Merge branch 'upstream-fixes'

71 files changed, 993 insertions, 396 deletions

diff --git a/include/asm-alpha/compiler.h b/include/asm-alpha/compiler.h
index 399c33b7be51..0a4a8b40dfcd 100644
--- a/include/asm-alpha/compiler.h
+++ b/include/asm-alpha/compiler.h
@@ -98,6 +98,9 @@
 #undef inline
 #undef __inline__
 #undef __inline
-
+#if __GNUC__ == 3 && __GNUC_MINOR__ >= 1 || __GNUC__ > 3
+#undef __always_inline
+#define __always_inline         inline __attribute__((always_inline))
+#endif
 
 #endif /* __ALPHA_COMPILER_H */
diff --git a/include/asm-arm/arch-rpc/hardware.h b/include/asm-arm/arch-rpc/hardware.h
index be9754a05c19..9d7f87375aa7 100644
--- a/include/asm-arm/arch-rpc/hardware.h
+++ b/include/asm-arm/arch-rpc/hardware.h
@@ -15,7 +15,7 @@
 #include <asm/arch/memory.h>
 
 #ifndef __ASSEMBLY__
-#define IOMEM(x) ((void __iomem *)(x))
+#define IOMEM(x) ((void __iomem *)(unsigned long)(x))
 #else
 #define IOMEM(x) x
 #endif /* __ASSEMBLY__ */
@@ -52,7 +52,7 @@
 /*
  * IO Addresses
  */
-#define VIDC_BASE               (void __iomem *)0xe0400000
+#define VIDC_BASE               IOMEM(0xe0400000)
 #define EXPMASK_BASE            0xe0360000
 #define IOMD_BASE               IOMEM(0xe0200000)
 #define IOC_BASE                IOMEM(0xe0200000)
diff --git a/include/asm-arm/arch-s3c2410/anubis-map.h b/include/asm-arm/arch-s3c2410/anubis-map.h
index 97741d6e506a..d529ffda8599 100644
--- a/include/asm-arm/arch-s3c2410/anubis-map.h
+++ b/include/asm-arm/arch-s3c2410/anubis-map.h
@@ -20,22 +20,22 @@
 
 /* start peripherals off after the S3C2410 */
 
-#define ANUBIS_IOADDR(x)        (S3C2410_ADDR((x) + 0x02000000))
+#define ANUBIS_IOADDR(x)        (S3C2410_ADDR((x) + 0x01800000))
 
 #define ANUBIS_PA_CPLD          (S3C2410_CS1 | (1<<26))
 
 /* we put the CPLD registers next, to get them out of the way */
 
-#define ANUBIS_VA_CTRL1     ANUBIS_IOADDR(0x00000000)    /* 0x01300000 */
+#define ANUBIS_VA_CTRL1     ANUBIS_IOADDR(0x00000000)    /* 0x01800000 */
 #define ANUBIS_PA_CTRL1     (ANUBIS_PA_CPLD)
 
-#define ANUBIS_VA_CTRL2     ANUBIS_IOADDR(0x00100000)    /* 0x01400000 */
+#define ANUBIS_VA_CTRL2     ANUBIS_IOADDR(0x00100000)    /* 0x01900000 */
 #define ANUBIS_PA_CTRL2     (ANUBIS_PA_CPLD)
 
-#define ANUBIS_VA_CTRL3     ANUBIS_IOADDR(0x00200000)    /* 0x01500000 */
+#define ANUBIS_VA_CTRL3     ANUBIS_IOADDR(0x00200000)    /* 0x01A00000 */
 #define ANUBIS_PA_CTRL3     (ANUBIS_PA_CPLD)
 
-#define ANUBIS_VA_CTRL4     ANUBIS_IOADDR(0x00300000)    /* 0x01600000 */
+#define ANUBIS_VA_CTRL4     ANUBIS_IOADDR(0x00300000)    /* 0x01B00000 */
 #define ANUBIS_PA_CTRL4     (ANUBIS_PA_CPLD)
 
 #define ANUBIS_IDEPRI       ANUBIS_IOADDR(0x01000000)
diff --git a/include/asm-arm/arch-versatile/io.h b/include/asm-arm/arch-versatile/io.h
index 9f895bf61494..47e904cf25c7 100644
--- a/include/asm-arm/arch-versatile/io.h
+++ b/include/asm-arm/arch-versatile/io.h
@@ -22,7 +22,11 @@
 
 #define IO_SPACE_LIMIT 0xffffffff
 
-#define __io(a)                 ((void __iomem *)(a))
+static inline void __iomem *__io(unsigned long addr)
+{
+        return (void __iomem *)addr;
+}
+#define __io(a) __io(a)
 #define __mem_pci(a)            (a)
 #define __mem_isa(a)            (a)
 
diff --git a/include/asm-arm/elf.h b/include/asm-arm/elf.h
index a1696ba238d3..7da97a937548 100644
--- a/include/asm-arm/elf.h
+++ b/include/asm-arm/elf.h
@@ -124,6 +124,8 @@ do { \
         if (((ex).e_flags & EF_ARM_EABI_MASK) || \
             ((ex).e_flags & EF_ARM_SOFT_FLOAT)) \
                 set_thread_flag(TIF_USING_IWMMXT); \
+        else \
+                clear_thread_flag(TIF_USING_IWMMXT); \
 } while (0)
 
 #endif
diff --git a/include/asm-arm/io.h b/include/asm-arm/io.h
index cfa71a0dffb6..5c4ae8f5dbb0 100644
--- a/include/asm-arm/io.h
+++ b/include/asm-arm/io.h
@@ -136,9 +136,9 @@ extern void __readwrite_bug(const char *fn);
 /*
  * String version of IO memory access ops:
  */
-extern void _memcpy_fromio(void *, void __iomem *, size_t);
-extern void _memcpy_toio(void __iomem *, const void *, size_t);
-extern void _memset_io(void __iomem *, int, size_t);
+extern void _memcpy_fromio(void *, const volatile void __iomem *, size_t);
+extern void _memcpy_toio(volatile void __iomem *, const void *, size_t);
+extern void _memset_io(volatile void __iomem *, int, size_t);
 
 #define mmiowb()
 
diff --git a/include/asm-arm/signal.h b/include/asm-arm/signal.h
index 760f6e65af05..ced69161917b 100644
--- a/include/asm-arm/signal.h
+++ b/include/asm-arm/signal.h
@@ -115,7 +115,6 @@ typedef unsigned long sigset_t;
 
 #ifdef __KERNEL__
 #define SA_TIMER                0x40000000
-#define SA_IRQNOMASK            0x08000000
 #endif
 
 #include <asm-generic/signal.h>
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index f86c1e549466..ff28c8b31f58 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -158,6 +158,19 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #define lazy_mmu_prot_update(pte)       do { } while (0)
 #endif
 
+#ifndef __HAVE_ARCH_MULTIPLE_ZERO_PAGE
+#define move_pte(pte, prot, old_addr, new_addr) (pte)
+#else
+#define move_pte(pte, prot, old_addr, new_addr)                         \
+({                                                                      \
+        pte_t newpte = (pte);                                           \
+        if (pte_present(pte) && pfn_valid(pte_pfn(pte)) &&              \
+                        pte_page(pte) == ZERO_PAGE(old_addr))           \
+                newpte = mk_pte(ZERO_PAGE(new_addr), (prot));           \
+        newpte;                                                         \
+})
+#endif
+
 /*
  * When walking page tables, get the address of the next boundary,
  * or the end address of the range if that comes earlier.  Although no
diff --git a/include/asm-i386/hw_irq.h b/include/asm-i386/hw_irq.h
index 4ac84cc6f01a..622815bf3243 100644
--- a/include/asm-i386/hw_irq.h
+++ b/include/asm-i386/hw_irq.h
@@ -18,6 +18,8 @@
 #include <asm/irq.h>
 #include <asm/sections.h>
 
+struct hw_interrupt_type;
+
 /*
  * Various low-level irq details needed by irq.c, process.c,
  * time.c, io_apic.c and smp.c
diff --git a/include/asm-ia64/mca.h b/include/asm-ia64/mca.h
index 97a28b8b2ddd..c7d9c9ed38ba 100644
--- a/include/asm-ia64/mca.h
+++ b/include/asm-ia64/mca.h
@@ -80,7 +80,12 @@ struct ia64_sal_os_state {
         u64                     sal_ra;                 /* Return address in SAL, physical */
         u64                     sal_gp;                 /* GP of the SAL - physical */
         pal_min_state_area_t    *pal_min_state;         /* from R17.  physical in asm, virtual in C */
+        /* Previous values of IA64_KR(CURRENT) and IA64_KR(CURRENT_STACK).
+         * Note: if the MCA/INIT recovery code wants to resume to a new context
+         * then it must change these values to reflect the new kernel stack.
+         */
         u64                     prev_IA64_KR_CURRENT;   /* previous value of IA64_KR(CURRENT) */
+        u64                     prev_IA64_KR_CURRENT_STACK;
         struct task_struct      *prev_task;             /* previous task, NULL if it is not useful */
         /* Some interrupt registers are not saved in minstate, pt_regs or
          * switch_stack.  Because MCA/INIT can occur when interrupts are
diff --git a/include/asm-ia64/uaccess.h b/include/asm-ia64/uaccess.h
index 3a7829bb5954..9adb51211c22 100644
--- a/include/asm-ia64/uaccess.h
+++ b/include/asm-ia64/uaccess.h
@@ -187,8 +187,8 @@ extern void __get_user_unknown (void);
 ({                                                                                      \
         const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);                              \
         __typeof__ (size) __gu_size = (size);                                           \
-        long __gu_err = -EFAULT, __gu_val = 0;                                          \
-                                                                                        \
+        long __gu_err = -EFAULT;                                                        \
+        unsigned long __gu_val = 0;                                                     \
         if (!check || __access_ok(__gu_ptr, size, segment))                             \
                 switch (__gu_size) {                                                    \
                       case 1: __get_user_size(__gu_val, __gu_ptr, 1, __gu_err); break;  \
@@ -240,13 +240,13 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
 static inline unsigned long
 __copy_to_user (void __user *to, const void *from, unsigned long count)
 {
-        return __copy_user(to, (void __user *) from, count);
+        return __copy_user(to, (__force void __user *) from, count);
 }
 
 static inline unsigned long
 __copy_from_user (void *to, const void __user *from, unsigned long count)
 {
-        return __copy_user((void __user *) to, from, count);
+        return __copy_user((__force void __user *) to, from, count);
 }
 
 #define __copy_to_user_inatomic         __copy_to_user
@@ -258,7 +258,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
         long __cu_len = (n);                                                            \
                                                                                         \
         if (__access_ok(__cu_to, __cu_len, get_fs()))                                   \
-                __cu_len = __copy_user(__cu_to, (void __user *) __cu_from, __cu_len);   \
+                __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);   \
         __cu_len;                                                                       \
 })
 
@@ -270,7 +270,7 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
                                                                                         \
         __chk_user_ptr(__cu_from);                                                      \
         if (__access_ok(__cu_from, __cu_len, get_fs()))                                 \
-                __cu_len = __copy_user((void __user *) __cu_to, __cu_from, __cu_len);   \
+                __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
         __cu_len;                                                                       \
 })
 
diff --git a/include/asm-m32r/io.h b/include/asm-m32r/io.h
index 8e9e481e6996..70ad1c949c2b 100644
--- a/include/asm-m32r/io.h
+++ b/include/asm-m32r/io.h
@@ -60,7 +60,7 @@ __ioremap(unsigned long offset, unsigned long size, unsigned long flags);
  *      address.
  */
 
-static inline void * ioremap(unsigned long offset, unsigned long size)
+static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
 {
         return __ioremap(offset, size, 0);
 }
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index 93d863c455a1..0da7c47d2f01 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -208,7 +208,8 @@ extern void __get_user_4(void);
  * On error, the variable @x is set to zero.
  */
 #define get_user(x,ptr)                                                 \
-({      int __ret_gu,__val_gu;                                          \
+({      int __ret_gu;                                                   \
+        unsigned long __val_gu;                                         \
         __chk_user_ptr(ptr);                                            \
         switch(sizeof (*(ptr))) {                                       \
         case 1:  __get_user_x(1,__ret_gu,__val_gu,ptr); break;          \
@@ -403,7 +404,8 @@ struct __large_struct { unsigned long buf[100]; };
 
 #define __get_user_nocheck(x,ptr,size)                                  \
 ({                                                                      \
-        long __gu_err, __gu_val;                                        \
+        long __gu_err;                                                  \
+        unsigned long __gu_val;                                         \
         __get_user_size(__gu_val,(ptr),(size),__gu_err);                \
         (x) = (__typeof__(*(ptr)))__gu_val;                             \
         __gu_err;                                                       \
@@ -594,8 +596,8 @@ static inline unsigned long __generic_copy_to_user_nocheck(void __user *to,
         return n;
 }
 
-unsigned long __generic_copy_to_user(void *, const void *, unsigned long);
-unsigned long __generic_copy_from_user(void *, const void *, unsigned long);
+unsigned long __generic_copy_to_user(void __user *, const void *, unsigned long);
+unsigned long __generic_copy_from_user(void *, const void __user *, unsigned long);
 
 /**
  * __copy_to_user: - Copy a block of data into user space, with less checking.
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index cbd1672c94cb..eaf5d9b3a0e1 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -68,6 +68,8 @@ extern unsigned long zero_page_mask;
 #define ZERO_PAGE(vaddr) \
         (virt_to_page(empty_zero_page + (((unsigned long)(vaddr)) & zero_page_mask)))
 
+#define __HAVE_ARCH_MULTIPLE_ZERO_PAGE
+
 extern void paging_init(void);
 
 /*
diff --git a/include/asm-ppc/io.h b/include/asm-ppc/io.h
index 7eb7cf6360bd..94d83998a759 100644
--- a/include/asm-ppc/io.h
+++ b/include/asm-ppc/io.h
@@ -56,7 +56,7 @@ extern unsigned long pci_dram_offset;
  * is actually performed (i.e. the data has come back) before we start
  * executing any following instructions.
  */
-extern inline int in_8(volatile unsigned char __iomem *addr)
+extern inline int in_8(const volatile unsigned char __iomem *addr)
 {
         int ret;
 
@@ -72,7 +72,7 @@ extern inline void out_8(volatile unsigned char __iomem *addr, int val)
         __asm__ __volatile__("stb%U0%X0 %1,%0; eieio" : "=m" (*addr) : "r" (val));
 }
 
-extern inline int in_le16(volatile unsigned short __iomem *addr)
+extern inline int in_le16(const volatile unsigned short __iomem *addr)
 {
         int ret;
 
@@ -83,7 +83,7 @@ extern inline int in_le16(volatile unsigned short __iomem *addr)
         return ret;
 }
 
-extern inline int in_be16(volatile unsigned short __iomem *addr)
+extern inline int in_be16(const volatile unsigned short __iomem *addr)
 {
         int ret;
 
@@ -104,7 +104,7 @@ extern inline void out_be16(volatile unsigned short __iomem *addr, int val)
         __asm__ __volatile__("sth%U0%X0 %1,%0; eieio" : "=m" (*addr) : "r" (val));
 }
 
-extern inline unsigned in_le32(volatile unsigned __iomem *addr)
+extern inline unsigned in_le32(const volatile unsigned __iomem *addr)
 {
         unsigned ret;
 
@@ -115,7 +115,7 @@ extern inline unsigned in_le32(volatile unsigned __iomem *addr)
         return ret;
 }
 
-extern inline unsigned in_be32(volatile unsigned __iomem *addr)
+extern inline unsigned in_be32(const volatile unsigned __iomem *addr)
 {
         unsigned ret;
 
@@ -139,7 +139,7 @@ extern inline void out_be32(volatile unsigned __iomem *addr, int val)
 #define readb(addr) in_8((volatile u8 *)(addr))
 #define writeb(b,addr) out_8((volatile u8 *)(addr), (b))
 #else
-static inline __u8 readb(volatile void __iomem *addr)
+static inline __u8 readb(const volatile void __iomem *addr)
 {
         return in_8(addr);
 }
@@ -150,11 +150,11 @@ static inline void writeb(__u8 b, volatile void __iomem *addr)
 #endif
 
 #if defined(CONFIG_APUS)
-static inline __u16 readw(volatile void __iomem *addr)
+static inline __u16 readw(const volatile void __iomem *addr)
 {
         return *(__force volatile __u16 *)(addr);
 }
-static inline __u32 readl(volatile void __iomem *addr)
+static inline __u32 readl(const volatile void __iomem *addr)
 {
         return *(__force volatile __u32 *)(addr);
 }
@@ -173,11 +173,11 @@ static inline void writel(__u32 b, volatile void __iomem *addr)
 #define writew(b,addr) out_le16((volatile u16 *)(addr),(b))
 #define writel(b,addr) out_le32((volatile u32 *)(addr),(b))
 #else
-static inline __u16 readw(volatile void __iomem *addr)
+static inline __u16 readw(const volatile void __iomem *addr)
 {
         return in_le16(addr);
 }
-static inline __u32 readl(volatile void __iomem *addr)
+static inline __u32 readl(const volatile void __iomem *addr)
 {
         return in_le32(addr);
 }
diff --git a/include/asm-ppc/macio.h b/include/asm-ppc/macio.h
index a481b772d154..b553dd4b139e 100644
--- a/include/asm-ppc/macio.h
+++ b/include/asm-ppc/macio.h
@@ -1,7 +1,6 @@
 #ifndef __MACIO_ASIC_H__
 #define __MACIO_ASIC_H__
 
-#include <linux/mod_devicetable.h>
 #include <asm/of_device.h>
 
 extern struct bus_type macio_bus_type;
diff --git a/include/asm-ppc/mv64x60.h b/include/asm-ppc/mv64x60.h
index 75c2ffa26b26..ee2f9188cc64 100644
--- a/include/asm-ppc/mv64x60.h
+++ b/include/asm-ppc/mv64x60.h
@@ -233,7 +233,7 @@ struct mv64x60_chip_info {
 struct mv64x60_handle {
         u32             type;           /* type of bridge */
         u32             rev;            /* revision of bridge */
-        void            *v_base;        /* virtual base addr of bridge regs */
+        void            __iomem *v_base;/* virtual base addr of bridge regs */
         phys_addr_t     p_base;         /* physical base addr of bridge regs */
 
         u32             pci_mode_a;     /* pci 0 mode: conventional pci, pci-x*/
@@ -303,7 +303,7 @@ void mv64x60_alloc_hose(struct mv64x60_handle *bh, u32 cfg_addr,
         u32 cfg_data, struct pci_controller **hose);
 int mv64x60_get_type(struct mv64x60_handle *bh);
 int mv64x60_setup_for_chip(struct mv64x60_handle *bh);
-void *mv64x60_get_bridge_vbase(void);
+void __iomem *mv64x60_get_bridge_vbase(void);
 u32 mv64x60_get_bridge_type(void);
 u32 mv64x60_get_bridge_rev(void);
 void mv64x60_get_mem_windows(struct mv64x60_handle *bh,
diff --git a/include/asm-ppc/of_device.h b/include/asm-ppc/of_device.h
index 4b264cfd3998..575bce418f80 100644
--- a/include/asm-ppc/of_device.h
+++ b/include/asm-ppc/of_device.h
@@ -2,6 +2,7 @@
 #define __OF_DEVICE_H__
 
 #include <linux/device.h>
+#include <linux/mod_devicetable.h>
 #include <asm/prom.h>
 
 /*
@@ -55,7 +56,9 @@ extern int of_register_driver(struct of_platform_driver *drv);
 extern void of_unregister_driver(struct of_platform_driver *drv);
 extern int of_device_register(struct of_device *ofdev);
 extern void of_device_unregister(struct of_device *ofdev);
-extern struct of_device *of_platform_device_create(struct device_node *np, const char *bus_id);
+extern struct of_device *of_platform_device_create(struct device_node *np,
+                                                   const char *bus_id,
+                                                   struct device *parent);
 extern void of_release_dev(struct device *dev);
 
 #endif /* __OF_DEVICE_H__ */
diff --git a/include/asm-ppc64/smu.h b/include/asm-ppc64/smu.h
index 10b4397af9aa..dee8eefe47bc 100644
--- a/include/asm-ppc64/smu.h
+++ b/include/asm-ppc64/smu.h
@@ -1,22 +1,379 @@
+#ifndef _SMU_H
+#define _SMU_H
+
 /*
  * Definitions for talking to the SMU chip in newer G5 PowerMacs
  */
 
 #include <linux/config.h>
+#include <linux/list.h>
+
+/*
+ * Known SMU commands
+ *
+ * Most of what is below comes from looking at the Open Firmware driver,
+ * though this is still incomplete and could use better documentation here
+ * or there...
+ */
+
+
+/*
+ * Partition info commands
+ *
+ * I do not know what those are for at this point
+ */
+#define SMU_CMD_PARTITION_COMMAND               0x3e
+
+
+/*
+ * Fan control
+ *
+ * This is a "mux" for fan control commands, first byte is the
+ * "sub" command.
+ */
+#define SMU_CMD_FAN_COMMAND                     0x4a
+
+
+/*
+ * Battery access
+ *
+ * Same command number as the PMU, could it be same syntax ?
+ */
+#define SMU_CMD_BATTERY_COMMAND                 0x6f
+#define   SMU_CMD_GET_BATTERY_INFO              0x00
+
+/*
+ * Real time clock control
+ *
+ * This is a "mux", first data byte contains the "sub" command.
+ * The "RTC" part of the SMU controls the date, time, powerup
+ * timer, but also a PRAM
+ *
+ * Dates are in BCD format on 7 bytes:
+ * [sec] [min] [hour] [weekday] [month day] [month] [year]
+ * with month being 1 based and year minus 100
+ */
+#define SMU_CMD_RTC_COMMAND                     0x8e
+#define   SMU_CMD_RTC_SET_PWRUP_TIMER           0x00 /* i: 7 bytes date */
+#define   SMU_CMD_RTC_GET_PWRUP_TIMER           0x01 /* o: 7 bytes date */
+#define   SMU_CMD_RTC_STOP_PWRUP_TIMER          0x02
+#define   SMU_CMD_RTC_SET_PRAM_BYTE_ACC         0x20 /* i: 1 byte (address?) */
+#define   SMU_CMD_RTC_SET_PRAM_AUTOINC          0x21 /* i: 1 byte (data?) */
+#define   SMU_CMD_RTC_SET_PRAM_LO_BYTES         0x22 /* i: 10 bytes */
+#define   SMU_CMD_RTC_SET_PRAM_HI_BYTES         0x23 /* i: 10 bytes */
+#define   SMU_CMD_RTC_GET_PRAM_BYTE             0x28 /* i: 1 bytes (address?) */
+#define   SMU_CMD_RTC_GET_PRAM_LO_BYTES         0x29 /* o: 10 bytes */
+#define   SMU_CMD_RTC_GET_PRAM_HI_BYTES         0x2a /* o: 10 bytes */
+#define   SMU_CMD_RTC_SET_DATETIME              0x80 /* i: 7 bytes date */
+#define   SMU_CMD_RTC_GET_DATETIME              0x81 /* o: 7 bytes date */
+
+ /*
+  * i2c commands
+  *
+  * To issue an i2c command, first is to send a parameter block to the
+  * the SMU. This is a command of type 0x9a with 9 bytes of header
+  * eventually followed by data for a write:
+  *
+  * 0: bus number (from device-tree usually, SMU has lots of busses !)
+  * 1: transfer type/format (see below)
+  * 2: device address. For combined and combined4 type transfers, this
+  *    is the "write" version of the address (bit 0x01 cleared)
+  * 3: subaddress length (0..3)
+  * 4: subaddress byte 0 (or only byte for subaddress length 1)
+  * 5: subaddress byte 1
+  * 6: subaddress byte 2
+  * 7: combined address (device address for combined mode data phase)
+  * 8: data length
+  *
+  * The transfer types are the same good old Apple ones it seems,
+  * that is:
+  *   - 0x00: Simple transfer
+  *   - 0x01: Subaddress transfer (addr write + data tx, no restart)
+  *   - 0x02: Combined transfer (addr write + restart + data tx)
+  *
+  * This is then followed by actual data for a write.
+  *
+  * At this point, the OF driver seems to have a limitation on transfer
+  * sizes of 0xd bytes on reads and 0x5 bytes on writes. I do not know
+  * wether this is just an OF limit due to some temporary buffer size
+  * or if this is an SMU imposed limit. This driver has the same limitation
+  * for now as I use a 0x10 bytes temporary buffer as well
+  *
+  * Once that is completed, a response is expected from the SMU. This is
+  * obtained via a command of type 0x9a with a length of 1 byte containing
+  * 0 as the data byte. OF also fills the rest of the data buffer with 0xff's
+  * though I can't tell yet if this is actually necessary. Once this command
+  * is complete, at this point, all I can tell is what OF does. OF tests
+  * byte 0 of the reply:
+  *   - on read, 0xfe or 0xfc : bus is busy, wait (see below) or nak ?
+  *   - on read, 0x00 or 0x01 : reply is in buffer (after the byte 0)
+  *   - on write, < 0 -> failure (immediate exit)
+  *   - else, OF just exists (without error, weird)
+  *
+  * So on read, there is this wait-for-busy thing when getting a 0xfc or
+  * 0xfe result. OF does a loop of up to 64 retries, waiting 20ms and
+  * doing the above again until either the retries expire or the result
+  * is no longer 0xfe or 0xfc
+  *
+  * The Darwin I2C driver is less subtle though. On any non-success status
+  * from the response command, it waits 5ms and tries again up to 20 times,
+  * it doesn't differenciate between fatal errors or "busy" status.
+  *
+  * This driver provides an asynchronous paramblock based i2c command
+  * interface to be used either directly by low level code or by a higher
+  * level driver interfacing to the linux i2c layer. The current
+  * implementation of this relies on working timers & timer interrupts
+  * though, so be careful of calling context for now. This may be "fixed"
+  * in the future by adding a polling facility.
+  */
+#define SMU_CMD_I2C_COMMAND                     0x9a
+          /* transfer types */
+#define   SMU_I2C_TRANSFER_SIMPLE       0x00
+#define   SMU_I2C_TRANSFER_STDSUB       0x01
+#define   SMU_I2C_TRANSFER_COMBINED     0x02
+
+/*
+ * Power supply control
+ *
+ * The "sub" command is an ASCII string in the data, the
+ * data lenght is that of the string.
+ *
+ * The VSLEW command can be used to get or set the voltage slewing.
+ *  - lenght 5 (only "VSLEW") : it returns "DONE" and 3 bytes of
+ *    reply at data offset 6, 7 and 8.
+ *  - lenght 8 ("VSLEWxyz") has 3 additional bytes appended, and is
+ *    used to set the voltage slewing point. The SMU replies with "DONE"
+ * I yet have to figure out their exact meaning of those 3 bytes in
+ * both cases.
+ *
+ */
+#define SMU_CMD_POWER_COMMAND                   0xaa
+#define   SMU_CMD_POWER_RESTART                 "RESTART"
+#define   SMU_CMD_POWER_SHUTDOWN                "SHUTDOWN"
+#define   SMU_CMD_POWER_VOLTAGE_SLEW            "VSLEW"
+
+/* Misc commands
+ *
+ * This command seem to be a grab bag of various things
+ */
+#define SMU_CMD_MISC_df_COMMAND                 0xdf
+#define   SMU_CMD_MISC_df_SET_DISPLAY_LIT       0x02 /* i: 1 byte */
+#define   SMU_CMD_MISC_df_NMI_OPTION            0x04
+
+/*
+ * Version info commands
+ *
+ * I haven't quite tried to figure out how these work
+ */
+#define SMU_CMD_VERSION_COMMAND                 0xea
+
+
+/*
+ * Misc commands
+ *
+ * This command seem to be a grab bag of various things
+ */
+#define SMU_CMD_MISC_ee_COMMAND                 0xee
+#define   SMU_CMD_MISC_ee_GET_DATABLOCK_REC     0x02
+#define   SMU_CMD_MISC_ee_LEDS_CTRL             0x04 /* i: 00 (00,01) [00] */
+#define   SMU_CMD_MISC_ee_GET_DATA              0x05 /* i: 00 , o: ?? */
+
+
+
+/*
+ * - Kernel side interface -
+ */
+
+#ifdef __KERNEL__
+
+/*
+ * Asynchronous SMU commands
+ *
+ * Fill up this structure and submit it via smu_queue_command(),
+ * and get notified by the optional done() callback, or because
+ * status becomes != 1
+ */
+
+struct smu_cmd;
+
+struct smu_cmd
+{
+        /* public */
+        u8                      cmd;            /* command */
+        int                     data_len;       /* data len */
+        int                     reply_len;      /* reply len */
+        void                    *data_buf;      /* data buffer */
+        void                    *reply_buf;     /* reply buffer */
+        int                     status;         /* command status */
+        void                    (*done)(struct smu_cmd *cmd, void *misc);
+        void                    *misc;
+
+        /* private */
+        struct list_head        link;
+};
+
+/*
+ * Queues an SMU command, all fields have to be initialized
+ */
+extern int smu_queue_cmd(struct smu_cmd *cmd);
+
+/*
+ * Simple command wrapper. This structure embeds a small buffer
+ * to ease sending simple SMU commands from the stack
+ */
+struct smu_simple_cmd
+{
+        struct smu_cmd  cmd;
+        u8              buffer[16];
+};
+
+/*
+ * Queues a simple command. All fields will be initialized by that
+ * function
+ */
+extern int smu_queue_simple(struct smu_simple_cmd *scmd, u8 command,
+                            unsigned int data_len,
+                            void (*done)(struct smu_cmd *cmd, void *misc),
+                            void *misc,
+                            ...);
+
+/*
+ * Completion helper. Pass it to smu_queue_simple or as 'done'
+ * member to smu_queue_cmd, it will call complete() on the struct
+ * completion passed in the "misc" argument
+ */
+extern void smu_done_complete(struct smu_cmd *cmd, void *misc);
 
 /*
- * Basic routines for use by architecture. To be extended as
- * we understand more of the chip
+ * Synchronous helpers. Will spin-wait for completion of a command
+ */
+extern void smu_spinwait_cmd(struct smu_cmd *cmd);
+
+static inline void smu_spinwait_simple(struct smu_simple_cmd *scmd)
+{
+        smu_spinwait_cmd(&scmd->cmd);
+}
+
+/*
+ * Poll routine to call if blocked with irqs off
+ */
+extern void smu_poll(void);
+
+
+/*
+ * Init routine, presence check....
  */
 extern int smu_init(void);
 extern int smu_present(void);
+struct of_device;
+extern struct of_device *smu_get_ofdev(void);
+
+
+/*
+ * Common command wrappers
+ */
 extern void smu_shutdown(void);
 extern void smu_restart(void);
-extern int smu_get_rtc_time(struct rtc_time *time);
-extern int smu_set_rtc_time(struct rtc_time *time);
+struct rtc_time;
+extern int smu_get_rtc_time(struct rtc_time *time, int spinwait);
+extern int smu_set_rtc_time(struct rtc_time *time, int spinwait);
 
 /*
  * SMU command buffer absolute address, exported by pmac_setup,
  * this is allocated very early during boot.
  */
 extern unsigned long smu_cmdbuf_abs;
+
+
+/*
+ * Kenrel asynchronous i2c interface
+ */
+
+/* SMU i2c header, exactly matches i2c header on wire */
+struct smu_i2c_param
+{
+        u8      bus;            /* SMU bus ID (from device tree) */
+        u8      type;           /* i2c transfer type */
+        u8      devaddr;        /* device address (includes direction) */
+        u8      sublen;         /* subaddress length */
+        u8      subaddr[3];     /* subaddress */
+        u8      caddr;          /* combined address, filled by SMU driver */
+        u8      datalen;        /* length of transfer */
+        u8      data[7];        /* data */
+};
+
+#define SMU_I2C_READ_MAX        0x0d
+#define SMU_I2C_WRITE_MAX       0x05
+
+struct smu_i2c_cmd
+{
+        /* public */
+        struct smu_i2c_param    info;
+        void                    (*done)(struct smu_i2c_cmd *cmd, void *misc);
+        void                    *misc;
+        int                     status; /* 1 = pending, 0 = ok, <0 = fail */
+
+        /* private */
+        struct smu_cmd          scmd;
+        int                     read;
+        int                     stage;
+        int                     retries;
+        u8                      pdata[0x10];
+        struct list_head        link;
+};
+
+/*
+ * Call this to queue an i2c command to the SMU. You must fill info,
+ * including info.data for a write, done and misc.
+ * For now, no polling interface is provided so you have to use completion
+ * callback.
+ */
+extern int smu_queue_i2c(struct smu_i2c_cmd *cmd);
+
+
+#endif /* __KERNEL__ */
+
+/*
+ * - Userland interface -
+ */
+
+/*
+ * A given instance of the device can be configured for 2 different
+ * things at the moment:
+ *
+ *  - sending SMU commands (default at open() time)
+ *  - receiving SMU events (not yet implemented)
+ *
+ * Commands are written with write() of a command block. They can be
+ * "driver" commands (for example to switch to event reception mode)
+ * or real SMU commands. They are made of a header followed by command
+ * data if any.
+ *
+ * For SMU commands (not for driver commands), you can then read() back
+ * a reply. The reader will be blocked or not depending on how the device
+ * file is opened. poll() isn't implemented yet. The reply will consist
+ * of a header as well, followed by the reply data if any. You should
+ * always provide a buffer large enough for the maximum reply data, I
+ * recommand one page.
+ *
+ * It is illegal to send SMU commands through a file descriptor configured
+ * for events reception
+ *
+ */
+struct smu_user_cmd_hdr
+{
+        __u32           cmdtype;
+#define SMU_CMDTYPE_SMU                 0       /* SMU command */
+#define SMU_CMDTYPE_WANTS_EVENTS        1       /* switch fd to events mode */
+
+        __u8            cmd;                    /* SMU command byte */
+        __u32           data_len;               /* Lenght of data following */
+};
+
+struct smu_user_reply_hdr
+{
+        __u32           status;                 /* Command status */
+        __u32           reply_len;              /* Lenght of data follwing */
+};
+
+#endif /*  _SMU_H */
diff --git a/include/asm-ppc64/tlbflush.h b/include/asm-ppc64/tlbflush.h
index 45411a67e082..74271d7c1d16 100644
--- a/include/asm-ppc64/tlbflush.h
+++ b/include/asm-ppc64/tlbflush.h
@@ -25,6 +25,7 @@ struct ppc64_tlb_batch {
         pte_t pte[PPC64_TLB_BATCH_NR];
         unsigned long addr[PPC64_TLB_BATCH_NR];
         unsigned long vaddr[PPC64_TLB_BATCH_NR];
+        unsigned int large;
 };
 DECLARE_PER_CPU(struct ppc64_tlb_batch, ppc64_tlb_batch);
 
diff --git a/include/asm-ppc64/uaccess.h b/include/asm-ppc64/uaccess.h
index c181a60d868c..132c1276547b 100644
--- a/include/asm-ppc64/uaccess.h
+++ b/include/asm-ppc64/uaccess.h
@@ -164,7 +164,8 @@ do {									\
 
 #define __get_user_nocheck(x,ptr,size)                          \
 ({                                                              \
-        long __gu_err, __gu_val;                                \
+        long __gu_err;                                          \
+        unsigned long __gu_val;                                 \
         might_sleep();                                          \
         __get_user_size(__gu_val,(ptr),(size),__gu_err,-EFAULT);\
         (x) = (__typeof__(*(ptr)))__gu_val;                     \
@@ -173,7 +174,8 @@ do {									\
 
 #define __get_user_check(x,ptr,size)                                    \
 ({                                                                      \
-        long __gu_err = -EFAULT, __gu_val = 0;                          \
+        long __gu_err = -EFAULT;                                        \
+        unsigned long __gu_val = 0;                                     \
         const __typeof__(*(ptr)) __user *__gu_addr = (ptr);             \
         might_sleep();                                                  \
         if (access_ok(VERIFY_READ,__gu_addr,size))                      \
diff --git a/include/asm-s390/sigcontext.h b/include/asm-s390/sigcontext.h
index d57bc0cebdce..803545351dd8 100644
--- a/include/asm-s390/sigcontext.h
+++ b/include/asm-s390/sigcontext.h
@@ -61,7 +61,7 @@ typedef struct
 struct sigcontext
 {
         unsigned long   oldmask[_SIGCONTEXT_NSIG_WORDS];
-        _sigregs        *sregs;
+        _sigregs        __user *sregs;
 };
 
 
diff --git a/include/asm-s390/signal.h b/include/asm-s390/signal.h
index 3d6e11c6c1fd..7084626de215 100644
--- a/include/asm-s390/signal.h
+++ b/include/asm-s390/signal.h
@@ -165,7 +165,7 @@ struct sigaction {
 #endif /* __KERNEL__ */
 
 typedef struct sigaltstack {
-        void *ss_sp;
+        void __user *ss_sp;
         int ss_flags;
         size_t ss_size;
 } stack_t;
diff --git a/include/asm-sparc/pgtable.h b/include/asm-sparc/pgtable.h
index 8f4f6a959651..8395ad2f1c09 100644
--- a/include/asm-sparc/pgtable.h
+++ b/include/asm-sparc/pgtable.h
@@ -82,6 +82,8 @@ extern unsigned long page_kernel;
 /* Top-level page directory */
 extern pgd_t swapper_pg_dir[1024];
 
+extern void paging_init(void);
+
 /* Page table for 0-4MB for everybody, on the Sparc this
  * holds the same as on the i386.
  */
diff --git a/include/asm-sparc64/cacheflush.h b/include/asm-sparc64/cacheflush.h
index ededd2659eab..b3f61659ba81 100644
--- a/include/asm-sparc64/cacheflush.h
+++ b/include/asm-sparc64/cacheflush.h
@@ -66,6 +66,11 @@ extern void flush_ptrace_access(struct vm_area_struct *, struct page *,
 #define flush_cache_vmap(start, end)            do { } while (0)
 #define flush_cache_vunmap(start, end)          do { } while (0)
 
+#ifdef CONFIG_DEBUG_PAGEALLOC
+/* internal debugging function */
+void kernel_map_pages(struct page *page, int numpages, int enable);
+#endif
+
 #endif /* !__ASSEMBLY__ */
 
 #endif /* _SPARC64_CACHEFLUSH_H */
diff --git a/include/asm-sparc64/cpudata.h b/include/asm-sparc64/cpudata.h
index 9a3a81f1cc58..74de79dca915 100644
--- a/include/asm-sparc64/cpudata.h
+++ b/include/asm-sparc64/cpudata.h
@@ -22,6 +22,16 @@ typedef struct {
         unsigned int    __pad1;
         unsigned long   *pte_cache[2];
         unsigned long   *pgd_cache;
+
+        /* Dcache line 3, rarely used */
+        unsigned int    dcache_size;
+        unsigned int    dcache_line_size;
+        unsigned int    icache_size;
+        unsigned int    icache_line_size;
+        unsigned int    ecache_size;
+        unsigned int    ecache_line_size;
+        unsigned int    __pad2;
+        unsigned int    __pad3;
 } cpuinfo_sparc;
 
 DECLARE_PER_CPU(cpuinfo_sparc, __cpu_data);
diff --git a/include/asm-sparc64/head.h b/include/asm-sparc64/head.h
index b63a33cf4971..0abd3a674e8f 100644
--- a/include/asm-sparc64/head.h
+++ b/include/asm-sparc64/head.h
@@ -12,9 +12,12 @@
 #define __JALAPENO_ID   0x003e0016
 
 #define CHEETAH_MANUF           0x003e
-#define CHEETAH_IMPL            0x0014
-#define CHEETAH_PLUS_IMPL       0x0015
-#define JALAPENO_IMPL           0x0016
+#define CHEETAH_IMPL            0x0014 /* Ultra-III   */
+#define CHEETAH_PLUS_IMPL       0x0015 /* Ultra-III+  */
+#define JALAPENO_IMPL           0x0016 /* Ultra-IIIi  */
+#define JAGUAR_IMPL             0x0018 /* Ultra-IV    */
+#define PANTHER_IMPL            0x0019 /* Ultra-IV+   */
+#define SERRANO_IMPL            0x0022 /* Ultra-IIIi+ */
 
 #define BRANCH_IF_CHEETAH_BASE(tmp1,tmp2,label) \
         rdpr    %ver, %tmp1;                    \
diff --git a/include/asm-sparc64/openprom.h b/include/asm-sparc64/openprom.h
index 0a336901d585..b4959d2b0d99 100644
--- a/include/asm-sparc64/openprom.h
+++ b/include/asm-sparc64/openprom.h
@@ -186,8 +186,8 @@ struct linux_prom_registers {
 };
 
 struct linux_prom64_registers {
-        long phys_addr;
-        long reg_size;
+        unsigned long phys_addr;
+        unsigned long reg_size;
 };
 
 struct linux_prom_irqs {
diff --git a/include/asm-sparc64/oplib.h b/include/asm-sparc64/oplib.h
index a432d9e7daaa..d02f1e8ae1a6 100644
--- a/include/asm-sparc64/oplib.h
+++ b/include/asm-sparc64/oplib.h
@@ -38,6 +38,20 @@ extern int prom_stdin, prom_stdout;
  */
 extern int prom_chosen_node;
 
+/* Helper values and strings in arch/sparc64/kernel/head.S */
+extern const char prom_finddev_name[];
+extern const char prom_chosen_path[];
+extern const char prom_getprop_name[];
+extern const char prom_mmu_name[];
+extern const char prom_callmethod_name[];
+extern const char prom_translate_name[];
+extern const char prom_map_name[];
+extern const char prom_unmap_name[];
+extern int prom_mmu_ihandle_cache;
+extern unsigned int prom_boot_mapped_pc;
+extern unsigned int prom_boot_mapping_mode;
+extern unsigned long prom_boot_mapping_phys_high, prom_boot_mapping_phys_low;
+
 struct linux_mlist_p1275 {
         struct linux_mlist_p1275 *theres_more;
         unsigned long start_adr;
@@ -68,7 +82,7 @@ extern char *prom_getbootargs(void);
  * of the string is different on V0 vs. V2->higher proms.  The caller must
  * know what he/she is doing!  Returns the device descriptor, an int.
  */
-extern int prom_devopen(char *device_string);
+extern int prom_devopen(const char *device_string);
 
 /* Close a previously opened device described by the passed integer
  * descriptor.
@@ -81,27 +95,13 @@ extern int prom_devclose(int device_handle);
 extern void prom_seek(int device_handle, unsigned int seek_hival,
                       unsigned int seek_lowval);
 
-/* Machine memory configuration routine. */
-
-/* This function returns a V0 format memory descriptor table, it has three
- * entries.  One for the total amount of physical ram on the machine, one
- * for the amount of physical ram available, and one describing the virtual
- * areas which are allocated by the prom.  So, in a sense the physical
- * available is a calculation of the total physical minus the physical mapped
- * by the prom with virtual mappings.
- *
- * These lists are returned pre-sorted, this should make your life easier
- * since the prom itself is way too lazy to do such nice things.
- */
-extern struct linux_mem_p1275 *prom_meminfo(void);
-
 /* Miscellaneous routines, don't really fit in any category per se. */
 
 /* Reboot the machine with the command line passed. */
-extern void prom_reboot(char *boot_command);
+extern void prom_reboot(const char *boot_command);
 
 /* Evaluate the forth string passed. */
-extern void prom_feval(char *forth_string);
+extern void prom_feval(const char *forth_string);
 
 /* Enter the prom, with possibility of continuation with the 'go'
  * command in newer proms.
@@ -154,7 +154,7 @@ extern char prom_getchar(void);
 extern void prom_putchar(char character);
 
 /* Prom's internal routines, don't use in kernel/boot code. */
-extern void prom_printf(char *fmt, ...);
+extern void prom_printf(const char *fmt, ...);
 extern void prom_write(const char *buf, unsigned int len);
 
 /* Query for input device type */
@@ -215,7 +215,7 @@ extern int prom_getunumber(int syndrome_code,
                            char *buf, int buflen);
 
 /* Retain physical memory to the caller across soft resets. */
-extern unsigned long prom_retain(char *name,
+extern unsigned long prom_retain(const char *name,
                                  unsigned long pa_low, unsigned long pa_high,
                                  long size, long align);
 
@@ -269,28 +269,28 @@ extern int prom_getsibling(int node);
 /* Get the length, at the passed node, of the given property type.
  * Returns -1 on error (ie. no such property at this node).
  */
-extern int prom_getproplen(int thisnode, char *property);
+extern int prom_getproplen(int thisnode, const char *property);
 
 /* Fetch the requested property using the given buffer.  Returns
  * the number of bytes the prom put into your buffer or -1 on error.
  */
-extern int prom_getproperty(int thisnode, char *property,
+extern int prom_getproperty(int thisnode, const char *property,
                             char *prop_buffer, int propbuf_size);
 
 /* Acquire an integer property. */
-extern int prom_getint(int node, char *property);
+extern int prom_getint(int node, const char *property);
 
 /* Acquire an integer property, with a default value. */
-extern int prom_getintdefault(int node, char *property, int defval);
+extern int prom_getintdefault(int node, const char *property, int defval);
 
 /* Acquire a boolean property, 0=FALSE 1=TRUE. */
-extern int prom_getbool(int node, char *prop);
+extern int prom_getbool(int node, const char *prop);
 
 /* Acquire a string property, null string on error. */
-extern void prom_getstring(int node, char *prop, char *buf, int bufsize);
+extern void prom_getstring(int node, const char *prop, char *buf, int bufsize);
 
 /* Does the passed node have the given "name"? YES=1 NO=0 */
-extern int prom_nodematch(int thisnode, char *name);
+extern int prom_nodematch(int thisnode, const char *name);
 
 /* Puts in buffer a prom name in the form name@x,y or name (x for which_io 
  * and y for first regs phys address
@@ -300,7 +300,7 @@ extern int prom_getname(int node, char *buf, int buflen);
 /* Search all siblings starting at the passed node for "name" matching
  * the given string.  Returns the node on success, zero on failure.
  */
-extern int prom_searchsiblings(int node_start, char *name);
+extern int prom_searchsiblings(int node_start, const char *name);
 
 /* Return the first property type, as a string, for the given node.
  * Returns a null string on error. Buffer should be at least 32B long.
@@ -310,21 +310,21 @@ extern char *prom_firstprop(int node, char *buffer);
 /* Returns the next property after the passed property for the given
  * node.  Returns null string on failure. Buffer should be at least 32B long.
  */
-extern char *prom_nextprop(int node, char *prev_property, char *buffer);
+extern char *prom_nextprop(int node, const char *prev_property, char *buffer);
 
 /* Returns 1 if the specified node has given property. */
-extern int prom_node_has_property(int node, char *property);
+extern int prom_node_has_property(int node, const char *property);
 
 /* Returns phandle of the path specified */
-extern int prom_finddevice(char *name);
+extern int prom_finddevice(const char *name);
 
 /* Set the indicated property at the given node with the passed value.
  * Returns the number of bytes of your value that the prom took.
  */
-extern int prom_setprop(int node, char *prop_name, char *prop_value,
+extern int prom_setprop(int node, const char *prop_name, char *prop_value,
                         int value_size);
                         
-extern int prom_pathtoinode(char *path);
+extern int prom_pathtoinode(const char *path);
 extern int prom_inst2pkg(int);
 
 /* CPU probing helpers.  */
@@ -334,7 +334,7 @@ int cpu_find_by_mid(int mid, int *prom_node);
 /* Client interface level routines. */
 extern void prom_set_trap_table(unsigned long tba);
 
-extern long p1275_cmd (char *, long, ...);
+extern long p1275_cmd(const char *, long, ...);
                                    
 
 #if 0
diff --git a/include/asm-sparc64/page.h b/include/asm-sparc64/page.h
index 7f8d764abc47..5426bb28a993 100644
--- a/include/asm-sparc64/page.h
+++ b/include/asm-sparc64/page.h
@@ -140,23 +140,6 @@ extern unsigned long page_to_pfn(struct page *);
 #define virt_to_phys __pa
 #define phys_to_virt __va
 
-/* The following structure is used to hold the physical
- * memory configuration of the machine.  This is filled in
- * probe_memory() and is later used by mem_init() to set up
- * mem_map[].  We statically allocate SPARC_PHYS_BANKS of
- * these structs, this is arbitrary.  The entry after the
- * last valid one has num_bytes==0.
- */
-
-struct sparc_phys_banks {
-        unsigned long base_addr;
-        unsigned long num_bytes;
-};
-
-#define SPARC_PHYS_BANKS 32
-
-extern struct sparc_phys_banks sp_banks[SPARC_PHYS_BANKS];
-
 #endif /* !(__ASSEMBLY__) */
 
 #define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_EXEC | \
diff --git a/include/asm-sparc64/pgtable.h b/include/asm-sparc64/pgtable.h
index a297f6144f0f..8c6dfc6c7af6 100644
--- a/include/asm-sparc64/pgtable.h
+++ b/include/asm-sparc64/pgtable.h
@@ -60,13 +60,13 @@
  * table can map
  */
 #define PMD_SHIFT       (PAGE_SHIFT + (PAGE_SHIFT-3))
-#define PMD_SIZE        (1UL << PMD_SHIFT)
+#define PMD_SIZE        (_AC(1,UL) << PMD_SHIFT)
 #define PMD_MASK        (~(PMD_SIZE-1))
 #define PMD_BITS        (PAGE_SHIFT - 2)
 
 /* PGDIR_SHIFT determines what a third-level page table entry can map */
 #define PGDIR_SHIFT     (PAGE_SHIFT + (PAGE_SHIFT-3) + PMD_BITS)
-#define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
+#define PGDIR_SIZE      (_AC(1,UL) << PGDIR_SHIFT)
 #define PGDIR_MASK      (~(PGDIR_SIZE-1))
 #define PGDIR_BITS      (PAGE_SHIFT - 2)
 
@@ -98,7 +98,9 @@
 #define _PAGE_NFO       _AC(0x1000000000000000,UL) /* No Fault Only          */
 #define _PAGE_IE        _AC(0x0800000000000000,UL) /* Invert Endianness      */
 #define _PAGE_SOFT2     _AC(0x07FC000000000000,UL) /* Software bits, set 2   */
-#define _PAGE_RES1      _AC(0x0003000000000000,UL) /* Reserved               */
+#define _PAGE_RES1      _AC(0x0002000000000000,UL) /* Reserved               */
+#define _PAGE_SZ32MB    _AC(0x0001000000000000,UL) /* (Panther) 32MB page    */
+#define _PAGE_SZ256MB   _AC(0x2001000000000000,UL) /* (Panther) 256MB page   */
 #define _PAGE_SN        _AC(0x0000800000000000,UL) /* (Cheetah) Snoop        */
 #define _PAGE_RES2      _AC(0x0000780000000000,UL) /* Reserved               */
 #define _PAGE_PADDR_SF  _AC(0x000001FFFFFFE000,UL) /* (Spitfire) paddr[40:13]*/
@@ -336,7 +338,11 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *p
 #define pte_clear(mm,addr,ptep)         \
         set_pte_at((mm), (addr), (ptep), __pte(0UL))
 
-extern pgd_t swapper_pg_dir[1];
+extern pgd_t swapper_pg_dir[2048];
+extern pmd_t swapper_low_pmd_dir[2048];
+
+extern void paging_init(void);
+extern unsigned long find_ecache_flush_span(unsigned long size);
 
 /* These do nothing with the way I have things setup. */
 #define mmu_lockarea(vaddr, len)                (vaddr)
diff --git a/include/asm-sparc64/uaccess.h b/include/asm-sparc64/uaccess.h
index 80a65d7e3dbf..203e8eee6351 100644
--- a/include/asm-sparc64/uaccess.h
+++ b/include/asm-sparc64/uaccess.h
@@ -70,26 +70,14 @@ static inline int access_ok(int type, const void __user * addr, unsigned long si
  * with the main instruction path.  This means when everything is well,
  * we don't even have to jump over them.  Further, they do not intrude
  * on our cache or tlb entries.
- *
- * There is a special way how to put a range of potentially faulting
- * insns (like twenty ldd/std's with now intervening other instructions)
- * You specify address of first in insn and 0 in fixup and in the next
- * exception_table_entry you specify last potentially faulting insn + 1
- * and in fixup the routine which should handle the fault.
- * That fixup code will get
- * (faulting_insn_address - first_insn_in_the_range_address)/4
- * in %g2 (ie. index of the faulting instruction in the range).
  */
 
-struct exception_table_entry
-{
-        unsigned insn, fixup;
+struct exception_table_entry {
+        unsigned int insn, fixup;
 };
 
-/* Special exable search, which handles ranges.  Returns fixup */
-unsigned long search_extables_range(unsigned long addr, unsigned long *g2);
-
 extern void __ret_efault(void);
+extern void __retl_efault(void);
 
 /* Uh, these should become the main single-value transfer routines..
  * They automatically use the right size if we just have the right
@@ -263,7 +251,7 @@ copy_from_user(void *to, const void __user *from, unsigned long size)
 {
         unsigned long ret = ___copy_from_user(to, from, size);
 
-        if (ret)
+        if (unlikely(ret))
                 ret = copy_from_user_fixup(to, from, size);
         return ret;
 }
@@ -279,7 +267,7 @@ copy_to_user(void __user *to, const void *from, unsigned long size)
 {
         unsigned long ret = ___copy_to_user(to, from, size);
 
-        if (ret)
+        if (unlikely(ret))
                 ret = copy_to_user_fixup(to, from, size);
         return ret;
 }
@@ -295,7 +283,7 @@ copy_in_user(void __user *to, void __user *from, unsigned long size)
 {
         unsigned long ret = ___copy_in_user(to, from, size);
 
-        if (ret)
+        if (unlikely(ret))
                 ret = copy_in_user_fixup(to, from, size);
         return ret;
 }
diff --git a/include/asm-um/pgtable.h b/include/asm-um/pgtable.h
index ed06170e0edd..616d02b57ea9 100644
--- a/include/asm-um/pgtable.h
+++ b/include/asm-um/pgtable.h
@@ -346,7 +346,6 @@ static inline void set_pte(pte_t *pteptr, pte_t pteval)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
         pte_set_val(pte, (pte_val(pte) & _PAGE_CHG_MASK), newprot);
-        if(pte_present(pte)) pte = pte_mknewpage(pte_mknewprot(pte));
         return pte; 
 }
 
diff --git a/include/asm-um/uaccess.h b/include/asm-um/uaccess.h
index 801710d00a40..2ee028b8de9d 100644
--- a/include/asm-um/uaccess.h
+++ b/include/asm-um/uaccess.h
@@ -44,7 +44,7 @@
         const __typeof__(ptr) __private_ptr = ptr; \
         __typeof__(*(__private_ptr)) __private_val; \
         int __private_ret = -EFAULT; \
-        (x) = 0; \
+        (x) = (__typeof__(*(__private_ptr)))0; \
         if (__copy_from_user(&__private_val, (__private_ptr), \
             sizeof(*(__private_ptr))) == 0) {\
                 (x) = (__typeof__(*(__private_ptr))) __private_val; \
diff --git a/include/asm-x86_64/msr.h b/include/asm-x86_64/msr.h
index 4d727f3f5550..5a7fe3c6c3d8 100644
--- a/include/asm-x86_64/msr.h
+++ b/include/asm-x86_64/msr.h
@@ -234,6 +234,7 @@ static inline unsigned int cpuid_edx(unsigned int op)
 #define MSR_K8_TOP_MEM1            0xC001001A
 #define MSR_K8_TOP_MEM2            0xC001001D
 #define MSR_K8_SYSCFG              0xC0010010
+#define MSR_K8_HWCR                0xC0010015
 
 /* K6 MSRs */
 #define MSR_K6_EFER                     0xC0000080
diff --git a/include/asm-x86_64/pgtable.h b/include/asm-x86_64/pgtable.h
index 2cb483516459..dd8711ecaf2f 100644
--- a/include/asm-x86_64/pgtable.h
+++ b/include/asm-x86_64/pgtable.h
@@ -384,7 +384,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 }
 
 #define pte_index(address) \
-                ((address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
+                (((address) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
 #define pte_offset_kernel(dir, address) ((pte_t *) pmd_page_kernel(*(dir)) + \
                         pte_index(address))
 
diff --git a/include/asm-xtensa/atomic.h b/include/asm-xtensa/atomic.h
index 24f86f0e43cf..12b5732dc6e5 100644
--- a/include/asm-xtensa/atomic.h
+++ b/include/asm-xtensa/atomic.h
@@ -22,7 +22,7 @@ typedef struct { volatile int counter; } atomic_t;
 #include <asm/processor.h>
 #include <asm/system.h>
 
-#define ATOMIC_INIT(i)  ( (atomic_t) { (i) } )
+#define ATOMIC_INIT(i)  { (i) }
 
 /*
  * This Xtensa implementation assumes that the right mechanism
diff --git a/include/asm-xtensa/bitops.h b/include/asm-xtensa/bitops.h
index d395ef226c32..e76ee889e21d 100644
--- a/include/asm-xtensa/bitops.h
+++ b/include/asm-xtensa/bitops.h
@@ -174,7 +174,7 @@ static __inline__ int test_bit(int nr, const volatile void *addr)
         return 1UL & (((const volatile unsigned int *)addr)[nr>>5] >> (nr&31));
 }
 
-#if XCHAL_HAVE_NSAU
+#if XCHAL_HAVE_NSA
 
 static __inline__ int __cntlz (unsigned long x)
 {
diff --git a/include/asm-xtensa/hardirq.h b/include/asm-xtensa/hardirq.h
index e07c76c36b95..aa9c1adf68d7 100644
--- a/include/asm-xtensa/hardirq.h
+++ b/include/asm-xtensa/hardirq.h
@@ -23,6 +23,7 @@ typedef struct {
         unsigned int __nmi_count;              /* arch dependent */
 } ____cacheline_aligned irq_cpustat_t;
 
+void ack_bad_irq(unsigned int irq);
 #include <linux/irq_cpustat.h>  /* Standard mappings for irq_cpustat_t above */
 
 #endif  /* _XTENSA_HARDIRQ_H */
diff --git a/include/asm-xtensa/semaphore.h b/include/asm-xtensa/semaphore.h
index db740b8bc6f0..09e89ab3eb61 100644
--- a/include/asm-xtensa/semaphore.h
+++ b/include/asm-xtensa/semaphore.h
@@ -20,28 +20,19 @@ struct semaphore {
         atomic_t count;
         int sleepers;
         wait_queue_head_t wait;
-#if WAITQUEUE_DEBUG
-        long __magic;
-#endif
 };
 
-#if WAITQUEUE_DEBUG
-# define __SEM_DEBUG_INIT(name) \
-                , (int)&(name).__magic
-#else
-# define __SEM_DEBUG_INIT(name)
-#endif
-
-#define __SEMAPHORE_INITIALIZER(name,count)                     \
-        { ATOMIC_INIT(count),                                   \
-          0,                                                    \
-          __WAIT_QUEUE_HEAD_INITIALIZER((name).wait)            \
-        __SEM_DEBUG_INIT(name) }
+#define __SEMAPHORE_INITIALIZER(name,n)                                 \
+{                                                                       \
+        .count          = ATOMIC_INIT(n),                               \
+        .sleepers       = 0,                                            \
+        .wait           = __WAIT_QUEUE_HEAD_INITIALIZER((name).wait)    \
+}
 
-#define __MUTEX_INITIALIZER(name) \
+#define __MUTEX_INITIALIZER(name)                                       \
         __SEMAPHORE_INITIALIZER(name, 1)
 
-#define __DECLARE_SEMAPHORE_GENERIC(name,count) \
+#define __DECLARE_SEMAPHORE_GENERIC(name,count)                         \
         struct semaphore name = __SEMAPHORE_INITIALIZER(name,count)
 
 #define DECLARE_MUTEX(name) __DECLARE_SEMAPHORE_GENERIC(name,1)
@@ -49,17 +40,8 @@ struct semaphore {
 
 static inline void sema_init (struct semaphore *sem, int val)
 {
-/*
- *      *sem = (struct semaphore)__SEMAPHORE_INITIALIZER((*sem),val);
- *
- * i'd rather use the more flexible initialization above, but sadly
- * GCC 2.7.2.3 emits a bogus warning. EGCS doesnt. Oh well.
- */
         atomic_set(&sem->count, val);
         init_waitqueue_head(&sem->wait);
-#if WAITQUEUE_DEBUG
-        sem->__magic = (int)&sem->__magic;
-#endif
 }
 
 static inline void init_MUTEX (struct semaphore *sem)
@@ -81,9 +63,7 @@ extern spinlock_t semaphore_wake_lock;
 
 static inline void down(struct semaphore * sem)
 {
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
+        might_sleep();
 
         if (atomic_sub_return(1, &sem->count) < 0)
                 __down(sem);
@@ -92,9 +72,8 @@ static inline void down(struct semaphore * sem)
 static inline int down_interruptible(struct semaphore * sem)
 {
         int ret = 0;
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
+
+        might_sleep();
 
         if (atomic_sub_return(1, &sem->count) < 0)
                 ret = __down_interruptible(sem);
@@ -104,9 +83,6 @@ static inline int down_interruptible(struct semaphore * sem)
 static inline int down_trylock(struct semaphore * sem)
 {
         int ret = 0;
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
 
         if (atomic_sub_return(1, &sem->count) < 0)
                 ret = __down_trylock(sem);
@@ -119,9 +95,6 @@ static inline int down_trylock(struct semaphore * sem)
  */
 static inline void up(struct semaphore * sem)
 {
-#if WAITQUEUE_DEBUG
-        CHECK_MAGIC(sem->__magic);
-#endif
         if (atomic_add_return(1, &sem->count) <= 0)
                 __up(sem);
 }
diff --git a/include/asm-xtensa/system.h b/include/asm-xtensa/system.h
index f09393232e5e..9284867f1cb9 100644
--- a/include/asm-xtensa/system.h
+++ b/include/asm-xtensa/system.h
@@ -189,20 +189,6 @@ static inline unsigned long xchg_u32(volatile int * m, unsigned long val)
 
 #define tas(ptr) (xchg((ptr),1))
 
-#if ( __XCC__ == 1 )
-
-/* xt-xcc processes __inline__ differently than xt-gcc and decides to
- * insert an out-of-line copy of function __xchg.  This presents the
- * unresolved symbol at link time of __xchg_called_with_bad_pointer,
- * even though such a function would never be called at run-time.
- * xt-gcc always inlines __xchg, and optimizes away the undefined
- * bad_pointer function.
- */
-
-#define xchg(ptr,x) xchg_u32(ptr,x)
-
-#else  /* assume xt-gcc */
-
 #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
 
 /*
@@ -224,8 +210,6 @@ __xchg(unsigned long x, volatile void * ptr, int size)
         return x;
 }
 
-#endif
-
 extern void set_except_vector(int n, void *addr);
 
 static inline void spill_registers(void)
diff --git a/include/linux/aio.h b/include/linux/aio.h
index a4d5af907f90..60def658b246 100644
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -43,6 +43,40 @@ struct kioctx;
 #define kiocbIsKicked(iocb)     test_bit(KIF_KICKED, &(iocb)->ki_flags)
 #define kiocbIsCancelled(iocb)  test_bit(KIF_CANCELLED, &(iocb)->ki_flags)
 
+/* is there a better place to document function pointer methods? */
+/**
+ * ki_retry     -       iocb forward progress callback
+ * @kiocb:      The kiocb struct to advance by performing an operation.
+ *
+ * This callback is called when the AIO core wants a given AIO operation
+ * to make forward progress.  The kiocb argument describes the operation
+ * that is to be performed.  As the operation proceeds, perhaps partially,
+ * ki_retry is expected to update the kiocb with progress made.  Typically
+ * ki_retry is set in the AIO core and it itself calls file_operations
+ * helpers.
+ *
+ * ki_retry's return value determines when the AIO operation is completed
+ * and an event is generated in the AIO event ring.  Except the special
+ * return values described below, the value that is returned from ki_retry
+ * is transferred directly into the completion ring as the operation's
+ * resulting status.  Once this has happened ki_retry *MUST NOT* reference
+ * the kiocb pointer again.
+ *
+ * If ki_retry returns -EIOCBQUEUED it has made a promise that aio_complete()
+ * will be called on the kiocb pointer in the future.  The AIO core will
+ * not ask the method again -- ki_retry must ensure forward progress.
+ * aio_complete() must be called once and only once in the future, multiple
+ * calls may result in undefined behaviour.
+ *
+ * If ki_retry returns -EIOCBRETRY it has made a promise that kick_iocb()
+ * will be called on the kiocb pointer in the future.  This may happen
+ * through generic helpers that associate kiocb->ki_wait with a wait
+ * queue head that ki_retry uses via current->io_wait.  It can also happen
+ * with custom tracking and manual calls to kick_iocb(), though that is
+ * discouraged.  In either case, kick_iocb() must be called once and only
+ * once.  ki_retry must ensure forward progress, the AIO core will wait
+ * indefinitely for kick_iocb() to be called.
+ */
 struct kiocb {
         struct list_head        ki_run_list;
         long                    ki_flags;
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 96de26301f84..86d4b0a81713 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -104,12 +104,19 @@ struct cn_queue_dev {
         struct sock *nls;
 };
 
-struct cn_callback {
+struct cn_callback_id {
         unsigned char name[CN_CBQ_NAMELEN];
-
         struct cb_id id;
+};
+
+struct cn_callback_data {
+        void (*destruct_data) (void *);
+        void *ddata;
+        
+        void *callback_priv;
         void (*callback) (void *);
-        void *priv;
+
+        void *free;
 };
 
 struct cn_callback_entry {
@@ -118,8 +125,8 @@ struct cn_callback_entry {
         struct work_struct work;
         struct cn_queue_dev *pdev;
 
-        void (*destruct_data) (void *);
-        void *ddata;
+        struct cn_callback_id id;
+        struct cn_callback_data data;
 
         int seq, group;
         struct sock *nls;
@@ -144,7 +151,7 @@ int cn_add_callback(struct cb_id *, char *, void (*callback) (void *));
 void cn_del_callback(struct cb_id *);
 int cn_netlink_send(struct cn_msg *, u32, int);
 
-int cn_queue_add_callback(struct cn_queue_dev *dev, struct cn_callback *cb);
+int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *));
 void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id);
 
 struct cn_queue_dev *cn_queue_alloc_dev(char *name, struct sock *);
@@ -152,6 +159,8 @@ void cn_queue_free_dev(struct cn_queue_dev *dev);
 
 int cn_cb_equal(struct cb_id *, struct cb_id *);
 
+void cn_queue_wrapper(void *data);
+
 extern int cn_already_initialized;
 
 #endif                          /* __KERNEL__ */
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index fc2d4c8225aa..d21c305c6c64 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -111,7 +111,9 @@ static inline struct ethhdr *eth_hdr(const struct sk_buff *skb)
         return (struct ethhdr *)skb->mac.raw;
 }
 
+#ifdef CONFIG_SYSCTL
 extern struct ctl_table ether_table[];
 #endif
+#endif
 
 #endif  /* _LINUX_IF_ETHER_H */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index 7e1e15f934f3..fd7af86151b1 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -142,13 +142,21 @@ static __inline__ int bad_mask(u32 mask, u32 addr)
 
 #define endfor_ifa(in_dev) }
 
+static inline struct in_device *__in_dev_get_rcu(const struct net_device *dev)
+{
+        struct in_device *in_dev = dev->ip_ptr;
+        if (in_dev)
+                in_dev = rcu_dereference(in_dev);
+        return in_dev;
+}
+
 static __inline__ struct in_device *
 in_dev_get(const struct net_device *dev)
 {
         struct in_device *in_dev;
 
         rcu_read_lock();
-        in_dev = dev->ip_ptr;
+        in_dev = __in_dev_get_rcu(dev);
         if (in_dev)
                 atomic_inc(&in_dev->refcnt);
         rcu_read_unlock();
@@ -156,7 +164,7 @@ in_dev_get(const struct net_device *dev)
 }
 
 static __inline__ struct in_device *
-__in_dev_get(const struct net_device *dev)
+__in_dev_get_rtnl(const struct net_device *dev)
 {
         return (struct in_device*)dev->ip_ptr;
 }
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index bb6f88e14061..e0b922785d98 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -372,8 +372,9 @@ static inline struct raw6_sock *raw6_sk(const struct sock *sk)
 #define inet_v6_ipv6only(__sk)          0
 #endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
 
-#define INET6_MATCH(__sk, __saddr, __daddr, __ports, __dif)        \
-        (((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   && \
+#define INET6_MATCH(__sk, __hash, __saddr, __daddr, __ports, __dif)\
+        (((__sk)->sk_hash == (__hash))                          && \
+         ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   && \
          ((__sk)->sk_family             == AF_INET6)            && \
          ipv6_addr_equal(&inet6_sk(__sk)->daddr, (__saddr))     && \
          ipv6_addr_equal(&inet6_sk(__sk)->rcv_saddr, (__daddr)) && \
diff --git a/include/linux/key-ui.h b/include/linux/key-ui.h
index cc326174a808..918c34a8347e 100644
--- a/include/linux/key-ui.h
+++ b/include/linux/key-ui.h
@@ -42,11 +42,14 @@ struct keyring_list {
 /*
  * check to see whether permission is granted to use a key in the desired way
  */
-static inline int key_permission(const struct key *key, key_perm_t perm)
+static inline int key_permission(const key_ref_t key_ref, key_perm_t perm)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         key_perm_t kperm;
 
-        if (key->uid == current->fsuid)
+        if (is_key_possessed(key_ref))
+                kperm = key->perm >> 24;
+        else if (key->uid == current->fsuid)
                 kperm = key->perm >> 16;
         else if (key->gid != -1 &&
                  key->perm & KEY_GRP_ALL &&
@@ -65,11 +68,14 @@ static inline int key_permission(const struct key *key, key_perm_t perm)
  * check to see whether permission is granted to use a key in at least one of
  * the desired ways
  */
-static inline int key_any_permission(const struct key *key, key_perm_t perm)
+static inline int key_any_permission(const key_ref_t key_ref, key_perm_t perm)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         key_perm_t kperm;
 
-        if (key->uid == current->fsuid)
+        if (is_key_possessed(key_ref))
+                kperm = key->perm >> 24;
+        else if (key->uid == current->fsuid)
                 kperm = key->perm >> 16;
         else if (key->gid != -1 &&
                  key->perm & KEY_GRP_ALL &&
@@ -94,13 +100,17 @@ static inline int key_task_groups_search(struct task_struct *tsk, gid_t gid)
         return ret;
 }
 
-static inline int key_task_permission(const struct key *key,
+static inline int key_task_permission(const key_ref_t key_ref,
                                       struct task_struct *context,
                                       key_perm_t perm)
 {
+        struct key *key = key_ref_to_ptr(key_ref);
         key_perm_t kperm;
 
-        if (key->uid == context->fsuid) {
+        if (is_key_possessed(key_ref)) {
+                kperm = key->perm >> 24;
+        }
+        else if (key->uid == context->fsuid) {
                 kperm = key->perm >> 16;
         }
         else if (key->gid != -1 &&
@@ -121,9 +131,9 @@ static inline int key_task_permission(const struct key *key,
 
 }
 
-extern struct key *lookup_user_key(struct task_struct *context,
-                                   key_serial_t id, int create, int partial,
-                                   key_perm_t perm);
+extern key_ref_t lookup_user_key(struct task_struct *context,
+                                 key_serial_t id, int create, int partial,
+                                 key_perm_t perm);
 
 extern long join_session_keyring(const char *name);
 
diff --git a/include/linux/key.h b/include/linux/key.h
index 970bbd916cf4..f1efa016dbf3 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -35,11 +35,18 @@ struct key;
 
 #undef KEY_DEBUGGING
 
-#define KEY_USR_VIEW    0x00010000      /* user can view a key's attributes */
-#define KEY_USR_READ    0x00020000      /* user can read key payload / view keyring */
-#define KEY_USR_WRITE   0x00040000      /* user can update key payload / add link to keyring */
-#define KEY_USR_SEARCH  0x00080000      /* user can find a key in search / search a keyring */
-#define KEY_USR_LINK    0x00100000      /* user can create a link to a key/keyring */
+#define KEY_POS_VIEW    0x01000000      /* possessor can view a key's attributes */
+#define KEY_POS_READ    0x02000000      /* possessor can read key payload / view keyring */
+#define KEY_POS_WRITE   0x04000000      /* possessor can update key payload / add link to keyring */
+#define KEY_POS_SEARCH  0x08000000      /* possessor can find a key in search / search a keyring */
+#define KEY_POS_LINK    0x10000000      /* possessor can create a link to a key/keyring */
+#define KEY_POS_ALL     0x1f000000
+
+#define KEY_USR_VIEW    0x00010000      /* user permissions... */
+#define KEY_USR_READ    0x00020000
+#define KEY_USR_WRITE   0x00040000
+#define KEY_USR_SEARCH  0x00080000
+#define KEY_USR_LINK    0x00100000
 #define KEY_USR_ALL     0x001f0000
 
 #define KEY_GRP_VIEW    0x00000100      /* group permissions... */
@@ -67,6 +74,38 @@ struct keyring_name;
 
 /*****************************************************************************/
 /*
+ * key reference with possession attribute handling
+ *
+ * NOTE! key_ref_t is a typedef'd pointer to a type that is not actually
+ * defined. This is because we abuse the bottom bit of the reference to carry a
+ * flag to indicate whether the calling process possesses that key in one of
+ * its keyrings.
+ *
+ * the key_ref_t has been made a separate type so that the compiler can reject
+ * attempts to dereference it without proper conversion.
+ *
+ * the three functions are used to assemble and disassemble references
+ */
+typedef struct __key_reference_with_attributes *key_ref_t;
+
+static inline key_ref_t make_key_ref(const struct key *key,
+                                     unsigned long possession)
+{
+        return (key_ref_t) ((unsigned long) key | possession);
+}
+
+static inline struct key *key_ref_to_ptr(const key_ref_t key_ref)
+{
+        return (struct key *) ((unsigned long) key_ref & ~1UL);
+}
+
+static inline unsigned long is_key_possessed(const key_ref_t key_ref)
+{
+        return (unsigned long) key_ref & 1UL;
+}
+
+/*****************************************************************************/
+/*
  * authentication token / access credential / keyring
  * - types of key include:
  *   - keyrings
@@ -215,20 +254,25 @@ static inline struct key *key_get(struct key *key)
         return key;
 }
 
+static inline void key_ref_put(key_ref_t key_ref)
+{
+        key_put(key_ref_to_ptr(key_ref));
+}
+
 extern struct key *request_key(struct key_type *type,
                                const char *description,
                                const char *callout_info);
 
 extern int key_validate(struct key *key);
 
-extern struct key *key_create_or_update(struct key *keyring,
-                                        const char *type,
-                                        const char *description,
-                                        const void *payload,
-                                        size_t plen,
-                                        int not_in_quota);
+extern key_ref_t key_create_or_update(key_ref_t keyring,
+                                      const char *type,
+                                      const char *description,
+                                      const void *payload,
+                                      size_t plen,
+                                      int not_in_quota);
 
-extern int key_update(struct key *key,
+extern int key_update(key_ref_t key,
                       const void *payload,
                       size_t plen);
 
@@ -243,9 +287,9 @@ extern struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
 
 extern int keyring_clear(struct key *keyring);
 
-extern struct key *keyring_search(struct key *keyring,
-                                  struct key_type *type,
-                                  const char *description);
+extern key_ref_t keyring_search(key_ref_t keyring,
+                                struct key_type *type,
+                                const char *description);
 
 extern int keyring_add_key(struct key *keyring,
                            struct key *key);
@@ -285,6 +329,10 @@ extern void key_init(void);
 #define key_serial(k)                   0
 #define key_get(k)                      ({ NULL; })
 #define key_put(k)                      do { } while(0)
+#define key_ref_put(k)                  do { } while(0)
+#define make_key_ref(k)                 ({ NULL; })
+#define key_ref_to_ptr(k)               ({ NULL; })
+#define is_key_possessed(k)             0
 #define alloc_uid_keyring(u)            0
 #define switch_uid_keyring(u)           do { } while(0)
 #define __install_session_keyring(t, k) ({ NULL; })
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 022105c745fc..ceee1fc42c60 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -393,6 +393,7 @@ extern int ata_pci_init_one (struct pci_dev *pdev, struct ata_port_info **port_i
 extern void ata_pci_remove_one (struct pci_dev *pdev);
 #endif /* CONFIG_PCI */
 extern int ata_device_add(struct ata_probe_ent *ent);
+extern void ata_host_set_remove(struct ata_host_set *host_set);
 extern int ata_scsi_detect(Scsi_Host_Template *sht);
 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
index 47da39ba3f03..2f0299a448f6 100644
--- a/include/linux/mod_devicetable.h
+++ b/include/linux/mod_devicetable.h
@@ -183,7 +183,7 @@ struct of_device_id
         char    name[32];
         char    type[32];
         char    compatible[128];
-#if __KERNEL__
+#ifdef __KERNEL__
         void    *data;
 #else
         kernel_ulong_t data;
@@ -209,10 +209,11 @@ struct pcmcia_device_id {
         /* for real multi-function devices */
         __u8            function;
 
-        /* for pseude multi-function devices */
+        /* for pseudo multi-function devices */
         __u8            device_no;
 
-        __u32           prod_id_hash[4];
+        __u32           prod_id_hash[4]
+                __attribute__((aligned(sizeof(__u32))));
 
         /* not matched against in kernelspace*/
 #ifdef __KERNEL__
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 98c98e6cd4f3..a9281b24c40b 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -265,6 +265,8 @@ struct net_device
          * the interface.
          */
         char                    name[IFNAMSIZ];
+        /* device name hash chain */
+        struct hlist_node       name_hlist;
 
         /*
          *      I/O specific fields
@@ -292,6 +294,21 @@ struct net_device
 
         /* ------- Fields preinitialized in Space.c finish here ------- */
 
+        /* Net device features */
+        unsigned long           features;
+#define NETIF_F_SG              1       /* Scatter/gather IO. */
+#define NETIF_F_IP_CSUM         2       /* Can checksum only TCP/UDP over IPv4. */
+#define NETIF_F_NO_CSUM         4       /* Does not require checksum. F.e. loopack. */
+#define NETIF_F_HW_CSUM         8       /* Can checksum all the packets. */
+#define NETIF_F_HIGHDMA         32      /* Can DMA to high memory. */
+#define NETIF_F_FRAGLIST        64      /* Scatter/gather IO. */
+#define NETIF_F_HW_VLAN_TX      128     /* Transmit VLAN hw acceleration */
+#define NETIF_F_HW_VLAN_RX      256     /* Receive VLAN hw acceleration */
+#define NETIF_F_HW_VLAN_FILTER  512     /* Receive filtering on VLAN */
+#define NETIF_F_VLAN_CHALLENGED 1024    /* Device cannot handle VLAN packets */
+#define NETIF_F_TSO             2048    /* Can offload TCP/IP segmentation */
+#define NETIF_F_LLTX            4096    /* LockLess TX */
+
         struct net_device       *next_sched;
 
         /* Interface index. Unique device identifier    */
@@ -316,9 +333,6 @@ struct net_device
          * will (read: may be cleaned up at will).
          */
 
-        /* These may be needed for future network-power-down code. */
-        unsigned long           trans_start;    /* Time (in jiffies) of last Tx */
-        unsigned long           last_rx;        /* Time of last Rx      */
 
         unsigned short          flags;  /* interface flags (a la BSD)   */
         unsigned short          gflags;
@@ -328,15 +342,12 @@ struct net_device
         unsigned                mtu;    /* interface MTU value          */
         unsigned short          type;   /* interface hardware type      */
         unsigned short          hard_header_len;        /* hardware hdr length  */
-        void                    *priv;  /* pointer to private data      */
 
         struct net_device       *master; /* Pointer to master device of a group,
                                           * which this device is member of.
                                           */
 
         /* Interface address info. */
-        unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
-        unsigned char           dev_addr[MAX_ADDR_LEN]; /* hw address   */
         unsigned char           perm_addr[MAX_ADDR_LEN]; /* permanent hw address */
         unsigned char           addr_len;       /* hardware address length      */
         unsigned short          dev_id;         /* for shared network cards */
@@ -346,8 +357,6 @@ struct net_device
         int                     promiscuity;
         int                     allmulti;
 
-        int                     watchdog_timeo;
-        struct timer_list       watchdog_timer;
 
         /* Protocol specific pointers */
         
@@ -358,32 +367,62 @@ struct net_device
         void                    *ec_ptr;        /* Econet specific data */
         void                    *ax25_ptr;      /* AX.25 specific data */
 
-        struct list_head        poll_list;      /* Link to poll list    */
+/*
+ * Cache line mostly used on receive path (including eth_type_trans())
+ */
+        struct list_head        poll_list ____cacheline_aligned_in_smp;
+                                        /* Link to poll list    */
+
+        int                     (*poll) (struct net_device *dev, int *quota);
         int                     quota;
         int                     weight;
+        unsigned long           last_rx;        /* Time of last Rx      */
+        /* Interface address info used in eth_type_trans() */
+        unsigned char           dev_addr[MAX_ADDR_LEN]; /* hw address, (before bcast 
+                                                        because most packets are unicast) */
+
+        unsigned char           broadcast[MAX_ADDR_LEN];        /* hw bcast add */
 
+/*
+ * Cache line mostly used on queue transmit path (qdisc)
+ */
+        /* device queue lock */
+        spinlock_t              queue_lock ____cacheline_aligned_in_smp;
         struct Qdisc            *qdisc;
         struct Qdisc            *qdisc_sleeping;
-        struct Qdisc            *qdisc_ingress;
         struct list_head        qdisc_list;
         unsigned long           tx_queue_len;   /* Max frames per queue allowed */
 
         /* ingress path synchronizer */
         spinlock_t              ingress_lock;
+        struct Qdisc            *qdisc_ingress;
+
+/*
+ * One part is mostly used on xmit path (device)
+ */
         /* hard_start_xmit synchronizer */
-        spinlock_t              xmit_lock;
+        spinlock_t              xmit_lock ____cacheline_aligned_in_smp;
         /* cpu id of processor entered to hard_start_xmit or -1,
            if nobody entered there.
          */
         int                     xmit_lock_owner;
-        /* device queue lock */
-        spinlock_t              queue_lock;
+        void                    *priv;  /* pointer to private data      */
+        int                     (*hard_start_xmit) (struct sk_buff *skb,
+                                                    struct net_device *dev);
+        /* These may be needed for future network-power-down code. */
+        unsigned long           trans_start;    /* Time (in jiffies) of last Tx */
+
+        int                     watchdog_timeo; /* used by dev_watchdog() */
+        struct timer_list       watchdog_timer;
+
+/*
+ * refcnt is a very hot point, so align it on SMP
+ */
         /* Number of references to this device */
-        atomic_t                refcnt;
+        atomic_t                refcnt ____cacheline_aligned_in_smp;
+
         /* delayed register/unregister */
         struct list_head        todo_list;
-        /* device name hash chain */
-        struct hlist_node       name_hlist;
         /* device index hash chain */
         struct hlist_node       index_hlist;
 
@@ -396,21 +435,6 @@ struct net_device
                NETREG_RELEASED,         /* called free_netdev */
         } reg_state;
 
-        /* Net device features */
-        unsigned long           features;
-#define NETIF_F_SG              1       /* Scatter/gather IO. */
-#define NETIF_F_IP_CSUM         2       /* Can checksum only TCP/UDP over IPv4. */
-#define NETIF_F_NO_CSUM         4       /* Does not require checksum. F.e. loopack. */
-#define NETIF_F_HW_CSUM         8       /* Can checksum all the packets. */
-#define NETIF_F_HIGHDMA         32      /* Can DMA to high memory. */
-#define NETIF_F_FRAGLIST        64      /* Scatter/gather IO. */
-#define NETIF_F_HW_VLAN_TX      128     /* Transmit VLAN hw acceleration */
-#define NETIF_F_HW_VLAN_RX      256     /* Receive VLAN hw acceleration */
-#define NETIF_F_HW_VLAN_FILTER  512     /* Receive filtering on VLAN */
-#define NETIF_F_VLAN_CHALLENGED 1024    /* Device cannot handle VLAN packets */
-#define NETIF_F_TSO             2048    /* Can offload TCP/IP segmentation */
-#define NETIF_F_LLTX            4096    /* LockLess TX */
-
         /* Called after device is detached from network. */
         void                    (*uninit)(struct net_device *dev);
         /* Called after last user reference disappears. */
@@ -419,10 +443,7 @@ struct net_device
         /* Pointers to interface service routines.      */
         int                     (*open)(struct net_device *dev);
         int                     (*stop)(struct net_device *dev);
-        int                     (*hard_start_xmit) (struct sk_buff *skb,
-                                                    struct net_device *dev);
 #define HAVE_NETDEV_POLL
-        int                     (*poll) (struct net_device *dev, int *quota);
         int                     (*hard_header) (struct sk_buff *skb,
                                                 struct net_device *dev,
                                                 unsigned short type,
diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h
index bace72a76cc4..4ced38736813 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -332,11 +332,28 @@ extern void need_ip_conntrack(void);
 extern int invert_tuplepr(struct ip_conntrack_tuple *inverse,
                           const struct ip_conntrack_tuple *orig);
 
+extern void __ip_ct_refresh_acct(struct ip_conntrack *ct,
+                                 enum ip_conntrack_info ctinfo,
+                                 const struct sk_buff *skb,
+                                 unsigned long extra_jiffies,
+                                 int do_acct);
+
+/* Refresh conntrack for this many jiffies and do accounting */
+static inline void ip_ct_refresh_acct(struct ip_conntrack *ct, 
+                                      enum ip_conntrack_info ctinfo,
+                                      const struct sk_buff *skb,
+                                      unsigned long extra_jiffies)
+{
+        __ip_ct_refresh_acct(ct, ctinfo, skb, extra_jiffies, 1);
+}
+
 /* Refresh conntrack for this many jiffies */
-extern void ip_ct_refresh_acct(struct ip_conntrack *ct,
-                               enum ip_conntrack_info ctinfo,
-                               const struct sk_buff *skb,
-                               unsigned long extra_jiffies);
+static inline void ip_ct_refresh(struct ip_conntrack *ct,
+                                 const struct sk_buff *skb,
+                                 unsigned long extra_jiffies)
+{
+        __ip_ct_refresh_acct(ct, 0, skb, extra_jiffies, 0);
+}
 
 /* These are for NAT.  Icky. */
 /* Update TCP window tracking data when NAT mangles the packet */
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_pptp.h b/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
index 389e3851d52f..816144c75de0 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_pptp.h
@@ -60,8 +60,8 @@ struct ip_ct_pptp_expect {
 
 struct pptp_pkt_hdr {
         __u16   packetLength;
-        __u16   packetType;
-        __u32   magicCookie;
+        __be16  packetType;
+        __be32  magicCookie;
 };
 
 /* PptpControlMessageType values */
@@ -93,7 +93,7 @@ struct pptp_pkt_hdr {
 #define PPTP_REMOVE_DEVICE_ERROR        6
 
 struct PptpControlHeader {
-        __u16   messageType;
+        __be16  messageType;
         __u16   reserved;
 };
 
@@ -106,13 +106,13 @@ struct PptpControlHeader {
 #define PPTP_BEARER_CAP_DIGITAL         0x2
 
 struct PptpStartSessionRequest {
-        __u16   protocolVersion;
+        __be16  protocolVersion;
         __u8    reserved1;
         __u8    reserved2;
-        __u32   framingCapability;
-        __u32   bearerCapability;
-        __u16   maxChannels;
-        __u16   firmwareRevision;
+        __be32  framingCapability;
+        __be32  bearerCapability;
+        __be16  maxChannels;
+        __be16  firmwareRevision;
         __u8    hostName[64];
         __u8    vendorString[64];
 };
@@ -125,13 +125,13 @@ struct PptpStartSessionRequest {
 #define PPTP_START_UNKNOWN_PROTOCOL     5
 
 struct PptpStartSessionReply {
-        __u16   protocolVersion;
+        __be16  protocolVersion;
         __u8    resultCode;
         __u8    generalErrorCode;
-        __u32   framingCapability;
-        __u32   bearerCapability;
-        __u16   maxChannels;
-        __u16   firmwareRevision;
+        __be32  framingCapability;
+        __be32  bearerCapability;
+        __be16  maxChannels;
+        __be16  firmwareRevision;
         __u8    hostName[64];
         __u8    vendorString[64];
 };
@@ -155,7 +155,7 @@ struct PptpStopSessionReply {
 };
 
 struct PptpEchoRequest {
-        __u32 identNumber;
+        __be32 identNumber;
 };
 
 /* PptpEchoReplyResultCode */
@@ -163,7 +163,7 @@ struct PptpEchoRequest {
 #define PPTP_ECHO_GENERAL_ERROR         2
 
 struct PptpEchoReply {
-        __u32   identNumber;
+        __be32  identNumber;
         __u8    resultCode;
         __u8    generalErrorCode;
         __u16   reserved;
@@ -180,16 +180,16 @@ struct PptpEchoReply {
 #define PPTP_DONT_CARE_BEARER_TYPE      3
 
 struct PptpOutCallRequest {
-        __u16   callID;
-        __u16   callSerialNumber;
-        __u32   minBPS;
-        __u32   maxBPS;
-        __u32   bearerType;
-        __u32   framingType;
-        __u16   packetWindow;
-        __u16   packetProcDelay;
+        __be16  callID;
+        __be16  callSerialNumber;
+        __be32  minBPS;
+        __be32  maxBPS;
+        __be32  bearerType;
+        __be32  framingType;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
         __u16   reserved1;
-        __u16   phoneNumberLength;
+        __be16  phoneNumberLength;
         __u16   reserved2;
         __u8    phoneNumber[64];
         __u8    subAddress[64];
@@ -205,24 +205,24 @@ struct PptpOutCallRequest {
 #define PPTP_OUTCALL_DONT_ACCEPT        7
 
 struct PptpOutCallReply {
-        __u16   callID;
-        __u16   peersCallID;
+        __be16  callID;
+        __be16  peersCallID;
         __u8    resultCode;
         __u8    generalErrorCode;
-        __u16   causeCode;
-        __u32   connectSpeed;
-        __u16   packetWindow;
-        __u16   packetProcDelay;
-        __u32   physChannelID;
+        __be16  causeCode;
+        __be32  connectSpeed;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
+        __be32  physChannelID;
 };
 
 struct PptpInCallRequest {
-        __u16   callID;
-        __u16   callSerialNumber;
-        __u32   callBearerType;
-        __u32   physChannelID;
-        __u16   dialedNumberLength;
-        __u16   dialingNumberLength;
+        __be16  callID;
+        __be16  callSerialNumber;
+        __be32  callBearerType;
+        __be32  physChannelID;
+        __be16  dialedNumberLength;
+        __be16  dialingNumberLength;
         __u8    dialedNumber[64];
         __u8    dialingNumber[64];
         __u8    subAddress[64];
@@ -234,61 +234,54 @@ struct PptpInCallRequest {
 #define PPTP_INCALL_DONT_ACCEPT         3
 
 struct PptpInCallReply {
-        __u16   callID;
-        __u16   peersCallID;
+        __be16  callID;
+        __be16  peersCallID;
         __u8    resultCode;
         __u8    generalErrorCode;
-        __u16   packetWindow;
-        __u16   packetProcDelay;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
         __u16   reserved;
 };
 
 struct PptpInCallConnected {
-        __u16   peersCallID;
+        __be16  peersCallID;
         __u16   reserved;
-        __u32   connectSpeed;
-        __u16   packetWindow;
-        __u16   packetProcDelay;
-        __u32   callFramingType;
+        __be32  connectSpeed;
+        __be16  packetWindow;
+        __be16  packetProcDelay;
+        __be32  callFramingType;
 };
 
 struct PptpClearCallRequest {
-        __u16   callID;
+        __be16  callID;
         __u16   reserved;
 };
 
 struct PptpCallDisconnectNotify {
-        __u16   callID;
+        __be16  callID;
         __u8    resultCode;
         __u8    generalErrorCode;
-        __u16   causeCode;
+        __be16  causeCode;
         __u16   reserved;
         __u8    callStatistics[128];
 };
 
 struct PptpWanErrorNotify {
-        __u16   peersCallID;
+        __be16  peersCallID;
         __u16   reserved;
-        __u32   crcErrors;
-        __u32   framingErrors;
-        __u32   hardwareOverRuns;
-        __u32   bufferOverRuns;
-        __u32   timeoutErrors;
-        __u32   alignmentErrors;
+        __be32  crcErrors;
+        __be32  framingErrors;
+        __be32  hardwareOverRuns;
+        __be32  bufferOverRuns;
+        __be32  timeoutErrors;
+        __be32  alignmentErrors;
 };
 
 struct PptpSetLinkInfo {
-        __u16   peersCallID;
+        __be16  peersCallID;
         __u16   reserved;
-        __u32   sendAccm;
-        __u32   recvAccm;
-};
-
-
-struct pptp_priv_data {
-        __u16   call_id;
-        __u16   mcall_id;
-        __u16   pcall_id;
+        __be32  sendAccm;
+        __be32  recvAccm;
 };
 
 union pptp_ctrl_union {
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_tuple.h b/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
index 14dc0f7b6556..20e43f018b7c 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_tuple.h
@@ -17,7 +17,7 @@ union ip_conntrack_manip_proto
         u_int16_t all;
 
         struct {
-                u_int16_t port;
+                __be16 port;
         } tcp;
         struct {
                 u_int16_t port;
@@ -29,7 +29,7 @@ union ip_conntrack_manip_proto
                 u_int16_t port;
         } sctp;
         struct {
-                u_int16_t key;  /* key is 32bit, pptp only uses 16 */
+                __be16 key;     /* key is 32bit, pptp only uses 16 */
         } gre;
 };
 
@@ -65,7 +65,7 @@ struct ip_conntrack_tuple
                                 u_int16_t port;
                         } sctp;
                         struct {
-                                u_int16_t key;  /* key is 32bit, 
+                                __be16 key;     /* key is 32bit, 
                                                  * pptp only uses 16 */
                         } gre;
                 } u;
diff --git a/include/linux/netfilter_ipv4/ip_nat_core.h b/include/linux/netfilter_ipv4/ip_nat_core.h
index 3b50eb91f007..30db23f06b03 100644
--- a/include/linux/netfilter_ipv4/ip_nat_core.h
+++ b/include/linux/netfilter_ipv4/ip_nat_core.h
@@ -5,16 +5,14 @@
 
 /* This header used to share core functionality between the standalone
    NAT module, and the compatibility layer's use of NAT for masquerading. */
-extern int ip_nat_init(void);
-extern void ip_nat_cleanup(void);
 
-extern unsigned int nat_packet(struct ip_conntrack *ct,
+extern unsigned int ip_nat_packet(struct ip_conntrack *ct,
                                enum ip_conntrack_info conntrackinfo,
                                unsigned int hooknum,
                                struct sk_buff **pskb);
 
-extern int icmp_reply_translation(struct sk_buff **pskb,
-                                  struct ip_conntrack *ct,
-                                  enum ip_nat_manip_type manip,
-                                  enum ip_conntrack_dir dir);
+extern int ip_nat_icmp_reply_translation(struct sk_buff **pskb,
+                                         struct ip_conntrack *ct,
+                                         enum ip_nat_manip_type manip,
+                                         enum ip_conntrack_dir dir);
 #endif /* _IP_NAT_CORE_H */
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index c49d28eca561..f74ed9462475 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -185,6 +185,7 @@
 #define PCI_DEVICE_ID_LSI_61C102        0x0901
 #define PCI_DEVICE_ID_LSI_63C815        0x1000
 #define PCI_DEVICE_ID_LSI_SAS1064       0x0050
+#define PCI_DEVICE_ID_LSI_SAS1064R      0x0411
 #define PCI_DEVICE_ID_LSI_SAS1066       0x005E
 #define PCI_DEVICE_ID_LSI_SAS1068       0x0054
 #define PCI_DEVICE_ID_LSI_SAS1064A      0x005C
@@ -392,6 +393,7 @@
 #define PCI_DEVICE_ID_NS_87560_USB      0x0012
 #define PCI_DEVICE_ID_NS_83815          0x0020
 #define PCI_DEVICE_ID_NS_83820          0x0022
+#define PCI_DEVICE_ID_NS_SATURN         0x0035
 #define PCI_DEVICE_ID_NS_SCx200_BRIDGE  0x0500
 #define PCI_DEVICE_ID_NS_SCx200_SMI     0x0501
 #define PCI_DEVICE_ID_NS_SCx200_IDE     0x0502
@@ -559,6 +561,7 @@
 #define PCI_VENDOR_ID_DELL              0x1028
 #define PCI_DEVICE_ID_DELL_RACIII       0x0008
 #define PCI_DEVICE_ID_DELL_RAC4         0x0012
+#define PCI_DEVICE_ID_DELL_PERC5        0x0015
 
 #define PCI_VENDOR_ID_MATROX            0x102B
 #define PCI_DEVICE_ID_MATROX_MGA_2      0x0518
@@ -769,6 +772,8 @@
 #define PCI_DEVICE_ID_TI_TVP4010        0x3d04
 #define PCI_DEVICE_ID_TI_TVP4020        0x3d07
 #define PCI_DEVICE_ID_TI_4450           0x8011
+#define PCI_DEVICE_ID_TI_XX21_XX11      0x8031
+#define PCI_DEVICE_ID_TI_X515           0x8036
 #define PCI_DEVICE_ID_TI_1130           0xac12
 #define PCI_DEVICE_ID_TI_1031           0xac13
 #define PCI_DEVICE_ID_TI_1131           0xac15
@@ -785,12 +790,17 @@
 #define PCI_DEVICE_ID_TI_4451           0xac42
 #define PCI_DEVICE_ID_TI_4510           0xac44
 #define PCI_DEVICE_ID_TI_4520           0xac46
+#define PCI_DEVICE_ID_TI_7510           0xac47
+#define PCI_DEVICE_ID_TI_7610           0xac48
+#define PCI_DEVICE_ID_TI_7410           0xac49
 #define PCI_DEVICE_ID_TI_1410           0xac50
 #define PCI_DEVICE_ID_TI_1420           0xac51
 #define PCI_DEVICE_ID_TI_1451A          0xac52
 #define PCI_DEVICE_ID_TI_1620           0xac54
 #define PCI_DEVICE_ID_TI_1520           0xac55
 #define PCI_DEVICE_ID_TI_1510           0xac56
+#define PCI_DEVICE_ID_TI_X620           0xac8d
+#define PCI_DEVICE_ID_TI_X420           0xac8e
 
 #define PCI_VENDOR_ID_SONY              0x104d
 #define PCI_DEVICE_ID_SONY_CXD3222      0x8039
@@ -976,6 +986,7 @@
 #define PCI_DEVICE_ID_SUN_SABRE         0xa000
 #define PCI_DEVICE_ID_SUN_HUMMINGBIRD   0xa001
 #define PCI_DEVICE_ID_SUN_TOMATILLO     0xa801
+#define PCI_DEVICE_ID_SUN_CASSINI       0xabba
 
 #define PCI_VENDOR_ID_CMD               0x1095
 #define PCI_DEVICE_ID_CMD_640           0x0640
@@ -1268,7 +1279,8 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA  0x0266
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_SATA2 0x0267
 #define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE   0x036E
-#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA  0x036F
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA  0x037E
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_SATA2 0x037F
 #define PCI_DEVICE_ID_NVIDIA_NVENET_12          0x0268
 #define PCI_DEVICE_ID_NVIDIA_NVENET_13          0x0269
 #define PCI_DEVICE_ID_NVIDIA_MCP51_AUDIO        0x026B
@@ -2186,7 +2198,12 @@
 #define PCI_DEVICE_ID_ENE_1211          0x1211
 #define PCI_DEVICE_ID_ENE_1225          0x1225
 #define PCI_DEVICE_ID_ENE_1410          0x1410
+#define PCI_DEVICE_ID_ENE_710           0x1411
+#define PCI_DEVICE_ID_ENE_712           0x1412
 #define PCI_DEVICE_ID_ENE_1420          0x1420
+#define PCI_DEVICE_ID_ENE_720           0x1421
+#define PCI_DEVICE_ID_ENE_722           0x1422
+
 #define PCI_VENDOR_ID_CHELSIO           0x1425
 
 #define PCI_VENDOR_ID_MIPS              0x153f
diff --git a/include/linux/reboot.h b/include/linux/reboot.h
index 3b3266ff1a95..7ab2cdb83ef0 100644
--- a/include/linux/reboot.h
+++ b/include/linux/reboot.h
@@ -59,6 +59,10 @@ extern void machine_crash_shutdown(struct pt_regs *);
  * Architecture independent implemenations of sys_reboot commands.
  */
 
+extern void kernel_restart_prepare(char *cmd);
+extern void kernel_halt_prepare(void);
+extern void kernel_power_off_prepare(void);
+
 extern void kernel_restart(char *cmd);
 extern void kernel_halt(void);
 extern void kernel_power_off(void);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 49e617fa0f66..c3ba31f210a9 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -107,13 +107,25 @@ extern unsigned long nr_iowait(void);
 
 #include <asm/processor.h>
 
+/*
+ * Task state bitmask. NOTE! These bits are also
+ * encoded in fs/proc/array.c: get_task_state().
+ *
+ * We have two separate sets of flags: task->state
+ * is about runnability, while task->exit_state are
+ * about the task exiting. Confusing, but this way
+ * modifying one set can't modify the other one by
+ * mistake.
+ */
 #define TASK_RUNNING            0
 #define TASK_INTERRUPTIBLE      1
 #define TASK_UNINTERRUPTIBLE    2
 #define TASK_STOPPED            4
 #define TASK_TRACED             8
+/* in tsk->exit_state */
 #define EXIT_ZOMBIE             16
 #define EXIT_DEAD               32
+/* in tsk->state again */
 #define TASK_NONINTERACTIVE     64
 
 #define __set_task_state(tsk, state_value)              \
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 2741c0c55e83..466c879f82b8 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -155,8 +155,6 @@ struct skb_shared_info {
 #define SKB_DATAREF_SHIFT 16
 #define SKB_DATAREF_MASK ((1 << SKB_DATAREF_SHIFT) - 1)
 
-extern struct timeval skb_tv_base;
-
 struct skb_timeval {
         u32     off_sec;
         u32     off_usec;
@@ -175,7 +173,7 @@ enum {
  *      @prev: Previous buffer in list
  *      @list: List we are on
  *      @sk: Socket we are owned by
- *      @tstamp: Time we arrived stored as offset to skb_tv_base
+ *      @tstamp: Time we arrived
  *      @dev: Device we arrived on/are leaving by
  *      @input_dev: Device we arrived on
  *      @h: Transport layer header
@@ -1255,10 +1253,6 @@ static inline void skb_get_timestamp(const struct sk_buff *skb, struct timeval *
 {
         stamp->tv_sec  = skb->tstamp.off_sec;
         stamp->tv_usec = skb->tstamp.off_usec;
-        if (skb->tstamp.off_sec) {
-                stamp->tv_sec  += skb_tv_base.tv_sec;
-                stamp->tv_usec += skb_tv_base.tv_usec;
-        }
 }
 
 /**
@@ -1272,8 +1266,8 @@ static inline void skb_get_timestamp(const struct sk_buff *skb, struct timeval *
  */
 static inline void skb_set_timestamp(struct sk_buff *skb, const struct timeval *stamp)
 {
-        skb->tstamp.off_sec  = stamp->tv_sec - skb_tv_base.tv_sec;
-        skb->tstamp.off_usec = stamp->tv_usec - skb_tv_base.tv_usec;
+        skb->tstamp.off_sec  = stamp->tv_sec;
+        skb->tstamp.off_usec = stamp->tv_usec;
 }
 
 extern void __net_timestamp(struct sk_buff *skb);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 3a29a9f9b451..fc8e367f671e 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -202,7 +202,8 @@ enum
         NET_TR=14,
         NET_DECNET=15,
         NET_ECONET=16,
-        NET_SCTP=17, 
+        NET_SCTP=17,
+        NET_LLC=18,
 };
 
 /* /proc/sys/kernel/random */
@@ -522,6 +523,29 @@ enum {
         NET_IPX_FORWARDING=2
 };
 
+/* /proc/sys/net/llc */
+enum {
+        NET_LLC2=1,
+        NET_LLC_STATION=2,
+};
+
+/* /proc/sys/net/llc/llc2 */
+enum {
+        NET_LLC2_TIMEOUT=1,
+};
+
+/* /proc/sys/net/llc/station */
+enum {
+        NET_LLC_STATION_ACK_TIMEOUT=1,
+};
+
+/* /proc/sys/net/llc/llc2/timeout */
+enum {
+        NET_LLC2_ACK_TIMEOUT=1,
+        NET_LLC2_P_TIMEOUT=2,
+        NET_LLC2_REJ_TIMEOUT=3,
+        NET_LLC2_BUSY_TIMEOUT=4,
+};
 
 /* /proc/sys/net/appletalk */
 enum {
diff --git a/include/linux/tc_ematch/tc_em_meta.h b/include/linux/tc_ematch/tc_em_meta.h
index 081b1ee8516e..e21937cf91d0 100644
--- a/include/linux/tc_ematch/tc_em_meta.h
+++ b/include/linux/tc_ematch/tc_em_meta.h
@@ -71,7 +71,7 @@ enum
         TCF_META_ID_SK_SNDBUF,
         TCF_META_ID_SK_ALLOCS,
         TCF_META_ID_SK_ROUTE_CAPS,
-        TCF_META_ID_SK_HASHENT,
+        TCF_META_ID_SK_HASH,
         TCF_META_ID_SK_LINGERTIME,
         TCF_META_ID_SK_ACK_BACKLOG,
         TCF_META_ID_SK_MAX_ACK_BACKLOG,
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index 03df3b157960..5a2beed5a770 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -26,19 +26,18 @@
 struct inet_hashinfo;
 
 /* I have no idea if this is a good hash for v6 or not. -DaveM */
-static inline int inet6_ehashfn(const struct in6_addr *laddr, const u16 lport,
-                                const struct in6_addr *faddr, const u16 fport,
-                                const int ehash_size)
+static inline unsigned int inet6_ehashfn(const struct in6_addr *laddr, const u16 lport,
+                                const struct in6_addr *faddr, const u16 fport)
 {
-        int hashent = (lport ^ fport);
+        unsigned int hashent = (lport ^ fport);
 
         hashent ^= (laddr->s6_addr32[3] ^ faddr->s6_addr32[3]);
         hashent ^= hashent >> 16;
         hashent ^= hashent >> 8;
-        return (hashent & (ehash_size - 1));
+        return hashent;
 }
 
-static inline int inet6_sk_ehashfn(const struct sock *sk, const int ehash_size)
+static inline int inet6_sk_ehashfn(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -46,7 +45,7 @@ static inline int inet6_sk_ehashfn(const struct sock *sk, const int ehash_size)
         const struct in6_addr *faddr = &np->daddr;
         const __u16 lport = inet->num;
         const __u16 fport = inet->dport;
-        return inet6_ehashfn(laddr, lport, faddr, fport, ehash_size);
+        return inet6_ehashfn(laddr, lport, faddr, fport);
 }
 
 /*
@@ -69,14 +68,14 @@ static inline struct sock *
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
-        const int hash = inet6_ehashfn(daddr, hnum, saddr, sport,
-                                       hashinfo->ehash_size);
-        struct inet_ehash_bucket *head = &hashinfo->ehash[hash];
+        unsigned int hash = inet6_ehashfn(daddr, hnum, saddr, sport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
 
+        prefetch(head->chain.first);
         read_lock(&head->lock);
         sk_for_each(sk, node, &head->chain) {
                 /* For IPV6 do the cheaper port and family tests first. */
-                if (INET6_MATCH(sk, saddr, daddr, ports, dif))
+                if (INET6_MATCH(sk, hash, saddr, daddr, ports, dif))
                         goto hit; /* You sunk my battleship! */
         }
         /* Must check for a TIME_WAIT'er before going to listener hash. */
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 646b6ea7fe26..35f49e65e295 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -108,7 +108,7 @@ struct inet_hashinfo {
         struct inet_bind_hashbucket     *bhash;
 
         int                             bhash_size;
-        int                             ehash_size;
+        unsigned int                    ehash_size;
 
         /* All sockets in TCP_LISTEN state will be in here.  This is the only
          * table where wildcard'd TCP sockets can exist.  Hash function here
@@ -130,17 +130,16 @@ struct inet_hashinfo {
         int                             port_rover;
 };
 
-static inline int inet_ehashfn(const __u32 laddr, const __u16 lport,
-                               const __u32 faddr, const __u16 fport,
-                               const int ehash_size)
+static inline unsigned int inet_ehashfn(const __u32 laddr, const __u16 lport,
+                               const __u32 faddr, const __u16 fport)
 {
-        int h = (laddr ^ lport) ^ (faddr ^ fport);
+        unsigned int h = (laddr ^ lport) ^ (faddr ^ fport);
         h ^= h >> 16;
         h ^= h >> 8;
-        return h & (ehash_size - 1);
+        return h;
 }
 
-static inline int inet_sk_ehashfn(const struct sock *sk, const int ehash_size)
+static inline int inet_sk_ehashfn(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
         const __u32 laddr = inet->rcv_saddr;
@@ -148,7 +147,14 @@ static inline int inet_sk_ehashfn(const struct sock *sk, const int ehash_size)
         const __u32 faddr = inet->daddr;
         const __u16 fport = inet->dport;
 
-        return inet_ehashfn(laddr, lport, faddr, fport, ehash_size);
+        return inet_ehashfn(laddr, lport, faddr, fport);
+}
+
+static inline struct inet_ehash_bucket *inet_ehash_bucket(
+        struct inet_hashinfo *hashinfo,
+        unsigned int hash)
+{
+        return &hashinfo->ehash[hash & (hashinfo->ehash_size - 1)];
 }
 
 extern struct inet_bind_bucket *
@@ -235,9 +241,11 @@ static inline void __inet_hash(struct inet_hashinfo *hashinfo,
                 lock = &hashinfo->lhash_lock;
                 inet_listen_wlock(hashinfo);
         } else {
-                sk->sk_hashent = inet_sk_ehashfn(sk, hashinfo->ehash_size);
-                list = &hashinfo->ehash[sk->sk_hashent].chain;
-                lock = &hashinfo->ehash[sk->sk_hashent].lock;
+                struct inet_ehash_bucket *head;
+                sk->sk_hash = inet_sk_ehashfn(sk);
+                head = inet_ehash_bucket(hashinfo, sk->sk_hash);
+                list = &head->chain;
+                lock = &head->lock;
                 write_lock(lock);
         }
         __sk_add_node(sk, list);
@@ -268,9 +276,8 @@ static inline void inet_unhash(struct inet_hashinfo *hashinfo, struct sock *sk)
                 inet_listen_wlock(hashinfo);
                 lock = &hashinfo->lhash_lock;
         } else {
-                struct inet_ehash_bucket *head = &hashinfo->ehash[sk->sk_hashent];
-                lock = &head->lock;
-                write_lock_bh(&head->lock);
+                lock = &inet_ehash_bucket(hashinfo, sk->sk_hash)->lock;
+                write_lock_bh(lock);
         }
 
         if (__sk_del_node_init(sk))
@@ -337,23 +344,27 @@ sherry_cache:
 #define INET_ADDR_COOKIE(__name, __saddr, __daddr) \
         const __u64 __name = (((__u64)(__daddr)) << 32) | ((__u64)(__saddr));
 #endif /* __BIG_ENDIAN */
-#define INET_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
-        (((*((__u64 *)&(inet_sk(__sk)->daddr))) == (__cookie))  &&      \
+#define INET_MATCH(__sk, __hash, __cookie, __saddr, __daddr, __ports, __dif)\
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         ((*((__u64 *)&(inet_sk(__sk)->daddr))) == (__cookie))  &&      \
          ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   &&      \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)\
-        (((*((__u64 *)&(inet_twsk(__sk)->tw_daddr))) == (__cookie)) &&  \
+#define INET_TW_MATCH(__sk, __hash, __cookie, __saddr, __daddr, __ports, __dif)\
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         ((*((__u64 *)&(inet_twsk(__sk)->tw_daddr))) == (__cookie)) &&  \
          ((*((__u32 *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&   \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
 #else /* 32-bit arch */
 #define INET_ADDR_COOKIE(__name, __saddr, __daddr)
-#define INET_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif)    \
-        ((inet_sk(__sk)->daddr          == (__saddr))           &&      \
+#define INET_MATCH(__sk, __hash, __cookie, __saddr, __daddr, __ports, __dif)    \
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         (inet_sk(__sk)->daddr          == (__saddr))           &&      \
          (inet_sk(__sk)->rcv_saddr      == (__daddr))           &&      \
          ((*((__u32 *)&(inet_sk(__sk)->dport))) == (__ports))   &&      \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
-#define INET_TW_MATCH(__sk, __cookie, __saddr, __daddr, __ports, __dif) \
-        ((inet_twsk(__sk)->tw_daddr     == (__saddr))           &&      \
+#define INET_TW_MATCH(__sk, __hash,__cookie, __saddr, __daddr, __ports, __dif)  \
+        (((__sk)->sk_hash == (__hash))                          &&      \
+         (inet_twsk(__sk)->tw_daddr     == (__saddr))           &&      \
          (inet_twsk(__sk)->tw_rcv_saddr == (__daddr))           &&      \
          ((*((__u32 *)&(inet_twsk(__sk)->tw_dport))) == (__ports)) &&   \
          (!((__sk)->sk_bound_dev_if) || ((__sk)->sk_bound_dev_if == (__dif))))
@@ -378,18 +389,19 @@ static inline struct sock *
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
-        const int hash = inet_ehashfn(daddr, hnum, saddr, sport, hashinfo->ehash_size);
-        struct inet_ehash_bucket *head = &hashinfo->ehash[hash];
+        unsigned int hash = inet_ehashfn(daddr, hnum, saddr, sport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
 
+        prefetch(head->chain.first);
         read_lock(&head->lock);
         sk_for_each(sk, node, &head->chain) {
-                if (INET_MATCH(sk, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk, hash, acookie, saddr, daddr, ports, dif))
                         goto hit; /* You sunk my battleship! */
         }
 
         /* Must check for a TIME_WAIT'er before going to listener hash. */
         sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
-                if (INET_TW_MATCH(sk, acookie, saddr, daddr, ports, dif))
+                if (INET_TW_MATCH(sk, hash, acookie, saddr, daddr, ports, dif))
                         goto hit;
         }
         sk = NULL;
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 3b070352e869..4ade56ef3a4d 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -112,6 +112,7 @@ struct inet_timewait_sock {
 #define tw_node                 __tw_common.skc_node
 #define tw_bind_node            __tw_common.skc_bind_node
 #define tw_refcnt               __tw_common.skc_refcnt
+#define tw_hash                 __tw_common.skc_hash
 #define tw_prot                 __tw_common.skc_prot
         volatile unsigned char  tw_substate;
         /* 3 bits hole, try to pack */
@@ -126,7 +127,6 @@ struct inet_timewait_sock {
         /* And these are ours. */
         __u8                    tw_ipv6only:1;
         /* 31 bits hole, try to pack */
-        int                     tw_hashent;
         int                     tw_timeout;
         unsigned long           tw_ttd;
         struct inet_bind_bucket *tw_tb;
diff --git a/include/net/llc.h b/include/net/llc.h
index 71769a5aeef3..1adb2ef3f6f7 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -17,6 +17,8 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 
+#include <asm/atomic.h>
+
 struct net_device;
 struct packet_type;
 struct sk_buff;
@@ -44,6 +46,7 @@ struct llc_sap {
         unsigned char    state;
         unsigned char    p_bit;
         unsigned char    f_bit;
+        atomic_t         refcnt;
         int              (*rcv_func)(struct sk_buff *skb,
                                      struct net_device *dev,
                                      struct packet_type *pt,
@@ -81,13 +84,27 @@ extern struct llc_sap *llc_sap_open(unsigned char lsap,
                                                struct net_device *dev,
                                                struct packet_type *pt,
                                                struct net_device *orig_dev));
+static inline void llc_sap_hold(struct llc_sap *sap)
+{
+        atomic_inc(&sap->refcnt);
+}
+
 extern void llc_sap_close(struct llc_sap *sap);
 
+static inline void llc_sap_put(struct llc_sap *sap)
+{
+        if (atomic_dec_and_test(&sap->refcnt))
+                llc_sap_close(sap);
+}
+
 extern struct llc_sap *llc_sap_find(unsigned char sap_value);
 
 extern int llc_build_and_send_ui_pkt(struct llc_sap *sap, struct sk_buff *skb,
                                      unsigned char *dmac, unsigned char dsap);
 
+extern void llc_sap_handler(struct llc_sap *sap, struct sk_buff *skb);
+extern void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb);
+
 extern int llc_station_init(void);
 extern void llc_station_exit(void);
 
@@ -98,4 +115,17 @@ extern void llc_proc_exit(void);
 #define llc_proc_init() (0)
 #define llc_proc_exit() do { } while(0)
 #endif /* CONFIG_PROC_FS */
+#ifdef CONFIG_SYSCTL
+extern int llc_sysctl_init(void);
+extern void llc_sysctl_exit(void);
+
+extern int sysctl_llc2_ack_timeout;
+extern int sysctl_llc2_busy_timeout;
+extern int sysctl_llc2_p_timeout;
+extern int sysctl_llc2_rej_timeout;
+extern int sysctl_llc_station_ack_timeout;
+#else
+#define llc_sysctl_init() (0)
+#define llc_sysctl_exit() do { } while(0)
+#endif /* CONFIG_SYSCTL */
 #endif /* LLC_H */
diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
index 8ad3bc2c23d7..54852ff6033b 100644
--- a/include/net/llc_conn.h
+++ b/include/net/llc_conn.h
@@ -19,14 +19,14 @@
 #define LLC_EVENT                1
 #define LLC_PACKET               2
 
-#define LLC_P_TIME               2
-#define LLC_ACK_TIME             1
-#define LLC_REJ_TIME             3
-#define LLC_BUSY_TIME            3
+#define LLC2_P_TIME               2
+#define LLC2_ACK_TIME             1
+#define LLC2_REJ_TIME             3
+#define LLC2_BUSY_TIME            3
 
 struct llc_timer {
         struct timer_list timer;
-        u16               expire;       /* timer expire time */
+        unsigned long     expire;       /* timer expire time */
 };
 
 struct llc_sock {
@@ -38,6 +38,7 @@ struct llc_sock {
         struct llc_addr     laddr;              /* lsap/mac pair */
         struct llc_addr     daddr;              /* dsap/mac pair */
         struct net_device   *dev;               /* device to send to remote */
+        u32                 copied_seq;         /* head of yet unread data */
         u8                  retry_count;        /* number of retries */
         u8                  ack_must_be_send;
         u8                  first_pdu_Ns;
@@ -92,7 +93,8 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb)
         return skb->cb[sizeof(skb->cb) - 1];
 }
 
-extern struct sock *llc_sk_alloc(int family, int priority, struct proto *prot);
+extern struct sock *llc_sk_alloc(int family, unsigned int __nocast priority,
+                                 struct proto *prot);
 extern void llc_sk_free(struct sock *sk);
 
 extern void llc_sk_reset(struct sock *sk);
@@ -115,5 +117,4 @@ extern void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk);
 
 extern u8 llc_data_accept_state(u8 state);
 extern void llc_build_offset_table(void);
-extern int llc_release_sockets(struct llc_sap *sap);
 #endif /* LLC_CONN_H */
diff --git a/include/net/llc_sap.h b/include/net/llc_sap.h
index 353baaa627f3..2c56dbece729 100644
--- a/include/net/llc_sap.h
+++ b/include/net/llc_sap.h
@@ -12,11 +12,15 @@
  * See the GNU General Public License for more details.
  */
 struct llc_sap;
+struct net_device;
 struct sk_buff;
+struct sock;
 
 extern void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb);
-extern void llc_save_primitive(struct sk_buff* skb, unsigned char prim);
-extern struct sk_buff *llc_alloc_frame(void);
+extern void llc_save_primitive(struct sock *sk, struct sk_buff* skb,
+                               unsigned char prim);
+extern struct sk_buff *llc_alloc_frame(struct sock *sk,
+                                       struct net_device *dev);
 
 extern void llc_build_and_send_test_pkt(struct llc_sap *sap,
                                         struct sk_buff *skb,
diff --git a/include/net/sock.h b/include/net/sock.h
index 8c48fbecb7cf..b6440805c420 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -99,6 +99,7 @@ struct proto;
  *      @skc_node: main hash linkage for various protocol lookup tables
  *      @skc_bind_node: bind hash linkage for various protocol lookup tables
  *      @skc_refcnt: reference count
+ *      @skc_hash: hash value used with various protocol lookup tables
  *      @skc_prot: protocol handlers inside a network family
  *
  *      This is the minimal network layer representation of sockets, the header
@@ -112,6 +113,7 @@ struct sock_common {
         struct hlist_node       skc_node;
         struct hlist_node       skc_bind_node;
         atomic_t                skc_refcnt;
+        unsigned int            skc_hash;
         struct proto            *skc_prot;
 };
 
@@ -139,7 +141,6 @@ struct sock_common {
   *     @sk_no_check: %SO_NO_CHECK setting, wether or not checkup packets
   *     @sk_route_caps: route capabilities (e.g. %NETIF_F_TSO)
   *     @sk_lingertime: %SO_LINGER l_linger setting
-  *     @sk_hashent: hash entry in several tables (e.g. inet_hashinfo.ehash)
   *     @sk_backlog: always used with the per-socket spinlock held
   *     @sk_callback_lock: used with the callbacks in the end of this struct
   *     @sk_error_queue: rarely used
@@ -186,6 +187,7 @@ struct sock {
 #define sk_node                 __sk_common.skc_node
 #define sk_bind_node            __sk_common.skc_bind_node
 #define sk_refcnt               __sk_common.skc_refcnt
+#define sk_hash                 __sk_common.skc_hash
 #define sk_prot                 __sk_common.skc_prot
         unsigned char           sk_shutdown : 2,
                                 sk_no_check : 2,
@@ -208,7 +210,6 @@ struct sock {
         unsigned int            sk_allocation;
         int                     sk_sndbuf;
         int                     sk_route_caps;
-        int                     sk_hashent;
         unsigned long           sk_flags;
         unsigned long           sk_lingertime;
         /*
diff --git a/include/pcmcia/ss.h b/include/pcmcia/ss.h
index 0f7aacc33fe9..c8592c7e8eaa 100644
--- a/include/pcmcia/ss.h
+++ b/include/pcmcia/ss.h
@@ -21,6 +21,9 @@
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
 #include <pcmcia/bulkmem.h>
+#ifdef CONFIG_CARDBUS
+#include <linux/pci.h>
+#endif
 
 /* Definitions for card status flags for GetStatus */
 #define SS_WRPROT       0x0001
@@ -233,7 +236,11 @@ struct pcmcia_socket {
 
         /* so is power hook */
         int (*power_hook)(struct pcmcia_socket *sock, int operation);
-                           
+#ifdef CONFIG_CARDBUS
+        /* allows tuning the CB bridge before loading driver for the CB card */
+        void (*tune_bridge)(struct pcmcia_socket *sock, struct pci_bus *bus);
+#endif
+
         /* state thread */
         struct semaphore                skt_sem;        /* protects socket h/w state */
 
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index e16cf94870f2..e6f4c9e55df7 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -665,7 +665,6 @@ struct ib_ucontext {
         struct list_head        qp_list;
         struct list_head        srq_list;
         struct list_head        ah_list;
-        spinlock_t              lock;
 };
 
 struct ib_uobject {
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index c0e4c67d836f..7ece05666feb 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -163,6 +163,7 @@ struct scsi_target {
         unsigned int            id; /* target id ... replace
                                      * scsi_device.id eventually */
         unsigned long           create:1; /* signal that it needs to be added */
+        char                    scsi_level;
         void                    *hostdata; /* available to low-level driver */
         unsigned long           starget_data[0]; /* for the transport */
         /* starget_data must be the last element!!!! */