203 files changed, 4294 insertions, 1960 deletions

diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
index c8bce82ddcac..89b1d196ca80 100644
--- a/Documentation/filesystems/sysfs.txt
+++ b/Documentation/filesystems/sysfs.txt
@@ -246,6 +246,7 @@ class/
 devices/
 firmware/
 net/
+fs/
 
 devices/ contains a filesystem representation of the device tree. It maps
 directly to the internal kernel device tree, which is a hierarchy of
@@ -264,6 +265,10 @@ drivers/ contains a directory for each device driver that is loaded
 for devices on that particular bus (this assumes that drivers do not
 span multiple bus types).
 
+fs/ contains a directory for some filesystems.  Currently each
+filesystem wanting to export attributes must create its own hierarchy
+below fs/ (see ./fuse.txt for an example).
+
 
 More information can driver-model specific features can be found in
 Documentation/driver-model/. 
diff --git a/MAINTAINERS b/MAINTAINERS
index 61060e82fb0e..d6a8e5b434ec 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -421,6 +421,14 @@ L:	linux-hams@vger.kernel.org
 W:      http://www.baycom.org/~tom/ham/ham.html
 S:      Maintained
 
+BCM43XX WIRELESS DRIVER
+P:      Michael Buesch
+M:      mb@bu3sch.de
+P:      Stefano Brivio
+M:      st3@riseup.net
+W:      http://bcm43xx.berlios.de/
+S:      Maintained
+
 BEFS FILE SYSTEM
 P:      Sergey S. Kostyliov
 M:      rathamahata@php4.ru
@@ -2065,8 +2073,12 @@ P:	Matthew Wilcox
 M:      matthew@wil.cx
 P:      Grant Grundler
 M:      grundler@parisc-linux.org
+P:      Kyle McMartin
+M:      kyle@parisc-linux.org
 L:      parisc-linux@parisc-linux.org
 W:      http://www.parisc-linux.org/
+T:      git kernel.org:/pub/scm/linux/kernel/git/kyle/parisc-2.6.git
+T:      cvs cvs.parisc-linux.org:/var/cvs/linux-2.6
 S:      Maintained
 
 PCI ERROR RECOVERY
diff --git a/Makefile b/Makefile
index a940eaefe1c4..6bf99624bd4c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 17
-EXTRAVERSION =-rc2
+EXTRAVERSION =-rc3
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/lib/strncpy.S b/arch/alpha/lib/strncpy.S
index 338551c7113c..bbdef1be5f95 100644
--- a/arch/alpha/lib/strncpy.S
+++ b/arch/alpha/lib/strncpy.S
@@ -43,8 +43,8 @@ strncpy:
 
         .align  4
 $multiword:
-        subq    $24, 1, $2      # clear the final bits in the prev word
-        or      $2, $24, $2
+        subq    $27, 1, $2      # clear the final bits in the prev word
+        or      $2, $27, $2
         zapnot  $1, $2, $1
         subq    $18, 1, $18
 
@@ -70,8 +70,8 @@ $multiword:
         bne     $18, 0b
 
 1:      ldq_u   $1, 0($16)      # clear the leading bits in the final word
-        subq    $27, 1, $2
-        or      $2, $27, $2
+        subq    $24, 1, $2
+        or      $2, $24, $2
 
         zap     $1, $2, $1
         stq_u   $1, 0($16)
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 95a96275f88a..6f8e84c1c1f2 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -66,7 +66,7 @@ tune-$(CONFIG_CPU_XSC3)		:=$(call cc-option,-mtune=xscale,-mtune=strongarm110) -
 tune-$(CONFIG_CPU_V6)           :=$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
 
 ifeq ($(CONFIG_AEABI),y)
-CFLAGS_ABI      :=-mabi=aapcs -mno-thumb-interwork
+CFLAGS_ABI      :=-mabi=aapcs-linux -mno-thumb-interwork
 else
 CFLAGS_ABI      :=$(call cc-option,-mapcs-32,-mabi=apcs-gnu) $(call cc-option,-mno-thumb-interwork,)
 endif
diff --git a/arch/arm/configs/ep93xx_defconfig b/arch/arm/configs/ep93xx_defconfig
index 8dcc8e8ec813..b69e88bbc909 100644
--- a/arch/arm/configs/ep93xx_defconfig
+++ b/arch/arm/configs/ep93xx_defconfig
@@ -1,12 +1,14 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16
-# Mon Mar 20 14:54:51 2006
+# Linux kernel version: 2.6.17-rc2
+# Wed Apr 19 21:21:01 2006
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_VECTORS_BASE=0xffff0000
 
 #
 # Code maturity level options
@@ -28,6 +30,7 @@ CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_UID16=y
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -43,10 +46,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -59,7 +58,6 @@ CONFIG_OBSOLETE_INTERMODULE=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_OBSOLETE_MODPARM=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
@@ -67,6 +65,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -94,6 +93,7 @@ CONFIG_ARCH_EP93XX=y
 # CONFIG_ARCH_IOP3XX is not set
 # CONFIG_ARCH_IXP4XX is not set
 # CONFIG_ARCH_IXP2000 is not set
+# CONFIG_ARCH_IXP23XX is not set
 # CONFIG_ARCH_L7200 is not set
 # CONFIG_ARCH_PXA is not set
 # CONFIG_ARCH_RPC is not set
@@ -112,7 +112,6 @@ CONFIG_ARCH_EP93XX=y
 #
 # Cirrus EP93xx Implementation Options
 #
-CONFIG_CRUNCH=y
 
 #
 # EP93xx Platforms
@@ -232,12 +231,15 @@ CONFIG_SYN_COOKIES=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_BIC=y
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETFILTER is not set
 
 #
@@ -346,7 +348,6 @@ CONFIG_MTD_CFI_I2=y
 # CONFIG_MTD_OTP is not set
 CONFIG_MTD_CFI_INTELEXT=y
 CONFIG_MTD_CFI_AMDSTD=y
-CONFIG_MTD_CFI_AMDSTD_RETRY=0
 CONFIG_MTD_CFI_STAA=y
 CONFIG_MTD_CFI_UTIL=y
 # CONFIG_MTD_RAM is not set
@@ -371,7 +372,6 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=1
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
-# CONFIG_MTD_BLKMTD is not set
 # CONFIG_MTD_BLOCK2MTD is not set
 
 #
@@ -412,7 +412,7 @@ CONFIG_MTD_NAND_IDS=y
 # CONFIG_BLK_DEV_NBD is not set
 # CONFIG_BLK_DEV_UB is not set
 # CONFIG_BLK_DEV_RAM is not set
-CONFIG_BLK_DEV_RAM_COUNT=16
+# CONFIG_BLK_DEV_INITRD is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -576,13 +576,13 @@ CONFIG_WATCHDOG=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
+CONFIG_EP93XX_WATCHDOG=y
 
 #
 # USB-based Watchdog Cards
 #
 # CONFIG_USBPCWATCHDOG is not set
 # CONFIG_NVRAM is not set
-# CONFIG_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 
@@ -626,9 +626,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 CONFIG_I2C_DEBUG_CORE=y
 CONFIG_I2C_DEBUG_ALGO=y
 CONFIG_I2C_DEBUG_BUS=y
@@ -690,7 +688,16 @@ CONFIG_HWMON=y
 #
 
 #
-# Multimedia Capabilities Port drivers
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
 #
 
 #
@@ -702,6 +709,7 @@ CONFIG_HWMON=y
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
@@ -718,6 +726,7 @@ CONFIG_HWMON=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
+# CONFIG_USB_ARCH_HAS_EHCI is not set
 CONFIG_USB=y
 CONFIG_USB_DEBUG=y
 
@@ -776,15 +785,6 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_MICROTEK is not set
 
 #
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-
-#
-# Video4Linux support is needed for USB Multimedia device support
-#
-
-#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -813,6 +813,7 @@ CONFIG_USB_SERIAL_CONSOLE=y
 # CONFIG_USB_SERIAL_CYPRESS_M8 is not set
 # CONFIG_USB_SERIAL_EMPEG is not set
 # CONFIG_USB_SERIAL_FTDI_SIO is not set
+# CONFIG_USB_SERIAL_FUNSOFT is not set
 # CONFIG_USB_SERIAL_VISOR is not set
 # CONFIG_USB_SERIAL_IPAQ is not set
 # CONFIG_USB_SERIAL_IR is not set
@@ -825,6 +826,7 @@ CONFIG_USB_SERIAL_CONSOLE=y
 # CONFIG_USB_SERIAL_KLSI is not set
 # CONFIG_USB_SERIAL_KOBIL_SCT is not set
 # CONFIG_USB_SERIAL_MCT_U232 is not set
+# CONFIG_USB_SERIAL_NAVMAN is not set
 CONFIG_USB_SERIAL_PL2303=y
 # CONFIG_USB_SERIAL_HP4X is not set
 # CONFIG_USB_SERIAL_SAFE is not set
@@ -865,6 +867,32 @@ CONFIG_USB_SERIAL_PL2303=y
 # CONFIG_MMC is not set
 
 #
+# Real Time Clock
+#
+CONFIG_RTC_LIB=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+
+#
+# RTC drivers
+#
+# CONFIG_RTC_DRV_X1205 is not set
+# CONFIG_RTC_DRV_DS1672 is not set
+# CONFIG_RTC_DRV_PCF8563 is not set
+# CONFIG_RTC_DRV_RS5C372 is not set
+CONFIG_RTC_DRV_M48T86=y
+CONFIG_RTC_DRV_EP93XX=y
+# CONFIG_RTC_DRV_TEST is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -912,7 +940,6 @@ CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -1044,6 +1071,7 @@ CONFIG_LOG_BUF_SHIFT=14
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 CONFIG_DEBUG_SLAB=y
+# CONFIG_DEBUG_SLAB_LEAK is not set
 CONFIG_DEBUG_MUTEXES=y
 CONFIG_DEBUG_SPINLOCK=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
@@ -1053,6 +1081,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
 CONFIG_FRAME_POINTER=y
+# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
diff --git a/arch/arm/configs/ixp2000_defconfig b/arch/arm/configs/ixp2000_defconfig
index 7b02ca04c3ee..e6f3e4873d6c 100644
--- a/arch/arm/configs/ixp2000_defconfig
+++ b/arch/arm/configs/ixp2000_defconfig
@@ -1,18 +1,19 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc2
-# Wed Feb  8 04:49:11 2006
+# Linux kernel version: 2.6.17-rc2
+# Wed Apr 19 21:12:49 2006
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_VECTORS_BASE=0xffff0000
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -29,6 +30,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_UID16=y
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -44,10 +46,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -60,7 +58,6 @@ CONFIG_OBSOLETE_INTERMODULE=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
@@ -68,6 +65,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -89,11 +87,13 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
+# CONFIG_ARCH_EP93XX is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
 # CONFIG_ARCH_INTEGRATOR is not set
 # CONFIG_ARCH_IOP3XX is not set
 # CONFIG_ARCH_IXP4XX is not set
 CONFIG_ARCH_IXP2000=y
+# CONFIG_ARCH_IXP23XX is not set
 # CONFIG_ARCH_L7200 is not set
 # CONFIG_ARCH_PXA is not set
 # CONFIG_ARCH_RPC is not set
@@ -123,6 +123,7 @@ CONFIG_ARCH_IXDP2800=y
 CONFIG_ARCH_IXDP2X00=y
 CONFIG_ARCH_IXDP2401=y
 CONFIG_ARCH_IXDP2801=y
+CONFIG_MACH_IXDP28X5=y
 CONFIG_ARCH_IXDP2X01=y
 # CONFIG_IXP2000_SUPPORT_BROKEN_PCI_IO is not set
 
@@ -147,7 +148,6 @@ CONFIG_XSCALE_PMU=y
 # Bus support
 #
 CONFIG_PCI=y
-CONFIG_PCI_LEGACY_PROC=y
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -160,6 +160,7 @@ CONFIG_PCI_LEGACY_PROC=y
 #
 # CONFIG_PREEMPT is not set
 # CONFIG_NO_IDLE_HZ is not set
+CONFIG_HZ=100
 # CONFIG_AEABI is not set
 # CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -213,6 +214,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -232,12 +234,15 @@ CONFIG_SYN_COOKIES=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_BIC=y
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETFILTER is not set
 
 #
@@ -347,7 +352,6 @@ CONFIG_MTD_CFI_UTIL=y
 # CONFIG_MTD_ROM is not set
 # CONFIG_MTD_ABSENT is not set
 # CONFIG_MTD_OBSOLETE_CHIPS is not set
-# CONFIG_MTD_XIP is not set
 
 #
 # Mapping drivers for chip access
@@ -366,7 +370,6 @@ CONFIG_MTD_IXP2000=y
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
-# CONFIG_MTD_BLKMTD is not set
 # CONFIG_MTD_BLOCK2MTD is not set
 
 #
@@ -614,8 +617,9 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_PCI=y
 CONFIG_SERIAL_8250_NR_UARTS=3
-CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=3
 # CONFIG_SERIAL_8250_EXTENDED is not set
 
 #
@@ -623,6 +627,7 @@ CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 #
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -650,7 +655,6 @@ CONFIG_IXP2000_WATCHDOG=y
 # CONFIG_PCIPCWATCHDOG is not set
 # CONFIG_WDTPCI is not set
 # CONFIG_NVRAM is not set
-# CONFIG_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -696,7 +700,6 @@ CONFIG_I2C_IXP2000=y
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -715,9 +718,7 @@ CONFIG_SENSORS_EEPROM=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -730,6 +731,11 @@ CONFIG_SENSORS_EEPROM=y
 # CONFIG_SPI_MASTER is not set
 
 #
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
 # Hardware Monitoring support
 #
 CONFIG_HWMON=y
@@ -742,6 +748,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ASB100 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_SENSORS_FSCHER is not set
 # CONFIG_SENSORS_FSCPOS is not set
 # CONFIG_SENSORS_GL518SM is not set
@@ -776,7 +783,16 @@ CONFIG_HWMON=y
 #
 
 #
-# Multimedia Capabilities Port drivers
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
 #
 
 #
@@ -804,6 +820,7 @@ CONFIG_HWMON=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_USB is not set
 
 #
@@ -821,6 +838,12 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_MMC is not set
 
 #
+# Real Time Clock
+#
+CONFIG_RTC_LIB=y
+# CONFIG_RTC_CLASS is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -870,7 +893,6 @@ CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -972,6 +994,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
 CONFIG_FRAME_POINTER=y
+# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
diff --git a/arch/arm/configs/ixp23xx_defconfig b/arch/arm/configs/ixp23xx_defconfig
index 1a2751e9ab05..9ce898a6cf87 100644
--- a/arch/arm/configs/ixp23xx_defconfig
+++ b/arch/arm/configs/ixp23xx_defconfig
@@ -1,12 +1,14 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16
-# Tue Mar 21 03:27:20 2006
+# Linux kernel version: 2.6.17-rc2
+# Wed Apr 19 21:13:50 2006
 #
 CONFIG_ARM=y
 CONFIG_MMU=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_VECTORS_BASE=0xffff0000
 
 #
 # Code maturity level options
@@ -28,6 +30,7 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_UID16=y
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -43,10 +46,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -59,7 +58,6 @@ CONFIG_OBSOLETE_INTERMODULE=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
@@ -67,6 +65,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -143,7 +142,6 @@ CONFIG_CPU_BIG_ENDIAN=y
 # Bus support
 #
 CONFIG_PCI=y
-CONFIG_PCI_LEGACY_PROC=y
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -230,12 +228,15 @@ CONFIG_SYN_COOKIES=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_BIC=y
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETFILTER is not set
 
 #
@@ -365,7 +366,6 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=1
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
-# CONFIG_MTD_BLKMTD is not set
 # CONFIG_MTD_BLOCK2MTD is not set
 
 #
@@ -527,7 +527,6 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_INIA100 is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
 # CONFIG_SCSI_IPR is not set
-# CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
@@ -735,6 +734,7 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_PCI=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -776,7 +776,6 @@ CONFIG_WATCHDOG=y
 #
 # CONFIG_USBPCWATCHDOG is not set
 # CONFIG_NVRAM is not set
-# CONFIG_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -821,7 +820,6 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -840,9 +838,7 @@ CONFIG_SENSORS_EEPROM=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -907,7 +903,16 @@ CONFIG_HWMON=y
 #
 
 #
-# Multimedia Capabilities Port drivers
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
 #
 
 #
@@ -919,6 +924,7 @@ CONFIG_HWMON=y
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
@@ -935,6 +941,7 @@ CONFIG_HWMON=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -1000,9 +1007,7 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_ACECAD is not set
 # CONFIG_USB_KBTAB is not set
 # CONFIG_USB_POWERMATE is not set
-# CONFIG_USB_MTOUCH is not set
-# CONFIG_USB_ITMTOUCH is not set
-# CONFIG_USB_EGALAX is not set
+# CONFIG_USB_TOUCHSCREEN is not set
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
@@ -1017,15 +1022,6 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_MICROTEK is not set
 
 #
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-
-#
-# Video4Linux support is needed for USB Multimedia device support
-#
-
-#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -1076,6 +1072,12 @@ CONFIG_USB_MON=y
 # CONFIG_MMC is not set
 
 #
+# Real Time Clock
+#
+CONFIG_RTC_LIB=y
+# CONFIG_RTC_CLASS is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1127,7 +1129,6 @@ CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -1268,6 +1269,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
 CONFIG_FRAME_POINTER=y
+# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile
index 2ce0e3a27a45..a601b8b55f35 100644
--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -29,7 +29,7 @@ ifneq ($(CONFIG_ARCH_EBSA110),y)
   obj-y         += io.o
 endif
 
-head-y                  := head.o
+head-y                  := head$(MMUEXT).o
 obj-$(CONFIG_DEBUG_LL)  += debug.o
 
 extra-y := $(head-y) init_task.o vmlinux.lds
diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S
index b093ab8738b5..0bea65864051 100644
--- a/arch/arm/kernel/head-nommu.S
+++ b/arch/arm/kernel/head-nommu.S
@@ -20,10 +20,11 @@
 #include <asm/mach-types.h>
 #include <asm/procinfo.h>
 #include <asm/ptrace.h>
-#include <asm/constants.h>
+#include <asm/thread_info.h>
 #include <asm/system.h>
 
 #define PROCINFO_INITFUNC       12
+#define MACHINFO_TYPE           0
 
 /*
  * Kernel startup entry point.
@@ -79,5 +80,6 @@ __after_proc_init:
 
         mov     pc, r13                         @ clear the BSS and jump
                                                 @ to start_kernel
+        .ltorg
 
 #include "head-common.S"
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 8cff73e668b3..9fc9af88c60c 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -407,7 +407,7 @@ static void __init early_initrd(char **p)
 }
 __early_param("initrd=", early_initrd);
 
-static void __init add_memory(unsigned long start, unsigned long size)
+static void __init arm_add_memory(unsigned long start, unsigned long size)
 {
         /*
          * Ensure that start/size are aligned to a page boundary.
@@ -445,7 +445,7 @@ static void __init early_mem(char **p)
         if (**p == '@')
                 start = memparse(*p + 1, p);
 
-        add_memory(start, size);
+        arm_add_memory(start, size);
 }
 __early_param("mem=", early_mem);
 
@@ -587,7 +587,7 @@ static int __init parse_tag_mem32(const struct tag *tag)
                         tag->u.mem.start, tag->u.mem.size / 1024);
                 return -EINVAL;
         }
-        add_memory(tag->u.mem.start, tag->u.mem.size);
+        arm_add_memory(tag->u.mem.start, tag->u.mem.size);
         return 0;
 }
 
@@ -807,7 +807,7 @@ static int __init topology_init(void)
 {
         int cpu;
 
-        for_each_cpu(cpu)
+        for_each_possible_cpu(cpu)
                 register_cpu(&per_cpu(cpu_data, cpu).cpu, cpu, NULL);
 
         return 0;
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index a0888e160e3b..00b761ff0f9c 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -91,7 +91,7 @@ static void ixp4xx_config_irq(unsigned irq, enum ixp4xx_irq_type type);
 /*
  * IRQ -> GPIO mapping table
  */
-static char irq2gpio[32] = {
+static signed char irq2gpio[32] = {
         -1, -1, -1, -1, -1, -1,  0,  1,
         -1, -1, -1, -1, -1, -1, -1, -1,
         -1, -1, -1,  2,  3,  4,  5,  6,
diff --git a/arch/arm/vfp/vfpdouble.c b/arch/arm/vfp/vfpdouble.c
index febd115dba28..009038c8113e 100644
--- a/arch/arm/vfp/vfpdouble.c
+++ b/arch/arm/vfp/vfpdouble.c
@@ -197,7 +197,7 @@ u32 vfp_double_normaliseround(int dd, struct vfp_double *vd, u32 fpscr, u32 exce
                          dd, d, exceptions);
                 vfp_put_double(dd, d);
         }
-        return exceptions & ~VFP_NAN_FLAG;
+        return exceptions;
 }
 
 /*
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 22f3da4e0829..37ff8145b5b5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -180,7 +180,7 @@ static u32 vfp_emulate_instruction(u32 inst, u32 fpscr, struct pt_regs *regs)
                  * emulate it.
                  */
         }
-        return exceptions;
+        return exceptions & ~VFP_NAN_FLAG;
 }
 
 /*
diff --git a/arch/arm/vfp/vfpsingle.c b/arch/arm/vfp/vfpsingle.c
index 4ac27f193934..dae2c2f46052 100644
--- a/arch/arm/vfp/vfpsingle.c
+++ b/arch/arm/vfp/vfpsingle.c
@@ -203,7 +203,7 @@ u32 vfp_single_normaliseround(int sd, struct vfp_single *vs, u32 fpscr, u32 exce
                 vfp_put_float(sd, d);
         }
 
-        return exceptions & ~VFP_NAN_FLAG;
+        return exceptions;
 }
 
 /*
diff --git a/arch/i386/kernel/cpu/intel_cacheinfo.c b/arch/i386/kernel/cpu/intel_cacheinfo.c
index 9df87b03612c..c8547a6fa7e6 100644
--- a/arch/i386/kernel/cpu/intel_cacheinfo.c
+++ b/arch/i386/kernel/cpu/intel_cacheinfo.c
@@ -642,7 +642,7 @@ static void __cpuexit cache_remove_dev(struct sys_device * sys_dev)
         return;
 }
 
-static int __cpuinit cacheinfo_cpu_callback(struct notifier_block *nfb,
+static int cacheinfo_cpu_callback(struct notifier_block *nfb,
                                         unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index e30798811216..bcb80ca5cf40 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1610,5 +1610,6 @@ sys_call_table:
         data8 sys_get_robust_list
         data8 sys_sync_file_range               // 1300
         data8 sys_tee
+        data8 sys_vmsplice
 
         .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
index 6386f63c413e..859fb37ff49b 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
@@ -959,7 +959,7 @@ remove_palinfo_proc_entries(unsigned int hcpu)
         }
 }
 
-static int __devinit palinfo_cpu_callback(struct notifier_block *nfb,
+static int palinfo_cpu_callback(struct notifier_block *nfb,
                                                                 unsigned long action,
                                                                 void *hcpu)
 {
diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
index 9d5a823479a3..663a186ad194 100644
--- a/arch/ia64/kernel/salinfo.c
+++ b/arch/ia64/kernel/salinfo.c
@@ -572,7 +572,7 @@ static struct file_operations salinfo_data_fops = {
 };
 
 #ifdef  CONFIG_HOTPLUG_CPU
-static int __devinit
+static int
 salinfo_cpu_callback(struct notifier_block *nb, unsigned long action, void *hcpu)
 {
         unsigned int i, cpu = (unsigned long)hcpu;
diff --git a/arch/ia64/kernel/topology.c b/arch/ia64/kernel/topology.c
index b47476d655f1..7da4739f536e 100644
--- a/arch/ia64/kernel/topology.c
+++ b/arch/ia64/kernel/topology.c
@@ -429,7 +429,7 @@ static int __cpuinit cache_remove_dev(struct sys_device * sys_dev)
  * When a cpu is hot-plugged, do a check and initiate
  * cache kobject if necessary
  */
-static int __cpuinit cache_cpu_callback(struct notifier_block *nfb,
+static int cache_cpu_callback(struct notifier_block *nfb,
                 unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 7c953bcc5f6a..a7d2bb3cf835 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -356,73 +356,13 @@ asmlinkage int sys32_llseek(unsigned int fd, unsigned int offset_high,
 asmlinkage ssize_t sys32_pread(unsigned int fd, char __user * buf,
                                size_t count, u32 unused, u64 a4, u64 a5)
 {
-        ssize_t ret;
-        struct file * file;
-        ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
-        loff_t pos;
-
-        ret = -EBADF;
-        file = fget(fd);
-        if (!file)
-                goto bad_file;
-        if (!(file->f_mode & FMODE_READ))
-                goto out;
-        pos = merge_64(a4, a5);
-        ret = rw_verify_area(READ, file, &pos, count);
-        if (ret < 0)
-                goto out;
-        ret = -EINVAL;
-        if (!file->f_op || !(read = file->f_op->read))
-                goto out;
-        if (pos < 0)
-                goto out;
-        ret = -ESPIPE;
-        if (!(file->f_mode & FMODE_PREAD))
-                goto out;
-        ret = read(file, buf, count, &pos);
-        if (ret > 0)
-                dnotify_parent(file->f_dentry, DN_ACCESS);
-out:
-        fput(file);
-bad_file:
-        return ret;
+        return sys_pread64(fd, buf, count, merge_64(a4, a5));
 }
 
 asmlinkage ssize_t sys32_pwrite(unsigned int fd, const char __user * buf,
                                 size_t count, u32 unused, u64 a4, u64 a5)
 {
-        ssize_t ret;
-        struct file * file;
-        ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
-        loff_t pos;
-
-        ret = -EBADF;
-        file = fget(fd);
-        if (!file)
-                goto bad_file;
-        if (!(file->f_mode & FMODE_WRITE))
-                goto out;
-        pos = merge_64(a4, a5);
-        ret = rw_verify_area(WRITE, file, &pos, count);
-        if (ret < 0)
-                goto out;
-        ret = -EINVAL;
-        if (!file->f_op || !(write = file->f_op->write))
-                goto out;
-        if (pos < 0)
-                goto out;
-
-        ret = -ESPIPE;
-        if (!(file->f_mode & FMODE_PWRITE))
-                goto out;
-
-        ret = write(file, buf, count, &pos);
-        if (ret > 0)
-                dnotify_parent(file->f_dentry, DN_MODIFY);
-out:
-        fput(file);
-bad_file:
-        return ret;
+        return sys_pwrite64(fd, buf, count, merge_64(a4, a5));
 }
 
 asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 19f911c5dd58..910fb3afc0b5 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -138,6 +138,37 @@ config 64BIT
           enable this option otherwise. The 64bit kernel is significantly bigger
           and slower than the 32bit one.
 
+choice
+        prompt "Kernel page size"
+        default PARISC_PAGE_SIZE_4KB  if !64BIT
+        default PARISC_PAGE_SIZE_4KB  if 64BIT
+#       default PARISC_PAGE_SIZE_16KB if 64BIT
+
+config PARISC_PAGE_SIZE_4KB
+        bool "4KB"
+        help
+          This lets you select the page size of the kernel.  For best
+          performance, a page size of 16KB is recommended.  For best
+          compatibility with 32bit applications, a page size of 4KB should be
+          selected (the vast majority of 32bit binaries work perfectly fine
+          with a larger page size).
+
+          4KB                For best 32bit compatibility
+          16KB               For best performance
+          64KB               For best performance, might give more overhead.
+
+          If you don't know what to do, choose 4KB.
+
+config PARISC_PAGE_SIZE_16KB
+        bool "16KB (EXPERIMENTAL)"
+        depends on PA8X00 && EXPERIMENTAL
+
+config PARISC_PAGE_SIZE_64KB
+        bool "64KB (EXPERIMENTAL)"
+        depends on PA8X00 && EXPERIMENTAL
+
+endchoice
+
 config SMP
         bool "Symmetric multi-processing support"
         ---help---
diff --git a/arch/parisc/defconfig b/arch/parisc/defconfig
index 59f7bc38e72e..b38b58eb9dc2 100644
--- a/arch/parisc/defconfig
+++ b/arch/parisc/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-pa6
-# Sun Mar 26 19:50:07 2006
+# Linux kernel version: 2.6.16-pa10
+# Sun Apr  2 15:26:38 2006
 #
 CONFIG_PARISC=y
 CONFIG_MMU=y
@@ -25,7 +25,7 @@ CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
-# CONFIG_POSIX_MQUEUE is not set
+CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
@@ -35,7 +35,7 @@ CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
-# CONFIG_KALLSYMS_ALL is not set
+CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
@@ -57,7 +57,13 @@ CONFIG_BASE_SMALL=0
 #
 # Loadable module support
 #
-# CONFIG_MODULES is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_OBSOLETE_MODPARM=y
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+CONFIG_KMOD=y
 
 #
 # Block layer
@@ -79,16 +85,19 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 # Processor type and features
 #
-CONFIG_PA7000=y
-# CONFIG_PA7100LC is not set
+# CONFIG_PA7000 is not set
+CONFIG_PA7100LC=y
 # CONFIG_PA7200 is not set
 # CONFIG_PA7300LC is not set
 # CONFIG_PA8X00 is not set
 CONFIG_PA11=y
+CONFIG_PARISC_PAGE_SIZE_4KB=y
+# CONFIG_PARISC_PAGE_SIZE_16KB is not set
+# CONFIG_PARISC_PAGE_SIZE_64KB is not set
 # CONFIG_SMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
-CONFIG_PREEMPT_NONE=y
-# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
 # CONFIG_PREEMPT is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
@@ -108,7 +117,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4096
 # Bus options (PCI, PCMCIA, EISA, GSC, ISA)
 #
 CONFIG_GSC=y
-CONFIG_HPPB=y
+# CONFIG_HPPB is not set
 CONFIG_IOMMU_CCIO=y
 CONFIG_GSC_LASI=y
 CONFIG_GSC_WAX=y
@@ -126,7 +135,25 @@ CONFIG_IOMMU_SBA=y
 #
 # PCCARD (PCMCIA/CardBus) support
 #
-# CONFIG_PCCARD is not set
+CONFIG_PCCARD=y
+# CONFIG_PCMCIA_DEBUG is not set
+CONFIG_PCMCIA=y
+CONFIG_PCMCIA_LOAD_CIS=y
+CONFIG_PCMCIA_IOCTL=y
+CONFIG_CARDBUS=y
+
+#
+# PC-card bridges
+#
+CONFIG_YENTA=y
+CONFIG_YENTA_O2=y
+CONFIG_YENTA_RICOH=y
+CONFIG_YENTA_TI=y
+CONFIG_YENTA_ENE_TUNE=y
+CONFIG_YENTA_TOSHIBA=y
+CONFIG_PD6729=y
+CONFIG_I82092=y
+CONFIG_PCCARD_NONSTATIC=y
 
 #
 # PCI Hotplug Support
@@ -145,7 +172,7 @@ CONFIG_PDC_STABLE=y
 # Executable file formats
 #
 CONFIG_BINFMT_ELF=y
-# CONFIG_BINFMT_MISC is not set
+CONFIG_BINFMT_MISC=m
 
 #
 # Networking
@@ -159,13 +186,15 @@ CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
+CONFIG_XFRM=y
+CONFIG_XFRM_USER=m
+CONFIG_NET_KEY=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 # CONFIG_IP_ADVANCED_ROUTER is not set
 CONFIG_IP_FIB_HASH=y
 CONFIG_IP_PNP=y
-# CONFIG_IP_PNP_DHCP is not set
+CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
 # CONFIG_IP_PNP_RARP is not set
 # CONFIG_NET_IPIP is not set
@@ -173,19 +202,20 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_IP_MROUTE is not set
 # CONFIG_ARPD is not set
 # CONFIG_SYN_COOKIES is not set
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
+CONFIG_INET_AH=m
+CONFIG_INET_ESP=m
 # CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-# CONFIG_INET_DIAG is not set
+CONFIG_INET_TUNNEL=m
+CONFIG_INET_DIAG=m
+CONFIG_INET_TCP_DIAG=m
 # CONFIG_TCP_CONG_ADVANCED is not set
 CONFIG_TCP_CONG_BIC=y
 CONFIG_IPV6=y
 # CONFIG_IPV6_PRIVACY is not set
-# CONFIG_INET6_AH is not set
-# CONFIG_INET6_ESP is not set
-# CONFIG_INET6_IPCOMP is not set
-# CONFIG_INET6_TUNNEL is not set
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_INET6_IPCOMP=y
+CONFIG_INET6_TUNNEL=y
 # CONFIG_IPV6_TUNNEL is not set
 # CONFIG_NETFILTER is not set
 
@@ -207,7 +237,8 @@ CONFIG_IPV6=y
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
+CONFIG_LLC=m
+CONFIG_LLC2=m
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
@@ -237,9 +268,9 @@ CONFIG_IPV6=y
 #
 # Generic Driver Options
 #
-CONFIG_STANDALONE=y
-CONFIG_PREVENT_FIRMWARE_BUILD=y
-# CONFIG_FW_LOADER is not set
+# CONFIG_STANDALONE is not set
+# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+CONFIG_FW_LOADER=y
 # CONFIG_DEBUG_DRIVER is not set
 
 #
@@ -256,13 +287,14 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 # Parallel port support
 #
 CONFIG_PARPORT=y
-CONFIG_PARPORT_PC=y
+CONFIG_PARPORT_PC=m
 # CONFIG_PARPORT_SERIAL is not set
 # CONFIG_PARPORT_PC_FIFO is not set
 # CONFIG_PARPORT_PC_SUPERIO is not set
+CONFIG_PARPORT_PC_PCMCIA=m
 CONFIG_PARPORT_NOT_PC=y
 CONFIG_PARPORT_GSC=y
-# CONFIG_PARPORT_1284 is not set
+CONFIG_PARPORT_1284=y
 
 #
 # Plug and Play support
@@ -284,7 +316,7 @@ CONFIG_BLK_DEV_CRYPTOLOOP=y
 # CONFIG_BLK_DEV_UB is not set
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
-CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_SIZE=6144
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -292,7 +324,60 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # ATA/ATAPI/MFM/RLL support
 #
-# CONFIG_IDE is not set
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDE=y
+
+#
+# Please see Documentation/ide.txt for help/info on IDE drives
+#
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_BLK_DEV_IDEDISK=y
+CONFIG_IDEDISK_MULTI_MODE=y
+CONFIG_BLK_DEV_IDECS=y
+CONFIG_BLK_DEV_IDECD=y
+# CONFIG_BLK_DEV_IDETAPE is not set
+# CONFIG_BLK_DEV_IDEFLOPPY is not set
+CONFIG_BLK_DEV_IDESCSI=y
+# CONFIG_IDE_TASK_IOCTL is not set
+
+#
+# IDE chipset support/bugfixes
+#
+CONFIG_IDE_GENERIC=y
+CONFIG_BLK_DEV_IDEPCI=y
+CONFIG_IDEPCI_SHARE_IRQ=y
+# CONFIG_BLK_DEV_OFFBOARD is not set
+CONFIG_BLK_DEV_GENERIC=y
+# CONFIG_BLK_DEV_OPTI621 is not set
+CONFIG_BLK_DEV_IDEDMA_PCI=y
+# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
+# CONFIG_IDEDMA_PCI_AUTO is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT34X is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+CONFIG_BLK_DEV_NS87415=y
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_IDE_ARM is not set
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_IDEDMA_IVB is not set
+# CONFIG_IDEDMA_AUTO is not set
+# CONFIG_BLK_DEV_HD is not set
 
 #
 # SCSI device support
@@ -375,6 +460,15 @@ CONFIG_SCSI_NCR53C8XX_SYNC=20
 # CONFIG_SCSI_DEBUG is not set
 
 #
+# PCMCIA SCSI adapter support
+#
+# CONFIG_PCMCIA_AHA152X is not set
+# CONFIG_PCMCIA_FDOMAIN is not set
+# CONFIG_PCMCIA_NINJA_SCSI is not set
+# CONFIG_PCMCIA_QLOGIC is not set
+# CONFIG_PCMCIA_SYM53C500 is not set
+
+#
 # Multi-device support (RAID and LVM)
 #
 CONFIG_MD=y
@@ -382,12 +476,17 @@ CONFIG_BLK_DEV_MD=y
 CONFIG_MD_LINEAR=y
 CONFIG_MD_RAID0=y
 CONFIG_MD_RAID1=y
-# CONFIG_MD_RAID10 is not set
+CONFIG_MD_RAID10=y
 CONFIG_MD_RAID5=y
-# CONFIG_MD_RAID6 is not set
+CONFIG_MD_RAID6=y
 # CONFIG_MD_MULTIPATH is not set
 # CONFIG_MD_FAULTY is not set
-# CONFIG_BLK_DEV_DM is not set
+CONFIG_BLK_DEV_DM=y
+# CONFIG_DM_CRYPT is not set
+# CONFIG_DM_SNAPSHOT is not set
+# CONFIG_DM_MIRROR is not set
+# CONFIG_DM_ZERO is not set
+# CONFIG_DM_MULTIPATH is not set
 
 #
 # Fusion MPT device support
@@ -411,10 +510,10 @@ CONFIG_MD_RAID5=y
 # Network device support
 #
 CONFIG_NETDEVICES=y
-# CONFIG_DUMMY is not set
-# CONFIG_BONDING is not set
+CONFIG_DUMMY=m
+CONFIG_BONDING=m
 # CONFIG_EQUALIZER is not set
-# CONFIG_TUN is not set
+CONFIG_TUN=m
 
 #
 # ARCnet devices
@@ -430,7 +529,7 @@ CONFIG_NETDEVICES=y
 # Ethernet (10 or 100Mbit)
 #
 CONFIG_NET_ETHERNET=y
-# CONFIG_MII is not set
+CONFIG_MII=m
 CONFIG_LASI_82596=y
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
@@ -451,6 +550,8 @@ CONFIG_TULIP=y
 # CONFIG_WINBOND_840 is not set
 # CONFIG_DM9102 is not set
 # CONFIG_ULI526X is not set
+# CONFIG_PCMCIA_XIRCOM is not set
+# CONFIG_PCMCIA_XIRTULIP is not set
 # CONFIG_DEPCA is not set
 # CONFIG_HP100 is not set
 CONFIG_NET_PCI=y
@@ -518,14 +619,33 @@ CONFIG_NET_RADIO=y
 # Obsolete Wireless cards support (pre-802.11)
 #
 # CONFIG_STRIP is not set
+# CONFIG_PCMCIA_WAVELAN is not set
+# CONFIG_PCMCIA_NETWAVE is not set
+
+#
+# Wireless 802.11 Frequency Hopping cards support
+#
+# CONFIG_PCMCIA_RAYCS is not set
 
 #
 # Wireless 802.11b ISA/PCI cards support
 #
-# CONFIG_HERMES is not set
+CONFIG_HERMES=y
+# CONFIG_PLX_HERMES is not set
+# CONFIG_TMD_HERMES is not set
+# CONFIG_NORTEL_HERMES is not set
+# CONFIG_PCI_HERMES is not set
 # CONFIG_ATMEL is not set
 
 #
+# Wireless 802.11b Pcmcia/Cardbus cards support
+#
+CONFIG_PCMCIA_HERMES=y
+CONFIG_PCMCIA_SPECTRUM=y
+# CONFIG_AIRO_CS is not set
+# CONFIG_PCMCIA_WL3501 is not set
+
+#
 # Prism GT/Duette 802.11(a/b/g) PCI/Cardbus support
 #
 # CONFIG_PRISM54 is not set
@@ -533,13 +653,34 @@ CONFIG_NET_RADIO=y
 CONFIG_NET_WIRELESS=y
 
 #
+# PCMCIA network device support
+#
+CONFIG_NET_PCMCIA=y
+# CONFIG_PCMCIA_3C589 is not set
+# CONFIG_PCMCIA_3C574 is not set
+# CONFIG_PCMCIA_FMVJ18X is not set
+# CONFIG_PCMCIA_PCNET is not set
+# CONFIG_PCMCIA_NMCLAN is not set
+# CONFIG_PCMCIA_SMC91C92 is not set
+# CONFIG_PCMCIA_XIRC2PS is not set
+# CONFIG_PCMCIA_AXNET is not set
+
+#
 # Wan interfaces
 #
 # CONFIG_WAN is not set
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
 # CONFIG_PLIP is not set
-# CONFIG_PPP is not set
+CONFIG_PPP=m
+# CONFIG_PPP_MULTILINK is not set
+# CONFIG_PPP_FILTER is not set
+CONFIG_PPP_ASYNC=m
+CONFIG_PPP_SYNC_TTY=m
+CONFIG_PPP_DEFLATE=m
+CONFIG_PPP_BSDCOMP=m
+# CONFIG_PPP_MPPE is not set
+CONFIG_PPPOE=m
 # CONFIG_SLIP is not set
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
@@ -571,14 +712,16 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
 CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 # CONFIG_INPUT_JOYDEV is not set
 # CONFIG_INPUT_TSDEV is not set
-CONFIG_INPUT_EVDEV=y
+# CONFIG_INPUT_EVDEV is not set
 # CONFIG_INPUT_EVBUG is not set
 
 #
 # Input Device Drivers
 #
 CONFIG_INPUT_KEYBOARD=y
-# CONFIG_KEYBOARD_ATKBD is not set
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_KEYBOARD_ATKBD_HP_KEYCODES=y
+# CONFIG_KEYBOARD_ATKBD_RDI_KEYCODES is not set
 # CONFIG_KEYBOARD_SUNKBD is not set
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
@@ -586,52 +729,25 @@ CONFIG_INPUT_KEYBOARD=y
 # CONFIG_KEYBOARD_HIL_OLD is not set
 CONFIG_KEYBOARD_HIL=y
 CONFIG_INPUT_MOUSE=y
-# CONFIG_MOUSE_PS2 is not set
-# CONFIG_MOUSE_SERIAL is not set
+CONFIG_MOUSE_PS2=y
+CONFIG_MOUSE_SERIAL=y
 # CONFIG_MOUSE_VSXXXAA is not set
 CONFIG_MOUSE_HIL=y
-CONFIG_INPUT_JOYSTICK=y
-# CONFIG_JOYSTICK_ANALOG is not set
-# CONFIG_JOYSTICK_A3D is not set
-# CONFIG_JOYSTICK_ADI is not set
-# CONFIG_JOYSTICK_COBRA is not set
-# CONFIG_JOYSTICK_GF2K is not set
-# CONFIG_JOYSTICK_GRIP is not set
-# CONFIG_JOYSTICK_GRIP_MP is not set
-# CONFIG_JOYSTICK_GUILLEMOT is not set
-# CONFIG_JOYSTICK_INTERACT is not set
-# CONFIG_JOYSTICK_SIDEWINDER is not set
-# CONFIG_JOYSTICK_TMDC is not set
-# CONFIG_JOYSTICK_IFORCE is not set
-# CONFIG_JOYSTICK_WARRIOR is not set
-# CONFIG_JOYSTICK_MAGELLAN is not set
-# CONFIG_JOYSTICK_SPACEORB is not set
-# CONFIG_JOYSTICK_SPACEBALL is not set
-# CONFIG_JOYSTICK_STINGER is not set
-# CONFIG_JOYSTICK_TWIDJOY is not set
-# CONFIG_JOYSTICK_DB9 is not set
-# CONFIG_JOYSTICK_GAMECON is not set
-# CONFIG_JOYSTICK_TURBOGRAFX is not set
-# CONFIG_JOYSTICK_JOYDUMP is not set
-CONFIG_INPUT_TOUCHSCREEN=y
-# CONFIG_TOUCHSCREEN_GUNZE is not set
-# CONFIG_TOUCHSCREEN_ELO is not set
-# CONFIG_TOUCHSCREEN_MTOUCH is not set
-# CONFIG_TOUCHSCREEN_MK712 is not set
-CONFIG_INPUT_MISC=y
-# CONFIG_INPUT_UINPUT is not set
-CONFIG_HP_SDC_RTC=y
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
 
 #
 # Hardware I/O ports
 #
 CONFIG_SERIO=y
-# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_SERPORT=y
 # CONFIG_SERIO_PARKBD is not set
 CONFIG_SERIO_GSCPS2=y
 CONFIG_HP_SDC=y
 CONFIG_HIL_MLC=y
 # CONFIG_SERIO_PCIPS2 is not set
+CONFIG_SERIO_LIBPS2=y
 # CONFIG_SERIO_RAW is not set
 # CONFIG_GAMEPORT is not set
 
@@ -648,7 +764,8 @@ CONFIG_HW_CONSOLE=y
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_NR_UARTS=13
+CONFIG_SERIAL_8250_CS=y
+CONFIG_SERIAL_8250_NR_UARTS=17
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
@@ -666,10 +783,10 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
-CONFIG_LEGACY_PTY_COUNT=256
-CONFIG_PRINTER=y
+CONFIG_LEGACY_PTY_COUNT=64
+CONFIG_PRINTER=m
 # CONFIG_LP_CONSOLE is not set
-# CONFIG_PPDEV is not set
+CONFIG_PPDEV=m
 # CONFIG_TIPAR is not set
 
 #
@@ -682,7 +799,7 @@ CONFIG_PRINTER=y
 #
 # CONFIG_WATCHDOG is not set
 CONFIG_GEN_RTC=y
-# CONFIG_GEN_RTC_X is not set
+CONFIG_GEN_RTC_X=y
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -691,6 +808,13 @@ CONFIG_GEN_RTC=y
 # Ftape, the floppy tape device driver
 #
 # CONFIG_DRM is not set
+
+#
+# PCMCIA character devices
+#
+# CONFIG_SYNCLINK_CS is not set
+# CONFIG_CARDMAN_4000 is not set
+# CONFIG_CARDMAN_4040 is not set
 # CONFIG_RAW_DRIVER is not set
 
 #
@@ -718,10 +842,8 @@ CONFIG_GEN_RTC=y
 #
 # Hardware Monitoring support
 #
-CONFIG_HWMON=y
+# CONFIG_HWMON is not set
 # CONFIG_HWMON_VID is not set
-# CONFIG_SENSORS_F71805F is not set
-# CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
@@ -749,8 +871,8 @@ CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_MACMODES is not set
-# CONFIG_FB_MODE_HELPERS is not set
-# CONFIG_FB_TILEBLITTING is not set
+CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_CIRRUS is not set
 # CONFIG_FB_PM2 is not set
 # CONFIG_FB_CYBER2000 is not set
@@ -778,8 +900,8 @@ CONFIG_FB_STI=y
 # Console display driver support
 #
 CONFIG_DUMMY_CONSOLE=y
-CONFIG_DUMMY_CONSOLE_COLUMNS=160
-CONFIG_DUMMY_CONSOLE_ROWS=64
+CONFIG_DUMMY_CONSOLE_COLUMNS=128
+CONFIG_DUMMY_CONSOLE_ROWS=48
 CONFIG_FRAMEBUFFER_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
 CONFIG_STI_CONSOLE=y
@@ -816,13 +938,14 @@ CONFIG_SOUND=y
 CONFIG_SND=y
 CONFIG_SND_TIMER=y
 CONFIG_SND_PCM=y
+CONFIG_SND_HWDEP=y
 CONFIG_SND_SEQUENCER=y
 # CONFIG_SND_SEQ_DUMMY is not set
 CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_SEQUENCER_OSS=y
-# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_DYNAMIC_MINORS=y
 CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
@@ -830,6 +953,7 @@ CONFIG_SND_SUPPORT_OLD_API=y
 #
 # Generic devices
 #
+CONFIG_SND_OPL3_LIB=y
 CONFIG_SND_AC97_CODEC=y
 CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_DUMMY is not set
@@ -842,7 +966,7 @@ CONFIG_SND_AC97_BUS=y
 # PCI devices
 #
 CONFIG_SND_AD1889=y
-# CONFIG_SND_AD1889_OPL3 is not set
+CONFIG_SND_AD1889_OPL3=y
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -890,6 +1014,10 @@ CONFIG_SND_AD1889=y
 # CONFIG_SND_USB_AUDIO is not set
 
 #
+# PCMCIA devices
+#
+
+#
 # GSC devices
 #
 CONFIG_SND_HARMONY=y
@@ -905,12 +1033,12 @@ CONFIG_SND_HARMONY=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
 CONFIG_USB=y
-CONFIG_USB_DEBUG=y
+# CONFIG_USB_DEBUG is not set
 
 #
 # Miscellaneous USB options
 #
-# CONFIG_USB_DEVICEFS is not set
+CONFIG_USB_DEVICEFS=y
 # CONFIG_USB_BANDWIDTH is not set
 # CONFIG_USB_DYNAMIC_MINORS is not set
 # CONFIG_USB_OTG is not set
@@ -918,14 +1046,12 @@ CONFIG_USB_DEBUG=y
 #
 # USB Host Controller Drivers
 #
-CONFIG_USB_EHCI_HCD=y
-# CONFIG_USB_EHCI_SPLIT_ISO is not set
-# CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+# CONFIG_USB_EHCI_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_BIG_ENDIAN is not set
 CONFIG_USB_OHCI_LITTLE_ENDIAN=y
-# CONFIG_USB_UHCI_HCD is not set
+CONFIG_USB_UHCI_HCD=y
 # CONFIG_USB_SL811_HCD is not set
 
 #
@@ -948,13 +1074,11 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 #
 # USB Input Devices
 #
-# CONFIG_USB_HID is not set
-
-#
-# USB HID Boot Protocol drivers
-#
-# CONFIG_USB_KBD is not set
-# CONFIG_USB_MOUSE is not set
+CONFIG_USB_HID=y
+CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
+# CONFIG_HID_FF is not set
+# CONFIG_USB_HIDDEV is not set
 # CONFIG_USB_AIPTEK is not set
 # CONFIG_USB_WACOM is not set
 # CONFIG_USB_ACECAD is not set
@@ -1020,8 +1144,8 @@ CONFIG_USB_MON=y
 # CONFIG_USB_PHIDGETKIT is not set
 # CONFIG_USB_PHIDGETSERVO is not set
 # CONFIG_USB_IDMOUSE is not set
-# CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TEST is not set
 
 #
 # USB DSL modem support
@@ -1058,7 +1182,7 @@ CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
-# CONFIG_FS_POSIX_ACL is not set
+CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
@@ -1066,7 +1190,7 @@ CONFIG_JBD=y
 CONFIG_INOTIFY=y
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
-# CONFIG_AUTOFS_FS is not set
+CONFIG_AUTOFS_FS=y
 # CONFIG_AUTOFS4_FS is not set
 # CONFIG_FUSE_FS is not set
 
@@ -1081,8 +1205,11 @@ CONFIG_JOLIET=y
 #
 # DOS/FAT/NT Filesystems
 #
+CONFIG_FAT_FS=y
 # CONFIG_MSDOS_FS is not set
-# CONFIG_VFAT_FS is not set
+CONFIG_VFAT_FS=y
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # CONFIG_NTFS_FS is not set
 
 #
@@ -1125,7 +1252,7 @@ CONFIG_NFS_V3=y
 CONFIG_NFSD=y
 CONFIG_NFSD_V3=y
 # CONFIG_NFSD_V3_ACL is not set
-# CONFIG_NFSD_V4 is not set
+CONFIG_NFSD_V4=y
 CONFIG_NFSD_TCP=y
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
@@ -1133,10 +1260,16 @@ CONFIG_LOCKD_V4=y
 CONFIG_EXPORTFS=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
-# CONFIG_RPCSEC_GSS_KRB5 is not set
-# CONFIG_RPCSEC_GSS_SPKM3 is not set
-# CONFIG_SMB_FS is not set
-# CONFIG_CIFS is not set
+CONFIG_SUNRPC_GSS=y
+CONFIG_RPCSEC_GSS_KRB5=y
+CONFIG_RPCSEC_GSS_SPKM3=m
+CONFIG_SMB_FS=m
+CONFIG_SMB_NLS_DEFAULT=y
+CONFIG_SMB_NLS_REMOTE="cp437"
+CONFIG_CIFS=m
+# CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_XATTR is not set
+# CONFIG_CIFS_EXPERIMENTAL is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -1153,50 +1286,50 @@ CONFIG_MSDOS_PARTITION=y
 #
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="iso8859-1"
-# CONFIG_NLS_CODEPAGE_437 is not set
-# CONFIG_NLS_CODEPAGE_737 is not set
-# CONFIG_NLS_CODEPAGE_775 is not set
-# CONFIG_NLS_CODEPAGE_850 is not set
-# CONFIG_NLS_CODEPAGE_852 is not set
-# CONFIG_NLS_CODEPAGE_855 is not set
-# CONFIG_NLS_CODEPAGE_857 is not set
-# CONFIG_NLS_CODEPAGE_860 is not set
-# CONFIG_NLS_CODEPAGE_861 is not set
-# CONFIG_NLS_CODEPAGE_862 is not set
-# CONFIG_NLS_CODEPAGE_863 is not set
-# CONFIG_NLS_CODEPAGE_864 is not set
-# CONFIG_NLS_CODEPAGE_865 is not set
-# CONFIG_NLS_CODEPAGE_866 is not set
-# CONFIG_NLS_CODEPAGE_869 is not set
-# CONFIG_NLS_CODEPAGE_936 is not set
-# CONFIG_NLS_CODEPAGE_950 is not set
-# CONFIG_NLS_CODEPAGE_932 is not set
-# CONFIG_NLS_CODEPAGE_949 is not set
-# CONFIG_NLS_CODEPAGE_874 is not set
-# CONFIG_NLS_ISO8859_8 is not set
-# CONFIG_NLS_CODEPAGE_1250 is not set
-# CONFIG_NLS_CODEPAGE_1251 is not set
-# CONFIG_NLS_ASCII is not set
-# CONFIG_NLS_ISO8859_1 is not set
-# CONFIG_NLS_ISO8859_2 is not set
-# CONFIG_NLS_ISO8859_3 is not set
-# CONFIG_NLS_ISO8859_4 is not set
-# CONFIG_NLS_ISO8859_5 is not set
-# CONFIG_NLS_ISO8859_6 is not set
-# CONFIG_NLS_ISO8859_7 is not set
-# CONFIG_NLS_ISO8859_9 is not set
-# CONFIG_NLS_ISO8859_13 is not set
-# CONFIG_NLS_ISO8859_14 is not set
-# CONFIG_NLS_ISO8859_15 is not set
-# CONFIG_NLS_KOI8_R is not set
-# CONFIG_NLS_KOI8_U is not set
-# CONFIG_NLS_UTF8 is not set
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_CODEPAGE_737=m
+CONFIG_NLS_CODEPAGE_775=m
+CONFIG_NLS_CODEPAGE_850=m
+CONFIG_NLS_CODEPAGE_852=m
+CONFIG_NLS_CODEPAGE_855=m
+CONFIG_NLS_CODEPAGE_857=m
+CONFIG_NLS_CODEPAGE_860=m
+CONFIG_NLS_CODEPAGE_861=m
+CONFIG_NLS_CODEPAGE_862=m
+CONFIG_NLS_CODEPAGE_863=m
+CONFIG_NLS_CODEPAGE_864=m
+CONFIG_NLS_CODEPAGE_865=m
+CONFIG_NLS_CODEPAGE_866=m
+CONFIG_NLS_CODEPAGE_869=m
+CONFIG_NLS_CODEPAGE_936=m
+CONFIG_NLS_CODEPAGE_950=m
+CONFIG_NLS_CODEPAGE_932=m
+CONFIG_NLS_CODEPAGE_949=m
+CONFIG_NLS_CODEPAGE_874=m
+CONFIG_NLS_ISO8859_8=m
+CONFIG_NLS_CODEPAGE_1250=y
+CONFIG_NLS_CODEPAGE_1251=m
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+CONFIG_NLS_KOI8_R=m
+CONFIG_NLS_KOI8_U=m
+CONFIG_NLS_UTF8=y
 
 #
 # Profiling support
 #
 CONFIG_PROFILING=y
-CONFIG_OPROFILE=y
+CONFIG_OPROFILE=m
 
 #
 # Kernel hacking
@@ -1204,7 +1337,7 @@ CONFIG_OPROFILE=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_LOG_BUF_SHIFT=15
+CONFIG_LOG_BUF_SHIFT=16
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
@@ -1217,42 +1350,43 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_VM is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
-CONFIG_DEBUG_RODATA=y
+# CONFIG_DEBUG_RODATA is not set
 
 #
 # Security options
 #
-# CONFIG_KEYS is not set
+CONFIG_KEYS=y
+CONFIG_KEYS_DEBUG_PROC_KEYS=y
 # CONFIG_SECURITY is not set
 
 #
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
-# CONFIG_CRYPTO_HMAC is not set
-# CONFIG_CRYPTO_NULL is not set
-# CONFIG_CRYPTO_MD4 is not set
-# CONFIG_CRYPTO_MD5 is not set
-# CONFIG_CRYPTO_SHA1 is not set
-# CONFIG_CRYPTO_SHA256 is not set
-# CONFIG_CRYPTO_SHA512 is not set
-# CONFIG_CRYPTO_WP512 is not set
-# CONFIG_CRYPTO_TGR192 is not set
-# CONFIG_CRYPTO_DES is not set
-# CONFIG_CRYPTO_BLOWFISH is not set
-# CONFIG_CRYPTO_TWOFISH is not set
-# CONFIG_CRYPTO_SERPENT is not set
-# CONFIG_CRYPTO_AES is not set
-# CONFIG_CRYPTO_CAST5 is not set
-# CONFIG_CRYPTO_CAST6 is not set
-# CONFIG_CRYPTO_TEA is not set
-# CONFIG_CRYPTO_ARC4 is not set
-# CONFIG_CRYPTO_KHAZAD is not set
-# CONFIG_CRYPTO_ANUBIS is not set
-# CONFIG_CRYPTO_DEFLATE is not set
-# CONFIG_CRYPTO_MICHAEL_MIC is not set
-# CONFIG_CRYPTO_CRC32C is not set
-# CONFIG_CRYPTO_TEST is not set
+CONFIG_CRYPTO_HMAC=y
+CONFIG_CRYPTO_NULL=m
+CONFIG_CRYPTO_MD4=m
+CONFIG_CRYPTO_MD5=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA256=m
+CONFIG_CRYPTO_SHA512=m
+CONFIG_CRYPTO_WP512=m
+CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_DES=y
+CONFIG_CRYPTO_BLOWFISH=m
+CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_SERPENT=m
+CONFIG_CRYPTO_AES=m
+CONFIG_CRYPTO_CAST5=m
+CONFIG_CRYPTO_CAST6=m
+CONFIG_CRYPTO_TEA=m
+CONFIG_CRYPTO_ARC4=m
+CONFIG_CRYPTO_KHAZAD=m
+CONFIG_CRYPTO_ANUBIS=m
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_CRC32C=m
+CONFIG_CRYPTO_TEST=m
 
 #
 # Hardware crypto devices
@@ -1261,7 +1395,9 @@ CONFIG_CRYPTO=y
 #
 # Library routines
 #
-# CONFIG_CRC_CCITT is not set
+CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
-# CONFIG_LIBCRC32C is not set
+CONFIG_LIBCRC32C=m
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
index e23c4e1e3a25..c11a5bc7c067 100644
--- a/arch/parisc/kernel/asm-offsets.c
+++ b/arch/parisc/kernel/asm-offsets.c
@@ -288,8 +288,11 @@ int main(void)
         DEFINE(ASM_PGD_ENTRY_SIZE, PGD_ENTRY_SIZE);
         DEFINE(ASM_PMD_ENTRY_SIZE, PMD_ENTRY_SIZE);
         DEFINE(ASM_PTE_ENTRY_SIZE, PTE_ENTRY_SIZE);
+        DEFINE(ASM_PFN_PTE_SHIFT, PFN_PTE_SHIFT);
         DEFINE(ASM_PT_INITIAL, PT_INITIAL);
         DEFINE(ASM_PAGE_SIZE, PAGE_SIZE);
+        DEFINE(ASM_PAGE_SIZE_DIV64, PAGE_SIZE/64);
+        DEFINE(ASM_PAGE_SIZE_DIV128, PAGE_SIZE/128);
         BLANK();
         DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
         DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index 360b7391cb8c..c057ad7605ba 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -4,7 +4,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1999 Helge Deller (07-13-1999)
+ * Copyright (C) 1999-2006 Helge Deller <deller@gmx.de> (07-13-1999)
  * Copyright (C) 1999 SuSE GmbH Nuernberg
  * Copyright (C) 2000 Philipp Rumpf (prumpf@tux.org)
  *
@@ -358,5 +358,5 @@ void parisc_setup_cache_timing(void)
         if (!parisc_cache_flush_threshold)
                 parisc_cache_flush_threshold = FLUSH_THRESHOLD;
 
-        printk("Setting cache flush threshold to %x (%d CPUs online)\n", parisc_cache_flush_threshold, num_online_cpus());
+        printk(KERN_INFO "Setting cache flush threshold to %x (%d CPUs online)\n", parisc_cache_flush_threshold, num_online_cpus());
 }
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 7c95d7663c29..d9e53cf0372b 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -502,18 +502,20 @@
          * all ILP32 processes and all the kernel for machines with
          * under 4GB of memory) */
         .macro          L3_ptep pgd,pte,index,va,fault
+#if PT_NLEVELS == 3 /* we might have a 2-Level scheme, e.g. with 16kb page size */
         extrd,u         \va,63-ASM_PGDIR_SHIFT,ASM_BITS_PER_PGD,\index
         copy            %r0,\pte
-        extrd,u,*=      \va,31,32,%r0
+        extrd,u,*=      \va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
         ldw,s           \index(\pgd),\pgd
-        extrd,u,*=      \va,31,32,%r0
+        extrd,u,*=      \va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
         bb,>=,n         \pgd,_PxD_PRESENT_BIT,\fault
-        extrd,u,*=      \va,31,32,%r0
+        extrd,u,*=      \va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
         shld            \pgd,PxD_VALUE_SHIFT,\index
-        extrd,u,*=      \va,31,32,%r0
+        extrd,u,*=      \va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
         copy            \index,\pgd
-        extrd,u,*<>     \va,31,32,%r0
+        extrd,u,*<>     \va,63-ASM_PGDIR_SHIFT,64-ASM_PGDIR_SHIFT,%r0
         ldo             ASM_PGD_PMD_OFFSET(\pgd),\pgd
+#endif
         L2_ptep         \pgd,\pte,\index,\va,\fault
         .endm
 
@@ -563,10 +565,18 @@
         extrd,u,*=      \pte,_PAGE_GATEWAY_BIT+32,1,%r0
         depd            %r0,11,2,\prot  /* If Gateway, Set PL2 to 0 */
 
-        /* Get rid of prot bits and convert to page addr for iitlbt and idtlbt */
+        /* Enforce uncacheable pages.
+         * This should ONLY be use for MMIO on PA 2.0 machines.
+         * Memory/DMA is cache coherent on all PA2.0 machines we support
+         * (that means T-class is NOT supported) and the memory controllers
+         * on most of those machines only handles cache transactions.
+         */
+        extrd,u,*=      \pte,_PAGE_NO_CACHE_BIT+32,1,%r0
+        depi            1,12,1,\prot
 
-        depd            %r0,63,PAGE_SHIFT,\pte
-        extrd,s         \pte,(63-PAGE_SHIFT)+(63-58),64-PAGE_SHIFT,\pte
+        /* Drop prot bits and convert to page addr for iitlbt and idtlbt */
+        extrd,u         \pte,(63-ASM_PFN_PTE_SHIFT)+(63-58),64-PAGE_SHIFT,\pte
+        depdi           _PAGE_SIZE_ENCODING_DEFAULT,63,63-58,\pte
         .endm
 
         /* Identical macro to make_insert_tlb above, except it
@@ -584,9 +594,8 @@
 
         /* Get rid of prot bits and convert to page addr for iitlba */
 
-        depi            0,31,PAGE_SHIFT,\pte
+        depi            _PAGE_SIZE_ENCODING_DEFAULT,31,ASM_PFN_PTE_SHIFT,\pte
         extru           \pte,24,25,\pte
-
         .endm
 
         /* This is for ILP32 PA2.0 only.  The TLB insertion needs
@@ -1201,10 +1210,9 @@ intr_save:
          */
 
         /* adjust isr/ior. */
-
-        extrd,u         %r16,63,7,%r1    /* get high bits from isr for ior */
-        depd            %r1,31,7,%r17    /* deposit them into ior */
-        depdi           0,63,7,%r16      /* clear them from isr */
+        extrd,u         %r16,63,SPACEID_SHIFT,%r1       /* get high bits from isr for ior */
+        depd            %r1,31,SPACEID_SHIFT,%r17       /* deposit them into ior */
+        depdi           0,63,SPACEID_SHIFT,%r16         /* clear them from isr */
 #endif
         STREG           %r16, PT_ISR(%r29)
         STREG           %r17, PT_IOR(%r29)
diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
index 0b47afc20690..3e79e62f7b0b 100644
--- a/arch/parisc/kernel/head.S
+++ b/arch/parisc/kernel/head.S
@@ -76,16 +76,16 @@ $bss_loop:
         mtctl           %r4,%cr24       /* Initialize kernel root pointer */
         mtctl           %r4,%cr25       /* Initialize user root pointer */
 
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         /* Set pmd in pgd */
         load32          PA(pmd0),%r5
         shrd            %r5,PxD_VALUE_SHIFT,%r3 
-        ldo             (PxD_FLAG_PRESENT+PxD_FLAG_VALID)(%r3),%r3      
+        ldo             (PxD_FLAG_PRESENT+PxD_FLAG_VALID)(%r3),%r3
         stw             %r3,ASM_PGD_ENTRY*ASM_PGD_ENTRY_SIZE(%r4)
         ldo             ASM_PMD_ENTRY*ASM_PMD_ENTRY_SIZE(%r5),%r4
 #else
         /* 2-level page table, so pmd == pgd */
-        ldo             ASM_PGD_ENTRY*ASM_PGD_ENTRY_SIZE(%r4),%r4
+        ldo             ASM_PGD_ENTRY*ASM_PGD_ENTRY_SIZE(%r4),%r4
 #endif
 
         /* Fill in pmd with enough pte directories */
@@ -99,7 +99,7 @@ $bss_loop:
         stw             %r3,0(%r4)
         ldo             (ASM_PAGE_SIZE >> PxD_VALUE_SHIFT)(%r3),%r3
         addib,>         -1,%r1,1b
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         ldo             ASM_PMD_ENTRY_SIZE(%r4),%r4
 #else
         ldo             ASM_PGD_ENTRY_SIZE(%r4),%r4
@@ -107,13 +107,14 @@ $bss_loop:
 
 
         /* Now initialize the PTEs themselves */
-        ldo             _PAGE_KERNEL(%r0),%r3 /* Hardwired 0 phys addr start */
+        ldo             0+_PAGE_KERNEL(%r0),%r3 /* Hardwired 0 phys addr start */
+        ldi             (1<<(KERNEL_INITIAL_ORDER-PAGE_SHIFT)),%r11 /* PFN count */
         load32          PA(pg0),%r1
 
 $pgt_fill_loop:
         STREGM          %r3,ASM_PTE_ENTRY_SIZE(%r1)
-        ldo             ASM_PAGE_SIZE(%r3),%r3
-        bb,>=           %r3,31-KERNEL_INITIAL_ORDER,$pgt_fill_loop
+        ldo             (1<<PFN_PTE_SHIFT)(%r3),%r3 /* add one PFN */
+        addib,>         -1,%r11,$pgt_fill_loop
         nop
 
         /* Load the return address...er...crash 'n burn */
diff --git a/arch/parisc/kernel/init_task.c b/arch/parisc/kernel/init_task.c
index 7e898fd64415..8384bf9cecd2 100644
--- a/arch/parisc/kernel/init_task.c
+++ b/arch/parisc/kernel/init_task.c
@@ -53,17 +53,17 @@ union thread_union init_thread_union
         __attribute__((aligned(128))) __attribute__((__section__(".data.init_task"))) =
                 { INIT_THREAD_INFO(init_task) };
 
-#ifdef __LP64__
+#if PT_NLEVELS == 3
 /* NOTE: This layout exactly conforms to the hybrid L2/L3 page table layout
  * with the first pmd adjacent to the pgd and below it. gcc doesn't actually
  * guarantee that global objects will be laid out in memory in the same order 
  * as the order of declaration, so put these in different sections and use
  * the linker script to order them. */
-pmd_t pmd0[PTRS_PER_PMD] __attribute__ ((aligned(PAGE_SIZE))) __attribute__ ((__section__ (".data.vm0.pmd"))) = { {0}, };
-
+pmd_t pmd0[PTRS_PER_PMD] __attribute__ ((__section__ (".data.vm0.pmd"), aligned(PAGE_SIZE)));
 #endif
-pgd_t swapper_pg_dir[PTRS_PER_PGD] __attribute__ ((aligned(PAGE_SIZE))) __attribute__ ((__section__ (".data.vm0.pgd"))) = { {0}, };
-pte_t pg0[PT_INITIAL * PTRS_PER_PTE] __attribute__ ((aligned(PAGE_SIZE))) __attribute__ ((__section__ (".data.vm0.pte")))  = { {0}, };
+
+pgd_t swapper_pg_dir[PTRS_PER_PGD] __attribute__ ((__section__ (".data.vm0.pgd"), aligned(PAGE_SIZE)));
+pte_t pg0[PT_INITIAL * PTRS_PER_PTE] __attribute__ ((__section__ (".data.vm0.pte"), aligned(PAGE_SIZE)));
 
 /*
  * Initial task structure.
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 7a4f07e8d3c3..f600556414d1 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -65,7 +65,7 @@ flush_tlb_all_local:
          */
 
         /* pcxt_ssm_bug - relied upon translation! PA 2.0 Arch. F-4 and F-5 */
-        rsm     PSW_SM_I, %r19          /* save I-bit state */
+        rsm             PSW_SM_I, %r19          /* save I-bit state */
         load32          PA(1f), %r1
         nop
         nop
@@ -84,8 +84,7 @@ flush_tlb_all_local:
         rfi
         nop
 
-1:      ldil            L%PA(cache_info), %r1
-        ldo             R%PA(cache_info)(%r1), %r1
+1:      load32          PA(cache_info), %r1
 
         /* Flush Instruction Tlb */
 
@@ -212,8 +211,7 @@ flush_instruction_cache_local:
         .entry
 
         mtsp            %r0, %sr1
-        ldil            L%cache_info, %r1
-        ldo             R%cache_info(%r1), %r1
+        load32          cache_info, %r1
 
         /* Flush Instruction Cache */
 
@@ -254,8 +252,7 @@ flush_data_cache_local:
         .entry
 
         mtsp            %r0, %sr1
-        ldil            L%cache_info, %r1
-        ldo             R%cache_info(%r1), %r1
+        load32          cache_info, %r1
 
         /* Flush Data Cache */
 
@@ -303,7 +300,8 @@ copy_user_page_asm:
          */
 
         ldd             0(%r25), %r19
-        ldi             32, %r1                 /* PAGE_SIZE/128 == 32 */
+        ldi             ASM_PAGE_SIZE_DIV128, %r1
+
         ldw             64(%r25), %r0           /* prefetch 1 cacheline ahead */
         ldw             128(%r25), %r0          /* prefetch 2 */
 
@@ -368,7 +366,7 @@ copy_user_page_asm:
          * use ldd/std on a 32 bit kernel.
          */
         ldw             0(%r25), %r19
-        ldi             64, %r1         /* PAGE_SIZE/64 == 64 */
+        ldi             ASM_PAGE_SIZE_DIV64, %r1
 
 1:
         ldw             4(%r25), %r20
@@ -461,6 +459,7 @@ copy_user_page_asm:
         sub             %r25, %r1, %r23         /* move physical addr into non shadowed reg */
 
         ldil            L%(TMPALIAS_MAP_START), %r28
+        /* FIXME for different page sizes != 4k */
 #ifdef CONFIG_64BIT
         extrd,u         %r26,56,32, %r26                /* convert phys addr to tlb insert format */
         extrd,u         %r23,56,32, %r23                /* convert phys addr to tlb insert format */
@@ -551,6 +550,7 @@ __clear_user_page_asm:
 #ifdef CONFIG_64BIT
 #if (TMPALIAS_MAP_START >= 0x80000000)
         depdi           0, 31,32, %r28          /* clear any sign extension */
+        /* FIXME: page size dependend */
 #endif
         extrd,u         %r26, 56,32, %r26       /* convert phys addr to tlb insert format */
         depd            %r25, 63,22, %r28       /* Form aliased virtual address 'to' */
@@ -566,10 +566,10 @@ __clear_user_page_asm:
         pdtlb           0(%r28)
 
 #ifdef CONFIG_64BIT
-        ldi             32, %r1                 /* PAGE_SIZE/128 == 32 */
+        ldi             ASM_PAGE_SIZE_DIV128, %r1
 
         /* PREFETCH (Write) has not (yet) been proven to help here */
-/* #define      PREFETCHW_OP    ldd             256(%0), %r0 */
+        /* #define      PREFETCHW_OP    ldd             256(%0), %r0 */
 
 1:      std             %r0, 0(%r28)
         std             %r0, 8(%r28)
@@ -591,8 +591,7 @@ __clear_user_page_asm:
         ldo             128(%r28), %r28
 
 #else   /* ! CONFIG_64BIT */
-
-        ldi             64, %r1                 /* PAGE_SIZE/64 == 64 */
+        ldi             ASM_PAGE_SIZE_DIV64, %r1
 
 1:
         stw             %r0, 0(%r28)
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index d15a1d53e101..8b5df98e2b31 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -231,6 +231,14 @@ asmlinkage long parisc_fadvise64_64(int fd,
                         (loff_t)high_len << 32 | low_len, advice);
 }
 
+asmlinkage long parisc_sync_file_range(int fd,
+                        u32 hi_off, u32 lo_off, u32 hi_nbytes, u32 lo_nbytes,
+                        unsigned int flags)
+{
+        return sys_sync_file_range(fd, (loff_t)hi_off << 32 | lo_off,
+                        (loff_t)hi_nbytes << 32 | lo_nbytes, flags);
+}
+
 asmlinkage unsigned long sys_alloc_hugepages(int key, unsigned long addr, unsigned long len, int prot, int flag)
 {
         return -ENOMEM;
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index af88afef41bd..479d9a017cd1 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -55,7 +55,7 @@
          * pointers.
          */
 
-        .align 4096
+        .align ASM_PAGE_SIZE
 linux_gateway_page:
 
         /* ADDRESS 0x00 to 0xb0 = 176 bytes / 4 bytes per insn = 44 insns */
@@ -632,7 +632,7 @@ cas_action:
 end_compare_and_swap:
 
         /* Make sure nothing else is placed on this page */
-        .align 4096
+        .align ASM_PAGE_SIZE
         .export end_linux_gateway_page
 end_linux_gateway_page:
 
@@ -652,7 +652,7 @@ end_linux_gateway_page:
 
         .section .rodata,"a"
 
-        .align 4096
+        .align ASM_PAGE_SIZE
         /* Light-weight-syscall table */
         /* Start of lws table. */
         .export lws_table
@@ -662,14 +662,14 @@ lws_table:
         LWS_ENTRY(compare_and_swap64)   /* 1 - ELF64 Atomic compare and swap */
         /* End of lws table */
 
-        .align 4096
+        .align ASM_PAGE_SIZE
         .export sys_call_table
 .Lsys_call_table:
 sys_call_table:
 #include "syscall_table.S"
 
 #ifdef CONFIG_64BIT
-        .align 4096
+        .align ASM_PAGE_SIZE
         .export sys_call_table64
 .Lsys_call_table64:
 sys_call_table64:
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index bbeeb614cfab..e27b432f90a8 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -13,7 +13,7 @@
  *    Copyright (C) 2001 Helge Deller <deller at parisc-linux.org>
  *    Copyright (C) 2000-2001 Thomas Bogendoerfer <tsbogend at parisc-linux.org>
  *    Copyright (C) 2002 Randolph Chung <tausq with parisc-linux.org>
- *
+ *    Copyright (C) 2005-2006 Kyle McMartin <kyle at parisc-linux.org>
  *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
@@ -393,5 +393,11 @@
         ENTRY_SAME(readlinkat)          /* 285 */
         ENTRY_SAME(fchmodat)
         ENTRY_SAME(faccessat)
+        ENTRY_SAME(unshare)
+        ENTRY_COMP(set_robust_list)
+        ENTRY_COMP(get_robust_list)     /* 290 */
+        ENTRY_SAME(splice)
+        ENTRY_OURS(sync_file_range)
+        ENTRY_SAME(tee)
         /* Nothing yet */
 
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 6d6436a6b624..94dcc03a28ed 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -6,6 +6,7 @@
  *    Copyright (C) 2000 Michael Ang <mang with subcarrier.org>
  *    Copyright (C) 2002 Randolph Chung <tausq with parisc-linux.org>
  *    Copyright (C) 2003 James Bottomley <jejb with parisc-linux.org>
+ *    Copyright (C) 2006 Helge Deller <deller@gmx.de>
  *
  *
  *    This program is free software; you can redistribute it and/or modify
@@ -27,6 +28,7 @@
 /* needed for the processor specific cache alignment size */    
 #include <asm/cache.h>
 #include <asm/page.h>
+#include <asm/asm-offsets.h>
         
 /* ld script to make hppa Linux kernel */
 #ifndef CONFIG_64BIT
@@ -68,7 +70,7 @@ SECTIONS
   RODATA
 
   /* writeable */
-  . = ALIGN(4096);              /* Make sure this is page aligned so
+  . = ALIGN(ASM_PAGE_SIZE);     /* Make sure this is page aligned so
                                    that we can properly leave these
                                    as writable */
   data_start = .;
@@ -81,23 +83,17 @@ SECTIONS
   __start___unwind = .;         /* unwind info */
   .PARISC.unwind : { *(.PARISC.unwind) }
   __stop___unwind = .;
- 
+
+  /* rarely changed data like cpu maps */
+  . = ALIGN(16);
+  .data.read_mostly : { *(.data.read_mostly) }
+
+  . = ALIGN(L1_CACHE_BYTES);
   .data : {                     /* Data */
         *(.data)
-        *(.data.vm0.pmd)
-        *(.data.vm0.pgd)
-        *(.data.vm0.pte)
         CONSTRUCTORS
         }
 
-  . = ALIGN(4096);
-  /* nosave data is really only used for software suspend...it's here
-   * just in case we ever implement it */
-  __nosave_begin = .;
-  .data_nosave : { *(.data.nosave) }
-  . = ALIGN(4096);
-  __nosave_end = .;
-
   . = ALIGN(L1_CACHE_BYTES);
   .data.cacheline_aligned : { *(.data.cacheline_aligned) }
 
@@ -105,12 +101,29 @@ SECTIONS
   . = ALIGN(16);
   .data.lock_aligned : { *(.data.lock_aligned) }
 
-  /* rarely changed data like cpu maps */
-  . = ALIGN(16);
-  .data.read_mostly : { *(.data.read_mostly) }
+  . = ALIGN(ASM_PAGE_SIZE);
+  /* nosave data is really only used for software suspend...it's here
+   * just in case we ever implement it */
+  __nosave_begin = .;
+  .data_nosave : { *(.data.nosave) }
+  . = ALIGN(ASM_PAGE_SIZE);
+  __nosave_end = .;
 
   _edata = .;                   /* End of data section */
 
+  __bss_start = .;              /* BSS */
+  /* page table entries need to be PAGE_SIZE aligned */
+  . = ALIGN(ASM_PAGE_SIZE);
+  .data.vmpages : {
+        *(.data.vm0.pmd)
+        *(.data.vm0.pgd)
+        *(.data.vm0.pte)
+        }
+  .bss : { *(.bss) *(COMMON) }
+  __bss_stop = .;
+
+
+  /* assembler code expects init_task to be 16k aligned */
   . = ALIGN(16384);             /* init_task */
   .data.init_task : { *(.data.init_task) }
 
@@ -126,6 +139,7 @@ SECTIONS
   .dlt : { *(.dlt) }
 #endif
 
+  /* reserve space for interrupt stack by aligning __init* to 16k */
   . = ALIGN(16384);
   __init_begin = .;
   .init.text : { 
@@ -166,7 +180,7 @@ SECTIONS
      from .altinstructions and .eh_frame */
   .exit.text : { *(.exit.text) }
   .exit.data : { *(.exit.data) }
-  . = ALIGN(4096);
+  . = ALIGN(ASM_PAGE_SIZE);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
   __initramfs_end = .;
@@ -174,14 +188,10 @@ SECTIONS
   __per_cpu_start = .;
   .data.percpu  : { *(.data.percpu) }
   __per_cpu_end = .;
-  . = ALIGN(4096);
+  . = ALIGN(ASM_PAGE_SIZE);
   __init_end = .;
   /* freed after init ends here */
         
-  __bss_start = .;              /* BSS */
-  .bss : { *(.bss) *(COMMON) }
-  __bss_stop = .; 
-
   _end = . ;
 
   /* Sections to be discarded */
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index 0ad945d4c0a4..64785e46f93b 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -186,7 +186,7 @@ good_area:
                 break;
               case VM_FAULT_SIGBUS:
                 /*
-                 * We hit a hared mapping outside of the file, or some
+                 * We hit a shared mapping outside of the file, or some
                  * other thing happened to us that made us unable to
                  * handle the page fault gracefully.
                  */
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 3796be67cd53..631712562656 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -6,6 +6,7 @@
  *    changed by Philipp Rumpf
  *  Copyright 1999 Philipp Rumpf (prumpf@tux.org)
  *  Copyright 2004 Randolph Chung (tausq@debian.org)
+ *  Copyright 2006 Helge Deller (deller@gmx.de)
  *
  */
 
@@ -371,8 +372,8 @@ static void __init setup_bootmem(void)
 
 void free_initmem(void)
 {
-        unsigned long addr;
-        
+        unsigned long addr, init_begin, init_end;
+
         printk(KERN_INFO "Freeing unused kernel memory: ");
 
 #ifdef CONFIG_DEBUG_KERNEL
@@ -395,8 +396,11 @@ void free_initmem(void)
         local_irq_enable();
 #endif
         
-        addr = (unsigned long)(&__init_begin);
-        for (; addr < (unsigned long)(&__init_end); addr += PAGE_SIZE) {
+        /* align __init_begin and __init_end to page size,
+           ignoring linker script where we might have tried to save RAM */
+        init_begin = PAGE_ALIGN((unsigned long)(&__init_begin));
+        init_end   = PAGE_ALIGN((unsigned long)(&__init_end));
+        for (addr = init_begin; addr < init_end; addr += PAGE_SIZE) {
                 ClearPageReserved(virt_to_page(addr));
                 init_page_count(virt_to_page(addr));
                 free_page(addr);
@@ -407,7 +411,7 @@ void free_initmem(void)
         /* set up a new led state on systems shipped LED State panel */
         pdc_chassis_send_status(PDC_CHASSIS_DIRECT_BCOMPLETE);
         
-        printk("%luk freed\n", (unsigned long)(&__init_end - &__init_begin) >> 10);
+        printk("%luk freed\n", (init_end - init_begin) >> 10);
 }
 
 
@@ -639,11 +643,13 @@ static void __init map_pages(unsigned long start_vaddr, unsigned long start_padd
                                  * Map the fault vector writable so we can
                                  * write the HPMC checksum.
                                  */
+#if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
                                 if (address >= ro_start && address < ro_end
                                                         && address != fv_addr
                                                         && address != gw_addr)
                                     pte = __mk_pte(address, PAGE_KERNEL_RO);
                                 else
+#endif
                                     pte = __mk_pte(address, pgprot);
 
                                 if (address >= end_paddr)
@@ -874,8 +880,7 @@ unsigned long alloc_sid(void)
                         flush_tlb_all(); /* flush_tlb_all() calls recycle_sids() */
                         spin_lock(&sid_lock);
                 }
-                if (free_space_ids == 0)
-                        BUG();
+                BUG_ON(free_space_ids == 0);
         }
 
         free_space_ids--;
@@ -899,8 +904,7 @@ void free_sid(unsigned long spaceid)
 
         spin_lock(&sid_lock);
 
-        if (*dirty_space_offset & (1L << index))
-            BUG(); /* attempt to free space id twice */
+        BUG_ON(*dirty_space_offset & (1L << index)); /* attempt to free space id twice */
 
         *dirty_space_offset |= (1L << index);
         dirty_space_ids++;
@@ -975,7 +979,7 @@ static void recycle_sids(void)
 
 static unsigned long recycle_ndirty;
 static unsigned long recycle_dirty_array[SID_ARRAY_SIZE];
-static unsigned int recycle_inuse = 0;
+static unsigned int recycle_inuse;
 
 void flush_tlb_all(void)
 {
@@ -984,9 +988,7 @@ void flush_tlb_all(void)
         do_recycle = 0;
         spin_lock(&sid_lock);
         if (dirty_space_ids > RECYCLE_THRESHOLD) {
-            if (recycle_inuse) {
-                BUG();  /* FIXME: Use a semaphore/wait queue here */
-            }
+            BUG_ON(recycle_inuse);  /* FIXME: Use a semaphore/wait queue here */
             get_dirty_sids(&recycle_ndirty,recycle_dirty_array);
             recycle_inuse++;
             do_recycle++;
diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c
index 0db12818d7bc..27384567a1d0 100644
--- a/arch/parisc/mm/ioremap.c
+++ b/arch/parisc/mm/ioremap.c
@@ -2,7 +2,7 @@
  * arch/parisc/mm/ioremap.c
  *
  * (C) Copyright 1995 1996 Linus Torvalds
- * (C) Copyright 2001 Helge Deller <deller@gmx.de>
+ * (C) Copyright 2001-2006 Helge Deller <deller@gmx.de>
  * (C) Copyright 2005 Kyle McMartin <kyle@parisc-linux.org>
  */
 
@@ -138,6 +138,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
         if ((phys_addr >= 0x00080000 && end < 0x000fffff) ||
             (phys_addr >= 0x00500000 && end < 0x03bfffff)) {
                 phys_addr |= F_EXTEND(0xfc000000);
+                flags |= _PAGE_NO_CACHE;
         }
 #endif
 
diff --git a/arch/powerpc/configs/g5_defconfig b/arch/powerpc/configs/g5_defconfig
index 2c3fd2007676..a45627547d03 100644
--- a/arch/powerpc/configs/g5_defconfig
+++ b/arch/powerpc/configs/g5_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc2
-# Fri Feb 10 17:33:08 2006
+# Linux kernel version: 2.6.17-rc1
+# Wed Apr 19 13:24:37 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -9,6 +9,7 @@ CONFIG_PPC_MERGE=y
 CONFIG_MMU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
@@ -29,6 +30,7 @@ CONFIG_POWER4=y
 CONFIG_PPC_FPU=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
+CONFIG_VIRT_CPU_ACCOUNTING=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=4
 
@@ -53,6 +55,7 @@ CONFIG_SYSCTL=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
@@ -67,10 +70,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -82,7 +81,6 @@ CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_KMOD=y
@@ -91,6 +89,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -185,7 +184,6 @@ CONFIG_GENERIC_ISA_DMA=y
 # CONFIG_PPC_INDIRECT_PCI is not set
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
-CONFIG_PCI_LEGACY_PROC=y
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -227,6 +225,7 @@ CONFIG_SYN_COOKIES=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_TUNNEL=m
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
@@ -238,6 +237,8 @@ CONFIG_TCP_CONG_BIC=y
 #
 # CONFIG_IP_VS is not set
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 
@@ -261,6 +262,7 @@ CONFIG_IP_NF_IRC=m
 CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
+# CONFIG_IP_NF_H323 is not set
 CONFIG_IP_NF_QUEUE=m
 
 #
@@ -513,6 +515,7 @@ CONFIG_MD_RAID0=y
 CONFIG_MD_RAID1=y
 CONFIG_MD_RAID10=m
 CONFIG_MD_RAID5=y
+# CONFIG_MD_RAID5_RESHAPE is not set
 CONFIG_MD_RAID6=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_MD_FAULTY=m
@@ -761,7 +764,6 @@ CONFIG_LEGACY_PTY_COUNT=256
 # Watchdog Cards
 #
 # CONFIG_WATCHDOG is not set
-# CONFIG_RTC is not set
 CONFIG_GEN_RTC=y
 # CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
@@ -772,6 +774,7 @@ CONFIG_GEN_RTC=y
 # Ftape, the floppy tape device driver
 #
 CONFIG_AGP=m
+# CONFIG_AGP_VIA is not set
 CONFIG_AGP_UNINORTH=m
 # CONFIG_DRM is not set
 CONFIG_RAW_DRIVER=y
@@ -813,7 +816,6 @@ CONFIG_I2C_POWERMAC=y
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -832,9 +834,7 @@ CONFIG_I2C_POWERMAC=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -862,10 +862,6 @@ CONFIG_I2C_POWERMAC=y
 #
 
 #
-# Multimedia Capabilities Port drivers
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -874,6 +870,7 @@ CONFIG_I2C_POWERMAC=y
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
@@ -883,6 +880,7 @@ CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 CONFIG_FB_MACMODES=y
+CONFIG_FB_FIRMWARE_EDID=y
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_CIRRUS is not set
@@ -901,7 +899,6 @@ CONFIG_FB_NVIDIA=y
 CONFIG_FB_NVIDIA_I2C=y
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
-# CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=y
 CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_RADEON_DEBUG is not set
@@ -958,9 +955,11 @@ CONFIG_SND_SEQUENCER=m
 CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=m
 CONFIG_SND_PCM_OSS=m
+CONFIG_SND_PCM_OSS_PLUGINS=y
 CONFIG_SND_SEQUENCER_OSS=y
 # CONFIG_SND_DYNAMIC_MINORS is not set
 CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_VERBOSE_PROCFS=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -977,6 +976,7 @@ CONFIG_SND_SUPPORT_OLD_API=y
 # PCI devices
 #
 # CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS300 is not set
 # CONFIG_SND_ALS4000 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
@@ -1009,6 +1009,7 @@ CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_MIXART is not set
 # CONFIG_SND_NM256 is not set
 # CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RIPTIDE is not set
 # CONFIG_SND_RME32 is not set
 # CONFIG_SND_RME96 is not set
 # CONFIG_SND_RME9652 is not set
@@ -1041,6 +1042,7 @@ CONFIG_SND_USB_AUDIO=m
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -1068,7 +1070,6 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 #
 # USB Device Class drivers
 #
-# CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
 CONFIG_USB_ACM=m
 CONFIG_USB_PRINTER=y
 
@@ -1126,15 +1127,6 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_MICROTEK is not set
 
 #
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-
-#
-# Video4Linux support is needed for USB Multimedia device support
-#
-
-#
 # USB Network Adapters
 #
 CONFIG_USB_CATC=m
@@ -1194,6 +1186,7 @@ CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y
 CONFIG_USB_SERIAL_KLSI=m
 CONFIG_USB_SERIAL_KOBIL_SCT=m
 CONFIG_USB_SERIAL_MCT_U232=m
+# CONFIG_USB_SERIAL_NAVMAN is not set
 CONFIG_USB_SERIAL_PL2303=m
 # CONFIG_USB_SERIAL_HP4X is not set
 CONFIG_USB_SERIAL_SAFE=m
@@ -1237,17 +1230,23 @@ CONFIG_USB_EZUSB=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
-# EDAC - error detection and reporting (RAS)
+# Real Time Clock
 #
+# CONFIG_RTC_CLASS is not set
 
 #
 # File systems
@@ -1319,7 +1318,6 @@ CONFIG_TMPFS=y
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
diff --git a/arch/powerpc/configs/iseries_defconfig b/arch/powerpc/configs/iseries_defconfig
index 1816a46742f6..a95e455a1944 100644
--- a/arch/powerpc/configs/iseries_defconfig
+++ b/arch/powerpc/configs/iseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc6
-# Wed Mar 15 16:19:52 2006
+# Linux kernel version: 2.6.17-rc1
+# Wed Apr 19 11:46:44 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -9,6 +9,7 @@ CONFIG_PPC_MERGE=y
 CONFIG_MMU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
@@ -30,6 +31,7 @@ CONFIG_POWER4=y
 CONFIG_PPC_FPU=y
 # CONFIG_ALTIVEC is not set
 CONFIG_PPC_STD_MMU=y
+CONFIG_VIRT_CPU_ACCOUNTING=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=32
 
@@ -55,6 +57,7 @@ CONFIG_AUDITSYSCALL=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
@@ -69,10 +72,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -84,7 +83,6 @@ CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_KMOD=y
@@ -93,6 +91,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -165,7 +164,6 @@ CONFIG_GENERIC_ISA_DMA=y
 # CONFIG_PPC_INDIRECT_PCI is not set
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
-CONFIG_PCI_LEGACY_PROC=y
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -207,6 +205,7 @@ CONFIG_SYN_COOKIES=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_TUNNEL=m
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
@@ -218,6 +217,8 @@ CONFIG_TCP_CONG_BIC=y
 #
 # CONFIG_IP_VS is not set
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 
@@ -236,11 +237,14 @@ CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
 CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
 # CONFIG_NETFILTER_XT_MATCH_DCCP is not set
+# CONFIG_NETFILTER_XT_MATCH_ESP is not set
 CONFIG_NETFILTER_XT_MATCH_HELPER=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
 CONFIG_NETFILTER_XT_MATCH_LIMIT=m
 CONFIG_NETFILTER_XT_MATCH_MAC=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
+# CONFIG_NETFILTER_XT_MATCH_POLICY is not set
+# CONFIG_NETFILTER_XT_MATCH_MULTIPORT is not set
 CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_SCTP=m
@@ -262,20 +266,19 @@ CONFIG_IP_NF_IRC=m
 CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
+# CONFIG_IP_NF_H323 is not set
 CONFIG_IP_NF_QUEUE=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
 CONFIG_IP_NF_MATCH_TOS=m
 CONFIG_IP_NF_MATCH_RECENT=m
 CONFIG_IP_NF_MATCH_ECN=m
 CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
+# CONFIG_IP_NF_MATCH_AH is not set
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_MATCH_OWNER=m
 CONFIG_IP_NF_MATCH_ADDRTYPE=m
 CONFIG_IP_NF_MATCH_HASHLIMIT=m
-CONFIG_IP_NF_MATCH_POLICY=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_TARGET_LOG=m
@@ -479,6 +482,7 @@ CONFIG_MD_RAID0=y
 CONFIG_MD_RAID1=y
 CONFIG_MD_RAID10=m
 CONFIG_MD_RAID5=y
+# CONFIG_MD_RAID5_RESHAPE is not set
 CONFIG_MD_RAID6=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_MD_FAULTY=m
@@ -702,7 +706,6 @@ CONFIG_LEGACY_PTY_COUNT=256
 # Watchdog Cards
 #
 # CONFIG_WATCHDOG is not set
-# CONFIG_RTC is not set
 CONFIG_GEN_RTC=y
 # CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
@@ -751,10 +754,6 @@ CONFIG_MAX_RAW_DEVS=256
 #
 
 #
-# Multimedia Capabilities Port drivers
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -779,6 +778,7 @@ CONFIG_MAX_RAW_DEVS=256
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_USB is not set
 
 #
@@ -796,6 +796,11 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
@@ -805,6 +810,11 @@ CONFIG_USB_ARCH_HAS_OHCI=y
 #
 
 #
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -878,7 +888,6 @@ CONFIG_TMPFS=y
 # CONFIG_HUGETLBFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index daaf038a1faa..58e68ce09b0f 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc2
-# Fri Feb 10 17:33:32 2006
+# Linux kernel version: 2.6.17-rc1
+# Wed Apr 19 11:48:00 2006
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -9,6 +9,7 @@ CONFIG_PPC_MERGE=y
 CONFIG_MMU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
@@ -30,6 +31,7 @@ CONFIG_POWER4=y
 CONFIG_PPC_FPU=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
+CONFIG_VIRT_CPU_ACCOUNTING=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=128
 
@@ -55,6 +57,7 @@ CONFIG_AUDITSYSCALL=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
@@ -69,10 +72,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -84,7 +83,6 @@ CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 CONFIG_KMOD=y
@@ -93,6 +91,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -188,7 +187,6 @@ CONFIG_PPC_I8259=y
 # CONFIG_PPC_INDIRECT_PCI is not set
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
-CONFIG_PCI_LEGACY_PROC=y
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -235,6 +233,7 @@ CONFIG_SYN_COOKIES=y
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
 CONFIG_INET_IPCOMP=m
+CONFIG_INET_XFRM_TUNNEL=m
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
@@ -246,6 +245,8 @@ CONFIG_TCP_CONG_BIC=y
 #
 # CONFIG_IP_VS is not set
 # CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 
@@ -272,6 +273,7 @@ CONFIG_IP_NF_IRC=m
 CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
+# CONFIG_IP_NF_H323 is not set
 CONFIG_IP_NF_QUEUE=m
 
 #
@@ -519,6 +521,7 @@ CONFIG_MD_RAID0=y
 CONFIG_MD_RAID1=y
 CONFIG_MD_RAID10=m
 CONFIG_MD_RAID5=y
+# CONFIG_MD_RAID5_RESHAPE is not set
 CONFIG_MD_RAID6=m
 CONFIG_MD_MULTIPATH=m
 CONFIG_MD_FAULTY=m
@@ -750,6 +753,7 @@ CONFIG_HW_CONSOLE=y
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_PCI=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -767,7 +771,9 @@ CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_PRINTER is not set
 # CONFIG_PPDEV is not set
 # CONFIG_TIPAR is not set
+CONFIG_HVC_DRIVER=y
 CONFIG_HVC_CONSOLE=y
+# CONFIG_HVC_RTAS is not set
 CONFIG_HVCS=m
 
 #
@@ -779,7 +785,6 @@ CONFIG_HVCS=m
 # Watchdog Cards
 #
 # CONFIG_WATCHDOG is not set
-# CONFIG_RTC is not set
 CONFIG_GEN_RTC=y
 # CONFIG_GEN_RTC_X is not set
 # CONFIG_DTLK is not set
@@ -830,7 +835,6 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_PROSAVAGE is not set
 # CONFIG_I2C_SAVAGE4 is not set
-# CONFIG_SCx200_ACB is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
@@ -849,9 +853,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -879,10 +881,6 @@ CONFIG_I2C_ALGOBIT=y
 #
 
 #
-# Multimedia Capabilities Port drivers
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -891,6 +889,7 @@ CONFIG_I2C_ALGOBIT=y
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
@@ -900,6 +899,7 @@ CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 CONFIG_FB_MACMODES=y
+CONFIG_FB_FIRMWARE_EDID=y
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_CIRRUS is not set
@@ -919,7 +919,6 @@ CONFIG_FB_MATROX_MYSTIQUE=y
 CONFIG_FB_MATROX_G=y
 # CONFIG_FB_MATROX_I2C is not set
 CONFIG_FB_MATROX_MULTIHEAD=y
-# CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=y
 CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_RADEON_DEBUG is not set
@@ -968,6 +967,7 @@ CONFIG_LCD_DEVICE=y
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
 
@@ -1048,15 +1048,6 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_MICROTEK is not set
 
 #
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-
-#
-# Video4Linux support is needed for USB Multimedia device support
-#
-
-#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -1109,6 +1100,11 @@ CONFIG_USB_MON=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
 # InfiniBand support
 #
 CONFIG_INFINIBAND=m
@@ -1121,12 +1117,13 @@ CONFIG_INFINIBAND_IPOIB=m
 # CONFIG_INFINIBAND_SRP is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
-# EDAC - error detection and reporting (RAS)
+# Real Time Clock
 #
+# CONFIG_RTC_CLASS is not set
 
 #
 # File systems
@@ -1202,7 +1199,6 @@ CONFIG_TMPFS=y
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index d9a7fdef59b9..4eba60a32890 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -61,6 +61,7 @@ __setup("iommu=", setup_iommu);
 static unsigned long iommu_range_alloc(struct iommu_table *tbl,
                                        unsigned long npages,
                                        unsigned long *handle,
+                                       unsigned long mask,
                                        unsigned int align_order)
 { 
         unsigned long n, end, i, start;
@@ -97,9 +98,21 @@ static unsigned long iommu_range_alloc(struct iommu_table *tbl,
          */
         if (start >= limit)
                 start = largealloc ? tbl->it_largehint : tbl->it_hint;
-        
+
  again:
 
+        if (limit + tbl->it_offset > mask) {
+                limit = mask - tbl->it_offset + 1;
+                /* If we're constrained on address range, first try
+                 * at the masked hint to avoid O(n) search complexity,
+                 * but on second pass, start at 0.
+                 */
+                if ((start & mask) >= limit || pass > 0)
+                        start = 0;
+                else
+                        start &= mask;
+        }
+
         n = find_next_zero_bit(tbl->it_map, limit, start);
 
         /* Align allocation */
@@ -150,14 +163,14 @@ static unsigned long iommu_range_alloc(struct iommu_table *tbl,
 
 static dma_addr_t iommu_alloc(struct iommu_table *tbl, void *page,
                        unsigned int npages, enum dma_data_direction direction,
-                       unsigned int align_order)
+                       unsigned long mask, unsigned int align_order)
 {
         unsigned long entry, flags;
         dma_addr_t ret = DMA_ERROR_CODE;
-        
+
         spin_lock_irqsave(&(tbl->it_lock), flags);
 
-        entry = iommu_range_alloc(tbl, npages, NULL, align_order);
+        entry = iommu_range_alloc(tbl, npages, NULL, mask, align_order);
 
         if (unlikely(entry == DMA_ERROR_CODE)) {
                 spin_unlock_irqrestore(&(tbl->it_lock), flags);
@@ -236,7 +249,7 @@ static void iommu_free(struct iommu_table *tbl, dma_addr_t dma_addr,
 
 int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                 struct scatterlist *sglist, int nelems,
-                enum dma_data_direction direction)
+                unsigned long mask, enum dma_data_direction direction)
 {
         dma_addr_t dma_next = 0, dma_addr;
         unsigned long flags;
@@ -274,7 +287,7 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                 vaddr = (unsigned long)page_address(s->page) + s->offset;
                 npages = PAGE_ALIGN(vaddr + slen) - (vaddr & PAGE_MASK);
                 npages >>= PAGE_SHIFT;
-                entry = iommu_range_alloc(tbl, npages, &handle, 0);
+                entry = iommu_range_alloc(tbl, npages, &handle, mask >> PAGE_SHIFT, 0);
 
                 DBG("  - vaddr: %lx, size: %lx\n", vaddr, slen);
 
@@ -479,7 +492,8 @@ void iommu_free_table(struct device_node *dn)
  * byte within the page as vaddr.
  */
 dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
-                size_t size, enum dma_data_direction direction)
+                size_t size, unsigned long mask,
+                enum dma_data_direction direction)
 {
         dma_addr_t dma_handle = DMA_ERROR_CODE;
         unsigned long uaddr;
@@ -492,7 +506,8 @@ dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
         npages >>= PAGE_SHIFT;
 
         if (tbl) {
-                dma_handle = iommu_alloc(tbl, vaddr, npages, direction, 0);
+                dma_handle = iommu_alloc(tbl, vaddr, npages, direction,
+                                         mask >> PAGE_SHIFT, 0);
                 if (dma_handle == DMA_ERROR_CODE) {
                         if (printk_ratelimit())  {
                                 printk(KERN_INFO "iommu_alloc failed, "
@@ -521,7 +536,7 @@ void iommu_unmap_single(struct iommu_table *tbl, dma_addr_t dma_handle,
  * to the dma address (mapping) of the first page.
  */
 void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
-                dma_addr_t *dma_handle, gfp_t flag)
+                dma_addr_t *dma_handle, unsigned long mask, gfp_t flag)
 {
         void *ret = NULL;
         dma_addr_t mapping;
@@ -551,7 +566,8 @@ void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
         memset(ret, 0, size);
 
         /* Set up tces to cover the allocated range */
-        mapping = iommu_alloc(tbl, ret, npages, DMA_BIDIRECTIONAL, order);
+        mapping = iommu_alloc(tbl, ret, npages, DMA_BIDIRECTIONAL,
+                              mask >> PAGE_SHIFT, order);
         if (mapping == DMA_ERROR_CODE) {
                 free_pages((unsigned long)ret, order);
                 ret = NULL;
diff --git a/arch/powerpc/kernel/pci_iommu.c b/arch/powerpc/kernel/pci_iommu.c
index c336f3e31cff..c1d95e14bbed 100644
--- a/arch/powerpc/kernel/pci_iommu.c
+++ b/arch/powerpc/kernel/pci_iommu.c
@@ -59,6 +59,25 @@ static inline struct iommu_table *devnode_table(struct device *dev)
 }
 
 
+static inline unsigned long device_to_mask(struct device *hwdev)
+{
+        struct pci_dev *pdev;
+
+        if (!hwdev) {
+                pdev = ppc64_isabridge_dev;
+                if (!pdev) /* This is the best guess we can do */
+                        return 0xfffffffful;
+        } else
+                pdev = to_pci_dev(hwdev);
+
+        if (pdev->dma_mask)
+                return pdev->dma_mask;
+
+        /* Assume devices without mask can take 32 bit addresses */
+        return 0xfffffffful;
+}
+
+
 /* Allocates a contiguous real buffer and creates mappings over it.
  * Returns the virtual address of the buffer and sets dma_handle
  * to the dma address (mapping) of the first page.
@@ -67,7 +86,7 @@ static void *pci_iommu_alloc_coherent(struct device *hwdev, size_t size,
                            dma_addr_t *dma_handle, gfp_t flag)
 {
         return iommu_alloc_coherent(devnode_table(hwdev), size, dma_handle,
-                        flag);
+                        device_to_mask(hwdev), flag);
 }
 
 static void pci_iommu_free_coherent(struct device *hwdev, size_t size,
@@ -85,7 +104,8 @@ static void pci_iommu_free_coherent(struct device *hwdev, size_t size,
 static dma_addr_t pci_iommu_map_single(struct device *hwdev, void *vaddr,
                 size_t size, enum dma_data_direction direction)
 {
-        return iommu_map_single(devnode_table(hwdev), vaddr, size, direction);
+        return iommu_map_single(devnode_table(hwdev), vaddr, size,
+                                device_to_mask(hwdev), direction);
 }
 
 
@@ -100,7 +120,7 @@ static int pci_iommu_map_sg(struct device *pdev, struct scatterlist *sglist,
                 int nelems, enum dma_data_direction direction)
 {
         return iommu_map_sg(pdev, devnode_table(pdev), sglist,
-                        nelems, direction);
+                        nelems, device_to_mask(pdev), direction);
 }
 
 static void pci_iommu_unmap_sg(struct device *pdev, struct scatterlist *sglist,
@@ -112,7 +132,19 @@ static void pci_iommu_unmap_sg(struct device *pdev, struct scatterlist *sglist,
 /* We support DMA to/from any memory page via the iommu */
 static int pci_iommu_dma_supported(struct device *dev, u64 mask)
 {
-        return 1;
+        struct iommu_table *tbl = devnode_table(dev);
+
+        if (!tbl || tbl->it_offset > mask) {
+                printk(KERN_INFO "Warning: IOMMU table offset too big for device mask\n");
+                if (tbl)
+                        printk(KERN_INFO "mask: 0x%08lx, table offset: 0x%08lx\n",
+                                mask, tbl->it_offset);
+                else
+                        printk(KERN_INFO "mask: 0x%08lx, table unavailable\n",
+                                mask);
+                return 0;
+        } else
+                return 1;
 }
 
 void pci_iommu_init(void)
diff --git a/arch/powerpc/kernel/ppc_ksyms.c b/arch/powerpc/kernel/ppc_ksyms.c
index dfa5398ab3c8..4b052ae5dc34 100644
--- a/arch/powerpc/kernel/ppc_ksyms.c
+++ b/arch/powerpc/kernel/ppc_ksyms.c
@@ -81,6 +81,7 @@ EXPORT_SYMBOL(strcat);
 EXPORT_SYMBOL(strlen);
 EXPORT_SYMBOL(strcmp);
 EXPORT_SYMBOL(strcasecmp);
+EXPORT_SYMBOL(strncasecmp);
 
 EXPORT_SYMBOL(csum_partial);
 EXPORT_SYMBOL(csum_partial_copy_generic);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 4336390bcf34..1cb69e8fb0b1 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -62,7 +62,7 @@ static int __initdata dt_root_addr_cells;
 static int __initdata dt_root_size_cells;
 
 #ifdef CONFIG_PPC64
-static int __initdata iommu_is_off;
+int __initdata iommu_is_off;
 int __initdata iommu_force_on;
 unsigned long tce_alloc_start, tce_alloc_end;
 #endif
diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
index 73560ef6f802..ed737cacf92d 100644
--- a/arch/powerpc/kernel/sysfs.c
+++ b/arch/powerpc/kernel/sysfs.c
@@ -279,7 +279,7 @@ static void unregister_cpu_online(unsigned int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit sysfs_cpu_notify(struct notifier_block *self,
+static int sysfs_cpu_notify(struct notifier_block *self,
                                       unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned int)(long)hcpu;
@@ -297,7 +297,7 @@ static int __devinit sysfs_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata sysfs_cpu_nb = {
+static struct notifier_block sysfs_cpu_nb = {
         .notifier_call  = sysfs_cpu_notify,
 };
 
diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
index a14c96403840..0b98eea73c5e 100644
--- a/arch/powerpc/kernel/systbl.S
+++ b/arch/powerpc/kernel/systbl.S
@@ -324,3 +324,9 @@ COMPAT_SYS(ppoll)
 SYSCALL(unshare)
 SYSCALL(splice)
 SYSCALL(tee)
+SYSCALL(vmsplice)
+
+/*
+ * please add new calls to arch/powerpc/platforms/cell/spu_callbacks.c
+ * as well when appropriate.
+ */
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index 13c655ba2841..971020cf3f7d 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -202,7 +202,7 @@ static dma_addr_t vio_map_single(struct device *dev, void *vaddr,
                           size_t size, enum dma_data_direction direction)
 {
         return iommu_map_single(to_vio_dev(dev)->iommu_table, vaddr, size,
-                        direction);
+                        ~0ul, direction);
 }
 
 static void vio_unmap_single(struct device *dev, dma_addr_t dma_handle,
@@ -216,7 +216,7 @@ static int vio_map_sg(struct device *dev, struct scatterlist *sglist,
                 int nelems, enum dma_data_direction direction)
 {
         return iommu_map_sg(dev, to_vio_dev(dev)->iommu_table, sglist,
-                        nelems, direction);
+                        nelems, ~0ul, direction);
 }
 
 static void vio_unmap_sg(struct device *dev, struct scatterlist *sglist,
@@ -229,7 +229,7 @@ static void *vio_alloc_coherent(struct device *dev, size_t size,
                            dma_addr_t *dma_handle, gfp_t flag)
 {
         return iommu_alloc_coherent(to_vio_dev(dev)->iommu_table, size,
-                        dma_handle, flag);
+                        dma_handle, ~0ul, flag);
 }
 
 static void vio_free_coherent(struct device *dev, size_t size,
diff --git a/arch/powerpc/platforms/cell/spu_callbacks.c b/arch/powerpc/platforms/cell/spu_callbacks.c
index 6594bec73882..b283380a2a18 100644
--- a/arch/powerpc/platforms/cell/spu_callbacks.c
+++ b/arch/powerpc/platforms/cell/spu_callbacks.c
@@ -317,17 +317,17 @@ void *spu_syscall_table[] = {
         [__NR_ppoll]                    sys_ni_syscall, /* sys_ppoll */
         [__NR_unshare]                  sys_unshare,
         [__NR_splice]                   sys_splice,
+        [__NR_tee]                      sys_tee,
+        [__NR_vmsplice]                 sys_vmsplice,
 };
 
 long spu_sys_callback(struct spu_syscall_block *s)
 {
         long (*syscall)(u64 a1, u64 a2, u64 a3, u64 a4, u64 a5, u64 a6);
 
-        BUILD_BUG_ON(ARRAY_SIZE(spu_syscall_table) != __NR_syscalls);
-
         syscall = spu_syscall_table[s->nr_ret];
 
-        if (s->nr_ret >= __NR_syscalls) {
+        if (s->nr_ret >= ARRAY_SIZE(spu_syscall_table)) {
                 pr_debug("%s: invalid syscall #%ld", __FUNCTION__, s->nr_ret);
                 return -ENOSYS;
         }
diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index e14f9ac55cf4..df2343e1956b 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -231,6 +231,14 @@ static u8 kw_i2c_wait_interrupt(struct pmac_i2c_host_kw *host)
         return isr;
 }
 
+static void kw_i2c_do_stop(struct pmac_i2c_host_kw *host, int result)
+{
+        kw_write_reg(reg_control, KW_I2C_CTL_STOP);
+        host->state = state_stop;
+        host->result = result;
+}
+
+
 static void kw_i2c_handle_interrupt(struct pmac_i2c_host_kw *host, u8 isr)
 {
         u8 ack;
@@ -246,42 +254,36 @@ static void kw_i2c_handle_interrupt(struct pmac_i2c_host_kw *host, u8 isr)
         }
 
         if (isr == 0) {
+                printk(KERN_WARNING "low_i2c: Timeout in i2c transfer"
+                       " on keywest !\n");
                 if (host->state != state_stop) {
-                        DBG_LOW("KW: Timeout !\n");
-                        host->result = -EIO;
-                        goto stop;
-                }
-                if (host->state == state_stop) {
-                        ack = kw_read_reg(reg_status);
-                        if (ack & KW_I2C_STAT_BUSY)
-                                kw_write_reg(reg_status, 0);
-                        host->state = state_idle;
-                        kw_write_reg(reg_ier, 0x00);
-                        if (!host->polled)
-                                complete(&host->complete);
+                        kw_i2c_do_stop(host, -EIO);
+                        return;
                 }
+                ack = kw_read_reg(reg_status);
+                if (ack & KW_I2C_STAT_BUSY)
+                        kw_write_reg(reg_status, 0);
+                host->state = state_idle;
+                kw_write_reg(reg_ier, 0x00);
+                if (!host->polled)
+                        complete(&host->complete);
                 return;
         }
 
         if (isr & KW_I2C_IRQ_ADDR) {
                 ack = kw_read_reg(reg_status);
                 if (host->state != state_addr) {
-                        kw_write_reg(reg_isr, KW_I2C_IRQ_ADDR);
                         WRONG_STATE("KW_I2C_IRQ_ADDR"); 
-                        host->result = -EIO;
-                        goto stop;
+                        kw_i2c_do_stop(host, -EIO);
                 }
                 if ((ack & KW_I2C_STAT_LAST_AAK) == 0) {
-                        host->result = -ENODEV;
-                        DBG_LOW("KW: NAK on address\n");
+                        host->result = -ENXIO;
                         host->state = state_stop;
-                        return;
+                        DBG_LOW("KW: NAK on address\n");
                 } else {
-                        if (host->len == 0) {
-                                kw_write_reg(reg_isr, KW_I2C_IRQ_ADDR);
-                                goto stop;
-                        }
-                        if (host->rw) {
+                        if (host->len == 0)
+                                kw_i2c_do_stop(host, 0);
+                        else if (host->rw) {
                                 host->state = state_read;
                                 if (host->len > 1)
                                         kw_write_reg(reg_control,
@@ -308,25 +310,19 @@ static void kw_i2c_handle_interrupt(struct pmac_i2c_host_kw *host, u8 isr)
                         ack = kw_read_reg(reg_status);
                         if ((ack & KW_I2C_STAT_LAST_AAK) == 0) {
                                 DBG_LOW("KW: nack on data write\n");
-                                host->result = -EIO;
-                                goto stop;
+                                host->result = -EFBIG;
+                                host->state = state_stop;
                         } else if (host->len) {
                                 kw_write_reg(reg_data, *(host->data++));
                                 host->len--;
-                        } else {
-                                kw_write_reg(reg_control, KW_I2C_CTL_STOP);
-                                host->state = state_stop;
-                                host->result = 0;
-                        }
-                        kw_write_reg(reg_isr, KW_I2C_IRQ_DATA);
+                        } else
+                                kw_i2c_do_stop(host, 0);
                 } else {
-                        kw_write_reg(reg_isr, KW_I2C_IRQ_DATA);
                         WRONG_STATE("KW_I2C_IRQ_DATA"); 
-                        if (host->state != state_stop) {
-                                host->result = -EIO;
-                                goto stop;
-                        }
+                        if (host->state != state_stop)
+                                kw_i2c_do_stop(host, -EIO);
                 }
+                kw_write_reg(reg_isr, KW_I2C_IRQ_DATA);
         }
 
         if (isr & KW_I2C_IRQ_STOP) {
@@ -340,14 +336,10 @@ static void kw_i2c_handle_interrupt(struct pmac_i2c_host_kw *host, u8 isr)
                         complete(&host->complete);
         }
 
+        /* Below should only happen in manual mode which we don't use ... */
         if (isr & KW_I2C_IRQ_START)
                 kw_write_reg(reg_isr, KW_I2C_IRQ_START);
 
-        return;
- stop:
-        kw_write_reg(reg_control, KW_I2C_CTL_STOP);     
-        host->state = state_stop;
-        return;
 }
 
 /* Interrupt handler */
@@ -544,11 +536,11 @@ static struct pmac_i2c_host_kw *__init kw_i2c_host_init(struct device_node *np)
                 return NULL;
         }
 
-        /* Make sure IRA is disabled */
+        /* Make sure IRQ is disabled */
         kw_write_reg(reg_ier, 0);
 
         /* Request chip interrupt */
-        if (request_irq(host->irq, kw_i2c_irq, SA_SHIRQ, "keywest i2c", host))
+        if (request_irq(host->irq, kw_i2c_irq, 0, "keywest i2c", host))
                 host->irq = NO_IRQ;
 
         printk(KERN_INFO "KeyWest i2c @0x%08x irq %d %s\n",
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 61d317428610..38087bd6e3cf 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -49,6 +49,7 @@
 
 #include "dart.h"
 
+extern int iommu_is_off;
 extern int iommu_force_on;
 
 /* Physical base address and size of the DART table */
@@ -329,10 +330,17 @@ void iommu_init_early_dart(void)
 
 void __init alloc_dart_table(void)
 {
-        /* Only reserve DART space if machine has more than 2GB of RAM
+        /* Only reserve DART space if machine has more than 1GB of RAM
          * or if requested with iommu=on on cmdline.
+         *
+         * 1GB of RAM is picked as limit because some default devices
+         * (i.e. Airport Extreme) have 30 bit address range limits.
          */
-        if (lmb_end_of_DRAM() <= 0x80000000ull && !iommu_force_on)
+
+        if (iommu_is_off)
+                return;
+
+        if (!iommu_force_on && lmb_end_of_DRAM() <= 0x40000000ull)
                 return;
 
         /* 512 pages (2MB) is max DART tablesize. */
diff --git a/arch/ppc/kernel/asm-offsets.c b/arch/ppc/kernel/asm-offsets.c
index 77e4dc780f8c..cc7c4aea9397 100644
--- a/arch/ppc/kernel/asm-offsets.c
+++ b/arch/ppc/kernel/asm-offsets.c
@@ -134,6 +134,7 @@ main(void)
         DEFINE(TI_TASK, offsetof(struct thread_info, task));
         DEFINE(TI_EXECDOMAIN, offsetof(struct thread_info, exec_domain));
         DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));
+        DEFINE(TI_LOCAL_FLAGS, offsetof(struct thread_info, flags));
         DEFINE(TI_CPU, offsetof(struct thread_info, cpu));
         DEFINE(TI_PREEMPT, offsetof(struct thread_info, preempt_count));
 
diff --git a/arch/ppc/kernel/entry.S b/arch/ppc/kernel/entry.S
index 5891ecbdc703..1adc9145516f 100644
--- a/arch/ppc/kernel/entry.S
+++ b/arch/ppc/kernel/entry.S
@@ -128,29 +128,26 @@ transfer_to_handler:
         stw     r12,4(r11)
 #endif
         b       3f
+
 2:      /* if from kernel, check interrupted DOZE/NAP mode and
          * check for stack overflow
          */
+        lwz     r9,THREAD_INFO-THREAD(r12)
+        cmplw   r1,r9                   /* if r1 <= current->thread_info */
+        ble-    stack_ovf               /* then the kernel stack overflowed */
+5:
 #ifdef CONFIG_6xx
-        mfspr   r11,SPRN_HID0
-        mtcr    r11
-BEGIN_FTR_SECTION
-        bt-     8,4f                    /* Check DOZE */
-END_FTR_SECTION_IFSET(CPU_FTR_CAN_DOZE)
-BEGIN_FTR_SECTION
-        bt-     9,4f                    /* Check NAP */
-END_FTR_SECTION_IFSET(CPU_FTR_CAN_NAP)
+        tophys(r9,r9)                   /* check local flags */
+        lwz     r12,TI_LOCAL_FLAGS(r9)
+        mtcrf   0x01,r12
+        bt-     31-TLF_NAPPING,4f
 #endif /* CONFIG_6xx */
         .globl transfer_to_handler_cont
 transfer_to_handler_cont:
-        lwz     r11,THREAD_INFO-THREAD(r12)
-        cmplw   r1,r11                  /* if r1 <= current->thread_info */
-        ble-    stack_ovf               /* then the kernel stack overflowed */
 3:
         mflr    r9
         lwz     r11,0(r9)               /* virtual address of handler */
         lwz     r9,4(r9)                /* where to go when done */
-        FIX_SRR1(r10,r12)
         mtspr   SPRN_SRR0,r11
         mtspr   SPRN_SRR1,r10
         mtlr    r9
@@ -158,7 +155,9 @@ transfer_to_handler_cont:
         RFI                             /* jump to handler, enable MMU */
 
 #ifdef CONFIG_6xx
-4:      b       power_save_6xx_restore
+4:      rlwinm  r12,r12,0,~_TLF_NAPPING
+        stw     r12,TI_LOCAL_FLAGS(r9)
+        b       power_save_6xx_restore
 #endif
 
 /*
@@ -167,10 +166,10 @@ transfer_to_handler_cont:
  */
 stack_ovf:
         /* sometimes we use a statically-allocated stack, which is OK. */
-        lis     r11,_end@h
-        ori     r11,r11,_end@l
-        cmplw   r1,r11
-        ble     3b                      /* r1 <= &_end is OK */
+        lis     r12,_end@h
+        ori     r12,r12,_end@l
+        cmplw   r1,r12
+        ble     5b                      /* r1 <= &_end is OK */
         SAVE_NVGPRS(r11)
         addi    r3,r1,STACK_FRAME_OVERHEAD
         lis     r1,init_thread_union@ha
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index 865ba74991a9..b250b1b539b6 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -94,6 +94,7 @@ EXPORT_SYMBOL(strcat);
 EXPORT_SYMBOL(strlen);
 EXPORT_SYMBOL(strcmp);
 EXPORT_SYMBOL(strcasecmp);
+EXPORT_SYMBOL(strncasecmp);
 EXPORT_SYMBOL(__div64_32);
 
 EXPORT_SYMBOL(csum_partial);
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 54d35c130907..9a22434a580c 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -652,7 +652,7 @@ appldata_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata appldata_nb = {
+static struct notifier_block appldata_nb = {
         .notifier_call = appldata_cpu_notify,
 };
 
diff --git a/arch/x86_64/ia32/Makefile b/arch/x86_64/ia32/Makefile
index 929e6b0771f8..e9263b4975e0 100644
--- a/arch/x86_64/ia32/Makefile
+++ b/arch/x86_64/ia32/Makefile
@@ -27,5 +27,5 @@ $(obj)/vsyscall-sysenter.so $(obj)/vsyscall-syscall.so: \
 $(obj)/vsyscall-%.so: $(src)/vsyscall.lds $(obj)/vsyscall-%.o FORCE
         $(call if_changed,syscall)
 
-AFLAGS_vsyscall-sysenter.o = -m32
-AFLAGS_vsyscall-syscall.o = -m32
+AFLAGS_vsyscall-sysenter.o = -m32 -Wa,-32
+AFLAGS_vsyscall-syscall.o = -m32 -Wa,-32
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 6f0790e8b6d3..c69fc43cee7b 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -629,7 +629,7 @@ static __cpuinit void mce_remove_device(unsigned int cpu)
 #endif
 
 /* Get notified when a cpu comes on/off. Be hotplug friendly. */
-static __cpuinit int
+static int
 mce_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/arch/x86_64/kernel/mce_amd.c b/arch/x86_64/kernel/mce_amd.c
index d3ad7d81266d..d13b241ad094 100644
--- a/arch/x86_64/kernel/mce_amd.c
+++ b/arch/x86_64/kernel/mce_amd.c
@@ -482,7 +482,7 @@ static void threshold_remove_device(unsigned int cpu)
 #endif
 
 /* get notified when a cpu comes on/off */
-static __cpuinit int threshold_cpu_callback(struct notifier_block *nfb,
+static int threshold_cpu_callback(struct notifier_block *nfb,
                                             unsigned long action, void *hcpu)
 {
         /* cpu was unsigned int to begin with */
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index a6c01e121266..9d3d76c85ae7 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -112,10 +112,6 @@ static unsigned long alloc_iommu(int size)
 static void free_iommu(unsigned long offset, int size)
 { 
         unsigned long flags;
-        if (size == 1) { 
-                clear_bit(offset, iommu_gart_bitmap); 
-                return;
-        }
         spin_lock_irqsave(&iommu_bitmap_lock, flags);
         __clear_bit_string(iommu_gart_bitmap, offset, size);
         spin_unlock_irqrestore(&iommu_bitmap_lock, flags);
diff --git a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
index cc02573a3271..b2fac14baac0 100644
--- a/arch/x86_64/mm/numa.c
+++ b/arch/x86_64/mm/numa.c
@@ -188,11 +188,13 @@ void __init setup_node_zones(int nodeid)
            memory. */
         memmapsize = sizeof(struct page) * (end_pfn-start_pfn);
         limit = end_pfn << PAGE_SHIFT;
+#ifdef CONFIG_FLAT_NODE_MEM_MAP
         NODE_DATA(nodeid)->node_mem_map = 
                 __alloc_bootmem_core(NODE_DATA(nodeid)->bdata, 
                                 memmapsize, SMP_CACHE_BYTES, 
                                 round_down(limit - memmapsize, PAGE_SIZE), 
                                 limit);
+#endif
 
         size_zones(zones, holes, start_pfn, end_pfn);
         free_area_init_node(nodeid, NODE_DATA(nodeid), zones,
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 1755c053fd68..e5041a02e21f 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -3385,7 +3385,7 @@ static int blk_cpu_notify(struct notifier_block *self, unsigned long action,
 }
 
 
-static struct notifier_block __devinitdata blk_cpu_notifier = {
+static struct notifier_block blk_cpu_notifier = {
         .notifier_call  = blk_cpu_notify,
 };
 
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index 915810f6237e..8c52421cbc54 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -107,7 +107,7 @@ static int __cpuinit topology_remove_dev(struct sys_device * sys_dev)
         return 0;
 }
 
-static int __cpuinit topology_cpu_callback(struct notifier_block *nfb,
+static int topology_cpu_callback(struct notifier_block *nfb,
                 unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index e1aadae00623..cb76e5ca9a23 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -889,7 +889,6 @@ extern int drm_lock_free(drm_device_t * dev,
                                 /* Buffer management support (drm_bufs.h) */
 extern int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request);
 extern int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request);
-extern int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request);
 extern int drm_addmap(drm_device_t * dev, unsigned int offset,
                       unsigned int size, drm_map_type_t type,
                       drm_map_flags_t flags, drm_local_map_t ** map_ptr);
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index fabc930c67a2..40bfd9b01e39 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -503,8 +503,6 @@ int drm_agp_bind_memory(DRM_AGP_MEM * handle, off_t start)
         return agp_bind_memory(handle, start);
 }
 
-EXPORT_SYMBOL(drm_agp_bind_memory);
-
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM * handle)
 {
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 8a9cf12e6183..006b06d29727 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -386,7 +386,6 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
         return 0;
 }
-EXPORT_SYMBOL(drm_rmmap_locked);
 
 int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 {
@@ -398,7 +397,6 @@ int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 
         return ret;
 }
-EXPORT_SYMBOL(drm_rmmap);
 
 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
  * the last close of the device, and this is necessary for cleanup when things
@@ -1053,7 +1051,7 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
         return 0;
 }
 
-int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
+static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
 {
         drm_device_dma_t *dma = dev->dma;
         drm_buf_entry_t *entry;
@@ -1212,7 +1210,6 @@ int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
         atomic_dec(&dev->buf_alloc);
         return 0;
 }
-EXPORT_SYMBOL(drm_addbufs_fb);
 
 
 /**
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 68073e14fdec..9a842a36bb27 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -229,8 +229,6 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         return ret;
 }
 
-EXPORT_SYMBOL(drm_get_dev);
-
 /**
  * Put a device minor number.
  *
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index b108c7f913b2..26bdf2ca59d7 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -723,7 +723,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
         
         dev_priv->scratch_ages[header.scratch.reg]++;
         
-        ref_age_base = *(u32 **)cmdbuf->buf;
+        ref_age_base =  (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
         
         cmdbuf->buf += sizeof(u64);
         cmdbuf->bufsz -= sizeof(u64);
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 66719f9d294c..1fa9fa157c12 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -27,6 +27,7 @@
 #include <linux/crash_dump.h>
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
+#include <linux/pipe_fs_i.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -578,6 +579,18 @@ static ssize_t write_null(struct file * file, const char __user * buf,
         return count;
 }
 
+static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
+                        struct splice_desc *sd)
+{
+        return sd->len;
+}
+
+static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
+                                 loff_t *ppos, size_t len, unsigned int flags)
+{
+        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
+}
+
 #ifdef CONFIG_MMU
 /*
  * For fun, we are using the MMU for this.
@@ -785,6 +798,7 @@ static struct file_operations null_fops = {
         .llseek         = null_lseek,
         .read           = read_null,
         .write          = write_null,
+        .splice_write   = splice_write_null,
 };
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index b543821d8cb4..56c8243cdb73 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -390,7 +390,8 @@ scdrv_init(void)
                         format_module_id(devnamep, geo_module(geoid),
                                          MODULE_FORMAT_BRIEF);
                         devnamep = devname + strlen(devname);
-                        sprintf(devnamep, "#%d", geo_slab(geoid));
+                        sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                                geo_slab(geoid));
 
                         /* allocate sysctl device data */
                         scd = kzalloc(sizeof (struct sysctl_data_s),
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index a6873bf89ffa..1efde3b27619 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -20,9 +20,18 @@ config TCG_TPM
           Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
 
+config TCG_TIS
+        tristate "TPM Interface Specification 1.2 Interface"
+        depends on TCG_TPM
+        ---help---
+          If you have a TPM security chip that is compliant with the
+          TCG TIS 1.2 TPM specification say Yes and it will be accessible
+          from within Linux.  To compile this driver as a module, choose
+          M here; the module will be called tpm_tis.
+
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from National Semicondutor 
           say Yes and it will be accessible from within Linux.  To 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index ba4582d160fd..ea3a1e02a824 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_TCG_TPM) += tpm.o
 ifdef CONFIG_ACPI
         obj-$(CONFIG_TCG_TPM) += tpm_bios.o
 endif
+obj-$(CONFIG_TCG_TIS) += tpm_tis.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 5a3870477ef1..6889e7db3aff 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -32,12 +32,291 @@ enum tpm_const {
         TPM_MINOR = 224,        /* officially assigned */
         TPM_BUFSIZE = 2048,
         TPM_NUM_DEVICES = 256,
-        TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
 };
 
+enum tpm_duration {
+        TPM_SHORT = 0,
+        TPM_MEDIUM = 1,
+        TPM_LONG = 2,
+        TPM_UNDEFINED,
+};
+
+#define TPM_MAX_ORDINAL 243
+#define TPM_MAX_PROTECTED_ORDINAL 12
+#define TPM_PROTECTED_ORDINAL_MASK 0xFF
+
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
-static int dev_mask[TPM_NUM_MASK_ENTRIES];
+static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+
+/*
+ * Array with one entry per ordinal defining the maximum amount
+ * of time the chip could take to return the result.  The ordinal
+ * designation of short, medium or long is defined in a table in
+ * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
+ * values of the SHORT, MEDIUM, and LONG durations are retrieved
+ * from the chip during initialization with a call to tpm_get_timeouts.
+ */
+static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+};
+
+static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 15 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,              /* 20 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,              /* 25 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 30 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 35 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 40 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 45 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 50 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 55 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 60 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 65 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 70 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 75 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 80 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 85 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 90 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 95 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 100 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 105 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 110 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 115 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 120 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 125 */
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 130 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 135 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 140 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 145 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 150 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 155 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 160 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 165 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 170 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 175 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 180 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,             /* 185 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 190 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 195 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 200 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 205 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 210 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 215 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 220 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 225 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 230 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 235 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 240 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+};
 
 static void user_reader_timeout(unsigned long ptr)
 {
@@ -46,7 +325,7 @@ static void user_reader_timeout(unsigned long ptr)
         schedule_work(&chip->work);
 }
 
-static void timeout_work(void * ptr)
+static void timeout_work(void *ptr)
 {
         struct tpm_chip *chip = ptr;
 
@@ -57,17 +336,43 @@ static void timeout_work(void * ptr)
 }
 
 /*
+ * Returns max number of jiffies to wait
+ */
+unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+                                           u32 ordinal)
+{
+        int duration_idx = TPM_UNDEFINED;
+        int duration = 0;
+
+        if (ordinal < TPM_MAX_ORDINAL)
+                duration_idx = tpm_ordinal_duration[ordinal];
+        else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
+                 TPM_MAX_PROTECTED_ORDINAL)
+                duration_idx =
+                    tpm_protected_ordinal_duration[ordinal &
+                                                   TPM_PROTECTED_ORDINAL_MASK];
+
+        if (duration_idx != TPM_UNDEFINED)
+                duration = chip->vendor.duration[duration_idx];
+        if (duration <= 0)
+                return 2 * 60 * HZ;
+        else
+                return duration;
+}
+EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+
+/*
  * Internal kernel interface to transmit TPM commands
  */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                             size_t bufsiz)
 {
         ssize_t rc;
-        u32 count;
+        u32 count, ordinal;
         unsigned long stop;
 
         count = be32_to_cpu(*((__be32 *) (buf + 2)));
-
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
         if (count == 0)
                 return -ENODATA;
         if (count > bufsiz) {
@@ -78,21 +383,23 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
 
         down(&chip->tpm_mutex);
 
-        if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
+        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_send: error %zd\n", rc);
                 goto out;
         }
 
-        stop = jiffies + 2 * 60 * HZ;
+        if (chip->vendor.irq)
+                goto out_recv;
+
+        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
         do {
-                u8 status = chip->vendor->status(chip);
-                if ((status & chip->vendor->req_complete_mask) ==
-                    chip->vendor->req_complete_val) {
+                u8 status = chip->vendor.status(chip);
+                if ((status & chip->vendor.req_complete_mask) ==
+                    chip->vendor.req_complete_val)
                         goto out_recv;
-                }
 
-                if ((status == chip->vendor->req_canceled)) {
+                if ((status == chip->vendor.req_canceled)) {
                         dev_err(chip->dev, "Operation Canceled\n");
                         rc = -ECANCELED;
                         goto out;
@@ -102,14 +409,13 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                 rmb();
         } while (time_before(jiffies, stop));
 
-
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         dev_err(chip->dev, "Operation Timed out\n");
         rc = -ETIME;
         goto out;
 
 out_recv:
-        rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
+        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
         if (rc < 0)
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_recv: error %zd\n", rc);
@@ -119,17 +425,247 @@ out:
 }
 
 #define TPM_DIGEST_SIZE 20
-#define CAP_PCR_RESULT_SIZE 18
-static const u8 cap_pcr[] = {
+#define TPM_ERROR_SIZE 10
+#define TPM_RET_CODE_IDX 6
+#define TPM_GET_CAP_RET_SIZE_IDX 10
+#define TPM_GET_CAP_RET_UINT32_1_IDX 14
+#define TPM_GET_CAP_RET_UINT32_2_IDX 18
+#define TPM_GET_CAP_RET_UINT32_3_IDX 22
+#define TPM_GET_CAP_RET_UINT32_4_IDX 26
+#define TPM_GET_CAP_PERM_DISABLE_IDX 16
+#define TPM_GET_CAP_PERM_INACTIVE_IDX 18
+#define TPM_GET_CAP_RET_BOOL_1_IDX 14
+#define TPM_GET_CAP_TEMP_INACTIVE_IDX 16
+
+#define TPM_CAP_IDX 13
+#define TPM_CAP_SUBCAP_IDX 21
+
+enum tpm_capabilities {
+        TPM_CAP_FLAG = 4,
+        TPM_CAP_PROP = 5,
+};
+
+enum tpm_sub_capabilities {
+        TPM_CAP_PROP_PCR = 0x1,
+        TPM_CAP_PROP_MANUFACTURER = 0x3,
+        TPM_CAP_FLAG_PERM = 0x8,
+        TPM_CAP_FLAG_VOL = 0x9,
+        TPM_CAP_PROP_OWNER = 0x11,
+        TPM_CAP_PROP_TIS_TIMEOUT = 0x15,
+        TPM_CAP_PROP_TIS_DURATION = 0x20,
+};
+
+/*
+ * This is a semi generic GetCapability command for use
+ * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
+ * and their associated sub_capabilities.
+ */
+
+static const u8 tpm_cap[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 22,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 1
+        0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
+        0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
+        0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 };
 
-#define READ_PCR_RESULT_SIZE 30
+static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
+                            char *desc)
+{
+        int err;
+
+        len = tpm_transmit(chip, data, len);
+        if (len <  0)
+                return len;
+        if (len == TPM_ERROR_SIZE) {
+                err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
+                dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
+                return err;
+        }
+        return 0;
+}
+
+void tpm_gen_interrupt(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+}
+EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+
+void tpm_get_timeouts(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        u32 timeout;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+        if (rc)
+                goto duration;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 4 * sizeof(u32))
+                goto duration;
+
+        /* Don't overwrite default if value is 0 */
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
+        if (timeout)
+                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
+        if (timeout)
+                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
+        if (timeout)
+                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
+        if (timeout)
+                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+
+duration:
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_DURATION;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the durations");
+        if (rc)
+                return;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 3 * sizeof(u32))
+                return;
+
+        chip->vendor.duration[TPM_SHORT] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_1_IDX))));
+        chip->vendor.duration[TPM_MEDIUM] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_2_IDX))));
+        chip->vendor.duration[TPM_LONG] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_3_IDX))));
+}
+EXPORT_SYMBOL_GPL(tpm_get_timeouts);
+
+void tpm_continue_selftest(struct tpm_chip *chip)
+{
+        u8 data[] = {
+                0, 193,                 /* TPM_TAG_RQU_COMMAND */
+                0, 0, 0, 10,            /* length */
+                0, 0, 0, 83,            /* TPM_ORD_GetCapability */
+        };
+
+        tpm_transmit(chip, data, sizeof(data));
+}
+EXPORT_SYMBOL_GPL(tpm_continue_selftest);
+
+ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_DISABLE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_enabled);
+
+ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_active);
+
+ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_OWNER;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the owner state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_RET_BOOL_1_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_owned);
+
+ssize_t tpm_show_temp_deactivated(struct device * dev,
+                                struct device_attribute * attr, char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_VOL;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the temporary state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_TEMP_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
+
 static const u8 pcrread[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 14,            /* length */
@@ -140,8 +676,8 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[READ_PCR_RESULT_SIZE];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
+        ssize_t rc;
         int i, j, num_pcrs;
         __be32 index;
         char *str = buf;
@@ -150,29 +686,24 @@ ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_pcr, sizeof(cap_pcr));
-        if ((len = tpm_transmit(chip, data, sizeof(data)))
-            < CAP_PCR_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to determine the number of PCRS\n",
-                        be32_to_cpu(*((__be32 *) (data + 6))));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the number of PCRS");
+        if (rc)
                 return 0;
-        }
 
         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
-
         for (i = 0; i < num_pcrs; i++) {
                 memcpy(data, pcrread, sizeof(pcrread));
                 index = cpu_to_be32(i);
                 memcpy(data + 10, &index, 4);
-                if ((len = tpm_transmit(chip, data, sizeof(data)))
-                    < READ_PCR_RESULT_SIZE){
-                        dev_dbg(chip->dev, "A TPM error (%d) occurred"
-                                " attempting to read PCR %d of %d\n",
-                                be32_to_cpu(*((__be32 *) (data + 6))),
-                                i, num_pcrs);
+                rc = transmit_cmd(chip, data, sizeof(data),
+                                "attempting to read a PCR");
+                if (rc)
                         goto out;
-                }
                 str += sprintf(str, "PCR-%02d: ", i);
                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
                         str += sprintf(str, "%02X ", *(data + 10 + j));
@@ -194,7 +725,7 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                        char *buf)
 {
         u8 *data;
-        ssize_t len;
+        ssize_t err;
         int i, rc;
         char *str = buf;
 
@@ -208,14 +739,10 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 
         memcpy(data, readpubek, sizeof(readpubek));
 
-        if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
-            READ_PUBEK_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to read the PUBEK\n",
-                            be32_to_cpu(*((__be32 *) (data + 6))));
-                rc = 0;
+        err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
+                        "attempting to read the PUBEK");
+        if (err)
                 goto out;
-        }
 
         /* 
            ignore header 10 bytes
@@ -245,67 +772,110 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                 if ((i + 1) % 16 == 0)
                         str += sprintf(str, "\n");
         }
-        rc = str - buf;
 out:
+        rc = str - buf;
         kfree(data);
         return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 
-#define CAP_VER_RESULT_SIZE 18
+#define CAP_VERSION_1_1 6
+#define CAP_VERSION_1_2 0x1A
+#define CAP_VERSION_IDX 13
 static const u8 cap_version[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 18,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 6,
+        0, 0, 0, 0,
         0, 0, 0, 0
 };
 
-#define CAP_MANUFACTURER_RESULT_SIZE 18
-static const u8 cap_manufacturer[] = {
-        0, 193,                 /* TPM_TAG_RQU_COMMAND */
-        0, 0, 0, 22,            /* length */
-        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 3
-};
-
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[sizeof(cap_manufacturer)];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t rc;
         char *str = buf;
 
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_MANUFACTURER_RESULT_SIZE)
-                return len;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the manufacturer");
+        if (rc)
+                return 0;
 
         str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(*((__be32 *) (data + 14))));
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
 
         memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the 1.1 version");
+        if (rc)
+                goto out;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_VER_RESULT_SIZE)
-                return len;
-
-        str +=
-            sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                    (int) data[14], (int) data[15], (int) data[16],
-                    (int) data[17]);
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[14], (int) data[15], (int) data[16],
+                       (int) data[17]);
 
+out:
         return str - buf;
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps);
 
+ssize_t tpm_show_caps_1_2(struct device * dev,
+                          struct device_attribute * attr, char *buf)
+{
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t len;
+        char *str = buf;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the manufacturer\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                return 0;
+        }
+
+        str += sprintf(str, "Manufacturer: 0x%x\n",
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
+
+        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_2;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_err(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the 1.2 version\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                goto out;
+        }
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[16], (int) data[17], (int) data[18],
+                       (int) data[19]);
+
+out:
+        return str - buf;
+}
+EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
@@ -313,7 +883,7 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return 0;
 
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         return count;
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
@@ -329,7 +899,7 @@ int tpm_open(struct inode *inode, struct file *file)
         spin_lock(&driver_lock);
 
         list_for_each_entry(pos, &tpm_chip_list, list) {
-                if (pos->vendor->miscdev.minor == minor) {
+                if (pos->vendor.miscdev.minor == minor) {
                         chip = pos;
                         break;
                 }
@@ -387,7 +957,7 @@ int tpm_release(struct inode *inode, struct file *file)
 EXPORT_SYMBOL_GPL(tpm_release);
 
 ssize_t tpm_write(struct file *file, const char __user *buf,
-                  size_t size, loff_t * off)
+                  size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int in_size = size, out_size;
@@ -419,11 +989,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
 
         return in_size;
 }
-
 EXPORT_SYMBOL_GPL(tpm_write);
 
-ssize_t tpm_read(struct file * file, char __user *buf,
-                 size_t size, loff_t * off)
+ssize_t tpm_read(struct file *file, char __user *buf,
+                 size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int ret_size;
@@ -462,14 +1031,13 @@ void tpm_remove_hardware(struct device *dev)
         spin_unlock(&driver_lock);
 
         dev_set_drvdata(dev, NULL);
-        misc_deregister(&chip->vendor->miscdev);
-        kfree(chip->vendor->miscdev.name);
+        misc_deregister(&chip->vendor.miscdev);
+        kfree(chip->vendor.miscdev.name);
 
-        sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
         tpm_bios_log_teardown(chip->bios_dir);
 
-        dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &=
-                ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
+        clear_bit(chip->dev_num, dev_mask);
 
         kfree(chip);
 
@@ -520,18 +1088,18 @@ EXPORT_SYMBOL_GPL(tpm_pm_resume);
  * upon errant exit from this function specific probe function should call
  * pci_disable_device
  */
-int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
+                                       *entry)
 {
 #define DEVNAME_SIZE 7
 
         char *devname;
         struct tpm_chip *chip;
-        int i, j;
 
         /* Driver specific per-device data */
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
-                return -ENOMEM;
+                return NULL;
 
         init_MUTEX(&chip->buffer_mutex);
         init_MUTEX(&chip->tpm_mutex);
@@ -543,45 +1111,37 @@ int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
         chip->user_read_timer.function = user_reader_timeout;
         chip->user_read_timer.data = (unsigned long) chip;
 
-        chip->vendor = entry;
-
-        chip->dev_num = -1;
+        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
 
-        for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
-                for (j = 0; j < 8 * sizeof(int); j++)
-                        if ((dev_mask[i] & (1 << j)) == 0) {
-                                chip->dev_num =
-                                    i * TPM_NUM_MASK_ENTRIES + j;
-                                dev_mask[i] |= 1 << j;
-                                goto dev_num_search_complete;
-                        }
+        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
 
-dev_num_search_complete:
-        if (chip->dev_num < 0) {
+        if (chip->dev_num >= TPM_NUM_DEVICES) {
                 dev_err(dev, "No available tpm device numbers\n");
                 kfree(chip);
-                return -ENODEV;
+                return NULL;
         } else if (chip->dev_num == 0)
-                chip->vendor->miscdev.minor = TPM_MINOR;
+                chip->vendor.miscdev.minor = TPM_MINOR;
         else
-                chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
+                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
+
+        set_bit(chip->dev_num, dev_mask);
 
         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor->miscdev.name = devname;
+        chip->vendor.miscdev.name = devname;
 
-        chip->vendor->miscdev.dev = dev;
+        chip->vendor.miscdev.dev = dev;
         chip->dev = get_device(dev);
 
-        if (misc_register(&chip->vendor->miscdev)) {
+        if (misc_register(&chip->vendor.miscdev)) {
                 dev_err(chip->dev,
                         "unable to misc_register %s, minor %d\n",
-                        chip->vendor->miscdev.name,
-                        chip->vendor->miscdev.minor);
+                        chip->vendor.miscdev.name,
+                        chip->vendor.miscdev.minor);
                 put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
                 kfree(chip);
-                dev_mask[i] &= !(1 << j);
-                return -ENODEV;
+                return NULL;
         }
 
         spin_lock(&driver_lock);
@@ -592,11 +1152,11 @@ dev_num_search_complete:
 
         spin_unlock(&driver_lock);
 
-        sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
-        return 0;
+        return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index dec0224b4478..54a4c804e25f 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -42,18 +42,30 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                 char *);
+extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
+                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                 const char *, size_t);
+extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_active(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_temp_deactivated(struct device *,
+                                         struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
 struct tpm_vendor_specific {
-        u8 req_complete_mask;
-        u8 req_complete_val;
-        u8 req_canceled;
+        const u8 req_complete_mask;
+        const u8 req_complete_val;
+        const u8 req_canceled;
         void __iomem *iobase;           /* ioremapped address */
         unsigned long base;             /* TPM base address */
 
+        int irq;
+
         int region_size;
         int have_region;
 
@@ -63,6 +75,13 @@ struct tpm_vendor_specific {
         u8 (*status) (struct tpm_chip *);
         struct miscdevice miscdev;
         struct attribute_group *attr_group;
+        struct list_head list;
+        int locality;
+        unsigned long timeout_a, timeout_b, timeout_c, timeout_d; /* jiffies */
+        unsigned long duration[3]; /* jiffies */
+
+        wait_queue_head_t read_queue;
+        wait_queue_head_t int_queue;
 };
 
 struct tpm_chip {
@@ -81,13 +100,15 @@ struct tpm_chip {
         struct work_struct work;
         struct semaphore tpm_mutex;     /* tpm is processing */
 
-        struct tpm_vendor_specific *vendor;
+        struct tpm_vendor_specific vendor;
 
         struct dentry **bios_dir;
 
         struct list_head list;
 };
 
+#define to_tpm_chip(n) container_of(n, struct tpm_chip, vendor)
+
 static inline int tpm_read_index(int base, int index)
 {
         outb(index, base);
@@ -100,8 +121,12 @@ static inline void tpm_write_index(int base, int index, int value)
         outb(value & 0xFF, base+1);
 }
 
-extern int tpm_register_hardware(struct device *,
-                                 struct tpm_vendor_specific *);
+extern void tpm_get_timeouts(struct tpm_chip *);
+extern void tpm_gen_interrupt(struct tpm_chip *);
+extern void tpm_continue_selftest(struct tpm_chip *);
+extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);
+extern struct tpm_chip* tpm_register_hardware(struct device *,
+                                 const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ff3654964fe3..58a258cec153 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -47,12 +47,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 return -EIO;
 
         for (i = 0; i < 6; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading header\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* size of the data received */
@@ -63,7 +63,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 dev_err(chip->dev,
                         "Recv size(%d) less than available space\n", size);
                 for (; i < size; i++) { /* clear the waiting data anyway */
-                        status = ioread8(chip->vendor->iobase + 1);
+                        status = ioread8(chip->vendor.iobase + 1);
                         if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                                 dev_err(chip->dev, "error reading data\n");
                                 return -EIO;
@@ -74,16 +74,16 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
         /* read all the data available */
         for (; i < size; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading data\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* make sure data available is gone */
-        status = ioread8(chip->vendor->iobase + 1);
+        status = ioread8(chip->vendor.iobase + 1);
 
         if (status & ATML_STATUS_DATA_AVAIL) {
                 dev_err(chip->dev, "data available is stuck\n");
@@ -100,7 +100,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
         dev_dbg(chip->dev, "tpm_atml_send:\n");
         for (i = 0; i < count; i++) {
                 dev_dbg(chip->dev, "%d 0x%x(%d)\n",  i, buf[i], buf[i]);
-                iowrite8(buf[i], chip->vendor->iobase);
+                iowrite8(buf[i], chip->vendor.iobase);
         }
 
         return count;
@@ -108,12 +108,12 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
 
 static void tpm_atml_cancel(struct tpm_chip *chip)
 {
-        iowrite8(ATML_STATUS_ABORT, chip->vendor->iobase + 1);
+        iowrite8(ATML_STATUS_ABORT, chip->vendor.iobase + 1);
 }
 
 static u8 tpm_atml_status(struct tpm_chip *chip)
 {
-        return ioread8(chip->vendor->iobase + 1);
+        return ioread8(chip->vendor.iobase + 1);
 }
 
 static struct file_operations atmel_ops = {
@@ -140,7 +140,7 @@ static struct attribute* atmel_attrs[] = {
 
 static struct attribute_group atmel_attr_grp = { .attrs = atmel_attrs };
 
-static struct tpm_vendor_specific tpm_atmel = {
+static const struct tpm_vendor_specific tpm_atmel = {
         .recv = tpm_atml_recv,
         .send = tpm_atml_send,
         .cancel = tpm_atml_cancel,
@@ -159,10 +159,10 @@ static void atml_plat_remove(void)
         struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
 
         if (chip) {
-                if (chip->vendor->have_region)
-                        atmel_release_region(chip->vendor->base,
-                                             chip->vendor->region_size);
-                atmel_put_base_addr(chip->vendor);
+                if (chip->vendor.have_region)
+                        atmel_release_region(chip->vendor.base,
+                                             chip->vendor.region_size);
+                atmel_put_base_addr(chip->vendor.iobase);
                 tpm_remove_hardware(chip->dev);
                 platform_device_unregister(pdev);
         }
@@ -179,18 +179,22 @@ static struct device_driver atml_drv = {
 static int __init init_atmel(void)
 {
         int rc = 0;
+        void __iomem *iobase = NULL;
+        int have_region, region_size;
+        unsigned long base;
+        struct  tpm_chip *chip;
 
         driver_register(&atml_drv);
 
-        if ((tpm_atmel.iobase = atmel_get_base_addr(&tpm_atmel)) == NULL) {
+        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                 rc = -ENODEV;
                 goto err_unreg_drv;
         }
 
-        tpm_atmel.have_region =
+        have_region =
             (atmel_request_region
-             (tpm_atmel.base, tpm_atmel.region_size,
-              "tpm_atmel0") == NULL) ? 0 : 1;
+             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+
 
         if (IS_ERR
             (pdev =
@@ -199,17 +203,25 @@ static int __init init_atmel(void)
                 goto err_rel_reg;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_atmel)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_atmel))) {
+                rc = -ENODEV;
                 goto err_unreg_dev;
+        }
+
+        chip->vendor.iobase = iobase;
+        chip->vendor.base = base;
+        chip->vendor.have_region = have_region;
+        chip->vendor.region_size = region_size;
+
         return 0;
 
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_rel_reg:
-        atmel_put_base_addr(&tpm_atmel);
-        if (tpm_atmel.have_region)
-                atmel_release_region(tpm_atmel.base,
-                                     tpm_atmel.region_size);
+        atmel_put_base_addr(iobase);
+        if (have_region)
+                atmel_release_region(base,
+                                     region_size);
 err_unreg_drv:
         driver_unregister(&atml_drv);
         return rc;
diff --git a/drivers/char/tpm/tpm_atmel.h b/drivers/char/tpm/tpm_atmel.h
index d3478aaadd77..2e68eeb8a2cd 100644
--- a/drivers/char/tpm/tpm_atmel.h
+++ b/drivers/char/tpm/tpm_atmel.h
@@ -28,13 +28,12 @@
 #define atmel_request_region request_mem_region
 #define atmel_release_region release_mem_region
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
-        iounmap(vendor->iobase);
+        iounmap(iobase);
 }
 
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         struct device_node *dn;
         unsigned long address, size;
@@ -71,9 +70,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
         else
                 size = reg[naddrc];
 
-        vendor->base = address;
-        vendor->region_size = size;
-        return ioremap(vendor->base, vendor->region_size);
+        *base = address;
+        *region_size = size;
+        return ioremap(*base, *region_size);
 }
 #else
 #define atmel_getb(chip, offset) inb(chip->vendor->base + offset)
@@ -106,14 +105,12 @@ static int atmel_verify_tpm11(void)
         return 0;
 }
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
 }
 
 /* Determine where to talk to device */
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         int lo, hi;
 
@@ -123,9 +120,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
         lo = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_LO);
         hi = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_HI);
 
-        vendor->base = (hi << 8) | lo;
-        vendor->region_size = 2;
+        *base = (hi << 8) | lo;
+        *region_size = 2;
 
-        return ioport_map(vendor->base, vendor->region_size);
+        return ioport_map(*base, *region_size);
 }
 #endif
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 537aa45d8c67..e45f0d3d12de 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -29,6 +29,11 @@
 #define MAX_TEXT_EVENT          1000    /* Max event string length */
 #define ACPI_TCPA_SIG           "TCPA"  /* 0x41504354 /'TCPA' */
 
+enum bios_platform_class {
+        BIOS_CLIENT = 0x00,
+        BIOS_SERVER = 0x01,
+};
+
 struct tpm_bios_log {
         void *bios_event_log;
         void *bios_event_log_end;
@@ -36,9 +41,18 @@ struct tpm_bios_log {
 
 struct acpi_tcpa {
         struct acpi_table_header hdr;
-        u16 reserved;
-        u32 log_max_len __attribute__ ((packed));
-        u32 log_start_addr __attribute__ ((packed));
+        u16 platform_class;
+        union {
+                struct client_hdr {
+                        u32 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } client;
+                struct server_hdr {
+                        u16 reserved;
+                        u64 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } server;
+        };
 };
 
 struct tcpa_event {
@@ -120,6 +134,7 @@ static const char* tcpa_pc_event_id_strings[] = {
         "S-CRTM Version",
         "S-CRTM Contents",
         "S-CRTM POST Contents",
+        "POST Contents",
 };
 
 /* returns pointer to start of pos. entry of tcg log */
@@ -306,6 +321,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
         /* 5th: delimiter */
         seq_putc(m, '\0');
 
+        kfree(eventname);
         return 0;
 }
 
@@ -353,6 +369,7 @@ static int tpm_ascii_bios_measurements_show(struct seq_file *m, void *v)
         /* 4th: eventname <= max + \'0' delimiter */
         seq_printf(m, " %s\n", eventname);
 
+        kfree(eventname);
         return 0;
 }
 
@@ -376,6 +393,7 @@ static int read_log(struct tpm_bios_log *log)
         struct acpi_tcpa *buff;
         acpi_status status;
         struct acpi_table_header *virt;
+        u64 len, start;
 
         if (log->bios_event_log != NULL) {
                 printk(KERN_ERR
@@ -396,27 +414,37 @@ static int read_log(struct tpm_bios_log *log)
                 return -EIO;
         }
 
-        if (buff->log_max_len == 0) {
+        switch(buff->platform_class) {
+        case BIOS_SERVER:
+                len = buff->server.log_max_len;
+                start = buff->server.log_start_addr;
+                break;
+        case BIOS_CLIENT:
+        default:
+                len = buff->client.log_max_len;
+                start = buff->client.log_start_addr;
+                break;
+        }
+        if (!len) {
                 printk(KERN_ERR "%s: ERROR - TCPA log area empty\n", __func__);
                 return -EIO;
         }
 
         /* malloc EventLog space */
-        log->bios_event_log = kmalloc(buff->log_max_len, GFP_KERNEL);
+        log->bios_event_log = kmalloc(len, GFP_KERNEL);
         if (!log->bios_event_log) {
-                printk
-                    ("%s: ERROR - Not enough  Memory for BIOS measurements\n",
-                     __func__);
+                printk("%s: ERROR - Not enough  Memory for BIOS measurements\n",
+                        __func__);
                 return -ENOMEM;
         }
 
-        log->bios_event_log_end = log->bios_event_log + buff->log_max_len;
+        log->bios_event_log_end = log->bios_event_log + len;
 
-        acpi_os_map_memory(buff->log_start_addr, buff->log_max_len, (void *) &virt);
+        acpi_os_map_memory(start, len, (void *) &virt);
 
-        memcpy(log->bios_event_log, virt, buff->log_max_len);
+        memcpy(log->bios_event_log, virt, len);
 
-        acpi_os_unmap_memory(virt, buff->log_max_len);
+        acpi_os_unmap_memory(virt, len);
         return 0;
 }
 
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 24095f6ee6da..adfff21beb21 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -15,6 +15,7 @@
  * License.
  */
 
+#include <linux/init.h>
 #include <linux/pnp.h>
 #include "tpm.h"
 
@@ -104,7 +105,7 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
 
         if (clear_wrfifo) {
                 for (i = 0; i < 4096; i++) {
-                        status = inb(chip->vendor->base + WRFIFO);
+                        status = inb(chip->vendor.base + WRFIFO);
                         if (status == 0xff) {
                                 if (check == 5)
                                         break;
@@ -124,8 +125,8 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
          */
         i = 0;
         do {
-                status = inb(chip->vendor->base + RDFIFO);
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + RDFIFO);
+                status = inb(chip->vendor.base + STAT);
                 i++;
                 if (i == TPM_MAX_TRIES)
                         return -EIO;
@@ -138,7 +139,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
         int status;
         int i;
         for (i = 0; i < TPM_MAX_TRIES; i++) {
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
@@ -157,7 +158,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
 {
         wait(chip, STAT_XFE);
-        outb(sendbyte, chip->vendor->base + WRFIFO);
+        outb(sendbyte, chip->vendor.base + WRFIFO);
 }
 
     /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
@@ -204,7 +205,7 @@ recv_begin:
                 ret = wait(chip, STAT_RDA);
                 if (ret)
                         return -EIO;
-                buf[i] = inb(chip->vendor->base + RDFIFO);
+                buf[i] = inb(chip->vendor.base + RDFIFO);
         }
 
         if (buf[0] != TPM_VL_VER) {
@@ -219,7 +220,7 @@ recv_begin:
 
                 for (i = 0; i < size; i++) {
                         wait(chip, STAT_RDA);
-                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                        buf[i] = inb(chip->vendor.base + RDFIFO);
                 }
 
                 if ((size == 0x6D00) && (buf[1] == 0x80)) {
@@ -268,7 +269,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
         u8 count_high, count_low, count_4, count_3, count_2, count_1;
 
         /* Disabling Reset, LP and IRQC */
-        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor.base + CMD);
 
         ret = empty_fifo(chip, 1);
         if (ret) {
@@ -319,7 +320,7 @@ static void tpm_inf_cancel(struct tpm_chip *chip)
 
 static u8 tpm_inf_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + STAT);
+        return inb(chip->vendor.base + STAT);
 }
 
 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
@@ -346,7 +347,7 @@ static struct file_operations inf_ops = {
         .release = tpm_release,
 };
 
-static struct tpm_vendor_specific tpm_inf = {
+static const struct tpm_vendor_specific tpm_inf = {
         .recv = tpm_inf_recv,
         .send = tpm_inf_send,
         .cancel = tpm_inf_cancel,
@@ -375,6 +376,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         int version[2];
         int productid[2];
         char chipname[20];
+        struct tpm_chip *chip;
 
         /* read IO-ports through PnP */
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
@@ -395,14 +397,13 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
                 /* publish my base address and request region */
-                tpm_inf.base = TPM_INF_BASE;
                 if (request_region
-                    (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
+                    (TPM_INF_BASE, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
-                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
-                                "tpm_infineon0") == NULL) {
+                if (request_region
+                    (TPM_INF_ADDR, TPM_INF_ADDR_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
@@ -442,9 +443,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 /* configure TPM with IO-ports */
                 outb(IOLIMH, TPM_INF_ADDR);
-                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(((TPM_INF_BASE >> 8) & 0xff), TPM_INF_DATA);
                 outb(IOLIML, TPM_INF_ADDR);
-                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+                outb((TPM_INF_BASE & 0xff), TPM_INF_DATA);
 
                 /* control if IO-ports are set correctly */
                 outb(IOLIMH, TPM_INF_ADDR);
@@ -452,10 +453,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(IOLIML, TPM_INF_ADDR);
                 iol = inb(TPM_INF_DATA);
 
-                if ((ioh << 8 | iol) != tpm_inf.base) {
+                if ((ioh << 8 | iol) != TPM_INF_BASE) {
                         dev_err(&dev->dev,
-                                "Could not set IO-ports to 0x%lx\n",
-                                tpm_inf.base);
+                                "Could not set IO-ports to 0x%x\n",
+                                TPM_INF_BASE);
                         rc = -EIO;
                         goto err_release_region;
                 }
@@ -466,15 +467,15 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
-                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+                outb(RESET_LP_IRQC_DISABLE, TPM_INF_BASE + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&dev->dev, "TPM found: "
                          "config base 0x%x, "
                          "io base 0x%x, "
-                         "chip version %02x%02x, "
-                         "vendor id %x%x (Infineon), "
-                         "product id %02x%02x"
+                         "chip version 0x%02x%02x, "
+                         "vendor id 0x%x%x (Infineon), "
+                         "product id 0x%02x%02x"
                          "%s\n",
                          TPM_INF_ADDR,
                          TPM_INF_BASE,
@@ -482,11 +483,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
 
-                rc = tpm_register_hardware(&dev->dev, &tpm_inf);
-                if (rc < 0) {
-                        rc = -ENODEV;
+                if (!(chip = tpm_register_hardware(&dev->dev, &tpm_inf))) {
                         goto err_release_region;
                 }
+                chip->vendor.base = TPM_INF_BASE;
                 return 0;
         } else {
                 rc = -ENODEV;
@@ -494,7 +494,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         }
 
 err_release_region:
-        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
         release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
 
 err_last:
@@ -506,7 +506,8 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
         struct tpm_chip *chip = pnp_get_drvdata(dev);
 
         if (chip) {
-                release_region(chip->vendor->base, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -520,7 +521,7 @@ static struct pnp_driver tpm_inf_pnp = {
         },
         .id_table = tpm_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = tpm_inf_pnp_remove,
+        .remove = __devexit_p(tpm_inf_pnp_remove),
 };
 
 static int __init init_inf(void)
@@ -538,5 +539,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.7");
+MODULE_VERSION("1.8");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 680a8e331887..4c8bc06c7d95 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -71,7 +71,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         unsigned long stop;
 
         /* status immediately available check */
-        *data = inb(chip->vendor->base + NSC_STATUS);
+        *data = inb(chip->vendor.base + NSC_STATUS);
         if ((*data & mask) == val)
                 return 0;
 
@@ -79,7 +79,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         stop = jiffies + 10 * HZ;
         do {
                 msleep(TPM_TIMEOUT);
-                *data = inb(chip->vendor->base + 1);
+                *data = inb(chip->vendor.base + 1);
                 if ((*data & mask) == val)
                         return 0;
         }
@@ -94,9 +94,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         unsigned long stop;
 
         /* status immediately available check */
-        status = inb(chip->vendor->base + NSC_STATUS);
+        status = inb(chip->vendor.base + NSC_STATUS);
         if (status & NSC_STATUS_OBF)
-                status = inb(chip->vendor->base + NSC_DATA);
+                status = inb(chip->vendor.base + NSC_DATA);
         if (status & NSC_STATUS_RDY)
                 return 0;
 
@@ -104,9 +104,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         stop = jiffies + 100;
         do {
                 msleep(TPM_TIMEOUT);
-                status = inb(chip->vendor->base + NSC_STATUS);
+                status = inb(chip->vendor.base + NSC_STATUS);
                 if (status & NSC_STATUS_OBF)
-                        status = inb(chip->vendor->base + NSC_DATA);
+                        status = inb(chip->vendor.base + NSC_DATA);
                 if (status & NSC_STATUS_RDY)
                         return 0;
         }
@@ -132,7 +132,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
         if ((data =
-             inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
+             inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
                 dev_err(chip->dev, "not in normal mode (0x%x)\n",
                         data);
                 return -EIO;
@@ -148,7 +148,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 }
                 if (data & NSC_STATUS_F0)
                         break;
-                *p = inb(chip->vendor->base + NSC_DATA);
+                *p = inb(chip->vendor.base + NSC_DATA);
         }
 
         if ((data & NSC_STATUS_F0) == 0 &&
@@ -156,7 +156,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 dev_err(chip->dev, "F0 not set\n");
                 return -EIO;
         }
-        if ((data = inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_EOC) {
+        if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) {
                 dev_err(chip->dev,
                         "expected end of command(0x%x)\n", data);
                 return -EIO;
@@ -182,7 +182,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
          * fix it. Not sure why this is needed, we followed the flow
          * chart in the manual to the letter.
          */
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 
         if (nsc_wait_for_ready(chip) != 0)
                 return -EIO;
@@ -192,7 +192,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
 
-        outb(NSC_COMMAND_NORMAL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND);
         if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) {
                 dev_err(chip->dev, "IBR timeout\n");
                 return -EIO;
@@ -204,26 +204,26 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                                 "IBF timeout (while writing data)\n");
                         return -EIO;
                 }
-                outb(buf[i], chip->vendor->base + NSC_DATA);
+                outb(buf[i], chip->vendor.base + NSC_DATA);
         }
 
         if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) {
                 dev_err(chip->dev, "IBF timeout\n");
                 return -EIO;
         }
-        outb(NSC_COMMAND_EOC, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND);
 
         return count;
 }
 
 static void tpm_nsc_cancel(struct tpm_chip *chip)
 {
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 }
 
 static u8 tpm_nsc_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + NSC_STATUS);
+        return inb(chip->vendor.base + NSC_STATUS);
 }
 
 static struct file_operations nsc_ops = {
@@ -250,7 +250,7 @@ static struct attribute * nsc_attrs[] = {
 
 static struct attribute_group nsc_attr_grp = { .attrs = nsc_attrs };
 
-static struct tpm_vendor_specific tpm_nsc = {
+static const struct tpm_vendor_specific tpm_nsc = {
         .recv = tpm_nsc_recv,
         .send = tpm_nsc_send,
         .cancel = tpm_nsc_cancel,
@@ -268,7 +268,7 @@ static void __devexit tpm_nsc_remove(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if ( chip ) {
-                release_region(chip->vendor->base, 2);
+                release_region(chip->vendor.base, 2);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -286,7 +286,8 @@ static int __init init_nsc(void)
         int rc = 0;
         int lo, hi;
         int nscAddrBase = TPM_ADDR;
-
+        struct tpm_chip *chip;
+        unsigned long base;
 
         /* verify that it is a National part (SID) */
         if (tpm_read_index(TPM_ADDR, NSC_SID_INDEX) != 0xEF) {
@@ -300,7 +301,7 @@ static int __init init_nsc(void)
 
         hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
         lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
-        tpm_nsc.base = (hi<<8) | lo;
+        base = (hi<<8) | lo;
 
         /* enable the DPM module */
         tpm_write_index(nscAddrBase, NSC_LDC_INDEX, 0x01);
@@ -320,13 +321,15 @@ static int __init init_nsc(void)
         if ((rc = platform_device_register(pdev)) < 0)
                 goto err_free_dev;
 
-        if (request_region(tpm_nsc.base, 2, "tpm_nsc0") == NULL ) {
+        if (request_region(base, 2, "tpm_nsc0") == NULL ) {
                 rc = -EBUSY;
                 goto err_unreg_dev;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_nsc)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_nsc))) {
+                rc = -ENODEV;
                 goto err_rel_reg;
+        }
 
         dev_dbg(&pdev->dev, "NSC TPM detected\n");
         dev_dbg(&pdev->dev,
@@ -361,10 +364,12 @@ static int __init init_nsc(void)
                  "NSC TPM revision %d\n",
                  tpm_read_index(nscAddrBase, 0x27) & 0x1F);
 
+        chip->vendor.base = base;
+
         return 0;
 
 err_rel_reg:
-        release_region(tpm_nsc.base, 2);
+        release_region(base, 2);
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_free_dev:
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
new file mode 100644
index 000000000000..b9cae9a238bb
--- /dev/null
+++ b/drivers/char/tpm/tpm_tis.c
@@ -0,0 +1,669 @@
+/*
+ * Copyright (C) 2005, 2006 IBM Corporation
+ *
+ * Authors:
+ * Leendert van Doorn <leendert@watson.ibm.com>
+ * Kylene Hall <kjhall@us.ibm.com>
+ *
+ * Device driver for TCG/TCPA TPM (trusted platform module).
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * This device driver implements the TPM interface as defined in
+ * the TCG TPM Interface Spec version 1.2, revision 1.0.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pnp.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include "tpm.h"
+
+#define TPM_HEADER_SIZE 10
+
+enum tis_access {
+        TPM_ACCESS_VALID = 0x80,
+        TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
+        TPM_ACCESS_REQUEST_PENDING = 0x04,
+        TPM_ACCESS_REQUEST_USE = 0x02,
+};
+
+enum tis_status {
+        TPM_STS_VALID = 0x80,
+        TPM_STS_COMMAND_READY = 0x40,
+        TPM_STS_GO = 0x20,
+        TPM_STS_DATA_AVAIL = 0x10,
+        TPM_STS_DATA_EXPECT = 0x08,
+};
+
+enum tis_int_flags {
+        TPM_GLOBAL_INT_ENABLE = 0x80000000,
+        TPM_INTF_BURST_COUNT_STATIC = 0x100,
+        TPM_INTF_CMD_READY_INT = 0x080,
+        TPM_INTF_INT_EDGE_FALLING = 0x040,
+        TPM_INTF_INT_EDGE_RISING = 0x020,
+        TPM_INTF_INT_LEVEL_LOW = 0x010,
+        TPM_INTF_INT_LEVEL_HIGH = 0x008,
+        TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
+        TPM_INTF_STS_VALID_INT = 0x002,
+        TPM_INTF_DATA_AVAIL_INT = 0x001,
+};
+
+enum tis_defaults {
+        TIS_MEM_BASE = 0xFED4000,
+        TIS_MEM_LEN = 0x5000,
+        TIS_SHORT_TIMEOUT = 750,        /* ms */
+        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
+};
+
+#define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
+#define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
+#define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
+#define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
+#define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
+#define TPM_STS(l)                      (0x0018 | ((l) << 12))
+#define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
+
+#define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
+#define TPM_RID(l)                      (0x0F04 | ((l) << 12))
+
+static LIST_HEAD(tis_chips);
+static DEFINE_SPINLOCK(tis_lock);
+
+static int check_locality(struct tpm_chip *chip, int l)
+{
+        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
+                return chip->vendor.locality = l;
+
+        return -1;
+}
+
+static void release_locality(struct tpm_chip *chip, int l, int force)
+{
+        if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+                      (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
+                iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
+                         chip->vendor.iobase + TPM_ACCESS(l));
+}
+
+static int request_locality(struct tpm_chip *chip, int l)
+{
+        unsigned long stop;
+        long rc;
+
+        if (check_locality(chip, l) >= 0)
+                return l;
+
+        iowrite8(TPM_ACCESS_REQUEST_USE,
+                 chip->vendor.iobase + TPM_ACCESS(l));
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
+                                                      (check_locality
+                                                       (chip, l) >= 0),
+                                                      chip->vendor.timeout_a);
+                if (rc > 0)
+                        return l;
+
+        } else {
+                /* wait for burstcount */
+                stop = jiffies + chip->vendor.timeout_a;
+                do {
+                        if (check_locality(chip, l) >= 0)
+                                return l;
+                        msleep(TPM_TIMEOUT);
+                }
+                while (time_before(jiffies, stop));
+        }
+        return -1;
+}
+
+static u8 tpm_tis_status(struct tpm_chip *chip)
+{
+        return ioread8(chip->vendor.iobase +
+                       TPM_STS(chip->vendor.locality));
+}
+
+static void tpm_tis_ready(struct tpm_chip *chip)
+{
+        /* this causes the current command to be aborted */
+        iowrite8(TPM_STS_COMMAND_READY,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+}
+
+static int get_burstcount(struct tpm_chip *chip)
+{
+        unsigned long stop;
+        int burstcnt;
+
+        /* wait for burstcount */
+        /* which timeout value, spec has 2 answers (c & d) */
+        stop = jiffies + chip->vendor.timeout_d;
+        do {
+                burstcnt = ioread8(chip->vendor.iobase +
+                                   TPM_STS(chip->vendor.locality) + 1);
+                burstcnt += ioread8(chip->vendor.iobase +
+                                    TPM_STS(chip->vendor.locality) +
+                                    2) << 8;
+                if (burstcnt)
+                        return burstcnt;
+                msleep(TPM_TIMEOUT);
+        } while (time_before(jiffies, stop));
+        return -EBUSY;
+}
+
+static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+                         wait_queue_head_t *queue)
+{
+        unsigned long stop;
+        long rc;
+        u8 status;
+
+        /* check current status */
+        status = tpm_tis_status(chip);
+        if ((status & mask) == mask)
+                return 0;
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      ((tpm_tis_status
+                                                        (chip) & mask) ==
+                                                       mask), timeout);
+                if (rc > 0)
+                        return 0;
+        } else {
+                stop = jiffies + timeout;
+                do {
+                        msleep(TPM_TIMEOUT);
+                        status = tpm_tis_status(chip);
+                        if ((status & mask) == mask)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        return -ETIME;
+}
+
+static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0, burstcnt;
+        while (size < count &&
+               wait_for_stat(chip,
+                             TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                             chip->vendor.timeout_c,
+                             &chip->vendor.read_queue)
+               == 0) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && size < count; burstcnt--)
+                        buf[size++] = ioread8(chip->vendor.iobase +
+                                              TPM_DATA_FIFO(chip->vendor.
+                                                            locality));
+        }
+        return size;
+}
+
+static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0;
+        int expected, status;
+
+        if (count < TPM_HEADER_SIZE) {
+                size = -EIO;
+                goto out;
+        }
+
+        /* read first 10 bytes, including tag, paramsize, and result */
+        if ((size =
+             recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
+                dev_err(chip->dev, "Unable to read header\n");
+                goto out;
+        }
+
+        expected = be32_to_cpu(*(__be32 *) (buf + 2));
+        if (expected > count) {
+                size = -EIO;
+                goto out;
+        }
+
+        if ((size +=
+             recv_data(chip, &buf[TPM_HEADER_SIZE],
+                       expected - TPM_HEADER_SIZE)) < expected) {
+                dev_err(chip->dev, "Unable to read remainder of result\n");
+                size = -ETIME;
+                goto out;
+        }
+
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
+                dev_err(chip->dev, "Error left over data\n");
+                size = -EIO;
+                goto out;
+        }
+
+out:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return size;
+}
+
+/*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        int rc, status, burstcnt;
+        size_t count = 0;
+        u32 ordinal;
+
+        if (request_locality(chip, 0) < 0)
+                return -EBUSY;
+
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_COMMAND_READY) == 0) {
+                tpm_tis_ready(chip);
+                if (wait_for_stat
+                    (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
+                     &chip->vendor.int_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+
+        while (count < len - 1) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && count < len - 1; burstcnt--) {
+                        iowrite8(buf[count], chip->vendor.iobase +
+                                 TPM_DATA_FIFO(chip->vendor.locality));
+                        count++;
+                }
+
+                wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                              &chip->vendor.int_queue);
+                status = tpm_tis_status(chip);
+                if ((status & TPM_STS_DATA_EXPECT) == 0) {
+                        rc = -EIO;
+                        goto out_err;
+                }
+        }
+
+        /* write last byte */
+        iowrite8(buf[count],
+                 chip->vendor.iobase +
+                 TPM_DATA_FIFO(chip->vendor.locality));
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_DATA_EXPECT) != 0) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        /* go and do it */
+        iowrite8(TPM_STS_GO,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+
+        if (chip->vendor.irq) {
+                ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+                if (wait_for_stat
+                    (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                     tpm_calc_ordinal_duration(chip, ordinal),
+                     &chip->vendor.read_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        return len;
+out_err:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return rc;
+}
+
+static struct file_operations tis_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+                   NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+
+static struct attribute *tis_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr, NULL,
+};
+
+static struct attribute_group tis_attr_grp = {
+        .attrs = tis_attrs
+};
+
+static struct tpm_vendor_specific tpm_tis = {
+        .status = tpm_tis_status,
+        .recv = tpm_tis_recv,
+        .send = tpm_tis_send,
+        .cancel = tpm_tis_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = TPM_STS_COMMAND_READY,
+        .attr_group = &tis_attr_grp,
+        .miscdev = {
+                    .fops = &tis_ops,},
+};
+
+static irqreturn_t tis_int_probe(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        chip->vendor.irq = irq;
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        int i;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+                wake_up_interruptible(&chip->vendor.read_queue);
+        if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+                for (i = 0; i < 5; i++)
+                        if (check_locality(chip, i) >= 0)
+                                break;
+        if (interrupt &
+            (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
+             TPM_INTF_CMD_READY_INT))
+                wake_up_interruptible(&chip->vendor.int_queue);
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static int interrupts = 1;
+module_param(interrupts, bool, 0444);
+MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        u32 vendor, intfcaps, intmask;
+        int rc, i;
+        unsigned long start, len;
+        struct tpm_chip *chip;
+
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+
+        if (!start)
+                start = TIS_MEM_BASE;
+        if (!len)
+                len = TIS_MEM_LEN;
+
+        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+                return -ENODEV;
+
+        chip->vendor.iobase = ioremap(start, len);
+        if (!chip->vendor.iobase) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+        if ((vendor & 0xFFFF) == 0xFFFF) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+
+        dev_info(&pnp_dev->dev,
+                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+        /* Figure out the capabilities */
+        intfcaps =
+            ioread32(chip->vendor.iobase +
+                     TPM_INTF_CAPS(chip->vendor.locality));
+        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+                intfcaps);
+        if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
+                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+        if (intfcaps & TPM_INTF_CMD_READY_INT)
+                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_RISING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+        if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
+                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+        if (intfcaps & TPM_INTF_STS_VALID_INT)
+                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+        if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+
+        if (request_locality(chip, 0) != 0) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* INTERRUPT Setup */
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+
+        intmask =
+            ioread32(chip->vendor.iobase +
+                     TPM_INT_ENABLE(chip->vendor.locality));
+
+        intmask |= TPM_INTF_CMD_READY_INT
+            | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
+            | TPM_INTF_STS_VALID_INT;
+
+        iowrite32(intmask,
+                  chip->vendor.iobase +
+                  TPM_INT_ENABLE(chip->vendor.locality));
+        if (interrupts) {
+                chip->vendor.irq =
+                    ioread8(chip->vendor.iobase +
+                            TPM_INT_VECTOR(chip->vendor.locality));
+
+                for (i = 3; i < 16 && chip->vendor.irq == 0; i++) {
+                        iowrite8(i, chip->vendor.iobase +
+                                    TPM_INT_VECTOR(chip->vendor.locality));
+                        if (request_irq
+                            (i, tis_int_probe, SA_SHIRQ,
+                             chip->vendor.miscdev.name, chip) != 0) {
+                                dev_info(chip->dev,
+                                         "Unable to request irq: %d for probe\n",
+                                         i);
+                                continue;
+                        }
+
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+
+                        /* Generate Interrupts */
+                        tpm_gen_interrupt(chip);
+
+                        /* Turn off */
+                        iowrite32(intmask,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        free_irq(i, chip);
+                }
+        }
+        if (chip->vendor.irq) {
+                iowrite8(chip->vendor.irq,
+                         chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
+                if (request_irq
+                    (chip->vendor.irq, tis_int_handler, SA_SHIRQ,
+                     chip->vendor.miscdev.name, chip) != 0) {
+                        dev_info(chip->dev,
+                                 "Unable to request irq: %d for use\n",
+                                 chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                }
+        }
+
+        INIT_LIST_HEAD(&chip->vendor.list);
+        spin_lock(&tis_lock);
+        list_add(&chip->vendor.list, &tis_chips);
+        spin_unlock(&tis_lock);
+
+        tpm_get_timeouts(chip);
+        tpm_continue_selftest(chip);
+
+        return 0;
+out_err:
+        if (chip->vendor.iobase)
+                iounmap(chip->vendor.iobase);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+{
+        return tpm_pm_suspend(&dev->dev, msg);
+}
+
+static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+{
+        return tpm_pm_resume(&dev->dev);
+}
+
+static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+        {"PNP0C31", 0},         /* TPM */
+        {"ATM1200", 0},         /* Atmel */
+        {"IFX0102", 0},         /* Infineon */
+        {"BCM0101", 0},         /* Broadcom */
+        {"NSC1200", 0},         /* National */
+        /* Add new here */
+        {"", 0},                /* User Specified */
+        {"", 0}                 /* Terminator */
+};
+
+static struct pnp_driver tis_pnp_driver = {
+        .name = "tpm_tis",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_tis_pnp_init,
+        .suspend = tpm_tis_pnp_suspend,
+        .resume = tpm_tis_pnp_resume,
+};
+
+#define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
+module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
+                    sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
+MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
+
+static int __init init_tis(void)
+{
+        return pnp_register_driver(&tis_pnp_driver);
+}
+
+static void __exit cleanup_tis(void)
+{
+        struct tpm_vendor_specific *i, *j;
+        struct tpm_chip *chip;
+        spin_lock(&tis_lock);
+        list_for_each_entry_safe(i, j, &tis_chips, list) {
+                chip = to_tpm_chip(i);
+                iowrite32(~TPM_GLOBAL_INT_ENABLE &
+                          ioread32(chip->vendor.iobase +
+                                   TPM_INT_ENABLE(chip->vendor.
+                                                  locality)),
+                          chip->vendor.iobase +
+                          TPM_INT_ENABLE(chip->vendor.locality));
+                release_locality(chip, chip->vendor.locality, 1);
+                if (chip->vendor.irq)
+                        free_irq(chip->vendor.irq, chip);
+                iounmap(i->iobase);
+                list_del(&i->list);
+                tpm_remove_hardware(chip->dev);
+        }
+        spin_unlock(&tis_lock);
+        pnp_unregister_driver(&tis_pnp_driver);
+}
+
+module_init(init_tis);
+module_exit(cleanup_tis);
+MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
+MODULE_DESCRIPTION("TPM Driver");
+MODULE_VERSION("2.0");
+MODULE_LICENSE("GPL");
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 9759d05b1972..29b2fa5534ae 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1497,7 +1497,7 @@ int cpufreq_update_policy(unsigned int cpu)
 }
 EXPORT_SYMBOL(cpufreq_update_policy);
 
-static int __cpuinit cpufreq_cpu_callback(struct notifier_block *nfb,
+static int cpufreq_cpu_callback(struct notifier_block *nfb,
                                         unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 1dca3cf42a54..2e4abdc26367 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -350,11 +350,11 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
         return 0;
  bail2:
         serio_close(serio);
+        serio_set_drvdata(serio, NULL);
  bail1:
         input_free_device(kbd->dev);
  bail0:
         kfree(kbd);
-        serio_set_drvdata(serio, NULL);
         return -EIO;
 }
 
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index f86ed6af3aa2..eb41aba3ddef 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -5,8 +5,6 @@
  *                       Tilman Schmidt <tilman@imap.cc>,
  *                       Stefan Eilers.
  *
- * Based on usb-gigaset.c.
- *
  * =====================================================================
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License as
@@ -46,19 +44,20 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define GIGASET_DEVFSNAME  "gig/bas/"
 #define GIGASET_DEVNAME    "ttyGB"
 
-#define IF_WRITEBUF 256 //FIXME
+/* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
+#define IF_WRITEBUF 264
 
 /* Values for the Gigaset 307x */
 #define USB_GIGA_VENDOR_ID      0x0681
-#define USB_GIGA_PRODUCT_ID     0x0001
-#define USB_4175_PRODUCT_ID     0x0002
+#define USB_3070_PRODUCT_ID     0x0001
+#define USB_3075_PRODUCT_ID     0x0002
 #define USB_SX303_PRODUCT_ID    0x0021
 #define USB_SX353_PRODUCT_ID    0x0022
 
 /* table of devices that work with this driver */
 static struct usb_device_id gigaset_table [] = {
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_GIGA_PRODUCT_ID) },
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_4175_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3070_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3075_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX353_PRODUCT_ID) },
         { } /* Terminating entry */
@@ -77,6 +76,10 @@ static int gigaset_probe(struct usb_interface *interface,
 /* Function will be called if the device is unplugged */
 static void gigaset_disconnect(struct usb_interface *interface);
 
+static void read_ctrl_callback(struct urb *, struct pt_regs *);
+static void stopurbs(struct bas_bc_state *);
+static int atwrite_submit(struct cardstate *, unsigned char *, int);
+static int start_cbsend(struct cardstate *);
 
 /*==============================================================================*/
 
@@ -111,12 +114,14 @@ struct bas_cardstate {
 };
 
 /* status of direct USB connection to 307x base (bits in basstate) */
-#define BS_ATOPEN       0x001
-#define BS_B1OPEN       0x002
-#define BS_B2OPEN       0x004
-#define BS_ATREADY      0x008
-#define BS_INIT         0x010
-#define BS_ATTIMER      0x020
+#define BS_ATOPEN       0x001   /* AT channel open */
+#define BS_B1OPEN       0x002   /* B channel 1 open */
+#define BS_B2OPEN       0x004   /* B channel 2 open */
+#define BS_ATREADY      0x008   /* base ready for AT command */
+#define BS_INIT         0x010   /* base has signalled INIT_OK */
+#define BS_ATTIMER      0x020   /* waiting for HD_READY_SEND_ATDATA */
+#define BS_ATRDPEND     0x040   /* urb_cmd_in in use */
+#define BS_ATWRPEND     0x080   /* urb_cmd_out in use */
 
 
 static struct gigaset_driver *driver = NULL;
@@ -130,6 +135,47 @@ static struct usb_driver gigaset_usb_driver = {
         .id_table =     gigaset_table,
 };
 
+/* get message text for usb_submit_urb return code
+ */
+static char *get_usb_rcmsg(int rc)
+{
+        static char unkmsg[28];
+
+        switch (rc) {
+        case 0:
+                return "success";
+        case -ENOMEM:
+                return "out of memory";
+        case -ENODEV:
+                return "device not present";
+        case -ENOENT:
+                return "endpoint not present";
+        case -ENXIO:
+                return "URB type not supported";
+        case -EINVAL:
+                return "invalid argument";
+        case -EAGAIN:
+                return "start frame too early or too much scheduled";
+        case -EFBIG:
+                return "too many isochronous frames requested";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -EMSGSIZE:
+                return "invalid packet size";
+        case -ENOSPC:
+                return "would overcommit USB bandwidth";
+        case -ESHUTDOWN:
+                return "device shut down";
+        case -EPERM:
+                return "reject flag set";
+        case -EHOSTUNREACH:
+                return "device suspended";
+        default:
+                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", rc);
+                return unkmsg;
+        }
+}
+
 /* get message text for USB status code
  */
 static char *get_usb_statmsg(int status)
@@ -140,43 +186,37 @@ static char *get_usb_statmsg(int status)
         case 0:
                 return "success";
         case -ENOENT:
-                return "canceled";
-        case -ECONNRESET:
-                return "canceled (async)";
+                return "unlinked (sync)";
         case -EINPROGRESS:
                 return "pending";
         case -EPROTO:
-                return "bit stuffing or unknown USB error";
+                return "bit stuffing error, timeout, or unknown USB error";
         case -EILSEQ:
-                return "Illegal byte sequence (CRC mismatch)";
-        case -EPIPE:
-                return "babble detect or endpoint stalled";
-        case -ENOSR:
-                return "buffer error";
+                return "CRC mismatch, timeout, or unknown USB error";
         case -ETIMEDOUT:
                 return "timed out";
-        case -ENODEV:
-                return "device not present";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -ECOMM:
+                return "IN buffer overrun";
+        case -ENOSR:
+                return "OUT buffer underrun";
+        case -EOVERFLOW:
+                return "too much data";
         case -EREMOTEIO:
                 return "short packet detected";
+        case -ENODEV:
+                return "device removed";
         case -EXDEV:
                 return "partial isochronous transfer";
         case -EINVAL:
                 return "invalid argument";
-        case -ENXIO:
-                return "URB already queued";
-        case -EAGAIN:
-                return "isochronous start frame too early or too much scheduled";
-        case -EFBIG:
-                return "too many isochronous frames requested";
-        case -EMSGSIZE:
-                return "endpoint message size zero";
+        case -ECONNRESET:
+                return "unlinked (async)";
         case -ESHUTDOWN:
-                return "endpoint shutdown";
-        case -EBUSY:
-                return "another request pending";
+                return "device shut down";
         default:
-                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", status);
+                snprintf(unkmsg, sizeof(unkmsg), "unknown status %d", status);
                 return unkmsg;
         }
 }
@@ -277,18 +317,17 @@ static inline void error_hangup(struct bc_state *bcs)
         gig_dbg(DEBUG_ANY, "%s: scheduling HUP for channel %d",
                 __func__, bcs->channel);
 
-        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
-                //FIXME what should we do?
-                return;
-        }
+        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL))
+                dev_err(cs->dev, "event queue full\n");
 
         gigaset_schedule_event(cs);
 }
 
 /* error_reset
  * reset Gigaset device because of an unrecoverable error
- * This function may be called from any context and takes care of scheduling
- * the necessary actions for execution outside of interrupt context.
+ * This function may be called from any context, and should take care of
+ * scheduling the necessary actions for execution outside of interrupt context.
+ * Right now, it just generates a kernel message calling for help.
  * argument:
  *      controller state structure
  */
@@ -364,36 +403,38 @@ static void cmd_in_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
         struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
 
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                gig_dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
         if (!ucs->rcvbuf_size) {
                 gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
-        spin_unlock_irqrestore(&cs->lock, flags);
 
         dev_err(cs->dev, "timeout reading AT response\n");
         error_reset(cs);        //FIXME retry?
 }
 
+/* set/clear bits in base connection state, return previous state
+ */
+inline static int update_basstate(struct bas_cardstate *ucs,
+                                  int set, int clear)
+{
+        unsigned long flags;
+        int state;
 
-static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs);
+        spin_lock_irqsave(&ucs->lock, flags);
+        state = atomic_read(&ucs->basstate);
+        atomic_set(&ucs->basstate, (state & ~clear) | set);
+        spin_unlock_irqrestore(&ucs->lock, flags);
+        return state;
+}
 
 /* atread_submit
- * submit an HD_READ_ATMESSAGE command URB
+ * submit an HD_READ_ATMESSAGE command URB and optionally start a timeout
  * parameters:
  *      cs      controller state structure
  *      timeout timeout in 1/10 sec., 0: none
  * return value:
  *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
@@ -405,7 +446,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
         gig_dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)",
                 ucs->rcvbuf_size);
 
-        if (ucs->urb_cmd_in->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATRDPEND, 0) & BS_ATRDPEND) {
                 dev_err(cs->dev,
                         "could not submit HD_READ_ATMESSAGE: URB busy\n");
                 return -EBUSY;
@@ -423,6 +464,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
                              read_ctrl_callback, cs->inbuf);
 
         if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
+                update_basstate(ucs, 0, BS_ATRDPEND);
                 dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
                         get_usb_statmsg(ret));
                 return ret;
@@ -438,26 +480,6 @@ static int atread_submit(struct cardstate *cs, int timeout)
         return 0;
 }
 
-static void stopurbs(struct bas_bc_state *);
-static int start_cbsend(struct cardstate *);
-
-/* set/clear bits in base connection state
- */
-inline static void update_basstate(struct bas_cardstate *ucs,
-                                   int set, int clear)
-{
-        unsigned long flags;
-        int state;
-
-        spin_lock_irqsave(&ucs->lock, flags);
-        state = atomic_read(&ucs->basstate);
-        state &= ~clear;
-        state |= set;
-        atomic_set(&ucs->basstate, state);
-        spin_unlock_irqrestore(&ucs->lock, flags);
-}
-
-
 /* read_int_callback
  * USB completion handler for interrupt pipe input
  * called by the USB subsystem in interrupt context
@@ -471,20 +493,25 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         struct bc_state *bcs;
         unsigned long flags;
-        int status;
+        int rc;
         unsigned l;
         int channel;
 
         switch (urb->status) {
         case 0:                 /* success */
                 break;
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
                 /* ignore silently */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                //FIXME use this as disconnect indicator?
+                gig_dbg(DEBUG_USBREQ, "%s: device disconnected", __func__);
+                return;
         default:                /* severe trouble */
                 dev_warn(cs->dev, "interrupt read: %s\n",
                          get_usb_statmsg(urb->status));
@@ -492,6 +519,13 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 goto resubmit;
         }
 
+        /* drop incomplete packets even if the missing bytes wouldn't matter */
+        if (unlikely(urb->actual_length < 3)) {
+                dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
+                         urb->actual_length);
+                goto resubmit;
+        }
+
         l = (unsigned) ucs->int_in_buf[1] +
             (((unsigned) ucs->int_in_buf[2]) << 8);
 
@@ -558,25 +592,28 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 }
                 spin_lock_irqsave(&cs->lock, flags);
                 if (ucs->rcvbuf_size) {
-                        spin_unlock_irqrestore(&cs->lock, flags);
+                        /* throw away previous buffer - we have no queue */
                         dev_err(cs->dev,
-                                "receive AT data overrun, %d bytes lost\n", l);
-                        error_reset(cs);        //FIXME reschedule
-                        break;
+                                "receive AT data overrun, %d bytes lost\n",
+                                ucs->rcvbuf_size);
+                        kfree(ucs->rcvbuf);
+                        ucs->rcvbuf_size = 0;
                 }
                 if ((ucs->rcvbuf = kmalloc(l, GFP_ATOMIC)) == NULL) {
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        dev_err(cs->dev, "out of memory, %d bytes lost\n", l);
-                        error_reset(cs);        //FIXME reschedule
+                        dev_err(cs->dev, "out of memory receiving AT data\n");
+                        error_reset(cs);
                         break;
                 }
                 ucs->rcvbuf_size = l;
                 ucs->retry_cmd_in = 0;
-                if ((status = atread_submit(cs, BAS_TIMEOUT)) < 0) {
+                if ((rc = atread_submit(cs, BAS_TIMEOUT)) < 0) {
                         kfree(ucs->rcvbuf);
                         ucs->rcvbuf = NULL;
                         ucs->rcvbuf_size = 0;
-                        error_reset(cs);        //FIXME reschedule
+                        if (rc != -ENODEV)
+                                //FIXME corrective action?
+                                error_reset(cs);
                 }
                 spin_unlock_irqrestore(&cs->lock, flags);
                 break;
@@ -598,12 +635,10 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         check_pending(ucs);
 
 resubmit:
-        spin_lock_irqsave(&cs->lock, flags);
-        status = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-        spin_unlock_irqrestore(&cs->lock, flags);
-        if (unlikely(status)) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc != 0 && rc != -ENODEV)) {
                 dev_err(cs->dev, "could not resubmit interrupt URB: %s\n",
-                        get_usb_statmsg(status));
+                        get_usb_rcmsg(rc));
                 error_reset(cs);
         }
 }
@@ -622,18 +657,12 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         int have_data = 0;
         unsigned numbytes;
-        unsigned long flags;
+        int rc;
 
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                warn("%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
+        update_basstate(ucs, 0, BS_ATRDPEND);
 
         if (!ucs->rcvbuf_size) {
                 dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
 
@@ -666,9 +695,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                 }
                 break;
 
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                 /* no action necessary */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
@@ -681,11 +712,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                 if (ucs->retry_cmd_in++ < BAS_RETRY) {
                         dev_notice(cs->dev, "control read: retry %d\n",
                                    ucs->retry_cmd_in);
-                        if (atread_submit(cs, BAS_TIMEOUT) >= 0) {
-                                /* resubmitted - bypass regular exit block */
-                                spin_unlock_irqrestore(&cs->lock, flags);
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
                                 return;
-                        }
                 } else {
                         dev_err(cs->dev,
                                 "control read: giving up after %d tries\n",
@@ -697,7 +728,6 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        spin_unlock_irqrestore(&cs->lock, flags);
         if (have_data) {
                 gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
                 gigaset_schedule_event(cs);
@@ -719,8 +749,11 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
         int i, rc;
 
         /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
+        if (unlikely(urb->status == -ENOENT ||
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                 gig_dbg(DEBUG_ISO, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
@@ -740,9 +773,9 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                 for (i = 0; i < BAS_NUMFRAMES; i++) {
                         ubc->isoinlost += urb->iso_frame_desc[i].actual_length;
                         if (unlikely(urb->iso_frame_desc[i].status != 0 &&
-                                     urb->iso_frame_desc[i].status != -EINPROGRESS)) {
+                                     urb->iso_frame_desc[i].status !=
+                                                                -EINPROGRESS))
                                 ubc->loststatus = urb->iso_frame_desc[i].status;
-                        }
                         urb->iso_frame_desc[i].status = 0;
                         urb->iso_frame_desc[i].actual_length = 0;
                 }
@@ -754,10 +787,10 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                         gig_dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit",
                                 __func__);
                         rc = usb_submit_urb(urb, SLAB_ATOMIC);
-                        if (unlikely(rc != 0)) {
+                        if (unlikely(rc != 0 && rc != -ENODEV)) {
                                 dev_err(bcs->cs->dev,
                                         "could not resubmit isochronous read "
-                                        "URB: %s\n", get_usb_statmsg(rc));
+                                        "URB: %s\n", get_usb_rcmsg(rc));
                                 dump_urb(DEBUG_ISO, "isoc read", urb);
                                 error_hangup(bcs);
                         }
@@ -780,8 +813,11 @@ static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
         unsigned long flags;
 
         /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
+        if (unlikely(urb->status == -ENOENT ||
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                 gig_dbg(DEBUG_ISO, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
@@ -822,7 +858,6 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_INURBS; k++) {
                 urb = ubc->isoinurbs[k];
                 if (!urb) {
-                        dev_err(bcs->cs->dev, "isoinurbs[%d]==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -844,12 +879,8 @@ static int starturbs(struct bc_state *bcs)
                 }
 
                 dump_urb(DEBUG_ISO, "Initial isoc read", urb);
-                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
-                        dev_err(bcs->cs->dev,
-                               "could not submit isochronous read URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
+                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0)
                         goto error;
-                }
         }
 
         /* initialize L2 transmission */
@@ -859,7 +890,6 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 urb = ubc->isoouturbs[k].urb;
                 if (!urb) {
-                        dev_err(bcs->cs->dev, "isoouturbs[%d].urb==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -885,12 +915,8 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < 2; ++k) {
                 dump_urb(DEBUG_ISO, "Initial isoc write", urb);
                 rc = usb_submit_urb(ubc->isoouturbs[k].urb, SLAB_ATOMIC);
-                if (rc != 0) {
-                        dev_err(bcs->cs->dev,
-                              "could not submit isochronous write URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
+                if (rc != 0)
                         goto error;
-                }
         }
         dump_urb(DEBUG_ISO, "Initial isoc write (free)", urb);
         ubc->isooutfree = &ubc->isoouturbs[2];
@@ -916,15 +942,15 @@ static void stopurbs(struct bas_bc_state *ubc)
         for (k = 0; k < BAS_INURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoinurbs[k]);
                 gig_dbg(DEBUG_ISO,
-                        "%s: isoc input URB %d unlinked, result = %d",
-                        __func__, k, rc);
+                        "%s: isoc input URB %d unlinked, result = %s",
+                        __func__, k, get_usb_rcmsg(rc));
         }
 
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoouturbs[k].urb);
                 gig_dbg(DEBUG_ISO,
-                        "%s: isoc output URB %d unlinked, result = %d",
-                        __func__, k, rc);
+                        "%s: isoc output URB %d unlinked, result = %s",
+                        __func__, k, get_usb_rcmsg(rc));
         }
 }
 
@@ -934,7 +960,7 @@ static void stopurbs(struct bas_bc_state *ubc)
 /* submit_iso_write_urb
  * fill and submit the next isochronous write URB
  * parameters:
- *      bcs     B channel state structure
+ *      ucx     context structure containing URB
  * return value:
  *      number of frames submitted in URB
  *      0 if URB not submitted because no data available (isooutbuf busy)
@@ -946,7 +972,6 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
         struct bas_bc_state *ubc = ucx->bcs->hw.bas;
         struct usb_iso_packet_descriptor *ifd;
         int corrbytes, nframe, rc;
-        unsigned long flags;
 
         /* urb->dev is clobbered by USB subsystem */
         urb->dev = ucx->bcs->cs->hw.bas->udev;
@@ -992,20 +1017,22 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                 ifd->status = 0;
                 ifd->actual_length = 0;
         }
-        if ((urb->number_of_packets = nframe) > 0) {
-                spin_lock_irqsave(&ucx->bcs->cs->lock, flags);
-                rc = ucx->bcs->cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-                spin_unlock_irqrestore(&ucx->bcs->cs->lock, flags);
+        if (unlikely(nframe == 0))
+                return 0;       /* no data to send */
+        urb->number_of_packets = nframe;
 
-                if (rc) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                if (rc == -ENODEV)
+                        /* device removed - give up silently */
+                        gig_dbg(DEBUG_ISO, "%s: disconnected", __func__);
+                else
                         dev_err(ucx->bcs->cs->dev,
                                 "could not submit isochronous write URB: %s\n",
-                                get_usb_statmsg(rc));
-                        dump_urb(DEBUG_ISO, "isoc write", urb);
-                        return rc;
-                }
-                ++ubc->numsub;
+                                get_usb_rcmsg(rc));
+                return rc;
         }
+        ++ubc->numsub;
         return nframe;
 }
 
@@ -1028,6 +1055,7 @@ static void write_iso_tasklet(unsigned long data)
         int i;
         struct sk_buff *skb;
         int len;
+        int rc;
 
         /* loop while completed URBs arrive in time */
         for (;;) {
@@ -1057,7 +1085,8 @@ static void write_iso_tasklet(unsigned long data)
                 ubc->isooutfree = NULL;
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (next) {
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                 /* could not submit URB, put it back */
                                 spin_lock_irqsave(&ubc->isooutlock, flags);
                                 if (ubc->isooutfree == NULL) {
@@ -1077,17 +1106,18 @@ static void write_iso_tasklet(unsigned long data)
                 /* process completed URB */
                 urb = done->urb;
                 switch (urb->status) {
+                case -EXDEV:                    /* partial completion */
+                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                                __func__);
+                        /* fall through - what's the difference anyway? */
                 case 0:                         /* normal completion */
-                        break;
-                case -EXDEV:                    /* inspect individual frames */
-                        /* assumptions (for lack of documentation):
-                         * - actual_length bytes of the frame in error are
+                        /* inspect individual frames
+                         * assumptions (for lack of documentation):
+                         * - actual_length bytes of first frame in error are
                          *   successfully sent
                          * - all following frames are not sent at all
                          */
-                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
-                                __func__);
-                        offset = done->limit;   /* just in case */
+                        offset = done->limit;   /* default (no error) */
                         for (i = 0; i < BAS_NUMFRAMES; i++) {
                                 ifd = &urb->iso_frame_desc[i];
                                 if (ifd->status ||
@@ -1122,7 +1152,7 @@ static void write_iso_tasklet(unsigned long data)
                         }
 #endif
                         break;
-                case -EPIPE:            //FIXME is this the code for "underrun"?
+                case -EPIPE:                    /* stall - probably underrun */
                         dev_err(cs->dev, "isochronous write stalled\n");
                         error_hangup(bcs);
                         break;
@@ -1142,7 +1172,8 @@ static void write_iso_tasklet(unsigned long data)
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (next) {
                         /* only one URB still active - resubmit one */
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                 /* couldn't submit */
                                 error_hangup(bcs);
                         }
@@ -1222,10 +1253,9 @@ static void read_iso_tasklet(unsigned long data)
                         break;
                 case -ENOENT:
                 case -ECONNRESET:
-                        gig_dbg(DEBUG_ISO, "%s: URB canceled", __func__);
-                        continue;               /* -> skip */
-                case -EINPROGRESS:              /* huh? */
-                        gig_dbg(DEBUG_ISO, "%s: URB still pending", __func__);
+                case -EINPROGRESS:
+                        gig_dbg(DEBUG_ISO, "%s: %s",
+                                __func__, get_usb_statmsg(urb->status));
                         continue;               /* -> skip */
                 case -EPIPE:
                         dev_err(cs->dev, "isochronous read stalled\n");
@@ -1290,13 +1320,11 @@ static void read_iso_tasklet(unsigned long data)
                 urb->dev = bcs->cs->hw.bas->udev;
                 urb->transfer_flags = URB_ISO_ASAP;
                 urb->number_of_packets = BAS_NUMFRAMES;
-                spin_lock_irqsave(&cs->lock, flags);
-                rc = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-                spin_unlock_irqrestore(&cs->lock, flags);
-                if (rc) {
+                rc = usb_submit_urb(urb, SLAB_ATOMIC);
+                if (unlikely(rc != 0 && rc != -ENODEV)) {
                         dev_err(cs->dev,
                                 "could not resubmit isochronous read URB: %s\n",
-                                get_usb_statmsg(rc));
+                                get_usb_rcmsg(rc));
                         dump_urb(DEBUG_ISO, "resubmit iso read", urb);
                         error_hangup(bcs);
                 }
@@ -1397,7 +1425,6 @@ static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
  *      timeout timeout in seconds (0: no timeout)
  * return value:
  *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
@@ -1418,12 +1445,6 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
                         req, ucs->pending);
                 return -EBUSY;
         }
-        if (ucs->urb_ctrl->status == -EINPROGRESS) {
-                spin_unlock_irqrestore(&ucs->lock, flags);
-                dev_err(bcs->cs->dev,
-                        "could not submit request 0x%02x: URB busy\n", req);
-                return -EBUSY;
-        }
 
         ucs->dr_ctrl.bRequestType = OUT_VENDOR_REQ;
         ucs->dr_ctrl.bRequest = req;
@@ -1465,22 +1486,36 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
 static int gigaset_init_bchannel(struct bc_state *bcs)
 {
         int req, ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
 
         if ((ret = starturbs(bcs)) < 0) {
                 dev_err(bcs->cs->dev,
-                        "could not start isochronous I/O for channel %d\n",
-                        bcs->channel + 1);
-                error_hangup(bcs);
+                        "could not start isochronous I/O for channel B%d: %s\n",
+                        bcs->channel + 1,
+                        ret == -EFAULT ? "null URB" : get_usb_rcmsg(ret));
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 return ret;
         }
 
         req = bcs->channel ? HD_OPEN_B2CHANNEL : HD_OPEN_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0) {
-                dev_err(bcs->cs->dev, "could not open channel %d: %s\n",
-                        bcs->channel + 1, get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "could not open channel B%d\n",
+                        bcs->channel + 1);
                 stopurbs(bcs->hw.bas);
-                error_hangup(bcs);
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
         }
+
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return ret;
 }
 
@@ -1497,19 +1532,30 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 static int gigaset_close_bchannel(struct bc_state *bcs)
 {
         int req, ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
 
         if (!(atomic_read(&bcs->cs->hw.bas->basstate) &
               (bcs->channel ? BS_B2OPEN : BS_B1OPEN))) {
                 /* channel not running: just signal common.c */
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 gigaset_bchannel_down(bcs);
                 return 0;
         }
 
+        /* channel running: tell device to close it */
         req = bcs->channel ? HD_CLOSE_B2CHANNEL : HD_CLOSE_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0)
-                dev_err(bcs->cs->dev,
-                        "could not submit HD_CLOSE_BxCHANNEL request: %s\n",
-                        get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "closing channel B%d failed\n",
+                        bcs->channel + 1);
+
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return ret;
 }
 
@@ -1545,8 +1591,6 @@ static void complete_cb(struct cardstate *cs)
         kfree(cb);
 }
 
-static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len);
-
 /* write_command_callback
  * USB completion handler for AT command transmission
  * called by the USB subsystem in interrupt context
@@ -1560,13 +1604,17 @@ static void write_command_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         unsigned long flags;
 
+        update_basstate(ucs, 0, BS_ATWRPEND);
+
         /* check status */
         switch (urb->status) {
         case 0:                                 /* normal completion */
                 break;
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                 /* ignore silently */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
@@ -1627,19 +1675,17 @@ static void atrdy_timeout(unsigned long data)
  *      len     length of command to send
  * return value:
  *      0 on success
- *      -EFAULT if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
 static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 {
         struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
-        int ret;
+        int rc;
 
         gig_dbg(DEBUG_USBREQ, "-------> HD_WRITE_ATMESSAGE (%d)", len);
 
-        if (ucs->urb_cmd_out->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATWRPEND, 0) & BS_ATWRPEND) {
                 dev_err(cs->dev,
                         "could not submit HD_WRITE_ATMESSAGE: URB busy\n");
                 return -EBUSY;
@@ -1654,29 +1700,22 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
                              usb_sndctrlpipe(ucs->udev, 0),
                              (unsigned char*) &ucs->dr_cmd_out, buf, len,
                              write_command_callback, cs);
-
-        spin_lock_irqsave(&cs->lock, flags);
-        ret = cs->connected ? usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC) : -ENODEV;
-        spin_unlock_irqrestore(&cs->lock, flags);
-
-        if (ret) {
+        rc = usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                update_basstate(ucs, 0, BS_ATWRPEND);
                 dev_err(cs->dev, "could not submit HD_WRITE_ATMESSAGE: %s\n",
-                        get_usb_statmsg(ret));
-                return ret;
+                        get_usb_rcmsg(rc));
+                return rc;
         }
 
-        /* submitted successfully */
-        update_basstate(ucs, 0, BS_ATREADY);
-
-        /* start timeout if necessary */
-        if (!(atomic_read(&ucs->basstate) & BS_ATTIMER)) {
+        /* submitted successfully, start timeout if necessary */
+        if (!(update_basstate(ucs, BS_ATTIMER, BS_ATREADY) & BS_ATTIMER)) {
                 gig_dbg(DEBUG_OUTPUT, "setting ATREADY timeout of %d/10 secs",
                         ATRDY_TIMEOUT);
                 ucs->timer_atrdy.expires = jiffies + ATRDY_TIMEOUT * HZ / 10;
                 ucs->timer_atrdy.data = (unsigned long) cs;
                 ucs->timer_atrdy.function = atrdy_timeout;
                 add_timer(&ucs->timer_atrdy);
-                update_basstate(ucs, BS_ATTIMER, 0);
         }
         return 0;
 }
@@ -1702,7 +1741,6 @@ static int start_cbsend(struct cardstate *cs)
                 gig_dbg(DEBUG_TRANSCMD|DEBUG_LOCKCMD, "AT channel not open");
                 rc = req_submit(cs->bcs, HD_OPEN_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (rc < 0) {
-                        dev_err(cs->dev, "could not open AT channel\n");
                         /* flush command queue */
                         spin_lock_irqsave(&cs->cmdlock, flags);
                         while (cs->cmdbuf != NULL)
@@ -1786,8 +1824,14 @@ static int gigaset_write_cmd(struct cardstate *cs,
         cs->lastcmdbuf = cb;
         spin_unlock_irqrestore(&cs->cmdlock, flags);
 
+        spin_lock_irqsave(&cs->lock, flags);
+        if (unlikely(!cs->connected)) {
+                spin_unlock_irqrestore(&cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
         status = start_cbsend(cs);
-
+        spin_unlock_irqrestore(&cs->lock, flags);
         return status < 0 ? status : len;
 }
 
@@ -1849,12 +1893,32 @@ static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
  */
 static int gigaset_freebcshw(struct bc_state *bcs)
 {
-        if (!bcs->hw.bas)
+        struct bas_bc_state *ubc = bcs->hw.bas;
+        int i;
+
+        if (!ubc)
                 return 0;
 
-        if (bcs->hw.bas->isooutbuf)
-                kfree(bcs->hw.bas->isooutbuf);
-        kfree(bcs->hw.bas);
+        /* kill URBs and tasklets before freeing - better safe than sorry */
+        atomic_set(&ubc->running, 0);
+        for (i = 0; i < BAS_OUTURBS; ++i)
+                if (ubc->isoouturbs[i].urb) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso out URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoouturbs[i].urb);
+                        usb_free_urb(ubc->isoouturbs[i].urb);
+                }
+        for (i = 0; i < BAS_INURBS; ++i)
+                if (ubc->isoinurbs[i]) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso in URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoinurbs[i]);
+                        usb_free_urb(ubc->isoinurbs[i]);
+                }
+        tasklet_kill(&ubc->sent_tasklet);
+        tasklet_kill(&ubc->rcvd_tasklet);
+        kfree(ubc->isooutbuf);
+        kfree(ubc);
         bcs->hw.bas = NULL;
         return 1;
 }
@@ -1931,13 +1995,9 @@ static void gigaset_reinitbcshw(struct bc_state *bcs)
 
 static void gigaset_freecshw(struct cardstate *cs)
 {
-        struct bas_cardstate *ucs = cs->hw.bas;
-
-        del_timer(&ucs->timer_ctrl);
-        del_timer(&ucs->timer_atrdy);
-        del_timer(&ucs->timer_cmd_in);
-
+        /* timers, URBs and rcvbuf are disposed of in disconnect */
         kfree(cs->hw.bas);
+        cs->hw.bas = NULL;
 }
 
 static int gigaset_initcshw(struct cardstate *cs)
@@ -2041,23 +2101,13 @@ static int gigaset_probe(struct usb_interface *interface,
         struct bas_bc_state *ubc;
         struct usb_endpoint_descriptor *endpoint;
         int i, j;
-        int ret;
+        int rc;
 
         gig_dbg(DEBUG_ANY,
                 "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
                 __func__, le16_to_cpu(udev->descriptor.idVendor),
                 le16_to_cpu(udev->descriptor.idProduct));
 
-        /* See if the device offered us matches what we can accept */
-        if ((le16_to_cpu(udev->descriptor.idVendor)  != USB_GIGA_VENDOR_ID) ||
-            (le16_to_cpu(udev->descriptor.idProduct) != USB_GIGA_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_4175_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX303_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX353_PRODUCT_ID)) {
-                gig_dbg(DEBUG_ANY, "%s: unmatched ID - exiting", __func__);
-                return -ENODEV;
-        }
-
         /* set required alternate setting */
         hostif = interface->cur_altsetting;
         if (hostif->desc.bAlternateSetting != 3) {
@@ -2105,45 +2155,22 @@ static int gigaset_probe(struct usb_interface *interface,
          * - three for the different uses of the default control pipe
          * - three for each isochronous pipe
          */
-        ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_int_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_out) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_ctrl) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
+        if (!(ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL)))
+                goto allocerr;
 
         for (j = 0; j < 2; ++j) {
                 ubc = cs->bcs[j].hw.bas;
-                for (i = 0; i < BAS_OUTURBS; ++i) {
-                        ubc->isoouturbs[i].urb =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoouturbs[i].urb) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
-                for (i = 0; i < BAS_INURBS; ++i) {
-                        ubc->isoinurbs[i] =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoinurbs[i]) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
+                for (i = 0; i < BAS_OUTURBS; ++i)
+                        if (!(ubc->isoouturbs[i].urb =
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
+                                goto allocerr;
+                for (i = 0; i < BAS_INURBS; ++i)
+                        if (!(ubc->isoinurbs[i] =
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
+                                goto allocerr;
         }
 
         ucs->rcvbuf = NULL;
@@ -2156,15 +2183,14 @@ static int gigaset_probe(struct usb_interface *interface,
                                         (endpoint->bEndpointAddress) & 0x0f),
                          ucs->int_in_buf, 3, read_int_callback, cs,
                          endpoint->bInterval);
-        ret = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL);
-        if (ret) {
+        if ((rc = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL)) != 0) {
                 dev_err(cs->dev, "could not submit interrupt URB: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(rc));
                 goto error;
         }
 
         /* tell the device that the driver is ready */
-        if ((ret = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
+        if ((rc = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
                 goto error;
 
         /* tell common part that the device is ready */
@@ -2179,6 +2205,8 @@ static int gigaset_probe(struct usb_interface *interface,
 
         return 0;
 
+allocerr:
+        dev_err(cs->dev, "could not allocate URBs\n");
 error:
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
@@ -2193,19 +2221,34 @@ static void gigaset_disconnect(struct usb_interface *interface)
 {
         struct cardstate *cs;
         struct bas_cardstate *ucs;
+        int j;
 
         cs = usb_get_intfdata(interface);
 
         ucs = cs->hw.bas;
 
         dev_info(cs->dev, "disconnecting Gigaset base\n");
+
+        /* mark base as not ready, all channels disconnected */
+        atomic_set(&ucs->basstate, 0);
+
+        /* tell LL all channels are down */
+        //FIXME shouldn't gigaset_stop() do this?
+        for (j = 0; j < 2; ++j)
+                gigaset_bchannel_down(cs->bcs + j);
+
+        /* stop driver (common part) */
         gigaset_stop(cs);
+
+        /* stop timers and URBs, free ressources */
+        del_timer_sync(&ucs->timer_ctrl);
+        del_timer_sync(&ucs->timer_atrdy);
+        del_timer_sync(&ucs->timer_cmd_in);
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        atomic_set(&ucs->basstate, 0);
         usb_put_dev(ucs->udev);
         ucs->interface = NULL;
         ucs->udev = NULL;
@@ -2277,6 +2320,8 @@ error:	if (cardstate)
  */
 static void __exit bas_gigaset_exit(void)
 {
+        struct bas_cardstate *ucs = cardstate->hw.bas;
+
         gigaset_blockdriver(driver); /* => probe will fail
                                       * => no gigaset_start any more
                                       */
@@ -2284,14 +2329,26 @@ static void __exit bas_gigaset_exit(void)
         gigaset_shutdown(cardstate);
         /* from now on, no isdn callback should be possible */
 
-        if (atomic_read(&cardstate->hw.bas->basstate) & BS_ATOPEN) {
-                gig_dbg(DEBUG_ANY, "closing AT channel");
-                if (req_submit(cardstate->bcs,
-                               HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT) >= 0) {
-                        /* successfully submitted */
-                        //FIXME wait for completion?
-                }
+        /* close all still open channels */
+        if (atomic_read(&ucs->basstate) & BS_B1OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B1 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B1CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_B2OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B2 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B2CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_ATOPEN) {
+                gig_dbg(DEBUG_INIT, "closing AT channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_ATCHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
         }
+        atomic_set(&ucs->basstate, 0);
 
         /* deregister this driver with the USB subsystem */
         usb_deregister(&gigaset_usb_driver);
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 749b3da1236e..e55767b2ccd3 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -781,8 +781,7 @@ error:	if (cs)
 }
 EXPORT_SYMBOL_GPL(gigaset_initcs);
 
-/* ReInitialize the b-channel structure */
-/* e.g. called on hangup, disconnect */
+/* ReInitialize the b-channel structure on hangup */
 void gigaset_bcs_reinit(struct bc_state *bcs)
 {
         struct sk_buff *skb;
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 1ba3424a286b..18e05c09b71c 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -373,6 +373,9 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
 
         {EV_TIMEOUT,  750,750, -1,                  0, 0, {ACT_CONNTIMEOUT}},
 
+        /* B channel closed (general case) */
+        {EV_BC_CLOSED, -1, -1, -1,                 -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
+
         /* misc. */
         {EV_PROTO_L2,  -1, -1, -1,                 -1,-1, {ACT_PROTO_L2}}, //FIXME
 
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 9d21ba8757b0..22b9693f7c0a 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -75,7 +75,7 @@ extern int gigaset_debuglevel;	/* "needs" cast to (enum debuglevel) */
  * e.g. 'insmod usb_gigaset.o debug=0x2c' will set DEBUG_OPEN, DEBUG_CMD and
  * DEBUG_INTR.
  */
-enum debuglevel { /* up to 24 bits (atomic_t) */
+enum debuglevel {
         DEBUG_REG         = 0x0002, /* serial port I/O register operations */
         DEBUG_OPEN        = 0x0004, /* open/close serial port */
         DEBUG_INTR        = 0x0008, /* interrupt processing */
@@ -141,7 +141,7 @@ enum debuglevel { /* up to 24 bits (atomic_t) */
                         printk(KERN_DEBUG KBUILD_MODNAME ": " format "\n", \
                                ## arg); \
         } while (0)
-#define DEBUG_DEFAULT (DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
+#define DEBUG_DEFAULT (DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
 
 #else
 
@@ -627,8 +627,7 @@ struct gigaset_ops {
         /* Called by gigaset_freecs() for freeing bcs->hw.xxx */
         int (*freebcshw)(struct bc_state *bcs);
 
-        /* Called by gigaset_stop() or gigaset_bchannel_down() for resetting
-           bcs->hw.xxx */
+        /* Called by gigaset_bchannel_down() for resetting bcs->hw.xxx */
         void (*reinitbcshw)(struct bc_state *bcs);
 
         /* Called by gigaset_initcs() for setting up cs->hw.xxx */
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 0815dbfb8291..1654fa413575 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -73,7 +73,7 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
                 len, skblen, (unsigned) skb->head[0], (unsigned) skb->head[1]);
 
         /* pass to device-specific module */
-        return cs->ops->send_skb(bcs, skb); //FIXME cs->ops->send_skb() must handle !cs->connected correctly
+        return cs->ops->send_skb(bcs, skb);
 }
 
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 45f017ed6e8c..8667daaa1a82 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -992,14 +992,18 @@ int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
         int len = skb->len;
         unsigned long flags;
 
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (!bcs->cs->connected) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
+
         skb_queue_tail(&bcs->squeue, skb);
         gig_dbg(DEBUG_ISO, "%s: skb queued, qlen=%d",
                 __func__, skb_queue_len(&bcs->squeue));
 
         /* tasklet submits URB if necessary */
-        spin_lock_irqsave(&bcs->cs->lock, flags);
-        if (bcs->cs->connected)
-                tasklet_schedule(&bcs->hw.bas->sent_tasklet);
+        tasklet_schedule(&bcs->hw.bas->sent_tasklet);
         spin_unlock_irqrestore(&bcs->cs->lock, flags);
 
         return len;     /* ok so far */
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index 5ebfd1d138da..5282fec17075 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -627,8 +627,8 @@ thermostat_init(void)
         if(therm_type == ADT7460)
                 device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
 
-#ifndef CONFIG_I2C_KEYWEST
-        request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+        request_module("i2c-powermac");
 #endif
 
         return i2c_add_driver(&thermostat_driver);
diff --git a/drivers/mmc/pxamci.c b/drivers/mmc/pxamci.c
index eb9a8826e9b5..eb42cb349420 100644
--- a/drivers/mmc/pxamci.c
+++ b/drivers/mmc/pxamci.c
@@ -65,11 +65,6 @@ struct pxamci_host {
         unsigned int            dma_dir;
 };
 
-static inline unsigned int ns_to_clocks(unsigned int ns)
-{
-        return (ns * (CLOCKRATE / 1000000) + 999) / 1000;
-}
-
 static void pxamci_stop_clock(struct pxamci_host *host)
 {
         if (readl(host->base + MMC_STAT) & STAT_CLK_EN) {
@@ -113,6 +108,7 @@ static void pxamci_disable_irq(struct pxamci_host *host, unsigned int mask)
 static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
 {
         unsigned int nob = data->blocks;
+        unsigned long long clks;
         unsigned int timeout;
         u32 dcmd;
         int i;
@@ -125,7 +121,9 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
         writel(nob, host->base + MMC_NOB);
         writel(1 << data->blksz_bits, host->base + MMC_BLKLEN);
 
-        timeout = ns_to_clocks(data->timeout_ns) + data->timeout_clks;
+        clks = (unsigned long long)data->timeout_ns * CLOCKRATE;
+        do_div(clks, 1000000000UL);
+        timeout = (unsigned int)clks + (data->timeout_clks << host->clkrt);
         writel((timeout + 255) / 256, host->base + MMC_RDTO);
 
         if (data->flags & MMC_DATA_READ) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index add8dc4aa7b0..c99e87838f92 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3768,6 +3768,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         ps_page->ps_page[j] = NULL;
                         skb->len += length;
                         skb->data_len += length;
+                        skb->truesize += length;
                 }
 
 copydone:
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 7627a75f4f7c..9788b1ef2e7d 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -105,6 +105,7 @@
  *      0.50: 20 Jan 2006: Add 8021pq tagging support.
  *      0.51: 20 Jan 2006: Add 64bit consistent memory allocation for rings.
  *      0.52: 20 Jan 2006: Add MSI/MSIX support.
+ *      0.53: 19 Mar 2006: Fix init from low power mode and add hw reset.
  *
  * Known bugs:
  * We suspect that on some hardware no TX done interrupts are generated.
@@ -116,7 +117,7 @@
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
-#define FORCEDETH_VERSION               "0.52"
+#define FORCEDETH_VERSION               "0.53"
 #define DRV_NAME                        "forcedeth"
 
 #include <linux/module.h>
@@ -160,6 +161,7 @@
 #define DEV_HAS_VLAN            0x0020  /* device supports vlan tagging and striping */
 #define DEV_HAS_MSI             0x0040  /* device supports MSI */
 #define DEV_HAS_MSI_X           0x0080  /* device supports MSI-X */
+#define DEV_HAS_POWER_CNTRL     0x0100  /* device supports power savings */
 
 enum {
         NvRegIrqStatus = 0x000,
@@ -203,6 +205,8 @@ enum {
 #define NVREG_MISC1_HD          0x02
 #define NVREG_MISC1_FORCE       0x3b0f3c
 
+        NvRegMacReset = 0x3c,
+#define NVREG_MAC_RESET_ASSERT  0x0F3
         NvRegTransmitterControl = 0x084,
 #define NVREG_XMITCTL_START     0x01
         NvRegTransmitterStatus = 0x088,
@@ -326,6 +330,10 @@ enum {
         NvRegMSIXMap0 = 0x3e0,
         NvRegMSIXMap1 = 0x3e4,
         NvRegMSIXIrqStatus = 0x3f0,
+
+        NvRegPowerState2 = 0x600,
+#define NVREG_POWERSTATE2_POWERUP_MASK          0x0F11
+#define NVREG_POWERSTATE2_POWERUP_REV_A3        0x0001
 };
 
 /* Big endian: should work, but is untested */
@@ -414,7 +422,8 @@ typedef union _ring_type {
 #define NV_RX3_VLAN_TAG_MASK    (0x0000FFFF)
 
 /* Miscelaneous hardware related defines: */
-#define NV_PCI_REGSZ            0x270
+#define NV_PCI_REGSZ_VER1       0x270
+#define NV_PCI_REGSZ_VER2       0x604
 
 /* various timeout delays: all in usec */
 #define NV_TXRX_RESET_DELAY     4
@@ -431,6 +440,7 @@ typedef union _ring_type {
 #define NV_MIIBUSY_DELAY        50
 #define NV_MIIPHY_DELAY 10
 #define NV_MIIPHY_DELAYMAX      10000
+#define NV_MAC_RESET_DELAY      64
 
 #define NV_WAKEUPPATTERNS       5
 #define NV_WAKEUPMASKENTRIES    4
@@ -552,6 +562,8 @@ struct fe_priv {
         u32 desc_ver;
         u32 txrxctl_bits;
         u32 vlanctl_bits;
+        u32 driver_data;
+        u32 register_size;
 
         void __iomem *base;
 
@@ -919,6 +931,24 @@ static void nv_txrx_reset(struct net_device *dev)
         pci_push(base);
 }
 
+static void nv_mac_reset(struct net_device *dev)
+{
+        struct fe_priv *np = netdev_priv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+
+        dprintk(KERN_DEBUG "%s: nv_mac_reset\n", dev->name);
+        writel(NVREG_TXRXCTL_BIT2 | NVREG_TXRXCTL_RESET | np->txrxctl_bits, base + NvRegTxRxControl);
+        pci_push(base);
+        writel(NVREG_MAC_RESET_ASSERT, base + NvRegMacReset);
+        pci_push(base);
+        udelay(NV_MAC_RESET_DELAY);
+        writel(0, base + NvRegMacReset);
+        pci_push(base);
+        udelay(NV_MAC_RESET_DELAY);
+        writel(NVREG_TXRXCTL_BIT2 | np->txrxctl_bits, base + NvRegTxRxControl);
+        pci_push(base);
+}
+
 /*
  * nv_get_stats: dev->get_stats function
  * Get latest stats value from the nic.
@@ -1331,7 +1361,7 @@ static void nv_tx_timeout(struct net_device *dev)
                                 dev->name, (unsigned long)np->ring_addr,
                                 np->next_tx, np->nic_tx);
                 printk(KERN_INFO "%s: Dumping tx registers\n", dev->name);
-                for (i=0;i<0x400;i+= 32) {
+                for (i=0;i<=np->register_size;i+= 32) {
                         printk(KERN_INFO "%3x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
                                         i,
                                         readl(base + i + 0), readl(base + i + 4),
@@ -2488,11 +2518,11 @@ static int nv_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 }
 
 #define FORCEDETH_REGS_VER      1
-#define FORCEDETH_REGS_SIZE     0x400 /* 256 32-bit registers */
 
 static int nv_get_regs_len(struct net_device *dev)
 {
-        return FORCEDETH_REGS_SIZE;
+        struct fe_priv *np = netdev_priv(dev);
+        return np->register_size;
 }
 
 static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *buf)
@@ -2504,7 +2534,7 @@ static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void
 
         regs->version = FORCEDETH_REGS_VER;
         spin_lock_irq(&np->lock);
-        for (i=0;i<FORCEDETH_REGS_SIZE/sizeof(u32);i++)
+        for (i = 0;i <= np->register_size/sizeof(u32); i++)
                 rbuf[i] = readl(base + i*sizeof(u32));
         spin_unlock_irq(&np->lock);
 }
@@ -2608,6 +2638,8 @@ static int nv_open(struct net_device *dev)
         dprintk(KERN_DEBUG "nv_open: begin\n");
 
         /* 1) erase previous misconfiguration */
+        if (np->driver_data & DEV_HAS_POWER_CNTRL)
+                nv_mac_reset(dev);
         /* 4.1-1: stop adapter: ignored, 4.3 seems to be overkill */
         writel(NVREG_MCASTADDRA_FORCE, base + NvRegMulticastAddrA);
         writel(0, base + NvRegMulticastAddrB);
@@ -2878,6 +2910,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         unsigned long addr;
         u8 __iomem *base;
         int err, i;
+        u32 powerstate;
 
         dev = alloc_etherdev(sizeof(struct fe_priv));
         err = -ENOMEM;
@@ -2910,6 +2943,11 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         if (err < 0)
                 goto out_disable;
 
+        if (id->driver_data & (DEV_HAS_VLAN|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL))
+                np->register_size = NV_PCI_REGSZ_VER2;
+        else
+                np->register_size = NV_PCI_REGSZ_VER1;
+
         err = -EINVAL;
         addr = 0;
         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
@@ -2918,7 +2956,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                                 pci_resource_len(pci_dev, i),
                                 pci_resource_flags(pci_dev, i));
                 if (pci_resource_flags(pci_dev, i) & IORESOURCE_MEM &&
-                                pci_resource_len(pci_dev, i) >= NV_PCI_REGSZ) {
+                                pci_resource_len(pci_dev, i) >= np->register_size) {
                         addr = pci_resource_start(pci_dev, i);
                         break;
                 }
@@ -2929,6 +2967,9 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 goto out_relreg;
         }
 
+        /* copy of driver data */
+        np->driver_data = id->driver_data;
+
         /* handle different descriptor versions */
         if (id->driver_data & DEV_HAS_HIGH_DMA) {
                 /* packet format 3: supports 40-bit addressing */
@@ -2986,7 +3027,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         }
 
         err = -ENOMEM;
-        np->base = ioremap(addr, NV_PCI_REGSZ);
+        np->base = ioremap(addr, np->register_size);
         if (!np->base)
                 goto out_relreg;
         dev->base_addr = (unsigned long)np->base;
@@ -3062,6 +3103,20 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         writel(0, base + NvRegWakeUpFlags);
         np->wolenabled = 0;
 
+        if (id->driver_data & DEV_HAS_POWER_CNTRL) {
+                u8 revision_id;
+                pci_read_config_byte(pci_dev, PCI_REVISION_ID, &revision_id);
+
+                /* take phy and nic out of low power mode */
+                powerstate = readl(base + NvRegPowerState2);
+                powerstate &= ~NVREG_POWERSTATE2_POWERUP_MASK;
+                if ((id->device == PCI_DEVICE_ID_NVIDIA_NVENET_12 ||
+                     id->device == PCI_DEVICE_ID_NVIDIA_NVENET_13) &&
+                    revision_id >= 0xA3)
+                        powerstate |= NVREG_POWERSTATE2_POWERUP_REV_A3;
+                writel(powerstate, base + NvRegPowerState2);
+        }
+
         if (np->desc_ver == DESC_VER_1) {
                 np->tx_flags = NV_TX_VALID;
         } else {
@@ -3223,19 +3278,19 @@ static struct pci_device_id pci_tbl[] = {
         },
         {       /* MCP51 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_12),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP51 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_13),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_14),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_15),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL,
         },
         {0,},
 };
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 771e25d8c417..218d31764c52 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -210,7 +210,8 @@ static int gfar_probe(struct platform_device *pdev)
                 goto regs_fail;
         }
 
-        spin_lock_init(&priv->lock);
+        spin_lock_init(&priv->txlock);
+        spin_lock_init(&priv->rxlock);
 
         platform_set_drvdata(pdev, dev);
 
@@ -515,11 +516,13 @@ void stop_gfar(struct net_device *dev)
         phy_stop(priv->phydev);
 
         /* Lock it down */
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
+        spin_lock(&priv->rxlock);
 
         gfar_halt(dev);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->rxlock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         /* Free the IRQs */
         if (priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_MULTI_INTR) {
@@ -605,14 +608,15 @@ void gfar_start(struct net_device *dev)
         tempval |= DMACTRL_INIT_SETTINGS;
         gfar_write(&priv->regs->dmactrl, tempval);
 
-        /* Clear THLT, so that the DMA starts polling now */
-        gfar_write(&regs->tstat, TSTAT_CLEAR_THALT);
-
         /* Make sure we aren't stopped */
         tempval = gfar_read(&priv->regs->dmactrl);
         tempval &= ~(DMACTRL_GRS | DMACTRL_GTS);
         gfar_write(&priv->regs->dmactrl, tempval);
 
+        /* Clear THLT/RHLT, so that the DMA starts polling now */
+        gfar_write(&regs->tstat, TSTAT_CLEAR_THALT);
+        gfar_write(&regs->rstat, RSTAT_CLEAR_RHALT);
+
         /* Unmask the interrupts we look for */
         gfar_write(&regs->imask, IMASK_DEFAULT);
 }
@@ -928,12 +932,13 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct txfcb *fcb = NULL;
         struct txbd8 *txbdp;
         u16 status;
+        unsigned long flags;
 
         /* Update transmit stats */
         priv->stats.tx_bytes += skb->len;
 
         /* Lock priv now */
-        spin_lock_irq(&priv->lock);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         /* Point at the first free tx descriptor */
         txbdp = priv->cur_tx;
@@ -1004,7 +1009,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         gfar_write(&priv->regs->tstat, TSTAT_CLEAR_THALT);
 
         /* Unlock priv */
-        spin_unlock_irq(&priv->lock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return 0;
 }
@@ -1049,7 +1054,7 @@ static void gfar_vlan_rx_register(struct net_device *dev,
         unsigned long flags;
         u32 tempval;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         priv->vlgrp = grp;
 
@@ -1076,7 +1081,7 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                 gfar_write(&priv->regs->rctrl, tempval);
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
 
@@ -1085,12 +1090,12 @@ static void gfar_vlan_rx_kill_vid(struct net_device *dev, uint16_t vid)
         struct gfar_private *priv = netdev_priv(dev);
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         if (priv->vlgrp)
                 priv->vlgrp->vlan_devices[vid] = NULL;
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
 
@@ -1179,7 +1184,7 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id, struct pt_regs *regs)
         gfar_write(&priv->regs->ievent, IEVENT_TX_MASK);
 
         /* Lock priv */
-        spin_lock(&priv->lock);
+        spin_lock(&priv->txlock);
         bdp = priv->dirty_tx;
         while ((bdp->status & TXBD_READY) == 0) {
                 /* If dirty_tx and cur_tx are the same, then either the */
@@ -1224,7 +1229,7 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id, struct pt_regs *regs)
         else
                 gfar_write(&priv->regs->txic, 0);
 
-        spin_unlock(&priv->lock);
+        spin_unlock(&priv->txlock);
 
         return IRQ_HANDLED;
 }
@@ -1305,9 +1310,10 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
         struct gfar_private *priv = netdev_priv(dev);
-
 #ifdef CONFIG_GFAR_NAPI
         u32 tempval;
+#else
+        unsigned long flags;
 #endif
 
         /* Clear IEVENT, so rx interrupt isn't called again
@@ -1330,7 +1336,7 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
         }
 #else
 
-        spin_lock(&priv->lock);
+        spin_lock_irqsave(&priv->rxlock, flags);
         gfar_clean_rx_ring(dev, priv->rx_ring_size);
 
         /* If we are coalescing interrupts, update the timer */
@@ -1341,7 +1347,7 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
         else
                 gfar_write(&priv->regs->rxic, 0);
 
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 #endif
 
         return IRQ_HANDLED;
@@ -1490,13 +1496,6 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
         /* Update the current rxbd pointer to be the next one */
         priv->cur_rx = bdp;
 
-        /* If no packets have arrived since the
-         * last one we processed, clear the IEVENT RX and
-         * BSY bits so that another interrupt won't be
-         * generated when we set IMASK */
-        if (bdp->status & RXBD_EMPTY)
-                gfar_write(&priv->regs->ievent, IEVENT_RX_MASK);
-
         return howmany;
 }
 
@@ -1516,7 +1515,7 @@ static int gfar_poll(struct net_device *dev, int *budget)
         rx_work_limit -= howmany;
         *budget -= howmany;
 
-        if (rx_work_limit >= 0) {
+        if (rx_work_limit > 0) {
                 netif_rx_complete(dev);
 
                 /* Clear the halt bit in RSTAT */
@@ -1533,7 +1532,8 @@ static int gfar_poll(struct net_device *dev, int *budget)
                         gfar_write(&priv->regs->rxic, 0);
         }
 
-        return (rx_work_limit < 0) ? 1 : 0;
+        /* Return 1 if there's more work to do */
+        return (rx_work_limit > 0) ? 0 : 1;
 }
 #endif
 
@@ -1629,7 +1629,7 @@ static void adjust_link(struct net_device *dev)
         struct phy_device *phydev = priv->phydev;
         int new_state = 0;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
         if (phydev->link) {
                 u32 tempval = gfar_read(&regs->maccfg2);
                 u32 ecntrl = gfar_read(&regs->ecntrl);
@@ -1694,7 +1694,7 @@ static void adjust_link(struct net_device *dev)
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 }
 
 /* Update the hash table based on the current list of multicast
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index d37d5401be6e..127c98cf3336 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -656,43 +656,62 @@ struct gfar {
  * the buffer descriptor determines the actual condition.
  */
 struct gfar_private {
-        /* pointers to arrays of skbuffs for tx and rx */
+        /* Fields controlled by TX lock */
+        spinlock_t txlock;
+
+        /* Pointer to the array of skbuffs */
         struct sk_buff ** tx_skbuff;
-        struct sk_buff ** rx_skbuff;
 
-        /* indices pointing to the next free sbk in skb arrays */
+        /* next free skb in the array */
         u16 skb_curtx;
-        u16 skb_currx;
 
-        /* index of the first skb which hasn't been transmitted
-         * yet. */
+        /* First skb in line to be transmitted */
         u16 skb_dirtytx;
 
         /* Configuration info for the coalescing features */
         unsigned char txcoalescing;
         unsigned short txcount;
         unsigned short txtime;
+
+        /* Buffer descriptor pointers */
+        struct txbd8 *tx_bd_base;       /* First tx buffer descriptor */
+        struct txbd8 *cur_tx;           /* Next free ring entry */
+        struct txbd8 *dirty_tx;         /* First buffer in line
+                                           to be transmitted */
+        unsigned int tx_ring_size;
+
+        /* RX Locked fields */
+        spinlock_t rxlock;
+
+        /* skb array and index */
+        struct sk_buff ** rx_skbuff;
+        u16 skb_currx;
+
+        /* RX Coalescing values */
         unsigned char rxcoalescing;
         unsigned short rxcount;
         unsigned short rxtime;
 
-        /* GFAR addresses */
-        struct rxbd8 *rx_bd_base;       /* Base addresses of Rx and Tx Buffers */
-        struct txbd8 *tx_bd_base;
+        struct rxbd8 *rx_bd_base;       /* First Rx buffers */
         struct rxbd8 *cur_rx;           /* Next free rx ring entry */
-        struct txbd8 *cur_tx;           /* Next free ring entry */
-        struct txbd8 *dirty_tx;         /* The Ring entry to be freed. */
-        struct gfar __iomem *regs;      /* Pointer to the GFAR memory mapped Registers */
-        u32 __iomem *hash_regs[16];
-        int hash_width;
-        struct net_device_stats stats; /* linux network statistics */
-        struct gfar_extra_stats extra_stats;
-        spinlock_t lock;
+
+        /* RX parameters */
+        unsigned int rx_ring_size;
         unsigned int rx_buffer_size;
         unsigned int rx_stash_size;
         unsigned int rx_stash_index;
-        unsigned int tx_ring_size;
-        unsigned int rx_ring_size;
+
+        struct vlan_group *vlgrp;
+
+        /* Unprotected fields */
+        /* Pointer to the GFAR memory mapped Registers */
+        struct gfar __iomem *regs;
+
+        /* Hash registers and their width */
+        u32 __iomem *hash_regs[16];
+        int hash_width;
+
+        /* global parameters */
         unsigned int fifo_threshold;
         unsigned int fifo_starve;
         unsigned int fifo_starve_off;
@@ -702,13 +721,15 @@ struct gfar_private {
                 extended_hash:1,
                 bd_stash_en:1;
         unsigned short padding;
-        struct vlan_group *vlgrp;
-        /* Info structure initialized by board setup code */
+
         unsigned int interruptTransmit;
         unsigned int interruptReceive;
         unsigned int interruptError;
+
+        /* info structure initialized by platform code */
         struct gianfar_platform_data *einfo;
 
+        /* PHY stuff */
         struct phy_device *phydev;
         struct mii_bus *mii_bus;
         int oldspeed;
@@ -716,6 +737,10 @@ struct gfar_private {
         int oldlink;
 
         uint32_t msg_enable;
+
+        /* Network Statistics */
+        struct net_device_stats stats;
+        struct gfar_extra_stats extra_stats;
 };
 
 static inline u32 gfar_read(volatile unsigned __iomem *addr)
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 5de7b2e259dc..d69698c695ef 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -455,10 +455,14 @@ static int gfar_sringparam(struct net_device *dev, struct ethtool_ringparam *rva
 
                 /* Halt TX and RX, and process the frames which
                  * have already been received */
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock_irqsave(&priv->txlock, flags);
+                spin_lock(&priv->rxlock);
+
                 gfar_halt(dev);
                 gfar_clean_rx_ring(dev, priv->rx_ring_size);
-                spin_unlock_irqrestore(&priv->lock, flags);
+
+                spin_unlock(&priv->rxlock);
+                spin_unlock_irqrestore(&priv->txlock, flags);
 
                 /* Now we take down the rings to rebuild them */
                 stop_gfar(dev);
@@ -488,10 +492,14 @@ static int gfar_set_rx_csum(struct net_device *dev, uint32_t data)
 
                 /* Halt TX and RX, and process the frames which
                  * have already been received */
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock_irqsave(&priv->txlock, flags);
+                spin_lock(&priv->rxlock);
+
                 gfar_halt(dev);
                 gfar_clean_rx_ring(dev, priv->rx_ring_size);
-                spin_unlock_irqrestore(&priv->lock, flags);
+
+                spin_unlock(&priv->rxlock);
+                spin_unlock_irqrestore(&priv->txlock, flags);
 
                 /* Now we take down the rings to rebuild them */
                 stop_gfar(dev);
@@ -523,7 +531,7 @@ static int gfar_set_tx_csum(struct net_device *dev, uint32_t data)
         if (!(priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_CSUM))
                 return -EOPNOTSUPP;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
         gfar_halt(dev);
 
         if (data)
@@ -532,7 +540,7 @@ static int gfar_set_tx_csum(struct net_device *dev, uint32_t data)
                 dev->features &= ~NETIF_F_IP_CSUM;
 
         gfar_start(dev);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return 0;
 }
diff --git a/drivers/net/gianfar_sysfs.c b/drivers/net/gianfar_sysfs.c
index 51ef181b1368..a6d5c43199cb 100644
--- a/drivers/net/gianfar_sysfs.c
+++ b/drivers/net/gianfar_sysfs.c
@@ -82,7 +82,7 @@ static ssize_t gfar_set_bd_stash(struct class_device *cdev,
         else
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         /* Set the new stashing value */
         priv->bd_stash_en = new_setting;
@@ -96,7 +96,7 @@ static ssize_t gfar_set_bd_stash(struct class_device *cdev,
 
         gfar_write(&priv->regs->attr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -118,7 +118,7 @@ static ssize_t gfar_set_rx_stash_size(struct class_device *cdev,
         u32 temp;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
         if (length > priv->rx_buffer_size)
                 return count;
 
@@ -142,7 +142,7 @@ static ssize_t gfar_set_rx_stash_size(struct class_device *cdev,
 
         gfar_write(&priv->regs->attr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -166,7 +166,7 @@ static ssize_t gfar_set_rx_stash_index(struct class_device *cdev,
         u32 temp;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
         if (index > priv->rx_stash_size)
                 return count;
 
@@ -180,7 +180,7 @@ static ssize_t gfar_set_rx_stash_index(struct class_device *cdev,
         temp |= ATTRELI_EI(index);
         gfar_write(&priv->regs->attreli, flags);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -205,7 +205,7 @@ static ssize_t gfar_set_fifo_threshold(struct class_device *cdev,
         if (length > GFAR_MAX_FIFO_THRESHOLD)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_threshold = length;
 
@@ -214,7 +214,7 @@ static ssize_t gfar_set_fifo_threshold(struct class_device *cdev,
         temp |= length;
         gfar_write(&priv->regs->fifo_tx_thr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
@@ -240,7 +240,7 @@ static ssize_t gfar_set_fifo_starve(struct class_device *cdev,
         if (num > GFAR_MAX_FIFO_STARVE)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_starve = num;
 
@@ -249,7 +249,7 @@ static ssize_t gfar_set_fifo_starve(struct class_device *cdev,
         temp |= num;
         gfar_write(&priv->regs->fifo_tx_starve, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
@@ -274,7 +274,7 @@ static ssize_t gfar_set_fifo_starve_off(struct class_device *cdev,
         if (num > GFAR_MAX_FIFO_STARVE_OFF)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_starve_off = num;
 
@@ -283,7 +283,7 @@ static ssize_t gfar_set_fifo_starve_off(struct class_device *cdev,
         temp |= num;
         gfar_write(&priv->regs->fifo_tx_starve_shutoff, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index 08b218c5bfbc..93c494bcd18d 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -226,7 +226,7 @@ struct net_device * __init ne_probe(int unit)
         netdev_boot_setup_check(dev);
 
 #ifdef CONFIG_TOSHIBA_RBTX4938
-        dev->base_addr = 0x07f20280;
+        dev->base_addr = RBTX4938_RTL_8019_BASE;
         dev->irq = RBTX4938_RTL_8019_IRQ;
 #endif
         err = do_ne_probe(dev);
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 506e777c5f06..d090df413049 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1639,6 +1639,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("CONTEC", "C-NET(PC)C-10L", 0x21cab552, 0xf6f90722),
         PCMCIA_DEVICE_PROD_ID12("corega", "FEther PCC-TXF", 0x0a21501a, 0xa51564a2),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-T", 0x5261440f, 0xfa9d85bd),
+        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-TD", 0x5261440f, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("Corega K.K.", "corega EtherII PCC-TD", 0xd4fdcbd8, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega Ether PCC-T", 0x5261440f, 0x6705fcaa),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FastEther PCC-TX", 0x5261440f, 0x485e85d9),
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 67b0eab16589..227df9876a2c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -51,7 +51,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.1"
+#define DRV_VERSION             "1.2"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -925,8 +925,7 @@ static inline struct sk_buff *sky2_alloc_skb(unsigned int size, gfp_t gfp_mask)
         skb = alloc_skb(size + RX_SKB_ALIGN, gfp_mask);
         if (likely(skb)) {
                 unsigned long p = (unsigned long) skb->data;
-                skb_reserve(skb,
-                        ((p + RX_SKB_ALIGN - 1) & ~(RX_SKB_ALIGN - 1)) - p);
+                skb_reserve(skb, ALIGN(p, RX_SKB_ALIGN) - p);
         }
 
         return skb;
@@ -1686,13 +1685,12 @@ static void sky2_tx_timeout(struct net_device *dev)
 }
 
 
-#define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
 /* Want receive buffer size to be multiple of 64 bits
  * and incl room for vlan and truncation
  */
 static inline unsigned sky2_buf_size(int mtu)
 {
-        return roundup(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
+        return ALIGN(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
 }
 
 static int sky2_change_mtu(struct net_device *dev, int new_mtu)
@@ -2086,6 +2084,20 @@ static void sky2_descriptor_error(struct sky2_hw *hw, unsigned port,
         }
 }
 
+/* If idle then force a fake soft NAPI poll once a second
+ * to work around cases where sharing an edge triggered interrupt.
+ */
+static void sky2_idle(unsigned long arg)
+{
+        struct net_device *dev = (struct net_device *) arg;
+
+        local_irq_disable();
+        if (__netif_rx_schedule_prep(dev))
+                __netif_rx_schedule(dev);
+        local_irq_enable();
+}
+
+
 static int sky2_poll(struct net_device *dev0, int *budget)
 {
         struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
@@ -2093,6 +2105,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         int work_done = 0;
         u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
 
+ restart_poll:
         if (unlikely(status & ~Y2_IS_STAT_BMU)) {
                 if (status & Y2_IS_HW_ERR)
                         sky2_hw_intr(hw);
@@ -2123,7 +2136,7 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         }
 
         if (status & Y2_IS_STAT_BMU) {
-                work_done = sky2_status_intr(hw, work_limit);
+                work_done += sky2_status_intr(hw, work_limit - work_done);
                 *budget -= work_done;
                 dev0->quota -= work_done;
 
@@ -2133,9 +2146,24 @@ static int sky2_poll(struct net_device *dev0, int *budget)
                 sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
         }
 
-        netif_rx_complete(dev0);
+        mod_timer(&hw->idle_timer, jiffies + HZ);
+
+        local_irq_disable();
+        __netif_rx_complete(dev0);
 
         status = sky2_read32(hw, B0_Y2_SP_LISR);
+
+        if (unlikely(status)) {
+                /* More work pending, try and keep going */
+                if (__netif_rx_schedule_prep(dev0)) {
+                        __netif_rx_reschedule(dev0, work_done);
+                        status = sky2_read32(hw, B0_Y2_SP_EISR);
+                        local_irq_enable();
+                        goto restart_poll;
+                }
+        }
+
+        local_irq_enable();
         return 0;
 }
 
@@ -2153,8 +2181,6 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
         prefetch(&hw->st_le[hw->st_idx]);
         if (likely(__netif_rx_schedule_prep(dev0)))
                 __netif_rx_schedule(dev0);
-        else
-                printk(KERN_DEBUG PFX "irq race detected\n");
 
         return IRQ_HANDLED;
 }
@@ -2193,7 +2219,7 @@ static inline u32 sky2_clk2us(const struct sky2_hw *hw, u32 clk)
 }
 
 
-static int sky2_reset(struct sky2_hw *hw)
+static int __devinit sky2_reset(struct sky2_hw *hw)
 {
         u16 status;
         u8 t8, pmd_type;
@@ -3276,6 +3302,8 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
 
         sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
 
+        setup_timer(&hw->idle_timer, sky2_idle, (unsigned long) dev);
+
         pci_set_drvdata(pdev, hw);
 
         return 0;
@@ -3311,13 +3339,15 @@ static void __devexit sky2_remove(struct pci_dev *pdev)
         if (!hw)
                 return;
 
+        del_timer_sync(&hw->idle_timer);
+
+        sky2_write32(hw, B0_IMSK, 0);
         dev0 = hw->dev[0];
         dev1 = hw->dev[1];
         if (dev1)
                 unregister_netdev(dev1);
         unregister_netdev(dev0);
 
-        sky2_write32(hw, B0_IMSK, 0);
         sky2_set_power_state(hw, PCI_D3hot);
         sky2_write16(hw, B0_Y2LED, LED_STAT_OFF);
         sky2_write8(hw, B0_CTST, CS_RST_SET);
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 89dd18cd12f0..b026f5653f04 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -1880,6 +1880,8 @@ struct sky2_hw {
         struct sky2_status_le *st_le;
         u32                  st_idx;
         dma_addr_t           st_dma;
+
+        struct timer_list    idle_timer;
         int                  msi_detected;
         wait_queue_head_t    msi_wait;
 };
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index cb0aba95d4e3..046371ee5bbe 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -275,7 +275,7 @@ static int bcm5411_init(struct mii_phy* phy)
         return 0;
 }
 
-static int bcm5411_suspend(struct mii_phy* phy)
+static int generic_suspend(struct mii_phy* phy)
 {
         phy_write(phy, MII_BMCR, BMCR_PDOWN);
 
@@ -738,7 +738,7 @@ static struct mii_phy_def bcm5401_phy_def = {
 /* Broadcom BCM 5411 */
 static struct mii_phy_ops bcm5411_phy_ops = {
         .init           = bcm5411_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -757,7 +757,7 @@ static struct mii_phy_def bcm5411_phy_def = {
 /* Broadcom BCM 5421 */
 static struct mii_phy_ops bcm5421_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -776,7 +776,7 @@ static struct mii_phy_def bcm5421_phy_def = {
 /* Broadcom BCM 5421 built-in K2 */
 static struct mii_phy_ops bcm5421k2_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -795,7 +795,7 @@ static struct mii_phy_def bcm5421k2_phy_def = {
 /* Broadcom BCM 5462 built-in Vesta */
 static struct mii_phy_ops bcm5462V_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -816,6 +816,7 @@ static struct mii_phy_def bcm5462V_phy_def = {
  * would be useful here) --BenH.
  */
 static struct mii_phy_ops marvell_phy_ops = {
+        .suspend        = generic_suspend,
         .setup_aneg     = marvell_setup_aneg,
         .setup_forced   = marvell_setup_forced,
         .poll_link      = genmii_poll_link,
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index bad09ebdb50b..e0874cbfefea 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -6,7 +6,7 @@ menu "Wireless LAN (non-hamradio)"
         depends on NETDEVICES
 
 config NET_RADIO
-        bool "Wireless LAN drivers (non-hamradio)"
+        bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions"
         select WIRELESS_EXT
         ---help---
           Support for wireless LANs and everything having to do with radio,
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 108d9fed8f07..00764ddd74d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -3139,6 +3139,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                 }
                 if ( status & EV_LINK ) {
                         union iwreq_data        wrqu;
+                        int scan_forceloss = 0;
                         /* The link status has changed, if you want to put a
                            monitor hook in, do it here.  (Remember that
                            interrupts are still disabled!)
@@ -3157,7 +3158,8 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                           code) */
 #define AUTHFAIL 0x0300 /* Authentication failure (low byte is reason
                            code) */
-#define ASSOCIATED 0x0400 /* Assocatied */
+#define ASSOCIATED 0x0400 /* Associated */
+#define REASSOCIATED 0x0600 /* Reassociated?  Only on firmware >= 5.30.17 */
 #define RC_RESERVED 0 /* Reserved return code */
 #define RC_NOREASON 1 /* Unspecified reason */
 #define RC_AUTHINV 2 /* Previous authentication invalid */
@@ -3174,44 +3176,30 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                           leaving BSS */
 #define RC_NOAUTH 9 /* Station requesting (Re)Association is not
                        Authenticated with the responding station */
-                        if (newStatus != ASSOCIATED) {
-                                if (auto_wep && !apriv->expires) {
-                                        apriv->expires = RUN_AT(3*HZ);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-                        } else {
-                                struct task_struct *task = apriv->task;
+                        if (newStatus == FORCELOSS && apriv->scan_timeout > 0)
+                                scan_forceloss = 1;
+                        if(newStatus == ASSOCIATED || newStatus == REASSOCIATED) {
                                 if (auto_wep)
                                         apriv->expires = 0;
-                                if (task)
-                                        wake_up_process (task);
+                                if (apriv->task)
+                                        wake_up_process (apriv->task);
                                 set_bit(FLAG_UPDATE_UNI, &apriv->flags);
                                 set_bit(FLAG_UPDATE_MULTI, &apriv->flags);
-                        }
-                        /* Question : is ASSOCIATED the only status
-                         * that is valid ? We want to catch handover
-                         * and reassociations as valid status
-                         * Jean II */
-                        if(newStatus == ASSOCIATED) {
-#if 0
-                                /* FIXME: Grabbing scan results here
-                                 * seems to be too early???  Just wait for
-                                 * timeout instead. */
-                                if (apriv->scan_timeout > 0) {
-                                        set_bit(JOB_SCAN_RESULTS, &apriv->flags);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-#endif
+
                                 if (down_trylock(&apriv->sem) != 0) {
                                         set_bit(JOB_EVENT, &apriv->flags);
                                         wake_up_interruptible(&apriv->thr_wait);
                                 } else
                                         airo_send_event(dev);
-                        } else {
-                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
-                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        } else if (!scan_forceloss) {
+                                if (auto_wep && !apriv->expires) {
+                                        apriv->expires = RUN_AT(3*HZ);
+                                        wake_up_interruptible(&apriv->thr_wait);
+                                }
 
                                 /* Send event to user space */
+                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
+                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
                                 wireless_send_event(dev, SIOCGIWAP, &wrqu,NULL);
                         }
                 }
@@ -7136,10 +7124,10 @@ static int airo_set_scan(struct net_device *dev,
                 goto out;
 
         /* Initiate a scan command */
+        ai->scan_timeout = RUN_AT(3*HZ);
         memset(&cmd, 0, sizeof(cmd));
         cmd.cmd=CMD_LISTBSS;
         issuecommand(ai, &cmd, &rsp);
-        ai->scan_timeout = RUN_AT(3*HZ);
         wake = 1;
 
 out:
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 87afa6878f26..8606c88886fc 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -3463,6 +3463,7 @@ static void atmel_command_irq(struct atmel_private *priv)
         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
         int fast_scan;
+        union iwreq_data wrqu;
 
         if (status == CMD_STATUS_IDLE ||
             status == CMD_STATUS_IN_PROGRESS)
@@ -3487,6 +3488,7 @@ static void atmel_command_irq(struct atmel_private *priv)
                         atmel_scan(priv, 1);
                 } else {
                         int bss_index = retrieve_bss(priv);
+                        int notify_scan_complete = 1;
                         if (bss_index != -1) {
                                 atmel_join_bss(priv, bss_index);
                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
@@ -3495,8 +3497,14 @@ static void atmel_command_irq(struct atmel_private *priv)
                         } else {
                                 priv->fast_scan = !fast_scan;
                                 atmel_scan(priv, 1);
+                                notify_scan_complete = 0;
                         }
                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
+                        if (notify_scan_complete) {
+                                wrqu.data.length = 0;
+                                wrqu.data.flags = 0;
+                                wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
+                        }
                 }
                 break;
 
@@ -3509,6 +3517,9 @@ static void atmel_command_irq(struct atmel_private *priv)
                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
                 if (priv->station_is_associated) {
                         atmel_enter_state(priv, STATION_STATE_READY);
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
                 } else {
                         atmel_scan(priv, 1);
                 }
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 418465600a77..25ea4748f0b9 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -17,8 +17,11 @@ config BCM43XX_DEBUG
 
 config BCM43XX_DMA
         bool
+        depends on BCM43XX
+
 config BCM43XX_PIO
         bool
+        depends on BCM43XX
 
 choice
         prompt "BCM43xx data transfer mode"
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
index dcadd295de4f..2e83083935e1 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -15,7 +15,6 @@
 
 #include "bcm43xx_debugfs.h"
 #include "bcm43xx_leds.h"
-#include "bcm43xx_sysfs.h"
 
 
 #define PFX                             KBUILD_MODNAME ": "
@@ -638,8 +637,6 @@ struct bcm43xx_key {
 };
 
 struct bcm43xx_private {
-        struct bcm43xx_sysfs sysfs;
-
         struct ieee80211_device *ieee;
         struct ieee80211softmac_device *softmac;
 
@@ -772,6 +769,20 @@ struct bcm43xx_private * bcm43xx_priv(struct net_device *dev)
         return ieee80211softmac_priv(dev);
 }
 
+struct device;
+
+static inline
+struct bcm43xx_private * dev_to_bcm(struct device *dev)
+{
+        struct net_device *net_dev;
+        struct bcm43xx_private *bcm;
+
+        net_dev = dev_get_drvdata(dev);
+        bcm = bcm43xx_priv(net_dev);
+
+        return bcm;
+}
+
 
 /* Helper function, which returns a boolean.
  * TRUE, if PIO is used; FALSE, if DMA is used.
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
index d2c3401e9b70..35a4fcb6d923 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
@@ -452,12 +452,12 @@ void bcm43xx_printk_dump(const char *data,
         size_t i;
         char c;
 
-        printk(KERN_INFO PFX "Data dump (%s, %u bytes):",
+        printk(KERN_INFO PFX "Data dump (%s, %zd bytes):",
                description, size);
         for (i = 0; i < size; i++) {
                 c = data[i];
                 if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  0x%02x, ", i, c & 0xff);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  0x%02x, ", i, c & 0xff);
                 else
                         printk("0x%02x, ", c & 0xff);
         }
@@ -472,12 +472,12 @@ void bcm43xx_printk_bitdump(const unsigned char *data,
         int j;
         const unsigned char *d;
 
-        printk(KERN_INFO PFX "*** Bitdump (%s, %u bytes, %s) ***",
+        printk(KERN_INFO PFX "*** Bitdump (%s, %zd bytes, %s) ***",
                description, bytes, msb_to_lsb ? "MSB to LSB" : "LSB to MSB");
         for (i = 0; i < bytes; i++) {
                 d = data + i;
                 if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  ", i);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  ", i);
                 if (msb_to_lsb) {
                         for (j = 7; j >= 0; j--) {
                                 if (*d & (1 << j))
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index c3681b8f09b4..bbecba02e697 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -196,8 +196,9 @@ static int alloc_ringmemory(struct bcm43xx_dmaring *ring)
         }
         if (ring->dmabase + BCM43xx_DMA_RINGMEMSIZE > BCM43xx_DMA_BUSADDRMAX) {
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RINGMEMORY >1G "
-                                    "(0x%08x, len: %lu)\n",
-                       ring->dmabase, BCM43xx_DMA_RINGMEMSIZE);
+                                    "(0x%llx, len: %lu)\n",
+                                (unsigned long long)ring->dmabase,
+                                BCM43xx_DMA_RINGMEMSIZE);
                 dma_free_coherent(dev, BCM43xx_DMA_RINGMEMSIZE,
                                   ring->vbase, ring->dmabase);
                 return -ENOMEM;
@@ -307,8 +308,8 @@ static int setup_rx_descbuffer(struct bcm43xx_dmaring *ring,
                 unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
                 dev_kfree_skb_any(skb);
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
-                       dmaaddr, ring->rx_buffersize);
+                                    "(0x%llx, len: %u)\n",
+                        (unsigned long long)dmaaddr, ring->rx_buffersize);
                 return -ENOMEM;
         }
         meta->skb = skb;
@@ -729,8 +730,8 @@ static int dma_tx_fragment(struct bcm43xx_dmaring *ring,
         if (unlikely(meta->dmaaddr + skb->len > BCM43xx_DMA_BUSADDRMAX)) {
                 return_slot(ring, slot);
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA TX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
-                       meta->dmaaddr, skb->len);
+                                    "(0x%llx, len: %u)\n",
+                        (unsigned long long)meta->dmaaddr, skb->len);
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
index 2d520e4b0276..b7d77638ba8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
@@ -213,6 +213,14 @@ static inline
 void bcm43xx_dma_rx(struct bcm43xx_dmaring *ring)
 {
 }
+static inline
+void bcm43xx_dma_tx_suspend(struct bcm43xx_dmaring *ring)
+{
+}
+static inline
+void bcm43xx_dma_tx_resume(struct bcm43xx_dmaring *ring)
+{
+}
 
 #endif /* CONFIG_BCM43XX_DMA */
 #endif /* BCM43xx_DMA_H_ */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index c37371fc9e01..9a06e61df0a2 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -52,6 +52,7 @@
 #include "bcm43xx_wx.h"
 #include "bcm43xx_ethtool.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_sysfs.h"
 
 
 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
@@ -3522,6 +3523,7 @@ static inline int bcm43xx_tx(struct bcm43xx_private *bcm,
                 err = bcm43xx_pio_tx(bcm, txb);
         else
                 err = bcm43xx_dma_tx(bcm, txb);
+        bcm->net_dev->trans_start = jiffies;
 
         return err;
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index 0a66f43ca0c0..33137165727f 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -2151,6 +2151,7 @@ int bcm43xx_phy_init_tssi2dbm_table(struct bcm43xx_private *bcm)
                                 phy->tssi2dbm = NULL;
                                 printk(KERN_ERR PFX "Could not generate "
                                                     "tssi2dBm table\n");
+                                kfree(dyn_tssi2dbm);
                                 return -ENODEV;
                         }
                 phy->tssi2dbm = dyn_tssi2dbm;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
index c59ddd40680d..0aa1bd269a25 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
@@ -27,6 +27,7 @@
 #include "bcm43xx_pio.h"
 #include "bcm43xx_main.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_power.h"
 
 #include <linux/delay.h>
 
@@ -44,10 +45,10 @@ static void tx_octet(struct bcm43xx_pioqueue *queue,
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   octet);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI);
+                                  BCM43xx_PIO_TXCTL_WRITELO);
         } else {
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI);
+                                  BCM43xx_PIO_TXCTL_WRITELO);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   octet);
         }
@@ -103,7 +104,7 @@ static void tx_complete(struct bcm43xx_pioqueue *queue,
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   skb->data[skb->len - 1]);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI |
+                                  BCM43xx_PIO_TXCTL_WRITELO |
                                   BCM43xx_PIO_TXCTL_COMPLETE);
         } else {
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
@@ -112,9 +113,10 @@ static void tx_complete(struct bcm43xx_pioqueue *queue,
 }
 
 static u16 generate_cookie(struct bcm43xx_pioqueue *queue,
-                           int packetindex)
+                           struct bcm43xx_pio_txpacket *packet)
 {
         u16 cookie = 0x0000;
+        int packetindex;
 
         /* We use the upper 4 bits for the PIO
          * controller ID and the lower 12 bits
@@ -135,6 +137,7 @@ static u16 generate_cookie(struct bcm43xx_pioqueue *queue,
         default:
                 assert(0);
         }
+        packetindex = pio_txpacket_getindex(packet);
         assert(((u16)packetindex & 0xF000) == 0x0000);
         cookie |= (u16)packetindex;
 
@@ -184,7 +187,7 @@ static void pio_tx_write_fragment(struct bcm43xx_pioqueue *queue,
         bcm43xx_generate_txhdr(queue->bcm,
                                &txhdr, skb->data, skb->len,
                                (packet->xmitted_frags == 0),
-                               generate_cookie(queue, pio_txpacket_getindex(packet)));
+                               generate_cookie(queue, packet));
 
         tx_start(queue);
         octets = skb->len + sizeof(txhdr);
@@ -241,7 +244,7 @@ static int pio_tx_packet(struct bcm43xx_pio_txpacket *packet)
                 queue->tx_devq_packets++;
                 queue->tx_devq_used += octets;
 
-                assert(packet->xmitted_frags <= packet->txb->nr_frags);
+                assert(packet->xmitted_frags < packet->txb->nr_frags);
                 packet->xmitted_frags++;
                 packet->xmitted_octets += octets;
         }
@@ -257,8 +260,14 @@ static void tx_tasklet(unsigned long d)
         unsigned long flags;
         struct bcm43xx_pio_txpacket *packet, *tmp_packet;
         int err;
+        u16 txctl;
 
         bcm43xx_lock_mmio(bcm, flags);
+
+        txctl = bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL);
+        if (txctl & BCM43xx_PIO_TXCTL_SUSPEND)
+                goto out_unlock;
+
         list_for_each_entry_safe(packet, tmp_packet, &queue->txqueue, list) {
                 assert(packet->xmitted_frags < packet->txb->nr_frags);
                 if (packet->xmitted_frags == 0) {
@@ -288,6 +297,7 @@ static void tx_tasklet(unsigned long d)
         next_packet:
                 continue;
         }
+out_unlock:
         bcm43xx_unlock_mmio(bcm, flags);
 }
 
@@ -330,12 +340,19 @@ struct bcm43xx_pioqueue * bcm43xx_setup_pioqueue(struct bcm43xx_private *bcm,
                      (unsigned long)queue);
 
         value = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-        value |= BCM43xx_SBF_XFER_REG_BYTESWAP;
+        value &= ~BCM43xx_SBF_XFER_REG_BYTESWAP;
         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value);
 
         qsize = bcm43xx_read16(bcm, queue->mmio_base + BCM43xx_PIO_TXQBUFSIZE);
+        if (qsize == 0) {
+                printk(KERN_ERR PFX "ERROR: This card does not support PIO "
+                                    "operation mode. Please use DMA mode "
+                                    "(module parameter pio=0).\n");
+                goto err_freequeue;
+        }
         if (qsize <= BCM43xx_PIO_TXQADJUST) {
-                printk(KERN_ERR PFX "PIO tx device-queue too small (%u)\n", qsize);
+                printk(KERN_ERR PFX "PIO tx device-queue too small (%u)\n",
+                       qsize);
                 goto err_freequeue;
         }
         qsize -= BCM43xx_PIO_TXQADJUST;
@@ -444,15 +461,10 @@ int bcm43xx_pio_tx(struct bcm43xx_private *bcm,
 {
         struct bcm43xx_pioqueue *queue = bcm43xx_current_pio(bcm)->queue1;
         struct bcm43xx_pio_txpacket *packet;
-        u16 tmp;
 
         assert(!queue->tx_suspended);
         assert(!list_empty(&queue->txfree));
 
-        tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL);
-        if (tmp & BCM43xx_PIO_TXCTL_SUSPEND)
-                return -EBUSY;
-
         packet = list_entry(queue->txfree.next, struct bcm43xx_pio_txpacket, list);
         packet->txb = txb;
         packet->xmitted_frags = 0;
@@ -462,7 +474,7 @@ int bcm43xx_pio_tx(struct bcm43xx_private *bcm,
         assert(queue->nr_txfree < BCM43xx_PIO_MAXTXPACKETS);
 
         /* Suspend TX, if we are out of packets in the "free" queue. */
-        if (unlikely(list_empty(&queue->txfree))) {
+        if (list_empty(&queue->txfree)) {
                 netif_stop_queue(queue->bcm->net_dev);
                 queue->tx_suspended = 1;
         }
@@ -480,15 +492,15 @@ void bcm43xx_pio_handle_xmitstatus(struct bcm43xx_private *bcm,
 
         queue = parse_cookie(bcm, status->cookie, &packet);
         assert(queue);
-//TODO
-if (!queue)
-return;
+
         free_txpacket(packet, 1);
-        if (unlikely(queue->tx_suspended)) {
+        if (queue->tx_suspended) {
                 queue->tx_suspended = 0;
                 netif_wake_queue(queue->bcm->net_dev);
         }
-        /* If there are packets on the txqueue, poke the tasklet. */
+        /* If there are packets on the txqueue, poke the tasklet
+         * to transmit them.
+         */
         if (!list_empty(&queue->txqueue))
                 tasklet_schedule(&queue->txtask);
 }
@@ -519,12 +531,9 @@ void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue)
         int i, preamble_readwords;
         struct sk_buff *skb;
 
-return;
         tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXCTL);
-        if (!(tmp & BCM43xx_PIO_RXCTL_DATAAVAILABLE)) {
-                dprintkl(KERN_ERR PFX "PIO RX: No data available\n");//TODO: remove this printk.
+        if (!(tmp & BCM43xx_PIO_RXCTL_DATAAVAILABLE))
                 return;
-        }
         bcm43xx_pio_write(queue, BCM43xx_PIO_RXCTL,
                           BCM43xx_PIO_RXCTL_DATAAVAILABLE);
 
@@ -538,8 +547,7 @@ return;
         return;
 data_ready:
 
-//FIXME: endianess in this function.
-        len = le16_to_cpu(bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA));
+        len = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
         if (unlikely(len > 0x700)) {
                 pio_rx_error(queue, 0, "len > 0x700");
                 return;
@@ -555,7 +563,7 @@ data_ready:
                 preamble_readwords = 18 / sizeof(u16);
         for (i = 0; i < preamble_readwords; i++) {
                 tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
-                preamble[i + 1] = cpu_to_be16(tmp);//FIXME?
+                preamble[i + 1] = cpu_to_le16(tmp);
         }
         rxhdr = (struct bcm43xx_rxhdr *)preamble;
         rxflags2 = le16_to_cpu(rxhdr->flags2);
@@ -591,16 +599,40 @@ data_ready:
         }
         skb_put(skb, len);
         for (i = 0; i < len - 1; i += 2) {
-                tmp = cpu_to_be16(bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA));
-                *((u16 *)(skb->data + i)) = tmp;
+                tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
+                *((u16 *)(skb->data + i)) = cpu_to_le16(tmp);
         }
         if (len % 2) {
                 tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
                 skb->data[len - 1] = (tmp & 0x00FF);
+/* The specs say the following is required, but
+ * it is wrong and corrupts the PLCP. If we don't do
+ * this, the PLCP seems to be correct. So ifdef it out for now.
+ */
+#if 0
                 if (rxflags2 & BCM43xx_RXHDR_FLAGS2_TYPE2FRAME)
-                        skb->data[0x20] = (tmp & 0xFF00) >> 8;
+                        skb->data[2] = (tmp & 0xFF00) >> 8;
                 else
-                        skb->data[0x1E] = (tmp & 0xFF00) >> 8;
+                        skb->data[0] = (tmp & 0xFF00) >> 8;
+#endif
         }
+        skb_trim(skb, len - IEEE80211_FCS_LEN);
         bcm43xx_rx(queue->bcm, skb, rxhdr);
 }
+
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue)
+{
+        bcm43xx_power_saving_ctl_bits(queue->bcm, -1, 1);
+        bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
+                          bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL)
+                          | BCM43xx_PIO_TXCTL_SUSPEND);
+}
+
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue)
+{
+        bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
+                          bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL)
+                          & ~BCM43xx_PIO_TXCTL_SUSPEND);
+        bcm43xx_power_saving_ctl_bits(queue->bcm, -1, -1);
+        tasklet_schedule(&queue->txtask);
+}
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.h b/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
index 970627bc1769..dfc78209e3a3 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
@@ -14,8 +14,8 @@
 #define BCM43xx_PIO_RXCTL               0x08
 #define BCM43xx_PIO_RXDATA              0x0A
 
-#define BCM43xx_PIO_TXCTL_WRITEHI       (1 << 0)
-#define BCM43xx_PIO_TXCTL_WRITELO       (1 << 1)
+#define BCM43xx_PIO_TXCTL_WRITELO       (1 << 0)
+#define BCM43xx_PIO_TXCTL_WRITEHI       (1 << 1)
 #define BCM43xx_PIO_TXCTL_COMPLETE      (1 << 2)
 #define BCM43xx_PIO_TXCTL_INIT          (1 << 3)
 #define BCM43xx_PIO_TXCTL_SUSPEND       (1 << 7)
@@ -95,6 +95,7 @@ void bcm43xx_pio_write(struct bcm43xx_pioqueue *queue,
                        u16 offset, u16 value)
 {
         bcm43xx_write16(queue->bcm, queue->mmio_base + offset, value);
+        mmiowb();
 }
 
 
@@ -107,6 +108,9 @@ void bcm43xx_pio_handle_xmitstatus(struct bcm43xx_private *bcm,
                                    struct bcm43xx_xmitstatus *status);
 void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue);
 
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue);
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue);
+
 #else /* CONFIG_BCM43XX_PIO */
 
 static inline
@@ -133,6 +137,14 @@ static inline
 void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue)
 {
 }
+static inline
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue)
+{
+}
+static inline
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue)
+{
+}
 
 #endif /* CONFIG_BCM43XX_PIO */
 #endif /* BCM43xx_PIO_H_ */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.c b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
index 3c92b62807c5..6569da3a7a39 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
@@ -35,77 +35,101 @@
 #include "bcm43xx_main.h"
 
 
+/* Get the Slow Clock Source */
+static int bcm43xx_pctl_get_slowclksrc(struct bcm43xx_private *bcm)
+{
+        u32 tmp;
+        int err;
+
+        assert(bcm->current_core == &bcm->core_chipcommon);
+        if (bcm->current_core->rev < 6) {
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCMCIA ||
+                    bcm->bustype == BCM43xx_BUSTYPE_SB)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCI) {
+                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
+                        assert(!err);
+                        if (tmp & 0x10)
+                                return BCM43xx_PCTL_CLKSRC_PCI;
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                }
+        }
+        if (bcm->current_core->rev < 10) {
+                tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
+                tmp &= 0x7;
+                if (tmp == 0)
+                        return BCM43xx_PCTL_CLKSRC_LOPWROS;
+                if (tmp == 1)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (tmp == 2)
+                        return BCM43xx_PCTL_CLKSRC_PCI;
+        }
+
+        return BCM43xx_PCTL_CLKSRC_XTALOS;
+}
+
 /* Get max/min slowclock frequency
  * as described in http://bcm-specs.sipsolutions.net/PowerControl
  */
 static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                                        int get_max)
 {
-        int limit = 0;
+        int limit;
+        int clocksrc;
         int divisor;
-        int selection;
-        int err;
         u32 tmp;
-        struct bcm43xx_coreinfo *old_core;
 
-        if (!(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL))
-                goto out;
-        old_core = bcm->current_core;
-        err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
-        if (err)
-                goto out;
+        assert(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL);
+        assert(bcm->current_core == &bcm->core_chipcommon);
 
+        clocksrc = bcm43xx_pctl_get_slowclksrc(bcm);
         if (bcm->current_core->rev < 6) {
-                if ((bcm->bustype == BCM43xx_BUSTYPE_PCMCIA) ||
-                        (bcm->bustype == BCM43xx_BUSTYPE_SB)) {
-                        selection = 1;
+                switch (clocksrc) {
+                case BCM43xx_PCTL_CLKSRC_PCI:
+                        divisor = 64;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
                         divisor = 32;
-                } else {
-                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
-                        if (err) {
-                                printk(KERN_ERR PFX "clockfreqlimit pcicfg read failure\n");
-                                goto out_switchback;
-                        }
-                        if (tmp & 0x10) {
-                                /* PCI */
-                                selection = 2;
-                                divisor = 64;
-                        } else {
-                                /* XTAL */
-                                selection = 1;
-                                divisor = 32;
-                        }
+                        break;
+                default:
+                        assert(0);
+                        divisor = 1;
                 }
         } else if (bcm->current_core->rev < 10) {
-                selection = (tmp & 0x07);
-                if (selection) {
+                switch (clocksrc) {
+                case BCM43xx_PCTL_CLKSRC_LOPWROS:
+                        divisor = 1;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
+                case BCM43xx_PCTL_CLKSRC_PCI:
                         tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
-                        divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
-                } else
+                        divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
+                        divisor *= 4;
+                        break;
+                default:
+                        assert(0);
                         divisor = 1;
+                }
         } else {
                 tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SYSCLKCTL);
-                divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
-                selection = 1;
+                divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
+                divisor *= 4;
         }
-        
-        switch (selection) {
-        case 0:
-                /* LPO */
+
+        switch (clocksrc) {
+        case BCM43xx_PCTL_CLKSRC_LOPWROS:
                 if (get_max)
                         limit = 43000;
                 else
                         limit = 25000;
                 break;
-        case 1:
-                /* XTAL */
+        case BCM43xx_PCTL_CLKSRC_XTALOS:
                 if (get_max)
                         limit = 20200000;
                 else
                         limit = 19800000;
                 break;
-        case 2:
-                /* PCI */
+        case BCM43xx_PCTL_CLKSRC_PCI:
                 if (get_max)
                         limit = 34000000;
                 else
@@ -113,17 +137,14 @@ static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                 break;
         default:
                 assert(0);
+                limit = 0;
         }
         limit /= divisor;
 
-out_switchback:
-        err = bcm43xx_switch_core(bcm, old_core);
-        assert(err == 0);
-
-out:
         return limit;
 }
 
+
 /* init power control
  * as described in http://bcm-specs.sipsolutions.net/PowerControl
  */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.h b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
index 5f63640810bd..c966ab3a5a8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
@@ -33,6 +33,15 @@
 
 #include <linux/types.h>
 
+/* Clock sources */
+enum {
+        /* PCI clock */
+        BCM43xx_PCTL_CLKSRC_PCI,
+        /* Crystal slow clock oscillator */
+        BCM43xx_PCTL_CLKSRC_XTALOS,
+        /* Low power oscillator */
+        BCM43xx_PCTL_CLKSRC_LOPWROS,
+};
 
 struct bcm43xx_private;
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
index c44d890b949b..b438f48e891d 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
@@ -71,14 +71,46 @@ static int get_boolean(const char *buf, size_t count)
         return -EINVAL;
 }
 
+static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len)
+{
+        int i, pos = 0;
+
+        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
+                pos += snprintf(buf + pos, buf_len - pos - 1,
+                                "%04X", swab16(sprom[i]) & 0xFFFF);
+        }
+        pos += snprintf(buf + pos, buf_len - pos - 1, "\n");
+
+        return pos + 1;
+}
+
+static int hex2sprom(u16 *sprom, const char *dump, size_t len)
+{
+        char tmp[5] = { 0 };
+        int cnt = 0;
+        unsigned long parsed;
+
+        if (len < BCM43xx_SPROM_SIZE * sizeof(u16) * 2)
+                return -EINVAL;
+
+        while (cnt < BCM43xx_SPROM_SIZE) {
+                memcpy(tmp, dump, 4);
+                dump += 4;
+                parsed = simple_strtoul(tmp, NULL, 16);
+                sprom[cnt++] = swab16((u16)parsed);
+        }
+
+        return 0;
+}
+
 static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
                                        struct device_attribute *attr,
                                        char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         u16 *sprom;
         unsigned long flags;
-        int i, err;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
@@ -91,55 +123,53 @@ static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
         bcm43xx_lock_mmio(bcm, flags);
         assert(bcm->initialized);
         err = bcm43xx_sprom_read(bcm, sprom);
-        if (!err) {
-                for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
-                        buf[i * 2] = sprom[i] & 0x00FF;
-                        buf[i * 2 + 1] = (sprom[i] & 0xFF00) >> 8;
-                }
-        }
+        if (!err)
+                err = sprom2hex(sprom, buf, PAGE_SIZE);
         bcm43xx_unlock_mmio(bcm, flags);
         kfree(sprom);
 
-        return err ? err : BCM43xx_SPROM_SIZE * sizeof(u16);
+        return err;
 }
 
 static ssize_t bcm43xx_attr_sprom_store(struct device *dev,
                                         struct device_attribute *attr,
                                         const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         u16 *sprom;
         unsigned long flags;
-        int i, err;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (count != BCM43xx_SPROM_SIZE * sizeof(u16))
-                return -EINVAL;
         sprom = kmalloc(BCM43xx_SPROM_SIZE * sizeof(*sprom),
                         GFP_KERNEL);
         if (!sprom)
                 return -ENOMEM;
-        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
-                sprom[i] = buf[i * 2] & 0xFF;
-                sprom[i] |= ((u16)(buf[i * 2 + 1] & 0xFF)) << 8;
-        }
+        err = hex2sprom(sprom, buf, count);
+        if (err)
+                goto out_kfree;
         bcm43xx_lock_mmio(bcm, flags);
         assert(bcm->initialized);
         err = bcm43xx_sprom_write(bcm, sprom);
         bcm43xx_unlock_mmio(bcm, flags);
+out_kfree:
         kfree(sprom);
 
         return err ? err : count;
 
 }
 
+static DEVICE_ATTR(sprom, 0600,
+                   bcm43xx_attr_sprom_show,
+                   bcm43xx_attr_sprom_store);
+
 static ssize_t bcm43xx_attr_interfmode_show(struct device *dev,
                                             struct device_attribute *attr,
                                             char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         ssize_t count = 0;
@@ -175,7 +205,7 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
                                              struct device_attribute *attr,
                                              const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         int mode;
@@ -215,11 +245,15 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
         return err ? err : count;
 }
 
+static DEVICE_ATTR(interference, 0644,
+                   bcm43xx_attr_interfmode_show,
+                   bcm43xx_attr_interfmode_store);
+
 static ssize_t bcm43xx_attr_preamble_show(struct device *dev,
                                           struct device_attribute *attr,
                                           char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         ssize_t count;
@@ -245,7 +279,7 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
                                            struct device_attribute *attr,
                                            const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         int value;
@@ -267,56 +301,41 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
         return err ? err : count;
 }
 
+static DEVICE_ATTR(shortpreamble, 0644,
+                   bcm43xx_attr_preamble_show,
+                   bcm43xx_attr_preamble_store);
+
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm)
 {
         struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
         int err;
 
         assert(bcm->initialized);
 
-        sysfs->attr_sprom.attr.name = "sprom";
-        sysfs->attr_sprom.attr.owner = THIS_MODULE;
-        sysfs->attr_sprom.attr.mode = 0600;
-        sysfs->attr_sprom.show = bcm43xx_attr_sprom_show;
-        sysfs->attr_sprom.store = bcm43xx_attr_sprom_store;
-        err = device_create_file(dev, &sysfs->attr_sprom);
+        err = device_create_file(dev, &dev_attr_sprom);
         if (err)
                 goto out;
-
-        sysfs->attr_interfmode.attr.name = "interference";
-        sysfs->attr_interfmode.attr.owner = THIS_MODULE;
-        sysfs->attr_interfmode.attr.mode = 0600;
-        sysfs->attr_interfmode.show = bcm43xx_attr_interfmode_show;
-        sysfs->attr_interfmode.store = bcm43xx_attr_interfmode_store;
-        err = device_create_file(dev, &sysfs->attr_interfmode);
+        err = device_create_file(dev, &dev_attr_interference);
         if (err)
                 goto err_remove_sprom;
-
-        sysfs->attr_preamble.attr.name = "shortpreamble";
-        sysfs->attr_preamble.attr.owner = THIS_MODULE;
-        sysfs->attr_preamble.attr.mode = 0600;
-        sysfs->attr_preamble.show = bcm43xx_attr_preamble_show;
-        sysfs->attr_preamble.store = bcm43xx_attr_preamble_store;
-        err = device_create_file(dev, &sysfs->attr_preamble);
+        err = device_create_file(dev, &dev_attr_shortpreamble);
         if (err)
                 goto err_remove_interfmode;
 
 out:
         return err;
 err_remove_interfmode:
-        device_remove_file(dev, &sysfs->attr_interfmode);
+        device_remove_file(dev, &dev_attr_interference);
 err_remove_sprom:
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_sprom);
         goto out;
 }
 
 void bcm43xx_sysfs_unregister(struct bcm43xx_private *bcm)
 {
         struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
 
-        device_remove_file(dev, &sysfs->attr_preamble);
-        device_remove_file(dev, &sysfs->attr_interfmode);
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_shortpreamble);
+        device_remove_file(dev, &dev_attr_interference);
+        device_remove_file(dev, &dev_attr_sprom);
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
index 57f14514e3e0..cc701df71e2a 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
@@ -1,22 +1,6 @@
 #ifndef BCM43xx_SYSFS_H_
 #define BCM43xx_SYSFS_H_
 
-#include <linux/device.h>
-
-
-struct bcm43xx_sysfs {
-        struct device_attribute attr_sprom;
-        struct device_attribute attr_interfmode;
-        struct device_attribute attr_preamble;
-};
-
-#define devattr_to_bcm(attr, attr_name) ({                              \
-        struct bcm43xx_sysfs *__s; struct bcm43xx_private *__p;         \
-        __s = container_of((attr), struct bcm43xx_sysfs, attr_name);    \
-        __p = container_of(__s, struct bcm43xx_private, sysfs);         \
-        __p;                                                            \
-                                        })
-
 struct bcm43xx_private;
 
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 3daee828ef4b..3edbb481a0a0 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -962,22 +962,22 @@ static const struct iw_priv_args bcm43xx_priv_wx_args[] = {
         {
                 .cmd            = PRIV_WX_SET_SHORTPREAMBLE,
                 .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_shortpreambl",
+                .name           = "set_shortpreamb",
         },
         {
                 .cmd            = PRIV_WX_GET_SHORTPREAMBLE,
                 .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_shortpreambl",
+                .name           = "get_shortpreamb",
         },
         {
                 .cmd            = PRIV_WX_SET_SWENCRYPTION,
                 .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_swencryption",
+                .name           = "set_swencrypt",
         },
         {
                 .cmd            = PRIV_WX_GET_SWENCRYPTION,
                 .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_swencryption",
+                .name           = "get_swencrypt",
         },
         {
                 .cmd            = PRIV_WX_SPROM_WRITE,
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 8b37e824dfcb..8399de581893 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -1860,7 +1860,7 @@ static char * __prism2_translate_scan(local_info_t *local,
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         if (scan) {
-                chan = scan->chid;
+                chan = le16_to_cpu(scan->chid);
         } else if (bss) {
                 chan = bss->chan;
         } else {
@@ -1868,7 +1868,7 @@ static char * __prism2_translate_scan(local_info_t *local,
         }
 
         if (chan > 0) {
-                iwe.u.freq.m = freq_list[le16_to_cpu(chan - 1)] * 100000;
+                iwe.u.freq.m = freq_list[chan - 1] * 100000;
                 iwe.u.freq.e = 1;
                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                                   IW_EV_FREQ_LEN);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 8dfdfbd5966c..06523e2a8471 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -390,7 +390,7 @@ static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
                 }
         } else {
                 struct {
-                        __le16 qual, signal, noise;
+                        __le16 qual, signal, noise, unused;
                 } __attribute__ ((packed)) cq;
 
                 err = HERMES_READ_RECORD(hw, USER_BAP,
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 4e53be9c03ab..bbeabe3fc4c6 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -535,7 +535,7 @@ pdcs_auto_read(struct subsystem *entry, char *buf, int knob)
 {
         char *out = buf;
         struct pdcspath_entry *pathentry;
-        
+
         if (!entry || !buf)
                 return -EINVAL;
 
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 42b32ff2fca6..278f325021ee 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -178,6 +178,11 @@ extern struct proc_dir_entry * proc_mckinley_root;
 #define ROPE6_CTL       0x230
 #define ROPE7_CTL       0x238
 
+#define IOC_ROPE0_CFG   0x500   /* pluto only */
+#define   IOC_ROPE_AO     0x10  /* Allow "Relaxed Ordering" */
+
+
+
 #define HF_ENABLE       0x40
 
 
@@ -1759,19 +1764,33 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,
 
         sba_dev->num_ioc = num_ioc;
         for (i = 0; i < num_ioc; i++) {
-                /*
-                ** Make sure the box crashes if we get any errors on a rope.
-                */
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE0_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE1_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE2_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE3_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE4_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE5_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE6_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
-
-                /* flush out the writes */
+                unsigned long ioc_hpa = sba_dev->ioc[i].ioc_hpa;
+                unsigned int j;
+
+                for (j=0; j < sizeof(u64) * ROPES_PER_IOC; j+=sizeof(u64)) {
+
+                        /*
+                         * Clear ROPE(N)_CONFIG AO bit.
+                         * Disables "NT Ordering" (~= !"Relaxed Ordering")
+                         * Overrides bit 1 in DMA Hint Sets.
+                         * Improves netperf UDP_STREAM by ~10% for bcm5701.
+                         */
+                        if (IS_PLUTO(sba_dev->iodc)) {
+                                unsigned long rope_cfg, cfg_val;
+
+                                rope_cfg = ioc_hpa + IOC_ROPE0_CFG + j;
+                                cfg_val = READ_REG(rope_cfg);
+                                cfg_val &= ~IOC_ROPE_AO;
+                                WRITE_REG(cfg_val, rope_cfg);
+                        }
+
+                        /*
+                        ** Make sure the box crashes on rope errors.
+                        */
+                        WRITE_REG(HF_ENABLE, ioc_hpa + ROPE0_CTL + j);
+                }
+
+                /* flush out the last writes */
                 READ_REG(sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
 
                 DBG_INIT("      ioc[%d] ROPE_CFG 0x%Lx  ROPE_DBG 0x%Lx\n",
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index 719b863bc20e..828eb45062de 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -155,7 +155,7 @@ superio_init(struct pci_dev *pcidev)
         struct pci_dev *pdev = sio->lio_pdev;
         u16 word;
 
-        if (sio->suckyio_irq_enabled)                                       
+        if (sio->suckyio_irq_enabled)
                 return;
 
         BUG_ON(!pdev);
@@ -194,7 +194,7 @@ superio_init(struct pci_dev *pcidev)
         request_region (sio->acpi_base, 0x1f, "acpi");
 
         /* Enable the legacy I/O function */
-        pci_read_config_word (pdev, PCI_COMMAND, &word);
+        pci_read_config_word (pdev, PCI_COMMAND, &word);
         word |= PCI_COMMAND_SERR | PCI_COMMAND_PARITY | PCI_COMMAND_IO;
         pci_write_config_word (pdev, PCI_COMMAND, word);
 
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index cba6c9eef28e..61cb4b29f55c 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -250,7 +250,7 @@ config M32R_CFC_NUM
 
 config PCMCIA_VRC4171
         tristate "NEC VRC4171 Card Controllers support"
-        depends on VRC4171 && PCMCIA
+        depends on CPU_VR41XX && ISA && PCMCIA
 
 config PCMCIA_VRC4173
         tristate "NEC VRC4173 CARDU support"
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index ae10d1eed65e..48d3b3d30c21 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -236,11 +236,11 @@ static void pcmcia_check_driver(struct pcmcia_driver *p_drv)
 /**
  * pcmcia_load_firmware - load CIS from userspace if device-provided is broken
  * @dev - the pcmcia device which needs a CIS override
- * @filename - requested filename in /lib/firmware/cis/
+ * @filename - requested filename in /lib/firmware/
  *
  * This uses the in-kernel firmware loading mechanism to use a "fake CIS" if
  * the one provided by the card is broken. The firmware files reside in
- * /lib/firmware/cis/ in userspace.
+ * /lib/firmware/ in userspace.
  */
 static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
 {
@@ -298,9 +298,6 @@ static inline int pcmcia_load_firmware(struct pcmcia_device *dev, char * filenam
  *
  * Registers a PCMCIA driver with the PCMCIA bus core.
  */
-static int pcmcia_device_probe(struct device *dev);
-static int pcmcia_device_remove(struct device * dev);
-
 int pcmcia_register_driver(struct pcmcia_driver *driver)
 {
         if (!driver)
@@ -400,7 +397,7 @@ static int pcmcia_device_probe(struct device * dev)
          * call which will then check whether there are two
          * pseudo devices, and if not, add the second one.
          */
-        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        did = p_dev->dev.driver_data;
         if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
                 pcmcia_add_pseudo_device(p_dev->socket);
@@ -448,7 +445,6 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
         return;
 }
 
-
 static int pcmcia_device_remove(struct device * dev)
 {
         struct pcmcia_device *p_dev;
@@ -463,7 +459,7 @@ static int pcmcia_device_remove(struct device * dev)
          * pseudo multi-function card, we need to unbind
          * all devices
          */
-        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        did = p_dev->dev.driver_data;
         if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count != 0) &&
             (p_dev->device_no == 0))
@@ -476,6 +472,8 @@ static int pcmcia_device_remove(struct device * dev)
         if (p_drv->remove)
                 p_drv->remove(p_dev);
 
+        p_dev->dev_node = NULL;
+
         /* check for proper unloading */
         if (p_dev->_irq || p_dev->_io || p_dev->_locked)
                 printk(KERN_INFO "pcmcia: driver %s did not release config properly\n",
@@ -628,7 +626,7 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
                 }
 
         /* Add to the list in pcmcia_bus_socket */
-        list_add_tail(&p_dev->socket_device_list, &s->devices_list);
+        list_add(&p_dev->socket_device_list, &s->devices_list);
 
         spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 45063b4e5b78..3131bb0a0095 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -88,7 +88,6 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr, ioaddr_t *base,
         }
         if ((s->features & SS_CAP_STATIC_MAP) && s->io_offset) {
                 *base = s->io_offset | (*base & 0x0fff);
-                s->io[0].res->flags = (s->io[0].res->flags & ~IORESOURCE_BITS) | (attr & IORESOURCE_BITS);
                 return 0;
         }
         /* Check for an already-allocated window that must conflict with
@@ -209,7 +208,6 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
 
-        config->Function = p_dev->func;
 
 #ifdef CONFIG_CARDBUS
         if (s->state & SOCKET_CARDBUS) {
@@ -223,14 +221,22 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
                         config->AssignedIRQ = s->irq.AssignedIRQ;
                         if (config->AssignedIRQ)
                                 config->Attributes |= CONF_ENABLE_IRQ;
-                        config->BasePort1 = s->io[0].res->start;
-                        config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
+                        if (s->io[0].res) {
+                                config->BasePort1 = s->io[0].res->start;
+                                config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
+                        }
                 }
                 return CS_SUCCESS;
         }
 #endif
 
-        c = (p_dev) ? p_dev->function_config : NULL;
+        if (p_dev) {
+                c = p_dev->function_config;
+                config->Function = p_dev->func;
+        } else {
+                c = NULL;
+                config->Function = 0;
+        }
 
         if ((c == NULL) || !(c->state & CONFIG_LOCKED)) {
                 config->Attributes = 0;
@@ -947,7 +953,5 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev) {
         pcmcia_release_irq(p_dev, &p_dev->irq);
         if (&p_dev->win)
                 pcmcia_release_window(p_dev->win);
-
-        p_dev->dev_node = NULL;
 }
 EXPORT_SYMBOL(pcmcia_disable_device);
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 42b457030b03..0eb010a3f5bc 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1614,6 +1614,7 @@ static int activate_ep_files (struct dev_data *dev)
                                 data, &ep_config_operations,
                                 &data->dentry);
                 if (!data->inode) {
+                        usb_ep_free_request(ep, data->req);
                         kfree (data);
                         goto enomem;
                 }
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 8a2de038882e..1a27ecb46c9a 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,7 +1,11 @@
 Version 1.42
 ------------
 Fix slow oplock break when mounted to different servers at the same time and
-the tids match and we try to find matching fid on wrong server.
+the tids match and we try to find matching fid on wrong server. Fix read
+looping when signing required by server (2.6.16 kernel only). Fix readdir
+vs. rename race which could cause each to hang. Return . and .. even
+if server does not.  Allow searches to skip first three entries and
+begin at any location. Fix oops in find_writeable_file.
 
 Version 1.41
 ------------
diff --git a/fs/cifs/README b/fs/cifs/README
index b2b4d0803761..0355003f4f0a 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -511,6 +511,14 @@ LinuxExtensionsEnabled	If set to one then the client will attempt to
                         support and want to map the uid and gid fields 
                         to values supplied at mount (rather than the 
                         actual values, then set this to zero. (default 1)
+Experimental            When set to 1 used to enable certain experimental
+                        features (currently enables multipage writes
+                        when signing is enabled, the multipage write
+                        performance enhancement was disabled when
+                        signing turned on in case buffer was modified
+                        just before it was sent, also this flag will
+                        be used to use the new experimental sessionsetup
+                        code).
 
 These experimental features and tracing can be enabled by changing flags in 
 /proc/fs/cifs (after the cifs module has been installed or built into the 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index d4b713e5affb..c262d8874ce9 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -33,6 +33,7 @@
 #include <linux/vfs.h>
 #include <linux/mempool.h>
 #include <linux/delay.h>
+#include <linux/kthread.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
 #define DECLARE_GLOBALS_HERE
@@ -75,9 +76,6 @@ unsigned int cifs_max_pending = CIFS_MAX_REQ;
 module_param(cifs_max_pending, int, 0);
 MODULE_PARM_DESC(cifs_max_pending,"Simultaneous requests to server. Default: 50 Range: 2 to 256");
 
-static DECLARE_COMPLETION(cifs_oplock_exited);
-static DECLARE_COMPLETION(cifs_dnotify_exited);
-
 extern mempool_t *cifs_sm_req_poolp;
 extern mempool_t *cifs_req_poolp;
 extern mempool_t *cifs_mid_poolp;
@@ -841,10 +839,6 @@ static int cifs_oplock_thread(void * dummyarg)
         __u16  netfid;
         int rc;
 
-        daemonize("cifsoplockd");
-        allow_signal(SIGTERM);
-
-        oplockThread = current;
         do {
                 if (try_to_freeze()) 
                         continue;
@@ -900,9 +894,9 @@ static int cifs_oplock_thread(void * dummyarg)
                         set_current_state(TASK_INTERRUPTIBLE);
                         schedule_timeout(1);  /* yield in case q were corrupt */
                 }
-        } while(!signal_pending(current));
-        oplockThread = NULL;
-        complete_and_exit (&cifs_oplock_exited, 0);
+        } while (!kthread_should_stop());
+
+        return 0;
 }
 
 static int cifs_dnotify_thread(void * dummyarg)
@@ -910,10 +904,6 @@ static int cifs_dnotify_thread(void * dummyarg)
         struct list_head *tmp;
         struct cifsSesInfo *ses;
 
-        daemonize("cifsdnotifyd");
-        allow_signal(SIGTERM);
-
-        dnotifyThread = current;
         do {
                 if(try_to_freeze())
                         continue;
@@ -931,8 +921,9 @@ static int cifs_dnotify_thread(void * dummyarg)
                                 wake_up_all(&ses->server->response_q);
                 }
                 read_unlock(&GlobalSMBSeslock);
-        } while(!signal_pending(current));
-        complete_and_exit (&cifs_dnotify_exited, 0);
+        } while (!kthread_should_stop());
+
+        return 0;
 }
 
 static int __init
@@ -982,32 +973,48 @@ init_cifs(void)
         }
 
         rc = cifs_init_inodecache();
-        if (!rc) {
-                rc = cifs_init_mids();
-                if (!rc) {
-                        rc = cifs_init_request_bufs();
-                        if (!rc) {
-                                rc = register_filesystem(&cifs_fs_type);
-                                if (!rc) {                
-                                        rc = (int)kernel_thread(cifs_oplock_thread, NULL, 
-                                                CLONE_FS | CLONE_FILES | CLONE_VM);
-                                        if(rc > 0) {
-                                                rc = (int)kernel_thread(cifs_dnotify_thread, NULL,
-                                                        CLONE_FS | CLONE_FILES | CLONE_VM);
-                                                if(rc > 0)
-                                                        return 0;
-                                                else
-                                                        cERROR(1,("error %d create dnotify thread", rc));
-                                        } else {
-                                                cERROR(1,("error %d create oplock thread",rc));
-                                        }
-                                }
-                                cifs_destroy_request_bufs();
-                        }
-                        cifs_destroy_mids();
-                }
-                cifs_destroy_inodecache();
+        if (rc)
+                goto out_clean_proc;
+
+        rc = cifs_init_mids();
+        if (rc)
+                goto out_destroy_inodecache;
+
+        rc = cifs_init_request_bufs();
+        if (rc)
+                goto out_destroy_mids;
+
+        rc = register_filesystem(&cifs_fs_type);
+        if (rc)
+                goto out_destroy_request_bufs;
+
+        oplockThread = kthread_run(cifs_oplock_thread, NULL, "cifsoplockd");
+        if (IS_ERR(oplockThread)) {
+                rc = PTR_ERR(oplockThread);
+                cERROR(1,("error %d create oplock thread", rc));
+                goto out_unregister_filesystem;
         }
+
+        dnotifyThread = kthread_run(cifs_dnotify_thread, NULL, "cifsdnotifyd");
+        if (IS_ERR(dnotifyThread)) {
+                rc = PTR_ERR(dnotifyThread);
+                cERROR(1,("error %d create dnotify thread", rc));
+                goto out_stop_oplock_thread;
+        }
+
+        return 0;
+
+ out_stop_oplock_thread:
+        kthread_stop(oplockThread);
+ out_unregister_filesystem:
+        unregister_filesystem(&cifs_fs_type);
+ out_destroy_request_bufs:
+        cifs_destroy_request_bufs();
+ out_destroy_mids:
+        cifs_destroy_mids();
+ out_destroy_inodecache:
+        cifs_destroy_inodecache();
+ out_clean_proc:
 #ifdef CONFIG_PROC_FS
         cifs_proc_clean();
 #endif
@@ -1025,14 +1032,8 @@ exit_cifs(void)
         cifs_destroy_inodecache();
         cifs_destroy_mids();
         cifs_destroy_request_bufs();
-        if(oplockThread) {
-                send_sig(SIGTERM, oplockThread, 1);
-                wait_for_completion(&cifs_oplock_exited);
-        }
-        if(dnotifyThread) {
-                send_sig(SIGTERM, dnotifyThread, 1);
-                wait_for_completion(&cifs_dnotify_exited);
-        }
+        kthread_stop(oplockThread);
+        kthread_stop(dnotifyThread);
 }
 
 MODULE_AUTHOR("Steve French <sfrench@us.ibm.com>");
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index d705500aa283..fd36892eda55 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3119,7 +3119,7 @@ findFirstRetry:
                                 psrch_inf->endOfSearch = FALSE;
 
                         psrch_inf->entries_in_buffer  = le16_to_cpu(parms->SearchCount);
-                        psrch_inf->index_of_last_entry = 
+                        psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
                                 psrch_inf->entries_in_buffer;
                         *pnetfid = parms->SearchHandle;
                 } else {
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0b86d5ca9014..d2ec806a4f32 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3447,6 +3447,12 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                         pSesInfo->server->secMode,
                         pSesInfo->server->capabilities,
                         pSesInfo->server->timeZone));
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+                if(experimEnabled > 1)
+                        rc = CIFS_SessSetup(xid, pSesInfo, CIFS_NTLM /* type */,
+                                            &ntlmv2_flag, nls_info);    
+                else
+#endif
                 if (extended_security
                                 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
                                 && (pSesInfo->server->secType == NTLMSSP)) {
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 1d0ca3eaaca5..82315edc77d7 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -139,9 +139,7 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
         cifs_sb = CIFS_SB(inode->i_sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&direntry->d_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&direntry->d_sb->s_vfs_rename_mutex);
         if(full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -316,9 +314,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, int mode,
         cifs_sb = CIFS_SB(inode->i_sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&direntry->d_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&direntry->d_sb->s_vfs_rename_mutex);
         if(full_path == NULL)
                 rc = -ENOMEM;
         else if (pTcon->ses->capabilities & CAP_UNIX) {
@@ -440,6 +436,20 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry, struct name
         cifs_sb = CIFS_SB(parent_dir_inode->i_sb);
         pTcon = cifs_sb->tcon;
 
+        /*
+         * Don't allow the separator character in a path component.
+         * The VFS will not allow "/", but "\" is allowed by posix.
+         */
+        if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
+                int i;
+                for (i = 0; i < direntry->d_name.len; i++)
+                        if (direntry->d_name.name[i] == '\\') {
+                                cFYI(1, ("Invalid file name"));
+                                FreeXid(xid);
+                                return ERR_PTR(-EINVAL);
+                        }
+        }
+
         /* can not grab the rename sem here since it would
         deadlock in the cases (beginning of sys_rename itself)
         in which we already have the sb rename sem */
diff --git a/fs/cifs/fcntl.c b/fs/cifs/fcntl.c
index ec4dfe9bf5ef..633a93811328 100644
--- a/fs/cifs/fcntl.c
+++ b/fs/cifs/fcntl.c
@@ -86,9 +86,7 @@ int cifs_dir_notify(struct file * file, unsigned long arg)
         cifs_sb = CIFS_SB(file->f_dentry->d_sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&file->f_dentry->d_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(file->f_dentry);
-        mutex_unlock(&file->f_dentry->d_sb->s_vfs_rename_mutex);
 
         if(full_path == NULL) {
                 rc = -ENOMEM;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 5c497c529772..e152bf6afa60 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -203,9 +203,7 @@ int cifs_open(struct inode *inode, struct file *file)
                 }
         }
 
-        mutex_lock(&inode->i_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(file->f_dentry);
-        mutex_unlock(&inode->i_sb->s_vfs_rename_mutex);
         if (full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -906,8 +904,7 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                                 if (rc != 0)
                                         break;
                         }
-                        /* BB FIXME We can not sign across two buffers yet */
-                        if((pTcon->ses->server->secMode & 
+                        if(experimEnabled || (pTcon->ses->server->secMode & 
                          (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) == 0) {
                                 struct kvec iov[2];
                                 unsigned int len;
@@ -923,13 +920,13 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                                                 *poffset, &bytes_written,
                                                 iov, 1, long_op);
                         } else
-                        /* BB FIXME fixup indentation of line below */
-                        rc = CIFSSMBWrite(xid, pTcon,
-                                 open_file->netfid,
-                                 min_t(const int, cifs_sb->wsize, 
-                                       write_size - total_written),
-                                 *poffset, &bytes_written,
-                                 write_data + total_written, NULL, long_op);
+                                rc = CIFSSMBWrite(xid, pTcon,
+                                         open_file->netfid,
+                                         min_t(const int, cifs_sb->wsize,
+                                               write_size - total_written),
+                                         *poffset, &bytes_written,
+                                         write_data + total_written,
+                                         NULL, long_op);
                 }
                 if (rc || (bytes_written == 0)) {
                         if (total_written)
@@ -968,6 +965,16 @@ struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *cifs_inode)
         struct cifsFileInfo *open_file;
         int rc;
 
+        /* Having a null inode here (because mapping->host was set to zero by
+        the VFS or MM) should not happen but we had reports of on oops (due to
+        it being zero) during stress testcases so we need to check for it */
+
+        if(cifs_inode == NULL) {
+                cERROR(1,("Null inode passed to cifs_writeable_file"));
+                dump_stack();
+                return NULL;
+        }
+
         read_lock(&GlobalSMBSeslock);
         list_for_each_entry(open_file, &cifs_inode->openFileList, flist) {
                 if (open_file->closePend)
@@ -1093,12 +1100,11 @@ static int cifs_writepages(struct address_space *mapping,
         if (cifs_sb->wsize < PAGE_CACHE_SIZE)
                 return generic_writepages(mapping, wbc);
 
-        /* BB FIXME we do not have code to sign across multiple buffers yet,
-           so go to older writepage style write which we can sign if needed */
         if((cifs_sb->tcon->ses) && (cifs_sb->tcon->ses->server))
                 if(cifs_sb->tcon->ses->server->secMode &
                           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
-                        return generic_writepages(mapping, wbc);
+                        if(!experimEnabled)
+                                return generic_writepages(mapping, wbc);
 
         /*
          * BB: Is this meaningful for a non-block-device file system?
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 957ddd1571c6..4093764ef461 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -722,9 +722,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode)
         cifs_sb = CIFS_SB(inode->i_sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&inode->i_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&inode->i_sb->s_vfs_rename_mutex);
         if (full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -807,9 +805,7 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         cifs_sb = CIFS_SB(inode->i_sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&inode->i_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&inode->i_sb->s_vfs_rename_mutex);
         if (full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -1141,9 +1137,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                         rc = 0;
         }
                 
-        mutex_lock(&direntry->d_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&direntry->d_sb->s_vfs_rename_mutex);
         if (full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 9562f5bba65c..2ec99f833142 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -48,10 +48,8 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode,
 /* No need to check for cross device links since server will do that
    BB note DFS case in future though (when we may have to check) */
 
-        mutex_lock(&inode->i_sb->s_vfs_rename_mutex);
         fromName = build_path_from_dentry(old_file);
         toName = build_path_from_dentry(direntry);
-        mutex_unlock(&inode->i_sb->s_vfs_rename_mutex);
         if((fromName == NULL) || (toName == NULL)) {
                 rc = -ENOMEM;
                 goto cifs_hl_exit;
@@ -103,9 +101,7 @@ cifs_follow_link(struct dentry *direntry, struct nameidata *nd)
 
         xid = GetXid();
 
-        mutex_lock(&direntry->d_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&direntry->d_sb->s_vfs_rename_mutex);
 
         if (!full_path)
                 goto out_no_free;
@@ -164,9 +160,7 @@ cifs_symlink(struct inode *inode, struct dentry *direntry, const char *symname)
         cifs_sb = CIFS_SB(inode->i_sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&inode->i_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&inode->i_sb->s_vfs_rename_mutex);
 
         if(full_path == NULL) {
                 FreeXid(xid);
diff --git a/fs/cifs/ntlmssp.c b/fs/cifs/ntlmssp.c
index 78866f925747..115359cc7a32 100644
--- a/fs/cifs/ntlmssp.c
+++ b/fs/cifs/ntlmssp.c
@@ -121,6 +121,20 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, const int type,
         }
 
 
+        /* copy session key */
+
+        /* if Unicode, align strings to two byte boundary */
+
+        /* copy user name */ /* BB Do we need to special case null user name? */
+
+        /* copy domain name */
+
+        /* copy Linux version */
+
+        /* copy network operating system name */
+
+        /* update bcc and smb buffer length */
+
 /*      rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buf_type, 0); */
         /* SMB request buf freed in SendReceive2 */
 
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 2f6e2825571e..b689c5035124 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -404,9 +404,7 @@ static int initiate_cifs_search(const int xid, struct file *file)
         if(pTcon == NULL)
                 return -EINVAL;
 
-        mutex_lock(&file->f_dentry->d_sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(file->f_dentry);
-        mutex_unlock(&file->f_dentry->d_sb->s_vfs_rename_mutex);
 
         if(full_path == NULL) {
                 return -ENOMEM;
@@ -592,6 +590,13 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
         first_entry_in_buffer = 
                 cifsFile->srch_inf.index_of_last_entry - 
                         cifsFile->srch_inf.entries_in_buffer;
+
+        /* if first entry in buf is zero then is first buffer
+        in search response data which means it is likely . and ..
+        will be in this buffer, although some servers do not return
+        . and .. for the root of a drive and for those we need
+        to start two entries earlier */
+
 /*      dump_cifs_file_struct(file, "In fce ");*/
         if(((index_to_find < cifsFile->srch_inf.index_of_last_entry) && 
              is_dir_changed(file)) || 
@@ -634,23 +639,14 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
                 char * end_of_smb = cifsFile->srch_inf.ntwrk_buf_start + 
                         smbCalcSize((struct smb_hdr *)
                                 cifsFile->srch_inf.ntwrk_buf_start);
+
+                current_entry = cifsFile->srch_inf.srch_entries_start;
                 first_entry_in_buffer = cifsFile->srch_inf.index_of_last_entry
                                         - cifsFile->srch_inf.entries_in_buffer;
                 pos_in_buf = index_to_find - first_entry_in_buffer;
                 cFYI(1,("found entry - pos_in_buf %d",pos_in_buf)); 
-                current_entry = cifsFile->srch_inf.srch_entries_start;
                 for(i=0;(i<(pos_in_buf)) && (current_entry != NULL);i++) {
                         /* go entry by entry figuring out which is first */
-                        /* if( . or ..)
-                                skip */
-                        rc = cifs_entry_is_dot(current_entry,cifsFile);
-                        if(rc == 1) /* is . or .. so skip */ {
-                                cFYI(1,("Entry is .")); /* BB removeme BB */
-                                /* continue; */
-                        } else if (rc == 2 ) {
-                                cFYI(1,("Entry is ..")); /* BB removeme BB */
-                                /* continue; */
-                        }
                         current_entry = nxt_dir_entry(current_entry,end_of_smb);
                 }
                 if((current_entry == NULL) && (i < pos_in_buf)) {
@@ -770,6 +766,11 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
         if(file->f_dentry == NULL)
                 return -ENOENT;
 
+        rc = cifs_entry_is_dot(pfindEntry,pCifsF);
+        /* skip . and .. since we added them first */
+        if(rc != 0) 
+                return 0;
+
         cifs_sb = CIFS_SB(file->f_dentry->d_sb);
 
         qstring.name = scratch_buf;
@@ -898,22 +899,22 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
 
         switch ((int) file->f_pos) {
         case 0:
-                /*if (filldir(direntry, ".", 1, file->f_pos,
+                if (filldir(direntry, ".", 1, file->f_pos,
                      file->f_dentry->d_inode->i_ino, DT_DIR) < 0) {
-                        cERROR(1, ("Filldir for current dir failed "));
+                        cERROR(1, ("Filldir for current dir failed"));
                         rc = -ENOMEM;
                         break;
                 }
-                file->f_pos++; */
+                file->f_pos++;
         case 1:
-                /* if (filldir(direntry, "..", 2, file->f_pos,
+                if (filldir(direntry, "..", 2, file->f_pos,
                      file->f_dentry->d_parent->d_inode->i_ino, DT_DIR) < 0) {
                         cERROR(1, ("Filldir for parent dir failed "));
                         rc = -ENOMEM;
                         break;
                 }
-                file->f_pos++; */
-        case 2:
+                file->f_pos++;
+        default:
                 /* 1) If search is active, 
                         is in current search buffer? 
                         if it before then restart search
@@ -927,7 +928,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                                 return rc;
                         }
                 }
-        default:
                 if(file->private_data == NULL) {
                         rc = -EINVAL;
                         FreeXid(xid);
@@ -947,8 +947,6 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                 kfree(cifsFile->search_resume_name);
                 cifsFile->search_resume_name = NULL; */
 
-                /* BB account for . and .. in f_pos as special case */
-
                 rc = find_cifs_entry(xid,pTcon, file,
                                 &current_entry,&num_to_fill);
                 if(rc) {
@@ -977,7 +975,8 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                                           num_to_fill, i));
                                 break;
                         }
-
+                        /* if buggy server returns . and .. late do
+                        we want to check for that here? */
                         rc = cifs_filldir(current_entry, file, 
                                         filldir, direntry,tmp_buf);
                         file->f_pos++;
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 3938444d87b2..7754d641775e 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -62,9 +62,7 @@ int cifs_removexattr(struct dentry * direntry, const char * ea_name)
         cifs_sb = CIFS_SB(sb);
         pTcon = cifs_sb->tcon;
                                                                                      
-        mutex_lock(&sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&sb->s_vfs_rename_mutex);
         if(full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -116,9 +114,7 @@ int cifs_setxattr(struct dentry * direntry, const char * ea_name,
         cifs_sb = CIFS_SB(sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&sb->s_vfs_rename_mutex);
         if(full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -223,9 +219,7 @@ ssize_t cifs_getxattr(struct dentry * direntry, const char * ea_name,
         cifs_sb = CIFS_SB(sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&sb->s_vfs_rename_mutex);
         if(full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
@@ -341,9 +335,7 @@ ssize_t cifs_listxattr(struct dentry * direntry, char * data, size_t buf_size)
         cifs_sb = CIFS_SB(sb);
         pTcon = cifs_sb->tcon;
 
-        mutex_lock(&sb->s_vfs_rename_mutex);
         full_path = build_path_from_dentry(direntry);
-        mutex_unlock(&sb->s_vfs_rename_mutex);
         if(full_path == NULL) {
                 FreeXid(xid);
                 return -ENOMEM;
diff --git a/fs/compat.c b/fs/compat.c
index 7f8e26ea427c..2e32bd340474 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1217,6 +1217,10 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
         if (ret < 0)
                 goto out;
 
+        ret = security_file_permission(file, type == READ ? MAY_READ:MAY_WRITE);
+        if (ret)
+                goto out;
+
         fnv = NULL;
         if (type == READ) {
                 fn = file->f_op->read;
diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c
index aaf1da17b6d4..8c22aa9a7fbb 100644
--- a/fs/ext3/ioctl.c
+++ b/fs/ext3/ioctl.c
@@ -48,6 +48,7 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 if (!S_ISDIR(inode->i_mode))
                         flags &= ~EXT3_DIRSYNC_FL;
 
+                mutex_lock(&inode->i_mutex);
                 oldflags = ei->i_flags;
 
                 /* The JOURNAL_DATA flag is modifiable only by root */
@@ -60,8 +61,10 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                  * This test looks nicer. Thanks to Pauline Middelink
                  */
                 if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FL)) {
-                        if (!capable(CAP_LINUX_IMMUTABLE))
+                        if (!capable(CAP_LINUX_IMMUTABLE)) {
+                                mutex_unlock(&inode->i_mutex);
                                 return -EPERM;
+                        }
                 }
 
                 /*
@@ -69,14 +72,18 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                  * the relevant capability.
                  */
                 if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL)) {
-                        if (!capable(CAP_SYS_RESOURCE))
+                        if (!capable(CAP_SYS_RESOURCE)) {
+                                mutex_unlock(&inode->i_mutex);
                                 return -EPERM;
+                        }
                 }
 
 
                 handle = ext3_journal_start(inode, 1);
-                if (IS_ERR(handle))
+                if (IS_ERR(handle)) {
+                        mutex_unlock(&inode->i_mutex);
                         return PTR_ERR(handle);
+                }
                 if (IS_SYNC(inode))
                         handle->h_sync = 1;
                 err = ext3_reserve_inode_write(handle, inode, &iloc);
@@ -93,11 +100,14 @@ int ext3_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
                 err = ext3_mark_iloc_dirty(handle, inode, &iloc);
 flags_err:
                 ext3_journal_stop(handle);
-                if (err)
+                if (err) {
+                        mutex_unlock(&inode->i_mutex);
                         return err;
+                }
 
                 if ((jflag ^ oldflags) & (EXT3_JOURNAL_DATA_FL))
                         err = ext3_change_inode_journal_flag(inode, jflag);
+                mutex_unlock(&inode->i_mutex);
                 return err;
         }
         case EXT3_IOC_GETVERSION:
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index c5ffa8523968..8aac5334680d 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -213,7 +213,7 @@ static int setup_new_group_blocks(struct super_block *sb,
                         goto exit_bh;
                 }
                 lock_buffer(bh);
-                memcpy(gdb->b_data, sbi->s_group_desc[i], bh->b_size);
+                memcpy(gdb->b_data, sbi->s_group_desc[i]->b_data, bh->b_size);
                 set_buffer_uptodate(gdb);
                 unlock_buffer(bh);
                 ext3_journal_dirty_metadata(handle, gdb);
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index cc750c68fe70..104a62dadb94 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -128,14 +128,24 @@ void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
         }
 }
 
-void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req)
+/*
+ * Called with sbput_sem held for read (request_end) or write
+ * (fuse_put_super).  By the time fuse_put_super() is finished, all
+ * inodes belonging to background requests must be released, so the
+ * iputs have to be done within the locked region.
+ */
+void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req)
 {
-        list_del_init(&req->bg_entry);
+        iput(req->inode);
+        iput(req->inode2);
+        spin_lock(&fc->lock);
+        list_del(&req->bg_entry);
         if (fc->num_background == FUSE_MAX_BACKGROUND) {
                 fc->blocked = 0;
                 wake_up_all(&fc->blocked_waitq);
         }
         fc->num_background--;
+        spin_unlock(&fc->lock);
 }
 
 /*
@@ -165,27 +175,22 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
                 wake_up(&req->waitq);
                 fuse_put_request(fc, req);
         } else {
-                struct inode *inode = req->inode;
-                struct inode *inode2 = req->inode2;
-                struct file *file = req->file;
                 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
                 req->end = NULL;
-                req->inode = NULL;
-                req->inode2 = NULL;
-                req->file = NULL;
-                if (!list_empty(&req->bg_entry))
-                        fuse_remove_background(fc, req);
                 spin_unlock(&fc->lock);
+                down_read(&fc->sbput_sem);
+                if (fc->mounted)
+                        fuse_release_background(fc, req);
+                up_read(&fc->sbput_sem);
+
+                /* fput must go outside sbput_sem, otherwise it can deadlock */
+                if (req->file)
+                        fput(req->file);
 
                 if (end)
                         end(fc, req);
                 else
                         fuse_put_request(fc, req);
-
-                if (file)
-                        fput(file);
-                iput(inode);
-                iput(inode2);
         }
 }
 
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 59661c481d9d..0474202cb5dc 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -258,9 +258,15 @@ struct fuse_conn {
         /** waitq for blocked connection */
         wait_queue_head_t blocked_waitq;
 
+        /** RW semaphore for exclusion with fuse_put_super() */
+        struct rw_semaphore sbput_sem;
+
         /** The next unique request id */
         u64 reqctr;
 
+        /** Mount is active */
+        unsigned mounted;
+
         /** Connection established, cleared on umount, connection
             abort and device release */
         unsigned connected;
@@ -471,11 +477,11 @@ void request_send_noreply(struct fuse_conn *fc, struct fuse_req *req);
 void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
 
 /**
- * Remove request from the the background list
+ * Release inodes and file associated with background request
  */
-void fuse_remove_background(struct fuse_conn *fc, struct fuse_req *req);
+void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req);
 
-/** Abort all requests */
+/* Abort all requests */
 void fuse_abort_conn(struct fuse_conn *fc);
 
 /**
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 43a6fc0db8a7..7627022446b2 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -204,26 +204,17 @@ static void fuse_put_super(struct super_block *sb)
 {
         struct fuse_conn *fc = get_fuse_conn_super(sb);
 
+        down_write(&fc->sbput_sem);
+        while (!list_empty(&fc->background))
+                fuse_release_background(fc,
+                                        list_entry(fc->background.next,
+                                                   struct fuse_req, bg_entry));
+
         spin_lock(&fc->lock);
+        fc->mounted = 0;
         fc->connected = 0;
-        while (!list_empty(&fc->background)) {
-                struct fuse_req *req = list_entry(fc->background.next,
-                                                  struct fuse_req, bg_entry);
-                struct inode *inode = req->inode;
-                struct inode *inode2 = req->inode2;
-
-                /* File would hold a reference to vfsmount */
-                BUG_ON(req->file);
-                req->inode = NULL;
-                req->inode2 = NULL;
-                fuse_remove_background(fc, req);
-
-                spin_unlock(&fc->lock);
-                iput(inode);
-                iput(inode2);
-                spin_lock(&fc->lock);
-        }
         spin_unlock(&fc->lock);
+        up_write(&fc->sbput_sem);
         /* Flush all readers on this fs */
         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
         wake_up_all(&fc->waitq);
@@ -395,6 +386,7 @@ static struct fuse_conn *new_conn(void)
                 INIT_LIST_HEAD(&fc->processing);
                 INIT_LIST_HEAD(&fc->io);
                 INIT_LIST_HEAD(&fc->background);
+                init_rwsem(&fc->sbput_sem);
                 kobj_set_kset_s(fc, connections_subsys);
                 kobject_init(&fc->kobj);
                 atomic_set(&fc->num_waiting, 0);
@@ -508,11 +500,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (file->f_op != &fuse_dev_operations)
                 return -EINVAL;
 
-        /* Setting file->private_data can't race with other mount()
-           instances, since BKL is held for ->get_sb() */
-        if (file->private_data)
-                return -EINVAL;
-
         fc = new_conn();
         if (!fc)
                 return -ENOMEM;
@@ -548,7 +535,14 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (err)
                 goto err_free_req;
 
+        /* Setting file->private_data can't race with other mount()
+           instances, since BKL is held for ->get_sb() */
+        err = -EINVAL;
+        if (file->private_data)
+                goto err_kobject_del;
+
         sb->s_root = root_dentry;
+        fc->mounted = 1;
         fc->connected = 1;
         kobject_get(&fc->kobj);
         file->private_data = fc;
@@ -563,6 +557,8 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
 
         return 0;
 
+ err_kobject_del:
+        kobject_del(&fc->kobj);
  err_free_req:
         fuse_request_free(init_req);
  err_put_root:
diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c
index 58c418fbca2c..97ae1b92bc47 100644
--- a/fs/reiserfs/xattr_acl.c
+++ b/fs/reiserfs/xattr_acl.c
@@ -408,8 +408,9 @@ int reiserfs_cache_default_acl(struct inode *inode)
                 acl = reiserfs_get_acl(inode, ACL_TYPE_DEFAULT);
                 reiserfs_read_unlock_xattrs(inode->i_sb);
                 reiserfs_read_unlock_xattr_i(inode);
-                ret = acl ? 1 : 0;
-                posix_acl_release(acl);
+                ret = (acl && !IS_ERR(acl));
+                if (ret)
+                        posix_acl_release(acl);
         }
 
         return ret;
diff --git a/fs/splice.c b/fs/splice.c
index 0559e7577a04..447ebc0a37f3 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -27,15 +27,22 @@
 #include <linux/buffer_head.h>
 #include <linux/module.h>
 #include <linux/syscalls.h>
+#include <linux/uio.h>
+
+struct partial_page {
+        unsigned int offset;
+        unsigned int len;
+};
 
 /*
- * Passed to the actors
+ * Passed to splice_to_pipe
  */
-struct splice_desc {
-        unsigned int len, total_len;    /* current and remaining length */
+struct splice_pipe_desc {
+        struct page **pages;            /* page map */
+        struct partial_page *partial;   /* pages[] may not be contig */
+        int nr_pages;                   /* number of pages in map */
         unsigned int flags;             /* splice flags */
-        struct file *file;              /* file to read/write */
-        loff_t pos;                     /* file position */
+        struct pipe_buf_operations *ops;/* ops associated with output pipe */
 };
 
 /*
@@ -128,6 +135,19 @@ static void page_cache_pipe_buf_unmap(struct pipe_inode_info *info,
         kunmap(buf->page);
 }
 
+static void *user_page_pipe_buf_map(struct file *file,
+                                    struct pipe_inode_info *pipe,
+                                    struct pipe_buffer *buf)
+{
+        return kmap(buf->page);
+}
+
+static void user_page_pipe_buf_unmap(struct pipe_inode_info *pipe,
+                                     struct pipe_buffer *buf)
+{
+        kunmap(buf->page);
+}
+
 static void page_cache_pipe_buf_get(struct pipe_inode_info *info,
                                     struct pipe_buffer *buf)
 {
@@ -143,19 +163,33 @@ static struct pipe_buf_operations page_cache_pipe_buf_ops = {
         .get = page_cache_pipe_buf_get,
 };
 
+static int user_page_pipe_buf_steal(struct pipe_inode_info *pipe,
+                                    struct pipe_buffer *buf)
+{
+        return 1;
+}
+
+static struct pipe_buf_operations user_page_pipe_buf_ops = {
+        .can_merge = 0,
+        .map = user_page_pipe_buf_map,
+        .unmap = user_page_pipe_buf_unmap,
+        .release = page_cache_pipe_buf_release,
+        .steal = user_page_pipe_buf_steal,
+        .get = page_cache_pipe_buf_get,
+};
+
 /*
  * Pipe output worker. This sets up our pipe format with the page cache
  * pipe buffer operations. Otherwise very similar to the regular pipe_writev().
  */
-static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
-                            int nr_pages, unsigned long len,
-                            unsigned int offset, unsigned int flags)
+static ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
+                              struct splice_pipe_desc *spd)
 {
-        int ret, do_wakeup, i;
+        int ret, do_wakeup, page_nr;
 
         ret = 0;
         do_wakeup = 0;
-        i = 0;
+        page_nr = 0;
 
         if (pipe->inode)
                 mutex_lock(&pipe->inode->i_mutex);
@@ -171,27 +205,19 @@ static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
                 if (pipe->nrbufs < PIPE_BUFFERS) {
                         int newbuf = (pipe->curbuf + pipe->nrbufs) & (PIPE_BUFFERS - 1);
                         struct pipe_buffer *buf = pipe->bufs + newbuf;
-                        struct page *page = pages[i++];
-                        unsigned long this_len;
 
-                        this_len = PAGE_CACHE_SIZE - offset;
-                        if (this_len > len)
-                                this_len = len;
-
-                        buf->page = page;
-                        buf->offset = offset;
-                        buf->len = this_len;
-                        buf->ops = &page_cache_pipe_buf_ops;
+                        buf->page = spd->pages[page_nr];
+                        buf->offset = spd->partial[page_nr].offset;
+                        buf->len = spd->partial[page_nr].len;
+                        buf->ops = spd->ops;
                         pipe->nrbufs++;
+                        page_nr++;
+                        ret += buf->len;
+
                         if (pipe->inode)
                                 do_wakeup = 1;
 
-                        ret += this_len;
-                        len -= this_len;
-                        offset = 0;
-                        if (!--nr_pages)
-                                break;
-                        if (!len)
+                        if (!--spd->nr_pages)
                                 break;
                         if (pipe->nrbufs < PIPE_BUFFERS)
                                 continue;
@@ -199,7 +225,7 @@ static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
                         break;
                 }
 
-                if (flags & SPLICE_F_NONBLOCK) {
+                if (spd->flags & SPLICE_F_NONBLOCK) {
                         if (!ret)
                                 ret = -EAGAIN;
                         break;
@@ -234,8 +260,8 @@ static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
         }
 
-        while (i < nr_pages)
-                page_cache_release(pages[i++]);
+        while (page_nr < spd->nr_pages)
+                page_cache_release(spd->pages[page_nr++]);
 
         return ret;
 }
@@ -246,17 +272,24 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                            unsigned int flags)
 {
         struct address_space *mapping = in->f_mapping;
-        unsigned int loff, offset, nr_pages;
+        unsigned int loff, nr_pages;
         struct page *pages[PIPE_BUFFERS];
+        struct partial_page partial[PIPE_BUFFERS];
         struct page *page;
         pgoff_t index, end_index;
         loff_t isize;
-        size_t bytes;
-        int i, error;
+        size_t total_len;
+        int error;
+        struct splice_pipe_desc spd = {
+                .pages = pages,
+                .partial = partial,
+                .flags = flags,
+                .ops = &page_cache_pipe_buf_ops,
+        };
 
         index = *ppos >> PAGE_CACHE_SHIFT;
-        loff = offset = *ppos & ~PAGE_CACHE_MASK;
-        nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
+        loff = *ppos & ~PAGE_CACHE_MASK;
+        nr_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
 
         if (nr_pages > PIPE_BUFFERS)
                 nr_pages = PIPE_BUFFERS;
@@ -266,15 +299,15 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
          * read-ahead if this is a non-zero offset (we are likely doing small
          * chunk splice and the page is already there) for a single page.
          */
-        if (!offset || nr_pages > 1)
-                do_page_cache_readahead(mapping, in, index, nr_pages);
+        if (!loff || spd.nr_pages > 1)
+                do_page_cache_readahead(mapping, in, index, spd.nr_pages);
 
         /*
          * Now fill in the holes:
          */
         error = 0;
-        bytes = 0;
-        for (i = 0; i < nr_pages; i++, index++) {
+        total_len = 0;
+        for (spd.nr_pages = 0; spd.nr_pages < nr_pages; spd.nr_pages++, index++) {
                 unsigned int this_len;
 
                 if (!len)
@@ -283,7 +316,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                 /*
                  * this_len is the max we'll use from this page
                  */
-                this_len = min(len, PAGE_CACHE_SIZE - loff);
+                this_len = min_t(unsigned long, len, PAGE_CACHE_SIZE - loff);
 find_page:
                 /*
                  * lookup the page for this index
@@ -367,26 +400,29 @@ readpage:
                          */
                         if (end_index == index) {
                                 loff = PAGE_CACHE_SIZE - (isize & ~PAGE_CACHE_MASK);
-                                if (bytes + loff > isize) {
+                                if (total_len + loff > isize) {
                                         page_cache_release(page);
                                         break;
                                 }
                                 /*
                                  * force quit after adding this page
                                  */
-                                nr_pages = i;
+                                nr_pages = spd.nr_pages;
                                 this_len = min(this_len, loff);
+                                loff = 0;
                         }
                 }
 fill_it:
-                pages[i] = page;
-                bytes += this_len;
+                pages[spd.nr_pages] = page;
+                partial[spd.nr_pages].offset = loff;
+                partial[spd.nr_pages].len = this_len;
                 len -= this_len;
+                total_len += this_len;
                 loff = 0;
         }
 
-        if (i)
-                return move_to_pipe(pipe, pages, i, bytes, offset, flags);
+        if (spd.nr_pages)
+                return splice_to_pipe(pipe, &spd);
 
         return error;
 }
@@ -439,14 +475,13 @@ EXPORT_SYMBOL(generic_file_splice_read);
 
 /*
  * Send 'sd->len' bytes to socket from 'sd->file' at position 'sd->pos'
- * using sendpage().
+ * using sendpage(). Return the number of bytes sent.
  */
 static int pipe_to_sendpage(struct pipe_inode_info *info,
                             struct pipe_buffer *buf, struct splice_desc *sd)
 {
         struct file *file = sd->file;
         loff_t pos = sd->pos;
-        unsigned int offset;
         ssize_t ret;
         void *ptr;
         int more;
@@ -461,16 +496,13 @@ static int pipe_to_sendpage(struct pipe_inode_info *info,
         if (IS_ERR(ptr))
                 return PTR_ERR(ptr);
 
-        offset = pos & ~PAGE_CACHE_MASK;
         more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
 
-        ret = file->f_op->sendpage(file, buf->page, offset, sd->len, &pos,more);
+        ret = file->f_op->sendpage(file, buf->page, buf->offset, sd->len,
+                                   &pos, more);
 
         buf->ops->unmap(info, buf);
-        if (ret == sd->len)
-                return 0;
-
-        return -EIO;
+        return ret;
 }
 
 /*
@@ -499,7 +531,7 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
         struct file *file = sd->file;
         struct address_space *mapping = file->f_mapping;
         gfp_t gfp_mask = mapping_gfp_mask(mapping);
-        unsigned int offset;
+        unsigned int offset, this_len;
         struct page *page;
         pgoff_t index;
         char *src;
@@ -515,6 +547,10 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
         index = sd->pos >> PAGE_CACHE_SHIFT;
         offset = sd->pos & ~PAGE_CACHE_MASK;
 
+        this_len = sd->len;
+        if (this_len + offset > PAGE_CACHE_SIZE)
+                this_len = PAGE_CACHE_SIZE - offset;
+
         /*
          * Reuse buf page, if SPLICE_F_MOVE is set.
          */
@@ -558,7 +594,7 @@ find_page:
                  * the full page.
                  */
                 if (!PageUptodate(page)) {
-                        if (sd->len < PAGE_CACHE_SIZE) {
+                        if (this_len < PAGE_CACHE_SIZE) {
                                 ret = mapping->a_ops->readpage(file, page);
                                 if (unlikely(ret))
                                         goto out;
@@ -582,7 +618,7 @@ find_page:
                 }
         }
 
-        ret = mapping->a_ops->prepare_write(file, page, 0, sd->len);
+        ret = mapping->a_ops->prepare_write(file, page, offset, offset+this_len);
         if (ret == AOP_TRUNCATED_PAGE) {
                 page_cache_release(page);
                 goto find_page;
@@ -592,18 +628,22 @@ find_page:
         if (!(buf->flags & PIPE_BUF_FLAG_STOLEN)) {
                 char *dst = kmap_atomic(page, KM_USER0);
 
-                memcpy(dst + offset, src + buf->offset, sd->len);
+                memcpy(dst + offset, src + buf->offset, this_len);
                 flush_dcache_page(page);
                 kunmap_atomic(dst, KM_USER0);
         }
 
-        ret = mapping->a_ops->commit_write(file, page, 0, sd->len);
+        ret = mapping->a_ops->commit_write(file, page, offset, offset+this_len);
         if (ret == AOP_TRUNCATED_PAGE) {
                 page_cache_release(page);
                 goto find_page;
         } else if (ret)
                 goto out;
 
+        /*
+         * Return the number of bytes written.
+         */
+        ret = this_len;
         mark_page_accessed(page);
         balance_dirty_pages_ratelimited(mapping);
 out:
@@ -616,17 +656,14 @@ out_nomem:
         return ret;
 }
 
-typedef int (splice_actor)(struct pipe_inode_info *, struct pipe_buffer *,
-                           struct splice_desc *);
-
 /*
  * Pipe input worker. Most of this logic works like a regular pipe, the
  * key here is the 'actor' worker passed in that actually moves the data
  * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
  */
-static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
-                              loff_t *ppos, size_t len, unsigned int flags,
-                              splice_actor *actor)
+ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
+                         loff_t *ppos, size_t len, unsigned int flags,
+                         splice_actor *actor)
 {
         int ret, do_wakeup, err;
         struct splice_desc sd;
@@ -652,16 +689,22 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                                 sd.len = sd.total_len;
 
                         err = actor(pipe, buf, &sd);
-                        if (err) {
+                        if (err <= 0) {
                                 if (!ret && err != -ENODATA)
                                         ret = err;
 
                                 break;
                         }
 
-                        ret += sd.len;
-                        buf->offset += sd.len;
-                        buf->len -= sd.len;
+                        ret += err;
+                        buf->offset += err;
+                        buf->len -= err;
+
+                        sd.len -= err;
+                        sd.pos += err;
+                        sd.total_len -= err;
+                        if (sd.len)
+                                continue;
 
                         if (!buf->len) {
                                 buf->ops = NULL;
@@ -672,8 +715,6 @@ static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                                         do_wakeup = 1;
                         }
 
-                        sd.pos += sd.len;
-                        sd.total_len -= sd.len;
                         if (!sd.total_len)
                                 break;
                 }
@@ -741,7 +782,7 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
         struct address_space *mapping = out->f_mapping;
         ssize_t ret;
 
-        ret = move_from_pipe(pipe, out, ppos, len, flags, pipe_to_file);
+        ret = splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_file);
         if (ret > 0) {
                 struct inode *inode = mapping->host;
 
@@ -783,7 +824,7 @@ EXPORT_SYMBOL(generic_file_splice_write);
 ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe, struct file *out,
                                 loff_t *ppos, size_t len, unsigned int flags)
 {
-        return move_from_pipe(pipe, out, ppos, len, flags, pipe_to_sendpage);
+        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_sendpage);
 }
 
 EXPORT_SYMBOL(generic_splice_sendpage);
@@ -870,7 +911,7 @@ long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
 
                 /*
                  * We don't have an immediate reader, but we'll read the stuff
-                 * out of the pipe right after the move_to_pipe(). So set
+                 * out of the pipe right after the splice_to_pipe(). So set
                  * PIPE_READERS appropriately.
                  */
                 pipe->readers = 1;
@@ -1010,6 +1051,174 @@ static long do_splice(struct file *in, loff_t __user *off_in,
         return -EINVAL;
 }
 
+/*
+ * Map an iov into an array of pages and offset/length tupples. With the
+ * partial_page structure, we can map several non-contiguous ranges into
+ * our ones pages[] map instead of splitting that operation into pieces.
+ * Could easily be exported as a generic helper for other users, in which
+ * case one would probably want to add a 'max_nr_pages' parameter as well.
+ */
+static int get_iovec_page_array(const struct iovec __user *iov,
+                                unsigned int nr_vecs, struct page **pages,
+                                struct partial_page *partial)
+{
+        int buffers = 0, error = 0;
+
+        /*
+         * It's ok to take the mmap_sem for reading, even
+         * across a "get_user()".
+         */
+        down_read(&current->mm->mmap_sem);
+
+        while (nr_vecs) {
+                unsigned long off, npages;
+                void __user *base;
+                size_t len;
+                int i;
+
+                /*
+                 * Get user address base and length for this iovec.
+                 */
+                error = get_user(base, &iov->iov_base);
+                if (unlikely(error))
+                        break;
+                error = get_user(len, &iov->iov_len);
+                if (unlikely(error))
+                        break;
+
+                /*
+                 * Sanity check this iovec. 0 read succeeds.
+                 */
+                if (unlikely(!len))
+                        break;
+                error = -EFAULT;
+                if (unlikely(!base))
+                        break;
+
+                /*
+                 * Get this base offset and number of pages, then map
+                 * in the user pages.
+                 */
+                off = (unsigned long) base & ~PAGE_MASK;
+                npages = (off + len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                if (npages > PIPE_BUFFERS - buffers)
+                        npages = PIPE_BUFFERS - buffers;
+
+                error = get_user_pages(current, current->mm,
+                                       (unsigned long) base, npages, 0, 0,
+                                       &pages[buffers], NULL);
+
+                if (unlikely(error <= 0))
+                        break;
+
+                /*
+                 * Fill this contiguous range into the partial page map.
+                 */
+                for (i = 0; i < error; i++) {
+                        const int plen = min_t(size_t, len, PAGE_SIZE) - off;
+
+                        partial[buffers].offset = off;
+                        partial[buffers].len = plen;
+
+                        off = 0;
+                        len -= plen;
+                        buffers++;
+                }
+
+                /*
+                 * We didn't complete this iov, stop here since it probably
+                 * means we have to move some of this into a pipe to
+                 * be able to continue.
+                 */
+                if (len)
+                        break;
+
+                /*
+                 * Don't continue if we mapped fewer pages than we asked for,
+                 * or if we mapped the max number of pages that we have
+                 * room for.
+                 */
+                if (error < npages || buffers == PIPE_BUFFERS)
+                        break;
+
+                nr_vecs--;
+                iov++;
+        }
+
+        up_read(&current->mm->mmap_sem);
+
+        if (buffers)
+                return buffers;
+
+        return error;
+}
+
+/*
+ * vmsplice splices a user address range into a pipe. It can be thought of
+ * as splice-from-memory, where the regular splice is splice-from-file (or
+ * to file). In both cases the output is a pipe, naturally.
+ *
+ * Note that vmsplice only supports splicing _from_ user memory to a pipe,
+ * not the other way around. Splicing from user memory is a simple operation
+ * that can be supported without any funky alignment restrictions or nasty
+ * vm tricks. We simply map in the user memory and fill them into a pipe.
+ * The reverse isn't quite as easy, though. There are two possible solutions
+ * for that:
+ *
+ *      - memcpy() the data internally, at which point we might as well just
+ *        do a regular read() on the buffer anyway.
+ *      - Lots of nasty vm tricks, that are neither fast nor flexible (it
+ *        has restriction limitations on both ends of the pipe).
+ *
+ * Alas, it isn't here.
+ *
+ */
+static long do_vmsplice(struct file *file, const struct iovec __user *iov,
+                        unsigned long nr_segs, unsigned int flags)
+{
+        struct pipe_inode_info *pipe = file->f_dentry->d_inode->i_pipe;
+        struct page *pages[PIPE_BUFFERS];
+        struct partial_page partial[PIPE_BUFFERS];
+        struct splice_pipe_desc spd = {
+                .pages = pages,
+                .partial = partial,
+                .flags = flags,
+                .ops = &user_page_pipe_buf_ops,
+        };
+
+        if (unlikely(!pipe))
+                return -EBADF;
+        if (unlikely(nr_segs > UIO_MAXIOV))
+                return -EINVAL;
+        else if (unlikely(!nr_segs))
+                return 0;
+
+        spd.nr_pages = get_iovec_page_array(iov, nr_segs, pages, partial);
+        if (spd.nr_pages <= 0)
+                return spd.nr_pages;
+
+        return splice_to_pipe(pipe, &spd);
+}
+
+asmlinkage long sys_vmsplice(int fd, const struct iovec __user *iov,
+                             unsigned long nr_segs, unsigned int flags)
+{
+        struct file *file;
+        long error;
+        int fput;
+
+        error = -EBADF;
+        file = fget_light(fd, &fput);
+        if (file) {
+                if (file->f_mode & FMODE_WRITE)
+                        error = do_vmsplice(file, iov, nr_segs, flags);
+
+                fput_light(file, fput);
+        }
+
+        return error;
+}
+
 asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
                            int fd_out, loff_t __user *off_out,
                            size_t len, unsigned int flags)
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index d81d6cfc1bb4..eb4b152c82fc 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -321,8 +321,9 @@
 #define __NR_splice             313
 #define __NR_sync_file_range    314
 #define __NR_tee                315
+#define __NR_vmsplice           316
 
-#define NR_syscalls 316
+#define NR_syscalls 317
 
 /*
  * user-visible error numbers are in the range -1 - -128: see
diff --git a/include/asm-ia64/unistd.h b/include/asm-ia64/unistd.h
index a40ebec6aeeb..7107763168bf 100644
--- a/include/asm-ia64/unistd.h
+++ b/include/asm-ia64/unistd.h
@@ -290,12 +290,13 @@
 #define __NR_get_robust_list            1299
 #define __NR_sync_file_range            1300
 #define __NR_tee                        1301
+#define __NR_vmsplice                   1302
 
 #ifdef __KERNEL__
 
 #include <linux/config.h>
 
-#define NR_syscalls                     278 /* length of syscall table */
+#define NR_syscalls                     279 /* length of syscall table */
 
 #define __ARCH_WANT_SYS_RT_SIGACTION
 
diff --git a/include/asm-parisc/io.h b/include/asm-parisc/io.h
index 29da31194b91..244f6b8883f4 100644
--- a/include/asm-parisc/io.h
+++ b/include/asm-parisc/io.h
@@ -126,24 +126,17 @@ static inline void gsc_writeq(unsigned long long val, unsigned long addr)
 
 extern void __iomem * __ioremap(unsigned long offset, unsigned long size, unsigned long flags);
 
-extern inline void __iomem * ioremap(unsigned long offset, unsigned long size)
-{
-        return __ioremap(offset, size, 0);
-}
-
-/*
- * This one maps high address device memory and turns off caching for that area.
- * it's useful if some control registers are in such an area and write combining
- * or read caching is not desirable:
+/* Most machines react poorly to I/O-space being cacheable... Instead let's
+ * define ioremap() in terms of ioremap_nocache().
  */
-extern inline void * ioremap_nocache(unsigned long offset, unsigned long size)
+extern inline void __iomem * ioremap(unsigned long offset, unsigned long size)
 {
-        return __ioremap(offset, size, _PAGE_NO_CACHE /* _PAGE_PCD */);
+        return __ioremap(offset, size, _PAGE_NO_CACHE);
 }
+#define ioremap_nocache(off, sz)        ioremap((off), (sz))
 
 extern void iounmap(void __iomem *addr);
 
-
 static inline unsigned char __raw_readb(const volatile void __iomem *addr)
 {
         return (*(volatile unsigned char __force *) (addr));
diff --git a/include/asm-parisc/page.h b/include/asm-parisc/page.h
index 45e02aa5bf4b..c0dd461fb8f1 100644
--- a/include/asm-parisc/page.h
+++ b/include/asm-parisc/page.h
@@ -1,13 +1,30 @@
 #ifndef _PARISC_PAGE_H
 #define _PARISC_PAGE_H
 
-/* PAGE_SHIFT determines the page size */
-#define PAGE_SHIFT      12
-#define PAGE_SIZE       (1UL << PAGE_SHIFT)
-#define PAGE_MASK       (~(PAGE_SIZE-1))
+#if !defined(__KERNEL__)
+/* this is for userspace applications (4k page size) */
+# define PAGE_SHIFT     12      /* 4k */
+# define PAGE_SIZE      (1UL << PAGE_SHIFT)
+# define PAGE_MASK      (~(PAGE_SIZE-1))
+#endif
+
 
 #ifdef __KERNEL__
 #include <linux/config.h>
+
+#if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define PAGE_SHIFT     12      /* 4k */
+#elif defined(CONFIG_PARISC_PAGE_SIZE_16KB)
+# define PAGE_SHIFT     14      /* 16k */
+#elif defined(CONFIG_PARISC_PAGE_SIZE_64KB)
+# define PAGE_SHIFT     16      /* 64k */
+#else
+# error "unknown default kernel page size"
+#endif
+#define PAGE_SIZE       (1UL << PAGE_SHIFT)
+#define PAGE_MASK       (~(PAGE_SIZE-1))
+
+
 #ifndef __ASSEMBLY__
 
 #include <asm/types.h>
diff --git a/include/asm-parisc/pgtable.h b/include/asm-parisc/pgtable.h
index 4e34c6b44059..aec089eb8b85 100644
--- a/include/asm-parisc/pgtable.h
+++ b/include/asm-parisc/pgtable.h
@@ -59,16 +59,15 @@
 #define  ISTACK_SIZE  32768 /* Interrupt Stack Size */
 #define  ISTACK_ORDER 3
 
-/* This is the size of the initially mapped kernel memory (i.e. currently
- * 0 to 1<<23 == 8MB */
+/* This is the size of the initially mapped kernel memory */
 #ifdef CONFIG_64BIT
-#define KERNEL_INITIAL_ORDER    24
+#define KERNEL_INITIAL_ORDER    24      /* 0 to 1<<24 = 16MB */
 #else
-#define KERNEL_INITIAL_ORDER    23
+#define KERNEL_INITIAL_ORDER    23      /* 0 to 1<<23 = 8MB */
 #endif
 #define KERNEL_INITIAL_SIZE     (1 << KERNEL_INITIAL_ORDER)
 
-#ifdef CONFIG_64BIT
+#if defined(CONFIG_64BIT) && defined(CONFIG_PARISC_PAGE_SIZE_4KB)
 #define PT_NLEVELS      3
 #define PGD_ORDER       1 /* Number of pages per pgd */
 #define PMD_ORDER       1 /* Number of pages per pmd */
@@ -111,11 +110,15 @@
 #define MAX_ADDRBITS    (PGDIR_SHIFT + BITS_PER_PGD)
 #define MAX_ADDRESS     (1UL << MAX_ADDRBITS)
 
-#define SPACEID_SHIFT (MAX_ADDRBITS - 32)
+#define SPACEID_SHIFT   (MAX_ADDRBITS - 32)
 
 /* This calculates the number of initial pages we need for the initial
  * page tables */
-#define PT_INITIAL      (1 << (KERNEL_INITIAL_ORDER - PMD_SHIFT))
+#if (KERNEL_INITIAL_ORDER) >= (PMD_SHIFT)
+# define PT_INITIAL     (1 << (KERNEL_INITIAL_ORDER - PMD_SHIFT))
+#else
+# define PT_INITIAL     (1)  /* all initial PTEs fit into one page */
+#endif
 
 /*
  * pgd entries used up by user/kernel:
@@ -160,6 +163,10 @@ extern  void *vmalloc_start;
  * to zero */
 #define PTE_SHIFT               xlate_pabit(_PAGE_USER_BIT)
 
+/* PFN_PTE_SHIFT defines the shift of a PTE value to access the PFN field */
+#define PFN_PTE_SHIFT           12
+
+
 /* this is how many bits may be used by the file functions */
 #define PTE_FILE_MAX_BITS       (BITS_PER_LONG - PTE_SHIFT)
 
@@ -188,7 +195,8 @@ extern  void *vmalloc_start;
 /* The pgd/pmd contains a ptr (in phys addr space); since all pgds/pmds
  * are page-aligned, we don't care about the PAGE_OFFSET bits, except
  * for a few meta-information bits, so we shift the address to be
- * able to effectively address 40-bits of physical address space. */
+ * able to effectively address 40/42/44-bits of physical address space
+ * depending on 4k/16k/64k PAGE_SIZE */
 #define _PxD_PRESENT_BIT   31
 #define _PxD_ATTACHED_BIT  30
 #define _PxD_VALID_BIT     29
@@ -198,7 +206,7 @@ extern  void *vmalloc_start;
 #define PxD_FLAG_VALID    (1 << xlate_pabit(_PxD_VALID_BIT))
 #define PxD_FLAG_MASK     (0xf)
 #define PxD_FLAG_SHIFT    (4)
-#define PxD_VALUE_SHIFT   (8)
+#define PxD_VALUE_SHIFT   (8) /* (PAGE_SHIFT-PxD_FLAG_SHIFT) */
 
 #ifndef __ASSEMBLY__
 
@@ -246,6 +254,7 @@ extern  void *vmalloc_start;
 #define __S110  PAGE_RWX
 #define __S111  PAGE_RWX
 
+
 extern pgd_t swapper_pg_dir[]; /* declared in init_task.c */
 
 /* initial page tables for 0-8MB for kernel */
@@ -272,7 +281,7 @@ extern unsigned long *empty_zero_page;
 #define pgd_flag(x)     (pgd_val(x) & PxD_FLAG_MASK)
 #define pgd_address(x)  ((unsigned long)(pgd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
 
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
 /* The first entry of the permanent pmd is not there if it contains
  * the gateway marker */
 #define pmd_none(x)     (!pmd_val(x) || pmd_flag(x) == PxD_FLAG_ATTACHED)
@@ -282,7 +291,7 @@ extern unsigned long *empty_zero_page;
 #define pmd_bad(x)      (!(pmd_flag(x) & PxD_FLAG_VALID))
 #define pmd_present(x)  (pmd_flag(x) & PxD_FLAG_PRESENT)
 static inline void pmd_clear(pmd_t *pmd) {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
                 /* This is the entry pointing to the permanent pmd
                  * attached to the pgd; cannot clear it */
@@ -303,7 +312,7 @@ static inline void pmd_clear(pmd_t *pmd) {
 #define pgd_bad(x)      (!(pgd_flag(x) & PxD_FLAG_VALID))
 #define pgd_present(x)  (pgd_flag(x) & PxD_FLAG_PRESENT)
 static inline void pgd_clear(pgd_t *pgd) {
-#ifdef CONFIG_64BIT
+#if PT_NLEVELS == 3
         if(pgd_flag(*pgd) & PxD_FLAG_ATTACHED)
                 /* This is the permanent pmd attached to the pgd; cannot
                  * free it */
@@ -351,7 +360,7 @@ extern inline pte_t pte_mkwrite(pte_t pte)	{ pte_val(pte) |= _PAGE_WRITE; return
 ({                                                                      \
         pte_t __pte;                                                    \
                                                                         \
-        pte_val(__pte) = ((addr)+pgprot_val(pgprot));                   \
+        pte_val(__pte) = ((((addr)>>PAGE_SHIFT)<<PFN_PTE_SHIFT) + pgprot_val(pgprot));  \
                                                                         \
         __pte;                                                          \
 })
@@ -361,20 +370,16 @@ extern inline pte_t pte_mkwrite(pte_t pte)	{ pte_val(pte) |= _PAGE_WRITE; return
 static inline pte_t pfn_pte(unsigned long pfn, pgprot_t pgprot)
 {
         pte_t pte;
-        pte_val(pte) = (pfn << PAGE_SHIFT) | pgprot_val(pgprot);
+        pte_val(pte) = (pfn << PFN_PTE_SHIFT) | pgprot_val(pgprot);
         return pte;
 }
 
-/* This takes a physical page address that is used by the remapping functions */
-#define mk_pte_phys(physpage, pgprot) \
-({ pte_t __pte; pte_val(__pte) = physpage + pgprot_val(pgprot); __pte; })
-
 extern inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 { pte_val(pte) = (pte_val(pte) & _PAGE_CHG_MASK) | pgprot_val(newprot); return pte; }
 
 /* Permanent address of a page.  On parisc we don't have highmem. */
 
-#define pte_pfn(x) (pte_val(x) >> PAGE_SHIFT)
+#define pte_pfn(x)              (pte_val(x) >> PFN_PTE_SHIFT)
 
 #define pte_page(pte)           (pfn_to_page(pte_pfn(pte)))
 
@@ -499,6 +504,26 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
 
 #endif /* !__ASSEMBLY__ */
 
+
+/* TLB page size encoding - see table 3-1 in parisc20.pdf */
+#define _PAGE_SIZE_ENCODING_4K          0
+#define _PAGE_SIZE_ENCODING_16K 1
+#define _PAGE_SIZE_ENCODING_64K 2
+#define _PAGE_SIZE_ENCODING_256K        3
+#define _PAGE_SIZE_ENCODING_1M          4
+#define _PAGE_SIZE_ENCODING_4M          5
+#define _PAGE_SIZE_ENCODING_16M 6
+#define _PAGE_SIZE_ENCODING_64M 7
+
+#if defined(CONFIG_PARISC_PAGE_SIZE_4KB)
+# define _PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_4K
+#elif defined(CONFIG_PARISC_PAGE_SIZE_16KB)
+# define _PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_16K
+#elif defined(CONFIG_PARISC_PAGE_SIZE_64KB)
+# define _PAGE_SIZE_ENCODING_DEFAULT _PAGE_SIZE_ENCODING_64K
+#endif
+
+
 #define io_remap_pfn_range(vma, vaddr, pfn, size, prot)         \
                 remap_pfn_range(vma, vaddr, pfn, size, prot)
 
diff --git a/include/asm-parisc/unistd.h b/include/asm-parisc/unistd.h
index c56fccbf34ad..0e1a30be2e30 100644
--- a/include/asm-parisc/unistd.h
+++ b/include/asm-parisc/unistd.h
@@ -780,8 +780,14 @@
 #define __NR_readlinkat         (__NR_Linux + 285)
 #define __NR_fchmodat           (__NR_Linux + 286)
 #define __NR_faccessat          (__NR_Linux + 287)
+#define __NR_unshare            (__NR_Linux + 288)
+#define __NR_set_robust_list    (__NR_Linux + 289)
+#define __NR_get_robust_list    (__NR_Linux + 290)
+#define __NR_splice             (__NR_Linux + 291)
+#define __NR_sync_file_range    (__NR_Linux + 292)
+#define __NR_tee                (__NR_Linux + 293)
 
-#define __NR_Linux_syscalls     288
+#define __NR_Linux_syscalls     294
 
 #define HPUX_GATEWAY_ADDR       0xC0000004
 #define LINUX_GATEWAY_ADDR      0x100
diff --git a/include/asm-powerpc/iommu.h b/include/asm-powerpc/iommu.h
index d5677cbec200..18ca29e9105a 100644
--- a/include/asm-powerpc/iommu.h
+++ b/include/asm-powerpc/iommu.h
@@ -70,17 +70,18 @@ extern void iommu_free_table(struct device_node *dn);
 extern struct iommu_table *iommu_init_table(struct iommu_table * tbl);
 
 extern int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
-                struct scatterlist *sglist, int nelems,
+                struct scatterlist *sglist, int nelems, unsigned long mask,
                 enum dma_data_direction direction);
 extern void iommu_unmap_sg(struct iommu_table *tbl, struct scatterlist *sglist,
                 int nelems, enum dma_data_direction direction);
 
 extern void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
-                dma_addr_t *dma_handle, gfp_t flag);
+                dma_addr_t *dma_handle, unsigned long mask, gfp_t flag);
 extern void iommu_free_coherent(struct iommu_table *tbl, size_t size,
                 void *vaddr, dma_addr_t dma_handle);
 extern dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
-                size_t size, enum dma_data_direction direction);
+                size_t size, unsigned long mask,
+                enum dma_data_direction direction);
 extern void iommu_unmap_single(struct iommu_table *tbl, dma_addr_t dma_handle,
                 size_t size, enum dma_data_direction direction);
 
diff --git a/include/asm-powerpc/machdep.h b/include/asm-powerpc/machdep.h
index 5ed847680754..0f9254c18914 100644
--- a/include/asm-powerpc/machdep.h
+++ b/include/asm-powerpc/machdep.h
@@ -253,7 +253,11 @@ extern struct machdep_calls *machine_id;
 
 #define __machine_desc __attribute__ ((__section__ (".machine.desc")))
 
-#define define_machine(name) struct machdep_calls mach_##name __machine_desc =
+#define define_machine(name)                                    \
+        extern struct machdep_calls mach_##name;                \
+        EXPORT_SYMBOL(mach_##name);                             \
+        struct machdep_calls mach_##name __machine_desc =
+
 #define machine_is(name) \
         ({ \
                 extern struct machdep_calls mach_##name \
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index c612f1a62772..34325e292596 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -303,8 +303,9 @@
 #define __NR_unshare            282
 #define __NR_splice             283
 #define __NR_tee                284
+#define __NR_vmsplice           285
 
-#define __NR_syscalls           285
+#define __NR_syscalls           286
 
 #ifdef __KERNEL__
 #define __NR__exit __NR_exit
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index 45feff893b8e..32a48f623e2b 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -271,7 +271,7 @@
 #define __NR_getsid             252
 #define __NR_fdatasync          253
 #define __NR_nfsservctl         254
-#define __NR_sys_sync_file_range 255
+#define __NR_sync_file_range    255
 #define __NR_clock_settime      256
 #define __NR_clock_gettime      257
 #define __NR_clock_getres       258
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index 597f6923a46e..ca80e8aca128 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -273,7 +273,7 @@
 #define __NR_getsid             252
 #define __NR_fdatasync          253
 #define __NR_nfsservctl         254
-#define __NR_sys_sync_file_range 255
+#define __NR_sync_file_range    255
 #define __NR_clock_settime      256
 #define __NR_clock_gettime      257
 #define __NR_clock_getres       258
diff --git a/include/asm-x86_64/unistd.h b/include/asm-x86_64/unistd.h
index 98c36eae567c..feb77cb8c044 100644
--- a/include/asm-x86_64/unistd.h
+++ b/include/asm-x86_64/unistd.h
@@ -615,8 +615,10 @@ __SYSCALL(__NR_splice, sys_splice)
 __SYSCALL(__NR_tee, sys_tee)
 #define __NR_sync_file_range    277
 __SYSCALL(__NR_sync_file_range, sys_sync_file_range)
+#define __NR_vmsplice           278
+__SYSCALL(__NR_vmsplice, sys_vmsplice)
 
-#define __NR_syscall_max __NR_sync_file_range
+#define __NR_syscall_max __NR_vmsplice
 
 #ifndef __NO_STUBS
 
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 40ccf8cc4239..01db7b88a2b1 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -829,19 +829,21 @@ static inline void netif_rx_schedule(struct net_device *dev)
                 __netif_rx_schedule(dev);
 }
 
-/* Try to reschedule poll. Called by dev->poll() after netif_rx_complete().
- * Do not inline this?
- */
+
+static inline void  __netif_rx_reschedule(struct net_device *dev, int undo)
+{
+        dev->quota += undo;
+        list_add_tail(&dev->poll_list, &__get_cpu_var(softnet_data).poll_list);
+        __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+}
+
+/* Try to reschedule poll. Called by dev->poll() after netif_rx_complete(). */
 static inline int netif_rx_reschedule(struct net_device *dev, int undo)
 {
         if (netif_rx_schedule_prep(dev)) {
                 unsigned long flags;
-
-                dev->quota += undo;
-
                 local_irq_save(flags);
-                list_add_tail(&dev->poll_list, &__get_cpu_var(softnet_data).poll_list);
-                __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+                __netif_rx_reschedule(dev, undo);
                 local_irq_restore(flags);
                 return 1;
         }
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index f6bdef82a322..38701454e197 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -361,7 +361,11 @@ struct compat_xt_entry_target
 
 struct compat_xt_counters
 {
+#if defined(CONFIG_X86_64) || defined(CONFIG_IA64)
         u_int32_t cnt[4];
+#else
+        u_int64_t cnt[2];
+#endif
 };
 
 struct compat_xt_counters_info
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index ef7f33c0be19..0008d4bd4059 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -61,4 +61,21 @@ void __free_pipe_info(struct pipe_inode_info *);
                                  /* from/to, of course */
 #define SPLICE_F_MORE   (0x04)  /* expect more data */
 
+/*
+ * Passed to the actors
+ */
+struct splice_desc {
+        unsigned int len, total_len;    /* current and remaining length */
+        unsigned int flags;             /* splice flags */
+        struct file *file;              /* file to read/write */
+        loff_t pos;                     /* file position */
+};
+
+typedef int (splice_actor)(struct pipe_inode_info *, struct pipe_buffer *,
+                           struct splice_desc *);
+
+extern ssize_t splice_from_pipe(struct pipe_inode_info *, struct file *,
+                                loff_t *, size_t, unsigned int,
+                                splice_actor *);
+
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c4619a428d9b..f8f234708b98 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -344,6 +344,13 @@ extern void	      skb_over_panic(struct sk_buff *skb, int len,
                                      void *here);
 extern void           skb_under_panic(struct sk_buff *skb, int len,
                                       void *here);
+extern void           skb_truesize_bug(struct sk_buff *skb);
+
+static inline void skb_truesize_check(struct sk_buff *skb)
+{
+        if (unlikely((int)skb->truesize < sizeof(struct sk_buff) + skb->len))
+                skb_truesize_bug(skb);
+}
 
 extern int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
                         int getfrag(void *from, char *to, int offset,
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index d3ebc0e68b2b..3996960fc565 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -574,6 +574,9 @@ asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
                            int fd_out, loff_t __user *off_out,
                            size_t len, unsigned int flags);
 
+asmlinkage long sys_vmsplice(int fd, const struct iovec __user *iov,
+                             unsigned long nr_segs, unsigned int flags);
+
 asmlinkage long sys_tee(int fdin, int fdout, size_t len, unsigned int flags);
 
 asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
diff --git a/include/net/ieee80211softmac.h b/include/net/ieee80211softmac.h
index b971d8c82bdd..b1ebfbae397f 100644
--- a/include/net/ieee80211softmac.h
+++ b/include/net/ieee80211softmac.h
@@ -96,10 +96,13 @@ struct ieee80211softmac_assoc_info {
          *
          * bssvalid is true if we found a matching network
          * and saved it's BSSID into the bssid above.
+         *
+         * bssfixed is used for SIOCSIWAP.
          */
         u8 static_essid:1,
            associating:1,
-           bssvalid:1;
+           bssvalid:1,
+           bssfixed:1;
 
         /* Scan retries remaining */
         int scan_retry;
@@ -267,8 +270,9 @@ extern void ieee80211softmac_stop(struct net_device *dev);
 #define IEEE80211SOFTMAC_EVENT_AUTH_FAILED              5
 #define IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT             6
 #define IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND  7
+#define IEEE80211SOFTMAC_EVENT_DISASSOCIATED            8
 /* keep this updated! */
-#define IEEE80211SOFTMAC_EVENT_LAST                     7
+#define IEEE80211SOFTMAC_EVENT_LAST                     8
 /*
  * If you want to be notified of certain events, you can call
  * ieee80211softmac_notify[_atomic] with
diff --git a/include/net/sock.h b/include/net/sock.h
index af2b0544586e..ff8b0dad7b0f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -454,6 +454,7 @@ static inline void sk_stream_set_owner_r(struct sk_buff *skb, struct sock *sk)
 
 static inline void sk_stream_free_skb(struct sock *sk, struct sk_buff *skb)
 {
+        skb_truesize_check(skb);
         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
         sk->sk_wmem_queued   -= skb->truesize;
         sk->sk_forward_alloc += skb->truesize;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index d2a7296c8251..b7f0388bd71c 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -836,7 +836,7 @@ static void migrate_hrtimers(int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit hrtimer_cpu_notify(struct notifier_block *self,
+static int hrtimer_cpu_notify(struct notifier_block *self,
                                         unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -860,7 +860,7 @@ static int __devinit hrtimer_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata hrtimers_nb = {
+static struct notifier_block hrtimers_nb = {
         .notifier_call = hrtimer_cpu_notify,
 };
 
diff --git a/kernel/profile.c b/kernel/profile.c
index 5a730fdb1a2c..68afe121e507 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -299,7 +299,7 @@ out:
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-static int __devinit profile_cpu_callback(struct notifier_block *info,
+static int profile_cpu_callback(struct notifier_block *info,
                                         unsigned long action, void *__cpu)
 {
         int node, cpu = (unsigned long)__cpu;
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 13458bbaa1be..6d32ff26f948 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -520,7 +520,7 @@ static void __devinit rcu_online_cpu(int cpu)
         tasklet_init(&per_cpu(rcu_tasklet, cpu), rcu_process_callbacks, 0UL);
 }
 
-static int __devinit rcu_cpu_notify(struct notifier_block *self, 
+static int rcu_cpu_notify(struct notifier_block *self,
                                 unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -537,7 +537,7 @@ static int __devinit rcu_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata rcu_nb = {
+static struct notifier_block rcu_nb = {
         .notifier_call  = rcu_cpu_notify,
 };
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 365f0b90b4de..4c64f85698ae 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -4814,7 +4814,7 @@ static int migration_call(struct notifier_block *nfb, unsigned long action,
 /* Register at highest priority so that task migration (migrate_all_tasks)
  * happens before everything else.
  */
-static struct notifier_block __devinitdata migration_notifier = {
+static struct notifier_block migration_notifier = {
         .notifier_call = migration_call,
         .priority = 10
 };
diff --git a/kernel/softirq.c b/kernel/softirq.c
index ec8fed42a86f..336f92d64e2e 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -446,7 +446,7 @@ static void takeover_tasklets(unsigned int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit cpu_callback(struct notifier_block *nfb,
+static int cpu_callback(struct notifier_block *nfb,
                                   unsigned long action,
                                   void *hcpu)
 {
@@ -484,7 +484,7 @@ static int __devinit cpu_callback(struct notifier_block *nfb,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata cpu_nfb = {
+static struct notifier_block cpu_nfb = {
         .notifier_call = cpu_callback
 };
 
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index ced91e1ff564..14c7faf02909 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -104,7 +104,7 @@ static int watchdog(void * __bind_cpu)
 /*
  * Create/destroy watchdog threads as CPUs come and go:
  */
-static int __devinit
+static int
 cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
         int hotcpu = (unsigned long)hcpu;
@@ -140,7 +140,7 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata cpu_nfb = {
+static struct notifier_block cpu_nfb = {
         .notifier_call = cpu_callback
 };
 
diff --git a/kernel/timer.c b/kernel/timer.c
index 883773788836..67eaf0f54096 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1314,7 +1314,7 @@ static void __devinit migrate_timers(int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-static int __devinit timer_cpu_notify(struct notifier_block *self, 
+static int timer_cpu_notify(struct notifier_block *self,
                                 unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
@@ -1334,7 +1334,7 @@ static int __devinit timer_cpu_notify(struct notifier_block *self,
         return NOTIFY_OK;
 }
 
-static struct notifier_block __devinitdata timers_nb = {
+static struct notifier_block timers_nb = {
         .notifier_call  = timer_cpu_notify,
 };
 
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index e9e464a90376..880fb415a8f6 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -547,7 +547,7 @@ static void take_over_work(struct workqueue_struct *wq, unsigned int cpu)
 }
 
 /* We're holding the cpucontrol mutex here */
-static int __devinit workqueue_cpu_callback(struct notifier_block *nfb,
+static int workqueue_cpu_callback(struct notifier_block *nfb,
                                   unsigned long action,
                                   void *hcpu)
 {
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 123c60586740..ea77c999047e 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1962,7 +1962,7 @@ static inline void free_zone_pagesets(int cpu)
         }
 }
 
-static int __cpuinit pageset_cpuup_callback(struct notifier_block *nfb,
+static int pageset_cpuup_callback(struct notifier_block *nfb,
                 unsigned long action,
                 void *hcpu)
 {
diff --git a/mm/shmem.c b/mm/shmem.c
index 37eaf42ed2c6..4c5e68e4e9ae 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -46,6 +46,8 @@
 #include <linux/mempolicy.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/migrate.h>
+
 #include <asm/uaccess.h>
 #include <asm/div64.h>
 #include <asm/pgtable.h>
@@ -2173,6 +2175,7 @@ static struct address_space_operations shmem_aops = {
         .prepare_write  = shmem_prepare_write,
         .commit_write   = simple_commit_write,
 #endif
+        .migratepage    = migrate_page,
 };
 
 static struct file_operations shmem_file_operations = {
diff --git a/mm/slab.c b/mm/slab.c
index e6ef9bd52335..af5c5237e11a 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1036,7 +1036,7 @@ static inline void free_alien_cache(struct array_cache **ac_ptr)
 
 #endif
 
-static int __devinit cpuup_callback(struct notifier_block *nfb,
+static int cpuup_callback(struct notifier_block *nfb,
                                     unsigned long action, void *hcpu)
 {
         long cpu = (long)hcpu;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index acdf001d6941..4649a63a8cb6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1328,7 +1328,7 @@ repeat:
    not required for correctness.  So if the last cpu in a node goes
    away, we get changed to run anywhere: as the first one comes back,
    restore their cpu bindings. */
-static int __devinit cpu_callback(struct notifier_block *nfb,
+static int cpu_callback(struct notifier_block *nfb,
                                   unsigned long action, void *hcpu)
 {
         pg_data_t *pgdat;
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 2d24fb400e0c..56f3aa47e758 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -16,6 +16,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
 
@@ -29,10 +30,15 @@ static inline int should_deliver(const struct net_bridge_port *p,
         return 1;
 }
 
+static inline unsigned packet_length(const struct sk_buff *skb)
+{
+        return skb->len - (skb->protocol == htons(ETH_P_8021Q) ? VLAN_HLEN : 0);
+}
+
 int br_dev_queue_push_xmit(struct sk_buff *skb)
 {
         /* drop mtu oversized packets except tso */
-        if (skb->len > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
+        if (packet_length(skb) > skb->dev->mtu && !skb_shinfo(skb)->tso_size)
                 kfree_skb(skb);
         else {
 #ifdef CONFIG_BRIDGE_NETFILTER
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 84b9af76f0a2..3a13ed643459 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -831,7 +831,7 @@ static int translate_table(struct ebt_replace *repl,
                         return -ENOMEM;
                 for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
-                           vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
+                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
                         if (!newinfo->chainstack[i]) {
                                 while (i)
                                         vfree(newinfo->chainstack[--i]);
@@ -841,8 +841,7 @@ static int translate_table(struct ebt_replace *repl,
                         }
                 }
 
-                cl_s = (struct ebt_cl_stack *)
-                   vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
+                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
                 if (!cl_s)
                         return -ENOMEM;
                 i = 0; /* the i'th udc */
@@ -944,8 +943,7 @@ static int do_replace(void __user *user, unsigned int len)
 
         countersize = COUNTER_OFFSET(tmp.nentries) * 
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         if (!newinfo)
                 return -ENOMEM;
 
@@ -967,8 +965,7 @@ static int do_replace(void __user *user, unsigned int len)
         /* the user wants counters back
            the check on the size is done later, when we have the lock */
         if (tmp.num_counters) {
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
                 if (!counterstmp) {
                         ret = -ENOMEM;
                         goto free_entries;
@@ -1148,8 +1145,7 @@ int ebt_register_table(struct ebt_table *table)
 
         countersize = COUNTER_OFFSET(table->table->nentries) *
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         ret = -ENOMEM;
         if (!newinfo)
                 return -ENOMEM;
@@ -1247,8 +1243,7 @@ static int update_counters(void __user *user, unsigned int len)
         if (hlp.num_counters == 0)
                 return -EINVAL;
 
-        if ( !(tmp = (struct ebt_counter *)
-           vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
+        if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
                 MEMPRINT("Update_counters && nomemory\n");
                 return -ENOMEM;
         }
@@ -1377,8 +1372,7 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                         BUGPRINT("Num_counters wrong\n");
                         return -EINVAL;
                 }
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(nentries * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(nentries * sizeof(*counterstmp));
                 if (!counterstmp) {
                         MEMPRINT("Couldn't copy counters, out of memory\n");
                         return -ENOMEM;
diff --git a/net/core/dev.c b/net/core/dev.c
index 83231a27ae02..3bad1afc89fa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2698,7 +2698,8 @@ int dev_ioctl(unsigned int cmd, void __user *arg)
                                 /* If command is `set a parameter', or
                                  * `get the encoding parameters', check if
                                  * the user has the right to do it */
-                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE) {
+                                if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE
+                                    || cmd == SIOCGIWENCODEEXT) {
                                         if (!capable(CAP_NET_ADMIN))
                                                 return -EPERM;
                                 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09464fa8d72f..fb3770f9c094 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -112,6 +112,14 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
         BUG();
 }
 
+void skb_truesize_bug(struct sk_buff *skb)
+{
+        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+               "len=%u, sizeof(sk_buff)=%Zd\n",
+               skb->truesize, skb->len, sizeof(struct sk_buff));
+}
+EXPORT_SYMBOL(skb_truesize_bug);
+
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
  *      'private' fields and also do memory statistics to find all the
  *      [BEEP] leaks.
diff --git a/net/core/stream.c b/net/core/stream.c
index 35e25259fd95..e9489696f694 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -176,6 +176,7 @@ void sk_stream_rfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
 
+        skb_truesize_check(skb);
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
         sk->sk_forward_alloc += skb->truesize;
 }
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 81d6995fcfdb..d2bc72d318f7 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -1726,6 +1726,14 @@ int wireless_rtnetlink_get(struct net_device *	dev,
         if(!IW_IS_GET(request->cmd))
                 return -EOPNOTSUPP;
 
+        /* If command is `get the encoding parameters', check if
+         * the user has the right to do it */
+        if (request->cmd == SIOCGIWENCODE ||
+            request->cmd == SIOCGIWENCODEEXT) {
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        }
+
         /* Special cases */
         if(request->cmd == SIOCGIWSTATS)
                 /* Get Wireless Stats */
diff --git a/net/ieee80211/softmac/Kconfig b/net/ieee80211/softmac/Kconfig
index 6cd9f3427be6..f2a27cc6ecb1 100644
--- a/net/ieee80211/softmac/Kconfig
+++ b/net/ieee80211/softmac/Kconfig
@@ -1,6 +1,7 @@
 config IEEE80211_SOFTMAC
         tristate "Software MAC add-on to the IEEE 802.11 networking stack"
         depends on IEEE80211 && EXPERIMENTAL
+        select WIRELESS_EXT
         ---help---
         This option enables the hardware independent software MAC addon
         for the IEEE 802.11 networking stack.
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index be61de78dfa4..fb79ce7d6439 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -101,6 +101,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac, u16 reason)
         /* Do NOT clear bssvalid as that will break ieee80211softmac_assoc_work! */
         mac->associated = 0;
         mac->associnfo.associating = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         spin_unlock_irqrestore(&mac->lock, flags);
 }
 
@@ -143,6 +144,12 @@ network_matches_request(struct ieee80211softmac_device *mac, struct ieee80211_ne
         if (!we_support_all_basic_rates(mac, net->rates_ex, net->rates_ex_len))
                 return 0;
 
+        /* assume that users know what they're doing ...
+         * (note we don't let them select a net we're incompatible with) */
+        if (mac->associnfo.bssfixed) {
+                return !memcmp(mac->associnfo.bssid, net->bssid, ETH_ALEN);
+        }
+
         /* if 'ANY' network requested, take any that doesn't have privacy enabled */
         if (mac->associnfo.req_essid.len == 0 
             && !(net->capability & WLAN_CAPABILITY_PRIVACY))
@@ -175,7 +182,7 @@ ieee80211softmac_assoc_work(void *d)
                 ieee80211softmac_disassoc(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
         /* try to find the requested network in our list, if we found one already */
-        if (mac->associnfo.bssvalid)
+        if (mac->associnfo.bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
         
         /* Search the ieee80211 networks for this network if we didn't find it by bssid,
@@ -240,19 +247,25 @@ ieee80211softmac_assoc_work(void *d)
                         if (ieee80211softmac_start_scan(mac))
                                 dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
                         return;
-                }
-                else {
+                } else {
                         spin_lock_irqsave(&mac->lock, flags);
                         mac->associnfo.associating = 0;
                         mac->associated = 0;
                         spin_unlock_irqrestore(&mac->lock, flags);
 
                         dprintk(KERN_INFO PFX "Unable to find matching network after scan!\n");
+                        /* reset the retry counter for the next user request since we
+                         * break out and don't reschedule ourselves after this point. */
+                        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND, NULL);
                         return;
                 }
         }
-        
+
+        /* reset the retry counter for the next user request since we
+         * now found a net and will try to associate to it, but not
+         * schedule this function again. */
+        mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
         mac->associnfo.bssvalid = 1;
         memcpy(mac->associnfo.bssid, found->bssid, ETH_ALEN);
         /* copy the ESSID for displaying it */
@@ -373,6 +386,7 @@ ieee80211softmac_handle_disassoc(struct net_device * dev,
         spin_lock_irqsave(&mac->lock, flags);
         mac->associnfo.bssvalid = 0;
         mac->associated = 0;
+        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_DISASSOCIATED, NULL);
         schedule_work(&mac->associnfo.work);
         spin_unlock_irqrestore(&mac->lock, flags);
         
@@ -391,6 +405,7 @@ ieee80211softmac_handle_reassoc_req(struct net_device * dev,
                 dprintkl(KERN_INFO PFX "reassoc request from unknown network\n");
                 return 0;
         }
-        ieee80211softmac_assoc(mac, network);
+        schedule_work(&mac->associnfo.work);
+
         return 0;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c
index 0a52bbda1e4c..8cc8f3f0f8e7 100644
--- a/net/ieee80211/softmac/ieee80211softmac_event.c
+++ b/net/ieee80211/softmac/ieee80211softmac_event.c
@@ -67,6 +67,7 @@ static char *event_descriptions[IEEE80211SOFTMAC_EVENT_LAST+1] = {
         "authenticating failed",
         "authenticating timed out",
         "associating failed because no suitable network was found",
+        "disassociated",
 };
 
 
@@ -128,13 +129,42 @@ void
 ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int event, void *event_ctx)
 {
         struct ieee80211softmac_event *eventptr, *tmp;
-        union iwreq_data wrqu;
-        char *msg;
+        struct ieee80211softmac_network *network;
         
         if (event >= 0) {
-                msg = event_descriptions[event];
-                wrqu.data.length = strlen(msg);
-                wireless_send_event(mac->dev, IWEVCUSTOM, &wrqu, msg);
+                union iwreq_data wrqu;
+                int we_event;
+                char *msg = NULL;
+
+                switch(event) {
+                case IEEE80211SOFTMAC_EVENT_ASSOCIATED:
+                        network = (struct ieee80211softmac_network *)event_ctx;
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memcpy(wrqu.ap_addr.sa_data, &network->bssid[0], ETH_ALEN);
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_DISASSOCIATED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        we_event = SIOCGIWAP;
+                        break;
+                case IEEE80211SOFTMAC_EVENT_SCAN_FINISHED:
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        memset(&wrqu, '\0', sizeof (union iwreq_data));
+                        we_event = SIOCGIWSCAN;
+                        break;
+                default:
+                        msg = event_descriptions[event];
+                        wrqu.data.length = strlen(msg);
+                        we_event = IWEVCUSTOM;
+                        break;
+                }
+                wireless_send_event(mac->dev, we_event, &wrqu, msg);
         }
 
         if (!list_empty(&mac->events))
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index febc51dbb412..cc6cd56c85b1 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -180,9 +180,21 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
         ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
 
         /* Fill in capability Info */
-        (*pkt)->capability = (mac->ieee->iw_mode == IW_MODE_MASTER) || (mac->ieee->iw_mode == IW_MODE_INFRA) ?
-                cpu_to_le16(WLAN_CAPABILITY_ESS) :
-                cpu_to_le16(WLAN_CAPABILITY_IBSS);
+        switch (mac->ieee->iw_mode) {
+        case IW_MODE_INFRA:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
+                break;
+        case IW_MODE_ADHOC:
+                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                break;
+        case IW_MODE_AUTO:
+                (*pkt)->capability = net->capabilities & (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
+                break;
+        default:
+                /* bleh. we don't ever go to these modes */
+                printk(KERN_ERR PFX "invalid iw_mode!\n");
+                break;
+        }
         /* Need to add this
         (*pkt)->capability |= mac->ieee->short_slot ? 
                         cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index 60f06a31f0d1..be83bdc1644a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -45,6 +45,8 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
         softmac->ieee->handle_disassoc = ieee80211softmac_handle_disassoc;
         softmac->scaninfo = NULL;
 
+        softmac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
+
         /* TODO: initialise all the other callbacks in the ieee struct
          *       (once they're written)
          */
diff --git a/net/ieee80211/softmac/ieee80211softmac_scan.c b/net/ieee80211/softmac/ieee80211softmac_scan.c
index bb9ab8b45d09..2b9e7edfa3ce 100644
--- a/net/ieee80211/softmac/ieee80211softmac_scan.c
+++ b/net/ieee80211/softmac/ieee80211softmac_scan.c
@@ -47,6 +47,7 @@ ieee80211softmac_start_scan(struct ieee80211softmac_device *sm)
         sm->scanning = 1;
         spin_unlock_irqrestore(&sm->lock, flags);
 
+        netif_tx_disable(sm->ieee->dev);
         ret = sm->start_scan(sm->dev);
         if (ret) {
                 spin_lock_irqsave(&sm->lock, flags);
@@ -239,6 +240,7 @@ void ieee80211softmac_scan_finished(struct ieee80211softmac_device *sm)
                 if (net)
                         sm->set_channel(sm->dev, net->channel);
         }
+        netif_wake_queue(sm->ieee->dev);
         ieee80211softmac_call_events(sm, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, NULL);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_scan_finished);
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index b559aa9b5507..27edb2b5581a 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -27,7 +27,8 @@
 #include "ieee80211softmac_priv.h"
 
 #include <net/iw_handler.h>
-
+/* for is_broadcast_ether_addr and is_zero_ether_addr */
+#include <linux/etherdevice.h>
 
 int
 ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
@@ -41,13 +42,23 @@ ieee80211softmac_wx_trigger_scan(struct net_device *net_dev,
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_trigger_scan);
 
 
+/* if we're still scanning, return -EAGAIN so that userspace tools
+ * can get the complete scan results, otherwise return 0. */
 int
 ieee80211softmac_wx_get_scan_results(struct net_device *net_dev,
                                      struct iw_request_info *info,
                                      union iwreq_data *data,
                                      char *extra)
 {
+        unsigned long flags;
         struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
+
+        spin_lock_irqsave(&sm->lock, flags);
+        if (sm->scanning) {
+                spin_unlock_irqrestore(&sm->lock, flags);
+                return -EAGAIN;
+        }
+        spin_unlock_irqrestore(&sm->lock, flags);
         return ieee80211_wx_get_scan(sm->ieee, info, data, extra);
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_scan_results);
@@ -73,7 +84,6 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                         sm->associnfo.static_essid = 1;
                 }
         }
-        sm->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
 
         /* set our requested ESSID length.
          * If applicable, we have already copied the data in */
@@ -300,8 +310,6 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                             char *extra)
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(net_dev);
-        static const unsigned char any[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-        static const unsigned char off[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
         unsigned long flags;
 
         /* sanity check */
@@ -310,10 +318,17 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
         }
 
         spin_lock_irqsave(&mac->lock, flags);
-        if (!memcmp(any, data->ap_addr.sa_data, ETH_ALEN) ||
-            !memcmp(off, data->ap_addr.sa_data, ETH_ALEN)) {
-                schedule_work(&mac->associnfo.work);
-                goto out;
+        if (is_broadcast_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is not to be fixed any longer,
+                 * and we should reassociate to the best AP. */
+                mac->associnfo.bssfixed = 0;
+                /* force reassociation */
+                mac->associnfo.bssvalid = 0;
+                if (mac->associated)
+                        schedule_work(&mac->associnfo.work);
+        } else if (is_zero_ether_addr(data->ap_addr.sa_data)) {
+                /* the bssid we have is no longer fixed */
+                mac->associnfo.bssfixed = 0;
         } else {
                 if (!memcmp(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN)) {
                         if (mac->associnfo.associating || mac->associated) {
@@ -323,12 +338,14 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                 } else {
                         /* copy new value in data->ap_addr.sa_data to bssid */
                         memcpy(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN);
-                }       
+                }
+                /* tell the other code that this bssid should be used no matter what */
+                mac->associnfo.bssfixed = 1;
                 /* queue associate if new bssid or (old one again and not associated) */
                 schedule_work(&mac->associnfo.work);
         }
 
-out:
+ out:
         spin_unlock_irqrestore(&mac->lock, flags);
         return 0;
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index c60fd5c4ea1e..3d560dec63ab 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -345,7 +345,7 @@ config IP_NF_TARGET_LOG
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support (OBSOLETE)"
+        tristate "ULOG target support"
         depends on IP_NF_IPTABLES
         ---help---
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 44df1db726a3..a28ae593b976 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -533,6 +533,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
         int nsize, old_factor;
+        int nlen;
         u16 flags;
 
         BUG_ON(len > skb->len);
@@ -552,8 +553,10 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         if (buff == NULL)
                 return -ENOMEM; /* We'll just try again later. */
 
-        buff->truesize = skb->len - len;
-        skb->truesize -= buff->truesize;
+        sk_charge_skb(sk, buff);
+        nlen = skb->len - len - nsize;
+        buff->truesize += nlen;
+        skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
         TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
@@ -1039,7 +1042,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         if (unlikely(buff == NULL))
                 return -ENOMEM;
 
-        buff->truesize = nlen;
+        sk_charge_skb(sk, buff);
+        buff->truesize += nlen;
         skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 642b4b11464f..0a673038344f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -288,19 +288,6 @@ ip6t_do_table(struct sk_buff **pskb,
         table_base = (void *)private->entries[smp_processor_id()];
         e = get_entry(table_base, private->hook_entry[hook]);
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        /* Check noone else using our table */
-        if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac
-            && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {
-                printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",
-                       smp_processor_id(),
-                       table->name,
-                       &((struct ip6t_entry *)table_base)->comefrom,
-                       ((struct ip6t_entry *)table_base)->comefrom);
-        }
-        ((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;
-#endif
-
         /* For return from builtin chain */
         back = get_entry(table_base, private->underflow[hook]);
 
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 8f3addf0724c..d62e0f9b9da3 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -118,7 +118,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                 u16 pdulen = eth_hdr(skb)->h_proto,
                     data_size = ntohs(pdulen) - llc_len;
 
-                skb_trim(skb, data_size);
+                if (unlikely(pskb_trim_rcsum(skb, data_size)))
+                        return 0;
         }
         return 1;
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e581190fb6c3..f9b83f91371a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -178,9 +178,6 @@ static struct {
         /* allocated slab cache + modules which uses this slab cache */
         int use;
 
-        /* Initialization */
-        int (*init_conntrack)(struct nf_conn *, u_int32_t);
-
 } nf_ct_cache[NF_CT_F_NUM];
 
 /* protect members of nf_ct_cache except of "use" */
@@ -208,10 +205,8 @@ nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol)
 
         preempt_disable();
         p = __nf_ct_proto_find(l3proto, protocol);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_protocol;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_protocol;
         preempt_enable();
         
         return p;
@@ -229,10 +224,8 @@ nf_ct_l3proto_find_get(u_int16_t l3proto)
 
         preempt_disable();
         p = __nf_ct_l3proto_find(l3proto);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_l3proto;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_l3proto;
         preempt_enable();
 
         return p;
diff --git a/net/netfilter/nf_conntrack_l3proto_generic.c b/net/netfilter/nf_conntrack_l3proto_generic.c
index 7de4f06c63c5..3fc58e454d4e 100644
--- a/net/netfilter/nf_conntrack_l3proto_generic.c
+++ b/net/netfilter/nf_conntrack_l3proto_generic.c
@@ -94,5 +94,4 @@ struct nf_conntrack_l3proto nf_conntrack_generic_l3proto = {
         .print_conntrack = generic_print_conntrack,
         .prepare         = generic_prepare,
         .get_features    = generic_get_features,
-        .me              = THIS_MODULE,
 };
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 00cf0a4f4d92..17abf60f9570 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -529,6 +529,7 @@ int xt_register_table(struct xt_table *table,
 
         /* Simplifies replace_table code. */
         table->private = bootstrap;
+        rwlock_init(&table->lock);
         if (!xt_replace_table(table, 0, newinfo, &ret))
                 goto unlock;
 
@@ -538,7 +539,6 @@ int xt_register_table(struct xt_table *table,
         /* save number of initial entries */
         private->initial_entries = private->number;
 
-        rwlock_init(&table->lock);
         list_prepend(&xt[table->af].tables, table);
 
         ret = 0;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 6056d20ef429..37640c6fc014 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -69,6 +69,11 @@ ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
         DPRINTK("ipt_init_target: found %s\n", target->name);
         t->u.kernel.target = target;
 
+        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
+                              table, hook, 0, 0);
+        if (ret)
+                return ret;
+
         if (t->u.kernel.target->checkentry
             && !t->u.kernel.target->checkentry(table, NULL,
                                                t->u.kernel.target, t->data,
diff --git a/net/socket.c b/net/socket.c
index 23898f45f713..0ce12dfc7a71 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -490,6 +490,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
         struct file *file;
         struct socket *sock;
 
+        *err = -EBADF;
         file = fget_light(fd, fput_needed);
         if (file) {
                 sock = sock_from_file(file, err);
diff --git a/sound/oss/ad1889.c b/sound/oss/ad1889.c
index 54dabf862802..a4ca7569e700 100644
--- a/sound/oss/ad1889.c
+++ b/sound/oss/ad1889.c
@@ -75,7 +75,7 @@ static inline void ad1889_set_wav_rate(ad1889_dev_t *dev, int rate)
 
         DBG("Setting WAV rate to %d\n", rate);
         dev->state[AD_WAV_STATE].dmabuf.rate = rate;
-        AD1889_WRITEW(dev, AD_DSWAS, rate);
+        AD1889_WRITEW(dev, AD_DS_WAS, rate);
 
         /* Cycle the DAC to enable the new rate */
         ac97_codec->codec_write(dev->ac97_codec, AC97_POWER_CONTROL, 0x0200);
@@ -89,14 +89,14 @@ static inline void ad1889_set_wav_fmt(ad1889_dev_t *dev, int fmt)
 
         DBG("Setting WAV format to 0x%x\n", fmt);
 
-        tmp = AD1889_READW(ad1889_dev, AD_DSWSMC);
+        tmp = AD1889_READW(ad1889_dev, AD_DS_WSMC);
         if (fmt & AFMT_S16_LE) {
                 //tmp |= 0x0100; /* set WA16 */
                 tmp |= 0x0300; /* set WA16 stereo */
         } else if (fmt & AFMT_U8) {
                 tmp &= ~0x0100; /* clear WA16 */
         } 
-        AD1889_WRITEW(ad1889_dev, AD_DSWSMC, tmp);
+        AD1889_WRITEW(ad1889_dev, AD_DS_WSMC, tmp);
 }
 
 static inline void ad1889_set_adc_fmt(ad1889_dev_t *dev, int fmt)
@@ -105,13 +105,13 @@ static inline void ad1889_set_adc_fmt(ad1889_dev_t *dev, int fmt)
 
         DBG("Setting ADC format to 0x%x\n", fmt);
 
-        tmp = AD1889_READW(ad1889_dev, AD_DSRAMC);
+        tmp = AD1889_READW(ad1889_dev, AD_DS_RAMC);
         if (fmt & AFMT_S16_LE) {
                 tmp |= 0x0100; /* set WA16 */
         } else if (fmt & AFMT_U8) {
                 tmp &= ~0x0100; /* clear WA16 */
         } 
-        AD1889_WRITEW(ad1889_dev, AD_DSRAMC, tmp);
+        AD1889_WRITEW(ad1889_dev, AD_DS_RAMC, tmp);
 }
 
 static void ad1889_start_wav(ad1889_state_t *state)
@@ -145,21 +145,21 @@ static void ad1889_start_wav(ad1889_state_t *state)
             dmabuf->rd_ptr, dmabuf->dma_len);
 
         /* load up the current register set */
-        AD1889_WRITEL(ad1889_dev, AD_DMAWAVCC, cnt);
-        AD1889_WRITEL(ad1889_dev, AD_DMAWAVICC, cnt);
-        AD1889_WRITEL(ad1889_dev, AD_DMAWAVCA, dmabuf->dma_handle);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_WAVCC, cnt);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_WAVICC, cnt);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_WAVCA, dmabuf->dma_handle);
 
         /* TODO: for now we load the base registers with the same thing */
-        AD1889_WRITEL(ad1889_dev, AD_DMAWAVBC, cnt);
-        AD1889_WRITEL(ad1889_dev, AD_DMAWAVIBC, cnt);
-        AD1889_WRITEL(ad1889_dev, AD_DMAWAVBA, dmabuf->dma_handle);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_WAVBC, cnt);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_WAVIBC, cnt);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_WAVBA, dmabuf->dma_handle);
 
         /* and we're off to the races... */
-        AD1889_WRITEL(ad1889_dev, AD_DMACHSS, 0x8);
-        tmp = AD1889_READW(ad1889_dev, AD_DSWSMC);
+        AD1889_WRITEL(ad1889_dev, AD_DMA_CHSS, 0x8);
+        tmp = AD1889_READW(ad1889_dev, AD_DS_WSMC);
         tmp |= 0x0400; /* set WAEN */
-        AD1889_WRITEW(ad1889_dev, AD_DSWSMC, tmp);
-        (void) AD1889_READW(ad1889_dev, AD_DSWSMC); /* flush posted PCI write */
+        AD1889_WRITEW(ad1889_dev, AD_DS_WSMC, tmp);
+        (void) AD1889_READW(ad1889_dev, AD_DS_WSMC); /* flush posted PCI write */
 
         dmabuf->enable |= DAC_RUNNING;
 
@@ -179,10 +179,10 @@ static void ad1889_stop_wav(ad1889_state_t *state)
                 u16 tmp;
                 unsigned long cnt = dmabuf->dma_len;
 
-                tmp = AD1889_READW(ad1889_dev, AD_DSWSMC);
+                tmp = AD1889_READW(ad1889_dev, AD_DS_WSMC);
                 tmp &= ~0x0400; /* clear WAEN */
-                AD1889_WRITEW(ad1889_dev, AD_DSWSMC, tmp);
-                (void) AD1889_READW(ad1889_dev, AD_DSWSMC); /* flush posted PCI write */
+                AD1889_WRITEW(ad1889_dev, AD_DS_WSMC, tmp);
+                (void) AD1889_READW(ad1889_dev, AD_DS_WSMC); /* flush posted PCI write */
                 pci_unmap_single(ad1889_dev->pci, dmabuf->dma_handle, 
                                 cnt, PCI_DMA_TODEVICE);
 
@@ -211,7 +211,7 @@ static void ad1889_startstop_adc(ad1889_state_t *state, int start)
 
         spin_lock_irqsave(&state->card->lock, flags);
         
-        tmp = AD1889_READW(ad1889_dev, AD_DSRAMC);
+        tmp = AD1889_READW(ad1889_dev, AD_DS_RAMC);
         if (start) {
                 state->dmabuf.enable |= ADC_RUNNING;
                 tmp |= 0x0004; /* set ADEN */
@@ -219,7 +219,7 @@ static void ad1889_startstop_adc(ad1889_state_t *state, int start)
                 state->dmabuf.enable &= ~ADC_RUNNING;
                 tmp &= ~0x0004; /* clear ADEN */
         }
-        AD1889_WRITEW(ad1889_dev, AD_DSRAMC, tmp);
+        AD1889_WRITEW(ad1889_dev, AD_DS_RAMC, tmp);
 
         spin_unlock_irqrestore(&state->card->lock, flags);
 }
@@ -301,53 +301,53 @@ static int ad1889_read_proc (char *page, char **start, off_t off,
         int len, i;
         ad1889_dev_t *dev = data;
         ad1889_reg_t regs[] = {
-                { "WSMC", AD_DSWSMC, 16 },
-                { "RAMC", AD_DSRAMC, 16 },
-                { "WADA", AD_DSWADA, 16 },
-                { "SYDA", AD_DSSYDA, 16 },
-                { "WAS", AD_DSWAS, 16 },
-                { "RES", AD_DSRES, 16 },
-                { "CCS", AD_DSCCS, 16 },
-                { "ADCBA", AD_DMAADCBA, 32 },
-                { "ADCCA", AD_DMAADCCA, 32 },
-                { "ADCBC", AD_DMAADCBC, 32 },
-                { "ADCCC", AD_DMAADCCC, 32 },
-                { "ADCIBC", AD_DMAADCIBC, 32 },
-                { "ADCICC", AD_DMAADCICC, 32 },
-                { "ADCCTRL", AD_DMAADCCTRL, 16 },
-                { "WAVBA", AD_DMAWAVBA, 32 },
-                { "WAVCA", AD_DMAWAVCA, 32 },
-                { "WAVBC", AD_DMAWAVBC, 32 },
-                { "WAVCC", AD_DMAWAVCC, 32 },
-                { "WAVIBC", AD_DMAWAVIBC, 32 },
-                { "WAVICC", AD_DMAWAVICC, 32 },
-                { "WAVCTRL", AD_DMAWAVCTRL, 16 },
-                { "DISR", AD_DMADISR, 32 },
-                { "CHSS", AD_DMACHSS, 32 },
-                { "IPC", AD_GPIOIPC, 16 },
-                { "OP", AD_GPIOOP, 16 },
-                { "IP", AD_GPIOIP, 16 },
-                { "ACIC", AD_ACIC, 16 },
-                { "AC97_RESET", 0x100 + AC97_RESET, 16 },
-                { "AC97_MASTER_VOL_STEREO", 0x100 + AC97_MASTER_VOL_STEREO, 16 },
-                { "AC97_HEADPHONE_VOL", 0x100 + AC97_HEADPHONE_VOL, 16 },
-                { "AC97_MASTER_VOL_MONO", 0x100 + AC97_MASTER_VOL_MONO, 16 },
-                { "AC97_MASTER_TONE", 0x100 + AC97_MASTER_TONE, 16 },
-                { "AC97_PCBEEP_VOL", 0x100 + AC97_PCBEEP_VOL, 16 },
-                { "AC97_PHONE_VOL", 0x100 + AC97_PHONE_VOL, 16 },
-                { "AC97_MIC_VOL", 0x100 + AC97_MIC_VOL, 16 },
-                { "AC97_LINEIN_VOL", 0x100 + AC97_LINEIN_VOL, 16 },
-                { "AC97_CD_VOL", 0x100 + AC97_CD_VOL, 16 },
-                { "AC97_VIDEO_VOL", 0x100 + AC97_VIDEO_VOL, 16 },
-                { "AC97_AUX_VOL", 0x100 + AC97_AUX_VOL, 16 },
-                { "AC97_PCMOUT_VOL", 0x100 + AC97_PCMOUT_VOL, 16 },
-                { "AC97_RECORD_SELECT", 0x100 + AC97_RECORD_SELECT, 16 },
-                { "AC97_RECORD_GAIN", 0x100 + AC97_RECORD_GAIN, 16 },
-                { "AC97_RECORD_GAIN_MIC", 0x100 + AC97_RECORD_GAIN_MIC, 16 },
-                { "AC97_GENERAL_PURPOSE", 0x100 + AC97_GENERAL_PURPOSE, 16 },
-                { "AC97_3D_CONTROL", 0x100 + AC97_3D_CONTROL, 16 },
-                { "AC97_MODEM_RATE", 0x100 + AC97_MODEM_RATE, 16 },
-                { "AC97_POWER_CONTROL", 0x100 + AC97_POWER_CONTROL, 16 },
+                { "WSMC", AD_DS_WSMC, 16 },
+                { "RAMC", AD_DS_RAMC, 16 },
+                { "WADA", AD_DS_WADA, 16 },
+                { "SYDA", AD_DS_SYDA, 16 },
+                { "WAS", AD_DS_WAS, 16 },
+                { "RES", AD_DS_RES, 16 },
+                { "CCS", AD_DS_CCS, 16 },
+                { "ADCBA", AD_DMA_ADCBA, 32 },
+                { "ADCCA", AD_DMA_ADCCA, 32 },
+                { "ADCBC", AD_DMA_ADCBC, 32 },
+                { "ADCCC", AD_DMA_ADCCC, 32 },
+                { "ADCIBC", AD_DMA_ADCIBC, 32 },
+                { "ADCICC", AD_DMA_ADCICC, 32 },
+                { "ADCCTRL", AD_DMA_ADCCTRL, 16 },
+                { "WAVBA", AD_DMA_WAVBA, 32 },
+                { "WAVCA", AD_DMA_WAVCA, 32 },
+                { "WAVBC", AD_DMA_WAVBC, 32 },
+                { "WAVCC", AD_DMA_WAVCC, 32 },
+                { "WAVIBC", AD_DMA_WAVIBC, 32 },
+                { "WAVICC", AD_DMA_WAVICC, 32 },
+                { "WAVCTRL", AD_DMA_WAVCTRL, 16 },
+                { "DISR", AD_DMA_DISR, 32 },
+                { "CHSS", AD_DMA_CHSS, 32 },
+                { "IPC", AD_GPIO_IPC, 16 },
+                { "OP", AD_GPIO_OP, 16 },
+                { "IP", AD_GPIO_IP, 16 },
+                { "ACIC", AD_AC97_ACIC, 16 },
+                { "AC97_RESET", AD_AC97_BASE + AC97_RESET, 16 },
+                { "AC97_MASTER_VOL_STEREO", AD_AC97_BASE + AC97_MASTER_VOL_STEREO, 16 },
+                { "AC97_HEADPHONE_VOL", AD_AC97_BASE + AC97_HEADPHONE_VOL, 16 },
+                { "AC97_MASTER_VOL_MONO", AD_AC97_BASE + AC97_MASTER_VOL_MONO, 16 },
+                { "AC97_MASTER_TONE", AD_AC97_BASE + AC97_MASTER_TONE, 16 },
+                { "AC97_PCBEEP_VOL", AD_AC97_BASE + AC97_PCBEEP_VOL, 16 },
+                { "AC97_PHONE_VOL", AD_AC97_BASE + AC97_PHONE_VOL, 16 },
+                { "AC97_MIC_VOL", AD_AC97_BASE + AC97_MIC_VOL, 16 },
+                { "AC97_LINEIN_VOL", AD_AC97_BASE + AC97_LINEIN_VOL, 16 },
+                { "AC97_CD_VOL", AD_AC97_BASE + AC97_CD_VOL, 16 },
+                { "AC97_VIDEO_VOL", AD_AC97_BASE + AC97_VIDEO_VOL, 16 },
+                { "AC97_AUX_VOL", AD_AC97_BASE + AC97_AUX_VOL, 16 },
+                { "AC97_PCMOUT_VOL", AD_AC97_BASE + AC97_PCMOUT_VOL, 16 },
+                { "AC97_RECORD_SELECT", AD_AC97_BASE + AC97_RECORD_SELECT, 16 },
+                { "AC97_RECORD_GAIN", AD_AC97_BASE + AC97_RECORD_GAIN, 16 },
+                { "AC97_RECORD_GAIN_MIC", AD_AC97_BASE + AC97_RECORD_GAIN_MIC, 16 },
+                { "AC97_GENERAL_PURPOSE", AD_AC97_BASE + AC97_GENERAL_PURPOSE, 16 },
+                { "AC97_3D_CONTROL", AD_AC97_BASE + AC97_3D_CONTROL, 16 },
+                { "AC97_MODEM_RATE", AD_AC97_BASE + AC97_MODEM_RATE, 16 },
+                { "AC97_POWER_CONTROL", AD_AC97_BASE + AC97_POWER_CONTROL, 16 },
                 { NULL }
         };
 
@@ -400,9 +400,9 @@ static inline unsigned long ad1889_get_dma_addr(ad1889_state_t *state)
         }
         
         if (dmabuf->enable & DAC_RUNNING)
-                offset = le32_to_cpu(AD1889_READL(state->card, AD_DMAWAVBA));
+                offset = le32_to_cpu(AD1889_READL(state->card, AD_DMA_WAVBA));
         else
-                offset = le32_to_cpu(AD1889_READL(state->card, AD_DMAADCBA));
+                offset = le32_to_cpu(AD1889_READL(state->card, AD_DMA_ADCBA));
 
         return (unsigned long)bus_to_virt((unsigned long)offset) - (unsigned long)dmabuf->rawbuf;
 }
@@ -639,9 +639,9 @@ static int ad1889_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                 if (val > 5400 && val < 48000)
                 {
                         if (file->f_mode & FMODE_WRITE)
-                                AD1889_WRITEW(ad1889_dev, AD_DSWAS, val);
+                                AD1889_WRITEW(ad1889_dev, AD_DS_WAS, val);
                         if (file->f_mode & FMODE_READ)
-                                AD1889_WRITEW(ad1889_dev, AD_DSRES, val);
+                                AD1889_WRITEW(ad1889_dev, AD_DS_RES, val);
                 }
                 return 0;
 
@@ -649,22 +649,22 @@ static int ad1889_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                 if (get_user(val, p))
                         return -EFAULT;
                 if (file->f_mode & FMODE_READ) {
-                        val = AD1889_READW(ad1889_dev, AD_DSWSMC);
+                        val = AD1889_READW(ad1889_dev, AD_DS_WSMC);
                         if (val) {
                                 val |= 0x0200;  /* set WAST */
                         } else {
                                 val &= ~0x0200; /* clear WAST */
                         }
-                        AD1889_WRITEW(ad1889_dev, AD_DSWSMC, val);
+                        AD1889_WRITEW(ad1889_dev, AD_DS_WSMC, val);
                 }
                 if (file->f_mode & FMODE_WRITE) {
-                        val = AD1889_READW(ad1889_dev, AD_DSRAMC);
+                        val = AD1889_READW(ad1889_dev, AD_DS_RAMC);
                         if (val) {
                                 val |= 0x0002;  /* set ADST */
                         } else {
                                 val &= ~0x0002; /* clear ADST */
                         }
-                        AD1889_WRITEW(ad1889_dev, AD_DSRAMC, val);
+                        AD1889_WRITEW(ad1889_dev, AD_DS_RAMC, val);
                 }
 
                 return 0;
@@ -739,7 +739,7 @@ static int ad1889_ioctl(struct inode *inode, struct file *file, unsigned int cmd
                 break;
 
         case SOUND_PCM_READ_RATE:
-                return put_user(AD1889_READW(ad1889_dev, AD_DSWAS), p);
+                return put_user(AD1889_READW(ad1889_dev, AD_DS_WAS), p);
 
         case SOUND_PCM_READ_CHANNELS:
         case SOUND_PCM_READ_BITS:
@@ -769,7 +769,7 @@ static int ad1889_open(struct inode *inode, struct file *file)
 
         ad1889_set_wav_rate(ad1889_dev, 48000);
         ad1889_set_wav_fmt(ad1889_dev, AFMT_S16_LE);
-        AD1889_WRITEW(ad1889_dev, AD_DSWADA, 0x0404); /* attenuation */
+        AD1889_WRITEW(ad1889_dev, AD_DS_WADA, 0x0404); /* attenuation */
         return nonseekable_open(inode, file);
 }
 
@@ -826,15 +826,15 @@ static void ad1889_codec_write(struct ac97_codec *ac97, u8 reg, u16 val)
 {
         ad1889_dev_t *dev = ac97->private_data;
 
-        //DBG("Writing 0x%x to 0x%lx\n", val, dev->regbase + 0x100 + reg);
-        AD1889_WRITEW(dev, 0x100 + reg, val);
+        //DBG("Writing 0x%x to 0x%lx\n", val, dev->regbase + AD_AC97_BASE + reg);
+        AD1889_WRITEW(dev, AD_AC97_BASE + reg, val);
 }
 
 static u16 ad1889_codec_read(struct ac97_codec *ac97, u8 reg)
 {
         ad1889_dev_t *dev = ac97->private_data;
-        //DBG("Reading from 0x%lx\n", dev->regbase + 0x100 + reg);
-        return AD1889_READW(dev, 0x100 + reg);
+        //DBG("Reading from 0x%lx\n", dev->regbase + AD_AC97_BASE + reg);
+        return AD1889_READW(dev, AD_AC97_BASE + reg);
 }       
 
 static int ad1889_ac97_init(ad1889_dev_t *dev, int id)
@@ -883,24 +883,24 @@ static int ad1889_aclink_reset(struct pci_dev * pcidev)
         int retry = 200;
         ad1889_dev_t *dev = pci_get_drvdata(pcidev);
 
-        AD1889_WRITEW(dev, AD_DSCCS, 0x8000); /* turn on clock */
-        AD1889_READW(dev, AD_DSCCS); 
+        AD1889_WRITEW(dev, AD_DS_CCS, 0x8000); /* turn on clock */
+        AD1889_READW(dev, AD_DS_CCS);
 
         WAIT_10MS();
 
-        stat = AD1889_READW(dev, AD_ACIC);
+        stat = AD1889_READW(dev, AD_AC97_ACIC);
         stat |= 0x0002;                         /* Reset Disable */
-        AD1889_WRITEW(dev, AD_ACIC, stat);
-        (void) AD1889_READW(dev, AD_ACIC);      /* flush posted write */
+        AD1889_WRITEW(dev, AD_AC97_ACIC, stat);
+        (void) AD1889_READW(dev, AD_AC97_ACIC); /* flush posted write */
 
         udelay(10);
 
-        stat = AD1889_READW(dev, AD_ACIC);
+        stat = AD1889_READW(dev, AD_AC97_ACIC);
         stat |= 0x0001;                         /* Interface Enable */
-        AD1889_WRITEW(dev, AD_ACIC, stat);
+        AD1889_WRITEW(dev, AD_AC97_ACIC, stat);
 
         do {
-                if (AD1889_READW(dev, AD_ACIC) & 0x8000)        /* Ready */
+                if (AD1889_READW(dev, AD_AC97_ACIC) & 0x8000)   /* Ready */
                         break;
                 WAIT_10MS();
                 retry--;
@@ -908,16 +908,16 @@ static int ad1889_aclink_reset(struct pci_dev * pcidev)
 
         if (!retry) {
                 printk(KERN_ERR "ad1889_aclink_reset: codec is not ready [0x%x]\n",
-                            AD1889_READW(dev, AD_ACIC));
+                            AD1889_READW(dev, AD_AC97_ACIC));
                 return -EBUSY;
         }
 
         /* TODO reset AC97 codec */
         /* TODO set wave/adc pci ctrl status */
 
-        stat = AD1889_READW(dev, AD_ACIC);
+        stat = AD1889_READW(dev, AD_AC97_ACIC);
         stat |= 0x0004;                         /* Audio Stream Output Enable */
-        AD1889_WRITEW(dev, AD_ACIC, stat);
+        AD1889_WRITEW(dev, AD_AC97_ACIC, stat);
         return 0;
 }
 
@@ -935,10 +935,10 @@ static irqreturn_t ad1889_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         u32 stat;
         ad1889_dev_t *dev = (ad1889_dev_t *)dev_id;
 
-        stat = AD1889_READL(dev, AD_DMADISR);
+        stat = AD1889_READL(dev, AD_DMA_DISR);
 
         /* clear ISR */
-        AD1889_WRITEL(dev, AD_DMADISR, stat);
+        AD1889_WRITEL(dev, AD_DMA_DISR, stat);
 
         if (stat & 0x8) {               /* WAVI */
                 DBG("WAV interrupt\n");
@@ -964,15 +964,15 @@ static void ad1889_initcfg(ad1889_dev_t *dev)
         u32 tmp32;
 
         /* make sure the interrupt bits are setup the way we want */
-        tmp32 = AD1889_READL(dev, AD_DMAWAVCTRL);
+        tmp32 = AD1889_READL(dev, AD_DMA_WAVCTRL);
         tmp32 &= ~0xff; /* flat dma, no sg, mask out the intr bits */
         tmp32 |= 0x6;  /* intr on count, loop */
-        AD1889_WRITEL(dev, AD_DMAWAVCTRL, tmp32);
+        AD1889_WRITEL(dev, AD_DMA_WAVCTRL, tmp32);
 
         /* unmute... */
-        tmp16 = AD1889_READW(dev, AD_DSWADA);
+        tmp16 = AD1889_READW(dev, AD_DS_WADA);
         tmp16 &= ~0x8080;
-        AD1889_WRITEW(dev, AD_DSWADA, tmp16);
+        AD1889_WRITEW(dev, AD_DS_WADA, tmp16);
 }
 
 static int __devinit ad1889_probe(struct pci_dev *pcidev, const struct pci_device_id *ent)
@@ -1005,7 +1005,7 @@ static int __devinit ad1889_probe(struct pci_dev *pcidev, const struct pci_devic
                 goto out1;
         }
 
-        dev->regbase = ioremap_nocache(bar, AD_DSIOMEMSIZE);
+        dev->regbase = ioremap_nocache(bar, AD_DS_IOMEMSIZE);
         if (!dev->regbase) {
                 printk(KERN_ERR DEVNAME ": unable to remap iomem\n");
                 goto out2;
diff --git a/sound/oss/ad1889.h b/sound/oss/ad1889.h
index 861b3213f30b..09913765967a 100644
--- a/sound/oss/ad1889.h
+++ b/sound/oss/ad1889.h
@@ -1,57 +1,58 @@
 #ifndef _AD1889_H_
 #define _AD1889_H_
 
-#define AD_DSWSMC       0x00    /* DMA input wave/syn mixer control */
-#define AD_DSRAMC       0x02    /* DMA output resamp/ADC mixer control */
-#define AD_DSWADA       0x04    /* DMA input wave attenuation */
-#define AD_DSSYDA       0x06    /* DMA input syn attentuation */
-#define AD_DSWAS        0x08    /* wave input sample rate */
-#define AD_DSRES        0x0a    /* resampler output sample rate */
-#define AD_DSCCS        0x0c    /* chip control/status */
-
-#define AD_DMARESBA     0x40    /* RES base addr */
-#define AD_DMARESCA     0x44    /* RES current addr */
-#define AD_DMARESBC     0x48    /* RES base cnt */
-#define AD_DMARESCC     0x4c    /* RES current count */
-#define AD_DMAADCBA     0x50    /* ADC */
-#define AD_DMAADCCA     0x54
-#define AD_DMAADCBC     0x58
-#define AD_DMAADCCC     0x5c
-#define AD_DMASYNBA     0x60    /* SYN */
-#define AD_DMASYNCA     0x64
-#define AD_DMASYNBC     0x68
-#define AD_DMASYNCC     0x6c
-#define AD_DMAWAVBA     0x70    /* WAV */
-#define AD_DMAWAVCA     0x74
-#define AD_DMAWAVBC     0x78
-#define AD_DMAWAVCC     0x7c
-#define AD_DMARESICC    0x80    /* RES interrupt current count */
-#define AD_DMARESIBC    0x84    /* RES interrupt base count */
-#define AD_DMAADCICC    0x88    /* ADC interrupt current count */
-#define AD_DMAADCIBC    0x8c    /* ADC interrupt base count */
-#define AD_DMASYNICC    0x90    /* SYN interrupt current count */
-#define AD_DMASYNIBC    0x94    /* SYN interrupt base count */
-#define AD_DMAWAVICC    0x98    /* WAV interrupt current count */
-#define AD_DMAWAVIBC    0x9c    /* WAV interrupt base count */
-#define AD_DMARESCTRL   0xa0    /* RES PCI control/status */
-#define AD_DMAADCCTRL   0xa8    /* ADC PCI control/status */
-#define AD_DMASYNCTRL   0xb0    /* SYN PCI control/status */
-#define AD_DMAWAVCTRL   0xb8    /* WAV PCI control/status */
-#define AD_DMADISR      0xc0    /* PCI DMA intr status */
-#define AD_DMACHSS      0xc4    /* PCI DMA channel stop status */
-
-#define AD_GPIOIPC      0xc8    /* IO port ctrl */
-#define AD_GPIOOP       0xca    /* IO output status */
-#define AD_GPIOIP       0xcc    /* IO input status */
+#define AD_DS_WSMC      0x00    /* DMA input wave/syn mixer control */
+#define AD_DS_RAMC      0x02    /* DMA output resamp/ADC mixer control */
+#define AD_DS_WADA      0x04    /* DMA input wave attenuation */
+#define AD_DS_SYDA      0x06    /* DMA input syn attentuation */
+#define AD_DS_WAS       0x08    /* wave input sample rate */
+#define AD_DS_RES       0x0a    /* resampler output sample rate */
+#define AD_DS_CCS       0x0c    /* chip control/status */
+
+#define AD_DMA_RESBA    0x40    /* RES base addr */
+#define AD_DMA_RESCA    0x44    /* RES current addr */
+#define AD_DMA_RESBC    0x48    /* RES base cnt */
+#define AD_DMA_RESCC    0x4c    /* RES current count */
+#define AD_DMA_ADCBA    0x50    /* ADC */
+#define AD_DMA_ADCCA    0x54
+#define AD_DMA_ADCBC    0x58
+#define AD_DMA_ADCCC    0x5c
+#define AD_DMA_SYNBA    0x60    /* SYN */
+#define AD_DMA_SYNCA    0x64
+#define AD_DMA_SYNBC    0x68
+#define AD_DMA_SYNCC    0x6c
+#define AD_DMA_WAVBA    0x70    /* WAV */
+#define AD_DMA_WAVCA    0x74
+#define AD_DMA_WAVBC    0x78
+#define AD_DMA_WAVCC    0x7c
+#define AD_DMA_RESICC   0x80    /* RES interrupt current count */
+#define AD_DMA_RESIBC   0x84    /* RES interrupt base count */
+#define AD_DMA_ADCICC   0x88    /* ADC interrupt current count */
+#define AD_DMA_ADCIBC   0x8c    /* ADC interrupt base count */
+#define AD_DMA_SYNICC   0x90    /* SYN interrupt current count */
+#define AD_DMA_SYNIBC   0x94    /* SYN interrupt base count */
+#define AD_DMA_WAVICC   0x98    /* WAV interrupt current count */
+#define AD_DMA_WAVIBC   0x9c    /* WAV interrupt base count */
+#define AD_DMA_RESCTRL  0xa0    /* RES PCI control/status */
+#define AD_DMA_ADCCTRL  0xa8    /* ADC PCI control/status */
+#define AD_DMA_SYNCTRL  0xb0    /* SYN PCI control/status */
+#define AD_DMA_WAVCTRL  0xb8    /* WAV PCI control/status */
+#define AD_DMA_DISR     0xc0    /* PCI DMA intr status */
+#define AD_DMA_CHSS     0xc4    /* PCI DMA channel stop status */
+
+#define AD_GPIO_IPC     0xc8    /* IO port ctrl */
+#define AD_GPIO_OP      0xca    /* IO output status */
+#define AD_GPIO_IP      0xcc    /* IO input status */
 
 /* AC97 registers, 0x100 - 0x17f; see ac97.h */
-#define AD_ACIC         0x180   /* AC Link interface ctrl */
+#define AD_AC97_BASE    0x100   /* ac97 base register */
+#define AD_AC97_ACIC    0x180   /* AC Link interface ctrl */
 
 /* OPL3; BAR1 */
-#define AD_OPLM0AS      0x00    /* Music0 address/status */
-#define AD_OPLM0DATA    0x01    /* Music0 data */
-#define AD_OPLM1A       0x02    /* Music1 address */
-#define AD_OPLM1DATA    0x03    /* Music1 data */
+#define AD_OPL_M0AS     0x00    /* Music0 address/status */
+#define AD_OPL_M0DATA   0x01    /* Music0 data */
+#define AD_OPL_M1A      0x02    /* Music1 address */
+#define AD_OPL_M1DATA   0x03    /* Music1 data */
 /* 0x04-0x0f reserved */
 
 /* MIDI; BAR2 */
@@ -59,9 +60,9 @@
 #define AD_MISC         0x01    /* MIDI status/cmd */
 /* 0x02-0xff reserved */
 
-#define AD_DSIOMEMSIZE  512
-#define AD_OPLMEMSIZE   16
-#define AD_MIDIMEMSIZE  16
+#define AD_DS_IOMEMSIZE 512
+#define AD_OPL_MEMSIZE  16
+#define AD_MIDI_MEMSIZE 16
 
 #define AD_WAV_STATE    0
 #define AD_ADC_STATE    1
diff --git a/sound/oss/dmasound/tas_common.c b/sound/oss/dmasound/tas_common.c
index 81315996c0f1..882ae98a41b1 100644
--- a/sound/oss/dmasound/tas_common.c
+++ b/sound/oss/dmasound/tas_common.c
@@ -195,8 +195,8 @@ tas_init(int driver_id, const char *driver_name)
 
         printk(KERN_INFO "tas driver [%s])\n", driver_name);
 
-#ifndef CONFIG_I2C_KEYWEST
-        request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+        request_module("i2c-powermac");
 #endif
         tas_node = find_devices("deq");
         if (tas_node == NULL)
diff --git a/sound/ppc/daca.c b/sound/ppc/daca.c
index aa09ebd9ffb8..46eebf5610e3 100644
--- a/sound/ppc/daca.c
+++ b/sound/ppc/daca.c
@@ -255,7 +255,7 @@ int __init snd_pmac_daca_init(struct snd_pmac *chip)
 
 #ifdef CONFIG_KMOD
         if (current->fs->root)
-                request_module("i2c-keywest");
+                request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */        
 
         mix = kmalloc(sizeof(*mix), GFP_KERNEL);
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 1146dd882bb1..70e4ebc70260 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -1313,7 +1313,7 @@ int __init snd_pmac_tumbler_init(struct snd_pmac *chip)
 
 #ifdef CONFIG_KMOD
         if (current->fs->root)
-                request_module("i2c-keywest");
+                request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */        
 
         mix = kmalloc(sizeof(*mix), GFP_KERNEL);