }
 
@@ -124,28 +123,28 @@ static pte_t *hugepte_alloc(struct mm_struct *mm, pgd_t *dir,
 
 static pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr)
 {
-        pgd_t *pgd;
+        pud_t *pud;
 
         BUG_ON(! in_hugepage_area(mm->context, addr));
 
-        pgd = hugepgd_offset(mm, addr);
-        if (! pgd)
+        pud = hugepgd_offset(mm, addr);
+        if (! pud)
                 return NULL;
 
-        return hugepte_offset(pgd, addr);
+        return hugepte_offset(pud, addr);
 }
 
 static pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr)
 {
-        pgd_t *pgd;
+        pud_t *pud;
 
         BUG_ON(! in_hugepage_area(mm->context, addr));
 
-        pgd = hugepgd_alloc(mm, addr);
-        if (! pgd)
+        pud = hugepgd_alloc(mm, addr);
+        if (! pud)
                 return NULL;
 
-        return hugepte_alloc(mm, pgd, addr);
+        return hugepte_alloc(mm, pud, addr);
 }
 
 static void set_huge_pte(struct mm_struct *mm, struct vm_area_struct *vma,
@@ -709,10 +708,10 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm)
 
         /* cleanup any hugepte pages leftover */
         for (i = 0; i < PTRS_PER_HUGEPGD; i++) {
-                pgd_t *pgd = pgdir + i;
+                pud_t *pud = (pud_t *)(pgdir + i);
 
-                if (! pgd_none(*pgd)) {
-                        pte_t *pte = (pte_t *)pgd_page(*pgd);
+                if (! pud_none(*pud)) {
+                        pte_t *pte = (pte_t *)pud_page(*pud);
                         struct page *ptepage = virt_to_page(pte);
 
                         ptepage->mapping = NULL;
@@ -720,7 +719,7 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm)
                         BUG_ON(memcmp(pte, empty_zero_page, PAGE_SIZE));
                         kmem_cache_free(zero_cache, pte);
                 }
-                pgd_clear(pgd);
+                pud_clear(pud);
         }
 
         BUG_ON(memcmp(pgdir, empty_zero_page, PAGE_SIZE));
diff --git a/arch/ppc64/mm/init.c b/arch/ppc64/mm/init.c
index a7149b9fc35c..cf33d7ec2e29 100644
--- a/arch/ppc64/mm/init.c
+++ b/arch/ppc64/mm/init.c
@@ -136,14 +136,78 @@ void iounmap(volatile void __iomem *addr)
 
 #else
 
+static void unmap_im_area_pte(pmd_t *pmd, unsigned long addr,
+                                  unsigned long end)
+{
+        pte_t *pte;
+
+        pte = pte_offset_kernel(pmd, addr);
+        do {
+                pte_t ptent = ptep_get_and_clear(&ioremap_mm, addr, pte);
+                WARN_ON(!pte_none(ptent) && !pte_present(ptent));
+        } while (pte++, addr += PAGE_SIZE, addr != end);
+}
+
+static inline void unmap_im_area_pmd(pud_t *pud, unsigned long addr,
+                                     unsigned long end)
+{
+        pmd_t *pmd;
+        unsigned long next;
+
+        pmd = pmd_offset(pud, addr);
+        do {
+                next = pmd_addr_end(addr, end);
+                if (pmd_none_or_clear_bad(pmd))
+                        continue;
+                unmap_im_area_pte(pmd, addr, next);
+        } while (pmd++, addr = next, addr != end);
+}
+
+static inline void unmap_im_area_pud(pgd_t *pgd, unsigned long addr,
+                                     unsigned long end)
+{
+        pud_t *pud;
+        unsigned long next;
+
+        pud = pud_offset(pgd, addr);
+        do {
+                next = pud_addr_end(addr, end);
+                if (pud_none_or_clear_bad(pud))
+                        continue;
+                unmap_im_area_pmd(pud, addr, next);
+        } while (pud++, addr = next, addr != end);
+}
+
+static void unmap_im_area(unsigned long addr, unsigned long end)
+{
+        struct mm_struct *mm = &ioremap_mm;
+        unsigned long next;
+        pgd_t *pgd;
+
+        spin_lock(&mm->page_table_lock);
+
+        pgd = pgd_offset_i(addr);
+        flush_cache_vunmap(addr, end);
+        do {
+                next = pgd_addr_end(addr, end);
+                if (pgd_none_or_clear_bad(pgd))
+                        continue;
+                unmap_im_area_pud(pgd, addr, next);
+        } while (pgd++, addr = next, addr != end);
+        flush_tlb_kernel_range(start, end);
+
+        spin_unlock(&mm->page_table_lock);
+}
+
 /*
  * map_io_page currently only called by __ioremap
  * map_io_page adds an entry to the ioremap page table
  * and adds an entry to the HPT, possibly bolting it
  */
-static void map_io_page(unsigned long ea, unsigned long pa, int flags)
+static int map_io_page(unsigned long ea, unsigned long pa, int flags)
 {
         pgd_t *pgdp;
+        pud_t *pudp;
         pmd_t *pmdp;
         pte_t *ptep;
         unsigned long vsid;
@@ -151,9 +215,15 @@ static void map_io_page(unsigned long ea, unsigned long pa, int flags)
         if (mem_init_done) {
                 spin_lock(&ioremap_mm.page_table_lock);
                 pgdp = pgd_offset_i(ea);
-                pmdp = pmd_alloc(&ioremap_mm, pgdp, ea);
+                pudp = pud_alloc(&ioremap_mm, pgdp, ea);
+                if (!pudp)
+                        return -ENOMEM;
+                pmdp = pmd_alloc(&ioremap_mm, pudp, ea);
+                if (!pmdp)
+                        return -ENOMEM;
                 ptep = pte_alloc_kernel(&ioremap_mm, pmdp, ea);
-
+                if (!ptep)
+                        return -ENOMEM;
                 pa = abs_to_phys(pa);
                 set_pte_at(&ioremap_mm, ea, ptep, pfn_pte(pa >> PAGE_SHIFT,
                                                           __pgprot(flags)));
@@ -181,6 +251,7 @@ static void map_io_page(unsigned long ea, unsigned long pa, int flags)
                         panic("map_io_page: could not insert mapping");
                 }
         }
+        return 0;
 }
 
 
@@ -194,9 +265,14 @@ static void __iomem * __ioremap_com(unsigned long addr, unsigned long pa,
                 flags |= pgprot_val(PAGE_KERNEL);
 
         for (i = 0; i < size; i += PAGE_SIZE)
-                map_io_page(ea+i, pa+i, flags);
+                if (map_io_page(ea+i, pa+i, flags))
+                        goto failure;
 
         return (void __iomem *) (ea + (addr & ~PAGE_MASK));
+ failure:
+        if (mem_init_done)
+                unmap_im_area(ea, ea + size);
+        return NULL;
 }
 
 
@@ -206,10 +282,11 @@ ioremap(unsigned long addr, unsigned long size)
         return __ioremap(addr, size, _PAGE_NO_CACHE | _PAGE_GUARDED);
 }
 
-void __iomem *
-__ioremap(unsigned long addr, unsigned long size, unsigned long flags)
+void __iomem * __ioremap(unsigned long addr, unsigned long size,
+                         unsigned long flags)
 {
         unsigned long pa, ea;
+        void __iomem *ret;
 
         /*
          * Choose an address to map it to.
@@ -232,12 +309,16 @@ __ioremap(unsigned long addr, unsigned long size, unsigned long flags)
                 if (area == NULL)
                         return NULL;
                 ea = (unsigned long)(area->addr);
+                ret = __ioremap_com(addr, pa, ea, size, flags);
+                if (!ret)
+                        im_free(area->addr);
         } else {
                 ea = ioremap_bot;
-                ioremap_bot += size;
+                ret = __ioremap_com(addr, pa, ea, size, flags);
+                if (ret)
+                        ioremap_bot += size;
         }
-
-        return __ioremap_com(addr, pa, ea, size, flags);
+        return ret;
 }
 
 #define IS_PAGE_ALIGNED(_val) ((_val) == ((_val) & PAGE_MASK))
@@ -246,6 +327,7 @@ int __ioremap_explicit(unsigned long pa, unsigned long ea,
                        unsigned long size, unsigned long flags)
 {
         struct vm_struct *area;
+        void __iomem *ret;
         
         /* For now, require page-aligned values for pa, ea, and size */
         if (!IS_PAGE_ALIGNED(pa) || !IS_PAGE_ALIGNED(ea) ||
@@ -276,7 +358,12 @@ int __ioremap_explicit(unsigned long pa, unsigned long ea,
                 }
         }
         
-        if (__ioremap_com(pa, pa, ea, size, flags) != (void *) ea) {
+        ret = __ioremap_com(pa, pa, ea, size, flags);
+        if (ret == NULL) {
+                printk(KERN_ERR "ioremap_explicit() allocation failure !\n");
+                return 1;
+        }
+        if (ret != (void *) ea) {
                 printk(KERN_ERR "__ioremap_com() returned unexpected addr\n");
                 return 1;
         }
@@ -284,69 +371,6 @@ int __ioremap_explicit(unsigned long pa, unsigned long ea,
         return 0;
 }
 
-static void unmap_im_area_pte(pmd_t *pmd, unsigned long address,
-                                  unsigned long size)
-{
-        unsigned long base, end;
-        pte_t *pte;
-
-        if (pmd_none(*pmd))
-                return;
-        if (pmd_bad(*pmd)) {
-                pmd_ERROR(*pmd);
-                pmd_clear(pmd);
-                return;
-        }
-
-        pte = pte_offset_kernel(pmd, address);
-        base = address & PMD_MASK;
-        address &= ~PMD_MASK;
-        end = address + size;
-        if (end > PMD_SIZE)
-                end = PMD_SIZE;
-
-        do {
-                pte_t page;
-                page = ptep_get_and_clear(&ioremap_mm, base + address, pte);
-                address += PAGE_SIZE;
-                pte++;
-                if (pte_none(page))
-                        continue;
-                if (pte_present(page))
-                        continue;
-                printk(KERN_CRIT "Whee.. Swapped out page in kernel page"
-                       " table\n");
-        } while (address < end);
-}
-
-static void unmap_im_area_pmd(pgd_t *dir, unsigned long address,
-                                  unsigned long size)
-{
-        unsigned long base, end;
-        pmd_t *pmd;
-
-        if (pgd_none(*dir))
-                return;
-        if (pgd_bad(*dir)) {
-                pgd_ERROR(*dir);
-                pgd_clear(dir);
-                return;
-        }
-
-        pmd = pmd_offset(dir, address);
-        base = address & PGDIR_MASK;
-        address &= ~PGDIR_MASK;
-        end = address + size;
-        if (end > PGDIR_SIZE)
-                end = PGDIR_SIZE;
-
-        do {
-                unmap_im_area_pte(pmd, base + address, end - address);
-                address = (address + PMD_SIZE) & PMD_MASK;
-                pmd++;
-        } while (address < end);
-}
-
 /*  
  * Unmap an IO region and remove it from imalloc'd list.
  * Access to IO memory should be serialized by driver.
@@ -356,39 +380,19 @@ static void unmap_im_area_pmd(pgd_t *dir, unsigned long address,
  */
 void iounmap(volatile void __iomem *token)
 {
-        unsigned long address, start, end, size;
-        struct mm_struct *mm;
-        pgd_t *dir;
+        unsigned long address, size;
         void *addr;
 
-        if (!mem_init_done) {
+        if (!mem_init_done)
                 return;
-        }
         
         addr = (void *) ((unsigned long __force) token & PAGE_MASK);
         
-        if ((size = im_free(addr)) == 0) {
+        if ((size = im_free(addr)) == 0)
                 return;
-        }
 
         address = (unsigned long)addr; 
-        start = address;
-        end = address + size;
-
-        mm = &ioremap_mm;
-        spin_lock(&mm->page_table_lock);
-
-        dir = pgd_offset_i(address);
-        flush_cache_vunmap(address, end);
-        do {
-                unmap_im_area_pmd(dir, address, end - address);
-                address = (address + PGDIR_SIZE) & PGDIR_MASK;
-                dir++;
-        } while (address && (address < end));
-        flush_tlb_kernel_range(start, end);
-
-        spin_unlock(&mm->page_table_lock);
-        return;
+        unmap_im_area(address, address + size);
 }
 
 static int iounmap_subset_regions(unsigned long addr, unsigned long size)
diff --git a/arch/ppc64/mm/slb.c b/arch/ppc64/mm/slb.c
index 6a20773f695d..244150a0bc18 100644
--- a/arch/ppc64/mm/slb.c
+++ b/arch/ppc64/mm/slb.c
@@ -33,8 +33,8 @@ static inline unsigned long mk_vsid_data(unsigned long ea, unsigned long flags)
         return (get_kernel_vsid(ea) << SLB_VSID_SHIFT) | flags;
 }
 
-static inline void create_slbe(unsigned long ea, unsigned long vsid,
-                               unsigned long flags, unsigned long entry)
+static inline void create_slbe(unsigned long ea, unsigned long flags,
+                               unsigned long entry)
 {
         asm volatile("slbmte  %0,%1" :
                      : "r" (mk_vsid_data(ea, flags)),
@@ -145,9 +145,8 @@ void slb_initialize(void)
         asm volatile("isync":::"memory");
         asm volatile("slbmte  %0,%0"::"r" (0) : "memory");
         asm volatile("isync; slbia; isync":::"memory");
-        create_slbe(KERNELBASE, get_kernel_vsid(KERNELBASE), flags, 0);
-        create_slbe(VMALLOCBASE, get_kernel_vsid(KERNELBASE),
-                    SLB_VSID_KERNEL, 1);
+        create_slbe(KERNELBASE, flags, 0);
+        create_slbe(VMALLOCBASE, SLB_VSID_KERNEL, 1);
         /* We don't bolt the stack for the time being - we're in boot,
          * so the stack is in the bolted segment.  By the time it goes
          * elsewhere, we'll call _switch() which will bolt in the new
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index 1358b4201701..07fd0414a4bf 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.11
-# Wed Mar  2 16:57:55 2005
+# Linux kernel version: 2.6.12-rc3
+# Fri Apr 22 15:30:58 2005
 #
 CONFIG_MMU=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
@@ -15,6 +15,7 @@ CONFIG_UID16=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_CLEAN_COMPILE=y
 CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
@@ -26,24 +27,25 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_LOG_BUF_SHIFT=17
 CONFIG_HOTPLUG=y
 CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
+# CONFIG_CPUSETS is not set
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SHMEM=y
 CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
 # CONFIG_TINY_SHMEM is not set
+CONFIG_BASE_SMALL=0
 
 #
 # Loadable module support
@@ -261,7 +263,6 @@ CONFIG_NET=y
 #
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
-# CONFIG_NETLINK_DEV is not set
 CONFIG_UNIX=y
 CONFIG_NET_KEY=y
 CONFIG_INET=y
@@ -329,6 +330,7 @@ CONFIG_NET_SCH_DSMARK=m
 CONFIG_NET_QOS=y
 CONFIG_NET_ESTIMATOR=y
 CONFIG_NET_CLS=y
+# CONFIG_NET_CLS_BASIC is not set
 CONFIG_NET_CLS_TCINDEX=m
 CONFIG_NET_CLS_ROUTE4=m
 CONFIG_NET_CLS_ROUTE=y
@@ -338,6 +340,7 @@ CONFIG_NET_CLS_U32=m
 # CONFIG_NET_CLS_IND is not set
 CONFIG_NET_CLS_RSVP=m
 CONFIG_NET_CLS_RSVP6=m
+# CONFIG_NET_EMATCH is not set
 # CONFIG_NET_CLS_ACT is not set
 CONFIG_NET_CLS_POLICE=y
 
@@ -393,6 +396,8 @@ CONFIG_CTC=m
 CONFIG_IUCV=m
 # CONFIG_NETIUCV is not set
 # CONFIG_SMSGIUCV is not set
+# CONFIG_CLAW is not set
+# CONFIG_MPC is not set
 CONFIG_QETH=y
 
 #
@@ -532,10 +537,13 @@ CONFIG_MSDOS_PARTITION=y
 #
 # Kernel hacking
 #
+# CONFIG_PRINTK_TIME is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
@@ -560,6 +568,7 @@ CONFIG_CRYPTO=y
 # CONFIG_CRYPTO_SHA256 is not set
 # CONFIG_CRYPTO_SHA512 is not set
 # CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
 # CONFIG_CRYPTO_DES is not set
 # CONFIG_CRYPTO_DES_Z990 is not set
 # CONFIG_CRYPTO_BLOWFISH is not set
diff --git a/arch/s390/kernel/compat_ioctl.c b/arch/s390/kernel/compat_ioctl.c
index 96571ff7115d..03d03c6d3cbb 100644
--- a/arch/s390/kernel/compat_ioctl.c
+++ b/arch/s390/kernel/compat_ioctl.c
@@ -16,6 +16,7 @@
 #define CODE
 #include "../../../fs/compat_ioctl.c"
 #include <asm/dasd.h>
+#include <asm/cmb.h>
 #include <asm/tape390.h>
 
 static int do_ioctl32_pointer(unsigned int fd, unsigned int cmd,
@@ -58,7 +59,11 @@ COMPATIBLE_IOCTL(BIODASDPRRD)
 COMPATIBLE_IOCTL(BIODASDPSRD)
 COMPATIBLE_IOCTL(BIODASDGATTR)
 COMPATIBLE_IOCTL(BIODASDSATTR)
-
+#if defined(CONFIG_DASD_CMB) || defined(CONFIG_DASD_CMB_MODULE)
+COMPATIBLE_IOCTL(BIODASDCMFENABLE)
+COMPATIBLE_IOCTL(BIODASDCMFDISABLE)
+COMPATIBLE_IOCTL(BIODASDREADALLCMB)
+#endif
 #endif
 
 #if defined(CONFIG_S390_TAPE) || defined(CONFIG_S390_TAPE_MODULE)
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 647233c02fc8..9f0d73e3f5f7 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -32,6 +32,7 @@
 #include <linux/user.h>
 #include <linux/security.h>
 #include <linux/audit.h>
+#include <linux/signal.h>
 
 #include <asm/segment.h>
 #include <asm/page.h>
@@ -609,7 +610,7 @@ do_ptrace(struct task_struct *child, long request, long addr, long data)
                 /* continue and stop at next (return from) syscall */
         case PTRACE_CONT:
                 /* restart after signal. */
-                if ((unsigned long) data >= _NSIG)
+                if (!valid_signal(data))
                         return -EIO;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -637,7 +638,7 @@ do_ptrace(struct task_struct *child, long request, long addr, long data)
 
         case PTRACE_SINGLESTEP:
                 /* set the trap flag. */
-                if ((unsigned long) data >= _NSIG)
+                if (!valid_signal(data))
                         return -EIO;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 child->exit_code = data;
diff --git a/arch/s390/kernel/s390_ksyms.c b/arch/s390/kernel/s390_ksyms.c
index 11fd6d556d8f..bee654abb6d3 100644
--- a/arch/s390/kernel/s390_ksyms.c
+++ b/arch/s390/kernel/s390_ksyms.c
@@ -34,7 +34,6 @@ EXPORT_SYMBOL(__clear_user_asm);
 EXPORT_SYMBOL(__strncpy_from_user_asm);
 EXPORT_SYMBOL(__strnlen_user_asm);
 EXPORT_SYMBOL(diag10);
-EXPORT_SYMBOL(default_storage_key);
 
 /*
  * semaphore ops
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index c879c40aa7a5..df83215beac3 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -44,6 +44,8 @@
 #include <asm/cpcmd.h>
 #include <asm/lowcore.h>
 #include <asm/irq.h>
+#include <asm/page.h>
+#include <asm/ptrace.h>
 
 /*
  * Machine setup..
@@ -53,13 +55,14 @@ unsigned int console_devno = -1;
 unsigned int console_irq = -1;
 unsigned long memory_size = 0;
 unsigned long machine_flags = 0;
-unsigned int default_storage_key = 0;
 struct {
         unsigned long addr, size, type;
 } memory_chunk[MEMORY_CHUNKS] = { { 0 } };
 #define CHUNK_READ_WRITE 0
 #define CHUNK_READ_ONLY 1
 volatile int __cpu_logical_map[NR_CPUS]; /* logical cpu to cpu address */
+unsigned long __initdata zholes_size[MAX_NR_ZONES];
+static unsigned long __initdata memory_end;
 
 /*
  * Setup options
@@ -78,11 +81,15 @@ static char command_line[COMMAND_LINE_SIZE] = { 0, };
 
 static struct resource code_resource = {
         .name  = "Kernel code",
+        .start = (unsigned long) &_text,
+        .end = (unsigned long) &_etext - 1,
         .flags = IORESOURCE_BUSY | IORESOURCE_MEM,
 };
 
 static struct resource data_resource = {
         .name = "Kernel data",
+        .start = (unsigned long) &_etext,
+        .end = (unsigned long) &_edata - 1,
         .flags = IORESOURCE_BUSY | IORESOURCE_MEM,
 };
 
@@ -310,90 +317,50 @@ void machine_power_off(void)
 
 EXPORT_SYMBOL(machine_power_off);
 
-/*
- * Setup function called from init/main.c just after the banner
- * was printed.
- */
-extern char _pstart, _pend, _stext;
+static void __init
+add_memory_hole(unsigned long start, unsigned long end)
+{
+        unsigned long dma_pfn = MAX_DMA_ADDRESS >> PAGE_SHIFT;
+
+        if (end <= dma_pfn)
+                zholes_size[ZONE_DMA] += end - start + 1;
+        else if (start > dma_pfn)
+                zholes_size[ZONE_NORMAL] += end - start + 1;
+        else {
+                zholes_size[ZONE_DMA] += dma_pfn - start + 1;
+                zholes_size[ZONE_NORMAL] += end - dma_pfn;
+        }
+}
 
-void __init setup_arch(char **cmdline_p)
+static void __init
+parse_cmdline_early(char **cmdline_p)
 {
-        unsigned long bootmap_size;
-        unsigned long memory_start, memory_end;
-        char c = ' ', cn, *to = command_line, *from = COMMAND_LINE;
-        unsigned long start_pfn, end_pfn;
-        static unsigned int smptrap=0;
-        unsigned long delay = 0;
-        struct _lowcore *lc;
-        int i;
+        char c = ' ', cn, *to = command_line, *from = COMMAND_LINE;
+        unsigned long delay = 0;
 
-        if (smptrap)
-                return;
-        smptrap=1;
+        /* Save unparsed command line copy for /proc/cmdline */
+        memcpy(saved_command_line, COMMAND_LINE, COMMAND_LINE_SIZE);
+        saved_command_line[COMMAND_LINE_SIZE-1] = '\0';
 
-        /*
-         * print what head.S has found out about the machine 
-         */
-#ifndef CONFIG_ARCH_S390X
-        printk((MACHINE_IS_VM) ?
-               "We are running under VM (31 bit mode)\n" :
-               "We are running native (31 bit mode)\n");
-        printk((MACHINE_HAS_IEEE) ?
-               "This machine has an IEEE fpu\n" :
-               "This machine has no IEEE fpu\n");
-#else /* CONFIG_ARCH_S390X */
-        printk((MACHINE_IS_VM) ?
-               "We are running under VM (64 bit mode)\n" :
-               "We are running native (64 bit mode)\n");
-#endif /* CONFIG_ARCH_S390X */
-
-        ROOT_DEV = Root_RAM0;
-        memory_start = (unsigned long) &_end;    /* fixit if use $CODELO etc*/
-#ifndef CONFIG_ARCH_S390X
-        memory_end = memory_size & ~0x400000UL;  /* align memory end to 4MB */
-        /*
-         * We need some free virtual space to be able to do vmalloc.
-         * On a machine with 2GB memory we make sure that we have at
-         * least 128 MB free space for vmalloc.
-         */
-        if (memory_end > 1920*1024*1024)
-                memory_end = 1920*1024*1024;
-#else /* CONFIG_ARCH_S390X */
-        memory_end = memory_size & ~0x200000UL;  /* detected in head.s */
-#endif /* CONFIG_ARCH_S390X */
-        init_mm.start_code = PAGE_OFFSET;
-        init_mm.end_code = (unsigned long) &_etext;
-        init_mm.end_data = (unsigned long) &_edata;
-        init_mm.brk = (unsigned long) &_end;
-
-        code_resource.start = (unsigned long) &_text;
-        code_resource.end = (unsigned long) &_etext - 1;
-        data_resource.start = (unsigned long) &_etext;
-        data_resource.end = (unsigned long) &_edata - 1;
-
-        /* Save unparsed command line copy for /proc/cmdline */
-        memcpy(saved_command_line, COMMAND_LINE, COMMAND_LINE_SIZE);
-        saved_command_line[COMMAND_LINE_SIZE-1] = '\0';
-
-        for (;;) {
-                /*
-                 * "mem=XXX[kKmM]" sets memsize 
-                 */
-                if (c == ' ' && strncmp(from, "mem=", 4) == 0) {
-                        memory_end = simple_strtoul(from+4, &from, 0);
-                        if ( *from == 'K' || *from == 'k' ) {
-                                memory_end = memory_end << 10;
-                                from++;
-                        } else if ( *from == 'M' || *from == 'm' ) {
-                                memory_end = memory_end << 20;
-                                from++;
-                        }
-                }
-                /*
-                 * "ipldelay=XXX[sm]" sets ipl delay in seconds or minutes
-                 */
-                if (c == ' ' && strncmp(from, "ipldelay=", 9) == 0) {
-                        delay = simple_strtoul(from+9, &from, 0);
+        for (;;) {
+                /*
+                 * "mem=XXX[kKmM]" sets memsize
+                 */
+                if (c == ' ' && strncmp(from, "mem=", 4) == 0) {
+                        memory_end = simple_strtoul(from+4, &from, 0);
+                        if ( *from == 'K' || *from == 'k' ) {
+                                memory_end = memory_end << 10;
+                                from++;
+                        } else if ( *from == 'M' || *from == 'm' ) {
+                                memory_end = memory_end << 20;
+                                from++;
+                        }
+                }
+                /*
+                 * "ipldelay=XXX[sm]" sets ipl delay in seconds or minutes
+                 */
+                if (c == ' ' && strncmp(from, "ipldelay=", 9) == 0) {
+                        delay = simple_strtoul(from+9, &from, 0);
                         if (*from == 's' || *from == 'S') {
                                 delay = delay*1000000;
                                 from++;
@@ -403,24 +370,110 @@ void __init setup_arch(char **cmdline_p)
                         }
                         /* now wait for the requested amount of time */
                         udelay(delay);
-                }
-                cn = *(from++);
-                if (!cn)
-                        break;
-                if (cn == '\n')
-                        cn = ' ';  /* replace newlines with space */
+                }
+                cn = *(from++);
+                if (!cn)
+                        break;
+                if (cn == '\n')
+                        cn = ' ';  /* replace newlines with space */
                 if (cn == 0x0d)
                         cn = ' ';  /* replace 0x0d with space */
-                if (cn == ' ' && c == ' ')
-                        continue;  /* remove additional spaces */
-                c = cn;
-                if (to - command_line >= COMMAND_LINE_SIZE)
-                        break;
-                *(to++) = c;
-        }
-        if (c == ' ' && to > command_line) to--;
-        *to = '\0';
-        *cmdline_p = command_line;
+                if (cn == ' ' && c == ' ')
+                        continue;  /* remove additional spaces */
+                c = cn;
+                if (to - command_line >= COMMAND_LINE_SIZE)
+                        break;
+                *(to++) = c;
+        }
+        if (c == ' ' && to > command_line) to--;
+        *to = '\0';
+        *cmdline_p = command_line;
+}
+
+static void __init
+setup_lowcore(void)
+{
+        struct _lowcore *lc;
+        int lc_pages;
+
+        /*
+         * Setup lowcore for boot cpu
+         */
+        lc_pages = sizeof(void *) == 8 ? 2 : 1;
+        lc = (struct _lowcore *)
+                __alloc_bootmem(lc_pages * PAGE_SIZE, lc_pages * PAGE_SIZE, 0);
+        memset(lc, 0, lc_pages * PAGE_SIZE);
+        lc->restart_psw.mask = PSW_BASE_BITS | PSW_DEFAULT_KEY;
+        lc->restart_psw.addr =
+                PSW_ADDR_AMODE | (unsigned long) restart_int_handler;
+        lc->external_new_psw.mask = PSW_KERNEL_BITS;
+        lc->external_new_psw.addr =
+                PSW_ADDR_AMODE | (unsigned long) ext_int_handler;
+        lc->svc_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_IO | PSW_MASK_EXT;
+        lc->svc_new_psw.addr = PSW_ADDR_AMODE | (unsigned long) system_call;
+        lc->program_new_psw.mask = PSW_KERNEL_BITS;
+        lc->program_new_psw.addr =
+                PSW_ADDR_AMODE | (unsigned long)pgm_check_handler;
+        lc->mcck_new_psw.mask = PSW_KERNEL_BITS;
+        lc->mcck_new_psw.addr =
+                PSW_ADDR_AMODE | (unsigned long) mcck_int_handler;
+        lc->io_new_psw.mask = PSW_KERNEL_BITS;
+        lc->io_new_psw.addr = PSW_ADDR_AMODE | (unsigned long) io_int_handler;
+        lc->ipl_device = S390_lowcore.ipl_device;
+        lc->jiffy_timer = -1LL;
+        lc->kernel_stack = ((unsigned long) &init_thread_union) + THREAD_SIZE;
+        lc->async_stack = (unsigned long)
+                __alloc_bootmem(ASYNC_SIZE, ASYNC_SIZE, 0) + ASYNC_SIZE;
+#ifdef CONFIG_CHECK_STACK
+        lc->panic_stack = (unsigned long)
+                __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0) + PAGE_SIZE;
+#endif
+        lc->current_task = (unsigned long) init_thread_union.thread_info.task;
+        lc->thread_info = (unsigned long) &init_thread_union;
+#ifdef CONFIG_ARCH_S390X
+        if (MACHINE_HAS_DIAG44)
+                lc->diag44_opcode = 0x83000044;
+        else
+                lc->diag44_opcode = 0x07000700;
+#endif /* CONFIG_ARCH_S390X */
+        set_prefix((u32)(unsigned long) lc);
+}
+
+static void __init
+setup_resources(void)
+{
+        struct resource *res;
+        int i;
+
+        for (i = 0; i < MEMORY_CHUNKS && memory_chunk[i].size > 0; i++) {
+                res = alloc_bootmem_low(sizeof(struct resource));
+                res->flags = IORESOURCE_BUSY | IORESOURCE_MEM;
+                switch (memory_chunk[i].type) {
+                case CHUNK_READ_WRITE:
+                        res->name = "System RAM";
+                        break;
+                case CHUNK_READ_ONLY:
+                        res->name = "System ROM";
+                        res->flags |= IORESOURCE_READONLY;
+                        break;
+                default:
+                        res->name = "reserved";
+                }
+                res->start = memory_chunk[i].addr;
+                res->end = memory_chunk[i].addr +  memory_chunk[i].size - 1;
+                request_resource(&iomem_resource, res);
+                request_resource(res, &code_resource);
+                request_resource(res, &data_resource);
+        }
+}
+
+static void __init
+setup_memory(void)
+{
+        unsigned long bootmap_size;
+        unsigned long start_pfn, end_pfn, init_pfn;
+        unsigned long last_rw_end;
+        int i;
 
         /*
          * partially used pages are not usable - thus
@@ -429,6 +482,10 @@ void __init setup_arch(char **cmdline_p)
         start_pfn = (__pa(&_end) + PAGE_SIZE - 1) >> PAGE_SHIFT;
         end_pfn = max_pfn = memory_end >> PAGE_SHIFT;
 
+        /* Initialize storage key for kernel pages */
+        for (init_pfn = 0 ; init_pfn < start_pfn; init_pfn++)
+                page_set_storage_key(init_pfn << PAGE_SHIFT, PAGE_DEFAULT_KEY);
+
         /*
          * Initialize the boot-time allocator (with low memory only):
          */
@@ -437,7 +494,9 @@ void __init setup_arch(char **cmdline_p)
         /*
          * Register RAM areas with the bootmem allocator.
          */
-        for (i = 0; i < 16 && memory_chunk[i].size > 0; i++) {
+        last_rw_end = start_pfn;
+
+        for (i = 0; i < MEMORY_CHUNKS && memory_chunk[i].size > 0; i++) {
                 unsigned long start_chunk, end_chunk;
 
                 if (memory_chunk[i].type != CHUNK_READ_WRITE)
@@ -450,102 +509,98 @@ void __init setup_arch(char **cmdline_p)
                         start_chunk = start_pfn;
                 if (end_chunk > end_pfn)
                         end_chunk = end_pfn;
-                if (start_chunk < end_chunk)
+                if (start_chunk < end_chunk) {
+                        /* Initialize storage key for RAM pages */
+                        for (init_pfn = start_chunk ; init_pfn < end_chunk;
+                             init_pfn++)
+                                page_set_storage_key(init_pfn << PAGE_SHIFT,
+                                                     PAGE_DEFAULT_KEY);
                         free_bootmem(start_chunk << PAGE_SHIFT,
                                      (end_chunk - start_chunk) << PAGE_SHIFT);
+                        if (last_rw_end < start_chunk)
+                                add_memory_hole(last_rw_end, start_chunk - 1);
+                        last_rw_end = end_chunk;
+                }
         }
 
-        /*
-         * Reserve the bootmem bitmap itself as well. We do this in two
-         * steps (first step was init_bootmem()) because this catches
-         * the (very unlikely) case of us accidentally initializing the
-         * bootmem allocator with an invalid RAM area.
-         */
-        reserve_bootmem(start_pfn << PAGE_SHIFT, bootmap_size);
+        psw_set_key(PAGE_DEFAULT_KEY);
+
+        if (last_rw_end < end_pfn - 1)
+                add_memory_hole(last_rw_end, end_pfn - 1);
+
+        /*
+         * Reserve the bootmem bitmap itself as well. We do this in two
+         * steps (first step was init_bootmem()) because this catches
+         * the (very unlikely) case of us accidentally initializing the
+         * bootmem allocator with an invalid RAM area.
+         */
+        reserve_bootmem(start_pfn << PAGE_SHIFT, bootmap_size);
 
 #ifdef CONFIG_BLK_DEV_INITRD
-        if (INITRD_START) {
+        if (INITRD_START) {
                 if (INITRD_START + INITRD_SIZE <= memory_end) {
                         reserve_bootmem(INITRD_START, INITRD_SIZE);
                         initrd_start = INITRD_START;
                         initrd_end = initrd_start + INITRD_SIZE;
                 } else {
-                        printk("initrd extends beyond end of memory "
-                               "(0x%08lx > 0x%08lx)\ndisabling initrd\n",
-                               initrd_start + INITRD_SIZE, memory_end);
-                        initrd_start = initrd_end = 0;
+                        printk("initrd extends beyond end of memory "
+                               "(0x%08lx > 0x%08lx)\ndisabling initrd\n",
+                               initrd_start + INITRD_SIZE, memory_end);
+                        initrd_start = initrd_end = 0;
                 }
-        }
+        }
 #endif
+}
 
-        for (i = 0; i < 16 && memory_chunk[i].size > 0; i++) {
-                struct resource *res;
-
-                res = alloc_bootmem_low(sizeof(struct resource));
-                res->flags = IORESOURCE_BUSY | IORESOURCE_MEM;
-
-                switch (memory_chunk[i].type) {
-                case CHUNK_READ_WRITE:
-                        res->name = "System RAM";
-                        break;
-                case CHUNK_READ_ONLY:
-                        res->name = "System ROM";
-                        res->flags |= IORESOURCE_READONLY;
-                        break;
-                default:
-                        res->name = "reserved";
-                }
-                res->start = memory_chunk[i].addr;
-                res->end = memory_chunk[i].addr +  memory_chunk[i].size - 1;
-                request_resource(&iomem_resource, res);
-                request_resource(res, &code_resource);
-                request_resource(res, &data_resource);
-        }
+/*
+ * Setup function called from init/main.c just after the banner
+ * was printed.
+ */
 
+void __init
+setup_arch(char **cmdline_p)
+{
         /*
-         * Setup lowcore for boot cpu
+         * print what head.S has found out about the machine
          */
 #ifndef CONFIG_ARCH_S390X
-        lc = (struct _lowcore *) __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0);
-        memset(lc, 0, PAGE_SIZE);
+        printk((MACHINE_IS_VM) ?
+               "We are running under VM (31 bit mode)\n" :
+               "We are running native (31 bit mode)\n");
+        printk((MACHINE_HAS_IEEE) ?
+               "This machine has an IEEE fpu\n" :
+               "This machine has no IEEE fpu\n");
 #else /* CONFIG_ARCH_S390X */
-        lc = (struct _lowcore *) __alloc_bootmem(2*PAGE_SIZE, 2*PAGE_SIZE, 0);
-        memset(lc, 0, 2*PAGE_SIZE);
+        printk((MACHINE_IS_VM) ?
+               "We are running under VM (64 bit mode)\n" :
+               "We are running native (64 bit mode)\n");
 #endif /* CONFIG_ARCH_S390X */
-        lc->restart_psw.mask = PSW_BASE_BITS;
-        lc->restart_psw.addr =
-                PSW_ADDR_AMODE | (unsigned long) restart_int_handler;
-        lc->external_new_psw.mask = PSW_KERNEL_BITS;
-        lc->external_new_psw.addr =
-                PSW_ADDR_AMODE | (unsigned long) ext_int_handler;
-        lc->svc_new_psw.mask = PSW_KERNEL_BITS | PSW_MASK_IO | PSW_MASK_EXT;
-        lc->svc_new_psw.addr = PSW_ADDR_AMODE | (unsigned long) system_call;
-        lc->program_new_psw.mask = PSW_KERNEL_BITS;
-        lc->program_new_psw.addr =
-                PSW_ADDR_AMODE | (unsigned long)pgm_check_handler;
-        lc->mcck_new_psw.mask = PSW_KERNEL_BITS;
-        lc->mcck_new_psw.addr =
-                PSW_ADDR_AMODE | (unsigned long) mcck_int_handler;
-        lc->io_new_psw.mask = PSW_KERNEL_BITS;
-        lc->io_new_psw.addr = PSW_ADDR_AMODE | (unsigned long) io_int_handler;
-        lc->ipl_device = S390_lowcore.ipl_device;
-        lc->jiffy_timer = -1LL;
-        lc->kernel_stack = ((unsigned long) &init_thread_union) + THREAD_SIZE;
-        lc->async_stack = (unsigned long)
-                __alloc_bootmem(ASYNC_SIZE, ASYNC_SIZE, 0) + ASYNC_SIZE;
-#ifdef CONFIG_CHECK_STACK
-        lc->panic_stack = (unsigned long)
-                __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0) + PAGE_SIZE;
-#endif
-        lc->current_task = (unsigned long) init_thread_union.thread_info.task;
-        lc->thread_info = (unsigned long) &init_thread_union;
-#ifdef CONFIG_ARCH_S390X
-        if (MACHINE_HAS_DIAG44)
-                lc->diag44_opcode = 0x83000044;
-        else
-                lc->diag44_opcode = 0x07000700;
+
+        ROOT_DEV = Root_RAM0;
+#ifndef CONFIG_ARCH_S390X
+        memory_end = memory_size & ~0x400000UL;  /* align memory end to 4MB */
+        /*
+         * We need some free virtual space to be able to do vmalloc.
+         * On a machine with 2GB memory we make sure that we have at
+         * least 128 MB free space for vmalloc.
+         */
+        if (memory_end > 1920*1024*1024)
+                memory_end = 1920*1024*1024;
+#else /* CONFIG_ARCH_S390X */
+        memory_end = memory_size & ~0x200000UL;  /* detected in head.s */
 #endif /* CONFIG_ARCH_S390X */
-        set_prefix((u32)(unsigned long) lc);
+
+        init_mm.start_code = PAGE_OFFSET;
+        init_mm.end_code = (unsigned long) &_etext;
+        init_mm.end_data = (unsigned long) &_edata;
+        init_mm.brk = (unsigned long) &_end;
+
+        parse_cmdline_early(cmdline_p);
+
+        setup_memory();
+        setup_resources();
+        setup_lowcore();
+
         cpu_init();
         __cpu_logical_map[0] = S390_lowcore.cpu_data.cpu_addr;
 
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 061e81138dc2..8ca485676780 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -244,7 +244,7 @@ int sysctl_hz_timer = 1;
  */
 static inline void stop_hz_timer(void)
 {
-        __u64 timer;
+        __u64 timer, todval;
 
         if (sysctl_hz_timer != 0)
                 return;
@@ -265,8 +265,14 @@ static inline void stop_hz_timer(void)
          * for the next event.
          */
         timer = (__u64) (next_timer_interrupt() - jiffies) + jiffies_64;
-        timer = jiffies_timer_cc + timer * CLK_TICKS_PER_JIFFY;
-        asm volatile ("SCKC %0" : : "m" (timer));
+        todval = -1ULL;
+        /* Be careful about overflows. */
+        if (timer < (-1ULL / CLK_TICKS_PER_JIFFY)) {
+                timer = jiffies_timer_cc + timer * CLK_TICKS_PER_JIFFY;
+                if (timer >= jiffies_timer_cc)
+                        todval = timer;
+        }
+        asm volatile ("SCKC %0" : : "m" (todval));
 }
 
 /*
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index bb6cf02418a2..fa0726507b3d 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -122,12 +122,17 @@ static void start_cpu_timer(void)
         struct vtimer_queue *vt_list;
 
         vt_list = &per_cpu(virt_cpu_timer, smp_processor_id());
-        set_vtimer(vt_list->idle);
+
+        /* CPU timer interrupt is pending, don't reprogramm it */
+        if (vt_list->idle & 1LL<<63)
+                return;
+
+        if (!list_empty(&vt_list->list))
+                set_vtimer(vt_list->idle);
 }
 
 static void stop_cpu_timer(void)
 {
-        __u64 done;
         struct vtimer_queue *vt_list;
 
         vt_list = &per_cpu(virt_cpu_timer, smp_processor_id());
@@ -138,21 +143,17 @@ static void stop_cpu_timer(void)
                 goto fire;
         }
 
-        /* store progress */
-        asm volatile ("STPT %0" : "=m" (done));
+        /* store the actual expire value */
+        asm volatile ("STPT %0" : "=m" (vt_list->idle));
 
         /*
-         * If done is negative we do not stop the CPU timer
-         * because we will get instantly an interrupt that
-         * will start the CPU timer again.
+         * If the CPU timer is negative we don't reprogramm
+         * it because we will get instantly an interrupt.
          */
-        if (done & 1LL<<63)
+        if (vt_list->idle & 1LL<<63)
                 return;
-        else
-                vt_list->offset += vt_list->to_expire - done;
 
-        /* save the actual expire value */
-        vt_list->idle = done;
+        vt_list->offset += vt_list->to_expire - vt_list->idle;
 
         /*
          * We cannot halt the CPU timer, we just write a value that
diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c
index d30cdb4248a9..f5a5bc09b8fa 100644
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -20,6 +20,11 @@
 #include <asm/pgalloc.h>
 #include <asm/uaccess.h>
 
+static char *sender = "VMRMSVM";
+module_param(sender, charp, 0);
+MODULE_PARM_DESC(sender,
+                 "Guest name that may send SMSG messages (default VMRMSVM)");
+
 #include "../../../drivers/s390/net/smsgiucv.h"
 
 #define CMM_NR_PAGES ((PAGE_SIZE / sizeof(unsigned long)) - 2)
@@ -367,10 +372,12 @@ static struct ctl_table cmm_dir_table[] = {
 #ifdef CONFIG_CMM_IUCV
 #define SMSG_PREFIX "CMM"
 static void
-cmm_smsg_target(char *msg)
+cmm_smsg_target(char *from, char *msg)
 {
         long pages, seconds;
 
+        if (strlen(sender) > 0 && strcmp(from, sender) != 0)
+                return;
         if (!cmm_skip_blanks(msg + strlen(SMSG_PREFIX), &msg))
                 return;
         if (strncmp(msg, "SHRINK", 6) == 0) {
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 8e723bc7f795..6ec5cd981e74 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -101,6 +101,7 @@ extern unsigned long _end;
 extern unsigned long __init_begin;
 extern unsigned long __init_end;
 
+extern unsigned long __initdata zholes_size[];
 /*
  * paging_init() sets up the page tables
  */
@@ -163,10 +164,13 @@ void __init paging_init(void)
         local_flush_tlb();
 
         {
-                unsigned long zones_size[MAX_NR_ZONES] = { 0, 0, 0};
+                unsigned long zones_size[MAX_NR_ZONES];
 
+                memset(zones_size, 0, sizeof(zones_size));
                 zones_size[ZONE_DMA] = max_low_pfn;
-                free_area_init(zones_size);
+                free_area_init_node(0, &contig_page_data, zones_size,
+                                    __pa(PAGE_OFFSET) >> PAGE_SHIFT,
+                                    zholes_size);
         }
         return;
 }
@@ -184,9 +188,10 @@ void __init paging_init(void)
           _KERN_REGION_TABLE;
         static const int ssm_mask = 0x04000000L;
 
-        unsigned long zones_size[MAX_NR_ZONES] = {0, 0, 0};
+        unsigned long zones_size[MAX_NR_ZONES];
         unsigned long dma_pfn, high_pfn;
 
+        memset(zones_size, 0, sizeof(zones_size));
         dma_pfn = MAX_DMA_ADDRESS >> PAGE_SHIFT;
         high_pfn = max_low_pfn;
 
@@ -198,8 +203,8 @@ void __init paging_init(void)
         }
 
         /* Initialize mem_map[].  */
-        free_area_init(zones_size);
-
+        free_area_init_node(0, &contig_page_data, zones_size,
+                            __pa(PAGE_OFFSET) >> PAGE_SHIFT, zholes_size);
 
         /*
          * map whole physical memory to virtual memory (identity mapping) 
diff --git a/arch/sh/kernel/ptrace.c b/arch/sh/kernel/ptrace.c
index 1b0dfb4d8ea4..b28919b65682 100644
--- a/arch/sh/kernel/ptrace.c
+++ b/arch/sh/kernel/ptrace.c
@@ -20,6 +20,7 @@
 #include <linux/user.h>
 #include <linux/slab.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -197,7 +198,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -228,7 +229,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                 struct pt_regs *dummy = NULL;
 
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 if ((child->ptrace & PT_DTRACE) == 0) {
diff --git a/arch/sh64/kernel/ptrace.c b/arch/sh64/kernel/ptrace.c
index 800288c1562b..fd2000956dae 100644
--- a/arch/sh64/kernel/ptrace.c
+++ b/arch/sh64/kernel/ptrace.c
@@ -27,6 +27,7 @@
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/user.h>
+#include <linux/signal.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -255,7 +256,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
@@ -285,7 +286,7 @@ asmlinkage int sys_ptrace(long request, long pid, long addr, long data)
                 struct pt_regs *regs;
 
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 if ((child->ptrace & PT_DTRACE) == 0) {
diff --git a/arch/sh64/kernel/sys_sh64.c b/arch/sh64/kernel/sys_sh64.c
index 4546845b9caf..58ff7d522d81 100644
--- a/arch/sh64/kernel/sys_sh64.c
+++ b/arch/sh64/kernel/sys_sh64.c
@@ -283,18 +283,3 @@ asmlinkage int sys_uname(struct old_utsname * name)
         up_read(&uts_sem);
         return err?-EFAULT:0;
 }
-
-/* Copy from mips version */
-asmlinkage long sys_shmatcall(int shmid, char __user *shmaddr,
-                int shmflg)
-{
-        unsigned long raddr;
-        int err;
-
-        err = do_shmat(shmid, shmaddr, shmflg, &raddr);
-        if (err)
-                return err;
-
-        err = raddr;
-        return err;
-}
diff --git a/arch/sh64/kernel/syscalls.S b/arch/sh64/kernel/syscalls.S
index 8ed417df3dc6..6aabc63e4518 100644
--- a/arch/sh64/kernel/syscalls.S
+++ b/arch/sh64/kernel/syscalls.S
@@ -268,7 +268,7 @@ sys_call_table:
         .long sys_msgrcv
         .long sys_msgget
         .long sys_msgctl
-        .long sys_shmatcall
+        .long sys_shmat
         .long sys_shmdt                 /* 245 */
         .long sys_shmget
         .long sys_shmctl
diff --git a/arch/sparc/kernel/ptrace.c b/arch/sparc/kernel/ptrace.c
index c4f93bd2daf2..475c4c13462c 100644
--- a/arch/sparc/kernel/ptrace.c
+++ b/arch/sparc/kernel/ptrace.c
@@ -18,6 +18,7 @@
 #include <linux/smp.h>
 #include <linux/smp_lock.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/pgtable.h>
 #include <asm/system.h>
@@ -526,7 +527,7 @@ asmlinkage void do_ptrace(struct pt_regs *regs)
                 addr = 1;
 
         case PTRACE_CONT: { /* restart after signal. */
-                if (data > _NSIG) {
+                if (!valid_signal(data)) {
                         pt_error_return(regs, EIO);
                         goto out_tsk;
                 }
diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
index 5f080cf04b33..80a76e2ad732 100644
--- a/arch/sparc64/kernel/ptrace.c
+++ b/arch/sparc64/kernel/ptrace.c
@@ -19,6 +19,7 @@
 #include <linux/smp.h>
 #include <linux/smp_lock.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/asi.h>
 #include <asm/pgtable.h>
@@ -559,7 +560,7 @@ asmlinkage void do_ptrace(struct pt_regs *regs)
                 addr = 1;
 
         case PTRACE_CONT: { /* restart after signal. */
-                if (data > _NSIG) {
+                if (!valid_signal(data)) {
                         pt_error_return(regs, EIO);
                         goto out_tsk;
                 }
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 9a23df182123..c5292181a664 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -244,6 +244,7 @@ config KERNEL_HALF_GIGS
 
 config HIGHMEM
         bool "Highmem support"
+        depends on !64BIT
 
 config KERNEL_STACK_ORDER
         int "Kernel stack size order"
diff --git a/arch/um/Kconfig_i386 b/arch/um/Kconfig_i386
index 203c242201b6..e41f3748d30f 100644
--- a/arch/um/Kconfig_i386
+++ b/arch/um/Kconfig_i386
@@ -1,4 +1,8 @@
-config 64_BIT
+config UML_X86
+        bool
+        default y
+
+config 64BIT
         bool
         default n
 
diff --git a/arch/um/Kconfig_x86_64 b/arch/um/Kconfig_x86_64
index 768dc6626a8d..fd8d7e8982b1 100644
--- a/arch/um/Kconfig_x86_64
+++ b/arch/um/Kconfig_x86_64
@@ -1,4 +1,8 @@
-config 64_BIT
+config UML_X86
+        bool
+        default y
+
+config 64BIT
         bool
         default y
 
diff --git a/arch/um/Makefile-i386 b/arch/um/Makefile-i386
index 97b223bfa78e..f9e3c0f06541 100644
--- a/arch/um/Makefile-i386
+++ b/arch/um/Makefile-i386
@@ -1,4 +1,4 @@
-SUBARCH_CORE := arch/um/sys-i386/
+SUBARCH_CORE := arch/um/sys-i386/ arch/i386/crypto/
 
 TOP_ADDR := $(CONFIG_TOP_ADDR)
 
diff --git a/arch/um/defconfig b/arch/um/defconfig
index fc3075c589d8..4067c3aa5b60 100644
--- a/arch/um/defconfig
+++ b/arch/um/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.12-rc1-bk1
-# Sun Mar 20 16:53:00 2005
+# Linux kernel version: 2.6.12-rc3-skas3-v9-pre2
+# Sun Apr 24 19:46:10 2005
 #
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_UML=y
@@ -15,7 +15,8 @@ CONFIG_GENERIC_CALIBRATE_DELAY=y
 #
 CONFIG_MODE_TT=y
 CONFIG_MODE_SKAS=y
-# CONFIG_64_BIT is not set
+CONFIG_UML_X86=y
+# CONFIG_64BIT is not set
 CONFIG_TOP_ADDR=0xc0000000
 # CONFIG_3_LEVEL_PGTABLES is not set
 CONFIG_ARCH_HAS_SC_SIGNALS=y
@@ -41,6 +42,7 @@ CONFIG_UML_REAL_TIME_CLOCK=y
 CONFIG_EXPERIMENTAL=y
 CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
@@ -158,7 +160,6 @@ CONFIG_UML_NET_SLIRP=y
 #
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
-# CONFIG_NETLINK_DEV is not set
 CONFIG_UNIX=y
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
@@ -412,6 +413,5 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_FS is not set
 CONFIG_FRAME_POINTER=y
 CONFIG_PT_PROXY=y
-# CONFIG_GPROF is not set
 # CONFIG_GCOV is not set
 # CONFIG_SYSCALL_DEBUG is not set
diff --git a/arch/um/drivers/chan_kern.c b/arch/um/drivers/chan_kern.c
index 1f77deb3fd23..0150038af795 100644
--- a/arch/um/drivers/chan_kern.c
+++ b/arch/um/drivers/chan_kern.c
@@ -22,7 +22,7 @@
 #ifdef CONFIG_NOCONFIG_CHAN
 static void *not_configged_init(char *str, int device, struct chan_opts *opts)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(NULL);
 }
@@ -30,27 +30,27 @@ static void *not_configged_init(char *str, int device, struct chan_opts *opts)
 static int not_configged_open(int input, int output, int primary, void *data,
                               char **dev_out)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-ENODEV);
 }
 
 static void not_configged_close(int fd, void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
 }
 
 static int not_configged_read(int fd, char *c_out, void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
 
 static int not_configged_write(int fd, const char *buf, int len, void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
@@ -58,7 +58,7 @@ static int not_configged_write(int fd, const char *buf, int len, void *data)
 static int not_configged_console_write(int fd, const char *buf, int len,
                                        void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-EIO);
 }
@@ -66,14 +66,14 @@ static int not_configged_console_write(int fd, const char *buf, int len,
 static int not_configged_window_size(int fd, void *data, unsigned short *rows,
                                      unsigned short *cols)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
         return(-ENODEV);
 }
 
 static void not_configged_free(void *data)
 {
-        printk(KERN_ERR "Using a channel type which is configured out of "
+        printf(KERN_ERR "Using a channel type which is configured out of "
                "UML\n");
 }
 
diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 6924f273ced9..d0f97127adf6 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -39,19 +39,69 @@ static void line_timer_cb(void *arg)
         line_interrupt(line->driver->read_irq, arg, NULL);
 }
 
-static int write_room(struct line *dev)
+/* Returns the free space inside the ring buffer of this line.
+ *
+ * Should be called while holding line->lock (this does not modify datas).
+ */
+static int write_room(struct line *line)
 {
         int n;
 
-        if (dev->buffer == NULL)
-                return (LINE_BUFSIZE - 1);
+        if (line->buffer == NULL)
+                return LINE_BUFSIZE - 1;
+
+        /* This is for the case where the buffer is wrapped! */
+        n = line->head - line->tail;
 
-        n = dev->head - dev->tail;
         if (n <= 0)
-                n = LINE_BUFSIZE + n;
-        return (n - 1);
+                n = LINE_BUFSIZE + n; /* The other case */
+        return n - 1;
+}
+
+int line_write_room(struct tty_struct *tty)
+{
+        struct line *line = tty->driver_data;
+        unsigned long flags;
+        int room;
+
+        if (tty->stopped)
+                return 0;
+
+        spin_lock_irqsave(&line->lock, flags);
+        room = write_room(line);
+        spin_unlock_irqrestore(&line->lock, flags);
+
+        /*XXX: Warning to remove */
+        if (0 == room)
+                printk(KERN_DEBUG "%s: %s: no room left in buffer\n",
+                       __FUNCTION__,tty->name);
+        return room;
 }
 
+int line_chars_in_buffer(struct tty_struct *tty)
+{
+        struct line *line = tty->driver_data;
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&line->lock, flags);
+
+        /*write_room subtracts 1 for the needed NULL, so we readd it.*/
+        ret = LINE_BUFSIZE - (write_room(line) + 1);
+        spin_unlock_irqrestore(&line->lock, flags);
+
+        return ret;
+}
+
+/*
+ * This copies the content of buf into the circular buffer associated with
+ * this line.
+ * The return value is the number of characters actually copied, i.e. the ones
+ * for which there was space: this function is not supposed to ever flush out
+ * the circular buffer.
+ *
+ * Must be called while holding line->lock!
+ */
 static int buffer_data(struct line *line, const char *buf, int len)
 {
         int end, room;
@@ -70,48 +120,95 @@ static int buffer_data(struct line *line, const char *buf, int len)
         len = (len > room) ? room : len;
 
         end = line->buffer + LINE_BUFSIZE - line->tail;
-        if(len < end){
+
+        if (len < end){
                 memcpy(line->tail, buf, len);
                 line->tail += len;
-        }
-        else {
+        } else {
+                /* The circular buffer is wrapping */
                 memcpy(line->tail, buf, end);
                 buf += end;
                 memcpy(line->buffer, buf, len - end);
                 line->tail = line->buffer + len - end;
         }
 
-        return(len);
+        return len;
 }
 
+/*
+ * Flushes the ring buffer to the output channels. That is, write_chan is
+ * called, passing it line->head as buffer, and an appropriate count.
+ *
+ * On exit, returns 1 when the buffer is empty,
+ * 0 when the buffer is not empty on exit,
+ * and -errno when an error occurred.
+ *
+ * Must be called while holding line->lock!*/
 static int flush_buffer(struct line *line)
 {
         int n, count;
 
         if ((line->buffer == NULL) || (line->head == line->tail))
-                return(1);
+                return 1;
 
         if (line->tail < line->head) {
+                /* line->buffer + LINE_BUFSIZE is the end of the buffer! */
                 count = line->buffer + LINE_BUFSIZE - line->head;
+
                 n = write_chan(&line->chan_list, line->head, count,
                                line->driver->write_irq);
                 if (n < 0)
-                        return(n);
-                if (n == count)
+                        return n;
+                if (n == count) {
+                        /* We have flushed from ->head to buffer end, now we
+                         * must flush only from the beginning to ->tail.*/
                         line->head = line->buffer;
-                else {
+                } else {
                         line->head += n;
-                        return(0);
+                        return 0;
                 }
         }
 
         count = line->tail - line->head;
         n = write_chan(&line->chan_list, line->head, count, 
                        line->driver->write_irq);
-        if(n < 0) return(n);
+
+        if(n < 0)
+                return n;
 
         line->head += n;
-        return(line->head == line->tail);
+        return line->head == line->tail;
+}
+
+void line_flush_buffer(struct tty_struct *tty)
+{
+        struct line *line = tty->driver_data;
+        unsigned long flags;
+        int err;
+
+        /*XXX: copied from line_write, verify if it is correct!*/
+        if(tty->stopped)
+                return;
+                //return 0;
+
+        spin_lock_irqsave(&line->lock, flags);
+        err = flush_buffer(line);
+        /*if (err == 1)
+                err = 0;*/
+        spin_unlock_irqrestore(&line->lock, flags);
+        //return err;
+}
+
+/* We map both ->flush_chars and ->put_char (which go in pair) onto ->flush_buffer
+ * and ->write. Hope it's not that bad.*/
+void line_flush_chars(struct tty_struct *tty)
+{
+        line_flush_buffer(tty);
+}
+
+void line_put_char(struct tty_struct *tty, unsigned char ch)
+{
+        line_write(tty, &ch, sizeof(ch));
 }
 
 int line_write(struct tty_struct *tty, const unsigned char *buf, int len)
@@ -120,38 +217,31 @@ int line_write(struct tty_struct *tty, const unsigned char *buf, int len)
         unsigned long flags;
         int n, err, ret = 0;
 
-        if(tty->stopped) return 0;
+        if(tty->stopped)
+                return 0;
 
-        down(&line->sem);
-        if(line->head != line->tail){
-                local_irq_save(flags);
+        spin_lock_irqsave(&line->lock, flags);
+        if (line->head != line->tail) {
                 ret = buffer_data(line, buf, len);
                 err = flush_buffer(line);
-                local_irq_restore(flags);
-                if(err <= 0 && (err != -EAGAIN || !ret))
+                if (err <= 0 && (err != -EAGAIN || !ret))
                         ret = err;
-        }
-        else {
+        } else {
                 n = write_chan(&line->chan_list, buf, len, 
                                line->driver->write_irq);
-                if(n < 0){
+                if (n < 0) {
                         ret = n;
                         goto out_up;
                 }
 
                 len -= n;
                 ret += n;
-                if(len > 0)
+                if (len > 0)
                         ret += buffer_data(line, buf + n, len);
         }
- out_up:
-        up(&line->sem);
-        return(ret);
-}
-
-void line_put_char(struct tty_struct *tty, unsigned char ch)
-{
-        line_write(tty, &ch, sizeof(ch));
+out_up:
+        spin_unlock_irqrestore(&line->lock, flags);
+        return ret;
 }
 
 void line_set_termios(struct tty_struct *tty, struct termios * old)
@@ -159,11 +249,6 @@ void line_set_termios(struct tty_struct *tty, struct termios * old)
         /* nothing */
 }
 
-int line_chars_in_buffer(struct tty_struct *tty)
-{
-        return 0;
-}
-
 static struct {
         int  cmd;
         char *level;
@@ -250,7 +335,7 @@ int line_ioctl(struct tty_struct *tty, struct file * file,
                 ret = -ENOIOCTLCMD;
                 break;
         }
-        return(ret);
+        return ret;
 }
 
 static irqreturn_t line_write_interrupt(int irq, void *data,
@@ -260,18 +345,23 @@ static irqreturn_t line_write_interrupt(int irq, void *data,
         struct line *line = tty->driver_data;
         int err;
 
+        /* Interrupts are enabled here because we registered the interrupt with
+         * SA_INTERRUPT (see line_setup_irq).*/
+
+        spin_lock_irq(&line->lock);
         err = flush_buffer(line);
-        if(err == 0)
-                return(IRQ_NONE);
-        else if(err < 0){
+        if (err == 0) {
+                return IRQ_NONE;
+        } else if(err < 0) {
                 line->head = line->buffer;
                 line->tail = line->buffer;
         }
+        spin_unlock_irq(&line->lock);
 
         if(tty == NULL)
-                return(IRQ_NONE);
+                return IRQ_NONE;
 
-        if(test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) &&
+        if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) &&
            (tty->ldisc.write_wakeup != NULL))
                 (tty->ldisc.write_wakeup)(tty);
         
@@ -281,9 +371,9 @@ static irqreturn_t line_write_interrupt(int irq, void *data,
          * writes.
          */
 
-        if(waitqueue_active(&tty->write_wait))
+        if (waitqueue_active(&tty->write_wait))
                 wake_up_interruptible(&tty->write_wait);
-        return(IRQ_HANDLED);
+        return IRQ_HANDLED;
 }
 
 int line_setup_irq(int fd, int input, int output, struct tty_struct *tty)
@@ -292,15 +382,18 @@ int line_setup_irq(int fd, int input, int output, struct tty_struct *tty)
         struct line_driver *driver = line->driver;
         int err = 0, flags = SA_INTERRUPT | SA_SHIRQ | SA_SAMPLE_RANDOM;
 
-        if(input) err = um_request_irq(driver->read_irq, fd, IRQ_READ, 
+        if (input)
+                err = um_request_irq(driver->read_irq, fd, IRQ_READ,
                                        line_interrupt, flags, 
                                        driver->read_irq_name, tty);
-        if(err) return(err);
-        if(output) err = um_request_irq(driver->write_irq, fd, IRQ_WRITE, 
+        if (err)
+                return err;
+        if (output)
+                err = um_request_irq(driver->write_irq, fd, IRQ_WRITE,
                                         line_write_interrupt, flags, 
                                         driver->write_irq_name, tty);
         line->have_irq = 1;
-        return(err);
+        return err;
 }
 
 void line_disable(struct tty_struct *tty, int current_irq)
@@ -336,7 +429,9 @@ int line_open(struct line *lines, struct tty_struct *tty,
         line = &lines[tty->index];
         tty->driver_data = line;
 
-        down(&line->sem);
+        /* The IRQ which takes this lock is not yet enabled and won't be run
+         * before the end, so we don't need to use spin_lock_irq.*/
+        spin_lock(&line->lock);
         if (tty->count == 1) {
                 if (!line->valid) {
                         err = -ENODEV;
@@ -349,6 +444,7 @@ int line_open(struct line *lines, struct tty_struct *tty,
                         err = open_chan(&line->chan_list);
                         if(err) goto out;
                 }
+                /* Here the interrupt is registered.*/
                 enable_chan(&line->chan_list, tty);
                 INIT_WORK(&line->task, line_timer_cb, tty);
         }
@@ -362,21 +458,27 @@ int line_open(struct line *lines, struct tty_struct *tty,
         line->count++;
 
 out:
-        up(&line->sem);
-        return(err);
+        spin_unlock(&line->lock);
+        return err;
 }
 
 void line_close(struct tty_struct *tty, struct file * filp)
 {
         struct line *line = tty->driver_data;
 
-        down(&line->sem);
+        /* XXX: I assume this should be called in process context, not with interrupt
+         * disabled!*/
+        spin_lock_irq(&line->lock);
+
+        /* We ignore the error anyway! */
+        flush_buffer(line);
+
         line->count--;
         if (tty->count == 1) {
                 line_disable(tty, -1);
                 tty->driver_data = NULL;
         }
-        up(&line->sem);
+        spin_unlock_irq(&line->lock);
 }
 
 void close_lines(struct line *lines, int nlines)
@@ -387,31 +489,41 @@ void close_lines(struct line *lines, int nlines)
                 close_chan(&lines[i].chan_list);
 }
 
-int line_setup(struct line *lines, int num, char *init, int all_allowed)
+/* Common setup code for both startup command line and mconsole initialization.
+ * @lines contains the the array (of size @num) to modify;
+ * @init is the setup string;
+ * @all_allowed is a boolean saying if we can setup the whole @lines
+ * at once. For instance, it will be usually true for startup init. (where we
+ * can use con=xterm) and false for mconsole.*/
+
+int line_setup(struct line *lines, unsigned int num, char *init, int all_allowed)
 {
         int i, n;
         char *end;
 
-        if(*init == '=') n = -1;
-        else {
+        if(*init == '=') {
+                /* We said con=/ssl= instead of con#=, so we are configuring all
+                 * consoles at once.*/
+                n = -1;
+        } else {
                 n = simple_strtoul(init, &end, 0);
                 if(*end != '='){
                         printk(KERN_ERR "line_setup failed to parse \"%s\"\n", 
                                init);
-                        return(0);
+                        return 0;
                 }
                 init = end;
         }
         init++;
-        if((n >= 0) && (n >= num)){
+
+        if (n >= (signed int) num) {
                 printk("line_setup - %d out of range ((0 ... %d) allowed)\n",
                        n, num - 1);
-                return(0);
-        }
-        else if (n >= 0){
+                return 0;
+        } else if (n >= 0){
                 if (lines[n].count > 0) {
                         printk("line_setup - device %d is open\n", n);
-                        return(0);
+                        return 0;
                 }
                 if (lines[n].init_pri <= INIT_ONE){
                         lines[n].init_pri = INIT_ONE;
@@ -422,13 +534,11 @@ int line_setup(struct line *lines, int num, char *init, int all_allowed)
                                 lines[n].valid = 1;
                         }       
                 }
-        }
-        else if(!all_allowed){
+        } else if(!all_allowed){
                 printk("line_setup - can't configure all devices from "
                        "mconsole\n");
-                return(0);
-        }
-        else {
+                return 0;
+        } else {
                 for(i = 0; i < num; i++){
                         if(lines[i].init_pri <= INIT_ALL){
                                 lines[i].init_pri = INIT_ALL;
@@ -440,21 +550,21 @@ int line_setup(struct line *lines, int num, char *init, int all_allowed)
                         }
                 }
         }
-        return(1);
+        return 1;
 }
 
-int line_config(struct line *lines, int num, char *str)
+int line_config(struct line *lines, unsigned int num, char *str)
 {
         char *new = uml_strdup(str);
 
         if(new == NULL){
                 printk("line_config - uml_strdup failed\n");
-                return(-ENOMEM);
+                return -ENOMEM;
         }
-        return(!line_setup(lines, num, new, 0));
+        return !line_setup(lines, num, new, 0);
 }
 
-int line_get_config(char *name, struct line *lines, int num, char *str, 
+int line_get_config(char *name, struct line *lines, unsigned int num, char *str,
                     int size, char **error_out)
 {
         struct line *line;
@@ -464,47 +574,33 @@ int line_get_config(char *name, struct line *lines, int num, char *str,
         dev = simple_strtoul(name, &end, 0);
         if((*end != '\0') || (end == name)){
                 *error_out = "line_get_config failed to parse device number";
-                return(0);
+                return 0;
         }
 
         if((dev < 0) || (dev >= num)){
-                *error_out = "device number of of range";
-                return(0);
+                *error_out = "device number out of range";
+                return 0;
         }
 
         line = &lines[dev];
 
-        down(&line->sem);
+        spin_lock(&line->lock);
         if(!line->valid)
                 CONFIG_CHUNK(str, size, n, "none", 1);
         else if(line->count == 0)
                 CONFIG_CHUNK(str, size, n, line->init_str, 1);
         else n = chan_config_string(&line->chan_list, str, size, error_out);
-        up(&line->sem);
+        spin_unlock(&line->lock);
 
-        return(n);
+        return n;
 }
 
-int line_remove(struct line *lines, int num, char *str)
+int line_remove(struct line *lines, unsigned int num, char *str)
 {
         char config[sizeof("conxxxx=none\0")];
 
         sprintf(config, "%s=none", str);
-        return(!line_setup(lines, num, config, 0));
-}
-
-int line_write_room(struct tty_struct *tty)
-{
-        struct line *dev = tty->driver_data;
-        int room;
-
-        if (tty->stopped)
-                return 0;
-        room = write_room(dev);
-        if (0 == room)
-                printk(KERN_DEBUG "%s: %s: no room left in buffer\n",
-                       __FUNCTION__,tty->name);
-        return room;
+        return !line_setup(lines, num, config, 0);
 }
 
 struct tty_driver *line_register_devfs(struct lines *set,
@@ -553,7 +649,7 @@ void lines_init(struct line *lines, int nlines)
         for(i = 0; i < nlines; i++){
                 line = &lines[i];
                 INIT_LIST_HEAD(&line->chan_list);
-                sema_init(&line->sem, 1);
+                spin_lock_init(&line->lock);
                 if(line->init_str != NULL){
                         line->init_str = uml_strdup(line->init_str);
                         if(line->init_str == NULL)
@@ -587,7 +683,7 @@ irqreturn_t winch_interrupt(int irq, void *data, struct pt_regs *unused)
                                        "errno = %d\n", -err);
                                 printk("fd %d is losing SIGWINCH support\n",
                                        winch->tty_fd);
-                                return(IRQ_HANDLED);
+                                return IRQ_HANDLED;
                         }
                         goto out;
                 }
@@ -603,7 +699,7 @@ irqreturn_t winch_interrupt(int irq, void *data, struct pt_regs *unused)
  out:
         if(winch->fd != -1)
                 reactivate_fd(winch->fd, WINCH_IRQ);
-        return(IRQ_HANDLED);
+        return IRQ_HANDLED;
 }
 
 DECLARE_MUTEX(winch_handler_sem);
@@ -625,7 +721,7 @@ void register_winch_irq(int fd, int tty_fd, int pid, struct tty_struct *tty)
                                    .pid         = pid,
                                    .tty         = tty });
         list_add(&winch->list, &winch_handlers);
-        if(um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt, 
+        if(um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
                           SA_INTERRUPT | SA_SHIRQ | SA_SAMPLE_RANDOM, 
                           "winch", winch) < 0)
                 printk("register_winch_irq - failed to register IRQ\n");
@@ -656,26 +752,16 @@ char *add_xterm_umid(char *base)
         int len;
 
         umid = get_umid(1);
-        if(umid == NULL) return(base);
+        if(umid == NULL)
+                return base;
         
         len = strlen(base) + strlen(" ()") + strlen(umid) + 1;
         title = kmalloc(len, GFP_KERNEL);
         if(title == NULL){
                 printk("Failed to allocate buffer for xterm title\n");
-                return(base);
+                return base;
         }
 
         snprintf(title, len, "%s (%s)", base, umid);
-        return(title);
+        return title;
 }
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
index c5839c3141f8..a2bac429f3d4 100644
--- a/arch/um/drivers/ssl.c
+++ b/arch/um/drivers/ssl.c
@@ -107,11 +107,6 @@ int ssl_open(struct tty_struct *tty, struct file *filp)
 }
 
 #if 0
-static int ssl_chars_in_buffer(struct tty_struct *tty)
-{
-        return(0);
-}
-
 static void ssl_flush_buffer(struct tty_struct *tty)
 {
         return;
@@ -149,11 +144,11 @@ static struct tty_operations ssl_ops = {
         .put_char               = line_put_char,
         .write_room             = line_write_room,
         .chars_in_buffer        = line_chars_in_buffer,
+        .flush_buffer           = line_flush_buffer,
+        .flush_chars            = line_flush_chars,
         .set_termios            = line_set_termios,
         .ioctl                  = line_ioctl,
 #if 0
-        .flush_chars            = ssl_flush_chars,
-        .flush_buffer           = ssl_flush_buffer,
         .throttle               = ssl_throttle,
         .unthrottle             = ssl_unthrottle,
         .stop                   = ssl_stop,
@@ -171,10 +166,11 @@ static void ssl_console_write(struct console *c, const char *string,
                               unsigned len)
 {
         struct line *line = &serial_lines[c->index];
+        unsigned long flags;
 
-        down(&line->sem);
+        spin_lock_irqsave(&line->lock, flags);
         console_write_chan(&line->chan_list, string, len);
-        up(&line->sem);
+        spin_unlock_irqrestore(&line->lock, flags);
 }
 
 static struct tty_driver *ssl_console_device(struct console *c, int *index)
@@ -238,14 +234,3 @@ static int ssl_chan_setup(char *str)
 
 __setup("ssl", ssl_chan_setup);
 __channel_help(ssl_chan_setup, "ssl");
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/stdio_console.c b/arch/um/drivers/stdio_console.c
index e604d7c87695..361d0be342b3 100644
--- a/arch/um/drivers/stdio_console.c
+++ b/arch/um/drivers/stdio_console.c
@@ -116,8 +116,11 @@ static struct tty_operations console_ops = {
         .open                   = con_open,
         .close                  = line_close,
         .write                  = line_write,
+        .put_char               = line_put_char,
         .write_room             = line_write_room,
         .chars_in_buffer        = line_chars_in_buffer,
+        .flush_buffer           = line_flush_buffer,
+        .flush_chars            = line_flush_chars,
         .set_termios            = line_set_termios,
         .ioctl                  = line_ioctl,
 };
@@ -126,10 +129,11 @@ static void uml_console_write(struct console *console, const char *string,
                           unsigned len)
 {
         struct line *line = &vts[console->index];
+        unsigned long flags;
 
-        down(&line->sem);
+        spin_lock_irqsave(&line->lock, flags);
         console_write_chan(&line->chan_list, string, len);
-        up(&line->sem);
+        spin_unlock_irqrestore(&line->lock, flags);
 }
 
 static struct tty_driver *uml_console_device(struct console *c, int *index)
@@ -192,14 +196,3 @@ static int console_chan_setup(char *str)
 }
 __setup("con", console_chan_setup);
 __channel_help(console_chan_setup, "con");
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 4d8b165bfa48..9a56ff94308d 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -156,6 +156,7 @@ static struct gendisk *fake_gendisk[MAX_DEV];
 static struct openflags global_openflags = OPEN_FLAGS;
 
 struct cow {
+        /* This is the backing file, actually */
         char *file;
         int fd;
         unsigned long *bitmap;
@@ -927,10 +928,14 @@ static int ubd_open(struct inode *inode, struct file *filp)
                 }
         }
         dev->count++;
-        if((filp->f_mode & FMODE_WRITE) && !dev->openflags.w){
+        set_disk_ro(disk, !dev->openflags.w);
+
+        /* This should no more be needed. And it didn't work anyway to exclude
+         * read-write remounting of filesystems.*/
+        /*if((filp->f_mode & FMODE_WRITE) && !dev->openflags.w){
                 if(--dev->count == 0) ubd_close(dev);
                 err = -EROFS;
-        }
+        }*/
  out:
         return(err);
 }
@@ -1096,6 +1101,7 @@ static int prepare_request(struct request *req, struct io_thread_req *io_req)
 
         if(req->rq_status == RQ_INACTIVE) return(1);
 
+        /* This should be impossible now */
         if((rq_data_dir(req) == WRITE) && !dev->openflags.w){
                 printk("Write attempted on readonly ubd device %s\n", 
                        disk->disk_name);
@@ -1243,6 +1249,7 @@ static int ubd_check_remapped(int fd, unsigned long address, int is_write,
 
                 /* It's a write to a ubd device */
 
+                /* This should be impossible now */
                 if(!dev->openflags.w){
                         /* It's a write access on a read-only device - probably
                          * shouldn't happen.  If the kernel is trying to change
@@ -1605,8 +1612,7 @@ void do_io(struct io_thread_req *req)
                                 }
                         } while((n < len) && (n != 0));
                         if (n < len) memset(&buf[n], 0, len - n);
-                }
-                else {
+                } else {
                         n = os_write_file(req->fds[bit], buf, len);
                         if(n != len){
                                 printk("do_io - write failed err = %d "
diff --git a/arch/um/include/line.h b/arch/um/include/line.h
index 6d81ecc17be5..4c5e92c04ccb 100644
--- a/arch/um/include/line.h
+++ b/arch/um/include/line.h
@@ -10,7 +10,7 @@
 #include "linux/workqueue.h"
 #include "linux/tty.h"
 #include "linux/interrupt.h"
-#include "asm/semaphore.h"
+#include "linux/spinlock.h"
 #include "chan_user.h"
 #include "mconsole_kern.h"
 
@@ -37,10 +37,18 @@ struct line {
         struct list_head chan_list;
         int valid;
         int count;
-        struct semaphore sem;
+        /*This lock is actually, mostly, local to*/
+        spinlock_t lock;
+
+        /* Yes, this is a real circular buffer.
+         * XXX: And this should become a struct kfifo!
+         *
+         * buffer points to a buffer allocated on demand, of length
+         * LINE_BUFSIZE, head to the start of the ring, tail to the end.*/
         char *buffer;
         char *head;
         char *tail;
+
         int sigio;
         struct work_struct task;
         struct line_driver *driver;
@@ -52,7 +60,6 @@ struct line {
           init_pri :    INIT_STATIC, \
           chan_list :   { }, \
           valid :       1, \
-          sem :         { }, \
           buffer :      NULL, \
           head :        NULL, \
           tail :        NULL, \
@@ -69,15 +76,18 @@ struct lines {
 extern void line_close(struct tty_struct *tty, struct file * filp);
 extern int line_open(struct line *lines, struct tty_struct *tty, 
                      struct chan_opts *opts);
-extern int line_setup(struct line *lines, int num, char *init, 
+extern int line_setup(struct line *lines, unsigned int sizeof_lines, char *init,
                       int all_allowed);
 extern int line_write(struct tty_struct *tty, const unsigned char *buf, int len);
 extern void line_put_char(struct tty_struct *tty, unsigned char ch);
 extern void line_set_termios(struct tty_struct *tty, struct termios * old);
 extern int line_chars_in_buffer(struct tty_struct *tty);
+extern void line_flush_buffer(struct tty_struct *tty);
+extern void line_flush_chars(struct tty_struct *tty);
 extern int line_write_room(struct tty_struct *tty);
 extern int line_ioctl(struct tty_struct *tty, struct file * file,
                       unsigned int cmd, unsigned long arg);
+
 extern char *add_xterm_umid(char *base);
 extern int line_setup_irq(int fd, int input, int output, struct tty_struct *tty);
 extern void line_close_chan(struct line *line);
@@ -89,20 +99,10 @@ extern struct tty_driver * line_register_devfs(struct lines *set,
                                 int nlines);
 extern void lines_init(struct line *lines, int nlines);
 extern void close_lines(struct line *lines, int nlines);
-extern int line_config(struct line *lines, int num, char *str);
-extern int line_remove(struct line *lines, int num, char *str);
-extern int line_get_config(char *dev, struct line *lines, int num, char *str, 
+
+extern int line_config(struct line *lines, unsigned int sizeof_lines, char *str);
+extern int line_remove(struct line *lines, unsigned int sizeof_lines, char *str);
+extern int line_get_config(char *dev, struct line *lines, unsigned int sizeof_lines, char *str,
                            int size, char **error_out);
 
 #endif
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/include/sysdep-i386/syscalls.h b/arch/um/include/sysdep-i386/syscalls.h
index 5db81ec9087d..be0a3e3469eb 100644
--- a/arch/um/include/sysdep-i386/syscalls.h
+++ b/arch/um/include/sysdep-i386/syscalls.h
@@ -22,102 +22,3 @@ extern syscall_handler_t old_mmap_i386;
 extern long sys_mmap2(unsigned long addr, unsigned long len,
                       unsigned long prot, unsigned long flags,
                       unsigned long fd, unsigned long pgoff);
-
-/* On i386 they choose a meaningless naming.*/
-#define __NR_kexec_load __NR_sys_kexec_load
-
-#define ARCH_SYSCALLS \
-        [ __NR_waitpid ] = (syscall_handler_t *) sys_waitpid, \
-        [ __NR_break ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_oldstat ] = (syscall_handler_t *) sys_stat, \
-        [ __NR_umount ] = (syscall_handler_t *) sys_oldumount, \
-        [ __NR_stime ] = um_stime, \
-        [ __NR_oldfstat ] = (syscall_handler_t *) sys_fstat, \
-        [ __NR_stty ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_gtty ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_nice ] = (syscall_handler_t *) sys_nice, \
-        [ __NR_ftime ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_prof ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_signal ] = (syscall_handler_t *) sys_signal, \
-        [ __NR_lock ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_mpx ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_ulimit ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_oldolduname ] = (syscall_handler_t *) sys_olduname, \
-        [ __NR_sigaction ] = (syscall_handler_t *) sys_sigaction, \
-        [ __NR_sgetmask ] = (syscall_handler_t *) sys_sgetmask, \
-        [ __NR_ssetmask ] = (syscall_handler_t *) sys_ssetmask, \
-        [ __NR_sigsuspend ] = (syscall_handler_t *) sys_sigsuspend, \
-        [ __NR_sigpending ] = (syscall_handler_t *) sys_sigpending, \
-        [ __NR_oldlstat ] = (syscall_handler_t *) sys_lstat, \
-        [ __NR_readdir ] = old_readdir, \
-        [ __NR_profil ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_socketcall ] = (syscall_handler_t *) sys_socketcall, \
-        [ __NR_olduname ] = (syscall_handler_t *) sys_uname, \
-        [ __NR_iopl ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_idle ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_ipc ] = (syscall_handler_t *) sys_ipc, \
-        [ __NR_sigreturn ] = (syscall_handler_t *) sys_sigreturn, \
-        [ __NR_sigprocmask ] = (syscall_handler_t *) sys_sigprocmask, \
-        [ __NR_bdflush ] = (syscall_handler_t *) sys_bdflush, \
-        [ __NR__llseek ] = (syscall_handler_t *) sys_llseek, \
-        [ __NR__newselect ] = (syscall_handler_t *) sys_select, \
-        [ __NR_vm86 ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_mmap ] = (syscall_handler_t *) old_mmap_i386, \
-        [ __NR_ugetrlimit ] = (syscall_handler_t *) sys_getrlimit, \
-        [ __NR_mmap2 ] = (syscall_handler_t *) sys_mmap2, \
-        [ __NR_truncate64 ] = (syscall_handler_t *) sys_truncate64, \
-        [ __NR_ftruncate64 ] = (syscall_handler_t *) sys_ftruncate64, \
-        [ __NR_stat64 ] = (syscall_handler_t *) sys_stat64, \
-        [ __NR_lstat64 ] = (syscall_handler_t *) sys_lstat64, \
-        [ __NR_fstat64 ] = (syscall_handler_t *) sys_fstat64, \
-        [ __NR_fcntl64 ] = (syscall_handler_t *) sys_fcntl64, \
-        [ __NR_sendfile64 ] = (syscall_handler_t *) sys_sendfile64, \
-        [ __NR_statfs64 ] = (syscall_handler_t *) sys_statfs64, \
-        [ __NR_fstatfs64 ] = (syscall_handler_t *) sys_fstatfs64, \
-        [ __NR_fadvise64_64 ] = (syscall_handler_t *) sys_fadvise64_64, \
-        [ __NR_select ] = (syscall_handler_t *) old_select, \
-        [ __NR_vm86old ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_modify_ldt ] = (syscall_handler_t *) sys_modify_ldt, \
-        [ __NR_lchown32 ] = (syscall_handler_t *) sys_lchown, \
-        [ __NR_getuid32 ] = (syscall_handler_t *) sys_getuid, \
-        [ __NR_getgid32 ] = (syscall_handler_t *) sys_getgid, \
-        [ __NR_geteuid32 ] = (syscall_handler_t *) sys_geteuid, \
-        [ __NR_getegid32 ] = (syscall_handler_t *) sys_getegid, \
-        [ __NR_setreuid32 ] = (syscall_handler_t *) sys_setreuid, \
-        [ __NR_setregid32 ] = (syscall_handler_t *) sys_setregid, \
-        [ __NR_getgroups32 ] = (syscall_handler_t *) sys_getgroups, \
-        [ __NR_setgroups32 ] = (syscall_handler_t *) sys_setgroups, \
-        [ __NR_fchown32 ] = (syscall_handler_t *) sys_fchown, \
-        [ __NR_setresuid32 ] = (syscall_handler_t *) sys_setresuid, \
-        [ __NR_getresuid32 ] = (syscall_handler_t *) sys_getresuid, \
-        [ __NR_setresgid32 ] = (syscall_handler_t *) sys_setresgid, \
-        [ __NR_getresgid32 ] = (syscall_handler_t *) sys_getresgid, \
-        [ __NR_chown32 ] = (syscall_handler_t *) sys_chown, \
-        [ __NR_setuid32 ] = (syscall_handler_t *) sys_setuid, \
-        [ __NR_setgid32 ] = (syscall_handler_t *) sys_setgid, \
-        [ __NR_setfsuid32 ] = (syscall_handler_t *) sys_setfsuid, \
-        [ __NR_setfsgid32 ] = (syscall_handler_t *) sys_setfsgid, \
-        [ __NR_pivot_root ] = (syscall_handler_t *) sys_pivot_root, \
-        [ __NR_mincore ] = (syscall_handler_t *) sys_mincore, \
-        [ __NR_madvise ] = (syscall_handler_t *) sys_madvise, \
-        [ 222 ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ 223 ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_set_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_get_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ 251 ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ 285 ] = (syscall_handler_t *) sys_ni_syscall,
-
-/* 222 doesn't yet have a name in include/asm-i386/unistd.h */
-
-#define LAST_ARCH_SYSCALL 285
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/include/sysdep-x86_64/syscalls.h b/arch/um/include/sysdep-x86_64/syscalls.h
index b187a4157ff3..67923cca5691 100644
--- a/arch/um/include/sysdep-x86_64/syscalls.h
+++ b/arch/um/include/sysdep-x86_64/syscalls.h
@@ -26,66 +26,9 @@ extern syscall_handler_t *ia32_sys_call_table[];
 extern long old_mmap(unsigned long addr, unsigned long len,
                      unsigned long prot, unsigned long flags,
                      unsigned long fd, unsigned long pgoff);
-extern syscall_handler_t wrap_sys_shmat;
 extern syscall_handler_t sys_modify_ldt;
 extern syscall_handler_t sys_arch_prctl;
 
-#define ARCH_SYSCALLS \
-        [ __NR_mmap ] = (syscall_handler_t *) old_mmap, \
-        [ __NR_select ] = (syscall_handler_t *) sys_select, \
-        [ __NR_mincore ] = (syscall_handler_t *) sys_mincore, \
-        [ __NR_madvise ] = (syscall_handler_t *) sys_madvise, \
-        [ __NR_shmget ] = (syscall_handler_t *) sys_shmget, \
-        [ __NR_shmat ] = (syscall_handler_t *) wrap_sys_shmat, \
-        [ __NR_shmctl ] = (syscall_handler_t *) sys_shmctl, \
-        [ __NR_semop ] = (syscall_handler_t *) sys_semop, \
-        [ __NR_semget ] = (syscall_handler_t *) sys_semget, \
-        [ __NR_semctl ] = (syscall_handler_t *) sys_semctl, \
-        [ __NR_shmdt ] = (syscall_handler_t *) sys_shmdt, \
-        [ __NR_msgget ] = (syscall_handler_t *) sys_msgget, \
-        [ __NR_msgsnd ] = (syscall_handler_t *) sys_msgsnd, \
-        [ __NR_msgrcv ] = (syscall_handler_t *) sys_msgrcv, \
-        [ __NR_msgctl ] = (syscall_handler_t *) sys_msgctl, \
-        [ __NR_pivot_root ] = (syscall_handler_t *) sys_pivot_root, \
-        [ __NR_tuxcall ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_security ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_epoll_ctl_old ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_epoll_wait_old ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_modify_ldt ] = (syscall_handler_t *) sys_modify_ldt, \
-        [ __NR_arch_prctl ] = (syscall_handler_t *) sys_arch_prctl, \
-        [ __NR_socket ] = (syscall_handler_t *) sys_socket, \
-        [ __NR_connect ] = (syscall_handler_t *) sys_connect, \
-        [ __NR_accept ] = (syscall_handler_t *) sys_accept, \
-        [ __NR_recvfrom ] = (syscall_handler_t *) sys_recvfrom, \
-        [ __NR_recvmsg ] = (syscall_handler_t *) sys_recvmsg, \
-        [ __NR_sendmsg ] = (syscall_handler_t *) sys_sendmsg, \
-        [ __NR_bind ] = (syscall_handler_t *) sys_bind, \
-        [ __NR_listen ] = (syscall_handler_t *) sys_listen, \
-        [ __NR_getsockname ] = (syscall_handler_t *) sys_getsockname, \
-        [ __NR_getpeername ] = (syscall_handler_t *) sys_getpeername, \
-        [ __NR_socketpair ] = (syscall_handler_t *) sys_socketpair, \
-        [ __NR_sendto ] = (syscall_handler_t *) sys_sendto, \
-        [ __NR_shutdown ] = (syscall_handler_t *) sys_shutdown, \
-        [ __NR_setsockopt ] = (syscall_handler_t *) sys_setsockopt, \
-        [ __NR_getsockopt ] = (syscall_handler_t *) sys_getsockopt, \
-        [ __NR_iopl ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_set_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_get_thread_area ] = (syscall_handler_t *) sys_ni_syscall, \
-        [ __NR_semtimedop ] = (syscall_handler_t *) sys_semtimedop, \
-        [ 251 ] = (syscall_handler_t *) sys_ni_syscall,
-
-#define LAST_ARCH_SYSCALL 251
-#define NR_syscalls 1024
+#define NR_syscalls (__NR_syscall_max + 1)
 
 #endif
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/Makefile b/arch/um/kernel/Makefile
index dc796c1bf39e..246f0e7fb4cc 100644
--- a/arch/um/kernel/Makefile
+++ b/arch/um/kernel/Makefile
@@ -10,7 +10,7 @@ obj-y = checksum.o config.o exec_kern.o exitcode.o \
         helper.o init_task.o irq.o irq_user.o ksyms.o main.o mem.o mem_user.o \
         physmem.o process.o process_kern.o ptrace.o reboot.o resource.o \
         sigio_user.o sigio_kern.o signal_kern.o signal_user.o smp.o \
-        syscall_kern.o sysrq.o sys_call_table.o tempfile.o time.o time_kern.o \
+        syscall_kern.o sysrq.o tempfile.o time.o time_kern.o \
         tlb.o trap_kern.o trap_user.o uaccess_user.o um_arch.o umid.o \
         user_util.o
 
@@ -53,6 +53,7 @@ quiet_cmd_quote2 = QUOTE   $@
       cmd_quote2 = sed -e '/CONFIG/{'          \
                   -e 's/"CONFIG"\;/""/'        \
                   -e 'r $(obj)/config.tmp'     \
-                  -e 'a""\;'                   \
+                  -e 'a \'                     \
+                  -e '""\;'                    \
                   -e '}'                       \
                   $< > $@
diff --git a/arch/um/kernel/process_kern.c b/arch/um/kernel/process_kern.c
index 1d719d5b4bb9..7a943696f950 100644
--- a/arch/um/kernel/process_kern.c
+++ b/arch/um/kernel/process_kern.c
@@ -161,10 +161,6 @@ void *get_current(void)
         return(current);
 }
 
-void prepare_to_copy(struct task_struct *tsk)
-{
-}
-
 int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
                 unsigned long stack_top, struct task_struct * p, 
                 struct pt_regs *regs)
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 3a99ee6d94eb..e50e60ff5d27 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -143,7 +143,7 @@ long sys_ptrace(long request, long pid, long addr, long data)
         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */
         case PTRACE_CONT: { /* restart after signal. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
 
                 child->ptrace &= ~PT_DTRACE;
@@ -179,7 +179,7 @@ long sys_ptrace(long request, long pid, long addr, long data)
 
         case PTRACE_SINGLESTEP: {  /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
                 child->ptrace |= PT_DTRACE;
diff --git a/arch/um/kernel/skas/include/uaccess-skas.h b/arch/um/kernel/skas/include/uaccess-skas.h
index 11986c9b9ddf..c35620385da0 100644
--- a/arch/um/kernel/skas/include/uaccess-skas.h
+++ b/arch/um/kernel/skas/include/uaccess-skas.h
@@ -18,7 +18,7 @@
           ((unsigned long) (addr) + (size) <= FIXADDR_USER_END) && \
           ((unsigned long) (addr) + (size) >= (unsigned long)(addr))))
 
-static inline int verify_area_skas(int type, const void * addr,
+static inline int __deprecated verify_area_skas(int type, const void * addr,
                                    unsigned long size)
 {
         return(access_ok_skas(type, addr, size) ? 0 : -EFAULT);
diff --git a/arch/um/kernel/skas/uaccess.c b/arch/um/kernel/skas/uaccess.c
index 7575ec489b63..f7da9d027672 100644
--- a/arch/um/kernel/skas/uaccess.c
+++ b/arch/um/kernel/skas/uaccess.c
@@ -3,6 +3,7 @@
  * Licensed under the GPL
  */
 
+#include "linux/compiler.h"
 #include "linux/stddef.h"
 #include "linux/kernel.h"
 #include "linux/string.h"
@@ -61,8 +62,7 @@ static void do_buffer_op(void *jmpbuf, void *arg_ptr)
         void *arg;
         int *res;
 
-        /* Some old gccs recognize __va_copy, but not va_copy */
-        __va_copy(args, *(va_list *)arg_ptr);
+        va_copy(args, *(va_list *)arg_ptr);
         addr = va_arg(args, unsigned long);
         len = va_arg(args, int);
         is_write = va_arg(args, int);
diff --git a/arch/um/kernel/sys_call_table.c b/arch/um/kernel/sys_call_table.c
deleted file mode 100644
index 7fc06c85b29d..000000000000
--- a/arch/um/kernel/sys_call_table.c
+++ /dev/null
@@ -1,276 +0,0 @@
-/* 
- * Copyright (C) 2000 Jeff Dike (jdike@karaya.com)
- * Copyright 2003 PathScale, Inc.
- * Licensed under the GPL
- */
-
-#include "linux/config.h"
-#include "linux/unistd.h"
-#include "linux/sys.h"
-#include "linux/swap.h"
-#include "linux/syscalls.h"
-#include "linux/sysctl.h"
-#include "asm/signal.h"
-#include "sysdep/syscalls.h"
-#include "kern_util.h"
-
-#ifdef CONFIG_NFSD
-#define NFSSERVCTL sys_nfsservctl
-#else
-#define NFSSERVCTL sys_ni_syscall
-#endif
-
-#define LAST_GENERIC_SYSCALL __NR_keyctl
-
-#if LAST_GENERIC_SYSCALL > LAST_ARCH_SYSCALL
-#define LAST_SYSCALL LAST_GENERIC_SYSCALL
-#else
-#define LAST_SYSCALL LAST_ARCH_SYSCALL
-#endif
-
-extern syscall_handler_t sys_fork;
-extern syscall_handler_t sys_execve;
-extern syscall_handler_t um_time;
-extern syscall_handler_t um_stime;
-extern syscall_handler_t sys_pipe;
-extern syscall_handler_t sys_olduname;
-extern syscall_handler_t sys_sigaction;
-extern syscall_handler_t sys_sigsuspend;
-extern syscall_handler_t old_readdir;
-extern syscall_handler_t sys_uname;
-extern syscall_handler_t sys_ipc;
-extern syscall_handler_t sys_sigreturn;
-extern syscall_handler_t sys_clone;
-extern syscall_handler_t sys_rt_sigreturn;
-extern syscall_handler_t sys_sigaltstack;
-extern syscall_handler_t sys_vfork;
-extern syscall_handler_t old_select;
-extern syscall_handler_t sys_modify_ldt;
-extern syscall_handler_t sys_rt_sigsuspend;
-extern syscall_handler_t sys_mbind;
-extern syscall_handler_t sys_get_mempolicy;
-extern syscall_handler_t sys_set_mempolicy;
-extern syscall_handler_t sys_sys_setaltroot;
-
-syscall_handler_t *sys_call_table[] = {
-        [ __NR_restart_syscall ] = (syscall_handler_t *) sys_restart_syscall,
-        [ __NR_exit ] = (syscall_handler_t *) sys_exit,
-        [ __NR_fork ] = (syscall_handler_t *) sys_fork,
-        [ __NR_read ] = (syscall_handler_t *) sys_read,
-        [ __NR_write ] = (syscall_handler_t *) sys_write,
-
-        /* These three are declared differently in asm/unistd.h */
-        [ __NR_open ] = (syscall_handler_t *) sys_open,
-        [ __NR_close ] = (syscall_handler_t *) sys_close,
-        [ __NR_creat ] = (syscall_handler_t *) sys_creat,
-        [ __NR_link ] = (syscall_handler_t *) sys_link,
-        [ __NR_unlink ] = (syscall_handler_t *) sys_unlink,
-        [ __NR_execve ] = (syscall_handler_t *) sys_execve,
-
-        /* declared differently in kern_util.h */
-        [ __NR_chdir ] = (syscall_handler_t *) sys_chdir,
-        [ __NR_time ] = um_time,
-        [ __NR_mknod ] = (syscall_handler_t *) sys_mknod,
-        [ __NR_chmod ] = (syscall_handler_t *) sys_chmod,
-        [ __NR_lchown ] = (syscall_handler_t *) sys_lchown16,
-        [ __NR_lseek ] = (syscall_handler_t *) sys_lseek,
-        [ __NR_getpid ] = (syscall_handler_t *) sys_getpid,
-        [ __NR_mount ] = (syscall_handler_t *) sys_mount,
-        [ __NR_setuid ] = (syscall_handler_t *) sys_setuid16,
-        [ __NR_getuid ] = (syscall_handler_t *) sys_getuid16,
-        [ __NR_ptrace ] = (syscall_handler_t *) sys_ptrace,
-        [ __NR_alarm ] = (syscall_handler_t *) sys_alarm,
-        [ __NR_pause ] = (syscall_handler_t *) sys_pause,
-        [ __NR_utime ] = (syscall_handler_t *) sys_utime,
-        [ __NR_access ] = (syscall_handler_t *) sys_access,
-        [ __NR_sync ] = (syscall_handler_t *) sys_sync,
-        [ __NR_kill ] = (syscall_handler_t *) sys_kill,
-        [ __NR_rename ] = (syscall_handler_t *) sys_rename,
-        [ __NR_mkdir ] = (syscall_handler_t *) sys_mkdir,
-        [ __NR_rmdir ] = (syscall_handler_t *) sys_rmdir,
-
-        /* Declared differently in asm/unistd.h */
-        [ __NR_dup ] = (syscall_handler_t *) sys_dup,
-        [ __NR_pipe ] = (syscall_handler_t *) sys_pipe,
-        [ __NR_times ] = (syscall_handler_t *) sys_times,
-        [ __NR_brk ] = (syscall_handler_t *) sys_brk,
-        [ __NR_setgid ] = (syscall_handler_t *) sys_setgid16,
-        [ __NR_getgid ] = (syscall_handler_t *) sys_getgid16,
-        [ __NR_geteuid ] = (syscall_handler_t *) sys_geteuid16,
-        [ __NR_getegid ] = (syscall_handler_t *) sys_getegid16,
-        [ __NR_acct ] = (syscall_handler_t *) sys_acct,
-        [ __NR_umount2 ] = (syscall_handler_t *) sys_umount,
-        [ __NR_ioctl ] = (syscall_handler_t *) sys_ioctl,
-        [ __NR_fcntl ] = (syscall_handler_t *) sys_fcntl,
-        [ __NR_setpgid ] = (syscall_handler_t *) sys_setpgid,
-        [ __NR_umask ] = (syscall_handler_t *) sys_umask,
-        [ __NR_chroot ] = (syscall_handler_t *) sys_chroot,
-        [ __NR_ustat ] = (syscall_handler_t *) sys_ustat,
-        [ __NR_dup2 ] = (syscall_handler_t *) sys_dup2,
-        [ __NR_getppid ] = (syscall_handler_t *) sys_getppid,
-        [ __NR_getpgrp ] = (syscall_handler_t *) sys_getpgrp,
-        [ __NR_setsid ] = (syscall_handler_t *) sys_setsid,
-        [ __NR_setreuid ] = (syscall_handler_t *) sys_setreuid16,
-        [ __NR_setregid ] = (syscall_handler_t *) sys_setregid16,
-        [ __NR_sethostname ] = (syscall_handler_t *) sys_sethostname,
-        [ __NR_setrlimit ] = (syscall_handler_t *) sys_setrlimit,
-        [ __NR_getrlimit ] = (syscall_handler_t *) sys_old_getrlimit,
-        [ __NR_getrusage ] = (syscall_handler_t *) sys_getrusage,
-        [ __NR_gettimeofday ] = (syscall_handler_t *) sys_gettimeofday,
-        [ __NR_settimeofday ] = (syscall_handler_t *) sys_settimeofday,
-        [ __NR_getgroups ] = (syscall_handler_t *) sys_getgroups16,
-        [ __NR_setgroups ] = (syscall_handler_t *) sys_setgroups16,
-        [ __NR_symlink ] = (syscall_handler_t *) sys_symlink,
-        [ __NR_readlink ] = (syscall_handler_t *) sys_readlink,
-        [ __NR_uselib ] = (syscall_handler_t *) sys_uselib,
-        [ __NR_swapon ] = (syscall_handler_t *) sys_swapon,
-        [ __NR_reboot ] = (syscall_handler_t *) sys_reboot,
-        [ __NR_munmap ] = (syscall_handler_t *) sys_munmap,
-        [ __NR_truncate ] = (syscall_handler_t *) sys_truncate,
-        [ __NR_ftruncate ] = (syscall_handler_t *) sys_ftruncate,
-        [ __NR_fchmod ] = (syscall_handler_t *) sys_fchmod,
-        [ __NR_fchown ] = (syscall_handler_t *) sys_fchown16,
-        [ __NR_getpriority ] = (syscall_handler_t *) sys_getpriority,
-        [ __NR_setpriority ] = (syscall_handler_t *) sys_setpriority,
-        [ __NR_statfs ] = (syscall_handler_t *) sys_statfs,
-        [ __NR_fstatfs ] = (syscall_handler_t *) sys_fstatfs,
-        [ __NR_ioperm ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_syslog ] = (syscall_handler_t *) sys_syslog,
-        [ __NR_setitimer ] = (syscall_handler_t *) sys_setitimer,
-        [ __NR_getitimer ] = (syscall_handler_t *) sys_getitimer,
-        [ __NR_stat ] = (syscall_handler_t *) sys_newstat,
-        [ __NR_lstat ] = (syscall_handler_t *) sys_newlstat,
-        [ __NR_fstat ] = (syscall_handler_t *) sys_newfstat,
-        [ __NR_vhangup ] = (syscall_handler_t *) sys_vhangup,
-        [ __NR_wait4 ] = (syscall_handler_t *) sys_wait4,
-        [ __NR_swapoff ] = (syscall_handler_t *) sys_swapoff,
-        [ __NR_sysinfo ] = (syscall_handler_t *) sys_sysinfo,
-        [ __NR_fsync ] = (syscall_handler_t *) sys_fsync,
-        [ __NR_clone ] = (syscall_handler_t *) sys_clone,
-        [ __NR_setdomainname ] = (syscall_handler_t *) sys_setdomainname,
-        [ __NR_uname ] = (syscall_handler_t *) sys_newuname,
-        [ __NR_adjtimex ] = (syscall_handler_t *) sys_adjtimex,
-        [ __NR_mprotect ] = (syscall_handler_t *) sys_mprotect,
-        [ __NR_create_module ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_init_module ] = (syscall_handler_t *) sys_init_module,
-        [ __NR_delete_module ] = (syscall_handler_t *) sys_delete_module,
-        [ __NR_get_kernel_syms ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_quotactl ] = (syscall_handler_t *) sys_quotactl,
-        [ __NR_getpgid ] = (syscall_handler_t *) sys_getpgid,
-        [ __NR_fchdir ] = (syscall_handler_t *) sys_fchdir,
-        [ __NR_sysfs ] = (syscall_handler_t *) sys_sysfs,
-        [ __NR_personality ] = (syscall_handler_t *) sys_personality,
-        [ __NR_afs_syscall ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_setfsuid ] = (syscall_handler_t *) sys_setfsuid16,
-        [ __NR_setfsgid ] = (syscall_handler_t *) sys_setfsgid16,
-        [ __NR_getdents ] = (syscall_handler_t *) sys_getdents,
-        [ __NR_flock ] = (syscall_handler_t *) sys_flock,
-        [ __NR_msync ] = (syscall_handler_t *) sys_msync,
-        [ __NR_readv ] = (syscall_handler_t *) sys_readv,
-        [ __NR_writev ] = (syscall_handler_t *) sys_writev,
-        [ __NR_getsid ] = (syscall_handler_t *) sys_getsid,
-        [ __NR_fdatasync ] = (syscall_handler_t *) sys_fdatasync,
-        [ __NR__sysctl ] = (syscall_handler_t *) sys_sysctl,
-        [ __NR_mlock ] = (syscall_handler_t *) sys_mlock,
-        [ __NR_munlock ] = (syscall_handler_t *) sys_munlock,
-        [ __NR_mlockall ] = (syscall_handler_t *) sys_mlockall,
-        [ __NR_munlockall ] = (syscall_handler_t *) sys_munlockall,
-        [ __NR_sched_setparam ] = (syscall_handler_t *) sys_sched_setparam,
-        [ __NR_sched_getparam ] = (syscall_handler_t *) sys_sched_getparam,
-        [ __NR_sched_setscheduler ] = (syscall_handler_t *) sys_sched_setscheduler,
-        [ __NR_sched_getscheduler ] = (syscall_handler_t *) sys_sched_getscheduler,
-        [ __NR_sched_yield ] = (syscall_handler_t *) yield,
-        [ __NR_sched_get_priority_max ] = (syscall_handler_t *) sys_sched_get_priority_max,
-        [ __NR_sched_get_priority_min ] = (syscall_handler_t *) sys_sched_get_priority_min,
-        [ __NR_sched_rr_get_interval ] = (syscall_handler_t *) sys_sched_rr_get_interval,
-        [ __NR_nanosleep ] = (syscall_handler_t *) sys_nanosleep,
-        [ __NR_mremap ] = (syscall_handler_t *) sys_mremap,
-        [ __NR_setresuid ] = (syscall_handler_t *) sys_setresuid16,
-        [ __NR_getresuid ] = (syscall_handler_t *) sys_getresuid16,
-        [ __NR_query_module ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_poll ] = (syscall_handler_t *) sys_poll,
-        [ __NR_nfsservctl ] = (syscall_handler_t *) NFSSERVCTL,
-        [ __NR_setresgid ] = (syscall_handler_t *) sys_setresgid16,
-        [ __NR_getresgid ] = (syscall_handler_t *) sys_getresgid16,
-        [ __NR_prctl ] = (syscall_handler_t *) sys_prctl,
-        [ __NR_rt_sigreturn ] = (syscall_handler_t *) sys_rt_sigreturn,
-        [ __NR_rt_sigaction ] = (syscall_handler_t *) sys_rt_sigaction,
-        [ __NR_rt_sigprocmask ] = (syscall_handler_t *) sys_rt_sigprocmask,
-        [ __NR_rt_sigpending ] = (syscall_handler_t *) sys_rt_sigpending,
-        [ __NR_rt_sigtimedwait ] = (syscall_handler_t *) sys_rt_sigtimedwait,
-        [ __NR_rt_sigqueueinfo ] = (syscall_handler_t *) sys_rt_sigqueueinfo,
-        [ __NR_rt_sigsuspend ] = (syscall_handler_t *) sys_rt_sigsuspend,
-        [ __NR_pread64 ] = (syscall_handler_t *) sys_pread64,
-        [ __NR_pwrite64 ] = (syscall_handler_t *) sys_pwrite64,
-        [ __NR_chown ] = (syscall_handler_t *) sys_chown16,
-        [ __NR_getcwd ] = (syscall_handler_t *) sys_getcwd,
-        [ __NR_capget ] = (syscall_handler_t *) sys_capget,
-        [ __NR_capset ] = (syscall_handler_t *) sys_capset,
-        [ __NR_sigaltstack ] = (syscall_handler_t *) sys_sigaltstack,
-        [ __NR_sendfile ] = (syscall_handler_t *) sys_sendfile,
-        [ __NR_getpmsg ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_putpmsg ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_vfork ] = (syscall_handler_t *) sys_vfork,
-        [ __NR_getdents64 ] = (syscall_handler_t *) sys_getdents64,
-        [ __NR_gettid ] = (syscall_handler_t *) sys_gettid,
-        [ __NR_readahead ] = (syscall_handler_t *) sys_readahead,
-        [ __NR_setxattr ] = (syscall_handler_t *) sys_setxattr,
-        [ __NR_lsetxattr ] = (syscall_handler_t *) sys_lsetxattr,
-        [ __NR_fsetxattr ] = (syscall_handler_t *) sys_fsetxattr,
-        [ __NR_getxattr ] = (syscall_handler_t *) sys_getxattr,
-        [ __NR_lgetxattr ] = (syscall_handler_t *) sys_lgetxattr,
-        [ __NR_fgetxattr ] = (syscall_handler_t *) sys_fgetxattr,
-        [ __NR_listxattr ] = (syscall_handler_t *) sys_listxattr,
-        [ __NR_llistxattr ] = (syscall_handler_t *) sys_llistxattr,
-        [ __NR_flistxattr ] = (syscall_handler_t *) sys_flistxattr,
-        [ __NR_removexattr ] = (syscall_handler_t *) sys_removexattr,
-        [ __NR_lremovexattr ] = (syscall_handler_t *) sys_lremovexattr,
-        [ __NR_fremovexattr ] = (syscall_handler_t *) sys_fremovexattr,
-        [ __NR_tkill ] = (syscall_handler_t *) sys_tkill,
-        [ __NR_futex ] = (syscall_handler_t *) sys_futex,
-        [ __NR_sched_setaffinity ] = (syscall_handler_t *) sys_sched_setaffinity,
-        [ __NR_sched_getaffinity ] = (syscall_handler_t *) sys_sched_getaffinity,
-        [ __NR_io_setup ] = (syscall_handler_t *) sys_io_setup,
-        [ __NR_io_destroy ] = (syscall_handler_t *) sys_io_destroy,
-        [ __NR_io_getevents ] = (syscall_handler_t *) sys_io_getevents,
-        [ __NR_io_submit ] = (syscall_handler_t *) sys_io_submit,
-        [ __NR_io_cancel ] = (syscall_handler_t *) sys_io_cancel,
-        [ __NR_exit_group ] = (syscall_handler_t *) sys_exit_group,
-        [ __NR_lookup_dcookie ] = (syscall_handler_t *) sys_lookup_dcookie,
-        [ __NR_epoll_create ] = (syscall_handler_t *) sys_epoll_create,
-        [ __NR_epoll_ctl ] = (syscall_handler_t *) sys_epoll_ctl,
-        [ __NR_epoll_wait ] = (syscall_handler_t *) sys_epoll_wait,
-        [ __NR_remap_file_pages ] = (syscall_handler_t *) sys_remap_file_pages,
-        [ __NR_set_tid_address ] = (syscall_handler_t *) sys_set_tid_address,
-        [ __NR_timer_create ] = (syscall_handler_t *) sys_timer_create,
-        [ __NR_timer_settime ] = (syscall_handler_t *) sys_timer_settime,
-        [ __NR_timer_gettime ] = (syscall_handler_t *) sys_timer_gettime,
-        [ __NR_timer_getoverrun ] = (syscall_handler_t *) sys_timer_getoverrun,
-        [ __NR_timer_delete ] = (syscall_handler_t *) sys_timer_delete,
-        [ __NR_clock_settime ] = (syscall_handler_t *) sys_clock_settime,
-        [ __NR_clock_gettime ] = (syscall_handler_t *) sys_clock_gettime,
-        [ __NR_clock_getres ] = (syscall_handler_t *) sys_clock_getres,
-        [ __NR_clock_nanosleep ] = (syscall_handler_t *) sys_clock_nanosleep,
-        [ __NR_tgkill ] = (syscall_handler_t *) sys_tgkill,
-        [ __NR_utimes ] = (syscall_handler_t *) sys_utimes,
-        [ __NR_fadvise64 ] = (syscall_handler_t *) sys_fadvise64,
-        [ __NR_vserver ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_mbind ] = (syscall_handler_t *) sys_mbind,
-        [ __NR_get_mempolicy ] = (syscall_handler_t *) sys_get_mempolicy,
-        [ __NR_set_mempolicy ] = (syscall_handler_t *) sys_set_mempolicy,
-        [ __NR_mq_open ] = (syscall_handler_t *) sys_mq_open,
-        [ __NR_mq_unlink ] = (syscall_handler_t *) sys_mq_unlink,
-        [ __NR_mq_timedsend ] = (syscall_handler_t *) sys_mq_timedsend,
-        [ __NR_mq_timedreceive ] = (syscall_handler_t *) sys_mq_timedreceive,
-        [ __NR_mq_notify ] = (syscall_handler_t *) sys_mq_notify,
-        [ __NR_mq_getsetattr ] = (syscall_handler_t *) sys_mq_getsetattr,
-        [ __NR_kexec_load ] = (syscall_handler_t *) sys_ni_syscall,
-        [ __NR_waitid ] = (syscall_handler_t *) sys_waitid,
-        [ __NR_add_key ] = (syscall_handler_t *) sys_add_key,
-        [ __NR_request_key ] = (syscall_handler_t *) sys_request_key,
-        [ __NR_keyctl ] = (syscall_handler_t *) sys_keyctl,
-
-        ARCH_SYSCALLS
-        [ LAST_SYSCALL + 1 ... NR_syscalls ] = 
-                (syscall_handler_t *) sys_ni_syscall
-};
diff --git a/arch/um/kernel/tt/include/uaccess-tt.h b/arch/um/kernel/tt/include/uaccess-tt.h
index f0bad010cebd..bb69d6b7d022 100644
--- a/arch/um/kernel/tt/include/uaccess-tt.h
+++ b/arch/um/kernel/tt/include/uaccess-tt.h
@@ -33,7 +33,7 @@ extern unsigned long uml_physmem;
          (((unsigned long) (addr) <= ((unsigned long) (addr) + (size))) && \
           (under_task_size(addr, size) || is_stack(addr, size))))
 
-static inline int verify_area_tt(int type, const void * addr,
+static inline int __deprecated verify_area_tt(int type, const void * addr,
                                  unsigned long size)
 {
         return(access_ok_tt(type, addr, size) ? 0 : -EFAULT);
diff --git a/arch/um/os-Linux/sys-i386/registers.c b/arch/um/os-Linux/sys-i386/registers.c
index 148645b14480..9a0ad094d926 100644
--- a/arch/um/os-Linux/sys-i386/registers.c
+++ b/arch/um/os-Linux/sys-i386/registers.c
@@ -105,14 +105,15 @@ void init_registers(int pid)
                 panic("check_ptrace : PTRACE_GETREGS failed, errno = %d",
                       err);
 
+        errno = 0;
         err = ptrace(PTRACE_GETFPXREGS, pid, 0, exec_fpx_regs);
         if(!err)
                 return;
+        if(errno != EIO)
+                panic("check_ptrace : PTRACE_GETFPXREGS failed, errno = %d",
+                      errno);
 
         have_fpx_regs = 0;
-        if(err != EIO)
-                panic("check_ptrace : PTRACE_GETFPXREGS failed, errno = %d",
-                      err);
 
         err = ptrace(PTRACE_GETFPREGS, pid, 0, exec_fp_regs);
         if(err)
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 71b47e618605..950781e354de 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -1,5 +1,6 @@
 obj-y = bitops.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
-        ptrace_user.o semaphore.o signal.o sigcontext.o syscalls.o sysrq.o
+        ptrace_user.o semaphore.o signal.o sigcontext.o syscalls.o sysrq.o \
+        sys_call_table.o
 
 obj-$(CONFIG_HIGHMEM) += highmem.o
 obj-$(CONFIG_MODULES) += module.o
diff --git a/arch/um/sys-i386/sys_call_table.S b/arch/um/sys-i386/sys_call_table.S
new file mode 100644
index 000000000000..ad75c27afe38
--- /dev/null
+++ b/arch/um/sys-i386/sys_call_table.S
@@ -0,0 +1,16 @@
+#include <linux/linkage.h>
+/* Steal i386 syscall table for our purposes, but with some slight changes.*/
+
+#define sys_iopl sys_ni_syscall
+#define sys_ioperm sys_ni_syscall
+
+#define sys_vm86old sys_ni_syscall
+#define sys_vm86 sys_ni_syscall
+#define sys_set_thread_area sys_ni_syscall
+#define sys_get_thread_area sys_ni_syscall
+
+#define sys_stime um_stime
+#define sys_time um_time
+#define old_mmap old_mmap_i386
+
+#include "../../i386/kernel/syscall_table.S"
diff --git a/arch/um/sys-x86_64/Makefile b/arch/um/sys-x86_64/Makefile
index 2129e3143559..d7ed2f7908df 100644
--- a/arch/um/sys-x86_64/Makefile
+++ b/arch/um/sys-x86_64/Makefile
@@ -6,7 +6,7 @@
 
 lib-y = bitops.o bugs.o csum-partial.o delay.o fault.o mem.o memcpy.o \
         ptrace.o ptrace_user.o semaphore.o sigcontext.o signal.o \
-        syscalls.o sysrq.o thunk.o
+        syscalls.o sysrq.o thunk.o syscall_table.o
 
 USER_OBJS := ptrace_user.o sigcontext.o
 
diff --git a/arch/um/sys-x86_64/syscall_table.c b/arch/um/sys-x86_64/syscall_table.c
new file mode 100644
index 000000000000..34b2e842864f
--- /dev/null
+++ b/arch/um/sys-x86_64/syscall_table.c
@@ -0,0 +1,59 @@
+/* System call table for UML/x86-64, copied from arch/x86_64/kernel/syscall.c
+ * with some changes for UML. */
+
+#include <linux/linkage.h>
+#include <linux/sys.h>
+#include <linux/cache.h>
+#include <linux/config.h>
+
+#define __NO_STUBS
+
+/* Below you can see, in terms of #define's, the differences between the x86-64
+ * and the UML syscall table. */
+
+/* Not going to be implemented by UML, since we have no hardware. */
+#define stub_iopl sys_ni_syscall
+#define sys_ioperm sys_ni_syscall
+
+/* The UML TLS problem. Note that x86_64 does not implement this, so the below
+ * is needed only for the ia32 compatibility. */
+/*#define sys_set_thread_area sys_ni_syscall
+#define sys_get_thread_area sys_ni_syscall*/
+
+/* For __NR_time. The x86-64 name hopefully will change from sys_time64 to
+ * sys_time (since the current situation is bogus). I've sent a patch to cleanup
+ * this. Remove below the obsoleted line. */
+#define sys_time64 um_time
+#define sys_time um_time
+
+/* On UML we call it this way ("old" means it's not mmap2) */
+#define sys_mmap old_mmap
+/* On x86-64 sys_uname is actually sys_newuname plus a compatibility trick.
+ * See arch/x86_64/kernel/sys_x86_64.c */
+#define sys_uname sys_uname64
+
+#define stub_clone sys_clone
+#define stub_fork sys_fork
+#define stub_vfork sys_vfork
+#define stub_execve sys_execve
+#define stub_rt_sigsuspend sys_rt_sigsuspend
+#define stub_sigaltstack sys_sigaltstack
+#define stub_rt_sigreturn sys_rt_sigreturn
+
+#define __SYSCALL(nr, sym) extern asmlinkage void sym(void) ;
+#undef _ASM_X86_64_UNISTD_H_
+#include <asm-x86_64/unistd.h>
+
+#undef __SYSCALL
+#define __SYSCALL(nr, sym) [ nr ] = sym,
+#undef _ASM_X86_64_UNISTD_H_
+
+typedef void (*sys_call_ptr_t)(void);
+
+extern void sys_ni_syscall(void);
+
+sys_call_ptr_t sys_call_table[__NR_syscall_max+1] __cacheline_aligned = {
+        /* Smells like a like a compiler bug -- it doesn't work when the & below is removed. */
+        [0 ... __NR_syscall_max] = &sys_ni_syscall,
+#include <asm-x86_64/unistd.h>
+};
diff --git a/arch/um/sys-x86_64/syscalls.c b/arch/um/sys-x86_64/syscalls.c
index 68205a03364c..ab4b0abf8af3 100644
--- a/arch/um/sys-x86_64/syscalls.c
+++ b/arch/um/sys-x86_64/syscalls.c
@@ -14,11 +14,15 @@
 #include "asm/prctl.h" /* XXX This should get the constants from libc */
 #include "choose-mode.h"
 
-asmlinkage long wrap_sys_shmat(int shmid, char __user *shmaddr, int shmflg)
+asmlinkage long sys_uname64(struct new_utsname __user * name)
 {
-        unsigned long raddr;
-
-        return do_shmat(shmid, shmaddr, shmflg, &raddr) ?: (long) raddr;
+        int err;
+        down_read(&uts_sem);
+        err = copy_to_user(name, &system_utsname, sizeof (*name));
+        up_read(&uts_sem);
+        if (personality(current->personality) == PER_LINUX32)
+                err |= copy_to_user(&name->machine, "i686", 5);
+        return err ? -EFAULT : 0;
 }
 
 #ifdef CONFIG_MODE_TT
diff --git a/arch/v850/kernel/ptrace.c b/arch/v850/kernel/ptrace.c
index 8fa780757dcd..4726b87f5e5a 100644
--- a/arch/v850/kernel/ptrace.c
+++ b/arch/v850/kernel/ptrace.c
@@ -23,6 +23,7 @@
 #include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/ptrace.h>
+#include <linux/signal.h>
 
 #include <asm/errno.h>
 #include <asm/ptrace.h>
@@ -208,7 +209,7 @@ int sys_ptrace(long request, long pid, long addr, long data)
         /* Execute a single instruction. */
         case PTRACE_SINGLESTEP:
                 rval = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
 
                 /* Turn CHILD's single-step flag on or off.  */
diff --git a/arch/x86_64/boot/setup.S b/arch/x86_64/boot/setup.S
index 3e838be9dbe7..75d4d2ad93b3 100644
--- a/arch/x86_64/boot/setup.S
+++ b/arch/x86_64/boot/setup.S
@@ -160,7 +160,7 @@ ramdisk_max:	.long 0xffffffff
 trampoline:     call    start_of_setup
                 .align 16
                                         # The offset at this point is 0x240
-                .space  (0x7ff-0x240+1) # E820 & EDD space (ending at 0x7ff)
+                .space  (0xeff-0x240+1) # E820 & EDD space (ending at 0xeff)
 # End of setup header #####################################################
 
 start_of_setup:
@@ -412,9 +412,9 @@ jmpe820:
         # sizeof(e820rec).
         #
 good820:
-        movb    (E820NR), %al                   # up to 32 entries
+        movb    (E820NR), %al                   # up to 128 entries
         cmpb    $E820MAX, %al
-        jnl     bail820
+        jae     bail820
 
         incb    (E820NR)
         movw    %di, %ax
diff --git a/arch/x86_64/ia32/vsyscall.lds b/arch/x86_64/ia32/vsyscall.lds
index fa4b4dd4a9ff..f2e75ed4c6c7 100644
--- a/arch/x86_64/ia32/vsyscall.lds
+++ b/arch/x86_64/ia32/vsyscall.lds
@@ -36,6 +36,7 @@ SECTIONS
 
   .text.rtsigreturn : { *(.text.rtsigreturn) }   :text =0x90909090
         
+  .note           : { *(.note.*) }              :text :note
   .eh_frame_hdr   : { *(.eh_frame_hdr) }        :text :eh_frame_hdr
   .eh_frame       : { KEEP (*(.eh_frame)) }     :text
   .dynamic        : { *(.dynamic) }             :text :dynamic
@@ -55,6 +56,7 @@ PHDRS
 {
   text PT_LOAD FILEHDR PHDRS FLAGS(5); /* PF_R|PF_X */
   dynamic PT_DYNAMIC FLAGS(4); /* PF_R */
+  note PT_NOTE FLAGS(4); /* PF_R */
   eh_frame_hdr 0x6474e550; /* PT_GNU_EH_FRAME, but ld doesn't match the name */
 }
 
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 56516ac92e5d..7c154dfff64a 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -2,6 +2,12 @@
  * Handle the memory map.
  * The functions here do the job until bootmem takes over.
  * $Id: e820.c,v 1.4 2002/09/19 19:25:32 ak Exp $
+ *
+ *  Getting sanitize_e820_map() in sync with i386 version by applying change:
+ *  -  Provisions for empty E820 memory regions (reported by certain BIOSes).
+ *     Alex Achenbach <xela@slit.de>, December 2002.
+ *  Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+ *
  */
 #include <linux/config.h>
 #include <linux/kernel.h>
@@ -277,7 +283,7 @@ static int __init sanitize_e820_map(struct e820entry * biosmap, char * pnr_map)
         int chgidx, still_changing;
         int overlap_entries;
         int new_bios_entry;
-        int old_nr, new_nr;
+        int old_nr, new_nr, chg_nr;
         int i;
 
         /*
@@ -331,20 +337,24 @@ static int __init sanitize_e820_map(struct e820entry * biosmap, char * pnr_map)
         for (i=0; i < 2*old_nr; i++)
                 change_point[i] = &change_point_list[i];
 
-        /* record all known change-points (starting and ending addresses) */
+        /* record all known change-points (starting and ending addresses),
+           omitting those that are for empty memory regions */
         chgidx = 0;
         for (i=0; i < old_nr; i++)      {
-                change_point[chgidx]->addr = biosmap[i].addr;
-                change_point[chgidx++]->pbios = &biosmap[i];
-                change_point[chgidx]->addr = biosmap[i].addr + biosmap[i].size;
-                change_point[chgidx++]->pbios = &biosmap[i];
+                if (biosmap[i].size != 0) {
+                        change_point[chgidx]->addr = biosmap[i].addr;
+                        change_point[chgidx++]->pbios = &biosmap[i];
+                        change_point[chgidx]->addr = biosmap[i].addr + biosmap[i].size;
+                        change_point[chgidx++]->pbios = &biosmap[i];
+                }
         }
+        chg_nr = chgidx;
 
         /* sort change-point list by memory addresses (low -> high) */
         still_changing = 1;
         while (still_changing)  {
                 still_changing = 0;
-                for (i=1; i < 2*old_nr; i++)  {
+                for (i=1; i < chg_nr; i++)  {
                         /* if <current_addr> > <last_addr>, swap */
                         /* or, if current=<start_addr> & last=<end_addr>, swap */
                         if ((change_point[i]->addr < change_point[i-1]->addr) ||
@@ -367,7 +377,7 @@ static int __init sanitize_e820_map(struct e820entry * biosmap, char * pnr_map)
         last_type = 0;           /* start with undefined memory type */
         last_addr = 0;           /* start with 0 as last starting address */
         /* loop through change-points, determining affect on the new bios map */
-        for (chgidx=0; chgidx < 2*old_nr; chgidx++)
+        for (chgidx=0; chgidx < chg_nr; chgidx++)
         {
                 /* keep track of all overlapping bios entries */
                 if (change_point[chgidx]->addr == change_point[chgidx]->pbios->addr)
diff --git a/arch/x86_64/kernel/early_printk.c b/arch/x86_64/kernel/early_printk.c
index 750bcd0655dc..e3a19e8ebbf8 100644
--- a/arch/x86_64/kernel/early_printk.c
+++ b/arch/x86_64/kernel/early_printk.c
@@ -60,7 +60,7 @@ static struct console early_vga_console = {
 
 /* Serial functions loosely based on a similar package from Klaus P. Gerlicher */ 
 
-int early_serial_base = 0x3f8;  /* ttyS0 */ 
+static int early_serial_base = 0x3f8;  /* ttyS0 */
 
 #define XMTRDY          0x20
 
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index 3233a15cc4e0..1086b5fcac21 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -296,6 +296,7 @@ int_very_careful:
         call syscall_trace_leave
         popq %rdi
         andl $~(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SINGLESTEP),%edi
+        cli
         jmp int_restore_rest
         
 int_signal:
@@ -307,6 +308,7 @@ int_signal:
 1:      movl $_TIF_NEED_RESCHED,%edi    
 int_restore_rest:
         RESTORE_REST
+        cli
         jmp int_with_check
         CFI_ENDPROC
                 
@@ -490,7 +492,8 @@ retint_signal:
         call do_notify_resume
         RESTORE_REST
         cli
-        GET_THREAD_INFO(%rcx)   
+        GET_THREAD_INFO(%rcx)
+        movl $_TIF_WORK_MASK,%edi
         jmp retint_check
 
 #ifdef CONFIG_PREEMPT
diff --git a/arch/x86_64/kernel/head64.c b/arch/x86_64/kernel/head64.c
index 6cad46c98a23..0f8c78dcd38c 100644
--- a/arch/x86_64/kernel/head64.c
+++ b/arch/x86_64/kernel/head64.c
@@ -29,8 +29,6 @@ static void __init clear_bss(void)
                (unsigned long) __bss_end - (unsigned long) __bss_start);
 }
 
-extern char x86_boot_params[2048];
-
 #define NEW_CL_POINTER          0x228   /* Relative to real mode data */
 #define OLD_CL_MAGIC_ADDR       0x90020
 #define OLD_CL_MAGIC            0xA33F
@@ -44,7 +42,7 @@ static void __init copy_bootdata(char *real_mode_data)
         int new_data;
         char * command_line;
 
-        memcpy(x86_boot_params, real_mode_data, 2048); 
+        memcpy(x86_boot_params, real_mode_data, BOOT_PARAM_SIZE);
         new_data = *(int *) (x86_boot_params + NEW_CL_POINTER);
         if (!new_data) {
                 if (OLD_CL_MAGIC != * (u16 *) OLD_CL_MAGIC_ADDR) {
@@ -93,9 +91,6 @@ void __init x86_64_start_kernel(char * real_mode_data)
 #ifdef CONFIG_SMP
         cpu_set(0, cpu_online_map);
 #endif
-        /* default console: */
-        if (!strstr(saved_command_line, "console="))
-                strcat(saved_command_line, " console=tty0"); 
         s = strstr(saved_command_line, "earlyprintk=");
         if (s != NULL)
                 setup_early_printk(s);
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 29a257295484..60be58617eb9 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -1607,7 +1607,6 @@ static inline void check_timer(void)
                                 disable_8259A_irq(0);
                                 setup_nmi();
                                 enable_8259A_irq(0);
-                                check_nmi_watchdog();
                         }
                         return;
                 }
@@ -1627,7 +1626,6 @@ static inline void check_timer(void)
                         nmi_watchdog_default();
                         if (nmi_watchdog == NMI_IO_APIC) {
                                 setup_nmi();
-                                check_nmi_watchdog();
                         }
                         return;
                 }
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index e00d4adec36b..61de0b34a01e 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -112,17 +112,20 @@ static __init int cpu_has_lapic(void)
         }       
 }
 
-int __init check_nmi_watchdog (void)
+static int __init check_nmi_watchdog (void)
 {
         int counts[NR_CPUS];
         int cpu;
 
+        if (nmi_watchdog == NMI_NONE)
+                return 0;
+
         if (nmi_watchdog == NMI_LOCAL_APIC && !cpu_has_lapic())  {
                 nmi_watchdog = NMI_NONE;
                 return -1; 
         }       
 
-        printk(KERN_INFO "testing NMI watchdog ... ");
+        printk(KERN_INFO "Testing NMI watchdog ... ");
 
         for (cpu = 0; cpu < NR_CPUS; cpu++)
                 counts[cpu] = cpu_pda[cpu].__nmi_count; 
@@ -148,6 +151,8 @@ int __init check_nmi_watchdog (void)
 
         return 0;
 }
+/* Have this called later during boot so counters are updating */
+late_initcall(check_nmi_watchdog);
 
 int __init setup_nmi_watchdog(char *str)
 {
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 9922d2ba24a3..761b6d35e338 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -402,10 +402,10 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long rsp,
         p->thread.fs = me->thread.fs;
         p->thread.gs = me->thread.gs;
 
-        asm("movl %%gs,%0" : "=m" (p->thread.gsindex));
-        asm("movl %%fs,%0" : "=m" (p->thread.fsindex));
-        asm("movl %%es,%0" : "=m" (p->thread.es));
-        asm("movl %%ds,%0" : "=m" (p->thread.ds));
+        asm("mov %%gs,%0" : "=m" (p->thread.gsindex));
+        asm("mov %%fs,%0" : "=m" (p->thread.fsindex));
+        asm("mov %%es,%0" : "=m" (p->thread.es));
+        asm("mov %%ds,%0" : "=m" (p->thread.ds));
 
         if (unlikely(me->thread.io_bitmap_ptr != NULL)) { 
                 p->thread.io_bitmap_ptr = kmalloc(IO_BITMAP_BYTES, GFP_KERNEL);
@@ -468,11 +468,11 @@ struct task_struct *__switch_to(struct task_struct *prev_p, struct task_struct *
          * Switch DS and ES.
          * This won't pick up thread selector changes, but I guess that is ok.
          */
-        asm volatile("movl %%es,%0" : "=m" (prev->es)); 
+        asm volatile("mov %%es,%0" : "=m" (prev->es));
         if (unlikely(next->es | prev->es))
                 loadsegment(es, next->es); 
         
-        asm volatile ("movl %%ds,%0" : "=m" (prev->ds)); 
+        asm volatile ("mov %%ds,%0" : "=m" (prev->ds));
         if (unlikely(next->ds | prev->ds))
                 loadsegment(ds, next->ds);
 
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c
index c7011675007d..c64b9c97c745 100644
--- a/arch/x86_64/kernel/ptrace.c
+++ b/arch/x86_64/kernel/ptrace.c
@@ -18,6 +18,7 @@
 #include <linux/security.h>
 #include <linux/audit.h>
 #include <linux/seccomp.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -467,7 +468,7 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
         case PTRACE_CONT:    /* restart after signal. */
 
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 if (request == PTRACE_SYSCALL)
                         set_tsk_thread_flag(child,TIF_SYSCALL_TRACE);
@@ -529,7 +530,7 @@ asmlinkage long sys_ptrace(long request, long pid, unsigned long addr, long data
 
         case PTRACE_SINGLESTEP:    /* set the trap flag. */
                 ret = -EIO;
-                if ((unsigned long) data > _NSIG)
+                if (!valid_signal(data))
                         break;
                 clear_tsk_thread_flag(child,TIF_SYSCALL_TRACE);
                 set_singlestep(child);
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index b18c114c7648..2129cf9ba6b2 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -977,7 +977,7 @@ void __init identify_cpu(struct cpuinfo_x86 *c)
         if ((xlvl & 0xffff0000) == 0x80000000) {
                 if (xlvl >= 0x80000001) {
                         c->x86_capability[1] = cpuid_edx(0x80000001);
-                        c->x86_capability[5] = cpuid_ecx(0x80000001);
+                        c->x86_capability[6] = cpuid_ecx(0x80000001);
                 }
                 if (xlvl >= 0x80000004)
                         get_model_name(c); /* Default name */
@@ -1076,7 +1076,7 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 "fxsr", "sse", "sse2", "ss", "ht", "tm", "ia64", NULL,
 
                 /* AMD-defined */
-                "pni", NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, "syscall", NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, NULL, "nx", NULL, "mmxext", NULL,
                 NULL, "fxsr_opt", NULL, NULL, NULL, "lm", "3dnowext", "3dnow",
@@ -1100,11 +1100,17 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 
+                /* VIA/Cyrix/Centaur-defined */
+                NULL, NULL, "rng", "rng_en", NULL, NULL, "ace", "ace_en",
+                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
+
                 /* AMD-defined (#2) */
                 "lahf_lm", "cmp_legacy", NULL, NULL, NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
-                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
+                NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
         };
         static char *x86_power_flags[] = { 
                 "ts",   /* temperature sensor */
diff --git a/arch/x86_64/kernel/setup64.c b/arch/x86_64/kernel/setup64.c
index b5305b04bc40..678b7ac33b8b 100644
--- a/arch/x86_64/kernel/setup64.c
+++ b/arch/x86_64/kernel/setup64.c
@@ -12,6 +12,7 @@
 #include <linux/string.h>
 #include <linux/bootmem.h>
 #include <linux/bitops.h>
+#include <asm/bootsetup.h>
 #include <asm/pda.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -26,7 +27,7 @@
 #include <asm/mman.h>
 #include <asm/numa.h>
 
-char x86_boot_params[2048] __initdata = {0,};
+char x86_boot_params[BOOT_PARAM_SIZE] __initdata = {0,};
 
 cpumask_t cpu_initialized __initdata = CPU_MASK_NONE;
 
diff --git a/arch/x86_64/kernel/sys_x86_64.c b/arch/x86_64/kernel/sys_x86_64.c
index 477d8be57d64..dbebd5ccba6b 100644
--- a/arch/x86_64/kernel/sys_x86_64.c
+++ b/arch/x86_64/kernel/sys_x86_64.c
@@ -152,12 +152,6 @@ asmlinkage long sys_uname(struct new_utsname __user * name)
         return err ? -EFAULT : 0;
 }
 
-asmlinkage long wrap_sys_shmat(int shmid, char __user *shmaddr, int shmflg)
-{
-        unsigned long raddr;
-        return do_shmat(shmid,shmaddr,shmflg,&raddr) ?: (long)raddr;
-}
-
 asmlinkage long sys_time64(long __user * tloc)
 {
         struct timeval now; 
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 536754faf4d2..90d6089d60ed 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -146,7 +146,7 @@ config CRYPTO_SERPENT
 
 config CRYPTO_AES
         tristate "AES cipher algorithms"
-        depends on CRYPTO && !(X86 && !X86_64)
+        depends on CRYPTO && !((X86 || UML_X86) && !64BIT)
         help
           AES cipher algorithms (FIPS-197). AES uses the Rijndael 
           algorithm.
@@ -166,7 +166,7 @@ config CRYPTO_AES
 
 config CRYPTO_AES_586
         tristate "AES cipher algorithms (i586)"
-        depends on CRYPTO && (X86 && !X86_64)
+        depends on CRYPTO && ((X86 || UML_X86) && !64BIT)
         help
           AES cipher algorithms (FIPS-197). AES uses the Rijndael 
           algorithm.
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 05a17812d521..ff64d333e95f 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -838,7 +838,7 @@ int acpi_processor_cst_has_changed (struct acpi_processor *pr)
 
         /* Fall back to the default idle loop */
         pm_idle = pm_idle_save;
-        synchronize_kernel();
+        synchronize_sched();  /* Relies on interrupts forcing exit from idle. */
 
         pr->flags.power = 0;
         result = acpi_processor_get_power_info(pr);
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index e7ca06626566..119c94093a13 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -379,8 +379,8 @@ ACPI_DEVICE_ATTR(eject, 0200, NULL, acpi_eject_store);
 
 /**
  * setup_sys_fs_device_files - sets up the device files under device namespace
- * @@dev:       acpi_device object
- * @@func:      function pointer to create or destroy the device file
+ * @dev:        acpi_device object
+ * @func:       function pointer to create or destroy the device file
  */
 static void
 setup_sys_fs_device_files (
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index cd6453905a9b..3a5f4c991797 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -115,7 +115,7 @@ int platform_add_devices(struct platform_device **devs, int num)
 
 /**
  *      platform_device_register - add a platform-level device
- *      @dev:   platform device we're adding
+ *      @pdev:  platform device we're adding
  *
  */
 int platform_device_register(struct platform_device * pdev)
@@ -174,7 +174,7 @@ int platform_device_register(struct platform_device * pdev)
 
 /**
  *      platform_device_unregister - remove a platform-level device
- *      @dev:   platform device we're removing
+ *      @pdev:  platform device we're removing
  *
  *      Note that this function will also release all memory- and port-based
  *      resources owned by the device (@dev->resource).
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index efdf04450bf7..9e268ddedfbd 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -78,6 +78,7 @@
 #define DBG_RX          0x0200
 #define DBG_TX          0x0400
 static unsigned int debugflags;
+static unsigned int nbds_max = 16;
 #endif /* NDEBUG */
 
 static struct nbd_device nbd_dev[MAX_NBD];
@@ -647,7 +648,13 @@ static int __init nbd_init(void)
                 return -EIO;
         }
 
-        for (i = 0; i < MAX_NBD; i++) {
+        if (nbds_max > MAX_NBD) {
+                printk(KERN_CRIT "nbd: cannot allocate more than %u nbds; %u requested.\n", MAX_NBD,
+                                nbds_max);
+                return -EINVAL;
+        }
+
+        for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = alloc_disk(1);
                 if (!disk)
                         goto out;
@@ -673,7 +680,7 @@ static int __init nbd_init(void)
         dprintk(DBG_INIT, "nbd: debugflags=0x%x\n", debugflags);
 
         devfs_mk_dir("nbd");
-        for (i = 0; i < MAX_NBD; i++) {
+        for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = nbd_dev[i].disk;
                 nbd_dev[i].file = NULL;
                 nbd_dev[i].magic = LO_MAGIC;
@@ -706,8 +713,9 @@ out:
 static void __exit nbd_cleanup(void)
 {
         int i;
-        for (i = 0; i < MAX_NBD; i++) {
+        for (i = 0; i < nbds_max; i++) {
                 struct gendisk *disk = nbd_dev[i].disk;
+                nbd_dev[i].magic = 0;
                 if (disk) {
                         del_gendisk(disk);
                         blk_cleanup_queue(disk->queue);
@@ -725,6 +733,8 @@ module_exit(nbd_cleanup);
 MODULE_DESCRIPTION("Network Block Device");
 MODULE_LICENSE("GPL");
 
+module_param(nbds_max, int, 0444);
+MODULE_PARM_DESC(nbds_max, "How many network block devices to initialize.");
 #ifndef NDEBUG
 module_param(debugflags, int, 0644);
 MODULE_PARM_DESC(debugflags, "flags for controlling debug output");
diff --git a/drivers/block/noop-iosched.c b/drivers/block/noop-iosched.c
index 888c477e02b3..b1730b62c37e 100644
--- a/drivers/block/noop-iosched.c
+++ b/drivers/block/noop-iosched.c
@@ -13,34 +13,13 @@
 static int elevator_noop_merge(request_queue_t *q, struct request **req,
                                struct bio *bio)
 {
-        struct list_head *entry = &q->queue_head;
-        struct request *__rq;
         int ret;
 
-        if ((ret = elv_try_last_merge(q, bio))) {
+        ret = elv_try_last_merge(q, bio);
+        if (ret != ELEVATOR_NO_MERGE)
                 *req = q->last_merge;
-                return ret;
-        }
 
-        while ((entry = entry->prev) != &q->queue_head) {
-                __rq = list_entry_rq(entry);
-
-                if (__rq->flags & (REQ_SOFTBARRIER | REQ_HARDBARRIER))
-                        break;
-                else if (__rq->flags & REQ_STARTED)
-                        break;
-
-                if (!blk_fs_request(__rq))
-                        continue;
-
-                if ((ret = elv_try_merge(__rq, bio))) {
-                        *req = __rq;
-                        q->last_merge = __rq;
-                        return ret;
-                }
-        }
-
-        return ELEVATOR_NO_MERGE;
+        return ret;
 }
 
 static void elevator_noop_merge_requests(request_queue_t *q, struct request *req,
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 9deca49c71f0..beaa561f2ed8 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -645,7 +645,7 @@ static int cdrom_mrw_exit(struct cdrom_device_info *cdi)
                 ret = cdrom_mrw_bgformat_susp(cdi, 0);
         }
 
-        if (!ret)
+        if (!ret && cdi->media_written)
                 ret = cdrom_flush_cache(cdi);
 
         return ret;
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 97ac4edf4655..e162dab64ffd 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -982,7 +982,7 @@ config MAX_RAW_DEVS
 
 config HANGCHECK_TIMER
         tristate "Hangcheck timer"
-        depends on X86_64 || X86
+        depends on X86_64 || X86 || IA64 || PPC64 || ARCH_S390
         help
           The hangcheck-timer module detects when the system has gone
           out to lunch past a certain margin.  It can reboot the system
diff --git a/drivers/char/agp/ali-agp.c b/drivers/char/agp/ali-agp.c
index c86a22c5499b..0212febda654 100644
--- a/drivers/char/agp/ali-agp.c
+++ b/drivers/char/agp/ali-agp.c
@@ -192,7 +192,7 @@ static struct aper_size_info_32 ali_generic_sizes[7] =
         {4, 1024, 0, 3}
 };
 
-struct agp_bridge_driver ali_generic_bridge = {
+static struct agp_bridge_driver ali_generic_bridge = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = ali_generic_sizes,
         .size_type              = U32_APER_SIZE,
@@ -215,7 +215,7 @@ struct agp_bridge_driver ali_generic_bridge = {
         .agp_destroy_page       = ali_destroy_page,
 };
 
-struct agp_bridge_driver ali_m1541_bridge = {
+static struct agp_bridge_driver ali_m1541_bridge = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = ali_generic_sizes,
         .size_type              = U32_APER_SIZE,
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index f1ea87ea6b65..e62a3c2c44a9 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -358,7 +358,7 @@ static struct gatt_mask amd_irongate_masks[] =
         {.mask = 1, .type = 0}
 };
 
-struct agp_bridge_driver amd_irongate_driver = {
+static struct agp_bridge_driver amd_irongate_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = amd_irongate_sizes,
         .size_type              = LVL2_APER_SIZE,
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 905f0629c44f..399c042f68f0 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -243,7 +243,7 @@ static void amd64_cleanup(void)
 }
 
 
-struct agp_bridge_driver amd_8151_driver = {
+static struct agp_bridge_driver amd_8151_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = amd_8151_sizes,
         .size_type              = U32_APER_SIZE,
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 757dde006fc9..a65f8827c283 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -393,7 +393,7 @@ static int ati_free_gatt_table(struct agp_bridge_data *bridge)
         return 0;
 }
 
-struct agp_bridge_driver ati_generic_bridge = {
+static struct agp_bridge_driver ati_generic_bridge = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = ati_generic_sizes,
         .size_type              = LVL2_APER_SIZE,
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index c3442f3c6480..2f3dfb63bdc6 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -97,7 +97,7 @@ void agp_backend_release(struct agp_bridge_data *bridge)
 EXPORT_SYMBOL(agp_backend_release);
 
 
-struct { int mem, agp; } maxes_table[] = {
+static struct { int mem, agp; } maxes_table[] = {
         {0, 0},
         {32, 4},
         {64, 28},
@@ -322,7 +322,7 @@ static int __init agp_init(void)
         return 0;
 }
 
-void __exit agp_exit(void)
+static void __exit agp_exit(void)
 {
 }
 
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index 2a87cecdc912..1383c3165ea1 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -303,7 +303,7 @@ static int efficeon_remove_memory(struct agp_memory * mem, off_t pg_start, int t
 }
 
 
-struct agp_bridge_driver efficeon_driver = {
+static struct agp_bridge_driver efficeon_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = efficeon_generic_sizes,
         .size_type              = LVL2_APER_SIZE,
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index f633623ac802..3dfb6648547b 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -235,7 +235,7 @@ static void agp_insert_into_pool(struct agp_memory * temp)
 
 /* File private list routines */
 
-struct agp_file_private *agp_find_private(pid_t pid)
+static struct agp_file_private *agp_find_private(pid_t pid)
 {
         struct agp_file_private *curr;
 
@@ -250,7 +250,7 @@ struct agp_file_private *agp_find_private(pid_t pid)
         return NULL;
 }
 
-void agp_insert_file_private(struct agp_file_private * priv)
+static void agp_insert_file_private(struct agp_file_private * priv)
 {
         struct agp_file_private *prev;
 
@@ -262,7 +262,7 @@ void agp_insert_file_private(struct agp_file_private * priv)
         agp_fe.file_priv_list = priv;
 }
 
-void agp_remove_file_private(struct agp_file_private * priv)
+static void agp_remove_file_private(struct agp_file_private * priv)
 {
         struct agp_file_private *next;
         struct agp_file_private *prev;
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index 4f7a3e8bc919..80dafa3030bd 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -288,7 +288,7 @@ static struct gatt_mask nvidia_generic_masks[] =
 };
 
 
-struct agp_bridge_driver nvidia_driver = {
+static struct agp_bridge_driver nvidia_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = nvidia_generic_sizes,
         .size_type              = U8_APER_SIZE,
diff --git a/drivers/char/agp/sis-agp.c b/drivers/char/agp/sis-agp.c
index cfccacb2a647..ebc05554045c 100644
--- a/drivers/char/agp/sis-agp.c
+++ b/drivers/char/agp/sis-agp.c
@@ -119,7 +119,7 @@ static struct aper_size_info_8 sis_generic_sizes[7] =
         {4, 1024, 0, 3}
 };
 
-struct agp_bridge_driver sis_driver = {
+static struct agp_bridge_driver sis_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = sis_generic_sizes,
         .size_type              = U8_APER_SIZE,
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index bb338d9134e0..10c23302dd84 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -409,7 +409,7 @@ static void serverworks_agp_enable(struct agp_bridge_data *bridge, u32 mode)
         agp_device_command(command, 0);
 }
 
-struct agp_bridge_driver sworks_driver = {
+static struct agp_bridge_driver sworks_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = serverworks_sizes,
         .size_type              = LVL2_APER_SIZE,
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index e1451dd9b6a7..c847df575cf5 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -170,7 +170,7 @@ static void via_tlbflush_agp3(struct agp_memory *mem)
 }
 
 
-struct agp_bridge_driver via_agp3_driver = {
+static struct agp_bridge_driver via_agp3_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = agp3_generic_sizes,
         .size_type              = U8_APER_SIZE,
@@ -193,7 +193,7 @@ struct agp_bridge_driver via_agp3_driver = {
         .agp_destroy_page       = agp_generic_destroy_page,
 };
 
-struct agp_bridge_driver via_driver = {
+static struct agp_bridge_driver via_driver = {
         .owner                  = THIS_MODULE,
         .aperture_sizes         = via_generic_sizes,
         .size_type              = U8_APER_SIZE,
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index 903e4c3cc209..a229915ce1b2 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -52,7 +52,7 @@
 #define KERNEL
 #include <linux/types.h>
 #include <linux/fs.h>
-#include <linux/mm.h>           /* for verify_area */
+#include <linux/mm.h>
 #include <linux/errno.h>        /* for -EBUSY */
 #include <linux/ioport.h>       /* for request_region */
 #include <linux/delay.h>        /* for loops_per_jiffy */
diff --git a/drivers/char/hangcheck-timer.c b/drivers/char/hangcheck-timer.c
index 83d6b37b36cd..78e650fc5b41 100644
--- a/drivers/char/hangcheck-timer.c
+++ b/drivers/char/hangcheck-timer.c
@@ -3,7 +3,7 @@
  *
  * Driver for a little io fencing timer.
  *
- * Copyright (C) 2002 Oracle Corporation.  All rights reserved.
+ * Copyright (C) 2002, 2003 Oracle.  All rights reserved.
  *
  * Author: Joel Becker <joel.becker@oracle.com>
  *
@@ -44,11 +44,14 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/reboot.h>
+#include <linux/smp_lock.h>
 #include <linux/init.h>
+#include <linux/delay.h>
 #include <asm/uaccess.h>
+#include <linux/sysrq.h>
 
 
-#define VERSION_STR "0.5.0"
+#define VERSION_STR "0.9.0"
 
 #define DEFAULT_IOFENCE_MARGIN 60       /* Default fudge factor, in seconds */
 #define DEFAULT_IOFENCE_TICK 180        /* Default timer timeout, in seconds */
@@ -56,18 +59,89 @@
 static int hangcheck_tick = DEFAULT_IOFENCE_TICK;
 static int hangcheck_margin = DEFAULT_IOFENCE_MARGIN;
 static int hangcheck_reboot;  /* Defaults to not reboot */
+static int hangcheck_dump_tasks;  /* Defaults to not dumping SysRQ T */
 
-/* Driver options */
+/* options - modular */
 module_param(hangcheck_tick, int, 0);
 MODULE_PARM_DESC(hangcheck_tick, "Timer delay.");
 module_param(hangcheck_margin, int, 0);
 MODULE_PARM_DESC(hangcheck_margin, "If the hangcheck timer has been delayed more than hangcheck_margin seconds, the driver will fire.");
 module_param(hangcheck_reboot, int, 0);
 MODULE_PARM_DESC(hangcheck_reboot, "If nonzero, the machine will reboot when the timer margin is exceeded.");
+module_param(hangcheck_dump_tasks, int, 0);
+MODULE_PARM_DESC(hangcheck_dump_tasks, "If nonzero, the machine will dump the system task state when the timer margin is exceeded.");
 
-MODULE_AUTHOR("Joel Becker");
+MODULE_AUTHOR("Oracle");
 MODULE_DESCRIPTION("Hangcheck-timer detects when the system has gone out to lunch past a certain margin.");
 MODULE_LICENSE("GPL");
+MODULE_VERSION(VERSION_STR);
+
+/* options - nonmodular */
+#ifndef MODULE
+
+static int __init hangcheck_parse_tick(char *str)
+{
+        int par;
+        if (get_option(&str,&par))
+                hangcheck_tick = par;
+        return 1;
+}
+
+static int __init hangcheck_parse_margin(char *str)
+{
+        int par;
+        if (get_option(&str,&par))
+                hangcheck_margin = par;
+        return 1;
+}
+
+static int __init hangcheck_parse_reboot(char *str)
+{
+        int par;
+        if (get_option(&str,&par))
+                hangcheck_reboot = par;
+        return 1;
+}
+
+static int __init hangcheck_parse_dump_tasks(char *str)
+{
+        int par;
+        if (get_option(&str,&par))
+                hangcheck_dump_tasks = par;
+        return 1;
+}
+
+__setup("hcheck_tick", hangcheck_parse_tick);
+__setup("hcheck_margin", hangcheck_parse_margin);
+__setup("hcheck_reboot", hangcheck_parse_reboot);
+__setup("hcheck_dump_tasks", hangcheck_parse_dump_tasks);
+#endif /* not MODULE */
+
+#if defined(CONFIG_X86) || defined(CONFIG_X86_64)
+# define HAVE_MONOTONIC
+# define TIMER_FREQ 1000000000ULL
+#elif defined(CONFIG_ARCH_S390)
+/* FA240000 is 1 Second in the IBM time universe (Page 4-38 Principles of Op for zSeries */
+# define TIMER_FREQ 0xFA240000ULL
+#elif defined(CONFIG_IA64)
+# define TIMER_FREQ ((unsigned long long)local_cpu_data->itc_freq)
+#elif defined(CONFIG_PPC64)
+# define TIMER_FREQ (HZ*loops_per_jiffy)
+#endif
+
+#ifdef HAVE_MONOTONIC
+extern unsigned long long monotonic_clock(void);
+#else
+static inline unsigned long long monotonic_clock(void)
+{
+# ifdef __s390__
+        /* returns the TOD.  see 4-38 Principles of Op of zSeries */
+        return get_clock();
+# else
+        return get_cycles();
+# endif  /* __s390__ */
+}
+#endif  /* HAVE_MONOTONIC */
 
 
 /* Last time scheduled */
@@ -78,7 +152,6 @@ static void hangcheck_fire(unsigned long);
 static struct timer_list hangcheck_ticktock =
                 TIMER_INITIALIZER(hangcheck_fire, 0, 0);
 
-extern unsigned long long monotonic_clock(void);
 
 static void hangcheck_fire(unsigned long data)
 {
@@ -92,6 +165,12 @@ static void hangcheck_fire(unsigned long data)
                 tsc_diff = (cur_tsc + (~0ULL - hangcheck_tsc)); /* or something */
 
         if (tsc_diff > hangcheck_tsc_margin) {
+                if (hangcheck_dump_tasks) {
+                        printk(KERN_CRIT "Hangcheck: Task state:\n");
+#ifdef CONFIG_MAGIC_SYSRQ
+                        handle_sysrq('t', NULL, NULL);
+#endif  /* CONFIG_MAGIC_SYSRQ */
+                }
                 if (hangcheck_reboot) {
                         printk(KERN_CRIT "Hangcheck: hangcheck is restarting the machine.\n");
                         machine_restart(NULL);
@@ -108,10 +187,16 @@ static int __init hangcheck_init(void)
 {
         printk("Hangcheck: starting hangcheck timer %s (tick is %d seconds, margin is %d seconds).\n",
                VERSION_STR, hangcheck_tick, hangcheck_margin);
-
-        hangcheck_tsc_margin = hangcheck_margin + hangcheck_tick;
-        hangcheck_tsc_margin *= 1000000000;
-
+#if defined (HAVE_MONOTONIC)
+        printk("Hangcheck: Using monotonic_clock().\n");
+#elif defined(__s390__)
+        printk("Hangcheck: Using TOD.\n");
+#else
+        printk("Hangcheck: Using get_cycles().\n");
+#endif  /* HAVE_MONOTONIC */
+        hangcheck_tsc_margin =
+                (unsigned long long)(hangcheck_margin + hangcheck_tick);
+        hangcheck_tsc_margin *= (unsigned long long)TIMER_FREQ;
 
         hangcheck_tsc = monotonic_clock();
         mod_timer(&hangcheck_ticktock, jiffies + (hangcheck_tick*HZ));
@@ -123,6 +208,7 @@ static int __init hangcheck_init(void)
 static void __exit hangcheck_exit(void)
 {
         del_timer_sync(&hangcheck_ticktock);
+        printk("Hangcheck: Stopped hangcheck timer.\n");
 }
 
 module_init(hangcheck_init);
diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
index 225b330115bb..5ce9c6269033 100644
--- a/drivers/char/ipmi/ipmi_bt_sm.c
+++ b/drivers/char/ipmi/ipmi_bt_sm.c
@@ -235,7 +235,6 @@ static void reset_flags(struct si_sm_data *bt)
         if (BT_STATUS & BT_B_BUSY) BT_CONTROL(BT_B_BUSY);
         BT_CONTROL(BT_CLR_WR_PTR);
         BT_CONTROL(BT_SMS_ATN);
-        BT_INTMASK_W(BT_BMC_HWRST);
 #ifdef DEVELOPMENT_ONLY_NOT_FOR_PRODUCTION
         if (BT_STATUS & BT_B2H_ATN) {
                 int i;
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index a6606a1aced7..d7fb452af7f9 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -2588,28 +2588,20 @@ handle_msg_timeout(struct ipmi_recv_msg *msg)
         deliver_response(msg);
 }
 
-static void
-send_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
-                   struct ipmi_smi_msg *smi_msg,
-                   unsigned char seq, long seqid)
+static struct ipmi_smi_msg *
+smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
+                  unsigned char seq, long seqid)
 {
-        if (!smi_msg)
-                smi_msg = ipmi_alloc_smi_msg();
+        struct ipmi_smi_msg *smi_msg = ipmi_alloc_smi_msg();
         if (!smi_msg)
                 /* If we can't allocate the message, then just return, we
                    get 4 retries, so this should be ok. */
-                return;
+                return NULL;
 
         memcpy(smi_msg->data, recv_msg->msg.data, recv_msg->msg.data_len);
         smi_msg->data_size = recv_msg->msg.data_len;
         smi_msg->msgid = STORE_SEQ_IN_MSGID(seq, seqid);
                 
-        /* Send the new message.  We send with a zero priority.  It
-           timed out, I doubt time is that critical now, and high
-           priority messages are really only for messages to the local
-           MC, which don't get resent. */
-        intf->handlers->sender(intf->send_info, smi_msg, 0);
-
 #ifdef DEBUG_MSGING
         {
                 int m;
@@ -2619,6 +2611,7 @@ send_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg,
                 printk("\n");
         }
 #endif
+        return smi_msg;
 }
 
 static void
@@ -2683,14 +2676,13 @@ ipmi_timeout_handler(long timeout_period)
                                         intf->timed_out_ipmb_commands++;
                                 spin_unlock(&intf->counter_lock);
                         } else {
+                                struct ipmi_smi_msg *smi_msg;
                                 /* More retries, send again. */
 
                                 /* Start with the max timer, set to normal
                                    timer after the message is sent. */
                                 ent->timeout = MAX_MSG_TIMEOUT;
                                 ent->retries_left--;
-                                send_from_recv_msg(intf, ent->recv_msg, NULL,
-                                                   j, ent->seqid);
                                 spin_lock(&intf->counter_lock);
                                 if (ent->recv_msg->addr.addr_type
                                     == IPMI_LAN_ADDR_TYPE)
@@ -2698,6 +2690,20 @@ ipmi_timeout_handler(long timeout_period)
                                 else
                                         intf->retransmitted_ipmb_commands++;
                                 spin_unlock(&intf->counter_lock);
+                                smi_msg = smi_from_recv_msg(intf,
+                                                ent->recv_msg, j, ent->seqid);
+                                if(!smi_msg)
+                                        continue;
+
+                                spin_unlock_irqrestore(&(intf->seq_lock),flags);
+                                /* Send the new message.  We send with a zero
+                                 * priority.  It timed out, I doubt time is
+                                 * that critical now, and high priority
+                                 * messages are really only for messages to the
+                                 * local MC, which don't get resent. */
+                                intf->handlers->sender(intf->send_info,
+                                                        smi_msg, 0);
+                                spin_lock_irqsave(&(intf->seq_lock), flags);
                         }
                 }
                 spin_unlock_irqrestore(&(intf->seq_lock), flags);
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 29de259a981e..5419440087fd 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -100,6 +100,11 @@ enum si_intf_state {
         /* FIXME - add watchdog stuff. */
 };
 
+/* Some BT-specific defines we need here. */
+#define IPMI_BT_INTMASK_REG             2
+#define IPMI_BT_INTMASK_CLEAR_IRQ_BIT   2
+#define IPMI_BT_INTMASK_ENABLE_IRQ_BIT  1
+
 enum si_type {
     SI_KCS, SI_SMIC, SI_BT
 };
@@ -875,6 +880,17 @@ static irqreturn_t si_irq_handler(int irq, void *data, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
+static irqreturn_t si_bt_irq_handler(int irq, void *data, struct pt_regs *regs)
+{
+        struct smi_info *smi_info = data;
+        /* We need to clear the IRQ flag for the BT interface. */
+        smi_info->io.outputb(&smi_info->io, IPMI_BT_INTMASK_REG,
+                             IPMI_BT_INTMASK_CLEAR_IRQ_BIT
+                             | IPMI_BT_INTMASK_ENABLE_IRQ_BIT);
+        return si_irq_handler(irq, data, regs);
+}
+
+
 static struct ipmi_smi_handlers handlers =
 {
         .owner                  = THIS_MODULE,
@@ -1001,11 +1017,22 @@ static int std_irq_setup(struct smi_info *info)
         if (!info->irq)
                 return 0;
 
-        rv = request_irq(info->irq,
-                         si_irq_handler,
-                         SA_INTERRUPT,
-                         DEVICE_NAME,
-                         info);
+        if (info->si_type == SI_BT) {
+                rv = request_irq(info->irq,
+                                 si_bt_irq_handler,
+                                 SA_INTERRUPT,
+                                 DEVICE_NAME,
+                                 info);
+                if (!rv)
+                        /* Enable the interrupt in the BT interface. */
+                        info->io.outputb(&info->io, IPMI_BT_INTMASK_REG,
+                                         IPMI_BT_INTMASK_ENABLE_IRQ_BIT);
+        } else
+                rv = request_irq(info->irq,
+                                 si_irq_handler,
+                                 SA_INTERRUPT,
+                                 DEVICE_NAME,
+                                 info);
         if (rv) {
                 printk(KERN_WARNING
                        "ipmi_si: %s unable to claim interrupt %d,"
@@ -1024,6 +1051,9 @@ static void std_irq_cleanup(struct smi_info *info)
         if (!info->irq)
                 return;
 
+        if (info->si_type == SI_BT)
+                /* Disable the interrupt in the BT interface. */
+                info->io.outputb(&info->io, IPMI_BT_INTMASK_REG, 0);
         free_irq(info->irq, info);
 }
 
@@ -1526,8 +1556,17 @@ static int try_init_acpi(int intf_num, struct smi_info **new_info)
                 info->irq_setup = NULL;
         }
 
-        regspacings[intf_num] = spmi->addr.register_bit_width / 8;
-        info->io.regspacing = spmi->addr.register_bit_width / 8;
+        if (spmi->addr.register_bit_width) {
+                /* A (hopefully) properly formed register bit width. */
+                regspacings[intf_num] = spmi->addr.register_bit_width / 8;
+                info->io.regspacing = spmi->addr.register_bit_width / 8;
+        } else {
+                /* Some broken systems get this wrong and set the value
+                 * to zero.  Assume it is the default spacing.  If that
+                 * is wrong, too bad, the vendor should fix the tables. */
+                regspacings[intf_num] = DEFAULT_REGSPACING;
+                info->io.regspacing = DEFAULT_REGSPACING;
+        }
         regsizes[intf_num] = regspacings[intf_num];
         info->io.regsize = regsizes[intf_num];
         regshifts[intf_num] = spmi->addr.register_bit_offset;
@@ -1623,7 +1662,13 @@ static int decode_dmi(dmi_header_t *dm, int intf_num)
                 }
         } else {
                 /* Old DMI spec. */
-                ipmi_data->base_addr = base_addr;
+                /* Note that technically, the lower bit of the base
+                 * address should be 1 if the address is I/O and 0 if
+                 * the address is in memory.  So many systems get that
+                 * wrong (and all that I have seen are I/O) so we just
+                 * ignore that bit and assume I/O.  Systems that use
+                 * memory should use the newer spec, anyway. */
+                ipmi_data->base_addr = base_addr & 0xfffe;
                 ipmi_data->addr_space = IPMI_IO_ADDR_SPACE;
                 ipmi_data->offset = 1;
         }
@@ -2199,7 +2244,7 @@ static int init_one_smi(int intf_num, struct smi_info **smi)
         /* Wait until we know that we are out of any interrupt
            handlers might have been running before we freed the
            interrupt. */
-        synchronize_kernel();
+        synchronize_sched();
 
         if (new_smi->si_sm) {
                 if (new_smi->handlers)
@@ -2312,7 +2357,7 @@ static void __exit cleanup_one_si(struct smi_info *to_clean)
         /* Wait until we know that we are out of any interrupt
            handlers might have been running before we freed the
            interrupt. */
-        synchronize_kernel();
+        synchronize_sched();
 
         /* Wait for the timer to stop.  This avoids problems with race
            conditions removing the timer here. */
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index fd7093879c66..fcd1c02a32cb 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -709,11 +709,11 @@ static int ipmi_close(struct inode *ino, struct file *filep)
                 if (expect_close == 42) {
                         ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
                         ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
-                        clear_bit(0, &ipmi_wdog_open);
                 } else {
                         printk(KERN_CRIT PFX "Unexpected close, not stopping watchdog!\n");
                         ipmi_heartbeat();
                 }
+                clear_bit(0, &ipmi_wdog_open);
         }
 
         ipmi_fasync (-1, filep, 0);
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index a91ae271cf0a..763893e289b3 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -221,7 +221,7 @@ static int rio_probe_addrs[]= {0xc0000, 0xd0000, 0xe0000};
 /* Set the mask to all-ones. This alas, only supports 32 interrupts. 
    Some architectures may need more. -- Changed to LONG to
    support up to 64 bits on 64bit architectures. -- REW 20/06/99 */
-long rio_irqmask = -1;
+static long rio_irqmask = -1;
 
 MODULE_AUTHOR("Rogier Wolff <R.E.Wolff@bitwizard.nl>, Patrick van de Lageweg <patrick@bitwizard.nl>");
 MODULE_DESCRIPTION("RIO driver");
diff --git a/drivers/char/s3c2410-rtc.c b/drivers/char/s3c2410-rtc.c
index 8e61be34a1d3..ed867db550a9 100644
--- a/drivers/char/s3c2410-rtc.c
+++ b/drivers/char/s3c2410-rtc.c
@@ -116,7 +116,7 @@ static void s3c2410_rtc_setfreq(int freq)
 
 /* Time read/write */
 
-static void s3c2410_rtc_gettime(struct rtc_time *rtc_tm)
+static int s3c2410_rtc_gettime(struct rtc_time *rtc_tm)
 {
         unsigned int have_retried = 0;
 
@@ -151,6 +151,8 @@ static void s3c2410_rtc_gettime(struct rtc_time *rtc_tm)
 
         rtc_tm->tm_year += 100;
         rtc_tm->tm_mon -= 1;
+
+        return 0;
 }
 
 
@@ -171,7 +173,7 @@ static int s3c2410_rtc_settime(struct rtc_time *tm)
         return 0;
 }
 
-static void s3c2410_rtc_getalarm(struct rtc_wkalrm *alrm)
+static int s3c2410_rtc_getalarm(struct rtc_wkalrm *alrm)
 {
         struct rtc_time *alm_tm = &alrm->time;
         unsigned int alm_en;
@@ -231,6 +233,8 @@ static void s3c2410_rtc_getalarm(struct rtc_wkalrm *alrm)
         }
 
         /* todo - set alrm->enabled ? */
+
+        return 0;
 }
 
 static int s3c2410_rtc_setalarm(struct rtc_wkalrm *alrm)
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index c789d5ceac76..50e0b612a8a2 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -1987,10 +1987,9 @@ static inline int sx_set_serial_info(struct specialix_port * port,
 
         func_enter();
         /*
-        error = verify_area(VERIFY_READ, (void *) newinfo, sizeof(tmp));
-        if (error) {
+        if (!access_ok(VERIFY_READ, (void *) newinfo, sizeof(tmp))) {
                 func_exit();
-                return error;
+                return -EFAULT;
         }
         */
         if (copy_from_user(&tmp, newinfo, sizeof(tmp))) {
@@ -2046,14 +2045,12 @@ static inline int sx_get_serial_info(struct specialix_port * port,
 {
         struct serial_struct tmp;
         struct specialix_board *bp = port_Board(port);
-        //      int error;
         
         func_enter();
 
         /*
-        error = verify_area(VERIFY_WRITE, (void *) retinfo, sizeof(tmp));
-        if (error)
-                return error;
+        if (!access_ok(VERIFY_WRITE, (void *) retinfo, sizeof(tmp)))
+                return -EFAULT;
         */
 
         memset(&tmp, 0, sizeof(tmp));
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index de166608c59e..b8899f560b5e 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -466,7 +466,7 @@ static int	stl_parsebrd(stlconf_t *confp, char **argp);
 
 static unsigned long stl_atol(char *str);
 
-int             stl_init(void);
+static int      stl_init(void);
 static int      stl_open(struct tty_struct *tty, struct file *filp);
 static void     stl_close(struct tty_struct *tty, struct file *filp);
 static int      stl_write(struct tty_struct *tty, const unsigned char *buf, int count);
@@ -3063,7 +3063,7 @@ static struct tty_operations stl_ops = {
 
 /*****************************************************************************/
 
-int __init stl_init(void)
+static int __init stl_init(void)
 {
         int i;
         printk(KERN_INFO "%s: version %s\n", stl_drvtitle, stl_drvversion);
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 5d386f4bea49..8971484b956b 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -24,6 +24,7 @@
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/console.h>
+#include <linux/signal.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -641,7 +642,7 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 extern int spawnpid, spawnsig;
                 if (!perm || !capable(CAP_KILL))
                   return -EPERM;
-                if (arg < 1 || arg > _NSIG || arg == SIGKILL)
+                if (!valid_signal(arg) || arg < 1 || arg == SIGKILL)
                   return -EINVAL;
                 spawnpid = current->pid;
                 spawnsig = arg;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b30001f31610..8e561313d094 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -223,7 +223,7 @@ static inline void adjust_jiffies(unsigned long val, struct cpufreq_freqs *ci)
         }
         if ((val == CPUFREQ_PRECHANGE  && ci->old < ci->new) ||
             (val == CPUFREQ_POSTCHANGE && ci->old > ci->new) ||
-            (val == CPUFREQ_RESUMECHANGE)) {
+            (val == CPUFREQ_RESUMECHANGE || val == CPUFREQ_SUSPENDCHANGE)) {
                 loops_per_jiffy = cpufreq_scale(l_p_j_ref, l_p_j_ref_freq, ci->new);
                 dprintk("scaling loops_per_jiffy to %lu for frequency %u kHz\n", loops_per_jiffy, ci->new);
         }
@@ -866,11 +866,90 @@ EXPORT_SYMBOL(cpufreq_get);
 
 
 /**
+ *      cpufreq_suspend - let the low level driver prepare for suspend
+ */
+
+static int cpufreq_suspend(struct sys_device * sysdev, u32 state)
+{
+        int cpu = sysdev->id;
+        unsigned int ret = 0;
+        unsigned int cur_freq = 0;
+        struct cpufreq_policy *cpu_policy;
+
+        dprintk("resuming cpu %u\n", cpu);
+
+        if (!cpu_online(cpu))
+                return 0;
+
+        /* we may be lax here as interrupts are off. Nonetheless
+         * we need to grab the correct cpu policy, as to check
+         * whether we really run on this CPU.
+         */
+
+        cpu_policy = cpufreq_cpu_get(cpu);
+        if (!cpu_policy)
+                return -EINVAL;
+
+        /* only handle each CPU group once */
+        if (unlikely(cpu_policy->cpu != cpu)) {
+                cpufreq_cpu_put(cpu_policy);
+                return 0;
+        }
+
+        if (cpufreq_driver->suspend) {
+                ret = cpufreq_driver->suspend(cpu_policy, state);
+                if (ret) {
+                        printk(KERN_ERR "cpufreq: suspend failed in ->suspend "
+                                        "step on CPU %u\n", cpu_policy->cpu);
+                        cpufreq_cpu_put(cpu_policy);
+                        return ret;
+                }
+        }
+
+
+        if (cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)
+                goto out;
+
+        if (cpufreq_driver->get)
+                cur_freq = cpufreq_driver->get(cpu_policy->cpu);
+
+        if (!cur_freq || !cpu_policy->cur) {
+                printk(KERN_ERR "cpufreq: suspend failed to assert current "
+                       "frequency is what timing core thinks it is.\n");
+                goto out;
+        }
+
+        if (unlikely(cur_freq != cpu_policy->cur)) {
+                struct cpufreq_freqs freqs;
+
+                if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
+                        printk(KERN_DEBUG "Warning: CPU frequency is %u, "
+                               "cpufreq assumed %u kHz.\n",
+                               cur_freq, cpu_policy->cur);
+
+                freqs.cpu = cpu;
+                freqs.old = cpu_policy->cur;
+                freqs.new = cur_freq;
+
+                notifier_call_chain(&cpufreq_transition_notifier_list,
+                                    CPUFREQ_SUSPENDCHANGE, &freqs);
+                adjust_jiffies(CPUFREQ_SUSPENDCHANGE, &freqs);
+
+                cpu_policy->cur = cur_freq;
+        }
+
+ out:
+        cpufreq_cpu_put(cpu_policy);
+        return 0;
+}
+
+/**
  *      cpufreq_resume -  restore proper CPU frequency handling after resume
  *
  *      1.) resume CPUfreq hardware support (cpufreq_driver->resume())
  *      2.) if ->target and !CPUFREQ_CONST_LOOPS: verify we're in sync
- *      3.) schedule call cpufreq_update_policy() ASAP as interrupts are restored.
+ *      3.) schedule call cpufreq_update_policy() ASAP as interrupts are
+ *          restored.
  */
 static int cpufreq_resume(struct sys_device * sysdev)
 {
@@ -915,21 +994,26 @@ static int cpufreq_resume(struct sys_device * sysdev)
                         cur_freq = cpufreq_driver->get(cpu_policy->cpu);
 
                 if (!cur_freq || !cpu_policy->cur) {
-                        printk(KERN_ERR "cpufreq: resume failed to assert current frequency is what timing core thinks it is.\n");
+                        printk(KERN_ERR "cpufreq: resume failed to assert "
+                                        "current frequency is what timing core "
+                                        "thinks it is.\n");
                         goto out;
                 }
 
                 if (unlikely(cur_freq != cpu_policy->cur)) {
                         struct cpufreq_freqs freqs;
 
-                        printk(KERN_WARNING "Warning: CPU frequency is %u, "
-                               "cpufreq assumed %u kHz.\n", cur_freq, cpu_policy->cur);
+                        if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
+                                printk(KERN_WARNING "Warning: CPU frequency"
+                                       "is %u, cpufreq assumed %u kHz.\n",
+                                       cur_freq, cpu_policy->cur);
 
                         freqs.cpu = cpu;
                         freqs.old = cpu_policy->cur;
                         freqs.new = cur_freq;
 
-                        notifier_call_chain(&cpufreq_transition_notifier_list, CPUFREQ_RESUMECHANGE, &freqs);
+                        notifier_call_chain(&cpufreq_transition_notifier_list,
+                                        CPUFREQ_RESUMECHANGE, &freqs);
                         adjust_jiffies(CPUFREQ_RESUMECHANGE, &freqs);
 
                         cpu_policy->cur = cur_freq;
@@ -945,6 +1029,7 @@ out:
 static struct sysdev_driver cpufreq_sysdev_driver = {
         .add            = cpufreq_add_dev,
         .remove         = cpufreq_remove_dev,
+        .suspend        = cpufreq_suspend,
         .resume         = cpufreq_resume,
 };
 
diff --git a/drivers/ide/ppc/pmac.c b/drivers/ide/ppc/pmac.c
index 6dc273a81327..569f16767442 100644
--- a/drivers/ide/ppc/pmac.c
+++ b/drivers/ide/ppc/pmac.c
@@ -1204,6 +1204,8 @@ pmac_ide_do_suspend(ide_hwif_t *hwif)
         }
 #endif /* CONFIG_BLK_DEV_IDE_PMAC_BLINK */
 
+        disable_irq(pmif->irq);
+
         /* The media bay will handle itself just fine */
         if (pmif->mediabay)
                 return 0;
@@ -1236,7 +1238,6 @@ pmac_ide_do_resume(ide_hwif_t *hwif)
                 ppc_md.feature_call(PMAC_FTR_IDE_ENABLE, pmif->node, pmif->aapl_bus_id, 1);
                 msleep(10);
                 ppc_md.feature_call(PMAC_FTR_IDE_RESET, pmif->node, pmif->aapl_bus_id, 0);
-                msleep(jiffies_to_msecs(IDE_WAKEUP_DELAY));
 
                 /* Kauai has it different */
                 if (pmif->kauai_fcr) {
@@ -1244,11 +1245,15 @@ pmac_ide_do_resume(ide_hwif_t *hwif)
                         fcr |= KAUAI_FCR_UATA_RESET_N | KAUAI_FCR_UATA_ENABLE;
                         writel(fcr, pmif->kauai_fcr);
                 }
+
+                msleep(jiffies_to_msecs(IDE_WAKEUP_DELAY));
         }
 
         /* Sanitize drive timings */
         sanitize_timings(pmif);
 
+        enable_irq(pmif->irq);
+
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 986f2180404b..637b30e35592 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -32,10 +32,11 @@
  * $Id$
  */
 
+#include <linux/mm.h>
+
 #include "mthca_memfree.h"
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
-#include <linux/mm.h>
 
 /*
  * We allocate in as big chunks as we can, up to a maximum of 256 KB
diff --git a/drivers/input/joystick/spaceorb.c b/drivers/input/joystick/spaceorb.c
index c76cf8ff29c0..874367bfab08 100644
--- a/drivers/input/joystick/spaceorb.c
+++ b/drivers/input/joystick/spaceorb.c
@@ -116,7 +116,7 @@ static void spaceorb_process_packet(struct spaceorb *spaceorb, struct pt_regs *r
 
                 case 'K':                               /* Button data */
                         if (spaceorb->idx != 5) return;
-                        for (i = 0; i < 7; i++)
+                        for (i = 0; i < 6; i++)
                                 input_report_key(dev, spaceorb_buttons[i], (data[2] >> i) & 1);
 
                         break;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index f7304f0ce542..ff66ed4ee2cd 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -678,7 +678,7 @@ static void atkbd_disconnect(struct serio *serio)
         atkbd_disable(atkbd);
 
         /* make sure we don't have a command in flight */
-        synchronize_kernel();
+        synchronize_sched();  /* Allow atkbd_interrupt()s to complete. */
         flush_scheduled_work();
 
         device_remove_file(&serio->dev, &atkbd_attr_extra);
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 06163538bb20..12dee8e9fbbe 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -60,12 +60,12 @@ MODULE_LICENSE("GPL");
 
 static struct class_simple *capi_class;
 
-int capi_major = 68;            /* allocated */
+static int capi_major = 68;             /* allocated */
 #ifdef CONFIG_ISDN_CAPI_MIDDLEWARE
 #define CAPINC_NR_PORTS 32
 #define CAPINC_MAX_PORTS        256
-int capi_ttymajor = 191;
-int capi_ttyminors = CAPINC_NR_PORTS;
+static int capi_ttymajor = 191;
+static int capi_ttyminors = CAPINC_NR_PORTS;
 #endif /* CONFIG_ISDN_CAPI_MIDDLEWARE */
 
 module_param_named(major, capi_major, uint, 0);
@@ -268,7 +268,7 @@ static void capiminor_free(struct capiminor *mp)
         kfree(mp);
 }
 
-struct capiminor *capiminor_find(unsigned int minor)
+static struct capiminor *capiminor_find(unsigned int minor)
 {
         struct list_head *l;
         struct capiminor *p = NULL;
@@ -1166,7 +1166,7 @@ static int capinc_tty_write_room(struct tty_struct *tty)
         return room;
 }
 
-int capinc_tty_chars_in_buffer(struct tty_struct *tty)
+static int capinc_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct capiminor *mp = (struct capiminor *)tty->driver_data;
         if (!mp || !mp->nccip) {
diff --git a/drivers/isdn/capi/kcapi_proc.c b/drivers/isdn/capi/kcapi_proc.c
index 16dc5418ff41..2cc8b27e4c3b 100644
--- a/drivers/isdn/capi/kcapi_proc.c
+++ b/drivers/isdn/capi/kcapi_proc.c
@@ -89,14 +89,14 @@ static int contrstats_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-struct seq_operations seq_controller_ops = {
+static struct seq_operations seq_controller_ops = {
         .start  = controller_start,
         .next   = controller_next,
         .stop   = controller_stop,
         .show   = controller_show,
 };
 
-struct seq_operations seq_contrstats_ops = {
+static struct seq_operations seq_contrstats_ops = {
         .start  = controller_start,
         .next   = controller_next,
         .stop   = controller_stop,
@@ -192,14 +192,14 @@ applstats_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-struct seq_operations seq_applications_ops = {
+static struct seq_operations seq_applications_ops = {
         .start  = applications_start,
         .next   = applications_next,
         .stop   = applications_stop,
         .show   = applications_show,
 };
 
-struct seq_operations seq_applstats_ops = {
+static struct seq_operations seq_applstats_ops = {
         .start  = applications_start,
         .next   = applications_next,
         .stop   = applications_stop,
@@ -287,7 +287,7 @@ static int capi_driver_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-struct seq_operations seq_capi_driver_ops = {
+static struct seq_operations seq_capi_driver_ops = {
         .start  = capi_driver_start,
         .next   = capi_driver_next,
         .stop   = capi_driver_stop,
diff --git a/drivers/isdn/divert/isdn_divert.c b/drivers/isdn/divert/isdn_divert.c
index 1eb112213f0c..0bfd698726a6 100644
--- a/drivers/isdn/divert/isdn_divert.c
+++ b/drivers/isdn/divert/isdn_divert.c
@@ -383,7 +383,7 @@ divert_rule *getruleptr(int idx)
 /*************************************************/
 /* called from common module on an incoming call */
 /*************************************************/
-int isdn_divert_icall(isdn_ctrl *ic)
+static int isdn_divert_icall(isdn_ctrl *ic)
 { int retval = 0;
   unsigned long flags;
   struct call_struc *cs = NULL; 
@@ -552,7 +552,7 @@ void deleteprocs(void)
 /****************************************************/
 /* put a address including address type into buffer */
 /****************************************************/
-int put_address(char *st, u_char *p, int len)
+static int put_address(char *st, u_char *p, int len)
 { u_char retval = 0;
   u_char adr_typ = 0; /* network standard */
 
@@ -595,7 +595,7 @@ int put_address(char *st, u_char *p, int len)
 /*************************************/
 /* report a succesfull interrogation */
 /*************************************/
-int interrogate_success(isdn_ctrl *ic, struct call_struc *cs)
+static int interrogate_success(isdn_ctrl *ic, struct call_struc *cs)
 { char *src = ic->parm.dss1_io.data;
   int restlen = ic->parm.dss1_io.datalen;
   int cnt = 1;
@@ -689,7 +689,7 @@ int interrogate_success(isdn_ctrl *ic, struct call_struc *cs)
 /*********************************************/
 /* callback for protocol specific extensions */
 /*********************************************/
-int prot_stat_callback(isdn_ctrl *ic)
+static int prot_stat_callback(isdn_ctrl *ic)
 { struct call_struc *cs, *cs1;
   int i;
   unsigned long flags;
@@ -781,7 +781,7 @@ int prot_stat_callback(isdn_ctrl *ic)
 /***************************/
 /* status callback from HL */
 /***************************/
-int isdn_divert_stat_callback(isdn_ctrl *ic)
+static int isdn_divert_stat_callback(isdn_ctrl *ic)
 { struct call_struc *cs, *cs1;
   unsigned long flags;
   int retval;
diff --git a/drivers/macintosh/adbhid.c b/drivers/macintosh/adbhid.c
index 8f93d01d8928..db654e8bd67e 100644
--- a/drivers/macintosh/adbhid.c
+++ b/drivers/macintosh/adbhid.c
@@ -555,6 +555,42 @@ adbhid_buttons_input(unsigned char *data, int nb, struct pt_regs *regs, int auto
 #endif /* CONFIG_PMAC_BACKLIGHT */
                         input_report_key(&adbhid[id]->input, KEY_BRIGHTNESSUP, down);
                         break;
+
+                case 0xc:       /* videomode switch */
+                        input_report_key(&adbhid[id]->input, KEY_SWITCHVIDEOMODE, down);
+                        break;
+
+                case 0xd:       /* keyboard illumination toggle */
+                        input_report_key(&adbhid[id]->input, KEY_KBDILLUMTOGGLE, down);
+                        break;
+
+                case 0xe:       /* keyboard illumination decrease */
+                        input_report_key(&adbhid[id]->input, KEY_KBDILLUMDOWN, down);
+                        break;
+
+                case 0xf:
+                        switch (data[1]) {
+                        case 0x8f:
+                        case 0x0f:
+                                /* keyboard illumination increase */
+                                input_report_key(&adbhid[id]->input, KEY_KBDILLUMUP, down);
+                                break;
+
+                        case 0x7f:
+                        case 0xff:
+                                /* keypad overlay toogle */
+                                break;
+
+                        default:
+                                printk(KERN_INFO "Unhandled ADB_MISC event %02x, %02x, %02x, %02x\n",
+                                       data[0], data[1], data[2], data[3]);
+                                break;
+                        }
+                        break;
+                default:
+                        printk(KERN_INFO "Unhandled ADB_MISC event %02x, %02x, %02x, %02x\n",
+                               data[0], data[1], data[2], data[3]);
+                        break;
                 }
           }
           break;
@@ -775,6 +811,10 @@ adbhid_input_register(int id, int default_id, int original_handler_id,
                         set_bit(KEY_BRIGHTNESSUP, adbhid[id]->input.keybit);
                         set_bit(KEY_BRIGHTNESSDOWN, adbhid[id]->input.keybit);
                         set_bit(KEY_EJECTCD, adbhid[id]->input.keybit);
+                        set_bit(KEY_SWITCHVIDEOMODE, adbhid[id]->input.keybit);
+                        set_bit(KEY_KBDILLUMTOGGLE, adbhid[id]->input.keybit);
+                        set_bit(KEY_KBDILLUMDOWN, adbhid[id]->input.keybit);
+                        set_bit(KEY_KBDILLUMUP, adbhid[id]->input.keybit);
                         break;
                 }
                 if (adbhid[id]->name[0])
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index fdea1a3a631d..e654aa5eecd4 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -2351,6 +2351,10 @@ pmac_suspend_devices(void)
                 return -EBUSY;
         }
 
+        /* Disable clock spreading on some machines */
+        pmac_tweak_clock_spreading(0);
+
+        /* Stop preemption */
         preempt_disable();
 
         /* Make sure the decrementer won't interrupt us */
@@ -2417,11 +2421,12 @@ pmac_wakeup_devices(void)
 
         /* Re-enable local CPU interrupts */
         local_irq_enable();
-
         mdelay(100);
-
         preempt_enable();
 
+        /* Re-enable clock spreading on some machines */
+        pmac_tweak_clock_spreading(1);
+
         /* Resume devices */
         device_resume();
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 77619a56e2bf..0dd6c2b5391b 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -331,25 +331,19 @@ crypt_alloc_buffer(struct crypt_config *cc, unsigned int size,
         struct bio *bio;
         unsigned int nr_iovecs = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
         int gfp_mask = GFP_NOIO | __GFP_HIGHMEM;
-        unsigned long flags = current->flags;
         unsigned int i;
 
         /*
-         * Tell VM to act less aggressively and fail earlier.
-         * This is not necessary but increases throughput.
+         * Use __GFP_NOMEMALLOC to tell the VM to act less aggressively and
+         * to fail earlier.  This is not necessary but increases throughput.
          * FIXME: Is this really intelligent?
          */
-        current->flags &= ~PF_MEMALLOC;
-
         if (base_bio)
-                bio = bio_clone(base_bio, GFP_NOIO);
+                bio = bio_clone(base_bio, GFP_NOIO|__GFP_NOMEMALLOC);
         else
-                bio = bio_alloc(GFP_NOIO, nr_iovecs);
-        if (!bio) {
-                if (flags & PF_MEMALLOC)
-                        current->flags |= PF_MEMALLOC;
+                bio = bio_alloc(GFP_NOIO|__GFP_NOMEMALLOC, nr_iovecs);
+        if (!bio)
                 return NULL;
-        }
 
         /* if the last bio was not complete, continue where that one ended */
         bio->bi_idx = *bio_vec_idx;
@@ -386,9 +380,6 @@ crypt_alloc_buffer(struct crypt_config *cc, unsigned int size,
                 size -= bv->bv_len;
         }
 
-        if (flags & PF_MEMALLOC)
-                current->flags |= PF_MEMALLOC;
-
         if (!bio->bi_size) {
                 bio_put(bio);
                 return NULL;
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index c9b134cd1532..1891e4930dcc 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -355,7 +355,7 @@ static int multipath_remove_disk(mddev_t *mddev, int number)
                         goto abort;
                 }
                 p->rdev = NULL;
-                synchronize_kernel();
+                synchronize_rcu();
                 if (atomic_read(&rdev->nr_pending)) {
                         /* lost the race, try later */
                         err = -EBUSY;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a389394b52f6..83380b5d6593 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -797,7 +797,7 @@ static int raid1_remove_disk(mddev_t *mddev, int number)
                         goto abort;
                 }
                 p->rdev = NULL;
-                synchronize_kernel();
+                synchronize_rcu();
                 if (atomic_read(&rdev->nr_pending)) {
                         /* lost the race, try later */
                         err = -EBUSY;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index b100bfe4fdca..e9dc2876a626 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -977,7 +977,7 @@ static int raid10_remove_disk(mddev_t *mddev, int number)
                         goto abort;
                 }
                 p->rdev = NULL;
-                synchronize_kernel();
+                synchronize_rcu();
                 if (atomic_read(&rdev->nr_pending)) {
                         /* lost the race, try later */
                         err = -EBUSY;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 52c3a81c4aa7..e96e2a10a9c9 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1873,7 +1873,7 @@ static int raid5_remove_disk(mddev_t *mddev, int number)
                         goto abort;
                 }
                 p->rdev = NULL;
-                synchronize_kernel();
+                synchronize_rcu();
                 if (atomic_read(&rdev->nr_pending)) {
                         /* lost the race, try later */
                         err = -EBUSY;
diff --git a/drivers/md/raid6main.c b/drivers/md/raid6main.c
index 7e30ab29691a..8a33f351e092 100644
--- a/drivers/md/raid6main.c
+++ b/drivers/md/raid6main.c
@@ -2038,7 +2038,7 @@ static int raid6_remove_disk(mddev_t *mddev, int number)
                         goto abort;
                 }
                 p->rdev = NULL;
-                synchronize_kernel();
+                synchronize_rcu();
                 if (atomic_read(&rdev->nr_pending)) {
                         /* lost the race, try later */
                         err = -EBUSY;
diff --git a/drivers/media/common/ir-common.c b/drivers/media/common/ir-common.c
index 8c842e2f59a2..84a49d2ec919 100644
--- a/drivers/media/common/ir-common.c
+++ b/drivers/media/common/ir-common.c
@@ -131,10 +131,10 @@ IR_KEYTAB_TYPE ir_codes_winfast[IR_KEYTAB_SIZE] = {
         [ 18 ] = KEY_KP0,
 
         [  0 ] = KEY_POWER,
-//      [ 27 ] = MTS button
+        [ 27 ] = KEY_LANGUAGE,  //MTS button
         [  2 ] = KEY_TUNER,     // TV/FM
         [ 30 ] = KEY_VIDEO,
-//      [ 22 ] = display button
+        [ 22 ] = KEY_INFO,      //display button
         [  4 ] = KEY_VOLUMEUP,
         [  8 ] = KEY_VOLUMEDOWN,
         [ 12 ] = KEY_CHANNELUP,
@@ -142,7 +142,7 @@ IR_KEYTAB_TYPE ir_codes_winfast[IR_KEYTAB_SIZE] = {
         [  3 ] = KEY_ZOOM,      // fullscreen
         [ 31 ] = KEY_SUBTITLE,  // closed caption/teletext
         [ 32 ] = KEY_SLEEP,
-//      [ 41 ] = boss key
+        [ 41 ] = KEY_SEARCH,    //boss key
         [ 20 ] = KEY_MUTE,
         [ 43 ] = KEY_RED,
         [ 44 ] = KEY_GREEN,
@@ -150,17 +150,17 @@ IR_KEYTAB_TYPE ir_codes_winfast[IR_KEYTAB_SIZE] = {
         [ 46 ] = KEY_BLUE,
         [ 24 ] = KEY_KPPLUS,    //fine tune +
         [ 25 ] = KEY_KPMINUS,   //fine tune -
-//      [ 42 ] = picture in picture
-        [ 33 ] = KEY_KPDOT,
+        [ 42 ] = KEY_ANGLE,     //picture in picture
+        [ 33 ] = KEY_KPDOT,
         [ 19 ] = KEY_KPENTER,
-//      [ 17 ] = recall
+        [ 17 ] = KEY_AGAIN,     //recall
         [ 34 ] = KEY_BACK,
         [ 35 ] = KEY_PLAYPAUSE,
         [ 36 ] = KEY_NEXT,
-//      [ 37 ] = time shifting
+        [ 37 ] = KEY_T,         //time shifting
         [ 38 ] = KEY_STOP,
-        [ 39 ] = KEY_RECORD
-//      [ 40 ] = snapshot
+        [ 39 ] = KEY_RECORD,
+        [ 40 ] = KEY_SHUFFLE    //snapshot
 };
 EXPORT_SYMBOL_GPL(ir_codes_winfast);
 
diff --git a/drivers/media/dvb/frontends/cx22702.c b/drivers/media/dvb/frontends/cx22702.c
index 1930b513eefa..011860ce36cc 100644
--- a/drivers/media/dvb/frontends/cx22702.c
+++ b/drivers/media/dvb/frontends/cx22702.c
@@ -32,6 +32,7 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include "dvb_frontend.h"
+#include "dvb-pll.h"
 #include "cx22702.h"
 
 
@@ -203,7 +204,19 @@ static int cx22702_set_tps (struct dvb_frontend* fe, struct dvb_frontend_paramet
 
         /* set PLL */
         cx22702_writereg (state, 0x0D, cx22702_readreg(state,0x0D) &0xfe);
-        state->config->pll_set(fe, p);
+        if (state->config->pll_set) {
+                state->config->pll_set(fe, p);
+        } else if (state->config->pll_desc) {
+                u8 pllbuf[4];
+                struct i2c_msg msg = { .addr = state->config->pll_address,
+                                       .buf = pllbuf, .len = 4 };
+                dvb_pll_configure(state->config->pll_desc, pllbuf,
+                                  p->frequency,
+                                  p->u.ofdm.bandwidth);
+                i2c_transfer(state->i2c, &msg, 1);
+        } else {
+                BUG();
+        }
         cx22702_writereg (state, 0x0D, cx22702_readreg(state,0x0D) | 1);
 
         /* set inversion */
diff --git a/drivers/media/dvb/frontends/cx22702.h b/drivers/media/dvb/frontends/cx22702.h
index 6e34f997aba2..559fdb906669 100644
--- a/drivers/media/dvb/frontends/cx22702.h
+++ b/drivers/media/dvb/frontends/cx22702.h
@@ -36,6 +36,9 @@ struct cx22702_config
         u8 demod_address;
 
         /* PLL maintenance */
+        u8 pll_address;
+        struct dvb_pll_desc *pll_desc;
+
         int (*pll_init)(struct dvb_frontend* fe);
         int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params);
 };
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index c1b3542dad88..d3dd4228b72d 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -252,6 +252,7 @@ config VIDEO_SAA7134_DVB
         depends on VIDEO_SAA7134 && DVB_CORE
         select VIDEO_BUF_DVB
         select DVB_MT352
+        select DVB_CX22702
         ---help---
           This adds support for DVB cards based on the
           Philips saa7134 chip.
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c
index c13f222fe6bd..033cc5498f23 100644
--- a/drivers/media/video/bttv-driver.c
+++ b/drivers/media/video/bttv-driver.c
@@ -3169,7 +3169,7 @@ static struct video_device radio_template =
 /* ----------------------------------------------------------------------- */
 /* some debug code                                                         */
 
-int bttv_risc_decode(u32 risc)
+static int bttv_risc_decode(u32 risc)
 {
         static char *instr[16] = {
                 [ BT848_RISC_WRITE     >> 28 ] = "write",
@@ -3206,8 +3206,8 @@ int bttv_risc_decode(u32 risc)
         return incr[risc >> 28] ? incr[risc >> 28] : 1;
 }
 
-void bttv_risc_disasm(struct bttv *btv,
-                      struct btcx_riscmem *risc)
+static void bttv_risc_disasm(struct bttv *btv,
+                             struct btcx_riscmem *risc)
 {
         unsigned int i,j,n;
 
diff --git a/drivers/media/video/cx88/cx88-core.c b/drivers/media/video/cx88/cx88-core.c
index 26a6138015cb..1ff79b5a8835 100644
--- a/drivers/media/video/cx88/cx88-core.c
+++ b/drivers/media/video/cx88/cx88-core.c
@@ -429,7 +429,7 @@ int cx88_sram_channel_setup(struct cx88_core *core,
 /* ------------------------------------------------------------------ */
 /* debug helper code                                                  */
 
-int cx88_risc_decode(u32 risc)
+static int cx88_risc_decode(u32 risc)
 {
         static char *instr[16] = {
                 [ RISC_SYNC    >> 28 ] = "sync",
@@ -542,7 +542,7 @@ void cx88_sram_channel_dump(struct cx88_core *core,
                core->name,cx_read(ch->cnt2_reg));
 }
 
-char *cx88_pci_irqs[32] = {
+static char *cx88_pci_irqs[32] = {
         "vid", "aud", "ts", "vip", "hst", "5", "6", "tm1",
         "src_dma", "dst_dma", "risc_rd_err", "risc_wr_err",
         "brdg_err", "src_dma_err", "dst_dma_err", "ipb_dma_err",
@@ -1206,7 +1206,6 @@ void cx88_core_put(struct cx88_core *core, struct pci_dev *pci)
 /* ------------------------------------------------------------------ */
 
 EXPORT_SYMBOL(cx88_print_ioctl);
-EXPORT_SYMBOL(cx88_pci_irqs);
 EXPORT_SYMBOL(cx88_vid_irqs);
 EXPORT_SYMBOL(cx88_mpeg_irqs);
 EXPORT_SYMBOL(cx88_print_irqbits);
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index bc6f18c45357..9d15d3d5a2b7 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -31,7 +31,7 @@
 #include <linux/suspend.h>
 
 /* those two frontends need merging via linuxtv cvs ... */
-#define HAVE_CX22702 0
+#define HAVE_CX22702 1
 #define HAVE_OR51132 1
 
 #include "cx88.h"
@@ -91,7 +91,7 @@ static void dvb_buf_release(struct videobuf_queue *q, struct videobuf_buffer *vb
         cx88_free_buffer(dev->pci, (struct cx88_buffer*)vb);
 }
 
-struct videobuf_queue_ops dvb_qops = {
+static struct videobuf_queue_ops dvb_qops = {
         .buf_setup    = dvb_buf_setup,
         .buf_prepare  = dvb_buf_prepare,
         .buf_queue    = dvb_buf_queue,
@@ -191,7 +191,7 @@ static int or51132_set_ts_param(struct dvb_frontend* fe,
         return 0;
 }
 
-struct or51132_config pchdtv_hd3000 = {
+static struct or51132_config pchdtv_hd3000 = {
         .demod_address    = 0x15,
         .pll_address      = 0x61,
         .pll_desc         = &dvb_pll_thomson_dtt7610,
@@ -243,10 +243,8 @@ static int dvb_register(struct cx8802_dev *dev)
                 break;
 #endif
         default:
-                printk("%s: The frontend of your DVB/ATSC card isn't supported yet\n"
-                       "%s: you might want to look out for patches here:\n"
-                       "%s:     http://dl.bytesex.org/patches/\n",
-                       dev->core->name, dev->core->name, dev->core->name);
+                printk("%s: The frontend of your DVB/ATSC card isn't supported yet\n",
+                       dev->core->name);
                 break;
         }
         if (NULL == dev->dvb.frontend) {
@@ -308,9 +306,11 @@ static int __devinit dvb_probe(struct pci_dev *pci_dev,
                             dev);
         err = dvb_register(dev);
         if (0 != err)
-                goto fail_free;
+                goto fail_fini;
         return 0;
 
+ fail_fini:
+        cx8802_fini_common(dev);
  fail_free:
         kfree(dev);
  fail_core:
diff --git a/drivers/media/video/cx88/cx88-i2c.c b/drivers/media/video/cx88/cx88-i2c.c
index 60800172c026..0725b1288f4f 100644
--- a/drivers/media/video/cx88/cx88-i2c.c
+++ b/drivers/media/video/cx88/cx88-i2c.c
@@ -45,7 +45,7 @@ MODULE_PARM_DESC(i2c_scan,"scan i2c bus at insmod time");
 
 /* ----------------------------------------------------------------------- */
 
-void cx8800_bit_setscl(void *data, int state)
+static void cx8800_bit_setscl(void *data, int state)
 {
         struct cx88_core *core = data;
 
@@ -57,7 +57,7 @@ void cx8800_bit_setscl(void *data, int state)
         cx_read(MO_I2C);
 }
 
-void cx8800_bit_setsda(void *data, int state)
+static void cx8800_bit_setsda(void *data, int state)
 {
         struct cx88_core *core = data;
 
diff --git a/drivers/media/video/cx88/cx88-vbi.c b/drivers/media/video/cx88/cx88-vbi.c
index 471e508b0746..0584ff476387 100644
--- a/drivers/media/video/cx88/cx88-vbi.c
+++ b/drivers/media/video/cx88/cx88-vbi.c
@@ -46,9 +46,9 @@ void cx8800_vbi_fmt(struct cx8800_dev *dev, struct v4l2_format *f)
         }
 }
 
-int cx8800_start_vbi_dma(struct cx8800_dev    *dev,
-                         struct cx88_dmaqueue *q,
-                         struct cx88_buffer   *buf)
+static int cx8800_start_vbi_dma(struct cx8800_dev    *dev,
+                                struct cx88_dmaqueue *q,
+                                struct cx88_buffer   *buf)
 {
         struct cx88_core *core = dev->core;
 
diff --git a/drivers/media/video/cx88/cx88-video.c b/drivers/media/video/cx88/cx88-video.c
index 701f594e1816..d1f5c92f0ce5 100644
--- a/drivers/media/video/cx88/cx88-video.c
+++ b/drivers/media/video/cx88/cx88-video.c
@@ -325,7 +325,7 @@ static struct cx88_ctrl cx8800_ctls[] = {
                 .shift                 = 0,
         }
 };
-const int CX8800_CTLS = ARRAY_SIZE(cx8800_ctls);
+static const int CX8800_CTLS = ARRAY_SIZE(cx8800_ctls);
 
 /* ------------------------------------------------------------------- */
 /* resource management                                                 */
@@ -665,7 +665,7 @@ static void buffer_release(struct videobuf_queue *q, struct videobuf_buffer *vb)
         cx88_free_buffer(fh->dev->pci,buf);
 }
 
-struct videobuf_queue_ops cx8800_video_qops = {
+static struct videobuf_queue_ops cx8800_video_qops = {
         .buf_setup    = buffer_setup,
         .buf_prepare  = buffer_prepare,
         .buf_queue    = buffer_queue,
@@ -1924,7 +1924,7 @@ static struct file_operations video_fops =
         .llseek        = no_llseek,
 };
 
-struct video_device cx8800_video_template =
+static struct video_device cx8800_video_template =
 {
         .name          = "cx8800-video",
         .type          = VID_TYPE_CAPTURE|VID_TYPE_TUNER|VID_TYPE_SCALES,
@@ -1933,7 +1933,7 @@ struct video_device cx8800_video_template =
         .minor         = -1,
 };
 
-struct video_device cx8800_vbi_template =
+static struct video_device cx8800_vbi_template =
 {
         .name          = "cx8800-vbi",
         .type          = VID_TYPE_TELETEXT|VID_TYPE_TUNER,
@@ -1951,7 +1951,7 @@ static struct file_operations radio_fops =
         .llseek        = no_llseek,
 };
 
-struct video_device cx8800_radio_template =
+static struct video_device cx8800_radio_template =
 {
         .name          = "cx8800-radio",
         .type          = VID_TYPE_TUNER,
@@ -2226,7 +2226,7 @@ static int cx8800_resume(struct pci_dev *pci_dev)
 
 /* ----------------------------------------------------------- */
 
-struct pci_device_id cx8800_pci_tbl[] = {
+static struct pci_device_id cx8800_pci_tbl[] = {
         {
                 .vendor       = 0x14f1,
                 .device       = 0x8800,
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index b351d9eae615..88eaaaba5ad8 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -420,7 +420,6 @@ struct cx8802_dev {
 /* ----------------------------------------------------------- */
 /* cx88-core.c                                                 */
 
-extern char *cx88_pci_irqs[32];
 extern char *cx88_vid_irqs[32];
 extern char *cx88_mpeg_irqs[32];
 extern void cx88_print_irqbits(char *name, char *tag, char **strings,
@@ -472,9 +471,6 @@ extern void cx88_core_put(struct cx88_core *core,
 /* cx88-vbi.c                                                  */
 
 void cx8800_vbi_fmt(struct cx8800_dev *dev, struct v4l2_format *f);
-int cx8800_start_vbi_dma(struct cx8800_dev    *dev,
-                         struct cx88_dmaqueue *q,
-                         struct cx88_buffer   *buf);
 int cx8800_stop_vbi_dma(struct cx8800_dev *dev);
 int cx8800_restart_vbi_queue(struct cx8800_dev    *dev,
                              struct cx88_dmaqueue *q);
diff --git a/drivers/media/video/msp3400.c b/drivers/media/video/msp3400.c
index c97df705df5e..7fbb8581a87d 100644
--- a/drivers/media/video/msp3400.c
+++ b/drivers/media/video/msp3400.c
@@ -380,7 +380,9 @@ static void msp3400c_setvolume(struct i2c_client *client,
         int val = 0, bal = 0;
 
         if (!muted) {
-                val = (volume * 0x7F / 65535) << 8;
+                /* 0x7f instead if 0x73 here has sound quality issues,
+                 * probably due to overmodulation + clipping ... */
+                val = (volume * 0x73 / 65535) << 8;
         }
         if (val) {
                 bal = (balance / 256) - 128;
@@ -997,7 +999,13 @@ static int msp34xx_modus(int norm)
 {
         switch (norm) {
         case VIDEO_MODE_PAL:
+#if 1
+                /* experimental: not sure this works with all chip versions */
+                return 0x7003;
+#else
+                /* previous value, try this if it breaks ... */
                 return 0x1003;
+#endif
         case VIDEO_MODE_NTSC:  /* BTSC */
                 return 0x2003;
         case VIDEO_MODE_SECAM:
@@ -1264,6 +1272,7 @@ static int msp34xxg_thread(void *data)
         int val, std, i;
 
         printk("msp34xxg: daemon started\n");
+        msp->source = 1; /* default */
         for (;;) {
                 d2printk(KERN_DEBUG "msp34xxg: thread: sleep\n");
                 msp34xx_sleep(msp,-1);
@@ -1334,8 +1343,9 @@ static void msp34xxg_set_source(struct i2c_client *client, int source)
 
         /* fix matrix mode to stereo and let the msp choose what
          * to output according to 'source', as recommended
+         * for MONO (source==0) downmixing set bit[7:0] to 0x30
          */
-        int value = (source&0x07)<<8|(source==0 ? 0x00:0x20);
+        int value = (source&0x07)<<8|(source==0 ? 0x30:0x20);
         dprintk("msp34xxg: set source to %d (0x%x)\n", source, value);
         msp3400c_write(client,
                        I2C_MSP3400C_DFP,
@@ -1359,7 +1369,7 @@ static void msp34xxg_set_source(struct i2c_client *client, int source)
         msp3400c_write(client,
                        I2C_MSP3400C_DEM,
                        0x22, /* a2 threshold for stereo/bilingual */
-                       source==0 ? 0x7f0:stereo_threshold);
+                       stereo_threshold);
         msp->source=source;
 }
 
@@ -1394,7 +1404,7 @@ static void msp34xxg_detect_stereo(struct i2c_client *client)
 static void msp34xxg_set_audmode(struct i2c_client *client, int audmode)
 {
         struct msp3400c *msp = i2c_get_clientdata(client);
-        int source = 0;
+        int source;
 
         switch (audmode) {
         case V4L2_TUNER_MODE_MONO:
@@ -1410,9 +1420,10 @@ static void msp34xxg_set_audmode(struct i2c_client *client, int audmode)
         case V4L2_TUNER_MODE_LANG2:
                 source=4; /* stereo or B */
                 break;
-        default: /* doing nothing: a safe, sane default */
+        default:
                 audmode = 0;
-                return;
+                source  = 1;
+                break;
         }
         msp->audmode = audmode;
         msp34xxg_set_source(client, source);
@@ -1514,12 +1525,9 @@ static int msp_attach(struct i2c_adapter *adap, int addr, int kind)
 
         msp->opmode = opmode;
         if (OPMODE_AUTO == msp->opmode) {
-#if 0 /* seems to work for ivtv only, disable by default for now ... */
                 if (HAVE_SIMPLER(msp))
                         msp->opmode = OPMODE_SIMPLER;
-                else
-#endif
-                if (HAVE_SIMPLE(msp))
+                else if (HAVE_SIMPLE(msp))
                         msp->opmode = OPMODE_SIMPLE;
                 else
                         msp->opmode = OPMODE_MANUAL;
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 180d3175ea5b..c51eb7f078d3 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -183,12 +183,12 @@ struct saa7134_board saa7134_boards[] = {
                 .name           = "LifeView FlyTV Platinum FM",
                 .audio_clock    = 0x00200000,
                 .tuner_type     = TUNER_PHILIPS_TDA8290,
-//              .gpiomask       = 0xe000,
+                .gpiomask       = 0x1E000,      /* Set GP16 and unused 15,14,13 to Output */
                 .inputs         = {{
                         .name = name_tv,
                         .vmux = 1,
                         .amux = TV,
-//                      .gpio = 0x0000,
+                        .gpio = 0x10000,        /* GP16=1 selects TV input */
                         .tv   = 1,
                 },{
 /*                      .name = name_tv_mono,
@@ -212,12 +212,12 @@ struct saa7134_board saa7134_boards[] = {
                         .amux = LINE2,
 //                      .gpio = 0x4000,
                 }},
-/*              .radio = {
+                .radio = {
                         .name = name_radio,
-                        .amux = LINE2,
-                        .gpio = 0x2000,
+                        .amux = TV,
+                        .gpio = 0x00000,        /* GP16=0 selects FM radio antenna */
                 },
-*/      },
+        },
         [SAA7134_BOARD_EMPRESS] = {
                 /* "Gert Vervoort" <gert.vervoort@philips.com> */
                 .name           = "EMPRESS",
@@ -1628,11 +1628,17 @@ struct pci_device_id saa7134_pci_tbl[] = {
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
-                .subvendor    = 0x5168,
+                .subvendor    = 0x5168, /* Animation Technologies (LifeView) */
                 .subdevice    = 0x0214, /* Standard PCI, LR214WF */
                 .driver_data  = SAA7134_BOARD_FLYTVPLATINUM_FM,
         },{
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
+                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
+                .subvendor    = 0x1489, /* KYE */
+                .subdevice    = 0x0214, /* Genius VideoWonder ProTV */
+                .driver_data  = SAA7134_BOARD_FLYTVPLATINUM_FM, /* is an LR214WF actually */
+        },{
+                .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7134,
                 .subvendor    = 0x16be,
                 .subdevice    = 0x0003,
@@ -1948,6 +1954,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                 dev->has_remote = 1;
                 board_flyvideo(dev);
                 break;
+        case SAA7134_BOARD_FLYTVPLATINUM_FM:
         case SAA7134_BOARD_CINERGY400:
         case SAA7134_BOARD_CINERGY600:
         case SAA7134_BOARD_CINERGY600_MK3:
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index dd4a6c8ee65f..c2873ae029f9 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -172,7 +172,7 @@ static int fe_request_firmware(struct dvb_frontend* fe,
         return request_firmware(fw, name, &dev->pci->dev);
 }
 
-struct tda1004x_config medion_cardbus = {
+static struct tda1004x_config medion_cardbus = {
         .demod_address = 0x08,  /* not sure this is correct */
         .invert        = 0,
         .invert_oclk   = 0,
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index 727d437e07df..ca50cf531f20 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -379,6 +379,7 @@ int saa7134_input_init1(struct saa7134_dev *dev)
         switch (dev->board) {
         case SAA7134_BOARD_FLYVIDEO2000:
         case SAA7134_BOARD_FLYVIDEO3000:
+        case SAA7134_BOARD_FLYTVPLATINUM_FM:
                 ir_codes     = flyvideo_codes;
                 mask_keycode = 0xEC00000;
                 mask_keydown = 0x0040000;
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index 065eb4007b1d..80dc34f18c2c 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -991,7 +991,7 @@ static int tda9874a_initialize(struct CHIPSTATE *chip)
 {
         if (tda9874a_SIF > 2)
                 tda9874a_SIF = 1;
-        if (tda9874a_STD >= 8)
+        if (tda9874a_STD > 8)
                 tda9874a_STD = 0;
         if(tda9874a_AMSEL > 1)
                 tda9874a_AMSEL = 0;
diff --git a/drivers/net/gt96100eth.h b/drivers/net/gt96100eth.h
index 2f4bfd4dacbe..395869c5ed3e 100644
--- a/drivers/net/gt96100eth.h
+++ b/drivers/net/gt96100eth.h
@@ -214,7 +214,7 @@ typedef struct {
         u32 cmdstat;
         u32 next;
         u32 buff_ptr;
-} gt96100_td_t __attribute__ ((packed));
+} __attribute__ ((packed)) gt96100_td_t;
 
 typedef struct {
 #ifdef DESC_BE
@@ -227,7 +227,7 @@ typedef struct {
         u32 cmdstat;
         u32 next;
         u32 buff_ptr;
-} gt96100_rd_t __attribute__ ((packed));
+} __attribute__ ((packed)) gt96100_rd_t;
 
 
 /* Values for the Tx command-status descriptor entry. */
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index acb170152bbd..b3a898c5a585 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -13,8 +13,8 @@
 ** This driver has only been tested with
 ** -- HP J2585B 10/100 Mbit/s PCI Busmaster
 ** -- HP J2585A 10/100 Mbit/s PCI 
-** -- HP J2970  10 Mbit/s PCI Combo 10base-T/BNC
-** -- HP J2973  10 Mbit/s PCI 10base-T
+** -- HP J2970A 10 Mbit/s PCI Combo 10base-T/BNC
+** -- HP J2973A 10 Mbit/s PCI 10base-T
 ** -- HP J2573  10/100 ISA
 ** -- Compex ReadyLink ENET100-VG4  10/100 Mbit/s PCI / EISA
 ** -- Compex FreedomLine 100/VG  10/100 Mbit/s ISA / EISA / PCI
diff --git a/drivers/net/ppp_deflate.c b/drivers/net/ppp_deflate.c
index 507d6328d4eb..3872088fdd10 100644
--- a/drivers/net/ppp_deflate.c
+++ b/drivers/net/ppp_deflate.c
@@ -87,8 +87,7 @@ static void z_comp_free(void *arg)
 
         if (state) {
                 zlib_deflateEnd(&state->strm);
-                if (state->strm.workspace)
-                        vfree(state->strm.workspace);
+                vfree(state->strm.workspace);
                 kfree(state);
         }
 }
@@ -308,8 +307,7 @@ static void z_decomp_free(void *arg)
 
         if (state) {
                 zlib_inflateEnd(&state->strm);
-                if (state->strm.workspace)
-                        kfree(state->strm.workspace);
+                kfree(state->strm.workspace);
                 kfree(state);
         }
 }
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index c456dc81b873..3b377f6cd4a0 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -2467,14 +2467,10 @@ static void ppp_destroy_interface(struct ppp *ppp)
         skb_queue_purge(&ppp->mrq);
 #endif /* CONFIG_PPP_MULTILINK */
 #ifdef CONFIG_PPP_FILTER
-        if (ppp->pass_filter) {
-                kfree(ppp->pass_filter);
-                ppp->pass_filter = NULL;
-        }
-        if (ppp->active_filter) {
-                kfree(ppp->active_filter);
-                ppp->active_filter = NULL;
-        }
+        kfree(ppp->pass_filter);
+        ppp->pass_filter = NULL;
+        kfree(ppp->active_filter);
+        ppp->active_filter = NULL;
 #endif /* CONFIG_PPP_FILTER */
 
         kfree(ppp);
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 07e2df09491f..c59507f8a76b 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2385,7 +2385,7 @@ core_down:
         }
 
         /* Give a racing hard_start_xmit a few cycles to complete. */
-        synchronize_kernel();
+        synchronize_sched();  /* FIXME: should this be synchronize_irq()? */
 
         /*
          * And now for the 50k$ question: are IRQ disabled or not ?
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 903d0ced7ddb..058c70c6f1ac 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -5830,7 +5830,7 @@ static int tg3_test_interrupt(struct tg3 *tp)
         free_irq(tp->pdev->irq, dev);
 
         err = request_irq(tp->pdev->irq, tg3_test_isr,
-                          SA_SHIRQ, dev->name, dev);
+                          SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
         if (err)
                 return err;
 
@@ -5852,10 +5852,10 @@ static int tg3_test_interrupt(struct tg3 *tp)
         
         if (tp->tg3_flags2 & TG3_FLG2_USING_MSI)
                 err = request_irq(tp->pdev->irq, tg3_msi,
-                                  0, dev->name, dev);
+                                  SA_SAMPLE_RANDOM, dev->name, dev);
         else
                 err = request_irq(tp->pdev->irq, tg3_interrupt,
-                                  SA_SHIRQ, dev->name, dev);
+                                  SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
 
         if (err)
                 return err;
@@ -5908,7 +5908,7 @@ static int tg3_test_msi(struct tg3 *tp)
         tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
 
         err = request_irq(tp->pdev->irq, tg3_interrupt,
-                          SA_SHIRQ, dev->name, dev);
+                          SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
 
         if (err)
                 return err;
@@ -5965,10 +5965,10 @@ static int tg3_open(struct net_device *dev)
         }
         if (tp->tg3_flags2 & TG3_FLG2_USING_MSI)
                 err = request_irq(tp->pdev->irq, tg3_msi,
-                                  0, dev->name, dev);
+                                  SA_SAMPLE_RANDOM, dev->name, dev);
         else
                 err = request_irq(tp->pdev->irq, tg3_interrupt,
-                                  SA_SHIRQ, dev->name, dev);
+                                  SA_SHIRQ | SA_SAMPLE_RANDOM, dev->name, dev);
 
         if (err) {
                 if (tp->tg3_flags2 & TG3_FLG2_USING_MSI) {
diff --git a/drivers/net/wan/cycx_x25.c b/drivers/net/wan/cycx_x25.c
index 5b48cd8568f5..02d57c0b4243 100644
--- a/drivers/net/wan/cycx_x25.c
+++ b/drivers/net/wan/cycx_x25.c
@@ -436,9 +436,7 @@ static int cycx_wan_new_if(struct wan_device *wandev, struct net_device *dev,
         }
 
         if (err) {
-                if (chan->local_addr)
-                        kfree(chan->local_addr);
-
+                kfree(chan->local_addr);
                 kfree(chan);
                 return err;
         }
@@ -458,9 +456,7 @@ static int cycx_wan_del_if(struct wan_device *wandev, struct net_device *dev)
                 struct cycx_x25_channel *chan = dev->priv;
 
                 if (chan->svc) {
-                        if (chan->local_addr)
-                                kfree(chan->local_addr);
-
+                        kfree(chan->local_addr);
                         if (chan->state == WAN_CONNECTED)
                                 del_timer(&chan->timer);
                 }
diff --git a/drivers/net/wan/pc300_tty.c b/drivers/net/wan/pc300_tty.c
index 29f84ad08730..8454bf6caaa7 100644
--- a/drivers/net/wan/pc300_tty.c
+++ b/drivers/net/wan/pc300_tty.c
@@ -400,10 +400,8 @@ static void cpc_tty_close(struct tty_struct *tty, struct file *flip)
                 cpc_tty->buf_rx.last = NULL;
         }
         
-        if (cpc_tty->buf_tx) {
-                kfree(cpc_tty->buf_tx);
-                cpc_tty->buf_tx = NULL;
-        }
+        kfree(cpc_tty->buf_tx);
+        cpc_tty->buf_tx = NULL;
 
         CPC_TTY_DBG("%s: TTY closed\n",cpc_tty->name);
         
@@ -666,7 +664,7 @@ static void cpc_tty_rx_work(void * data)
         unsigned long port;
         int i, j;
         st_cpc_tty_area *cpc_tty; 
-        volatile st_cpc_rx_buf * buf;
+        volatile st_cpc_rx_buf *buf;
         char flags=0,flg_rx=1; 
         struct tty_ldisc *ld;
 
@@ -680,9 +678,9 @@ static void cpc_tty_rx_work(void * data)
                         cpc_tty = &cpc_tty_area[port];
                 
                         if ((buf=cpc_tty->buf_rx.first) != 0) {
-                                if(cpc_tty->tty) {
+                                if (cpc_tty->tty) {
                                         ld = tty_ldisc_ref(cpc_tty->tty);
-                                        if(ld) {
+                                        if (ld) {
                                                 if (ld->receive_buf) {
                                                         CPC_TTY_DBG("%s: call line disc. receive_buf\n",cpc_tty->name);
                                                         ld->receive_buf(cpc_tty->tty, (char *)(buf->data), &flags, buf->size);
@@ -691,7 +689,7 @@ static void cpc_tty_rx_work(void * data)
                                         }
                                 }       
                                 cpc_tty->buf_rx.first = cpc_tty->buf_rx.first->next;
-                                kfree((unsigned char *)buf);
+                                kfree(buf);
                                 buf = cpc_tty->buf_rx.first;
                                 flg_rx = 1;
                         }
@@ -733,7 +731,7 @@ static void cpc_tty_rx_disc_frame(pc300ch_t *pc300chan)
 
 void cpc_tty_receive(pc300dev_t *pc300dev)
 {
-        st_cpc_tty_area    *cpc_tty; 
+        st_cpc_tty_area *cpc_tty; 
         pc300ch_t *pc300chan = (pc300ch_t *)pc300dev->chan; 
         pc300_t *card = (pc300_t *)pc300chan->card; 
         int ch = pc300chan->channel; 
@@ -742,7 +740,7 @@ void cpc_tty_receive(pc300dev_t *pc300dev)
         int rx_len, rx_aux; 
         volatile unsigned char status; 
         unsigned short first_bd = pc300chan->rx_first_bd;
-        st_cpc_rx_buf   *new=NULL;
+        st_cpc_rx_buf *new = NULL;
         unsigned char dsr_rx;
 
         if (pc300dev->cpc_tty == NULL) { 
@@ -762,7 +760,7 @@ void cpc_tty_receive(pc300dev_t *pc300dev)
                         if (status & DST_EOM) {
                                 break;
                         }
-                        ptdescr=(pcsca_bd_t __iomem *)(card->hw.rambase+cpc_readl(&ptdescr->next));
+                        ptdescr = (pcsca_bd_t __iomem *)(card->hw.rambase+cpc_readl(&ptdescr->next));
                 }
                         
                 if (!rx_len) { 
@@ -771,10 +769,7 @@ void cpc_tty_receive(pc300dev_t *pc300dev)
                                 cpc_writel(card->hw.scabase + DRX_REG(EDAL, ch), 
                                                 RX_BD_ADDR(ch, pc300chan->rx_last_bd)); 
                         }
-                        if (new) {
-                                kfree(new);
-                                new = NULL;
-                        }
+                        kfree(new);
                         return; 
                 }
                 
@@ -787,7 +782,7 @@ void cpc_tty_receive(pc300dev_t *pc300dev)
                         continue;
                 } 
                 
-                new = (st_cpc_rx_buf *) kmalloc(rx_len + sizeof(st_cpc_rx_buf), GFP_ATOMIC);
+                new = (st_cpc_rx_buf *)kmalloc(rx_len + sizeof(st_cpc_rx_buf), GFP_ATOMIC);
                 if (new == 0) {
                         cpc_tty_rx_disc_frame(pc300chan);
                         continue;
diff --git a/drivers/net/wan/sdla_chdlc.c b/drivers/net/wan/sdla_chdlc.c
index afbe0024e3e1..496d29237e92 100644
--- a/drivers/net/wan/sdla_chdlc.c
+++ b/drivers/net/wan/sdla_chdlc.c
@@ -3664,15 +3664,10 @@ static void wanpipe_tty_close(struct tty_struct *tty, struct file * filp)
                 chdlc_disable_comm_shutdown(card);
                 unlock_adapter_irq(&card->wandev.lock,&smp_flags);
 
-                if (card->tty_buf){
-                        kfree(card->tty_buf);
-                        card->tty_buf=NULL;                     
-                }
-
-                if (card->tty_rx){
-                        kfree(card->tty_rx);
-                        card->tty_rx=NULL;
-                }
+                kfree(card->tty_buf);
+                card->tty_buf = NULL;                   
+                kfree(card->tty_rx);
+                card->tty_rx = NULL;
         }
         return;
 }
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 8c5cfcb55826..1c540d825551 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -107,13 +107,9 @@ static struct x25_asy *x25_asy_alloc(void)
 static void x25_asy_free(struct x25_asy *sl)
 {
         /* Free all X.25 frame buffers. */
-        if (sl->rbuff)  {
-                kfree(sl->rbuff);
-        }
+        kfree(sl->rbuff);
         sl->rbuff = NULL;
-        if (sl->xbuff)  {
-                kfree(sl->xbuff);
-        }
+        kfree(sl->xbuff);
         sl->xbuff = NULL;
 
         if (!test_and_clear_bit(SLF_INUSE, &sl->flags)) {
@@ -134,10 +130,8 @@ static int x25_asy_change_mtu(struct net_device *dev, int newmtu)
         {
                 printk("%s: unable to grow X.25 buffers, MTU change cancelled.\n",
                        dev->name);
-                if (xbuff != NULL)  
-                        kfree(xbuff);
-                if (rbuff != NULL)  
-                        kfree(rbuff);
+                kfree(xbuff);
+                kfree(rbuff);
                 return -ENOMEM;
         }
 
@@ -169,10 +163,8 @@ static int x25_asy_change_mtu(struct net_device *dev, int newmtu)
 
         spin_unlock_bh(&sl->lock);
 
-        if (xbuff != NULL) 
-                kfree(xbuff);
-        if (rbuff != NULL)
-                kfree(rbuff);
+        kfree(xbuff);
+        kfree(rbuff);
         return 0;
 }
 
diff --git a/drivers/pci/hotplug.c b/drivers/pci/hotplug.c
index d471b3ea5d12..021d0f76bc4c 100644
--- a/drivers/pci/hotplug.c
+++ b/drivers/pci/hotplug.c
@@ -120,6 +120,10 @@ static int pci_visit_bridge (struct pci_visit * fn,
 
 /**
  * pci_visit_dev - scans the pci buses.
+ * @fn: callback functions that are called while visiting
+ * @wrapped_dev: the device to scan
+ * @wrapped_parent: the bus where @wrapped_dev is connected to
+ *
  * Every bus and every function is presented to a custom
  * function that can act upon it.
  */
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index 3e64ff64b38c..838575e3fac6 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -14,7 +14,7 @@
 
 /**
  * pci_enable_rom - enable ROM decoding for a PCI device
- * @dev: PCI device to enable
+ * @pdev: PCI device to enable
  *
  * Enable ROM decoding on @dev.  This involves simply turning on the last
  * bit of the PCI ROM BAR.  Note that some cards may share address decoders
@@ -32,7 +32,7 @@ static void pci_enable_rom(struct pci_dev *pdev)
 
 /**
  * pci_disable_rom - disable ROM decoding for a PCI device
- * @dev: PCI device to disable
+ * @pdev: PCI device to disable
  *
  * Disable ROM decoding on a PCI device by turning off the last bit in the
  * ROM BAR.
@@ -47,7 +47,7 @@ static void pci_disable_rom(struct pci_dev *pdev)
 
 /**
  * pci_map_rom - map a PCI ROM to kernel space
- * @dev: pointer to pci device struct
+ * @pdev: pointer to pci device struct
  * @size: pointer to receive size of pci window over ROM
  * @return: kernel virtual pointer to image of ROM
  *
@@ -132,7 +132,7 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
 
 /**
  * pci_map_rom_copy - map a PCI ROM to kernel space, create a copy
- * @dev: pointer to pci device struct
+ * @pdev: pointer to pci device struct
  * @size: pointer to receive size of pci window over ROM
  * @return: kernel virtual pointer to image of ROM
  *
@@ -166,7 +166,7 @@ void __iomem *pci_map_rom_copy(struct pci_dev *pdev, size_t *size)
 
 /**
  * pci_unmap_rom - unmap the ROM from kernel space
- * @dev: pointer to pci device struct
+ * @pdev: pointer to pci device struct
  * @rom: virtual address of the previous mapping
  *
  * Remove a mapping of a previously mapped ROM
@@ -187,7 +187,7 @@ void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom)
 
 /**
  * pci_remove_rom - disable the ROM and remove its sysfs attribute
- * @dev: pointer to pci device struct
+ * @pdev: pointer to pci device struct
  *
  * Remove the rom file in sysfs and disable ROM decoding.
  */
@@ -206,7 +206,7 @@ void pci_remove_rom(struct pci_dev *pdev)
 /**
  * pci_cleanup_rom - internal routine for freeing the ROM copy created
  * by pci_map_rom_copy called from remove.c
- * @dev: pointer to pci device struct
+ * @pdev: pointer to pci device struct
  *
  * Free the copied ROM if we allocated one.
  */
diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
index 639e04253482..65ecef738537 100644
--- a/drivers/pnp/manager.c
+++ b/drivers/pnp/manager.c
@@ -253,7 +253,7 @@ void pnp_init_resource_table(struct pnp_resource_table *table)
 
 /**
  * pnp_clean_resources - clears resources that were not manually set
- * @res - the resources to clean
+ * @res: the resources to clean
  *
  */
 static void pnp_clean_resource_table(struct pnp_resource_table * res)
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index c0ddb1eb8c4d..dd61e09029b1 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -94,8 +94,8 @@ static void
 pnpacpi_parse_allocated_dmaresource(struct pnp_resource_table * res, int dma)
 {
         int i = 0;
-        while (!(res->dma_resource[i].flags & IORESOURCE_UNSET) &&
-                        i < PNP_MAX_DMA)
+        while (i < PNP_MAX_DMA &&
+                        !(res->dma_resource[i].flags & IORESOURCE_UNSET))
                 i++;
         if (i < PNP_MAX_DMA) {
                 res->dma_resource[i].flags = IORESOURCE_DMA;  // Also clears _UNSET flag
diff --git a/drivers/pnp/pnpbios/rsparser.c b/drivers/pnp/pnpbios/rsparser.c
index 618ac15a9e90..79bce7b75740 100644
--- a/drivers/pnp/pnpbios/rsparser.c
+++ b/drivers/pnp/pnpbios/rsparser.c
@@ -72,7 +72,9 @@ static void
 pnpbios_parse_allocated_dmaresource(struct pnp_resource_table * res, int dma)
 {
         int i = 0;
-        while (!(res->dma_resource[i].flags & IORESOURCE_UNSET) && i < PNP_MAX_DMA) i++;
+        while (i < PNP_MAX_DMA &&
+                        !(res->dma_resource[i].flags & IORESOURCE_UNSET))
+                i++;
         if (i < PNP_MAX_DMA) {
                 res->dma_resource[i].flags = IORESOURCE_DMA;  // Also clears _UNSET flag
                 if (dma == -1) {
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index b755bac6ccbc..02cfe244e069 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -7,7 +7,7 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999-2001
  *
- * $Revision: 1.158 $
+ * $Revision: 1.161 $
  */
 
 #include <linux/config.h>
@@ -1131,13 +1131,17 @@ __dasd_process_blk_queue(struct dasd_device * device)
         request_queue_t *queue;
         struct request *req;
         struct dasd_ccw_req *cqr;
-        int nr_queued;
+        int nr_queued, feature_ro;
 
         queue = device->request_queue;
         /* No queue ? Then there is nothing to do. */
         if (queue == NULL)
                 return;
 
+        feature_ro = dasd_get_feature(device->cdev, DASD_FEATURE_READONLY);
+        if (feature_ro < 0)     /* no devmap */
+                return;
+
         /*
          * We requeue request from the block device queue to the ccw
          * queue only in two states. In state DASD_STATE_READY the
@@ -1157,8 +1161,8 @@ __dasd_process_blk_queue(struct dasd_device * device)
                elv_next_request(queue) &&
                 nr_queued < DASD_CHANQ_MAX_SIZE) {
                 req = elv_next_request(queue);
-                if (test_bit(DASD_FLAG_RO, &device->flags) &&
-                    rq_data_dir(req) == WRITE) {
+
+                if (feature_ro && rq_data_dir(req) == WRITE) {
                         DBF_DEV_EVENT(DBF_ERR, device,
                                       "Rejecting write request %p",
                                       req);
@@ -1631,6 +1635,7 @@ dasd_setup_queue(struct dasd_device * device)
         blk_queue_max_hw_segments(device->request_queue, -1L);
         blk_queue_max_segment_size(device->request_queue, -1L);
         blk_queue_segment_boundary(device->request_queue, -1L);
+        blk_queue_ordered(device->request_queue, 1);
 }
 
 /*
@@ -1803,13 +1808,17 @@ dasd_generic_set_online (struct ccw_device *cdev,
 
 {
         struct dasd_device *device;
-        int rc;
+        int feature_diag, rc;
+
+        feature_diag = dasd_get_feature(cdev, DASD_FEATURE_USEDIAG);
+        if (feature_diag < 0)
+                return feature_diag;
 
         device = dasd_create_device(cdev);
         if (IS_ERR(device))
                 return PTR_ERR(device);
 
-        if (test_bit(DASD_FLAG_USE_DIAG, &device->flags)) {
+        if (feature_diag) {
                 if (!dasd_diag_discipline_pointer) {
                         printk (KERN_WARNING
                                 "dasd_generic couldn't online device %s "
diff --git a/drivers/s390/block/dasd_cmb.c b/drivers/s390/block/dasd_cmb.c
index ed1ab474c0c6..4f365bff275c 100644
--- a/drivers/s390/block/dasd_cmb.c
+++ b/drivers/s390/block/dasd_cmb.c
@@ -1,5 +1,5 @@
 /*
- * linux/drivers/s390/block/dasd_cmb.c ($Revision: 1.6 $)
+ * linux/drivers/s390/block/dasd_cmb.c ($Revision: 1.9 $)
  *
  * Linux on zSeries Channel Measurement Facility support
  *  (dasd device driver interface)
@@ -23,7 +23,6 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 #include <linux/init.h>
-#include <linux/ioctl32.h>
 #include <linux/module.h>
 #include <asm/ccwdev.h>
 #include <asm/cmb.h>
@@ -84,27 +83,13 @@ dasd_ioctl_readall_cmb(struct block_device *bdev, int no, long args)
 static inline int
 ioctl_reg(unsigned int no, dasd_ioctl_fn_t handler)
 {
-        int ret;
-        ret = dasd_ioctl_no_register(THIS_MODULE, no, handler);
-#ifdef CONFIG_COMPAT
-        if (ret)
-                return ret;
-
-        ret = register_ioctl32_conversion(no, NULL);
-        if (ret)
-                dasd_ioctl_no_unregister(THIS_MODULE, no, handler);
-#endif
-        return ret;
+        return dasd_ioctl_no_register(THIS_MODULE, no, handler);
 }
 
 static inline void
 ioctl_unreg(unsigned int no, dasd_ioctl_fn_t handler)
 {
         dasd_ioctl_no_unregister(THIS_MODULE, no, handler);
-#ifdef CONFIG_COMPAT
-        unregister_ioctl32_conversion(no);
-#endif
-
 }
 
 static void
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index ad1841a96c87..1aedc48e5f85 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -11,7 +11,7 @@
  * functions may not be called from interrupt context. In particular
  * dasd_get_device is a no-no from interrupt context.
  *
- * $Revision: 1.37 $
+ * $Revision: 1.40 $
  */
 
 #include <linux/config.h>
@@ -513,14 +513,6 @@ dasd_create_device(struct ccw_device *cdev)
         if (!devmap->device) {
                 devmap->device = device;
                 device->devindex = devmap->devindex;
-                if (devmap->features & DASD_FEATURE_READONLY)
-                        set_bit(DASD_FLAG_RO, &device->flags);
-                else
-                        clear_bit(DASD_FLAG_RO, &device->flags);
-                if (devmap->features & DASD_FEATURE_USEDIAG)
-                        set_bit(DASD_FLAG_USE_DIAG, &device->flags);
-                else
-                        clear_bit(DASD_FLAG_USE_DIAG, &device->flags);
                 get_device(&cdev->dev);
                 device->cdev = cdev;
                 rc = 0;
@@ -651,14 +643,8 @@ dasd_ro_store(struct device *dev, const char *buf, size_t count)
                 devmap->features |= DASD_FEATURE_READONLY;
         else
                 devmap->features &= ~DASD_FEATURE_READONLY;
-        if (devmap->device) {
-                if (devmap->device->gdp)
-                        set_disk_ro(devmap->device->gdp, ro_flag);
-                if (ro_flag)
-                        set_bit(DASD_FLAG_RO, &devmap->device->flags);
-                else
-                        clear_bit(DASD_FLAG_RO, &devmap->device->flags);
-        }
+        if (devmap->device && devmap->device->gdp)
+                set_disk_ro(devmap->device->gdp, ro_flag);
         spin_unlock(&dasd_devmap_lock);
         return count;
 }
@@ -739,6 +725,45 @@ static struct attribute_group dasd_attr_group = {
         .attrs = dasd_attrs,
 };
 
+/*
+ * Return value of the specified feature.
+ */
+int
+dasd_get_feature(struct ccw_device *cdev, int feature)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(cdev->dev.bus_id);
+        if (IS_ERR(devmap))
+                return (int) PTR_ERR(devmap);
+
+        return ((devmap->features & feature) != 0);
+}
+
+/*
+ * Set / reset given feature.
+ * Flag indicates wether to set (!=0) or the reset (=0) the feature.
+ */
+int
+dasd_set_feature(struct ccw_device *cdev, int feature, int flag)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(cdev->dev.bus_id);
+        if (IS_ERR(devmap))
+                return (int) PTR_ERR(devmap);
+
+        spin_lock(&dasd_devmap_lock);
+        if (flag)
+                devmap->features |= feature;
+        else
+                devmap->features &= ~feature;
+
+        spin_unlock(&dasd_devmap_lock);
+        return 0;
+}
+
+
 int
 dasd_add_sysfs_files(struct ccw_device *cdev)
 {
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 838aedf78a56..811060e10c00 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -7,7 +7,7 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999,2000
  *
- * $Revision: 1.69 $
+ * $Revision: 1.71 $
  */
 
 #include <linux/config.h>
@@ -1101,7 +1101,8 @@ dasd_eckd_build_cp(struct dasd_device * device, struct request *req)
                                 if (dasd_eckd_cdl_special(blk_per_trk, recid)){
                                         rcmd |= 0x8;
                                         count = dasd_eckd_cdl_reclen(recid);
-                                        if (count < blksize)
+                                        if (count < blksize &&
+                                            rq_data_dir(req) == READ)
                                                 memset(dst + count, 0xe5,
                                                        blksize - count);
                                 }
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 1d52db406b2e..96c49349701f 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -9,7 +9,7 @@
  *
  * gendisk related functions for the dasd driver.
  *
- * $Revision: 1.48 $
+ * $Revision: 1.50 $
  */
 
 #include <linux/config.h>
@@ -31,12 +31,16 @@ int
 dasd_gendisk_alloc(struct dasd_device *device)
 {
         struct gendisk *gdp;
-        int len;
+        int len, feature_ro;
 
         /* Make sure the minor for this device exists. */
         if (device->devindex >= DASD_PER_MAJOR)
                 return -EBUSY;
 
+        feature_ro = dasd_get_feature(device->cdev, DASD_FEATURE_READONLY);
+        if (feature_ro < 0)
+                return feature_ro;
+
         gdp = alloc_disk(1 << DASD_PARTN_BITS);
         if (!gdp)
                 return -ENOMEM;
@@ -71,7 +75,7 @@ dasd_gendisk_alloc(struct dasd_device *device)
 
         sprintf(gdp->devfs_name, "dasd/%s", device->cdev->dev.bus_id);
 
-        if (test_bit(DASD_FLAG_RO, &device->flags))
+        if (feature_ro)
                 set_disk_ro(gdp, 1);
         gdp->private_data = device;
         gdp->queue = device->request_queue;
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 4586e0ecc526..a9f38b235981 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -6,7 +6,7 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999,2000
  *
- * $Revision: 1.63 $
+ * $Revision: 1.64 $
  */
 
 #ifndef DASD_INT_H
@@ -329,8 +329,6 @@ struct dasd_device {
 #define DASD_STOPPED_DC_EIO  16        /* disconnected, return -EIO */
 
 /* per device flags */
-#define DASD_FLAG_RO            0       /* device is read-only */
-#define DASD_FLAG_USE_DIAG      1       /* use diag disciplnie */
 #define DASD_FLAG_DSC_ERROR     2       /* return -EIO when disconnected */
 #define DASD_FLAG_OFFLINE       3       /* device is in offline processing */
 
@@ -501,6 +499,9 @@ void dasd_devmap_exit(void);
 struct dasd_device *dasd_create_device(struct ccw_device *);
 void dasd_delete_device(struct dasd_device *);
 
+int dasd_get_feature(struct ccw_device *, int);
+int dasd_set_feature(struct ccw_device *, int, int);
+
 int dasd_add_sysfs_files(struct ccw_device *);
 void dasd_remove_sysfs_files(struct ccw_device *);
 
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index f1892baa3b18..980c555aa538 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -7,6 +7,8 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999-2001
  *
+ * $Revision: 1.45 $
+ *
  * i/o controls for the dasd driver.
  */
 #include <linux/config.h>
@@ -294,6 +296,7 @@ dasd_ioctl_format(struct block_device *bdev, int no, long args)
 {
         struct dasd_device *device;
         struct format_data_t fdata;
+        int feature_ro;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -304,7 +307,11 @@ dasd_ioctl_format(struct block_device *bdev, int no, long args)
 
         if (device == NULL)
                 return -ENODEV;
-        if (test_bit(DASD_FLAG_RO, &device->flags))
+
+        feature_ro = dasd_get_feature(device->cdev, DASD_FEATURE_READONLY);
+        if (feature_ro < 0)
+                return feature_ro;
+        if (feature_ro)
                 return -EROFS;
         if (copy_from_user(&fdata, (void __user *) args,
                            sizeof (struct format_data_t)))
@@ -377,7 +384,7 @@ dasd_ioctl_information(struct block_device *bdev, int no, long args)
         struct dasd_device *device;
         struct dasd_information2_t *dasd_info;
         unsigned long flags;
-        int rc;
+        int rc, feature_ro;
         struct ccw_device *cdev;
 
         device = bdev->bd_disk->private_data;
@@ -387,6 +394,10 @@ dasd_ioctl_information(struct block_device *bdev, int no, long args)
         if (!device->discipline->fill_info)
                 return -EINVAL;
 
+        feature_ro = dasd_get_feature(device->cdev, DASD_FEATURE_READONLY);
+        if (feature_ro < 0)
+                return feature_ro;
+
         dasd_info = kmalloc(sizeof(struct dasd_information2_t), GFP_KERNEL);
         if (dasd_info == NULL)
                 return -ENOMEM;
@@ -415,9 +426,8 @@ dasd_ioctl_information(struct block_device *bdev, int no, long args)
         if ((device->state < DASD_STATE_READY) ||
             (dasd_check_blocksize(device->bp_block)))
                 dasd_info->format = DASD_FORMAT_NONE;
-        
-        dasd_info->features |= test_bit(DASD_FLAG_RO, &device->flags) ?
-                DASD_FEATURE_READONLY : DASD_FEATURE_DEFAULT;
+
+        dasd_info->features |= feature_ro;
 
         if (device->discipline)
                 memcpy(dasd_info->type, device->discipline->name, 4);
@@ -460,7 +470,7 @@ static int
 dasd_ioctl_set_ro(struct block_device *bdev, int no, long args)
 {
         struct dasd_device *device;
-        int intval;
+        int intval, rc;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
@@ -472,12 +482,11 @@ dasd_ioctl_set_ro(struct block_device *bdev, int no, long args)
         device =  bdev->bd_disk->private_data;
         if (device == NULL)
                 return -ENODEV;
+
         set_disk_ro(bdev->bd_disk, intval);
-        if (intval)
-                set_bit(DASD_FLAG_RO, &device->flags);
-        else
-                clear_bit(DASD_FLAG_RO, &device->flags);
-        return 0;
+        rc = dasd_set_feature(device->cdev, DASD_FEATURE_READONLY, intval);
+
+        return rc;
 }
 
 /*
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 353d41118c62..d7f19745911f 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -9,7 +9,7 @@
  *
  * /proc interface for the dasd driver.
  *
- * $Revision: 1.30 $
+ * $Revision: 1.31 $
  */
 
 #include <linux/config.h>
@@ -54,6 +54,7 @@ dasd_devices_show(struct seq_file *m, void *v)
 {
         struct dasd_device *device;
         char *substr;
+        int feature;
 
         device = dasd_device_from_devindex((unsigned long) v - 1);
         if (IS_ERR(device))
@@ -77,7 +78,10 @@ dasd_devices_show(struct seq_file *m, void *v)
         else
                 seq_printf(m, " is ????????");
         /* Print devices features. */
-        substr = test_bit(DASD_FLAG_RO, &device->flags) ? "(ro)" : " ";
+        feature = dasd_get_feature(device->cdev, DASD_FEATURE_READONLY);
+        if (feature < 0)
+                return 0;
+        substr = feature ? "(ro)" : " ";
         seq_printf(m, "%4s: ", substr);
         /* Print device status information. */
         switch ((device != NULL) ? device->state : -1) {
diff --git a/drivers/s390/cio/airq.c b/drivers/s390/cio/airq.c
index 3720e77b465f..83e6a060668e 100644
--- a/drivers/s390/cio/airq.c
+++ b/drivers/s390/cio/airq.c
@@ -45,7 +45,7 @@ s390_register_adapter_interrupt (adapter_int_handler_t handler)
         else
                 ret = (cmpxchg(&adapter_handler, NULL, handler) ? -EBUSY : 0);
         if (!ret)
-                synchronize_kernel();
+                synchronize_sched();  /* Allow interrupts to complete. */
 
         sprintf (dbf_txt, "ret:%d", ret);
         CIO_TRACE_EVENT (4, dbf_txt);
@@ -65,7 +65,7 @@ s390_unregister_adapter_interrupt (adapter_int_handler_t handler)
                 ret = -EINVAL;
         else {
                 adapter_handler = NULL;
-                synchronize_kernel();
+                synchronize_sched();  /* Allow interrupts to complete. */
                 ret = 0;
         }
         sprintf (dbf_txt, "ret:%d", ret);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 99ce5a567982..1d9b3f18d8de 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -1,7 +1,7 @@
 /*
  *  drivers/s390/cio/cio.c
  *   S/390 common I/O routines -- low level i/o calls
- *   $Revision: 1.131 $
+ *   $Revision: 1.133 $
  *
  *    Copyright (C) 1999-2002 IBM Deutschland Entwicklung GmbH,
  *                            IBM Corporation
@@ -228,7 +228,7 @@ cio_start_key (struct subchannel *sch,	/* subchannel structure */
 int
 cio_start (struct subchannel *sch, struct ccw1 *cpa, __u8 lpm)
 {
-        return cio_start_key(sch, cpa, lpm, default_storage_key);
+        return cio_start_key(sch, cpa, lpm, PAGE_DEFAULT_KEY);
 }
 
 /*
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 11e260e0b9c9..02d01a0de16c 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -1,7 +1,7 @@
 /*
  *  drivers/s390/cio/device_ops.c
  *
- *   $Revision: 1.55 $
+ *   $Revision: 1.56 $
  *
  *    Copyright (C) 2002 IBM Deutschland Entwicklung GmbH,
  *                       IBM Corporation
@@ -128,7 +128,7 @@ ccw_device_start(struct ccw_device *cdev, struct ccw1 *cpa,
                  unsigned long intparm, __u8 lpm, unsigned long flags)
 {
         return ccw_device_start_key(cdev, cpa, intparm, lpm,
-                                    default_storage_key, flags);
+                                    PAGE_DEFAULT_KEY, flags);
 }
 
 int
@@ -137,7 +137,7 @@ ccw_device_start_timeout(struct ccw_device *cdev, struct ccw1 *cpa,
                          int expires)
 {
         return ccw_device_start_timeout_key(cdev, cpa, intparm, lpm,
-                                            default_storage_key, flags,
+                                            PAGE_DEFAULT_KEY, flags,
                                             expires);
 }
 
diff --git a/drivers/s390/cio/qdio.h b/drivers/s390/cio/qdio.h
index 9ad14db24143..b6daadac4e8b 100644
--- a/drivers/s390/cio/qdio.h
+++ b/drivers/s390/cio/qdio.h
@@ -1,7 +1,9 @@
 #ifndef _CIO_QDIO_H
 #define _CIO_QDIO_H
 
-#define VERSION_CIO_QDIO_H "$Revision: 1.26 $"
+#include <asm/page.h>
+
+#define VERSION_CIO_QDIO_H "$Revision: 1.32 $"
 
 #ifdef CONFIG_QDIO_DEBUG
 #define QDIO_VERBOSE_LEVEL 9
@@ -42,7 +44,7 @@
 
 #define QDIO_Q_LAPS 5
 
-#define QDIO_STORAGE_KEY 0
+#define QDIO_STORAGE_KEY PAGE_DEFAULT_KEY
 
 #define L2_CACHELINE_SIZE 256
 #define INDICATORS_PER_CACHELINE (L2_CACHELINE_SIZE/sizeof(__u32))
diff --git a/drivers/s390/crypto/z90main.c b/drivers/s390/crypto/z90main.c
index a98c00c02559..9ec29bb41b28 100644
--- a/drivers/s390/crypto/z90main.c
+++ b/drivers/s390/crypto/z90main.c
@@ -385,8 +385,8 @@ static int z90crypt_release(struct inode *, struct file *);
 static ssize_t z90crypt_read(struct file *, char __user *, size_t, loff_t *);
 static ssize_t z90crypt_write(struct file *, const char __user *,
                                                         size_t, loff_t *);
-static int z90crypt_ioctl(struct inode *, struct file *,
-                          unsigned int, unsigned long);
+static long z90crypt_unlocked_ioctl(struct file *, unsigned int, unsigned long);
+static long z90crypt_compat_ioctl(struct file *, unsigned int, unsigned long);
 
 static void z90crypt_reader_task(unsigned long);
 static void z90crypt_schedule_reader_task(unsigned long);
@@ -433,12 +433,15 @@ static atomic_t total_open;
 static atomic_t z90crypt_step;
 
 static struct file_operations z90crypt_fops = {
-        .owner   = THIS_MODULE,
-        .read    = z90crypt_read,
-        .write   = z90crypt_write,
-        .ioctl   = z90crypt_ioctl,
-        .open    = z90crypt_open,
-        .release = z90crypt_release
+        .owner          = THIS_MODULE,
+        .read           = z90crypt_read,
+        .write          = z90crypt_write,
+        .unlocked_ioctl = z90crypt_unlocked_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = z90crypt_compat_ioctl,
+#endif
+        .open           = z90crypt_open,
+        .release        = z90crypt_release
 };
 
 #ifndef Z90CRYPT_USE_HOTPLUG
@@ -474,14 +477,13 @@ struct ica_rsa_modexpo_32 { // For 32-bit callers
         compat_uptr_t   n_modulus;
 };
 
-static int
-trans_modexpo32(unsigned int fd, unsigned int cmd, unsigned long arg,
-                struct file *file)
+static long
+trans_modexpo32(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct ica_rsa_modexpo_32 __user *mex32u = compat_ptr(arg);
         struct ica_rsa_modexpo_32  mex32k;
         struct ica_rsa_modexpo __user *mex64;
-        int ret = 0;
+        long ret = 0;
         unsigned int i;
 
         if (!access_ok(VERIFY_WRITE, mex32u, sizeof(struct ica_rsa_modexpo_32)))
@@ -498,7 +500,7 @@ trans_modexpo32(unsigned int fd, unsigned int cmd, unsigned long arg,
             __put_user(compat_ptr(mex32k.b_key), &mex64->b_key)           ||
             __put_user(compat_ptr(mex32k.n_modulus), &mex64->n_modulus))
                 return -EFAULT;
-        ret = sys_ioctl(fd, cmd, (unsigned long)mex64);
+        ret = z90crypt_unlocked_ioctl(filp, cmd, (unsigned long)mex64);
         if (!ret)
                 if (__get_user(i, &mex64->outputdatalength) ||
                     __put_user(i, &mex32u->outputdatalength))
@@ -518,14 +520,13 @@ struct ica_rsa_modexpo_crt_32 { // For 32-bit callers
         compat_uptr_t   u_mult_inv;
 };
 
-static int
-trans_modexpo_crt32(unsigned int fd, unsigned int cmd, unsigned long arg,
-                    struct file *file)
+static long
+trans_modexpo_crt32(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct ica_rsa_modexpo_crt_32 __user *crt32u = compat_ptr(arg);
         struct ica_rsa_modexpo_crt_32  crt32k;
         struct ica_rsa_modexpo_crt __user *crt64;
-        int ret = 0;
+        long ret = 0;
         unsigned int i;
 
         if (!access_ok(VERIFY_WRITE, crt32u,
@@ -546,9 +547,8 @@ trans_modexpo_crt32(unsigned int fd, unsigned int cmd, unsigned long arg,
             __put_user(compat_ptr(crt32k.np_prime), &crt64->np_prime)     ||
             __put_user(compat_ptr(crt32k.nq_prime), &crt64->nq_prime)     ||
             __put_user(compat_ptr(crt32k.u_mult_inv), &crt64->u_mult_inv))
-                ret = -EFAULT;
-        if (!ret)
-                ret = sys_ioctl(fd, cmd, (unsigned long)crt64);
+                return -EFAULT;
+        ret = z90crypt_unlocked_ioctl(filp, cmd, (unsigned long)crt64);
         if (!ret)
                 if (__get_user(i, &crt64->outputdatalength) ||
                     __put_user(i, &crt32u->outputdatalength))
@@ -556,66 +556,34 @@ trans_modexpo_crt32(unsigned int fd, unsigned int cmd, unsigned long arg,
         return ret;
 }
 
-static int compatible_ioctls[] = {
-        ICAZ90STATUS, Z90QUIESCE, Z90STAT_TOTALCOUNT, Z90STAT_PCICACOUNT,
-        Z90STAT_PCICCCOUNT, Z90STAT_PCIXCCCOUNT, Z90STAT_PCIXCCMCL2COUNT,
-        Z90STAT_PCIXCCMCL3COUNT, Z90STAT_CEX2CCOUNT, Z90STAT_REQUESTQ_COUNT,
-        Z90STAT_PENDINGQ_COUNT, Z90STAT_TOTALOPEN_COUNT, Z90STAT_DOMAIN_INDEX,
-        Z90STAT_STATUS_MASK, Z90STAT_QDEPTH_MASK, Z90STAT_PERDEV_REQCNT,
-};
-
-static void z90_unregister_ioctl32s(void)
-{
-        int i;
-
-        unregister_ioctl32_conversion(ICARSAMODEXPO);
-        unregister_ioctl32_conversion(ICARSACRT);
-
-        for(i = 0; i < ARRAY_SIZE(compatible_ioctls); i++)
-                unregister_ioctl32_conversion(compatible_ioctls[i]);
-}
-
-static int z90_register_ioctl32s(void)
-{
-        int result, i;
-
-        result = register_ioctl32_conversion(ICARSAMODEXPO, trans_modexpo32);
-        if (result == -EBUSY) {
-                unregister_ioctl32_conversion(ICARSAMODEXPO);
-                result = register_ioctl32_conversion(ICARSAMODEXPO,
-                                                     trans_modexpo32);
-        }
-        if (result)
-                return result;
-        result = register_ioctl32_conversion(ICARSACRT, trans_modexpo_crt32);
-        if (result == -EBUSY) {
-                unregister_ioctl32_conversion(ICARSACRT);
-                result = register_ioctl32_conversion(ICARSACRT,
-                                                     trans_modexpo_crt32);
-        }
-        if (result)
-                return result;
-
-        for(i = 0; i < ARRAY_SIZE(compatible_ioctls); i++) {
-                result = register_ioctl32_conversion(compatible_ioctls[i], 0);
-                if (result == -EBUSY) {
-                        unregister_ioctl32_conversion(compatible_ioctls[i]);
-                        result = register_ioctl32_conversion(
-                                                       compatible_ioctls[i], 0);
-                }
-                if (result)
-                        return result;
-        }
-        return 0;
-}
-#else // !CONFIG_COMPAT
-static inline void z90_unregister_ioctl32s(void)
-{
-}
-
-static inline int z90_register_ioctl32s(void)
+static long
+z90crypt_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
-        return 0;
+        switch (cmd) {
+        case ICAZ90STATUS:
+        case Z90QUIESCE:
+        case Z90STAT_TOTALCOUNT:
+        case Z90STAT_PCICACOUNT:
+        case Z90STAT_PCICCCOUNT:
+        case Z90STAT_PCIXCCCOUNT:
+        case Z90STAT_PCIXCCMCL2COUNT:
+        case Z90STAT_PCIXCCMCL3COUNT:
+        case Z90STAT_CEX2CCOUNT:
+        case Z90STAT_REQUESTQ_COUNT:
+        case Z90STAT_PENDINGQ_COUNT:
+        case Z90STAT_TOTALOPEN_COUNT:
+        case Z90STAT_DOMAIN_INDEX:
+        case Z90STAT_STATUS_MASK:
+        case Z90STAT_QDEPTH_MASK:
+        case Z90STAT_PERDEV_REQCNT:
+                return z90crypt_unlocked_ioctl(filp, cmd, arg);
+        case ICARSAMODEXPO:
+                return trans_modexpo32(filp, cmd, arg);
+        case ICARSACRT:
+                return trans_modexpo_crt32(filp, cmd, arg);
+        default:
+                return -ENOIOCTLCMD;
+        }
 }
 #endif
 
@@ -730,14 +698,9 @@ z90crypt_init_module(void)
         reader_timer.expires = jiffies + (READERTIME * HZ / 1000);
         add_timer(&reader_timer);
 
-        if ((result = z90_register_ioctl32s()))
-                goto init_module_cleanup;
-
         return 0; // success
 
 init_module_cleanup:
-        z90_unregister_ioctl32s();
-
 #ifndef Z90CRYPT_USE_HOTPLUG
         if ((nresult = misc_deregister(&z90crypt_misc_device)))
                 PRINTK("misc_deregister failed with %d.\n", nresult);
@@ -763,8 +726,6 @@ z90crypt_cleanup_module(void)
 
         PDEBUG("PID %d\n", PID());
 
-        z90_unregister_ioctl32s();
-
         remove_proc_entry("driver/z90crypt", 0);
 
 #ifndef Z90CRYPT_USE_HOTPLUG
@@ -800,7 +761,7 @@ z90crypt_cleanup_module(void)
  *     z90crypt_release
  *     z90crypt_read
  *     z90crypt_write
- *     z90crypt_ioctl
+ *     z90crypt_unlocked_ioctl
  *     z90crypt_status
  *     z90crypt_status_write
  *       disable_card
@@ -1804,9 +1765,8 @@ z90crypt_rsa(struct priv_data *private_data_p, pid_t pid,
  * This function is a little long, but it's really just one large switch
  * statement.
  */
-static int
-z90crypt_ioctl(struct inode *inode, struct file *filp,
-               unsigned int cmd, unsigned long arg)
+static long
+z90crypt_unlocked_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct priv_data *private_data_p = filp->private_data;
         unsigned char *status;
diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c
index a3d285859564..1e3f7f3c662f 100644
--- a/drivers/s390/net/smsgiucv.c
+++ b/drivers/s390/net/smsgiucv.c
@@ -32,7 +32,7 @@ struct smsg_callback {
         struct list_head list;
         char *prefix;
         int len;
-        void (*callback)(char *str);
+        void (*callback)(char *from, char *str);
 };
 
 MODULE_AUTHOR
@@ -55,8 +55,9 @@ smsg_message_pending(iucv_MessagePending *eib, void *pgm_data)
 {
         struct smsg_callback *cb;
         unsigned char *msg;
+        unsigned char sender[9];
         unsigned short len;
-        int rc;
+        int rc, i;
 
         len = eib->ln1msg2.ipbfln1f;
         msg = kmalloc(len + 1, GFP_ATOMIC|GFP_DMA);
@@ -69,10 +70,18 @@ smsg_message_pending(iucv_MessagePending *eib, void *pgm_data)
         if (rc == 0) {
                 msg[len] = 0;
                 EBCASC(msg, len);
+                memcpy(sender, msg, 8);
+                sender[8] = 0;
+                /* Remove trailing whitespace from the sender name. */
+                for (i = 7; i >= 0; i--) {
+                        if (sender[i] != ' ' && sender[i] != '\t')
+                                break;
+                        sender[i] = 0;
+                }
                 spin_lock(&smsg_list_lock);
                 list_for_each_entry(cb, &smsg_list, list)
                         if (strncmp(msg + 8, cb->prefix, cb->len) == 0) {
-                                cb->callback(msg + 8);
+                                cb->callback(sender, msg + 8);
                                 break;
                         }
                 spin_unlock(&smsg_list_lock);
@@ -91,7 +100,7 @@ static struct device_driver smsg_driver = {
 };
 
 int
-smsg_register_callback(char *prefix, void (*callback)(char *str))
+smsg_register_callback(char *prefix, void (*callback)(char *from, char *str))
 {
         struct smsg_callback *cb;
 
@@ -108,7 +117,7 @@ smsg_register_callback(char *prefix, void (*callback)(char *str))
 }
 
 void
-smsg_unregister_callback(char *prefix, void (*callback)(char *str))
+smsg_unregister_callback(char *prefix, void (*callback)(char *from, char *str))
 {
         struct smsg_callback *cb, *tmp;
 
diff --git a/drivers/s390/net/smsgiucv.h b/drivers/s390/net/smsgiucv.h
index 04cd87152964..67f5d4f8378d 100644
--- a/drivers/s390/net/smsgiucv.h
+++ b/drivers/s390/net/smsgiucv.h
@@ -5,6 +5,6 @@
  * Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com)
  */
 
-int  smsg_register_callback(char *, void (*)(char *));
-void smsg_unregister_callback(char *, void (*)(char *));
+int  smsg_register_callback(char *, void (*)(char *, char *));
+void smsg_unregister_callback(char *, void (*)(char *, char *));
 
diff --git a/drivers/scsi/pas16.c b/drivers/scsi/pas16.c
index e70dedb0d0a5..7976947c0322 100644
--- a/drivers/scsi/pas16.c
+++ b/drivers/scsi/pas16.c
@@ -137,7 +137,7 @@ static unsigned short pas16_addr = 0;
 static int pas16_irq = 0;
  
 
-int scsi_irq_translate[] =
+static const int scsi_irq_translate[] =
         { 0,  0,  1,  2,  3,  4,  5,  6, 0,  0,  7,  8,  9,  0, 10, 11 };
 
 /* The default_irqs array contains values used to set the irq into the
@@ -145,7 +145,7 @@ int scsi_irq_translate[] =
  * irq jumpers on the board).  The first value in the array will be
  * assigned to logical board 0, the next to board 1, etc.
  */
-int default_irqs[] __initdata = 
+static int default_irqs[] __initdata =
         {  PAS16_DEFAULT_BOARD_1_IRQ,
            PAS16_DEFAULT_BOARD_2_IRQ,
            PAS16_DEFAULT_BOARD_3_IRQ,
@@ -177,7 +177,7 @@ static struct base {
 
 #define NO_BASES (sizeof (bases) / sizeof (struct base))
 
-unsigned short  pas16_offset[ 8 ] =
+static const unsigned short  pas16_offset[ 8 ] =
     {
         0x1c00,    /* OUTPUT_DATA_REG */
         0x1c01,    /* INITIATOR_COMMAND_REG */
diff --git a/drivers/scsi/ultrastor.c b/drivers/scsi/ultrastor.c
index a00095cc74c6..97f4d9112b48 100644
--- a/drivers/scsi/ultrastor.c
+++ b/drivers/scsi/ultrastor.c
@@ -945,7 +945,7 @@ static int ultrastor_abort(Scsi_Cmnd *SCpnt)
                config.mscp[mscp_index].SCint, SCpnt);
 #endif
     if (config.mscp[mscp_index].SCint == 0)
-        return FAILURE;
+        return FAILED;
 
     if (config.mscp[mscp_index].SCint != SCpnt) panic("Bad abort");
     config.mscp[mscp_index].SCint = NULL;
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 218b69372c0b..0d9358608fdf 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -51,7 +51,7 @@
  *   share_irqs - whether we pass SA_SHIRQ to request_irq().  This option
  *                is unsafe when used on edge-triggered interrupts.
  */
-unsigned int share_irqs = SERIAL8250_SHARE_IRQS;
+static unsigned int share_irqs = SERIAL8250_SHARE_IRQS;
 
 /*
  * Debugging.
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index c682c6308cde..01a8726a3f97 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -321,18 +321,39 @@ static void imx_break_ctl(struct uart_port *port, int break_state)
 #define TXTL 2 /* reset default */
 #define RXTL 1 /* reset default */
 
+static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
+{
+        unsigned int val;
+        unsigned int ufcr_rfdiv;
+
+        /* set receiver / transmitter trigger level.
+         * RFDIV is set such way to satisfy requested uartclk value
+         */
+        val = TXTL<<10 | RXTL;
+        ufcr_rfdiv = (imx_get_perclk1() + sport->port.uartclk / 2) / sport->port.uartclk;
+
+        if(!ufcr_rfdiv)
+                ufcr_rfdiv = 1;
+
+        if(ufcr_rfdiv >= 7)
+                ufcr_rfdiv = 6;
+        else
+                ufcr_rfdiv = 6 - ufcr_rfdiv;
+
+        val |= UFCR_RFDIV & (ufcr_rfdiv << 7);
+
+        UFCR((u32)sport->port.membase) = val;
+
+        return 0;
+}
+
 static int imx_startup(struct uart_port *port)
 {
         struct imx_port *sport = (struct imx_port *)port;
         int retval;
-        unsigned int val;
         unsigned long flags;
 
-        /* set receiver / transmitter trigger level. We assume
-         * that RFDIV has been set by the arch setup or by the bootloader.
-         */
-        val = (UFCR((u32)sport->port.membase) & UFCR_RFDIV)  | TXTL<<10 | RXTL;
-        UFCR((u32)sport->port.membase) = val;
+        imx_setup_ufcr(sport, 0);
 
         /* disable the DREN bit (Data Ready interrupt enable) before
          * requesting IRQs
@@ -737,9 +758,12 @@ static void __init
 imx_console_get_options(struct imx_port *sport, int *baud,
                            int *parity, int *bits)
 {
+
         if ( UCR1((u32)sport->port.membase) | UCR1_UARTEN ) {
                 /* ok, the port was enabled */
                 unsigned int ucr2, ubir,ubmr, uartclk;
+                unsigned int baud_raw;
+                unsigned int ucfr_rfdiv;
 
                 ucr2 = UCR2((u32)sport->port.membase);
 
@@ -758,9 +782,35 @@ imx_console_get_options(struct imx_port *sport, int *baud,
 
                 ubir = UBIR((u32)sport->port.membase) & 0xffff;
                 ubmr = UBMR((u32)sport->port.membase) & 0xffff;
-                uartclk = sport->port.uartclk;
 
-                *baud = ((uartclk/16) * (ubir + 1)) / (ubmr + 1);
+
+                ucfr_rfdiv = (UFCR((u32)sport->port.membase) & UFCR_RFDIV) >> 7;
+                if (ucfr_rfdiv == 6)
+                        ucfr_rfdiv = 7;
+                else
+                        ucfr_rfdiv = 6 - ucfr_rfdiv;
+
+                uartclk = imx_get_perclk1();
+                uartclk /= ucfr_rfdiv;
+
+                {       /*
+                         * The next code provides exact computation of
+                         *   baud_raw = round(((uartclk/16) * (ubir + 1)) / (ubmr + 1))
+                         * without need of float support or long long division,
+                         * which would be required to prevent 32bit arithmetic overflow
+                         */
+                        unsigned int mul = ubir + 1;
+                        unsigned int div = 16 * (ubmr + 1);
+                        unsigned int rem = uartclk % div;
+
+                        baud_raw = (uartclk / div) * mul;
+                        baud_raw += (rem * mul + div / 2) / div;
+                        *baud = (baud_raw + 50) / 100 * 100;
+                }
+
+                if(*baud != baud_raw)
+                        printk(KERN_INFO "Serial: Console IMX rounded baud rate from %d to %d\n",
+                                baud_raw, *baud);
         }
 }
 
@@ -787,6 +837,8 @@ imx_console_setup(struct console *co, char *options)
         else
                 imx_console_get_options(sport, &baud, &parity, &bits);
 
+        imx_setup_ufcr(sport, 0);
+
         return uart_set_options(&sport->port, co, baud, parity, bits, flow);
 }
 
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index d054f1265701..ba4e13a22a50 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -838,7 +838,7 @@ static int inline port_init(struct ioc4_port *port)
         port->ip_tx_prod = readl(&port->ip_serial_regs->stcir) & PROD_CONS_MASK;
         writel(port->ip_tx_prod, &port->ip_serial_regs->stpir);
         port->ip_rx_cons = readl(&port->ip_serial_regs->srpir) & PROD_CONS_MASK;
-        writel(port->ip_rx_cons, &port->ip_serial_regs->srcir);
+        writel(port->ip_rx_cons | IOC4_SRCIR_ARM, &port->ip_serial_regs->srcir);
 
         /* Disable interrupts for this 16550 */
         uart = port->ip_uart_regs;
@@ -1272,8 +1272,9 @@ static inline int set_rx_timeout(struct ioc4_port *port, int timeout)
          * and set the rx threshold to that amount.  There are 4 chars
          * per ring entry, so we'll divide the number of chars that will
          * arrive in timeout by 4.
+         * So .... timeout * baud / 10 / HZ / 4, with HZ = 100.
          */
-        threshold = timeout * port->ip_baud / 10 / HZ / 4;
+        threshold = timeout * port->ip_baud / 4000;
         if (threshold == 0)
                 threshold = 1;  /* otherwise we'll intr all the time! */
 
@@ -1285,8 +1286,10 @@ static inline int set_rx_timeout(struct ioc4_port *port, int timeout)
 
         writel(port->ip_sscr, &port->ip_serial_regs->sscr);
 
-        /* Now set the rx timeout to the given value */
-        timeout = timeout * IOC4_SRTR_HZ / HZ;
+        /* Now set the rx timeout to the given value
+         * again timeout * IOC4_SRTR_HZ / HZ
+         */
+        timeout = timeout * IOC4_SRTR_HZ / 100;
         if (timeout > IOC4_SRTR_CNT)
                 timeout = IOC4_SRTR_CNT;
 
@@ -1380,7 +1383,7 @@ config_port(struct ioc4_port *port,
         if (port->ip_tx_lowat == 0)
                 port->ip_tx_lowat = 1;
 
-        set_rx_timeout(port, port->ip_rx_timeout);
+        set_rx_timeout(port, 2);
 
         return 0;
 }
@@ -1685,8 +1688,8 @@ ioc4_change_speed(struct uart_port *the_port,
 {
         struct ioc4_port *port = get_ioc4_port(the_port);
         int baud, bits;
-        unsigned cflag, cval;
-        int new_parity = 0, new_parity_enable = 0, new_stop = 1, new_data = 8;
+        unsigned cflag;
+        int new_parity = 0, new_parity_enable = 0, new_stop = 0, new_data = 8;
         struct uart_info *info = the_port->info;
 
         cflag = new_termios->c_cflag;
@@ -1694,48 +1697,35 @@ ioc4_change_speed(struct uart_port *the_port,
         switch (cflag & CSIZE) {
         case CS5:
                 new_data = 5;
-                cval = 0x00;
                 bits = 7;
                 break;
         case CS6:
                 new_data = 6;
-                cval = 0x01;
                 bits = 8;
                 break;
         case CS7:
                 new_data = 7;
-                cval = 0x02;
                 bits = 9;
                 break;
         case CS8:
                 new_data = 8;
-                cval = 0x03;
                 bits = 10;
                 break;
         default:
                 /* cuz we always need a default ... */
                 new_data = 5;
-                cval = 0x00;
                 bits = 7;
                 break;
         }
         if (cflag & CSTOPB) {
-                cval |= 0x04;
                 bits++;
                 new_stop = 1;
         }
         if (cflag & PARENB) {
-                cval |= UART_LCR_PARITY;
                 bits++;
                 new_parity_enable = 1;
-        }
-        if (cflag & PARODD) {
-                cval |= UART_LCR_EPAR;
-                new_parity = 1;
-        }
-        if (cflag & IGNPAR) {
-                cval &= ~UART_LCR_PARITY;
-                new_parity_enable = 0;
+                if (cflag & PARODD)
+                        new_parity = 1;
         }
         baud = uart_get_baud_rate(the_port, new_termios, old_termios,
                                 MIN_BAUD_SUPPORTED, MAX_BAUD_SUPPORTED);
@@ -1765,10 +1755,15 @@ ioc4_change_speed(struct uart_port *the_port,
                 the_port->ignore_status_mask &= ~N_DATA_READY;
         }
 
-        if (cflag & CRTSCTS)
+        if (cflag & CRTSCTS) {
                 info->flags |= ASYNC_CTS_FLOW;
-        else
+                port->ip_sscr |= IOC4_SSCR_HFC_EN;
+        }
+        else {
                 info->flags &= ~ASYNC_CTS_FLOW;
+                port->ip_sscr &= ~IOC4_SSCR_HFC_EN;
+        }
+        writel(port->ip_sscr, &port->ip_serial_regs->sscr);
 
         /* Set the configuration and proper notification call */
         DPRINT_CONFIG(("%s : port 0x%p cflag 0%o "
@@ -1825,12 +1820,6 @@ static inline int ic4_startup_local(struct uart_port *the_port)
         /* set the speed of the serial port */
         ioc4_change_speed(the_port, info->tty->termios, (struct termios *)0);
 
-        /* enable hardware flow control - after ioc4_change_speed because
-         * ASYNC_CTS_FLOW is set there */
-        if (info->flags & ASYNC_CTS_FLOW) {
-                port->ip_sscr |= IOC4_SSCR_HFC_EN;
-                writel(port->ip_sscr, &port->ip_serial_regs->sscr);
-        }
         info->flags |= UIF_INITIALIZED;
         return 0;
 }
@@ -1847,7 +1836,6 @@ static void ioc4_cb_output_lowat(struct ioc4_port *port)
         }
 }
 
-
 /**
  * handle_intr - service any interrupts for the given port - 2nd level
  *                      called via sd_intr
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index e0717611c940..777829fa3300 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -393,7 +393,6 @@ int jsm_tty_init(struct jsm_board *);
 int jsm_uart_port_init(struct jsm_board *);
 int jsm_remove_uart_port(struct jsm_board *);
 void jsm_input(struct jsm_channel *ch);
-void jsm_carrier(struct jsm_channel *ch);
 void jsm_check_queue_flow_control(struct jsm_channel *ch);
 
 #endif
diff --git a/drivers/serial/jsm/jsm_neo.c b/drivers/serial/jsm/jsm_neo.c
index 9b79c1ff6c72..3a11a69feb44 100644
--- a/drivers/serial/jsm/jsm_neo.c
+++ b/drivers/serial/jsm/jsm_neo.c
@@ -688,7 +688,7 @@ static void neo_flush_uart_read(struct jsm_channel *ch)
 /*
  * No locks are assumed to be held when calling this function.
  */
-void neo_clear_break(struct jsm_channel *ch, int force)
+static void neo_clear_break(struct jsm_channel *ch, int force)
 {
         unsigned long lock_flags;
 
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 24fe76c28833..98de2258fd06 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -31,6 +31,8 @@
 
 #include "jsm.h"
 
+static void jsm_carrier(struct jsm_channel *ch);
+
 static inline int jsm_get_mstat(struct jsm_channel *ch)
 {
         unsigned char mstat;
@@ -755,7 +757,7 @@ void jsm_input(struct jsm_channel *ch)
         jsm_printk(IOCTL, INFO, &ch->ch_bd->pci_dev, "finish\n");
 }
 
-void jsm_carrier(struct jsm_channel *ch)
+static void jsm_carrier(struct jsm_channel *ch)
 {
         struct jsm_board *bd;
 
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 9034f9ad37c7..6eeb48f6a482 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -107,6 +107,13 @@ struct serial_info {
         int                     line[4];
 };
 
+struct serial_cfg_mem {
+        tuple_t tuple;
+        cisparse_t parse;
+        u_char buf[256];
+};
+
+
 static void serial_config(dev_link_t * link);
 static int serial_event(event_t event, int priority,
                         event_callback_args_t * args);
@@ -357,14 +364,24 @@ static int simple_config(dev_link_t *link)
         static int size_table[2] = { 8, 16 };
         client_handle_t handle = link->handle;
         struct serial_info *info = link->priv;
-        tuple_t tuple;
-        u_char buf[256];
-        cisparse_t parse;
-        cistpl_cftable_entry_t *cf = &parse.cftable_entry;
+        struct serial_cfg_mem *cfg_mem;
+        tuple_t *tuple;
+        u_char *buf;
+        cisparse_t *parse;
+        cistpl_cftable_entry_t *cf;
         config_info_t config;
         int i, j, try;
         int s;
 
+        cfg_mem = kmalloc(sizeof(struct serial_cfg_mem), GFP_KERNEL);
+        if (!cfg_mem)
+                return -1;
+
+        tuple = &cfg_mem->tuple;
+        parse = &cfg_mem->parse;
+        cf = &parse->cftable_entry;
+        buf = cfg_mem->buf;
+
         /* If the card is already configured, look up the port and irq */
         i = pcmcia_get_configuration_info(handle, &config);
         if ((i == CS_SUCCESS) && (config.Attributes & CONF_VALID_CLIENT)) {
@@ -377,21 +394,23 @@ static int simple_config(dev_link_t *link)
                         port = config.BasePort1 + 0x28;
                         info->slave = 1;
                 }
-                if (info->slave)
+                if (info->slave) {
+                        kfree(cfg_mem);
                         return setup_serial(handle, info, port, config.AssignedIRQ);
+                }
         }
         link->conf.Vcc = config.Vcc;
 
         /* First pass: look for a config entry that looks normal. */
-        tuple.TupleData = (cisdata_t *) buf;
-        tuple.TupleOffset = 0;
-        tuple.TupleDataMax = 255;
-        tuple.Attributes = 0;
-        tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
+        tuple->TupleData = (cisdata_t *) buf;
+        tuple->TupleOffset = 0;
+        tuple->TupleDataMax = 255;
+        tuple->Attributes = 0;
+        tuple->DesiredTuple = CISTPL_CFTABLE_ENTRY;
         /* Two tries: without IO aliases, then with aliases */
         for (s = 0; s < 2; s++) {
                 for (try = 0; try < 2; try++) {
-                        i = first_tuple(handle, &tuple, &parse);
+                        i = first_tuple(handle, tuple, parse);
                         while (i != CS_NO_MORE_ITEMS) {
                                 if (i != CS_SUCCESS)
                                         goto next_entry;
@@ -409,14 +428,14 @@ static int simple_config(dev_link_t *link)
                                                 goto found_port;
                                 }
 next_entry:
-                                i = next_tuple(handle, &tuple, &parse);
+                                i = next_tuple(handle, tuple, parse);
                         }
                 }
         }
         /* Second pass: try to find an entry that isn't picky about
            its base address, then try to grab any standard serial port
            address, and finally try to get any free port. */
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(handle, tuple, parse);
         while (i != CS_NO_MORE_ITEMS) {
                 if ((i == CS_SUCCESS) && (cf->io.nwin > 0) &&
                     ((cf->io.flags & CISTPL_IO_LINES_MASK) <= 3)) {
@@ -429,7 +448,7 @@ next_entry:
                                         goto found_port;
                         }
                 }
-                i = next_tuple(handle, &tuple, &parse);
+                i = next_tuple(handle, tuple, parse);
         }
 
       found_port:
@@ -437,6 +456,7 @@ next_entry:
                 printk(KERN_NOTICE
                        "serial_cs: no usable port range found, giving up\n");
                 cs_error(link->handle, RequestIO, i);
+                kfree(cfg_mem);
                 return -1;
         }
 
@@ -450,9 +470,10 @@ next_entry:
         i = pcmcia_request_configuration(link->handle, &link->conf);
         if (i != CS_SUCCESS) {
                 cs_error(link->handle, RequestConfiguration, i);
+                kfree(cfg_mem);
                 return -1;
         }
-
+        kfree(cfg_mem);
         return setup_serial(handle, info, link->io.BasePort1, link->irq.AssignedIRQ);
 }
 
@@ -460,29 +481,39 @@ static int multi_config(dev_link_t * link)
 {
         client_handle_t handle = link->handle;
         struct serial_info *info = link->priv;
-        tuple_t tuple;
-        u_char buf[256];
-        cisparse_t parse;
-        cistpl_cftable_entry_t *cf = &parse.cftable_entry;
+        struct serial_cfg_mem *cfg_mem;
+        tuple_t *tuple;
+        u_char *buf;
+        cisparse_t *parse;
+        cistpl_cftable_entry_t *cf;
         config_info_t config;
-        int i, base2 = 0;
+        int i, rc, base2 = 0;
+
+        cfg_mem = kmalloc(sizeof(struct serial_cfg_mem), GFP_KERNEL);
+        if (!cfg_mem)
+                return -1;
+        tuple = &cfg_mem->tuple;
+        parse = &cfg_mem->parse;
+        cf = &parse->cftable_entry;
+        buf = cfg_mem->buf;
 
         i = pcmcia_get_configuration_info(handle, &config);
         if (i != CS_SUCCESS) {
                 cs_error(handle, GetConfigurationInfo, i);
-                return -1;
+                rc = -1;
+                goto free_cfg_mem;
         }
         link->conf.Vcc = config.Vcc;
 
-        tuple.TupleData = (cisdata_t *) buf;
-        tuple.TupleOffset = 0;
-        tuple.TupleDataMax = 255;
-        tuple.Attributes = 0;
-        tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
+        tuple->TupleData = (cisdata_t *) buf;
+        tuple->TupleOffset = 0;
+        tuple->TupleDataMax = 255;
+        tuple->Attributes = 0;
+        tuple->DesiredTuple = CISTPL_CFTABLE_ENTRY;
 
         /* First, look for a generic full-sized window */
         link->io.NumPorts1 = info->multi * 8;
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(handle, tuple, parse);
         while (i != CS_NO_MORE_ITEMS) {
                 /* The quad port cards have bad CIS's, so just look for a
                    window larger than 8 ports and assume it will be right */
@@ -497,14 +528,14 @@ static int multi_config(dev_link_t * link)
                         if (i == CS_SUCCESS)
                                 break;
                 }
-                i = next_tuple(handle, &tuple, &parse);
+                i = next_tuple(handle, tuple, parse);
         }
 
         /* If that didn't work, look for two windows */
         if (i != CS_SUCCESS) {
                 link->io.NumPorts1 = link->io.NumPorts2 = 8;
                 info->multi = 2;
-                i = first_tuple(handle, &tuple, &parse);
+                i = first_tuple(handle, tuple, parse);
                 while (i != CS_NO_MORE_ITEMS) {
                         if ((i == CS_SUCCESS) && (cf->io.nwin == 2)) {
                                 link->conf.ConfigIndex = cf->index;
@@ -517,13 +548,14 @@ static int multi_config(dev_link_t * link)
                                 if (i == CS_SUCCESS)
                                         break;
                         }
-                        i = next_tuple(handle, &tuple, &parse);
+                        i = next_tuple(handle, tuple, parse);
                 }
         }
 
         if (i != CS_SUCCESS) {
                 cs_error(link->handle, RequestIO, i);
-                return -1;
+                rc = -1;
+                goto free_cfg_mem;
         }
 
         i = pcmcia_request_irq(link->handle, &link->irq);
@@ -541,7 +573,8 @@ static int multi_config(dev_link_t * link)
         i = pcmcia_request_configuration(link->handle, &link->conf);
         if (i != CS_SUCCESS) {
                 cs_error(link->handle, RequestConfiguration, i);
-                return -1;
+                rc = -1;
+                goto free_cfg_mem;
         }
 
         /* The Oxford Semiconductor OXCF950 cards are in fact single-port:
@@ -554,17 +587,23 @@ static int multi_config(dev_link_t * link)
                         setup_serial(handle, info, link->io.BasePort1, link->irq.AssignedIRQ);
                         outb(12, base2 + 1);
                 }
-                return 0;
+                rc = 0;
+                goto free_cfg_mem;
         }
 
         setup_serial(handle, info, link->io.BasePort1, link->irq.AssignedIRQ);
         /* The Nokia cards are not really multiport cards */
-        if (info->manfid == MANFID_NOKIA)
-                return 0;
+        if (info->manfid == MANFID_NOKIA) {
+                rc = 0;
+                goto free_cfg_mem;
+        }
         for (i = 0; i < info->multi - 1; i++)
-                setup_serial(handle, info, base2 + (8 * i), link->irq.AssignedIRQ);
-
-        return 0;
+                setup_serial(handle, info, base2 + (8 * i),
+                                link->irq.AssignedIRQ);
+        rc = 0;
+free_cfg_mem:
+        kfree(cfg_mem);
+        return rc;
 }
 
 /*======================================================================
@@ -579,39 +618,49 @@ void serial_config(dev_link_t * link)
 {
         client_handle_t handle = link->handle;
         struct serial_info *info = link->priv;
-        tuple_t tuple;
-        u_short buf[128];
-        cisparse_t parse;
-        cistpl_cftable_entry_t *cf = &parse.cftable_entry;
+        struct serial_cfg_mem *cfg_mem;
+        tuple_t *tuple;
+        u_char *buf;
+        cisparse_t *parse;
+        cistpl_cftable_entry_t *cf;
         int i, last_ret, last_fn;
 
         DEBUG(0, "serial_config(0x%p)\n", link);
 
-        tuple.TupleData = (cisdata_t *) buf;
-        tuple.TupleOffset = 0;
-        tuple.TupleDataMax = 255;
-        tuple.Attributes = 0;
+        cfg_mem = kmalloc(sizeof(struct serial_cfg_mem), GFP_KERNEL);
+        if (!cfg_mem)
+                goto failed;
+
+        tuple = &cfg_mem->tuple;
+        parse = &cfg_mem->parse;
+        cf = &parse->cftable_entry;
+        buf = cfg_mem->buf;
+
+        tuple->TupleData = (cisdata_t *) buf;
+        tuple->TupleOffset = 0;
+        tuple->TupleDataMax = 255;
+        tuple->Attributes = 0;
         /* Get configuration register information */
-        tuple.DesiredTuple = CISTPL_CONFIG;
-        last_ret = first_tuple(handle, &tuple, &parse);
+        tuple->DesiredTuple = CISTPL_CONFIG;
+        last_ret = first_tuple(handle, tuple, parse);
         if (last_ret != CS_SUCCESS) {
                 last_fn = ParseTuple;
                 goto cs_failed;
         }
-        link->conf.ConfigBase = parse.config.base;
-        link->conf.Present = parse.config.rmask[0];
+        link->conf.ConfigBase = parse->config.base;
+        link->conf.Present = parse->config.rmask[0];
 
         /* Configure card */
         link->state |= DEV_CONFIG;
 
         /* Is this a compliant multifunction card? */
-        tuple.DesiredTuple = CISTPL_LONGLINK_MFC;
-        tuple.Attributes = TUPLE_RETURN_COMMON | TUPLE_RETURN_LINK;
-        info->multi = (first_tuple(handle, &tuple, &parse) == CS_SUCCESS);
+        tuple->DesiredTuple = CISTPL_LONGLINK_MFC;
+        tuple->Attributes = TUPLE_RETURN_COMMON | TUPLE_RETURN_LINK;
+        info->multi = (first_tuple(handle, tuple, parse) == CS_SUCCESS);
 
         /* Is this a multiport card? */
-        tuple.DesiredTuple = CISTPL_MANFID;
-        if (first_tuple(handle, &tuple, &parse) == CS_SUCCESS) {
+        tuple->DesiredTuple = CISTPL_MANFID;
+        if (first_tuple(handle, tuple, parse) == CS_SUCCESS) {
                 info->manfid = le16_to_cpu(buf[0]);
                 for (i = 0; i < MULTI_COUNT; i++)
                         if ((info->manfid == multi_id[i].manfid) &&
@@ -623,13 +672,13 @@ void serial_config(dev_link_t * link)
 
         /* Another check for dual-serial cards: look for either serial or
            multifunction cards that ask for appropriate IO port ranges */
-        tuple.DesiredTuple = CISTPL_FUNCID;
+        tuple->DesiredTuple = CISTPL_FUNCID;
         if ((info->multi == 0) &&
-            ((first_tuple(handle, &tuple, &parse) != CS_SUCCESS) ||
-             (parse.funcid.func == CISTPL_FUNCID_MULTI) ||
-             (parse.funcid.func == CISTPL_FUNCID_SERIAL))) {
-                tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-                if (first_tuple(handle, &tuple, &parse) == CS_SUCCESS) {
+            ((first_tuple(handle, tuple, parse) != CS_SUCCESS) ||
+             (parse->funcid.func == CISTPL_FUNCID_MULTI) ||
+             (parse->funcid.func == CISTPL_FUNCID_SERIAL))) {
+                tuple->DesiredTuple = CISTPL_CFTABLE_ENTRY;
+                if (first_tuple(handle, tuple, parse) == CS_SUCCESS) {
                         if ((cf->io.nwin == 1) && (cf->io.win[0].len % 8 == 0))
                                 info->multi = cf->io.win[0].len >> 3;
                         if ((cf->io.nwin == 2) && (cf->io.win[0].len == 8) &&
@@ -664,6 +713,7 @@ void serial_config(dev_link_t * link)
 
         link->dev = &info->node[0];
         link->state &= ~DEV_CONFIG_PENDING;
+        kfree(cfg_mem);
         return;
 
  cs_failed:
@@ -671,6 +721,7 @@ void serial_config(dev_link_t * link)
  failed:
         serial_remove(link);
         link->state &= ~DEV_CONFIG_PENDING;
+        kfree(cfg_mem);
 }
 
 /*======================================================================
diff --git a/drivers/serial/sn_console.c b/drivers/serial/sn_console.c
index ffaab9b90fd8..fee6418e84c4 100644
--- a/drivers/serial/sn_console.c
+++ b/drivers/serial/sn_console.c
@@ -787,7 +787,7 @@ static void __init sn_sal_switch_to_interrupts(struct sn_cons_port *port)
 
 static void sn_sal_console_write(struct console *, const char *, unsigned);
 static int __init sn_sal_console_setup(struct console *, char *);
-extern struct uart_driver sal_console_uart;
+static struct uart_driver sal_console_uart;
 extern struct tty_driver *uart_console_device(struct console *, int *);
 
 static struct console sal_console = {
@@ -801,7 +801,7 @@ static struct console sal_console = {
 
 #define SAL_CONSOLE     &sal_console
 
-struct uart_driver sal_console_uart = {
+static struct uart_driver sal_console_uart = {
         .owner = THIS_MODULE,
         .driver_name = "sn_console",
         .dev_name = DEVICE_NAME,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 2a1c5965de22..6be8fbec0a0e 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -198,6 +198,14 @@ config FB_SA1100
           If you plan to use the LCD display with your SA-1100 system, say
           Y here.
 
+config FB_IMX
+        tristate "Motorola i.MX LCD support"
+        depends on FB && ARM && ARCH_IMX
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
+        select FB_SOFT_CURSOR
+
 config FB_CYBER2000
         tristate "CyberPro 2000/2010/5000 support"
         depends on FB && PCI && (BROKEN || !SPARC64)
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 92265b741dc3..bd8dc0ffe723 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -90,6 +90,7 @@ obj-$(CONFIG_FB_PMAGB_B)	  += pmagb-b-fb.o
 obj-$(CONFIG_FB_MAXINE)           += maxinefb.o
 obj-$(CONFIG_FB_TX3912)           += tx3912fb.o
 obj-$(CONFIG_FB_S1D13XXX)         += s1d13xxxfb.o
+obj-$(CONFIG_FB_IMX)              += imxfb.o
 
 # Platform or fallback drivers go here
 obj-$(CONFIG_FB_VESA)             += vesafb.o
diff --git a/drivers/video/amba-clcd.c b/drivers/video/amba-clcd.c
index acdba0c67fb8..321dbe91dc14 100644
--- a/drivers/video/amba-clcd.c
+++ b/drivers/video/amba-clcd.c
@@ -125,28 +125,28 @@ clcdfb_set_bitfields(struct clcd_fb *fb, struct fb_var_screeninfo *var)
         case 2:
         case 4:
         case 8:
-                var->red.length         = 8;
+                var->red.length         = var->bits_per_pixel;
                 var->red.offset         = 0;
-                var->green.length       = 8;
+                var->green.length       = var->bits_per_pixel;
                 var->green.offset       = 0;
-                var->blue.length        = 8;
+                var->blue.length        = var->bits_per_pixel;
                 var->blue.offset        = 0;
                 break;
         case 16:
                 var->red.length         = 5;
-                var->green.length       = 5;
+                var->green.length       = 6;
                 var->blue.length        = 5;
                 if (fb->panel->cntl & CNTL_BGR) {
-                        var->red.offset         = 10;
+                        var->red.offset         = 11;
                         var->green.offset       = 5;
                         var->blue.offset        = 0;
                 } else {
                         var->red.offset         = 0;
                         var->green.offset       = 5;
-                        var->blue.offset        = 10;
+                        var->blue.offset        = 11;
                 }
                 break;
-        case 24:
+        case 32:
                 if (fb->panel->cntl & CNTL_LCDTFT) {
                         var->red.length         = 8;
                         var->green.length       = 8;
@@ -178,6 +178,12 @@ static int clcdfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 
         if (fb->board->check)
                 ret = fb->board->check(fb, var);
+
+        if (ret == 0 &&
+            var->xres_virtual * var->bits_per_pixel / 8 *
+            var->yres_virtual > fb->fb.fix.smem_len)
+                ret = -EINVAL;
+
         if (ret == 0)
                 ret = clcdfb_set_bitfields(fb, var);
 
@@ -250,7 +256,7 @@ clcdfb_setcolreg(unsigned int regno, unsigned int red, unsigned int green,
                                   convert_bitfield(green, &fb->fb.var.green) |
                                   convert_bitfield(red, &fb->fb.var.red);
 
-        if (fb->fb.var.bits_per_pixel == 8 && regno < 256) {
+        if (fb->fb.fix.visual == FB_VISUAL_PSEUDOCOLOR && regno < 256) {
                 int hw_reg = CLCD_PALETTE + ((regno * 2) & ~3);
                 u32 val, mask, newval;
 
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index e8eb124754b1..ee25b9e8db60 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -1057,13 +1057,14 @@ static int radeonfb_blank (int blank, struct fb_info *info)
         return radeon_screen_blank(rinfo, blank, 0);
 }
 
-static int radeonfb_setcolreg (unsigned regno, unsigned red, unsigned green,
-                             unsigned blue, unsigned transp, struct fb_info *info)
+static int radeon_setcolreg (unsigned regno, unsigned red, unsigned green,
+                             unsigned blue, unsigned transp,
+                             struct radeonfb_info *rinfo)
 {
-        struct radeonfb_info *rinfo = info->par;
         u32 pindex;
         unsigned int i;
-        
+
+
         if (regno > 255)
                 return 1;
 
@@ -1078,20 +1079,7 @@ static int radeonfb_setcolreg (unsigned regno, unsigned red, unsigned green,
         pindex = regno;
 
         if (!rinfo->asleep) {
-                u32 dac_cntl2, vclk_cntl = 0;
-                
                 radeon_fifo_wait(9);
-                if (rinfo->is_mobility) {
-                        vclk_cntl = INPLL(VCLK_ECP_CNTL);
-                        OUTPLL(VCLK_ECP_CNTL, vclk_cntl & ~PIXCLK_DAC_ALWAYS_ONb);
-                }
-
-                /* Make sure we are on first palette */
-                if (rinfo->has_CRTC2) {
-                        dac_cntl2 = INREG(DAC_CNTL2);
-                        dac_cntl2 &= ~DAC2_PALETTE_ACCESS_CNTL;
-                        OUTREG(DAC_CNTL2, dac_cntl2);
-                }
 
                 if (rinfo->bpp == 16) {
                         pindex = regno * 8;
@@ -1101,24 +1089,27 @@ static int radeonfb_setcolreg (unsigned regno, unsigned red, unsigned green,
                         if (rinfo->depth == 15 && regno > 31)
                                 return 1;
 
-                        /* For 565, the green component is mixed one order below */
+                        /* For 565, the green component is mixed one order
+                         * below
+                         */
                         if (rinfo->depth == 16) {
                                 OUTREG(PALETTE_INDEX, pindex>>1);
-                                OUTREG(PALETTE_DATA, (rinfo->palette[regno>>1].red << 16) |
-                                        (green << 8) | (rinfo->palette[regno>>1].blue));
+                                OUTREG(PALETTE_DATA,
+                                       (rinfo->palette[regno>>1].red << 16) |
+                                        (green << 8) |
+                                       (rinfo->palette[regno>>1].blue));
                                 green = rinfo->palette[regno<<1].green;
                         }
                 }
 
                 if (rinfo->depth != 16 || regno < 32) {
                         OUTREG(PALETTE_INDEX, pindex);
-                        OUTREG(PALETTE_DATA, (red << 16) | (green << 8) | blue);
+                        OUTREG(PALETTE_DATA, (red << 16) |
+                               (green << 8) | blue);
                 }
-                if (rinfo->is_mobility)
-                        OUTPLL(VCLK_ECP_CNTL, vclk_cntl);
         }
         if (regno < 16) {
-                u32 *pal = info->pseudo_palette;
+                u32 *pal = rinfo->info->pseudo_palette;
                 switch (rinfo->depth) {
                 case 15:
                         pal[regno] = (regno << 10) | (regno << 5) | regno;
@@ -1138,6 +1129,84 @@ static int radeonfb_setcolreg (unsigned regno, unsigned red, unsigned green,
         return 0;
 }
 
+static int radeonfb_setcolreg (unsigned regno, unsigned red, unsigned green,
+                               unsigned blue, unsigned transp,
+                               struct fb_info *info)
+{
+        struct radeonfb_info *rinfo = info->par;
+        u32 dac_cntl2, vclk_cntl = 0;
+        int rc;
+
+        if (!rinfo->asleep) {
+                if (rinfo->is_mobility) {
+                        vclk_cntl = INPLL(VCLK_ECP_CNTL);
+                        OUTPLL(VCLK_ECP_CNTL,
+                               vclk_cntl & ~PIXCLK_DAC_ALWAYS_ONb);
+                }
+
+                /* Make sure we are on first palette */
+                if (rinfo->has_CRTC2) {
+                        dac_cntl2 = INREG(DAC_CNTL2);
+                        dac_cntl2 &= ~DAC2_PALETTE_ACCESS_CNTL;
+                        OUTREG(DAC_CNTL2, dac_cntl2);
+                }
+        }
+
+        rc = radeon_setcolreg (regno, red, green, blue, transp, rinfo);
+
+        if (!rinfo->asleep && rinfo->is_mobility)
+                OUTPLL(VCLK_ECP_CNTL, vclk_cntl);
+
+        return rc;
+}
+
+static int radeonfb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
+{
+        struct radeonfb_info *rinfo = info->par;
+        u16 *red, *green, *blue, *transp;
+        u32 dac_cntl2, vclk_cntl = 0;
+        int i, start, rc = 0;
+
+        if (!rinfo->asleep) {
+                if (rinfo->is_mobility) {
+                        vclk_cntl = INPLL(VCLK_ECP_CNTL);
+                        OUTPLL(VCLK_ECP_CNTL,
+                               vclk_cntl & ~PIXCLK_DAC_ALWAYS_ONb);
+                }
+
+                /* Make sure we are on first palette */
+                if (rinfo->has_CRTC2) {
+                        dac_cntl2 = INREG(DAC_CNTL2);
+                        dac_cntl2 &= ~DAC2_PALETTE_ACCESS_CNTL;
+                        OUTREG(DAC_CNTL2, dac_cntl2);
+                }
+        }
+
+        red = cmap->red;
+        green = cmap->green;
+        blue = cmap->blue;
+        transp = cmap->transp;
+        start = cmap->start;
+
+        for (i = 0; i < cmap->len; i++) {
+                u_int hred, hgreen, hblue, htransp = 0xffff;
+
+                hred = *red++;
+                hgreen = *green++;
+                hblue = *blue++;
+                if (transp)
+                        htransp = *transp++;
+                rc = radeon_setcolreg (start++, hred, hgreen, hblue, htransp,
+                                       rinfo);
+                if (rc)
+                        break;
+        }
+
+        if (!rinfo->asleep && rinfo->is_mobility)
+                OUTPLL(VCLK_ECP_CNTL, vclk_cntl);
+
+        return rc;
+}
 
 static void radeon_save_state (struct radeonfb_info *rinfo,
                                struct radeon_regs *save)
@@ -1796,6 +1865,7 @@ static struct fb_ops radeonfb_ops = {
         .fb_check_var           = radeonfb_check_var,
         .fb_set_par             = radeonfb_set_par,
         .fb_setcolreg           = radeonfb_setcolreg,
+        .fb_setcmap             = radeonfb_setcmap,
         .fb_pan_display         = radeonfb_pan_display,
         .fb_blank               = radeonfb_blank,
         .fb_ioctl               = radeonfb_ioctl,
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 59e3b4b4e7e3..b209adbd508a 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -906,10 +906,13 @@ static void fbcon_init(struct vc_data *vc, int init)
         struct vc_data *svc = *default_mode;
         struct display *t, *p = &fb_display[vc->vc_num];
         int logo = 1, new_rows, new_cols, rows, cols, charcnt = 256;
-        int cap = info->flags;
+        int cap;
 
         if (info_idx == -1 || info == NULL)
             return;
+
+        cap = info->flags;
+
         if (vc != svc || logo_shown == FBCON_LOGO_DONTSHOW ||
             (info->fix.type == FB_TYPE_TEXT))
                 logo = 0;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 7d1ae06667c6..bcf59b28a14f 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -337,6 +337,8 @@ static void vgacon_init(struct vc_data *c, int init)
         c->vc_scan_lines = vga_scan_lines;
         c->vc_font.height = vga_video_font_height;
         c->vc_complement_mask = 0x7700;
+        if (vga_512_chars)
+                c->vc_hi_font_mask = 0x0800;
         p = *c->vc_uni_pagedir_loc;
         if (c->vc_uni_pagedir_loc == &c->vc_uni_pagedir ||
             !--c->vc_uni_pagedir_loc[1])
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/cyber2000fb.c
index 8b1b7c687a99..3894b2a501d6 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/cyber2000fb.c
@@ -90,6 +90,8 @@ struct cfb_info {
          */
         u_char                  ramdac_ctrl;
         u_char                  ramdac_powerdown;
+
+        u32                     pseudo_palette[16];
 };
 
 static char *default_font = "Acorn8x8";
@@ -1223,9 +1225,7 @@ cyberpro_alloc_fb_info(unsigned int id, char *name)
 {
         struct cfb_info *cfb;
 
-        cfb = kmalloc(sizeof(struct cfb_info) +
-                       sizeof(u32) * 16, GFP_KERNEL);
-
+        cfb = kmalloc(sizeof(struct cfb_info), GFP_KERNEL);
         if (!cfb)
                 return NULL;
 
@@ -1281,7 +1281,7 @@ cyberpro_alloc_fb_info(unsigned int id, char *name)
 
         cfb->fb.fbops           = &cyber2000fb_ops;
         cfb->fb.flags           = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN;
-        cfb->fb.pseudo_palette  = (void *)(cfb + 1);
+        cfb->fb.pseudo_palette  = cfb->pseudo_palette;
 
         fb_alloc_cmap(&cfb->fb.cmap, NR_PALETTE, 0);
 
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index c51f8fb5c1de..4e5ce8f7d65e 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -222,8 +222,11 @@ int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
         transp = cmap->transp;
         start = cmap->start;
 
-        if (start < 0 || !info->fbops->fb_setcolreg)
+        if (start < 0 || (!info->fbops->fb_setcolreg &&
+                          !info->fbops->fb_setcmap))
                 return -EINVAL;
+        if (info->fbops->fb_setcmap)
+                return info->fbops->fb_setcmap(cmap, info);
         for (i = 0; i < cmap->len; i++) {
                 hred = *red++;
                 hgreen = *green++;
@@ -250,8 +253,33 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
         transp = cmap->transp;
         start = cmap->start;
 
-        if (start < 0 || !info->fbops->fb_setcolreg)
+        if (start < 0 || (!info->fbops->fb_setcolreg &&
+                          !info->fbops->fb_setcmap))
                 return -EINVAL;
+
+        /* If we can batch, do it */
+        if (info->fbops->fb_setcmap && cmap->len > 1) {
+                struct fb_cmap umap;
+                int size = cmap->len * sizeof(u16);
+                int rc;
+
+                memset(&umap, 0, sizeof(struct fb_cmap));
+                rc = fb_alloc_cmap(&umap, cmap->len, transp != NULL);
+                if (rc)
+                        return rc;
+                if (copy_from_user(umap.red, red, size) ||
+                    copy_from_user(umap.green, green, size) ||
+                    copy_from_user(umap.blue, blue, size) ||
+                    (transp && copy_from_user(umap.transp, transp, size))) {
+                        rc = -EFAULT;
+                }
+                umap.start = start;
+                if (rc == 0)
+                        rc = info->fbops->fb_setcmap(&umap, info);
+                fb_dealloc_cmap(&umap);
+                return rc;
+        }
+
         for (i = 0; i < cmap->len; i++, red++, blue++, green++) {
                 if (get_user(hred, red) ||
                     get_user(hgreen, green) ||
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 25f460ca0daf..208a68ceb63b 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1257,6 +1257,8 @@ int fb_new_modelist(struct fb_info *info)
 static char *video_options[FB_MAX];
 static int ofonly;
 
+extern const char *global_mode_option;
+
 /**
  * fb_get_options - get kernel boot parameters
  * @name:   framebuffer name as it would appear in
@@ -1297,9 +1299,6 @@ int fb_get_options(char *name, char **option)
         return retval;
 }
 
-
-extern const char *global_mode_option;
-
 /**
  *      video_setup - process command line options
  *      @options: string of options
diff --git a/drivers/video/fbmon.c b/drivers/video/fbmon.c
index 978def013587..6cd1976548d4 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbmon.c
@@ -34,7 +34,6 @@
 #include <asm/prom.h>
 #include <asm/pci-bridge.h>
 #endif
-#include <video/edid.h>
 #include "edid.h"
 
 /* 
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index 9ec8781794c0..e04d3e8b2549 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -999,8 +999,14 @@ static int i810_check_params(struct fb_var_screeninfo *var,
         info->monspecs.dclkmin = 15000000;
 
         if (fb_validate_mode(var, info)) {
-                if (fb_get_mode(FB_MAXTIMINGS, 0, var, info))
+                if (fb_get_mode(FB_MAXTIMINGS, 0, var, info)) {
+                        int default_sync = (hsync1-HFMIN)|(hsync2-HFMAX)
+                                            |(vsync1-VFMIN)|(vsync2-VFMAX);
+                        printk("i810fb: invalid video mode%s\n",
+                            default_sync ? "" :
+                            ". Specifying vsyncN/hsyncN parameters may help");
                         return -EINVAL;
+                }
         }
         
         var->xres = xres;
@@ -2023,10 +2029,10 @@ MODULE_PARM_DESC(vyres, "Virtual vertical resolution in scanlines"
                  " (default = 480)");
 module_param(hsync1, int, 0);
 MODULE_PARM_DESC(hsync1, "Minimum horizontal frequency of monitor in KHz"
-                 " (default = 31)");
+                 " (default = 29)");
 module_param(hsync2, int, 0);
 MODULE_PARM_DESC(hsync2, "Maximum horizontal frequency of monitor in KHz"
-                 " (default = 31)");
+                 " (default = 30)");
 module_param(vsync1, int, 0);
 MODULE_PARM_DESC(vsync1, "Minimum vertical frequency of monitor in Hz"
                  " (default = 50)");
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
new file mode 100644
index 000000000000..8fe1c12a17bd
--- /dev/null
+++ b/drivers/video/imxfb.c
@@ -0,0 +1,695 @@
+/*
+ *  linux/drivers/video/imxfb.c
+ *
+ *  Freescale i.MX Frame Buffer device driver
+ *
+ *  Copyright (C) 2004 Sascha Hauer, Pengutronix
+ *   Based on acornfb.c Copyright (C) Russell King.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive for
+ * more details.
+ *
+ * Please direct your questions and comments on this driver to the following
+ * email address:
+ *
+ *      linux-arm-kernel@lists.arm.linux.org.uk
+ */
+
+//#define DEBUG 1
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+#include <linux/fb.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/cpufreq.h>
+#include <linux/device.h>
+#include <linux/dma-mapping.h>
+
+#include <asm/hardware.h>
+#include <asm/io.h>
+#include <asm/mach-types.h>
+#include <asm/uaccess.h>
+#include <asm/arch/imxfb.h>
+
+/*
+ * Complain if VAR is out of range.
+ */
+#define DEBUG_VAR 1
+
+#include "imxfb.h"
+
+static struct imxfb_rgb def_rgb_16 = {
+        .red    = { .offset = 8,  .length = 4, },
+        .green  = { .offset = 4,  .length = 4, },
+        .blue   = { .offset = 0,  .length = 4, },
+        .transp = { .offset = 0,  .length = 0, },
+};
+
+static struct imxfb_rgb def_rgb_8 = {
+        .red    = { .offset = 0,  .length = 8, },
+        .green  = { .offset = 0,  .length = 8, },
+        .blue   = { .offset = 0,  .length = 8, },
+        .transp = { .offset = 0,  .length = 0, },
+};
+
+static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *info);
+
+static inline u_int chan_to_field(u_int chan, struct fb_bitfield *bf)
+{
+        chan &= 0xffff;
+        chan >>= 16 - bf->length;
+        return chan << bf->offset;
+}
+
+#define LCDC_PALETTE(x) __REG2(IMX_LCDC_BASE+0x800, (x)<<2)
+static int
+imxfb_setpalettereg(u_int regno, u_int red, u_int green, u_int blue,
+                       u_int trans, struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+        u_int val, ret = 1;
+
+#define CNVT_TOHW(val,width) ((((val)<<(width))+0x7FFF-(val))>>16)
+        if (regno < fbi->palette_size) {
+                val = (CNVT_TOHW(red, 4) << 8) |
+                      (CNVT_TOHW(green,4) << 4) |
+                      CNVT_TOHW(blue,  4);
+
+                LCDC_PALETTE(regno) = val;
+                ret = 0;
+        }
+        return ret;
+}
+
+static int
+imxfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
+                   u_int trans, struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+        unsigned int val;
+        int ret = 1;
+
+        /*
+         * If inverse mode was selected, invert all the colours
+         * rather than the register number.  The register number
+         * is what you poke into the framebuffer to produce the
+         * colour you requested.
+         */
+        if (fbi->cmap_inverse) {
+                red   = 0xffff - red;
+                green = 0xffff - green;
+                blue  = 0xffff - blue;
+        }
+
+        /*
+         * If greyscale is true, then we convert the RGB value
+         * to greyscale no mater what visual we are using.
+         */
+        if (info->var.grayscale)
+                red = green = blue = (19595 * red + 38470 * green +
+                                        7471 * blue) >> 16;
+
+        switch (info->fix.visual) {
+        case FB_VISUAL_TRUECOLOR:
+                /*
+                 * 12 or 16-bit True Colour.  We encode the RGB value
+                 * according to the RGB bitfield information.
+                 */
+                if (regno < 16) {
+                        u32 *pal = info->pseudo_palette;
+
+                        val  = chan_to_field(red, &info->var.red);
+                        val |= chan_to_field(green, &info->var.green);
+                        val |= chan_to_field(blue, &info->var.blue);
+
+                        pal[regno] = val;
+                        ret = 0;
+                }
+                break;
+
+        case FB_VISUAL_STATIC_PSEUDOCOLOR:
+        case FB_VISUAL_PSEUDOCOLOR:
+                ret = imxfb_setpalettereg(regno, red, green, blue, trans, info);
+                break;
+        }
+
+        return ret;
+}
+
+/*
+ *  imxfb_check_var():
+ *    Round up in the following order: bits_per_pixel, xres,
+ *    yres, xres_virtual, yres_virtual, xoffset, yoffset, grayscale,
+ *    bitfields, horizontal timing, vertical timing.
+ */
+static int
+imxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+        int rgbidx;
+
+        if (var->xres < MIN_XRES)
+                var->xres = MIN_XRES;
+        if (var->yres < MIN_YRES)
+                var->yres = MIN_YRES;
+        if (var->xres > fbi->max_xres)
+                var->xres = fbi->max_xres;
+        if (var->yres > fbi->max_yres)
+                var->yres = fbi->max_yres;
+        var->xres_virtual = max(var->xres_virtual, var->xres);
+        var->yres_virtual = max(var->yres_virtual, var->yres);
+
+        pr_debug("var->bits_per_pixel=%d\n", var->bits_per_pixel);
+        switch (var->bits_per_pixel) {
+        case 16:
+                rgbidx = RGB_16;
+                break;
+        case 8:
+                rgbidx = RGB_8;
+                break;
+        default:
+                rgbidx = RGB_16;
+        }
+
+        /*
+         * Copy the RGB parameters for this display
+         * from the machine specific parameters.
+         */
+        var->red    = fbi->rgb[rgbidx]->red;
+        var->green  = fbi->rgb[rgbidx]->green;
+        var->blue   = fbi->rgb[rgbidx]->blue;
+        var->transp = fbi->rgb[rgbidx]->transp;
+
+        pr_debug("RGBT length = %d:%d:%d:%d\n",
+                var->red.length, var->green.length, var->blue.length,
+                var->transp.length);
+
+        pr_debug("RGBT offset = %d:%d:%d:%d\n",
+                var->red.offset, var->green.offset, var->blue.offset,
+                var->transp.offset);
+
+        return 0;
+}
+
+/*
+ * imxfb_set_par():
+ *      Set the user defined part of the display for the specified console
+ */
+static int imxfb_set_par(struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+        struct fb_var_screeninfo *var = &info->var;
+
+        pr_debug("set_par\n");
+
+        if (var->bits_per_pixel == 16)
+                info->fix.visual = FB_VISUAL_TRUECOLOR;
+        else if (!fbi->cmap_static)
+                info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
+        else {
+                /*
+                 * Some people have weird ideas about wanting static
+                 * pseudocolor maps.  I suspect their user space
+                 * applications are broken.
+                 */
+                info->fix.visual = FB_VISUAL_STATIC_PSEUDOCOLOR;
+        }
+
+        info->fix.line_length = var->xres_virtual *
+                                  var->bits_per_pixel / 8;
+        fbi->palette_size = var->bits_per_pixel == 8 ? 256 : 16;
+
+        imxfb_activate_var(var, info);
+
+        return 0;
+}
+
+static void imxfb_enable_controller(struct imxfb_info *fbi)
+{
+        pr_debug("Enabling LCD controller\n");
+
+        /* initialize LCDC */
+        LCDC_RMCR &= ~RMCR_LCDC_EN;             /* just to be safe... */
+
+        LCDC_SSA        = fbi->screen_dma;
+        /* physical screen start address            */
+        LCDC_VPW        = VPW_VPW(fbi->max_xres * fbi->max_bpp / 8 / 4);
+
+        LCDC_POS        = 0x00000000;   /* panning offset 0 (0 pixel offset)        */
+
+        /* disable hardware cursor */
+        LCDC_CPOS       &= ~(CPOS_CC0 | CPOS_CC1);
+
+        /* fixed burst length (see erratum 11) */
+        LCDC_DMACR = DMACR_BURST | DMACR_HM(8) | DMACR_TM(2);
+
+        LCDC_RMCR = RMCR_LCDC_EN;
+
+        if(fbi->backlight_power)
+                fbi->backlight_power(1);
+        if(fbi->lcd_power)
+                fbi->lcd_power(1);
+}
+
+static void imxfb_disable_controller(struct imxfb_info *fbi)
+{
+        pr_debug("Disabling LCD controller\n");
+
+        if(fbi->backlight_power)
+                fbi->backlight_power(0);
+        if(fbi->lcd_power)
+                fbi->lcd_power(0);
+
+        LCDC_RMCR = 0;
+}
+
+static int imxfb_blank(int blank, struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+
+        pr_debug("imxfb_blank: blank=%d\n", blank);
+
+        switch (blank) {
+        case FB_BLANK_POWERDOWN:
+        case FB_BLANK_VSYNC_SUSPEND:
+        case FB_BLANK_HSYNC_SUSPEND:
+        case FB_BLANK_NORMAL:
+                imxfb_disable_controller(fbi);
+                break;
+
+        case FB_BLANK_UNBLANK:
+                imxfb_enable_controller(fbi);
+                break;
+        }
+        return 0;
+}
+
+static struct fb_ops imxfb_ops = {
+        .owner          = THIS_MODULE,
+        .fb_check_var   = imxfb_check_var,
+        .fb_set_par     = imxfb_set_par,
+        .fb_setcolreg   = imxfb_setcolreg,
+        .fb_fillrect    = cfb_fillrect,
+        .fb_copyarea    = cfb_copyarea,
+        .fb_imageblit   = cfb_imageblit,
+        .fb_blank       = imxfb_blank,
+        .fb_cursor      = soft_cursor, /* FIXME: i.MX can do hardware cursor */
+};
+
+/*
+ * imxfb_activate_var():
+ *      Configures LCD Controller based on entries in var parameter.  Settings are
+ *      only written to the controller if changes were made.
+ */
+static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+        pr_debug("var: xres=%d hslen=%d lm=%d rm=%d\n",
+                var->xres, var->hsync_len,
+                var->left_margin, var->right_margin);
+        pr_debug("var: yres=%d vslen=%d um=%d bm=%d\n",
+                var->yres, var->vsync_len,
+                var->upper_margin, var->lower_margin);
+
+#if DEBUG_VAR
+        if (var->xres < 16        || var->xres > 1024)
+                printk(KERN_ERR "%s: invalid xres %d\n",
+                        info->fix.id, var->xres);
+        if (var->hsync_len < 1    || var->hsync_len > 64)
+                printk(KERN_ERR "%s: invalid hsync_len %d\n",
+                        info->fix.id, var->hsync_len);
+        if (var->left_margin > 255)
+                printk(KERN_ERR "%s: invalid left_margin %d\n",
+                        info->fix.id, var->left_margin);
+        if (var->right_margin > 255)
+                printk(KERN_ERR "%s: invalid right_margin %d\n",
+                        info->fix.id, var->right_margin);
+        if (var->yres < 1 || var->yres > 511)
+                printk(KERN_ERR "%s: invalid yres %d\n",
+                        info->fix.id, var->yres);
+        if (var->vsync_len > 100)
+                printk(KERN_ERR "%s: invalid vsync_len %d\n",
+                        info->fix.id, var->vsync_len);
+        if (var->upper_margin > 63)
+                printk(KERN_ERR "%s: invalid upper_margin %d\n",
+                        info->fix.id, var->upper_margin);
+        if (var->lower_margin > 255)
+                printk(KERN_ERR "%s: invalid lower_margin %d\n",
+                        info->fix.id, var->lower_margin);
+#endif
+
+        LCDC_HCR        = HCR_H_WIDTH(var->hsync_len) |
+                          HCR_H_WAIT_1(var->left_margin) |
+                          HCR_H_WAIT_2(var->right_margin);
+
+        LCDC_VCR        = VCR_V_WIDTH(var->vsync_len) |
+                          VCR_V_WAIT_1(var->upper_margin) |
+                          VCR_V_WAIT_2(var->lower_margin);
+
+        LCDC_SIZE       = SIZE_XMAX(var->xres) | SIZE_YMAX(var->yres);
+        LCDC_PCR        = fbi->pcr;
+        LCDC_PWMR       = fbi->pwmr;
+        LCDC_LSCR1      = fbi->lscr1;
+
+        return 0;
+}
+
+static void imxfb_setup_gpio(struct imxfb_info *fbi)
+{
+        int width;
+
+        LCDC_RMCR       &= ~(RMCR_LCDC_EN | RMCR_SELF_REF);
+
+        if( fbi->pcr & PCR_TFT )
+                width = 16;
+        else
+                width = 1 << ((fbi->pcr >> 28) & 0x3);
+
+        switch(width) {
+        case 16:
+                imx_gpio_mode(PD30_PF_LD15);
+                imx_gpio_mode(PD29_PF_LD14);
+                imx_gpio_mode(PD28_PF_LD13);
+                imx_gpio_mode(PD27_PF_LD12);
+                imx_gpio_mode(PD26_PF_LD11);
+                imx_gpio_mode(PD25_PF_LD10);
+                imx_gpio_mode(PD24_PF_LD9);
+                imx_gpio_mode(PD23_PF_LD8);
+        case 8:
+                imx_gpio_mode(PD22_PF_LD7);
+                imx_gpio_mode(PD21_PF_LD6);
+                imx_gpio_mode(PD20_PF_LD5);
+                imx_gpio_mode(PD19_PF_LD4);
+        case 4:
+                imx_gpio_mode(PD18_PF_LD3);
+                imx_gpio_mode(PD17_PF_LD2);
+        case 2:
+                imx_gpio_mode(PD16_PF_LD1);
+        case 1:
+                imx_gpio_mode(PD15_PF_LD0);
+        }
+
+        /* initialize GPIOs */
+        imx_gpio_mode(PD6_PF_LSCLK);
+        imx_gpio_mode(PD10_PF_SPL_SPR);
+        imx_gpio_mode(PD11_PF_CONTRAST);
+        imx_gpio_mode(PD14_PF_FLM_VSYNC);
+        imx_gpio_mode(PD13_PF_LP_HSYNC);
+        imx_gpio_mode(PD7_PF_REV);
+        imx_gpio_mode(PD8_PF_CLS);
+
+#ifndef CONFIG_MACH_PIMX1
+        /* on PiMX1 used as buffers enable signal
+         */
+        imx_gpio_mode(PD9_PF_PS);
+#endif
+
+#ifndef CONFIG_MACH_MX1FS2
+        /* on mx1fs2 this pin is used to (de)activate the display, so we need
+         * it as a normal gpio
+         */
+        imx_gpio_mode(PD12_PF_ACD_OE);
+#endif
+
+}
+
+#ifdef CONFIG_PM
+/*
+ * Power management hooks.  Note that we won't be called from IRQ context,
+ * unlike the blank functions above, so we may sleep.
+ */
+static int imxfb_suspend(struct device *dev, u32 state, u32 level)
+{
+        struct imxfb_info *fbi = dev_get_drvdata(dev);
+        pr_debug("%s\n",__FUNCTION__);
+
+        if (level == SUSPEND_DISABLE || level == SUSPEND_POWER_DOWN)
+                imxfb_disable_controller(fbi);
+        return 0;
+}
+
+static int imxfb_resume(struct device *dev, u32 level)
+{
+        struct imxfb_info *fbi = dev_get_drvdata(dev);
+        pr_debug("%s\n",__FUNCTION__);
+
+        if (level == RESUME_ENABLE)
+                imxfb_enable_controller(fbi);
+        return 0;
+}
+#else
+#define imxfb_suspend   NULL
+#define imxfb_resume    NULL
+#endif
+
+static int __init imxfb_init_fbinfo(struct device *dev)
+{
+        struct imxfb_mach_info *inf = dev->platform_data;
+        struct fb_info *info = dev_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
+
+        pr_debug("%s\n",__FUNCTION__);
+
+        info->pseudo_palette = kmalloc( sizeof(u32) * 16, GFP_KERNEL);
+        if (!info->pseudo_palette)
+                return -ENOMEM;
+
+        memset(fbi, 0, sizeof(struct imxfb_info));
+        fbi->dev = dev;
+
+        strlcpy(info->fix.id, IMX_NAME, sizeof(info->fix.id));
+
+        info->fix.type  = FB_TYPE_PACKED_PIXELS;
+        info->fix.type_aux              = 0;
+        info->fix.xpanstep              = 0;
+        info->fix.ypanstep              = 0;
+        info->fix.ywrapstep             = 0;
+        info->fix.accel = FB_ACCEL_NONE;
+
+        info->var.nonstd                = 0;
+        info->var.activate              = FB_ACTIVATE_NOW;
+        info->var.height                = -1;
+        info->var.width = -1;
+        info->var.accel_flags           = 0;
+        info->var.vmode = FB_VMODE_NONINTERLACED;
+
+        info->fbops                     = &imxfb_ops;
+        info->flags                     = FBINFO_FLAG_DEFAULT;
+        info->pseudo_palette            = (fbi + 1);
+
+        fbi->rgb[RGB_16]                = &def_rgb_16;
+        fbi->rgb[RGB_8]                 = &def_rgb_8;
+
+        fbi->max_xres                   = inf->xres;
+        info->var.xres                  = inf->xres;
+        info->var.xres_virtual          = inf->xres;
+        fbi->max_yres                   = inf->yres;
+        info->var.yres                  = inf->yres;
+        info->var.yres_virtual          = inf->yres;
+        fbi->max_bpp                    = inf->bpp;
+        info->var.bits_per_pixel        = inf->bpp;
+        info->var.pixclock              = inf->pixclock;
+        info->var.hsync_len             = inf->hsync_len;
+        info->var.left_margin           = inf->left_margin;
+        info->var.right_margin          = inf->right_margin;
+        info->var.vsync_len             = inf->vsync_len;
+        info->var.upper_margin          = inf->upper_margin;
+        info->var.lower_margin          = inf->lower_margin;
+        info->var.sync                  = inf->sync;
+        info->var.grayscale             = inf->cmap_greyscale;
+        fbi->cmap_inverse               = inf->cmap_inverse;
+        fbi->pcr                        = inf->pcr;
+        fbi->lscr1                      = inf->lscr1;
+        fbi->pwmr                       = inf->pwmr;
+        fbi->lcd_power                  = inf->lcd_power;
+        fbi->backlight_power            = inf->backlight_power;
+        info->fix.smem_len              = fbi->max_xres * fbi->max_yres *
+                                          fbi->max_bpp / 8;
+
+        return 0;
+}
+
+/*
+ *      Allocates the DRAM memory for the frame buffer.  This buffer is
+ *      remapped into a non-cached, non-buffered, memory region to
+ *      allow pixel writes to occur without flushing the cache.
+ *      Once this area is remapped, all virtual memory access to the
+ *      video memory should occur at the new region.
+ */
+static int __init imxfb_map_video_memory(struct fb_info *info)
+{
+        struct imxfb_info *fbi = info->par;
+
+        fbi->map_size = PAGE_ALIGN(info->fix.smem_len);
+        fbi->map_cpu = dma_alloc_writecombine(fbi->dev, fbi->map_size,
+                                        &fbi->map_dma,GFP_KERNEL);
+
+        if (fbi->map_cpu) {
+                info->screen_base = fbi->map_cpu;
+                fbi->screen_cpu = fbi->map_cpu;
+                fbi->screen_dma = fbi->map_dma;
+                info->fix.smem_start = fbi->screen_dma;
+        }
+
+        return fbi->map_cpu ? 0 : -ENOMEM;
+}
+
+static int __init imxfb_probe(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct imxfb_info *fbi;
+        struct fb_info *info;
+        struct imxfb_mach_info *inf;
+        struct resource *res;
+        int ret;
+
+        printk("i.MX Framebuffer driver\n");
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if(!res)
+                return -ENODEV;
+
+        inf = dev->platform_data;
+        if(!inf) {
+                dev_err(dev,"No platform_data available\n");
+                return -ENOMEM;
+        }
+
+        info = framebuffer_alloc(sizeof(struct imxfb_info), dev);
+        if(!info)
+                return -ENOMEM;
+
+        fbi = info->par;
+
+        dev_set_drvdata(dev, info);
+
+        ret = imxfb_init_fbinfo(dev);
+        if( ret < 0 )
+                goto failed_init;
+
+        res = request_mem_region(res->start, res->end - res->start + 1, "IMXFB");
+        if (!res) {
+                ret = -EBUSY;
+                goto failed_regs;
+        }
+
+        if (!inf->fixed_screen_cpu) {
+                ret = imxfb_map_video_memory(info);
+                if (ret) {
+                        dev_err(dev, "Failed to allocate video RAM: %d\n", ret);
+                        ret = -ENOMEM;
+                        goto failed_map;
+                }
+        } else {
+                /* Fixed framebuffer mapping enables location of the screen in eSRAM */
+                fbi->map_cpu = inf->fixed_screen_cpu;
+                fbi->map_dma = inf->fixed_screen_dma;
+                info->screen_base = fbi->map_cpu;
+                fbi->screen_cpu = fbi->map_cpu;
+                fbi->screen_dma = fbi->map_dma;
+                info->fix.smem_start = fbi->screen_dma;
+        }
+
+        /*
+         * This makes sure that our colour bitfield
+         * descriptors are correctly initialised.
+         */
+        imxfb_check_var(&info->var, info);
+
+        ret = fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
+        if (ret < 0)
+                goto failed_cmap;
+
+        imxfb_setup_gpio(fbi);
+
+        imxfb_set_par(info);
+        ret = register_framebuffer(info);
+        if (ret < 0) {
+                dev_err(dev, "failed to register framebuffer\n");
+                goto failed_register;
+        }
+
+        imxfb_enable_controller(fbi);
+
+        return 0;
+
+failed_register:
+        fb_dealloc_cmap(&info->cmap);
+failed_cmap:
+        if (!inf->fixed_screen_cpu)
+                dma_free_writecombine(dev,fbi->map_size,fbi->map_cpu,
+                           fbi->map_dma);
+failed_map:
+        kfree(info->pseudo_palette);
+failed_regs:
+        release_mem_region(res->start, res->end - res->start);
+failed_init:
+        dev_set_drvdata(dev, NULL);
+        framebuffer_release(info);
+        return ret;
+}
+
+static int imxfb_remove(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct fb_info *info = dev_get_drvdata(dev);
+        struct resource *res;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+        /* disable LCD controller */
+        LCDC_RMCR &= ~RMCR_LCDC_EN;
+
+        unregister_framebuffer(info);
+
+        fb_dealloc_cmap(&info->cmap);
+        kfree(info->pseudo_palette);
+        framebuffer_release(info);
+
+        release_mem_region(res->start, res->end - res->start + 1);
+        dev_set_drvdata(dev, NULL);
+
+        return 0;
+}
+
+void  imxfb_shutdown(struct device * dev)
+{
+        /* disable LCD Controller */
+        LCDC_RMCR &= ~RMCR_LCDC_EN;
+}
+
+static struct device_driver imxfb_driver = {
+        .name           = "imx-fb",
+        .bus            = &platform_bus_type,
+        .probe          = imxfb_probe,
+        .suspend        = imxfb_suspend,
+        .resume         = imxfb_resume,
+        .remove         = imxfb_remove,
+        .shutdown       = imxfb_shutdown,
+};
+
+int __init imxfb_init(void)
+{
+        return driver_register(&imxfb_driver);
+}
+
+static void __exit imxfb_cleanup(void)
+{
+        driver_unregister(&imxfb_driver);
+}
+
+module_init(imxfb_init);
+module_exit(imxfb_cleanup);
+
+MODULE_DESCRIPTION("Motorola i.MX framebuffer driver");
+MODULE_AUTHOR("Sascha Hauer, Pengutronix");
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/imxfb.h b/drivers/video/imxfb.h
new file mode 100644
index 000000000000..128c3ee515c7
--- /dev/null
+++ b/drivers/video/imxfb.h
@@ -0,0 +1,72 @@
+/*
+ * linux/drivers/video/imxfb.h
+ *
+ *  Freescale i.MX Frame Buffer device driver
+ *
+ *  Copyright (C) 2004 S.Hauer, Pengutronix
+ *
+ *  Copyright (C) 1999 Eric A. Thomas
+ *   Based on acornfb.c Copyright (C) Russell King.
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+
+/*
+ * These are the bitfields for each
+ * display depth that we support.
+ */
+struct imxfb_rgb {
+        struct fb_bitfield      red;
+        struct fb_bitfield      green;
+        struct fb_bitfield      blue;
+        struct fb_bitfield      transp;
+};
+
+#define RGB_16  (0)
+#define RGB_8   (1)
+#define NR_RGB  2
+
+struct imxfb_info {
+        struct device           *dev;
+        struct imxfb_rgb        *rgb[NR_RGB];
+
+        u_int                   max_bpp;
+        u_int                   max_xres;
+        u_int                   max_yres;
+
+        /*
+         * These are the addresses we mapped
+         * the framebuffer memory region to.
+         */
+        dma_addr_t              map_dma;
+        u_char *                map_cpu;
+        u_int                   map_size;
+
+        u_char *                screen_cpu;
+        dma_addr_t              screen_dma;
+        u_int                   palette_size;
+
+        dma_addr_t              dbar1;
+        dma_addr_t              dbar2;
+
+        u_int                   pcr;
+        u_int                   pwmr;
+        u_int                   lscr1;
+        u_int                   cmap_inverse:1,
+                                cmap_static:1,
+                                unused:30;
+
+        void (*lcd_power)(int);
+        void (*backlight_power)(int);
+};
+
+#define IMX_NAME        "IMX"
+
+/*
+ * Minimum X and Y resolutions
+ */
+#define MIN_XRES        64
+#define MIN_YRES        64
+
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 6a05b7000830..549e22939260 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -135,9 +135,45 @@
 #endif
 
 #include "intelfb.h"
-#include "intelfbdrv.h"
 #include "intelfbhw.h"
 
+static void __devinit get_initial_mode(struct intelfb_info *dinfo);
+static void update_dinfo(struct intelfb_info *dinfo,
+                         struct fb_var_screeninfo *var);
+static int intelfb_get_fix(struct fb_fix_screeninfo *fix,
+                           struct fb_info *info);
+
+static int intelfb_check_var(struct fb_var_screeninfo *var,
+                             struct fb_info *info);
+static int intelfb_set_par(struct fb_info *info);
+static int intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
+                             unsigned blue, unsigned transp,
+                             struct fb_info *info);
+
+static int intelfb_blank(int blank, struct fb_info *info);
+static int intelfb_pan_display(struct fb_var_screeninfo *var,
+                               struct fb_info *info);
+
+static void intelfb_fillrect(struct fb_info *info,
+                             const struct fb_fillrect *rect);
+static void intelfb_copyarea(struct fb_info *info,
+                             const struct fb_copyarea *region);
+static void intelfb_imageblit(struct fb_info *info,
+                              const struct fb_image *image);
+static int intelfb_cursor(struct fb_info *info,
+                           struct fb_cursor *cursor);
+
+static int intelfb_sync(struct fb_info *info);
+
+static int intelfb_ioctl(struct inode *inode, struct file *file,
+                         unsigned int cmd, unsigned long arg,
+                         struct fb_info *info);
+
+static int __devinit intelfb_pci_register(struct pci_dev *pdev,
+                                          const struct pci_device_id *ent);
+static void __devexit intelfb_pci_unregister(struct pci_dev *pdev);
+static int __devinit intelfb_set_fbinfo(struct intelfb_info *dinfo);
+
 /*
  * Limiting the class to PCI_CLASS_DISPLAY_VGA prevents function 1 of the
  * mobile chipsets from being registered.
diff --git a/drivers/video/intelfb/intelfbdrv.h b/drivers/video/intelfb/intelfbdrv.h
deleted file mode 100644
index cc3058128884..000000000000
--- a/drivers/video/intelfb/intelfbdrv.h
+++ /dev/null
@@ -1,68 +0,0 @@
-#ifndef _INTELFBDRV_H
-#define _INTELFBDRV_H
-
-/*
- ******************************************************************************
- * intelfb
- *
- * Linux framebuffer driver for Intel(R) 830M/845G/852GM/855GM/865G/915G
- * integrated graphics chips.
- *
- * Copyright © 2004 Sylvain Meyer
- *
- * Author: Sylvain Meyer
- *
- ******************************************************************************
- *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
- *
- *    This program is distributed in the hope that it will be useful,
- *    but WITHOUT ANY WARRANTY; without even the implied warranty of
- *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *    GNU General Public License for more details.
- *
- *    You should have received a copy of the GNU General Public License
- *    along with this program; if not, write to the Free Software
- *    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-static void __devinit get_initial_mode(struct intelfb_info *dinfo);
-static void update_dinfo(struct intelfb_info *dinfo,
-                         struct fb_var_screeninfo *var);
-static int intelfb_get_fix(struct fb_fix_screeninfo *fix,
-                           struct fb_info *info);
-
-static int intelfb_check_var(struct fb_var_screeninfo *var,
-                             struct fb_info *info);
-static int intelfb_set_par(struct fb_info *info);
-static int intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
-                             unsigned blue, unsigned transp,
-                             struct fb_info *info);
-
-static int intelfb_blank(int blank, struct fb_info *info);
-static int intelfb_pan_display(struct fb_var_screeninfo *var,
-                               struct fb_info *info);
-
-static void intelfb_fillrect(struct fb_info *info,
-                             const struct fb_fillrect *rect);
-static void intelfb_copyarea(struct fb_info *info,
-                             const struct fb_copyarea *region);
-static void intelfb_imageblit(struct fb_info *info,
-                              const struct fb_image *image);
-static int intelfb_cursor(struct fb_info *info,
-                           struct fb_cursor *cursor);
-
-static int intelfb_sync(struct fb_info *info);
-
-static int intelfb_ioctl(struct inode *inode, struct file *file,
-                         unsigned int cmd, unsigned long arg,
-                         struct fb_info *info);
-
-static int __devinit intelfb_pci_register(struct pci_dev *pdev,
-                                          const struct pci_device_id *ent);
-static void __devexit intelfb_pci_unregister(struct pci_dev *pdev);
-static int __devinit intelfb_set_fbinfo(struct intelfb_info *dinfo);
-
-#endif
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index 3a6555a8aaa2..47733f58153b 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -408,6 +408,7 @@ static int hwcur __devinitdata = 0;
 static int noaccel __devinitdata = 0;
 static int noscale __devinitdata = 0;
 static int paneltweak __devinitdata = 0;
+static int vram __devinitdata = 0;
 #ifdef CONFIG_MTRR
 static int nomtrr __devinitdata = 0;
 #endif
@@ -1180,7 +1181,7 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var,
 
         var->xres_virtual = (var->xres_virtual + 63) & ~63;
 
-        vramlen = info->fix.smem_len;
+        vramlen = info->screen_size;
         pitch = ((var->xres_virtual * var->bits_per_pixel) + 7) / 8;
         memlen = pitch * var->yres_virtual;
 
@@ -1343,7 +1344,7 @@ static int __devinit nvidia_set_fbinfo(struct fb_info *info)
         /* maximize virtual vertical length */
         lpitch = info->var.xres_virtual *
                 ((info->var.bits_per_pixel + 7) >> 3);
-        info->var.yres_virtual = info->fix.smem_len / lpitch;
+        info->var.yres_virtual = info->screen_size / lpitch;
 
         info->pixmap.scan_align = 4;
         info->pixmap.buf_align = 4;
@@ -1507,12 +1508,20 @@ static int __devinit nvidiafb_probe(struct pci_dev *pd,
 
         par->FbAddress = nvidiafb_fix.smem_start;
         par->FbMapSize = par->RamAmountKBytes * 1024;
+        if (vram && vram * 1024 * 1024 < par->FbMapSize)
+                par->FbMapSize = vram * 1024 * 1024;
+
+        /* Limit amount of vram to 64 MB */
+        if (par->FbMapSize > 64 * 1024 * 1024)
+                par->FbMapSize = 64 * 1024 * 1024;
+
         par->FbUsableSize = par->FbMapSize - (128 * 1024);
         par->ScratchBufferSize = (par->Architecture < NV_ARCH_10) ? 8 * 1024 :
             16 * 1024;
         par->ScratchBufferStart = par->FbUsableSize - par->ScratchBufferSize;
         info->screen_base = ioremap(nvidiafb_fix.smem_start, par->FbMapSize);
-        nvidiafb_fix.smem_len = par->FbUsableSize;
+        info->screen_size = par->FbUsableSize;
+        nvidiafb_fix.smem_len = par->RamAmountKBytes * 1024;
 
         if (!info->screen_base) {
                 printk(KERN_ERR PFX "cannot ioremap FB base\n");
@@ -1524,7 +1533,8 @@ static int __devinit nvidiafb_probe(struct pci_dev *pd,
 #ifdef CONFIG_MTRR
         if (!nomtrr) {
                 par->mtrr.vram = mtrr_add(nvidiafb_fix.smem_start,
-                                          par->FbMapSize, MTRR_TYPE_WRCOMB, 1);
+                                          par->RamAmountKBytes * 1024,
+                                          MTRR_TYPE_WRCOMB, 1);
                 if (par->mtrr.vram < 0) {
                         printk(KERN_ERR PFX "unable to setup MTRR\n");
                 } else {
@@ -1566,9 +1576,9 @@ static int __devinit nvidiafb_probe(struct pci_dev *pd,
 
       err_out_iounmap_fb:
         iounmap(info->screen_base);
+      err_out_free_base1:
         fb_destroy_modedb(info->monspecs.modedb);
         nvidia_delete_i2c_busses(par);
-      err_out_free_base1:
         iounmap(par->REGS);
       err_out_free_base0:
         pci_release_regions(pd);
@@ -1645,6 +1655,8 @@ static int __devinit nvidiafb_setup(char *options)
                         noscale = 1;
                 } else if (!strncmp(this_opt, "paneltweak:", 11)) {
                         paneltweak = simple_strtoul(this_opt+11, NULL, 0);
+                } else if (!strncmp(this_opt, "vram:", 5)) {
+                        vram = simple_strtoul(this_opt+5, NULL, 0);
 #ifdef CONFIG_MTRR
                 } else if (!strncmp(this_opt, "nomtrr", 6)) {
                         nomtrr = 1;
@@ -1716,6 +1728,10 @@ module_param(forceCRTC, int, 0);
 MODULE_PARM_DESC(forceCRTC,
                  "Forces usage of a particular CRTC in case autodetection "
                  "fails. (0 or 1) (default=autodetect)");
+module_param(vram, int, 0);
+MODULE_PARM_DESC(vram,
+                 "amount of framebuffer memory to remap in MiB"
+                 "(default=0 - remap entire memory)");
 #ifdef CONFIG_MTRR
 module_param(nomtrr, bool, 0);
 MODULE_PARM_DESC(nomtrr, "Disables MTRR support (0 or 1=disabled) "
diff --git a/drivers/video/radeonfb.c b/drivers/video/radeonfb.c
index d9a084e77a63..c46387024b1d 100644
--- a/drivers/video/radeonfb.c
+++ b/drivers/video/radeonfb.c
@@ -2107,7 +2107,7 @@ static void radeon_write_mode (struct radeonfb_info *rinfo,
 
 
         if (rinfo->arch == RADEON_M6) {
-                for (i=0; i<8; i++)
+                for (i=0; i<7; i++)
                         OUTREG(common_regs_m6[i].reg, common_regs_m6[i].val);
         } else {
                 for (i=0; i<9; i++)
diff --git a/drivers/video/tdfxfb.c b/drivers/video/tdfxfb.c
index c34ba39b6f7e..7044226c5d4c 100644
--- a/drivers/video/tdfxfb.c
+++ b/drivers/video/tdfxfb.c
@@ -317,30 +317,49 @@ static inline void do_setpalentry(struct tdfx_par *par, unsigned regno, u32 c)
 
 static u32 do_calc_pll(int freq, int* freq_out) 
 {
-        int m, n, k, best_m, best_n, best_k, f_cur, best_error;
+        int m, n, k, best_m, best_n, best_k, best_error;
         int fref = 14318;
   
-        /* this really could be done with more intelligence --
-           255*63*4 = 64260 iterations is silly */
         best_error = freq;
         best_n = best_m = best_k = 0;
-        for (n = 1; n < 256; n++) {
-                for (m = 1; m < 64; m++) {
-                        for (k = 0; k < 4; k++) {
-                                f_cur = fref*(n + 2)/(m + 2)/(1 << k);
-                                if (abs(f_cur - freq) < best_error) {
-                                        best_error = abs(f_cur-freq);
-                                        best_n = n;
-                                        best_m = m;
-                                        best_k = k;
+
+        for (k = 3; k >= 0; k--) {
+                for (m = 63; m >= 0; m--) {
+                        /*
+                         * Estimate value of n that produces target frequency
+                         * with current m and k
+                         */
+                        int n_estimated = (freq * (m + 2) * (1 << k) / fref) - 2;
+
+                        /* Search neighborhood of estimated n */
+                        for (n = max(0, n_estimated - 1);
+                                        n <= min(255, n_estimated + 1); n++) {
+                                /*
+                                 * Calculate PLL freqency with current m, k and
+                                 * estimated n
+                                 */
+                                int f = fref * (n + 2) / (m + 2) / (1 << k);
+                                int error = abs (f - freq);
+
+                                /*
+                                 *  If this is the closest we've come to the
+                                 * target frequency then remember n, m and k
+                                 */
+                                if (error  < best_error) {
+                                        best_error = error;
+                                        best_n     = n;
+                                        best_m     = m;
+                                        best_k     = k;
                                 }
                         }
                 }
         }
+
         n = best_n;
         m = best_m;
         k = best_k;
         *freq_out = fref*(n + 2)/(m + 2)/(1 << k);
+
         return (n << 8) | (m << 2) | k;
 }
 
@@ -411,36 +430,35 @@ static void do_write_regs(struct fb_info *info, struct banshee_reg* reg)
 
 static unsigned long do_lfb_size(struct tdfx_par *par, unsigned short dev_id) 
 {
-        u32 draminit0 = 0;
-        u32 draminit1 = 0;
-        u32 miscinit1 = 0;
-        u32 lfbsize   = 0;
-        int sgram_p   = 0;
+        u32 draminit0;
+        u32 draminit1;
+        u32 miscinit1;
+
+        int num_chips;
+        int chip_size; /* in MB */
+        u32 lfbsize;
+        int has_sgram;
 
         draminit0 = tdfx_inl(par, DRAMINIT0);  
         draminit1 = tdfx_inl(par, DRAMINIT1);
+
+        num_chips = (draminit0 & DRAMINIT0_SGRAM_NUM) ? 8 : 4;
  
-        if ((dev_id == PCI_DEVICE_ID_3DFX_BANSHEE) ||
-            (dev_id == PCI_DEVICE_ID_3DFX_VOODOO3)) {                    
-                sgram_p = (draminit1 & DRAMINIT1_MEM_SDRAM) ? 0 : 1;
-  
-        lfbsize = sgram_p ?
-                (((draminit0 & DRAMINIT0_SGRAM_NUM)  ? 2 : 1) * 
-                ((draminit0 & DRAMINIT0_SGRAM_TYPE) ? 8 : 4) * 1024 * 1024) :
-                16 * 1024 * 1024;
+        if (dev_id < PCI_DEVICE_ID_3DFX_VOODOO5) {
+                /* Banshee/Voodoo3 */
+                has_sgram = draminit1 & DRAMINIT1_MEM_SDRAM;
+                chip_size = has_sgram ? ((draminit0 & DRAMINIT0_SGRAM_TYPE) ? 2 : 1)
+                                      : 2;
         } else {
                 /* Voodoo4/5 */
-                u32 chips, psize, banks;
-
-                chips = ((draminit0 & (1 << 26)) == 0) ? 4 : 8;
-                psize = 1 << ((draminit0 & 0x38000000) >> 28);
-                banks = ((draminit0 & (1 << 30)) == 0) ? 2 : 4;
-                lfbsize = chips * psize * banks;
-                lfbsize <<= 20;
-        }                 
-        /* disable block writes for SDRAM (why?) */
+                has_sgram = 0;
+                chip_size = 1 << ((draminit0 & DRAMINIT0_SGRAM_TYPE_MASK) >> DRAMINIT0_SGRAM_TYPE_SHIFT);
+        }
+        lfbsize = num_chips * chip_size * 1024 * 1024;
+
+        /* disable block writes for SDRAM */
         miscinit1 = tdfx_inl(par, MISCINIT1);
-        miscinit1 |= sgram_p ? 0 : MISCINIT1_2DBLOCK_DIS;
+        miscinit1 |= has_sgram ? 0 : MISCINIT1_2DBLOCK_DIS;
         miscinit1 |= MISCINIT1_CLUT_INV;
 
         banshee_make_room(par, 1); 
diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
index 8fc1278d7fbd..3027841f9c24 100644
--- a/drivers/video/vesafb.c
+++ b/drivers/video/vesafb.c
@@ -19,9 +19,6 @@
 #include <linux/fb.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
-#ifdef __i386__
-#include <video/edid.h>
-#endif
 #include <asm/io.h>
 #include <asm/mtrr.h>
 
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 6b6bb7c8abf6..23c125128024 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -131,8 +131,7 @@ static int afs_file_readpage(struct file *file, struct page *page)
 
         vnode = AFS_FS_I(inode);
 
-        if (!PageLocked(page))
-                PAGE_BUG(page);
+        BUG_ON(!PageLocked(page));
 
         ret = -ESTALE;
         if (vnode->flags & AFS_VNODE_DELETED)
diff --git a/fs/aio.c b/fs/aio.c
index a82214d2e46d..7afa222f6802 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -40,9 +40,6 @@
 #define dprintk(x...)   do { ; } while (0)
 #endif
 
-static long aio_run = 0; /* for testing only */
-static long aio_wakeups = 0; /* for testing only */
-
 /*------ sysctl variables----*/
 atomic_t aio_nr = ATOMIC_INIT(0);       /* current system wide number of aio requests */
 unsigned aio_max_nr = 0x10000;  /* system wide maximum number of aio requests */
@@ -405,7 +402,6 @@ static struct kiocb fastcall *__aio_get_req(struct kioctx *ctx)
         req->ki_ctx = ctx;
         req->ki_cancel = NULL;
         req->ki_retry = NULL;
-        req->ki_obj.user = NULL;
         req->ki_dtor = NULL;
         req->private = NULL;
         INIT_LIST_HEAD(&req->ki_run_list);
@@ -451,11 +447,6 @@ static inline void really_put_req(struct kioctx *ctx, struct kiocb *req)
 {
         if (req->ki_dtor)
                 req->ki_dtor(req);
-        req->ki_ctx = NULL;
-        req->ki_filp = NULL;
-        req->ki_obj.user = NULL;
-        req->ki_dtor = NULL;
-        req->private = NULL;
         kmem_cache_free(kiocb_cachep, req);
         ctx->reqs_active--;
 
@@ -623,7 +614,6 @@ static inline int __queue_kicked_iocb(struct kiocb *iocb)
         if (list_empty(&iocb->ki_run_list)) {
                 list_add_tail(&iocb->ki_run_list,
                         &ctx->run_list);
-                iocb->ki_queued++;
                 return 1;
         }
         return 0;
@@ -664,10 +654,8 @@ static ssize_t aio_run_iocb(struct kiocb *iocb)
         }
 
         if (!(iocb->ki_retried & 0xff)) {
-                pr_debug("%ld retry: %d of %d (kick %ld, Q %ld run %ld, wake %ld)\n",
-                        iocb->ki_retried,
-                        iocb->ki_nbytes - iocb->ki_left, iocb->ki_nbytes,
-                        iocb->ki_kicked, iocb->ki_queued, aio_run, aio_wakeups);
+                pr_debug("%ld retry: %d of %d\n", iocb->ki_retried,
+                        iocb->ki_nbytes - iocb->ki_left, iocb->ki_nbytes);
         }
 
         if (!(retry = iocb->ki_retry)) {
@@ -774,7 +762,6 @@ out:
 static int __aio_run_iocbs(struct kioctx *ctx)
 {
         struct kiocb *iocb;
-        int count = 0;
         LIST_HEAD(run_list);
 
         list_splice_init(&ctx->run_list, &run_list);
@@ -789,9 +776,7 @@ static int __aio_run_iocbs(struct kioctx *ctx)
                 aio_run_iocb(iocb);
                 if (__aio_put_req(ctx, iocb))  /* drop extra ref */
                         put_ioctx(ctx);
-                count++;
         }
-        aio_run++;
         if (!list_empty(&ctx->run_list))
                 return 1;
         return 0;
@@ -890,10 +875,8 @@ static void queue_kicked_iocb(struct kiocb *iocb)
         spin_lock_irqsave(&ctx->ctx_lock, flags);
         run = __queue_kicked_iocb(iocb);
         spin_unlock_irqrestore(&ctx->ctx_lock, flags);
-        if (run) {
+        if (run)
                 aio_queue_work(ctx);
-                aio_wakeups++;
-        }
 }
 
 /*
@@ -913,7 +896,6 @@ void fastcall kick_iocb(struct kiocb *iocb)
                 return;
         }
 
-        iocb->ki_kicked++;
         /* If its already kicked we shouldn't queue it again */
         if (!kiocbTryKick(iocb)) {
                 queue_kicked_iocb(iocb);
@@ -984,7 +966,8 @@ int fastcall aio_complete(struct kiocb *iocb, long res, long res2)
 
         tail = info->tail;
         event = aio_ring_event(info, tail, KM_IRQ0);
-        tail = (tail + 1) % info->nr;
+        if (++tail >= info->nr)
+                tail = 0;
 
         event->obj = (u64)(unsigned long)iocb->ki_obj.user;
         event->data = iocb->ki_user_data;
@@ -1008,10 +991,8 @@ int fastcall aio_complete(struct kiocb *iocb, long res, long res2)
 
         pr_debug("added to ring %p at [%lu]\n", iocb, tail);
 
-        pr_debug("%ld retries: %d of %d (kicked %ld, Q %ld run %ld wake %ld)\n",
-                iocb->ki_retried,
-                iocb->ki_nbytes - iocb->ki_left, iocb->ki_nbytes,
-                iocb->ki_kicked, iocb->ki_queued, aio_run, aio_wakeups);
+        pr_debug("%ld retries: %d of %d\n", iocb->ki_retried,
+                iocb->ki_nbytes - iocb->ki_left, iocb->ki_nbytes);
 put_rq:
         /* everything turned out well, dispose of the aiocb. */
         ret = __aio_put_req(ctx, iocb);
@@ -1119,7 +1100,6 @@ static int read_events(struct kioctx *ctx,
         int                     i = 0;
         struct io_event         ent;
         struct aio_timeout      to;
-        int                     event_loop = 0; /* testing only */
         int                     retry = 0;
 
         /* needed to zero any padding within an entry (there shouldn't be 
@@ -1186,7 +1166,6 @@ retry:
                         if (to.timed_out)       /* Only check after read evt */
                                 break;
                         schedule();
-                        event_loop++;
                         if (signal_pending(tsk)) {
                                 ret = -EINTR;
                                 break;
@@ -1214,9 +1193,6 @@ retry:
         if (timeout)
                 clear_timeout(&to);
 out:
-        pr_debug("event loop executed %d times\n", event_loop);
-        pr_debug("aio_run %ld\n", aio_run);
-        pr_debug("aio_wakeups %ld\n", aio_wakeups);
         return i ? i : ret;
 }
 
@@ -1515,8 +1491,7 @@ int fastcall io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         }
 
         req->ki_filp = file;
-        iocb->aio_key = req->ki_key;
-        ret = put_user(iocb->aio_key, &user_iocb->aio_key);
+        ret = put_user(req->ki_key, &user_iocb->aio_key);
         if (unlikely(ret)) {
                 dprintk("EFAULT: aio_key\n");
                 goto out_put_req;
@@ -1531,13 +1506,7 @@ int fastcall io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         req->ki_opcode = iocb->aio_lio_opcode;
         init_waitqueue_func_entry(&req->ki_wait, aio_wake_function);
         INIT_LIST_HEAD(&req->ki_wait.task_list);
-        req->ki_run_list.next = req->ki_run_list.prev = NULL;
-        req->ki_retry = NULL;
         req->ki_retried = 0;
-        req->ki_kicked = 0;
-        req->ki_queued = 0;
-        aio_run = 0;
-        aio_wakeups = 0;
 
         ret = aio_setup_iocb(req);
 
@@ -1545,10 +1514,14 @@ int fastcall io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
                 goto out_put_req;
 
         spin_lock_irq(&ctx->ctx_lock);
-        list_add_tail(&req->ki_run_list, &ctx->run_list);
-        /* drain the run list */
-        while (__aio_run_iocbs(ctx))
-                ;
+        if (likely(list_empty(&ctx->run_list))) {
+                aio_run_iocb(req);
+        } else {
+                list_add_tail(&req->ki_run_list, &ctx->run_list);
+                /* drain the run list */
+                while (__aio_run_iocbs(ctx))
+                        ;
+        }
         spin_unlock_irq(&ctx->ctx_lock);
         aio_put_req(req);       /* drop extra ref to req */
         return 0;
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index f5a52c871726..c7b2b8890188 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -84,6 +84,7 @@ struct autofs_wait_queue {
         char *name;
         /* This is for status reporting upon return */
         int status;
+        atomic_t notified;
         atomic_t wait_ctr;
 };
 
@@ -101,6 +102,7 @@ struct autofs_sb_info {
         int needs_reghost;
         struct super_block *sb;
         struct semaphore wq_sem;
+        spinlock_t fs_lock;
         struct autofs_wait_queue *queues; /* Wait queue pointer */
 };
 
@@ -126,9 +128,18 @@ static inline int autofs4_oz_mode(struct autofs_sb_info *sbi) {
 static inline int autofs4_ispending(struct dentry *dentry)
 {
         struct autofs_info *inf = autofs4_dentry_ino(dentry);
+        int pending = 0;
 
-        return (dentry->d_flags & DCACHE_AUTOFS_PENDING) ||
-                (inf != NULL && inf->flags & AUTOFS_INF_EXPIRING);
+        if (dentry->d_flags & DCACHE_AUTOFS_PENDING)
+                return 1;
+
+        if (inf) {
+                spin_lock(&inf->sbi->fs_lock);
+                pending = inf->flags & AUTOFS_INF_EXPIRING;
+                spin_unlock(&inf->sbi->fs_lock);
+        }
+
+        return pending;
 }
 
 static inline void autofs4_copy_atime(struct file *src, struct file *dst)
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 31540a6404d9..500425e24fba 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -99,6 +99,10 @@ static int autofs4_check_tree(struct vfsmount *mnt,
         if (!autofs4_can_expire(top, timeout, do_now))
                 return 0;
 
+        /* Is someone visiting anywhere in the tree ? */
+        if (may_umount_tree(mnt))
+                return 0;
+
         spin_lock(&dcache_lock);
 repeat:
         next = this_parent->d_subdirs.next;
@@ -270,10 +274,18 @@ static struct dentry *autofs4_expire(struct super_block *sb,
 
                 /* Case 2: tree mount, expire iff entire tree is not busy */
                 if (!exp_leaves) {
+                        /* Lock the tree as we must expire as a whole */
+                        spin_lock(&sbi->fs_lock);
                         if (autofs4_check_tree(mnt, dentry, timeout, do_now)) {
-                        expired = dentry;
-                        break;
+                                struct autofs_info *inf = autofs4_dentry_ino(dentry);
+
+                                /* Set this flag early to catch sys_chdir and the like */
+                                inf->flags |= AUTOFS_INF_EXPIRING;
+                                spin_unlock(&sbi->fs_lock);
+                                expired = dentry;
+                                break;
                         }
+                        spin_unlock(&sbi->fs_lock);
                 /* Case 3: direct mount, expire individual leaves */
                 } else {
                         expired = autofs4_check_leaves(mnt, dentry, timeout, do_now);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index a52560746628..4bb14cc68040 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -206,6 +206,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         sbi->version = 0;
         sbi->sub_version = 0;
         init_MUTEX(&sbi->wq_sem);
+        spin_lock_init(&sbi->fs_lock);
         sbi->queues = NULL;
         s->s_blocksize = 1024;
         s->s_blocksize_bits = 10;
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 1ab24a662e09..5a40d36e5a51 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -210,17 +210,8 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                 wq->len = len;
                 wq->status = -EINTR; /* Status return if interrupted */
                 atomic_set(&wq->wait_ctr, 2);
+                atomic_set(&wq->notified, 1);
                 up(&sbi->wq_sem);
-
-                DPRINTK("new wait id = 0x%08lx, name = %.*s, nfy=%d",
-                        (unsigned long) wq->wait_queue_token, wq->len, wq->name, notify);
-                /* autofs4_notify_daemon() may block */
-                if (notify != NFY_NONE) {
-                        autofs4_notify_daemon(sbi,wq, 
-                                        notify == NFY_MOUNT ?
-                                                  autofs_ptype_missing :
-                                                  autofs_ptype_expire_multi);
-                }
         } else {
                 atomic_inc(&wq->wait_ctr);
                 up(&sbi->wq_sem);
@@ -229,6 +220,17 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                         (unsigned long) wq->wait_queue_token, wq->len, wq->name, notify);
         }
 
+        if (notify != NFY_NONE && atomic_dec_and_test(&wq->notified)) {
+                int type = (notify == NFY_MOUNT ?
+                        autofs_ptype_missing : autofs_ptype_expire_multi);
+
+                DPRINTK(("new wait id = 0x%08lx, name = %.*s, nfy=%d\n",
+                        (unsigned long) wq->wait_queue_token, wq->len, wq->name, notify));
+
+                /* autofs4_notify_daemon() may block */
+                autofs4_notify_daemon(sbi, wq, type);
+        }
+
         /* wq->name is NULL if and only if the lock is already released */
 
         if ( sbi->catatonic ) {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 6ae62cbf7c2e..ce9423bb2de3 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -945,7 +945,7 @@ static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         retval = arch_setup_additional_pages(bprm, executable_stack);
         if (retval < 0) {
                 send_sig(SIGKILL, current, 0);
-                goto out_free_dentry;
+                goto out;
         }
 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 
diff --git a/fs/bio.c b/fs/bio.c
index e5349e834563..3a1472acc361 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -140,6 +140,7 @@ inline void bio_init(struct bio *bio)
  * bio_alloc_bioset - allocate a bio for I/O
  * @gfp_mask:   the GFP_ mask given to the slab allocator
  * @nr_iovecs:  number of iovecs to pre-allocate
+ * @bs:         the bio_set to allocate from
  *
  * Description:
  *   bio_alloc_bioset will first try it's on mempool to satisfy the allocation.
@@ -629,6 +630,7 @@ out:
 
 /**
  *      bio_map_user    -       map user address into bio
+ *      @q: the request_queue_t for the bio
  *      @bdev: destination block device
  *      @uaddr: start of user address
  *      @len: length in bytes
diff --git a/fs/buffer.c b/fs/buffer.c
index 3b12cf947aba..5f525b3c6d9f 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -218,7 +218,7 @@ struct super_block *freeze_bdev(struct block_device *bdev)
         sb = get_super(bdev);
         if (sb && !(sb->s_flags & MS_RDONLY)) {
                 sb->s_frozen = SB_FREEZE_WRITE;
-                wmb();
+                smp_wmb();
 
                 sync_inodes_sb(sb, 0);
                 DQUOT_SYNC(sb);
@@ -235,7 +235,7 @@ struct super_block *freeze_bdev(struct block_device *bdev)
                 sync_inodes_sb(sb, 1);
 
                 sb->s_frozen = SB_FREEZE_TRANS;
-                wmb();
+                smp_wmb();
 
                 sync_blockdev(sb->s_bdev);
 
@@ -263,7 +263,7 @@ void thaw_bdev(struct block_device *bdev, struct super_block *sb)
                 if (sb->s_op->unlockfs)
                         sb->s_op->unlockfs(sb);
                 sb->s_frozen = SB_UNFROZEN;
-                wmb();
+                smp_wmb();
                 wake_up(&sb->s_wait_unfrozen);
                 drop_super(sb);
         }
@@ -774,15 +774,14 @@ repeat:
 /**
  * sync_mapping_buffers - write out and wait upon a mapping's "associated"
  *                        buffers
- * @buffer_mapping - the mapping which backs the buffers' data
- * @mapping - the mapping which wants those buffers written
+ * @mapping: the mapping which wants those buffers written
  *
  * Starts I/O against the buffers at mapping->private_list, and waits upon
  * that I/O.
  *
- * Basically, this is a convenience function for fsync().  @buffer_mapping is
- * the blockdev which "owns" the buffers and @mapping is a file or directory
- * which needs those buffers to be written for a successful fsync().
+ * Basically, this is a convenience function for fsync().
+ * @mapping is a file or directory which needs those buffers to be written for
+ * a successful fsync().
  */
 int sync_mapping_buffers(struct address_space *mapping)
 {
@@ -1263,6 +1262,7 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
 
 /**
  * mark_buffer_dirty - mark a buffer_head as needing writeout
+ * @bh: the buffer_head to mark dirty
  *
  * mark_buffer_dirty() will set the dirty bit against the buffer, then set its
  * backing page dirty, then tag the page as dirty in its address_space's radix
@@ -1501,6 +1501,7 @@ EXPORT_SYMBOL(__breadahead);
 
 /**
  *  __bread() - reads a specified block and returns the bh
+ *  @bdev: the block_device to read from
  *  @block: number of block
  *  @size: size (in bytes) to read
  * 
@@ -2078,8 +2079,7 @@ int block_read_full_page(struct page *page, get_block_t *get_block)
         int nr, i;
         int fully_mapped = 1;
 
-        if (!PageLocked(page))
-                PAGE_BUG(page);
+        BUG_ON(!PageLocked(page));
         blocksize = 1 << inode->i_blkbits;
         if (!page_has_buffers(page))
                 create_empty_buffers(page, blocksize, 0);
@@ -2917,7 +2917,7 @@ drop_buffers(struct page *page, struct buffer_head **buffers_to_free)
 
         bh = head;
         do {
-                if (buffer_write_io_error(bh))
+                if (buffer_write_io_error(bh) && page->mapping)
                         set_bit(AS_EIO, &page->mapping->flags);
                 if (buffer_busy(bh))
                         goto failed;
diff --git a/fs/cifs/AUTHORS b/fs/cifs/AUTHORS
index acce36e25d2e..72fdc10dfdd7 100644
--- a/fs/cifs/AUTHORS
+++ b/fs/cifs/AUTHORS
@@ -4,13 +4,16 @@ Steve French (sfrench@samba.org)
 
 The author wishes to express his appreciation and thanks to:
 Andrew Tridgell (Samba team) for his early suggestions about smb/cifs VFS
-improvements. Thanks to IBM for allowing me the time and test resources to pursue
-this project. Jim McDonough from IBM (and the Samba Team) for his help.
-The IBM Linux JFS team for explaining many esoteric Linux filesystem features.
+improvements. Thanks to IBM for allowing me time and test resources to pursue
+this project, to Jim McDonough from IBM (and the Samba Team) for his help, to
+the IBM Linux JFS team for explaining many esoteric Linux filesystem features.
+Jeremy Allison of the Samba team has done invaluable work in adding the server
+side of the original CIFS Unix extensions and reviewing and implementing
+portions of the newer CIFS POSIX extensions into the Samba 3 file server. Thank
 Dave Boutcher of IBM Rochester (author of the OS/400 smb/cifs filesystem client)
-for proving years ago that a very good smb/cifs client could be done on a Unix like 
-operating system.  Volker Lendecke, Andrew Tridgell, Urban Widmark, John Newbigin 
-and others for their work on the Linux smbfs module over the years. Thanks to
+for proving years ago that very good smb/cifs clients could be done on Unix-like
+operating systems.  Volker Lendecke, Andrew Tridgell, Urban Widmark, John 
+Newbigin and others for their work on the Linux smbfs module.  Thanks to
 the other members of the Storage Network Industry Association CIFS Technical
 Workgroup for their work specifying this highly complex protocol and finally
 thanks to the Samba team for their technical advice and encouragement.
@@ -24,9 +27,11 @@ Shobhit Dayal
 Sergey Vlasov
 Richard Hughes
 Yury Umanets
-Mark Hamzy
+Mark Hamzy (for some of the early cifs IPv6 work)
 Domen Puncer
-Jesper Juhl
+Jesper Juhl (in particular for lots of whitespace/formatting cleanup)
+Vince Negri and Dave Stahl (for finding an important caching bug)
+Adrian Bunk (kcalloc cleanups)
 
 Test case and Bug Report contributors
 -------------------------------------
@@ -36,7 +41,8 @@ Rene Scharfe, Martin Josefsson, Alexander Wild, Anthony Liguori,
 Lars Muller, Urban Widmark, Massimiliano Ferrero, Howard Owen,
 Olaf Kirch, Kieron Briggs, Nick Millington and others. Also special
 mention to the Stanford Checker (SWAT) which pointed out many minor
-bugs in error paths.
+bugs in error paths.  Valuable suggestions also have come from Al Viro
+and Dave Miller.
 
 And thanks to the IBM LTC and Power test teams and SuSE testers for
 finding multiple bugs during excellent stress test runs.
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 5316c8dd6bff..95483baab706 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,7 +1,44 @@
-Version 1.31
+Version 1.34
+------------
+Fix error mapping of the TOO_MANY_LINKS (hardlinks) case.
+Do not oops if root user kills cifs oplock kernel thread or
+kills the cifsd thread (NB: killing the cifs kernel threads is not
+recommended, unmount and rmmod cifs will kill them when they are
+no longer needed).  Fix readdir to ASCII servers (ie older servers
+which do not support Unicode) and also require asterik.
+
+
+Version 1.33
+------------
+Fix caching problem, in which readdir of directory containing a file
+which was cached could cause the file's time stamp to be updated
+without invalidating the readahead data (so we could get stale
+file data on the client for that file even as the server copy changed).
+Cleanup response processing so cifsd can not loop when abnormally
+terminated.
+
+
+Version 1.32
 ------------
 Fix oops in ls when Transact2 FindFirst (or FindNext) returns more than one
 transact response for an SMB request and search entry split across two frames.
+Add support for lsattr (getting ext2/ext3/reiserfs attr flags from the server)
+as new protocol extensions. Do not send Get/Set calls for POSIX ACLs
+unless server explicitly claims to support them in CIFS Unix extensions
+POSIX ACL capability bit. Fix packet signing when multiuser mounting with
+different users from the same client to the same server. Fix oops in
+cifs_close. Add mount option for remapping reserved characters in
+filenames (also allow recognizing files with created by SFU which have any
+of these seven reserved characters, except backslash, to be recognized).
+Fix invalid transact2 message (we were sometimes trying to interpret
+oplock breaks as SMB responses). Add ioctl for checking that the
+current uid matches the uid of the mounter (needed by umount.cifs).
+Reduce the number of large buffer allocations in cifs response processing
+(significantly reduces memory pressure under heavy stress with multiple
+processes accessing the same server at the same time).
+
+Version 1.31
+------------
 Fix updates of DOS attributes and time fields so that files on NT4 servers
 do not get marked delete on close. Display sizes of cifs buffer pools in
 cifs stats. Fix oops in unmount when cifsd thread being killed by 
diff --git a/fs/cifs/README b/fs/cifs/README
index 0f20edc935b5..7b4ac096cd11 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -75,7 +75,7 @@ Allowing User Mounts
 ====================
 To permit users to mount and unmount over directories they own is possible
 with the cifs vfs.  A way to enable such mounting is to mark the mount.cifs
-utility as suid (e.g. "chmod +s /sbin/mount/cifs). To enable users to 
+utility as suid (e.g. "chmod +s /sbin/mount.cifs). To enable users to 
 umount shares they mount requires
 1) mount.cifs version 1.4 or later
 2) an entry for the share in /etc/fstab indicating that a user may
@@ -97,6 +97,26 @@ mount.cifs with the following flag:
 There is a corresponding manual page for cifs mounting in the Samba 3.0 and
 later source tree in docs/manpages/mount.cifs.8 
 
+Allowing User Unmounts
+======================
+To permit users to ummount directories that they have user mounted (see above),
+the utility umount.cifs may be used.  It may be invoked directly, or if 
+umount.cifs is placed in /sbin, umount can invoke the cifs umount helper
+(at least for most versions of the umount utility) for umount of cifs
+mounts, unless umount is invoked with -i (which will avoid invoking a umount
+helper). As with mount.cifs, to enable user unmounts umount.cifs must be marked
+as suid (e.g. "chmod +s /sbin/umount.cifs") or equivalent (some distributions
+allow adding entries to a file to the /etc/permissions file to achieve the
+equivalent suid effect).  For this utility to succeed the target path
+must be a cifs mount, and the uid of the current user must match the uid
+of the user who mounted the resource.
+
+Also note that the customary way of allowing user mounts and unmounts is 
+(instead of using mount.cifs and unmount.cifs as suid) to add a line
+to the file /etc/fstab for each //server/share you wish to mount, but
+this can become unwieldy when potential mount targets include many
+or  unpredictable UNC names.
+
 Samba Considerations 
 ==================== 
 To get the maximum benefit from the CIFS VFS, we recommend using a server that 
@@ -376,6 +396,19 @@ A partial list of the supported mount options follows:
                 attributes) to the server (default) e.g. via setfattr 
                 and getfattr utilities. 
   nouser_xattr  Do not allow getfattr/setfattr to get/set xattrs 
+  mapchars      Translate six of the seven reserved characters (not backslash)
+                        *?<>|:
+                to the remap range (above 0xF000), which also
+                allows the CIFS client to recognize files created with
+                such characters by Windows's POSIX emulation. This can
+                also be useful when mounting to most versions of Samba
+                (which also forbids creating and opening files
+                whose names contain any of these seven characters).
+                This has no effect if the server does not support
+                Unicode on the wire.
+ nomapchars     Do not translate any of these seven characters (default).
+ remount        remount the share (often used to change from ro to rw mounts
+                or vice versa)
                 
 The mount.cifs mount helper also accepts a few mount options before -o
 including:
@@ -392,7 +425,7 @@ Misc /proc/fs/cifs Flags and Debug Info
 =======================================
 Informational pseudo-files:
 DebugData               Displays information about active CIFS sessions
-                        and shares.
+                        and shares, as well as the cifs.ko version.
 Stats                   Lists summary resource usage information as well as per
                         share statistics, if CONFIG_CIFS_STATS in enabled
                         in the kernel configuration.
@@ -449,7 +482,7 @@ and for more extensive tracing including the start of smb requests and responses
 Two other experimental features are under development and to test 
 require enabling CONFIG_CIFS_EXPERIMENTAL
 
-        More efficient write operations and SMB buffer handling
+        More efficient write operations
 
         DNOTIFY fcntl: needed for support of directory change 
                             notification and perhaps later for file leases)
@@ -467,8 +500,8 @@ returned success.
         
 Also note that "cat /proc/fs/cifs/DebugData" will display information about 
 the active sessions and the shares that are mounted.  Note: NTLMv2 enablement 
-will not work since they its implementation is not quite complete yet.
-Do not alter these configuration values unless you are doing specific testing.  
+will not work since its implementation is not quite complete yet. Do not alter
+the ExtendedSecurity configuration value unless you are doing specific testing.
 Enabling extended security works to Windows 2000 Workstations and XP but not to 
 Windows 2000 server or Samba since it does not usually send "raw NTLMSSP" 
 (instead it sends NTLMSSP encapsulated in SPNEGO/GSSAPI, which support is not 
diff --git a/fs/cifs/TODO b/fs/cifs/TODO
index f4e3e1f67ee4..8cc881694e29 100644
--- a/fs/cifs/TODO
+++ b/fs/cifs/TODO
@@ -1,4 +1,4 @@
-version 1.22 July 30, 2004 
+version 1.34 April 29, 2005
 
 A Partial List of Missing Features
 ==================================
@@ -14,7 +14,7 @@ b) Better pam/winbind integration (e.g. to handle uid mapping
 better)
 
 c) multi-user mounts - multiplexed sessionsetups over single vc
-(ie tcp session) - prettying up needed, and more testing needed
+(ie tcp session) - more testing needed
 
 d) Kerberos/SPNEGO session setup support - (started)
 
@@ -67,12 +67,26 @@ q) implement support for security and trusted categories of xattrs
 
 r) Implement O_DIRECT flag on open (already supported on mount)
 
-KNOWN BUGS (updated December 10, 2004)
+s) Allow remapping of last remaining character (\) to +0xF000 which
+(this character is valid for POSIX but not for Windows)
+
+t) Create UID mapping facility so server UIDs can be mapped on a per
+mount or a per server basis to client UIDs or nobody if no mapping
+exists.  This is helpful when Unix extensions are negotiated to
+allow better permission checking when UIDs differ on the server
+and client.  Add new protocol request to the CIFS protocol 
+standard for asking the server for the corresponding name of a
+particular uid.
+
+KNOWN BUGS (updated April 29, 2005)
 ====================================
+See http://bugzilla.samba.org - search on product "CifsVFS" for
+current bug list.
+
 1) existing symbolic links (Windows reparse points) are recognized but
 can not be created remotely. They are implemented for Samba and those that
-support the CIFS Unix extensions but Samba has a bug currently handling
-symlink text beginning with slash
+support the CIFS Unix extensions, although earlier versions of Samba
+overly restrict the pathnames.
 2) follow_link and readdir code does not follow dfs junctions
 but recognizes them
 3) create of new files to FAT partitions on Windows servers can
@@ -98,7 +112,5 @@ there are some easy changes that can be done to parallelize sequential writes,
 and when signing is disabled to request larger read sizes (larger than 
 negotiated size) and send larger write sizes to modern servers.
 
-4) More exhaustively test the recently added NT4 support against various
-NT4 service pack levels, and fix cifs_setattr for setting file times and 
-size to fall back to level 1 when error invalid level returned.
-
+4) More exhaustively test against less common servers.  More testing
+against Windows 9x, Windows ME servers.
diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
index db28b561cd4b..4061e43471c1 100644
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs_debug.c
  *
- *   Copyright (C) International Business Machines  Corp., 2000,2003
+ *   Copyright (C) International Business Machines  Corp., 2000,2005
  *
  *   Modified by Steve French (sfrench@us.ibm.com)
  *
@@ -29,6 +29,7 @@
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
+#include "cifsfs.h"
 
 void
 cifs_dump_mem(char *label, void *data, int length)
@@ -78,8 +79,9 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                     "Display Internal CIFS Data Structures for Debugging\n"
                     "---------------------------------------------------\n");
         buf += length;
-
-        length = sprintf(buf, "Servers:\n");
+        length = sprintf(buf,"CIFS Version %s\n",CIFS_VERSION);
+        buf += length;
+        length = sprintf(buf, "Servers:");
         buf += length;
 
         i = 0;
@@ -87,12 +89,21 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
         list_for_each(tmp, &GlobalSMBSessionList) {
                 i++;
                 ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
-                length =
-                    sprintf(buf,
-                            "\n%d) Name: %s  Domain: %s Mounts: %d ServerOS: %s  \n\tServerNOS: %s\tCapabilities: 0x%x\n\tSMB session status: %d\t",
-                                i, ses->serverName, ses->serverDomain, atomic_read(&ses->inUse),
-                                ses->serverOS, ses->serverNOS, ses->capabilities,ses->status);
-                buf += length;
+                if((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
+                   (ses->serverNOS == NULL)) {
+                        buf += sprintf("\nentry for %s not fully displayed\n\t",
+                                        ses->serverName);
+                        
+                } else {
+                        length =
+                            sprintf(buf,
+                                    "\n%d) Name: %s  Domain: %s Mounts: %d ServerOS: %s  \n\tServerNOS: %s\tCapabilities: 0x%x\n\tSMB session status: %d\t",
+                                i, ses->serverName, ses->serverDomain,
+                                atomic_read(&ses->inUse),
+                                ses->serverOS, ses->serverNOS,
+                                ses->capabilities,ses->status);
+                        buf += length;
+                }
                 if(ses->server) {
                         buf += sprintf(buf, "TCP status: %d\n\tLocal Users To Server: %d SecMode: 0x%x Req Active: %d",
                                 ses->server->tcpStatus,
@@ -100,7 +111,7 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                                 ses->server->secMode,
                                 atomic_read(&ses->server->inFlight));
                         
-                        length = sprintf(buf, "\nMIDs: \n");
+                        length = sprintf(buf, "\nMIDs:\n");
                         buf += length;
 
                         spin_lock(&GlobalMid_Lock);
@@ -109,7 +120,12 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
                                         mid_q_entry,
                                         qhead);
                                 if(mid_entry) {
-                                        length = sprintf(buf,"State: %d com: %d pid: %d tsk: %p mid %d\n",mid_entry->midState,mid_entry->command,mid_entry->pid,mid_entry->tsk,mid_entry->mid);
+                                        length = sprintf(buf,"State: %d com: %d pid: %d tsk: %p mid %d\n",
+                                                mid_entry->midState,
+                                                (int)mid_entry->command,
+                                                mid_entry->pid,
+                                                mid_entry->tsk,
+                                                mid_entry->mid);
                                         buf += length;
                                 }
                         }
@@ -121,7 +137,7 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
         sprintf(buf, "\n");
         buf++;
 
-        length = sprintf(buf, "\nShares:\n");
+        length = sprintf(buf, "Shares:");
         buf += length;
 
         i = 0;
@@ -200,7 +216,8 @@ cifs_stats_read(char *buf, char **beginBuffer, off_t offset,
         buf += item_length;      
         item_length = 
                 sprintf(buf,"SMB Request/Response Buffer: %d Pool size: %d\n",
-                        bufAllocCount.counter,cifs_min_rcv + tcpSesAllocCount.counter);
+                        bufAllocCount.counter,
+                        cifs_min_rcv + tcpSesAllocCount.counter);
         length += item_length;
         buf += item_length;
         item_length = 
diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h
index 77da902d8f32..ec00d61d5308 100644
--- a/fs/cifs/cifs_fs_sb.h
+++ b/fs/cifs/cifs_fs_sb.h
@@ -23,6 +23,7 @@
 #define CIFS_MOUNT_SERVER_INUM  4 /* inode numbers from uniqueid from server */
 #define CIFS_MOUNT_DIRECT_IO    8 /* do not write nor read through page cache */
 #define CIFS_MOUNT_NO_XATTR  0x10 /* if set - disable xattr support */
+#define CIFS_MOUNT_MAP_SPECIAL_CHR 0x20 /* remap illegal chars in filenames */
 
 struct cifs_sb_info {
         struct cifsTconInfo *tcon;      /* primary mount */
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index a17adf4cb9ba..99a096d3f84d 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -76,8 +76,8 @@ cifs_strtoUCS(wchar_t * to, const char *from, int len,
                                 charlen));
                         to[i] = cpu_to_le16(0x003f);    /* a question mark */
                         charlen = 1;
-                }
-                to[i] = cpu_to_le16(to[i]);
+                } else 
+                        to[i] = cpu_to_le16(to[i]);
 
         }
 
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 78829e7d8cd0..1959c7c4b185 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -50,7 +50,7 @@ static int cifs_calculate_signature(const struct smb_hdr * cifs_pdu, const char
         return 0;
 }
 
-int cifs_sign_smb(struct smb_hdr * cifs_pdu, struct cifsSesInfo * ses,
+int cifs_sign_smb(struct smb_hdr * cifs_pdu, struct TCP_Server_Info * server,
         __u32 * pexpected_response_sequence_number)
 {
         int rc = 0;
@@ -59,21 +59,21 @@ int cifs_sign_smb(struct smb_hdr * cifs_pdu, struct cifsSesInfo * ses,
         /* BB remember to initialize sequence number elsewhere and initialize mac_signing key elsewhere BB */
         /* BB remember to add code to save expected sequence number in midQ entry BB */
 
-        if((cifs_pdu == NULL) || (ses == NULL))
+        if((cifs_pdu == NULL) || (server == NULL))
                 return -EINVAL;
 
         if((cifs_pdu->Flags2 & SMBFLG2_SECURITY_SIGNATURE) == 0) 
                 return rc;
 
         spin_lock(&GlobalMid_Lock);
-        cifs_pdu->Signature.Sequence.SequenceNumber = cpu_to_le32(ses->sequence_number);
+        cifs_pdu->Signature.Sequence.SequenceNumber = cpu_to_le32(server->sequence_number);
         cifs_pdu->Signature.Sequence.Reserved = 0;
         
-        *pexpected_response_sequence_number = ses->sequence_number++;
-        ses->sequence_number++;
+        *pexpected_response_sequence_number = server->sequence_number++;
+        server->sequence_number++;
         spin_unlock(&GlobalMid_Lock);
 
-        rc = cifs_calculate_signature(cifs_pdu, ses->mac_signing_key,smb_signature);
+        rc = cifs_calculate_signature(cifs_pdu, server->mac_signing_key,smb_signature);
         if(rc)
                 memset(cifs_pdu->Signature.SecuritySignature, 0, 8);
         else
@@ -190,7 +190,7 @@ int CalcNTLMv2_partial_mac_key(struct cifsSesInfo * ses, struct nls_table * nls_
         hmac_md5_update((const unsigned char *) unicode_buf,
                 (user_name_len+dom_name_len)*2,&ctx);
 
-        hmac_md5_final(ses->mac_signing_key,&ctx);
+        hmac_md5_final(ses->server->mac_signing_key,&ctx);
         kfree(ucase_buf);
         kfree(unicode_buf);
         return 0;
@@ -200,7 +200,7 @@ void CalcNTLMv2_response(const struct cifsSesInfo * ses,char * v2_session_respon
         struct HMACMD5Context context;
         memcpy(v2_session_response + 8, ses->server->cryptKey,8);
         /* gen_blob(v2_session_response + 16); */
-        hmac_md5_init_limK_to_64(ses->mac_signing_key, 16, &context);
+        hmac_md5_init_limK_to_64(ses->server->mac_signing_key, 16, &context);
 
         hmac_md5_update(ses->server->cryptKey,8,&context);
 /*      hmac_md5_update(v2_session_response+16)client thing,8,&context); */ /* BB fix */
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 5082fce3c566..8cc23e7d0d5d 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -169,7 +169,8 @@ cifs_put_super(struct super_block *sb)
 static int
 cifs_statfs(struct super_block *sb, struct kstatfs *buf)
 {
-        int xid, rc = -EOPNOTSUPP;
+        int xid; 
+        int rc = -EOPNOTSUPP;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
 
@@ -181,31 +182,34 @@ cifs_statfs(struct super_block *sb, struct kstatfs *buf)
         buf->f_type = CIFS_MAGIC_NUMBER;
 
         /* instead could get the real value via SMB_QUERY_FS_ATTRIBUTE_INFO */
-        buf->f_namelen = PATH_MAX;      /* PATH_MAX may be too long - it would presumably
-                                           be length of total path, note that some servers may be 
-                                           able to support more than this, but best to be safe
-                                           since Win2k and others can not handle very long filenames */
+        buf->f_namelen = PATH_MAX; /* PATH_MAX may be too long - it would 
+                                      presumably be total path, but note
+                                      that some servers (includinng Samba 3)
+                                      have a shorter maximum path */
         buf->f_files = 0;       /* undefined */
         buf->f_ffree = 0;       /* unlimited */
 
 #ifdef CONFIG_CIFS_EXPERIMENTAL
 /* BB we could add a second check for a QFS Unix capability bit */
-    if (pTcon->ses->capabilities & CAP_UNIX)
-            rc = CIFSSMBQFSPosixInfo(xid, pTcon, buf, cifs_sb->local_nls);
+/* BB FIXME check CIFS_POSIX_EXTENSIONS Unix cap first FIXME BB */
+    if ((pTcon->ses->capabilities & CAP_UNIX) && (CIFS_POSIX_EXTENSIONS &
+                        le64_to_cpu(pTcon->fsUnixInfo.Capability)))
+            rc = CIFSSMBQFSPosixInfo(xid, pTcon, buf);
 
     /* Only need to call the old QFSInfo if failed
     on newer one */
     if(rc)
 #endif /* CIFS_EXPERIMENTAL */
-        rc = CIFSSMBQFSInfo(xid, pTcon, buf, cifs_sb->local_nls);
+        rc = CIFSSMBQFSInfo(xid, pTcon, buf);
 
         /*     
            int f_type;
            __fsid_t f_fsid;
            int f_namelen;  */
-        /* BB get from info put in tcon struct at mount time with call to QFSAttrInfo */
+        /* BB get from info in tcon struct at mount time call to QFSAttrInfo */
         FreeXid(xid);
-        return 0;               /* always return success? what if volume is no longer available? */
+        return 0;               /* always return success? what if volume is no
+                                   longer available? */
 }
 
 static int cifs_permission(struct inode * inode, int mask, struct nameidata *nd)
@@ -559,6 +563,10 @@ struct file_operations cifs_file_ops = {
         .flush = cifs_flush,
         .mmap  = cifs_file_mmap,
         .sendfile = generic_file_sendfile,
+#ifdef CONFIG_CIFS_POSIX
+        .ioctl  = cifs_ioctl,
+#endif /* CONFIG_CIFS_POSIX */
+
 #ifdef CONFIG_CIFS_EXPERIMENTAL
         .readv = generic_file_readv,
         .writev = generic_file_writev,
@@ -579,6 +587,10 @@ struct file_operations cifs_file_direct_ops = {
         .fsync = cifs_fsync,
         .flush = cifs_flush,
         .sendfile = generic_file_sendfile, /* BB removeme BB */
+#ifdef CONFIG_CIFS_POSIX
+        .ioctl  = cifs_ioctl,
+#endif /* CONFIG_CIFS_POSIX */
+
 #ifdef CONFIG_CIFS_EXPERIMENTAL
         .dir_notify = cifs_dir_notify,
 #endif /* CONFIG_CIFS_EXPERIMENTAL */
@@ -591,6 +603,7 @@ struct file_operations cifs_dir_ops = {
 #ifdef CONFIG_CIFS_EXPERIMENTAL
         .dir_notify = cifs_dir_notify,
 #endif /* CONFIG_CIFS_EXPERIMENTAL */
+        .ioctl  = cifs_ioctl,
 };
 
 static void
@@ -822,6 +835,7 @@ static int cifs_oplock_thread(void * dummyarg)
                 }
         } while(!signal_pending(current));
         complete_and_exit (&cifs_oplock_exited, 0);
+        oplockThread = NULL;
 }
 
 static int __init
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 451f18af3206..d00b3bfe1a52 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsfs.h
  *
- *   Copyright (c) International Business Machines  Corp., 2002
+ *   Copyright (c) International Business Machines  Corp., 2002, 2005
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -91,8 +91,10 @@ extern int cifs_symlink(struct inode *inode, struct dentry *direntry,
                         const char *symname);
 extern int      cifs_removexattr(struct dentry *, const char *);
 extern int      cifs_setxattr(struct dentry *, const char *, const void *,
-                         size_t, int);
+                        size_t, int);
 extern ssize_t  cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
-#define CIFS_VERSION   "1.31"
+extern int cifs_ioctl (struct inode * inode, struct file * filep,
+                       unsigned int command, unsigned long arg);
+#define CIFS_VERSION   "1.34"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 69aff1a7da9b..81babab265e1 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsglob.h
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2003
+ *   Copyright (C) International Business Machines  Corp., 2002,2005
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -149,6 +149,8 @@ struct TCP_Server_Info {
         __u16 timeZone;
         char cryptKey[CIFS_CRYPTO_KEY_SIZE];
         char workstation_RFC1001_name[16]; /* 16th byte is always zero */
+        __u32 sequence_number; /* needed for CIFS PDU signature */
+        char mac_signing_key[CIFS_SESSION_KEY_SIZE + 16]; 
 };
 
 /*
@@ -174,17 +176,16 @@ struct cifsSesInfo {
         struct TCP_Server_Info *server; /* pointer to server info */
         atomic_t inUse; /* # of mounts (tree connections) on this ses */
         enum statusEnum status;
-        __u32 sequence_number;  /* needed for CIFS PDU signature */
         __u16 ipc_tid;          /* special tid for connection to IPC share */
         __u16 flags;
-        char mac_signing_key[CIFS_SESSION_KEY_SIZE + 16];       
-        char *serverOS;         /* name of operating system underlying the server */
-        char *serverNOS;        /* name of network operating system that the server is running */
+        char *serverOS;         /* name of operating system underlying server */
+        char *serverNOS;        /* name of network operating system of server */
         char *serverDomain;     /* security realm of server */
         int Suid;               /* remote smb uid  */
         uid_t linux_uid;        /* local Linux uid */
         int capabilities;
-        char serverName[SERVER_NAME_LEN_WITH_NULL * 2]; /* BB make bigger for tcp names - will ipv6 and sctp addresses fit here?? */
+        char serverName[SERVER_NAME_LEN_WITH_NULL * 2]; /* BB make bigger for 
+                                TCP names - will ipv6 and sctp addresses fit? */
         char userName[MAX_USERNAME_SIZE + 1];
         char domainName[MAX_USERNAME_SIZE + 1];
         char * password;
@@ -312,12 +313,15 @@ struct mid_q_entry {
         __u16 mid;              /* multiplex id */
         __u16 pid;              /* process id */
         __u32 sequence_number;  /* for CIFS signing */
-        __u16 command;          /* smb command code */
         struct timeval when_sent;       /* time when smb sent */
         struct cifsSesInfo *ses;        /* smb was sent to this server */
         struct task_struct *tsk;        /* task waiting for response */
         struct smb_hdr *resp_buf;       /* response buffer */
         int midState;   /* wish this were enum but can not pass to wait_event */
+        __u8 command;   /* smb command code */
+        unsigned multiPart:1;   /* multiple responses to one SMB request */
+        unsigned largeBuf:1;    /* if valid response, is pointer to large buf */
+        unsigned multiResp:1;   /* multiple trans2 responses for one request  */
 };
 
 struct oplock_q_entry {
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index bcd4a6136f08..aede6a813167 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -330,7 +330,7 @@ struct smb_hdr {
 };
 /* given a pointer to an smb_hdr retrieve the value of byte count */
 #define BCC(smb_var) ( *(__u16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2* smb_var->WordCount) ) )
-
+#define BCC_LE(smb_var) ( *(__le16 *)((char *)smb_var + sizeof(struct smb_hdr) + (2* smb_var->WordCount) ) )
 /* given a pointer to an smb_hdr retrieve the pointer to the byte area */
 #define pByteArea(smb_var) ((unsigned char *)smb_var + sizeof(struct smb_hdr) + (2* smb_var->WordCount) + 2 )
 
@@ -762,6 +762,16 @@ typedef struct smb_com_lock_req {
         LOCKING_ANDX_RANGE Locks[1];
 } LOCK_REQ;
 
+
+typedef struct cifs_posix_lock {
+        __le16  lock_type;  /* 0 = Read, 1 = Write, 2 = Unlock */
+        __le16  lock_flags; /* 1 = Wait (only valid for setlock) */
+        __le32  pid;
+        __le64  start;
+        __le64  length;
+        /* BB what about additional owner info to identify network client */
+} CIFS_POSIX_LOCK;
+
 typedef struct smb_com_lock_rsp {
         struct smb_hdr hdr;     /* wct = 2 */
         __u8 AndXCommand;
@@ -1098,6 +1108,8 @@ struct smb_t2_rsp {
 #define SMB_QUERY_POSIX_ACL             0x204
 #define SMB_QUERY_XATTR                 0x205
 #define SMB_QUERY_ATTR_FLAGS            0x206  /* append,immutable etc. */
+#define SMB_QUERY_POSIX_PERMISSION      0x207
+#define SMB_QUERY_POSIX_LOCK            0x208
 #define SMB_QUERY_FILE_INTERNAL_INFO    0x3ee
 #define SMB_QUERY_FILE_ACCESS_INFO      0x3f0
 #define SMB_QUERY_FILE_NAME_INFO2       0x3f1 /* 0x30 bytes */
@@ -1116,6 +1128,7 @@ struct smb_t2_rsp {
 #define SMB_SET_POSIX_ACL               0x204
 #define SMB_SET_XATTR                   0x205
 #define SMB_SET_ATTR_FLAGS              0x206  /* append, immutable etc. */
+#define SMB_SET_POSIX_LOCK              0x208
 #define SMB_SET_FILE_BASIC_INFO2        0x3ec
 #define SMB_SET_FILE_RENAME_INFORMATION 0x3f2 /* BB check if qpathinfo level too */
 #define SMB_FILE_ALL_INFO2              0x3fa
@@ -1237,9 +1250,25 @@ struct smb_com_transaction2_sfi_rsp {
         struct smb_hdr hdr;     /* wct = 10 + SetupCount */
         struct trans2_resp t2;
         __u16 ByteCount;
-        __u16 Reserved2;        /* parameter word reserved - present for infolevels > 100 */
+        __u16 Reserved2;        /* parameter word reserved - 
+                                        present for infolevels > 100 */
+};
+
+struct smb_t2_qfi_req {
+        struct  smb_hdr hdr;
+        struct  trans2_req t2;
+        __u8    Pad;
+        __u16   Fid;
+        __le16  InformationLevel;
 };
 
+struct smb_t2_qfi_rsp {
+        struct smb_hdr hdr;     /* wct = 10 + SetupCount */
+        struct trans2_resp t2;
+        __u16 ByteCount;
+        __u16 Reserved2;        /* parameter word reserved - 
+                                        present for infolevels > 100 */
+};
 
 /*
  * Flags on T2 FINDFIRST and FINDNEXT 
@@ -1524,9 +1553,10 @@ typedef struct {
 } FILE_SYSTEM_UNIX_INFO;        /* Unix extensions info, level 0x200 */
 /* Linux/Unix extensions capability flags */
 #define CIFS_UNIX_FCNTL_CAP             0x00000001 /* support for fcntl locks */
-#define CIFS_UNIX_POSIX_ACL_CAP         0x00000002
-#define CIFS_UNIX_XATTR_CAP             0x00000004 /*support for new namespace*/
-
+#define CIFS_UNIX_POSIX_ACL_CAP         0x00000002 /* support getfacl/setfacl */
+#define CIFS_UNIX_XATTR_CAP             0x00000004 /* support new namespace   */
+#define CIFS_UNIX_EXTATTR_CAP           0x00000008 /* support chattr/chflag   */
+#define CIFS_POSIX_EXTENSIONS           0x00000010 /* support for new QFSInfo */
 typedef struct {
         /* For undefined recommended transfer size return -1 in that field */
         __le32 OptimalTransferSize;  /* bsize on some os, iosize on other os */
@@ -1971,14 +2001,39 @@ struct xsymlink {
         char path[1024];  
 };
 
-typedef struct {
+typedef struct file_xattr_info {
         /* BB do we need another field for flags? BB */
         __u32 xattr_name_len;
         __u32 xattr_value_len;
         char  xattr_name[0];
         /* followed by xattr_value[xattr_value_len], no pad */
-} FILE_XATTR_INFO;      /* extended attribute, info level 205 */
-
+} FILE_XATTR_INFO;      /* extended attribute, info level 0x205 */
+
+
+/* flags for chattr command */
+#define EXT_SECURE_DELETE               0x00000001 /* EXT3_SECRM_FL */
+#define EXT_ENABLE_UNDELETE             0x00000002 /* EXT3_UNRM_FL */
+/* Reserved for compress file 0x4 */
+#define EXT_SYNCHRONOUS                 0x00000008 /* EXT3_SYNC_FL */
+#define EXT_IMMUTABLE_FL                0x00000010 /* EXT3_IMMUTABLE_FL */
+#define EXT_OPEN_APPEND_ONLY            0x00000020 /* EXT3_APPEND_FL */
+#define EXT_DO_NOT_BACKUP               0x00000040 /* EXT3_NODUMP_FL */
+#define EXT_NO_UPDATE_ATIME             0x00000080 /* EXT3_NOATIME_FL */
+/* 0x100 through 0x800 reserved for compression flags and are GET-ONLY */
+#define EXT_HASH_TREE_INDEXED_DIR       0x00001000 /* GET-ONLY EXT3_INDEX_FL */
+/* 0x2000 reserved for IMAGIC_FL */
+#define EXT_JOURNAL_THIS_FILE   0x00004000 /* GET-ONLY EXT3_JOURNAL_DATA_FL */
+/* 0x8000 reserved for EXT3_NOTAIL_FL */
+#define EXT_SYNCHRONOUS_DIR             0x00010000 /* EXT3_DIRSYNC_FL */
+#define EXT_TOPDIR                      0x00020000 /* EXT3_TOPDIR_FL */
+
+#define EXT_SET_MASK                    0x000300FF
+#define EXT_GET_MASK                    0x0003DFFF
+
+typedef struct file_chattr_info {
+        __le64  mask; /* list of all possible attribute bits */
+        __le64  mode; /* list of actual attribute bits on this inode */
+} FILE_CHATTR_INFO;  /* ext attributes (chattr, chflags) level 0x206 */
 
 #endif 
 
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 787eef4d86d3..0010511083fc 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -57,10 +57,11 @@ extern int decode_negTokenInit(unsigned char *security_blob, int length,
 extern int cifs_inet_pton(int, char * source, void *dst);
 extern int map_smb_to_linux_error(struct smb_hdr *smb);
 extern void header_assemble(struct smb_hdr *, char /* command */ ,
-                        const struct cifsTconInfo *, int
-                        /* length of fixed section (word count) in two byte units  */
+                        const struct cifsTconInfo *, int /* specifies length
+                            of fixed section (word count) in two byte units */
                         );
-extern struct oplock_q_entry * AllocOplockQEntry(struct inode *, u16, struct cifsTconInfo *);
+extern struct oplock_q_entry * AllocOplockQEntry(struct inode *, u16, 
+                                                 struct cifsTconInfo *);
 extern void DeleteOplockQEntry(struct oplock_q_entry *);
 extern struct timespec cifs_NTtimeToUnix(u64 /* utc nanoseconds since 1601 */ );
 extern u64 cifs_UnixTimeToNT(struct timespec);
@@ -88,7 +89,7 @@ extern int CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
 
 extern int CIFSFindFirst(const int xid, struct cifsTconInfo *tcon,
             const char *searchName, const struct nls_table *nls_codepage,
-            __u16 *searchHandle, struct cifs_search_info * psrch_inf);
+            __u16 *searchHandle, struct cifs_search_info * psrch_inf, int map);
 
 extern int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
             __u16 searchHandle, struct cifs_search_info * psrch_inf);
@@ -99,42 +100,42 @@ extern int CIFSFindClose(const int, struct cifsTconInfo *tcon,
 extern int CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
                         FILE_ALL_INFO * findData,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 
 extern int CIFSSMBUnixQPathInfo(const int xid,
                         struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
                         FILE_UNIX_BASIC_INFO * pFindData,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 
 extern int CIFSGetDFSRefer(const int xid, struct cifsSesInfo *ses,
                         const unsigned char *searchName,
                         unsigned char **targetUNCs,
                         unsigned int *number_of_UNC_in_array,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 
 extern int connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
                         const char *old_path,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 extern int get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
-                        const char *old_path, const struct nls_table *nls_codepage, 
-                        unsigned int *pnum_referrals, unsigned char ** preferrals);
+                        const char *old_path, 
+                        const struct nls_table *nls_codepage,
+                        unsigned int *pnum_referrals, 
+                        unsigned char ** preferrals,
+                        int remap);
 extern int CIFSSMBQFSInfo(const int xid, struct cifsTconInfo *tcon,
-                        struct kstatfs *FSData,
-                        const struct nls_table *nls_codepage);
+                        struct kstatfs *FSData);
 extern int CIFSSMBQFSAttributeInfo(const int xid,
-                        struct cifsTconInfo *tcon,
-                        const struct nls_table *nls_codepage);
-extern int CIFSSMBQFSDeviceInfo(const int xid, struct cifsTconInfo *tcon,
-                        const struct nls_table *nls_codepage);
-extern int CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon,
-                        const struct nls_table *nls_codepage);
+                        struct cifsTconInfo *tcon);
+extern int CIFSSMBQFSDeviceInfo(const int xid, struct cifsTconInfo *tcon);
+extern int CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon);
 extern int CIFSSMBQFSPosixInfo(const int xid, struct cifsTconInfo *tcon,
-                        struct kstatfs *FSData, const struct nls_table *nls_codepage);
+                        struct kstatfs *FSData);
 
 extern int CIFSSMBSetTimes(const int xid, struct cifsTconInfo *tcon,
                         const char *fileName, const FILE_BASIC_INFO * data,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon,
                         const FILE_BASIC_INFO * data, __u16 fid);
 #if 0
@@ -143,36 +144,49 @@ extern int CIFSSMBSetAttrLegacy(int xid, struct cifsTconInfo *tcon,
                         const struct nls_table *nls_codepage);
 #endif /* possibly unneeded function */
 extern int CIFSSMBSetEOF(const int xid, struct cifsTconInfo *tcon,
-                        const char *fileName, __u64 size,int setAllocationSizeFlag,
-                        const struct nls_table *nls_codepage);
+                        const char *fileName, __u64 size,
+                        int setAllocationSizeFlag,
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon,
-                         __u64 size, __u16 fileHandle,__u32 opener_pid, int AllocSizeFlag);
+                         __u64 size, __u16 fileHandle,__u32 opener_pid, 
+                        int AllocSizeFlag);
 extern int CIFSSMBUnixSetPerms(const int xid, struct cifsTconInfo *pTcon,
                         char *full_path, __u64 mode, __u64 uid,
-                        __u64 gid, dev_t dev, const struct nls_table *nls_codepage);
+                        __u64 gid, dev_t dev, 
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 
 extern int CIFSSMBMkDir(const int xid, struct cifsTconInfo *tcon,
                         const char *newName,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSSMBRmDir(const int xid, struct cifsTconInfo *tcon,
-                        const char *name, const struct nls_table *nls_codepage);
+                        const char *name, const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 
 extern int CIFSSMBDelFile(const int xid, struct cifsTconInfo *tcon,
                         const char *name,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSSMBRename(const int xid, struct cifsTconInfo *tcon,
                         const char *fromName, const char *toName,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSSMBRenameOpenFile(const int xid,struct cifsTconInfo *pTcon,
-                        int netfid, char * target_name, const struct nls_table *nls_codepage);
+                        int netfid, char * target_name, 
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSCreateHardLink(const int xid,
                         struct cifsTconInfo *tcon,
                         const char *fromName, const char *toName,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern int CIFSUnixCreateHardLink(const int xid,
                         struct cifsTconInfo *tcon,
                         const char *fromName, const char *toName,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, 
+                        int remap_special_chars);
 extern int CIFSUnixCreateSymLink(const int xid,
                         struct cifsTconInfo *tcon,
                         const char *fromName, const char *toName,
@@ -192,7 +206,7 @@ extern int CIFSSMBOpen(const int xid, struct cifsTconInfo *tcon,
                         const char *fileName, const int disposition,
                         const int access_flags, const int omode,
                         __u16 * netfid, int *pOplock, FILE_ALL_INFO *,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, int remap);
 extern int CIFSSMBClose(const int xid, struct cifsTconInfo *tcon,
                         const int smb_file_id);
 
@@ -211,8 +225,13 @@ extern int CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
                         const char __user *buf,const int long_op);
 extern int CIFSGetSrvInodeNumber(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName, __u64 * inode_number,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, 
+                        int remap_special_chars);
 #endif /* CONFIG_CIFS_EXPERIMENTAL */
+extern int cifs_convertUCSpath(char *target, const __u16 *source, int maxlen,
+                        const struct nls_table * codepage);
+extern int cifsConvertToUCS(__le16 * target, const char *source, int maxlen,
+                        const struct nls_table * cp, int mapChars);
 
 extern int CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
                         const __u16 netfid, const __u64 len,
@@ -230,7 +249,7 @@ extern void tconInfoFree(struct cifsTconInfo *);
 
 extern int cifs_reconnect(struct TCP_Server_Info *server);
 
-extern int cifs_sign_smb(struct smb_hdr *, struct cifsSesInfo *,__u32 *);
+extern int cifs_sign_smb(struct smb_hdr *, struct TCP_Server_Info *,__u32 *);
 extern int cifs_verify_signature(struct smb_hdr *, const char * mac_key,
         __u32 expected_sequence_number);
 extern int cifs_calculate_mac_key(char * key,const char * rn,const char * pass);
@@ -241,29 +260,31 @@ extern int CIFSSMBCopy(int xid,
                         const char *fromName,
                         const __u16 target_tid,
                         const char *toName, const int flags,
-                        const struct nls_table *nls_codepage);
+                        const struct nls_table *nls_codepage, 
+                        int remap_special_chars);
 extern int CIFSSMBNotify(const int xid, struct cifsTconInfo *tcon, 
-                        const int notify_subdirs,const __u16 netfid,__u32 filter,
-                        const struct nls_table *nls_codepage);
+                        const int notify_subdirs,const __u16 netfid,
+                        __u32 filter, const struct nls_table *nls_codepage);
 extern ssize_t CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName, char * EAData,
-                        size_t bufsize, const struct nls_table *nls_codepage);
+                        size_t bufsize, const struct nls_table *nls_codepage,
+                        int remap_special_chars);
 extern ssize_t CIFSSMBQueryEA(const int xid,struct cifsTconInfo * tcon,
                 const unsigned char * searchName,const unsigned char * ea_name,
                 unsigned char * ea_value, size_t buf_size, 
-                const struct nls_table *nls_codepage);
+                const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon, 
                 const char *fileName, const char * ea_name, 
                 const void * ea_value, const __u16 ea_value_len, 
-                const struct nls_table *nls_codepage);
+                const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBGetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const unsigned char *searchName,
                 char *acl_inf, const int buflen,const int acl_type,
-                const struct nls_table *nls_codepage);
+                const struct nls_table *nls_codepage, int remap_special_chars);
 extern int CIFSSMBSetPosixACL(const int xid, struct cifsTconInfo *tcon,
                 const unsigned char *fileName,
                 const char *local_acl, const int buflen, const int acl_type,
-                const struct nls_table *nls_codepage);
-int cifs_ioctl (struct inode * inode, struct file * filep,
-                unsigned int command, unsigned long arg);
+                const struct nls_table *nls_codepage, int remap_special_chars);
+extern int CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
+                const int netfid, __u64 * pExtAttrBits, __u64 *pMask);
 #endif                  /* _CIFSPROTO_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index df6a619a6821..741ff0c69f37 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -75,7 +75,8 @@ static void mark_open_files_invalid(struct cifsTconInfo * pTcon)
                 }
         }
         write_unlock(&GlobalSMBSeslock);
-        /* BB Add call to invalidate_inodes(sb) for all superblocks mounted to this tcon */
+        /* BB Add call to invalidate_inodes(sb) for all superblocks mounted
+           to this tcon */
 }
 
 /* If the return code is zero, this function must fill in request_buf pointer */
@@ -89,11 +90,12 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
            check for tcp and smb session status done differently
            for those three - in the calling routine */
         if(tcon) {
-                if((tcon->ses) && (tcon->ses->server)){
+                if((tcon->ses) && (tcon->ses->status != CifsExiting) &&
+                                  (tcon->ses->server)){
                         struct nls_table *nls_codepage;
                                 /* Give Demultiplex thread up to 10 seconds to 
-                                        reconnect, should be greater than cifs socket
-                                        timeout which is 7 seconds */
+                                   reconnect, should be greater than cifs socket
+                                   timeout which is 7 seconds */
                         while(tcon->ses->server->tcpStatus == CifsNeedReconnect) {
                                 wait_event_interruptible_timeout(tcon->ses->server->response_q,
                                         (tcon->ses->server->tcpStatus == CifsGood), 10 * HZ);
@@ -103,8 +105,9 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                                            (tcon->ses->status == CifsExiting)) {
                                                 cFYI(1,("gave up waiting on reconnect in smb_init"));
                                                 return -EHOSTDOWN;
-                                        } /* else "hard" mount - keep retrying until 
-                                        process is killed or server comes back up */
+                                        } /* else "hard" mount - keep retrying
+                                             until process is killed or server
+                                             comes back on-line */
                                 } else /* TCP session is reestablished now */
                                         break;
                                  
@@ -115,23 +118,24 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 simultaneously reconnect the same SMB session */
                         down(&tcon->ses->sesSem);
                         if(tcon->ses->status == CifsNeedReconnect)
-                                rc = cifs_setup_session(0, tcon->ses, nls_codepage);
+                                rc = cifs_setup_session(0, tcon->ses, 
+                                                        nls_codepage);
                         if(!rc && (tcon->tidStatus == CifsNeedReconnect)) {
                                 mark_open_files_invalid(tcon);
-                                rc = CIFSTCon(0, tcon->ses, tcon->treeName, tcon,
-                                        nls_codepage);
+                                rc = CIFSTCon(0, tcon->ses, tcon->treeName, tcon
+                                        , nls_codepage);
                                 up(&tcon->ses->sesSem);
                                 if(rc == 0)
                                         atomic_inc(&tconInfoReconnectCount);
 
                                 cFYI(1, ("reconnect tcon rc = %d", rc));
                                 /* Removed call to reopen open files here - 
-                                        it is safer (and faster) to reopen files
-                                        one at a time as needed in read and write */
+                                   it is safer (and faster) to reopen files
+                                   one at a time as needed in read and write */
 
                                 /* Check if handle based operation so we 
-                                        know whether we can continue or not without
-                                        returning to caller to reset file handle */
+                                   know whether we can continue or not without
+                                   returning to caller to reset file handle */
                                 switch(smb_command) {
                                         case SMB_COM_READ_ANDX:
                                         case SMB_COM_WRITE_ANDX:
@@ -182,22 +186,25 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
            check for tcp and smb session status done differently
            for those three - in the calling routine */
         if(tcon) {
-                if((tcon->ses) && (tcon->ses->server)){
+                if((tcon->ses) && (tcon->ses->status != CifsExiting) && 
+                                  (tcon->ses->server)){
                         struct nls_table *nls_codepage;
-                                /* Give Demultiplex thread up to 10 seconds to 
-                                        reconnect, should be greater than cifs socket
-                                        timeout which is 7 seconds */
+                                /* Give Demultiplex thread up to 10 seconds to
+                                   reconnect, should be greater than cifs socket
+                                   timeout which is 7 seconds */
                         while(tcon->ses->server->tcpStatus == CifsNeedReconnect) {
                                 wait_event_interruptible_timeout(tcon->ses->server->response_q,
                                         (tcon->ses->server->tcpStatus == CifsGood), 10 * HZ);
-                                if(tcon->ses->server->tcpStatus == CifsNeedReconnect) {
+                                if(tcon->ses->server->tcpStatus == 
+                                                CifsNeedReconnect) {
                                         /* on "soft" mounts we wait once */
                                         if((tcon->retry == FALSE) || 
                                            (tcon->ses->status == CifsExiting)) {
                                                 cFYI(1,("gave up waiting on reconnect in smb_init"));
                                                 return -EHOSTDOWN;
-                                        } /* else "hard" mount - keep retrying until 
-                                        process is killed or server comes back up */
+                                        } /* else "hard" mount - keep retrying
+                                             until process is killed or server
+                                             comes on-line */
                                 } else /* TCP session is reestablished now */
                                         break;
                                  
@@ -208,23 +215,24 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 simultaneously reconnect the same SMB session */
                         down(&tcon->ses->sesSem);
                         if(tcon->ses->status == CifsNeedReconnect)
-                                rc = cifs_setup_session(0, tcon->ses, nls_codepage);
+                                rc = cifs_setup_session(0, tcon->ses, 
+                                                        nls_codepage);
                         if(!rc && (tcon->tidStatus == CifsNeedReconnect)) {
                                 mark_open_files_invalid(tcon);
-                                rc = CIFSTCon(0, tcon->ses, tcon->treeName, tcon,
-                                        nls_codepage);
+                                rc = CIFSTCon(0, tcon->ses, tcon->treeName,
+                                              tcon, nls_codepage);
                                 up(&tcon->ses->sesSem);
                                 if(rc == 0)
                                         atomic_inc(&tconInfoReconnectCount);
 
                                 cFYI(1, ("reconnect tcon rc = %d", rc));
                                 /* Removed call to reopen open files here - 
-                                        it is safer (and faster) to reopen files
-                                        one at a time as needed in read and write */
+                                   it is safer (and faster) to reopen files
+                                   one at a time as needed in read and write */
 
                                 /* Check if handle based operation so we 
-                                        know whether we can continue or not without
-                                        returning to caller to reset file handle */
+                                   know whether we can continue or not without
+                                   returning to caller to reset file handle */
                                 switch(smb_command) {
                                         case SMB_COM_READ_ANDX:
                                         case SMB_COM_WRITE_ANDX:
@@ -286,7 +294,8 @@ static int validate_t2(struct smb_t2_rsp * pSMB)
                         if(total_size < 512) {
                                 total_size+=le16_to_cpu(pSMB->t2_rsp.DataCount);
                                 /* BCC le converted in SendReceive */
-                                pBCC = (pSMB->hdr.WordCount * 2) + sizeof(struct smb_hdr) + 
+                                pBCC = (pSMB->hdr.WordCount * 2) + 
+                                        sizeof(struct smb_hdr) +
                                         (char *)pSMB;
                                 if((total_size <= (*(u16 *)pBCC)) && 
                                    (total_size < 
@@ -337,8 +346,10 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         if (rc == 0) {
                 server->secMode = pSMBr->SecurityMode;  
-                server->secType = NTLM; /* BB override default for NTLMv2 or krb*/
-                /* one byte - no need to convert this or EncryptionKeyLen from le,*/
+                server->secType = NTLM; /* BB override default for 
+                                           NTLMv2 or kerberos v5 */
+                /* one byte - no need to convert this or EncryptionKeyLen
+                   from little endian */
                 server->maxReq = le16_to_cpu(pSMBr->MaxMpxCount);
                 /* probably no need to store and check maxvcs */
                 server->maxBuf =
@@ -374,7 +385,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                                                 pSMBr->u.extended_response.
                                                 GUID, 16) != 0) {
                                                 cFYI(1,
-                                                        ("UID of server does not match previous connection to same ip address"));
+                                                     ("UID of server does not match previous connection to same ip address"));
                                                 memcpy(server->
                                                         server_GUID,
                                                         pSMBr->u.
@@ -454,17 +465,18 @@ CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon)
                 up(&tcon->tconSem);
                 return -EIO;
         }
-        rc = small_smb_init(SMB_COM_TREE_DISCONNECT, 0, tcon, (void **)&smb_buffer);
+        rc = small_smb_init(SMB_COM_TREE_DISCONNECT, 0, tcon, 
+                            (void **)&smb_buffer);
         if (rc) {
                 up(&tcon->tconSem);
                 return rc;
         } else {
                 smb_buffer_response = smb_buffer; /* BB removeme BB */
-    }
+        }
         rc = SendReceive(xid, tcon->ses, smb_buffer, smb_buffer_response,
                          &length, 0);
         if (rc)
-                cFYI(1, (" Tree disconnect failed %d", rc));
+                cFYI(1, ("Tree disconnect failed %d", rc));
 
         if (smb_buffer)
                 cifs_small_buf_release(smb_buffer);
@@ -538,8 +550,8 @@ CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses)
 }
 
 int
-CIFSSMBDelFile(const int xid, struct cifsTconInfo *tcon,
-               const char *fileName, const struct nls_table *nls_codepage)
+CIFSSMBDelFile(const int xid, struct cifsTconInfo *tcon, const char *fileName,
+               const struct nls_table *nls_codepage, int remap)
 {
         DELETE_FILE_REQ *pSMB = NULL;
         DELETE_FILE_RSP *pSMBr = NULL;
@@ -555,12 +567,11 @@ DelFileRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->fileName, fileName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->fileName, fileName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
-        } else {                /* BB improve the check for buffer overruns BB */
+        } else {                /* BB improve check for buffer overruns BB */
                 name_len = strnlen(fileName, PATH_MAX);
                 name_len++;     /* trailing null */
                 strncpy(pSMB->fileName, fileName, name_len);
@@ -589,8 +600,8 @@ DelFileRetry:
 }
 
 int
-CIFSSMBRmDir(const int xid, struct cifsTconInfo *tcon,
-             const char *dirName, const struct nls_table *nls_codepage)
+CIFSSMBRmDir(const int xid, struct cifsTconInfo *tcon, const char *dirName, 
+             const struct nls_table *nls_codepage, int remap)
 {
         DELETE_DIRECTORY_REQ *pSMB = NULL;
         DELETE_DIRECTORY_RSP *pSMBr = NULL;
@@ -606,12 +617,11 @@ RmDirRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifs_strtoUCS((wchar_t *) pSMB->DirName, dirName, PATH_MAX
-                                /* find define for this maxpathcomponent */
-                                , nls_codepage);
+                name_len = cifsConvertToUCS((__le16 *) pSMB->DirName, dirName,
+                                         PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
-        } else {                /* BB improve the check for buffer overruns BB */
+        } else {                /* BB improve check for buffer overruns BB */
                 name_len = strnlen(dirName, PATH_MAX);
                 name_len++;     /* trailing null */
                 strncpy(pSMB->DirName, dirName, name_len);
@@ -639,7 +649,7 @@ RmDirRetry:
 
 int
 CIFSSMBMkDir(const int xid, struct cifsTconInfo *tcon,
-             const char *name, const struct nls_table *nls_codepage)
+             const char *name, const struct nls_table *nls_codepage, int remap)
 {
         int rc = 0;
         CREATE_DIRECTORY_REQ *pSMB = NULL;
@@ -655,12 +665,11 @@ MkDirRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifs_strtoUCS((wchar_t *) pSMB->DirName, name, PATH_MAX
-                                         /* find define for this maxpathcomponent */
-                                         , nls_codepage);
+                name_len = cifsConvertToUCS((__u16 *) pSMB->DirName, name, 
+                                            PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
-        } else {                /* BB improve the check for buffer overruns BB */
+        } else {                /* BB improve check for buffer overruns BB */
                 name_len = strnlen(name, PATH_MAX);
                 name_len++;     /* trailing null */
                 strncpy(pSMB->DirName, name, name_len);
@@ -690,7 +699,7 @@ CIFSSMBOpen(const int xid, struct cifsTconInfo *tcon,
             const char *fileName, const int openDisposition,
             const int access_flags, const int create_options, __u16 * netfid,
             int *pOplock, FILE_ALL_INFO * pfile_info, 
-            const struct nls_table *nls_codepage)
+            const struct nls_table *nls_codepage, int remap)
 {
         int rc = -EACCES;
         OPEN_REQ *pSMB = NULL;
@@ -710,14 +719,12 @@ openRetry:
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 count = 1;      /* account for one byte pad to word boundary */
                 name_len =
-                    cifs_strtoUCS((wchar_t *) (pSMB->fileName + 1),
-                                  fileName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) (pSMB->fileName + 1),
+                                     fileName, PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->NameLength = cpu_to_le16(name_len);
-        } else {                /* BB improve the check for buffer overruns BB */
+        } else {                /* BB improve check for buffer overruns BB */
                 count = 0;      /* no pad */
                 name_len = strnlen(fileName, PATH_MAX);
                 name_len++;     /* trailing null */
@@ -746,7 +753,8 @@ openRetry:
         pSMB->ShareAccess = cpu_to_le32(FILE_SHARE_ALL);
         pSMB->CreateDisposition = cpu_to_le32(openDisposition);
         pSMB->CreateOptions = cpu_to_le32(create_options);
-        pSMB->ImpersonationLevel = cpu_to_le32(SECURITY_IMPERSONATION); /* BB ??*/
+        /* BB Expirement with various impersonation levels and verify */
+        pSMB->ImpersonationLevel = cpu_to_le32(SECURITY_IMPERSONATION);
         pSMB->SecurityFlags =
             SECURITY_CONTEXT_TRACKING | SECURITY_EFFECTIVE_ONLY;
 
@@ -760,7 +768,7 @@ openRetry:
         if (rc) {
                 cFYI(1, ("Error in Open = %d", rc));
         } else {
-                *pOplock = pSMBr->OplockLevel;  /* one byte no need to le_to_cpu */
+                *pOplock = pSMBr->OplockLevel; /* 1 byte no need to le_to_cpu */
                 *netfid = pSMBr->Fid;   /* cifs fid stays in le */
                 /* Let caller know file was created so we can set the mode. */
                 /* Do we care about the CreateAction in any other cases? */
@@ -1017,11 +1025,13 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         __u16 count;
 
         cFYI(1, ("In CIFSSMBLock - timeout %d numLock %d",waitFlag,numLock));
-        rc = smb_init(SMB_COM_LOCKING_ANDX, 8, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
+        rc = small_smb_init(SMB_COM_LOCKING_ANDX, 8, tcon, (void **) &pSMB);
+
         if (rc)
                 return rc;
 
+        pSMBr = (LOCK_RSP *)pSMB; /* BB removeme BB */
+
         if(lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
                 timeout = -1; /* no response expected */
                 pSMB->Timeout = 0;
@@ -1059,7 +1069,7 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
         if (rc) {
                 cFYI(1, ("Send error in Lock = %d", rc));
         }
-        cifs_buf_release(pSMB);
+        cifs_small_buf_release(pSMB);
 
         /* Note: On -EAGAIN error only caller can retry on handle based calls 
         since file handle passed in no longer valid */
@@ -1108,7 +1118,7 @@ CIFSSMBClose(const int xid, struct cifsTconInfo *tcon, int smb_file_id)
 int
 CIFSSMBRename(const int xid, struct cifsTconInfo *tcon,
               const char *fromName, const char *toName,
-              const struct nls_table *nls_codepage)
+              const struct nls_table *nls_codepage, int remap)
 {
         int rc = 0;
         RENAME_REQ *pSMB = NULL;
@@ -1131,18 +1141,16 @@ renameRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->OldFileName, fromName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->OldFileName, fromName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0x04;     /* pad */
         /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
                 name_len2 =
-                    cifs_strtoUCS((wchar_t *) & pSMB->
-                                  OldFileName[name_len + 2], toName, PATH_MAX,
-                                  nls_codepage);
+                    cifsConvertToUCS((__u16 *) &pSMB->OldFileName[name_len + 2],
+                                     toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {                /* BB improve the check for buffer overruns BB */
@@ -1182,7 +1190,8 @@ renameRetry:
 }
 
 int CIFSSMBRenameOpenFile(const int xid,struct cifsTconInfo *pTcon, 
-                int netfid, char * target_name, const struct nls_table * nls_codepage) 
+                int netfid, char * target_name, 
+                const struct nls_table * nls_codepage, int remap)
 {
         struct smb_com_transaction2_sfi_req *pSMB  = NULL;
         struct smb_com_transaction2_sfi_rsp *pSMBr = NULL;
@@ -1227,9 +1236,11 @@ int CIFSSMBRenameOpenFile(const int xid,struct cifsTconInfo *pTcon,
         /* unicode only call */
         if(target_name == NULL) {
                 sprintf(dummy_string,"cifs%x",pSMB->hdr.Mid);
-                len_of_str = cifs_strtoUCS((wchar_t *) rename_info->target_name, dummy_string, 24, nls_codepage);
+                len_of_str = cifsConvertToUCS((__u16 *)rename_info->target_name,
+                                        dummy_string, 24, nls_codepage, remap);
         } else {
-                len_of_str = cifs_strtoUCS((wchar_t *) rename_info->target_name, target_name, PATH_MAX, nls_codepage);
+                len_of_str = cifsConvertToUCS((__u16 *)rename_info->target_name,
+                                        target_name, PATH_MAX, nls_codepage, remap);
         }
         rename_info->target_name_len = cpu_to_le32(2 * len_of_str);
         count = 12 /* sizeof(struct set_file_rename) */ + (2 * len_of_str) + 2;
@@ -1263,7 +1274,7 @@ int CIFSSMBRenameOpenFile(const int xid,struct cifsTconInfo *pTcon,
 int
 CIFSSMBCopy(const int xid, struct cifsTconInfo *tcon, const char * fromName, 
             const __u16 target_tid, const char *toName, const int flags,
-            const struct nls_table *nls_codepage)
+            const struct nls_table *nls_codepage, int remap)
 {
         int rc = 0;
         COPY_REQ *pSMB = NULL;
@@ -1285,18 +1296,16 @@ copyRetry:
         pSMB->Flags = cpu_to_le16(flags & COPY_TREE);
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifs_strtoUCS((wchar_t *) pSMB->OldFileName, 
-                                fromName, 
-                                PATH_MAX /* find define for this maxpathcomponent */,
-                                nls_codepage);
+                name_len = cifsConvertToUCS((__u16 *) pSMB->OldFileName, 
+                                            fromName, PATH_MAX, nls_codepage,
+                                            remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0x04;     /* pad */
                 /* protocol requires ASCII signature byte on Unicode string */
                 pSMB->OldFileName[name_len + 1] = 0x00;
-                name_len2 = cifs_strtoUCS((wchar_t *) & pSMB->
-                                OldFileName[name_len + 2], toName, PATH_MAX,
-                                nls_codepage);
+                name_len2 = cifsConvertToUCS((__u16 *)&pSMB->OldFileName[name_len + 2], 
+                                toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {                /* BB improve the check for buffer overruns BB */
@@ -1425,7 +1434,7 @@ createSymLinkRetry:
 int
 CIFSUnixCreateHardLink(const int xid, struct cifsTconInfo *tcon,
                        const char *fromName, const char *toName,
-                       const struct nls_table *nls_codepage)
+                       const struct nls_table *nls_codepage, int remap)
 {
         TRANSACTION2_SPI_REQ *pSMB = NULL;
         TRANSACTION2_SPI_RSP *pSMBr = NULL;
@@ -1444,9 +1453,8 @@ createHardLinkRetry:
                 return rc;
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
-                name_len = cifs_strtoUCS((wchar_t *) pSMB->FileName, toName, PATH_MAX
-                                         /* find define for this maxpathcomponent */
-                                         , nls_codepage);
+                name_len = cifsConvertToUCS((__u16 *) pSMB->FileName, toName,
+                                            PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
 
@@ -1468,9 +1476,8 @@ createHardLinkRetry:
         data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len_target =
-                    cifs_strtoUCS((wchar_t *) data_offset, fromName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) data_offset, fromName, PATH_MAX,
+                                     nls_codepage, remap);
                 name_len_target++;      /* trailing null */
                 name_len_target *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -1512,7 +1519,7 @@ createHardLinkRetry:
 int
 CIFSCreateHardLink(const int xid, struct cifsTconInfo *tcon,
                    const char *fromName, const char *toName,
-                   const struct nls_table *nls_codepage)
+                   const struct nls_table *nls_codepage, int remap)
 {
         int rc = 0;
         NT_RENAME_REQ *pSMB = NULL;
@@ -1539,17 +1546,15 @@ winCreateHardLinkRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->OldFileName, fromName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->OldFileName, fromName,
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->OldFileName[name_len] = 0;        /* pad */
                 pSMB->OldFileName[name_len + 1] = 0x04; 
                 name_len2 =
-                    cifs_strtoUCS((wchar_t *) & pSMB->
-                                  OldFileName[name_len + 2], toName, PATH_MAX,
-                                  nls_codepage);
+                    cifsConvertToUCS((__u16 *)&pSMB->OldFileName[name_len + 2], 
+                                     toName, PATH_MAX, nls_codepage, remap);
                 name_len2 += 1 /* trailing null */  + 1 /* Signature word */ ;
                 name_len2 *= 2; /* convert to bytes */
         } else {                /* BB improve the check for buffer overruns BB */
@@ -1659,6 +1664,7 @@ querySymLinkRetry:
                                 name_len = UniStrnlen((wchar_t *) ((char *)
                                         &pSMBr->hdr.Protocol +data_offset),
                                         min_t(const int, buflen,count) / 2);
+                        /* BB FIXME investigate remapping reserved chars here */
                                 cifs_strfromUCS_le(symlinkinfo,
                                         (wchar_t *) ((char *)&pSMBr->hdr.Protocol +
                                                 data_offset),
@@ -1793,7 +1799,8 @@ static void cifs_convert_ace(posix_acl_xattr_entry * ace, struct cifs_posix_ace
 }
 
 /* Convert ACL from CIFS POSIX wire format to local Linux POSIX ACL xattr */
-static int cifs_copy_posix_acl(char * trgt,char * src, const int buflen,const int acl_type,const int size_of_data_area)
+static int cifs_copy_posix_acl(char * trgt,char * src, const int buflen,
+                                const int acl_type,const int size_of_data_area)
 {
         int size =  0;
         int i;
@@ -1912,7 +1919,7 @@ int
 CIFSSMBGetPosixACL(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
                         char *acl_inf, const int buflen, const int acl_type,
-                        const struct nls_table *nls_codepage)
+                        const struct nls_table *nls_codepage, int remap)
 {
 /* SMB_QUERY_POSIX_ACL */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
@@ -1932,8 +1939,8 @@ queryAclRetry:
                                                                                                                                              
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
-                                , nls_codepage);
+                        cifsConvertToUCS((__u16 *) pSMB->FileName, searchName, 
+                                         PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
                 pSMB->FileName[name_len] = 0;
@@ -1997,8 +2004,9 @@ queryAclRetry:
 int
 CIFSSMBSetPosixACL(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *fileName,
-                        const char *local_acl, const int buflen, const int acl_type,
-                        const struct nls_table *nls_codepage)
+                        const char *local_acl, const int buflen, 
+                        const int acl_type,
+                        const struct nls_table *nls_codepage, int remap)
 {
         struct smb_com_transaction2_spi_req *pSMB = NULL;
         struct smb_com_transaction2_spi_rsp *pSMBr = NULL;
@@ -2016,8 +2024,8 @@ setAclRetry:
                 return rc;
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, PATH_MAX
-                                , nls_codepage);
+                        cifsConvertToUCS((__u16 *) pSMB->FileName, fileName, 
+                                      PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -2072,13 +2080,96 @@ setACLerrorExit:
         return rc;
 }
 
-#endif
+/* BB fix tabs in this function FIXME BB */
+int
+CIFSGetExtAttr(const int xid, struct cifsTconInfo *tcon,
+                const int netfid, __u64 * pExtAttrBits, __u64 *pMask)
+{
+        int rc = 0;
+        struct smb_t2_qfi_req *pSMB = NULL;
+        struct smb_t2_qfi_rsp *pSMBr = NULL;
+        int bytes_returned;
+        __u16 params, byte_count;
+
+        cFYI(1,("In GetExtAttr"));
+        if(tcon == NULL)
+                return -ENODEV;
+
+GetExtAttrRetry:
+        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+                      (void **) &pSMBr);
+        if (rc)
+                return rc;
+
+        params = 2 /* level */ +2 /* fid */;
+        pSMB->t2.TotalDataCount = 0;
+        pSMB->t2.MaxParameterCount = cpu_to_le16(4);
+        /* BB find exact max data count below from sess structure BB */
+        pSMB->t2.MaxDataCount = cpu_to_le16(4000);
+        pSMB->t2.MaxSetupCount = 0;
+        pSMB->t2.Reserved = 0;
+        pSMB->t2.Flags = 0;
+        pSMB->t2.Timeout = 0;
+        pSMB->t2.Reserved2 = 0;
+        pSMB->t2.ParameterOffset = cpu_to_le16(offsetof(struct smb_t2_qfi_req,
+                        Fid) - 4);
+        pSMB->t2.DataCount = 0;
+        pSMB->t2.DataOffset = 0;
+        pSMB->t2.SetupCount = 1;
+        pSMB->t2.Reserved3 = 0;
+        pSMB->t2.SubCommand = cpu_to_le16(TRANS2_QUERY_FILE_INFORMATION);
+        byte_count = params + 1 /* pad */ ;
+        pSMB->t2.TotalParameterCount = cpu_to_le16(params);
+        pSMB->t2.ParameterCount = pSMB->t2.TotalParameterCount;
+        pSMB->InformationLevel = cpu_to_le16(SMB_QUERY_ATTR_FLAGS);
+        pSMB->Pad = 0;
+        pSMB->Fid = netfid;
+        pSMB->hdr.smb_buf_length += byte_count;
+        pSMB->t2.ByteCount = cpu_to_le16(byte_count);
+
+        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+                (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        if (rc) {
+                cFYI(1, ("error %d in GetExtAttr", rc));
+        } else {
+                /* decode response */
+                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                if (rc || (pSMBr->ByteCount < 2))
+                /* BB also check enough total bytes returned */
+                        /* If rc should we check for EOPNOSUPP and
+                        disable the srvino flag? or in caller? */
+                        rc = -EIO;      /* bad smb */
+                else {
+                        __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+                        __u16 count = le16_to_cpu(pSMBr->t2.DataCount);
+                        struct file_chattr_info * pfinfo;
+                        /* BB Do we need a cast or hash here ? */
+                        if(count != 16) {
+                                cFYI(1, ("Illegal size ret in GetExtAttr"));
+                                rc = -EIO;
+                                goto GetExtAttrOut;
+                        }
+                        pfinfo = (struct file_chattr_info *)
+                                (data_offset + (char *) &pSMBr->hdr.Protocol);
+                        *pExtAttrBits = le64_to_cpu(pfinfo->mode);
+                        *pMask = le64_to_cpu(pfinfo->mask);
+                }
+        }
+GetExtAttrOut:
+        cifs_buf_release(pSMB);
+        if (rc == -EAGAIN)
+                goto GetExtAttrRetry;
+        return rc;
+}
+
+
+#endif /* CONFIG_POSIX */
 
 int
 CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                  const unsigned char *searchName,
                  FILE_ALL_INFO * pFindData,
-                 const struct nls_table *nls_codepage)
+                 const struct nls_table *nls_codepage, int remap)
 {
 /* level 263 SMB_QUERY_FILE_ALL_INFO */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
@@ -2097,9 +2188,8 @@ QPathInfoRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, searchName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -2160,7 +2250,7 @@ int
 CIFSSMBUnixQPathInfo(const int xid, struct cifsTconInfo *tcon,
                      const unsigned char *searchName,
                      FILE_UNIX_BASIC_INFO * pFindData,
-                     const struct nls_table *nls_codepage)
+                     const struct nls_table *nls_codepage, int remap)
 {
 /* SMB_QUERY_FILE_UNIX_BASIC */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
@@ -2179,9 +2269,8 @@ UnixQPathInfoRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, searchName,
+                                  PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -2261,7 +2350,7 @@ findUniqueRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
+                    cifsConvertToUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
                                   /* find define for this maxpathcomponent */
                                   , nls_codepage);
                 name_len++;     /* trailing null */
@@ -2325,7 +2414,7 @@ CIFSFindFirst(const int xid, struct cifsTconInfo *tcon,
               const char *searchName, 
               const struct nls_table *nls_codepage,
               __u16 *   pnetfid,
-              struct cifs_search_info * psrch_inf)
+              struct cifs_search_info * psrch_inf, int remap)
 {
 /* level 257 SMB_ */
         TRANSACTION2_FFIRST_REQ *pSMB = NULL;
@@ -2336,7 +2425,7 @@ CIFSFindFirst(const int xid, struct cifsTconInfo *tcon,
         int name_len;
         __u16 params, byte_count;
 
-        cFYI(1, ("In FindFirst"));
+        cFYI(1, ("In FindFirst for %s",searchName));
 
 findFirstRetry:
         rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
@@ -2346,20 +2435,30 @@ findFirstRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName,searchName,
-                                 PATH_MAX, nls_codepage);
-                name_len++;     /* trailing null */
+                    cifsConvertToUCS((__u16 *) pSMB->FileName,searchName,
+                                 PATH_MAX, nls_codepage, remap);
+                /* We can not add the asterik earlier in case
+                it got remapped to 0xF03A as if it were part of the
+                directory name instead of a wildcard */
                 name_len *= 2;
+                pSMB->FileName[name_len] = '\\';
+                pSMB->FileName[name_len+1] = 0;
+                pSMB->FileName[name_len+2] = '*';
+                pSMB->FileName[name_len+3] = 0;
+                name_len += 4; /* now the trailing null */
                 pSMB->FileName[name_len] = 0; /* null terminate just in case */
                 pSMB->FileName[name_len+1] = 0;
+                name_len += 2;
         } else {        /* BB add check for overrun of SMB buf BB */
                 name_len = strnlen(searchName, PATH_MAX);
-                name_len++;     /* trailing null */
 /* BB fix here and in unicode clause above ie
                 if(name_len > buffersize-header)
                         free buffer exit; BB */
                 strncpy(pSMB->FileName, searchName, name_len);
-                pSMB->FileName[name_len] = 0; /* just in case */
+                pSMB->FileName[name_len] = '\\';
+                pSMB->FileName[name_len+1] = '*';
+                pSMB->FileName[name_len+2] = 0;
+                name_len += 3;
         }
 
         params = 12 + name_len /* includes null */ ;
@@ -2422,7 +2521,6 @@ findFirstRetry:
                         psrch_inf->srch_entries_start = 
                                 (char *) &pSMBr->hdr.Protocol + 
                                         le16_to_cpu(pSMBr->t2.DataOffset);
-
                         parms = (T2_FFIRST_RSP_PARMS *)((char *) &pSMBr->hdr.Protocol +
                                le16_to_cpu(pSMBr->t2.ParameterOffset));
 
@@ -2434,7 +2532,6 @@ findFirstRetry:
                         psrch_inf->entries_in_buffer  = le16_to_cpu(parms->SearchCount);
                         psrch_inf->index_of_last_entry = 
                                 psrch_inf->entries_in_buffer;
-/*cFYI(1,("entries in buf %d index_of_last %d",psrch_inf->entries_in_buffer,psrch_inf->index_of_last_entry));  */
                         *pnetfid = parms->SearchHandle;
                 } else {
                         cifs_buf_release(pSMB);
@@ -2608,7 +2705,7 @@ int
 CIFSGetSrvInodeNumber(const int xid, struct cifsTconInfo *tcon,
                 const unsigned char *searchName,
                 __u64 * inode_number,
-                const struct nls_table *nls_codepage)
+                const struct nls_table *nls_codepage, int remap)
 {
         int rc = 0;
         TRANSACTION2_QPI_REQ *pSMB = NULL;
@@ -2629,8 +2726,8 @@ GetInodeNumberRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, 
-                                PATH_MAX,nls_codepage);
+                        cifsConvertToUCS((__u16 *) pSMB->FileName, searchName,
+                                PATH_MAX,nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -2704,7 +2801,7 @@ CIFSGetDFSRefer(const int xid, struct cifsSesInfo *ses,
                 const unsigned char *searchName,
                 unsigned char **targetUNCs,
                 unsigned int *number_of_UNC_in_array,
-                const struct nls_table *nls_codepage)
+                const struct nls_table *nls_codepage, int remap)
 {
 /* TRANS2_GET_DFS_REFERRAL */
         TRANSACTION2_GET_DFS_REFER_REQ *pSMB = NULL;
@@ -2740,10 +2837,8 @@ getDFSRetry:
         if (ses->capabilities & CAP_UNICODE) {
                 pSMB->hdr.Flags2 |= SMBFLG2_UNICODE;
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->RequestFileName,
-                                  searchName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->RequestFileName,
+                                     searchName, PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -2871,8 +2966,7 @@ GetDFSRefExit:
 }
 
 int
-CIFSSMBQFSInfo(const int xid, struct cifsTconInfo *tcon,
-               struct kstatfs *FSData, const struct nls_table *nls_codepage)
+CIFSSMBQFSInfo(const int xid, struct cifsTconInfo *tcon, struct kstatfs *FSData)
 {
 /* level 0x103 SMB_QUERY_FILE_SYSTEM_INFO */
         TRANSACTION2_QFSI_REQ *pSMB = NULL;
@@ -2955,8 +3049,7 @@ QFSInfoRetry:
 }
 
 int
-CIFSSMBQFSAttributeInfo(const int xid, struct cifsTconInfo *tcon,
-                        const struct nls_table *nls_codepage)
+CIFSSMBQFSAttributeInfo(const int xid, struct cifsTconInfo *tcon)
 {
 /* level 0x105  SMB_QUERY_FILE_SYSTEM_INFO */
         TRANSACTION2_QFSI_REQ *pSMB = NULL;
@@ -3024,8 +3117,7 @@ QFSAttributeRetry:
 }
 
 int
-CIFSSMBQFSDeviceInfo(const int xid, struct cifsTconInfo *tcon,
-                     const struct nls_table *nls_codepage)
+CIFSSMBQFSDeviceInfo(const int xid, struct cifsTconInfo *tcon)
 {
 /* level 0x104 SMB_QUERY_FILE_SYSTEM_INFO */
         TRANSACTION2_QFSI_REQ *pSMB = NULL;
@@ -3078,8 +3170,8 @@ QFSDeviceRetry:
                 else {
                         __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
                         response_data =
-                            (FILE_SYSTEM_DEVICE_INFO
-                             *) (((char *) &pSMBr->hdr.Protocol) +
+                            (FILE_SYSTEM_DEVICE_INFO *)
+                                (((char *) &pSMBr->hdr.Protocol) +
                                  data_offset);
                         memcpy(&tcon->fsDevInfo, response_data,
                                sizeof (FILE_SYSTEM_DEVICE_INFO));
@@ -3094,8 +3186,7 @@ QFSDeviceRetry:
 }
 
 int
-CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon,
-                   const struct nls_table *nls_codepage)
+CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon)
 {
 /* level 0x200  SMB_QUERY_CIFS_UNIX_INFO */
         TRANSACTION2_QFSI_REQ *pSMB = NULL;
@@ -3166,7 +3257,7 @@ QFSUnixRetry:
 
 int
 CIFSSMBQFSPosixInfo(const int xid, struct cifsTconInfo *tcon,
-                   struct kstatfs *FSData, const struct nls_table *nls_codepage)
+                   struct kstatfs *FSData)
 {
 /* level 0x201  SMB_QUERY_CIFS_POSIX_INFO */
         TRANSACTION2_QFSI_REQ *pSMB = NULL;
@@ -3258,7 +3349,8 @@ QFSPosixRetry:
 
 int
 CIFSSMBSetEOF(const int xid, struct cifsTconInfo *tcon, const char *fileName,
-              __u64 size, int SetAllocation, const struct nls_table *nls_codepage)
+              __u64 size, int SetAllocation, 
+              const struct nls_table *nls_codepage, int remap)
 {
         struct smb_com_transaction2_spi_req *pSMB = NULL;
         struct smb_com_transaction2_spi_rsp *pSMBr = NULL;
@@ -3277,9 +3369,8 @@ SetEOFRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, fileName,
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -3360,11 +3451,13 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
 
         cFYI(1, ("SetFileSize (via SetFileInfo) %lld",
                         (long long)size));
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
+        rc = small_smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB);
+
         if (rc)
                 return rc;
 
+        pSMBr = (struct smb_com_transaction2_sfi_rsp *)pSMB;
+
         pSMB->hdr.Pid = cpu_to_le16((__u16)pid_of_opener);
         pSMB->hdr.PidHigh = cpu_to_le16((__u16)(pid_of_opener >> 16));
     
@@ -3424,7 +3517,7 @@ CIFSSMBSetFileSize(const int xid, struct cifsTconInfo *tcon, __u64 size,
         }
 
         if (pSMB)
-                cifs_buf_release(pSMB);
+                cifs_small_buf_release(pSMB);
 
         /* Note: On -EAGAIN error only caller can retry on handle based calls 
                 since file handle passed in no longer valid */
@@ -3450,11 +3543,13 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon, const FILE_BASIC_I
         __u16 params, param_offset, offset, byte_count, count;
 
         cFYI(1, ("Set Times (via SetFileInfo)"));
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
+        rc = small_smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB);
+
         if (rc)
                 return rc;
 
+        pSMBr = (struct smb_com_transaction2_sfi_rsp *)pSMB;
+
         /* At this point there is no need to override the current pid
         with the pid of the opener, but that could change if we someday
         use an existing handle (rather than opening one on the fly) */
@@ -3500,7 +3595,7 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon, const FILE_BASIC_I
                 cFYI(1,("Send error in Set Time (SetFileInfo) = %d",rc));
         }
 
-        cifs_buf_release(pSMB);
+        cifs_small_buf_release(pSMB);
 
         /* Note: On -EAGAIN error only caller can retry on handle based calls 
                 since file handle passed in no longer valid */
@@ -3512,7 +3607,7 @@ CIFSSMBSetFileTimes(const int xid, struct cifsTconInfo *tcon, const FILE_BASIC_I
 int
 CIFSSMBSetTimes(const int xid, struct cifsTconInfo *tcon, const char *fileName,
                 const FILE_BASIC_INFO * data, 
-                const struct nls_table *nls_codepage)
+                const struct nls_table *nls_codepage, int remap)
 {
         TRANSACTION2_SPI_REQ *pSMB = NULL;
         TRANSACTION2_SPI_RSP *pSMBr = NULL;
@@ -3532,9 +3627,8 @@ SetTimesRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, fileName,
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -3614,7 +3708,7 @@ SetAttrLgcyRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                        cifs_strtoUCS((wchar_t *) pSMB->fileName, fileName, 
+                        ConvertToUCS((wchar_t *) pSMB->fileName, fileName, 
                                 PATH_MAX, nls_codepage);
                 name_len++;     /* trailing null */
                 name_len *= 2;
@@ -3644,8 +3738,9 @@ SetAttrLgcyRetry:
 
 int
 CIFSSMBUnixSetPerms(const int xid, struct cifsTconInfo *tcon,
-                    char *fileName, __u64 mode, __u64 uid, __u64 gid,
-                    dev_t device, const struct nls_table *nls_codepage)
+                    char *fileName, __u64 mode, __u64 uid, __u64 gid, 
+                    dev_t device, const struct nls_table *nls_codepage, 
+                    int remap)
 {
         TRANSACTION2_SPI_REQ *pSMB = NULL;
         TRANSACTION2_SPI_RSP *pSMBr = NULL;
@@ -3664,9 +3759,8 @@ setPermsRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, fileName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
@@ -3789,7 +3883,7 @@ ssize_t
 CIFSSMBQAllEAs(const int xid, struct cifsTconInfo *tcon,
                  const unsigned char *searchName,
                  char * EAData, size_t buf_size,
-                 const struct nls_table *nls_codepage)
+                 const struct nls_table *nls_codepage, int remap)
 {
                 /* BB assumes one setup word */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
@@ -3810,9 +3904,8 @@ QAllEAsRetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((wchar_t *) pSMB->FileName, searchName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -3934,7 +4027,7 @@ QAllEAsRetry:
 ssize_t CIFSSMBQueryEA(const int xid,struct cifsTconInfo * tcon,
                 const unsigned char * searchName,const unsigned char * ea_name,
                 unsigned char * ea_value, size_t buf_size, 
-                const struct nls_table *nls_codepage)
+                const struct nls_table *nls_codepage, int remap)
 {
         TRANSACTION2_QPI_REQ *pSMB = NULL;
         TRANSACTION2_QPI_RSP *pSMBr = NULL;
@@ -3954,9 +4047,8 @@ QEARetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, searchName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, searchName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {        /* BB improve the check for buffer overruns BB */
@@ -4082,7 +4174,8 @@ QEARetry:
 int
 CIFSSMBSetEA(const int xid, struct cifsTconInfo *tcon, const char *fileName,
                 const char * ea_name, const void * ea_value, 
-                const __u16 ea_value_len, const struct nls_table *nls_codepage)
+                const __u16 ea_value_len, const struct nls_table *nls_codepage,
+                int remap)
 {
         struct smb_com_transaction2_spi_req *pSMB = NULL;
         struct smb_com_transaction2_spi_rsp *pSMBr = NULL;
@@ -4101,9 +4194,8 @@ SetEARetry:
 
         if (pSMB->hdr.Flags2 & SMBFLG2_UNICODE) {
                 name_len =
-                    cifs_strtoUCS((wchar_t *) pSMB->FileName, fileName, PATH_MAX
-                                  /* find define for this maxpathcomponent */
-                                  , nls_codepage);
+                    cifsConvertToUCS((__u16 *) pSMB->FileName, fileName, 
+                                     PATH_MAX, nls_codepage, remap);
                 name_len++;     /* trailing null */
                 name_len *= 2;
         } else {                /* BB improve the check for buffer overruns BB */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 40470b9d5477..e568cc47a7f9 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/connect.c
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2004
+ *   Copyright (C) International Business Machines  Corp., 2002,2005
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -28,6 +28,7 @@
 #include <linux/ctype.h>
 #include <linux/utsname.h>
 #include <linux/mempool.h>
+#include <linux/delay.h>
 #include <asm/uaccess.h>
 #include <asm/processor.h>
 #include "cifspdu.h"
@@ -72,6 +73,7 @@ struct smb_vol {
         unsigned no_xattr:1;   /* set if xattr (EA) support should be disabled*/
         unsigned server_ino:1; /* use inode numbers from server ie UniqueId */
         unsigned direct_io:1;
+        unsigned remap:1;   /* set to remap seven reserved chars in filenames */
         unsigned int rsize;
         unsigned int wsize;
         unsigned int sockopt;
@@ -114,7 +116,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
         spin_unlock(&GlobalMid_Lock);
         server->maxBuf = 0;
 
-        cFYI(1, ("Reconnecting tcp session "));
+        cFYI(1, ("Reconnecting tcp session"));
 
         /* before reconnecting the tcp session, mark the smb session (uid)
                 and the tid bad so they are not used until reconnected */
@@ -155,9 +157,10 @@ cifs_reconnect(struct TCP_Server_Info *server)
                                         qhead);
                 if(mid_entry) {
                         if(mid_entry->midState == MID_REQUEST_SUBMITTED) {
-                                /* Mark other intransit requests as needing retry so 
-                                  we do not immediately mark the session bad again 
-                                  (ie after we reconnect below) as they timeout too */
+                                /* Mark other intransit requests as needing
+                                   retry so we do not immediately mark the
+                                   session bad again (ie after we reconnect
+                                   below) as they timeout too */
                                 mid_entry->midState = MID_RETRY_NEEDED;
                         }
                 }
@@ -175,14 +178,14 @@ cifs_reconnect(struct TCP_Server_Info *server)
                                         server->workstation_RFC1001_name);
                 }
                 if(rc) {
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        schedule_timeout(3 * HZ);
+                        msleep(3000);
                 } else {
                         atomic_inc(&tcpSesReconnectCount);
                         spin_lock(&GlobalMid_Lock);
                         if(server->tcpStatus != CifsExiting)
                                 server->tcpStatus = CifsGood;
-                        spin_unlock(&GlobalMid_Lock);
+                        server->sequence_number = 0;
+                        spin_unlock(&GlobalMid_Lock);                   
         /*              atomic_set(&server->inFlight,0);*/
                         wake_up(&server->response_q);
                 }
@@ -190,12 +193,129 @@ cifs_reconnect(struct TCP_Server_Info *server)
         return rc;
 }
 
+/* 
+        return codes:
+                0       not a transact2, or all data present
+                >0      transact2 with that much data missing
+                -EINVAL = invalid transact2
+
+ */
+static int check2ndT2(struct smb_hdr * pSMB, unsigned int maxBufSize)
+{
+        struct smb_t2_rsp * pSMBt;
+        int total_data_size;
+        int data_in_this_rsp;
+        int remaining;
+
+        if(pSMB->Command != SMB_COM_TRANSACTION2)
+                return 0;
+
+        /* check for plausible wct, bcc and t2 data and parm sizes */
+        /* check for parm and data offset going beyond end of smb */
+        if(pSMB->WordCount != 10) { /* coalesce_t2 depends on this */
+                cFYI(1,("invalid transact2 word count"));
+                return -EINVAL;
+        }
+
+        pSMBt = (struct smb_t2_rsp *)pSMB;
+
+        total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
+        data_in_this_rsp = le16_to_cpu(pSMBt->t2_rsp.DataCount);
+
+        remaining = total_data_size - data_in_this_rsp;
+
+        if(remaining == 0)
+                return 0;
+        else if(remaining < 0) {
+                cFYI(1,("total data %d smaller than data in frame %d",
+                        total_data_size, data_in_this_rsp));
+                return -EINVAL;
+        } else {
+                cFYI(1,("missing %d bytes from transact2, check next response",
+                        remaining));
+                if(total_data_size > maxBufSize) {
+                        cERROR(1,("TotalDataSize %d is over maximum buffer %d",
+                                total_data_size,maxBufSize));
+                        return -EINVAL; 
+                }
+                return remaining;
+        }
+}
+
+static int coalesce_t2(struct smb_hdr * psecond, struct smb_hdr *pTargetSMB)
+{
+        struct smb_t2_rsp *pSMB2 = (struct smb_t2_rsp *)psecond;
+        struct smb_t2_rsp *pSMBt  = (struct smb_t2_rsp *)pTargetSMB;
+        int total_data_size;
+        int total_in_buf;
+        int remaining;
+        int total_in_buf2;
+        char * data_area_of_target;
+        char * data_area_of_buf2;
+        __u16 byte_count;
+
+        total_data_size = le16_to_cpu(pSMBt->t2_rsp.TotalDataCount);
+
+        if(total_data_size != le16_to_cpu(pSMB2->t2_rsp.TotalDataCount)) {
+                cFYI(1,("total data sizes of primary and secondary t2 differ"));
+        }
+
+        total_in_buf = le16_to_cpu(pSMBt->t2_rsp.DataCount);
+
+        remaining = total_data_size - total_in_buf;
+        
+        if(remaining < 0)
+                return -EINVAL;
+
+        if(remaining == 0) /* nothing to do, ignore */
+                return 0;
+        
+        total_in_buf2 = le16_to_cpu(pSMB2->t2_rsp.DataCount);
+        if(remaining < total_in_buf2) {
+                cFYI(1,("transact2 2nd response contains too much data"));
+        }
+
+        /* find end of first SMB data area */
+        data_area_of_target = (char *)&pSMBt->hdr.Protocol + 
+                                le16_to_cpu(pSMBt->t2_rsp.DataOffset);
+        /* validate target area */
+
+        data_area_of_buf2 = (char *) &pSMB2->hdr.Protocol +
+                                        le16_to_cpu(pSMB2->t2_rsp.DataOffset);
+
+        data_area_of_target += total_in_buf;
+
+        /* copy second buffer into end of first buffer */
+        memcpy(data_area_of_target,data_area_of_buf2,total_in_buf2);
+        total_in_buf += total_in_buf2;
+        pSMBt->t2_rsp.DataCount = cpu_to_le16(total_in_buf);
+        byte_count = le16_to_cpu(BCC_LE(pTargetSMB));
+        byte_count += total_in_buf2;
+        BCC_LE(pTargetSMB) = cpu_to_le16(byte_count);
+
+        byte_count = be32_to_cpu(pTargetSMB->smb_buf_length);
+        byte_count += total_in_buf2;
+
+        /* BB also add check that we are not beyond maximum buffer size */
+                
+        pTargetSMB->smb_buf_length = cpu_to_be32(byte_count);
+
+        if(remaining == total_in_buf2) {
+                cFYI(1,("found the last secondary response"));
+                return 0; /* we are done */
+        } else /* more responses to go */
+                return 1;
+
+}
+
 static int
 cifs_demultiplex_thread(struct TCP_Server_Info *server)
 {
         int length;
         unsigned int pdu_length, total_read;
         struct smb_hdr *smb_buffer = NULL;
+        struct smb_hdr *bigbuf = NULL;
+        struct smb_hdr *smallbuf = NULL;
         struct msghdr smb_msg;
         struct kvec iov;
         struct socket *csocket = server->ssocket;
@@ -204,6 +324,9 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
         struct task_struct *task_to_wake = NULL;
         struct mid_q_entry *mid_entry;
         char *temp;
+        int isLargeBuf = FALSE;
+        int isMultiRsp;
+        int reconnect;
 
         daemonize("cifsd");
         allow_signal(SIGKILL);
@@ -221,17 +344,34 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
         }
 
         while (server->tcpStatus != CifsExiting) {
-                if (smb_buffer == NULL)
-                        smb_buffer = cifs_buf_get();
-                else
-                        memset(smb_buffer, 0, sizeof (struct smb_hdr));
-
-                if (smb_buffer == NULL) {
-                        cERROR(1,("Can not get memory for SMB response"));
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        schedule_timeout(HZ * 3); /* give system time to free memory */
-                        continue;
+                if (bigbuf == NULL) {
+                        bigbuf = cifs_buf_get();
+                        if(bigbuf == NULL) {
+                                cERROR(1,("No memory for large SMB response"));
+                                msleep(3000);
+                                /* retry will check if exiting */
+                                continue;
+                        }
+                } else if(isLargeBuf) {
+                        /* we are reusing a dirtry large buf, clear its start */
+                        memset(bigbuf, 0, sizeof (struct smb_hdr));
                 }
+
+                if (smallbuf == NULL) {
+                        smallbuf = cifs_small_buf_get();
+                        if(smallbuf == NULL) {
+                                cERROR(1,("No memory for SMB response"));
+                                msleep(1000);
+                                /* retry will check if exiting */
+                                continue;
+                        }
+                        /* beginning of smb buffer is cleared in our buf_get */
+                } else /* if existing small buf clear beginning */
+                        memset(smallbuf, 0, sizeof (struct smb_hdr));
+
+                isLargeBuf = FALSE;
+                isMultiRsp = FALSE;
+                smb_buffer = smallbuf;
                 iov.iov_base = smb_buffer;
                 iov.iov_len = 4;
                 smb_msg.msg_control = NULL;
@@ -243,176 +383,257 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 if(server->tcpStatus == CifsExiting) {
                         break;
                 } else if (server->tcpStatus == CifsNeedReconnect) {
-                        cFYI(1,("Reconnecting after server stopped responding"));
+                        cFYI(1,("Reconnect after server stopped responding"));
                         cifs_reconnect(server);
                         cFYI(1,("call to reconnect done"));
                         csocket = server->ssocket;
                         continue;
                 } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        schedule_timeout(1); /* minimum sleep to prevent looping
+                        msleep(1); /* minimum sleep to prevent looping
                                 allowing socket to clear and app threads to set
                                 tcpStatus CifsNeedReconnect if server hung */
                         continue;
                 } else if (length <= 0) {
                         if(server->tcpStatus == CifsNew) {
-                                cFYI(1,("tcp session abended prematurely (after SMBnegprot)"));
-                                /* some servers kill tcp session rather than returning
-                                        smb negprot error in which case reconnecting here is
-                                        not going to help - return error to mount */
+                                cFYI(1,("tcp session abend after SMBnegprot"));
+                                /* some servers kill the TCP session rather than
+                                   returning an SMB negprot error, in which
+                                   case reconnecting here is not going to help,
+                                   and so simply return error to mount */
                                 break;
                         }
                         if(length == -EINTR) { 
                                 cFYI(1,("cifsd thread killed"));
                                 break;
                         }
-                        cFYI(1,("Reconnecting after unexpected peek error %d",length));
+                        cFYI(1,("Reconnect after unexpected peek error %d",
+                                length));
                         cifs_reconnect(server);
                         csocket = server->ssocket;
                         wake_up(&server->response_q);
                         continue;
-                } else if (length > 3) {
-                        pdu_length = ntohl(smb_buffer->smb_buf_length);
-                /* Only read pdu_length after below checks for too short (due
-                   to e.g. int overflow) and too long ie beyond end of buf */
-                        cFYI(1,("rfc1002 length(big endian)0x%x)", pdu_length+4));
-
-                        temp = (char *) smb_buffer;
-                        if (temp[0] == (char) RFC1002_SESSION_KEEP_ALIVE) {
-                                cFYI(0,("Received 4 byte keep alive packet"));
-                        } else if (temp[0] == (char) RFC1002_POSITIVE_SESSION_RESPONSE) {
-                                        cFYI(1,("Good RFC 1002 session rsp"));
-                        } else if (temp[0] == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
-                                /* we get this from Windows 98 instead of error on SMB negprot response */
-                                cFYI(1,("Negative RFC 1002 Session Response Error 0x%x)",temp[4]));
-                                if(server->tcpStatus == CifsNew) {
-                                        /* if nack on negprot (rather than 
-                                        ret of smb negprot error) reconnecting
-                                        not going to help, ret error to mount */
-                                        break;
-                                } else {
-                                        /* give server a second to
-                                        clean up before reconnect attempt */
-                                        set_current_state(TASK_INTERRUPTIBLE);
-                                        schedule_timeout(HZ);
-                                        /* always try 445 first on reconnect
-                                        since we get NACK on some if we ever
-                                        connected to port 139 (the NACK is 
-                                        since we do not begin with RFC1001
-                                        session initialize frame) */
-                                        server->addr.sockAddr.sin_port = htons(CIFS_PORT);
-                                        cifs_reconnect(server);
-                                        csocket = server->ssocket;
-                                        wake_up(&server->response_q);
-                                        continue;
-                                }
-                        } else if (temp[0] != (char) 0) {
-                                cERROR(1,("Unknown RFC 1002 frame"));
-                                cifs_dump_mem(" Received Data: ", temp, length);
-                                cifs_reconnect(server);
-                                csocket = server->ssocket;
-                                continue;
-                        } else {
-                                if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
-                                    || (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
-                                        cERROR(1,
-                                            ("Invalid size SMB length %d and pdu_length %d",
-                                                length, pdu_length+4));
-                                        cifs_reconnect(server);
-                                        csocket = server->ssocket;
-                                        wake_up(&server->response_q);
-                                        continue;
-                                } else { /* length ok */
-                                        length = 0;
-                                        iov.iov_base = 4 + (char *)smb_buffer;
-                                        iov.iov_len = pdu_length;
-                                        for (total_read = 0; 
-                                             total_read < pdu_length;
-                                             total_read += length) {
-                                                length = kernel_recvmsg(csocket, &smb_msg, 
-                                                        &iov, 1,
-                                                        pdu_length - total_read, 0);
-                                                if (length == 0) {
-                                                        cERROR(1,
-                                                               ("Zero length receive when expecting %d ",
-                                                                pdu_length - total_read));
-                                                        cifs_reconnect(server);
-                                                        csocket = server->ssocket;
-                                                        wake_up(&server->response_q);
-                                                        continue;
-                                                }
-                                        }
-                                        length += 4; /* account for rfc1002 hdr */
-                                }
+                } else if (length < 4) {
+                        cFYI(1,
+                            ("Frame under four bytes received (%d bytes long)",
+                              length));
+                        cifs_reconnect(server);
+                        csocket = server->ssocket;
+                        wake_up(&server->response_q);
+                        continue;
+                }
 
-                                dump_smb(smb_buffer, length);
-                                if (checkSMB
-                                    (smb_buffer, smb_buffer->Mid, total_read+4)) {
-                                        cERROR(1, ("Bad SMB Received "));
-                                        continue;
-                                }
+                /* the right amount was read from socket - 4 bytes */
 
-                                task_to_wake = NULL;
-                                spin_lock(&GlobalMid_Lock);
-                                list_for_each(tmp, &server->pending_mid_q) {
-                                        mid_entry = list_entry(tmp, struct
-                                                               mid_q_entry,
-                                                               qhead);
+                pdu_length = ntohl(smb_buffer->smb_buf_length);
+                cFYI(1,("rfc1002 length(big endian)0x%x)", pdu_length+4));
 
-                                        if ((mid_entry->mid == smb_buffer->Mid) && (mid_entry->midState == MID_REQUEST_SUBMITTED)) {
-                                                cFYI(1,
-                                                     (" Mid 0x%x matched - waking up ",mid_entry->mid));
-                                                task_to_wake = mid_entry->tsk;
-                                                mid_entry->resp_buf =
-                                                    smb_buffer;
-                                                mid_entry->midState =
-                                                    MID_RESPONSE_RECEIVED;
-                                        }
-                                }
-                                spin_unlock(&GlobalMid_Lock);
-                                if (task_to_wake) {
-                                        smb_buffer = NULL;      /* will be freed by users thread after he is done */
-                                        wake_up_process(task_to_wake);
-                                } else if (is_valid_oplock_break(smb_buffer) == FALSE) {                          
-                                        cERROR(1, ("No task to wake, unknown frame rcvd!"));
-                                        cifs_dump_mem("Received Data is: ",temp,sizeof(struct smb_hdr));
-                                }
+                temp = (char *) smb_buffer;
+                if (temp[0] == (char) RFC1002_SESSION_KEEP_ALIVE) {
+                        continue; 
+                } else if (temp[0] == (char)RFC1002_POSITIVE_SESSION_RESPONSE) {
+                        cFYI(1,("Good RFC 1002 session rsp"));
+                        continue;
+                } else if (temp[0] == (char)RFC1002_NEGATIVE_SESSION_RESPONSE) {
+                        /* we get this from Windows 98 instead of 
+                           an error on SMB negprot response */
+                        cFYI(1,("Negative RFC1002 Session Response Error 0x%x)",
+                                temp[4]));
+                        if(server->tcpStatus == CifsNew) {
+                                /* if nack on negprot (rather than 
+                                ret of smb negprot error) reconnecting
+                                not going to help, ret error to mount */
+                                break;
+                        } else {
+                                /* give server a second to
+                                clean up before reconnect attempt */
+                                msleep(1000);
+                                /* always try 445 first on reconnect
+                                since we get NACK on some if we ever
+                                connected to port 139 (the NACK is 
+                                since we do not begin with RFC1001
+                                session initialize frame) */
+                                server->addr.sockAddr.sin_port = 
+                                        htons(CIFS_PORT);
+                                cifs_reconnect(server);
+                                csocket = server->ssocket;
+                                wake_up(&server->response_q);
+                                continue;
                         }
-                } else {
-                        cFYI(1,
-                            ("Frame less than four bytes received  %d bytes long.",
-                              length));
+                } else if (temp[0] != (char) 0) {
+                        cERROR(1,("Unknown RFC 1002 frame"));
+                        cifs_dump_mem(" Received Data: ", temp, length);
+                        cifs_reconnect(server);
+                        csocket = server->ssocket;
+                        continue;
+                }
+
+                /* else we have an SMB response */
+                if((pdu_length > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) ||
+                            (pdu_length < sizeof (struct smb_hdr) - 1 - 4)) {
+                        cERROR(1, ("Invalid size SMB length %d pdu_length %d",
+                                        length, pdu_length+4));
                         cifs_reconnect(server);
                         csocket = server->ssocket;
                         wake_up(&server->response_q);
                         continue;
+                } 
+
+                /* else length ok */
+                reconnect = 0;
+
+                if(pdu_length > MAX_CIFS_HDR_SIZE - 4) {
+                        isLargeBuf = TRUE;
+                        memcpy(bigbuf, smallbuf, 4);
+                        smb_buffer = bigbuf;
                 }
-        }
+                length = 0;
+                iov.iov_base = 4 + (char *)smb_buffer;
+                iov.iov_len = pdu_length;
+                for (total_read = 0; total_read < pdu_length; 
+                     total_read += length) {
+                        length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
+                                                pdu_length - total_read, 0);
+                        if((server->tcpStatus == CifsExiting) ||
+                            (length == -EINTR)) {
+                                /* then will exit */
+                                reconnect = 2;
+                                break;
+                        } else if (server->tcpStatus == CifsNeedReconnect) {
+                                cifs_reconnect(server);
+                                csocket = server->ssocket;
+                                /* Reconnect wakes up rspns q */
+                                /* Now we will reread sock */
+                                reconnect = 1;
+                                break;
+                        } else if ((length == -ERESTARTSYS) || 
+                                   (length == -EAGAIN)) {
+                                msleep(1); /* minimum sleep to prevent looping,
+                                              allowing socket to clear and app 
+                                              threads to set tcpStatus
+                                              CifsNeedReconnect if server hung*/
+                                continue;
+                        } else if (length <= 0) {
+                                cERROR(1,("Received no data, expecting %d",
+                                              pdu_length - total_read));
+                                cifs_reconnect(server);
+                                csocket = server->ssocket;
+                                reconnect = 1;
+                                break;
+                        }
+                }
+                if(reconnect == 2)
+                        break;
+                else if(reconnect == 1)
+                        continue;
+
+                length += 4; /* account for rfc1002 hdr */
+        
+
+                dump_smb(smb_buffer, length);
+                if (checkSMB (smb_buffer, smb_buffer->Mid, total_read+4)) {
+                        cERROR(1, ("Bad SMB Received "));
+                        continue;
+                }
+
+
+                task_to_wake = NULL;
+                spin_lock(&GlobalMid_Lock);
+                list_for_each(tmp, &server->pending_mid_q) {
+                        mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
+
+                        if ((mid_entry->mid == smb_buffer->Mid) && 
+                            (mid_entry->midState == MID_REQUEST_SUBMITTED) &&
+                            (mid_entry->command == smb_buffer->Command)) {
+                                if(check2ndT2(smb_buffer,server->maxBuf) > 0) {
+                                        /* We have a multipart transact2 resp */
+                                        isMultiRsp = TRUE;
+                                        if(mid_entry->resp_buf) {
+                                                /* merge response - fix up 1st*/
+                                                if(coalesce_t2(smb_buffer, 
+                                                        mid_entry->resp_buf)) {
+                                                        break;
+                                                } else {
+                                                        /* all parts received */
+                                                        goto multi_t2_fnd; 
+                                                }
+                                        } else {
+                                                if(!isLargeBuf) {
+                                                        cERROR(1,("1st trans2 resp needs bigbuf"));
+                                        /* BB maybe we can fix this up,  switch
+                                           to already allocated large buffer? */
+                                                } else {
+                                                        /* Have first buffer */
+                                                        mid_entry->resp_buf =
+                                                                 smb_buffer;
+                                                        mid_entry->largeBuf = 1;
+                                                        bigbuf = NULL;
+                                                }
+                                        }
+                                        break;
+                                } 
+                                mid_entry->resp_buf = smb_buffer;
+                                if(isLargeBuf)
+                                        mid_entry->largeBuf = 1;
+                                else
+                                        mid_entry->largeBuf = 0;
+multi_t2_fnd:
+                                task_to_wake = mid_entry->tsk;
+                                mid_entry->midState = MID_RESPONSE_RECEIVED;
+                                break;
+                        }
+                }
+                spin_unlock(&GlobalMid_Lock);
+                if (task_to_wake) {
+                        /* Was previous buf put in mpx struct for multi-rsp? */
+                        if(!isMultiRsp) {
+                                /* smb buffer will be freed by user thread */
+                                if(isLargeBuf) {
+                                        bigbuf = NULL;
+                                } else
+                                        smallbuf = NULL;
+                        }
+                        wake_up_process(task_to_wake);
+                } else if ((is_valid_oplock_break(smb_buffer) == FALSE)
+                    && (isMultiRsp == FALSE)) {                          
+                        cERROR(1, ("No task to wake, unknown frame rcvd!"));
+                        cifs_dump_mem("Received Data is: ",temp,sizeof(struct smb_hdr));
+                }
+        } /* end while !EXITING */
+
         spin_lock(&GlobalMid_Lock);
         server->tcpStatus = CifsExiting;
         server->tsk = NULL;
-        atomic_set(&server->inFlight, 0);
+        /* check if we have blocked requests that need to free */
+        /* Note that cifs_max_pending is normally 50, but
+        can be set at module install time to as little as two */
+        if(atomic_read(&server->inFlight) >= cifs_max_pending)
+                atomic_set(&server->inFlight, cifs_max_pending - 1);
+        /* We do not want to set the max_pending too low or we
+        could end up with the counter going negative */
         spin_unlock(&GlobalMid_Lock);
         /* Although there should not be any requests blocked on 
         this queue it can not hurt to be paranoid and try to wake up requests
-        that may haven been blocked when more than 50 at time were on the wire 
+        that may haven been blocked when more than 50 at time were on the wire
         to the same server - they now will see the session is in exit state
         and get out of SendReceive.  */
         wake_up_all(&server->request_q);
         /* give those requests time to exit */
-        set_current_state(TASK_INTERRUPTIBLE);
-        schedule_timeout(HZ/8);
-
+        msleep(125);
+        
         if(server->ssocket) {
                 sock_release(csocket);
                 server->ssocket = NULL;
         }
-        if (smb_buffer) /* buffer usually freed in free_mid - need to free it on error or exit */
-                cifs_buf_release(smb_buffer);
+        /* buffer usuallly freed in free_mid - need to free it here on exit */
+        if (bigbuf != NULL)
+                cifs_buf_release(bigbuf);
+        if (smallbuf != NULL)
+                cifs_small_buf_release(smallbuf);
 
         read_lock(&GlobalSMBSeslock);
         if (list_empty(&server->pending_mid_q)) {
-                /* loop through server session structures attached to this and mark them dead */
+                /* loop through server session structures attached to this and
+                    mark them dead */
                 list_for_each(tmp, &GlobalSMBSessionList) {
                         ses =
                             list_entry(tmp, struct cifsSesInfo,
@@ -424,12 +645,23 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 }
                 read_unlock(&GlobalSMBSeslock);
         } else {
+                /* although we can not zero the server struct pointer yet,
+                since there are active requests which may depnd on them,
+                mark the corresponding SMB sessions as exiting too */
+                list_for_each(tmp, &GlobalSMBSessionList) {
+                        ses = list_entry(tmp, struct cifsSesInfo,
+                                         cifsSessionList);
+                        if (ses->server == server) {
+                                ses->status = CifsExiting;
+                        }
+                }
+
                 spin_lock(&GlobalMid_Lock);
                 list_for_each(tmp, &server->pending_mid_q) {
                 mid_entry = list_entry(tmp, struct mid_q_entry, qhead);
                         if (mid_entry->midState == MID_REQUEST_SUBMITTED) {
                                 cFYI(1,
-                                         (" Clearing Mid 0x%x - waking up ",mid_entry->mid));
+                                  ("Clearing Mid 0x%x - waking up ",mid_entry->mid));
                                 task_to_wake = mid_entry->tsk;
                                 if(task_to_wake) {
                                         wake_up_process(task_to_wake);
@@ -438,47 +670,51 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
                 }
                 spin_unlock(&GlobalMid_Lock);
                 read_unlock(&GlobalSMBSeslock);
-                set_current_state(TASK_INTERRUPTIBLE);
                 /* 1/8th of sec is more than enough time for them to exit */
-                schedule_timeout(HZ/8); 
+                msleep(125);
         }
 
         if (list_empty(&server->pending_mid_q)) {
                 /* mpx threads have not exited yet give them 
                 at least the smb send timeout time for long ops */
+                /* due to delays on oplock break requests, we need
+                to wait at least 45 seconds before giving up
+                on a request getting a response and going ahead
+                and killing cifsd */
                 cFYI(1, ("Wait for exit from demultiplex thread"));
-                set_current_state(TASK_INTERRUPTIBLE);
-                schedule_timeout(46 * HZ);      
+                msleep(46000);
                 /* if threads still have not exited they are probably never
                 coming home not much else we can do but free the memory */
         }
-        kfree(server);
 
         write_lock(&GlobalSMBSeslock);
         atomic_dec(&tcpSesAllocCount);
         length = tcpSesAllocCount.counter;
+
+        /* last chance to mark ses pointers invalid
+        if there are any pointing to this (e.g
+        if a crazy root user tried to kill cifsd 
+        kernel thread explicitly this might happen) */
+        list_for_each(tmp, &GlobalSMBSessionList) {
+                ses = list_entry(tmp, struct cifsSesInfo,
+                                cifsSessionList);
+                if (ses->server == server) {
+                        ses->server = NULL;
+                }
+        }
         write_unlock(&GlobalSMBSeslock);
+
+        kfree(server);
         if(length  > 0) {
                 mempool_resize(cifs_req_poolp,
                         length + cifs_min_rcv,
                         GFP_KERNEL);
         }
-
-        set_current_state(TASK_INTERRUPTIBLE);
-        schedule_timeout(HZ/4);
+        
+        msleep(250);
         return 0;
 }
 
-static void * 
-cifs_kcalloc(size_t size, unsigned int __nocast type)
-{
-        void *addr;
-        addr = kmalloc(size, type);
-        if (addr)
-                memset(addr, 0, size);
-        return addr;
-}
-
 static int
 cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
 {
@@ -495,7 +731,8 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
                 /* does not have to be a perfect mapping since the field is
                 informational, only used for servers that do not support
                 port 445 and it can be overridden at mount time */
-                vol->source_rfc1001_name[i] = toupper(system_utsname.nodename[i]);
+                vol->source_rfc1001_name[i] = 
+                        toupper(system_utsname.nodename[i]);
         }
         vol->source_rfc1001_name[15] = 0;
 
@@ -570,14 +807,17 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
                         /* NB: password legally can have multiple commas and
                         the only illegal character in a password is null */
 
-                        if ((value[temp_len] == 0) && (value[temp_len+1] == separator[0])) {
+                        if ((value[temp_len] == 0) && 
+                            (value[temp_len+1] == separator[0])) {
                                 /* reinsert comma */
                                 value[temp_len] = separator[0];
                                 temp_len+=2;  /* move after the second comma */
                                 while(value[temp_len] != 0)  {
                                         if (value[temp_len] == separator[0]) {
-                                                if (value[temp_len+1] == separator[0]) {
-                                                        temp_len++; /* skip second comma */
+                                                if (value[temp_len+1] == 
+                                                     separator[0]) {
+                                                /* skip second comma */
+                                                        temp_len++;
                                                 } else { 
                                                 /* single comma indicating start
                                                          of next parm */
@@ -596,17 +836,26 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
                                 /* go from value to value + temp_len condensing 
                                 double commas to singles. Note that this ends up
                                 allocating a few bytes too many, which is ok */
-                                vol->password = cifs_kcalloc(temp_len, GFP_KERNEL);
+                                vol->password = kcalloc(1, temp_len, GFP_KERNEL);
+                                if(vol->password == NULL) {
+                                        printk("CIFS: no memory for pass\n");
+                                        return 1;
+                                }
                                 for(i=0,j=0;i<temp_len;i++,j++) {
                                         vol->password[j] = value[i];
-                                        if(value[i] == separator[0] && value[i+1] == separator[0]) {
+                                        if(value[i] == separator[0]
+                                                && value[i+1] == separator[0]) {
                                                 /* skip second comma */
                                                 i++;
                                         }
                                 }
                                 vol->password[j] = 0;
                         } else {
-                                vol->password = cifs_kcalloc(temp_len + 1, GFP_KERNEL);
+                                vol->password = kcalloc(1, temp_len+1, GFP_KERNEL);
+                                if(vol->password == NULL) {
+                                        printk("CIFS: no memory for pass\n");
+                                        return 1;
+                                }
                                 strcpy(vol->password, value);
                         }
                 } else if (strnicmp(data, "ip", 2) == 0) {
@@ -770,6 +1019,10 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
                         vol->noperm = 0;
                 } else if (strnicmp(data, "noperm", 6) == 0) {
                         vol->noperm = 1;
+                } else if (strnicmp(data, "mapchars", 8) == 0) {
+                        vol->remap = 1;
+                } else if (strnicmp(data, "nomapchars", 10) == 0) {
+                        vol->remap = 0;
                 } else if (strnicmp(data, "setuids", 7) == 0) {
                         vol->setuids = 1;
                 } else if (strnicmp(data, "nosetuids", 9) == 0) {
@@ -918,14 +1171,15 @@ find_unc(__be32 new_target_ip_addr, char *uncName, char *userName)
 
 int
 connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
-                    const char *old_path, const struct nls_table *nls_codepage)
+                    const char *old_path, const struct nls_table *nls_codepage,
+                    int remap)
 {
         unsigned char *referrals = NULL;
         unsigned int num_referrals;
         int rc = 0;
 
         rc = get_dfs_path(xid, pSesInfo,old_path, nls_codepage, 
-                        &num_referrals, &referrals);
+                        &num_referrals, &referrals, remap);
 
         /* BB Add in code to: if valid refrl, if not ip address contact
                 the helper that resolves tcp names, mount to it, try to 
@@ -940,7 +1194,8 @@ connect_to_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
 int
 get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
                         const char *old_path, const struct nls_table *nls_codepage, 
-                        unsigned int *pnum_referrals, unsigned char ** preferrals)
+                        unsigned int *pnum_referrals, 
+                        unsigned char ** preferrals, int remap)
 {
         char *temp_unc;
         int rc = 0;
@@ -965,7 +1220,7 @@ get_dfs_path(int xid, struct cifsSesInfo *pSesInfo,
         }
         if (rc == 0)
                 rc = CIFSGetDFSRefer(xid, pSesInfo, old_path, preferrals,
-                                     pnum_referrals, nls_codepage);
+                                     pnum_referrals, nls_codepage, remap);
 
         return rc;
 }
@@ -1062,7 +1317,7 @@ ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
                 sessinit is sent but no second negprot */
                 struct rfc1002_session_packet * ses_init_buf;
                 struct smb_hdr * smb_buf;
-                ses_init_buf = cifs_kcalloc(sizeof(struct rfc1002_session_packet), GFP_KERNEL);
+                ses_init_buf = kcalloc(1, sizeof(struct rfc1002_session_packet), GFP_KERNEL);
                 if(ses_init_buf) {
                         ses_init_buf->trailer.session_req.called_len = 32;
                         rfc1002mangle(ses_init_buf->trailer.session_req.called_name,
@@ -1352,6 +1607,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         } else
                                 rc = 0;
                         memcpy(srvTcp->workstation_RFC1001_name, volume_info.source_rfc1001_name,16);
+                        srvTcp->sequence_number = 0;
                 }
         }
 
@@ -1419,6 +1675,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SET_UID;
                 if(volume_info.server_ino)
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_SERVER_INUM;
+                if(volume_info.remap)
+                        cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_MAP_SPECIAL_CHR;
                 if(volume_info.no_xattr)
                         cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_NO_XATTR;
                 if(volume_info.direct_io) {
@@ -1447,11 +1705,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                                 if ((strchr(volume_info.UNC + 3, '\\') == NULL)
                                     && (strchr(volume_info.UNC + 3, '/') ==
                                         NULL)) {
-                                        rc = connect_to_dfs_path(xid,
-                                                                 pSesInfo,
-                                                                 "",
-                                                                 cifs_sb->
-                                                                 local_nls);
+                                        rc = connect_to_dfs_path(xid, pSesInfo,
+                                                        "", cifs_sb->local_nls,
+                                                        cifs_sb->mnt_cifs_flags & 
+                                                          CIFS_MOUNT_MAP_SPECIAL_CHR);
                                         if(volume_info.UNC)
                                                 kfree(volume_info.UNC);
                                         FreeXid(xid);
@@ -1514,10 +1771,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 tcon->ses = pSesInfo;
 
                 /* do not care if following two calls succeed - informational only */
-                CIFSSMBQFSDeviceInfo(xid, tcon, cifs_sb->local_nls);
-                CIFSSMBQFSAttributeInfo(xid, tcon, cifs_sb->local_nls);
+                CIFSSMBQFSDeviceInfo(xid, tcon);
+                CIFSSMBQFSAttributeInfo(xid, tcon);
                 if (tcon->ses->capabilities & CAP_UNIX) {
-                        if(!CIFSSMBQFSUnixInfo(xid, tcon, cifs_sb->local_nls)) {
+                        if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
                                 if(!volume_info.no_psx_acl) {
                                         if(CIFS_UNIX_POSIX_ACL_CAP & 
                                            le64_to_cpu(tcon->fsUnixInfo.Capability))
@@ -1707,7 +1964,9 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
-                                ses->serverOS = cifs_kcalloc(2 * (len + 1), GFP_KERNEL);
+                                ses->serverOS = kcalloc(1, 2 * (len + 1), GFP_KERNEL);
+                                if(ses->serverOS == NULL)
+                                        goto sesssetup_nomem;
                                 cifs_strfromUCS_le(ses->serverOS,
                                            (wchar_t *)bcc_ptr, len,nls_codepage);
                                 bcc_ptr += 2 * (len + 1);
@@ -1717,7 +1976,9 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                 if (remaining_words > 0) {
                                         len = UniStrnlen((wchar_t *)bcc_ptr,
                                                          remaining_words-1);
-                                        ses->serverNOS =cifs_kcalloc(2 * (len + 1),GFP_KERNEL);
+                                        ses->serverNOS = kcalloc(1, 2 * (len + 1),GFP_KERNEL);
+                                        if(ses->serverNOS == NULL)
+                                                goto sesssetup_nomem;
                                         cifs_strfromUCS_le(ses->serverNOS,
                                                            (wchar_t *)bcc_ptr,len,nls_codepage);
                                         bcc_ptr += 2 * (len + 1);
@@ -1730,10 +1991,12 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         }
                                         remaining_words -= len + 1;
                                         if (remaining_words > 0) {
-                                                len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
+                                                len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
                                                 ses->serverDomain =
-                                                    cifs_kcalloc(2*(len+1),GFP_KERNEL);
+                                                    kcalloc(1, 2*(len+1),GFP_KERNEL);
+                                                if(ses->serverDomain == NULL)
+                                                        goto sesssetup_nomem;
                                                 cifs_strfromUCS_le(ses->serverDomain,
                                                      (wchar_t *)bcc_ptr,len,nls_codepage);
                                                 bcc_ptr += 2 * (len + 1);
@@ -1741,21 +2004,25 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 ses->serverDomain[1+(2*len)] = 0;
                                         } /* else no more room so create dummy domain string */
                                         else
-                                                ses->serverDomain =
-                                                    cifs_kcalloc(2,
-                                                            GFP_KERNEL);
+                                                ses->serverDomain = 
+                                                        kcalloc(1, 2, GFP_KERNEL);
                                 } else {        /* no room so create dummy domain and NOS string */
+                                        /* if these kcallocs fail not much we
+                                           can do, but better to not fail the
+                                           sesssetup itself */
                                         ses->serverDomain =
-                                            cifs_kcalloc(2, GFP_KERNEL);
+                                            kcalloc(1, 2, GFP_KERNEL);
                                         ses->serverNOS =
-                                            cifs_kcalloc(2, GFP_KERNEL);
+                                            kcalloc(1, 2, GFP_KERNEL);
                                 }
                         } else {        /* ASCII */
                                 len = strnlen(bcc_ptr, 1024);
                                 if (((long) bcc_ptr + len) - (long)
                                     pByteArea(smb_buffer_response)
                                             <= BCC(smb_buffer_response)) {
-                                        ses->serverOS = cifs_kcalloc(len + 1,GFP_KERNEL);
+                                        ses->serverOS = kcalloc(1, len + 1,GFP_KERNEL);
+                                        if(ses->serverOS == NULL)
+                                                goto sesssetup_nomem;
                                         strncpy(ses->serverOS,bcc_ptr, len);
 
                                         bcc_ptr += len;
@@ -1763,14 +2030,18 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         bcc_ptr++;
 
                                         len = strnlen(bcc_ptr, 1024);
-                                        ses->serverNOS = cifs_kcalloc(len + 1,GFP_KERNEL);
+                                        ses->serverNOS = kcalloc(1, len + 1,GFP_KERNEL);
+                                        if(ses->serverNOS == NULL)
+                                                goto sesssetup_nomem;
                                         strncpy(ses->serverNOS, bcc_ptr, len);
                                         bcc_ptr += len;
                                         bcc_ptr[0] = 0;
                                         bcc_ptr++;
 
                                         len = strnlen(bcc_ptr, 1024);
-                                        ses->serverDomain = cifs_kcalloc(len + 1,GFP_KERNEL);
+                                        ses->serverDomain = kcalloc(1, len + 1,GFP_KERNEL);
+                                        if(ses->serverDomain == NULL)
+                                                goto sesssetup_nomem;
                                         strncpy(ses->serverDomain, bcc_ptr, len);
                                         bcc_ptr += len;
                                         bcc_ptr[0] = 0;
@@ -1790,7 +2061,9 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                         smb_buffer_response->WordCount));
                 rc = -EIO;
         }
-        
+sesssetup_nomem:        /* do not return an error on nomem for the info strings,
+                           since that could make reconnection harder, and
+                           reconnection might be needed to free memory */
         if (smb_buffer)
                 cifs_buf_release(smb_buffer);
 
@@ -1967,7 +2240,7 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
                                         ses->serverOS =
-                                            cifs_kcalloc(2 * (len + 1), GFP_KERNEL);
+                                            kcalloc(1, 2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
                                                            (wchar_t *)
                                                            bcc_ptr, len,
@@ -1981,7 +2254,7 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                                  remaining_words
                                                                  - 1);
                                                 ses->serverNOS =
-                                                    cifs_kcalloc(2 * (len + 1),
+                                                    kcalloc(1, 2 * (len + 1),
                                                             GFP_KERNEL);
                                                 cifs_strfromUCS_le(ses->serverNOS,
                                                                    (wchar_t *)bcc_ptr,
@@ -1994,7 +2267,7 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 if (remaining_words > 0) {
                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
                             /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
-                                                        ses->serverDomain = cifs_kcalloc(2*(len+1),GFP_KERNEL);
+                                                        ses->serverDomain = kcalloc(1, 2*(len+1),GFP_KERNEL);
                                                         cifs_strfromUCS_le(ses->serverDomain,
                                                              (wchar_t *)bcc_ptr, 
                                  len,
@@ -2005,10 +2278,10 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 } /* else no more room so create dummy domain string */
                                                 else
                                                         ses->serverDomain =
-                                                            cifs_kcalloc(2,GFP_KERNEL);
+                                                            kcalloc(1, 2,GFP_KERNEL);
                                         } else {        /* no room so create dummy domain and NOS string */
-                                                ses->serverDomain = cifs_kcalloc(2, GFP_KERNEL);
-                                                ses->serverNOS = cifs_kcalloc(2, GFP_KERNEL);
+                                                ses->serverDomain = kcalloc(1, 2, GFP_KERNEL);
+                                                ses->serverNOS = kcalloc(1, 2, GFP_KERNEL);
                                         }
                                 } else {        /* ASCII */
 
@@ -2016,7 +2289,7 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                         if (((long) bcc_ptr + len) - (long)
                                             pByteArea(smb_buffer_response)
                                             <= BCC(smb_buffer_response)) {
-                                                ses->serverOS = cifs_kcalloc(len + 1, GFP_KERNEL);
+                                                ses->serverOS = kcalloc(1, len + 1, GFP_KERNEL);
                                                 strncpy(ses->serverOS, bcc_ptr, len);
 
                                                 bcc_ptr += len;
@@ -2024,14 +2297,14 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                ses->serverNOS = cifs_kcalloc(len + 1,GFP_KERNEL);
+                                                ses->serverNOS = kcalloc(1, len + 1,GFP_KERNEL);
                                                 strncpy(ses->serverNOS, bcc_ptr, len);
                                                 bcc_ptr += len;
                                                 bcc_ptr[0] = 0;
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                ses->serverDomain = cifs_kcalloc(len + 1, GFP_KERNEL);
+                                                ses->serverDomain = kcalloc(1, len + 1, GFP_KERNEL);
                                                 strncpy(ses->serverDomain, bcc_ptr, len);
                                                 bcc_ptr += len;
                                                 bcc_ptr[0] = 0;
@@ -2281,7 +2554,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
    the end since (at least) WIN2K and Windows XP have a major bug in not null
    terminating last Unicode string in response  */
                                         ses->serverOS =
-                                            cifs_kcalloc(2 * (len + 1), GFP_KERNEL);
+                                            kcalloc(1, 2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
                                                            (wchar_t *)
                                                            bcc_ptr, len,
@@ -2296,7 +2569,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                                  remaining_words
                                                                  - 1);
                                                 ses->serverNOS =
-                                                    cifs_kcalloc(2 * (len + 1),
+                                                    kcalloc(1, 2 * (len + 1),
                                                             GFP_KERNEL);
                                                 cifs_strfromUCS_le(ses->
                                                                    serverNOS,
@@ -2313,7 +2586,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
                                                         ses->serverDomain =
-                                                            cifs_kcalloc(2 *
+                                                            kcalloc(1, 2 *
                                                                     (len +
                                                                      1),
                                                                     GFP_KERNEL);
@@ -2339,13 +2612,13 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                 } /* else no more room so create dummy domain string */
                                                 else
                                                         ses->serverDomain =
-                                                            cifs_kcalloc(2,
+                                                            kcalloc(1, 2,
                                                                     GFP_KERNEL);
                                         } else {        /* no room so create dummy domain and NOS string */
                                                 ses->serverDomain =
-                                                    cifs_kcalloc(2, GFP_KERNEL);
+                                                    kcalloc(1, 2, GFP_KERNEL);
                                                 ses->serverNOS =
-                                                    cifs_kcalloc(2, GFP_KERNEL);
+                                                    kcalloc(1, 2, GFP_KERNEL);
                                         }
                                 } else {        /* ASCII */
                                         len = strnlen(bcc_ptr, 1024);
@@ -2353,7 +2626,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                             pByteArea(smb_buffer_response)
                                             <= BCC(smb_buffer_response)) {
                                                 ses->serverOS =
-                                                    cifs_kcalloc(len + 1,
+                                                    kcalloc(1, len + 1,
                                                             GFP_KERNEL);
                                                 strncpy(ses->serverOS,
                                                         bcc_ptr, len);
@@ -2364,7 +2637,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 
                                                 len = strnlen(bcc_ptr, 1024);
                                                 ses->serverNOS =
-                                                    cifs_kcalloc(len + 1,
+                                                    kcalloc(1, len + 1,
                                                             GFP_KERNEL);
                                                 strncpy(ses->serverNOS, bcc_ptr, len);
                                                 bcc_ptr += len;
@@ -2373,7 +2646,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 
                                                 len = strnlen(bcc_ptr, 1024);
                                                 ses->serverDomain =
-                                                    cifs_kcalloc(len + 1,
+                                                    kcalloc(1, len + 1,
                                                             GFP_KERNEL);
                                                 strncpy(ses->serverDomain, bcc_ptr, len);       
                                                 bcc_ptr += len;
@@ -2675,7 +2948,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
                                         ses->serverOS =
-                                            cifs_kcalloc(2 * (len + 1), GFP_KERNEL);
+                                            kcalloc(1, 2 * (len + 1), GFP_KERNEL);
                                         cifs_strfromUCS_le(ses->serverOS,
                                                            (wchar_t *)
                                                            bcc_ptr, len,
@@ -2690,7 +2963,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                                  remaining_words
                                                                  - 1);
                                                 ses->serverNOS =
-                                                    cifs_kcalloc(2 * (len + 1),
+                                                    kcalloc(1, 2 * (len + 1),
                                                             GFP_KERNEL);
                                                 cifs_strfromUCS_le(ses->
                                                                    serverNOS,
@@ -2706,7 +2979,7 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                         len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
      /* last string not always null terminated (e.g. for Windows XP & 2000) */
                                                         ses->serverDomain =
-                                                            cifs_kcalloc(2 *
+                                                            kcalloc(1, 2 *
                                                                     (len +
                                                                      1),
                                                                     GFP_KERNEL);
@@ -2731,17 +3004,17 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                             = 0;
                                                 } /* else no more room so create dummy domain string */
                                                 else
-                                                        ses->serverDomain = cifs_kcalloc(2,GFP_KERNEL);
+                                                        ses->serverDomain = kcalloc(1, 2,GFP_KERNEL);
                                         } else {  /* no room so create dummy domain and NOS string */
-                                                ses->serverDomain = cifs_kcalloc(2, GFP_KERNEL);
-                                                ses->serverNOS = cifs_kcalloc(2, GFP_KERNEL);
+                                                ses->serverDomain = kcalloc(1, 2, GFP_KERNEL);
+                                                ses->serverNOS = kcalloc(1, 2, GFP_KERNEL);
                                         }
                                 } else {        /* ASCII */
                                         len = strnlen(bcc_ptr, 1024);
                                         if (((long) bcc_ptr + len) - 
                         (long) pByteArea(smb_buffer_response) 
                             <= BCC(smb_buffer_response)) {
-                                                ses->serverOS = cifs_kcalloc(len + 1,GFP_KERNEL);
+                                                ses->serverOS = kcalloc(1, len + 1,GFP_KERNEL);
                                                 strncpy(ses->serverOS,bcc_ptr, len);
 
                                                 bcc_ptr += len;
@@ -2749,14 +3022,14 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                ses->serverNOS = cifs_kcalloc(len+1,GFP_KERNEL);
+                                                ses->serverNOS = kcalloc(1, len+1,GFP_KERNEL);
                                                 strncpy(ses->serverNOS, bcc_ptr, len);  
                                                 bcc_ptr += len;
                                                 bcc_ptr[0] = 0;
                                                 bcc_ptr++;
 
                                                 len = strnlen(bcc_ptr, 1024);
-                                                ses->serverDomain = cifs_kcalloc(len+1,GFP_KERNEL);
+                                                ses->serverDomain = kcalloc(1, len+1,GFP_KERNEL);
                                                 strncpy(ses->serverDomain, bcc_ptr, len);
                                                 bcc_ptr += len;
                                                 bcc_ptr[0] = 0;
@@ -2868,7 +3141,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                                 if(tcon->nativeFileSystem)
                                         kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
-                                    cifs_kcalloc(length + 2, GFP_KERNEL);
+                                    kcalloc(1, length + 2, GFP_KERNEL);
                                 cifs_strfromUCS_le(tcon->nativeFileSystem,
                                                    (wchar_t *) bcc_ptr,
                                                    length, nls_codepage);
@@ -2886,7 +3159,7 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                                 if(tcon->nativeFileSystem)
                                         kfree(tcon->nativeFileSystem);
                                 tcon->nativeFileSystem =
-                                    cifs_kcalloc(length + 1, GFP_KERNEL);
+                                    kcalloc(1, length + 1, GFP_KERNEL);
                                 strncpy(tcon->nativeFileSystem, bcc_ptr,
                                         length);
                         }
@@ -2959,6 +3232,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
         int rc = 0;
         char ntlm_session_key[CIFS_SESSION_KEY_SIZE];
         int ntlmv2_flag = FALSE;
+        int first_time = 0;
 
         /* what if server changes its buffer size after dropping the session? */
         if(pSesInfo->server->maxBuf == 0) /* no need to send on reconnect */ {
@@ -2977,12 +3251,13 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                         spin_unlock(&GlobalMid_Lock);
 
                 }
+                first_time = 1;
         }
         if (!rc) {
                 pSesInfo->capabilities = pSesInfo->server->capabilities;
                 if(linuxExtEnabled == 0)
                         pSesInfo->capabilities &= (~CAP_UNIX);
-                pSesInfo->sequence_number = 0;
+        /*      pSesInfo->sequence_number = 0;*/
                 cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x Time Zone: %d",
                         pSesInfo->server->secMode,
                         pSesInfo->server->capabilities,
@@ -3015,7 +3290,10 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                                                 v2_response = kmalloc(16 + 64 /* blob */, GFP_KERNEL);
                                         if(v2_response) {
                                                 CalcNTLMv2_response(pSesInfo,v2_response);
-/*                                              cifs_calculate_ntlmv2_mac_key(pSesInfo->mac_signing_key, response, ntlm_session_key, */
+                                /*              if(first_time)
+                                                        cifs_calculate_ntlmv2_mac_key(
+                                                          pSesInfo->server->mac_signing_key, 
+                                                          response, ntlm_session_key, */
                                                 kfree(v2_response);
                                         /* BB Put dummy sig in SessSetup PDU? */
                                         } else {
@@ -3028,9 +3306,11 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                                                 pSesInfo->server->cryptKey,
                                                 ntlm_session_key);
 
-                                        cifs_calculate_mac_key(pSesInfo->mac_signing_key,
-                                                ntlm_session_key,
-                                                pSesInfo->password);
+                                        if(first_time)
+                                                cifs_calculate_mac_key(
+                                                        pSesInfo->server->mac_signing_key,
+                                                        ntlm_session_key,
+                                                        pSesInfo->password);
                                 }
                         /* for better security the weaker lanman hash not sent
                            in AuthSessSetup so we no longer calculate it */
@@ -3046,8 +3326,11 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                                 pSesInfo->server->cryptKey,
                                 ntlm_session_key);
 
-                        cifs_calculate_mac_key(pSesInfo->mac_signing_key, 
-                                ntlm_session_key, pSesInfo->password);
+                        if(first_time)          
+                                cifs_calculate_mac_key(
+                                        pSesInfo->server->mac_signing_key,
+                                        ntlm_session_key, pSesInfo->password);
+
                         rc = CIFSSessSetup(xid, pSesInfo,
                                 ntlm_session_key, nls_info);
                 }
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index f54e1866f0f4..e3137aa48cdd 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -101,68 +101,15 @@ cifs_bp_rename_retry:
         return full_path;
 }
 
-/* Note: caller must free return buffer */
-char *
-build_wildcard_path_from_dentry(struct dentry *direntry)
+/* char * build_wildcard_path_from_dentry(struct dentry *direntry)
 {
-        struct dentry *temp;
-        int namelen = 0;
-        char *full_path;
-
-        if(direntry == NULL)
-                return NULL;  /* not much we can do if dentry is freed and
-                we need to reopen the file after it was closed implicitly
-                when the server crashed */
-
-cifs_bwp_rename_retry:
-        for (temp = direntry; !IS_ROOT(temp);) {
-                namelen += (1 + temp->d_name.len);
-                temp = temp->d_parent;
-                if(temp == NULL) {
-                        cERROR(1,("corrupt dentry"));
-                        return NULL;
-                }
-        }
-
-        full_path = kmalloc(namelen+3, GFP_KERNEL);
         if(full_path == NULL)
                 return full_path;
 
         full_path[namelen] = '\\';
         full_path[namelen+1] = '*';
-        full_path[namelen+2] = 0;  /* trailing null */
-
-        for (temp = direntry; !IS_ROOT(temp);) {
-                namelen -= 1 + temp->d_name.len;
-                if (namelen < 0) {
-                        break;
-                } else {
-                        full_path[namelen] = '\\';
-                        strncpy(full_path + namelen + 1, temp->d_name.name,
-                                temp->d_name.len);
-                        cFYI(0, (" name: %s ", full_path + namelen));
-                }
-                temp = temp->d_parent;
-                if(temp == NULL) {
-                        cERROR(1,("corrupt dentry"));
-                        kfree(full_path);
-                        return NULL;
-                }
-        }
-        if (namelen != 0) {
-                cERROR(1,
-                       ("We did not end path lookup where we expected namelen is %d",
-                        namelen));
-                /* presumably this is only possible if we were racing with a rename 
-                of one of the parent directories  (we can not lock the dentries
-                above us to prevent this, but retrying should be harmless) */
-                kfree(full_path);
-                namelen = 0;
-                goto cifs_bwp_rename_retry;
-        }
-
-        return full_path;
-}
+        full_path[namelen+2] = 0;
+BB remove above eight lines BB */
 
 /* Inode operations in similar order to how they appear in the Linux file fs.h */
 
@@ -235,7 +182,8 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
 
         rc = CIFSSMBOpen(xid, pTcon, full_path, disposition,
                          desiredAccess, CREATE_NOT_DIR,
-                         &fileHandle, &oplock, buf, cifs_sb->local_nls);
+                         &fileHandle, &oplock, buf, cifs_sb->local_nls,
+                         cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
                 cFYI(1, ("cifs_create returned 0x%x ", rc));
         } else {
@@ -248,13 +196,17 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                                         (__u64)current->euid,
                                         (__u64)current->egid,
                                         0 /* dev */,
-                                        cifs_sb->local_nls);
+                                        cifs_sb->local_nls, 
+                                        cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         } else {
                                 CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode,
                                         (__u64)-1,
                                         (__u64)-1,
                                         0 /* dev */,
-                                        cifs_sb->local_nls);
+                                        cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         }
                 else {
                         /* BB implement via Windows security descriptors */
@@ -284,51 +236,48 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                         /* mknod case - do not leave file open */
                         CIFSSMBClose(xid, pTcon, fileHandle);
                 } else if(newinode) {
-                        pCifsFile = (struct cifsFileInfo *)
+                        pCifsFile =
                            kmalloc(sizeof (struct cifsFileInfo), GFP_KERNEL);
-                
-                        if (pCifsFile) {
-                                memset((char *)pCifsFile, 0,
-                                       sizeof (struct cifsFileInfo));
-                                pCifsFile->netfid = fileHandle;
-                                pCifsFile->pid = current->tgid;
-                                pCifsFile->pInode = newinode;
-                                pCifsFile->invalidHandle = FALSE;
-                                pCifsFile->closePend     = FALSE;
-                                init_MUTEX(&pCifsFile->fh_sem);
-                                /* put the following in at open now */
-                                /* pCifsFile->pfile = file; */ 
-                                write_lock(&GlobalSMBSeslock);
-                                list_add(&pCifsFile->tlist,&pTcon->openFileList);
-                                pCifsInode = CIFS_I(newinode);
-                                if(pCifsInode) {
+                        
+                        if(pCifsFile == NULL)
+                                goto cifs_create_out;
+                        memset((char *)pCifsFile, 0,
+                               sizeof (struct cifsFileInfo));
+                        pCifsFile->netfid = fileHandle;
+                        pCifsFile->pid = current->tgid;
+                        pCifsFile->pInode = newinode;
+                        pCifsFile->invalidHandle = FALSE;
+                        pCifsFile->closePend     = FALSE;
+                        init_MUTEX(&pCifsFile->fh_sem);
+                        /* set the following in open now 
+                                pCifsFile->pfile = file; */
+                        write_lock(&GlobalSMBSeslock);
+                        list_add(&pCifsFile->tlist,&pTcon->openFileList);
+                        pCifsInode = CIFS_I(newinode);
+                        if(pCifsInode) {
                                 /* if readable file instance put first in list*/
-                                        if (write_only == TRUE) {
-                                                list_add_tail(&pCifsFile->flist,
-                                                        &pCifsInode->openFileList);
-                                        } else {
-                                                list_add(&pCifsFile->flist,
-                                                        &pCifsInode->openFileList);
-                                        }
-                                        if((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
-                                                pCifsInode->clientCanCacheAll = TRUE;
-                                                pCifsInode->clientCanCacheRead = TRUE;
-                                                cFYI(1,("Exclusive Oplock granted on inode %p",
-                                                        newinode));
-                                        } else if((oplock & 0xF) == OPLOCK_READ)
-                                                pCifsInode->clientCanCacheRead = TRUE;
+                                if (write_only == TRUE) {
+                                        list_add_tail(&pCifsFile->flist,
+                                                &pCifsInode->openFileList);
+                                } else {
+                                        list_add(&pCifsFile->flist,
+                                                &pCifsInode->openFileList);
                                 }
-                                write_unlock(&GlobalSMBSeslock);
+                                if((oplock & 0xF) == OPLOCK_EXCLUSIVE) {
+                                        pCifsInode->clientCanCacheAll = TRUE;
+                                        pCifsInode->clientCanCacheRead = TRUE;
+                                        cFYI(1,("Exclusive Oplock for inode %p",
+                                                newinode));
+                                } else if((oplock & 0xF) == OPLOCK_READ)
+                                        pCifsInode->clientCanCacheRead = TRUE;
                         }
+                        write_unlock(&GlobalSMBSeslock);
                 }
         } 
-
-        if (buf)
-            kfree(buf);
-        if (full_path)
-            kfree(full_path);
+cifs_create_out:
+        kfree(buf);
+        kfree(full_path);
         FreeXid(xid);
-
         return rc;
 }
 
@@ -359,11 +308,15 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode, dev_t dev
                 if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
                         rc = CIFSSMBUnixSetPerms(xid, pTcon, full_path,
                                 mode,(__u64)current->euid,(__u64)current->egid,
-                                device_number, cifs_sb->local_nls);
+                                device_number, cifs_sb->local_nls,
+                                cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                 } else {
                         rc = CIFSSMBUnixSetPerms(xid, pTcon,
                                 full_path, mode, (__u64)-1, (__u64)-1,
-                                device_number, cifs_sb->local_nls);
+                                device_number, cifs_sb->local_nls,
+                                cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                 }
 
                 if(!rc) {
@@ -375,10 +328,8 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode, dev_t dev
                 }
         }
 
-        if (full_path)
-                kfree(full_path);
+        kfree(full_path);
         FreeXid(xid);
-
         return rc;
 }
 
@@ -447,43 +398,11 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry, struct name
                 if file exists or not but no access BB */
         }
 
-        if (full_path)
-                kfree(full_path);
+        kfree(full_path);
         FreeXid(xid);
         return ERR_PTR(rc);
 }
 
-int
-cifs_dir_open(struct inode *inode, struct file *file)
-{                               /* NB: currently unused since searches are opened in readdir */
-        int rc = 0;
-        int xid;
-        struct cifs_sb_info *cifs_sb;
-        struct cifsTconInfo *pTcon;
-        char *full_path = NULL;
-
-        xid = GetXid();
-
-        cifs_sb = CIFS_SB(inode->i_sb);
-        pTcon = cifs_sb->tcon;
-
-        if(file->f_dentry) {
-                down(&file->f_dentry->d_sb->s_vfs_rename_sem);
-                full_path = build_wildcard_path_from_dentry(file->f_dentry);
-                up(&file->f_dentry->d_sb->s_vfs_rename_sem);
-        } else {
-                FreeXid(xid);
-                return -EIO;
-        }
-
-        cFYI(1, ("inode = 0x%p and full path is %s", inode, full_path));
-
-        if (full_path)
-                kfree(full_path);
-        FreeXid(xid);
-        return rc;
-}
-
 static int
 cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
 {
diff --git a/fs/cifs/fcntl.c b/fs/cifs/fcntl.c
index 9d24c40f1967..7d2a9202c39a 100644
--- a/fs/cifs/fcntl.c
+++ b/fs/cifs/fcntl.c
@@ -92,7 +92,8 @@ int cifs_dir_notify(struct file * file, unsigned long arg)
                 cERROR(1,("cifs dir notify on file %s with arg 0x%lx",full_path,arg)); /* BB removeme BB */
                 rc = CIFSSMBOpen(xid, pTcon, full_path, FILE_OPEN, 
                         GENERIC_READ | SYNCHRONIZE, 0 /* create options */,
-                        &netfid, &oplock,NULL, cifs_sb->local_nls);
+                        &netfid, &oplock,NULL, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
                 /* BB fixme - add this handle to a notify handle list */
                 if(rc) {
                         cERROR(1,("Could not open directory for notify"));  /* BB remove BB */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index dcab7cf1b53b..dde2d251fc3d 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -254,7 +254,8 @@ int cifs_open(struct inode *inode, struct file *file)
         }
         rc = CIFSSMBOpen(xid, pTcon, full_path, disposition, desiredAccess,
                          CREATE_NOT_DIR, &netfid, &oplock, buf,
-                         cifs_sb->local_nls);
+                         cifs_sb->local_nls, cifs_sb->mnt_cifs_flags
+                                 & CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
                 cFYI(1, ("cifs_open returned 0x%x ", rc));
                 goto out;
@@ -287,7 +288,9 @@ int cifs_open(struct inode *inode, struct file *file)
                         CIFSSMBUnixSetPerms(xid, pTcon, full_path,
                                             inode->i_mode,
                                             (__u64)-1, (__u64)-1, 0 /* dev */,
-                                            cifs_sb->local_nls);
+                                            cifs_sb->local_nls,
+                                            cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                 } else {
                         /* BB implement via Windows security descriptors eg
                            CIFSSMBWinSetPerms(xid, pTcon, full_path, mode,
@@ -387,7 +390,8 @@ static int cifs_reopen_file(struct inode *inode, struct file *file,
         } */
         rc = CIFSSMBOpen(xid, pTcon, full_path, disposition, desiredAccess,
                          CREATE_NOT_DIR, &netfid, &oplock, NULL,
-                         cifs_sb->local_nls);
+                         cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & 
+                                CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
                 up(&pCifsFile->fh_sem);
                 cFYI(1, ("cifs_open returned 0x%x ", rc));
@@ -465,8 +469,10 @@ int cifs_close(struct inode *inode, struct file *file)
                                 write_lock(&file->f_owner.lock);
                         }
                 }
+                write_lock(&GlobalSMBSeslock);
                 list_del(&pSMBFile->flist);
                 list_del(&pSMBFile->tlist);
+                write_unlock(&GlobalSMBSeslock);
                 write_unlock(&file->f_owner.lock);
                 kfree(pSMBFile->search_resume_name);
                 kfree(file->private_data);
@@ -506,7 +512,8 @@ int cifs_closedir(struct inode *inode, struct file *file)
                 pTcon = cifs_sb->tcon;
 
                 cFYI(1, ("Freeing private data in close dir"));
-                if (pCFileStruct->srch_inf.endOfSearch == FALSE) {
+                if ((pCFileStruct->srch_inf.endOfSearch == FALSE) &&
+                   (pCFileStruct->invalidHandle == FALSE)) {
                         pCFileStruct->invalidHandle = TRUE;
                         rc = CIFSFindClose(xid, pTcon, pCFileStruct->netfid);
                         cFYI(1, ("Closing uncompleted readdir with rc %d",
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index d73b0aa86775..670947288262 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -44,7 +44,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
         cFYI(1, (" Getting info on %s ", search_path));
         /* could have done a find first instead but this returns more info */
         rc = CIFSSMBUnixQPathInfo(xid, pTcon, search_path, &findData,
-                                  cifs_sb->local_nls);
+                                  cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
 /*      dump_mem("\nUnixQPathInfo return data", &findData,
                  sizeof(findData)); */
         if (rc) {
@@ -63,7 +64,9 @@ int cifs_get_inode_info_unix(struct inode **pinode,
                         strncat(tmp_path, search_path, MAX_PATHCONF);
                         rc = connect_to_dfs_path(xid, pTcon->ses,
                                                  /* treename + */ tmp_path,
-                                                 cifs_sb->local_nls);
+                                                 cifs_sb->local_nls, 
+                                                 cifs_sb->mnt_cifs_flags & 
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                         kfree(tmp_path);
 
                         /* BB fix up inode etc. */
@@ -210,7 +213,8 @@ int cifs_get_inode_info(struct inode **pinode,
                 pfindData = (FILE_ALL_INFO *)buf;
                 /* could do find first instead but this returns more info */
                 rc = CIFSSMBQPathInfo(xid, pTcon, search_path, pfindData,
-                              cifs_sb->local_nls);
+                              cifs_sb->local_nls, cifs_sb->mnt_cifs_flags & 
+                                CIFS_MOUNT_MAP_SPECIAL_CHR);
         }
         /* dump_mem("\nQPathInfo return data",&findData, sizeof(findData)); */
         if (rc) {
@@ -230,7 +234,9 @@ int cifs_get_inode_info(struct inode **pinode,
                         strncat(tmp_path, search_path, MAX_PATHCONF);
                         rc = connect_to_dfs_path(xid, pTcon->ses,
                                                  /* treename + */ tmp_path,
-                                                 cifs_sb->local_nls);
+                                                 cifs_sb->local_nls, 
+                                                 cifs_sb->mnt_cifs_flags & 
+                                                   CIFS_MOUNT_MAP_SPECIAL_CHR);
                         kfree(tmp_path);
                         /* BB fix up inode etc. */
                 } else if (rc) {
@@ -268,7 +274,9 @@ int cifs_get_inode_info(struct inode **pinode,
 
                                 rc1 = CIFSGetSrvInodeNumber(xid, pTcon, 
                                         search_path, &inode_num, 
-                                        cifs_sb->local_nls);
+                                        cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                                 if(rc1) {
                                         cFYI(1,("GetSrvInodeNum rc %d", rc1));
                                         /* BB EOPNOSUPP disable SERVER_INUM? */
@@ -410,7 +418,8 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                 FreeXid(xid);
                 return -ENOMEM;
         }
-        rc = CIFSSMBDelFile(xid, pTcon, full_path, cifs_sb->local_nls);
+        rc = CIFSSMBDelFile(xid, pTcon, full_path, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
 
         if (!rc) {
                 direntry->d_inode->i_nlink--;
@@ -422,10 +431,14 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
 
                 rc = CIFSSMBOpen(xid, pTcon, full_path, FILE_OPEN, DELETE,
                                  CREATE_NOT_DIR | CREATE_DELETE_ON_CLOSE,
-                                 &netfid, &oplock, NULL, cifs_sb->local_nls);
+                                 &netfid, &oplock, NULL, cifs_sb->local_nls,
+                                 cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if (rc==0) {
                         CIFSSMBRenameOpenFile(xid, pTcon, netfid, NULL,
-                                              cifs_sb->local_nls);
+                                              cifs_sb->local_nls, 
+                                              cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         CIFSSMBClose(xid, pTcon, netfid);
                         direntry->d_inode->i_nlink--;
                 }
@@ -439,7 +452,9 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                         if (!(pTcon->ses->flags & CIFS_SES_NT4))
                                 rc = CIFSSMBSetTimes(xid, pTcon, full_path,
                                                      pinfo_buf,
-                                                     cifs_sb->local_nls);
+                                                     cifs_sb->local_nls,
+                                                     cifs_sb->mnt_cifs_flags & 
+                                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                         else
                                 rc = -EOPNOTSUPP;
 
@@ -461,7 +476,9 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                                                  FILE_OPEN, SYNCHRONIZE |
                                                  FILE_WRITE_ATTRIBUTES, 0,
                                                  &netfid, &oplock, NULL,
-                                                 cifs_sb->local_nls);
+                                                 cifs_sb->local_nls,
+                                                 cifs_sb->mnt_cifs_flags & 
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                                 if (rc==0) {
                                         rc = CIFSSMBSetFileTimes(xid, pTcon,
                                                                  pinfo_buf,
@@ -472,8 +489,10 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                         kfree(pinfo_buf);
                 }
                 if (rc==0) {
-                        rc = CIFSSMBDelFile(xid, pTcon, full_path,
-                                            cifs_sb->local_nls);
+                        rc = CIFSSMBDelFile(xid, pTcon, full_path, 
+                                            cifs_sb->local_nls, 
+                                            cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         if (!rc) {
                                 direntry->d_inode->i_nlink--;
                         } else if (rc == -ETXTBSY) {
@@ -485,11 +504,15 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                                                  CREATE_NOT_DIR |
                                                  CREATE_DELETE_ON_CLOSE,
                                                  &netfid, &oplock, NULL,
-                                                 cifs_sb->local_nls);
+                                                 cifs_sb->local_nls, 
+                                                 cifs_sb->mnt_cifs_flags & 
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                                 if (rc==0) {
                                         CIFSSMBRenameOpenFile(xid, pTcon,
                                                 netfid, NULL,
-                                                cifs_sb->local_nls);
+                                                cifs_sb->local_nls,
+                                                cifs_sb->mnt_cifs_flags &
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                                         CIFSSMBClose(xid, pTcon, netfid);
                                         direntry->d_inode->i_nlink--;
                                 }
@@ -534,7 +557,8 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                 return -ENOMEM;
         }
         /* BB add setting the equivalent of mode via CreateX w/ACLs */
-        rc = CIFSSMBMkDir(xid, pTcon, full_path, cifs_sb->local_nls);
+        rc = CIFSSMBMkDir(xid, pTcon, full_path, cifs_sb->local_nls,
+                          cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc) {
                 cFYI(1, ("cifs_mkdir returned 0x%x ", rc));
                 d_drop(direntry);
@@ -558,12 +582,16 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
                                                     (__u64)current->euid,
                                                     (__u64)current->egid,
                                                     0 /* dev_t */,
-                                                    cifs_sb->local_nls);
+                                                    cifs_sb->local_nls,
+                                                    cifs_sb->mnt_cifs_flags &
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                         } else {
                                 CIFSSMBUnixSetPerms(xid, pTcon, full_path,
                                                     mode, (__u64)-1,
                                                     (__u64)-1, 0 /* dev_t */,
-                                                    cifs_sb->local_nls);
+                                                    cifs_sb->local_nls,
+                                                    cifs_sb->mnt_cifs_flags & 
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                         }
                 else {
                         /* BB to be implemented via Windows secrty descriptors
@@ -600,7 +628,8 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
                 return -ENOMEM;
         }
 
-        rc = CIFSSMBRmDir(xid, pTcon, full_path, cifs_sb->local_nls);
+        rc = CIFSSMBRmDir(xid, pTcon, full_path, cifs_sb->local_nls,
+                          cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
 
         if (!rc) {
                 inode->i_nlink--;
@@ -653,7 +682,9 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
         }
 
         rc = CIFSSMBRename(xid, pTcon, fromName, toName,
-                           cifs_sb_source->local_nls);
+                           cifs_sb_source->local_nls,
+                           cifs_sb_source->mnt_cifs_flags &
+                                CIFS_MOUNT_MAP_SPECIAL_CHR);
         if (rc == -EEXIST) {
                 /* check if they are the same file because rename of hardlinked
                    files is a noop */
@@ -665,11 +696,16 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                 if (info_buf_source != NULL) {
                         info_buf_target = info_buf_source + 1;
                         rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
-                                info_buf_source, cifs_sb_source->local_nls);
+                                info_buf_source, cifs_sb_source->local_nls, 
+                                cifs_sb_source->mnt_cifs_flags &
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                         if (rc == 0) {
                                 rc = CIFSSMBUnixQPathInfo(xid, pTcon, toName,
                                                 info_buf_target,
-                                                cifs_sb_target->local_nls);
+                                                cifs_sb_target->local_nls,
+                                                /* remap based on source sb */
+                                                cifs_sb_source->mnt_cifs_flags &
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                         }
                         if ((rc == 0) &&
                             (info_buf_source->UniqueId ==
@@ -685,7 +721,9 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                                 cifs_unlink(target_inode, target_direntry);
                                 rc = CIFSSMBRename(xid, pTcon, fromName,
                                                    toName,
-                                                   cifs_sb_source->local_nls);
+                                                   cifs_sb_source->local_nls,
+                                                   cifs_sb_source->mnt_cifs_flags
+                                                   & CIFS_MOUNT_MAP_SPECIAL_CHR);
                         }
                         kfree(info_buf_source);
                 } /* if we can not get memory just leave rc as EEXIST */
@@ -705,10 +743,14 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                    might not right be right access to request */
                 rc = CIFSSMBOpen(xid, pTcon, fromName, FILE_OPEN, GENERIC_READ,
                                  CREATE_NOT_DIR, &netfid, &oplock, NULL,
-                                 cifs_sb_source->local_nls);
+                                 cifs_sb_source->local_nls, 
+                                 cifs_sb_source->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if (rc==0) {
                         CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
-                                              cifs_sb_source->local_nls);
+                                              cifs_sb_source->local_nls, 
+                                              cifs_sb_source->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         CIFSSMBClose(xid, pTcon, netfid);
                 }
         }
@@ -962,7 +1004,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                            it by handle */
                         rc = CIFSSMBSetEOF(xid, pTcon, full_path,
                                            attrs->ia_size, FALSE,
-                                           cifs_sb->local_nls);
+                                           cifs_sb->local_nls, 
+                                           cifs_sb->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         cFYI(1, (" SetEOF by path (setattrs) rc = %d", rc));
                 }
 
@@ -999,7 +1043,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
         if ((cifs_sb->tcon->ses->capabilities & CAP_UNIX)
             && (attrs->ia_valid & (ATTR_MODE | ATTR_GID | ATTR_UID)))
                 rc = CIFSSMBUnixSetPerms(xid, pTcon, full_path, mode, uid, gid,
-                                         0 /* dev_t */, cifs_sb->local_nls);
+                                         0 /* dev_t */, cifs_sb->local_nls,
+                                         cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
         else if (attrs->ia_valid & ATTR_MODE) {
                 if ((mode & S_IWUGO) == 0) /* not writeable */ {
                         if ((cifsInode->cifsAttrs & ATTR_READONLY) == 0)
@@ -1048,7 +1094,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                    via Handle (SetFileInfo) instead of by path */
                 if (!(pTcon->ses->flags & CIFS_SES_NT4))
                         rc = CIFSSMBSetTimes(xid, pTcon, full_path, &time_buf,
-                                             cifs_sb->local_nls);
+                                             cifs_sb->local_nls,
+                                             cifs_sb->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                 else
                         rc = -EOPNOTSUPP;
 
@@ -1063,7 +1111,9 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                         rc = CIFSSMBOpen(xid, pTcon, full_path, FILE_OPEN,
                                          SYNCHRONIZE | FILE_WRITE_ATTRIBUTES,
                                          CREATE_NOT_DIR, &netfid, &oplock,
-                                         NULL, cifs_sb->local_nls);
+                                         NULL, cifs_sb->local_nls,
+                                         cifs_sb->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         if (rc==0) {
                                 rc = CIFSSMBSetFileTimes(xid, pTcon, &time_buf,
                                                          netfid);
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index b4b8e201d428..b0ea6687ab55 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -20,30 +20,93 @@
  *   along with this library; if not, write to the Free Software
  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
+
 #include <linux/fs.h>
 #include <linux/ext2_fs.h>
 #include "cifspdu.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
+#include "cifsfs.h"
+
+#define CIFS_IOC_CHECKUMOUNT _IO(0xCF, 2)
 
 int cifs_ioctl (struct inode * inode, struct file * filep, 
                 unsigned int command, unsigned long arg)
 {
         int rc = -ENOTTY; /* strange error - but the precedent */
+        int xid;
+        struct cifs_sb_info *cifs_sb;
+#ifdef CONFIG_CIFS_POSIX
+        __u64   ExtAttrBits = 0;
+        __u64   ExtAttrMask = 0;
+        __u64   caps;
+        struct cifsTconInfo *tcon;
+        struct cifsFileInfo *pSMBFile =
+                (struct cifsFileInfo *)filep->private_data;
+#endif /* CONFIG_CIFS_POSIX */
+
+        xid = GetXid();
+
+        cFYI(1,("ioctl file %p  cmd %u  arg %lu",filep,command,arg));
+
+        cifs_sb = CIFS_SB(inode->i_sb);
+
 #ifdef CONFIG_CIFS_POSIX
-        cFYI(1,("ioctl file %p  cmd %u  arg %lu",filep,command,arg));
+        tcon = cifs_sb->tcon;
+        if(tcon)
+                caps = le64_to_cpu(tcon->fsUnixInfo.Capability);
+        else {
+                rc = -EIO;
+                FreeXid(xid);
+                return -EIO;
+        }
+#endif /* CONFIG_CIFS_POSIX */
+
         switch(command) {
+                case CIFS_IOC_CHECKUMOUNT:
+                        cFYI(1,("User unmount attempted"));
+                        if(cifs_sb->mnt_uid == current->uid)
+                                rc = 0;
+                        else {
+                                rc = -EACCES;
+                                cFYI(1,("uids do not match"));
+                        }
+                        break;
+#ifdef CONFIG_CIFS_POSIX
                 case EXT2_IOC_GETFLAGS:
-                        cFYI(1,("get flags not implemented yet"));
-                        return -EOPNOTSUPP;
+                        if(CIFS_UNIX_EXTATTR_CAP & caps) {
+                                if (pSMBFile == NULL)
+                                        break;
+                                rc = CIFSGetExtAttr(xid, tcon, pSMBFile->netfid,
+                                        &ExtAttrBits, &ExtAttrMask);
+                                if(rc == 0)
+                                        rc = put_user(ExtAttrBits &
+                                                EXT2_FL_USER_VISIBLE,
+                                                (int __user *)arg);
+                        }
+                        break;
+
                 case EXT2_IOC_SETFLAGS:
+                        if(CIFS_UNIX_EXTATTR_CAP & caps) {
+                                if(get_user(ExtAttrBits,(int __user *)arg)) {
+                                        rc = -EFAULT;
+                                        break;
+                                }
+                                if (pSMBFile == NULL)
+                                        break;
+                                /* rc= CIFSGetExtAttr(xid,tcon,pSMBFile->netfid,
+                                        extAttrBits, &ExtAttrMask);*/
+                                
+                        }
                         cFYI(1,("set flags not implemented yet"));
-                        return -EOPNOTSUPP;
+                        break;
+#endif /* CONFIG_CIFS_POSIX */
                 default:
                         cFYI(1,("unsupported ioctl"));
-                        return rc;
+                        break;
         }
-#endif /* CONFIG_CIFS_POSIX */
+
+        FreeXid(xid);
         return rc;
 } 
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 1455810ba1cb..bde0fabfece0 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -59,10 +59,14 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode,
 
         if (cifs_sb_target->tcon->ses->capabilities & CAP_UNIX)
                 rc = CIFSUnixCreateHardLink(xid, pTcon, fromName, toName,
-                                            cifs_sb_target->local_nls);
+                                            cifs_sb_target->local_nls, 
+                                            cifs_sb_target->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
         else {
                 rc = CIFSCreateHardLink(xid, pTcon, fromName, toName,
-                                        cifs_sb_target->local_nls);
+                                        cifs_sb_target->local_nls, 
+                                        cifs_sb_target->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if(rc == -EIO)
                         rc = -EOPNOTSUPP;  
         }
@@ -260,7 +264,10 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
                                 cifs_sb->local_nls);
         else {
                 rc = CIFSSMBOpen(xid, pTcon, full_path, FILE_OPEN, GENERIC_READ,
-                                OPEN_REPARSE_POINT,&fid, &oplock, NULL, cifs_sb->local_nls);
+                                OPEN_REPARSE_POINT,&fid, &oplock, NULL, 
+                                cifs_sb->local_nls, 
+                                cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if(!rc) {
                         rc = CIFSSMBQueryReparseLinkInfo(xid, pTcon, full_path,
                                 tmpbuffer,
@@ -279,7 +286,10 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
                                         strncpy(tmp_path, pTcon->treeName, MAX_TREE_SIZE);
                                         strncat(tmp_path, full_path, MAX_PATHCONF);
                                         rc = get_dfs_path(xid, pTcon->ses, tmp_path,
-                                                cifs_sb->local_nls, &num_referrals, &referrals);
+                                                cifs_sb->local_nls,
+                                                &num_referrals, &referrals,
+                                                cifs_sb->mnt_cifs_flags &
+                                                    CIFS_MOUNT_MAP_SPECIAL_CHR);
                                         cFYI(1,("Get DFS for %s rc = %d ",tmp_path, rc));
                                         if((num_referrals == 0) && (rc == 0))
                                                 rc = -EACCES;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 7b38d3059a83..db14b503d89e 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -28,6 +28,7 @@
 #include "cifs_debug.h"
 #include "smberr.h"
 #include "nterr.h"
+#include "cifs_unicode.h"
 
 extern mempool_t *cifs_sm_req_poolp;
 extern mempool_t *cifs_req_poolp;
@@ -451,25 +452,30 @@ is_valid_oplock_break(struct smb_hdr *buf)
                         atomic_inc(&tcon->num_oplock_brks);
 #endif
                         list_for_each(tmp1,&tcon->openFileList){
-                                netfile = list_entry(tmp1,struct cifsFileInfo,tlist);
+                                netfile = list_entry(tmp1,struct cifsFileInfo,
+                                                     tlist);
                                 if(pSMB->Fid == netfile->netfid) {
                                         struct cifsInodeInfo *pCifsInode;
                                         read_unlock(&GlobalSMBSeslock);
-                                        cFYI(1,("Matching file id, processing oplock break"));
+                                        cFYI(1,("file id match, oplock break"));
                                         pCifsInode = 
                                                 CIFS_I(netfile->pInode);
                                         pCifsInode->clientCanCacheAll = FALSE;
                                         if(pSMB->OplockLevel == 0)
-                                                pCifsInode->clientCanCacheRead = FALSE;
+                                                pCifsInode->clientCanCacheRead
+                                                        = FALSE;
                                         pCifsInode->oplockPending = TRUE;
-                                        AllocOplockQEntry(netfile->pInode, netfile->netfid, tcon);
+                                        AllocOplockQEntry(netfile->pInode,
+                                                          netfile->netfid,
+                                                          tcon);
                                         cFYI(1,("about to wake up oplock thd"));
-                                        wake_up_process(oplockThread);               
+                                        if(oplockThread)
+                                            wake_up_process(oplockThread);
                                         return TRUE;
                                 }
                         }
                         read_unlock(&GlobalSMBSeslock);
-                        cFYI(1,("No matching file for oplock break on connection"));
+                        cFYI(1,("No matching file for oplock break"));
                         return TRUE;
                 }
         }
@@ -490,7 +496,7 @@ dump_smb(struct smb_hdr *smb_buf, int smb_buf_length)
 
         buffer = (unsigned char *) smb_buf;
         for (i = 0, j = 0; i < smb_buf_length; i++, j++) {
-                if (i % 8 == 0) {       /* we have reached the beginning of line  */
+                if (i % 8 == 0) {       /* have reached the beginning of line */
                         printk(KERN_DEBUG "| ");
                         j = 0;
                 }
@@ -501,7 +507,7 @@ dump_smb(struct smb_hdr *smb_buf, int smb_buf_length)
                 else
                         debug_line[1 + (2 * j)] = '_';
 
-                if (i % 8 == 7) {       /* we have reached end of line, time to print ascii */
+                if (i % 8 == 7) { /* reached end of line, time to print ascii */
                         debug_line[16] = 0;
                         printk(" | %s\n", debug_line);
                 }
@@ -514,3 +520,141 @@ dump_smb(struct smb_hdr *smb_buf, int smb_buf_length)
         printk( " | %s\n", debug_line);
         return;
 }
+
+/* Windows maps these to the user defined 16 bit Unicode range since they are
+   reserved symbols (along with \ and /), otherwise illegal to store
+   in filenames in NTFS */
+#define UNI_ASTERIK     (__u16) ('*' + 0xF000)
+#define UNI_QUESTION    (__u16) ('?' + 0xF000)
+#define UNI_COLON       (__u16) (':' + 0xF000)
+#define UNI_GRTRTHAN    (__u16) ('>' + 0xF000)
+#define UNI_LESSTHAN    (__u16) ('<' + 0xF000)
+#define UNI_PIPE        (__u16) ('|' + 0xF000)
+#define UNI_SLASH       (__u16) ('\\' + 0xF000)
+
+/* Convert 16 bit Unicode pathname from wire format to string in current code
+   page.  Conversion may involve remapping up the seven characters that are
+   only legal in POSIX-like OS (if they are present in the string). Path
+   names are little endian 16 bit Unicode on the wire */
+int
+cifs_convertUCSpath(char *target, const __le16 * source, int maxlen,
+                    const struct nls_table * cp)
+{
+        int i,j,len;
+        __u16 src_char;
+
+        for(i = 0, j = 0; i < maxlen; i++) {
+                src_char = le16_to_cpu(source[i]);
+                switch (src_char) {
+                        case 0:
+                                goto cUCS_out; /* BB check this BB */
+                        case UNI_COLON:
+                                target[j] = ':';
+                                break;
+                        case UNI_ASTERIK:
+                                target[j] = '*';
+                                break;
+                        case UNI_QUESTION:
+                                target[j] = '?';
+                                break;
+                        /* BB We can not handle remapping slash until
+                           all the calls to build_path_from_dentry
+                           are modified, as they use slash as separator BB */
+                        /* case UNI_SLASH:
+                                target[j] = '\\';
+                                break;*/
+                        case UNI_PIPE:
+                                target[j] = '|';
+                                break;
+                        case UNI_GRTRTHAN:
+                                target[j] = '>';
+                                break;
+                        case UNI_LESSTHAN:
+                                target[j] = '<';
+                        default: 
+                                len = cp->uni2char(src_char, &target[j], 
+                                                NLS_MAX_CHARSET_SIZE);
+                                if(len > 0) {
+                                        j += len;
+                                        continue;
+                                } else {
+                                        target[j] = '?';
+                                }
+                }
+                j++;
+                /* make sure we do not overrun callers allocated temp buffer */
+                if(j >= (2 * NAME_MAX))
+                        break;
+        }
+cUCS_out:
+        target[j] = 0;
+        return j;
+}
+
+/* Convert 16 bit Unicode pathname to wire format from string in current code
+   page.  Conversion may involve remapping up the seven characters that are
+   only legal in POSIX-like OS (if they are present in the string). Path
+   names are little endian 16 bit Unicode on the wire */
+int
+cifsConvertToUCS(__le16 * target, const char *source, int maxlen, 
+                 const struct nls_table * cp, int mapChars)
+{
+        int i,j,charlen;
+        int len_remaining = maxlen;
+        char src_char;
+
+        if(!mapChars) 
+                return cifs_strtoUCS((wchar_t *) target, source, PATH_MAX, cp);
+
+        for(i = 0, j = 0; i < maxlen; j++) {
+                src_char = source[i];
+                switch (src_char) {
+                        case 0:
+                                goto ctoUCS_out;
+                        case ':':
+                                target[j] = cpu_to_le16(UNI_COLON);
+                                break;
+                        case '*':
+                                target[j] = cpu_to_le16(UNI_ASTERIK);
+                                break;
+                        case '?':
+                                target[j] = cpu_to_le16(UNI_QUESTION);
+                                break;
+                        case '<':
+                                target[j] = cpu_to_le16(UNI_LESSTHAN);
+                                break;
+                        case '>':
+                                target[j] = cpu_to_le16(UNI_GRTRTHAN);
+                                break;
+                        case '|':
+                                target[j] = cpu_to_le16(UNI_PIPE);
+                                break;                  
+                        /* BB We can not handle remapping slash until
+                           all the calls to build_path_from_dentry
+                           are modified, as they use slash as separator BB */
+                        /* case '\\':
+                                target[j] = cpu_to_le16(UNI_SLASH);
+                                break;*/
+                        default:
+                                charlen = cp->char2uni(source+i,
+                                        len_remaining, target+j);
+                                /* if no match, use question mark, which
+                                at least in some cases servers as wild card */
+                                if(charlen < 1) {
+                                        target[j] = cpu_to_le16(0x003f);
+                                        charlen = 1;
+                                }
+                                len_remaining -= charlen;
+                                /* character may take more than one byte in the
+                                   the source string, but will take exactly two
+                                   bytes in the target string */
+                                i+= charlen;
+                                continue;
+                }
+                i++; /* move to next char in source string */
+                len_remaining--;
+        }
+
+ctoUCS_out:
+        return i;
+}
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index 4e34c89cec5d..a92af41d4411 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -78,6 +78,7 @@ static const struct smb_to_posix_error mapping_table_ERRDOS[] = {
         {ErrQuota, -EDQUOT},
         {ErrNotALink, -ENOLINK},
         {ERRnetlogonNotStarted,-ENOPROTOOPT},
+        {ErrTooManyLinks,-EMLINK},
         {0, 0}
 };
 
@@ -206,7 +207,7 @@ static const struct {
         {
         ERRDOS, ERRgeneral, NT_STATUS_UNSUCCESSFUL}, {
         ERRDOS, ERRbadfunc, NT_STATUS_NOT_IMPLEMENTED}, {
-        ERRDOS, 87, NT_STATUS_INVALID_INFO_CLASS}, {
+        ERRDOS, ERRinvlevel, NT_STATUS_INVALID_INFO_CLASS}, {
         ERRDOS, 24, NT_STATUS_INFO_LENGTH_MISMATCH}, {
         ERRHRD, ERRgeneral, NT_STATUS_ACCESS_VIOLATION}, {
         ERRHRD, ERRgeneral, NT_STATUS_IN_PAGE_ERROR}, {
@@ -742,7 +743,7 @@ static const struct {
         ERRDOS, 182, NT_STATUS_DRIVER_ORDINAL_NOT_FOUND}, {
         ERRDOS, 127, NT_STATUS_DRIVER_ENTRYPOINT_NOT_FOUND}, {
         ERRDOS, 288, NT_STATUS_RESOURCE_NOT_OWNED}, {
-        ERRHRD, ERRgeneral, NT_STATUS_TOO_MANY_LINKS}, {
+        ERRDOS, ErrTooManyLinks, NT_STATUS_TOO_MANY_LINKS}, {
         ERRHRD, ERRgeneral, NT_STATUS_QUOTA_LIST_INCONSISTENT}, {
         ERRHRD, ERRgeneral, NT_STATUS_FILE_IS_OFFLINE}, {
         ERRDOS, 21, 0xc000026e}, {
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index f8bea395ec9e..22557716f9af 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -3,7 +3,7 @@
  *
  *   Directory search handling
  * 
- *   Copyright (C) International Business Machines  Corp., 2004
+ *   Copyright (C) International Business Machines  Corp., 2004, 2005
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -65,14 +65,14 @@ static int construct_dentry(struct qstr *qstring, struct file *file,
         struct cifsTconInfo *pTcon;
         int rc = 0;
 
-        cFYI(1, ("For %s ", qstring->name));
+        cFYI(1, ("For %s", qstring->name));
         cifs_sb = CIFS_SB(file->f_dentry->d_sb);
         pTcon = cifs_sb->tcon;
 
         qstring->hash = full_name_hash(qstring->name, qstring->len);
         tmp_dentry = d_lookup(file->f_dentry, qstring);
         if (tmp_dentry) {
-                cFYI(0, (" existing dentry with inode 0x%p", tmp_dentry->d_inode));
+                cFYI(0, ("existing dentry with inode 0x%p", tmp_dentry->d_inode));
                 *ptmp_inode = tmp_dentry->d_inode;
 /* BB overwrite old name? i.e. tmp_dentry->d_name and tmp_dentry->d_name.len??*/
                 if(*ptmp_inode == NULL) {
@@ -105,8 +105,11 @@ static int construct_dentry(struct qstr *qstring, struct file *file,
 }
 
 static void fill_in_inode(struct inode *tmp_inode,
-        FILE_DIRECTORY_INFO *pfindData, int *pobject_type)
+        FILE_DIRECTORY_INFO *pfindData, int *pobject_type, int isNewInode)
 {
+        loff_t local_size;
+        struct timespec local_mtime;
+
         struct cifsInodeInfo *cifsInfo = CIFS_I(tmp_inode);
         struct cifs_sb_info *cifs_sb = CIFS_SB(tmp_inode->i_sb);
         __u32 attr = le32_to_cpu(pfindData->ExtFileAttributes);
@@ -116,6 +119,10 @@ static void fill_in_inode(struct inode *tmp_inode,
         cifsInfo->cifsAttrs = attr;
         cifsInfo->time = jiffies;
 
+        /* save mtime and size */
+        local_mtime = tmp_inode->i_mtime;
+        local_size  = tmp_inode->i_size;
+
         /* Linux can not store file creation time unfortunately so ignore it */
         tmp_inode->i_atime =
             cifs_NTtimeToUnix(le64_to_cpu(pfindData->LastAccessTime));
@@ -134,7 +141,6 @@ static void fill_in_inode(struct inode *tmp_inode,
                 tmp_inode->i_mode = cifs_sb->mnt_file_mode;
         }
 
-        cFYI(0,("CIFS FFIRST: Attributes came in as 0x%x",attr));
         if (attr & ATTR_DIRECTORY) {
                 *pobject_type = DT_DIR;
                 /* override default perms since we do not lock dirs */
@@ -175,30 +181,46 @@ static void fill_in_inode(struct inode *tmp_inode,
               (unsigned long)tmp_inode->i_size, tmp_inode->i_blocks,
               tmp_inode->i_blksize));
         if (S_ISREG(tmp_inode->i_mode)) {
-                cFYI(1, (" File inode "));
+                cFYI(1, ("File inode"));
                 tmp_inode->i_op = &cifs_file_inode_ops;
                 if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_DIRECT_IO)
                         tmp_inode->i_fop = &cifs_file_direct_ops;
                 else
                         tmp_inode->i_fop = &cifs_file_ops;
                 tmp_inode->i_data.a_ops = &cifs_addr_ops;
+
+                if(isNewInode)
+                        return; /* No sense invalidating pages for new inode since we
+                                           have not started caching readahead file data yet */
+
+                if (timespec_equal(&tmp_inode->i_mtime, &local_mtime) &&
+                        (local_size == tmp_inode->i_size)) {
+                        cFYI(1, ("inode exists but unchanged"));
+                } else {
+                        /* file may have changed on server */
+                        cFYI(1, ("invalidate inode, readdir detected change"));
+                        invalidate_remote_inode(tmp_inode);
+                }
         } else if (S_ISDIR(tmp_inode->i_mode)) {
-                cFYI(1, (" Directory inode"));
+                cFYI(1, ("Directory inode"));
                 tmp_inode->i_op = &cifs_dir_inode_ops;
                 tmp_inode->i_fop = &cifs_dir_ops;
         } else if (S_ISLNK(tmp_inode->i_mode)) {
-                cFYI(1, (" Symbolic Link inode "));
+                cFYI(1, ("Symbolic Link inode"));
                 tmp_inode->i_op = &cifs_symlink_inode_ops;
         } else {
-                cFYI(1, (" Init special inode "));
+                cFYI(1, ("Init special inode"));
                 init_special_inode(tmp_inode, tmp_inode->i_mode,
                                    tmp_inode->i_rdev);
         }
 }
 
 static void unix_fill_in_inode(struct inode *tmp_inode,
-        FILE_UNIX_INFO *pfindData, int *pobject_type)
+        FILE_UNIX_INFO *pfindData, int *pobject_type, int isNewInode)
 {
+        loff_t local_size;
+        struct timespec local_mtime;
+
         struct cifsInodeInfo *cifsInfo = CIFS_I(tmp_inode);
         struct cifs_sb_info *cifs_sb = CIFS_SB(tmp_inode->i_sb);
 
@@ -208,6 +230,10 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
         cifsInfo->time = jiffies;
         atomic_inc(&cifsInfo->inUse);
 
+        /* save mtime and size */
+        local_mtime = tmp_inode->i_mtime;
+        local_size  = tmp_inode->i_size;
+
         tmp_inode->i_atime =
             cifs_NTtimeToUnix(le64_to_cpu(pfindData->LastAccessTime));
         tmp_inode->i_mtime =
@@ -265,6 +291,19 @@ static void unix_fill_in_inode(struct inode *tmp_inode,
                 else
                         tmp_inode->i_fop = &cifs_file_ops;
                 tmp_inode->i_data.a_ops = &cifs_addr_ops;
+
+                if(isNewInode)
+                        return; /* No sense invalidating pages for new inode since we
+                                           have not started caching readahead file data yet */
+
+                if (timespec_equal(&tmp_inode->i_mtime, &local_mtime) &&
+                        (local_size == tmp_inode->i_size)) {
+                        cFYI(1, ("inode exists but unchanged"));
+                } else {
+                        /* file may have changed on server */
+                        cFYI(1, ("invalidate inode, readdir detected change"));
+                        invalidate_remote_inode(tmp_inode);
+                }
         } else if (S_ISDIR(tmp_inode->i_mode)) {
                 cFYI(1, ("Directory inode"));
                 tmp_inode->i_op = &cifs_dir_inode_ops;
@@ -314,15 +353,16 @@ static int initiate_cifs_search(const int xid, struct file *file)
                 return -EINVAL;
 
         down(&file->f_dentry->d_sb->s_vfs_rename_sem);
-        full_path = build_wildcard_path_from_dentry(file->f_dentry);
+        full_path = build_path_from_dentry(file->f_dentry);
         up(&file->f_dentry->d_sb->s_vfs_rename_sem);
 
         if(full_path == NULL) {
                 return -ENOMEM;
         }
 
-        cFYI(1, ("Full path: %s start at: %lld ", full_path, file->f_pos));
+        cFYI(1, ("Full path: %s start at: %lld", full_path, file->f_pos));
 
+ffirst_retry:
         /* test for Unix extensions */
         if (pTcon->ses->capabilities & CAP_UNIX) {
                 cifsFile->srch_inf.info_level = SMB_FIND_FILE_UNIX; 
@@ -332,10 +372,16 @@ static int initiate_cifs_search(const int xid, struct file *file)
                 cifsFile->srch_inf.info_level = SMB_FIND_FILE_DIRECTORY_INFO;
         }
 
-        rc = CIFSFindFirst(xid, pTcon,full_path,cifs_sb->local_nls, 
-                &cifsFile->netfid, &cifsFile->srch_inf); 
+        rc = CIFSFindFirst(xid, pTcon,full_path,cifs_sb->local_nls,
+                &cifsFile->netfid, &cifsFile->srch_inf,
+                cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         if(rc == 0)
                 cifsFile->invalidHandle = FALSE;
+        if((rc == -EOPNOTSUPP) && 
+                (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) {
+                cifs_sb->mnt_cifs_flags &= ~CIFS_MOUNT_SERVER_INUM;
+                goto ffirst_retry;
+        }
         kfree(full_path);
         return rc;
 }
@@ -363,10 +409,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb)
         cFYI(1,("new entry %p old entry %p",new_entry,old_entry));
         /* validate that new_entry is not past end of SMB */
         if(new_entry >= end_of_smb) {
-                cFYI(1,("search entry %p began after end of SMB %p old entry %p",
-                        new_entry,end_of_smb,old_entry)); 
+                cERROR(1,
+                      ("search entry %p began after end of SMB %p old entry %p",
+                        new_entry, end_of_smb, old_entry)); 
                 return NULL;
-        } else
+        } else if (new_entry + sizeof(FILE_DIRECTORY_INFO) > end_of_smb) {
+                cERROR(1,("search entry %p extends after end of SMB %p",
+                        new_entry, end_of_smb));
+                return NULL;
+        } else 
                 return new_entry;
 
 }
@@ -594,7 +645,12 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
         if(unicode) {
                 /* BB fixme - test with long names */
                 /* Note converted filename can be longer than in unicode */
-                pqst->len = cifs_strfromUCS_le((char *)pqst->name,(wchar_t *)filename,len/2,nlt);
+                if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR)
+                        pqst->len = cifs_convertUCSpath((char *)pqst->name,
+                                        (__le16 *)filename, len/2, nlt);
+                else
+                        pqst->len = cifs_strfromUCS_le((char *)pqst->name,
+                                        (wchar_t *)filename,len/2,nlt);
         } else {
                 pqst->name = filename;
                 pqst->len = len;
@@ -654,10 +710,15 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
                 insert_inode_hash(tmp_inode);
         }
 
+        /* we pass in rc below, indicating whether it is a new inode,
+           so we can figure out whether to invalidate the inode cached
+           data if the file has changed */
         if(pCifsF->srch_inf.info_level == SMB_FIND_FILE_UNIX) {
-                unix_fill_in_inode(tmp_inode,(FILE_UNIX_INFO *)pfindEntry,&obj_type);
+                unix_fill_in_inode(tmp_inode,
+                                   (FILE_UNIX_INFO *)pfindEntry,&obj_type, rc);
         } else {
-                fill_in_inode(tmp_inode,(FILE_DIRECTORY_INFO *)pfindEntry,&obj_type);
+                fill_in_inode(tmp_inode,
+                              (FILE_DIRECTORY_INFO *)pfindEntry,&obj_type, rc);
         }
         
         rc = filldir(direntry,qstring.name,qstring.len,file->f_pos,tmp_inode->i_ino,obj_type);
@@ -823,7 +884,11 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                 end_of_smb = cifsFile->srch_inf.ntwrk_buf_start +
                         smbCalcSize((struct smb_hdr *)
                                     cifsFile->srch_inf.ntwrk_buf_start);
-                tmp_buf = kmalloc(NAME_MAX+1,GFP_KERNEL);
+                /* To be safe - for UCS to UTF-8 with strings loaded
+                with the rare long characters alloc more to account for
+                such multibyte target UTF-8 characters. cifs_unicode.c,
+                which actually does the conversion, has the same limit */
+                tmp_buf = kmalloc((2 * NAME_MAX) + 4, GFP_KERNEL);
                 for(i=0;(i<num_to_fill) && (rc == 0);i++) {
                         if(current_entry == NULL) {
                                 /* evaluate whether this case is an error */
@@ -832,19 +897,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                                 break;
                         }
 
-                        /* BB FIXME - need to enable the below code BB */
-
-                /* if((!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM)) ||
-                           (cifsFile->srch_inf.info_level != 
-                                   something that supports server inodes)) {
-                                create dentry
-                                create inode
-                                fill in inode new_inode (getting local i_ino)
-                        }
-                        also create local inode for performance reasons (so we 
-                        have a cache of inode metadata) unless this new mount 
-                        parm says otherwise */
-
                         rc = cifs_filldir(current_entry, file, 
                                         filldir, direntry,tmp_buf);
                         file->f_pos++;
diff --git a/fs/cifs/smberr.h b/fs/cifs/smberr.h
index e21f1384661f..cd41c67ff8d3 100644
--- a/fs/cifs/smberr.h
+++ b/fs/cifs/smberr.h
@@ -22,94 +22,159 @@
  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 
  */
 
-#define SUCCESS 0               /* The request was successful. */
-#define ERRDOS 0x01             /* Error is from the core DOS operating system set */
-#define ERRSRV 0x02             /* Error is generated by the file server daemon */
-#define ERRHRD 0x03             /* Error is a hardware error. */
-#define ERRCMD 0xFF             /*  Command was not in the "SMB" format. */
+#define SUCCESS 0x00    /* The request was successful. */
+#define ERRDOS  0x01    /* Error is from the core DOS operating system set */
+#define ERRSRV  0x02    /* Error is generated by the file server daemon */
+#define ERRHRD  0x03    /* Error is a hardware error. */
+#define ERRCMD  0xFF    /* Command was not in the "SMB" format. */
 
 /* The following error codes may be generated with the SUCCESS error class.*/
 
-#define SUCCESS 0               /* The request was successful. */
+/*#define SUCCESS       0       The request was successful. */
 
 /* The following error codes may be generated with the ERRDOS error class.*/
 
-#define ERRbadfunc 1            /* Invalid function. The server did not recognize or could not perform a system call generated by the server, e.g., set the DIRECTORY attribute on a data file, invalid seek mode. */
-#define ERRbadfile 2            /*File not found. The last component of a file's pathname could not be found. */
-#define ERRbadpath 3            /* Directory invalid. A directory component in a pathname could not be found. */
-#define ERRnofids 4             /* Too many open files. The server has no file handles available. */
-#define ERRnoaccess 5           /* Access denied, the client's context does not permit the requested function. This includes the following conditions: invalid rename command, write to Fid open for read only, read on Fid open for write only, attempt to delete a non-empty directory */
-#define ERRbadfid 6             /* Invalid file handle. The file handle specified was not recognized by the server. */
-#define ERRbadmcb 7             /* Memory control blocks destroyed. */
-#define ERRnomem 8              /* Insufficient server memory to perform the requested function. */
-#define ERRbadmem 9             /* Invalid memory block address. */
-#define ERRbadenv 10            /* Invalid environment. */
-#define ERRbadformat 11         /* Invalid format. */
-#define ERRbadaccess 12         /* Invalid open mode. */
-#define ERRbaddata 13           /* Invalid data (generated only by IOCTL calls within the server). */
-#define ERRbaddrive 15          /* Invalid drive specified. */
-#define ERRremcd 16             /* A Delete Directory request attempted to remove the server's current directory. */
-#define ERRdiffdevice 17        /* Not same device (e.g., a cross volume rename was attempted */
-#define ERRnofiles 18           /* A File Search command can find no more files matching the specified criteria. */
-#define ERRgeneral 31
-#define ERRbadshare 32          /* The sharing mode specified for an Open conflicts with existing FIDs on the file. */
-#define ERRlock 33              /* A Lock request conflicted with an existing lock or specified an invalid mode, or an Unlock requested attempted to remove a lock held by another process. */
-#define ERRunsup     50
-#define ERRnosuchshare 67
-#define ERRfilexists 80         /* The file named in the request already exists. */
-#define ERRinvparm   87
-#define ERRdiskfull  112
-#define ERRinvname   123
-#define ERRinvlevel  124
-#define ERRdirnotempty 145
-#define ERRnotlocked   158
-#define ERRalreadyexists 183
-#define ERRbadpipe 230
-#define ERRpipebusy 231
-#define ERRpipeclosing 232
-#define ERRnotconnected 233
-#define ERRmoredata    234
-#define ERReasnotsupported 282
-#define ErrQuota 0x200          /* The operation would cause a quota limit to be exceeded. */
-#define ErrNotALink 0x201       /* A link operation was performed on a pathname that
-                                   was not a link. */
+#define ERRbadfunc              1       /* Invalid function. The server did not
+                                           recognize or could not perform a
+                                           system call generated by the server,
+                                           e.g., set the DIRECTORY attribute on
+                                           a data file, invalid seek mode. */
+#define ERRbadfile              2       /* File not found. The last component
+                                           of a file's pathname could not be
+                                           found. */
+#define ERRbadpath              3       /* Directory invalid. A directory
+                                           component in a pathname could not be
+                                           found. */
+#define ERRnofids               4       /* Too many open files. The server has
+                                           no file handles available. */
+#define ERRnoaccess             5       /* Access denied, the client's context
+                                           does not permit the requested
+                                           function. This includes the
+                                           following conditions: invalid rename
+                                           command, write to Fid open for read
+                                           only, read on Fid open for write
+                                           only, attempt to delete a non-empty
+                                           directory */
+#define ERRbadfid               6       /* Invalid file handle. The file handle
+                                           specified was not recognized by the
+                                           server. */
+#define ERRbadmcb               7       /* Memory control blocks destroyed. */
+#define ERRnomem                8       /* Insufficient server memory to
+                                           perform the requested function. */
+#define ERRbadmem               9       /* Invalid memory block address. */
+#define ERRbadenv               10      /* Invalid environment. */
+#define ERRbadformat            11      /* Invalid format. */
+#define ERRbadaccess            12      /* Invalid open mode. */
+#define ERRbaddata              13      /* Invalid data (generated only by
+                                           IOCTL calls within the server). */
+#define ERRbaddrive             15      /* Invalid drive specified. */
+#define ERRremcd                16      /* A Delete Directory request attempted
+                                           to remove the server's current
+                                           directory. */
+#define ERRdiffdevice           17      /* Not same device (e.g., a cross
+                                           volume rename was attempted */
+#define ERRnofiles              18      /* A File Search command can find no
+                                           more files matching the specified
+                                           criteria. */
+#define ERRgeneral              31
+#define ERRbadshare             32      /* The sharing mode specified for an
+                                           Open conflicts with existing FIDs on
+                                           the file. */
+#define ERRlock                 33      /* A Lock request conflicted with an
+                                           existing lock or specified an
+                                           invalid mode, or an Unlock requested
+                                           attempted to remove a lock held by
+                                           another process. */
+#define ERRunsup                50
+#define ERRnosuchshare          67
+#define ERRfilexists            80      /* The file named in the request
+                                           already exists. */
+#define ERRinvparm              87
+#define ERRdiskfull             112
+#define ERRinvname              123
+#define ERRinvlevel             124
+#define ERRdirnotempty          145
+#define ERRnotlocked            158
+#define ERRalreadyexists        183
+#define ERRbadpipe              230
+#define ERRpipebusy             231
+#define ERRpipeclosing          232
+#define ERRnotconnected         233
+#define ERRmoredata             234
+#define ERReasnotsupported      282
+#define ErrQuota                0x200   /* The operation would cause a quota
+                                           limit to be exceeded. */
+#define ErrNotALink             0x201   /* A link operation was performed on a
+                                           pathname that was not a link. */
 
-/* Following error codes may be generated with the ERRSRV error
-class.*/
+/* Below errors are used internally (do not come over the wire) for passthrough
+   from STATUS codes to POSIX only  */
+#define ErrTooManyLinks         0xFFFE   
 
-#define ERRerror 1              /* Non-specific error code. It is returned under the following conditions: resource other than disk space exhausted (e.g. TIDs), first SMB command was not negotiate, multiple negotiates attempted, and internal server error. */
-#define ERRbadpw 2              /* Bad password - name/password pair in a TreeConnect or Session Setup are invalid. */
-#define ERRbadtype 3            /* used for indicating DFS referral needed */
-#define ERRaccess 4             /* The client does not have the necessary access rights within the specified context for requested function. */
-#define ERRinvtid 5             /* The Tid specified in a command was invalid. */
-#define ERRinvnetname 6         /* Invalid network name in tree connect. */
-#define ERRinvdevice 7          /* Invalid device - printer request made to non-printer connection or non-printer request made to printer connection. */
-#define ERRqfull 49             /* Print queue full (files) -- returned by open print file. */
-#define ERRqtoobig 50           /* Print queue full -- no space. */
-#define ERRqeof         51      /* EOF on print queue dump */
-#define ERRinvpfid      52      /* Invalid print file FID. */
-#define ERRsmbcmd       64      /* The server did not recognize the command received. */
-#define ERRsrverror     65      /* The server encountered an internal error, e.g., system file unavailable. */
-#define ERRbadBID       66      /* (obsolete) */
-#define ERRfilespecs    67      /* The Fid and pathname parameters contained an invalid combination of values. */
-#define ERRbadLink      68      /* (obsolete) */
-#define ERRbadpermits   69      /* The access permissions specified for a file or directory are not a valid combination. */
-#define ERRbadPID       70
-#define ERRsetattrmode  71      /* attribute (mode) is invalid */
-#define ERRpaused       81      /* Server is paused */
-#define ERRmsgoff       82      /* reserved - messaging off */
-#define ERRnoroom       83      /* reserved - no room for message */
-#define ERRrmuns        87      /* reserved - too many remote names */
-#define ERRtimeout      88      /* operation timed out */
-#define ERRnoresource   89      /* No resources available for request */
-#define ERRtoomanyuids  90      /* Too many UIDs active on this session */
-#define ERRbaduid       91      /* The UID is not known as a valid user */
-#define ERRusempx      250      /* temporarily unable to use raw */
-#define ERRusestd      251      /* temporarily unable to use either raw or mpx */
-#define ERR_NOTIFY_ENUM_DIR 1024
-#define ERRaccountexpired 2239
-#define ERRbadclient      2240
-#define ERRbadLogonTime   2241
-#define ERRpasswordExpired 2242
-#define ERRnetlogonNotStarted 2455
-#define ERRnosupport       0xFFFF
+/* Following error codes may be generated with the ERRSRV error class.*/
+
+#define ERRerror                1       /* Non-specific error code. It is
+                                           returned under the following
+                                           conditions: resource other than disk
+                                           space exhausted (e.g. TIDs), first
+                                           SMB command was not negotiate,
+                                           multiple negotiates attempted, and
+                                           internal server error. */
+#define ERRbadpw                2       /* Bad password - name/password pair in
+                                           a TreeConnect or Session Setup are
+                                           invalid. */
+#define ERRbadtype              3       /* used for indicating DFS referral
+                                           needed */
+#define ERRaccess               4       /* The client does not have the
+                                           necessary access rights within the
+                                           specified context for requested
+                                           function. */
+#define ERRinvtid               5       /* The Tid specified in a command was
+                                           invalid. */
+#define ERRinvnetname           6       /* Invalid network name in tree
+                                           connect. */
+#define ERRinvdevice            7       /* Invalid device - printer request
+                                           made to non-printer connection or
+                                           non-printer request made to printer
+                                           connection. */
+#define ERRqfull                49      /* Print queue full (files) -- returned
+                                           by open print file. */
+#define ERRqtoobig              50      /* Print queue full -- no space. */
+#define ERRqeof                 51      /* EOF on print queue dump */
+#define ERRinvpfid              52      /* Invalid print file FID. */
+#define ERRsmbcmd               64      /* The server did not recognize the
+                                           command received. */
+#define ERRsrverror             65      /* The server encountered an internal
+                                           error, e.g., system file
+                                           unavailable. */
+#define ERRbadBID               66      /* (obsolete) */
+#define ERRfilespecs            67      /* The Fid and pathname parameters
+                                           contained an invalid combination of
+                                           values. */
+#define ERRbadLink              68      /* (obsolete) */
+#define ERRbadpermits           69      /* The access permissions specified for
+                                           a file or directory are not a valid
+                                           combination. */
+#define ERRbadPID               70
+#define ERRsetattrmode          71      /* attribute (mode) is invalid */
+#define ERRpaused               81      /* Server is paused */
+#define ERRmsgoff               82      /* reserved - messaging off */
+#define ERRnoroom               83      /* reserved - no room for message */
+#define ERRrmuns                87      /* reserved - too many remote names */
+#define ERRtimeout              88      /* operation timed out */
+#define ERRnoresource           89      /* No resources available for request
+                                           */
+#define ERRtoomanyuids          90      /* Too many UIDs active on this session
+                                           */
+#define ERRbaduid               91      /* The UID is not known as a valid user
+                                           */
+#define ERRusempx               250     /* temporarily unable to use raw */
+#define ERRusestd               251     /* temporarily unable to use either raw
+                                           or mpx */
+#define ERR_NOTIFY_ENUM_DIR     1024
+#define ERRaccountexpired       2239
+#define ERRbadclient            2240
+#define ERRbadLogonTime         2241
+#define ERRpasswordExpired      2242
+#define ERRnetlogonNotStarted   2455
+#define ERRnosupport            0xFFFF
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index af13e526b150..0046c219833d 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/transport.c
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2004
+ *   Copyright (C) International Business Machines  Corp., 2002,2005
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -41,7 +41,7 @@ AllocMidQEntry(struct smb_hdr *smb_buffer, struct cifsSesInfo *ses)
         struct mid_q_entry *temp;
 
         if (ses == NULL) {
-                cERROR(1, ("Null session passed in to AllocMidQEntry "));
+                cERROR(1, ("Null session passed in to AllocMidQEntry"));
                 return NULL;
         }
         if (ses->server == NULL) {
@@ -79,7 +79,10 @@ DeleteMidQEntry(struct mid_q_entry *midEntry)
         list_del(&midEntry->qhead);
         atomic_dec(&midCount);
         spin_unlock(&GlobalMid_Lock);
-        cifs_buf_release(midEntry->resp_buf);
+        if(midEntry->largeBuf)
+                cifs_buf_release(midEntry->resp_buf);
+        else
+                cifs_small_buf_release(midEntry->resp_buf);
         mempool_free(midEntry, cifs_mid_poolp);
 }
 
@@ -182,14 +185,14 @@ smb_send(struct socket *ssocket, struct smb_hdr *smb_buffer,
 
 int
 smb_sendv(struct socket *ssocket, struct smb_hdr *smb_buffer,
-         unsigned int smb_buf_length, struct kvec * write_vector /* page list */, struct sockaddr *sin)
+         unsigned int smb_buf_length, struct kvec * write_vector 
+          /* page list */, struct sockaddr *sin)
 {
         int rc = 0;
         int i = 0;
         struct msghdr smb_msg;
         number_of_pages += 1; /* account for SMB header */
         struct kvec * piov  = kmalloc(number_of_pages * sizeof(struct kvec));
-        if(i=0;i<num_pages-1;i++
         unsigned len = smb_buf_length + 4;
 
         if(ssocket == NULL)
@@ -213,7 +216,8 @@ smb_sendv(struct socket *ssocket, struct smb_hdr *smb_buffer,
         dump_smb(smb_buffer, len);
 
         while (len > 0) {
-                rc = kernel_sendmsg(ssocket, &smb_msg, &iov, number_of_pages, len?);
+                rc = kernel_sendmsg(ssocket, &smb_msg, &iov, number_of_pages, 
+                                    len);
                 if ((rc == -ENOSPC) || (rc == -EAGAIN)) {
                         i++;
                         if(i > 60) {
@@ -266,6 +270,9 @@ CIFSSendRcv(const unsigned int xid, struct cifsSesInfo *ses,
 
   
 
+        if(ses->server->tcpStatus == CIFS_EXITING)
+                return -ENOENT;
+
         /* Ensure that we do not send more than 50 overlapping requests 
            to the same server. We may make this configurable later or
            use ses->maxReq */
@@ -346,11 +353,12 @@ CIFSSendRcv(const unsigned int xid, struct cifsSesInfo *ses,
         }
 
         /* BB can we sign efficiently in this path? */
-        rc = cifs_sign_smb(in_buf, ses, &midQ->sequence_number);
+        rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 
         midQ->midState = MID_REQUEST_SUBMITTED;
-/*      rc = smb_sendv(ses->server->ssocket, in_buf, in_buf->smb_buf_length, piovec,
-                      (struct sockaddr *) &(ses->server->addr.sockAddr));*/
+/*      rc = smb_sendv(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
+                       piovec, 
+                       (struct sockaddr *) &(ses->server->addr.sockAddr));*/
         if(rc < 0) {
                 DeleteMidQEntry(midQ);
                 up(&ses->server->tcpSem);
@@ -396,6 +404,9 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 return -EIO;
         }
 
+        if(ses->server->tcpStatus == CifsExiting)
+                return -ENOENT;
+
         /* Ensure that we do not send more than 50 overlapping requests 
            to the same server. We may make this configurable later or
            use ses->maxReq */
@@ -405,7 +416,8 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
         } else {
                 spin_lock(&GlobalMid_Lock); 
                 while(1) {        
-                        if(atomic_read(&ses->server->inFlight) >= cifs_max_pending){
+                        if(atomic_read(&ses->server->inFlight) >= 
+                                        cifs_max_pending){
                                 spin_unlock(&GlobalMid_Lock);
                                 wait_event(ses->server->request_q,
                                         atomic_read(&ses->server->inFlight)
@@ -475,7 +487,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 return -EIO;
         }
 
-        rc = cifs_sign_smb(in_buf, ses, &midQ->sequence_number);
+        rc = cifs_sign_smb(in_buf, ses->server, &midQ->sequence_number);
 
         midQ->midState = MID_REQUEST_SUBMITTED;
         rc = smb_send(ses->server->ssocket, in_buf, in_buf->smb_buf_length,
@@ -493,7 +505,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                 up(&ses->server->tcpSem);
         if (long_op == -1)
                 goto cifs_no_response_exit;
-        else if (long_op == 2) /* writes past end of file can take looooong time */
+        else if (long_op == 2) /* writes past end of file can take loong time */
                 timeout = 300 * HZ;
         else if (long_op == 1)
                 timeout = 45 * HZ; /* should be greater than 
@@ -559,8 +571,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
         }
   
         if (receive_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) {
-                cERROR(1,
-                       ("Frame too large received.  Length: %d  Xid: %d",
+                cERROR(1, ("Frame too large received.  Length: %d  Xid: %d",
                         receive_len, xid));
                 rc = -EIO;
         } else {                /* rcvd frame is ok */
@@ -575,15 +586,20 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                         dump_smb(out_buf, 92);
                         /* convert the length into a more usable form */
                         if((receive_len > 24) &&
-                           (ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))) {
-                                rc = cifs_verify_signature(out_buf, ses->mac_signing_key,midQ->sequence_number); /* BB fix BB */
-                                if(rc)
-                                        cFYI(1,("Unexpected signature received from server"));
+                           (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
+                                        SECMODE_SIGN_ENABLED))) {
+                                rc = cifs_verify_signature(out_buf,
+                                                ses->server->mac_signing_key,
+                                                midQ->sequence_number+1);
+                                if(rc) {
+                                        cERROR(1,("Unexpected SMB signature"));
+                                        /* BB FIXME add code to kill session */
+                                }
                         }
 
                         *pbytes_returned = out_buf->smb_buf_length;
 
-                        /* BB special case reconnect tid and reconnect uid here? */
+                        /* BB special case reconnect tid and uid here? */
                         rc = map_smb_to_linux_error(out_buf);
 
                         /* convert ByteCount if necessary */
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 549afa184fd6..c1e02eff1d25 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -83,7 +83,8 @@ int cifs_removexattr(struct dentry * direntry, const char * ea_name)
 
                 ea_name+=5; /* skip past user. prefix */
                 rc = CIFSSMBSetEA(xid,pTcon,full_path,ea_name,NULL,
-                        (__u16)0, cifs_sb->local_nls);
+                        (__u16)0, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         }
 remove_ea_exit:
         if (full_path)
@@ -147,32 +148,40 @@ int cifs_setxattr(struct dentry * direntry, const char * ea_name,
                 }
                 ea_name += 5; /* skip past user. prefix */
                 rc = CIFSSMBSetEA(xid,pTcon,full_path,ea_name,ea_value,
-                        (__u16)value_size, cifs_sb->local_nls);
+                        (__u16)value_size, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if(strncmp(ea_name, CIFS_XATTR_OS2_PREFIX,4) == 0) {
                 if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto set_ea_exit;
 
                 ea_name += 4; /* skip past os2. prefix */
                 rc = CIFSSMBSetEA(xid,pTcon,full_path,ea_name,ea_value,
-                        (__u16)value_size, cifs_sb->local_nls);
+                        (__u16)value_size, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else {
                 int temp; 
                 temp = strncmp(ea_name,POSIX_ACL_XATTR_ACCESS,
                         strlen(POSIX_ACL_XATTR_ACCESS));
                 if (temp == 0) {
 #ifdef CONFIG_CIFS_POSIX
-                        rc = CIFSSMBSetPosixACL(xid, pTcon,full_path,ea_value,
-                                (const int)value_size, ACL_TYPE_ACCESS,
-                                cifs_sb->local_nls);
+                        if(sb->s_flags & MS_POSIXACL)
+                                rc = CIFSSMBSetPosixACL(xid, pTcon,full_path,
+                                        ea_value, (const int)value_size, 
+                                        ACL_TYPE_ACCESS,cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         cFYI(1,("set POSIX ACL rc %d",rc));
 #else
                         cFYI(1,("set POSIX ACL not supported"));
 #endif
                 } else if(strncmp(ea_name,POSIX_ACL_XATTR_DEFAULT,strlen(POSIX_ACL_XATTR_DEFAULT)) == 0) {
 #ifdef CONFIG_CIFS_POSIX
-                        rc = CIFSSMBSetPosixACL(xid, pTcon,full_path,ea_value,
-                                (const int)value_size, ACL_TYPE_DEFAULT,
-                                cifs_sb->local_nls);
+                        if(sb->s_flags & MS_POSIXACL)
+                                rc = CIFSSMBSetPosixACL(xid, pTcon,full_path,
+                                        ea_value, (const int)value_size, 
+                                        ACL_TYPE_DEFAULT, cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags & 
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
                         cFYI(1,("set POSIX default ACL rc %d",rc));
 #else
                         cFYI(1,("set default POSIX ACL not supported"));
@@ -238,27 +247,35 @@ ssize_t cifs_getxattr(struct dentry * direntry, const char * ea_name,
                 } /* BB add else when above is implemented */
                 ea_name += 5; /* skip past user. prefix */
                 rc = CIFSSMBQueryEA(xid,pTcon,full_path,ea_name,ea_value,
-                        buf_size, cifs_sb->local_nls);
+                        buf_size, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if(strncmp(ea_name, CIFS_XATTR_OS2_PREFIX,4) == 0) {
                 if(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
                         goto get_ea_exit;
 
                 ea_name += 4; /* skip past os2. prefix */
                 rc = CIFSSMBQueryEA(xid,pTcon,full_path,ea_name,ea_value,
-                        buf_size, cifs_sb->local_nls);
+                        buf_size, cifs_sb->local_nls,
+                        cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MAP_SPECIAL_CHR);
         } else if(strncmp(ea_name,POSIX_ACL_XATTR_ACCESS,strlen(POSIX_ACL_XATTR_ACCESS)) == 0) {
 #ifdef CONFIG_CIFS_POSIX
-                rc = CIFSSMBGetPosixACL(xid, pTcon, full_path,
+                if(sb->s_flags & MS_POSIXACL)
+                        rc = CIFSSMBGetPosixACL(xid, pTcon, full_path,
                                 ea_value, buf_size, ACL_TYPE_ACCESS, 
-                                cifs_sb->local_nls);
+                                cifs_sb->local_nls,
+                                cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
 #else 
                 cFYI(1,("query POSIX ACL not supported yet"));
 #endif /* CONFIG_CIFS_POSIX */
         } else if(strncmp(ea_name,POSIX_ACL_XATTR_DEFAULT,strlen(POSIX_ACL_XATTR_DEFAULT)) == 0) {
 #ifdef CONFIG_CIFS_POSIX
-                rc = CIFSSMBGetPosixACL(xid, pTcon, full_path,
+                if(sb->s_flags & MS_POSIXACL)
+                        rc = CIFSSMBGetPosixACL(xid, pTcon, full_path,
                                 ea_value, buf_size, ACL_TYPE_DEFAULT, 
-                                cifs_sb->local_nls);
+                                cifs_sb->local_nls,
+                                cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
 #else 
                 cFYI(1,("query POSIX default ACL not supported yet"));
 #endif
@@ -324,7 +341,9 @@ ssize_t cifs_listxattr(struct dentry * direntry, char * data, size_t buf_size)
                 search server for EAs or streams to 
                 returns as xattrs */
         rc = CIFSSMBQAllEAs(xid,pTcon,full_path,data,buf_size,
-                                cifs_sb->local_nls);
+                                cifs_sb->local_nls,
+                                cifs_sb->mnt_cifs_flags & 
+                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
 
         if (full_path)
                 kfree(full_path);
diff --git a/fs/compat.c b/fs/compat.c
index 67c0b94d1148..728cd8365384 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -809,7 +809,7 @@ static void *do_smb_super_data_conv(void *raw_data)
 
 struct compat_nfs_string {
         compat_uint_t len;
-        compat_uptr_t __user data;
+        compat_uptr_t data;
 };
 
 static inline void compat_nfs_string(struct nfs_string *dst,
@@ -834,10 +834,10 @@ struct compat_nfs4_mount_data_v1 {
         struct compat_nfs_string mnt_path;
         struct compat_nfs_string hostname;
         compat_uint_t host_addrlen;
-        compat_uptr_t __user host_addr;
+        compat_uptr_t host_addr;
         compat_int_t proto;
         compat_int_t auth_flavourlen;
-        compat_uptr_t __user auth_flavours;
+        compat_uptr_t auth_flavours;
 };
 
 static int do_nfs4_super_data_conv(void *raw_data)
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 040eb288bb1c..ea5888688f94 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -455,12 +455,11 @@ static unsigned long ext3_find_near(struct inode *inode, Indirect *ind)
  *      @goal:  place to store the result.
  *
  *      Normally this function find the prefered place for block allocation,
- *      stores it in *@goal and returns zero. If the branch had been changed
- *      under us we return -EAGAIN.
+ *      stores it in *@goal and returns zero.
  */
 
-static int ext3_find_goal(struct inode *inode, long block, Indirect chain[4],
-                          Indirect *partial, unsigned long *goal)
+static unsigned long ext3_find_goal(struct inode *inode, long block,
+                Indirect chain[4], Indirect *partial)
 {
         struct ext3_block_alloc_info *block_i =  EXT3_I(inode)->i_block_alloc_info;
 
@@ -470,15 +469,10 @@ static int ext3_find_goal(struct inode *inode, long block, Indirect chain[4],
          */
         if (block_i && (block == block_i->last_alloc_logical_block + 1)
                 && (block_i->last_alloc_physical_block != 0)) {
-                *goal = block_i->last_alloc_physical_block + 1;
-                return 0;
+                return block_i->last_alloc_physical_block + 1;
         }
 
-        if (verify_chain(chain, partial)) {
-                *goal = ext3_find_near(inode, partial);
-                return 0;
-        }
-        return -EAGAIN;
+        return ext3_find_near(inode, partial);
 }
 
 /**
@@ -582,12 +576,9 @@ static int ext3_alloc_branch(handle_t *handle, struct inode *inode,
  *      @where: location of missing link
  *      @num:   number of blocks we are adding
  *
- *      This function verifies that chain (up to the missing link) had not
- *      changed, fills the missing link and does all housekeeping needed in
+ *      This function fills the missing link and does all housekeeping needed in
  *      inode (->i_blocks, etc.). In case of success we end up with the full
- *      chain to new block and return 0. Otherwise (== chain had been changed)
- *      we free the new blocks (forgetting their buffer_heads, indeed) and
- *      return -EAGAIN.
+ *      chain to new block and return 0.
  */
 
 static int ext3_splice_branch(handle_t *handle, struct inode *inode, long block,
@@ -608,12 +599,6 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode, long block,
                 if (err)
                         goto err_out;
         }
-        /* Verify that place we are splicing to is still there and vacant */
-
-        if (!verify_chain(chain, where-1) || *where->p)
-                /* Writer: end */
-                goto changed;
-
         /* That's it */
 
         *where->p = where->key;
@@ -657,26 +642,11 @@ static int ext3_splice_branch(handle_t *handle, struct inode *inode, long block,
         }
         return err;
 
-changed:
-        /*
-         * AKPM: if where[i].bh isn't part of the current updating
-         * transaction then we explode nastily.  Test this code path.
-         */
-        jbd_debug(1, "the chain changed: try again\n");
-        err = -EAGAIN;
-
 err_out:
         for (i = 1; i < num; i++) {
                 BUFFER_TRACE(where[i].bh, "call journal_forget");
                 ext3_journal_forget(handle, where[i].bh);
         }
-        /* For the normal collision cleanup case, we free up the blocks.
-         * On genuine filesystem errors we don't even think about doing
-         * that. */
-        if (err == -EAGAIN)
-                for (i = 0; i < num; i++)
-                        ext3_free_blocks(handle, inode, 
-                                         le32_to_cpu(where[i].key), 1);
         return err;
 }
 
@@ -708,7 +678,7 @@ ext3_get_block_handle(handle_t *handle, struct inode *inode, sector_t iblock,
         unsigned long goal;
         int left;
         int boundary = 0;
-        int depth = ext3_block_to_path(inode, iblock, offsets, &boundary);
+        const int depth = ext3_block_to_path(inode, iblock, offsets, &boundary);
         struct ext3_inode_info *ei = EXT3_I(inode);
 
         J_ASSERT(handle != NULL || create == 0);
@@ -716,54 +686,55 @@ ext3_get_block_handle(handle_t *handle, struct inode *inode, sector_t iblock,
         if (depth == 0)
                 goto out;
 
-reread:
         partial = ext3_get_branch(inode, depth, offsets, chain, &err);
 
         /* Simplest case - block found, no allocation needed */
         if (!partial) {
                 clear_buffer_new(bh_result);
-got_it:
-                map_bh(bh_result, inode->i_sb, le32_to_cpu(chain[depth-1].key));
-                if (boundary)
-                        set_buffer_boundary(bh_result);
-                /* Clean up and exit */
-                partial = chain+depth-1; /* the whole chain */
-                goto cleanup;
+                goto got_it;
         }
 
         /* Next simple case - plain lookup or failed read of indirect block */
-        if (!create || err == -EIO) {
-cleanup:
+        if (!create || err == -EIO)
+                goto cleanup;
+
+        down(&ei->truncate_sem);
+
+        /*
+         * If the indirect block is missing while we are reading
+         * the chain(ext3_get_branch() returns -EAGAIN err), or
+         * if the chain has been changed after we grab the semaphore,
+         * (either because another process truncated this branch, or
+         * another get_block allocated this branch) re-grab the chain to see if
+         * the request block has been allocated or not.
+         *
+         * Since we already block the truncate/other get_block
+         * at this point, we will have the current copy of the chain when we
+         * splice the branch into the tree.
+         */
+        if (err == -EAGAIN || !verify_chain(chain, partial)) {
                 while (partial > chain) {
-                        BUFFER_TRACE(partial->bh, "call brelse");
                         brelse(partial->bh);
                         partial--;
                 }
-                BUFFER_TRACE(bh_result, "returned");
-out:
-                return err;
+                partial = ext3_get_branch(inode, depth, offsets, chain, &err);
+                if (!partial) {
+                        up(&ei->truncate_sem);
+                        if (err)
+                                goto cleanup;
+                        clear_buffer_new(bh_result);
+                        goto got_it;
+                }
         }
 
         /*
-         * Indirect block might be removed by truncate while we were
-         * reading it. Handling of that case (forget what we've got and
-         * reread) is taken out of the main path.
-         */
-        if (err == -EAGAIN)
-                goto changed;
-
-        goal = 0;
-        down(&ei->truncate_sem);
-
-        /* lazy initialize the block allocation info here if necessary */
-        if (S_ISREG(inode->i_mode) && (!ei->i_block_alloc_info)) {
+         * Okay, we need to do block allocation.  Lazily initialize the block
+         * allocation info here if necessary
+        */
+        if (S_ISREG(inode->i_mode) && (!ei->i_block_alloc_info))
                 ext3_init_block_alloc_info(inode);
-        }
 
-        if (ext3_find_goal(inode, iblock, chain, partial, &goal) < 0) {
-                up(&ei->truncate_sem);
-                goto changed;
-        }
+        goal = ext3_find_goal(inode, iblock, chain, partial);
 
         left = (chain + depth) - partial;
 
@@ -771,38 +742,45 @@ out:
          * Block out ext3_truncate while we alter the tree
          */
         err = ext3_alloc_branch(handle, inode, left, goal,
-                                        offsets+(partial-chain), partial);
+                                offsets + (partial - chain), partial);
 
-        /* The ext3_splice_branch call will free and forget any buffers
+        /*
+         * The ext3_splice_branch call will free and forget any buffers
          * on the new chain if there is a failure, but that risks using
          * up transaction credits, especially for bitmaps where the
          * credits cannot be returned.  Can we handle this somehow?  We
-         * may need to return -EAGAIN upwards in the worst case.  --sct */
+         * may need to return -EAGAIN upwards in the worst case.  --sct
+         */
         if (!err)
                 err = ext3_splice_branch(handle, inode, iblock, chain,
                                          partial, left);
-        /* i_disksize growing is protected by truncate_sem
-         * don't forget to protect it if you're about to implement
-         * concurrent ext3_get_block() -bzzz */
+        /*
+         * i_disksize growing is protected by truncate_sem.  Don't forget to
+         * protect it if you're about to implement concurrent
+         * ext3_get_block() -bzzz
+        */
         if (!err && extend_disksize && inode->i_size > ei->i_disksize)
                 ei->i_disksize = inode->i_size;
         up(&ei->truncate_sem);
-        if (err == -EAGAIN)
-                goto changed;
         if (err)
                 goto cleanup;
 
         set_buffer_new(bh_result);
-        goto got_it;
-
-changed:
+got_it:
+        map_bh(bh_result, inode->i_sb, le32_to_cpu(chain[depth-1].key));
+        if (boundary)
+                set_buffer_boundary(bh_result);
+        /* Clean up and exit */
+        partial = chain + depth - 1;    /* the whole chain */
+cleanup:
         while (partial > chain) {
-                jbd_debug(1, "buffer chain changed, retrying\n");
-                BUFFER_TRACE(partial->bh, "brelsing");
+                BUFFER_TRACE(partial->bh, "call brelse");
                 brelse(partial->bh);
                 partial--;
         }
-        goto reread;
+        BUFFER_TRACE(bh_result, "returned");
+out:
+        return err;
 }
 
 static int ext3_get_block(struct inode *inode, sector_t iblock,
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 3e7ab16ed154..286a9f8f3d49 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/security.h>
 #include <linux/ptrace.h>
+#include <linux/signal.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -308,7 +309,7 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                 break;
         case F_SETSIG:
                 /* arg == 0 restores default behaviour. */
-                if (arg < 0 || arg > _NSIG) {
+                if (!valid_signal(arg)) {
                         break;
                 }
                 err = 0;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index d6efb36cab2a..8e050fa58218 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -512,7 +512,8 @@ restart:
 }
 
 /**
- * sync_inodes
+ * sync_inodes - writes all inodes to disk
+ * @wait: wait for completion
  *
  * sync_inodes() goes through each super block's dirty inode list, writes the
  * inodes out, waits on the writeout and puts the inodes back on the normal
@@ -604,6 +605,7 @@ EXPORT_SYMBOL(sync_inode);
 /**
  * generic_osync_inode - flush all dirty data for a given inode to disk
  * @inode: inode to write
+ * @mapping: the address_space that should be flushed
  * @what:  what to write and wait upon
  *
  * This can be called by file_write functions for files which have the
diff --git a/fs/hfs/mdb.c b/fs/hfs/mdb.c
index 4efb640c4d0c..217e32f37e0b 100644
--- a/fs/hfs/mdb.c
+++ b/fs/hfs/mdb.c
@@ -333,6 +333,8 @@ void hfs_mdb_close(struct super_block *sb)
  * Release the resources associated with the in-core MDB.  */
 void hfs_mdb_put(struct super_block *sb)
 {
+        if (!HFS_SB(sb))
+                return;
         /* free the B-trees */
         hfs_btree_close(HFS_SB(sb)->ext_tree);
         hfs_btree_close(HFS_SB(sb)->cat_tree);
@@ -340,4 +342,7 @@ void hfs_mdb_put(struct super_block *sb)
         /* free the buffers holding the primary and alternate MDBs */
         brelse(HFS_SB(sb)->mdb_bh);
         brelse(HFS_SB(sb)->alt_mdb_bh);
+
+        kfree(HFS_SB(sb));
+        sb->s_fs_info = NULL;
 }
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index 1e2c193134cc..ab783f6afa3b 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -297,7 +297,7 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
         res = -EINVAL;
         if (!parse_options((char *)data, sbi)) {
                 hfs_warn("hfs_fs: unable to parse mount options.\n");
-                goto bail3;
+                goto bail;
         }
 
         sb->s_op = &hfs_super_operations;
@@ -310,7 +310,7 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
                         hfs_warn("VFS: Can't find a HFS filesystem on dev %s.\n",
                                 hfs_mdb_name(sb));
                 res = -EINVAL;
-                goto bail2;
+                goto bail;
         }
 
         /* try to get the root inode */
@@ -340,10 +340,8 @@ bail_iput:
         iput(root_inode);
 bail_no_root:
         hfs_warn("hfs_fs: get root inode failed.\n");
+bail:
         hfs_mdb_put(sb);
-bail2:
-bail3:
-        kfree(sbi);
         return res;
 }
 
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 5f8044664a3c..d55ad67b8e42 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -208,7 +208,9 @@ static void hfsplus_write_super(struct super_block *sb)
 static void hfsplus_put_super(struct super_block *sb)
 {
         dprint(DBG_SUPER, "hfsplus_put_super\n");
-        if (!(sb->s_flags & MS_RDONLY)) {
+        if (!sb->s_fs_info)
+                return;
+        if (!(sb->s_flags & MS_RDONLY) && HFSPLUS_SB(sb).s_vhdr) {
                 struct hfsplus_vh *vhdr = HFSPLUS_SB(sb).s_vhdr;
 
                 vhdr->modify_date = hfsp_now2mt();
@@ -226,6 +228,8 @@ static void hfsplus_put_super(struct super_block *sb)
         brelse(HFSPLUS_SB(sb).s_vhbh);
         if (HFSPLUS_SB(sb).nls)
                 unload_nls(HFSPLUS_SB(sb).nls);
+        kfree(sb->s_fs_info);
+        sb->s_fs_info = NULL;
 }
 
 static int hfsplus_statfs(struct super_block *sb, struct kstatfs *buf)
diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index a88ad2924851..e6c63d9cac7b 100644
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -521,7 +521,7 @@ int hostfs_commit_write(struct file *file, struct page *page, unsigned from,
 static struct address_space_operations hostfs_aops = {
         .writepage      = hostfs_writepage,
         .readpage       = hostfs_readpage,
-/*      .set_page_dirty = __set_page_dirty_nobuffers, */
+        .set_page_dirty = __set_page_dirty_nobuffers,
         .prepare_write  = hostfs_prepare_write,
         .commit_write   = hostfs_commit_write
 };
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 0c607c1388f4..771a554701d6 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -79,8 +79,7 @@ static int jffs2_do_readpage_nolock (struct inode *inode, struct page *pg)
 
         D2(printk(KERN_DEBUG "jffs2_do_readpage_nolock(): ino #%lu, page at offset 0x%lx\n", inode->i_ino, pg->index << PAGE_CACHE_SHIFT));
 
-        if (!PageLocked(pg))
-                PAGE_BUG(pg);
+        BUG_ON(!PageLocked(pg));
 
         pg_buf = kmap(pg);
         /* FIXME: Can kmap fail? */
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 7bc906677b0d..24a689179af2 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -175,31 +175,22 @@ jfs_get_blocks(struct inode *ip, sector_t lblock, unsigned long max_blocks,
 {
         s64 lblock64 = lblock;
         int rc = 0;
-        int take_locks;
         xad_t xad;
         s64 xaddr;
         int xflag;
-        s32 xlen;
-
-        /*
-         * If this is a special inode (imap, dmap)
-         * the lock should already be taken
-         */
-        take_locks = (JFS_IP(ip)->fileset != AGGREGATE_I);
+        s32 xlen = max_blocks;
 
         /*
          * Take appropriate lock on inode
          */
-        if (take_locks) {
-                if (create)
-                        IWRITE_LOCK(ip);
-                else
-                        IREAD_LOCK(ip);
-        }
+        if (create)
+                IWRITE_LOCK(ip);
+        else
+                IREAD_LOCK(ip);
 
         if (((lblock64 << ip->i_sb->s_blocksize_bits) < ip->i_size) &&
-            (xtLookup(ip, lblock64, max_blocks, &xflag, &xaddr, &xlen, 0)
-             == 0) && xlen) {
+            (!xtLookup(ip, lblock64, max_blocks, &xflag, &xaddr, &xlen, 0)) &&
+            xaddr) {
                 if (xflag & XAD_NOTRECORDED) {
                         if (!create)
                                 /*
@@ -238,7 +229,7 @@ jfs_get_blocks(struct inode *ip, sector_t lblock, unsigned long max_blocks,
 #ifdef _JFS_4K
         if ((rc = extHint(ip, lblock64 << ip->i_sb->s_blocksize_bits, &xad)))
                 goto unlock;
-        rc = extAlloc(ip, max_blocks, lblock64, &xad, FALSE);
+        rc = extAlloc(ip, xlen, lblock64, &xad, FALSE);
         if (rc)
                 goto unlock;
 
@@ -258,12 +249,10 @@ jfs_get_blocks(struct inode *ip, sector_t lblock, unsigned long max_blocks,
         /*
          * Release lock on inode
          */
-        if (take_locks) {
-                if (create)
-                        IWRITE_UNLOCK(ip);
-                else
-                        IREAD_UNLOCK(ip);
-        }
+        if (create)
+                IWRITE_UNLOCK(ip);
+        else
+                IREAD_UNLOCK(ip);
         return rc;
 }
 
diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index d86e467c6e42..69007fd546ef 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -471,6 +471,7 @@ dbUpdatePMap(struct inode *ipbmap,
         struct metapage *mp;
         struct jfs_log *log;
         int lsn, difft, diffp;
+        unsigned long flags;
 
         /* the blocks better be within the mapsize. */
         if (blkno + nblocks > bmp->db_mapsize) {
@@ -504,6 +505,7 @@ dbUpdatePMap(struct inode *ipbmap,
                                            0);
                         if (mp == NULL)
                                 return -EIO;
+                        metapage_wait_for_io(mp);
                 }
                 dp = (struct dmap *) mp->data;
 
@@ -578,34 +580,32 @@ dbUpdatePMap(struct inode *ipbmap,
                 if (mp->lsn != 0) {
                         /* inherit older/smaller lsn */
                         logdiff(diffp, mp->lsn, log);
+                        LOGSYNC_LOCK(log, flags);
                         if (difft < diffp) {
                                 mp->lsn = lsn;
 
                                 /* move bp after tblock in logsync list */
-                                LOGSYNC_LOCK(log);
                                 list_move(&mp->synclist, &tblk->synclist);
-                                LOGSYNC_UNLOCK(log);
                         }
 
                         /* inherit younger/larger clsn */
-                        LOGSYNC_LOCK(log);
                         logdiff(difft, tblk->clsn, log);
                         logdiff(diffp, mp->clsn, log);
                         if (difft > diffp)
                                 mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log);
+                        LOGSYNC_UNLOCK(log, flags);
                 } else {
                         mp->log = log;
                         mp->lsn = lsn;
 
                         /* insert bp after tblock in logsync list */
-                        LOGSYNC_LOCK(log);
+                        LOGSYNC_LOCK(log, flags);
 
                         log->count++;
                         list_add(&mp->synclist, &tblk->synclist);
 
                         mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log);
+                        LOGSYNC_UNLOCK(log, flags);
                 }
         }
 
diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
index e357890adfb2..ac41f72d6d50 100644
--- a/fs/jfs/jfs_dtree.c
+++ b/fs/jfs/jfs_dtree.c
@@ -212,7 +212,7 @@ static struct metapage *read_index_page(struct inode *inode, s64 blkno)
         s32 xlen;
 
         rc = xtLookup(inode, blkno, 1, &xflag, &xaddr, &xlen, 1);
-        if (rc || (xlen == 0))
+        if (rc || (xaddr == 0))
                 return NULL;
 
         return read_metapage(inode, xaddr, PSIZE, 1);
@@ -231,7 +231,7 @@ static struct metapage *get_index_page(struct inode *inode, s64 blkno)
         s32 xlen;
 
         rc = xtLookup(inode, blkno, 1, &xflag, &xaddr, &xlen, 1);
-        if (rc || (xlen == 0))
+        if (rc || (xaddr == 0))
                 return NULL;
 
         return get_metapage(inode, xaddr, PSIZE, 1);
@@ -3181,7 +3181,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         d = (struct ldtentry *) & p->slot[stbl[i]];
 
                         if (((long) jfs_dirent + d->namlen + 1) >
-                            (dirent_buf + PSIZE)) {
+                            (dirent_buf + PAGE_SIZE)) {
                                 /* DBCS codepages could overrun dirent_buf */
                                 index = i;
                                 overflow = 1;
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 783831301625..7acff2ce3c80 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -502,7 +502,7 @@ struct inode *diReadSpecial(struct super_block *sb, ino_t inum, int secondary)
 
         }
 
-        ip->i_mapping->a_ops = &jfs_aops;
+        ip->i_mapping->a_ops = &jfs_metapage_aops;
         mapping_set_gfp_mask(ip->i_mapping, GFP_NOFS);
 
         /* Allocations to metadata inodes should not affect quotas */
@@ -2573,9 +2573,18 @@ diNewIAG(struct inomap * imap, int *iagnop, int agno, struct metapage ** mpp)
                         goto out;
                 }
 
-                /* assign a buffer for the page */
-                mp = get_metapage(ipimap, xaddr, PSIZE, 1);
-                if (!mp) {
+                /*
+                 * start transaction of update of the inode map
+                 * addressing structure pointing to the new iag page;
+                 */
+                tid = txBegin(sb, COMMIT_FORCE);
+                down(&JFS_IP(ipimap)->commit_sem);
+
+                /* update the inode map addressing structure to point to it */
+                if ((rc =
+                     xtInsert(tid, ipimap, 0, blkno, xlen, &xaddr, 0))) {
+                        txEnd(tid);
+                        up(&JFS_IP(ipimap)->commit_sem);
                         /* Free the blocks allocated for the iag since it was
                          * not successfully added to the inode map
                          */
@@ -2584,6 +2593,29 @@ diNewIAG(struct inomap * imap, int *iagnop, int agno, struct metapage ** mpp)
                         /* release the inode map lock */
                         IWRITE_UNLOCK(ipimap);
 
+                        goto out;
+                }
+
+                /* update the inode map's inode to reflect the extension */
+                ipimap->i_size += PSIZE;
+                inode_add_bytes(ipimap, PSIZE);
+
+                /* assign a buffer for the page */
+                mp = get_metapage(ipimap, blkno, PSIZE, 0);
+                if (!mp) {
+                        /*
+                         * This is very unlikely since we just created the
+                         * extent, but let's try to handle it correctly
+                         */
+                        xtTruncate(tid, ipimap, ipimap->i_size - PSIZE,
+                                   COMMIT_PWMAP);
+
+                        txAbort(tid, 0);
+                        txEnd(tid);
+
+                        /* release the inode map lock */
+                        IWRITE_UNLOCK(ipimap);
+
                         rc = -EIO;
                         goto out;
                 }
@@ -2605,41 +2637,11 @@ diNewIAG(struct inomap * imap, int *iagnop, int agno, struct metapage ** mpp)
                         iagp->inosmap[i] = cpu_to_le32(ONES);
 
                 /*
-                 * Invalidate the page after writing and syncing it.
-                 * After it's initialized, we access it in a different
-                 * address space
+                 * Write and sync the metapage
                  */
-                set_bit(META_discard, &mp->flag);
                 flush_metapage(mp);
 
                 /*
-                 * start tyransaction of update of the inode map
-                 * addressing structure pointing to the new iag page;
-                 */
-                tid = txBegin(sb, COMMIT_FORCE);
-                down(&JFS_IP(ipimap)->commit_sem);
-
-                /* update the inode map addressing structure to point to it */
-                if ((rc =
-                     xtInsert(tid, ipimap, 0, blkno, xlen, &xaddr, 0))) {
-                        txEnd(tid);
-                        up(&JFS_IP(ipimap)->commit_sem);
-                        /* Free the blocks allocated for the iag since it was
-                         * not successfully added to the inode map
-                         */
-                        dbFree(ipimap, xaddr, (s64) xlen);
-
-                        /* release the inode map lock */
-                        IWRITE_UNLOCK(ipimap);
-
-                        goto out;
-                }
-
-                /* update the inode map's inode to reflect the extension */
-                ipimap->i_size += PSIZE;
-                inode_add_bytes(ipimap, PSIZE);
-
-                /*
                  * txCommit(COMMIT_FORCE) will synchronously write address 
                  * index pages and inode after commit in careful update order 
                  * of address index pages (right to left, bottom up);
@@ -2789,6 +2791,7 @@ diUpdatePMap(struct inode *ipimap,
         u32 mask;
         struct jfs_log *log;
         int lsn, difft, diffp;
+        unsigned long flags;
 
         imap = JFS_IP(ipimap)->i_imap;
         /* get the iag number containing the inode */
@@ -2805,6 +2808,7 @@ diUpdatePMap(struct inode *ipimap,
         IREAD_UNLOCK(ipimap);
         if (rc)
                 return (rc);
+        metapage_wait_for_io(mp);
         iagp = (struct iag *) mp->data;
         /* get the inode number and extent number of the inode within
          * the iag and the inode number within the extent.
@@ -2868,30 +2872,28 @@ diUpdatePMap(struct inode *ipimap,
                 /* inherit older/smaller lsn */
                 logdiff(difft, lsn, log);
                 logdiff(diffp, mp->lsn, log);
+                LOGSYNC_LOCK(log, flags);
                 if (difft < diffp) {
                         mp->lsn = lsn;
                         /* move mp after tblock in logsync list */
-                        LOGSYNC_LOCK(log);
                         list_move(&mp->synclist, &tblk->synclist);
-                        LOGSYNC_UNLOCK(log);
                 }
                 /* inherit younger/larger clsn */
-                LOGSYNC_LOCK(log);
                 assert(mp->clsn);
                 logdiff(difft, tblk->clsn, log);
                 logdiff(diffp, mp->clsn, log);
                 if (difft > diffp)
                         mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log);
+                LOGSYNC_UNLOCK(log, flags);
         } else {
                 mp->log = log;
                 mp->lsn = lsn;
                 /* insert mp after tblock in logsync list */
-                LOGSYNC_LOCK(log);
+                LOGSYNC_LOCK(log, flags);
                 log->count++;
                 list_add(&mp->synclist, &tblk->synclist);
                 mp->clsn = tblk->clsn;
-                LOGSYNC_UNLOCK(log);
+                LOGSYNC_UNLOCK(log, flags);
         }
         write_metapage(mp);
         return (0);
diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
index ebd77c1bed66..c0fd7b3eadc6 100644
--- a/fs/jfs/jfs_incore.h
+++ b/fs/jfs/jfs_incore.h
@@ -165,6 +165,7 @@ struct jfs_sb_info {
         /* Formerly in ipbmap */
         struct bmap     *bmap;          /* incore bmap descriptor       */
         struct nls_table *nls_tab;      /* current codepage             */
+        struct inode *direct_inode;     /* metadata inode */
         uint            state;          /* mount/recovery state */
         unsigned long   flag;           /* mount time flags */
         uint            p_state;        /* state prior to going no integrity */
diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index b6a6869ebb4f..dfa1200daa61 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -234,6 +234,7 @@ int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
         int lsn;
         int diffp, difft;
         struct metapage *mp = NULL;
+        unsigned long flags;
 
         jfs_info("lmLog: log:0x%p tblk:0x%p, lrd:0x%p tlck:0x%p",
                  log, tblk, lrd, tlck);
@@ -254,7 +255,7 @@ int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
          */
         lsn = log->lsn;
 
-        LOGSYNC_LOCK(log);
+        LOGSYNC_LOCK(log, flags);
 
         /*
          * initialize page lsn if first log write of the page
@@ -310,7 +311,7 @@ int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                 }
         }
 
-        LOGSYNC_UNLOCK(log);
+        LOGSYNC_UNLOCK(log, flags);
 
         /*
          *      write the log record
@@ -334,7 +335,6 @@ int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
         return lsn;
 }
 
-
 /*
  * NAME:        lmWriteRecord()
  *
@@ -927,9 +927,8 @@ static void lmPostGC(struct lbuf * bp)
  *      calculate new value of i_nextsync which determines when
  *      this code is called again.
  *
- *      this is called only from lmLog().
- *
- * PARAMETER:   ip      - pointer to logs inode.
+ * PARAMETERS:  log     - log structure
+ *              nosyncwait - 1 if called asynchronously
  *
  * RETURN:      0
  *                      
@@ -945,6 +944,15 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
         struct lrd lrd;
         int lsn;
         struct logsyncblk *lp;
+        struct jfs_sb_info *sbi;
+        unsigned long flags;
+
+        /* push dirty metapages out to disk */
+        list_for_each_entry(sbi, &log->sb_list, log_list) {
+                filemap_flush(sbi->ipbmap->i_mapping);
+                filemap_flush(sbi->ipimap->i_mapping);
+                filemap_flush(sbi->direct_inode->i_mapping);
+        }
 
         /*
          *      forward syncpt
@@ -954,10 +962,7 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
          */
 
         if (log->sync == log->syncpt) {
-                LOGSYNC_LOCK(log);
-                /* ToDo: push dirty metapages out to disk */
-//              bmLogSync(log);
-
+                LOGSYNC_LOCK(log, flags);
                 if (list_empty(&log->synclist))
                         log->sync = log->lsn;
                 else {
@@ -965,7 +970,7 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
                                         struct logsyncblk, synclist);
                         log->sync = lp->lsn;
                 }
-                LOGSYNC_UNLOCK(log);
+                LOGSYNC_UNLOCK(log, flags);
 
         }
 
@@ -974,27 +979,6 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
          * reset syncpt = sync
          */
         if (log->sync != log->syncpt) {
-                struct jfs_sb_info *sbi;
-
-                /*
-                 * We need to make sure all of the "written" metapages
-                 * actually make it to disk
-                 */
-                list_for_each_entry(sbi, &log->sb_list, log_list) {
-                        if (sbi->flag & JFS_NOINTEGRITY)
-                                continue;
-                        filemap_fdatawrite(sbi->ipbmap->i_mapping);
-                        filemap_fdatawrite(sbi->ipimap->i_mapping);
-                        filemap_fdatawrite(sbi->sb->s_bdev->bd_inode->i_mapping);
-                }
-                list_for_each_entry(sbi, &log->sb_list, log_list) {
-                        if (sbi->flag & JFS_NOINTEGRITY)
-                                continue;
-                        filemap_fdatawait(sbi->ipbmap->i_mapping);
-                        filemap_fdatawait(sbi->ipimap->i_mapping);
-                        filemap_fdatawait(sbi->sb->s_bdev->bd_inode->i_mapping);
-                }
-
                 lrd.logtid = 0;
                 lrd.backchain = 0;
                 lrd.type = cpu_to_le16(LOG_SYNCPT);
@@ -1066,6 +1050,18 @@ static int lmLogSync(struct jfs_log * log, int nosyncwait)
         return lsn;
 }
 
+/*
+ * NAME:        jfs_syncpt
+ *
+ * FUNCTION:    write log SYNCPT record for specified log
+ *
+ * PARAMETERS:  log     - log structure
+ */
+void jfs_syncpt(struct jfs_log *log)
+{       LOG_LOCK(log);
+        lmLogSync(log, 1);
+        LOG_UNLOCK(log);
+}
 
 /*
  * NAME:        lmLogOpen()
@@ -1547,6 +1543,7 @@ void jfs_flush_journal(struct jfs_log *log, int wait)
 {
         int i;
         struct tblock *target = NULL;
+        struct jfs_sb_info *sbi;
 
         /* jfs_write_inode may call us during read-only mount */
         if (!log)
@@ -1608,12 +1605,18 @@ void jfs_flush_journal(struct jfs_log *log, int wait)
         if (wait < 2)
                 return;
 
+        list_for_each_entry(sbi, &log->sb_list, log_list) {
+                filemap_fdatawrite(sbi->ipbmap->i_mapping);
+                filemap_fdatawrite(sbi->ipimap->i_mapping);
+                filemap_fdatawrite(sbi->direct_inode->i_mapping);
+        }
+
         /*
          * If there was recent activity, we may need to wait
          * for the lazycommit thread to catch up
          */
         if ((!list_empty(&log->cqueue)) || !list_empty(&log->synclist)) {
-                for (i = 0; i < 800; i++) {     /* Too much? */
+                for (i = 0; i < 200; i++) {     /* Too much? */
                         msleep(250);
                         if (list_empty(&log->cqueue) &&
                             list_empty(&log->synclist))
@@ -1621,7 +1624,24 @@ void jfs_flush_journal(struct jfs_log *log, int wait)
                 }
         }
         assert(list_empty(&log->cqueue));
-        assert(list_empty(&log->synclist));
+        if (!list_empty(&log->synclist)) {
+                struct logsyncblk *lp;
+
+                list_for_each_entry(lp, &log->synclist, synclist) {
+                        if (lp->xflag & COMMIT_PAGE) {
+                                struct metapage *mp = (struct metapage *)lp;
+                                dump_mem("orphan metapage", lp,
+                                         sizeof(struct metapage));
+                                dump_mem("page", mp->page, sizeof(struct page));
+                        }
+                        else
+                                dump_mem("orphan tblock", lp,
+                                         sizeof(struct tblock));
+                }
+//              current->state = TASK_INTERRUPTIBLE;
+//              schedule();
+        }
+        //assert(list_empty(&log->synclist));
         clear_bit(log_FLUSH, &log->flag);
 }
 
@@ -1669,6 +1689,7 @@ int lmLogShutdown(struct jfs_log * log)
         lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
         lbmWrite(log, log->bp, lbmWRITE | lbmRELEASE | lbmSYNC, 0);
         lbmIOWait(log->bp, lbmFREE);
+        log->bp = NULL;
 
         /*
          * synchronous update log superblock
@@ -1819,20 +1840,34 @@ static int lbmLogInit(struct jfs_log * log)
 
         log->lbuf_free = NULL;
 
-        for (i = 0; i < LOGPAGES; i++) {
-                lbuf = kmalloc(sizeof(struct lbuf), GFP_KERNEL);
-                if (lbuf == 0)
-                        goto error;
-                lbuf->l_ldata = (char *) get_zeroed_page(GFP_KERNEL);
-                if (lbuf->l_ldata == 0) {
-                        kfree(lbuf);
+        for (i = 0; i < LOGPAGES;) {
+                char *buffer;
+                uint offset;
+                struct page *page;
+
+                buffer = (char *) get_zeroed_page(GFP_KERNEL);
+                if (buffer == NULL)
                         goto error;
+                page = virt_to_page(buffer);
+                for (offset = 0; offset < PAGE_SIZE; offset += LOGPSIZE) {
+                        lbuf = kmalloc(sizeof(struct lbuf), GFP_KERNEL);
+                        if (lbuf == NULL) {
+                                if (offset == 0)
+                                        free_page((unsigned long) buffer);
+                                goto error;
+                        }
+                        if (offset) /* we already have one reference */
+                                get_page(page);
+                        lbuf->l_offset = offset;
+                        lbuf->l_ldata = buffer + offset;
+                        lbuf->l_page = page;
+                        lbuf->l_log = log;
+                        init_waitqueue_head(&lbuf->l_ioevent);
+
+                        lbuf->l_freelist = log->lbuf_free;
+                        log->lbuf_free = lbuf;
+                        i++;
                 }
-                lbuf->l_log = log;
-                init_waitqueue_head(&lbuf->l_ioevent);
-
-                lbuf->l_freelist = log->lbuf_free;
-                log->lbuf_free = lbuf;
         }
 
         return (0);
@@ -1857,12 +1892,10 @@ static void lbmLogShutdown(struct jfs_log * log)
         lbuf = log->lbuf_free;
         while (lbuf) {
                 struct lbuf *next = lbuf->l_freelist;
-                free_page((unsigned long) lbuf->l_ldata);
+                __free_page(lbuf->l_page);
                 kfree(lbuf);
                 lbuf = next;
         }
-
-        log->bp = NULL;
 }
 
 
@@ -1974,9 +2007,9 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 
         bio->bi_sector = bp->l_blkno << (log->l2bsize - 9);
         bio->bi_bdev = log->bdev;
-        bio->bi_io_vec[0].bv_page = virt_to_page(bp->l_ldata);
+        bio->bi_io_vec[0].bv_page = bp->l_page;
         bio->bi_io_vec[0].bv_len = LOGPSIZE;
-        bio->bi_io_vec[0].bv_offset = 0;
+        bio->bi_io_vec[0].bv_offset = bp->l_offset;
 
         bio->bi_vcnt = 1;
         bio->bi_idx = 0;
@@ -2115,9 +2148,9 @@ static void lbmStartIO(struct lbuf * bp)
         bio = bio_alloc(GFP_NOFS, 1);
         bio->bi_sector = bp->l_blkno << (log->l2bsize - 9);
         bio->bi_bdev = log->bdev;
-        bio->bi_io_vec[0].bv_page = virt_to_page(bp->l_ldata);
+        bio->bi_io_vec[0].bv_page = bp->l_page;
         bio->bi_io_vec[0].bv_len = LOGPSIZE;
-        bio->bi_io_vec[0].bv_offset = 0;
+        bio->bi_io_vec[0].bv_offset = bp->l_offset;
 
         bio->bi_vcnt = 1;
         bio->bi_idx = 0;
@@ -2127,16 +2160,13 @@ static void lbmStartIO(struct lbuf * bp)
         bio->bi_private = bp;
 
         /* check if journaling to disk has been disabled */
-        if (!log->no_integrity) {
+        if (log->no_integrity) {
+                bio->bi_size = 0;
+                lbmIODone(bio, 0, 0);
+        } else {
                 submit_bio(WRITE_SYNC, bio);
                 INCREMENT(lmStat.submitted);
         }
-        else {
-                bio->bi_size = 0;
-                lbmIODone(bio, 0, 0); /* 2nd argument appears to not be used => 0
-                                       *  3rd argument appears to not be used => 0
-                                       */
-        }
 }
 
 
diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h
index 141ad74010c9..51291fbc420c 100644
--- a/fs/jfs/jfs_logmgr.h
+++ b/fs/jfs/jfs_logmgr.h
@@ -463,9 +463,10 @@ struct lbuf {
 
         s64 l_blkno;            /* 8: log page block number */
         caddr_t l_ldata;        /* 4: data page */
+        struct page *l_page;    /* The page itself */
+        uint l_offset;          /* Offset of l_ldata within the page */ 
 
         wait_queue_head_t l_ioevent;    /* 4: i/o done event */
-        struct page *l_page;    /* The page itself */
 };
 
 /* Reuse l_freelist for redrive list */
@@ -489,8 +490,9 @@ struct logsyncblk {
  */
 
 #define LOGSYNC_LOCK_INIT(log) spin_lock_init(&(log)->synclock)
-#define LOGSYNC_LOCK(log) spin_lock(&(log)->synclock)
-#define LOGSYNC_UNLOCK(log) spin_unlock(&(log)->synclock)
+#define LOGSYNC_LOCK(log, flags) spin_lock_irqsave(&(log)->synclock, flags)
+#define LOGSYNC_UNLOCK(log, flags) \
+        spin_unlock_irqrestore(&(log)->synclock, flags)
 
 /* compute the difference in bytes of lsn from sync point */
 #define logdiff(diff, lsn, log)\
@@ -506,5 +508,6 @@ extern int lmLogShutdown(struct jfs_log * log);
 extern int lmLogInit(struct jfs_log * log);
 extern int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize);
 extern void jfs_flush_journal(struct jfs_log * log, int wait);
+extern void jfs_syncpt(struct jfs_log *log);
 
 #endif                          /* _H_JFS_LOGMGR */
diff --git a/fs/jfs/jfs_metapage.c b/fs/jfs/jfs_metapage.c
index 4c0a3ac75c08..41bf078dce05 100644
--- a/fs/jfs/jfs_metapage.c
+++ b/fs/jfs/jfs_metapage.c
@@ -1,5 +1,5 @@
 /*
- *   Copyright (C) International Business Machines Corp., 2000-2003
+ *   Copyright (C) International Business Machines Corp., 2000-2005
  *   Portions Copyright (C) Christoph Hellwig, 2001-2002
  *
  *   This program is free software;  you can redistribute it and/or modify
@@ -18,10 +18,11 @@
  */
 
 #include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/bio.h>
 #include <linux/init.h>
 #include <linux/buffer_head.h>
 #include <linux/mempool.h>
-#include <linux/delay.h>
 #include "jfs_incore.h"
 #include "jfs_superblock.h"
 #include "jfs_filsys.h"
@@ -29,8 +30,6 @@
 #include "jfs_txnmgr.h"
 #include "jfs_debug.h"
 
-static DEFINE_SPINLOCK(meta_lock);
-
 #ifdef CONFIG_JFS_STATISTICS
 static struct {
         uint    pagealloc;      /* # of page allocations */
@@ -39,22 +38,8 @@ static struct {
 } mpStat;
 #endif
 
-
-#define HASH_BITS 10            /* This makes hash_table 1 4K page */
-#define HASH_SIZE (1 << HASH_BITS)
-static struct metapage **hash_table = NULL;
-static unsigned long hash_order;
-
-
-static inline int metapage_locked(struct metapage *mp)
-{
-        return test_bit(META_locked, &mp->flag);
-}
-
-static inline int trylock_metapage(struct metapage *mp)
-{
-        return test_and_set_bit(META_locked, &mp->flag);
-}
+#define metapage_locked(mp) test_bit(META_locked, &(mp)->flag)
+#define trylock_metapage(mp) test_and_set_bit(META_locked, &(mp)->flag)
 
 static inline void unlock_metapage(struct metapage *mp)
 {
@@ -62,26 +47,26 @@ static inline void unlock_metapage(struct metapage *mp)
         wake_up(&mp->wait);
 }
 
-static void __lock_metapage(struct metapage *mp)
+static inline void __lock_metapage(struct metapage *mp)
 {
         DECLARE_WAITQUEUE(wait, current);
-
         INCREMENT(mpStat.lockwait);
-
         add_wait_queue_exclusive(&mp->wait, &wait);
         do {
                 set_current_state(TASK_UNINTERRUPTIBLE);
                 if (metapage_locked(mp)) {
-                        spin_unlock(&meta_lock);
+                        unlock_page(mp->page);
                         schedule();
-                        spin_lock(&meta_lock);
+                        lock_page(mp->page);
                 }
         } while (trylock_metapage(mp));
         __set_current_state(TASK_RUNNING);
         remove_wait_queue(&mp->wait, &wait);
 }
 
-/* needs meta_lock */
+/*
+ * Must have mp->page locked
+ */
 static inline void lock_metapage(struct metapage *mp)
 {
         if (trylock_metapage(mp))
@@ -92,6 +77,110 @@ static inline void lock_metapage(struct metapage *mp)
 static kmem_cache_t *metapage_cache;
 static mempool_t *metapage_mempool;
 
+#define MPS_PER_PAGE (PAGE_CACHE_SIZE >> L2PSIZE)
+
+#if MPS_PER_PAGE > 1
+
+struct meta_anchor {
+        int mp_count;
+        atomic_t io_count;
+        struct metapage *mp[MPS_PER_PAGE];
+};
+#define mp_anchor(page) ((struct meta_anchor *)page->private)
+
+static inline struct metapage *page_to_mp(struct page *page, uint offset)
+{
+        if (!PagePrivate(page))
+                return NULL;
+        return mp_anchor(page)->mp[offset >> L2PSIZE];
+}
+
+static inline int insert_metapage(struct page *page, struct metapage *mp)
+{
+        struct meta_anchor *a;
+        int index;
+        int l2mp_blocks;        /* log2 blocks per metapage */
+
+        if (PagePrivate(page))
+                a = mp_anchor(page);
+        else {
+                a = kmalloc(sizeof(struct meta_anchor), GFP_NOFS);
+                if (!a)
+                        return -ENOMEM;
+                memset(a, 0, sizeof(struct meta_anchor));
+                page->private = (unsigned long)a;
+                SetPagePrivate(page);
+                kmap(page);
+        }
+
+        if (mp) {
+                l2mp_blocks = L2PSIZE - page->mapping->host->i_blkbits;
+                index = (mp->index >> l2mp_blocks) & (MPS_PER_PAGE - 1);
+                a->mp_count++;
+                a->mp[index] = mp;
+        }
+
+        return 0;
+}
+
+static inline void remove_metapage(struct page *page, struct metapage *mp)
+{
+        struct meta_anchor *a = mp_anchor(page);
+        int l2mp_blocks = L2PSIZE - page->mapping->host->i_blkbits;
+        int index;
+
+        index = (mp->index >> l2mp_blocks) & (MPS_PER_PAGE - 1);
+
+        BUG_ON(a->mp[index] != mp);
+
+        a->mp[index] = NULL;
+        if (--a->mp_count == 0) {
+                kfree(a);
+                page->private = 0;
+                ClearPagePrivate(page);
+                kunmap(page);
+        }
+}
+
+static inline void inc_io(struct page *page)
+{
+        atomic_inc(&mp_anchor(page)->io_count);
+}
+
+static inline void dec_io(struct page *page, void (*handler) (struct page *))
+{
+        if (atomic_dec_and_test(&mp_anchor(page)->io_count))
+                handler(page);
+}
+
+#else
+static inline struct metapage *page_to_mp(struct page *page, uint offset)
+{
+        return PagePrivate(page) ? (struct metapage *)page->private : NULL;
+}
+
+static inline int insert_metapage(struct page *page, struct metapage *mp)
+{
+        if (mp) {
+                page->private = (unsigned long)mp;
+                SetPagePrivate(page);
+                kmap(page);
+        }
+        return 0;
+}
+
+static inline void remove_metapage(struct page *page, struct metapage *mp)
+{
+        page->private = 0;
+        ClearPagePrivate(page);
+        kunmap(page);
+}
+
+#define inc_io(page) do {} while(0)
+#define dec_io(page, handler) handler(page)
+
+#endif
+
 static void init_once(void *foo, kmem_cache_t *cachep, unsigned long flags)
 {
         struct metapage *mp = (struct metapage *)foo;
@@ -139,16 +228,6 @@ int __init metapage_init(void)
                 kmem_cache_destroy(metapage_cache);
                 return -ENOMEM;
         }
-        /*
-         * Now the hash list
-         */
-        for (hash_order = 0;
-             ((PAGE_SIZE << hash_order) / sizeof(void *)) < HASH_SIZE;
-             hash_order++);
-        hash_table =
-            (struct metapage **) __get_free_pages(GFP_KERNEL, hash_order);
-        assert(hash_table);
-        memset(hash_table, 0, PAGE_SIZE << hash_order);
 
         return 0;
 }
@@ -159,73 +238,388 @@ void metapage_exit(void)
         kmem_cache_destroy(metapage_cache);
 }
 
+static inline void drop_metapage(struct page *page, struct metapage *mp)
+{
+        if (mp->count || mp->nohomeok || test_bit(META_dirty, &mp->flag) ||
+            test_bit(META_io, &mp->flag))
+                return;
+        remove_metapage(page, mp);
+        INCREMENT(mpStat.pagefree);
+        free_metapage(mp);
+}
+
 /*
- * Basically same hash as in pagemap.h, but using our hash table
+ * Metapage address space operations
  */
-static struct metapage **meta_hash(struct address_space *mapping,
-                                   unsigned long index)
+
+static sector_t metapage_get_blocks(struct inode *inode, sector_t lblock,
+                                    unsigned int *len)
 {
-#define i (((unsigned long)mapping)/ \
-           (sizeof(struct inode) & ~(sizeof(struct inode) -1 )))
-#define s(x) ((x) + ((x) >> HASH_BITS))
-        return hash_table + (s(i + index) & (HASH_SIZE - 1));
-#undef i
-#undef s
+        int rc = 0;
+        int xflag;
+        s64 xaddr;
+        sector_t file_blocks = (inode->i_size + inode->i_blksize - 1) >>
+                               inode->i_blkbits;
+
+        if (lblock >= file_blocks)
+                return 0;
+        if (lblock + *len > file_blocks)
+                *len = file_blocks - lblock;
+
+        if (inode->i_ino) {
+                rc = xtLookup(inode, (s64)lblock, *len, &xflag, &xaddr, len, 0);
+                if ((rc == 0) && *len)
+                        lblock = (sector_t)xaddr;
+                else
+                        lblock = 0;
+        } /* else no mapping */
+
+        return lblock;
 }
 
-static struct metapage *search_hash(struct metapage ** hash_ptr,
-                                    struct address_space *mapping,
-                               unsigned long index)
+static void last_read_complete(struct page *page)
 {
-        struct metapage *ptr;
+        if (!PageError(page))
+                SetPageUptodate(page);
+        unlock_page(page);
+}
+
+static int metapage_read_end_io(struct bio *bio, unsigned int bytes_done,
+                                int err)
+{
+        struct page *page = bio->bi_private;
+
+        if (bio->bi_size)
+                return 1;
 
-        for (ptr = *hash_ptr; ptr; ptr = ptr->hash_next) {
-                if ((ptr->mapping == mapping) && (ptr->index == index))
-                        return ptr;
+        if (!test_bit(BIO_UPTODATE, &bio->bi_flags)) {
+                printk(KERN_ERR "metapage_read_end_io: I/O error\n");
+                SetPageError(page);
         }
 
-        return NULL;
+        dec_io(page, last_read_complete);
+        bio_put(bio);
+
+        return 0;
 }
 
-static void add_to_hash(struct metapage * mp, struct metapage ** hash_ptr)
+static void remove_from_logsync(struct metapage *mp)
 {
-        if (*hash_ptr)
-                (*hash_ptr)->hash_prev = mp;
+        struct jfs_log *log = mp->log;
+        unsigned long flags;
+/*
+ * This can race.  Recheck that log hasn't been set to null, and after
+ * acquiring logsync lock, recheck lsn
+ */
+        if (!log)
+                return;
+
+        LOGSYNC_LOCK(log, flags);
+        if (mp->lsn) {
+                mp->log = NULL;
+                mp->lsn = 0;
+                mp->clsn = 0;
+                log->count--;
+                list_del(&mp->synclist);
+        }
+        LOGSYNC_UNLOCK(log, flags);
+}
 
-        mp->hash_prev = NULL;
-        mp->hash_next = *hash_ptr;
-        *hash_ptr = mp;
+static void last_write_complete(struct page *page)
+{
+        struct metapage *mp;
+        unsigned int offset;
+
+        for (offset = 0; offset < PAGE_CACHE_SIZE; offset += PSIZE) {
+                mp = page_to_mp(page, offset);
+                if (mp && test_bit(META_io, &mp->flag)) {
+                        if (mp->lsn)
+                                remove_from_logsync(mp);
+                        clear_bit(META_io, &mp->flag);
+                }
+                /*
+                 * I'd like to call drop_metapage here, but I don't think it's
+                 * safe unless I have the page locked
+                 */
+        }
+        end_page_writeback(page);
 }
 
-static void remove_from_hash(struct metapage * mp, struct metapage ** hash_ptr)
+static int metapage_write_end_io(struct bio *bio, unsigned int bytes_done,
+                                 int err)
 {
-        if (mp->hash_prev)
-                mp->hash_prev->hash_next = mp->hash_next;
-        else {
-                assert(*hash_ptr == mp);
-                *hash_ptr = mp->hash_next;
+        struct page *page = bio->bi_private;
+
+        BUG_ON(!PagePrivate(page));
+
+        if (bio->bi_size)
+                return 1;
+
+        if (! test_bit(BIO_UPTODATE, &bio->bi_flags)) {
+                printk(KERN_ERR "metapage_write_end_io: I/O error\n");
+                SetPageError(page);
+        }
+        dec_io(page, last_write_complete);
+        bio_put(bio);
+        return 0;
+}
+
+static int metapage_writepage(struct page *page, struct writeback_control *wbc)
+{
+        struct bio *bio = NULL;
+        unsigned int block_offset;      /* block offset of mp within page */
+        struct inode *inode = page->mapping->host;
+        unsigned int blocks_per_mp = JFS_SBI(inode->i_sb)->nbperpage;
+        unsigned int len;
+        unsigned int xlen;
+        struct metapage *mp;
+        int redirty = 0;
+        sector_t lblock;
+        sector_t pblock;
+        sector_t next_block = 0;
+        sector_t page_start;
+        unsigned long bio_bytes = 0;
+        unsigned long bio_offset = 0;
+        unsigned int offset;
+
+        page_start = (sector_t)page->index <<
+                     (PAGE_CACHE_SHIFT - inode->i_blkbits);
+        BUG_ON(!PageLocked(page));
+        BUG_ON(PageWriteback(page));
+
+        for (offset = 0; offset < PAGE_CACHE_SIZE; offset += PSIZE) {
+                mp = page_to_mp(page, offset);
+
+                if (!mp || !test_bit(META_dirty, &mp->flag))
+                        continue;
+
+                if (mp->nohomeok && !test_bit(META_forcewrite, &mp->flag)) {
+                        redirty = 1;
+                        continue;
+                }
+
+                clear_bit(META_dirty, &mp->flag);
+                block_offset = offset >> inode->i_blkbits;
+                lblock = page_start + block_offset;
+                if (bio) {
+                        if (xlen && lblock == next_block) {
+                                /* Contiguous, in memory & on disk */
+                                len = min(xlen, blocks_per_mp);
+                                xlen -= len;
+                                bio_bytes += len << inode->i_blkbits;
+                                set_bit(META_io, &mp->flag);
+                                continue;
+                        }
+                        /* Not contiguous */
+                        if (bio_add_page(bio, page, bio_bytes, bio_offset) <
+                            bio_bytes)
+                                goto add_failed;
+                        /*
+                         * Increment counter before submitting i/o to keep
+                         * count from hitting zero before we're through
+                         */
+                        inc_io(page);
+                        if (!bio->bi_size)
+                                goto dump_bio;
+                        submit_bio(WRITE, bio);
+                        bio = NULL;
+                } else {
+                        set_page_writeback(page);
+                        inc_io(page);
+                }
+                xlen = (PAGE_CACHE_SIZE - offset) >> inode->i_blkbits;
+                pblock = metapage_get_blocks(inode, lblock, &xlen);
+                if (!pblock) {
+                        /* Need better error handling */
+                        printk(KERN_ERR "JFS: metapage_get_blocks failed\n");
+                        dec_io(page, last_write_complete);
+                        continue;
+                }
+                set_bit(META_io, &mp->flag);
+                len = min(xlen, (uint) JFS_SBI(inode->i_sb)->nbperpage);
+
+                bio = bio_alloc(GFP_NOFS, 1);
+                bio->bi_bdev = inode->i_sb->s_bdev;
+                bio->bi_sector = pblock << (inode->i_blkbits - 9);
+                bio->bi_end_io = metapage_write_end_io;
+                bio->bi_private = page;
+
+                /* Don't call bio_add_page yet, we may add to this vec */
+                bio_offset = offset;
+                bio_bytes = len << inode->i_blkbits;
+
+                xlen -= len;
+                next_block = lblock + len;
+        }
+        if (bio) {
+                if (bio_add_page(bio, page, bio_bytes, bio_offset) < bio_bytes)
+                                goto add_failed;
+                if (!bio->bi_size)
+                        goto dump_bio;
+                
+                submit_bio(WRITE, bio);
+        }
+        if (redirty)
+                redirty_page_for_writepage(wbc, page);
+
+        unlock_page(page);
+
+        return 0;
+add_failed:
+        /* We should never reach here, since we're only adding one vec */
+        printk(KERN_ERR "JFS: bio_add_page failed unexpectedly\n");
+        goto skip;
+dump_bio:
+        dump_mem("bio", bio, sizeof(*bio));
+skip:
+        bio_put(bio);
+        unlock_page(page);
+        dec_io(page, last_write_complete);
+
+        return -EIO;
+}
+
+static int metapage_readpage(struct file *fp, struct page *page)
+{
+        struct inode *inode = page->mapping->host;
+        struct bio *bio = NULL;
+        unsigned int block_offset;
+        unsigned int blocks_per_page = PAGE_CACHE_SIZE >> inode->i_blkbits;
+        sector_t page_start;    /* address of page in fs blocks */
+        sector_t pblock;
+        unsigned int xlen;
+        unsigned int len;
+        unsigned int offset;
+
+        BUG_ON(!PageLocked(page));
+        page_start = (sector_t)page->index <<
+                     (PAGE_CACHE_SHIFT - inode->i_blkbits);
+
+        block_offset = 0;
+        while (block_offset < blocks_per_page) {
+                xlen = blocks_per_page - block_offset;
+                pblock = metapage_get_blocks(inode, page_start + block_offset,
+                                             &xlen);
+                if (pblock) {
+                        if (!PagePrivate(page))
+                                insert_metapage(page, NULL);
+                        inc_io(page);
+                        if (bio)
+                                submit_bio(READ, bio);
+
+                        bio = bio_alloc(GFP_NOFS, 1);
+                        bio->bi_bdev = inode->i_sb->s_bdev;
+                        bio->bi_sector = pblock << (inode->i_blkbits - 9);
+                        bio->bi_end_io = metapage_read_end_io;
+                        bio->bi_private = page;
+                        len = xlen << inode->i_blkbits;
+                        offset = block_offset << inode->i_blkbits;
+                        if (bio_add_page(bio, page, len, offset) < len)
+                                goto add_failed;
+                        block_offset += xlen;
+                } else
+                        block_offset++;
         }
+        if (bio)
+                submit_bio(READ, bio);
+        else
+                unlock_page(page);
+
+        return 0;
 
-        if (mp->hash_next)
-                mp->hash_next->hash_prev = mp->hash_prev;
+add_failed:
+        printk(KERN_ERR "JFS: bio_add_page failed unexpectedly\n");
+        bio_put(bio);
+        dec_io(page, last_read_complete);
+        return -EIO;
 }
 
+static int metapage_releasepage(struct page *page, int gfp_mask)
+{
+        struct metapage *mp;
+        int busy = 0;
+        unsigned int offset;
+
+        for (offset = 0; offset < PAGE_CACHE_SIZE; offset += PSIZE) {
+                mp = page_to_mp(page, offset);
+
+                if (!mp)
+                        continue;
+
+                jfs_info("metapage_releasepage: mp = 0x%p", mp);
+                if (mp->count || mp->nohomeok) {
+                        jfs_info("count = %ld, nohomeok = %d", mp->count,
+                                 mp->nohomeok);
+                        busy = 1;
+                        continue;
+                }
+                wait_on_page_writeback(page);
+                //WARN_ON(test_bit(META_dirty, &mp->flag));
+                if (test_bit(META_dirty, &mp->flag)) {
+                        dump_mem("dirty mp in metapage_releasepage", mp,
+                                 sizeof(struct metapage));
+                        dump_mem("page", page, sizeof(struct page));
+                        dump_stack();
+                }
+                WARN_ON(mp->lsn);
+                if (mp->lsn)
+                        remove_from_logsync(mp);
+                remove_metapage(page, mp);
+                INCREMENT(mpStat.pagefree);
+                free_metapage(mp);
+        }
+        if (busy)
+                return -1;
+
+        return 0;
+}
+
+static int metapage_invalidatepage(struct page *page, unsigned long offset)
+{
+        BUG_ON(offset);
+
+        if (PageWriteback(page))
+                return 0;
+
+        return metapage_releasepage(page, 0);
+}
+
+struct address_space_operations jfs_metapage_aops = {
+        .readpage       = metapage_readpage,
+        .writepage      = metapage_writepage,
+        .sync_page      = block_sync_page,
+        .releasepage    = metapage_releasepage,
+        .invalidatepage = metapage_invalidatepage,
+        .set_page_dirty = __set_page_dirty_nobuffers,
+};
+
 struct metapage *__get_metapage(struct inode *inode, unsigned long lblock,
                                 unsigned int size, int absolute,
                                 unsigned long new)
 {
-        struct metapage **hash_ptr;
         int l2BlocksPerPage;
         int l2bsize;
         struct address_space *mapping;
-        struct metapage *mp;
+        struct metapage *mp = NULL;
+        struct page *page;
         unsigned long page_index;
         unsigned long page_offset;
 
-        jfs_info("__get_metapage: inode = 0x%p, lblock = 0x%lx", inode, lblock);
-
+        jfs_info("__get_metapage: ino = %ld, lblock = 0x%lx, abs=%d",
+                 inode->i_ino, lblock, absolute);
+
+        l2bsize = inode->i_blkbits;
+        l2BlocksPerPage = PAGE_CACHE_SHIFT - l2bsize;
+        page_index = lblock >> l2BlocksPerPage;
+        page_offset = (lblock - (page_index << l2BlocksPerPage)) << l2bsize;
+        if ((page_offset + size) > PAGE_CACHE_SIZE) {
+                jfs_err("MetaData crosses page boundary!!");
+                jfs_err("lblock = %lx, size  = %d", lblock, size);
+                dump_stack();
+                return NULL;
+        }
         if (absolute)
-                mapping = inode->i_sb->s_bdev->bd_inode->i_mapping;
+                mapping = JFS_SBI(inode->i_sb)->direct_inode->i_mapping;
         else {
                 /*
                  * If an nfs client tries to read an inode that is larger
@@ -237,312 +631,212 @@ struct metapage *__get_metapage(struct inode *inode, unsigned long lblock,
                 mapping = inode->i_mapping;
         }
 
-        hash_ptr = meta_hash(mapping, lblock);
-again:
-        spin_lock(&meta_lock);
-        mp = search_hash(hash_ptr, mapping, lblock);
+        if (new && (PSIZE == PAGE_CACHE_SIZE)) {
+                page = grab_cache_page(mapping, page_index);
+                if (!page) {
+                        jfs_err("grab_cache_page failed!");
+                        return NULL;
+                }
+                SetPageUptodate(page);
+        } else {
+                page = read_cache_page(mapping, page_index,
+                            (filler_t *)mapping->a_ops->readpage, NULL);
+                if (IS_ERR(page)) {
+                        jfs_err("read_cache_page failed!");
+                        return NULL;
+                }
+                lock_page(page);
+        }
+
+        mp = page_to_mp(page, page_offset);
         if (mp) {
-              page_found:
-                if (test_bit(META_stale, &mp->flag)) {
-                        spin_unlock(&meta_lock);
-                        msleep(1);
-                        goto again;
+                if (mp->logical_size != size) {
+                        jfs_error(inode->i_sb,
+                                  "__get_metapage: mp->logical_size != size");
+                        jfs_err("logical_size = %d, size = %d",
+                                mp->logical_size, size);
+                        dump_stack();
+                        goto unlock; 
                 }
                 mp->count++;
                 lock_metapage(mp);
-                spin_unlock(&meta_lock);
                 if (test_bit(META_discard, &mp->flag)) {
                         if (!new) {
                                 jfs_error(inode->i_sb,
                                           "__get_metapage: using a "
                                           "discarded metapage");
-                                release_metapage(mp);
-                                return NULL;
+                                discard_metapage(mp);
+                                goto unlock; 
                         }
                         clear_bit(META_discard, &mp->flag);
                 }
-                jfs_info("__get_metapage: found 0x%p, in hash", mp);
-                if (mp->logical_size != size) {
-                        jfs_error(inode->i_sb,
-                                  "__get_metapage: mp->logical_size != size");
-                        release_metapage(mp);
-                        return NULL;
-                }
         } else {
-                l2bsize = inode->i_blkbits;
-                l2BlocksPerPage = PAGE_CACHE_SHIFT - l2bsize;
-                page_index = lblock >> l2BlocksPerPage;
-                page_offset = (lblock - (page_index << l2BlocksPerPage)) <<
-                    l2bsize;
-                if ((page_offset + size) > PAGE_CACHE_SIZE) {
-                        spin_unlock(&meta_lock);
-                        jfs_err("MetaData crosses page boundary!!");
-                        return NULL;
-                }
-                
-                /*
-                 * Locks held on aggregate inode pages are usually
-                 * not held long, and they are taken in critical code
-                 * paths (committing dirty inodes, txCommit thread) 
-                 * 
-                 * Attempt to get metapage without blocking, tapping into
-                 * reserves if necessary.
-                 */
-                mp = NULL;
-                if (JFS_IP(inode)->fileset == AGGREGATE_I) {
-                        mp = alloc_metapage(GFP_ATOMIC);
-                        if (!mp) {
-                                /*
-                                 * mempool is supposed to protect us from
-                                 * failing here.  We will try a blocking
-                                 * call, but a deadlock is possible here
-                                 */
-                                printk(KERN_WARNING
-                                       "__get_metapage: atomic call to mempool_alloc failed.\n");
-                                printk(KERN_WARNING
-                                       "Will attempt blocking call\n");
-                        }
-                }
-                if (!mp) {
-                        struct metapage *mp2;
-
-                        spin_unlock(&meta_lock);
-                        mp = alloc_metapage(GFP_NOFS);
-                        spin_lock(&meta_lock);
-
-                        /* we dropped the meta_lock, we need to search the
-                         * hash again.
-                         */
-                        mp2 = search_hash(hash_ptr, mapping, lblock);
-                        if (mp2) {
-                                free_metapage(mp);
-                                mp = mp2;
-                                goto page_found;
-                        }
-                }
+                INCREMENT(mpStat.pagealloc);
+                mp = alloc_metapage(GFP_NOFS);
+                mp->page = page;
                 mp->flag = 0;
-                lock_metapage(mp);
-                if (absolute)
-                        set_bit(META_absolute, &mp->flag);
                 mp->xflag = COMMIT_PAGE;
                 mp->count = 1;
-                atomic_set(&mp->nohomeok,0);
-                mp->mapping = mapping;
-                mp->index = lblock;
-                mp->page = NULL;
+                mp->nohomeok = 0;
                 mp->logical_size = size;
-                add_to_hash(mp, hash_ptr);
-                spin_unlock(&meta_lock);
-
-                if (new) {
-                        jfs_info("__get_metapage: Calling grab_cache_page");
-                        mp->page = grab_cache_page(mapping, page_index);
-                        if (!mp->page) {
-                                jfs_err("grab_cache_page failed!");
-                                goto freeit;
-                        } else {
-                                INCREMENT(mpStat.pagealloc);
-                                unlock_page(mp->page);
-                        }
-                } else {
-                        jfs_info("__get_metapage: Calling read_cache_page");
-                        mp->page = read_cache_page(mapping, lblock,
-                                    (filler_t *)mapping->a_ops->readpage, NULL);
-                        if (IS_ERR(mp->page)) {
-                                jfs_err("read_cache_page failed!");
-                                goto freeit;
-                        } else
-                                INCREMENT(mpStat.pagealloc);
+                mp->data = page_address(page) + page_offset;
+                mp->index = lblock;
+                if (unlikely(insert_metapage(page, mp))) {
+                        free_metapage(mp);
+                        goto unlock;
                 }
-                mp->data = kmap(mp->page) + page_offset;
+                lock_metapage(mp);
         }
 
-        if (new)
+        if (new) {
+                jfs_info("zeroing mp = 0x%p", mp);
                 memset(mp->data, 0, PSIZE);
+        }
 
-        jfs_info("__get_metapage: returning = 0x%p", mp);
+        unlock_page(page);
+        jfs_info("__get_metapage: returning = 0x%p data = 0x%p", mp, mp->data);
         return mp;
 
-freeit:
-        spin_lock(&meta_lock);
-        remove_from_hash(mp, hash_ptr);
-        free_metapage(mp);
-        spin_unlock(&meta_lock);
+unlock:
+        unlock_page(page);
         return NULL;
 }
 
-void hold_metapage(struct metapage * mp, int force)
+void grab_metapage(struct metapage * mp)
 {
-        spin_lock(&meta_lock);
-
+        jfs_info("grab_metapage: mp = 0x%p", mp);
+        page_cache_get(mp->page);
+        lock_page(mp->page);
         mp->count++;
-
-        if (force) {
-                ASSERT (!(test_bit(META_forced, &mp->flag)));
-                if (trylock_metapage(mp))
-                        set_bit(META_forced, &mp->flag);
-        } else
-                lock_metapage(mp);
-
-        spin_unlock(&meta_lock);
+        lock_metapage(mp);
+        unlock_page(mp->page);
 }
 
-static void __write_metapage(struct metapage * mp)
+void force_metapage(struct metapage *mp)
 {
-        int l2bsize = mp->mapping->host->i_blkbits;
-        int l2BlocksPerPage = PAGE_CACHE_SHIFT - l2bsize;
-        unsigned long page_index;
-        unsigned long page_offset;
-        int rc;
-
-        jfs_info("__write_metapage: mp = 0x%p", mp);
-
-        page_index = mp->page->index;
-        page_offset =
-            (mp->index - (page_index << l2BlocksPerPage)) << l2bsize;
+        struct page *page = mp->page;
+        jfs_info("force_metapage: mp = 0x%p", mp);
+        set_bit(META_forcewrite, &mp->flag);
+        clear_bit(META_sync, &mp->flag);
+        page_cache_get(page);
+        lock_page(page);
+        set_page_dirty(page);
+        write_one_page(page, 1);
+        clear_bit(META_forcewrite, &mp->flag);
+        page_cache_release(page);
+}
 
+extern void hold_metapage(struct metapage *mp)
+{
         lock_page(mp->page);
-        rc = mp->mapping->a_ops->prepare_write(NULL, mp->page, page_offset,
-                                               page_offset +
-                                               mp->logical_size);
-        if (rc) {
-                jfs_err("prepare_write return %d!", rc);
-                ClearPageUptodate(mp->page);
+}
+
+extern void put_metapage(struct metapage *mp)
+{
+        if (mp->count || mp->nohomeok) {
+                /* Someone else will release this */
                 unlock_page(mp->page);
-                clear_bit(META_dirty, &mp->flag);
                 return;
         }
-        rc = mp->mapping->a_ops->commit_write(NULL, mp->page, page_offset,
-                                              page_offset +
-                                              mp->logical_size);
-        if (rc) {
-                jfs_err("commit_write returned %d", rc);
-        }
-
+        page_cache_get(mp->page);
+        mp->count++;
+        lock_metapage(mp);
         unlock_page(mp->page);
-        clear_bit(META_dirty, &mp->flag);
-
-        jfs_info("__write_metapage done");
-}
-
-static inline void sync_metapage(struct metapage *mp)
-{
-        struct page *page = mp->page;
-
-        page_cache_get(page);
-        lock_page(page);
-
-        /* we're done with this page - no need to check for errors */
-        if (page_has_buffers(page))
-                write_one_page(page, 1);
-        else
-                unlock_page(page);
-        page_cache_release(page);
+        release_metapage(mp);
 }
 
 void release_metapage(struct metapage * mp)
 {
-        struct jfs_log *log;
-
+        struct page *page = mp->page;
         jfs_info("release_metapage: mp = 0x%p, flag = 0x%lx", mp, mp->flag);
 
-        spin_lock(&meta_lock);
-        if (test_bit(META_forced, &mp->flag)) {
-                clear_bit(META_forced, &mp->flag);
-                mp->count--;
-                spin_unlock(&meta_lock);
-                return;
-        }
+        BUG_ON(!page);
+
+        lock_page(page);
+        unlock_metapage(mp);
 
         assert(mp->count);
-        if (--mp->count || atomic_read(&mp->nohomeok)) {
-                unlock_metapage(mp);
-                spin_unlock(&meta_lock);
+        if (--mp->count || mp->nohomeok) {
+                unlock_page(page);
+                page_cache_release(page);
                 return;
         }
 
-        if (mp->page) {
-                set_bit(META_stale, &mp->flag);
-                spin_unlock(&meta_lock);
-                kunmap(mp->page);
-                mp->data = NULL;
-                if (test_bit(META_dirty, &mp->flag))
-                        __write_metapage(mp);
+        if (test_bit(META_dirty, &mp->flag)) {
+                set_page_dirty(page);
                 if (test_bit(META_sync, &mp->flag)) {
-                        sync_metapage(mp);
                         clear_bit(META_sync, &mp->flag);
+                        write_one_page(page, 1);
+                        lock_page(page); /* write_one_page unlocks the page */
                 }
+        } else if (mp->lsn)     /* discard_metapage doesn't remove it */
+                remove_from_logsync(mp);
 
-                if (test_bit(META_discard, &mp->flag)) {
-                        lock_page(mp->page);
-                        block_invalidatepage(mp->page, 0);
-                        unlock_page(mp->page);
-                }
-
-                page_cache_release(mp->page);
-                mp->page = NULL;
-                INCREMENT(mpStat.pagefree);
-                spin_lock(&meta_lock);
-        }
+#if MPS_PER_PAGE == 1
+        /*
+         * If we know this is the only thing in the page, we can throw
+         * the page out of the page cache.  If pages are larger, we
+         * don't want to do this.
+         */
 
-        if (mp->lsn) {
-                /*
-                 * Remove metapage from logsynclist.
-                 */
-                log = mp->log;
-                LOGSYNC_LOCK(log);
-                mp->log = NULL;
-                mp->lsn = 0;
-                mp->clsn = 0;
-                log->count--;
-                list_del(&mp->synclist);
-                LOGSYNC_UNLOCK(log);
+        /* Retest mp->count since we may have released page lock */
+        if (test_bit(META_discard, &mp->flag) && !mp->count) {
+                clear_page_dirty(page);
+                ClearPageUptodate(page);
+#ifdef _NOT_YET
+                if (page->mapping) {
+                /* Remove from page cache and page cache reference */
+                        remove_from_page_cache(page);
+                        page_cache_release(page);
+                        metapage_releasepage(page, 0);
+                }
+#endif
         }
-        remove_from_hash(mp, meta_hash(mp->mapping, mp->index));
-        spin_unlock(&meta_lock);
-
-        free_metapage(mp);
+#else
+        /* Try to keep metapages from using up too much memory */
+        drop_metapage(page, mp);
+#endif
+        unlock_page(page);
+        page_cache_release(page);
 }
 
 void __invalidate_metapages(struct inode *ip, s64 addr, int len)
 {
-        struct metapage **hash_ptr;
-        unsigned long lblock;
+        sector_t lblock;
         int l2BlocksPerPage = PAGE_CACHE_SHIFT - ip->i_blkbits;
+        int BlocksPerPage = 1 << l2BlocksPerPage;
         /* All callers are interested in block device's mapping */
-        struct address_space *mapping = ip->i_sb->s_bdev->bd_inode->i_mapping;
+        struct address_space *mapping =
+                JFS_SBI(ip->i_sb)->direct_inode->i_mapping;
         struct metapage *mp;
         struct page *page;
+        unsigned int offset;
 
         /*
-         * First, mark metapages to discard.  They will eventually be
+         * Mark metapages to discard.  They will eventually be
          * released, but should not be written.
          */
-        for (lblock = addr; lblock < addr + len;
-             lblock += 1 << l2BlocksPerPage) {
-                hash_ptr = meta_hash(mapping, lblock);
-again:
-                spin_lock(&meta_lock);
-                mp = search_hash(hash_ptr, mapping, lblock);
-                if (mp) {
-                        if (test_bit(META_stale, &mp->flag)) {
-                                spin_unlock(&meta_lock);
-                                msleep(1);
-                                goto again;
-                        }
+        for (lblock = addr & ~(BlocksPerPage - 1); lblock < addr + len;
+             lblock += BlocksPerPage) {
+                page = find_lock_page(mapping, lblock >> l2BlocksPerPage);
+                if (!page)
+                        continue;
+                for (offset = 0; offset < PAGE_CACHE_SIZE; offset += PSIZE) {
+                        mp = page_to_mp(page, offset);
+                        if (!mp)
+                                continue;
+                        if (mp->index < addr)
+                                continue;
+                        if (mp->index >= addr + len)
+                                break;
 
                         clear_bit(META_dirty, &mp->flag);
                         set_bit(META_discard, &mp->flag);
-                        spin_unlock(&meta_lock);
-                } else {
-                        spin_unlock(&meta_lock);
-                        page = find_lock_page(mapping, lblock>>l2BlocksPerPage);
-                        if (page) {
-                                block_invalidatepage(page, 0);
-                                unlock_page(page);
-                                page_cache_release(page);
-                        }
+                        if (mp->lsn)
+                                remove_from_logsync(mp);
                 }
+                unlock_page(page);
+                page_cache_release(page);
         }
 }
 
diff --git a/fs/jfs/jfs_metapage.h b/fs/jfs/jfs_metapage.h
index 0e58aba58c37..991e9fb84c75 100644
--- a/fs/jfs/jfs_metapage.h
+++ b/fs/jfs/jfs_metapage.h
@@ -33,38 +33,27 @@ struct metapage {
         unsigned long flag;     /* See Below */
         unsigned long count;    /* Reference count */
         void *data;             /* Data pointer */
-
-        /* list management stuff */
-        struct metapage *hash_prev;
-        struct metapage *hash_next;     /* Also used for free list */
-
-        /*
-         * mapping & index become redundant, but we need these here to
-         * add the metapage to the hash before we have the real page
-         */
-        struct address_space *mapping;
-        unsigned long index;
+        sector_t index;         /* block address of page */
         wait_queue_head_t wait;
 
         /* implementation */
         struct page *page;
-        unsigned long logical_size;
+        unsigned int logical_size;
 
         /* Journal management */
         int clsn;
-        atomic_t nohomeok;
+        int nohomeok;
         struct jfs_log *log;
 };
 
 /* metapage flag */
 #define META_locked     0
-#define META_absolute   1
-#define META_free       2
-#define META_dirty      3
-#define META_sync       4
-#define META_discard    5
-#define META_forced     6
-#define META_stale      7
+#define META_free       1
+#define META_dirty      2
+#define META_sync       3
+#define META_discard    4
+#define META_forcewrite 5
+#define META_io         6
 
 #define mark_metapage_dirty(mp) set_bit(META_dirty, &(mp)->flag)
 
@@ -80,7 +69,16 @@ extern struct metapage *__get_metapage(struct inode *inode,
          __get_metapage(inode, lblock, size, absolute, TRUE)
 
 extern void release_metapage(struct metapage *);
-extern void hold_metapage(struct metapage *, int);
+extern void grab_metapage(struct metapage *);
+extern void force_metapage(struct metapage *);
+
+/*
+ * hold_metapage and put_metapage are used in conjuction.  The page lock
+ * is not dropped between the two, so no other threads can get or release
+ * the metapage
+ */
+extern void hold_metapage(struct metapage *);
+extern void put_metapage(struct metapage *);
 
 static inline void write_metapage(struct metapage *mp)
 {
@@ -101,6 +99,46 @@ static inline void discard_metapage(struct metapage *mp)
         release_metapage(mp);
 }
 
+static inline void metapage_nohomeok(struct metapage *mp)
+{
+        struct page *page = mp->page;
+        lock_page(page);
+        if (!mp->nohomeok++) {
+                mark_metapage_dirty(mp);
+                page_cache_get(page);
+                wait_on_page_writeback(page);
+        }
+        unlock_page(page);
+}
+
+/*
+ * This serializes access to mp->lsn when metapages are added to logsynclist
+ * without setting nohomeok.  i.e. updating imap & dmap
+ */
+static inline void metapage_wait_for_io(struct metapage *mp)
+{
+        if (test_bit(META_io, &mp->flag))
+                wait_on_page_writeback(mp->page);
+}
+
+/*
+ * This is called when already holding the metapage
+ */
+static inline void _metapage_homeok(struct metapage *mp)
+{
+        if (!--mp->nohomeok)
+                page_cache_release(mp->page);
+}
+
+static inline void metapage_homeok(struct metapage *mp)
+{
+        hold_metapage(mp);
+        _metapage_homeok(mp);
+        put_metapage(mp);
+}
+
+extern struct address_space_operations jfs_metapage_aops;
+
 /*
  * This routines invalidate all pages for an extent.
  */
diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index c535ffd638e8..032d111bc330 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -285,11 +285,6 @@ int jfs_mount_rw(struct super_block *sb, int remount)
          */
         logMOUNT(sb);
 
-        /*
-         * Set page cache allocation policy
-         */
-        mapping_set_gfp_mask(sb->s_bdev->bd_inode->i_mapping, GFP_NOFS);
-
         return rc;
 }
 
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index f40301d93f74..e93d01aa12c4 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -227,6 +227,7 @@ static lid_t txLockAlloc(void)
 
 static void txLockFree(lid_t lid)
 {
+        TxLock[lid].tid = 0;
         TxLock[lid].next = TxAnchor.freelock;
         TxAnchor.freelock = lid;
         TxAnchor.tlocksInUse--;
@@ -566,9 +567,6 @@ void txEnd(tid_t tid)
                  * synchronize with logsync barrier
                  */
                 if (test_bit(log_SYNCBARRIER, &log->flag)) {
-                        /* forward log syncpt */
-                        /* lmSync(log); */
-
                         jfs_info("log barrier off: 0x%x", log->lsn);
 
                         /* enable new transactions start */
@@ -576,15 +574,22 @@ void txEnd(tid_t tid)
 
                         /* wakeup all waitors for logsync barrier */
                         TXN_WAKEUP(&log->syncwait);
+
+                        TXN_UNLOCK();
+
+                        /* forward log syncpt */
+                        jfs_syncpt(log);
+
+                        goto wakeup;
                 }
         }
 
+        TXN_UNLOCK();
+wakeup:
         /*
          * wakeup all waitors for a free tblock
          */
         TXN_WAKEUP(&TxAnchor.freewait);
-
-        TXN_UNLOCK();
 }
 
 
@@ -633,8 +638,10 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
 
         /* is page locked by the requester transaction ? */
         tlck = lid_to_tlock(lid);
-        if ((xtid = tlck->tid) == tid)
+        if ((xtid = tlck->tid) == tid) {
+                TXN_UNLOCK();
                 goto grantLock;
+        }
 
         /*
          * is page locked by anonymous transaction/lock ?
@@ -649,6 +656,7 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
          */
         if (xtid == 0) {
                 tlck->tid = tid;
+                TXN_UNLOCK();
                 tblk = tid_to_tblock(tid);
                 /*
                  * The order of the tlocks in the transaction is important
@@ -706,17 +714,18 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
          */
         tlck->tid = tid;
 
+        TXN_UNLOCK();
+
         /* mark tlock for meta-data page */
         if (mp->xflag & COMMIT_PAGE) {
 
                 tlck->flag = tlckPAGELOCK;
 
                 /* mark the page dirty and nohomeok */
-                mark_metapage_dirty(mp);
-                atomic_inc(&mp->nohomeok);
+                metapage_nohomeok(mp);
 
                 jfs_info("locking mp = 0x%p, nohomeok = %d tid = %d tlck = 0x%p",
-                         mp, atomic_read(&mp->nohomeok), tid, tlck);
+                         mp, mp->nohomeok, tid, tlck);
 
                 /* if anonymous transaction, and buffer is on the group
                  * commit synclist, mark inode to show this.  This will
@@ -762,8 +771,10 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
                 if (tlck->next == 0) {
                         /* This inode's first anonymous transaction */
                         jfs_ip->atltail = lid;
+                        TXN_LOCK();
                         list_add_tail(&jfs_ip->anon_inode_list,
                                       &TxAnchor.anon_list);
+                        TXN_UNLOCK();
                 }
         }
 
@@ -821,8 +832,6 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
       grantLock:
         tlck->type |= type;
 
-        TXN_UNLOCK();
-
         return tlck;
 
         /*
@@ -841,11 +850,19 @@ struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
                 BUG();
         }
         INCREMENT(stattx.waitlock);     /* statistics */
+        TXN_UNLOCK();
         release_metapage(mp);
+        TXN_LOCK();
+        xtid = tlck->tid;       /* reaquire after dropping TXN_LOCK */
 
         jfs_info("txLock: in waitLock, tid = %d, xtid = %d, lid = %d",
                  tid, xtid, lid);
-        TXN_SLEEP_DROP_LOCK(&tid_to_tblock(xtid)->waitor);
+
+        /* Recheck everything since dropping TXN_LOCK */
+        if (xtid && (tlck->mp == mp) && (mp->lid == lid))
+                TXN_SLEEP_DROP_LOCK(&tid_to_tblock(xtid)->waitor);
+        else
+                TXN_UNLOCK();
         jfs_info("txLock: awakened     tid = %d, lid = %d", tid, lid);
 
         return NULL;
@@ -906,6 +923,7 @@ static void txUnlock(struct tblock * tblk)
         struct metapage *mp;
         struct jfs_log *log;
         int difft, diffp;
+        unsigned long flags;
 
         jfs_info("txUnlock: tblk = 0x%p", tblk);
         log = JFS_SBI(tblk->sb)->log;
@@ -925,19 +943,14 @@ static void txUnlock(struct tblock * tblk)
                         assert(mp->xflag & COMMIT_PAGE);
 
                         /* hold buffer
-                         *
-                         * It's possible that someone else has the metapage.
-                         * The only things were changing are nohomeok, which
-                         * is handled atomically, and clsn which is protected
-                         * by the LOGSYNC_LOCK.
                          */
-                        hold_metapage(mp, 1);
+                        hold_metapage(mp);
 
-                        assert(atomic_read(&mp->nohomeok) > 0);
-                        atomic_dec(&mp->nohomeok);
+                        assert(mp->nohomeok > 0);
+                        _metapage_homeok(mp);
 
                         /* inherit younger/larger clsn */
-                        LOGSYNC_LOCK(log);
+                        LOGSYNC_LOCK(log, flags);
                         if (mp->clsn) {
                                 logdiff(difft, tblk->clsn, log);
                                 logdiff(diffp, mp->clsn, log);
@@ -945,16 +958,11 @@ static void txUnlock(struct tblock * tblk)
                                         mp->clsn = tblk->clsn;
                         } else
                                 mp->clsn = tblk->clsn;
-                        LOGSYNC_UNLOCK(log);
+                        LOGSYNC_UNLOCK(log, flags);
 
                         assert(!(tlck->flag & tlckFREEPAGE));
 
-                        if (tlck->flag & tlckWRITEPAGE) {
-                                write_metapage(mp);
-                        } else {
-                                /* release page which has been forced */
-                                release_metapage(mp);
-                        }
+                        put_metapage(mp);
                 }
 
                 /* insert tlock, and linelock(s) of the tlock if any,
@@ -981,10 +989,10 @@ static void txUnlock(struct tblock * tblk)
          * has been inserted in logsync list at txUpdateMap())
          */
         if (tblk->lsn) {
-                LOGSYNC_LOCK(log);
+                LOGSYNC_LOCK(log, flags);
                 log->count--;
                 list_del(&tblk->synclist);
-                LOGSYNC_UNLOCK(log);
+                LOGSYNC_UNLOCK(log, flags);
         }
 }
 
@@ -1573,8 +1581,8 @@ static int dataLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                  * the last entry, so don't bother logging this
                  */
                 mp->lid = 0;
-                hold_metapage(mp, 0);
-                atomic_dec(&mp->nohomeok);
+                grab_metapage(mp);
+                metapage_homeok(mp);
                 discard_metapage(mp);
                 tlck->mp = NULL;
                 return 0;
@@ -1712,7 +1720,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
         struct maplock *maplock;
         struct xdlistlock *xadlock;
         struct pxd_lock *pxdlock;
-        pxd_t *pxd;
+        pxd_t *page_pxd;
         int next, lwm, hwm;
 
         ip = tlck->ip;
@@ -1722,7 +1730,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
         lrd->log.redopage.type = cpu_to_le16(LOG_XTREE);
         lrd->log.redopage.l2linesize = cpu_to_le16(L2XTSLOTSIZE);
 
-        pxd = &lrd->log.redopage.pxd;
+        page_pxd = &lrd->log.redopage.pxd;
 
         if (tlck->type & tlckBTROOT) {
                 lrd->log.redopage.type |= cpu_to_le16(LOG_BTROOT);
@@ -1752,9 +1760,9 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                  * applying the after-image to the meta-data page.
                  */
                 lrd->type = cpu_to_le16(LOG_REDOPAGE);
-//              *pxd = mp->cm_pxd;
-                PXDaddress(pxd, mp->index);
-                PXDlength(pxd,
+//              *page_pxd = mp->cm_pxd;
+                PXDaddress(page_pxd, mp->index);
+                PXDlength(page_pxd,
                           mp->logical_size >> tblk->sb->s_blocksize_bits);
                 lrd->backchain = cpu_to_le32(lmLog(log, tblk, lrd, tlck));
 
@@ -1776,25 +1784,31 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                 tlck->flag |= tlckUPDATEMAP;
                 xadlock->flag = mlckALLOCXADLIST;
                 xadlock->count = next - lwm;
-                if ((xadlock->count <= 2) && (tblk->xflag & COMMIT_LAZY)) {
+                if ((xadlock->count <= 4) && (tblk->xflag & COMMIT_LAZY)) {
                         int i;
+                        pxd_t *pxd;
                         /*
                          * Lazy commit may allow xtree to be modified before
                          * txUpdateMap runs.  Copy xad into linelock to
                          * preserve correct data.
+                         *
+                         * We can fit twice as may pxd's as xads in the lock
                          */
-                        xadlock->xdlist = &xtlck->pxdlock;
-                        memcpy(xadlock->xdlist, &p->xad[lwm],
-                               sizeof(xad_t) * xadlock->count);
-
-                        for (i = 0; i < xadlock->count; i++)
+                        xadlock->flag = mlckALLOCPXDLIST;
+                        pxd = xadlock->xdlist = &xtlck->pxdlock;
+                        for (i = 0; i < xadlock->count; i++) {
+                                PXDaddress(pxd, addressXAD(&p->xad[lwm + i]));
+                                PXDlength(pxd, lengthXAD(&p->xad[lwm + i]));
                                 p->xad[lwm + i].flag &=
                                     ~(XAD_NEW | XAD_EXTENDED);
+                                pxd++;
+                        }
                 } else {
                         /*
                          * xdlist will point to into inode's xtree, ensure
                          * that transaction is not committed lazily.
                          */
+                        xadlock->flag = mlckALLOCXADLIST;
                         xadlock->xdlist = &p->xad[lwm];
                         tblk->xflag &= ~COMMIT_LAZY;
                 }
@@ -1836,8 +1850,8 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                 if (tblk->xflag & COMMIT_TRUNCATE) {
                         /* write NOREDOPAGE for the page */
                         lrd->type = cpu_to_le16(LOG_NOREDOPAGE);
-                        PXDaddress(pxd, mp->index);
-                        PXDlength(pxd,
+                        PXDaddress(page_pxd, mp->index);
+                        PXDlength(page_pxd,
                                   mp->logical_size >> tblk->sb->
                                   s_blocksize_bits);
                         lrd->backchain =
@@ -1872,22 +1886,32 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                  * deleted page itself;
                  */
                 tlck->flag |= tlckUPDATEMAP;
-                xadlock->flag = mlckFREEXADLIST;
                 xadlock->count = hwm - XTENTRYSTART + 1;
-                if ((xadlock->count <= 2) && (tblk->xflag & COMMIT_LAZY)) {
+                if ((xadlock->count <= 4) && (tblk->xflag & COMMIT_LAZY)) {
+                        int i;
+                        pxd_t *pxd;
                         /*
                          * Lazy commit may allow xtree to be modified before
                          * txUpdateMap runs.  Copy xad into linelock to
                          * preserve correct data.
+                         *
+                         * We can fit twice as may pxd's as xads in the lock
                          */
-                        xadlock->xdlist = &xtlck->pxdlock;
-                        memcpy(xadlock->xdlist, &p->xad[XTENTRYSTART],
-                               sizeof(xad_t) * xadlock->count);
+                        xadlock->flag = mlckFREEPXDLIST;
+                        pxd = xadlock->xdlist = &xtlck->pxdlock;
+                        for (i = 0; i < xadlock->count; i++) {
+                                PXDaddress(pxd,
+                                        addressXAD(&p->xad[XTENTRYSTART + i]));
+                                PXDlength(pxd,
+                                        lengthXAD(&p->xad[XTENTRYSTART + i]));
+                                pxd++;
+                        }
                 } else {
                         /*
                          * xdlist will point to into inode's xtree, ensure
                          * that transaction is not committed lazily.
                          */
+                        xadlock->flag = mlckFREEXADLIST;
                         xadlock->xdlist = &p->xad[XTENTRYSTART];
                         tblk->xflag &= ~COMMIT_LAZY;
                 }
@@ -1918,7 +1942,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
          * header ?
          */
         if (tlck->type & tlckTRUNCATE) {
-                pxd_t tpxd;     /* truncated extent of xad */
+                pxd_t pxd;      /* truncated extent of xad */
                 int twm;
 
                 /*
@@ -1947,8 +1971,9 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                  * applying the after-image to the meta-data page.
                  */
                 lrd->type = cpu_to_le16(LOG_REDOPAGE);
-                PXDaddress(pxd, mp->index);
-                PXDlength(pxd, mp->logical_size >> tblk->sb->s_blocksize_bits);
+                PXDaddress(page_pxd, mp->index);
+                PXDlength(page_pxd,
+                          mp->logical_size >> tblk->sb->s_blocksize_bits);
                 lrd->backchain = cpu_to_le32(lmLog(log, tblk, lrd, tlck));
 
                 /*
@@ -1966,7 +1991,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                         lrd->log.updatemap.type = cpu_to_le16(LOG_FREEPXD);
                         lrd->log.updatemap.nxd = cpu_to_le16(1);
                         lrd->log.updatemap.pxd = pxdlock->pxd;
-                        tpxd = pxdlock->pxd;    /* save to format maplock */
+                        pxd = pxdlock->pxd;     /* save to format maplock */
                         lrd->backchain =
                             cpu_to_le32(lmLog(log, tblk, lrd, NULL));
                 }
@@ -2035,7 +2060,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
                         pxdlock = (struct pxd_lock *) xadlock;
                         pxdlock->flag = mlckFREEPXD;
                         pxdlock->count = 1;
-                        pxdlock->pxd = tpxd;
+                        pxdlock->pxd = pxd;
 
                         jfs_info("xtLog: truncate ip:0x%p mp:0x%p count:%d "
                                  "hwm:%d", ip, mp, pxdlock->count, hwm);
@@ -2253,7 +2278,8 @@ void txForce(struct tblock * tblk)
                                 tlck->flag &= ~tlckWRITEPAGE;
 
                                 /* do not release page to freelist */
-
+                                force_metapage(mp);
+#if 0
                                 /*
                                  * The "right" thing to do here is to
                                  * synchronously write the metadata.
@@ -2265,9 +2291,10 @@ void txForce(struct tblock * tblk)
                                  * we can get by with synchronously writing
                                  * the pages when they are released.
                                  */
-                                assert(atomic_read(&mp->nohomeok));
+                                assert(mp->nohomeok);
                                 set_bit(META_dirty, &mp->flag);
                                 set_bit(META_sync, &mp->flag);
+#endif
                         }
                 }
         }
@@ -2327,7 +2354,7 @@ static void txUpdateMap(struct tblock * tblk)
                          */
                         mp = tlck->mp;
                         ASSERT(mp->xflag & COMMIT_PAGE);
-                        hold_metapage(mp, 0);
+                        grab_metapage(mp);
                 }
 
                 /*
@@ -2377,8 +2404,8 @@ static void txUpdateMap(struct tblock * tblk)
                                 ASSERT(mp->lid == lid);
                                 tlck->mp->lid = 0;
                         }
-                        assert(atomic_read(&mp->nohomeok) == 1);
-                        atomic_dec(&mp->nohomeok);
+                        assert(mp->nohomeok == 1);
+                        metapage_homeok(mp);
                         discard_metapage(mp);
                         tlck->mp = NULL;
                 }
@@ -2844,24 +2871,9 @@ static void LogSyncRelease(struct metapage * mp)
 {
         struct jfs_log *log = mp->log;
 
-        assert(atomic_read(&mp->nohomeok));
+        assert(mp->nohomeok);
         assert(log);
-        atomic_dec(&mp->nohomeok);
-
-        if (atomic_read(&mp->nohomeok))
-                return;
-
-        hold_metapage(mp, 0);
-
-        LOGSYNC_LOCK(log);
-        mp->log = NULL;
-        mp->lsn = 0;
-        mp->clsn = 0;
-        log->count--;
-        list_del_init(&mp->synclist);
-        LOGSYNC_UNLOCK(log);
-
-        release_metapage(mp);
+        metapage_homeok(mp);
 }
 
 /*
diff --git a/fs/jfs/jfs_umount.c b/fs/jfs/jfs_umount.c
index f31a9e3f3fec..5cf91785b541 100644
--- a/fs/jfs/jfs_umount.c
+++ b/fs/jfs/jfs_umount.c
@@ -49,7 +49,6 @@
  */
 int jfs_umount(struct super_block *sb)
 {
-        struct address_space *bdev_mapping = sb->s_bdev->bd_inode->i_mapping;
         struct jfs_sb_info *sbi = JFS_SBI(sb);
         struct inode *ipbmap = sbi->ipbmap;
         struct inode *ipimap = sbi->ipimap;
@@ -109,8 +108,8 @@ int jfs_umount(struct super_block *sb)
          * Make sure all metadata makes it to disk before we mark
          * the superblock as clean
          */
-        filemap_fdatawrite(bdev_mapping);
-        filemap_fdatawait(bdev_mapping);
+        filemap_fdatawrite(sbi->direct_inode->i_mapping);
+        filemap_fdatawait(sbi->direct_inode->i_mapping);
 
         /*
          * ensure all file system file pages are propagated to their
@@ -123,9 +122,6 @@ int jfs_umount(struct super_block *sb)
         if (log) {              /* log = NULL if read-only mount */
                 updateSuper(sb, FM_CLEAN);
 
-                /* Restore default gfp_mask for bdev */
-                mapping_set_gfp_mask(bdev_mapping, GFP_USER);
-
                 /*
                  * close log: 
                  *
@@ -140,7 +136,6 @@ int jfs_umount(struct super_block *sb)
 
 int jfs_umount_rw(struct super_block *sb)
 {
-        struct address_space *bdev_mapping = sb->s_bdev->bd_inode->i_mapping;
         struct jfs_sb_info *sbi = JFS_SBI(sb);
         struct jfs_log *log = sbi->log;
 
@@ -166,13 +161,10 @@ int jfs_umount_rw(struct super_block *sb)
          * mark the superblock clean before everything is flushed to
          * disk.
          */
-        filemap_fdatawrite(bdev_mapping);
-        filemap_fdatawait(bdev_mapping);
+        filemap_fdatawrite(sbi->direct_inode->i_mapping);
+        filemap_fdatawait(sbi->direct_inode->i_mapping);
 
         updateSuper(sb, FM_CLEAN);
 
-        /* Restore default gfp_mask for bdev */
-        mapping_set_gfp_mask(bdev_mapping, GFP_USER);
-
         return lmLogClose(sb);
 }
diff --git a/fs/jfs/jfs_xtree.c b/fs/jfs/jfs_xtree.c
index 11c58c54b818..2c1f311914a1 100644
--- a/fs/jfs/jfs_xtree.c
+++ b/fs/jfs/jfs_xtree.c
@@ -111,8 +111,8 @@ static struct {
 /*
  * forward references
  */
-static int xtSearch(struct inode *ip,
-                    s64 xoff, int *cmpp, struct btstack * btstack, int flag);
+static int xtSearch(struct inode *ip, s64 xoff, s64 *next, int *cmpp,
+                    struct btstack * btstack, int flag);
 
 static int xtSplitUp(tid_t tid,
                      struct inode *ip,
@@ -159,11 +159,12 @@ int xtLookup(struct inode *ip, s64 lstart,
         xtpage_t *p;
         int index;
         xad_t *xad;
-        s64 size, xoff, xend;
+        s64 next, size, xoff, xend;
         int xlen;
         s64 xaddr;
 
-        *plen = 0;
+        *paddr = 0;
+        *plen = llen;
 
         if (!no_check) {
                 /* is lookup offset beyond eof ? */
@@ -180,7 +181,7 @@ int xtLookup(struct inode *ip, s64 lstart,
          * search for the xad entry covering the logical extent
          */
 //search:
-        if ((rc = xtSearch(ip, lstart, &cmp, &btstack, 0))) {
+        if ((rc = xtSearch(ip, lstart, &next, &cmp, &btstack, 0))) {
                 jfs_err("xtLookup: xtSearch returned %d", rc);
                 return rc;
         }
@@ -198,8 +199,11 @@ int xtLookup(struct inode *ip, s64 lstart,
          * lstart is a page start address,
          * i.e., lstart cannot start in a hole;
          */
-        if (cmp)
+        if (cmp) {
+                if (next)
+                        *plen = min(next - lstart, llen);
                 goto out;
+        }
 
         /*
          * lxd covered by xad
@@ -284,7 +288,7 @@ int xtLookupList(struct inode *ip, struct lxdlist * lxdlist,
         if (lstart >= size)
                 return 0;
 
-        if ((rc = xtSearch(ip, lstart, &cmp, &btstack, 0)))
+        if ((rc = xtSearch(ip, lstart, NULL, &cmp, &btstack, 0)))
                 return rc;
 
         /*
@@ -488,6 +492,7 @@ int xtLookupList(struct inode *ip, struct lxdlist * lxdlist,
  * parameters:
  *      ip      - file object;
  *      xoff    - extent offset;
+ *      nextp   - address of next extent (if any) for search miss
  *      cmpp    - comparison result:
  *      btstack - traverse stack;
  *      flag    - search process flag (XT_INSERT);
@@ -497,7 +502,7 @@ int xtLookupList(struct inode *ip, struct lxdlist * lxdlist,
  *      *cmpp is set to result of comparison with the entry returned.
  *      the page containing the entry is pinned at exit.
  */
-static int xtSearch(struct inode *ip, s64 xoff, /* offset of extent */
+static int xtSearch(struct inode *ip, s64 xoff, s64 *nextp,
                     int *cmpp, struct btstack * btstack, int flag)
 {
         struct jfs_inode_info *jfs_ip = JFS_IP(ip);
@@ -511,6 +516,7 @@ static int xtSearch(struct inode *ip, s64 xoff,	/* offset of extent */
         struct btframe *btsp;
         int nsplit = 0;         /* number of pages to split */
         s64 t64;
+        s64 next = 0;
 
         INCREMENT(xtStat.search);
 
@@ -579,6 +585,7 @@ static int xtSearch(struct inode *ip, s64 xoff,	/* offset of extent */
                                                  * previous and this entry
                                                  */
                                                 *cmpp = 1;
+                                                next = t64;
                                                 goto out;
                                         }
 
@@ -623,6 +630,9 @@ static int xtSearch(struct inode *ip, s64 xoff,	/* offset of extent */
                         /* update sequential access heuristics */
                         jfs_ip->btindex = index;
 
+                        if (nextp)
+                                *nextp = next;
+
                         INCREMENT(xtStat.fastSearch);
                         return 0;
                 }
@@ -675,10 +685,11 @@ static int xtSearch(struct inode *ip, s64 xoff,	/* offset of extent */
 
                                         return 0;
                                 }
-
                                 /* search hit - internal page:
                                  * descend/search its child page
                                  */
+                                if (index < p->header.nextindex - 1)
+                                        next = offsetXAD(&p->xad[index + 1]);
                                 goto next;
                         }
 
@@ -694,6 +705,8 @@ static int xtSearch(struct inode *ip, s64 xoff,	/* offset of extent */
                  * base is the smallest index with key (Kj) greater than
                  * search key (K) and may be zero or maxentry index.
                  */
+                if (base < p->header.nextindex)
+                        next = offsetXAD(&p->xad[base]);
                 /*
                  * search miss - leaf page:
                  *
@@ -727,6 +740,9 @@ static int xtSearch(struct inode *ip, s64 xoff,	/* offset of extent */
                                 jfs_ip->btorder = BT_RANDOM;
                         jfs_ip->btindex = base;
 
+                        if (nextp)
+                                *nextp = next;
+
                         return 0;
                 }
 
@@ -793,6 +809,7 @@ int xtInsert(tid_t tid,		/* transaction id */
         struct xtsplit split;   /* split information */
         xad_t *xad;
         int cmp;
+        s64 next;
         struct tlock *tlck;
         struct xtlock *xtlck;
 
@@ -806,7 +823,7 @@ int xtInsert(tid_t tid,		/* transaction id */
          * n.b. xtSearch() may return index of maxentry of
          * the full page.
          */
-        if ((rc = xtSearch(ip, xoff, &cmp, &btstack, XT_INSERT)))
+        if ((rc = xtSearch(ip, xoff, &next, &cmp, &btstack, XT_INSERT)))
                 return rc;
 
         /* retrieve search result */
@@ -814,7 +831,7 @@ int xtInsert(tid_t tid,		/* transaction id */
 
         /* This test must follow XT_GETSEARCH since mp must be valid if
          * we branch to out: */
-        if (cmp == 0) {
+        if ((cmp == 0) || (next && (xlen > next - xoff))) {
                 rc = -EEXIST;
                 goto out;
         }
@@ -1626,7 +1643,7 @@ int xtExtend(tid_t tid,		/* transaction id */
         jfs_info("xtExtend: nxoff:0x%lx nxlen:0x%x", (ulong) xoff, xlen);
 
         /* there must exist extent to be extended */
-        if ((rc = xtSearch(ip, xoff - 1, &cmp, &btstack, XT_INSERT)))
+        if ((rc = xtSearch(ip, xoff - 1, NULL, &cmp, &btstack, XT_INSERT)))
                 return rc;
 
         /* retrieve search result */
@@ -1794,7 +1811,7 @@ printf("xtTailgate: nxoff:0x%lx nxlen:0x%x nxaddr:0x%lx\n",
 */
 
         /* there must exist extent to be tailgated */
-        if ((rc = xtSearch(ip, xoff, &cmp, &btstack, XT_INSERT)))
+        if ((rc = xtSearch(ip, xoff, NULL, &cmp, &btstack, XT_INSERT)))
                 return rc;
 
         /* retrieve search result */
@@ -1977,7 +1994,7 @@ int xtUpdate(tid_t tid, struct inode *ip, xad_t * nxad)
         nxlen = lengthXAD(nxad);
         nxaddr = addressXAD(nxad);
 
-        if ((rc = xtSearch(ip, nxoff, &cmp, &btstack, XT_INSERT)))
+        if ((rc = xtSearch(ip, nxoff, NULL, &cmp, &btstack, XT_INSERT)))
                 return rc;
 
         /* retrieve search result */
@@ -2291,7 +2308,7 @@ int xtUpdate(tid_t tid, struct inode *ip, xad_t * nxad)
         if (nextindex == le16_to_cpu(p->header.maxentry)) {
                 XT_PUTPAGE(mp);
 
-                if ((rc = xtSearch(ip, nxoff, &cmp, &btstack, XT_INSERT)))
+                if ((rc = xtSearch(ip, nxoff, NULL, &cmp, &btstack, XT_INSERT)))
                         return rc;
 
                 /* retrieve search result */
@@ -2438,6 +2455,7 @@ int xtAppend(tid_t tid,		/* transaction id */
         int nsplit, nblocks, xlen;
         struct pxdlist pxdlist;
         pxd_t *pxd;
+        s64 next;
 
         xaddr = *xaddrp;
         xlen = *xlenp;
@@ -2452,7 +2470,7 @@ int xtAppend(tid_t tid,		/* transaction id */
          * n.b. xtSearch() may return index of maxentry of
          * the full page.
          */
-        if ((rc = xtSearch(ip, xoff, &cmp, &btstack, XT_INSERT)))
+        if ((rc = xtSearch(ip, xoff, &next, &cmp, &btstack, XT_INSERT)))
                 return rc;
 
         /* retrieve search result */
@@ -2462,6 +2480,9 @@ int xtAppend(tid_t tid,		/* transaction id */
                 rc = -EEXIST;
                 goto out;
         }
+
+        if (next)
+                xlen = min(xlen, (int)(next - xoff));
 //insert:
         /*
          *      insert entry for new extent
@@ -2600,7 +2621,7 @@ int xtDelete(tid_t tid, struct inode *ip, s64 xoff, s32 xlen, int flag)
         /*
          * find the matching entry; xtSearch() pins the page
          */
-        if ((rc = xtSearch(ip, xoff, &cmp, &btstack, 0)))
+        if ((rc = xtSearch(ip, xoff, NULL, &cmp, &btstack, 0)))
                 return rc;
 
         XT_GETSEARCH(ip, btstack.top, bn, mp, p, index);
@@ -2852,7 +2873,7 @@ xtRelocate(tid_t tid, struct inode * ip, xad_t * oxad,	/* old XAD */
          */
         if (xtype == DATAEXT) {
                 /* search in leaf entry */
-                rc = xtSearch(ip, xoff, &cmp, &btstack, 0);
+                rc = xtSearch(ip, xoff, NULL, &cmp, &btstack, 0);
                 if (rc)
                         return rc;
 
@@ -2958,7 +2979,7 @@ xtRelocate(tid_t tid, struct inode * ip, xad_t * oxad,	/* old XAD */
                 }
 
                 /* get back parent page */
-                if ((rc = xtSearch(ip, xoff, &cmp, &btstack, 0)))
+                if ((rc = xtSearch(ip, xoff, NULL, &cmp, &btstack, 0)))
                         return rc;
 
                 XT_GETSEARCH(ip, btstack.top, bn, pmp, pp, index);
@@ -3991,7 +4012,7 @@ s64 xtTruncate_pmap(tid_t tid, struct inode *ip, s64 committed_size)
 
         if (committed_size) {
                 xoff = (committed_size >> JFS_SBI(ip->i_sb)->l2bsize) - 1;
-                rc = xtSearch(ip, xoff, &cmp, &btstack, 0);
+                rc = xtSearch(ip, xoff, NULL, &cmp, &btstack, 0);
                 if (rc)
                         return rc;
 
diff --git a/fs/jfs/resize.c b/fs/jfs/resize.c
index 2eb6869b6e72..c6dc254d3253 100644
--- a/fs/jfs/resize.c
+++ b/fs/jfs/resize.c
@@ -209,6 +209,9 @@ int jfs_extendfs(struct super_block *sb, s64 newLVSize, int newLogSize)
          */
         txQuiesce(sb);
 
+        /* Reset size of direct inode */
+        sbi->direct_inode->i_size =  sb->s_bdev->bd_inode->i_size;
+
         if (sbi->mntflag & JFS_INLINELOG) {
                 /*
                  * deactivate old inline log
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 5856866e24fc..5e774ed7fb64 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -210,6 +210,10 @@ static void jfs_put_super(struct super_block *sb)
                 unload_nls(sbi->nls_tab);
         sbi->nls_tab = NULL;
 
+        truncate_inode_pages(sbi->direct_inode->i_mapping, 0);
+        iput(sbi->direct_inode);
+        sbi->direct_inode = NULL;
+
         kfree(sbi);
 }
 
@@ -358,6 +362,12 @@ static int jfs_remount(struct super_block *sb, int *flags, char *data)
         }
 
         if ((sb->s_flags & MS_RDONLY) && !(*flags & MS_RDONLY)) {
+                /*
+                 * Invalidate any previously read metadata.  fsck may have
+                 * changed the on-disk data since we mounted r/o
+                 */
+                truncate_inode_pages(JFS_SBI(sb)->direct_inode->i_mapping, 0);
+
                 JFS_SBI(sb)->flag = flag;
                 return jfs_mount_rw(sb, 1);
         }
@@ -428,12 +438,26 @@ static int jfs_fill_super(struct super_block *sb, void *data, int silent)
         sb->s_op = &jfs_super_operations;
         sb->s_export_op = &jfs_export_operations;
 
+        /*
+         * Initialize direct-mapping inode/address-space
+         */
+        inode = new_inode(sb);
+        if (inode == NULL)
+                goto out_kfree;
+        inode->i_ino = 0;
+        inode->i_nlink = 1;
+        inode->i_size = sb->s_bdev->bd_inode->i_size;
+        inode->i_mapping->a_ops = &jfs_metapage_aops;
+        mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
+
+        sbi->direct_inode = inode;
+
         rc = jfs_mount(sb);
         if (rc) {
                 if (!silent) {
                         jfs_err("jfs_mount failed w/return code = %d", rc);
                 }
-                goto out_kfree;
+                goto out_mount_failed;
         }
         if (sb->s_flags & MS_RDONLY)
                 sbi->log = NULL;
@@ -482,6 +506,13 @@ out_no_rw:
         if (rc) {
                 jfs_err("jfs_umount failed with return code %d", rc);
         }
+out_mount_failed:
+        filemap_fdatawrite(sbi->direct_inode->i_mapping);
+        filemap_fdatawait(sbi->direct_inode->i_mapping);
+        truncate_inode_pages(sbi->direct_inode->i_mapping, 0);
+        make_bad_inode(sbi->direct_inode);
+        iput(sbi->direct_inode);
+        sbi->direct_inode = NULL;
 out_kfree:
         if (sbi->nls_tab)
                 unload_nls(sbi->nls_tab);
@@ -527,8 +558,10 @@ static int jfs_sync_fs(struct super_block *sb, int wait)
         struct jfs_log *log = JFS_SBI(sb)->log;
 
         /* log == NULL indicates read-only mount */
-        if (log)
+        if (log) {
                 jfs_flush_journal(log, wait);
+                jfs_syncpt(log);
+        }
 
         return 0;
 }
diff --git a/fs/mpage.c b/fs/mpage.c
index e7d8d1a77606..32c7c8fcfce7 100644
--- a/fs/mpage.c
+++ b/fs/mpage.c
@@ -160,52 +160,6 @@ map_buffer_to_page(struct page *page, struct buffer_head *bh, int page_block)
         } while (page_bh != head);
 }
 
-/**
- * mpage_readpages - populate an address space with some pages, and
- *                       start reads against them.
- *
- * @mapping: the address_space
- * @pages: The address of a list_head which contains the target pages.  These
- *   pages have their ->index populated and are otherwise uninitialised.
- *
- *   The page at @pages->prev has the lowest file offset, and reads should be
- *   issued in @pages->prev to @pages->next order.
- *
- * @nr_pages: The number of pages at *@pages
- * @get_block: The filesystem's block mapper function.
- *
- * This function walks the pages and the blocks within each page, building and
- * emitting large BIOs.
- *
- * If anything unusual happens, such as:
- *
- * - encountering a page which has buffers
- * - encountering a page which has a non-hole after a hole
- * - encountering a page with non-contiguous blocks
- *
- * then this code just gives up and calls the buffer_head-based read function.
- * It does handle a page which has holes at the end - that is a common case:
- * the end-of-file on blocksize < PAGE_CACHE_SIZE setups.
- *
- * BH_Boundary explanation:
- *
- * There is a problem.  The mpage read code assembles several pages, gets all
- * their disk mappings, and then submits them all.  That's fine, but obtaining
- * the disk mappings may require I/O.  Reads of indirect blocks, for example.
- *
- * So an mpage read of the first 16 blocks of an ext2 file will cause I/O to be
- * submitted in the following order:
- *      12 0 1 2 3 4 5 6 7 8 9 10 11 13 14 15 16
- * because the indirect block has to be read to get the mappings of blocks
- * 13,14,15,16.  Obviously, this impacts performance.
- * 
- * So what we do it to allow the filesystem's get_block() function to set
- * BH_Boundary when it maps block 11.  BH_Boundary says: mapping of the block
- * after this one will require I/O against a block which is probably close to
- * this one.  So you should push what I/O you have currently accumulated.
- *
- * This all causes the disk requests to be issued in the correct order.
- */
 static struct bio *
 do_mpage_readpage(struct bio *bio, struct page *page, unsigned nr_pages,
                         sector_t *last_block_in_bio, get_block_t get_block)
@@ -320,6 +274,52 @@ confused:
         goto out;
 }
 
+/**
+ * mpage_readpages - populate an address space with some pages, and
+ *                       start reads against them.
+ *
+ * @mapping: the address_space
+ * @pages: The address of a list_head which contains the target pages.  These
+ *   pages have their ->index populated and are otherwise uninitialised.
+ *
+ *   The page at @pages->prev has the lowest file offset, and reads should be
+ *   issued in @pages->prev to @pages->next order.
+ *
+ * @nr_pages: The number of pages at *@pages
+ * @get_block: The filesystem's block mapper function.
+ *
+ * This function walks the pages and the blocks within each page, building and
+ * emitting large BIOs.
+ *
+ * If anything unusual happens, such as:
+ *
+ * - encountering a page which has buffers
+ * - encountering a page which has a non-hole after a hole
+ * - encountering a page with non-contiguous blocks
+ *
+ * then this code just gives up and calls the buffer_head-based read function.
+ * It does handle a page which has holes at the end - that is a common case:
+ * the end-of-file on blocksize < PAGE_CACHE_SIZE setups.
+ *
+ * BH_Boundary explanation:
+ *
+ * There is a problem.  The mpage read code assembles several pages, gets all
+ * their disk mappings, and then submits them all.  That's fine, but obtaining
+ * the disk mappings may require I/O.  Reads of indirect blocks, for example.
+ *
+ * So an mpage read of the first 16 blocks of an ext2 file will cause I/O to be
+ * submitted in the following order:
+ *      12 0 1 2 3 4 5 6 7 8 9 10 11 13 14 15 16
+ * because the indirect block has to be read to get the mappings of blocks
+ * 13,14,15,16.  Obviously, this impacts performance.
+ *
+ * So what we do it to allow the filesystem's get_block() function to set
+ * BH_Boundary when it maps block 11.  BH_Boundary says: mapping of the block
+ * after this one will require I/O against a block which is probably close to
+ * this one.  So you should push what I/O you have currently accumulated.
+ *
+ * This all causes the disk requests to be issued in the correct order.
+ */
 int
 mpage_readpages(struct address_space *mapping, struct list_head *pages,
                                 unsigned nr_pages, get_block_t get_block)
@@ -727,6 +727,8 @@ retry:
                                                 &last_block_in_bio, &ret, wbc,
                                                 writepage_fn);
                         }
+                        if (unlikely(ret == WRITEPAGE_ACTIVATE))
+                                unlock_page(page);
                         if (ret || (--(wbc->nr_to_write) <= 0))
                                 done = 1;
                         if (wbc->nonblocking && bdi_write_congested(bdi)) {
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 39fd336cfdb9..07cafdf74ef2 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1419,6 +1419,8 @@ static struct file_operations proc_tgid_attr_operations;
 static struct inode_operations proc_tgid_attr_inode_operations;
 #endif
 
+static int get_tid_list(int index, unsigned int *tids, struct inode *dir);
+
 /* SMP-safe */
 static struct dentry *proc_pident_lookup(struct inode *dir, 
                                          struct dentry *dentry,
@@ -1458,7 +1460,7 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
          */
         switch(p->type) {
                 case PROC_TGID_TASK:
-                        inode->i_nlink = 3;
+                        inode->i_nlink = 2 + get_tid_list(2, NULL, dir);
                         inode->i_op = &proc_task_inode_operations;
                         inode->i_fop = &proc_task_operations;
                         break;
@@ -1701,13 +1703,13 @@ static struct inode_operations proc_self_inode_operations = {
 };
 
 /**
- * proc_pid_unhash -  Unhash /proc/<pid> entry from the dcache.
+ * proc_pid_unhash -  Unhash /proc/@pid entry from the dcache.
  * @p: task that should be flushed.
  *
- * Drops the /proc/<pid> dcache entry from the hash chains.
+ * Drops the /proc/@pid dcache entry from the hash chains.
  *
- * Dropping /proc/<pid> entries and detach_pid must be synchroneous,
- * otherwise e.g. /proc/<pid>/exe might point to the wrong executable,
+ * Dropping /proc/@pid entries and detach_pid must be synchroneous,
+ * otherwise e.g. /proc/@pid/exe might point to the wrong executable,
  * if the pid value is immediately reused. This is enforced by
  * - caller must acquire spin_lock(p->proc_lock)
  * - must be called before detach_pid()
@@ -1739,8 +1741,8 @@ struct dentry *proc_pid_unhash(struct task_struct *p)
 }
 
 /**
- * proc_pid_flush - recover memory used by stale /proc/<pid>/x entries
- * @proc_entry: directoy to prune.
+ * proc_pid_flush - recover memory used by stale /proc/@pid/x entries
+ * @proc_dentry: directoy to prune.
  *
  * Shrink the /proc directory that was used by the just killed thread.
  */
@@ -1800,8 +1802,12 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, struct
         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
         inode->i_op = &proc_tgid_base_inode_operations;
         inode->i_fop = &proc_tgid_base_operations;
-        inode->i_nlink = 3;
         inode->i_flags|=S_IMMUTABLE;
+#ifdef CONFIG_SECURITY
+        inode->i_nlink = 5;
+#else
+        inode->i_nlink = 4;
+#endif
 
         dentry->d_op = &pid_base_dentry_operations;
 
@@ -1855,8 +1861,12 @@ static struct dentry *proc_task_lookup(struct inode *dir, struct dentry * dentry
         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
         inode->i_op = &proc_tid_base_inode_operations;
         inode->i_fop = &proc_tid_base_operations;
-        inode->i_nlink = 3;
         inode->i_flags|=S_IMMUTABLE;
+#ifdef CONFIG_SECURITY
+        inode->i_nlink = 4;
+#else
+        inode->i_nlink = 3;
+#endif
 
         dentry->d_op = &pid_base_dentry_operations;
 
@@ -1935,7 +1945,8 @@ static int get_tid_list(int index, unsigned int *tids, struct inode *dir)
 
                 if (--index >= 0)
                         continue;
-                tids[nr_tids] = tid;
+                if (tids != NULL)
+                        tids[nr_tids] = tid;
                 nr_tids++;
                 if (nr_tids >= PROC_MAXPIDS)
                         break;
@@ -2035,6 +2046,7 @@ static int proc_task_readdir(struct file * filp, void * dirent, filldir_t filldi
         }
 
         nr_tids = get_tid_list(pos, tid_array, inode);
+        inode->i_nlink = pos + nr_tids;
 
         for (i = 0; i < nr_tids; i++) {
                 unsigned long j = PROC_NUMBUF;
diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c
index a4e2ed544bbe..49c479c9454a 100644
--- a/fs/reiserfs/bitmap.c
+++ b/fs/reiserfs/bitmap.c
@@ -260,8 +260,9 @@ static inline int block_group_used(struct super_block *s, u32 id) {
 /*
  * the packing is returned in disk byte order
  */
-u32 reiserfs_choose_packing(struct inode *dir) {
-    u32 packing;
+__le32 reiserfs_choose_packing(struct inode *dir)
+{
+    __le32 packing;
     if (TEST_OPTION(packing_groups, dir->i_sb)) {
         u32 parent_dir = le32_to_cpu(INODE_PKEY(dir)->k_dir_id);
         /*
@@ -655,7 +656,7 @@ static int get_left_neighbor(reiserfs_blocknr_hint_t *hint)
     struct buffer_head * bh;
     struct item_head * ih;
     int pos_in_item;
-    __u32 * item;
+    __le32 * item;
     int ret = 0;
 
     if (!hint->path)            /* reiserfs code can call this function w/o pointer to path
@@ -736,7 +737,7 @@ static inline int this_blocknr_allocation_would_make_it_a_large_file(reiserfs_bl
 #ifdef DISPLACE_NEW_PACKING_LOCALITIES
 static inline void displace_new_packing_locality (reiserfs_blocknr_hint_t *hint)
 {
-    struct reiserfs_key * key = &hint->key;
+    struct in_core_key * key = &hint->key;
 
     hint->th->displace_new_blocks = 0;
     hint->search_start = hint->beg + keyed_hash((char*)(&key->k_objectid),4) % (hint->end - hint->beg);
@@ -777,7 +778,7 @@ static inline int old_way (reiserfs_blocknr_hint_t * hint)
 
 static inline void hundredth_slices (reiserfs_blocknr_hint_t * hint)
 {
-    struct reiserfs_key * key = &hint->key;
+    struct in_core_key * key = &hint->key;
     b_blocknr_t slice_start;
 
     slice_start = (keyed_hash((char*)(&key->k_dir_id),4) % 100) * (hint->end / 100);
diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c
index d1514a9b0514..fbde4b01a325 100644
--- a/fs/reiserfs/dir.c
+++ b/fs/reiserfs/dir.c
@@ -209,8 +209,8 @@ static int reiserfs_readdir (struct file * filp, void * dirent, filldir_t filldi
 /* compose directory item containing "." and ".." entries (entries are
    not aligned to 4 byte boundary) */
 /* the last four params are LE */
-void make_empty_dir_item_v1 (char * body, __u32 dirid, __u32 objid,
-                             __u32 par_dirid, __u32 par_objid)
+void make_empty_dir_item_v1 (char * body, __le32 dirid, __le32 objid,
+                             __le32 par_dirid, __le32 par_objid)
 {
     struct reiserfs_de_head * deh;
 
@@ -242,8 +242,8 @@ void make_empty_dir_item_v1 (char * body, __u32 dirid, __u32 objid,
 }
 
 /* compose directory item containing "." and ".." entries */
-void make_empty_dir_item (char * body, __u32 dirid, __u32 objid,
-                          __u32 par_dirid, __u32 par_objid)
+void make_empty_dir_item (char * body, __le32 dirid, __le32 objid,
+                          __le32 par_dirid, __le32 par_objid)
 {
     struct reiserfs_de_head * deh;
 
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index 26950113af8c..2230afff1870 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -166,7 +166,7 @@ static int reiserfs_allocate_blocks_for_region(
     struct cpu_key key; // cpu key of item that we are going to deal with
     struct item_head *ih; // pointer to item head that we are going to deal with
     struct buffer_head *bh; // Buffer head that contains items that we are going to deal with
-    __u32 * item; // pointer to item we are going to deal with
+    __le32 * item; // pointer to item we are going to deal with
     INITIALIZE_PATH(path); // path to item, that we are going to deal with.
     b_blocknr_t *allocated_blocks; // Pointer to a place where allocated blocknumbers would be stored.
     reiserfs_blocknr_hint_t hint; // hint structure for block allocator.
@@ -891,7 +891,7 @@ static int reiserfs_prepare_file_region_for_write(
     struct item_head *ih = NULL; // pointer to item head that we are going to deal with
     struct buffer_head *itembuf=NULL; // Buffer head that contains items that we are going to deal with
     INITIALIZE_PATH(path); // path to item, that we are going to deal with.
-    __u32 * item=NULL; // pointer to item we are going to deal with
+    __le32 * item=NULL; // pointer to item we are going to deal with
     int item_pos=-1; /* Position in indirect item */
 
 
@@ -1284,10 +1284,11 @@ static ssize_t reiserfs_file_write( struct file *file, /* the file we are going
         reiserfs_claim_blocks_to_be_allocated(inode->i_sb, num_pages << (PAGE_CACHE_SHIFT - inode->i_blkbits));
         reiserfs_write_unlock(inode->i_sb);
 
-        if ( !num_pages ) { /* If we do not have enough space even for */
-            res = -ENOSPC;  /* single page, return -ENOSPC */
-            if ( pos > (inode->i_size & (inode->i_sb->s_blocksize-1)))
-                break; // In case we are writing past the file end, break.
+        if ( !num_pages ) { /* If we do not have enough space even for a single page... */
+            if ( pos > inode->i_size+inode->i_sb->s_blocksize-(pos & (inode->i_sb->s_blocksize-1))) {
+                res = -ENOSPC;
+                break; // In case we are writing past the end of the last file block, break.
+            }
             // Otherwise we are possibly overwriting the file, so
             // let's set write size to be equal or less than blocksize.
             // This way we get it correctly for file holes.
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 7543031396f4..2711dff1b7b4 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -173,7 +173,7 @@ static inline void fix_tail_page_for_writing(struct page *page) {
    done already or non-hole position has been found in the indirect item */
 static inline int allocation_needed (int retval, b_blocknr_t allocated, 
                                      struct item_head * ih,
-                                     __u32 * item, int pos_in_item)
+                                     __le32 * item, int pos_in_item)
 {
   if (allocated)
          return 0;
@@ -278,7 +278,7 @@ research:
     bh = get_last_bh (&path);
     ih = get_ih (&path);
     if (is_indirect_le_ih (ih)) {
-        __u32 * ind_item = (__u32 *)B_I_PITEM (bh, ih);
+        __le32 * ind_item = (__le32 *)B_I_PITEM (bh, ih);
         
         /* FIXME: here we could cache indirect item or part of it in
            the inode to avoid search_by_key in case of subsequent
@@ -581,7 +581,7 @@ int reiserfs_get_block (struct inode * inode, sector_t block,
     struct cpu_key key;
     struct buffer_head * bh, * unbh = NULL;
     struct item_head * ih, tmp_ih;
-    __u32 * item;
+    __le32 * item;
     int done;
     int fs_gen;
     struct reiserfs_transaction_handle *th = NULL;
@@ -746,7 +746,7 @@ start_trans:
     done = 0;
     do {
         if (is_statdata_le_ih (ih)) {
-            __u32 unp = 0;
+            __le32 unp = 0;
             struct cpu_key tmp_key;
 
             /* indirect item has to be inserted */
@@ -1341,8 +1341,8 @@ void reiserfs_read_locked_inode (struct inode * inode, struct reiserfs_iget_args
     key.version = KEY_FORMAT_3_5;
     key.on_disk_key.k_dir_id = dirino;
     key.on_disk_key.k_objectid = inode->i_ino;
-    key.on_disk_key.u.k_offset_v1.k_offset = SD_OFFSET;
-    key.on_disk_key.u.k_offset_v1.k_uniqueness = SD_UNIQUENESS;
+    key.on_disk_key.k_offset = 0;
+    key.on_disk_key.k_type = 0;
 
     /* look for the object's stat data */
     retval = search_item (inode->i_sb, &key, &path_to_sd);
@@ -2067,7 +2067,7 @@ static int map_block_for_writepage(struct inode *inode,
     struct item_head tmp_ih ;
     struct item_head *ih ;
     struct buffer_head *bh ;
-    __u32 *item ;
+    __le32 *item ;
     struct cpu_key key ;
     INITIALIZE_PATH(path) ;
     int pos_in_item ;
diff --git a/fs/reiserfs/item_ops.c b/fs/reiserfs/item_ops.c
index 9cf7c13b120d..0ce33db1acdf 100644
--- a/fs/reiserfs/item_ops.c
+++ b/fs/reiserfs/item_ops.c
@@ -296,10 +296,11 @@ static void print_sequence (__u32 start, int len)
 static void indirect_print_item (struct item_head * ih, char * item)
 {
     int j;
-    __u32 * unp, prev = INT_MAX;
+    __le32 * unp;
+    __u32 prev = INT_MAX;
     int num;
 
-    unp = (__u32 *)item;
+    unp = (__le32 *)item;
 
     if (ih_item_len(ih) % UNFM_P_SIZE)
         reiserfs_warning (NULL, "indirect_print_item: invalid item len");
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index c9ad3a7849f4..3072cfdee959 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2306,13 +2306,16 @@ static int journal_init_dev( struct super_block *super,
         if( !IS_ERR( journal -> j_dev_file ) ) {
                 struct inode *jdev_inode = journal->j_dev_file->f_mapping->host;
                 if( !S_ISBLK( jdev_inode -> i_mode ) ) {
-                        reiserfs_warning  (super, "journal_init_dev: '%s' is "
-                                           "not a block device", jdev_name );
+                        reiserfs_warning(super, "journal_init_dev: '%s' is "
+                                         "not a block device", jdev_name );
                         result = -ENOTBLK;
+                        release_journal_dev( super, journal );
                 } else  {
                         /* ok */
                         journal->j_dev_bd = I_BDEV(jdev_inode);
                         set_blocksize(journal->j_dev_bd, super->s_blocksize);
+                        reiserfs_info(super, "journal_init_dev: journal device: %s\n",
+                                      bdevname(journal->j_dev_bd, b));
                 }
         } else {
                 result = PTR_ERR( journal -> j_dev_file );
@@ -2321,11 +2324,6 @@ static int journal_init_dev( struct super_block *super,
                                   "journal_init_dev: Cannot open '%s': %i",
                                   jdev_name, result );
         }
-        if( result != 0 ) {
-                release_journal_dev( super, journal );
-        }
-        reiserfs_info(super, "journal_init_dev: journal device: %s\n",
-                bdevname(journal->j_dev_bd, b));
         return result;
 }
 
@@ -2393,7 +2391,7 @@ int journal_init(struct super_block *p_s_sb, const char * j_dev_name, int old_fo
      jh = (struct reiserfs_journal_header *)(bhjh->b_data);
      
      /* make sure that journal matches to the super block */
-     if (is_reiserfs_jr(rs) && (jh->jh_journal.jp_journal_magic != sb_jp_journal_magic(rs))) {
+     if (is_reiserfs_jr(rs) && (le32_to_cpu(jh->jh_journal.jp_journal_magic) != sb_jp_journal_magic(rs))) {
          reiserfs_warning (p_s_sb, "sh-460: journal header magic %x "
                            "(device %s) does not match to magic found in super "
                            "block %x",
diff --git a/fs/reiserfs/objectid.c b/fs/reiserfs/objectid.c
index 0785c43a7486..bfe8e25ef293 100644
--- a/fs/reiserfs/objectid.c
+++ b/fs/reiserfs/objectid.c
@@ -11,13 +11,13 @@
 
 // find where objectid map starts
 #define objectid_map(s,rs) (old_format_only (s) ? \
-                         (__u32 *)((struct reiserfs_super_block_v1 *)(rs) + 1) :\
-                         (__u32 *)((rs) + 1))
+                         (__le32 *)((struct reiserfs_super_block_v1 *)(rs) + 1) :\
+                         (__le32 *)((rs) + 1))
 
 
 #ifdef CONFIG_REISERFS_CHECK
 
-static void check_objectid_map (struct super_block * s, __u32 * map)
+static void check_objectid_map (struct super_block * s, __le32 * map)
 {
     if (le32_to_cpu (map[0]) != 1)
         reiserfs_panic (s, "vs-15010: check_objectid_map: map corrupted: %lx",
@@ -27,7 +27,7 @@ static void check_objectid_map (struct super_block * s, __u32 * map)
 }
 
 #else
-static void check_objectid_map (struct super_block * s, __u32 * map)
+static void check_objectid_map (struct super_block * s, __le32 * map)
 {;}
 #endif
 
@@ -52,7 +52,7 @@ __u32 reiserfs_get_unused_objectid (struct reiserfs_transaction_handle *th)
 {
     struct super_block * s = th->t_super;
     struct reiserfs_super_block * rs = SB_DISK_SUPER_BLOCK (s);
-    __u32 * map = objectid_map (s, rs);
+    __le32 * map = objectid_map (s, rs);
     __u32 unused_objectid;
 
     BUG_ON (!th->t_trans_id);
@@ -97,7 +97,7 @@ void reiserfs_release_objectid (struct reiserfs_transaction_handle *th,
 {
     struct super_block * s = th->t_super;
     struct reiserfs_super_block * rs = SB_DISK_SUPER_BLOCK (s);
-    __u32 * map = objectid_map (s, rs);
+    __le32 * map = objectid_map (s, rs);
     int i = 0;
 
     BUG_ON (!th->t_trans_id);
@@ -172,12 +172,12 @@ int reiserfs_convert_objectid_map_v1(struct super_block *s) {
     int new_size = (s->s_blocksize - SB_SIZE) / sizeof(__u32) / 2 * 2 ;
     int old_max = sb_oid_maxsize(disk_sb);
     struct reiserfs_super_block_v1 *disk_sb_v1 ;
-    __u32 *objectid_map, *new_objectid_map ;
+    __le32 *objectid_map, *new_objectid_map ;
     int i ;
 
     disk_sb_v1=(struct reiserfs_super_block_v1 *)(SB_BUFFER_WITH_SB(s)->b_data);
-    objectid_map = (__u32 *)(disk_sb_v1 + 1) ;
-    new_objectid_map = (__u32 *)(disk_sb + 1) ;
+    objectid_map = (__le32 *)(disk_sb_v1 + 1) ;
+    new_objectid_map = (__le32 *)(disk_sb + 1) ;
 
     if (cur_size > new_size) {
         /* mark everyone used that was listed as free at the end of the objectid
diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
index f4ea81ae0e0f..e242ebc7f6f6 100644
--- a/fs/reiserfs/procfs.c
+++ b/fs/reiserfs/procfs.c
@@ -73,8 +73,8 @@ int reiserfs_global_version_in_proc( char *buffer, char **start, off_t offset,
 #define DFL( x ) D4C( rs -> s_v1.x )
 
 #define objectid_map( s, rs ) (old_format_only (s) ?                            \
-                         (__u32 *)((struct reiserfs_super_block_v1 *)rs + 1) :  \
-                         (__u32 *)(rs + 1))
+                         (__le32 *)((struct reiserfs_super_block_v1 *)rs + 1) : \
+                         (__le32 *)(rs + 1))
 #define MAP( i ) D4C( objectid_map( sb, rs )[ i ] )
 
 #define DJF( x ) le32_to_cpu( rs -> x )
diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index 73ec5212178b..da23ba75f3d5 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -87,22 +87,20 @@ inline void copy_item_head(struct item_head * p_v_to,
 inline int  comp_short_keys (const struct reiserfs_key * le_key,
                              const struct cpu_key * cpu_key)
 {
-  __u32 * p_s_le_u32, * p_s_cpu_u32;
-  int n_key_length = REISERFS_SHORT_KEY_LEN;
-
-  p_s_le_u32 = (__u32 *)le_key;
-  p_s_cpu_u32 = (__u32 *)&cpu_key->on_disk_key;
-  for( ; n_key_length--; ++p_s_le_u32, ++p_s_cpu_u32 ) {
-    if ( le32_to_cpu (*p_s_le_u32) < *p_s_cpu_u32 )
+  __u32 n;
+  n = le32_to_cpu(le_key->k_dir_id);
+  if (n < cpu_key->on_disk_key.k_dir_id)
       return -1;
-    if ( le32_to_cpu (*p_s_le_u32) > *p_s_cpu_u32 )
+  if (n > cpu_key->on_disk_key.k_dir_id)
+      return 1;
+  n = le32_to_cpu(le_key->k_objectid);
+  if (n < cpu_key->on_disk_key.k_objectid)
+      return -1;
+  if (n > cpu_key->on_disk_key.k_objectid)
       return 1;
-  }
-
   return 0;
 }
 
-
 /* k1 is pointer to on-disk structure which is stored in little-endian
    form. k2 is pointer to cpu variable.
    Compare keys using all 4 key fields.
@@ -152,18 +150,15 @@ inline int comp_short_le_keys (const struct reiserfs_key * key1, const struct re
 
 inline void le_key2cpu_key (struct cpu_key * to, const struct reiserfs_key * from)
 {
+    int version;
     to->on_disk_key.k_dir_id = le32_to_cpu (from->k_dir_id);
     to->on_disk_key.k_objectid = le32_to_cpu (from->k_objectid);
     
     // find out version of the key
-    to->version = le_key_version (from);
-    if (to->version == KEY_FORMAT_3_5) {
-        to->on_disk_key.u.k_offset_v1.k_offset = le32_to_cpu (from->u.k_offset_v1.k_offset);
-        to->on_disk_key.u.k_offset_v1.k_uniqueness = le32_to_cpu (from->u.k_offset_v1.k_uniqueness);
-    } else {
-        to->on_disk_key.u.k_offset_v2.k_offset = offset_v2_k_offset(&from->u.k_offset_v2);
-        to->on_disk_key.u.k_offset_v2.k_type = offset_v2_k_type(&from->u.k_offset_v2);
-    } 
+    version = le_key_version (from);
+    to->version = version;
+    to->on_disk_key.k_offset = le_key_k_offset(version, from);
+    to->on_disk_key.k_type = le_key_k_type(version, from);
 }
 
 
@@ -228,8 +223,14 @@ extern struct tree_balance * cur_tb;
 const struct reiserfs_key  MIN_KEY = {0, 0, {{0, 0},}};
 
 /* Maximal possible key. It is never in the tree. */
-const struct reiserfs_key  MAX_KEY = {0xffffffff, 0xffffffff, {{0xffffffff, 0xffffffff},}};
+const struct reiserfs_key  MAX_KEY = {
+        __constant_cpu_to_le32(0xffffffff),
+        __constant_cpu_to_le32(0xffffffff),
+        {{__constant_cpu_to_le32(0xffffffff),
+        __constant_cpu_to_le32(0xffffffff)},}
+};
 
+const struct in_core_key  MAX_IN_CORE_KEY = {~0U, ~0U, ~0ULL>>4, 15};
 
 /* Get delimiting key of the buffer by looking for it in the buffers in the path, starting from the bottom
    of the path, and going upwards.  We must check the path's validity at each step.  If the key is not in
@@ -997,7 +998,7 @@ static char  prepare_for_delete_or_cut(
         int                   n_unfm_number,    /* Number of the item unformatted nodes. */
             n_counter,
             n_blk_size;
-        __u32               * p_n_unfm_pointer; /* Pointer to the unformatted node number. */
+        __le32               * p_n_unfm_pointer; /* Pointer to the unformatted node number. */
         __u32 tmp;
         struct item_head      s_ih;           /* Item header. */
         char                  c_mode;           /* Returned mode of the balance. */
@@ -1059,7 +1060,7 @@ static char  prepare_for_delete_or_cut(
             /* pointers to be cut */
             n_unfm_number -= pos_in_item (p_s_path);
             /* Set pointer to the last unformatted node pointer that is to be cut. */
-            p_n_unfm_pointer = (__u32 *)B_I_PITEM(p_s_bh, &s_ih) + I_UNFM_NUM(&s_ih) - 1 - *p_n_removed;
+            p_n_unfm_pointer = (__le32 *)B_I_PITEM(p_s_bh, &s_ih) + I_UNFM_NUM(&s_ih) - 1 - *p_n_removed;
 
 
             /* We go through the unformatted nodes pointers of the indirect
@@ -1081,8 +1082,8 @@ static char  prepare_for_delete_or_cut(
                     need_research = 1 ;
                     break;
                 }
-                RFALSE( p_n_unfm_pointer < (__u32 *)B_I_PITEM(p_s_bh, &s_ih) ||
-                        p_n_unfm_pointer > (__u32 *)B_I_PITEM(p_s_bh, &s_ih) + I_UNFM_NUM(&s_ih) - 1,
+                RFALSE( p_n_unfm_pointer < (__le32 *)B_I_PITEM(p_s_bh, &s_ih) ||
+                        p_n_unfm_pointer > (__le32 *)B_I_PITEM(p_s_bh, &s_ih) + I_UNFM_NUM(&s_ih) - 1,
                         "vs-5265: pointer out of range");
 
                 /* Hole, nothing to remove. */
@@ -1431,7 +1432,7 @@ int reiserfs_delete_object (struct reiserfs_transaction_handle *th, struct inode
 #if defined( USE_INODE_GENERATION_COUNTER )
     if( !old_format_only ( th -> t_super ) )
       {
-       __u32 *inode_generation;
+       __le32 *inode_generation;
        
        inode_generation = 
          &REISERFS_SB(th -> t_super) -> s_rs -> s_inode_generation;
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index bcdf2438d152..31e75125f48b 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -110,7 +110,7 @@ static void reiserfs_unlockfs(struct super_block *s) {
   reiserfs_allow_writes(s) ;
 }
 
-extern const struct reiserfs_key  MAX_KEY;
+extern const struct in_core_key  MAX_IN_CORE_KEY;
 
 
 /* this is used to delete "save link" when there are no items of a
@@ -164,7 +164,7 @@ static int finish_unfinished (struct super_block * s)
  
     /* compose key to look for "save" links */
     max_cpu_key.version = KEY_FORMAT_3_5;
-    max_cpu_key.on_disk_key = MAX_KEY;
+    max_cpu_key.on_disk_key = MAX_IN_CORE_KEY;
     max_cpu_key.key_length = 3;
 
 #ifdef CONFIG_QUOTA
@@ -216,10 +216,10 @@ static int finish_unfinished (struct super_block * s)
  
         /* reiserfs_iget needs k_dirid and k_objectid only */
         item = B_I_PITEM (bh, ih);
-        obj_key.on_disk_key.k_dir_id = le32_to_cpu (*(__u32 *)item);
+        obj_key.on_disk_key.k_dir_id = le32_to_cpu (*(__le32 *)item);
         obj_key.on_disk_key.k_objectid = le32_to_cpu (ih->ih_key.k_objectid);
-        obj_key.on_disk_key.u.k_offset_v1.k_offset = 0;
-        obj_key.on_disk_key.u.k_offset_v1.k_uniqueness = 0;
+        obj_key.on_disk_key.k_offset = 0;
+        obj_key.on_disk_key.k_type = 0;
         
         pathrelse (&path);
  
@@ -304,7 +304,7 @@ void add_save_link (struct reiserfs_transaction_handle * th,
     int retval;
     struct cpu_key key;
     struct item_head ih;
-    __u32 link;
+    __le32 link;
 
     BUG_ON (!th->t_trans_id);
 
@@ -889,12 +889,18 @@ static int reiserfs_parse_options (struct super_block * s, char * options, /* st
             char * p;
             
             p = NULL;
-            /* "resize=NNN" */
-            *blocks = simple_strtoul (arg, &p, 0);
-            if (*p != '\0') {
-                /* NNN does not look like a number */
-                reiserfs_warning (s, "reiserfs_parse_options: bad value %s", arg);
-                return 0;
+            /* "resize=NNN" or "resize=auto" */
+
+            if (!strcmp(arg, "auto")) {
+                    /* From JFS code, to auto-get the size.*/
+                    *blocks = s->s_bdev->bd_inode->i_size >> s->s_blocksize_bits;
+            } else {
+                    *blocks = simple_strtoul (arg, &p, 0);
+                    if (*p != '\0') {
+                        /* NNN does not look like a number */
+                        reiserfs_warning (s, "reiserfs_parse_options: bad value %s", arg);
+                        return 0;
+                    }
             }
         }
 
@@ -903,7 +909,8 @@ static int reiserfs_parse_options (struct super_block * s, char * options, /* st
                 unsigned long val = simple_strtoul (arg, &p, 0);
                 /* commit=NNN (time in seconds) */
                 if ( *p != '\0' || val >= (unsigned int)-1) {
-                        reiserfs_warning (s, "reiserfs_parse_options: bad value %s", arg);                      return 0;
+                        reiserfs_warning (s, "reiserfs_parse_options: bad value %s", arg);
+                        return 0;
                 }
                 *commit_max_age = (unsigned int)val;
         }
@@ -1329,7 +1336,7 @@ static int read_super_block (struct super_block * s, int offset)
         return 1;
     }
 
-    if ( rs->s_v1.s_root_block == -1 ) {
+    if ( rs->s_v1.s_root_block == cpu_to_le32(-1) ) {
        brelse(bh) ;
        reiserfs_warning (s, "Unfinished reiserfsck --rebuild-tree run detected. Please run\n"
               "reiserfsck --rebuild-tree and wait for a completion. If that fails\n"
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 650c43ba86c4..38ef913767ff 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -51,7 +51,10 @@ EXPORT_SYMBOL(seq_open);
 
 /**
  *      seq_read -      ->read() method for sequential files.
- *      @file, @buf, @size, @ppos: see file_operations method
+ *      @file: the file to read from
+ *      @buf: the buffer to read to
+ *      @size: the maximum number of bytes to read
+ *      @ppos: the current position in the file
  *
  *      Ready-made ->f_op->read()
  */
@@ -219,7 +222,9 @@ Eoverflow:
 
 /**
  *      seq_lseek -     ->llseek() method for sequential files.
- *      @file, @offset, @origin: see file_operations method
+ *      @file: the file in question
+ *      @offset: new position
+ *      @origin: 0 for absolute, 1 for relative position
  *
  *      Ready-made ->f_op->llseek()
  */
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index da25aeb0e062..364208071e17 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -96,7 +96,7 @@ static int fill_read_buffer(struct dentry * dentry, struct sysfs_buffer * buffer
 /**
  *      flush_read_buffer - push buffer to userspace.
  *      @buffer:        data buffer for file.
- *      @userbuf:       user-passed buffer.
+ *      @buf:           user-passed buffer.
  *      @count:         number of bytes requested.
  *      @ppos:          file position.
  *
@@ -164,7 +164,7 @@ out:
 /**
  *      fill_write_buffer - copy buffer from userspace.
  *      @buffer:        data buffer for file.
- *      @userbuf:       data from user.
+ *      @buf:           data from user.
  *      @count:         number of bytes in @userbuf.
  *
  *      Allocate @buffer->page if it hasn't been already, then
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 2faa4172b9f7..bb40d63f328f 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -49,8 +49,7 @@ static int udf_adinicb_readpage(struct file *file, struct page * page)
         struct inode *inode = page->mapping->host;
         char *kaddr;
 
-        if (!PageLocked(page))
-                PAGE_BUG(page);
+        BUG_ON(!PageLocked(page));
 
         kaddr = kmap(page);
         memset(kaddr, 0, PAGE_CACHE_SIZE);
@@ -67,8 +66,7 @@ static int udf_adinicb_writepage(struct page *page, struct writeback_control *wb
         struct inode *inode = page->mapping->host;
         char *kaddr;
 
-        if (!PageLocked(page))
-                PAGE_BUG(page);
+        BUG_ON(!PageLocked(page));
 
         kaddr = kmap(page);
         memcpy(UDF_I_DATA(inode) + UDF_I_LENEATTR(inode), kaddr, inode->i_size);
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 0506e1173784..3d68de39fad6 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -167,8 +167,8 @@ void udf_expand_file_adinicb(struct inode * inode, int newsize, int * err)
         }
 
         page = grab_cache_page(inode->i_mapping, 0);
-        if (!PageLocked(page))
-                PAGE_BUG(page);
+        BUG_ON(!PageLocked(page));
+
         if (!PageUptodate(page))
         {
                 kaddr = kmap(page);
diff --git a/include/asm-alpha/bug.h b/include/asm-alpha/bug.h
index ae1e0a5fa492..39a3e2a5017d 100644
--- a/include/asm-alpha/bug.h
+++ b/include/asm-alpha/bug.h
@@ -1,6 +1,7 @@
 #ifndef _ALPHA_BUG_H
 #define _ALPHA_BUG_H
 
+#ifdef CONFIG_BUG
 #include <asm/pal.h>
 
 /* ??? Would be nice to use .gprel32 here, but we can't be sure that the
@@ -10,6 +11,8 @@
                        : : "i" (PAL_bugchk), "i"(__LINE__), "i"(__FILE__))
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-alpha/errno.h b/include/asm-alpha/errno.h
index c85ab6b9d6c6..69e2655249d2 100644
--- a/include/asm-alpha/errno.h
+++ b/include/asm-alpha/errno.h
@@ -116,4 +116,8 @@
 #define EKEYREVOKED     134     /* Key has been revoked */
 #define EKEYREJECTED    135     /* Key was rejected by service */
 
+/* for robust mutexes */
+#define EOWNERDEAD      136     /* Owner died */
+#define ENOTRECOVERABLE 137     /* State not recoverable */
+
 #endif
diff --git a/include/asm-alpha/siginfo.h b/include/asm-alpha/siginfo.h
index 86bcab59c52b..9822362a8424 100644
--- a/include/asm-alpha/siginfo.h
+++ b/include/asm-alpha/siginfo.h
@@ -4,8 +4,6 @@
 #define __ARCH_SI_PREAMBLE_SIZE         (4 * sizeof(int))
 #define __ARCH_SI_TRAPNO
 
-#define SIGEV_PAD_SIZE                  ((SIGEV_MAX_SIZE/sizeof(int)) - 4)
-
 #include <asm-generic/siginfo.h>
 
 #endif
diff --git a/include/asm-alpha/signal.h b/include/asm-alpha/signal.h
index 25f98bc5576f..4e0842b415aa 100644
--- a/include/asm-alpha/signal.h
+++ b/include/asm-alpha/signal.h
@@ -109,20 +109,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     4096
 #define SIGSTKSZ        16384
 
-
-#ifdef __KERNEL__
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x40000000
-#endif
-
 #define SIG_BLOCK          1    /* for blocking signals */
 #define SIG_UNBLOCK        2    /* for unblocking signals */
 #define SIG_SETMASK        3    /* for setting the signal mask */
diff --git a/include/asm-arm/arch-cl7500/vmalloc.h b/include/asm-arm/arch-cl7500/vmalloc.h
index 91883def4889..ba8d7a84456a 100644
--- a/include/asm-arm/arch-cl7500/vmalloc.h
+++ b/include/asm-arm/arch-cl7500/vmalloc.h
@@ -1,15 +1,4 @@
 /*
  * linux/include/asm-arm/arch-cl7500/vmalloc.h
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x1c000000)
diff --git a/include/asm-arm/arch-clps711x/vmalloc.h b/include/asm-arm/arch-clps711x/vmalloc.h
index 42571ed5e493..a5dfe96abc96 100644
--- a/include/asm-arm/arch-clps711x/vmalloc.h
+++ b/include/asm-arm/arch-clps711x/vmalloc.h
@@ -17,15 +17,4 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
diff --git a/include/asm-arm/arch-ebsa110/vmalloc.h b/include/asm-arm/arch-ebsa110/vmalloc.h
index 759659be109f..26674ba4683c 100644
--- a/include/asm-arm/arch-ebsa110/vmalloc.h
+++ b/include/asm-arm/arch-ebsa110/vmalloc.h
@@ -7,15 +7,4 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x1f000000)
diff --git a/include/asm-arm/arch-ebsa285/vmalloc.h b/include/asm-arm/arch-ebsa285/vmalloc.h
index def705a3c209..d1ca955ce434 100644
--- a/include/asm-arm/arch-ebsa285/vmalloc.h
+++ b/include/asm-arm/arch-ebsa285/vmalloc.h
@@ -8,17 +8,6 @@
 
 #include <linux/config.h>
 
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-
 #ifdef CONFIG_ARCH_FOOTBRIDGE
 #define VMALLOC_END       (PAGE_OFFSET + 0x30000000)
 #else
diff --git a/include/asm-arm/arch-epxa10db/vmalloc.h b/include/asm-arm/arch-epxa10db/vmalloc.h
index d31ef8584760..546fb7d2b6ad 100644
--- a/include/asm-arm/arch-epxa10db/vmalloc.h
+++ b/include/asm-arm/arch-epxa10db/vmalloc.h
@@ -17,15 +17,4 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
diff --git a/include/asm-arm/arch-h720x/vmalloc.h b/include/asm-arm/arch-h720x/vmalloc.h
index 4af523a5e189..b4693cb821ef 100644
--- a/include/asm-arm/arch-h720x/vmalloc.h
+++ b/include/asm-arm/arch-h720x/vmalloc.h
@@ -5,17 +5,6 @@
 #ifndef __ARCH_ARM_VMALLOC_H
 #define __ARCH_ARM_VMALLOC_H
 
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x) ((unsigned long)(x))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
 
 #endif
diff --git a/include/asm-arm/arch-imx/vmalloc.h b/include/asm-arm/arch-imx/vmalloc.h
index 252038f48163..cb6169127068 100644
--- a/include/asm-arm/arch-imx/vmalloc.h
+++ b/include/asm-arm/arch-imx/vmalloc.h
@@ -17,16 +17,4 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x) ((unsigned long)(x))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
diff --git a/include/asm-arm/arch-integrator/cm.h b/include/asm-arm/arch-integrator/cm.h
index d31c1a71f781..1ab353e23595 100644
--- a/include/asm-arm/arch-integrator/cm.h
+++ b/include/asm-arm/arch-integrator/cm.h
@@ -24,9 +24,9 @@ void cm_control(u32, u32);
 #define CM_CTRL_LCDBIASDN               (1 << 10)
 #define CM_CTRL_LCDMUXSEL_MASK          (7 << 11)
 #define CM_CTRL_LCDMUXSEL_GENLCD        (1 << 11)
-#define CM_CTRL_LCDMUXSEL_SHARPLCD1     (3 << 11)
-#define CM_CTRL_LCDMUXSEL_SHARPLCD2     (4 << 11)
-#define CM_CTRL_LCDMUXSEL_VGA           (7 << 11)
+#define CM_CTRL_LCDMUXSEL_VGA_16BPP     (2 << 11)
+#define CM_CTRL_LCDMUXSEL_SHARPLCD      (3 << 11)
+#define CM_CTRL_LCDMUXSEL_VGA_8421BPP   (4 << 11)
 #define CM_CTRL_LCDEN0                  (1 << 14)
 #define CM_CTRL_LCDEN1                  (1 << 15)
 #define CM_CTRL_STATIC1                 (1 << 16)
diff --git a/include/asm-arm/arch-integrator/platform.h b/include/asm-arm/arch-integrator/platform.h
index 6b67e41669f4..bd364f5a99bc 100644
--- a/include/asm-arm/arch-integrator/platform.h
+++ b/include/asm-arm/arch-integrator/platform.h
@@ -20,14 +20,14 @@
  * * Copyright © ARM Limited 1998.  All rights reserved.
  * ***********************************************************************/
 /* ************************************************************************
- * 
+ *
  *   Integrator address map
- * 
+ *
  *      NOTE: This is a multi-hosted header file for use with uHAL and
  *            supported debuggers.
- * 
+ *
  *      $Id: platform.s,v 1.32 2000/02/18 10:51:39 asims Exp $
- * 
+ *
  * ***********************************************************************/
 
 #ifndef __address_h
@@ -40,22 +40,22 @@
  *  Memory definitions
  * ------------------------------------------------------------------------
  *  Integrator memory map
- * 
+ *
  */
 #define INTEGRATOR_BOOT_ROM_LO          0x00000000
 #define INTEGRATOR_BOOT_ROM_HI          0x20000000
 #define INTEGRATOR_BOOT_ROM_BASE        INTEGRATOR_BOOT_ROM_HI   /*  Normal position */
 #define INTEGRATOR_BOOT_ROM_SIZE        SZ_512K
 
-/* 
+/*
  *  New Core Modules have different amounts of SSRAM, the amount of SSRAM
  *  fitted can be found in HDR_STAT.
- * 
+ *
  *  The symbol INTEGRATOR_SSRAM_SIZE is kept, however this now refers to
  *  the minimum amount of SSRAM fitted on any core module.
- * 
+ *
  *  New Core Modules also alias the SSRAM.
- * 
+ *
  */
 #define INTEGRATOR_SSRAM_BASE           0x00000000
 #define INTEGRATOR_SSRAM_ALIAS_BASE     0x10800000
@@ -67,9 +67,9 @@
 #define INTEGRATOR_MBRD_SSRAM_BASE      0x28000000
 #define INTEGRATOR_MBRD_SSRAM_SIZE      SZ_512K
 
-/* 
+/*
  *  SDRAM is a SIMM therefore the size is not known.
- * 
+ *
  */
 #define INTEGRATOR_SDRAM_BASE           0x00040000
 
@@ -79,9 +79,9 @@
 #define INTEGRATOR_HDR2_SDRAM_BASE      0xA0000000
 #define INTEGRATOR_HDR3_SDRAM_BASE      0xB0000000
 
-/* 
+/*
  *  Logic expansion modules
- * 
+ *
  */
 #define INTEGRATOR_LOGIC_MODULES_BASE   0xC0000000
 #define INTEGRATOR_LOGIC_MODULE0_BASE   0xC0000000
@@ -92,7 +92,7 @@
 /* ------------------------------------------------------------------------
  *  Integrator header card registers
  * ------------------------------------------------------------------------
- * 
+ *
  */
 #define INTEGRATOR_HDR_ID_OFFSET        0x00
 #define INTEGRATOR_HDR_PROC_OFFSET      0x04
@@ -185,12 +185,12 @@
 /* ------------------------------------------------------------------------
  *  Integrator system registers
  * ------------------------------------------------------------------------
- * 
+ *
  */
 
-/* 
+/*
  *  System Controller
- * 
+ *
  */
 #define INTEGRATOR_SC_ID_OFFSET         0x00
 #define INTEGRATOR_SC_OSC_OFFSET        0x04
@@ -230,11 +230,11 @@
 #define INTEGRATOR_SC_CTRL_URTS1        (1 << 6)
 #define INTEGRATOR_SC_CTRL_UDTR1        (1 << 7)
 
-/* 
+/*
  *  External Bus Interface
- * 
+ *
  */
-#define INTEGRATOR_EBI_BASE             0x12000000 
+#define INTEGRATOR_EBI_BASE             0x12000000
 
 #define INTEGRATOR_EBI_CSR0_OFFSET      0x00
 #define INTEGRATOR_EBI_CSR1_OFFSET      0x04
@@ -279,9 +279,9 @@
 #define INTEGRATOR_KBD_BASE             0x18000000       /*  Keyboard */
 #define INTEGRATOR_MOUSE_BASE           0x19000000       /*  Mouse */
 
-/* 
+/*
  *  LED's & Switches
- * 
+ *
  */
 #define INTEGRATOR_DBG_ALPHA_OFFSET     0x00
 #define INTEGRATOR_DBG_LEDS_OFFSET      0x04
@@ -300,7 +300,7 @@
  * ------------------------------------------------------------------------
  */
 /* PS2 Keyboard interface */
-#define KMI0_BASE                       INTEGRATOR_KBD_BASE             
+#define KMI0_BASE                       INTEGRATOR_KBD_BASE
 
 /* PS2 Mouse interface */
 #define KMI1_BASE                       INTEGRATOR_MOUSE_BASE
@@ -313,7 +313,7 @@
  *  This represents a fairly liberal usage of address space.  Even though
  *  the V3 only has two windows (therefore we need to map stuff on the fly),
  *  we maintain the same addresses, even if they're not mapped.
- * 
+ *
  */
 #define PHYS_PCI_MEM_BASE               0x40000000   /* 512M to xxx */
 /*  unused 256M from A0000000-AFFFFFFF might be used for I2O ???
@@ -326,7 +326,7 @@
  */
 #define PHYS_PCI_V3_BASE                0x62000000
 
-#define PCI_DRAMSIZE                    INTEGRATOR_SSRAM_SIZE   
+#define PCI_DRAMSIZE                    INTEGRATOR_SSRAM_SIZE
 
 /* 'export' these to UHAL */
 #define UHAL_PCI_IO                     PCI_IO_BASE
@@ -334,7 +334,7 @@
 #define UHAL_PCI_ALLOC_IO_BASE          0x00004000
 #define UHAL_PCI_ALLOC_MEM_BASE         PCI_MEM_BASE
 #define UHAL_PCI_MAX_SLOT               20
-        
+
 /* ========================================================================
  *  Start of uHAL definitions
  * ========================================================================
@@ -343,17 +343,17 @@
 /* ------------------------------------------------------------------------
  *  Integrator Interrupt Controllers
  * ------------------------------------------------------------------------
- * 
- *  Offsets from interrupt controller base 
- * 
+ *
+ *  Offsets from interrupt controller base
+ *
  *  System Controller interrupt controller base is
- * 
+ *
  *      INTEGRATOR_IC_BASE + (header_number << 6)
- * 
+ *
  *  Core Module interrupt controller base is
- * 
- *      INTEGRATOR_HDR_IC 
- * 
+ *
+ *      INTEGRATOR_HDR_IC
+ *
  */
 #define IRQ_STATUS                      0
 #define IRQ_RAW_STATUS                  0x04
@@ -374,22 +374,22 @@
 /* ------------------------------------------------------------------------
  *  Interrupts
  * ------------------------------------------------------------------------
- * 
- *  
+ *
+ *
  *  Each Core Module has two interrupts controllers, one on the core module
  *  itself and one in the system controller on the motherboard.  The
  *  READ_INT macro in target.s reads both interrupt controllers and returns
  *  a 32 bit bitmask, bits 0 to 23 are interrupts from the system controller
  *  and bits 24 to 31 are from the core module.
- *  
+ *
  *  The following definitions relate to the bitmask returned by READ_INT.
- * 
+ *
  */
 
 /* ------------------------------------------------------------------------
  *  LED's - The header LED is not accessible via the uHAL API
  * ------------------------------------------------------------------------
- * 
+ *
  */
 #define GREEN_LED                       0x01
 #define YELLOW_LED                      0x02
@@ -399,44 +399,44 @@
 
 #define LED_BANK                        INTEGRATOR_DBG_LEDS
 
-/* 
+/*
  *  Memory definitions - run uHAL out of SSRAM.
- * 
+ *
  */
 #define uHAL_MEMORY_SIZE                INTEGRATOR_SSRAM_SIZE
 
-/* 
+/*
  *  Application Flash
- * 
+ *
  */
 #define FLASH_BASE                      INTEGRATOR_FLASH_BASE
 #define FLASH_SIZE                      INTEGRATOR_FLASH_SIZE
 #define FLASH_END                       (FLASH_BASE + FLASH_SIZE - 1)
 #define FLASH_BLOCK_SIZE                SZ_128K
 
-/* 
+/*
  *  Boot Flash
- * 
+ *
  */
 #define EPROM_BASE                      INTEGRATOR_BOOT_ROM_HI
 #define EPROM_SIZE                      INTEGRATOR_BOOT_ROM_SIZE
 #define EPROM_END                       (EPROM_BASE + EPROM_SIZE - 1)
 
-/* 
+/*
  *  Clean base - dummy
- * 
+ *
  */
 #define CLEAN_BASE                      EPROM_BASE
 
-/* 
+/*
  *  Timer definitions
- * 
+ *
  *  Only use timer 1 & 2
  *  (both run at 24MHz and will need the clock divider set to 16).
- * 
+ *
  *  Timer 0 runs at bus frequency and therefore could vary and currently
  *  uHAL can't handle that.
- * 
+ *
  */
 
 #define INTEGRATOR_TIMER0_BASE          INTEGRATOR_CT_BASE
@@ -447,9 +447,9 @@
 #define MAX_PERIOD                      699050
 #define TICKS_PER_uSEC                  24
 
-/* 
- *  These are useconds NOT ticks.  
- * 
+/*
+ *  These are useconds NOT ticks.
+ *
  */
 #define mSEC_1                          1000
 #define mSEC_5                          (mSEC_1 * 5)
diff --git a/include/asm-arm/arch-integrator/vmalloc.h b/include/asm-arm/arch-integrator/vmalloc.h
index 50e9aee79486..170cccece523 100644
--- a/include/asm-arm/arch-integrator/vmalloc.h
+++ b/include/asm-arm/arch-integrator/vmalloc.h
@@ -17,15 +17,4 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
diff --git a/include/asm-arm/arch-iop3xx/vmalloc.h b/include/asm-arm/arch-iop3xx/vmalloc.h
index dc1d2a957164..0f2f6847f93c 100644
--- a/include/asm-arm/arch-iop3xx/vmalloc.h
+++ b/include/asm-arm/arch-iop3xx/vmalloc.h
@@ -10,9 +10,6 @@
  * The vmalloc() routines leaves a hole of 4kB between each vmalloced
  * area for the same reason. ;)
  */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x) ((unsigned long)(x))
 //#define VMALLOC_END       (0xe8000000)
 /* increase usable physical RAM to ~992M per RMK */
 #define VMALLOC_END       (0xfe000000)
diff --git a/include/asm-arm/arch-ixp2000/platform.h b/include/asm-arm/arch-ixp2000/platform.h
index 509e44d528d8..901bba6d02b4 100644
--- a/include/asm-arm/arch-ixp2000/platform.h
+++ b/include/asm-arm/arch-ixp2000/platform.h
@@ -121,6 +121,7 @@ unsigned long ixp2000_gettimeoffset(void);
 
 struct pci_sys_data;
 
+u32 *ixp2000_pci_config_addr(unsigned int bus, unsigned int devfn, int where);
 void ixp2000_pci_preinit(void);
 int ixp2000_pci_setup(int, struct pci_sys_data*);
 struct pci_bus* ixp2000_pci_scan_bus(int, struct pci_sys_data*);
diff --git a/include/asm-arm/arch-ixp2000/vmalloc.h b/include/asm-arm/arch-ixp2000/vmalloc.h
index 2e4bcbcf31f0..473dff4ec561 100644
--- a/include/asm-arm/arch-ixp2000/vmalloc.h
+++ b/include/asm-arm/arch-ixp2000/vmalloc.h
@@ -17,7 +17,4 @@
  * The vmalloc() routines leaves a hole of 4kB between each vmalloced
  * area for the same reason. ;)
  */
-#define VMALLOC_OFFSET      (8*1024*1024)
-#define VMALLOC_START       (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x)   ((unsigned long)(x))
 #define VMALLOC_END         0xfaffefff
diff --git a/include/asm-arm/arch-ixp4xx/vmalloc.h b/include/asm-arm/arch-ixp4xx/vmalloc.h
index da46e560ad6f..050d46e6b126 100644
--- a/include/asm-arm/arch-ixp4xx/vmalloc.h
+++ b/include/asm-arm/arch-ixp4xx/vmalloc.h
@@ -1,17 +1,5 @@
 /*
  * linux/include/asm-arm/arch-ixp4xx/vmalloc.h
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x) ((unsigned long)(x))
 #define VMALLOC_END       (0xFF000000)
 
diff --git a/include/asm-arm/arch-l7200/vmalloc.h b/include/asm-arm/arch-l7200/vmalloc.h
index edeaebe1f14a..816231eedaac 100644
--- a/include/asm-arm/arch-l7200/vmalloc.h
+++ b/include/asm-arm/arch-l7200/vmalloc.h
@@ -1,15 +1,4 @@
 /*
  * linux/include/asm-arm/arch-l7200/vmalloc.h
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
diff --git a/include/asm-arm/arch-lh7a40x/vmalloc.h b/include/asm-arm/arch-lh7a40x/vmalloc.h
index 5ac607925bea..8163e45109b9 100644
--- a/include/asm-arm/arch-lh7a40x/vmalloc.h
+++ b/include/asm-arm/arch-lh7a40x/vmalloc.h
@@ -7,15 +7,4 @@
  *  version 2 as published by the Free Software Foundation.
  *
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after
- * the physical memory until the kernel virtual memory starts.  That
- * means that any out-of-bounds memory accesses will hopefully be
- * caught.  The vmalloc() routines leaves a hole of 4kB (one page)
- * between each vmalloced area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (0xe8000000)
diff --git a/include/asm-arm/arch-omap/vmalloc.h b/include/asm-arm/arch-omap/vmalloc.h
index c6a83581a2fc..5b8bd8dae8be 100644
--- a/include/asm-arm/arch-omap/vmalloc.h
+++ b/include/asm-arm/arch-omap/vmalloc.h
@@ -17,17 +17,5 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x) ((unsigned long)(x))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
 
diff --git a/include/asm-arm/arch-pxa/vmalloc.h b/include/asm-arm/arch-pxa/vmalloc.h
index 3381af6ddb0d..5bb450c7aa2c 100644
--- a/include/asm-arm/arch-pxa/vmalloc.h
+++ b/include/asm-arm/arch-pxa/vmalloc.h
@@ -8,15 +8,4 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (0xe8000000)
diff --git a/include/asm-arm/arch-rpc/vmalloc.h b/include/asm-arm/arch-rpc/vmalloc.h
index a13c27f37d71..077046bb2f36 100644
--- a/include/asm-arm/arch-rpc/vmalloc.h
+++ b/include/asm-arm/arch-rpc/vmalloc.h
@@ -7,15 +7,4 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x1c000000)
diff --git a/include/asm-arm/arch-s3c2410/vmalloc.h b/include/asm-arm/arch-s3c2410/vmalloc.h
index 5fe72ad70904..33963cd5461b 100644
--- a/include/asm-arm/arch-s3c2410/vmalloc.h
+++ b/include/asm-arm/arch-s3c2410/vmalloc.h
@@ -19,18 +19,6 @@
 #ifndef __ASM_ARCH_VMALLOC_H
 #define __ASM_ARCH_VMALLOC_H
 
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x) ((unsigned long)(x))
 #define VMALLOC_END       (0xE0000000)
 
 #endif /* __ASM_ARCH_VMALLOC_H */
diff --git a/include/asm-arm/arch-sa1100/vmalloc.h b/include/asm-arm/arch-sa1100/vmalloc.h
index 135bc9493c06..2fb1c6f3aa1b 100644
--- a/include/asm-arm/arch-sa1100/vmalloc.h
+++ b/include/asm-arm/arch-sa1100/vmalloc.h
@@ -1,15 +1,4 @@
 /*
  * linux/include/asm-arm/arch-sa1100/vmalloc.h
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (0xe8000000)
diff --git a/include/asm-arm/arch-shark/vmalloc.h b/include/asm-arm/arch-shark/vmalloc.h
index 1cc20098f690..10db5d188231 100644
--- a/include/asm-arm/arch-shark/vmalloc.h
+++ b/include/asm-arm/arch-shark/vmalloc.h
@@ -1,15 +1,4 @@
 /*
  * linux/include/asm-arm/arch-rpc/vmalloc.h
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET    (8*1024*1024)
-#define VMALLOC_START     (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
 #define VMALLOC_END       (PAGE_OFFSET + 0x10000000)
diff --git a/include/asm-arm/arch-versatile/vmalloc.h b/include/asm-arm/arch-versatile/vmalloc.h
index adfb34829bfc..ac780df62156 100644
--- a/include/asm-arm/arch-versatile/vmalloc.h
+++ b/include/asm-arm/arch-versatile/vmalloc.h
@@ -18,16 +18,4 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-
-/*
- * Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET          (8*1024*1024)
-#define VMALLOC_START           (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
-#define VMALLOC_VMADDR(x)       ((unsigned long)(x))
 #define VMALLOC_END             (PAGE_OFFSET + 0x18000000)
diff --git a/include/asm-arm/bug.h b/include/asm-arm/bug.h
index 5e91b90a8181..24d11672eb60 100644
--- a/include/asm-arm/bug.h
+++ b/include/asm-arm/bug.h
@@ -3,6 +3,7 @@
 
 #include <linux/config.h>
 
+#ifdef CONFIG_BUG
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 extern volatile void __bug(const char *file, int line, void *data);
 
@@ -17,6 +18,8 @@ extern volatile void __bug(const char *file, int line, void *data);
 #endif
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-arm/hardware/amba_clcd.h b/include/asm-arm/hardware/amba_clcd.h
index 2149be7c7023..ce4cf5c1c05d 100644
--- a/include/asm-arm/hardware/amba_clcd.h
+++ b/include/asm-arm/hardware/amba_clcd.h
@@ -153,7 +153,7 @@ struct clcd_fb {
 
 static inline void clcdfb_decode(struct clcd_fb *fb, struct clcd_regs *regs)
 {
-        u32 val;
+        u32 val, cpl;
 
         /*
          * Program the CLCD controller registers and start the CLCD
@@ -164,7 +164,10 @@ static inline void clcdfb_decode(struct clcd_fb *fb, struct clcd_regs *regs)
         val |= (fb->fb.var.left_margin - 1) << 24;
         regs->tim0 = val;
 
-        val = fb->fb.var.yres - 1;
+        val = fb->fb.var.yres;
+        if (fb->panel->cntl & CNTL_LCDDUAL)
+                val /= 2;
+        val -= 1;
         val |= (fb->fb.var.vsync_len - 1) << 10;
         val |= fb->fb.var.lower_margin << 16;
         val |= fb->fb.var.upper_margin << 24;
@@ -174,13 +177,17 @@ static inline void clcdfb_decode(struct clcd_fb *fb, struct clcd_regs *regs)
         val |= fb->fb.var.sync & FB_SYNC_HOR_HIGH_ACT  ? 0 : TIM2_IHS;
         val |= fb->fb.var.sync & FB_SYNC_VERT_HIGH_ACT ? 0 : TIM2_IVS;
 
-        if (fb->panel->cntl & CNTL_LCDTFT)
-                val |= (fb->fb.var.xres_virtual - 1) << 16;
-        else if (fb->panel->cntl & CNTL_LCDBW)
-                printk("what value for CPL for stnmono panels?");
-        else
-                val |= ((fb->fb.var.xres_virtual * 8 / 3) - 1) << 16;
-        regs->tim2 = val;
+        cpl = fb->fb.var.xres_virtual;
+        if (fb->panel->cntl & CNTL_LCDTFT)        /* TFT */
+                /* / 1 */;
+        else if (!fb->fb.var.grayscale)           /* STN color */
+                cpl = cpl * 8 / 3;
+        else if (fb->panel->cntl & CNTL_LCDMONO8) /* STN monochrome, 8bit */
+                cpl /= 8;
+        else                                      /* STN monochrome, 4bit */
+                cpl /= 4;
+
+        regs->tim2 = val | ((cpl - 1) << 16);
 
         regs->tim3 = fb->panel->tim3;
 
@@ -204,7 +211,7 @@ static inline void clcdfb_decode(struct clcd_fb *fb, struct clcd_regs *regs)
         case 16:
                 val |= CNTL_LCDBPP16;
                 break;
-        case 24:
+        case 32:
                 val |= CNTL_LCDBPP24;
                 break;
         }
@@ -215,8 +222,8 @@ static inline void clcdfb_decode(struct clcd_fb *fb, struct clcd_regs *regs)
 
 static inline int clcdfb_check(struct clcd_fb *fb, struct fb_var_screeninfo *var)
 {
-        var->xres_virtual = var->xres = (var->xres + 7) & ~7;
-        var->yres_virtual = var->yres;
+        var->xres_virtual = var->xres = (var->xres + 15) & ~15;
+        var->yres_virtual = var->yres = (var->yres + 1) & ~1;
 
 #define CHECK(e,l,h) (var->e < l || var->e > h)
         if (CHECK(right_margin, (5+1), 256) ||  /* back porch */
diff --git a/include/asm-arm/hardware/clock.h b/include/asm-arm/hardware/clock.h
index 4983449ff2c7..19da861e523d 100644
--- a/include/asm-arm/hardware/clock.h
+++ b/include/asm-arm/hardware/clock.h
@@ -26,10 +26,13 @@ struct clk;
 /**
  * clk_get - lookup and obtain a reference to a clock producer.
  * @dev: device for clock "consumer"
- * @id: device ID
+ * @id: clock comsumer ID
  *
  * Returns a struct clk corresponding to the clock producer, or
- * valid IS_ERR() condition containing errno.
+ * valid IS_ERR() condition containing errno.  The implementation
+ * uses @dev and @id to determine the clock consumer, and thereby
+ * the clock producer.  (IOW, @id may be identical strings, but
+ * clk_get may return different clock producers depending on @dev.)
  */
 struct clk *clk_get(struct device *dev, const char *id);
 
diff --git a/include/asm-arm/io.h b/include/asm-arm/io.h
index 69bc7a3e8160..658ffa384fda 100644
--- a/include/asm-arm/io.h
+++ b/include/asm-arm/io.h
@@ -99,12 +99,16 @@ extern void __readwrite_bug(const char *fn);
  */
 #ifdef __io
 #define outb(v,p)               __raw_writeb(v,__io(p))
-#define outw(v,p)               __raw_writew(cpu_to_le16(v),__io(p))
-#define outl(v,p)               __raw_writel(cpu_to_le32(v),__io(p))
+#define outw(v,p)               __raw_writew((__force __u16) \
+                                        cpu_to_le16(v),__io(p))
+#define outl(v,p)               __raw_writel((__force __u32) \
+                                        cpu_to_le32(v),__io(p))
 
-#define inb(p)  ({ unsigned int __v = __raw_readb(__io(p)); __v; })
-#define inw(p)  ({ unsigned int __v = le16_to_cpu(__raw_readw(__io(p))); __v; })
-#define inl(p)  ({ unsigned int __v = le32_to_cpu(__raw_readl(__io(p))); __v; })
+#define inb(p)  ({ __u8 __v = __raw_readb(__io(p)); __v; })
+#define inw(p)  ({ __u16 __v = le16_to_cpu((__force __le16) \
+                        __raw_readw(__io(p))); __v; })
+#define inl(p)  ({ __u32 __v = le32_to_cpu((__force __le32) \
+                        __raw_readl(__io(p))); __v; })
 
 #define outsb(p,d,l)            __raw_writesb(__io(p),d,l)
 #define outsw(p,d,l)            __raw_writesw(__io(p),d,l)
@@ -149,9 +153,11 @@ extern void _memset_io(void __iomem *, int, size_t);
  * IO port primitives for more information.
  */
 #ifdef __mem_pci
-#define readb(c) ({ unsigned int __v = __raw_readb(__mem_pci(c)); __v; })
-#define readw(c) ({ unsigned int __v = le16_to_cpu(__raw_readw(__mem_pci(c))); __v; })
-#define readl(c) ({ unsigned int __v = le32_to_cpu(__raw_readl(__mem_pci(c))); __v; })
+#define readb(c) ({ __u8  __v = __raw_readb(__mem_pci(c)); __v; })
+#define readw(c) ({ __u16 __v = le16_to_cpu((__force __le16) \
+                                        __raw_readw(__mem_pci(c))); __v; })
+#define readl(c) ({ __u32 __v = le32_to_cpu((__force __le32) \
+                                        __raw_readl(__mem_pci(c))); __v; })
 #define readb_relaxed(addr) readb(addr)
 #define readw_relaxed(addr) readw(addr)
 #define readl_relaxed(addr) readl(addr)
@@ -161,8 +167,10 @@ extern void _memset_io(void __iomem *, int, size_t);
 #define readsl(p,d,l)           __raw_readsl(__mem_pci(p),d,l)
 
 #define writeb(v,c)             __raw_writeb(v,__mem_pci(c))
-#define writew(v,c)             __raw_writew(cpu_to_le16(v),__mem_pci(c))
-#define writel(v,c)             __raw_writel(cpu_to_le32(v),__mem_pci(c))
+#define writew(v,c)             __raw_writew((__force __u16) \
+                                        cpu_to_le16(v),__mem_pci(c))
+#define writel(v,c)             __raw_writel((__force __u32) \
+                                        cpu_to_le32(v),__mem_pci(c))
 
 #define writesb(p,d,l)          __raw_writesb(__mem_pci(p),d,l)
 #define writesw(p,d,l)          __raw_writesw(__mem_pci(p),d,l)
diff --git a/include/asm-arm/pgtable.h b/include/asm-arm/pgtable.h
index 2df4eacf4fa9..a9892eb42a23 100644
--- a/include/asm-arm/pgtable.h
+++ b/include/asm-arm/pgtable.h
@@ -17,6 +17,23 @@
 #include <asm/arch/vmalloc.h>
 
 /*
+ * Just any arbitrary offset to the start of the vmalloc VM area: the
+ * current 8MB value just means that there will be a 8MB "hole" after the
+ * physical memory until the kernel virtual memory starts.  That means that
+ * any out-of-bounds memory accesses will hopefully be caught.
+ * The vmalloc() routines leaves a hole of 4kB between each vmalloced
+ * area for the same reason. ;)
+ *
+ * Note that platforms may override VMALLOC_START, but they must provide
+ * VMALLOC_END.  VMALLOC_END defines the (exclusive) limit of this space,
+ * which may not overlap IO space.
+ */
+#ifndef VMALLOC_START
+#define VMALLOC_OFFSET          (8*1024*1024)
+#define VMALLOC_START           (((unsigned long)high_memory + VMALLOC_OFFSET) & ~(VMALLOC_OFFSET-1))
+#endif
+
+/*
  * Hardware-wise, we have a two level page table structure, where the first
  * level has 4096 entries, and the second level has 256 entries.  Each entry
  * is one 32-bit word.  Most of the bits in the second level entry are used
diff --git a/include/asm-arm/rtc.h b/include/asm-arm/rtc.h
index aa7e16b2e225..370dfe77589d 100644
--- a/include/asm-arm/rtc.h
+++ b/include/asm-arm/rtc.h
@@ -18,9 +18,9 @@ struct rtc_ops {
         void            (*release)(void);
         int             (*ioctl)(unsigned int, unsigned long);
 
-        void            (*read_time)(struct rtc_time *);
+        int             (*read_time)(struct rtc_time *);
         int             (*set_time)(struct rtc_time *);
-        void            (*read_alarm)(struct rtc_wkalrm *);
+        int             (*read_alarm)(struct rtc_wkalrm *);
         int             (*set_alarm)(struct rtc_wkalrm *);
         int             (*proc)(char *buf);
 };
diff --git a/include/asm-arm/signal.h b/include/asm-arm/signal.h
index b033e5fd60fa..b860dc3c5dc7 100644
--- a/include/asm-arm/signal.h
+++ b/include/asm-arm/signal.h
@@ -114,18 +114,7 @@ typedef unsigned long sigset_t;
 #define SIGSTKSZ        8192
 
 #ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                0x80000000
-#define SA_SAMPLE_RANDOM        0x10000000
 #define SA_IRQNOMASK            0x08000000
-#define SA_SHIRQ                0x04000000
 #endif
 
 #define SIG_BLOCK          0    /* for blocking signals */
diff --git a/include/asm-arm/unistd.h b/include/asm-arm/unistd.h
index a19ec09eaa01..ace27480886e 100644
--- a/include/asm-arm/unistd.h
+++ b/include/asm-arm/unistd.h
@@ -359,8 +359,7 @@
 #define __ARM_NR_cacheflush             (__ARM_NR_BASE+2)
 #define __ARM_NR_usr26                  (__ARM_NR_BASE+3)
 #define __ARM_NR_usr32                  (__ARM_NR_BASE+4)
-
-#define __ARM_NR_set_tls                (__ARM_NR_BASE+0x800)
+#define __ARM_NR_set_tls                (__ARM_NR_BASE+5)
 
 #define __sys2(x) #x
 #define __sys1(x) __sys2(x)
diff --git a/include/asm-arm26/bug.h b/include/asm-arm26/bug.h
index 920b70533368..7177c7399967 100644
--- a/include/asm-arm26/bug.h
+++ b/include/asm-arm26/bug.h
@@ -3,6 +3,7 @@
 
 #include <linux/config.h>
 
+#ifdef CONFIG_BUG
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 extern volatile void __bug(const char *file, int line, void *data);
 /* give file/line information */
@@ -12,6 +13,8 @@ extern volatile void __bug(const char *file, int line, void *data);
 #endif
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-arm26/signal.h b/include/asm-arm26/signal.h
index 6f62e51a2e5a..a1aacefa6562 100644
--- a/include/asm-arm26/signal.h
+++ b/include/asm-arm26/signal.h
@@ -114,18 +114,7 @@ typedef unsigned long sigset_t;
 #define SIGSTKSZ        8192
 
 #ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                0x80000000
-#define SA_SAMPLE_RANDOM        0x10000000
 #define SA_IRQNOMASK            0x08000000
-#define SA_SHIRQ                0x04000000
 #endif
 
 #define SIG_BLOCK          0    /* for blocking signals */
diff --git a/include/asm-cris/page.h b/include/asm-cris/page.h
index ddd8915e41e6..c767da1ef8f5 100644
--- a/include/asm-cris/page.h
+++ b/include/asm-cris/page.h
@@ -77,10 +77,6 @@ typedef struct { unsigned long pgprot; } pgprot_t;
   printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
 } while (0)
 
-#define PAGE_BUG(page) do { \
-         BUG(); \
-} while (0)
-
 /* Pure 2^n version of get_order */
 static inline int get_order(unsigned long size)
 {
diff --git a/include/asm-cris/signal.h b/include/asm-cris/signal.h
index 3f187ec4800a..2330769ba55d 100644
--- a/include/asm-cris/signal.h
+++ b/include/asm-cris/signal.h
@@ -108,20 +108,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-frv/bug.h b/include/asm-frv/bug.h
index 011860b28818..074c0d5770eb 100644
--- a/include/asm-frv/bug.h
+++ b/include/asm-frv/bug.h
@@ -13,6 +13,7 @@
 
 #include <linux/config.h>
 
+#ifdef CONFIG_BUG
 /*
  * Tell the user there is some problem.
  */
@@ -45,6 +46,7 @@ do {						\
 #define HAVE_ARCH_KGDB_BAD_PAGE
 #define kgdb_bad_page(page) do { kgdb_raise(SIGABRT); } while(0)
 #endif
+#endif
 
 #include <asm-generic/bug.h>
 
diff --git a/include/asm-frv/pgtable.h b/include/asm-frv/pgtable.h
index 3c6d42a22dfe..d0a9c2f9c13e 100644
--- a/include/asm-frv/pgtable.h
+++ b/include/asm-frv/pgtable.h
@@ -349,9 +349,9 @@ static inline pmd_t *pmd_offset(pud_t *dir, unsigned long address)
 
 /*
  * Define this to warn about kernel memory accesses that are
- * done without a 'verify_area(VERIFY_WRITE,..)'
+ * done without a 'access_ok(VERIFY_WRITE,..)'
  */
-#undef TEST_VERIFY_AREA
+#undef TEST_ACCESS_OK
 
 #define pte_present(x)  (pte_val(x) & _PAGE_PRESENT)
 #define pte_clear(mm,addr,xp)   do { set_pte_at(mm, addr, xp, __pte(0)); } while (0)
diff --git a/include/asm-frv/signal.h b/include/asm-frv/signal.h
index f18952f86a80..c930bb176875 100644
--- a/include/asm-frv/signal.h
+++ b/include/asm-frv/signal.h
@@ -107,20 +107,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index e5913c3b715a..400c2b41896e 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -4,6 +4,7 @@
 #include <linux/compiler.h>
 #include <linux/config.h>
 
+#ifdef CONFIG_BUG
 #ifndef HAVE_ARCH_BUG
 #define BUG() do { \
         printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
@@ -11,13 +12,6 @@
 } while (0)
 #endif
 
-#ifndef HAVE_ARCH_PAGE_BUG
-#define PAGE_BUG(page) do { \
-        printk("page BUG for page at %p\n", page); \
-        BUG(); \
-} while (0)
-#endif
-
 #ifndef HAVE_ARCH_BUG_ON
 #define BUG_ON(condition) do { if (unlikely((condition)!=0)) BUG(); } while(0)
 #endif
@@ -31,4 +25,18 @@
 } while (0)
 #endif
 
+#else /* !CONFIG_BUG */
+#ifndef HAVE_ARCH_BUG
+#define BUG()
+#endif
+
+#ifndef HAVE_ARCH_BUG_ON
+#define BUG_ON(condition) do { if (condition) ; } while(0)
+#endif
+
+#ifndef HAVE_ARCH_WARN_ON
+#define WARN_ON(condition) do { if (condition) ; } while(0)
+#endif
+#endif
+
 #endif
diff --git a/include/asm-generic/errno.h b/include/asm-generic/errno.h
index 4dd2384bc38d..e8852c092fea 100644
--- a/include/asm-generic/errno.h
+++ b/include/asm-generic/errno.h
@@ -102,4 +102,8 @@
 #define EKEYREVOKED     128     /* Key has been revoked */
 #define EKEYREJECTED    129     /* Key was rejected by service */
 
+/* for robust mutexes */
+#define EOWNERDEAD      130     /* Owner died */
+#define ENOTRECOVERABLE 131     /* State not recoverable */
+
 #endif
diff --git a/include/asm-generic/resource.h b/include/asm-generic/resource.h
index b1fcda9eac23..cfe3692b23e5 100644
--- a/include/asm-generic/resource.h
+++ b/include/asm-generic/resource.h
@@ -41,8 +41,11 @@
 #define RLIMIT_LOCKS            10      /* maximum file locks held */
 #define RLIMIT_SIGPENDING       11      /* max number of pending signals */
 #define RLIMIT_MSGQUEUE         12      /* maximum bytes in POSIX mqueues */
+#define RLIMIT_NICE             13      /* max nice prio allowed to raise to
+                                           0-39 for nice level 19 .. -20 */
+#define RLIMIT_RTPRIO           14      /* maximum realtime priority */
 
-#define RLIM_NLIMITS            13
+#define RLIM_NLIMITS            15
 
 /*
  * SuS says limits have to be unsigned.
@@ -81,6 +84,8 @@
         [RLIMIT_LOCKS]          = {  RLIM_INFINITY,  RLIM_INFINITY },   \
         [RLIMIT_SIGPENDING]     = {             0,             0 },     \
         [RLIMIT_MSGQUEUE]       = {   MQ_BYTES_MAX,   MQ_BYTES_MAX },   \
+        [RLIMIT_NICE]           = { 0, 0 },                             \
+        [RLIMIT_RTPRIO]         = { 0, 0 },                             \
 }
 
 #endif  /* __KERNEL__ */
diff --git a/include/asm-generic/siginfo.h b/include/asm-generic/siginfo.h
index 9cac8e8dde51..8786e01e0db8 100644
--- a/include/asm-generic/siginfo.h
+++ b/include/asm-generic/siginfo.h
@@ -236,11 +236,18 @@ typedef struct siginfo {
 #define SIGEV_THREAD    2       /* deliver via thread creation */
 #define SIGEV_THREAD_ID 4       /* deliver to thread */
 
-#define SIGEV_MAX_SIZE  64
-#ifndef SIGEV_PAD_SIZE
-#define SIGEV_PAD_SIZE  ((SIGEV_MAX_SIZE/sizeof(int)) - 3)
+/*
+ * This works because the alignment is ok on all current architectures
+ * but we leave open this being overridden in the future
+ */
+#ifndef __ARCH_SIGEV_PREAMBLE_SIZE
+#define __ARCH_SIGEV_PREAMBLE_SIZE      (sizeof(int) * 2 + sizeof(sigval_t))
 #endif
 
+#define SIGEV_MAX_SIZE  64
+#define SIGEV_PAD_SIZE  ((SIGEV_MAX_SIZE - __ARCH_SIGEV_PREAMBLE_SIZE) \
+                / sizeof(int))
+
 typedef struct sigevent {
         sigval_t sigev_value;
         int sigev_signo;
diff --git a/include/asm-h8300/signal.h b/include/asm-h8300/signal.h
index 3a08544a473e..ac3e01bd6396 100644
--- a/include/asm-h8300/signal.h
+++ b/include/asm-h8300/signal.h
@@ -107,19 +107,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-i386/apic.h b/include/asm-i386/apic.h
index e1de67483f38..a5810cf7b578 100644
--- a/include/asm-i386/apic.h
+++ b/include/asm-i386/apic.h
@@ -109,7 +109,6 @@ extern int APIC_init_uniprocessor (void);
 extern void disable_APIC_timer(void);
 extern void enable_APIC_timer(void);
 
-extern int check_nmi_watchdog (void);
 extern void enable_NMI_through_LVT0 (void * dummy);
 
 extern unsigned int nmi_watchdog;
diff --git a/include/asm-i386/bug.h b/include/asm-i386/bug.h
index 706eb511c330..8f79de19eb94 100644
--- a/include/asm-i386/bug.h
+++ b/include/asm-i386/bug.h
@@ -9,6 +9,8 @@
  * undefined" opcode for parsing in the trap handler.
  */
 
+#ifdef CONFIG_BUG
+#define HAVE_ARCH_BUG
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 #define BUG()                           \
  __asm__ __volatile__(  "ud2\n"         \
@@ -18,8 +20,7 @@
 #else
 #define BUG() __asm__ __volatile__("ud2\n")
 #endif
+#endif
 
-#define HAVE_ARCH_BUG
 #include <asm-generic/bug.h>
-
 #endif
diff --git a/include/asm-i386/checksum.h b/include/asm-i386/checksum.h
index d76a5f081c91..641342002bcd 100644
--- a/include/asm-i386/checksum.h
+++ b/include/asm-i386/checksum.h
@@ -33,7 +33,7 @@ asmlinkage unsigned int csum_partial_copy_generic(const unsigned char *src, unsi
  *      passed in an incorrect kernel address to one of these functions.
  *
  *      If you use these functions directly please don't forget the
- *      verify_area().
+ *      access_ok().
  */
 static __inline__
 unsigned int csum_partial_copy_nocheck (const unsigned char *src, unsigned char *dst,
diff --git a/include/asm-i386/cpufeature.h b/include/asm-i386/cpufeature.h
index e147cabd3bfe..ff1187e80c32 100644
--- a/include/asm-i386/cpufeature.h
+++ b/include/asm-i386/cpufeature.h
@@ -87,8 +87,8 @@
 #define X86_FEATURE_XCRYPT_EN   (5*32+ 7) /* on-CPU crypto enabled */
 
 /* More extended AMD flags: CPUID level 0x80000001, ecx, word 6 */
-#define X86_FEATURE_LAHF_LM     (5*32+ 0) /* LAHF/SAHF in long mode */
-#define X86_FEATURE_CMP_LEGACY  (5*32+ 1) /* If yes HyperThreading not valid */
+#define X86_FEATURE_LAHF_LM     (6*32+ 0) /* LAHF/SAHF in long mode */
+#define X86_FEATURE_CMP_LEGACY  (6*32+ 1) /* If yes HyperThreading not valid */
 
 #define cpu_has(c, bit)         test_bit(bit, (c)->x86_capability)
 #define boot_cpu_has(bit)       test_bit(bit, boot_cpu_data.x86_capability)
diff --git a/include/asm-i386/e820.h b/include/asm-i386/e820.h
index 5c285aee7294..edf65be21a92 100644
--- a/include/asm-i386/e820.h
+++ b/include/asm-i386/e820.h
@@ -13,7 +13,7 @@
 #define __E820_HEADER
 
 #define E820MAP 0x2d0           /* our map */
-#define E820MAX 32              /* number of entries in E820MAP */
+#define E820MAX 128             /* number of entries in E820MAP */
 #define E820NR  0x1e8           /* # entries in E820MAP */
 
 #define E820_RAM        1
diff --git a/include/asm-i386/hpet.h b/include/asm-i386/hpet.h
index 6e20b079f1d3..16ef9f996e3f 100644
--- a/include/asm-i386/hpet.h
+++ b/include/asm-i386/hpet.h
@@ -92,6 +92,7 @@
 
 extern unsigned long hpet_tick;         /* hpet clks count per tick */
 extern unsigned long hpet_address;      /* hpet memory map physical address */
+extern int hpet_use_timer;
 
 extern int hpet_rtc_timer_init(void);
 extern int hpet_enable(void);
diff --git a/include/asm-i386/pgtable.h b/include/asm-i386/pgtable.h
index 5c725425d863..8d60c2b4b003 100644
--- a/include/asm-i386/pgtable.h
+++ b/include/asm-i386/pgtable.h
@@ -193,9 +193,9 @@ extern unsigned long long __PAGE_KERNEL, __PAGE_KERNEL_EXEC;
 /*
  * Define this if things work differently on an i386 and an i486:
  * it will (on an i486) warn about kernel memory accesses that are
- * done without a 'verify_area(VERIFY_WRITE,..)'
+ * done without a 'access_ok(VERIFY_WRITE,..)'
  */
-#undef TEST_VERIFY_AREA
+#undef TEST_ACCESS_OK
 
 /* The boot page tables (all created as a single array) */
 extern unsigned long pg0[];
diff --git a/include/asm-i386/setup.h b/include/asm-i386/setup.h
index 8814b54c75d4..7a32184d54bf 100644
--- a/include/asm-i386/setup.h
+++ b/include/asm-i386/setup.h
@@ -16,7 +16,7 @@
 #define MAXMEM_PFN      PFN_DOWN(MAXMEM)
 #define MAX_NONPAE_PFN  (1 << 20)
 
-#define PARAM_SIZE 2048
+#define PARAM_SIZE 4096
 #define COMMAND_LINE_SIZE 256
 
 #define OLD_CL_MAGIC_ADDR       0x90020
diff --git a/include/asm-i386/signal.h b/include/asm-i386/signal.h
index 7ef343b6812d..0f082bd1c455 100644
--- a/include/asm-i386/signal.h
+++ b/include/asm-i386/signal.h
@@ -110,20 +110,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-i386/string.h b/include/asm-i386/string.h
index 1679983d053f..6a78ac58c194 100644
--- a/include/asm-i386/string.h
+++ b/include/asm-i386/string.h
@@ -198,47 +198,80 @@ static inline void * __memcpy(void * to, const void * from, size_t n)
 int d0, d1, d2;
 __asm__ __volatile__(
         "rep ; movsl\n\t"
-        "testb $2,%b4\n\t"
-        "je 1f\n\t"
-        "movsw\n"
-        "1:\ttestb $1,%b4\n\t"
-        "je 2f\n\t"
-        "movsb\n"
-        "2:"
+        "movl %4,%%ecx\n\t"
+        "andl $3,%%ecx\n\t"
+#if 1   /* want to pay 2 byte penalty for a chance to skip microcoded rep? */
+        "jz 1f\n\t"
+#endif
+        "rep ; movsb\n\t"
+        "1:"
         : "=&c" (d0), "=&D" (d1), "=&S" (d2)
-        :"0" (n/4), "q" (n),"1" ((long) to),"2" ((long) from)
+        : "0" (n/4), "g" (n), "1" ((long) to), "2" ((long) from)
         : "memory");
 return (to);
 }
 
 /*
- * This looks horribly ugly, but the compiler can optimize it totally,
+ * This looks ugly, but the compiler can optimize it totally,
  * as the count is constant.
  */
 static inline void * __constant_memcpy(void * to, const void * from, size_t n)
 {
-        if (n <= 128)
-                return __builtin_memcpy(to, from, n);
-
-#define COMMON(x) \
-__asm__ __volatile__( \
-        "rep ; movsl" \
-        x \
-        : "=&c" (d0), "=&D" (d1), "=&S" (d2) \
-        : "0" (n/4),"1" ((long) to),"2" ((long) from) \
-        : "memory");
-{
-        int d0, d1, d2;
+        long esi, edi;
+        if (!n) return to;
+#if 1   /* want to do small copies with non-string ops? */
+        switch (n) {
+                case 1: *(char*)to = *(char*)from; return to;
+                case 2: *(short*)to = *(short*)from; return to;
+                case 4: *(int*)to = *(int*)from; return to;
+#if 1   /* including those doable with two moves? */
+                case 3: *(short*)to = *(short*)from;
+                        *((char*)to+2) = *((char*)from+2); return to;
+                case 5: *(int*)to = *(int*)from;
+                        *((char*)to+4) = *((char*)from+4); return to;
+                case 6: *(int*)to = *(int*)from;
+                        *((short*)to+2) = *((short*)from+2); return to;
+                case 8: *(int*)to = *(int*)from;
+                        *((int*)to+1) = *((int*)from+1); return to;
+#endif
+        }
+#endif
+        esi = (long) from;
+        edi = (long) to;
+        if (n >= 5*4) {
+                /* large block: use rep prefix */
+                int ecx;
+                __asm__ __volatile__(
+                        "rep ; movsl"
+                        : "=&c" (ecx), "=&D" (edi), "=&S" (esi)
+                        : "0" (n/4), "1" (edi),"2" (esi)
+                        : "memory"
+                );
+        } else {
+                /* small block: don't clobber ecx + smaller code */
+                if (n >= 4*4) __asm__ __volatile__("movsl"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+                if (n >= 3*4) __asm__ __volatile__("movsl"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+                if (n >= 2*4) __asm__ __volatile__("movsl"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+                if (n >= 1*4) __asm__ __volatile__("movsl"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+        }
         switch (n % 4) {
-                case 0: COMMON(""); return to;
-                case 1: COMMON("\n\tmovsb"); return to;
-                case 2: COMMON("\n\tmovsw"); return to;
-                default: COMMON("\n\tmovsw\n\tmovsb"); return to;
+                /* tail */
+                case 0: return to;
+                case 1: __asm__ __volatile__("movsb"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+                        return to;
+                case 2: __asm__ __volatile__("movsw"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+                        return to;
+                default: __asm__ __volatile__("movsw\n\tmovsb"
+                        :"=&D"(edi),"=&S"(esi):"0"(edi),"1"(esi):"memory");
+                        return to;
         }
 }
-  
-#undef COMMON
-}
 
 #define __HAVE_ARCH_MEMCPY
 
diff --git a/include/asm-i386/system.h b/include/asm-i386/system.h
index 6f74d4c44a0e..3db717a244f0 100644
--- a/include/asm-i386/system.h
+++ b/include/asm-i386/system.h
@@ -81,7 +81,7 @@ static inline unsigned long _get_base(char * addr)
 #define loadsegment(seg,value)                  \
         asm volatile("\n"                       \
                 "1:\t"                          \
-                "movl %0,%%" #seg "\n"          \
+                "mov %0,%%" #seg "\n"           \
                 "2:\n"                          \
                 ".section .fixup,\"ax\"\n"      \
                 "3:\t"                          \
@@ -93,13 +93,13 @@ static inline unsigned long _get_base(char * addr)
                 ".align 4\n\t"                  \
                 ".long 1b,3b\n"                 \
                 ".previous"                     \
-                : :"m" (*(unsigned int *)&(value)))
+                : :"m" (value))
 
 /*
  * Save a segment register away
  */
 #define savesegment(seg, value) \
-        asm volatile("movl %%" #seg ",%0":"=m" (*(int *)&(value)))
+        asm volatile("mov %%" #seg ",%0":"=m" (value))
 
 /*
  * Clear and set 'TS' bit respectively
diff --git a/include/asm-ia64/bug.h b/include/asm-ia64/bug.h
index 2c0cd51e8856..3aa0a0a5474b 100644
--- a/include/asm-ia64/bug.h
+++ b/include/asm-ia64/bug.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_IA64_BUG_H
 #define _ASM_IA64_BUG_H
 
+#ifdef CONFIG_BUG
 #if (__GNUC__ > 3) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1)
 # define ia64_abort()   __builtin_trap()
 #else
@@ -8,8 +9,10 @@
 #endif
 #define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0)
 
-/* should this BUG should be made generic? */
+/* should this BUG be made generic? */
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-ia64/siginfo.h b/include/asm-ia64/siginfo.h
index d55f139cbcdc..9294e4b0c8bc 100644
--- a/include/asm-ia64/siginfo.h
+++ b/include/asm-ia64/siginfo.h
@@ -8,9 +8,7 @@
  *      David Mosberger-Tang <davidm@hpl.hp.com>, Hewlett-Packard Co
  */
 
-#define SI_PAD_SIZE     ((SI_MAX_SIZE/sizeof(int)) - 4)
-
-#define SIGEV_PAD_SIZE  ((SIGEV_MAX_SIZE/sizeof(int)) - 4)
+#define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
 
 #define HAVE_ARCH_SIGINFO_T
 #define HAVE_ARCH_COPY_SIGINFO
diff --git a/include/asm-ia64/signal.h b/include/asm-ia64/signal.h
index 660a759744dd..85a577ae9146 100644
--- a/include/asm-ia64/signal.h
+++ b/include/asm-ia64/signal.h
@@ -114,16 +114,6 @@
 #define _NSIG_BPW       64
 #define _NSIG_WORDS     (_NSIG / _NSIG_BPW)
 
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
 #define SA_PERCPU_IRQ           0x02000000
 
 #endif /* __KERNEL__ */
diff --git a/include/asm-m32r/signal.h b/include/asm-m32r/signal.h
index ce46eaea4494..6e55fd421883 100644
--- a/include/asm-m32r/signal.h
+++ b/include/asm-m32r/signal.h
@@ -114,20 +114,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-m68k/bug.h b/include/asm-m68k/bug.h
index 3e1d2266fa69..072ce274d537 100644
--- a/include/asm-m68k/bug.h
+++ b/include/asm-m68k/bug.h
@@ -3,6 +3,7 @@
 
 #include <linux/config.h>
 
+#ifdef CONFIG_BUG
 #ifdef CONFIG_DEBUG_BUGVERBOSE
 #ifndef CONFIG_SUN3
 #define BUG() do { \
@@ -22,6 +23,8 @@
 #endif
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-m68k/signal.h b/include/asm-m68k/signal.h
index 6681bb6a5523..1d016e9f19bf 100644
--- a/include/asm-m68k/signal.h
+++ b/include/asm-m68k/signal.h
@@ -105,19 +105,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-m68knommu/MC68328.h b/include/asm-m68knommu/MC68328.h
index 4f5a9845f5be..a337e56d09bf 100644
--- a/include/asm-m68knommu/MC68328.h
+++ b/include/asm-m68knommu/MC68328.h
@@ -993,7 +993,7 @@ typedef volatile struct {
   volatile unsigned short int pad1;
   volatile unsigned short int pad2;
   volatile unsigned short int pad3;
-} m68328_uart __attribute__((packed));
+} __attribute__((packed)) m68328_uart;
 
 
 /**********
diff --git a/include/asm-m68knommu/MC68EZ328.h b/include/asm-m68knommu/MC68EZ328.h
index 801933da4c70..69b7f9139e5e 100644
--- a/include/asm-m68knommu/MC68EZ328.h
+++ b/include/asm-m68knommu/MC68EZ328.h
@@ -815,7 +815,7 @@ typedef volatile struct {
   volatile unsigned short int nipr;
   volatile unsigned short int pad1;
   volatile unsigned short int pad2;
-} m68328_uart __attribute__((packed));
+} __attribute__((packed)) m68328_uart;
 
 
 /**********
diff --git a/include/asm-m68knommu/MC68VZ328.h b/include/asm-m68knommu/MC68VZ328.h
index df74322f37ed..2b9bf626a0a5 100644
--- a/include/asm-m68knommu/MC68VZ328.h
+++ b/include/asm-m68knommu/MC68VZ328.h
@@ -909,7 +909,7 @@ typedef struct {
   volatile unsigned short int nipr;
   volatile unsigned short int hmark;
   volatile unsigned short int unused;
-} m68328_uart __attribute__((packed));
+} __attribute__((packed)) m68328_uart;
 
 
 
diff --git a/include/asm-m68knommu/signal.h b/include/asm-m68knommu/signal.h
index 486cbb0dc088..37c9c8a024ba 100644
--- a/include/asm-m68knommu/signal.h
+++ b/include/asm-m68knommu/signal.h
@@ -105,19 +105,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-mips/bug.h b/include/asm-mips/bug.h
index eb94bb96cfbc..3f594b440abc 100644
--- a/include/asm-mips/bug.h
+++ b/include/asm-mips/bug.h
@@ -3,12 +3,14 @@
 
 #include <asm/break.h>
 
+#ifdef CONFIG_BUG
+#define HAVE_ARCH_BUG
 #define BUG()                                                           \
 do {                                                                    \
         __asm__ __volatile__("break %0" : : "i" (BRK_BUG));             \
 } while (0)
+#endif
 
-#define HAVE_ARCH_BUG
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-mips/errno.h b/include/asm-mips/errno.h
index 2b458f9538cd..3c0d840e4577 100644
--- a/include/asm-mips/errno.h
+++ b/include/asm-mips/errno.h
@@ -115,6 +115,10 @@
 #define EKEYREVOKED     163     /* Key has been revoked */
 #define EKEYREJECTED    164     /* Key was rejected by service */
 
+/* for robust mutexes */
+#define EOWNERDEAD      165     /* Owner died */
+#define ENOTRECOVERABLE 166     /* State not recoverable */
+
 #define EDQUOT          1133    /* Quota exceeded */
 
 #ifdef __KERNEL__
diff --git a/include/asm-mips/siginfo.h b/include/asm-mips/siginfo.h
index 8ddd3c99bcf7..a0e26e6c994d 100644
--- a/include/asm-mips/siginfo.h
+++ b/include/asm-mips/siginfo.h
@@ -11,8 +11,6 @@
 
 #include <linux/config.h>
 
-#define SIGEV_HEAD_SIZE (sizeof(long) + 2*sizeof(int))
-#define SIGEV_PAD_SIZE  ((SIGEV_MAX_SIZE-SIGEV_HEAD_SIZE) / sizeof(int))
 #undef __ARCH_SI_TRAPNO /* exception code needs to fill this ...  */
 
 #define HAVE_ARCH_SIGINFO_T
diff --git a/include/asm-mips/signal.h b/include/asm-mips/signal.h
index 994987db61be..d81356731eb6 100644
--- a/include/asm-mips/signal.h
+++ b/include/asm-mips/signal.h
@@ -98,21 +98,6 @@ typedef unsigned long old_sigset_t;		/* at least 32 bits */
 #define MINSIGSTKSZ    2048
 #define SIGSTKSZ       8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ flag is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x02000000
-
-#endif /* __KERNEL__ */
-
 #define SIG_BLOCK       1       /* for blocking signals */
 #define SIG_UNBLOCK     2       /* for unblocking signals */
 #define SIG_SETMASK     3       /* for setting the signal mask */
diff --git a/include/asm-parisc/bug.h b/include/asm-parisc/bug.h
index e72f6e2b4b9f..695588da41f8 100644
--- a/include/asm-parisc/bug.h
+++ b/include/asm-parisc/bug.h
@@ -1,12 +1,14 @@
 #ifndef _PARISC_BUG_H
 #define _PARISC_BUG_H
 
+#ifdef CONFIG_BUG
 #define HAVE_ARCH_BUG
 #define BUG() do { \
         printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
         dump_stack(); \
         panic("BUG!"); \
 } while (0)
+#endif
 
 #include <asm-generic/bug.h>
 #endif
diff --git a/include/asm-parisc/errno.h b/include/asm-parisc/errno.h
index a10f109770f1..08464c405471 100644
--- a/include/asm-parisc/errno.h
+++ b/include/asm-parisc/errno.h
@@ -115,5 +115,9 @@
 #define ENOTSUP         252     /* Function not implemented (POSIX.4 / HPUX) */
 #define ECANCELLED      253     /* aio request was canceled before complete (POSIX.4 / HPUX) */
 
+/* for robust mutexes */
+#define EOWNERDEAD      254     /* Owner died */
+#define ENOTRECOVERABLE 255     /* State not recoverable */
+
 
 #endif
diff --git a/include/asm-parisc/signal.h b/include/asm-parisc/signal.h
index 358f577c8eb8..25cb23ef7dd1 100644
--- a/include/asm-parisc/signal.h
+++ b/include/asm-parisc/signal.h
@@ -89,17 +89,6 @@
 #define _NSIG_BPW       BITS_PER_LONG
 #define _NSIG_WORDS     (_NSIG / _NSIG_BPW)
 
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-
 #endif /* __KERNEL__ */
 
 #define SIG_BLOCK          0    /* for blocking signals */
diff --git a/include/asm-parisc/uaccess.h b/include/asm-parisc/uaccess.h
index 8a08423b7570..c1b5bdea53ee 100644
--- a/include/asm-parisc/uaccess.h
+++ b/include/asm-parisc/uaccess.h
@@ -24,7 +24,7 @@
 
 /*
  * Note that since kernel addresses are in a separate address space on
- * parisc, we don't need to do anything for access_ok() or verify_area().
+ * parisc, we don't need to do anything for access_ok().
  * We just let the page fault handler do the right thing. This also means
  * that put_user is the same as __put_user, etc.
  */
diff --git a/include/asm-ppc/bug.h b/include/asm-ppc/bug.h
index e99c6cb9d618..8b34fd682b0d 100644
--- a/include/asm-ppc/bug.h
+++ b/include/asm-ppc/bug.h
@@ -14,6 +14,7 @@ struct bug_entry {
  */
 #define BUG_WARNING_TRAP        0x1000000
 
+#ifdef CONFIG_BUG
 #define BUG() do {                                                       \
         __asm__ __volatile__(                                            \
                 "1:     twi 31,0,0\n"                                    \
@@ -50,6 +51,8 @@ struct bug_entry {
 #define HAVE_ARCH_BUG
 #define HAVE_ARCH_BUG_ON
 #define HAVE_ARCH_WARN_ON
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-ppc/pmac_feature.h b/include/asm-ppc/pmac_feature.h
index 639b690ce6f7..8beb162873f4 100644
--- a/include/asm-ppc/pmac_feature.h
+++ b/include/asm-ppc/pmac_feature.h
@@ -316,6 +316,9 @@ extern void pmac_register_agp_pm(struct pci_dev *bridge,
 extern void pmac_suspend_agp_for_card(struct pci_dev *dev);
 extern void pmac_resume_agp_for_card(struct pci_dev *dev);
 
+/* Used by the via-pmu driver for suspend/resume
+ */
+extern void pmac_tweak_clock_spreading(int enable);
 
 /*
  * The part below is for use by macio_asic.c only, do not rely
diff --git a/include/asm-ppc/reg_booke.h b/include/asm-ppc/reg_booke.h
index e70c25f3c339..45c5e6f2b7ab 100644
--- a/include/asm-ppc/reg_booke.h
+++ b/include/asm-ppc/reg_booke.h
@@ -305,6 +305,7 @@ do {						\
 #define ESR_PIL         0x08000000      /* Program Exception - Illegal */
 #define ESR_PPR         0x04000000      /* Program Exception - Priveleged */
 #define ESR_PTR         0x02000000      /* Program Exception - Trap */
+#define ESR_FP          0x01000000      /* Floating Point Operation */
 #define ESR_DST         0x00800000      /* Storage Exception - Data miss */
 #define ESR_DIZ         0x00400000      /* Storage Exception - Zone fault */
 #define ESR_ST          0x00800000      /* Store Operation */
diff --git a/include/asm-ppc/signal.h b/include/asm-ppc/signal.h
index 8cc8b88d4edd..d890dabd5a69 100644
--- a/include/asm-ppc/signal.h
+++ b/include/asm-ppc/signal.h
@@ -99,19 +99,6 @@ typedef struct {
 
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif /* __KERNEL__ */
 
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
diff --git a/include/asm-ppc64/a.out.h b/include/asm-ppc64/a.out.h
index 802338efcb19..3871e252a6f1 100644
--- a/include/asm-ppc64/a.out.h
+++ b/include/asm-ppc64/a.out.h
@@ -1,8 +1,6 @@
 #ifndef __PPC64_A_OUT_H__
 #define __PPC64_A_OUT_H__
 
-#include <asm/ppcdebug.h>
-
 /*
  * c 2001 PPC 64 Team, IBM Corp
  *
diff --git a/include/asm-ppc64/bug.h b/include/asm-ppc64/bug.h
index db31dd22233c..169868fa307d 100644
--- a/include/asm-ppc64/bug.h
+++ b/include/asm-ppc64/bug.h
@@ -26,6 +26,8 @@ struct bug_entry *find_bug(unsigned long bugaddr);
  */
 #define BUG_WARNING_TRAP        0x1000000
 
+#ifdef CONFIG_BUG
+
 #define BUG() do {                                                       \
         __asm__ __volatile__(                                            \
                 "1:     twi 31,0,0\n"                                    \
@@ -55,11 +57,12 @@ struct bug_entry *find_bug(unsigned long bugaddr);
                     "i" (__FILE__), "i" (__FUNCTION__));        \
 } while (0)
 
-#endif
-
 #define HAVE_ARCH_BUG
 #define HAVE_ARCH_BUG_ON
 #define HAVE_ARCH_WARN_ON
+#endif
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-ppc64/elf.h b/include/asm-ppc64/elf.h
index 8457d90244fb..6c42d61bedd1 100644
--- a/include/asm-ppc64/elf.h
+++ b/include/asm-ppc64/elf.h
@@ -229,9 +229,13 @@ do {								\
 
 /*
  * An executable for which elf_read_implies_exec() returns TRUE will
- * have the READ_IMPLIES_EXEC personality flag set automatically.
+ * have the READ_IMPLIES_EXEC personality flag set automatically. This
+ * is only required to work around bugs in old 32bit toolchains. Since
+ * the 64bit ABI has never had these issues dont enable the workaround
+ * even if we have an executable stack.
  */
-#define elf_read_implies_exec(ex, exec_stk)     (exec_stk != EXSTACK_DISABLE_X)
+#define elf_read_implies_exec(ex, exec_stk) (test_thread_flag(TIF_32BIT) ? \
+                (exec_stk != EXSTACK_DISABLE_X) : 0)
 
 #endif
 
diff --git a/include/asm-ppc64/page.h b/include/asm-ppc64/page.h
index 20e0f19324e8..86219574c1a5 100644
--- a/include/asm-ppc64/page.h
+++ b/include/asm-ppc64/page.h
@@ -252,10 +252,19 @@ extern u64 ppc64_pft_size;		/* Log 2 of page table size */
 
 /*
  * This is the default if a program doesn't have a PT_GNU_STACK
- * program header entry.
+ * program header entry. The PPC64 ELF ABI has a non executable stack
+ * stack by default, so in the absense of a PT_GNU_STACK program header
+ * we turn execute permission off.
  */
-#define VM_STACK_DEFAULT_FLAGS  (VM_READ | VM_WRITE | VM_EXEC | \
-                                 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+#define VM_STACK_DEFAULT_FLAGS32        (VM_READ | VM_WRITE | VM_EXEC | \
+                                         VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+
+#define VM_STACK_DEFAULT_FLAGS64        (VM_READ | VM_WRITE | \
+                                         VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+
+#define VM_STACK_DEFAULT_FLAGS \
+        (test_thread_flag(TIF_32BIT) ? \
+         VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
 
 #endif /* __KERNEL__ */
 #endif /* _PPC64_PAGE_H */
diff --git a/include/asm-ppc64/pgalloc.h b/include/asm-ppc64/pgalloc.h
index 16232d740173..4fc4b739b380 100644
--- a/include/asm-ppc64/pgalloc.h
+++ b/include/asm-ppc64/pgalloc.h
@@ -27,7 +27,7 @@ pgd_free(pgd_t *pgd)
         kmem_cache_free(zero_cache, pgd);
 }
 
-#define pgd_populate(MM, PGD, PMD)      pgd_set(PGD, PMD)
+#define pud_populate(MM, PUD, PMD)      pud_set(PUD, PMD)
 
 static inline pmd_t *
 pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
diff --git a/include/asm-ppc64/pgtable.h b/include/asm-ppc64/pgtable.h
index a26120517c54..b984e2747e0c 100644
--- a/include/asm-ppc64/pgtable.h
+++ b/include/asm-ppc64/pgtable.h
@@ -1,8 +1,6 @@
 #ifndef _PPC64_PGTABLE_H
 #define _PPC64_PGTABLE_H
 
-#include <asm-generic/4level-fixup.h>
-
 /*
  * This file contains the functions and defines necessary to modify and use
  * the ppc64 hashed page table.
@@ -17,6 +15,8 @@
 #include <asm/tlbflush.h>
 #endif /* __ASSEMBLY__ */
 
+#include <asm-generic/pgtable-nopud.h>
+
 /* PMD_SHIFT determines what a second-level page table entry can map */
 #define PMD_SHIFT       (PAGE_SHIFT + PAGE_SHIFT - 3)
 #define PMD_SIZE        (1UL << PMD_SHIFT)
@@ -228,12 +228,13 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm);
 #define pmd_page_kernel(pmd)    \
         (__bpn_to_ba(pmd_val(pmd) >> PMD_TO_PTEPAGE_SHIFT))
 #define pmd_page(pmd)           virt_to_page(pmd_page_kernel(pmd))
-#define pgd_set(pgdp, pmdp)     (pgd_val(*(pgdp)) = (__ba_to_bpn(pmdp)))
-#define pgd_none(pgd)           (!pgd_val(pgd))
-#define pgd_bad(pgd)            ((pgd_val(pgd)) == 0)
-#define pgd_present(pgd)        (pgd_val(pgd) != 0UL)
-#define pgd_clear(pgdp)         (pgd_val(*(pgdp)) = 0UL)
-#define pgd_page(pgd)           (__bpn_to_ba(pgd_val(pgd))) 
+
+#define pud_set(pudp, pmdp)     (pud_val(*(pudp)) = (__ba_to_bpn(pmdp)))
+#define pud_none(pud)           (!pud_val(pud))
+#define pud_bad(pud)            ((pud_val(pud)) == 0UL)
+#define pud_present(pud)        (pud_val(pud) != 0UL)
+#define pud_clear(pudp)         (pud_val(*(pudp)) = 0UL)
+#define pud_page(pud)           (__bpn_to_ba(pud_val(pud)))
 
 /* 
  * Find an entry in a page-table-directory.  We combine the address region 
@@ -245,12 +246,13 @@ void hugetlb_mm_free_pgd(struct mm_struct *mm);
 #define pgd_offset(mm, address)  ((mm)->pgd + pgd_index(address))
 
 /* Find an entry in the second-level page table.. */
-#define pmd_offset(dir,addr) \
-  ((pmd_t *) pgd_page(*(dir)) + (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1)))
+#define pmd_offset(pudp,addr) \
+  ((pmd_t *) pud_page(*(pudp)) + (((addr) >> PMD_SHIFT) & (PTRS_PER_PMD - 1)))
 
 /* Find an entry in the third-level page table.. */
 #define pte_offset_kernel(dir,addr) \
-  ((pte_t *) pmd_page_kernel(*(dir)) + (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)))
+  ((pte_t *) pmd_page_kernel(*(dir)) \
+ + (((addr) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)))
 
 #define pte_offset_map(dir,addr)        pte_offset_kernel((dir), (addr))
 #define pte_offset_map_nested(dir,addr) pte_offset_kernel((dir), (addr))
@@ -582,19 +584,22 @@ extern long native_hpte_insert(unsigned long hpte_group, unsigned long va,
 static inline pte_t *find_linux_pte(pgd_t *pgdir, unsigned long ea)
 {
         pgd_t *pg;
+        pud_t *pu;
         pmd_t *pm;
         pte_t *pt = NULL;
         pte_t pte;
 
         pg = pgdir + pgd_index(ea);
         if (!pgd_none(*pg)) {
-
-                pm = pmd_offset(pg, ea);
-                if (pmd_present(*pm)) { 
-                        pt = pte_offset_kernel(pm, ea);
-                        pte = *pt;
-                        if (!pte_present(pte))
-                                pt = NULL;
+                pu = pud_offset(pg, ea);
+                if (!pud_none(*pu)) {
+                        pm = pmd_offset(pu, ea);
+                        if (pmd_present(*pm)) {
+                                pt = pte_offset_kernel(pm, ea);
+                                pte = *pt;
+                                if (!pte_present(pte))
+                                        pt = NULL;
+                        }
                 }
         }
 
diff --git a/include/asm-ppc64/signal.h b/include/asm-ppc64/signal.h
index fe5401adb41b..a2d7bbb4befd 100644
--- a/include/asm-ppc64/signal.h
+++ b/include/asm-ppc64/signal.h
@@ -96,19 +96,6 @@ typedef struct {
 
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
 
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
diff --git a/include/asm-ppc64/spinlock.h b/include/asm-ppc64/spinlock.h
index a9b2a1162cf7..acd11564dd75 100644
--- a/include/asm-ppc64/spinlock.h
+++ b/include/asm-ppc64/spinlock.h
@@ -110,7 +110,7 @@ static void __inline__ _raw_spin_lock(spinlock_t *lock)
                         HMT_low();
                         if (SHARED_PROCESSOR)
                                 __spin_yield(lock);
-                } while (likely(lock->lock != 0));
+                } while (unlikely(lock->lock != 0));
                 HMT_medium();
         }
 }
@@ -128,7 +128,7 @@ static void __inline__ _raw_spin_lock_flags(spinlock_t *lock, unsigned long flag
                         HMT_low();
                         if (SHARED_PROCESSOR)
                                 __spin_yield(lock);
-                } while (likely(lock->lock != 0));
+                } while (unlikely(lock->lock != 0));
                 HMT_medium();
                 local_irq_restore(flags_dis);
         }
@@ -194,7 +194,7 @@ static void __inline__ _raw_read_lock(rwlock_t *rw)
                         HMT_low();
                         if (SHARED_PROCESSOR)
                                 __rw_yield(rw);
-                } while (likely(rw->lock < 0));
+                } while (unlikely(rw->lock < 0));
                 HMT_medium();
         }
 }
@@ -251,7 +251,7 @@ static void __inline__ _raw_write_lock(rwlock_t *rw)
                         HMT_low();
                         if (SHARED_PROCESSOR)
                                 __rw_yield(rw);
-                } while (likely(rw->lock != 0));
+                } while (unlikely(rw->lock != 0));
                 HMT_medium();
         }
 }
diff --git a/include/asm-s390/bug.h b/include/asm-s390/bug.h
index 2b8d6d4dffcf..a2e7430aafa6 100644
--- a/include/asm-s390/bug.h
+++ b/include/asm-s390/bug.h
@@ -3,12 +3,15 @@
 
 #include <linux/kernel.h>
 
+#ifdef CONFIG_BUG
 #define BUG() do { \
         printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \
         __asm__ __volatile__(".long 0"); \
 } while (0)
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-s390/cmb.h b/include/asm-s390/cmb.h
index 1bfe2bd630b5..dae1dd4fb937 100644
--- a/include/asm-s390/cmb.h
+++ b/include/asm-s390/cmb.h
@@ -52,7 +52,7 @@ struct cmbdata {
 #define BIODASDREADALLCMB       _IOWR(DASD_IOCTL_LETTER,33,struct cmbdata)
 
 #ifdef __KERNEL__
-
+struct ccw_device;
 /**
  * enable_cmf() - switch on the channel measurement for a specific device
  *  @cdev:      The ccw device to be enabled
diff --git a/include/asm-s390/debug.h b/include/asm-s390/debug.h
index 28ef2354b1b2..6bbcdea42a86 100644
--- a/include/asm-s390/debug.h
+++ b/include/asm-s390/debug.h
@@ -43,7 +43,7 @@ struct __debug_entry{
 #define DEBUG_OFF_LEVEL            -1 /* level where debug is switched off */
 #define DEBUG_FLUSH_ALL            -1 /* parameter to flush all areas */
 #define DEBUG_MAX_VIEWS            10 /* max number of views in proc fs */
-#define DEBUG_MAX_PROCF_LEN        16 /* max length for a proc file name */
+#define DEBUG_MAX_PROCF_LEN        64 /* max length for a proc file name */
 #define DEBUG_DEFAULT_LEVEL        3  /* initial debug level */
 
 #define DEBUG_DIR_ROOT "s390dbf" /* name of debug root directory in proc fs */
diff --git a/include/asm-s390/page.h b/include/asm-s390/page.h
index 614e2a93c703..2be287b9df88 100644
--- a/include/asm-s390/page.h
+++ b/include/asm-s390/page.h
@@ -16,6 +16,8 @@
 #define PAGE_SHIFT      12
 #define PAGE_SIZE       (1UL << PAGE_SHIFT)
 #define PAGE_MASK       (~(PAGE_SIZE-1))
+#define PAGE_DEFAULT_ACC        0
+#define PAGE_DEFAULT_KEY        (PAGE_DEFAULT_ACC << 4)
 
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
diff --git a/include/asm-s390/processor.h b/include/asm-s390/processor.h
index 88c272ca48bf..fb46e9090b50 100644
--- a/include/asm-s390/processor.h
+++ b/include/asm-s390/processor.h
@@ -245,7 +245,7 @@ static inline void enabled_wait(void)
         psw_t wait_psw;
 
         wait_psw.mask = PSW_BASE_BITS | PSW_MASK_IO | PSW_MASK_EXT |
-                PSW_MASK_MCHECK | PSW_MASK_WAIT;
+                PSW_MASK_MCHECK | PSW_MASK_WAIT | PSW_DEFAULT_KEY;
 #ifndef __s390x__
         asm volatile (
                 "    basr %0,0\n"
diff --git a/include/asm-s390/ptrace.h b/include/asm-s390/ptrace.h
index 1dc80666e97e..4eff8f2e3bf1 100644
--- a/include/asm-s390/ptrace.h
+++ b/include/asm-s390/ptrace.h
@@ -185,6 +185,7 @@
 #include <linux/stddef.h>
 #include <linux/types.h>
 #include <asm/setup.h>
+#include <asm/page.h>
 
 typedef union
 {
@@ -235,6 +236,7 @@ typedef struct
 #define PSW_ADDR_INSN           0x7FFFFFFFUL
 
 #define PSW_BASE_BITS           0x00080000UL
+#define PSW_DEFAULT_KEY         (((unsigned long) PAGE_DEFAULT_ACC) << 20)
 
 #define PSW_ASC_PRIMARY         0x00000000UL
 #define PSW_ASC_ACCREG          0x00004000UL
@@ -260,6 +262,7 @@ typedef struct
 
 #define PSW_BASE_BITS           0x0000000180000000UL
 #define PSW_BASE32_BITS         0x0000000080000000UL
+#define PSW_DEFAULT_KEY         (((unsigned long) PAGE_DEFAULT_ACC) << 52)
 
 #define PSW_ASC_PRIMARY         0x0000000000000000UL
 #define PSW_ASC_ACCREG          0x0000400000000000UL
@@ -268,14 +271,15 @@ typedef struct
 
 #define PSW_USER32_BITS (PSW_BASE32_BITS | PSW_MASK_DAT | PSW_ASC_HOME | \
                          PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK | \
-                         PSW_MASK_PSTATE)
+                         PSW_MASK_PSTATE | PSW_DEFAULT_KEY)
 
 #endif /* __s390x__ */
 
-#define PSW_KERNEL_BITS (PSW_BASE_BITS | PSW_MASK_DAT | PSW_ASC_PRIMARY)
+#define PSW_KERNEL_BITS (PSW_BASE_BITS | PSW_MASK_DAT | PSW_ASC_PRIMARY | \
+                         PSW_DEFAULT_KEY)
 #define PSW_USER_BITS   (PSW_BASE_BITS | PSW_MASK_DAT | PSW_ASC_HOME | \
                          PSW_MASK_IO | PSW_MASK_EXT | PSW_MASK_MCHECK | \
-                         PSW_MASK_PSTATE)
+                         PSW_MASK_PSTATE | PSW_DEFAULT_KEY)
 
 /* This macro merges a NEW PSW mask specified by the user into
    the currently active PSW mask CURRENT, modifying only those
@@ -470,6 +474,12 @@ struct user_regs_struct
 extern void show_regs(struct pt_regs * regs);
 #endif
 
+static inline void
+psw_set_key(unsigned int key)
+{
+        asm volatile ( "spka 0(%0)" : : "d" (key) );
+}
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* _S390_PTRACE_H */
diff --git a/include/asm-s390/siginfo.h b/include/asm-s390/siginfo.h
index 72303537b732..e0ff1ab054be 100644
--- a/include/asm-s390/siginfo.h
+++ b/include/asm-s390/siginfo.h
@@ -13,12 +13,6 @@
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
 #endif
 
-#ifdef CONFIG_ARCH_S390X
-#define SIGEV_PAD_SIZE ((SIGEV_MAX_SIZE/sizeof(int)) - 4)
-#else
-#define SIGEV_PAD_SIZE ((SIGEV_MAX_SIZE/sizeof(int)) - 3)
-#endif
-
 #include <asm-generic/siginfo.h>
 
 #endif
diff --git a/include/asm-s390/signal.h b/include/asm-s390/signal.h
index f273cdcd1cf6..bfed83a818cc 100644
--- a/include/asm-s390/signal.h
+++ b/include/asm-s390/signal.h
@@ -117,20 +117,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-sh/bug.h b/include/asm-sh/bug.h
index 70172217140f..70508a360cd6 100644
--- a/include/asm-sh/bug.h
+++ b/include/asm-sh/bug.h
@@ -3,6 +3,7 @@
 
 #include <linux/config.h>
 
+#ifdef CONFIG_BUG
 /*
  * Tell the user there is some problem.
  */
@@ -12,6 +13,8 @@
 } while (0)
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-sh/checksum.h b/include/asm-sh/checksum.h
index 5113c7f8a739..5ebd0f24299e 100644
--- a/include/asm-sh/checksum.h
+++ b/include/asm-sh/checksum.h
@@ -42,7 +42,7 @@ asmlinkage unsigned int csum_partial_copy_generic(const unsigned char *src, unsi
  *      passed in an incorrect kernel address to one of these functions. 
  *      
  *      If you use these functions directly please don't forget the 
- *      verify_area().
+ *      access_ok().
  */
 static __inline__
 unsigned int csum_partial_copy_nocheck (const unsigned char *src, unsigned char *dst,
diff --git a/include/asm-sh/signal.h b/include/asm-sh/signal.h
index 0a7ff717c245..29f1ac1bf4df 100644
--- a/include/asm-sh/signal.h
+++ b/include/asm-sh/signal.h
@@ -108,20 +108,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-sh64/bug.h b/include/asm-sh64/bug.h
index 3acd54d59566..5d659ec28e10 100644
--- a/include/asm-sh64/bug.h
+++ b/include/asm-sh64/bug.h
@@ -17,10 +17,6 @@
                 BUG(); \
 } while(0)
 
-#define PAGE_BUG(page) do { \
-        BUG(); \
-} while (0)
-
 #define WARN_ON(condition) do { \
         if (unlikely((condition)!=0)) { \
                 printk("Badness in %s at %s:%d\n", __FUNCTION__, __FILE__, __LINE__); \
diff --git a/include/asm-sh64/checksum.h b/include/asm-sh64/checksum.h
index aa3911a99490..fd034e9ae6e3 100644
--- a/include/asm-sh64/checksum.h
+++ b/include/asm-sh64/checksum.h
@@ -34,7 +34,7 @@ asmlinkage unsigned int csum_partial(const unsigned char *buff, int len,
  *      passed in an incorrect kernel address to one of these functions.
  *
  *      If you use these functions directly please don't forget the
- *      verify_area().
+ *      access_ok().
  */
 
 
diff --git a/include/asm-sh64/signal.h b/include/asm-sh64/signal.h
index 77957e9b92d9..864c94ecc98c 100644
--- a/include/asm-sh64/signal.h
+++ b/include/asm-sh64/signal.h
@@ -107,20 +107,6 @@ typedef struct {
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        THREAD_SIZE
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-sparc/bug.h b/include/asm-sparc/bug.h
index 0d30a67d87a3..04151208189f 100644
--- a/include/asm-sparc/bug.h
+++ b/include/asm-sparc/bug.h
@@ -1,6 +1,7 @@
 #ifndef _SPARC_BUG_H
 #define _SPARC_BUG_H
 
+#ifdef CONFIG_BUG
 /* Only use the inline asm until a gcc release that can handle __builtin_trap
  * -rob 2003-06-25
  *
@@ -26,6 +27,8 @@ extern void do_BUG(const char *file, int line);
 #endif
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-sparc/errno.h b/include/asm-sparc/errno.h
index 8c01c5f3b06d..ed41c8bac1fa 100644
--- a/include/asm-sparc/errno.h
+++ b/include/asm-sparc/errno.h
@@ -107,4 +107,8 @@
 #define EKEYREVOKED     130     /* Key has been revoked */
 #define EKEYREJECTED    131     /* Key was rejected by service */
 
+/* for robust mutexes */
+#define EOWNERDEAD      132     /* Owner died */
+#define ENOTRECOVERABLE 133     /* State not recoverable */
+
 #endif
diff --git a/include/asm-sparc/signal.h b/include/asm-sparc/signal.h
index d8211cb6e6b4..f792e10e704f 100644
--- a/include/asm-sparc/signal.h
+++ b/include/asm-sparc/signal.h
@@ -143,7 +143,6 @@ struct sigstack {
 #define SA_ONESHOT      _SV_RESET
 #define SA_INTERRUPT    0x10u
 #define SA_NOMASK       0x20u
-#define SA_SHIRQ        0x40u
 #define SA_NOCLDWAIT    0x100u
 #define SA_SIGINFO      0x200u
 
@@ -162,11 +161,6 @@ struct sigstack {
 
 #ifdef __KERNEL__
 /*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- *
  * DJHR
  * SA_STATIC_ALLOC is used for the SPARC system to indicate that this
  * interrupt handler's irq structure should be statically allocated
@@ -177,8 +171,6 @@ struct sigstack {
  * statically allocated data.. which is NOT GOOD.
  *
  */
-#define SA_PROBE SA_ONESHOT
-#define SA_SAMPLE_RANDOM SA_RESTART
 #define SA_STATIC_ALLOC         0x80
 #endif
 
diff --git a/include/asm-sparc/uaccess.h b/include/asm-sparc/uaccess.h
index 3f47889883b7..f461144067ee 100644
--- a/include/asm-sparc/uaccess.h
+++ b/include/asm-sparc/uaccess.h
@@ -18,7 +18,7 @@
 
 #ifndef __ASSEMBLY__
 
-/* Sparc is not segmented, however we need to be able to fool verify_area()
+/* Sparc is not segmented, however we need to be able to fool access_ok()
  * when doing system calls from kernel mode legitimately.
  *
  * "For historical reasons, these macros are grossly misnamed." -Linus
diff --git a/include/asm-sparc64/bug.h b/include/asm-sparc64/bug.h
index 25c5b1dfe378..516bb27f3fc4 100644
--- a/include/asm-sparc64/bug.h
+++ b/include/asm-sparc64/bug.h
@@ -1,6 +1,7 @@
 #ifndef _SPARC64_BUG_H
 #define _SPARC64_BUG_H
 
+#ifdef CONFIG_BUG
 #include <linux/compiler.h>
 
 #ifdef CONFIG_DEBUG_BUGVERBOSE
@@ -14,6 +15,8 @@ extern void do_BUG(const char *file, int line);
 #endif
 
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif
diff --git a/include/asm-sparc64/errno.h b/include/asm-sparc64/errno.h
index cc98a73b55a7..ea3509ee1b0b 100644
--- a/include/asm-sparc64/errno.h
+++ b/include/asm-sparc64/errno.h
@@ -107,4 +107,8 @@
 #define EKEYREVOKED     130     /* Key has been revoked */
 #define EKEYREJECTED    131     /* Key was rejected by service */
 
+/* for robust mutexes */
+#define EOWNERDEAD      132     /* Owner died */
+#define ENOTRECOVERABLE 133     /* State not recoverable */
+
 #endif /* !(_SPARC64_ERRNO_H) */
diff --git a/include/asm-sparc64/siginfo.h b/include/asm-sparc64/siginfo.h
index 7160449e7cab..df17e47abc1c 100644
--- a/include/asm-sparc64/siginfo.h
+++ b/include/asm-sparc64/siginfo.h
@@ -3,8 +3,6 @@
 
 #define SI_PAD_SIZE32   ((SI_MAX_SIZE/sizeof(int)) - 3)
 
-#define SIGEV_PAD_SIZE  ((SIGEV_MAX_SIZE/sizeof(int)) - 4)
-
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
 #define __ARCH_SI_TRAPNO
 #define __ARCH_SI_BAND_T int
diff --git a/include/asm-sparc64/signal.h b/include/asm-sparc64/signal.h
index 6428e366c38c..466d021d7038 100644
--- a/include/asm-sparc64/signal.h
+++ b/include/asm-sparc64/signal.h
@@ -145,7 +145,6 @@ struct sigstack {
 #define SA_ONESHOT      _SV_RESET
 #define SA_INTERRUPT    0x10u
 #define SA_NOMASK       0x20u
-#define SA_SHIRQ        0x40u
 #define SA_NOCLDWAIT    0x100u
 #define SA_SIGINFO      0x200u
 
@@ -165,11 +164,6 @@ struct sigstack {
 
 #ifdef __KERNEL__
 /*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- *
  * DJHR
  * SA_STATIC_ALLOC is used for the SPARC system to indicate that this
  * interrupt handler's irq structure should be statically allocated
@@ -180,8 +174,6 @@ struct sigstack {
  * statically allocated data.. which is NOT GOOD.
  *
  */
-#define SA_PROBE SA_ONESHOT
-#define SA_SAMPLE_RANDOM SA_RESTART
 #define SA_STATIC_ALLOC         0x80
 #endif
 
diff --git a/include/asm-um/common.lds.S b/include/asm-um/common.lds.S
index a3d6aab0e74d..1010153faaf9 100644
--- a/include/asm-um/common.lds.S
+++ b/include/asm-um/common.lds.S
@@ -8,11 +8,6 @@
   _sdata = .;
   PROVIDE (sdata = .);
 
-  . = ALIGN(16);                /* Exception table */
-  __start___ex_table = .;
-  __ex_table : { *(__ex_table) }
-  __stop___ex_table = .;
-
   RODATA
 
   .unprotected : { *(.unprotected) }
@@ -20,6 +15,10 @@
   PROVIDE (_unprotected_end = .);
 
   . = ALIGN(4096);
+  __start___ex_table = .;
+  __ex_table : { *(__ex_table) }
+  __stop___ex_table = .;
+
   __uml_setup_start = .;
   .uml.setup.init : { *(.uml.setup.init) }
   __uml_setup_end = .;
diff --git a/include/asm-um/elf.h b/include/asm-um/elf.h
index b3a7258f9971..7908f8fe8231 100644
--- a/include/asm-um/elf.h
+++ b/include/asm-um/elf.h
@@ -13,7 +13,7 @@ extern long elf_aux_hwcap;
 
 #define elf_check_arch(x) (1)
 
-#ifdef CONFIG_64_BIT
+#ifdef CONFIG_64BIT
 #define ELF_CLASS ELFCLASS64
 #else
 #define ELF_CLASS ELFCLASS32
diff --git a/include/asm-um/page.h b/include/asm-um/page.h
index 3620a08dc9f3..102eb3df1aaf 100644
--- a/include/asm-um/page.h
+++ b/include/asm-um/page.h
@@ -27,7 +27,7 @@ struct page;
 #define clear_user_page(page, vaddr, pg)        clear_page(page)
 #define copy_user_page(to, from, vaddr, pg)     copy_page(to, from)
 
-#if defined(CONFIG_3_LEVEL_PGTABLES) && !defined(CONFIG_64_BIT)
+#if defined(CONFIG_3_LEVEL_PGTABLES) && !defined(CONFIG_64BIT)
 
 typedef struct { unsigned long pte_low, pte_high; } pte_t;
 typedef struct { unsigned long long pmd; } pmd_t;
diff --git a/include/asm-um/pgtable-3level.h b/include/asm-um/pgtable-3level.h
index bdbc3f97e20b..d309f3a9e6f6 100644
--- a/include/asm-um/pgtable-3level.h
+++ b/include/asm-um/pgtable-3level.h
@@ -145,7 +145,7 @@ static inline pmd_t pfn_pmd(pfn_t page_nr, pgprot_t pgprot)
  */
 #define PTE_FILE_MAX_BITS       32
 
-#ifdef CONFIG_64_BIT
+#ifdef CONFIG_64BIT
 
 #define pte_to_pgoff(p) ((p).pte >> 32)
 
diff --git a/include/asm-um/processor-generic.h b/include/asm-um/processor-generic.h
index 038ba6fc88b8..b953b1ad3b02 100644
--- a/include/asm-um/processor-generic.h
+++ b/include/asm-um/processor-generic.h
@@ -17,6 +17,10 @@ struct task_struct;
 struct mm_struct;
 
 struct thread_struct {
+        /* This flag is set to 1 before calling do_fork (and analyzed in
+         * copy_thread) to mark that we are begin called from userspace (fork /
+         * vfork / clone), and reset to 0 after. It is left to 0 when called
+         * from kernelspace (i.e. kernel_thread() or fork_idle(), as of 2.6.11). */
         int forking;
         int nsyscalls;
         struct pt_regs regs;
@@ -89,7 +93,11 @@ extern struct task_struct *alloc_task_struct(void);
 extern void release_thread(struct task_struct *);
 extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern void dump_thread(struct pt_regs *regs, struct user *u);
-extern void prepare_to_copy(struct task_struct *tsk);
+
+static inline void prepare_to_copy(struct task_struct *tsk)
+{
+}
+
 
 extern unsigned long thread_saved_pc(struct task_struct *t);
 
diff --git a/include/asm-v850/bug.h b/include/asm-v850/bug.h
index c778916bf7f2..b0ed2d35f3e8 100644
--- a/include/asm-v850/bug.h
+++ b/include/asm-v850/bug.h
@@ -14,9 +14,12 @@
 #ifndef __V850_BUG_H__
 #define __V850_BUG_H__
 
+#ifdef CONFIG_BUG
 extern void __bug (void) __attribute__ ((noreturn));
 #define BUG()           __bug()
 #define HAVE_ARCH_BUG
+#endif
+
 #include <asm-generic/bug.h>
 
 #endif /* __V850_BUG_H__ */
diff --git a/include/asm-v850/signal.h b/include/asm-v850/signal.h
index 407db875899c..ec3566c875d9 100644
--- a/include/asm-v850/signal.h
+++ b/include/asm-v850/signal.h
@@ -110,21 +110,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-
-#ifdef __KERNEL__
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif /* __KERNEL__ */
-
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-x86_64/apic.h b/include/asm-x86_64/apic.h
index c025cc3ef789..e4b1017b8b2b 100644
--- a/include/asm-x86_64/apic.h
+++ b/include/asm-x86_64/apic.h
@@ -99,7 +99,6 @@ extern void disable_APIC_timer(void);
 extern void enable_APIC_timer(void);
 extern void clustered_apic_check(void);
 
-extern int check_nmi_watchdog(void);
 extern void nmi_watchdog_default(void);
 extern int setup_nmi_watchdog(char *);
 
diff --git a/include/asm-x86_64/bootsetup.h b/include/asm-x86_64/bootsetup.h
index b570a484dc50..b829f7b534be 100644
--- a/include/asm-x86_64/bootsetup.h
+++ b/include/asm-x86_64/bootsetup.h
@@ -2,7 +2,8 @@
 #ifndef _X86_64_BOOTSETUP_H
 #define _X86_64_BOOTSETUP_H 1
 
-extern char x86_boot_params[2048];
+#define BOOT_PARAM_SIZE         4096
+extern char x86_boot_params[BOOT_PARAM_SIZE];
 
 /*
  * This is set up by the setup-routine at boot-time
diff --git a/include/asm-x86_64/bug.h b/include/asm-x86_64/bug.h
index 19aed6e78fec..bdbf66eab6ee 100644
--- a/include/asm-x86_64/bug.h
+++ b/include/asm-x86_64/bug.h
@@ -15,11 +15,13 @@ struct bug_frame {
         unsigned short line;
 } __attribute__((packed));
 
+#ifdef CONFIG_BUG
 #define HAVE_ARCH_BUG
 #define BUG() \
         asm volatile("ud2 ; .quad %c1 ; .short %c0" :: \
                      "i"(__LINE__), "i" (__stringify(__FILE__)))
 void out_of_line_bug(void);
-#include <asm-generic/bug.h>
+#endif
 
+#include <asm-generic/bug.h>
 #endif
diff --git a/include/asm-x86_64/cpufeature.h b/include/asm-x86_64/cpufeature.h
index e68ad97a6319..aea308c65709 100644
--- a/include/asm-x86_64/cpufeature.h
+++ b/include/asm-x86_64/cpufeature.h
@@ -7,7 +7,7 @@
 #ifndef __ASM_X8664_CPUFEATURE_H
 #define __ASM_X8664_CPUFEATURE_H
 
-#define NCAPINTS        6
+#define NCAPINTS        7       /* N 32-bit words worth of info */
 
 /* Intel-defined CPU features, CPUID level 0x00000001, word 0 */
 #define X86_FEATURE_FPU         (0*32+ 0) /* Onboard FPU */
@@ -74,9 +74,15 @@
 #define X86_FEATURE_CX16        (4*32+13) /* CMPXCHG16B */
 #define X86_FEATURE_XTPR        (4*32+14) /* Send Task Priority Messages */
 
-/* More extended AMD flags: CPUID level 0x80000001, ecx, word 5 */
-#define X86_FEATURE_LAHF_LM     (5*32+ 0) /* LAHF/SAHF in long mode */
-#define X86_FEATURE_CMP_LEGACY  (5*32+ 1) /* If yes HyperThreading not valid */
+/* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */
+#define X86_FEATURE_XSTORE      (5*32+ 2) /* on-CPU RNG present (xstore insn) */
+#define X86_FEATURE_XSTORE_EN   (5*32+ 3) /* on-CPU RNG enabled */
+#define X86_FEATURE_XCRYPT      (5*32+ 6) /* on-CPU crypto (xcrypt insn) */
+#define X86_FEATURE_XCRYPT_EN   (5*32+ 7) /* on-CPU crypto enabled */
+
+/* More extended AMD flags: CPUID level 0x80000001, ecx, word 6 */
+#define X86_FEATURE_LAHF_LM     (6*32+ 0) /* LAHF/SAHF in long mode */
+#define X86_FEATURE_CMP_LEGACY  (6*32+ 1) /* If yes HyperThreading not valid */
 
 #define cpu_has(c, bit)                test_bit(bit, (c)->x86_capability)
 #define boot_cpu_has(bit)      test_bit(bit, boot_cpu_data.x86_capability)
diff --git a/include/asm-x86_64/e820.h b/include/asm-x86_64/e820.h
index 08f83a4b4f4a..8e94edf0b984 100644
--- a/include/asm-x86_64/e820.h
+++ b/include/asm-x86_64/e820.h
@@ -14,7 +14,7 @@
 #include <linux/mmzone.h>
 
 #define E820MAP 0x2d0           /* our map */
-#define E820MAX 32              /* number of entries in E820MAP */
+#define E820MAX 128             /* number of entries in E820MAP */
 #define E820NR  0x1e8           /* # entries in E820MAP */
 
 #define E820_RAM        1
diff --git a/include/asm-x86_64/siginfo.h b/include/asm-x86_64/siginfo.h
index 7bc15985f124..d09a1e6e7246 100644
--- a/include/asm-x86_64/siginfo.h
+++ b/include/asm-x86_64/siginfo.h
@@ -3,8 +3,6 @@
 
 #define __ARCH_SI_PREAMBLE_SIZE (4 * sizeof(int))
 
-#define SIGEV_PAD_SIZE ((SIGEV_MAX_SIZE/sizeof(int)) - 4)
-
 #include <asm-generic/siginfo.h>
 
 #endif
diff --git a/include/asm-x86_64/signal.h b/include/asm-x86_64/signal.h
index 643a20d73765..4987ad8082ba 100644
--- a/include/asm-x86_64/signal.h
+++ b/include/asm-x86_64/signal.h
@@ -116,20 +116,6 @@ typedef unsigned long sigset_t;
 #define MINSIGSTKSZ     2048
 #define SIGSTKSZ        8192
 
-#ifdef __KERNEL__
-
-/*
- * These values of sa_flags are used only by the kernel as part of the
- * irq handling routines.
- *
- * SA_INTERRUPT is also used by the irq handling routines.
- * SA_SHIRQ is for shared interrupt support on PCI and EISA.
- */
-#define SA_PROBE                SA_ONESHOT
-#define SA_SAMPLE_RANDOM        SA_RESTART
-#define SA_SHIRQ                0x04000000
-#endif
-
 #define SIG_BLOCK          0    /* for blocking signals */
 #define SIG_UNBLOCK        1    /* for unblocking signals */
 #define SIG_SETMASK        2    /* for setting the signal mask */
diff --git a/include/asm-x86_64/unistd.h b/include/asm-x86_64/unistd.h
index 3d65d240dc95..3c9af6fd4332 100644
--- a/include/asm-x86_64/unistd.h
+++ b/include/asm-x86_64/unistd.h
@@ -76,7 +76,7 @@ __SYSCALL(__NR_madvise, sys_madvise)
 #define __NR_shmget                             29
 __SYSCALL(__NR_shmget, sys_shmget)
 #define __NR_shmat                              30
-__SYSCALL(__NR_shmat, wrap_sys_shmat)
+__SYSCALL(__NR_shmat, sys_shmat)
 #define __NR_shmctl                             31
 __SYSCALL(__NR_shmctl, sys_shmctl)
 
diff --git a/include/linux/auto_fs4.h b/include/linux/auto_fs4.h
index d1c7b0ec7c22..a1657fb99516 100644
--- a/include/linux/auto_fs4.h
+++ b/include/linux/auto_fs4.h
@@ -23,7 +23,7 @@
 #define AUTOFS_MIN_PROTO_VERSION        3
 #define AUTOFS_MAX_PROTO_VERSION        4
 
-#define AUTOFS_PROTO_SUBVERSION         5
+#define AUTOFS_PROTO_SUBVERSION         6
 
 /* Mask for expire behaviour */
 #define AUTOFS_EXP_IMMEDIATE            1
diff --git a/include/linux/compiler-gcc2.h b/include/linux/compiler-gcc2.h
index 5a359153ffd9..ebed17660c5f 100644
--- a/include/linux/compiler-gcc2.h
+++ b/include/linux/compiler-gcc2.h
@@ -22,3 +22,8 @@
 # define __attribute_pure__     __attribute__((pure))
 # define __attribute_const__    __attribute__((__const__))
 #endif
+
+/* GCC 2.95.x/2.96 recognize __va_copy, but not va_copy. Actually later GCC's
+ * define both va_copy and __va_copy, but the latter may go away, so limit this
+ * to this header */
+#define va_copy                 __va_copy
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 487725cf0d0d..d7378215b851 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -90,6 +90,12 @@ extern void __chk_io_ptr(void __iomem *);
 # define __deprecated           /* unimplemented */
 #endif
 
+#ifdef MODULE
+#define __deprecated_for_modules __deprecated
+#else
+#define __deprecated_for_modules
+#endif
+
 #ifndef __must_check
 #define __must_check
 #endif
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 910eca35583d..f21af067d015 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -103,6 +103,7 @@ struct cpufreq_policy {
 #define CPUFREQ_PRECHANGE       (0)
 #define CPUFREQ_POSTCHANGE      (1)
 #define CPUFREQ_RESUMECHANGE    (8)
+#define CPUFREQ_SUSPENDCHANGE   (9)
 
 struct cpufreq_freqs {
         unsigned int cpu;       /* cpu nr */
@@ -200,6 +201,7 @@ struct cpufreq_driver {
 
         /* optional */
         int     (*exit)         (struct cpufreq_policy *policy);
+        int     (*suspend)      (struct cpufreq_policy *policy, u32 state);
         int     (*resume)       (struct cpufreq_policy *policy);
         struct freq_attr        **attr;
 };
@@ -211,7 +213,8 @@ struct cpufreq_driver {
 #define CPUFREQ_CONST_LOOPS     0x02    /* loops_per_jiffy or other kernel
                                          * "constants" aren't affected by
                                          * frequency transitions */
-
+#define CPUFREQ_PM_NO_WARN      0x04    /* don't warn on suspend/resume speed
+                                         * mismatches */
 
 int cpufreq_register_driver(struct cpufreq_driver *driver_data);
 int cpufreq_unregister_driver(struct cpufreq_driver *driver_data);
diff --git a/include/linux/edd.h b/include/linux/edd.h
index c6e6747a401d..162512b886f7 100644
--- a/include/linux/edd.h
+++ b/include/linux/edd.h
@@ -32,7 +32,7 @@
 
 #define EDDNR 0x1e9             /* addr of number of edd_info structs at EDDBUF
                                    in boot_params - treat this as 1 byte  */
-#define EDDBUF  0x600           /* addr of edd_info structs in boot_params */
+#define EDDBUF  0xd00           /* addr of edd_info structs in boot_params */
 #define EDDMAXNR 6              /* number of edd_info structs starting at EDDBUF  */
 #define EDDEXTSIZE 8            /* change these if you muck with the structures */
 #define EDDPARMSIZE 74
diff --git a/include/linux/fb.h b/include/linux/fb.h
index b45d3e2d711a..b468bf496547 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -563,6 +563,9 @@ struct fb_ops {
         int (*fb_setcolreg)(unsigned regno, unsigned red, unsigned green,
                             unsigned blue, unsigned transp, struct fb_info *info);
 
+        /* set color registers in batch */
+        int (*fb_setcmap)(struct fb_cmap *cmap, struct fb_info *info);
+
         /* blank display */
         int (*fb_blank)(int blank, struct fb_info *info);
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 5df687d940fa..4edba067a717 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1053,83 +1053,87 @@ static inline void file_accessed(struct file *file)
 int sync_inode(struct inode *inode, struct writeback_control *wbc);
 
 /**
- * &export_operations - for nfsd to communicate with file systems
- * decode_fh:      decode a file handle fragment and return a &struct dentry
- * encode_fh:      encode a file handle fragment from a dentry
- * get_name:       find the name for a given inode in a given directory
- * get_parent:     find the parent of a given directory
- * get_dentry:     find a dentry for the inode given a file handle sub-fragment
+ * struct export_operations - for nfsd to communicate with file systems
+ * @decode_fh:      decode a file handle fragment and return a &struct dentry
+ * @encode_fh:      encode a file handle fragment from a dentry
+ * @get_name:       find the name for a given inode in a given directory
+ * @get_parent:     find the parent of a given directory
+ * @get_dentry:     find a dentry for the inode given a file handle sub-fragment
  *
  * Description:
  *    The export_operations structure provides a means for nfsd to communicate
  *    with a particular exported file system  - particularly enabling nfsd and
  *    the filesystem to co-operate when dealing with file handles.
  *
- *    export_operations contains two basic operation for dealing with file handles,
- *    decode_fh() and encode_fh(), and allows for some other operations to be defined
- *    which standard helper routines use to get specific information from the
- *    filesystem.
+ *    export_operations contains two basic operation for dealing with file
+ *    handles, decode_fh() and encode_fh(), and allows for some other
+ *    operations to be defined which standard helper routines use to get
+ *    specific information from the filesystem.
  *
  *    nfsd encodes information use to determine which filesystem a filehandle
- *    applies to in the initial part of the file handle.  The remainder, termed a
- *    file handle fragment, is controlled completely by the filesystem.
- *    The standard helper routines assume that this fragment will contain one or two
- *    sub-fragments, one which identifies the file, and one which may be used to
- *    identify the (a) directory containing the file.
+ *    applies to in the initial part of the file handle.  The remainder, termed
+ *    a file handle fragment, is controlled completely by the filesystem.  The
+ *    standard helper routines assume that this fragment will contain one or
+ *    two sub-fragments, one which identifies the file, and one which may be
+ *    used to identify the (a) directory containing the file.
  *
  *    In some situations, nfsd needs to get a dentry which is connected into a
- *    specific part of the file tree.  To allow for this, it passes the function
- *    acceptable() together with a @context which can be used to see if the dentry
- *    is acceptable.  As there can be multiple dentrys for a given file, the filesystem
- *    should check each one for acceptability before looking for the next.  As soon
- *    as an acceptable one is found, it should be returned.
+ *    specific part of the file tree.  To allow for this, it passes the
+ *    function acceptable() together with a @context which can be used to see
+ *    if the dentry is acceptable.  As there can be multiple dentrys for a
+ *    given file, the filesystem should check each one for acceptability before
+ *    looking for the next.  As soon as an acceptable one is found, it should
+ *    be returned.
  *
  * decode_fh:
- *    @decode_fh is given a &struct super_block (@sb), a file handle fragment (@fh, @fh_len)
- *    and an acceptability testing function (@acceptable, @context).  It should return
- *    a &struct dentry which refers to the same file that the file handle fragment refers
- *    to,  and which passes the acceptability test.  If it cannot, it should return
- *    a %NULL pointer if the file was found but no acceptable &dentries were available, or
- *    a %ERR_PTR error code indicating why it couldn't be found (e.g. %ENOENT or %ENOMEM).
+ *    @decode_fh is given a &struct super_block (@sb), a file handle fragment
+ *    (@fh, @fh_len) and an acceptability testing function (@acceptable,
+ *    @context).  It should return a &struct dentry which refers to the same
+ *    file that the file handle fragment refers to,  and which passes the
+ *    acceptability test.  If it cannot, it should return a %NULL pointer if
+ *    the file was found but no acceptable &dentries were available, or a
+ *    %ERR_PTR error code indicating why it couldn't be found (e.g. %ENOENT or
+ *    %ENOMEM).
  *
  * encode_fh:
- *    @encode_fh should store in the file handle fragment @fh (using at most @max_len bytes)
- *    information that can be used by @decode_fh to recover the file refered to by the
- *    &struct dentry @de.  If the @connectable flag is set, the encode_fh() should store
- *    sufficient information so that a good attempt can be made to find not only
- *    the file but also it's place in the filesystem.   This typically means storing
- *    a reference to de->d_parent in the filehandle fragment.
- *    encode_fh() should return the number of bytes stored or a negative error code
- *    such as %-ENOSPC
+ *    @encode_fh should store in the file handle fragment @fh (using at most
+ *    @max_len bytes) information that can be used by @decode_fh to recover the
+ *    file refered to by the &struct dentry @de.  If the @connectable flag is
+ *    set, the encode_fh() should store sufficient information so that a good
+ *    attempt can be made to find not only the file but also it's place in the
+ *    filesystem.   This typically means storing a reference to de->d_parent in
+ *    the filehandle fragment.  encode_fh() should return the number of bytes
+ *    stored or a negative error code such as %-ENOSPC
  *
  * get_name:
- *    @get_name should find a name for the given @child in the given @parent directory.
- *    The name should be stored in the @name (with the understanding that it is already
- *    pointing to a a %NAME_MAX+1 sized buffer.   get_name() should return %0 on success,
- *    a negative error code or error.
- *    @get_name will be called without @parent->i_sem held.
+ *    @get_name should find a name for the given @child in the given @parent
+ *    directory.  The name should be stored in the @name (with the
+ *    understanding that it is already pointing to a a %NAME_MAX+1 sized
+ *    buffer.   get_name() should return %0 on success, a negative error code
+ *    or error.  @get_name will be called without @parent->i_sem held.
  *
  * get_parent:
- *    @get_parent should find the parent directory for the given @child which is also
- *    a directory.  In the event that it cannot be found, or storage space cannot be
- *    allocated, a %ERR_PTR should be returned.
+ *    @get_parent should find the parent directory for the given @child which
+ *    is also a directory.  In the event that it cannot be found, or storage
+ *    space cannot be allocated, a %ERR_PTR should be returned.
  *
  * get_dentry:
- *    Given a &super_block (@sb) and a pointer to a file-system specific inode identifier,
- *    possibly an inode number, (@inump) get_dentry() should find the identified inode and
- *    return a dentry for that inode.
- *    Any suitable dentry can be returned including, if necessary, a new dentry created
- *    with d_alloc_root.  The caller can then find any other extant dentrys by following the
- *    d_alias links.  If a new dentry was created using d_alloc_root, DCACHE_NFSD_DISCONNECTED
- *    should be set, and the dentry should be d_rehash()ed.
+ *    Given a &super_block (@sb) and a pointer to a file-system specific inode
+ *    identifier, possibly an inode number, (@inump) get_dentry() should find
+ *    the identified inode and return a dentry for that inode.  Any suitable
+ *    dentry can be returned including, if necessary, a new dentry created with
+ *    d_alloc_root.  The caller can then find any other extant dentrys by
+ *    following the d_alias links.  If a new dentry was created using
+ *    d_alloc_root, DCACHE_NFSD_DISCONNECTED should be set, and the dentry
+ *    should be d_rehash()ed.
  *
- *    If the inode cannot be found, either a %NULL pointer or an %ERR_PTR code can be returned.
- *    The @inump will be whatever was passed to nfsd_find_fh_dentry() in either the
- *    @obj or @parent parameters.
+ *    If the inode cannot be found, either a %NULL pointer or an %ERR_PTR code
+ *    can be returned.  The @inump will be whatever was passed to
+ *    nfsd_find_fh_dentry() in either the @obj or @parent parameters.
  *
  * Locking rules:
- *  get_parent is called with child->d_inode->i_sem down
- *  get_name is not (which is possibly inconsistent)
+ *    get_parent is called with child->d_inode->i_sem down
+ *    get_name is not (which is possibly inconsistent)
  */
 
 struct export_operations {
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 848a1baac079..af7407e8cfc5 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -38,14 +38,16 @@ struct vm_area_struct;
 #define __GFP_NO_GROW   0x2000u /* Slab internal usage */
 #define __GFP_COMP      0x4000u /* Add compound page metadata */
 #define __GFP_ZERO      0x8000u /* Return zeroed page on success */
+#define __GFP_NOMEMALLOC 0x10000u /* Don't use emergency reserves */
 
-#define __GFP_BITS_SHIFT 16     /* Room for 16 __GFP_FOO bits */
+#define __GFP_BITS_SHIFT 20     /* Room for 20 __GFP_FOO bits */
 #define __GFP_BITS_MASK ((1 << __GFP_BITS_SHIFT) - 1)
 
 /* if you forget to add the bitmask here kernel will crash, period */
 #define GFP_LEVEL_MASK (__GFP_WAIT|__GFP_HIGH|__GFP_IO|__GFP_FS| \
                         __GFP_COLD|__GFP_NOWARN|__GFP_REPEAT| \
-                        __GFP_NOFAIL|__GFP_NORETRY|__GFP_NO_GROW|__GFP_COMP)
+                        __GFP_NOFAIL|__GFP_NORETRY|__GFP_NO_GROW|__GFP_COMP| \
+                        __GFP_NOMEMALLOC)
 
 #define GFP_ATOMIC      (__GFP_HIGH)
 #define GFP_NOIO        (__GFP_WAIT)
diff --git a/include/linux/input.h b/include/linux/input.h
index b70df8fe60e6..72731d7d189e 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -328,6 +328,11 @@ struct input_absinfo {
 #define KEY_BRIGHTNESSUP        225
 #define KEY_MEDIA               226
 
+#define KEY_SWITCHVIDEOMODE     227
+#define KEY_KBDILLUMTOGGLE      228
+#define KEY_KBDILLUMDOWN        229
+#define KEY_KBDILLUMUP          230
+
 #define KEY_UNKNOWN             240
 
 #define BTN_MISC                0x100
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 7c1cba4a5278..e25b97062ce1 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -115,10 +115,19 @@ extern int __kernel_text_address(unsigned long addr);
 extern int kernel_text_address(unsigned long addr);
 extern int session_of_pgrp(int pgrp);
 
+#ifdef CONFIG_PRINTK
 asmlinkage int vprintk(const char *fmt, va_list args)
         __attribute__ ((format (printf, 1, 0)));
 asmlinkage int printk(const char * fmt, ...)
         __attribute__ ((format (printf, 1, 2)));
+#else
+static inline int vprintk(const char *s, va_list args)
+        __attribute__ ((format (printf, 1, 0)));
+static inline int vprintk(const char *s, va_list args) { return 0; }
+static inline int printk(const char *s, ...)
+        __attribute__ ((format (printf, 1, 2)));
+static inline int printk(const char *s, ...) { return 0; }
+#endif
 
 unsigned long int_sqrt(unsigned long);
 
diff --git a/include/linux/mm.h b/include/linux/mm.h
index c74a74ca401d..8b007ad2d450 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -726,6 +726,7 @@ extern void __vma_link_rb(struct mm_struct *, struct vm_area_struct *,
 extern struct vm_area_struct *copy_vma(struct vm_area_struct **,
         unsigned long addr, unsigned long len, pgoff_t pgoff);
 extern void exit_mmap(struct mm_struct *);
+extern int may_expand_vm(struct mm_struct *mm, unsigned long npages);
 
 extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
diff --git a/include/linux/net.h b/include/linux/net.h
index 7823b3482506..e5914c1f0c4d 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -64,19 +64,19 @@ typedef enum {
 #define SOCK_PASSCRED           3
 
 #ifndef ARCH_HAS_SOCKET_TYPES
-/** sock_type - Socket types
- * 
+/**
+ * enum sock_type - Socket types
+ * @SOCK_STREAM: stream (connection) socket
+ * @SOCK_DGRAM: datagram (conn.less) socket
+ * @SOCK_RAW: raw socket
+ * @SOCK_RDM: reliably-delivered message
+ * @SOCK_SEQPACKET: sequential packet socket
+ * @SOCK_PACKET: linux specific way of getting packets at the dev level.
+ *                For writing rarp and other similar things on the user level.
+ *
  * When adding some new socket type please
  * grep ARCH_HAS_SOCKET_TYPE include/asm-* /socket.h, at least MIPS
  * overrides this enum for binary compat reasons.
- * 
- * @SOCK_STREAM - stream (connection) socket
- * @SOCK_DGRAM - datagram (conn.less) socket
- * @SOCK_RAW - raw socket
- * @SOCK_RDM - reliably-delivered message
- * @SOCK_SEQPACKET - sequential packet socket 
- * @SOCK_PACKET - linux specific way of getting packets at the dev level.
- *                For writing rarp and other similar things on the user level.
  */
 enum sock_type {
         SOCK_STREAM     = 1,
@@ -93,15 +93,15 @@ enum sock_type {
 
 /**
  *  struct socket - general BSD socket
- *  @state - socket state (%SS_CONNECTED, etc)
- *  @flags - socket flags (%SOCK_ASYNC_NOSPACE, etc)
- *  @ops - protocol specific socket operations
- *  @fasync_list - Asynchronous wake up list
- *  @file - File back pointer for gc
- *  @sk - internal networking protocol agnostic socket representation
- *  @wait - wait queue for several uses
- *  @type - socket type (%SOCK_STREAM, etc)
- *  @passcred - credentials (used only in Unix Sockets (aka PF_LOCAL))
+ *  @state: socket state (%SS_CONNECTED, etc)
+ *  @flags: socket flags (%SOCK_ASYNC_NOSPACE, etc)
+ *  @ops: protocol specific socket operations
+ *  @fasync_list: Asynchronous wake up list
+ *  @file: File back pointer for gc
+ *  @sk: internal networking protocol agnostic socket representation
+ *  @wait: wait queue for several uses
+ *  @type: socket type (%SOCK_STREAM, etc)
+ *  @passcred: credentials (used only in Unix Sockets (aka PF_LOCAL))
  */
 struct socket {
         socket_state            state;
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 6b74fcf5bb63..39ab8c6b5652 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -131,6 +131,7 @@ struct page_state {
         unsigned long allocstall;       /* direct reclaim calls */
 
         unsigned long pgrotated;        /* pages rotated to tail of the LRU */
+        unsigned long nr_bounce;        /* pages for bounce buffers */
 };
 
 extern void get_page_state(struct page_state *ret);
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 6a1897481942..5d5820a4cf10 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2415,6 +2415,8 @@
 #define PCI_DEVICE_ID_INTEL_ICH7_1      0x27b9
 #define PCI_DEVICE_ID_INTEL_ICH7_2      0x27c0
 #define PCI_DEVICE_ID_INTEL_ICH7_3      0x27c1
+#define PCI_DEVICE_ID_INTEL_ICH7_30     0x27b0
+#define PCI_DEVICE_ID_INTEL_ICH7_31     0x27bd
 #define PCI_DEVICE_ID_INTEL_ICH7_5      0x27c4
 #define PCI_DEVICE_ID_INTEL_ICH7_6      0x27c5
 #define PCI_DEVICE_ID_INTEL_ICH7_7      0x27c8
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 4d747433916b..fd276adf0fd5 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -157,9 +157,9 @@ static inline int rcu_pending(int cpu)
 /**
  * rcu_read_lock - mark the beginning of an RCU read-side critical section.
  *
- * When synchronize_kernel() is invoked on one CPU while other CPUs
+ * When synchronize_rcu() is invoked on one CPU while other CPUs
  * are within RCU read-side critical sections, then the
- * synchronize_kernel() is guaranteed to block until after all the other
+ * synchronize_rcu() is guaranteed to block until after all the other
  * CPUs exit their critical sections.  Similarly, if call_rcu() is invoked
  * on one CPU while other CPUs are within RCU read-side critical
  * sections, invocation of the corresponding RCU callback is deferred
@@ -256,6 +256,21 @@ static inline int rcu_pending(int cpu)
                                                 (p) = (v); \
                                         })
 
+/**
+ * synchronize_sched - block until all CPUs have exited any non-preemptive
+ * kernel code sequences.
+ *
+ * This means that all preempt_disable code sequences, including NMI and
+ * hardware-interrupt handlers, in progress on entry will have completed
+ * before this primitive returns.  However, this does not guarantee that
+ * softirq handlers will have completed, since in some kernels
+ *
+ * This primitive provides the guarantees made by the (deprecated)
+ * synchronize_kernel() API.  In contrast, synchronize_rcu() only
+ * guarantees that rcu_read_lock() sections will have completed.
+ */
+#define synchronize_sched() synchronize_rcu()
+
 extern void rcu_init(void);
 extern void rcu_check_callbacks(int cpu, int user);
 extern void rcu_restart_cpu(int cpu);
@@ -265,7 +280,9 @@ extern void FASTCALL(call_rcu(struct rcu_head *head,
                                 void (*func)(struct rcu_head *head)));
 extern void FASTCALL(call_rcu_bh(struct rcu_head *head,
                                 void (*func)(struct rcu_head *head)));
-extern void synchronize_kernel(void);
+extern __deprecated_for_modules void synchronize_kernel(void);
+extern void synchronize_rcu(void);
+void synchronize_idle(void);
 
 #endif /* __KERNEL__ */
 #endif /* __LINUX_RCUPDATE_H */
diff --git a/include/linux/reboot_fixups.h b/include/linux/reboot_fixups.h
new file mode 100644
index 000000000000..480ea2d489d8
--- /dev/null
+++ b/include/linux/reboot_fixups.h
@@ -0,0 +1,10 @@
+#ifndef _LINUX_REBOOT_FIXUPS_H
+#define _LINUX_REBOOT_FIXUPS_H
+
+#ifdef CONFIG_X86_REBOOTFIXUPS
+extern void mach_reboot_fixups(void);
+#else
+#define mach_reboot_fixups() ((void)(0))
+#endif
+
+#endif /* _LINUX_REBOOT_FIXUPS_H */
diff --git a/include/linux/reiserfs_acl.h b/include/linux/reiserfs_acl.h
index a57e973af0bd..2aef9c3f5ce8 100644
--- a/include/linux/reiserfs_acl.h
+++ b/include/linux/reiserfs_acl.h
@@ -5,18 +5,18 @@
 #define REISERFS_ACL_VERSION    0x0001
 
 typedef struct {
-        __u16           e_tag;
-        __u16           e_perm;
-        __u32           e_id;
+        __le16          e_tag;
+        __le16          e_perm;
+        __le32          e_id;
 } reiserfs_acl_entry;
 
 typedef struct {
-        __u16           e_tag;
-        __u16           e_perm;
+        __le16          e_tag;
+        __le16          e_perm;
 } reiserfs_acl_entry_short;
 
 typedef struct {
-        __u32           a_version;
+        __le32          a_version;
 } reiserfs_acl_header;
 
 static inline size_t reiserfs_acl_size(int count)
diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
index bccff8b17dc4..32148625fc2f 100644
--- a/include/linux/reiserfs_fs.h
+++ b/include/linux/reiserfs_fs.h
@@ -114,47 +114,47 @@ if( !( cond ) ) 								\
 
 
 struct journal_params {
-    __u32 jp_journal_1st_block;       /* where does journal start from on its
+    __le32 jp_journal_1st_block;              /* where does journal start from on its
                                        * device */
-    __u32 jp_journal_dev;             /* journal device st_rdev */
-    __u32 jp_journal_size;            /* size of the journal */
-    __u32 jp_journal_trans_max;       /* max number of blocks in a transaction. */
-    __u32 jp_journal_magic;           /* random value made on fs creation (this
+    __le32 jp_journal_dev;            /* journal device st_rdev */
+    __le32 jp_journal_size;           /* size of the journal */
+    __le32 jp_journal_trans_max;              /* max number of blocks in a transaction. */
+    __le32 jp_journal_magic;          /* random value made on fs creation (this
                                        * was sb_journal_block_count) */
-    __u32 jp_journal_max_batch;       /* max number of blocks to batch into a
+    __le32 jp_journal_max_batch;              /* max number of blocks to batch into a
                                        * trans */
-    __u32 jp_journal_max_commit_age;  /* in seconds, how old can an async
+    __le32 jp_journal_max_commit_age;  /* in seconds, how old can an async
                                        * commit be */
-    __u32 jp_journal_max_trans_age;   /* in seconds, how old can a transaction
+    __le32 jp_journal_max_trans_age;   /* in seconds, how old can a transaction
                                        * be */
 };
 
 /* this is the super from 3.5.X, where X >= 10 */
 struct reiserfs_super_block_v1
 {
-    __u32 s_block_count;           /* blocks count         */
-    __u32 s_free_blocks;           /* free blocks count    */
-    __u32 s_root_block;            /* root block number    */
+    __le32 s_block_count;          /* blocks count         */
+    __le32 s_free_blocks;           /* free blocks count    */
+    __le32 s_root_block;            /* root block number    */
     struct journal_params s_journal;
-    __u16 s_blocksize;             /* block size */
-    __u16 s_oid_maxsize;           /* max size of object id array, see
+    __le16 s_blocksize;             /* block size */
+    __le16 s_oid_maxsize;          /* max size of object id array, see
                                     * get_objectid() commentary  */
-    __u16 s_oid_cursize;           /* current size of object id array */
-    __u16 s_umount_state;          /* this is set to 1 when filesystem was
+    __le16 s_oid_cursize;          /* current size of object id array */
+    __le16 s_umount_state;          /* this is set to 1 when filesystem was
                                     * umounted, to 2 - when not */    
     char s_magic[10];              /* reiserfs magic string indicates that
                                     * file system is reiserfs:
                                     * "ReIsErFs" or "ReIsEr2Fs" or "ReIsEr3Fs" */
-    __u16 s_fs_state;              /* it is set to used by fsck to mark which
+    __le16 s_fs_state;             /* it is set to used by fsck to mark which
                                     * phase of rebuilding is done */
-    __u32 s_hash_function_code;    /* indicate, what hash function is being use
+    __le32 s_hash_function_code;    /* indicate, what hash function is being use
                                     * to sort names in a directory*/
-    __u16 s_tree_height;           /* height of disk tree */
-    __u16 s_bmap_nr;               /* amount of bitmap blocks needed to address
+    __le16 s_tree_height;           /* height of disk tree */
+    __le16 s_bmap_nr;               /* amount of bitmap blocks needed to address
                                     * each block of file system */
-    __u16 s_version;               /* this field is only reliable on filesystem
+    __le16 s_version;               /* this field is only reliable on filesystem
                                     * with non-standard journal */
-    __u16 s_reserved_for_journal;  /* size in blocks of journal area on main
+    __le16 s_reserved_for_journal;  /* size in blocks of journal area on main
                                     * device, we need to keep after
                                     * making fs with non-standard journal */    
 } __attribute__ ((__packed__));
@@ -165,8 +165,8 @@ struct reiserfs_super_block_v1
 struct reiserfs_super_block
 {
     struct reiserfs_super_block_v1 s_v1;
-    __u32 s_inode_generation;
-    __u32 s_flags;                  /* Right now used only by inode-attributes, if enabled */
+    __le32 s_inode_generation;
+    __le32 s_flags;                  /* Right now used only by inode-attributes, if enabled */
     unsigned char s_uuid[16];       /* filesystem unique identifier */
     unsigned char s_label[16];      /* filesystem volume label */
     char s_unused[88] ;             /* zero filled by mkreiserfs and
@@ -225,7 +225,7 @@ struct reiserfs_super_block
 #define SB_ONDISK_JOURNAL_DEVICE(s) \
          le32_to_cpu ((SB_ONDISK_JP(s)->jp_journal_dev))
 #define SB_ONDISK_RESERVED_FOR_JOURNAL(s) \
-         le32_to_cpu ((SB_V1_DISK_SUPER_BLOCK(s)->s_reserved_for_journal))
+         le16_to_cpu ((SB_V1_DISK_SUPER_BLOCK(s)->s_reserved_for_journal))
 
 #define is_block_in_log_or_reserved_area(s, block) \
          block >= SB_JOURNAL_1st_RESERVED_BLOCK(s) \
@@ -269,7 +269,7 @@ int is_reiserfs_jr (struct reiserfs_super_block * rs);
 #define QUOTA_EXCEEDED -6
 
 typedef __u32 b_blocknr_t;
-typedef __u32 unp_t;
+typedef __le32 unp_t;
 
 struct unfm_nodeinfo {
     unp_t unfm_nodenum;
@@ -376,78 +376,57 @@ static inline struct reiserfs_sb_info *REISERFS_SB(const struct super_block *sb)
 // directories use this key as well as old files
 //
 struct offset_v1 {
-    __u32 k_offset;
-    __u32 k_uniqueness;
+    __le32 k_offset;
+    __le32 k_uniqueness;
 } __attribute__ ((__packed__));
 
 struct offset_v2 {
-#ifdef __LITTLE_ENDIAN
-            /* little endian version */
-            __u64 k_offset:60;
-            __u64 k_type: 4;
-#else
-            /* big endian version */
-            __u64 k_type: 4;
-            __u64 k_offset:60;
-#endif
+        __le64 v;
 } __attribute__ ((__packed__));
 
-#ifndef __LITTLE_ENDIAN
-typedef union {
-    struct offset_v2 offset_v2;
-    __u64 linear;
-} __attribute__ ((__packed__)) offset_v2_esafe_overlay;
-
 static inline __u16 offset_v2_k_type( const struct offset_v2 *v2 )
 {
-    offset_v2_esafe_overlay tmp = *(const offset_v2_esafe_overlay *)v2;
-    tmp.linear = le64_to_cpu( tmp.linear );
-    return (tmp.offset_v2.k_type <= TYPE_MAXTYPE)?tmp.offset_v2.k_type:TYPE_ANY;
+        __u8 type = le64_to_cpu(v2->v) >> 60;
+        return (type <= TYPE_MAXTYPE)?type:TYPE_ANY;
 }
  
 static inline void set_offset_v2_k_type( struct offset_v2 *v2, int type )
 {
-    offset_v2_esafe_overlay *tmp = (offset_v2_esafe_overlay *)v2;
-    tmp->linear = le64_to_cpu(tmp->linear);
-    tmp->offset_v2.k_type = type;
-    tmp->linear = cpu_to_le64(tmp->linear);
+        v2->v = (v2->v & cpu_to_le64(~0ULL>>4)) | cpu_to_le64((__u64)type<<60);
 }
  
 static inline loff_t offset_v2_k_offset( const struct offset_v2 *v2 )
 {
-    offset_v2_esafe_overlay tmp = *(const offset_v2_esafe_overlay *)v2;
-    tmp.linear = le64_to_cpu( tmp.linear );
-    return tmp.offset_v2.k_offset;
+        return le64_to_cpu(v2->v) & (~0ULL>>4);
 }
 
 static inline void set_offset_v2_k_offset( struct offset_v2 *v2, loff_t offset ){
-    offset_v2_esafe_overlay *tmp = (offset_v2_esafe_overlay *)v2;
-    tmp->linear = le64_to_cpu(tmp->linear);
-    tmp->offset_v2.k_offset = offset;
-    tmp->linear = cpu_to_le64(tmp->linear);
+        offset &= (~0ULL>>4);
+        v2->v = (v2->v & cpu_to_le64(15ULL<<60)) | cpu_to_le64(offset);
 }
-#else
-# define offset_v2_k_type(v2)           ((v2)->k_type)
-# define set_offset_v2_k_type(v2,val)   (offset_v2_k_type(v2) = (val))
-# define offset_v2_k_offset(v2)         ((v2)->k_offset)
-# define set_offset_v2_k_offset(v2,val) (offset_v2_k_offset(v2) = (val))
-#endif
 
 /* Key of an item determines its location in the S+tree, and
    is composed of 4 components */
 struct reiserfs_key {
-    __u32 k_dir_id;    /* packing locality: by default parent
+    __le32 k_dir_id;    /* packing locality: by default parent
                           directory object id */
-    __u32 k_objectid;  /* object identifier */
+    __le32 k_objectid;  /* object identifier */
     union {
         struct offset_v1 k_offset_v1;
         struct offset_v2 k_offset_v2;
     } __attribute__ ((__packed__)) u;
 } __attribute__ ((__packed__));
 
+struct in_core_key {
+    __u32 k_dir_id;    /* packing locality: by default parent
+                          directory object id */
+    __u32 k_objectid;  /* object identifier */
+    __u64 k_offset;
+    __u8 k_type;
+};
 
 struct cpu_key {
-    struct reiserfs_key on_disk_key;
+    struct in_core_key on_disk_key;
     int version;
     int key_length; /* 3 in all cases but direct2indirect and
                        indirect2direct conversion */
@@ -508,15 +487,15 @@ struct item_head
                    item. Note that the key, not this field, is used to
                    determine the item type, and thus which field this
                    union contains. */
-                __u16 ih_free_space_reserved; 
+                __le16 ih_free_space_reserved;
                 /* Iff this is a directory item, this field equals the
                    number of directory entries in the directory item. */
-                __u16 ih_entry_count; 
+                __le16 ih_entry_count;
         } __attribute__ ((__packed__)) u;
-        __u16 ih_item_len;           /* total size of the item body */
-        __u16 ih_item_location;      /* an offset to the item body
+        __le16 ih_item_len;           /* total size of the item body */
+        __le16 ih_item_location;      /* an offset to the item body
                                       * within the block */
-        __u16 ih_version;            /* 0 for all old items, 2 for new
+        __le16 ih_version;           /* 0 for all old items, 2 for new
                                         ones. Highest bit is set by fsck
                                         temporary, cleaned after all
                                         done */
@@ -670,43 +649,29 @@ static inline void set_le_ih_k_type (struct item_head * ih, int type)
 //
 static inline loff_t cpu_key_k_offset (const struct cpu_key * key)
 {
-    return (key->version == KEY_FORMAT_3_5) ?
-        key->on_disk_key.u.k_offset_v1.k_offset :
-        key->on_disk_key.u.k_offset_v2.k_offset;
+    return key->on_disk_key.k_offset;
 }
 
 static inline loff_t cpu_key_k_type (const struct cpu_key * key)
 {
-    return (key->version == KEY_FORMAT_3_5) ?
-        uniqueness2type (key->on_disk_key.u.k_offset_v1.k_uniqueness) :
-        key->on_disk_key.u.k_offset_v2.k_type;
+    return key->on_disk_key.k_type;
 }
 
 static inline void set_cpu_key_k_offset (struct cpu_key * key, loff_t offset)
 {
-    (key->version == KEY_FORMAT_3_5) ?
-        (key->on_disk_key.u.k_offset_v1.k_offset = offset) :
-        (key->on_disk_key.u.k_offset_v2.k_offset = offset);
+        key->on_disk_key.k_offset = offset;
 }
 
-
 static inline void set_cpu_key_k_type (struct cpu_key * key, int type)
 {
-    (key->version == KEY_FORMAT_3_5) ?
-        (key->on_disk_key.u.k_offset_v1.k_uniqueness = type2uniqueness (type)):
-        (key->on_disk_key.u.k_offset_v2.k_type = type);
+        key->on_disk_key.k_type = type;
 }
 
-
 static inline void cpu_key_k_offset_dec (struct cpu_key * key)
 {
-    if (key->version == KEY_FORMAT_3_5)
-        key->on_disk_key.u.k_offset_v1.k_offset --;
-    else
-        key->on_disk_key.u.k_offset_v2.k_offset --;
+        key->on_disk_key.k_offset --;
 }
 
-
 #define is_direntry_cpu_key(key) (cpu_key_k_type (key) == TYPE_DIRENTRY)
 #define is_direct_cpu_key(key) (cpu_key_k_type (key) == TYPE_DIRECT)
 #define is_indirect_cpu_key(key) (cpu_key_k_type (key) == TYPE_INDIRECT)
@@ -752,10 +717,10 @@ extern struct reiserfs_key root_key;
 /* Header of a disk block.  More precisely, header of a formatted leaf
    or internal node, and not the header of an unformatted node. */
 struct block_head {       
-  __u16 blk_level;        /* Level of a block in the tree. */
-  __u16 blk_nr_item;      /* Number of keys/items in a block. */
-  __u16 blk_free_space;   /* Block free space in bytes. */
-  __u16 blk_reserved;
+  __le16 blk_level;        /* Level of a block in the tree. */
+  __le16 blk_nr_item;      /* Number of keys/items in a block. */
+  __le16 blk_free_space;   /* Block free space in bytes. */
+  __le16 blk_reserved;
                                 /* dump this in v4/planA */
   struct reiserfs_key  blk_right_delim_key; /* kept only for compatibility */
 };
@@ -819,19 +784,19 @@ struct block_head {
 //
 struct stat_data_v1
 {
-    __u16 sd_mode;      /* file type, permissions */
-    __u16 sd_nlink;     /* number of hard links */
-    __u16 sd_uid;               /* owner */
-    __u16 sd_gid;               /* group */
-    __u32 sd_size;      /* file size */
-    __u32 sd_atime;     /* time of last access */
-    __u32 sd_mtime;     /* time file was last modified  */
-    __u32 sd_ctime;     /* time inode (stat data) was last changed (except changes to sd_atime and sd_mtime) */
+    __le16 sd_mode;     /* file type, permissions */
+    __le16 sd_nlink;    /* number of hard links */
+    __le16 sd_uid;              /* owner */
+    __le16 sd_gid;              /* group */
+    __le32 sd_size;     /* file size */
+    __le32 sd_atime;    /* time of last access */
+    __le32 sd_mtime;    /* time file was last modified  */
+    __le32 sd_ctime;    /* time inode (stat data) was last changed (except changes to sd_atime and sd_mtime) */
     union {
-        __u32 sd_rdev;
-        __u32 sd_blocks;        /* number of blocks file uses */
+        __le32 sd_rdev;
+        __le32 sd_blocks;       /* number of blocks file uses */
     } __attribute__ ((__packed__)) u;
-    __u32 sd_first_direct_byte; /* first byte of file which is stored
+    __le32 sd_first_direct_byte; /* first byte of file which is stored
                                    in a direct item: except that if it
                                    equals 1 it is a symlink and if it
                                    equals ~(__u32)0 there is no
@@ -897,20 +862,20 @@ struct stat_data_v1
 /* Stat Data on disk (reiserfs version of UFS disk inode minus the
    address blocks) */
 struct stat_data {
-    __u16 sd_mode;      /* file type, permissions */
-    __u16 sd_attrs;     /* persistent inode flags */
-    __u32 sd_nlink;     /* number of hard links */
-    __u64 sd_size;      /* file size */
-    __u32 sd_uid;               /* owner */
-    __u32 sd_gid;               /* group */
-    __u32 sd_atime;     /* time of last access */
-    __u32 sd_mtime;     /* time file was last modified  */
-    __u32 sd_ctime;     /* time inode (stat data) was last changed (except changes to sd_atime and sd_mtime) */
-    __u32 sd_blocks;
+    __le16 sd_mode;     /* file type, permissions */
+    __le16 sd_attrs;     /* persistent inode flags */
+    __le32 sd_nlink;    /* number of hard links */
+    __le64 sd_size;     /* file size */
+    __le32 sd_uid;              /* owner */
+    __le32 sd_gid;              /* group */
+    __le32 sd_atime;    /* time of last access */
+    __le32 sd_mtime;    /* time file was last modified  */
+    __le32 sd_ctime;    /* time inode (stat data) was last changed (except changes to sd_atime and sd_mtime) */
+    __le32 sd_blocks;
     union {
-        __u32 sd_rdev;
-        __u32 sd_generation;
-      //__u32 sd_first_direct_byte; 
+        __le32 sd_rdev;
+        __le32 sd_generation;
+      //__le32 sd_first_direct_byte;
       /* first byte of file which is stored in a
                                        direct item: except that if it equals 1
                                        it is a symlink and if it equals
@@ -993,12 +958,12 @@ struct stat_data {
 
 struct reiserfs_de_head
 {
-  __u32 deh_offset;             /* third component of the directory entry key */
-  __u32 deh_dir_id;             /* objectid of the parent directory of the object, that is referenced
+  __le32 deh_offset;            /* third component of the directory entry key */
+  __le32 deh_dir_id;            /* objectid of the parent directory of the object, that is referenced
                                            by directory entry */
-  __u32 deh_objectid;           /* objectid of the object, that is referenced by directory entry */
-  __u16 deh_location;           /* offset of name in the whole item */
-  __u16 deh_state;              /* whether 1) entry contains stat data (for future), and 2) whether
+  __le32 deh_objectid;          /* objectid of the object, that is referenced by directory entry */
+  __le16 deh_location;          /* offset of name in the whole item */
+  __le16 deh_state;             /* whether 1) entry contains stat data (for future), and 2) whether
                                            entry is hidden (unlinked) */
 } __attribute__ ((__packed__));
 #define DEH_SIZE                  sizeof(struct reiserfs_de_head)
@@ -1058,10 +1023,10 @@ struct reiserfs_de_head
 #define de_visible(deh)             test_bit_unaligned (DEH_Visible, &((deh)->deh_state))
 #define de_hidden(deh)              !test_bit_unaligned (DEH_Visible, &((deh)->deh_state))
 
-extern void make_empty_dir_item_v1 (char * body, __u32 dirid, __u32 objid,
-                                    __u32 par_dirid, __u32 par_objid);
-extern void make_empty_dir_item (char * body, __u32 dirid, __u32 objid,
-                                 __u32 par_dirid, __u32 par_objid);
+extern void make_empty_dir_item_v1 (char * body, __le32 dirid, __le32 objid,
+                                    __le32 par_dirid, __le32 par_objid);
+extern void make_empty_dir_item (char * body, __le32 dirid, __le32 objid,
+                                 __le32 par_dirid, __le32 par_objid);
 
 /* array of the entry headers */
  /* get item body */
@@ -1160,9 +1125,9 @@ struct reiserfs_dir_entry
 /* Disk child pointer: The pointer from an internal node of the tree
    to a node that is on disk. */
 struct disk_child {
-  __u32       dc_block_number;              /* Disk child's block number. */
-  __u16       dc_size;                      /* Disk child's used space.   */
-  __u16       dc_reserved;
+  __le32       dc_block_number;              /* Disk child's block number. */
+  __le16       dc_size;                     /* Disk child's used space.   */
+  __le16       dc_reserved;
 };
 
 #define DC_SIZE (sizeof(struct disk_child))
@@ -1476,7 +1441,7 @@ struct tree_balance
   int fs_gen;                  /* saved value of `reiserfs_generation' counter
                                   see FILESYSTEM_CHANGED() macro in reiserfs_fs.h */
 #ifdef DISPLACE_NEW_PACKING_LOCALITIES
-  struct reiserfs_key  key;           /* key pointer, to pass to block allocator or
+  struct in_core_key  key;            /* key pointer, to pass to block allocator or
                                  another low-level subsystem */
 #endif
 } ;
@@ -1630,10 +1595,10 @@ struct reiserfs_iget_args {
 
 /* first block written in a commit.  */
 struct reiserfs_journal_desc {
-  __u32 j_trans_id ;                    /* id of commit */
-  __u32 j_len ;                 /* length of commit. len +1 is the commit block */
-  __u32 j_mount_id ;                            /* mount id of this trans*/
-  __u32 j_realblock[1] ; /* real locations for each block */
+  __le32 j_trans_id ;                   /* id of commit */
+  __le32 j_len ;                        /* length of commit. len +1 is the commit block */
+  __le32 j_mount_id ;                           /* mount id of this trans*/
+  __le32 j_realblock[1] ; /* real locations for each block */
 } ;
 
 #define get_desc_trans_id(d)   le32_to_cpu((d)->j_trans_id)
@@ -1646,9 +1611,9 @@ struct reiserfs_journal_desc {
 
 /* last block written in a commit */
 struct reiserfs_journal_commit {
-  __u32 j_trans_id ;                    /* must match j_trans_id from the desc block */
-  __u32 j_len ;                 /* ditto */
-  __u32 j_realblock[1] ; /* real locations for each block */
+  __le32 j_trans_id ;                   /* must match j_trans_id from the desc block */
+  __le32 j_len ;                        /* ditto */
+  __le32 j_realblock[1] ; /* real locations for each block */
 } ;
 
 #define get_commit_trans_id(c) le32_to_cpu((c)->j_trans_id)
@@ -1663,9 +1628,9 @@ struct reiserfs_journal_commit {
 ** and this transaction does not need to be replayed.
 */
 struct reiserfs_journal_header {
-  __u32 j_last_flush_trans_id ;         /* id of last fully flushed transaction */
-  __u32 j_first_unflushed_offset ;      /* offset in the log of where to start replay after a crash */
-  __u32 j_mount_id ;
+  __le32 j_last_flush_trans_id ;                /* id of last fully flushed transaction */
+  __le32 j_first_unflushed_offset ;      /* offset in the log of where to start replay after a crash */
+  __le32 j_mount_id ;
   /* 12 */ struct journal_params jh_journal;
 } ;
 
@@ -2117,7 +2082,7 @@ struct buffer_head * get_FEB (struct tree_balance *);
  struct __reiserfs_blocknr_hint {
      struct inode * inode;              /* inode passed to allocator, if we allocate unf. nodes */
      long block;                        /* file offset, in blocks */
-     struct reiserfs_key key;
+     struct in_core_key key;
      struct path * path;                /* search path, used by allocator to deternine search_start by
                                          * various ways */
      struct reiserfs_transaction_handle * th; /* transaction handle is needed to log super blocks and
@@ -2144,7 +2109,7 @@ void reiserfs_init_alloc_options (struct super_block *s);
  * to use for a new object underneat it.  The locality is returned
  * in disk byte order (le).
  */
-u32 reiserfs_choose_packing(struct inode *dir);
+__le32 reiserfs_choose_packing(struct inode *dir);
 
 int is_reusable (struct super_block * s, b_blocknr_t block, int bit_value);
 void reiserfs_free_block (struct reiserfs_transaction_handle *th, struct inode *, b_blocknr_t, int for_unformatted);
diff --git a/include/linux/reiserfs_xattr.h b/include/linux/reiserfs_xattr.h
index 1eaa48eca811..9244c5748820 100644
--- a/include/linux/reiserfs_xattr.h
+++ b/include/linux/reiserfs_xattr.h
@@ -10,8 +10,8 @@
 #define REISERFS_XATTR_MAGIC 0x52465841 /* "RFXA" */
 
 struct reiserfs_xattr_header {
-    __u32 h_magic;              /* magic number for identification */
-    __u32 h_hash;               /* hash of the value */
+    __le32 h_magic;              /* magic number for identification */
+    __le32 h_hash;               /* hash of the value */
 };
 
 #ifdef __KERNEL__
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 32e52769a00b..91ac97c20777 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -89,10 +89,14 @@ enum {
         RTM_GETANYCAST  = 62,
 #define RTM_GETANYCAST  RTM_GETANYCAST
 
-        RTM_MAX,
-#define RTM_MAX         RTM_MAX
+        __RTM_MAX,
+#define RTM_MAX         (((__RTM_MAX + 3) & ~3) - 1)
 };
 
+#define RTM_NR_MSGTYPES (RTM_MAX + 1 - RTM_BASE)
+#define RTM_NR_FAMILIES (RTM_NR_MSGTYPES >> 2)
+#define RTM_FAM(cmd)    (((cmd) - RTM_BASE) >> 2)
+
 /* 
    Generic structure for encapsulation of optional route information.
    It is reminiscent of sockaddr, but with sa_family replaced
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 1cced971232c..5f868a588581 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -845,6 +845,7 @@ extern void sched_idle_next(void);
 extern void set_user_nice(task_t *p, long nice);
 extern int task_prio(const task_t *p);
 extern int task_nice(const task_t *p);
+extern int can_nice(const task_t *p, const int nice);
 extern int task_curr(const task_t *p);
 extern int idle_cpu(int cpu);
 extern int sched_setscheduler(struct task_struct *, int, struct sched_param *);
@@ -1011,7 +1012,6 @@ extern int  copy_thread(int, unsigned long, unsigned long, unsigned long, struct
 extern void flush_thread(void);
 extern void exit_thread(void);
 
-extern void exit_mm(struct task_struct *);
 extern void exit_files(struct task_struct *);
 extern void exit_signal(struct task_struct *);
 extern void __exit_signal(struct task_struct *);
diff --git a/include/linux/signal.h b/include/linux/signal.h
index 99c97ad026c8..0a98f5ec5cae 100644
--- a/include/linux/signal.h
+++ b/include/linux/signal.h
@@ -9,6 +9,17 @@
 #ifdef __KERNEL__
 
 /*
+ * These values of sa_flags are used only by the kernel as part of the
+ * irq handling routines.
+ *
+ * SA_INTERRUPT is also used by the irq handling routines.
+ * SA_SHIRQ is for shared interrupt support on PCI and EISA.
+ */
+#define SA_PROBE                SA_ONESHOT
+#define SA_SAMPLE_RANDOM        SA_RESTART
+#define SA_SHIRQ                0x04000000
+
+/*
  * Real Time signals may be queued.
  */
 
@@ -209,6 +220,12 @@ static inline void init_sigpending(struct sigpending *sig)
         INIT_LIST_HEAD(&sig->list);
 }
 
+/* Test if 'sig' is valid signal. Use this instead of testing _NSIG directly */
+static inline int valid_signal(unsigned long sig)
+{
+        return sig <= _NSIG ? 1 : 0;
+}
+
 extern int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p);
 extern int __group_send_sig_info(int, struct siginfo *, struct task_struct *);
 extern long do_sigpending(void __user *, unsigned long);
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 22b701819619..cc04f5cd2286 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -167,13 +167,14 @@ struct skb_shared_info {
  *      @h: Transport layer header
  *      @nh: Network layer header
  *      @mac: Link layer header
- *      @dst: FIXME: Describe this field
+ *      @dst: destination entry
+ *      @sp: the security path, used for xfrm
  *      @cb: Control buffer. Free for use by every layer. Put private vars here
  *      @len: Length of actual data
  *      @data_len: Data length
  *      @mac_len: Length of link layer header
  *      @csum: Checksum
- *      @__unused: Dead field, may be reused
+ *      @local_df: allow local fragmentation
  *      @cloned: Head may be cloned (check refcnt to be sure)
  *      @nohdr: Payload reference only, must not modify header
  *      @pkt_type: Packet class
@@ -968,6 +969,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list)
                 kfree_skb(skb);
 }
 
+#ifndef CONFIG_HAVE_ARCH_DEV_ALLOC_SKB
 /**
  *      __dev_alloc_skb - allocate an skbuff for sending
  *      @length: length to allocate
@@ -980,7 +982,6 @@ static inline void __skb_queue_purge(struct sk_buff_head *list)
  *
  *      %NULL is returned in there is no free memory.
  */
-#ifndef CONFIG_HAVE_ARCH_DEV_ALLOC_SKB
 static inline struct sk_buff *__dev_alloc_skb(unsigned int length,
                                               int gfp_mask)
 {
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 3e3c3ab8ff94..7d66385ae750 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -62,16 +62,9 @@ extern kmem_cache_t *kmem_cache_create(const char *, size_t, size_t, unsigned lo
 extern int kmem_cache_destroy(kmem_cache_t *);
 extern int kmem_cache_shrink(kmem_cache_t *);
 extern void *kmem_cache_alloc(kmem_cache_t *, unsigned int __nocast);
-#ifdef CONFIG_NUMA
-extern void *kmem_cache_alloc_node(kmem_cache_t *, int);
-#else
-static inline void *kmem_cache_alloc_node(kmem_cache_t *cachep, int node)
-{
-        return kmem_cache_alloc(cachep, GFP_KERNEL);
-}
-#endif
 extern void kmem_cache_free(kmem_cache_t *, void *);
 extern unsigned int kmem_cache_size(kmem_cache_t *);
+extern kmem_cache_t *kmem_find_general_cachep(size_t size, int gfpflags);
 
 /* Size description struct for general caches. */
 struct cache_sizes {
@@ -109,6 +102,20 @@ extern void *kcalloc(size_t, size_t, unsigned int __nocast);
 extern void kfree(const void *);
 extern unsigned int ksize(const void *);
 
+#ifdef CONFIG_NUMA
+extern void *kmem_cache_alloc_node(kmem_cache_t *, int flags, int node);
+extern void *kmalloc_node(size_t size, int flags, int node);
+#else
+static inline void *kmem_cache_alloc_node(kmem_cache_t *cachep, int flags, int node)
+{
+        return kmem_cache_alloc(cachep, flags);
+}
+static inline void *kmalloc_node(size_t size, int flags, int node)
+{
+        return kmalloc(size, flags);
+}
+#endif
+
 extern int FASTCALL(kmem_cache_reap(int));
 extern int FASTCALL(kmem_ptr_validate(kmem_cache_t *cachep, void *ptr));
 
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 757cd9be7743..c39f6f72cbbc 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -456,8 +456,7 @@ asmlinkage long sys_semctl(int semid, int semnum, int cmd, union semun arg);
 asmlinkage long sys_semtimedop(int semid, struct sembuf __user *sops,
                                 unsigned nsops,
                                 const struct timespec __user *timeout);
-asmlinkage long sys_shmat(int shmid, char __user *shmaddr,
-                                int shmflg, unsigned long __user *addr);
+asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg);
 asmlinkage long sys_shmget(key_t key, size_t size, int flag);
 asmlinkage long sys_shmdt(char __user *shmaddr);
 asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 358d52b0c445..772998147e3e 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -643,6 +643,7 @@ enum {
         NET_SCTP_MAX_BURST               = 12,
         NET_SCTP_ADDIP_ENABLE            = 13,
         NET_SCTP_PRSCTP_ENABLE           = 14,
+        NET_SCTP_SNDBUF_POLICY           = 15,
 };
 
 /* /proc/sys/net/bridge */
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index f0df02ae68a4..fd2ef742a9fd 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -140,8 +140,11 @@ enum {
         XFRM_MSG_FLUSHPOLICY,
 #define XFRM_MSG_FLUSHPOLICY XFRM_MSG_FLUSHPOLICY
 
-        XFRM_MSG_MAX
+        __XFRM_MSG_MAX
 };
+#define XFRM_MSG_MAX (__XFRM_MSG_MAX - 1)
+
+#define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)
 
 struct xfrm_user_tmpl {
         struct xfrm_id          id;
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 7af9a13cb9be..f1e5af4be98e 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -46,6 +46,7 @@ struct prefix_info {
 #include <linux/in6.h>
 #include <linux/netdevice.h>
 #include <net/if_inet6.h>
+#include <net/ipv6.h>
 
 #define IN6_ADDR_HSIZE          16
 
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 87496e3aa330..fcb05a387dbe 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -140,7 +140,7 @@ psched_tod_diff(int delta_sec, int bound)
         if (bound <= 1000000 || delta_sec > (0x7FFFFFFF/1000000)-1)
                 return bound;
         delta = delta_sec * 1000000;
-        if (delta > bound)
+        if (delta > bound || delta < 0)
                 delta = bound;
         return delta;
 }
@@ -156,7 +156,9 @@ psched_tod_diff(int delta_sec, int bound)
                    __delta += 1000000; \
            case 1: \
                    __delta += 1000000; \
-           case 0: ; \
+           case 0: \
+                   if (__delta > bound || __delta < 0) \
+                        __delta = bound; \
            } \
            __delta; \
 })
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 5576db56324d..f4fcee104707 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -407,32 +407,38 @@ sctp_vtag_verify(const struct sctp_chunk *chunk,
         return 0;
 }
 
-/* Check VTAG of the packet matches the sender's own tag OR its peer's
- * tag and the T bit is set in the Chunk Flags.
+/* Check VTAG of the packet matches the sender's own tag and the T bit is
+ * not set, OR its peer's tag and the T bit is set in the Chunk Flags.
  */
 static inline int
 sctp_vtag_verify_either(const struct sctp_chunk *chunk,
                         const struct sctp_association *asoc)
 {
-        /* RFC 2960 Section 8.5.1, sctpimpguide-06 Section 2.13.2
+        /* RFC 2960 Section 8.5.1, sctpimpguide Section 2.41
          *
-         * B) The receiver of a ABORT shall accept the packet if the
-         * Verification Tag field of the packet matches its own tag OR it
-         * is set to its peer's tag and the T bit is set in the Chunk
-         * Flags. Otherwise, the receiver MUST silently discard the packet
-         * and take no further action.
-         *
-         * (C) The receiver of a SHUTDOWN COMPLETE shall accept the
-         * packet if the Verification Tag field of the packet
-         * matches its own tag OR it is set to its peer's tag and
-         * the T bit is set in the Chunk Flags.  Otherwise, the
-         * receiver MUST silently discard the packet and take no
-         * further action....
+         * B) The receiver of a ABORT MUST accept the packet
+         *    if the Verification Tag field of the packet matches its own tag
+         *    and the T bit is not set
+         *    OR
+         *    it is set to its peer's tag and the T bit is set in the Chunk
+         *    Flags.
+         *    Otherwise, the receiver MUST silently discard the packet
+         *    and take no further action.
          *
+         * C) The receiver of a SHUTDOWN COMPLETE shall accept the packet
+         *    if the Verification Tag field of the packet matches its own tag
+         *    and the T bit is not set
+         *    OR
+         *    it is set to its peer's tag and the T bit is set in the Chunk
+         *    Flags.
+         *    Otherwise, the receiver MUST silently discard the packet
+         *    and take no further action.  An endpoint MUST ignore the
+         *    SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
          */
-        if ((ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag) ||
-            (sctp_test_T_bit(chunk) && (ntohl(chunk->sctp_hdr->vtag)
-            == asoc->c.peer_vtag))) {
+        if ((!sctp_test_T_bit(chunk) &&
+             (ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag)) ||
+            (sctp_test_T_bit(chunk) &&
+             (ntohl(chunk->sctp_hdr->vtag) == asoc->c.peer_vtag))) {
                 return 1;
         }
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 7e64cf6bda1e..6c24d9cd3d66 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -154,6 +154,13 @@ extern struct sctp_globals {
         int max_retrans_path;
         int max_retrans_init;
 
+        /*
+         * Policy for preforming sctp/socket accounting
+         * 0   - do socket level accounting, all assocs share sk_sndbuf
+         * 1   - do sctp accounting, each asoc may use sk_sndbuf bytes
+         */
+        int sndbuf_policy;
+
         /* HB.interval              - 30 seconds  */
         int hb_interval;
 
@@ -207,6 +214,7 @@ extern struct sctp_globals {
 #define sctp_valid_cookie_life          (sctp_globals.valid_cookie_life)
 #define sctp_cookie_preserve_enable     (sctp_globals.cookie_preserve_enable)
 #define sctp_max_retrans_association    (sctp_globals.max_retrans_association)
+#define sctp_sndbuf_policy              (sctp_globals.sndbuf_policy)
 #define sctp_max_retrans_path           (sctp_globals.max_retrans_path)
 #define sctp_max_retrans_init           (sctp_globals.max_retrans_init)
 #define sctp_hb_interval                (sctp_globals.hb_interval)
@@ -1212,7 +1220,8 @@ struct sctp_endpoint {
         /* Default timeouts.  */
         int timeouts[SCTP_NUM_TIMEOUT_TYPES];
 
-        /* Various thresholds.  */
+        /* sendbuf acct. policy.        */
+        __u32 sndbuf_policy;
 
         /* Name for debugging output... */
         char *debug_name;
diff --git a/include/net/sock.h b/include/net/sock.h
index be81cabd0da3..cc4c9190b7fd 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -90,17 +90,17 @@ do {	spin_lock_init(&((__sk)->sk_lock.slock)); \
 struct sock;
 
 /**
-  *     struct sock_common - minimal network layer representation of sockets
-  *     @skc_family - network address family
-  *     @skc_state - Connection state
-  *     @skc_reuse - %SO_REUSEADDR setting
-  *     @skc_bound_dev_if - bound device index if != 0
-  *     @skc_node - main hash linkage for various protocol lookup tables
-  *     @skc_bind_node - bind hash linkage for various protocol lookup tables
-  *     @skc_refcnt - reference count
-  *
-  *     This is the minimal network layer representation of sockets, the header
-  *     for struct sock and struct tcp_tw_bucket.
+ *      struct sock_common - minimal network layer representation of sockets
+ *      @skc_family: network address family
+ *      @skc_state: Connection state
+ *      @skc_reuse: %SO_REUSEADDR setting
+ *      @skc_bound_dev_if: bound device index if != 0
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_bind_node: bind hash linkage for various protocol lookup tables
+ *      @skc_refcnt: reference count
+ *
+ *      This is the minimal network layer representation of sockets, the header
+ *      for struct sock and struct tcp_tw_bucket.
   */
 struct sock_common {
         unsigned short          skc_family;
@@ -114,60 +114,61 @@ struct sock_common {
 
 /**
   *     struct sock - network layer representation of sockets
-  *     @__sk_common - shared layout with tcp_tw_bucket
-  *     @sk_shutdown - mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
-  *     @sk_userlocks - %SO_SNDBUF and %SO_RCVBUF settings
-  *     @sk_lock -      synchronizer
-  *     @sk_rcvbuf - size of receive buffer in bytes
-  *     @sk_sleep - sock wait queue
-  *     @sk_dst_cache - destination cache
-  *     @sk_dst_lock - destination cache lock
-  *     @sk_policy - flow policy
-  *     @sk_rmem_alloc - receive queue bytes committed
-  *     @sk_receive_queue - incoming packets
-  *     @sk_wmem_alloc - transmit queue bytes committed
-  *     @sk_write_queue - Packet sending queue
-  *     @sk_omem_alloc - "o" is "option" or "other"
-  *     @sk_wmem_queued - persistent queue size
-  *     @sk_forward_alloc - space allocated forward
-  *     @sk_allocation - allocation mode
-  *     @sk_sndbuf - size of send buffer in bytes
-  *     @sk_flags - %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE, %SO_OOBINLINE settings
-  *     @sk_no_check - %SO_NO_CHECK setting, wether or not checkup packets
-  *     @sk_route_caps - route capabilities (e.g. %NETIF_F_TSO)
-  *     @sk_lingertime - %SO_LINGER l_linger setting
-  *     @sk_hashent - hash entry in several tables (e.g. tcp_ehash)
-  *     @sk_backlog - always used with the per-socket spinlock held
-  *     @sk_callback_lock - used with the callbacks in the end of this struct
-  *     @sk_error_queue - rarely used
-  *     @sk_prot - protocol handlers inside a network family
-  *     @sk_err - last error
-  *     @sk_err_soft - errors that don't cause failure but are the cause of a persistent failure not just 'timed out'
-  *     @sk_ack_backlog - current listen backlog
-  *     @sk_max_ack_backlog - listen backlog set in listen()
-  *     @sk_priority - %SO_PRIORITY setting
-  *     @sk_type - socket type (%SOCK_STREAM, etc)
-  *     @sk_protocol - which protocol this socket belongs in this network family
-  *     @sk_peercred - %SO_PEERCRED setting
-  *     @sk_rcvlowat - %SO_RCVLOWAT setting
-  *     @sk_rcvtimeo - %SO_RCVTIMEO setting
-  *     @sk_sndtimeo - %SO_SNDTIMEO setting
-  *     @sk_filter - socket filtering instructions
-  *     @sk_protinfo - private area, net family specific, when not using slab
-  *     @sk_timer - sock cleanup timer
-  *     @sk_stamp - time stamp of last packet received
-  *     @sk_socket - Identd and reporting IO signals
-  *     @sk_user_data - RPC layer private data
-  *     @sk_sndmsg_page - cached page for sendmsg
-  *     @sk_sndmsg_off - cached offset for sendmsg
-  *     @sk_send_head - front of stuff to transmit
-  *     @sk_write_pending - a write to stream socket waits to start
-  *     @sk_state_change - callback to indicate change in the state of the sock
-  *     @sk_data_ready - callback to indicate there is data to be processed
-  *     @sk_write_space - callback to indicate there is bf sending space available
-  *     @sk_error_report - callback to indicate errors (e.g. %MSG_ERRQUEUE)
-  *     @sk_backlog_rcv - callback to process the backlog
-  *     @sk_destruct - called at sock freeing time, i.e. when all refcnt == 0
+  *     @__sk_common: shared layout with tcp_tw_bucket
+  *     @sk_shutdown: mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
+  *     @sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
+  *     @sk_lock:       synchronizer
+  *     @sk_rcvbuf: size of receive buffer in bytes
+  *     @sk_sleep: sock wait queue
+  *     @sk_dst_cache: destination cache
+  *     @sk_dst_lock: destination cache lock
+  *     @sk_policy: flow policy
+  *     @sk_rmem_alloc: receive queue bytes committed
+  *     @sk_receive_queue: incoming packets
+  *     @sk_wmem_alloc: transmit queue bytes committed
+  *     @sk_write_queue: Packet sending queue
+  *     @sk_omem_alloc: "o" is "option" or "other"
+  *     @sk_wmem_queued: persistent queue size
+  *     @sk_forward_alloc: space allocated forward
+  *     @sk_allocation: allocation mode
+  *     @sk_sndbuf: size of send buffer in bytes
+  *     @sk_flags: %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE, %SO_OOBINLINE settings
+  *     @sk_no_check: %SO_NO_CHECK setting, wether or not checkup packets
+  *     @sk_route_caps: route capabilities (e.g. %NETIF_F_TSO)
+  *     @sk_lingertime: %SO_LINGER l_linger setting
+  *     @sk_hashent: hash entry in several tables (e.g. tcp_ehash)
+  *     @sk_backlog: always used with the per-socket spinlock held
+  *     @sk_callback_lock: used with the callbacks in the end of this struct
+  *     @sk_error_queue: rarely used
+  *     @sk_prot: protocol handlers inside a network family
+  *     @sk_err: last error
+  *     @sk_err_soft: errors that don't cause failure but are the cause of a persistent failure not just 'timed out'
+  *     @sk_ack_backlog: current listen backlog
+  *     @sk_max_ack_backlog: listen backlog set in listen()
+  *     @sk_priority: %SO_PRIORITY setting
+  *     @sk_type: socket type (%SOCK_STREAM, etc)
+  *     @sk_protocol: which protocol this socket belongs in this network family
+  *     @sk_peercred: %SO_PEERCRED setting
+  *     @sk_rcvlowat: %SO_RCVLOWAT setting
+  *     @sk_rcvtimeo: %SO_RCVTIMEO setting
+  *     @sk_sndtimeo: %SO_SNDTIMEO setting
+  *     @sk_filter: socket filtering instructions
+  *     @sk_protinfo: private area, net family specific, when not using slab
+  *     @sk_timer: sock cleanup timer
+  *     @sk_stamp: time stamp of last packet received
+  *     @sk_socket: Identd and reporting IO signals
+  *     @sk_user_data: RPC layer private data
+  *     @sk_sndmsg_page: cached page for sendmsg
+  *     @sk_sndmsg_off: cached offset for sendmsg
+  *     @sk_send_head: front of stuff to transmit
+  *     @sk_security: used by security modules
+  *     @sk_write_pending: a write to stream socket waits to start
+  *     @sk_state_change: callback to indicate change in the state of the sock
+  *     @sk_data_ready: callback to indicate there is data to be processed
+  *     @sk_write_space: callback to indicate there is bf sending space available
+  *     @sk_error_report: callback to indicate errors (e.g. %MSG_ERRQUEUE)
+  *     @sk_backlog_rcv: callback to process the backlog
+  *     @sk_destruct: called at sock freeing time, i.e. when all refcnt == 0
  */
 struct sock {
         /*
@@ -1223,8 +1224,8 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
 
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
- * @sk - socket to eat this skb from
- * @skb - socket buffer to eat
+ * @sk: socket to eat this skb from
+ * @skb: socket buffer to eat
  *
  * This routine must be called with interrupts disabled or with the socket
  * locked so that the sk_buff queue operation is ok.
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 73e9a8ca3d3b..e142a256d5dc 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1,6 +1,7 @@
 #ifndef _NET_XFRM_H
 #define _NET_XFRM_H
 
+#include <linux/compiler.h>
 #include <linux/xfrm.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
@@ -516,6 +517,15 @@ struct xfrm_dst
         u32 child_mtu_cached;
 };
 
+static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
+{
+        dst_release(xdst->route);
+        if (likely(xdst->u.dst.xfrm))
+                xfrm_state_put(xdst->u.dst.xfrm);
+}
+
+extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
+
 /* Decapsulation state, used by the input to store data during
  * decapsulation procedure, to be used later (during the policy
  * check
diff --git a/include/video/edid.h b/include/video/edid.h
index abc1b489c0db..b913f196131d 100644
--- a/include/video/edid.h
+++ b/include/video/edid.h
@@ -4,9 +4,6 @@
 #ifdef __KERNEL__
 
 #include <linux/config.h>
-#ifdef CONFIG_PPC_OF
-#include <linux/pci.h>
-#endif
 
 #ifdef CONFIG_X86
 struct edid_info {
@@ -14,14 +11,8 @@ struct edid_info {
 };
 
 extern struct edid_info edid_info;
-extern char *get_EDID_from_BIOS(void *);
-
 #endif /* CONFIG_X86 */
 
-#ifdef CONFIG_PPC_OF
-extern char *get_EDID_from_OF(struct pci_dev *pdev);
-#endif
-
 #endif /* __KERNEL__ */
 
 #endif /* __linux_video_edid_h__ */
diff --git a/include/video/tdfx.h b/include/video/tdfx.h
index a896e4442060..04237676b17c 100644
--- a/include/video/tdfx.h
+++ b/include/video/tdfx.h
@@ -99,6 +99,8 @@
 #define MISCINIT1_2DBLOCK_DIS           BIT(15)
 #define DRAMINIT0_SGRAM_NUM             BIT(26)
 #define DRAMINIT0_SGRAM_TYPE            BIT(27)
+#define DRAMINIT0_SGRAM_TYPE_MASK       (BIT(27)|BIT(28)|BIT(29))
+#define DRAMINIT0_SGRAM_TYPE_SHIFT      27
 #define DRAMINIT1_MEM_SDRAM             BIT(30)
 #define VGAINIT0_VGA_DISABLE            BIT(0)
 #define VGAINIT0_EXT_TIMING             BIT(1)
diff --git a/init/Kconfig b/init/Kconfig
index abe2682a6ca6..40d286d1d118 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -275,6 +275,27 @@ config KALLSYMS_EXTRA_PASS
            reported.  KALLSYMS_EXTRA_PASS is only a temporary workaround while
            you wait for kallsyms to be fixed.
 
+
+config PRINTK
+        default y
+        bool "Enable support for printk" if EMBEDDED
+        help
+          This option enables normal printk support. Removing it
+          eliminates most of the message strings from the kernel image
+          and makes the kernel more or less silent. As this makes it
+          very difficult to diagnose system problems, saying N here is
+          strongly discouraged.
+
+config BUG
+        bool "BUG() support" if EMBEDDED
+        default y
+        help
+          Disabling this option eliminates support for BUG and WARN, reducing
+          the size of your kernel image and potentially quietly ignoring
+          numerous fatal conditions. You should only consider disabling this
+          option for embedded systems with no facilities for reporting errors.
+          Just say Y.
+
 config BASE_FULL
         default y
         bool "Enable full-sized data structures for core" if EMBEDDED
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index cb0cd3cf3b5a..0acf245f441d 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -23,6 +23,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/syscalls.h>
+#include <linux/signal.h>
 #include <net/sock.h>
 #include "util.h"
 
@@ -767,7 +768,7 @@ static inline void pipelined_send(struct mqueue_inode_info *info,
         list_del(&receiver->list);
         receiver->state = STATE_PENDING;
         wake_up_process(receiver->task);
-        wmb();
+        smp_wmb();
         receiver->state = STATE_READY;
 }
 
@@ -786,7 +787,7 @@ static inline void pipelined_receive(struct mqueue_inode_info *info)
         list_del(&sender->list);
         sender->state = STATE_PENDING;
         wake_up_process(sender->task);
-        wmb();
+        smp_wmb();
         sender->state = STATE_READY;
 }
 
@@ -976,8 +977,7 @@ asmlinkage long sys_mq_notify(mqd_t mqdes,
                              notification.sigev_notify != SIGEV_THREAD))
                         return -EINVAL;
                 if (notification.sigev_notify == SIGEV_SIGNAL &&
-                        (notification.sigev_signo < 0 ||
-                         notification.sigev_signo > _NSIG)) {
+                        !valid_signal(notification.sigev_signo)) {
                         return -EINVAL;
                 }
                 if (notification.sigev_notify == SIGEV_THREAD) {
diff --git a/ipc/shm.c b/ipc/shm.c
index 06cd5c91056f..cce022435dbc 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -28,6 +28,8 @@
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/audit.h>
+#include <linux/ptrace.h>
+
 #include <asm/uaccess.h>
 
 #include "util.h"
@@ -771,6 +773,18 @@ out:
         return err;
 }
 
+asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
+{
+        unsigned long ret;
+        long err;
+
+        err = do_shmat(shmid, shmaddr, shmflg, &ret);
+        if (err)
+                return err;
+        force_successful_syscall_return();
+        return (long)ret;
+}
+
 /*
  * detach and kill segment if marked destroyed.
  * The work is done in shm_close.
diff --git a/kernel/audit.c b/kernel/audit.c
index 0f84dd7af2c8..ac26d4d960d3 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -427,7 +427,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 /* Get message from skb (based on rtnetlink_rcv_skb).  Each message is
  * processed by audit_receive_msg.  Malformed skbs with wrong length are
  * discarded silently.  */
-static int audit_receive_skb(struct sk_buff *skb)
+static void audit_receive_skb(struct sk_buff *skb)
 {
         int             err;
         struct nlmsghdr *nlh;
@@ -436,7 +436,7 @@ static int audit_receive_skb(struct sk_buff *skb)
         while (skb->len >= NLMSG_SPACE(0)) {
                 nlh = (struct nlmsghdr *)skb->data;
                 if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
-                        return 0;
+                        return;
                 rlen = NLMSG_ALIGN(nlh->nlmsg_len);
                 if (rlen > skb->len)
                         rlen = skb->len;
@@ -446,23 +446,20 @@ static int audit_receive_skb(struct sk_buff *skb)
                         netlink_ack(skb, nlh, 0);
                 skb_pull(skb, rlen);
         }
-        return 0;
 }
 
 /* Receive messages from netlink socket. */
 static void audit_receive(struct sock *sk, int length)
 {
         struct sk_buff  *skb;
+        unsigned int qlen;
 
-        if (down_trylock(&audit_netlink_sem))
-                return;
+        down(&audit_netlink_sem);
 
-                                /* FIXME: this must not cause starvation */
-        while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
-                if (audit_receive_skb(skb) && skb->len)
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                else
-                        kfree_skb(skb);
+        for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                audit_receive_skb(skb);
+                kfree_skb(skb);
         }
         up(&audit_netlink_sem);
 }
diff --git a/kernel/exit.c b/kernel/exit.c
index 39d35935b371..7be283d98983 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -27,6 +27,7 @@
 #include <linux/mempolicy.h>
 #include <linux/cpuset.h>
 #include <linux/syscalls.h>
+#include <linux/signal.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -38,6 +39,8 @@ extern struct task_struct *child_reaper;
 
 int getrusage(struct task_struct *, int, struct rusage __user *);
 
+static void exit_mm(struct task_struct * tsk);
+
 static void __unhash_process(struct task_struct *p)
 {
         nr_threads--;
@@ -209,7 +212,7 @@ static inline int has_stopped_jobs(int pgrp)
 }
 
 /**
- * reparent_to_init() - Reparent the calling kernel thread to the init task.
+ * reparent_to_init - Reparent the calling kernel thread to the init task.
  *
  * If a kernel thread is launched as a result of a system call, or if
  * it ever exits, it should generally reparent itself to init so that
@@ -277,7 +280,7 @@ void set_special_pids(pid_t session, pid_t pgrp)
  */
 int allow_signal(int sig)
 {
-        if (sig < 1 || sig > _NSIG)
+        if (!valid_signal(sig) || sig < 1)
                 return -EINVAL;
 
         spin_lock_irq(&current->sighand->siglock);
@@ -298,7 +301,7 @@ EXPORT_SYMBOL(allow_signal);
 
 int disallow_signal(int sig)
 {
-        if (sig < 1 || sig > _NSIG)
+        if (!valid_signal(sig) || sig < 1)
                 return -EINVAL;
 
         spin_lock_irq(&current->sighand->siglock);
@@ -473,7 +476,7 @@ EXPORT_SYMBOL_GPL(exit_fs);
  * Turn us into a lazy TLB process if we
  * aren't already..
  */
-void exit_mm(struct task_struct * tsk)
+static void exit_mm(struct task_struct * tsk)
 {
         struct mm_struct *mm = tsk->mm;
 
@@ -517,8 +520,6 @@ static inline void choose_new_parent(task_t *p, task_t *reaper, task_t *child_re
          */
         BUG_ON(p == reaper || reaper->exit_state >= EXIT_ZOMBIE);
         p->real_parent = reaper;
-        if (p->parent == p->real_parent)
-                BUG();
 }
 
 static inline void reparent_thread(task_t *p, task_t *father, int traced)
diff --git a/kernel/futex.c b/kernel/futex.c
index 7b54a672d0ad..c7130f86106c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -39,6 +39,7 @@
 #include <linux/mount.h>
 #include <linux/pagemap.h>
 #include <linux/syscalls.h>
+#include <linux/signal.h>
 
 #define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8)
 
@@ -654,7 +655,7 @@ static int futex_fd(unsigned long uaddr, int signal)
         int ret, err;
 
         ret = -EINVAL;
-        if (signal < 0 || signal > _NSIG)
+        if (!valid_signal(signal))
                 goto out;
 
         ret = get_unused_fd();
diff --git a/kernel/kthread.c b/kernel/kthread.c
index e377e2244103..f50f174e92da 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -174,7 +174,7 @@ int kthread_stop(struct task_struct *k)
 
         /* Must init completion *before* thread sees kthread_stop_info.k */
         init_completion(&kthread_stop_info.done);
-        wmb();
+        smp_wmb();
 
         /* Now set kthread_should_stop() to true, and wake it up. */
         kthread_stop_info.k = k;
diff --git a/kernel/module.c b/kernel/module.c
index 2dbfa0773faf..5734ab09d3f9 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1801,7 +1801,7 @@ sys_init_module(void __user *umod,
                 /* Init routine failed: abort.  Try to protect us from
                    buggy refcounters. */
                 mod->state = MODULE_STATE_GOING;
-                synchronize_kernel();
+                synchronize_sched();
                 if (mod->unsafe)
                         printk(KERN_ERR "%s: module is now stuck!\n",
                                mod->name);
diff --git a/kernel/power/swsusp.c b/kernel/power/swsusp.c
index ae5bebc3b18f..90b3b68dee3f 100644
--- a/kernel/power/swsusp.c
+++ b/kernel/power/swsusp.c
@@ -1099,7 +1099,7 @@ static struct pbe * swsusp_pagedir_relocate(struct pbe *pblist)
         return pblist;
 }
 
-/**
+/*
  *      Using bio to read from swap.
  *      This code requires a bit more work than just using buffer heads
  *      but, it is the recommended way for 2.5/2.6.
diff --git a/kernel/printk.c b/kernel/printk.c
index 1498689548d1..290a07ce2c8a 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -85,10 +85,6 @@ static int console_locked;
  */
 static DEFINE_SPINLOCK(logbuf_lock);
 
-static char __log_buf[__LOG_BUF_LEN];
-static char *log_buf = __log_buf;
-static int log_buf_len = __LOG_BUF_LEN;
-
 #define LOG_BUF_MASK    (log_buf_len-1)
 #define LOG_BUF(idx) (log_buf[(idx) & LOG_BUF_MASK])
 
@@ -99,7 +95,6 @@ static int log_buf_len = __LOG_BUF_LEN;
 static unsigned long log_start; /* Index into log_buf: next char to be read by syslog() */
 static unsigned long con_start; /* Index into log_buf: next char to be sent to consoles */
 static unsigned long log_end;   /* Index into log_buf: most-recently-written-char + 1 */
-static unsigned long logged_chars; /* Number of chars produced since last read+clear operation */
 
 /*
  *      Array of consoles built from command line options (console=)
@@ -120,6 +115,13 @@ static int preferred_console = -1;
 /* Flag: console code may call schedule() */
 static int console_may_schedule;
 
+#ifdef CONFIG_PRINTK
+
+static char __log_buf[__LOG_BUF_LEN];
+static char *log_buf = __log_buf;
+static int log_buf_len = __LOG_BUF_LEN;
+static unsigned long logged_chars; /* Number of chars produced since last read+clear operation */
+
 /*
  *      Setup a list of consoles. Called from init/main.c
  */
@@ -535,6 +537,7 @@ __setup("time", printk_time_setup);
  * then changes console_loglevel may break. This is because console_loglevel
  * is inspected when the actual printing occurs.
  */
+
 asmlinkage int printk(const char *fmt, ...)
 {
         va_list args;
@@ -655,6 +658,18 @@ out:
 EXPORT_SYMBOL(printk);
 EXPORT_SYMBOL(vprintk);
 
+#else
+
+asmlinkage long sys_syslog(int type, char __user * buf, int len)
+{
+        return 0;
+}
+
+int do_syslog(int type, char __user * buf, int len) { return 0; }
+static void call_console_drivers(unsigned long start, unsigned long end) {}
+
+#endif
+
 /**
  * acquire_console_sem - lock the console system for exclusive use.
  *
@@ -931,7 +946,7 @@ int unregister_console(struct console * console)
         return res;
 }
 EXPORT_SYMBOL(unregister_console);
-        
+
 /**
  * tty_write_message - write a message to a certain tty, not just the console.
  *
diff --git a/kernel/profile.c b/kernel/profile.c
index a38fa70075fe..0221a50ca867 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -184,7 +184,7 @@ void unregister_timer_hook(int (*hook)(struct pt_regs *))
         WARN_ON(hook != timer_hook);
         timer_hook = NULL;
         /* make sure all CPUs see the NULL hook */
-        synchronize_kernel();
+        synchronize_sched();  /* Allow ongoing interrupts to complete. */
 }
 
 EXPORT_SYMBOL_GPL(register_timer_hook);
@@ -522,7 +522,7 @@ static int __init create_hash_tables(void)
         return 0;
 out_cleanup:
         prof_on = 0;
-        mb();
+        smp_mb();
         on_each_cpu(profile_nop, NULL, 0, 1);
         for_each_online_cpu(cpu) {
                 struct page *page;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 88b306c4e841..8dcb8f6288bc 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -16,6 +16,7 @@
 #include <linux/smp_lock.h>
 #include <linux/ptrace.h>
 #include <linux/security.h>
+#include <linux/signal.h>
 
 #include <asm/pgtable.h>
 #include <asm/uaccess.h>
@@ -135,7 +136,7 @@ int ptrace_attach(struct task_struct *task)
             (current->gid != task->sgid) ||
             (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE))
                 goto bad;
-        rmb();
+        smp_rmb();
         if (!task->mm->dumpable && !capable(CAP_SYS_PTRACE))
                 goto bad;
         /* the same process cannot be attached many times */
@@ -166,7 +167,7 @@ bad:
 
 int ptrace_detach(struct task_struct *child, unsigned int data)
 {
-        if ((unsigned long) data > _NSIG)
+        if (!valid_signal(data))
                 return  -EIO;
 
         /* Architecture-specific hardware disable .. */
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index d00eded75d71..f436993bd590 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -444,15 +444,18 @@ static void wakeme_after_rcu(struct rcu_head  *head)
 }
 
 /**
- * synchronize_kernel - wait until a grace period has elapsed.
+ * synchronize_rcu - wait until a grace period has elapsed.
  *
  * Control will return to the caller some time after a full grace
  * period has elapsed, in other words after all currently executing RCU
  * read-side critical sections have completed.  RCU read-side critical
  * sections are delimited by rcu_read_lock() and rcu_read_unlock(),
  * and may be nested.
+ *
+ * If your read-side code is not protected by rcu_read_lock(), do -not-
+ * use synchronize_rcu().
  */
-void synchronize_kernel(void)
+void synchronize_rcu(void)
 {
         struct rcu_synchronize rcu;
 
@@ -464,7 +467,16 @@ void synchronize_kernel(void)
         wait_for_completion(&rcu.completion);
 }
 
+/*
+ * Deprecated, use synchronize_rcu() or synchronize_sched() instead.
+ */
+void synchronize_kernel(void)
+{
+        synchronize_rcu();
+}
+
 module_param(maxbatch, int, 0);
-EXPORT_SYMBOL_GPL(call_rcu);
-EXPORT_SYMBOL_GPL(call_rcu_bh);
-EXPORT_SYMBOL_GPL(synchronize_kernel);
+EXPORT_SYMBOL(call_rcu);  /* WARNING: GPL-only in April 2006. */
+EXPORT_SYMBOL(call_rcu_bh);  /* WARNING: GPL-only in April 2006. */
+EXPORT_SYMBOL_GPL(synchronize_rcu);
+EXPORT_SYMBOL(synchronize_kernel);  /* WARNING: GPL-only in April 2006. */
diff --git a/kernel/sched.c b/kernel/sched.c
index 9bb7489ee645..0dc3158667a2 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -2906,6 +2906,7 @@ static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
  * @q: the waitqueue
  * @mode: which threads
  * @nr_exclusive: how many wake-one or wake-many threads to wake up
+ * @key: is directly passed to the wakeup function
  */
 void fastcall __wake_up(wait_queue_head_t *q, unsigned int mode,
                                 int nr_exclusive, void *key)
@@ -2928,7 +2929,7 @@ void fastcall __wake_up_locked(wait_queue_head_t *q, unsigned int mode)
 }
 
 /**
- * __wake_up - sync- wake up threads blocked on a waitqueue.
+ * __wake_up_sync - wake up threads blocked on a waitqueue.
  * @q: the waitqueue
  * @mode: which threads
  * @nr_exclusive: how many wake-one or wake-many threads to wake up
@@ -3223,6 +3224,19 @@ out_unlock:
 
 EXPORT_SYMBOL(set_user_nice);
 
+/*
+ * can_nice - check if a task can reduce its nice value
+ * @p: task
+ * @nice: nice value
+ */
+int can_nice(const task_t *p, const int nice)
+{
+        /* convert nice value [19,-20] to rlimit style value [0,39] */
+        int nice_rlim = 19 - nice;
+        return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
+                capable(CAP_SYS_NICE));
+}
+
 #ifdef __ARCH_WANT_SYS_NICE
 
 /*
@@ -3242,12 +3256,8 @@ asmlinkage long sys_nice(int increment)
          * We don't have to worry. Conceptually one call occurs first
          * and we have a single winner.
          */
-        if (increment < 0) {
-                if (!capable(CAP_SYS_NICE))
-                        return -EPERM;
-                if (increment < -40)
-                        increment = -40;
-        }
+        if (increment < -40)
+                increment = -40;
         if (increment > 40)
                 increment = 40;
 
@@ -3257,6 +3267,9 @@ asmlinkage long sys_nice(int increment)
         if (nice > 19)
                 nice = 19;
 
+        if (increment < 0 && !can_nice(current, nice))
+                return -EPERM;
+
         retval = security_task_setnice(current, nice);
         if (retval)
                 return retval;
@@ -3372,6 +3385,7 @@ recheck:
                 return -EINVAL;
 
         if ((policy == SCHED_FIFO || policy == SCHED_RR) &&
+            param->sched_priority > p->signal->rlim[RLIMIT_RTPRIO].rlim_cur &&
             !capable(CAP_SYS_NICE))
                 return -EPERM;
         if ((current->euid != p->euid) && (current->euid != p->uid) &&
diff --git a/kernel/signal.c b/kernel/signal.c
index e6567d7f2b62..8f3debc77c5b 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -23,6 +23,7 @@
 #include <linux/syscalls.h>
 #include <linux/ptrace.h>
 #include <linux/posix-timers.h>
+#include <linux/signal.h>
 #include <asm/param.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -646,7 +647,7 @@ static int check_kill_permission(int sig, struct siginfo *info,
                                  struct task_struct *t)
 {
         int error = -EINVAL;
-        if (sig < 0 || sig > _NSIG)
+        if (!valid_signal(sig))
                 return error;
         error = -EPERM;
         if ((!info || ((unsigned long)info != 1 &&
@@ -1245,7 +1246,7 @@ send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
          * Make sure legacy kernel users don't send in bad values
          * (normal paths check this in check_kill_permission).
          */
-        if (sig < 0 || sig > _NSIG)
+        if (!valid_signal(sig))
                 return -EINVAL;
 
         /*
@@ -1520,7 +1521,7 @@ void do_notify_parent(struct task_struct *tsk, int sig)
                 if (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN)
                         sig = 0;
         }
-        if (sig > 0 && sig <= _NSIG)
+        if (valid_signal(sig) && sig > 0)
                 __group_send_sig_info(sig, &info, tsk->parent);
         __wake_up_parent(tsk, tsk->parent);
         spin_unlock_irqrestore(&psig->siglock, flags);
@@ -2364,7 +2365,7 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
 {
         struct k_sigaction *k;
 
-        if (sig < 1 || sig > _NSIG || (act && sig_kernel_only(sig)))
+        if (!valid_signal(sig) || sig < 1 || (act && sig_kernel_only(sig)))
                 return -EINVAL;
 
         k = &current->sighand->action[sig-1];
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index c39ed70af174..6116b25aa7cf 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -33,7 +33,7 @@ static int stopmachine(void *cpu)
         set_cpus_allowed(current, cpumask_of_cpu((int)(long)cpu));
 
         /* Ack: we are alive */
-        mb(); /* Theoretically the ack = 0 might not be on this CPU yet. */
+        smp_mb(); /* Theoretically the ack = 0 might not be on this CPU yet. */
         atomic_inc(&stopmachine_thread_ack);
 
         /* Simple state machine */
@@ -43,14 +43,14 @@ static int stopmachine(void *cpu)
                         local_irq_disable();
                         irqs_disabled = 1;
                         /* Ack: irqs disabled. */
-                        mb(); /* Must read state first. */
+                        smp_mb(); /* Must read state first. */
                         atomic_inc(&stopmachine_thread_ack);
                 } else if (stopmachine_state == STOPMACHINE_PREPARE
                            && !prepared) {
                         /* Everyone is in place, hold CPU. */
                         preempt_disable();
                         prepared = 1;
-                        mb(); /* Must read state first. */
+                        smp_mb(); /* Must read state first. */
                         atomic_inc(&stopmachine_thread_ack);
                 }
                 /* Yield in first stage: migration threads need to
@@ -62,7 +62,7 @@ static int stopmachine(void *cpu)
         }
 
         /* Ack: we are exiting. */
-        mb(); /* Must read state first. */
+        smp_mb(); /* Must read state first. */
         atomic_inc(&stopmachine_thread_ack);
 
         if (irqs_disabled)
@@ -77,7 +77,7 @@ static int stopmachine(void *cpu)
 static void stopmachine_set_state(enum stopmachine_state state)
 {
         atomic_set(&stopmachine_thread_ack, 0);
-        wmb();
+        smp_wmb();
         stopmachine_state = state;
         while (atomic_read(&stopmachine_thread_ack) != stopmachine_num_threads)
                 cpu_relax();
diff --git a/kernel/sys.c b/kernel/sys.c
index 462d78d55895..f64e97cabe25 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -25,6 +25,7 @@
 #include <linux/dcookies.h>
 #include <linux/suspend.h>
 #include <linux/tty.h>
+#include <linux/signal.h>
 
 #include <linux/compat.h>
 #include <linux/syscalls.h>
@@ -227,7 +228,7 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
                 error = -EPERM;
                 goto out;
         }
-        if (niceval < task_nice(p) && !capable(CAP_SYS_NICE)) {
+        if (niceval < task_nice(p) && !can_nice(p, niceval)) {
                 error = -EACCES;
                 goto out;
         }
@@ -525,7 +526,7 @@ asmlinkage long sys_setregid(gid_t rgid, gid_t egid)
         if (new_egid != old_egid)
         {
                 current->mm->dumpable = 0;
-                wmb();
+                smp_wmb();
         }
         if (rgid != (gid_t) -1 ||
             (egid != (gid_t) -1 && egid != old_rgid))
@@ -556,7 +557,7 @@ asmlinkage long sys_setgid(gid_t gid)
                 if(old_egid != gid)
                 {
                         current->mm->dumpable=0;
-                        wmb();
+                        smp_wmb();
                 }
                 current->gid = current->egid = current->sgid = current->fsgid = gid;
         }
@@ -565,7 +566,7 @@ asmlinkage long sys_setgid(gid_t gid)
                 if(old_egid != gid)
                 {
                         current->mm->dumpable=0;
-                        wmb();
+                        smp_wmb();
                 }
                 current->egid = current->fsgid = gid;
         }
@@ -596,7 +597,7 @@ static int set_user(uid_t new_ruid, int dumpclear)
         if(dumpclear)
         {
                 current->mm->dumpable = 0;
-                wmb();
+                smp_wmb();
         }
         current->uid = new_ruid;
         return 0;
@@ -653,7 +654,7 @@ asmlinkage long sys_setreuid(uid_t ruid, uid_t euid)
         if (new_euid != old_euid)
         {
                 current->mm->dumpable=0;
-                wmb();
+                smp_wmb();
         }
         current->fsuid = current->euid = new_euid;
         if (ruid != (uid_t) -1 ||
@@ -703,7 +704,7 @@ asmlinkage long sys_setuid(uid_t uid)
         if (old_euid != uid)
         {
                 current->mm->dumpable = 0;
-                wmb();
+                smp_wmb();
         }
         current->fsuid = current->euid = uid;
         current->suid = new_suid;
@@ -748,7 +749,7 @@ asmlinkage long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
                 if (euid != current->euid)
                 {
                         current->mm->dumpable = 0;
-                        wmb();
+                        smp_wmb();
                 }
                 current->euid = euid;
         }
@@ -798,7 +799,7 @@ asmlinkage long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
                 if (egid != current->egid)
                 {
                         current->mm->dumpable = 0;
-                        wmb();
+                        smp_wmb();
                 }
                 current->egid = egid;
         }
@@ -845,7 +846,7 @@ asmlinkage long sys_setfsuid(uid_t uid)
                 if (uid != old_fsuid)
                 {
                         current->mm->dumpable = 0;
-                        wmb();
+                        smp_wmb();
                 }
                 current->fsuid = uid;
         }
@@ -875,7 +876,7 @@ asmlinkage long sys_setfsgid(gid_t gid)
                 if (gid != old_fsgid)
                 {
                         current->mm->dumpable = 0;
-                        wmb();
+                        smp_wmb();
                 }
                 current->fsgid = gid;
                 key_fsgid_changed(current);
@@ -1637,7 +1638,7 @@ asmlinkage long sys_prctl(int option, unsigned long arg2, unsigned long arg3,
         switch (option) {
                 case PR_SET_PDEATHSIG:
                         sig = arg2;
-                        if (sig < 0 || sig > _NSIG) {
+                        if (!valid_signal(sig)) {
                                 error = -EINVAL;
                                 break;
                         }
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 1802a311dd3f..0dda70ed1f98 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -52,6 +52,7 @@ cond_syscall(sys_msgsnd);
 cond_syscall(sys_msgrcv);
 cond_syscall(sys_msgctl);
 cond_syscall(sys_shmget);
+cond_syscall(sys_shmat);
 cond_syscall(sys_shmdt);
 cond_syscall(sys_shmctl);
 cond_syscall(sys_mq_open);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 79dbd93bd697..701d12c63068 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1991,6 +1991,8 @@ int proc_dointvec_userhz_jiffies(ctl_table *table, int write, struct file *filp,
  * @filp: the file structure
  * @buffer: the user buffer
  * @lenp: the size of the user buffer
+ * @ppos: file position
+ * @ppos: the current position in the file
  *
  * Reads/writes up to table->maxlen/sizeof(unsigned int) integer
  * values from/to the user buffer, treated as an ASCII string. 
diff --git a/kernel/time.c b/kernel/time.c
index 96fd0f499631..d4335c1c884c 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -516,14 +516,6 @@ int do_settimeofday (struct timespec *tv)
 
         write_seqlock_irq(&xtime_lock);
         {
-                /*
-                 * This is revolting. We need to set "xtime" correctly. However, the value
-                 * in this location is the value at the most recent update of wall time.
-                 * Discover what correction gettimeofday would have done, and then undo
-                 * it!
-                 */
-                nsec -= time_interpolator_get_offset();
-
                 wtm_sec  = wall_to_monotonic.tv_sec + (xtime.tv_sec - sec);
                 wtm_nsec = wall_to_monotonic.tv_nsec + (xtime.tv_nsec - nsec);
 
diff --git a/kernel/timer.c b/kernel/timer.c
index ecb3d67c0e14..207aa4f0aa10 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1007,7 +1007,7 @@ asmlinkage long sys_getppid(void)
                  * Make sure we read the pid before re-reading the
                  * parent pointer:
                  */
-                rmb();
+                smp_rmb();
                 parent = me->group_leader->real_parent;
                 if (old != parent)
                         continue;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 426a0cf7b11c..ac23847ce0e3 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -108,6 +108,7 @@ config DEBUG_HIGHMEM
 
 config DEBUG_BUGVERBOSE
         bool "Verbose BUG() reporting (adds 70K)" if DEBUG_KERNEL && EMBEDDED
+        depends on BUG
         depends on ARM || ARM26 || M32R || M68K || SPARC32 || SPARC64 || (X86 && !X86_64) || FRV
         default !EMBEDDED
         help
diff --git a/lib/kobject.c b/lib/kobject.c
index 5df8441c44e7..94048826624c 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -216,13 +216,12 @@ int kobject_register(struct kobject * kobj)
 /**
  *      kobject_set_name - Set the name of an object
  *      @kobj:  object.
- *      @name:  name. 
+ *      @fmt:   format string used to build the name
  *
  *      If strlen(name) >= KOBJ_NAME_LEN, then use a dynamically allocated
  *      string that @kobj->k_name points to. Otherwise, use the static 
  *      @kobj->name array.
  */
-
 int kobject_set_name(struct kobject * kobj, const char * fmt, ...)
 {
         int error = 0;
diff --git a/lib/rwsem-spinlock.c b/lib/rwsem-spinlock.c
index 21f0db2c9711..40ffde940a86 100644
--- a/lib/rwsem-spinlock.c
+++ b/lib/rwsem-spinlock.c
@@ -76,7 +76,7 @@ __rwsem_do_wake(struct rw_semaphore *sem, int wakewrite)
                 list_del(&waiter->list);
                 tsk = waiter->task;
                 /* Don't touch waiter after ->task has been NULLed */
-                mb();
+                smp_mb();
                 waiter->task = NULL;
                 wake_up_process(tsk);
                 put_task_struct(tsk);
@@ -91,7 +91,7 @@ __rwsem_do_wake(struct rw_semaphore *sem, int wakewrite)
 
                 list_del(&waiter->list);
                 tsk = waiter->task;
-                mb();
+                smp_mb();
                 waiter->task = NULL;
                 wake_up_process(tsk);
                 put_task_struct(tsk);
@@ -123,7 +123,7 @@ __rwsem_wake_one_writer(struct rw_semaphore *sem)
         list_del(&waiter->list);
 
         tsk = waiter->task;
-        mb();
+        smp_mb();
         waiter->task = NULL;
         wake_up_process(tsk);
         put_task_struct(tsk);
diff --git a/lib/rwsem.c b/lib/rwsem.c
index 7644089ec8fa..62fa4eba9ffe 100644
--- a/lib/rwsem.c
+++ b/lib/rwsem.c
@@ -74,7 +74,7 @@ __rwsem_do_wake(struct rw_semaphore *sem, int downgrading)
          */
         list_del(&waiter->list);
         tsk = waiter->task;
-        mb();
+        smp_mb();
         waiter->task = NULL;
         wake_up_process(tsk);
         put_task_struct(tsk);
@@ -117,7 +117,7 @@ __rwsem_do_wake(struct rw_semaphore *sem, int downgrading)
                 waiter = list_entry(next, struct rwsem_waiter, list);
                 next = waiter->list.next;
                 tsk = waiter->task;
-                mb();
+                smp_mb();
                 waiter->task = NULL;
                 wake_up_process(tsk);
                 put_task_struct(tsk);
diff --git a/mm/filemap.c b/mm/filemap.c
index 93595c327bbd..d5fdae2eb183 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -123,8 +123,7 @@ void remove_from_page_cache(struct page *page)
 {
         struct address_space *mapping = page->mapping;
 
-        if (unlikely(!PageLocked(page)))
-                PAGE_BUG(page);
+        BUG_ON(!PageLocked(page));
 
         write_lock_irq(&mapping->tree_lock);
         __remove_from_page_cache(page);
@@ -139,7 +138,25 @@ static int sync_page(void *word)
         page = container_of((page_flags_t *)word, struct page, flags);
 
         /*
-         * FIXME, fercrissake.  What is this barrier here for?
+         * page_mapping() is being called without PG_locked held.
+         * Some knowledge of the state and use of the page is used to
+         * reduce the requirements down to a memory barrier.
+         * The danger here is of a stale page_mapping() return value
+         * indicating a struct address_space different from the one it's
+         * associated with when it is associated with one.
+         * After smp_mb(), it's either the correct page_mapping() for
+         * the page, or an old page_mapping() and the page's own
+         * page_mapping() has gone NULL.
+         * The ->sync_page() address_space operation must tolerate
+         * page_mapping() going NULL. By an amazing coincidence,
+         * this comes about because none of the users of the page
+         * in the ->sync_page() methods make essential use of the
+         * page_mapping(), merely passing the page down to the backing
+         * device's unplug functions when it's non-NULL, which in turn
+         * ignore it for all cases but swap, where only page->private is
+         * of interest. When page_mapping() does go NULL, the entire
+         * call stack gracefully ignores the page and returns.
+         * -- wli
          */
         smp_mb();
         mapping = page_mapping(page);
@@ -152,9 +169,10 @@ static int sync_page(void *word)
 /**
  * filemap_fdatawrite_range - start writeback against all of a mapping's
  * dirty pages that lie within the byte offsets <start, end>
- * @mapping: address space structure to write
- * @start: offset in bytes where the range starts
- * @end : offset in bytes where the range ends
+ * @mapping:    address space structure to write
+ * @start:      offset in bytes where the range starts
+ * @end:        offset in bytes where the range ends
+ * @sync_mode:  enable synchronous operation
  *
  * If sync_mode is WB_SYNC_ALL then this is a "data integrity" operation, as
  * opposed to a regular memory * cleansing writeback.  The difference between
@@ -518,8 +536,8 @@ EXPORT_SYMBOL(find_trylock_page);
 /**
  * find_lock_page - locate, pin and lock a pagecache page
  *
- * @mapping - the address_space to search
- * @offset - the page index
+ * @mapping: the address_space to search
+ * @offset: the page index
  *
  * Locates the desired pagecache page, locks it, increments its reference
  * count and returns its address.
@@ -558,9 +576,9 @@ EXPORT_SYMBOL(find_lock_page);
 /**
  * find_or_create_page - locate or add a pagecache page
  *
- * @mapping - the page's address_space
- * @index - the page's index into the mapping
- * @gfp_mask - page allocation mode
+ * @mapping: the page's address_space
+ * @index: the page's index into the mapping
+ * @gfp_mask: page allocation mode
  *
  * Locates a page in the pagecache.  If the page is not present, a new page
  * is allocated using @gfp_mask and is added to the pagecache and to the VM's
@@ -1949,7 +1967,7 @@ generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
                 buf = iov->iov_base + written;
         else {
                 filemap_set_next_iovec(&cur_iov, &iov_base, written);
-                buf = iov->iov_base + iov_base;
+                buf = cur_iov->iov_base + iov_base;
         }
 
         do {
@@ -2007,9 +2025,11 @@ generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
                                 count -= status;
                                 pos += status;
                                 buf += status;
-                                if (unlikely(nr_segs > 1))
+                                if (unlikely(nr_segs > 1)) {
                                         filemap_set_next_iovec(&cur_iov,
                                                         &iov_base, status);
+                                        buf = cur_iov->iov_base + iov_base;
+                                }
                         }
                 }
                 if (unlikely(copied != bytes))
diff --git a/mm/highmem.c b/mm/highmem.c
index d01276506b00..400911599468 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -325,6 +325,7 @@ static void bounce_end_io(struct bio *bio, mempool_t *pool, int err)
                         continue;
 
                 mempool_free(bvec->bv_page, pool);      
+                dec_page_state(nr_bounce);
         }
 
         bio_endio(bio_orig, bio_orig->bi_size, err);
@@ -405,6 +406,7 @@ static void __blk_queue_bounce(request_queue_t *q, struct bio **bio_orig,
                 to->bv_page = mempool_alloc(pool, q->bounce_gfp);
                 to->bv_len = from->bv_len;
                 to->bv_offset = from->bv_offset;
+                inc_page_state(nr_bounce);
 
                 if (rw == WRITE) {
                         char *vto, *vfrom;
diff --git a/mm/mempool.c b/mm/mempool.c
index b014ffeaa413..c9f3d4620428 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -198,31 +198,22 @@ void * mempool_alloc(mempool_t *pool, unsigned int __nocast gfp_mask)
         void *element;
         unsigned long flags;
         DEFINE_WAIT(wait);
-        int gfp_nowait = gfp_mask & ~(__GFP_WAIT | __GFP_IO);
+        int gfp_temp;
 
         might_sleep_if(gfp_mask & __GFP_WAIT);
+
+        gfp_mask |= __GFP_NOMEMALLOC;   /* don't allocate emergency reserves */
+        gfp_mask |= __GFP_NORETRY;      /* don't loop in __alloc_pages */
+        gfp_mask |= __GFP_NOWARN;       /* failures are OK */
+
+        gfp_temp = gfp_mask & ~(__GFP_WAIT|__GFP_IO);
+
 repeat_alloc:
-        element = pool->alloc(gfp_nowait|__GFP_NOWARN, pool->pool_data);
+
+        element = pool->alloc(gfp_temp, pool->pool_data);
         if (likely(element != NULL))
                 return element;
 
-        /*
-         * If the pool is less than 50% full and we can perform effective
-         * page reclaim then try harder to allocate an element.
-         */
-        mb();
-        if ((gfp_mask & __GFP_FS) && (gfp_mask != gfp_nowait) &&
-                                (pool->curr_nr <= pool->min_nr/2)) {
-                element = pool->alloc(gfp_mask, pool->pool_data);
-                if (likely(element != NULL))
-                        return element;
-        }
-
-        /*
-         * Kick the VM at this point.
-         */
-        wakeup_bdflush(0);
-
         spin_lock_irqsave(&pool->lock, flags);
         if (likely(pool->curr_nr)) {
                 element = remove_element(pool);
@@ -235,8 +226,10 @@ repeat_alloc:
         if (!(gfp_mask & __GFP_WAIT))
                 return NULL;
 
+        /* Now start performing page reclaim */
+        gfp_temp = gfp_mask;
         prepare_to_wait(&pool->wait, &wait, TASK_UNINTERRUPTIBLE);
-        mb();
+        smp_mb();
         if (!pool->curr_nr)
                 io_schedule();
         finish_wait(&pool->wait, &wait);
@@ -257,7 +250,7 @@ void mempool_free(void *element, mempool_t *pool)
 {
         unsigned long flags;
 
-        mb();
+        smp_mb();
         if (pool->curr_nr < pool->min_nr) {
                 spin_lock_irqsave(&pool->lock, flags);
                 if (pool->curr_nr < pool->min_nr) {
diff --git a/mm/mmap.c b/mm/mmap.c
index 6ea204cc751e..01f9793591f6 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -937,9 +937,10 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
         /* mlock MCL_FUTURE? */
         if (vm_flags & VM_LOCKED) {
                 unsigned long locked, lock_limit;
-                locked = mm->locked_vm << PAGE_SHIFT;
+                locked = len >> PAGE_SHIFT;
+                locked += mm->locked_vm;
                 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
-                locked += len;
+                lock_limit >>= PAGE_SHIFT;
                 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
                         return -EAGAIN;
         }
@@ -1009,8 +1010,7 @@ munmap_back:
         }
 
         /* Check against address space limit. */
-        if ((mm->total_vm << PAGE_SHIFT) + len
-            > current->signal->rlim[RLIMIT_AS].rlim_cur)
+        if (!may_expand_vm(mm, len >> PAGE_SHIFT))
                 return -ENOMEM;
 
         if (accountable && (!(flags & MAP_NORESERVE) ||
@@ -1421,7 +1421,7 @@ static int acct_stack_growth(struct vm_area_struct * vma, unsigned long size, un
         struct rlimit *rlim = current->signal->rlim;
 
         /* address space limit tests */
-        if (mm->total_vm + grow > rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT)
+        if (!may_expand_vm(mm, grow))
                 return -ENOMEM;
 
         /* Stack limit test */
@@ -1823,9 +1823,10 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
          */
         if (mm->def_flags & VM_LOCKED) {
                 unsigned long locked, lock_limit;
-                locked = mm->locked_vm << PAGE_SHIFT;
+                locked = len >> PAGE_SHIFT;
+                locked += mm->locked_vm;
                 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
-                locked += len;
+                lock_limit >>= PAGE_SHIFT;
                 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
                         return -EAGAIN;
         }
@@ -1848,8 +1849,7 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
         }
 
         /* Check against address space limits *after* clearing old maps... */
-        if ((mm->total_vm << PAGE_SHIFT) + len
-            > current->signal->rlim[RLIMIT_AS].rlim_cur)
+        if (!may_expand_vm(mm, len >> PAGE_SHIFT))
                 return -ENOMEM;
 
         if (mm->map_count > sysctl_max_map_count)
@@ -2019,3 +2019,19 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
         }
         return new_vma;
 }
+
+/*
+ * Return true if the calling process may expand its vm space by the passed
+ * number of pages
+ */
+int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+{
+        unsigned long cur = mm->total_vm;       /* pages */
+        unsigned long lim;
+
+        lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
+
+        if (cur + npages > lim)
+                return 0;
+        return 1;
+}
diff --git a/mm/mremap.c b/mm/mremap.c
index 0d1c1b9c7a0a..0dd7ace94e51 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -347,10 +347,10 @@ unsigned long do_mremap(unsigned long addr,
                 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
                         goto out;
         }
-        ret = -ENOMEM;
-        if ((current->mm->total_vm << PAGE_SHIFT) + (new_len - old_len)
-            > current->signal->rlim[RLIMIT_AS].rlim_cur)
+        if (!may_expand_vm(current->mm, (new_len - old_len) >> PAGE_SHIFT)) {
+                ret = -ENOMEM;
                 goto out;
+        }
 
         if (vma->vm_flags & VM_ACCOUNT) {
                 charged = (new_len - old_len) >> PAGE_SHIFT;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 6ddd6a29c73b..613b99a55917 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -255,7 +255,7 @@ static void balance_dirty_pages(struct address_space *mapping)
 
 /**
  * balance_dirty_pages_ratelimited - balance dirty memory state
- * @mapping - address_space which was dirtied
+ * @mapping: address_space which was dirtied
  *
  * Processes which are dirtying memory should call in here once for each page
  * which was newly dirtied.  The function will periodically check the system's
@@ -562,8 +562,8 @@ int do_writepages(struct address_space *mapping, struct writeback_control *wbc)
 /**
  * write_one_page - write out a single page and optionally wait on I/O
  *
- * @page - the page to write
- * @wait - if true, wait on writeout
+ * @page: the page to write
+ * @wait: if true, wait on writeout
  *
  * The page must be locked by the caller and will be unlocked upon return.
  *
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c73dbbc1cd8f..fc1b1064c505 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -799,14 +799,18 @@ __alloc_pages(unsigned int __nocast gfp_mask, unsigned int order,
         }
 
         /* This allocation should allow future memory freeing. */
-        if (((p->flags & PF_MEMALLOC) || unlikely(test_thread_flag(TIF_MEMDIE))) && !in_interrupt()) {
-                /* go through the zonelist yet again, ignoring mins */
-                for (i = 0; (z = zones[i]) != NULL; i++) {
-                        if (!cpuset_zone_allowed(z))
-                                continue;
-                        page = buffered_rmqueue(z, order, gfp_mask);
-                        if (page)
-                                goto got_pg;
+
+        if (((p->flags & PF_MEMALLOC) || unlikely(test_thread_flag(TIF_MEMDIE)))
+                        && !in_interrupt()) {
+                if (!(gfp_mask & __GFP_NOMEMALLOC)) {
+                        /* go through the zonelist yet again, ignoring mins */
+                        for (i = 0; (z = zones[i]) != NULL; i++) {
+                                if (!cpuset_zone_allowed(z))
+                                        continue;
+                                page = buffered_rmqueue(z, order, gfp_mask);
+                                if (page)
+                                        goto got_pg;
+                        }
                 }
                 goto nopage;
         }
@@ -1351,8 +1355,7 @@ static int __init build_zonelists_node(pg_data_t *pgdat, struct zonelist *zoneli
 #define MAX_NODE_LOAD (num_online_nodes())
 static int __initdata node_load[MAX_NUMNODES];
 /**
- * find_next_best_node - find the next node that should appear in a given
- *    node's fallback list
+ * find_next_best_node - find the next node that should appear in a given node's fallback list
  * @node: node whose fallback list we're appending
  * @used_node_mask: nodemask_t of already used nodes
  *
@@ -1671,6 +1674,18 @@ static void __init free_area_init_core(struct pglist_data *pgdat,
                 if (batch < 1)
                         batch = 1;
 
+                /*
+                 * Clamp the batch to a 2^n - 1 value. Having a power
+                 * of 2 value was found to be more likely to have
+                 * suboptimal cache aliasing properties in some cases.
+                 *
+                 * For example if 2 tasks are alternately allocating
+                 * batches of pages, one task can end up with a lot
+                 * of pages of one half of the possible page colors
+                 * and the other with pages of the other colors.
+                 */
+                batch = (1 << fls(batch + batch/2)) - 1;
+
                 for (cpu = 0; cpu < NR_CPUS; cpu++) {
                         struct per_cpu_pages *pcp;
 
@@ -1881,6 +1896,7 @@ static char *vmstat_text[] = {
         "allocstall",
 
         "pgrotated",
+        "nr_bounce",
 };
 
 static void *vmstat_start(struct seq_file *m, loff_t *pos)
diff --git a/mm/rmap.c b/mm/rmap.c
index 884d6d1928bc..378de234c12b 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -243,6 +243,42 @@ unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 }
 
 /*
+ * Check that @page is mapped at @address into @mm.
+ *
+ * On success returns with mapped pte and locked mm->page_table_lock.
+ */
+static pte_t *page_check_address(struct page *page, struct mm_struct *mm,
+                                        unsigned long address)
+{
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte;
+
+        /*
+         * We need the page_table_lock to protect us from page faults,
+         * munmap, fork, etc...
+         */
+        spin_lock(&mm->page_table_lock);
+        pgd = pgd_offset(mm, address);
+        if (likely(pgd_present(*pgd))) {
+                pud = pud_offset(pgd, address);
+                if (likely(pud_present(*pud))) {
+                        pmd = pmd_offset(pud, address);
+                        if (likely(pmd_present(*pmd))) {
+                                pte = pte_offset_map(pmd, address);
+                                if (likely(pte_present(*pte) &&
+                                           page_to_pfn(page) == pte_pfn(*pte)))
+                                        return pte;
+                                pte_unmap(pte);
+                        }
+                }
+        }
+        spin_unlock(&mm->page_table_lock);
+        return ERR_PTR(-ENOENT);
+}
+
+/*
  * Subfunctions of page_referenced: page_referenced_one called
  * repeatedly from either page_referenced_anon or page_referenced_file.
  */
@@ -251,9 +287,6 @@ static int page_referenced_one(struct page *page,
 {
         struct mm_struct *mm = vma->vm_mm;
         unsigned long address;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
         pte_t *pte;
         int referenced = 0;
 
@@ -263,39 +296,18 @@ static int page_referenced_one(struct page *page,
         if (address == -EFAULT)
                 goto out;
 
-        spin_lock(&mm->page_table_lock);
-
-        pgd = pgd_offset(mm, address);
-        if (!pgd_present(*pgd))
-                goto out_unlock;
-
-        pud = pud_offset(pgd, address);
-        if (!pud_present(*pud))
-                goto out_unlock;
-
-        pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
-                goto out_unlock;
-
-        pte = pte_offset_map(pmd, address);
-        if (!pte_present(*pte))
-                goto out_unmap;
-
-        if (page_to_pfn(page) != pte_pfn(*pte))
-                goto out_unmap;
-
-        if (ptep_clear_flush_young(vma, address, pte))
-                referenced++;
-
-        if (mm != current->mm && !ignore_token && has_swap_token(mm))
-                referenced++;
+        pte = page_check_address(page, mm, address);
+        if (!IS_ERR(pte)) {
+                if (ptep_clear_flush_young(vma, address, pte))
+                        referenced++;
 
-        (*mapcount)--;
+                if (mm != current->mm && !ignore_token && has_swap_token(mm))
+                        referenced++;
 
-out_unmap:
-        pte_unmap(pte);
-out_unlock:
-        spin_unlock(&mm->page_table_lock);
+                (*mapcount)--;
+                pte_unmap(pte);
+                spin_unlock(&mm->page_table_lock);
+        }
 out:
         return referenced;
 }
@@ -502,9 +514,6 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma)
 {
         struct mm_struct *mm = vma->vm_mm;
         unsigned long address;
-        pgd_t *pgd;
-        pud_t *pud;
-        pmd_t *pmd;
         pte_t *pte;
         pte_t pteval;
         int ret = SWAP_AGAIN;
@@ -515,30 +524,9 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma)
         if (address == -EFAULT)
                 goto out;
 
-        /*
-         * We need the page_table_lock to protect us from page faults,
-         * munmap, fork, etc...
-         */
-        spin_lock(&mm->page_table_lock);
-
-        pgd = pgd_offset(mm, address);
-        if (!pgd_present(*pgd))
-                goto out_unlock;
-
-        pud = pud_offset(pgd, address);
-        if (!pud_present(*pud))
-                goto out_unlock;
-
-        pmd = pmd_offset(pud, address);
-        if (!pmd_present(*pmd))
-                goto out_unlock;
-
-        pte = pte_offset_map(pmd, address);
-        if (!pte_present(*pte))
-                goto out_unmap;
-
-        if (page_to_pfn(page) != pte_pfn(*pte))
-                goto out_unmap;
+        pte = page_check_address(page, mm, address);
+        if (IS_ERR(pte))
+                goto out;
 
         /*
          * If the page is mlock()d, we cannot swap it out.
@@ -604,7 +592,6 @@ static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma)
 
 out_unmap:
         pte_unmap(pte);
-out_unlock:
         spin_unlock(&mm->page_table_lock);
 out:
         return ret;
@@ -708,7 +695,6 @@ static void try_to_unmap_cluster(unsigned long cursor,
         }
 
         pte_unmap(pte);
-
 out_unlock:
         spin_unlock(&mm->page_table_lock);
 }
@@ -860,3 +846,4 @@ int try_to_unmap(struct page *page)
                 ret = SWAP_SUCCESS;
         return ret;
 }
+
diff --git a/mm/slab.c b/mm/slab.c
index ec660d85ddd7..840742641152 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -583,7 +583,7 @@ static inline struct array_cache *ac_data(kmem_cache_t *cachep)
         return cachep->array[smp_processor_id()];
 }
 
-static inline kmem_cache_t *kmem_find_general_cachep(size_t size, int gfpflags)
+static inline kmem_cache_t *__find_general_cachep(size_t size, int gfpflags)
 {
         struct cache_sizes *csizep = malloc_sizes;
 
@@ -607,6 +607,12 @@ static inline kmem_cache_t *kmem_find_general_cachep(size_t size, int gfpflags)
         return csizep->cs_cachep;
 }
 
+kmem_cache_t *kmem_find_general_cachep(size_t size, int gfpflags)
+{
+        return __find_general_cachep(size, gfpflags);
+}
+EXPORT_SYMBOL(kmem_find_general_cachep);
+
 /* Cal the num objs, wastage, and bytes left over for a given slab size. */
 static void cache_estimate(unsigned long gfporder, size_t size, size_t align,
                  int flags, size_t *left_over, unsigned int *num)
@@ -672,14 +678,11 @@ static struct array_cache *alloc_arraycache(int cpu, int entries,
         int memsize = sizeof(void*)*entries+sizeof(struct array_cache);
         struct array_cache *nc = NULL;
 
-        if (cpu != -1) {
-                kmem_cache_t *cachep;
-                cachep = kmem_find_general_cachep(memsize, GFP_KERNEL);
-                if (cachep)
-                        nc = kmem_cache_alloc_node(cachep, cpu_to_node(cpu));
-        }
-        if (!nc)
+        if (cpu == -1)
                 nc = kmalloc(memsize, GFP_KERNEL);
+        else
+                nc = kmalloc_node(memsize, GFP_KERNEL, cpu_to_node(cpu));
+
         if (nc) {
                 nc->avail = 0;
                 nc->limit = entries;
@@ -1663,7 +1666,7 @@ int kmem_cache_destroy(kmem_cache_t * cachep)
         }
 
         if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU))
-                synchronize_kernel();
+                synchronize_rcu();
 
         /* no cpu_online check required here since we clear the percpu
          * array on cpu offline and set this to NULL.
@@ -2361,7 +2364,7 @@ out:
  * and can sleep. And it will allocate memory on the given node, which
  * can improve the performance for cpu bound structures.
  */
-void *kmem_cache_alloc_node(kmem_cache_t *cachep, int nodeid)
+void *kmem_cache_alloc_node(kmem_cache_t *cachep, int flags, int nodeid)
 {
         int loop;
         void *objp;
@@ -2393,7 +2396,7 @@ void *kmem_cache_alloc_node(kmem_cache_t *cachep, int nodeid)
                 spin_unlock_irq(&cachep->spinlock);
 
                 local_irq_disable();
-                if (!cache_grow(cachep, GFP_KERNEL, nodeid)) {
+                if (!cache_grow(cachep, flags, nodeid)) {
                         local_irq_enable();
                         return NULL;
                 }
@@ -2435,6 +2438,16 @@ got_slabp:
 }
 EXPORT_SYMBOL(kmem_cache_alloc_node);
 
+void *kmalloc_node(size_t size, int flags, int node)
+{
+        kmem_cache_t *cachep;
+
+        cachep = kmem_find_general_cachep(size, flags);
+        if (unlikely(cachep == NULL))
+                return NULL;
+        return kmem_cache_alloc_node(cachep, flags, node);
+}
+EXPORT_SYMBOL(kmalloc_node);
 #endif
 
 /**
@@ -2462,7 +2475,12 @@ void *__kmalloc(size_t size, unsigned int __nocast flags)
 {
         kmem_cache_t *cachep;
 
-        cachep = kmem_find_general_cachep(size, flags);
+        /* If you want to save a few bytes .text space: replace
+         * __ with kmem_.
+         * Then kmalloc uses the uninlined functions instead of the inline
+         * functions.
+         */
+        cachep = __find_general_cachep(size, flags);
         if (unlikely(cachep == NULL))
                 return NULL;
         return __cache_alloc(cachep, flags);
@@ -2489,9 +2507,8 @@ void *__alloc_percpu(size_t size, size_t align)
         for (i = 0; i < NR_CPUS; i++) {
                 if (!cpu_possible(i))
                         continue;
-                pdata->ptrs[i] = kmem_cache_alloc_node(
-                                kmem_find_general_cachep(size, GFP_KERNEL),
-                                cpu_to_node(i));
+                pdata->ptrs[i] = kmalloc_node(size, GFP_KERNEL,
+                                                cpu_to_node(i));
 
                 if (!pdata->ptrs[i])
                         goto unwind_oom;
diff --git a/mm/swap_state.c b/mm/swap_state.c
index a063a902ed03..4f251775ef90 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -143,7 +143,6 @@ void __delete_from_swap_cache(struct page *page)
 int add_to_swap(struct page * page)
 {
         swp_entry_t entry;
-        int pf_flags;
         int err;
 
         if (!PageLocked(page))
@@ -154,29 +153,19 @@ int add_to_swap(struct page * page)
                 if (!entry.val)
                         return 0;
 
-                /* Radix-tree node allocations are performing
-                 * GFP_ATOMIC allocations under PF_MEMALLOC.  
-                 * They can completely exhaust the page allocator.  
-                 *
-                 * So PF_MEMALLOC is dropped here.  This causes the slab 
-                 * allocations to fail earlier, so radix-tree nodes will 
-                 * then be allocated from the mempool reserves.
+                /*
+                 * Radix-tree node allocations from PF_MEMALLOC contexts could
+                 * completely exhaust the page allocator. __GFP_NOMEMALLOC
+                 * stops emergency reserves from being allocated.
                  *
-                 * We're still using __GFP_HIGH for radix-tree node
-                 * allocations, so some of the emergency pools are available,
-                 * just not all of them.
+                 * TODO: this could cause a theoretical memory reclaim
+                 * deadlock in the swap out path.
                  */
-
-                pf_flags = current->flags;
-                current->flags &= ~PF_MEMALLOC;
-
                 /*
                  * Add it to the swap cache and mark it dirty
                  */
-                err = __add_to_swap_cache(page, entry, GFP_ATOMIC|__GFP_NOWARN);
-
-                if (pf_flags & PF_MEMALLOC)
-                        current->flags |= PF_MEMALLOC;
+                err = __add_to_swap_cache(page, entry,
+                                GFP_ATOMIC|__GFP_NOMEMALLOC|__GFP_NOWARN);
 
                 switch (err) {
                 case 0:                         /* Success */
diff --git a/mm/truncate.c b/mm/truncate.c
index c9a63f0b69a2..60c8764bfac2 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -242,7 +242,7 @@ EXPORT_SYMBOL(invalidate_inode_pages);
 
 /**
  * invalidate_inode_pages2_range - remove range of pages from an address_space
- * @mapping - the address_space
+ * @mapping: the address_space
  * @start: the page offset 'from' which to invalidate
  * @end: the page offset 'to' which to invalidate (inclusive)
  *
@@ -322,7 +322,7 @@ EXPORT_SYMBOL_GPL(invalidate_inode_pages2_range);
 
 /**
  * invalidate_inode_pages2 - remove all pages from an address_space
- * @mapping - the address_space
+ * @mapping: the address_space
  *
  * Any pages which are found to be mapped into pagetables are unmapped prior to
  * invalidation.
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index c6182f6f1305..2bd83e5c2bbf 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -475,6 +475,10 @@ void *vmalloc(unsigned long size)
 
 EXPORT_SYMBOL(vmalloc);
 
+#ifndef PAGE_KERNEL_EXEC
+# define PAGE_KERNEL_EXEC PAGE_KERNEL
+#endif
+
 /**
  *      vmalloc_exec  -  allocate virtually contiguous, executable memory
  *
@@ -488,10 +492,6 @@ EXPORT_SYMBOL(vmalloc);
  *      use __vmalloc() instead.
  */
 
-#ifndef PAGE_KERNEL_EXEC
-# define PAGE_KERNEL_EXEC PAGE_KERNEL
-#endif
-
 void *vmalloc_exec(unsigned long size)
 {
         return __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC);
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index c32d27af0a3f..7b214cffc956 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -23,7 +23,7 @@
 #include <linux/errno.h>        /* return codes */
 #include <linux/kernel.h>
 #include <linux/slab.h>         /* kmalloc(), kfree() */
-#include <linux/mm.h>           /* verify_area(), etc. */
+#include <linux/mm.h>
 #include <linux/string.h>       /* inline mem*, str* functions */
 #include <linux/init.h>         /* __initfunc et al. */
 #include <asm/byteorder.h>      /* htons(), etc. */
diff --git a/net/atm/common.c b/net/atm/common.c
index 6d16be334ea0..e93e838069e8 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -12,7 +12,7 @@
 #include <linux/socket.h>       /* SOL_SOCKET */
 #include <linux/errno.h>        /* error codes */
 #include <linux/capability.h>
-#include <linux/mm.h>           /* verify_area */
+#include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/time.h>         /* struct timeval */
 #include <linux/skbuff.h>
@@ -540,7 +540,7 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                 error = -EMSGSIZE;
                 goto out;
         }
-        /* verify_area is done by net/socket.c */
+
         eff = (size+3) & ~3; /* align to word boundary */
         prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
         error = 0;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index d1bfd279cc1a..fcee054b6f75 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -115,10 +115,10 @@ out_noerr:
 
 /**
  *      skb_recv_datagram - Receive a datagram skbuff
- *      @sk - socket
- *      @flags - MSG_ flags
- *      @noblock - blocking operation?
- *      @err - error code returned
+ *      @sk: socket
+ *      @flags: MSG_ flags
+ *      @noblock: blocking operation?
+ *      @err: error code returned
  *
  *      Get a datagram skbuff, understands the peeking, nonblocking wakeups
  *      and possible races. This replaces identical code in packet, raw and
@@ -201,10 +201,10 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
 
 /**
  *      skb_copy_datagram_iovec - Copy a datagram to an iovec.
- *      @skb - buffer to copy
- *      @offset - offset in the buffer to start copying from
- *      @iovec - io vector to copy to
- *      @len - amount of data to copy from buffer to iovec
+ *      @skb: buffer to copy
+ *      @offset: offset in the buffer to start copying from
+ *      @to: io vector to copy to
+ *      @len: amount of data to copy from buffer to iovec
  *
  *      Note: the iovec is modified during the copy.
  */
@@ -377,9 +377,9 @@ fault:
 
 /**
  *      skb_copy_and_csum_datagram_iovec - Copy and checkum skb to user iovec.
- *      @skb - skbuff
- *      @hlen - hardware length
- *      @iovec - io vector
+ *      @skb: skbuff
+ *      @hlen: hardware length
+ *      @iov: io vector
  * 
  *      Caller _must_ check that skb will fit to this iovec.
  *
@@ -425,9 +425,9 @@ fault:
 
 /**
  *      datagram_poll - generic datagram poll
- *      @file - file struct
- *      @sock - socket
- *      @wait - poll table
+ *      @file: file struct
+ *      @sock: socket
+ *      @wait: poll table
  *
  *      Datagram poll: Again totally generic. This also handles
  *      sequenced packet sockets providing the socket receive queue
diff --git a/net/core/dev.c b/net/core/dev.c
index 7bd4cd4502c4..f5f005846fe1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3091,7 +3091,7 @@ void free_netdev(struct net_device *dev)
 void synchronize_net(void) 
 {
         might_sleep();
-        synchronize_kernel();
+        synchronize_rcu();
 }
 
 /**
diff --git a/net/core/iovec.c b/net/core/iovec.c
index d57ace949ab8..65e4b56fbc77 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -33,7 +33,7 @@
  *      Verify iovec. The caller must ensure that the iovec is big enough
  *      to hold the message iovec.
  *
- *      Save time not doing verify_area. copy_*_user will make this work
+ *      Save time not doing access_ok. copy_*_user will make this work
  *      in any case.
  */
 
diff --git a/net/core/link_watch.c b/net/core/link_watch.c
index 4859b7446c6f..d43d1201275c 100644
--- a/net/core/link_watch.c
+++ b/net/core/link_watch.c
@@ -16,6 +16,7 @@
 #include <linux/netdevice.h>
 #include <linux/if.h>
 #include <net/sock.h>
+#include <net/pkt_sched.h>
 #include <linux/rtnetlink.h>
 #include <linux/jiffies.h>
 #include <linux/spinlock.h>
@@ -74,6 +75,12 @@ void linkwatch_run_queue(void)
                 clear_bit(__LINK_STATE_LINKWATCH_PENDING, &dev->state);
 
                 if (dev->flags & IFF_UP) {
+                        if (netif_carrier_ok(dev)) {
+                                WARN_ON(dev->qdisc_sleeping == &noop_qdisc);
+                                dev_activate(dev);
+                        } else
+                                dev_deactivate(dev);
+
                         netdev_state_change(dev);
                 }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 0a2f67bbef2e..43bdc521e20d 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1953,7 +1953,7 @@ static int neigh_stat_seq_show(struct seq_file *seq, void *v)
         struct neigh_statistics *st = v;
 
         if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs forced_gc_goal_miss\n");
+                seq_printf(seq, "entries  allocs destroys hash_grows  lookups hits  res_failed  rcv_probes_mcast rcv_probes_ucast  periodic_gc_runs forced_gc_runs\n");
                 return 0;
         }
 
diff --git a/net/core/netfilter.c b/net/core/netfilter.c
index e51cfa46950c..22a8f127c4aa 100644
--- a/net/core/netfilter.c
+++ b/net/core/netfilter.c
@@ -217,21 +217,10 @@ void nf_debug_ip_local_deliver(struct sk_buff *skb)
          * NF_IP_RAW_INPUT and NF_IP_PRE_ROUTING.  */
         if (!skb->dev) {
                 printk("ip_local_deliver: skb->dev is NULL.\n");
-        }
-        else if (strcmp(skb->dev->name, "lo") == 0) {
-                if (skb->nf_debug != ((1 << NF_IP_LOCAL_OUT)
-                                      | (1 << NF_IP_POST_ROUTING)
-                                      | (1 << NF_IP_PRE_ROUTING)
-                                      | (1 << NF_IP_LOCAL_IN))) {
-                        printk("ip_local_deliver: bad loopback skb: ");
-                        debug_print_hooks_ip(skb->nf_debug);
-                        nf_dump_skb(PF_INET, skb);
-                }
-        }
-        else {
+        } else {
                 if (skb->nf_debug != ((1<<NF_IP_PRE_ROUTING)
                                       | (1<<NF_IP_LOCAL_IN))) {
-                        printk("ip_local_deliver: bad non-lo skb: ");
+                        printk("ip_local_deliver: bad skb: ");
                         debug_print_hooks_ip(skb->nf_debug);
                         nf_dump_skb(PF_INET, skb);
                 }
@@ -247,8 +236,6 @@ void nf_debug_ip_loopback_xmit(struct sk_buff *newskb)
                 debug_print_hooks_ip(newskb->nf_debug);
                 nf_dump_skb(PF_INET, newskb);
         }
-        /* Clear to avoid confusing input check */
-        newskb->nf_debug = 0;
 }
 
 void nf_debug_ip_finish_output2(struct sk_buff *skb)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d8c198e42f90..00caf4b318b2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -86,30 +86,33 @@ struct sock *rtnl;
 
 struct rtnetlink_link * rtnetlink_links[NPROTO];
 
-static const int rtm_min[(RTM_MAX+1-RTM_BASE)/4] =
+static const int rtm_min[RTM_NR_FAMILIES] =
 {
-        NLMSG_LENGTH(sizeof(struct ifinfomsg)),
-        NLMSG_LENGTH(sizeof(struct ifaddrmsg)),
-        NLMSG_LENGTH(sizeof(struct rtmsg)),
-        NLMSG_LENGTH(sizeof(struct ndmsg)),
-        NLMSG_LENGTH(sizeof(struct rtmsg)),
-        NLMSG_LENGTH(sizeof(struct tcmsg)),
-        NLMSG_LENGTH(sizeof(struct tcmsg)),
-        NLMSG_LENGTH(sizeof(struct tcmsg)),
-        NLMSG_LENGTH(sizeof(struct tcamsg))
+        [RTM_FAM(RTM_NEWLINK)]      = NLMSG_LENGTH(sizeof(struct ifinfomsg)),
+        [RTM_FAM(RTM_NEWADDR)]      = NLMSG_LENGTH(sizeof(struct ifaddrmsg)),
+        [RTM_FAM(RTM_NEWROUTE)]     = NLMSG_LENGTH(sizeof(struct rtmsg)),
+        [RTM_FAM(RTM_NEWNEIGH)]     = NLMSG_LENGTH(sizeof(struct ndmsg)),
+        [RTM_FAM(RTM_NEWRULE)]      = NLMSG_LENGTH(sizeof(struct rtmsg)),
+        [RTM_FAM(RTM_NEWQDISC)]     = NLMSG_LENGTH(sizeof(struct tcmsg)),
+        [RTM_FAM(RTM_NEWTCLASS)]    = NLMSG_LENGTH(sizeof(struct tcmsg)),
+        [RTM_FAM(RTM_NEWTFILTER)]   = NLMSG_LENGTH(sizeof(struct tcmsg)),
+        [RTM_FAM(RTM_NEWACTION)]    = NLMSG_LENGTH(sizeof(struct tcamsg)),
+        [RTM_FAM(RTM_NEWPREFIX)]    = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
+        [RTM_FAM(RTM_GETMULTICAST)] = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
+        [RTM_FAM(RTM_GETANYCAST)]   = NLMSG_LENGTH(sizeof(struct rtgenmsg)),
 };
 
-static const int rta_max[(RTM_MAX+1-RTM_BASE)/4] =
+static const int rta_max[RTM_NR_FAMILIES] =
 {
-        IFLA_MAX,
-        IFA_MAX,
-        RTA_MAX,
-        NDA_MAX,
-        RTA_MAX,
-        TCA_MAX,
-        TCA_MAX,
-        TCA_MAX,
-        TCAA_MAX
+        [RTM_FAM(RTM_NEWLINK)]      = IFLA_MAX,
+        [RTM_FAM(RTM_NEWADDR)]      = IFA_MAX,
+        [RTM_FAM(RTM_NEWROUTE)]     = RTA_MAX,
+        [RTM_FAM(RTM_NEWNEIGH)]     = NDA_MAX,
+        [RTM_FAM(RTM_NEWRULE)]      = RTA_MAX,
+        [RTM_FAM(RTM_NEWQDISC)]     = TCA_MAX,
+        [RTM_FAM(RTM_NEWTCLASS)]    = TCA_MAX,
+        [RTM_FAM(RTM_NEWTFILTER)]   = TCA_MAX,
+        [RTM_FAM(RTM_NEWACTION)]    = TCAA_MAX,
 };
 
 void __rta_fill(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
@@ -606,27 +609,33 @@ static inline int rtnetlink_rcv_skb(struct sk_buff *skb)
 
 /*
  *  rtnetlink input queue processing routine:
- *      - try to acquire shared lock. If it is failed, defer processing.
+ *      - process as much as there was in the queue upon entry.
  *      - feed skbs to rtnetlink_rcv_skb, until it refuse a message,
- *        that will occur, when a dump started and/or acquisition of
- *        exclusive lock failed.
+ *        that will occur, when a dump started.
  */
 
 static void rtnetlink_rcv(struct sock *sk, int len)
 {
+        unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
+
         do {
                 struct sk_buff *skb;
 
-                if (rtnl_shlock_nowait())
-                        return;
+                rtnl_lock();
+
+                if (qlen > skb_queue_len(&sk->sk_receive_queue))
+                        qlen = skb_queue_len(&sk->sk_receive_queue);
 
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+                for (; qlen; qlen--) {
+                        skb = skb_dequeue(&sk->sk_receive_queue);
                         if (rtnetlink_rcv_skb(skb)) {
                                 if (skb->len)
                                         skb_queue_head(&sk->sk_receive_queue,
                                                        skb);
-                                else
+                                else {
                                         kfree_skb(skb);
+                                        qlen--;
+                                }
                                 break;
                         }
                         kfree_skb(skb);
@@ -635,10 +644,10 @@ static void rtnetlink_rcv(struct sock *sk, int len)
                 up(&rtnl_sem);
 
                 netdev_run_todo();
-        } while (rtnl && rtnl->sk_receive_queue.qlen);
+        } while (qlen);
 }
 
-static struct rtnetlink_link link_rtnetlink_table[RTM_MAX-RTM_BASE+1] =
+static struct rtnetlink_link link_rtnetlink_table[RTM_NR_MSGTYPES] =
 {
         [RTM_GETLINK  - RTM_BASE] = { .dumpit = rtnetlink_dump_ifinfo },
         [RTM_SETLINK  - RTM_BASE] = { .doit   = do_setlink            },
diff --git a/net/core/sock.c b/net/core/sock.c
index 5c2f72fa1013..98171ddd7e7d 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -616,10 +616,10 @@ lenout:
 
 /**
  *      sk_alloc - All socket objects are allocated here
- *      @family - protocol family
- *      @priority - for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
- *      @prot - struct proto associated with this new sock instance
- *      @zero_it - if we should zero the newly allocated sock
+ *      @family: protocol family
+ *      @priority: for allocation (%GFP_KERNEL, %GFP_ATOMIC, etc)
+ *      @prot: struct proto associated with this new sock instance
+ *      @zero_it: if we should zero the newly allocated sock
  */
 struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
 {
@@ -970,8 +970,8 @@ static void __release_sock(struct sock *sk)
 
 /**
  * sk_wait_data - wait for data to arrive at sk_receive_queue
- * sk - sock to wait on
- * timeo - for how long
+ * @sk:    sock to wait on
+ * @timeo: for how long
  *
  * Now socket state including sk->sk_err is changed only under lock,
  * hence we may omit checks after joining wait queue.
diff --git a/net/core/stream.c b/net/core/stream.c
index 1e27a57b5a97..ac9edfdf8742 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -21,7 +21,7 @@
 
 /**
  * sk_stream_write_space - stream socket write_space callback.
- * sk - socket
+ * @sk: socket
  *
  * FIXME: write proper description
  */
@@ -43,8 +43,8 @@ EXPORT_SYMBOL(sk_stream_write_space);
 
 /**
  * sk_stream_wait_connect - Wait for a socket to get into the connected state
- * @sk - sock to wait on
- * @timeo_p - for how long to wait
+ * @sk: sock to wait on
+ * @timeo_p: for how long to wait
  *
  * Must be called with the socket locked.
  */
@@ -79,7 +79,7 @@ EXPORT_SYMBOL(sk_stream_wait_connect);
 
 /**
  * sk_stream_closing - Return 1 if we still have things to send in our buffers.
- * @sk - socket to verify
+ * @sk: socket to verify
  */
 static inline int sk_stream_closing(struct sock *sk)
 {
@@ -107,8 +107,8 @@ EXPORT_SYMBOL(sk_stream_wait_close);
 
 /**
  * sk_stream_wait_memory - Wait for more memory for a socket
- * @sk - socket to wait for memory
- * @timeo_p - for how long
+ * @sk: socket to wait for memory
+ * @timeo_p: for how long
  */
 int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 {
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index c2a0346f423b..e6e23eb14428 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1411,21 +1411,22 @@ static struct file_operations dn_dev_seq_fops = {
 
 #endif /* CONFIG_PROC_FS */
 
-static struct rtnetlink_link dnet_rtnetlink_table[RTM_MAX-RTM_BASE+1] = 
+static struct rtnetlink_link dnet_rtnetlink_table[RTM_NR_MSGTYPES] =
 {
-         [4] = { .doit   = dn_dev_rtm_newaddr,  },
-         [5] = { .doit   = dn_dev_rtm_deladdr,  },
-         [6] = { .dumpit = dn_dev_dump_ifaddr,  },
-
+        [RTM_NEWADDR  - RTM_BASE] = { .doit     = dn_dev_rtm_newaddr,   },
+        [RTM_DELADDR  - RTM_BASE] = { .doit     = dn_dev_rtm_deladdr,   },
+        [RTM_GETADDR  - RTM_BASE] = { .dumpit   = dn_dev_dump_ifaddr,   },
 #ifdef CONFIG_DECNET_ROUTER
-         [8] = { .doit   = dn_fib_rtm_newroute, },
-         [9] = { .doit   = dn_fib_rtm_delroute, },
-        [10] = { .doit   = dn_cache_getroute, .dumpit = dn_fib_dump, },
-        [16] = { .doit   = dn_fib_rtm_newrule, },
-        [17] = { .doit   = dn_fib_rtm_delrule, },
-        [18] = { .dumpit = dn_fib_dump_rules,  },
+        [RTM_NEWROUTE - RTM_BASE] = { .doit     = dn_fib_rtm_newroute,  },
+        [RTM_DELROUTE - RTM_BASE] = { .doit     = dn_fib_rtm_delroute,  },
+        [RTM_GETROUTE - RTM_BASE] = { .doit     = dn_cache_getroute,
+                                      .dumpit   = dn_fib_dump,          },
+        [RTM_NEWRULE  - RTM_BASE] = { .doit     = dn_fib_rtm_newrule,   },
+        [RTM_DELRULE  - RTM_BASE] = { .doit     = dn_fib_rtm_delrule,   },
+        [RTM_GETRULE  - RTM_BASE] = { .dumpit   = dn_fib_dump_rules,    },
 #else
-        [10] = { .doit   = dn_cache_getroute, .dumpit = dn_cache_dump, },
+        [RTM_GETROUTE - RTM_BASE] = { .doit     = dn_cache_getroute,
+                                      .dumpit   = dn_cache_dump,        
 #endif
 
 };
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index f86a6259fd12..284a9998e53d 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -119,8 +119,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 static void dnrmg_receive_user_sk(struct sock *sk, int len)
 {
         struct sk_buff *skb;
+        unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
 
-        while((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+        for (; qlen && (skb = skb_dequeue(&sk->sk_receive_queue)); qlen--) {
                 dnrmg_receive_user_skb(skb);
                 kfree_skb(skb);
         }
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index eea7ef010776..abbc6d5c183e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1107,17 +1107,18 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa)
         }
 }
 
-static struct rtnetlink_link inet_rtnetlink_table[RTM_MAX - RTM_BASE + 1] = {
-         [4] = { .doit   = inet_rtm_newaddr,  },
-         [5] = { .doit   = inet_rtm_deladdr,  },
-         [6] = { .dumpit = inet_dump_ifaddr,  },
-         [8] = { .doit   = inet_rtm_newroute, },
-         [9] = { .doit   = inet_rtm_delroute, },
-        [10] = { .doit   = inet_rtm_getroute, .dumpit = inet_dump_fib, },
+static struct rtnetlink_link inet_rtnetlink_table[RTM_NR_MSGTYPES] = {
+        [RTM_NEWADDR  - RTM_BASE] = { .doit     = inet_rtm_newaddr,     },
+        [RTM_DELADDR  - RTM_BASE] = { .doit     = inet_rtm_deladdr,     },
+        [RTM_GETADDR  - RTM_BASE] = { .dumpit   = inet_dump_ifaddr,     },
+        [RTM_NEWROUTE - RTM_BASE] = { .doit     = inet_rtm_newroute,    },
+        [RTM_DELROUTE - RTM_BASE] = { .doit     = inet_rtm_delroute,    },
+        [RTM_GETROUTE - RTM_BASE] = { .doit     = inet_rtm_getroute,
+                                      .dumpit   = inet_dump_fib,        },
 #ifdef CONFIG_IP_MULTIPLE_TABLES
-        [16] = { .doit   = inet_rtm_newrule, },
-        [17] = { .doit   = inet_rtm_delrule, },
-        [18] = { .dumpit = inet_dump_rules,  },
+        [RTM_NEWRULE  - RTM_BASE] = { .doit     = inet_rtm_newrule,     },
+        [RTM_DELRULE  - RTM_BASE] = { .doit     = inet_rtm_delrule,     },
+        [RTM_GETRULE  - RTM_BASE] = { .dumpit   = inet_dump_rules,      },
 #endif
 };
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 38f69532a029..24fe3e00b42b 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -111,6 +111,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
 #ifdef CONFIG_NETFILTER_DEBUG
         nf_debug_ip_loopback_xmit(newskb);
 #endif
+        nf_reset(newskb);
         netif_rx(newskb);
         return 0;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index 2b87c1974be6..721ddbf522b4 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -819,6 +819,7 @@ static int tcp_error(struct sk_buff *skb,
          */
         /* FIXME: Source route IP option packets --RR */
         if (hooknum == NF_IP_PRE_ROUTING
+            && skb->ip_summed != CHECKSUM_UNNECESSARY
             && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
                                  skb->ip_summed == CHECKSUM_HW ? skb->csum
                                  : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 9e40dffc204f..e5746b674413 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -546,20 +546,18 @@ ipq_rcv_skb(struct sk_buff *skb)
 static void
 ipq_rcv_sk(struct sock *sk, int len)
 {
-        do {
-                struct sk_buff *skb;
+        struct sk_buff *skb;
+        unsigned int qlen;
 
-                if (down_trylock(&ipqnl_sem))
-                        return;
+        down(&ipqnl_sem);
                         
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        ipq_rcv_skb(skb);
-                        kfree_skb(skb);
-                }
+        for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                ipq_rcv_skb(skb);
+                kfree_skb(skb);
+        }
                 
-                up(&ipqnl_sem);
-
-        } while (ipqnl && ipqnl->sk_receive_queue.qlen);
+        up(&ipqnl_sem);
 }
 
 static int
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 01b4a3c814d3..47449ba83eb9 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -103,13 +103,15 @@ static struct nf_hook_ops ipt_ops[] = {
           .hook = ipt_hook, 
           .pf = PF_INET, 
           .hooknum = NF_IP_PRE_ROUTING, 
-          .priority = NF_IP_PRI_RAW
+          .priority = NF_IP_PRI_RAW,
+          .owner = THIS_MODULE,
         },
         {
           .hook = ipt_hook, 
           .pf = PF_INET, 
           .hooknum = NF_IP_LOCAL_OUT, 
-          .priority = NF_IP_PRI_RAW
+          .priority = NF_IP_PRI_RAW,
+          .owner = THIS_MODULE,
         },
 };
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bb90a0c3a91e..199311746932 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -397,7 +397,7 @@ static int rt_cpu_seq_show(struct seq_file *seq, void *v)
         struct rt_cache_stat *st = v;
 
         if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "entries  in_hit in_slow_tot in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
+                seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
                 return 0;
         }
         
@@ -2843,7 +2843,7 @@ ctl_table ipv4_route_table[] = {
                 .procname       = "flush",
                 .data           = &flush_delay,
                 .maxlen         = sizeof(int),
-                .mode           = 0644,
+                .mode           = 0200,
                 .proc_handler   = &ipv4_sysctl_rtcache_flush,
                 .strategy       = &ipv4_sysctl_rtcache_flush_strategy,
         },
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 313c1408da33..8faa8948f75c 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -777,8 +777,9 @@ static inline void tcpdiag_rcv_skb(struct sk_buff *skb)
 static void tcpdiag_rcv(struct sock *sk, int len)
 {
         struct sk_buff *skb;
+        unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
 
-        while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+        while (qlen-- && (skb = skb_dequeue(&sk->sk_receive_queue))) {
                 tcpdiag_rcv_skb(skb);
                 kfree_skb(skb);
         }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3ac6659869c4..dad98e4a5043 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -222,10 +222,13 @@ static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
                 int rover;
 
                 spin_lock(&tcp_portalloc_lock);
-                rover = tcp_port_rover;
+                if (tcp_port_rover < low)
+                        rover = low;
+                else
+                        rover = tcp_port_rover;
                 do {
                         rover++;
-                        if (rover < low || rover > high)
+                        if (rover > high)
                                 rover = low;
                         head = &tcp_bhash[tcp_bhashfn(rover)];
                         spin_lock(&head->lock);
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 7fe2afd2e669..b2b60f3e9cdd 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -8,7 +8,10 @@
  *      
  */
 
+#include <asm/bug.h>
+#include <linux/compiler.h>
 #include <linux/config.h>
+#include <linux/inetdevice.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 
@@ -152,6 +155,8 @@ __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 x->u.rt.rt_dst = rt0->rt_dst;
                 x->u.rt.rt_gateway = rt->rt_gateway;
                 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
+                x->u.rt.idev = rt0->idev;
+                in_dev_hold(rt0->idev);
                 header_len -= x->u.dst.xfrm->props.header_len;
                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
         }
@@ -243,11 +248,48 @@ static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
         path->ops->update_pmtu(path, mtu);
 }
 
+static void xfrm4_dst_destroy(struct dst_entry *dst)
+{
+        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
+        if (likely(xdst->u.rt.idev))
+                in_dev_put(xdst->u.rt.idev);
+        xfrm_dst_destroy(xdst);
+}
+
+static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                             int unregister)
+{
+        struct xfrm_dst *xdst;
+
+        if (!unregister)
+                return;
+
+        xdst = (struct xfrm_dst *)dst;
+        if (xdst->u.rt.idev->dev == dev) {
+                struct in_device *loopback_idev = in_dev_get(&loopback_dev);
+                BUG_ON(!loopback_idev);
+
+                do {
+                        in_dev_put(xdst->u.rt.idev);
+                        xdst->u.rt.idev = loopback_idev;
+                        in_dev_hold(loopback_idev);
+                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
+                } while (xdst->u.dst.xfrm);
+
+                __in_dev_put(loopback_idev);
+        }
+
+        xfrm_dst_ifdown(dst, dev);
+}
+
 static struct dst_ops xfrm4_dst_ops = {
         .family =               AF_INET,
         .protocol =             __constant_htons(ETH_P_IP),
         .gc =                   xfrm4_garbage_collect,
         .update_pmtu =          xfrm4_update_pmtu,
+        .destroy =              xfrm4_dst_destroy,
+        .ifdown =               xfrm4_dst_ifdown,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7196ac2f2d16..7744a2592693 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3076,7 +3076,7 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
         netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_PREFIX, GFP_ATOMIC);
 }
 
-static struct rtnetlink_link inet6_rtnetlink_table[RTM_MAX - RTM_BASE + 1] = {
+static struct rtnetlink_link inet6_rtnetlink_table[RTM_NR_MSGTYPES] = {
         [RTM_GETLINK - RTM_BASE] = { .dumpit    = inet6_dump_ifinfo, },
         [RTM_NEWADDR - RTM_BASE] = { .doit      = inet6_rtm_newaddr, },
         [RTM_DELADDR - RTM_BASE] = { .doit      = inet6_rtm_deladdr, },
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index c54830b89593..750943e2d34e 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -549,20 +549,18 @@ ipq_rcv_skb(struct sk_buff *skb)
 static void
 ipq_rcv_sk(struct sock *sk, int len)
 {
-        do {
-                struct sk_buff *skb;
+        struct sk_buff *skb;
+        unsigned int qlen;
 
-                if (down_trylock(&ipqnl_sem))
-                        return;
+        down(&ipqnl_sem);
                         
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        ipq_rcv_skb(skb);
-                        kfree_skb(skb);
-                }
+        for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                ipq_rcv_skb(skb);
+                kfree_skb(skb);
+        }
                 
-                up(&ipqnl_sem);
-
-        } while (ipqnl && ipqnl->sk_receive_queue.qlen);
+        up(&ipqnl_sem);
 }
 
 static int
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1352c1d9bf4d..617645bc5ed6 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -455,11 +455,11 @@ csum_copy_err:
 static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                                      struct raw6_sock *rp)
 {
-        struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
         int err = 0;
         int offset;
         int len;
+        int total_len;
         u32 tmp_csum;
         u16 csum;
 
@@ -470,7 +470,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                 goto out;
 
         offset = rp->offset;
-        if (offset >= inet->cork.length - 1) {
+        total_len = inet_sk(sk)->cork.length - (skb->nh.raw - skb->data);
+        if (offset >= total_len - 1) {
                 err = -EINVAL;
                 ip6_flush_pending_frames(sk);
                 goto out;
@@ -514,7 +515,7 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
 
         tmp_csum = csum_ipv6_magic(&fl->fl6_src,
                                    &fl->fl6_dst,
-                                   inet->cork.length, fl->proto, tmp_csum);
+                                   total_len, fl->proto, tmp_csum);
 
         if (tmp_csum == 0)
                 tmp_csum = -1;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 183802902c02..3bf8a0254f81 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2005,7 +2005,7 @@ ctl_table ipv6_route_table[] = {
                 .procname       =       "flush",
                 .data           =       &flush_delay,
                 .maxlen         =       sizeof(int),
-                .mode           =       0644,
+                .mode           =       0200,
                 .proc_handler   =       &ipv6_sysctl_rtcache_flush
         },
         {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4760c85e19db..0f69e800a0ad 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -139,9 +139,12 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 int rover;
 
                 spin_lock(&tcp_portalloc_lock);
-                rover = tcp_port_rover;
+                if (tcp_port_rover < low)
+                        rover = low;
+                else
+                        rover = tcp_port_rover;
                 do {    rover++;
-                        if ((rover < low) || (rover > high))
+                        if (rover > high)
                                 rover = low;
                         head = &tcp_bhash[tcp_bhashfn(rover)];
                         spin_lock(&head->lock);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8a4f37de4d2d..4429b1a1fe5f 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -11,7 +11,11 @@
  * 
  */
 
+#include <asm/bug.h>
+#include <linux/compiler.h>
 #include <linux/config.h>
+#include <linux/netdevice.h>
+#include <net/addrconf.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -166,6 +170,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway)); 
                 x->u.rt6.rt6i_dst      = rt0->rt6i_dst;
                 x->u.rt6.rt6i_src      = rt0->rt6i_src; 
+                x->u.rt6.rt6i_idev     = rt0->rt6i_idev;
+                in6_dev_hold(rt0->rt6i_idev);
                 header_len -= x->u.dst.xfrm->props.header_len;
                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
         }
@@ -251,11 +257,48 @@ static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
         path->ops->update_pmtu(path, mtu);
 }
 
+static void xfrm6_dst_destroy(struct dst_entry *dst)
+{
+        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
+        if (likely(xdst->u.rt6.rt6i_idev))
+                in6_dev_put(xdst->u.rt6.rt6i_idev);
+        xfrm_dst_destroy(xdst);
+}
+
+static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                             int unregister)
+{
+        struct xfrm_dst *xdst;
+
+        if (!unregister)
+                return;
+
+        xdst = (struct xfrm_dst *)dst;
+        if (xdst->u.rt6.rt6i_idev->dev == dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(&loopback_dev);
+                BUG_ON(!loopback_idev);
+
+                do {
+                        in6_dev_put(xdst->u.rt6.rt6i_idev);
+                        xdst->u.rt6.rt6i_idev = loopback_idev;
+                        in6_dev_hold(loopback_idev);
+                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
+                } while (xdst->u.dst.xfrm);
+
+                __in6_dev_put(loopback_idev);
+        }
+
+        xfrm_dst_ifdown(dst, dev);
+}
+
 static struct dst_ops xfrm6_dst_ops = {
         .family =               AF_INET6,
         .protocol =             __constant_htons(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
+        .destroy =              xfrm6_dst_destroy,
+        .ifdown =               xfrm6_dst_ifdown,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 29a5fd231eac..4ee392066148 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -373,7 +373,6 @@ static int netlink_release(struct socket *sock)
                 nlk->cb->done(nlk->cb);
                 netlink_destroy_callback(nlk->cb);
                 nlk->cb = NULL;
-                __sock_put(sk);
         }
         spin_unlock(&nlk->cb_lock);
 
@@ -1099,7 +1098,6 @@ static int netlink_dump(struct sock *sk)
         spin_unlock(&nlk->cb_lock);
 
         netlink_destroy_callback(cb);
-        __sock_put(sk);
         return 0;
 }
 
@@ -1138,7 +1136,6 @@ int netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
                 return -EBUSY;
         }
         nlk->cb = cb;
-        sock_hold(sk);
         spin_unlock(&nlk->cb_lock);
 
         netlink_dump(sk);
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 9c118baed9dc..b0941186f867 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -185,7 +185,7 @@ config NET_SCH_GRED
         depends on NET_SCHED
         help
           Say Y here if you want to use the Generic Random Early Detection
-          (RED) packet scheduling algorithm for some of your network devices
+          (GRED) packet scheduling algorithm for some of your network devices
           (see the top of <file:net/sched/sch_red.c> for details and
           references about the algorithm).
 
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 5e6cc371b39e..cafcb084098d 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -171,10 +171,10 @@ repeat:
                                 skb->tc_verd = SET_TC_OK2MUNGE(skb->tc_verd);
                                 skb->tc_verd = CLR_TC_MUNGED(skb->tc_verd);
                         }
-                        if (ret != TC_ACT_PIPE)
-                                goto exec_done;
                         if (ret == TC_ACT_REPEAT)
                                 goto repeat;    /* we need a ttl - JHS */
+                        if (ret != TC_ACT_PIPE)
+                                goto exec_done;
                 }
                 act = a->next;
         }
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 4323a74eea30..07977f8f2679 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1289,6 +1289,7 @@ static int __init pktsched_init(void)
 
 subsys_initcall(pktsched_init);
 
+EXPORT_SYMBOL(qdisc_lookup);
 EXPORT_SYMBOL(qdisc_get_rtab);
 EXPORT_SYMBOL(qdisc_put_rtab);
 EXPORT_SYMBOL(register_qdisc);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 8c01e023f02e..87e48a4e1051 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -179,6 +179,7 @@ requeue:
                 netif_schedule(dev);
                 return 1;
         }
+        BUG_ON((int) q->q.qlen < 0);
         return q->q.qlen;
 }
 
@@ -539,6 +540,10 @@ void dev_activate(struct net_device *dev)
                 write_unlock_bh(&qdisc_tree_lock);
         }
 
+        if (!netif_carrier_ok(dev))
+                /* Delay activation until next carrier-on event */
+                return;
+
         spin_lock_bh(&dev->queue_lock);
         rcu_assign_pointer(dev->qdisc, dev->qdisc_sleeping);
         if (dev->qdisc != &noqueue_qdisc) {
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index a85935e7d53d..558cc087e602 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -717,6 +717,10 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (q->direct_queue.qlen < q->direct_qlen) {
             __skb_queue_tail(&q->direct_queue, skb);
             q->direct_pkts++;
+        } else {
+            kfree_skb(skb);
+            sch->qstats.drops++;
+            return NET_XMIT_DROP;
         }
 #ifdef CONFIG_NET_CLS_ACT
     } else if (!cl) {
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 31c29deb139d..e0c9fbe73b15 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -138,38 +138,77 @@ static long tabledist(unsigned long mu, long sigma,
 }
 
 /* Put skb in the private delayed queue. */
-static int delay_skb(struct Qdisc *sch, struct sk_buff *skb)
+static int netem_delay(struct Qdisc *sch, struct sk_buff *skb)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
-        struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb;
         psched_tdiff_t td;
         psched_time_t now;
         
         PSCHED_GET_TIME(now);
         td = tabledist(q->latency, q->jitter, &q->delay_cor, q->delay_dist);
-        PSCHED_TADD2(now, td, cb->time_to_send);
         
         /* Always queue at tail to keep packets in order */
         if (likely(q->delayed.qlen < q->limit)) {
+                struct netem_skb_cb *cb = (struct netem_skb_cb *)skb->cb;
+        
+                PSCHED_TADD2(now, td, cb->time_to_send);
+
+                pr_debug("netem_delay: skb=%p now=%llu tosend=%llu\n", skb, 
+                         now, cb->time_to_send);
+        
                 __skb_queue_tail(&q->delayed, skb);
-                if (!timer_pending(&q->timer)) {
-                        q->timer.expires = jiffies + PSCHED_US2JIFFIE(td);
-                        add_timer(&q->timer);
-                }
                 return NET_XMIT_SUCCESS;
         }
 
+        pr_debug("netem_delay: queue over limit %d\n", q->limit);
+        sch->qstats.overlimits++;
         kfree_skb(skb);
         return NET_XMIT_DROP;
 }
 
+/*
+ *  Move a packet that is ready to send from the delay holding
+ *  list to the underlying qdisc.
+ */
+static int netem_run(struct Qdisc *sch)
+{
+        struct netem_sched_data *q = qdisc_priv(sch);
+        struct sk_buff *skb;
+        psched_time_t now;
+
+        PSCHED_GET_TIME(now);
+
+        skb = skb_peek(&q->delayed);
+        if (skb) {
+                const struct netem_skb_cb *cb
+                        = (const struct netem_skb_cb *)skb->cb;
+                long delay 
+                        = PSCHED_US2JIFFIE(PSCHED_TDIFF(cb->time_to_send, now));
+                pr_debug("netem_run: skb=%p delay=%ld\n", skb, delay);
+
+                /* if more time remaining? */
+                if (delay > 0) {
+                        mod_timer(&q->timer, jiffies + delay);
+                        return 1;
+                }
+
+                __skb_unlink(skb, &q->delayed);
+                
+                if (q->qdisc->enqueue(skb, q->qdisc)) {
+                        sch->q.qlen--;
+                        sch->qstats.drops++;
+                } 
+        }
+
+        return 0;
+}
+
 static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
-        struct sk_buff *skb2;
         int ret;
 
-        pr_debug("netem_enqueue skb=%p @%lu\n", skb, jiffies);
+        pr_debug("netem_enqueue skb=%p\n", skb);
 
         /* Random packet drop 0 => none, ~0 => all */
         if (q->loss && q->loss >= get_crandom(&q->loss_cor)) {
@@ -180,11 +219,21 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         /* Random duplication */
-        if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor)
-            && (skb2 = skb_clone(skb, GFP_ATOMIC)) != NULL) {
-                pr_debug("netem_enqueue: dup %p\n", skb2);
+        if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor)) {
+                struct sk_buff *skb2;
+
+                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (skb2 && netem_delay(sch, skb2) == NET_XMIT_SUCCESS) {
+                        struct Qdisc *qp;
+
+                        /* Since one packet can generate two packets in the
+                         * queue, the parent's qlen accounting gets confused,
+                         * so fix it.
+                         */
+                        qp = qdisc_lookup(sch->dev, TC_H_MAJ(sch->parent));
+                        if (qp)
+                                qp->q.qlen++;
 
-                if (delay_skb(sch, skb2)) {
                         sch->q.qlen++;
                         sch->bstats.bytes += skb2->len;
                         sch->bstats.packets++;
@@ -202,7 +251,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 ret = q->qdisc->enqueue(skb, q->qdisc);
         } else {
                 q->counter = 0;
-                ret = delay_skb(sch, skb);
+                ret = netem_delay(sch, skb);
+                netem_run(sch);
         }
 
         if (likely(ret == NET_XMIT_SUCCESS)) {
@@ -212,6 +262,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         } else
                 sch->qstats.drops++;
 
+        pr_debug("netem: enqueue ret %d\n", ret);
         return ret;
 }
 
@@ -241,56 +292,35 @@ static unsigned int netem_drop(struct Qdisc* sch)
         return len;
 }
 
-/* Dequeue packet.
- *  Move all packets that are ready to send from the delay holding
- *  list to the underlying qdisc, then just call dequeue
- */
 static struct sk_buff *netem_dequeue(struct Qdisc *sch)
 {
         struct netem_sched_data *q = qdisc_priv(sch);
         struct sk_buff *skb;
+        int pending;
+
+        pending = netem_run(sch);
 
         skb = q->qdisc->dequeue(q->qdisc);
-        if (skb) 
+        if (skb) {
+                pr_debug("netem_dequeue: return skb=%p\n", skb);
                 sch->q.qlen--;
+                sch->flags &= ~TCQ_F_THROTTLED;
+        }
+        else if (pending) {
+                pr_debug("netem_dequeue: throttling\n");
+                sch->flags |= TCQ_F_THROTTLED;
+        } 
+
         return skb;
 }
 
 static void netem_watchdog(unsigned long arg)
 {
         struct Qdisc *sch = (struct Qdisc *)arg;
-        struct netem_sched_data *q = qdisc_priv(sch);
-        struct net_device *dev = sch->dev;
-        struct sk_buff *skb;
-        psched_time_t now;
-
-        pr_debug("netem_watchdog: fired @%lu\n", jiffies);
-
-        spin_lock_bh(&dev->queue_lock);
-        PSCHED_GET_TIME(now);
-
-        while ((skb = skb_peek(&q->delayed)) != NULL) {
-                const struct netem_skb_cb *cb
-                        = (const struct netem_skb_cb *)skb->cb;
-                long delay 
-                        = PSCHED_US2JIFFIE(PSCHED_TDIFF(cb->time_to_send, now));
-                pr_debug("netem_watchdog: skb %p@%lu %ld\n",
-                         skb, jiffies, delay);
 
-                /* if more time remaining? */
-                if (delay > 0) {
-                        mod_timer(&q->timer, jiffies + delay);
-                        break;
-                }
-                __skb_unlink(skb, &q->delayed);
-
-                if (q->qdisc->enqueue(skb, q->qdisc)) {
-                        sch->q.qlen--;
-                        sch->qstats.drops++;
-                }
-        }
-        qdisc_run(dev);
-        spin_unlock_bh(&dev->queue_lock);
+        pr_debug("netem_watchdog qlen=%d\n", sch->q.qlen);
+        sch->flags &= ~TCQ_F_THROTTLED;
+        netif_schedule(sch->dev);
 }
 
 static void netem_reset(struct Qdisc *sch)
@@ -301,6 +331,7 @@ static void netem_reset(struct Qdisc *sch)
         skb_queue_purge(&q->delayed);
 
         sch->q.qlen = 0;
+        sch->flags &= ~TCQ_F_THROTTLED;
         del_timer_sync(&q->timer);
 }
 
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 544b75077dbd..334f61773e6d 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -125,6 +125,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
                 sp->autoclose * HZ;
 
         /* Use SCTP specific send buffer space queues.  */
+        ep->sndbuf_policy = sctp_sndbuf_policy;
         sk->sk_write_space = sctp_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e42c74e3ec1e..c9d9ea064734 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -496,9 +496,7 @@ static void sctp_v6_inaddr_any(union sctp_addr *addr, unsigned short port)
 /* Is this a wildcard address? */
 static int sctp_v6_is_any(const union sctp_addr *addr)
 {
-        int type;
-        type = ipv6_addr_type((struct in6_addr *)&addr->v6.sin6_addr);
-        return IPV6_ADDR_ANY == type;
+        return ipv6_addr_any(&addr->v6.sin6_addr);
 }
 
 /* Should this be available for binding?   */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 9013f64f5219..84b5b370b09d 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -313,12 +313,12 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         sk = chunk->skb->sk;
 
         /* Allocate the new skb.  */
-        nskb = dev_alloc_skb(packet->size);
+        nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC);
         if (!nskb)
                 goto nomem;
 
         /* Make sure the outbound skb has enough header room reserved. */
-        skb_reserve(nskb, packet->overhead);
+        skb_reserve(nskb, packet->overhead + LL_MAX_HEADER);
 
         /* Set the owning socket so that we know where to get the
          * destination IP address.
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b9813cf3d91c..2e1f9c3556f5 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1043,6 +1043,9 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_max_retrans_path           = 5;
         sctp_max_retrans_init           = 8;
 
+        /* Sendbuffer growth        - do per-socket accounting */
+        sctp_sndbuf_policy              = 0;
+
         /* HB.interval              - 30 seconds */
         sctp_hb_interval                = 30 * HZ;
 
@@ -1159,8 +1162,6 @@ SCTP_STATIC __init int sctp_init(void)
         status = 0;
 out:
         return status;
-err_add_protocol:
-        proto_unregister(&sctp_prot);
 err_ctl_sock_init:
         sctp_v6_exit();
 err_v6_init:
@@ -1188,6 +1189,8 @@ err_bucket_cachep:
         inet_del_protocol(&sctp_protocol, IPPROTO_SCTP);
         inet_unregister_protosw(&sctp_seqpacket_protosw);
         inet_unregister_protosw(&sctp_stream_protosw);
+err_add_protocol:
+        proto_unregister(&sctp_prot);
         goto out;
 }
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 1db12cc18cf7..33ac8bf47b0e 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -710,7 +710,9 @@ struct sctp_chunk *sctp_make_shutdown_complete(
         struct sctp_chunk *retval;
         __u8 flags = 0;
 
-        /* Maybe set the T-bit if we have no association. */
+        /* Set the T-bit if we have no association (vtag will be
+         * reflected)
+         */
         flags |= asoc ? 0 : SCTP_CHUNK_FLAG_T;
 
         retval = sctp_make_chunk(asoc, SCTP_CID_SHUTDOWN_COMPLETE, flags, 0);
@@ -732,7 +734,7 @@ struct sctp_chunk *sctp_make_shutdown_complete(
 }
 
 /* Create an ABORT.  Note that we set the T bit if we have no
- * association.
+ * association, except when responding to an INIT (sctpimpguide 2.41).
  */
 struct sctp_chunk *sctp_make_abort(const struct sctp_association *asoc,
                               const struct sctp_chunk *chunk,
@@ -741,8 +743,16 @@ struct sctp_chunk *sctp_make_abort(const struct sctp_association *asoc,
         struct sctp_chunk *retval;
         __u8 flags = 0;
 
-        /* Maybe set the T-bit if we have no association.  */
-        flags |= asoc ? 0 : SCTP_CHUNK_FLAG_T;
+        /* Set the T-bit if we have no association and 'chunk' is not
+         * an INIT (vtag will be reflected).
+         */
+        if (!asoc) {
+                if (chunk && chunk->chunk_hdr &&
+                    chunk->chunk_hdr->type == SCTP_CID_INIT)
+                        flags = 0;
+                else
+                        flags = SCTP_CHUNK_FLAG_T;
+        }
 
         retval = sctp_make_chunk(asoc, SCTP_CID_ABORT, flags, hint);
 
@@ -2744,7 +2754,6 @@ struct sctp_chunk *sctp_make_fwdtsn(const struct sctp_association *asoc,
 
         hint = (nstreams + 1) * sizeof(__u32);
 
-        /* Maybe set the T-bit if we have no association.  */
         retval = sctp_make_chunk(asoc, SCTP_CID_FWD_TSN, 0, hint);
 
         if (!retval)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 278c56a2d076..8e01b8f09ac2 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -126,15 +126,18 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk,
  * should stop the T2-shutdown timer and remove all knowledge of the
  * association (and thus the association enters the CLOSED state).
  *
- * Verification Tag: 8.5.1(C)
+ * Verification Tag: 8.5.1(C), sctpimpguide 2.41.
  * C) Rules for packet carrying SHUTDOWN COMPLETE:
  * ...
- * - The receiver of a SHUTDOWN COMPLETE shall accept the packet if the
- *   Verification Tag field of the packet matches its own tag OR it is
- *   set to its peer's tag and the T bit is set in the Chunk Flags.
- *   Otherwise, the receiver MUST silently discard the packet and take
- *   no further action. An endpoint MUST ignore the SHUTDOWN COMPLETE if
- *   it is not in the SHUTDOWN-ACK-SENT state.
+ * - The receiver of a SHUTDOWN COMPLETE shall accept the packet
+ *   if the Verification Tag field of the packet matches its own tag and
+ *   the T bit is not set
+ *   OR
+ *   it is set to its peer's tag and the T bit is set in the Chunk
+ *   Flags.
+ *   Otherwise, the receiver MUST silently discard the packet
+ *   and take no further action.  An endpoint MUST ignore the
+ *   SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
  *
  * Inputs
  * (endpoint, asoc, chunk)
@@ -2858,16 +2861,16 @@ sctp_disposition_t sctp_sf_eat_sack_6_2(const struct sctp_endpoint *ep,
 /*
  * Generate an ABORT in response to a packet.
  *
- * Section: 8.4 Handle "Out of the blue" Packets
+ * Section: 8.4 Handle "Out of the blue" Packets, sctpimpguide 2.41
  *
- * 8) The receiver should respond to the sender of the OOTB packet
- *    with an ABORT.  When sending the ABORT, the receiver of the
- *    OOTB packet MUST fill in the Verification Tag field of the
- *    outbound packet with the value found in the Verification Tag
- *    field of the OOTB packet and set the T-bit in the Chunk Flags
- *    to indicate that no TCB was found.  After sending this ABORT,
- *    the receiver of the OOTB packet shall discard the OOTB packet
- *    and take no further action.
+ * 8) The receiver should respond to the sender of the OOTB packet with
+ *    an ABORT.  When sending the ABORT, the receiver of the OOTB packet
+ *    MUST fill in the Verification Tag field of the outbound packet
+ *    with the value found in the Verification Tag field of the OOTB
+ *    packet and set the T-bit in the Chunk Flags to indicate that the
+ *    Verification Tag is reflected.  After sending this ABORT, the
+ *    receiver of the OOTB packet shall discard the OOTB packet and take
+ *    no further action.
  *
  * Verification Tag:
  *
@@ -2895,6 +2898,10 @@ sctp_disposition_t sctp_sf_tabort_8_4_8(const struct sctp_endpoint *ep,
                         return SCTP_DISPOSITION_NOMEM;
                 }
 
+                /* Reflect vtag if T-Bit is set */
+                if (sctp_test_T_bit(abort))
+                        packet->vtag = ntohl(chunk->sctp_hdr->vtag);
+
                 /* Set the skb to the belonging sock for accounting.  */
                 abort->skb->sk = ep->base.sk;
 
@@ -3026,22 +3033,24 @@ nomem:
 }
 
 /*
- * RFC 2960, 8.4 - Handle "Out of the blue" Packets
+ * RFC 2960, 8.4 - Handle "Out of the blue" Packets, sctpimpguide 2.41.
+ *
  * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
  *    respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
  *    When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
  *    packet must fill in the Verification Tag field of the outbound
  *    packet with the Verification Tag received in the SHUTDOWN ACK and
- *    set the T-bit in the Chunk Flags to indicate that no TCB was
- *    found. Otherwise,
+ *    set the T-bit in the Chunk Flags to indicate that the Verification
+ *    Tag is reflected.
  *
  * 8) The receiver should respond to the sender of the OOTB packet with
  *    an ABORT.  When sending the ABORT, the receiver of the OOTB packet
  *    MUST fill in the Verification Tag field of the outbound packet
  *    with the value found in the Verification Tag field of the OOTB
- *    packet and set the T-bit in the Chunk Flags to indicate that no
- *    TCB was found.  After sending this ABORT, the receiver of the OOTB
- *    packet shall discard the OOTB packet and take no further action.
+ *    packet and set the T-bit in the Chunk Flags to indicate that the
+ *    Verification Tag is reflected.  After sending this ABORT, the
+ *    receiver of the OOTB packet shall discard the OOTB packet and take
+ *    no further action.
  */
 sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
                                 const struct sctp_association *asoc,
@@ -3090,13 +3099,15 @@ sctp_disposition_t sctp_sf_ootb(const struct sctp_endpoint *ep,
 /*
  * Handle an "Out of the blue" SHUTDOWN ACK.
  *
- * Section: 8.4 5)
+ * Section: 8.4 5, sctpimpguide 2.41.
+ *
  * 5) If the packet contains a SHUTDOWN ACK chunk, the receiver should
- *   respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
- *   When sending the SHUTDOWN COMPLETE, the receiver of the OOTB packet
- *   must fill in the Verification Tag field of the outbound packet with
- *   the Verification Tag received in the SHUTDOWN ACK and set the
- *   T-bit in the Chunk Flags to indicate that no TCB was found.
+ *    respond to the sender of the OOTB packet with a SHUTDOWN COMPLETE.
+ *    When sending the SHUTDOWN COMPLETE, the receiver of the OOTB
+ *    packet must fill in the Verification Tag field of the outbound
+ *    packet with the Verification Tag received in the SHUTDOWN ACK and
+ *    set the T-bit in the Chunk Flags to indicate that the Verification
+ *    Tag is reflected.
  *
  * Inputs
  * (endpoint, asoc, type, arg, commands)
@@ -3128,6 +3139,10 @@ static sctp_disposition_t sctp_sf_shut_8_4_5(const struct sctp_endpoint *ep,
                         return SCTP_DISPOSITION_NOMEM;
                 }
 
+                /* Reflect vtag if T-Bit is set */
+                if (sctp_test_T_bit(shut))
+                        packet->vtag = ntohl(chunk->sctp_hdr->vtag);
+
                 /* Set the skb to the belonging sock for accounting.  */
                 shut->skb->sk = ep->base.sk;
 
@@ -3591,7 +3606,6 @@ sctp_disposition_t sctp_sf_discard_chunk(const struct sctp_endpoint *ep,
  *
  * 2) If the OOTB packet contains an ABORT chunk, the receiver MUST
  *    silently discard the OOTB packet and take no further action.
- *    Otherwise,
  *
  * Verification Tag: No verification necessary
  *
@@ -4961,6 +4975,11 @@ static struct sctp_packet *sctp_abort_pkt_new(const struct sctp_endpoint *ep,
                         sctp_ootb_pkt_free(packet);
                         return NULL;
                 }
+
+                /* Reflect vtag if T-Bit is set */
+                if (sctp_test_T_bit(abort))
+                        packet->vtag = ntohl(chunk->sctp_hdr->vtag);
+
                 /* Add specified error causes, i.e., payload, to the
                  * end of the chunk.
                  */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index e8c210182571..0b338eca6dc0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -115,9 +115,17 @@ static inline int sctp_wspace(struct sctp_association *asoc)
         struct sock *sk = asoc->base.sk;
         int amt = 0;
 
-        amt = sk->sk_sndbuf - asoc->sndbuf_used;
+        if (asoc->ep->sndbuf_policy) {
+                /* make sure that no association uses more than sk_sndbuf */
+                amt = sk->sk_sndbuf - asoc->sndbuf_used;
+        } else {
+                /* do socket level accounting */
+                amt = sk->sk_sndbuf - atomic_read(&sk->sk_wmem_alloc);
+        }
+
         if (amt < 0)
                 amt = 0;
+
         return amt;
 }
 
@@ -138,12 +146,21 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
         /* The sndbuf space is tracked per association.  */
         sctp_association_hold(asoc);
 
+        skb_set_owner_w(chunk->skb, sk);
+
         chunk->skb->destructor = sctp_wfree;
         /* Save the chunk pointer in skb for sctp_wfree to use later.  */
         *((struct sctp_chunk **)(chunk->skb->cb)) = chunk;
 
-        asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk);
-        sk->sk_wmem_queued += SCTP_DATA_SNDSIZE(chunk);
+        asoc->sndbuf_used += SCTP_DATA_SNDSIZE(chunk) +
+                                sizeof(struct sk_buff) +
+                                sizeof(struct sctp_chunk);
+
+        sk->sk_wmem_queued += SCTP_DATA_SNDSIZE(chunk) +
+                                sizeof(struct sk_buff) +
+                                sizeof(struct sctp_chunk);
+
+        atomic_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
 }
 
 /* Verify that this is a valid address. */
@@ -3473,7 +3490,7 @@ static int sctp_getsockopt_associnfo(struct sock *sk, int len,
                 return -EINVAL;
 
         /* Values correspoinding to the specific association */
-        if (assocparams.sasoc_assoc_id != 0) {
+        if (asoc) {
                 assocparams.sasoc_asocmaxrxt = asoc->max_retrans;
                 assocparams.sasoc_peer_rwnd = asoc->peer.rwnd;
                 assocparams.sasoc_local_rwnd = asoc->a_rwnd;
@@ -4422,8 +4439,17 @@ static void sctp_wfree(struct sk_buff *skb)
         chunk = *((struct sctp_chunk **)(skb->cb));
         asoc = chunk->asoc;
         sk = asoc->base.sk;
-        asoc->sndbuf_used -= SCTP_DATA_SNDSIZE(chunk);
-        sk->sk_wmem_queued -= SCTP_DATA_SNDSIZE(chunk);
+        asoc->sndbuf_used -= SCTP_DATA_SNDSIZE(chunk) +
+                                sizeof(struct sk_buff) +
+                                sizeof(struct sctp_chunk);
+
+        sk->sk_wmem_queued -= SCTP_DATA_SNDSIZE(chunk) +
+                                sizeof(struct sk_buff) +
+                                sizeof(struct sctp_chunk);
+
+        atomic_sub(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
+
+        sock_wfree(skb);
         __sctp_write_space(asoc);
 
         sctp_association_put(asoc);
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 89fa20c73a5c..7fc31849312b 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -110,6 +110,14 @@ static ctl_table sctp_table[] = {
                 .proc_handler   = &proc_dointvec
         },
         {
+                .ctl_name       = NET_SCTP_SNDBUF_POLICY,
+                .procname       = "sndbuf_policy",
+                .data           = &sctp_sndbuf_policy,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec
+        },
+        {
                 .ctl_name       = NET_SCTP_PATH_MAX_RETRANS,
                 .procname       = "path_max_retrans",
                 .data           = &sctp_max_retrans_path,
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
index 4484931018eb..67b9f035ba86 100644
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -46,9 +46,9 @@ xdr_decode_netobj(u32 *p, struct xdr_netobj *obj)
 
 /**
  * xdr_encode_opaque_fixed - Encode fixed length opaque data
- * @p - pointer to current position in XDR buffer.
- * @ptr - pointer to data to encode (or NULL)
- * @nbytes - size of data.
+ * @p: pointer to current position in XDR buffer.
+ * @ptr: pointer to data to encode (or NULL)
+ * @nbytes: size of data.
  *
  * Copy the array of data of length nbytes at ptr to the XDR buffer
  * at position p, then align to the next 32-bit boundary by padding
@@ -76,9 +76,9 @@ EXPORT_SYMBOL(xdr_encode_opaque_fixed);
 
 /**
  * xdr_encode_opaque - Encode variable length opaque data
- * @p - pointer to current position in XDR buffer.
- * @ptr - pointer to data to encode (or NULL)
- * @nbytes - size of data.
+ * @p: pointer to current position in XDR buffer.
+ * @ptr: pointer to data to encode (or NULL)
+ * @nbytes: size of data.
  *
  * Returns the updated current XDR buffer position
  */
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 956c17f6c548..d6844ac226f5 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -48,8 +48,8 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/module.h>       /* support for loadable modules */
-#include <linux/slab.h> /* kmalloc(), kfree() */
-#include <linux/mm.h>           /* verify_area(), etc. */
+#include <linux/slab.h>         /* kmalloc(), kfree() */
+#include <linux/mm.h>
 #include <linux/string.h>       /* inline mem*, str* functions */
 
 #include <asm/byteorder.h>      /* htons(), etc. */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 80828078733d..55ed979db144 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1028,30 +1028,15 @@ static int stale_bundle(struct dst_entry *dst)
         return !xfrm_bundle_ok((struct xfrm_dst *)dst, NULL, AF_UNSPEC);
 }
 
-static void xfrm_dst_destroy(struct dst_entry *dst)
+void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
 {
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-
-        dst_release(xdst->route);
-
-        if (!dst->xfrm)
-                return;
-        xfrm_state_put(dst->xfrm);
-        dst->xfrm = NULL;
-}
-
-static void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
-                            int unregister)
-{
-        if (!unregister)
-                return;
-
         while ((dst = dst->child) && dst->xfrm && dst->dev == dev) {
                 dst->dev = &loopback_dev;
                 dev_hold(&loopback_dev);
                 dev_put(dev);
         }
 }
+EXPORT_SYMBOL(xfrm_dst_ifdown);
 
 static void xfrm_link_failure(struct sk_buff *skb)
 {
@@ -1262,10 +1247,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
                         dst_ops->kmem_cachep = xfrm_dst_cache;
                 if (likely(dst_ops->check == NULL))
                         dst_ops->check = xfrm_dst_check;
-                if (likely(dst_ops->destroy == NULL))
-                        dst_ops->destroy = xfrm_dst_destroy;
-                if (likely(dst_ops->ifdown == NULL))
-                        dst_ops->ifdown = xfrm_dst_ifdown;
                 if (likely(dst_ops->negative_advice == NULL))
                         dst_ops->negative_advice = xfrm_negative_advice;
                 if (likely(dst_ops->link_failure == NULL))
@@ -1297,8 +1278,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
                         xfrm_policy_afinfo[afinfo->family] = NULL;
                         dst_ops->kmem_cachep = NULL;
                         dst_ops->check = NULL;
-                        dst_ops->destroy = NULL;
-                        dst_ops->ifdown = NULL;
                         dst_ops->negative_advice = NULL;
                         dst_ops->link_failure = NULL;
                         dst_ops->get_mss = NULL;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 63661b0fd736..5ddda2c98af9 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -855,47 +855,44 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **x
         return 0;
 }
 
-static const int xfrm_msg_min[(XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)] = {
-        NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)),  /* NEW SA */
-        NLMSG_LENGTH(sizeof(struct xfrm_usersa_id)),    /* DEL SA */
-        NLMSG_LENGTH(sizeof(struct xfrm_usersa_id)),    /* GET SA */
-        NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info)),/* NEW POLICY */
-        NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id)),  /* DEL POLICY */
-        NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_id)),  /* GET POLICY */
-        NLMSG_LENGTH(sizeof(struct xfrm_userspi_info)), /* ALLOC SPI */
-        NLMSG_LENGTH(sizeof(struct xfrm_user_acquire)), /* ACQUIRE */
-        NLMSG_LENGTH(sizeof(struct xfrm_user_expire)),  /* EXPIRE */
-        NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info)),/* UPD POLICY */
-        NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)),  /* UPD SA */
-        NLMSG_LENGTH(sizeof(struct xfrm_user_polexpire)), /* POLEXPIRE */
-        NLMSG_LENGTH(sizeof(struct xfrm_usersa_flush)), /* FLUSH SA */
-        NLMSG_LENGTH(0),                                /* FLUSH POLICY */
+#define XMSGSIZE(type) NLMSG_LENGTH(sizeof(struct type))
+
+static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
+        [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
+        [XFRM_MSG_DELSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
+        [XFRM_MSG_GETSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_id),
+        [XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
+        [XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
+        [XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_id),
+        [XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userspi_info),
+        [XFRM_MSG_ACQUIRE     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_acquire),
+        [XFRM_MSG_EXPIRE      - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_expire),
+        [XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_userpolicy_info),
+        [XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_info),
+        [XFRM_MSG_POLEXPIRE   - XFRM_MSG_BASE] = XMSGSIZE(xfrm_user_polexpire),
+        [XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = XMSGSIZE(xfrm_usersa_flush),
+        [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = NLMSG_LENGTH(0),
 };
 
+#undef XMSGSIZE
+
 static struct xfrm_link {
         int (*doit)(struct sk_buff *, struct nlmsghdr *, void **);
         int (*dump)(struct sk_buff *, struct netlink_callback *);
-} xfrm_dispatch[] = {
-        {       .doit   =       xfrm_add_sa,            },
-        {       .doit   =       xfrm_del_sa,            },
-        {
-                .doit   =       xfrm_get_sa,
-                .dump   =       xfrm_dump_sa,
-        },
-        {       .doit   =       xfrm_add_policy         },
-        {       .doit   =       xfrm_get_policy         },
-        {
-                .doit   =       xfrm_get_policy,
-                .dump   =       xfrm_dump_policy,
-        },
-        {       .doit   =       xfrm_alloc_userspi      },
-        {},
-        {},
-        {       .doit   =       xfrm_add_policy         },
-        {       .doit   =       xfrm_add_sa,            },
-        {},
-        {       .doit   =       xfrm_flush_sa           },
-        {       .doit   =       xfrm_flush_policy       },
+} xfrm_dispatch[XFRM_NR_MSGTYPES] = {
+        [XFRM_MSG_NEWSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
+        [XFRM_MSG_DELSA       - XFRM_MSG_BASE] = { .doit = xfrm_del_sa        },
+        [XFRM_MSG_GETSA       - XFRM_MSG_BASE] = { .doit = xfrm_get_sa,
+                                                   .dump = xfrm_dump_sa       },
+        [XFRM_MSG_NEWPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
+        [XFRM_MSG_DELPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy    },
+        [XFRM_MSG_GETPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_get_policy,
+                                                   .dump = xfrm_dump_policy   },
+        [XFRM_MSG_ALLOCSPI    - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi },
+        [XFRM_MSG_UPDPOLICY   - XFRM_MSG_BASE] = { .doit = xfrm_add_policy    },
+        [XFRM_MSG_UPDSA       - XFRM_MSG_BASE] = { .doit = xfrm_add_sa        },
+        [XFRM_MSG_FLUSHSA     - XFRM_MSG_BASE] = { .doit = xfrm_flush_sa      },
+        [XFRM_MSG_FLUSHPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_flush_policy  },
 };
 
 static int xfrm_done(struct netlink_callback *cb)
@@ -931,7 +928,9 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err
                 return -1;
         }
 
-        if ((type == 2 || type == 5) && (nlh->nlmsg_flags & NLM_F_DUMP)) {
+        if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) ||
+             type == (XFRM_MSG_GETPOLICY - XFRM_MSG_BASE)) &&
+            (nlh->nlmsg_flags & NLM_F_DUMP)) {
                 u32 rlen;
 
                 if (link->dump == NULL)
@@ -1009,18 +1008,26 @@ static int xfrm_user_rcv_skb(struct sk_buff *skb)
 
 static void xfrm_netlink_rcv(struct sock *sk, int len)
 {
+        unsigned int qlen = skb_queue_len(&sk->sk_receive_queue);
+
         do {
                 struct sk_buff *skb;
 
                 down(&xfrm_cfg_sem);
 
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
+                if (qlen > skb_queue_len(&sk->sk_receive_queue))
+                        qlen = skb_queue_len(&sk->sk_receive_queue);
+
+                for (; qlen; qlen--) {
+                        skb = skb_dequeue(&sk->sk_receive_queue);
                         if (xfrm_user_rcv_skb(skb)) {
                                 if (skb->len)
                                         skb_queue_head(&sk->sk_receive_queue,
                                                        skb);
-                                else
+                                else {
                                         kfree_skb(skb);
+                                        qlen--;
+                                }
                                 break;
                         }
                         kfree_skb(skb);
@@ -1028,7 +1035,7 @@ static void xfrm_netlink_rcv(struct sock *sk, int len)
 
                 up(&xfrm_cfg_sem);
 
-        } while (xfrm_nl && xfrm_nl->sk_receive_queue.qlen);
+        } while (qlen);
 }
 
 static int build_expire(struct sk_buff *skb, struct xfrm_state *x, int hard)
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index 090ffda4adbc..fe11df83d1fc 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -69,6 +69,7 @@ static struct sym_entry *table;
 static int size, cnt;
 static unsigned long long _stext, _etext, _sinittext, _einittext;
 static int all_symbols = 0;
+static char symbol_prefix_char = '\0';
 
 struct token {
         unsigned char data[MAX_TOK_SIZE];
@@ -93,7 +94,7 @@ unsigned char best_table_len[256];
 static void
 usage(void)
 {
-        fprintf(stderr, "Usage: kallsyms [--all-symbols] < in.map > out.S\n");
+        fprintf(stderr, "Usage: kallsyms [--all-symbols] [--symbol-prefix=<prefix char>] < in.map > out.S\n");
         exit(1);
 }
 
@@ -112,6 +113,7 @@ static int
 read_symbol(FILE *in, struct sym_entry *s)
 {
         char str[500];
+        char *sym;
         int rc;
 
         rc = fscanf(in, "%llx %c %499s\n", &s->addr, &s->type, str);
@@ -123,27 +125,32 @@ read_symbol(FILE *in, struct sym_entry *s)
                 return -1;
         }
 
+        sym = str;
+        /* skip prefix char */
+        if (symbol_prefix_char && str[0] == symbol_prefix_char)
+                sym++;
+
         /* Ignore most absolute/undefined (?) symbols. */
-        if (strcmp(str, "_stext") == 0)
+        if (strcmp(sym, "_stext") == 0)
                 _stext = s->addr;
-        else if (strcmp(str, "_etext") == 0)
+        else if (strcmp(sym, "_etext") == 0)
                 _etext = s->addr;
-        else if (strcmp(str, "_sinittext") == 0)
+        else if (strcmp(sym, "_sinittext") == 0)
                 _sinittext = s->addr;
-        else if (strcmp(str, "_einittext") == 0)
+        else if (strcmp(sym, "_einittext") == 0)
                 _einittext = s->addr;
         else if (toupper(s->type) == 'A')
         {
                 /* Keep these useful absolute symbols */
-                if (strcmp(str, "__kernel_syscall_via_break") &&
-                    strcmp(str, "__kernel_syscall_via_epc") &&
-                    strcmp(str, "__kernel_sigtramp") &&
-                    strcmp(str, "__gp"))
+                if (strcmp(sym, "__kernel_syscall_via_break") &&
+                    strcmp(sym, "__kernel_syscall_via_epc") &&
+                    strcmp(sym, "__kernel_sigtramp") &&
+                    strcmp(sym, "__gp"))
                         return -1;
 
         }
         else if (toupper(s->type) == 'U' ||
-                 is_arm_mapping_symbol(str))
+                 is_arm_mapping_symbol(sym))
                 return -1;
 
         /* include the type field in the symbol name, so that it gets
@@ -177,6 +184,11 @@ symbol_valid(struct sym_entry *s)
                 "_SDA2_BASE_",          /* ppc */
                 NULL };
         int i;
+        int offset = 1;
+
+        /* skip prefix char */
+        if (symbol_prefix_char && *(s->sym + 1) == symbol_prefix_char)
+                offset++;
 
         /* if --all-symbols is not specified, then symbols outside the text
          * and inittext sections are discarded */
@@ -190,17 +202,17 @@ symbol_valid(struct sym_entry *s)
                  * they may get dropped in pass 2, which breaks the kallsyms
                  * rules.
                  */
-                if ((s->addr == _etext && strcmp(s->sym + 1, "_etext")) ||
-                    (s->addr == _einittext && strcmp(s->sym + 1, "_einittext")))
+                if ((s->addr == _etext && strcmp(s->sym + offset, "_etext")) ||
+                    (s->addr == _einittext && strcmp(s->sym + offset, "_einittext")))
                         return 0;
         }
 
         /* Exclude symbols which vary between passes. */
-        if (strstr(s->sym + 1, "_compiled."))
+        if (strstr(s->sym + offset, "_compiled."))
                 return 0;
 
         for (i = 0; special_symbols[i]; i++)
-                if( strcmp(s->sym + 1, special_symbols[i]) == 0 )
+                if( strcmp(s->sym + offset, special_symbols[i]) == 0 )
                         return 0;
 
         return 1;
@@ -225,9 +237,15 @@ read_map(FILE *in)
 
 static void output_label(char *label)
 {
-        printf(".globl %s\n",label);
+        if (symbol_prefix_char)
+                printf(".globl %c%s\n", symbol_prefix_char, label);
+        else
+                printf(".globl %s\n", label);
         printf("\tALGN\n");
-        printf("%s:\n",label);
+        if (symbol_prefix_char)
+                printf("%c%s:\n", symbol_prefix_char, label);
+        else
+                printf("%s:\n", label);
 }
 
 /* uncompress a compressed symbol. When this function is called, the best table
@@ -665,6 +683,13 @@ static void optimize_token_table(void)
 
         insert_real_symbols_in_table();
 
+        /* When valid symbol is not registered, exit to error */
+        if (good_head.left == good_head.right &&
+            bad_head.left == bad_head.right) {
+                fprintf(stderr, "No valid symbol.\n");
+                exit(1);
+        }
+
         optimize_result();
 }
 
@@ -672,9 +697,21 @@ static void optimize_token_table(void)
 int
 main(int argc, char **argv)
 {
-        if (argc == 2 && strcmp(argv[1], "--all-symbols") == 0)
-                all_symbols = 1;
-        else if (argc != 1)
+        if (argc >= 2) {
+                int i;
+                for (i = 1; i < argc; i++) {
+                        if(strcmp(argv[i], "--all-symbols") == 0)
+                                all_symbols = 1;
+                        else if (strncmp(argv[i], "--symbol-prefix=", 16) == 0) {
+                                char *p = &argv[i][16];
+                                /* skip quote */
+                                if ((*p == '"' && *(p+2) == '"') || (*p == '\'' && *(p+2) == '\''))
+                                        p++;
+                                symbol_prefix_char = *p;
+                        } else
+                                usage();
+                }
+        } else if (argc != 1)
                 usage();
 
         read_map(stdin);
@@ -683,4 +720,3 @@ main(int argc, char **argv)
 
         return 0;
 }
-
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 8b1dab63f11c..0835dc2a8aa9 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -553,15 +553,20 @@ sub output_section_xml(%) {
     # print out each section
     $lineprefix="   ";
     foreach $section (@{$args{'sectionlist'}}) {
-        print "<refsect1>\n <title>$section</title>\n <para>\n";
+        print "<refsect1>\n";
+        print "<title>$section</title>\n";
         if ($section =~ m/EXAMPLE/i) {
-            print "<example><para>\n";
+            print "<informalexample><programlisting>\n";
+        } else {
+            print "<para>\n";
         }
         output_highlight($args{'sections'}{$section});
         if ($section =~ m/EXAMPLE/i) {
-            print "</para></example>\n";
+            print "</programlisting></informalexample>\n";
+        } else {
+            print "</para>\n";
         }
-        print " </para>\n</refsect1>\n";
+        print "</refsect1>\n";
     }
 }
 
@@ -576,8 +581,14 @@ sub output_function_xml(%) {
     $id =~ s/[^A-Za-z0-9]/-/g;
 
     print "<refentry>\n";
+    print "<refentryinfo>\n";
+    print " <title>LINUX</title>\n";
+    print " <productname>Kernel Hackers Manual</productname>\n";
+    print " <date>$man_date</date>\n";
+    print "</refentryinfo>\n";
     print "<refmeta>\n";
-    print "<refentrytitle><phrase id=\"$id\">".$args{'function'}."</phrase></refentrytitle>\n";
+    print " <refentrytitle><phrase id=\"$id\">".$args{'function'}."</phrase></refentrytitle>\n";
+    print " <manvolnum>9</manvolnum>\n";
     print "</refmeta>\n";
     print "<refnamediv>\n";
     print " <refname>".$args{'function'}."</refname>\n";
@@ -607,7 +618,7 @@ sub output_function_xml(%) {
             }
         }
     } else {
-        print "  <void>\n";
+        print "  <void/>\n";
     }
     print "  </funcprototype></funcsynopsis>\n";
     print "</refsynopsisdiv>\n";
@@ -646,8 +657,14 @@ sub output_struct_xml(%) {
     $id =~ s/[^A-Za-z0-9]/-/g;
 
     print "<refentry>\n";
+    print "<refentryinfo>\n";
+    print " <title>LINUX</title>\n";
+    print " <productname>Kernel Hackers Manual</productname>\n";
+    print " <date>$man_date</date>\n";
+    print "</refentryinfo>\n";
     print "<refmeta>\n";
-    print "<refentrytitle><phrase id=\"$id\">".$args{'type'}." ".$args{'struct'}."</phrase></refentrytitle>\n";
+    print " <refentrytitle><phrase id=\"$id\">".$args{'type'}." ".$args{'struct'}."</phrase></refentrytitle>\n";
+    print " <manvolnum>9</manvolnum>\n";
     print "</refmeta>\n";
     print "<refnamediv>\n";
     print " <refname>".$args{'type'}." ".$args{'struct'}."</refname>\n";
@@ -724,8 +741,14 @@ sub output_enum_xml(%) {
     $id =~ s/[^A-Za-z0-9]/-/g;
 
     print "<refentry>\n";
+    print "<refentryinfo>\n";
+    print " <title>LINUX</title>\n";
+    print " <productname>Kernel Hackers Manual</productname>\n";
+    print " <date>$man_date</date>\n";
+    print "</refentryinfo>\n";
     print "<refmeta>\n";
-    print "<refentrytitle><phrase id=\"$id\">enum ".$args{'enum'}."</phrase></refentrytitle>\n";
+    print " <refentrytitle><phrase id=\"$id\">enum ".$args{'enum'}."</phrase></refentrytitle>\n";
+    print " <manvolnum>9</manvolnum>\n";
     print "</refmeta>\n";
     print "<refnamediv>\n";
     print " <refname>enum ".$args{'enum'}."</refname>\n";
@@ -784,8 +807,14 @@ sub output_typedef_xml(%) {
     $id =~ s/[^A-Za-z0-9]/-/g;
 
     print "<refentry>\n";
+    print "<refentryinfo>\n";
+    print " <title>LINUX</title>\n";
+    print " <productname>Kernel Hackers Manual</productname>\n";
+    print " <date>$man_date</date>\n";
+    print "</refentryinfo>\n";
     print "<refmeta>\n";
-    print "<refentrytitle><phrase id=\"$id\">typedef ".$args{'typedef'}."</phrase></refentrytitle>\n";
+    print " <refentrytitle><phrase id=\"$id\">typedef ".$args{'typedef'}."</phrase></refentrytitle>\n";
+    print " <manvolnum>9</manvolnum>\n";
     print "</refmeta>\n";
     print "<refnamediv>\n";
     print " <refname>typedef ".$args{'typedef'}."</refname>\n";
@@ -1465,6 +1494,8 @@ sub dump_function($$) {
 
     $prototype =~ s/^static +//;
     $prototype =~ s/^extern +//;
+    $prototype =~ s/^fastcall +//;
+    $prototype =~ s/^asmlinkage +//;
     $prototype =~ s/^inline +//;
     $prototype =~ s/^__inline__ +//;
     $prototype =~ s/^#define +//; #ak added
diff --git a/scripts/makeman b/scripts/makeman
deleted file mode 100755
index db3af647ee17..000000000000
--- a/scripts/makeman
+++ /dev/null
@@ -1,185 +0,0 @@
-#!/usr/bin/perl
-
-use strict;
-
-## Copyright (C) Michael Still (mikal@stillhq.com)
-## Released under the terms of the GNU GPL
-##
-## A script to make or install the manpages extracted by split-man
-##
-## Arguements: $1 -- the word "convert" or "install"
-##             $2 -- the directory containing the SGML files for the manpages
-##             $3 -- the filename which contained the sgmldoc output
-##                     (I need this so I know which manpages to convert)
-
-my($LISTING, $GENERATED, $INPUT, $OUTPUT, $front, $mode, $filename, $tmpdir);
-
-if($ARGV[0] eq ""){
-  die "Usage: makeman [convert | install] <dir> <file>\n";
-}
-
-if( ! -d "$ARGV[1]" ){
-  die "Output directory \"$ARGV[1]\" does not exist\n";
-}
-
-if($ENV{"TMPDIR"} ne ""){
-  $tmpdir = $ENV{"TMPDIR"};
-}
-else{
-  $tmpdir = "/tmp";
-}
-
-if($ARGV[0] eq "convert"){
-  open LISTING, "grep \"<refentrytitle>\" $ARGV[2] |";
-  while(<LISTING>){
-    s/<\/.*$//;
-    s/^.*>//;
-    s/\.sgml//;
-    s/struct //;
-    s/typedef //;
-
-    chomp;
-    $filename = $_;
-    print "Processing $filename\n";
-
-    # Open the input file to extract the front matter, generate the man page,
-    # and open it, and the rearrange everything until it is happy
-    open INPUT, "< $ARGV[1]/$filename.sgml";
-    $front = "";
-    $mode = 0;
-
-    # The modes used here are:
-    #                                                         mode = 0
-    # <!-- BEGINFRONTTAG -->
-    # <!-- <bookinfo>                                         mode = 1
-    # <!--   <legalnotice>                                    mode = 2
-    # <!--     ...GPL or whatever...
-    # <!--   </legalnotice>                                   mode = 4
-    # <!-- </bookinfo>                                        mode = 3
-    # <!-- ENDFRONTTAG -->
-    #
-    # ...doco...
-
-    # I know that some of the if statements in this while loop are in a funny
-    # order, but that is deliberate...
-    while(<INPUT>){
-      if($mode > 0){
-        s/<!-- //;
-        s/ -->//;
-        s/<docinfo>//i;
-        s<\/docinfo>//i;
-        s/^[ \t]*//i;
-      }
-
-      if($mode == 2){
-        if(/<para>/i){
-        }
-        elsif(/<\/para>/i){
-          $front = "$front.\\\" \n";
-        }
-        elsif(/<\/legalnotice>/i){
-          $mode = 4;
-        }
-        elsif(/^[ \t]*$/){
-        }
-        else{
-          $front = "$front.\\\"     $_";
-        }
-      }
-
-      if($mode == 1){
-        if(/<title>(.*)<\/title>/i){
-          $front = "$front.\\\" This documentation was generated from the book titled \"$1\", which is part of the Linux kernel source.\n.\\\" \n";
-        }
-        elsif(/<legalnotice>/i){
-          $front = "$front.\\\" This documentation comes with the following legal notice:\n.\\\" \n";
-          $mode = 2;
-        }
-
-        elsif(/<author>/i){
-          $front = "$front.\\\" Documentation by: ";
-        }
-        elsif(/<firstname>(.*)<\/firstname>/i){
-          $front = "$front$1 ";
-        }
-        elsif(/<surname>(.*)<\/surname>/i){
-          $front = "$front$1 ";
-        }
-        elsif(/<email>(.*)<\/email>/i){
-          $front = "$front($1)";
-        }
-        elsif(/\/author>/i){
-          $front = "$front\n";
-        }
-
-        elsif(/<copyright>/i){
-          $front = "$front.\\\" Documentation copyright: ";
-        }
-        elsif(/<holder>(.*)<\/holder>/i){
-          $front = "$front$1 ";
-        }
-        elsif(/<year>(.*)<\/year>/i){
-          $front = "$front$1 ";
-        }
-        elsif(/\/copyright>/i){
-          $front = "$front\n";
-        }
-
-        elsif(/^[ \t]*$/
-              || /<affiliation>/i
-              || /<\/affiliation>/i
-              || /<address>/i
-              || /<\/address>/i
-              || /<authorgroup>/i
-              || /<\/authorgroup>/i
-              || /<\/legalnotice>/i
-              || /<date>/i
-              || /<\/date>/i
-              || /<edition>/i
-              || /<\/edition>/i
-              || /<pubdate>/i
-              || /<\/pubdate>/i){
-        }
-        else{
-          print "Unknown tag in manpage conversion: $_";
-          }
-      }
-
-      if($mode == 0){
-        if(/<bookinfo>/i){
-          $mode = 1;
-        }
-      }
-
-      if($mode == 4){
-        if(/<\/bookinfo>/i){
-          $mode = 3;
-        }
-      }
-    }
-    close INPUT;
-
-    system("cd $ARGV[1]; docbook2man $filename.sgml; mv $filename.9 $tmpdir/$$.9\n");
-    open GENERATED, "< $tmpdir/$$.9";
-    open OUTPUT, "> $ARGV[1]/$filename.9";
-
-    print OUTPUT "$front";
-    print OUTPUT ".\\\" For comments on the formatting of this manpage, please contact Michael Still <mikal\@stillhq.com>\n\n";
-    while(<GENERATED>){
-      print OUTPUT "$_";
-    }
-    close OUTPUT;
-    close GENERATED;
-
-    system("gzip -f $ARGV[1]/$filename.9\n");
-    unlink("$tmpdir/$$.9");
-  }
-}
-elsif($ARGV[0] eq "install"){
-  system("mkdir -p /usr/local/man/man9/; install $ARGV[1]/*.9.gz /usr/local/man/man9/");
-}
-else{
-  die "Usage: makeman [convert | install] <dir> <file>\n";
-}
-
-print "Done\n";
diff --git a/scripts/split-man b/scripts/split-man
deleted file mode 100755
index 03897fe6a75d..000000000000
--- a/scripts/split-man
+++ /dev/null
@@ -1,112 +0,0 @@
-#!/usr/bin/perl
-
-use strict;
-
-## Copyright (C) Michael Still (mikal@stillhq.com)
-## Released under the terms of the GNU GPL
-##
-## Hoon through the specified DocBook SGML file, and split out the
-## man pages. These can then be processed into groff format, and
-## installed if desired...
-##
-## Arguements: $1 -- the name of the sgml file
-##             $2 -- the directory to put the generated SGML files in
-##             $3 -- kernel version
-
-my($SGML, $REF, $front, $refdata, $mode, $filename);
-
-if(($ARGV[0] eq "") || ($ARGV[1] eq "") || ($ARGV[2] eq "")){
-  die "Usage: split-man <sgml file> <output dir> <kernel version>\n";
-}
-
-open SGML, "< $ARGV[0]" or die "Could not open input file \"$ARGV[0]\"\n";
-if( ! -d "$ARGV[1]" ){
-  die "Output directory \"$ARGV[1]\" does not exist\n";
-}
-
-# Possible modes:
-#   0: Looking for input I care about
-#   1: Inside book front matter
-#   2: Inside a refentry
-#   3: Inside a refentry, and we know the filename
-
-$mode = 0;
-$refdata = "";
-$front = "";
-while(<SGML>){
-  # Starting modes
-  if(/<bookinfo>/ || /<docinfo>/){
-    $mode = 1;
-  }
-  elsif(/<refentry>/){
-    $mode = 2;
-  }
-  elsif(/<refentrytitle><phrase[^>]*>([^<]*)<.*$/){
-    $mode = 3;
-    $filename = $1;
-
-    $filename =~ s/struct //;
-    $filename =~ s/typedef //;
-
-    print "Found manpage for $filename\n";
-    open REF, "> $ARGV[1]/$filename.sgml" or
-      die "Couldn't open output file \"$ARGV[1]/$filename.sgml\": $!\n";
-    print REF <<EOF;
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
-
-<!-- BEGINFRONTTAG: The following is front matter for the parent book -->
-$front
-<!-- ENDFRONTTAG: End front matter -->
-
-$refdata
-EOF
-    $refdata = "";
-  }
-
-  # Extraction
-  if($mode == 1){
-    chomp $_;
-    $front = "$front<!-- $_ -->\n";
-  }
-  elsif($mode == 2){
-    $refdata = "$refdata$_";
-  }
-  elsif($mode == 3){
-    # There are some fixups which need to be applied
-    if(/<\/refmeta>/){
-      print REF "<manvolnum>9</manvolnum>\n";
-    }
-    if(/<\/refentry>/){
-      print REF <<EOF;
-<refsect1><title>About this document</title>
-<para>
-This documentation was generated with kernel version $ARGV[2].
-</para>
-</refsect1>
-EOF
-    }
-
-    # For some reason, we title the synopsis twice in the main DocBook
-    if(! /<title>Synopsis<\/title>/){
-      if(/<refentrytitle>/){
-        s/struct //;
-        s/typedef //;
-      }
-
-      print REF "$_";
-    }
-  }
-
-  # Ending modes
-  if(/<\/bookinfo>/ || /<\/docinfo>/){
-    $mode = 0;
-  }
-  elsif(/<\/refentry>/){
-    $mode = 0;
-    close REF;
-  }
-}
-
-# And make sure we don't process this unnessesarily
-$ARGV[0] =~ s/\.sgml/.9/;
-`touch $ARGV[0]`;
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 0d378141c95a..aae1e794fe48 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3667,7 +3667,7 @@ static void msg_msg_free_security(struct msg_msg *msg)
 }
 
 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
-                        u16 sclass, u32 perms)
+                        u32 perms)
 {
         struct task_security_struct *tsec;
         struct ipc_security_struct *isec;
@@ -3679,7 +3679,7 @@ static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
         AVC_AUDIT_DATA_INIT(&ad, IPC);
         ad.u.ipc_id = ipc_perms->key;
 
-        return avc_has_perm(tsec->sid, isec->sid, sclass, perms, &ad);
+        return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
 }
 
 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
@@ -3764,7 +3764,7 @@ static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
                 return 0;
         }
 
-        err = ipc_has_perm(&msq->q_perm, SECCLASS_MSGQ, perms);
+        err = ipc_has_perm(&msq->q_perm, perms);
         return err;
 }
 
@@ -3916,7 +3916,7 @@ static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
                 return 0;
         }
 
-        err = ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
+        err = ipc_has_perm(&shp->shm_perm, perms);
         return err;
 }
 
@@ -3935,7 +3935,7 @@ static int selinux_shm_shmat(struct shmid_kernel *shp,
         else
                 perms = SHM__READ | SHM__WRITE;
 
-        return ipc_has_perm(&shp->shm_perm, SECCLASS_SHM, perms);
+        return ipc_has_perm(&shp->shm_perm, perms);
 }
 
 /* Semaphore security operations */
@@ -4024,7 +4024,7 @@ static int selinux_sem_semctl(struct sem_array *sma, int cmd)
                 return 0;
         }
 
-        err = ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
+        err = ipc_has_perm(&sma->sem_perm, perms);
         return err;
 }
 
@@ -4038,18 +4038,13 @@ static int selinux_sem_semop(struct sem_array *sma,
         else
                 perms = SEM__READ;
 
-        return ipc_has_perm(&sma->sem_perm, SECCLASS_SEM, perms);
+        return ipc_has_perm(&sma->sem_perm, perms);
 }
 
 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
 {
-        struct ipc_security_struct *isec = ipcp->security;
-        u16 sclass = SECCLASS_IPC;
         u32 av = 0;
 
-        if (isec && isec->magic == SELINUX_MAGIC)
-                sclass = isec->sclass;
-
         av = 0;
         if (flag & S_IRUGO)
                 av |= IPC__UNIX_READ;
@@ -4059,7 +4054,7 @@ static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
         if (av == 0)
                 return 0;
 
-        return ipc_has_perm(ipcp, sclass, av);
+        return ipc_has_perm(ipcp, av);
 }
 
 /* module stacking operations */
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index eb340b45bc6f..8928bb4d3c53 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -220,6 +220,8 @@
    S_(SECCLASS_NETLINK_XFRM_SOCKET, NETLINK_XFRM_SOCKET__NLMSG_WRITE, "nlmsg_write")
    S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READ, "nlmsg_read")
    S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_WRITE, "nlmsg_write")
+   S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_RELAY, "nlmsg_relay")
+   S_(SECCLASS_NETLINK_AUDIT_SOCKET, NETLINK_AUDIT_SOCKET__NLMSG_READPRIV, "nlmsg_readpriv")
    S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_READ, "nlmsg_read")
    S_(SECCLASS_NETLINK_IP6FW_SOCKET, NETLINK_IP6FW_SOCKET__NLMSG_WRITE, "nlmsg_write")
    S_(SECCLASS_DBUS, DBUS__ACQUIRE_SVC, "acquire_svc")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index f9de0f966559..bdfce4ca8f8e 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -840,6 +840,8 @@
 
 #define NETLINK_AUDIT_SOCKET__NLMSG_READ          0x00400000UL
 #define NETLINK_AUDIT_SOCKET__NLMSG_WRITE         0x00800000UL
+#define NETLINK_AUDIT_SOCKET__NLMSG_RELAY         0x01000000UL
+#define NETLINK_AUDIT_SOCKET__NLMSG_READPRIV      0x02000000UL
 
 #define NETLINK_IP6FW_SOCKET__IOCTL               0x00000001UL
 #define NETLINK_IP6FW_SOCKET__READ                0x00000002UL
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
index f79408252730..b3adb481bc25 100644
--- a/security/selinux/nlmsgtab.c
+++ b/security/selinux/nlmsgtab.c
@@ -91,13 +91,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
 
 static struct nlmsg_perm nlmsg_audit_perms[] =
 {
-        { AUDIT_GET,            NETLINK_AUDIT_SOCKET__NLMSG_READ  },
-        { AUDIT_SET,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-        { AUDIT_LIST,           NETLINK_AUDIT_SOCKET__NLMSG_READ  },
-        { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-        { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-        { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
-        { AUDIT_LOGIN,          NETLINK_AUDIT_SOCKET__NLMSG_WRITE },
+        { AUDIT_GET,            NETLINK_AUDIT_SOCKET__NLMSG_READ     },
+        { AUDIT_SET,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
+        { AUDIT_LIST,           NETLINK_AUDIT_SOCKET__NLMSG_READPRIV },
+        { AUDIT_ADD,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
+        { AUDIT_DEL,            NETLINK_AUDIT_SOCKET__NLMSG_WRITE    },
+        { AUDIT_USER,           NETLINK_AUDIT_SOCKET__NLMSG_RELAY    },
 };
 
 
diff --git a/sound/oss/sonicvibes.c b/sound/oss/sonicvibes.c
index e1d69611a257..06047e7979af 100644
--- a/sound/oss/sonicvibes.c
+++ b/sound/oss/sonicvibes.c
@@ -1149,7 +1149,7 @@ static int mixer_ioctl(struct sv_state *s, unsigned int cmd, unsigned long arg)
                         if (mixtable[i].rec)
                                 break;
                 }
-                if (!mixtable[i].rec)
+                if (i == SOUND_MIXER_NRDEVICES)
                         return 0;
                 spin_lock_irqsave(&s->lock, flags);
                 frobindir(s, SV_CIMIX_ADCINL, 0x1f, mixtable[i].rec << 5);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index d89647a3d449..959953ca320a 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -64,7 +64,8 @@ MODULE_PARM_DESC(model, "Use the given board model.");
 MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{Intel, ICH6M},"
-                         "{Intel, ICH7}}");
+                         "{Intel, ICH7},"
+                         "{Intel, ESB2}}");
 MODULE_DESCRIPTION("Intel HDA driver");
 
 #define SFX     "hda-intel: "
@@ -1422,6 +1423,7 @@ static void __devexit azx_remove(struct pci_dev *pci)
 static struct pci_device_id azx_ids[] = {
         { 0x8086, 0x2668, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ICH6 */
         { 0x8086, 0x27d8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ICH7 */
+        { 0x8086, 0x269a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 }, /* ESB2 */
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);
diff --git a/sound/ppc/Makefile b/sound/ppc/Makefile
index 4d95c652c8ca..d6ba9959097b 100644
--- a/sound/ppc/Makefile
+++ b/sound/ppc/Makefile
@@ -3,7 +3,7 @@
 # Copyright (c) 2001 by Jaroslav Kysela <perex@suse.cz>
 #
 
-snd-powermac-objs := powermac.o pmac.o awacs.o burgundy.o daca.o tumbler.o keywest.o beep.o
+snd-powermac-objs := powermac.o pmac.o awacs.o burgundy.o daca.o tumbler.o toonie.o keywest.o beep.o
 
 # Toplevel Module Dependency
 obj-$(CONFIG_SND_POWERMAC) += snd-powermac.o
diff --git a/sound/ppc/pmac.c b/sound/ppc/pmac.c
index 3bf5f069a03d..32d94754acf8 100644
--- a/sound/ppc/pmac.c
+++ b/sound/ppc/pmac.c
@@ -986,7 +986,13 @@ static int __init snd_pmac_detect(pmac_t *chip)
                         chip->num_freqs = ARRAY_SIZE(tumbler_freqs);
                         chip->model = PMAC_SNAPPER;
                         chip->can_byte_swap = 0; /* FIXME: check this */
-                        chip->control_mask = MASK_IEPC | 0x11; /* disable IEE */
+                        chip->control_mask = MASK_IEPC | 0x11;/* disable IEE */
+                        break;
+                case 0x3a:
+                        chip->num_freqs = ARRAY_SIZE(tumbler_freqs);
+                        chip->model = PMAC_TOONIE;
+                        chip->can_byte_swap = 0; /* FIXME: check this */
+                        chip->control_mask = MASK_IEPC | 0x11;/* disable IEE */
                         break;
                 }
         }
diff --git a/sound/ppc/pmac.h b/sound/ppc/pmac.h
index dc6c99dd14e7..0a84c05f714b 100644
--- a/sound/ppc/pmac.h
+++ b/sound/ppc/pmac.h
@@ -94,7 +94,8 @@ struct snd_pmac_stream {
  */
 
 enum snd_pmac_model {
-        PMAC_AWACS, PMAC_SCREAMER, PMAC_BURGUNDY, PMAC_DACA, PMAC_TUMBLER, PMAC_SNAPPER
+        PMAC_AWACS, PMAC_SCREAMER, PMAC_BURGUNDY, PMAC_DACA, PMAC_TUMBLER,
+        PMAC_SNAPPER, PMAC_TOONIE
 };
 
 struct snd_pmac {
@@ -191,6 +192,7 @@ int snd_pmac_burgundy_init(pmac_t *chip);
 int snd_pmac_daca_init(pmac_t *chip);
 int snd_pmac_tumbler_init(pmac_t *chip);
 int snd_pmac_tumbler_post_init(void);
+int snd_pmac_toonie_init(pmac_t *chip);
 
 /* i2c functions */
 typedef struct snd_pmac_keywest {
diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
index 8f1953a8e290..231f6432ea6d 100644
--- a/sound/ppc/powermac.c
+++ b/sound/ppc/powermac.c
@@ -95,6 +95,13 @@ static int __init snd_pmac_probe(void)
                 if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0)
                         goto __error;
                 break;
+        case PMAC_TOONIE:
+                strcpy(card->driver, "PMac Toonie");
+                strcpy(card->shortname, "PowerMac Toonie");
+                strcpy(card->longname, card->shortname);
+                if ((err = snd_pmac_toonie_init(chip)) < 0)
+                        goto __error;
+                break;
         case PMAC_AWACS:
         case PMAC_SCREAMER:
                 name_ext = chip->model == PMAC_SCREAMER ? "Screamer" : "AWACS";
diff --git a/sound/ppc/toonie.c b/sound/ppc/toonie.c
new file mode 100644
index 000000000000..082bc4babab5
--- /dev/null
+++ b/sound/ppc/toonie.c
@@ -0,0 +1,379 @@
+/*
+ * Mac Mini "toonie" mixer control
+ *
+ * Copyright (c) 2005 by Benjamin Herrenschmidt <benh@kernel.crashing.org>
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+#include <sound/driver.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/i2c.h>
+#include <linux/i2c-dev.h>
+#include <linux/kmod.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <sound/core.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/machdep.h>
+#include <asm/pmac_feature.h>
+#include "pmac.h"
+
+#undef DEBUG
+
+#ifdef DEBUG
+#define DBG(fmt...) printk(fmt)
+#else
+#define DBG(fmt...)
+#endif
+
+struct pmac_gpio {
+        unsigned int addr;
+        u8 active_val;
+        u8 inactive_val;
+        u8 active_state;
+};
+
+struct pmac_toonie
+{
+        struct pmac_gpio        hp_detect_gpio;
+        struct pmac_gpio        hp_mute_gpio;
+        struct pmac_gpio        amp_mute_gpio;
+        int                     hp_detect_irq;
+        int                     auto_mute_notify;
+        struct work_struct      detect_work;
+};
+
+
+/*
+ * gpio access
+ */
+#define do_gpio_write(gp, val) \
+        pmac_call_feature(PMAC_FTR_WRITE_GPIO, NULL, (gp)->addr, val)
+#define do_gpio_read(gp) \
+        pmac_call_feature(PMAC_FTR_READ_GPIO, NULL, (gp)->addr, 0)
+#define tumbler_gpio_free(gp) /* NOP */
+
+static void write_audio_gpio(struct pmac_gpio *gp, int active)
+{
+        if (! gp->addr)
+                return;
+        active = active ? gp->active_val : gp->inactive_val;
+        do_gpio_write(gp, active);
+        DBG("(I) gpio %x write %d\n", gp->addr, active);
+}
+
+static int check_audio_gpio(struct pmac_gpio *gp)
+{
+        int ret;
+
+        if (! gp->addr)
+                return 0;
+
+        ret = do_gpio_read(gp);
+
+        return (ret & 0xd) == (gp->active_val & 0xd);
+}
+
+static int read_audio_gpio(struct pmac_gpio *gp)
+{
+        int ret;
+        if (! gp->addr)
+                return 0;
+        ret = ((do_gpio_read(gp) & 0x02) !=0);
+        return ret == gp->active_state;
+}
+
+
+enum { TOONIE_MUTE_HP, TOONIE_MUTE_AMP };
+
+static int toonie_get_mute_switch(snd_kcontrol_t *kcontrol,
+                                  snd_ctl_elem_value_t *ucontrol)
+{
+        pmac_t *chip = snd_kcontrol_chip(kcontrol);
+        struct pmac_toonie *mix = chip->mixer_data;
+        struct pmac_gpio *gp;
+
+        if (mix == NULL)
+                return -ENODEV;
+        switch(kcontrol->private_value) {
+        case TOONIE_MUTE_HP:
+                gp = &mix->hp_mute_gpio;
+                break;
+        case TOONIE_MUTE_AMP:
+                gp = &mix->amp_mute_gpio;
+                break;
+        default:
+                return -EINVAL;;
+        }
+        ucontrol->value.integer.value[0] = !check_audio_gpio(gp);
+        return 0;
+}
+
+static int toonie_put_mute_switch(snd_kcontrol_t *kcontrol,
+                                   snd_ctl_elem_value_t *ucontrol)
+{
+        pmac_t *chip = snd_kcontrol_chip(kcontrol);
+        struct pmac_toonie *mix = chip->mixer_data;
+        struct pmac_gpio *gp;
+        int val;
+
+        if (chip->update_automute && chip->auto_mute)
+                return 0; /* don't touch in the auto-mute mode */
+
+        if (mix == NULL)
+                return -ENODEV;
+
+        switch(kcontrol->private_value) {
+        case TOONIE_MUTE_HP:
+                gp = &mix->hp_mute_gpio;
+                break;
+        case TOONIE_MUTE_AMP:
+                gp = &mix->amp_mute_gpio;
+                break;
+        default:
+                return -EINVAL;;
+        }
+        val = ! check_audio_gpio(gp);
+        if (val != ucontrol->value.integer.value[0]) {
+                write_audio_gpio(gp, ! ucontrol->value.integer.value[0]);
+                return 1;
+        }
+        return 0;
+}
+
+static snd_kcontrol_new_t toonie_hp_sw __initdata = {
+        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+        .name = "Headphone Playback Switch",
+        .info = snd_pmac_boolean_mono_info,
+        .get = toonie_get_mute_switch,
+        .put = toonie_put_mute_switch,
+        .private_value = TOONIE_MUTE_HP,
+};
+static snd_kcontrol_new_t toonie_speaker_sw __initdata = {
+        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+        .name = "PC Speaker Playback Switch",
+        .info = snd_pmac_boolean_mono_info,
+        .get = toonie_get_mute_switch,
+        .put = toonie_put_mute_switch,
+        .private_value = TOONIE_MUTE_AMP,
+};
+
+/*
+ * auto-mute stuffs
+ */
+static int toonie_detect_headphone(pmac_t *chip)
+{
+        struct pmac_toonie *mix = chip->mixer_data;
+        int detect = 0;
+
+        if (mix->hp_detect_gpio.addr)
+                detect |= read_audio_gpio(&mix->hp_detect_gpio);
+        return detect;
+}
+
+static void toonie_check_mute(pmac_t *chip, struct pmac_gpio *gp, int val,
+                              int do_notify, snd_kcontrol_t *sw)
+{
+        if (check_audio_gpio(gp) != val) {
+                write_audio_gpio(gp, val);
+                if (do_notify)
+                        snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+                                       &sw->id);
+        }
+}
+
+static void toonie_detect_handler(void *self)
+{
+        pmac_t *chip = (pmac_t*) self;
+        struct pmac_toonie *mix;
+        int headphone;
+
+        if (!chip)
+                return;
+
+        mix = chip->mixer_data;
+        snd_assert(mix, return);
+
+        headphone = toonie_detect_headphone(chip);
+
+        DBG("headphone: %d, lineout: %d\n", headphone, lineout);
+
+        if (headphone) {
+                /* unmute headphone/lineout & mute speaker */
+                toonie_check_mute(chip, &mix->hp_mute_gpio, 0,
+                                  mix->auto_mute_notify, chip->master_sw_ctl);
+                toonie_check_mute(chip, &mix->amp_mute_gpio, 1,
+                                  mix->auto_mute_notify, chip->speaker_sw_ctl);
+        } else {
+                /* unmute speaker, mute others */
+                toonie_check_mute(chip, &mix->amp_mute_gpio, 0,
+                                  mix->auto_mute_notify, chip->speaker_sw_ctl);
+                toonie_check_mute(chip, &mix->hp_mute_gpio, 1,
+                                  mix->auto_mute_notify, chip->master_sw_ctl);
+        }
+        if (mix->auto_mute_notify) {
+                snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+                                       &chip->hp_detect_ctl->id);
+        }
+}
+
+static void toonie_update_automute(pmac_t *chip, int do_notify)
+{
+        if (chip->auto_mute) {
+                struct pmac_toonie *mix;
+                mix = chip->mixer_data;
+                snd_assert(mix, return);
+                mix->auto_mute_notify = do_notify;
+                schedule_work(&mix->detect_work);
+        }
+}
+
+/* interrupt - headphone plug changed */
+static irqreturn_t toonie_hp_intr(int irq, void *devid, struct pt_regs *regs)
+{
+        pmac_t *chip = devid;
+
+        if (chip->update_automute && chip->initialized) {
+                chip->update_automute(chip, 1);
+                return IRQ_HANDLED;
+        }
+        return IRQ_NONE;
+}
+
+/* look for audio gpio device */
+static int find_audio_gpio(const char *name, const char *platform,
+                           struct pmac_gpio *gp)
+{
+        struct device_node *np;
+        u32 *base, addr;
+
+        if (! (np = find_devices("gpio")))
+                return -ENODEV;
+
+        for (np = np->child; np; np = np->sibling) {
+                char *property = get_property(np, "audio-gpio", NULL);
+                if (property && strcmp(property, name) == 0)
+                        break;
+                if (device_is_compatible(np, name))
+                        break;
+        }
+        if (np == NULL)
+                return -ENODEV;
+
+        base = (u32 *)get_property(np, "AAPL,address", NULL);
+        if (! base) {
+                base = (u32 *)get_property(np, "reg", NULL);
+                if (!base) {
+                        DBG("(E) cannot find address for device %s !\n", name);
+                        return -ENODEV;
+                }
+                addr = *base;
+                if (addr < 0x50)
+                        addr += 0x50;
+        } else
+                addr = *base;
+
+        gp->addr = addr & 0x0000ffff;
+
+        /* Try to find the active state, default to 0 ! */
+        base = (u32 *)get_property(np, "audio-gpio-active-state", NULL);
+        if (base) {
+                gp->active_state = *base;
+                gp->active_val = (*base) ? 0x5 : 0x4;
+                gp->inactive_val = (*base) ? 0x4 : 0x5;
+        } else {
+                u32 *prop = NULL;
+                gp->active_state = 0;
+                gp->active_val = 0x4;
+                gp->inactive_val = 0x5;
+                /* Here are some crude hacks to extract the GPIO polarity and
+                 * open collector informations out of the do-platform script
+                 * as we don't yet have an interpreter for these things
+                 */
+                if (platform)
+                        prop = (u32 *)get_property(np, platform, NULL);
+                if (prop) {
+                        if (prop[3] == 0x9 && prop[4] == 0x9) {
+                                gp->active_val = 0xd;
+                                gp->inactive_val = 0xc;
+                        }
+                        if (prop[3] == 0x1 && prop[4] == 0x1) {
+                                gp->active_val = 0x5;
+                                gp->inactive_val = 0x4;
+                        }
+                }
+        }
+
+        DBG("(I) GPIO device %s found, offset: %x, active state: %d !\n",
+            name, gp->addr, gp->active_state);
+
+        return (np->n_intrs > 0) ? np->intrs[0].line : 0;
+}
+
+static void toonie_cleanup(pmac_t *chip)
+{
+        struct pmac_toonie *mix = chip->mixer_data;
+        if (! mix)
+                return;
+        if (mix->hp_detect_irq >= 0)
+                free_irq(mix->hp_detect_irq, chip);
+        kfree(mix);
+        chip->mixer_data = NULL;
+}
+
+int snd_pmac_toonie_init(pmac_t *chip)
+{
+        struct pmac_toonie *mix;
+
+        mix = kmalloc(sizeof(*mix), GFP_KERNEL);
+        if (! mix)
+                return -ENOMEM;
+
+        chip->mixer_data = mix;
+        chip->mixer_free = toonie_cleanup;
+
+        find_audio_gpio("headphone-mute", NULL, &mix->hp_mute_gpio);
+        find_audio_gpio("amp-mute", NULL, &mix->amp_mute_gpio);
+        mix->hp_detect_irq = find_audio_gpio("headphone-detect",
+                                             NULL, &mix->hp_detect_gpio);
+
+        strcpy(chip->card->mixername, "PowerMac Toonie");
+
+        chip->master_sw_ctl = snd_ctl_new1(&toonie_hp_sw, chip);
+        snd_ctl_add(chip->card, chip->master_sw_ctl);
+
+        chip->speaker_sw_ctl = snd_ctl_new1(&toonie_speaker_sw, chip);
+        snd_ctl_add(chip->card, chip->speaker_sw_ctl);
+
+        INIT_WORK(&mix->detect_work, toonie_detect_handler, (void *)chip);
+
+        if (mix->hp_detect_irq >= 0) {
+                snd_pmac_add_automute(chip);
+
+                chip->detect_headphone = toonie_detect_headphone;
+                chip->update_automute = toonie_update_automute;
+                toonie_update_automute(chip, 0);
+
+                if (request_irq(mix->hp_detect_irq, toonie_hp_intr, 0,
+                                "Sound Headphone Detection", chip) < 0)
+                        mix->hp_detect_irq = -1;
+        }
+
+        return 0;
+}
+
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index c71807e069ee..9332237cb6a4 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -99,6 +99,7 @@ typedef struct pmac_tumbler_t {
         pmac_gpio_t hp_detect;
         int headphone_irq;
         int lineout_irq;
+        unsigned int save_master_vol[2];
         unsigned int master_vol[2];
         unsigned int save_master_switch[2];
         unsigned int master_switch[2];
@@ -177,11 +178,22 @@ static void write_audio_gpio(pmac_gpio_t *gp, int active)
         if (! gp->addr)
                 return;
         active = active ? gp->active_val : gp->inactive_val;
-
         do_gpio_write(gp, active);
         DBG("(I) gpio %x write %d\n", gp->addr, active);
 }
 
+static int check_audio_gpio(pmac_gpio_t *gp)
+{
+        int ret;
+
+        if (! gp->addr)
+                return 0;
+
+        ret = do_gpio_read(gp);
+
+        return (ret & 0xd) == (gp->active_val & 0xd);
+}
+
 static int read_audio_gpio(pmac_gpio_t *gp)
 {
         int ret;
@@ -683,7 +695,7 @@ static int tumbler_get_mute_switch(snd_kcontrol_t *kcontrol, snd_ctl_elem_value_
         }
         if (gp == NULL)
                 return -EINVAL;
-        ucontrol->value.integer.value[0] = ! read_audio_gpio(gp);
+        ucontrol->value.integer.value[0] = !check_audio_gpio(gp);
         return 0;
 }
 
@@ -711,7 +723,7 @@ static int tumbler_put_mute_switch(snd_kcontrol_t *kcontrol, snd_ctl_elem_value_
         }
         if (gp == NULL)
                 return -EINVAL;
-        val = ! read_audio_gpio(gp);
+        val = ! check_audio_gpio(gp);
         if (val != ucontrol->value.integer.value[0]) {
                 write_audio_gpio(gp, ! ucontrol->value.integer.value[0]);
                 return 1;
@@ -897,11 +909,11 @@ static int tumbler_detect_lineout(pmac_t *chip)
 
 static void check_mute(pmac_t *chip, pmac_gpio_t *gp, int val, int do_notify, snd_kcontrol_t *sw)
 {
-        //pmac_tumbler_t *mix = chip->mixer_data;
-        if (val != read_audio_gpio(gp)) {
+        if (check_audio_gpio(gp) != val) {
                 write_audio_gpio(gp, val);
                 if (do_notify)
-                        snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE, &sw->id);
+                        snd_ctl_notify(chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+                                       &sw->id);
         }
 }
 
@@ -1128,6 +1140,8 @@ static void tumbler_suspend(pmac_t *chip)
                 disable_irq(mix->lineout_irq);
         mix->save_master_switch[0] = mix->master_switch[0];
         mix->save_master_switch[1] = mix->master_switch[1];
+        mix->save_master_vol[0] = mix->master_vol[0];
+        mix->save_master_vol[1] = mix->master_vol[1];
         mix->master_switch[0] = mix->master_switch[1] = 0;
         tumbler_set_master_volume(mix);
         if (!mix->anded_reset) {
@@ -1155,6 +1169,8 @@ static void tumbler_resume(pmac_t *chip)
         mix->acs &= ~1;
         mix->master_switch[0] = mix->save_master_switch[0];
         mix->master_switch[1] = mix->save_master_switch[1];
+        mix->master_vol[0] = mix->save_master_vol[0];
+        mix->master_vol[1] = mix->save_master_vol[1];
         tumbler_reset_audio(chip);
         if (mix->i2c.client && mix->i2c.init_client) {
                 if (mix->i2c.init_client(&mix->i2c) < 0)