421 files changed, 5666 insertions, 3093 deletions

diff --git a/Documentation/BUG-HUNTING b/Documentation/BUG-HUNTING
index 65b97e1dbf70..35f5bd243336 100644
--- a/Documentation/BUG-HUNTING
+++ b/Documentation/BUG-HUNTING
@@ -191,6 +191,30 @@ e.g. crash dump output as shown by Dave Miller.
 >        mov        0x8(%ebp), %ebx         ! %ebx = skb->sk
 >        mov        0x13c(%ebx), %eax       ! %eax = inet_sk(sk)->opt
 
+In addition, you can use GDB to figure out the exact file and line
+number of the OOPS from the vmlinux file. If you have
+CONFIG_DEBUG_INFO enabled, you can simply copy the EIP value from the
+OOPS:
+
+ EIP:    0060:[<c021e50e>]    Not tainted VLI
+
+And use GDB to translate that to human-readable form:
+
+  gdb vmlinux
+  (gdb) l *0xc021e50e
+
+If you don't have CONFIG_DEBUG_INFO enabled, you use the function
+offset from the OOPS:
+
+ EIP is at vt_ioctl+0xda8/0x1482
+
+And recompile the kernel with CONFIG_DEBUG_INFO enabled:
+
+  make vmlinux
+  gdb vmlinux
+  (gdb) p vt_ioctl
+  (gdb) l *(0x<address of vt_ioctl> + 0xda8)
+
 Another very useful option of the Kernel Hacking section in menuconfig is
 Debug memory allocations. This will help you see whether data has been
 initialised and not set before use etc. To see the values that get assigned
diff --git a/Documentation/SubmitChecklist b/Documentation/SubmitChecklist
index 3af3e65cf43b..6ebffb57e3db 100644
--- a/Documentation/SubmitChecklist
+++ b/Documentation/SubmitChecklist
@@ -84,3 +84,9 @@ kernel patches.
 24: Avoid whitespace damage such as indenting with spaces or whitespace
     at the end of lines.  You can test this by feeding the patch to
     "git apply --check --whitespace=error-all"
+
+25: Check your patch for general style as detailed in
+    Documentation/CodingStyle.  Check for trivial violations with the
+    patch style checker prior to submission (scripts/checkpatch.pl).
+    You should be able to justify all violations that remain in
+    your patch.
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index a417b25fb1aa..d91125ab6f49 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -118,7 +118,20 @@ then only post say 15 or so at a time and wait for review and integration.
 
 
 
-4) Select e-mail destination.
+4) Style check your changes.
+
+Check your patch for basic style violations, details of which can be
+found in Documentation/CodingStyle.  Failure to do so simply wastes
+the reviewers time and will get your patch rejected, probabally
+without even being read.
+
+At a minimum you should check your patches with the patch style
+checker prior to submission (scripts/patchcheck.pl).  You should
+be able to justify all violations that remain in your patch.
+
+
+
+5) Select e-mail destination.
 
 Look through the MAINTAINERS file and the source code, and determine
 if your change applies to a specific subsystem of the kernel, with
@@ -146,7 +159,7 @@ discussed should the patch then be submitted to Linus.
 
 
 
-5) Select your CC (e-mail carbon copy) list.
+6) Select your CC (e-mail carbon copy) list.
 
 Unless you have a reason NOT to do so, CC linux-kernel@vger.kernel.org.
 
@@ -187,8 +200,7 @@ URL: <http://www.kernel.org/pub/linux/kernel/people/bunk/trivial/>
 
 
 
-
-6) No MIME, no links, no compression, no attachments.  Just plain text.
+7) No MIME, no links, no compression, no attachments.  Just plain text.
 
 Linus and other kernel developers need to be able to read and comment
 on the changes you are submitting.  It is important for a kernel
@@ -223,9 +235,9 @@ pref("mailnews.display.disable_format_flowed_support", true);
 
 
 
-7) E-mail size.
+8) E-mail size.
 
-When sending patches to Linus, always follow step #6.
+When sending patches to Linus, always follow step #7.
 
 Large changes are not appropriate for mailing lists, and some
 maintainers.  If your patch, uncompressed, exceeds 40 kB in size,
@@ -234,7 +246,7 @@ server, and provide instead a URL (link) pointing to your patch.
 
 
 
-8) Name your kernel version.
+9) Name your kernel version.
 
 It is important to note, either in the subject line or in the patch
 description, the kernel version to which this patch applies.
@@ -244,7 +256,7 @@ Linus will not apply it.
 
 
 
-9) Don't get discouraged.  Re-submit.
+10) Don't get discouraged.  Re-submit.
 
 After you have submitted your change, be patient and wait.  If Linus
 likes your change and applies it, it will appear in the next version
@@ -270,7 +282,7 @@ When in doubt, solicit comments on linux-kernel mailing list.
 
 
 
-10) Include PATCH in the subject
+11) Include PATCH in the subject
 
 Due to high e-mail traffic to Linus, and to linux-kernel, it is common
 convention to prefix your subject line with [PATCH].  This lets Linus
@@ -279,7 +291,7 @@ e-mail discussions.
 
 
 
-11) Sign your work
+12) Sign your work
 
 To improve tracking of who did what, especially with patches that can
 percolate to their final resting place in the kernel through several
@@ -328,7 +340,8 @@ now, but you can do this to mark internal company procedures or just
 point out some special detail about the sign-off. 
 
 
-12) The canonical patch format
+
+13) The canonical patch format
 
 The canonical patch subject line is:
 
@@ -427,6 +440,10 @@ section Linus Computer Science 101.
 Nuff said.  If your code deviates too much from this, it is likely
 to be rejected without further review, and without comment.
 
+Check your patches with the patch style checker prior to submission
+(scripts/checkpatch.pl).  You should be able to justify all
+violations that remain in your patch.
+
 
 
 2) #ifdefs are ugly
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 2d7ea85075ba..49ae1ea9e868 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -70,6 +70,7 @@ Who:	David Miller <davem@davemloft.net>
 
 What:   Video4Linux API 1 ioctls and video_decoder.h from Video devices.
 When:   December 2006
+Files:  include/linux/video_decoder.h
 Why:    V4L1 AP1 was replaced by V4L2 API. during migration from 2.4 to 2.6
         series. The old API have lots of drawbacks and don't provide enough
         means to work with all video and audio standards. The newer API is
diff --git a/Documentation/hrtimer/timer_stats.txt b/Documentation/hrtimer/timer_stats.txt
index 27f782e3593f..22b0814d0ad0 100644
--- a/Documentation/hrtimer/timer_stats.txt
+++ b/Documentation/hrtimer/timer_stats.txt
@@ -2,9 +2,10 @@ timer_stats - timer usage statistics
 ------------------------------------
 
 timer_stats is a debugging facility to make the timer (ab)usage in a Linux
-system visible to kernel and userspace developers. It is not intended for
-production usage as it adds significant overhead to the (hr)timer code and the
-(hr)timer data structures.
+system visible to kernel and userspace developers. If enabled in the config
+but not used it has almost zero runtime overhead, and a relatively small
+data structure overhead. Even if collection is enabled runtime all the
+locking is per-CPU and lookup is hashed.
 
 timer_stats should be used by kernel and userspace developers to verify that
 their code does not make unduly use of timers. This helps to avoid unnecessary
diff --git a/Documentation/ia64/aliasing-test.c b/Documentation/ia64/aliasing-test.c
index 3153167b41c3..d485256ee1ce 100644
--- a/Documentation/ia64/aliasing-test.c
+++ b/Documentation/ia64/aliasing-test.c
@@ -197,7 +197,7 @@ skip:
         return rc;
 }
 
-main()
+int main()
 {
         int rc;
 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index aae2282600ca..5d0283cd3a81 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -170,7 +170,10 @@ and is between 256 and 4096 characters. It is defined in the file
         acpi_os_name=   [HW,ACPI] Tell ACPI BIOS the name of the OS
                         Format: To spoof as Windows 98: ="Microsoft Windows"
 
-        acpi_osi=       [HW,ACPI] empty param disables _OSI
+        acpi_osi=       [HW,ACPI] Modify list of supported OS interface strings
+                        acpi_osi="string1"      # add string1 -- only one string
+                        acpi_osi="!string2"     # remove built-in string2
+                        acpi_osi=               # disable all strings
 
         acpi_serialize  [HW,ACPI] force serialization of AML methods
 
@@ -1132,9 +1135,9 @@ and is between 256 and 4096 characters. It is defined in the file
                         when set.
                         Format: <int>
 
-        noaliencache    [MM, NUMA] Disables the allcoation of alien caches in
-                        the slab allocator.  Saves per-node memory, but will
-                        impact performance on real NUMA hardware.
+        noaliencache    [MM, NUMA, SLAB] Disables the allocation of alien
+                        caches in the slab allocator.  Saves per-node memory,
+                        but will impact performance.
 
         noalign         [KNL,ARM]
 
@@ -1613,6 +1616,37 @@ and is between 256 and 4096 characters. It is defined in the file
 
         slram=          [HW,MTD]
 
+        slub_debug      [MM, SLUB]
+                        Enabling slub_debug allows one to determine the culprit
+                        if slab objects become corrupted. Enabling slub_debug
+                        creates guard zones around objects and poisons objects
+                        when not in use. Also tracks the last alloc / free.
+                        For more information see Documentation/vm/slub.txt.
+
+        slub_max_order= [MM, SLUB]
+                        Determines the maximum allowed order for slabs. Setting
+                        this too high may cause fragmentation.
+                        For more information see Documentation/vm/slub.txt.
+
+        slub_min_objects=       [MM, SLUB]
+                        The minimum objects per slab. SLUB will increase the
+                        slab order up to slub_max_order to generate a
+                        sufficiently big slab to satisfy the number of objects.
+                        The higher the number of objects the smaller the overhead
+                        of tracking slabs.
+                        For more information see Documentation/vm/slub.txt.
+
+        slub_min_order= [MM, SLUB]
+                        Determines the mininum page order for slabs. Must be
+                        lower than slub_max_order
+                        For more information see Documentation/vm/slub.txt.
+
+        slub_nomerge    [MM, SLUB]
+                        Disable merging of slabs of similar size. May be
+                        necessary if there is some reason to distinguish
+                        allocs to different slabs.
+                        For more information see Documentation/vm/slub.txt.
+
         smart2=         [HW]
                         Format: <io1>[,<io2>[,...,<io8>]]
 
diff --git a/Documentation/networking/xfrm_sysctl.txt b/Documentation/networking/xfrm_sysctl.txt
new file mode 100644
index 000000000000..5bbd16792fe1
--- /dev/null
+++ b/Documentation/networking/xfrm_sysctl.txt
@@ -0,0 +1,4 @@
+/proc/sys/net/core/xfrm_* Variables:
+
+xfrm_acq_expires - INTEGER
+        default 30 - hard timeout in seconds for acquire requests
diff --git a/Documentation/powerpc/booting-without-of.txt b/Documentation/powerpc/booting-without-of.txt
index b49ce169a63a..d42d98107d49 100644
--- a/Documentation/powerpc/booting-without-of.txt
+++ b/Documentation/powerpc/booting-without-of.txt
@@ -1,7 +1,6 @@
            Booting the Linux/ppc kernel without Open Firmware
            --------------------------------------------------
 
-
 (c) 2005 Benjamin Herrenschmidt <benh at kernel.crashing.org>,
     IBM Corp.
 (c) 2005 Becky Bruce <becky.bruce at freescale.com>,
@@ -9,6 +8,62 @@
 (c) 2006 MontaVista Software, Inc.
     Flash chip node definition
 
+Table of Contents
+=================
+
+  I - Introduction
+    1) Entry point for arch/powerpc
+    2) Board support
+
+  II - The DT block format
+    1) Header
+    2) Device tree generalities
+    3) Device tree "structure" block
+    4) Device tree "strings" block
+
+  III - Required content of the device tree
+    1) Note about cells and address representation
+    2) Note about "compatible" properties
+    3) Note about "name" properties
+    4) Note about node and property names and character set
+    5) Required nodes and properties
+      a) The root node
+      b) The /cpus node
+      c) The /cpus/* nodes
+      d) the /memory node(s)
+      e) The /chosen node
+      f) the /soc<SOCname> node
+
+  IV - "dtc", the device tree compiler
+
+  V - Recommendations for a bootloader
+
+  VI - System-on-a-chip devices and nodes
+    1) Defining child nodes of an SOC
+    2) Representing devices without a current OF specification
+      a) MDIO IO device
+      c) PHY nodes
+      b) Gianfar-compatible ethernet nodes
+      d) Interrupt controllers
+      e) I2C
+      f) Freescale SOC USB controllers
+      g) Freescale SOC SEC Security Engines
+      h) Board Control and Status (BCSR)
+      i) Freescale QUICC Engine module (QE)
+      g) Flash chip nodes
+
+  VII - Specifying interrupt information for devices
+    1) interrupts property
+    2) interrupt-parent property
+    3) OpenPIC Interrupt Controllers
+    4) ISA Interrupt Controllers
+
+  Appendix A - Sample SOC node for MPC8540
+
+
+Revision Information
+====================
+
    May 18, 2005: Rev 0.1 - Initial draft, no chapter III yet.
 
    May 19, 2005: Rev 0.2 - Add chapter III and bits & pieces here or
@@ -1687,7 +1742,7 @@ platforms are moved over to use the flattened-device-tree model.
                 };
         };
 
-    g) Flash chip nodes
+    j) Flash chip nodes
 
     Flash chips (Memory Technology Devices) are often used for solid state
     file systems on embedded devices.
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 57b878cc393c..355ff0a2bb7c 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -917,6 +917,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           ref           Reference board, base config
           m2-2          Some Gateway MX series laptops
           m6            Some Gateway NX series laptops
+          pa6           Gateway NX860 series
 
         STAC9227/9228/9229/927x
           ref           Reference board
diff --git a/Documentation/thinkpad-acpi.txt b/Documentation/thinkpad-acpi.txt
index 2d4803359a04..9e6b94face4b 100644
--- a/Documentation/thinkpad-acpi.txt
+++ b/Documentation/thinkpad-acpi.txt
@@ -138,7 +138,7 @@ Hot keys
 --------
 
 procfs: /proc/acpi/ibm/hotkey
-sysfs device attribute: hotkey/*
+sysfs device attribute: hotkey_*
 
 Without this driver, only the Fn-F4 key (sleep button) generates an
 ACPI event. With the driver loaded, the hotkey feature enabled and the
@@ -196,10 +196,7 @@ The following commands can be written to the /proc/acpi/ibm/hotkey file:
 
 sysfs notes:
 
-        The hot keys attributes are in a hotkey/ subdirectory off the
-        thinkpad device.
-
-        bios_enabled:
+        hotkey_bios_enabled:
                 Returns the status of the hot keys feature when
                 thinkpad-acpi was loaded.  Upon module unload, the hot
                 key feature status will be restored to this value.
@@ -207,19 +204,19 @@ sysfs notes:
                 0: hot keys were disabled
                 1: hot keys were enabled
 
-        bios_mask:
+        hotkey_bios_mask:
                 Returns the hot keys mask when thinkpad-acpi was loaded.
                 Upon module unload, the hot keys mask will be restored
                 to this value.
 
-        enable:
+        hotkey_enable:
                 Enables/disables the hot keys feature, and reports
                 current status of the hot keys feature.
 
                 0: disables the hot keys feature / feature disabled
                 1: enables the hot keys feature / feature enabled
 
-        mask:
+        hotkey_mask:
                 bit mask to enable ACPI event generation for each hot
                 key (see above).  Returns the current status of the hot
                 keys mask, and allows one to modify it.
@@ -229,7 +226,7 @@ Bluetooth
 ---------
 
 procfs: /proc/acpi/ibm/bluetooth
-sysfs device attribute: bluetooth/enable
+sysfs device attribute: bluetooth_enable
 
 This feature shows the presence and current state of a ThinkPad
 Bluetooth device in the internal ThinkPad CDC slot.
@@ -244,7 +241,7 @@ If Bluetooth is installed, the following commands can be used:
 Sysfs notes:
 
         If the Bluetooth CDC card is installed, it can be enabled /
-        disabled through the "bluetooth/enable" thinkpad-acpi device
+        disabled through the "bluetooth_enable" thinkpad-acpi device
         attribute, and its current status can also be queried.
 
         enable:
@@ -252,7 +249,7 @@ Sysfs notes:
                 1: enables Bluetooth / Bluetooth is enabled.
 
         Note: this interface will be probably be superseeded by the
-        generic rfkill class.
+        generic rfkill class, so it is NOT to be considered stable yet.
 
 Video output control -- /proc/acpi/ibm/video
 --------------------------------------------
@@ -898,7 +895,7 @@ EXPERIMENTAL: WAN
 -----------------
 
 procfs: /proc/acpi/ibm/wan
-sysfs device attribute: wwan/enable
+sysfs device attribute: wwan_enable
 
 This feature is marked EXPERIMENTAL because the implementation
 directly accesses hardware registers and may not work as expected. USE
@@ -921,7 +918,7 @@ If the W-WAN card is installed, the following commands can be used:
 Sysfs notes:
 
         If the W-WAN card is installed, it can be enabled /
-        disabled through the "wwan/enable" thinkpad-acpi device
+        disabled through the "wwan_enable" thinkpad-acpi device
         attribute, and its current status can also be queried.
 
         enable:
@@ -929,7 +926,7 @@ Sysfs notes:
                 1: enables WWAN card / WWAN card is enabled.
 
         Note: this interface will be probably be superseeded by the
-        generic rfkill class.
+        generic rfkill class, so it is NOT to be considered stable yet.
 
 Multiple Commands, Module Parameters
 ------------------------------------
diff --git a/Documentation/vm/slub.txt b/Documentation/vm/slub.txt
index 727c8d81aeaf..1523320abd87 100644
--- a/Documentation/vm/slub.txt
+++ b/Documentation/vm/slub.txt
@@ -1,13 +1,9 @@
 Short users guide for SLUB
 --------------------------
 
-First of all slub should transparently replace SLAB. If you enable
-SLUB then everything should work the same (Note the word "should".
-There is likely not much value in that word at this point).
-
 The basic philosophy of SLUB is very different from SLAB. SLAB
 requires rebuilding the kernel to activate debug options for all
-SLABS. SLUB always includes full debugging but its off by default.
+slab caches. SLUB always includes full debugging but it is off by default.
 SLUB can enable debugging only for selected slabs in order to avoid
 an impact on overall system performance which may make a bug more
 difficult to find.
@@ -76,13 +72,28 @@ of objects.
 Careful with tracing: It may spew out lots of information and never stop if
 used on the wrong slab.
 
-SLAB Merging
+Slab merging
 ------------
 
-If no debugging is specified then SLUB may merge similar slabs together
+If no debug options are specified then SLUB may merge similar slabs together
 in order to reduce overhead and increase cache hotness of objects.
 slabinfo -a displays which slabs were merged together.
 
+Slab validation
+---------------
+
+SLUB can validate all object if the kernel was booted with slub_debug. In
+order to do so you must have the slabinfo tool. Then you can do
+
+slabinfo -v
+
+which will test all objects. Output will be generated to the syslog.
+
+This also works in a more limited way if boot was without slab debug.
+In that case slabinfo -v simply tests all reachable objects. Usually
+these are in the cpu slabs and the partial slabs. Full slabs are not
+tracked by SLUB in a non debug situation.
+
 Getting more performance
 ------------------------
 
@@ -91,9 +102,9 @@ list_lock once in a while to deal with partial slabs. That overhead is
 governed by the order of the allocation for each slab. The allocations
 can be influenced by kernel parameters:
 
-slub_min_objects=x              (default 8)
+slub_min_objects=x              (default 4)
 slub_min_order=x                (default 0)
-slub_max_order=x                (default 4)
+slub_max_order=x                (default 1)
 
 slub_min_objects allows to specify how many objects must at least fit
 into one slab in order for the allocation order to be acceptable.
@@ -109,5 +120,107 @@ longer be checked. This is useful to avoid SLUB trying to generate
 super large order pages to fit slub_min_objects of a slab cache with
 large object sizes into one high order page.
 
-
-Christoph Lameter, <clameter@sgi.com>, April 10, 2007
+SLUB Debug output
+-----------------
+
+Here is a sample of slub debug output:
+
+*** SLUB kmalloc-8: Redzone Active@0xc90f6d20 slab 0xc528c530 offset=3360 flags=0x400000c3 inuse=61 freelist=0xc90f6d58
+  Bytes b4 0xc90f6d10:  00 00 00 00 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
+    Object 0xc90f6d20:  31 30 31 39 2e 30 30 35                         1019.005
+   Redzone 0xc90f6d28:  00 cc cc cc                                     .
+FreePointer 0xc90f6d2c -> 0xc90f6d58
+Last alloc: get_modalias+0x61/0xf5 jiffies_ago=53 cpu=1 pid=554
+Filler 0xc90f6d50:  5a 5a 5a 5a 5a 5a 5a 5a                         ZZZZZZZZ
+  [<c010523d>] dump_trace+0x63/0x1eb
+  [<c01053df>] show_trace_log_lvl+0x1a/0x2f
+  [<c010601d>] show_trace+0x12/0x14
+  [<c0106035>] dump_stack+0x16/0x18
+  [<c017e0fa>] object_err+0x143/0x14b
+  [<c017e2cc>] check_object+0x66/0x234
+  [<c017eb43>] __slab_free+0x239/0x384
+  [<c017f446>] kfree+0xa6/0xc6
+  [<c02e2335>] get_modalias+0xb9/0xf5
+  [<c02e23b7>] dmi_dev_uevent+0x27/0x3c
+  [<c027866a>] dev_uevent+0x1ad/0x1da
+  [<c0205024>] kobject_uevent_env+0x20a/0x45b
+  [<c020527f>] kobject_uevent+0xa/0xf
+  [<c02779f1>] store_uevent+0x4f/0x58
+  [<c027758e>] dev_attr_store+0x29/0x2f
+  [<c01bec4f>] sysfs_write_file+0x16e/0x19c
+  [<c0183ba7>] vfs_write+0xd1/0x15a
+  [<c01841d7>] sys_write+0x3d/0x72
+  [<c0104112>] sysenter_past_esp+0x5f/0x99
+  [<b7f7b410>] 0xb7f7b410
+  =======================
+@@@ SLUB kmalloc-8: Restoring redzone (0xcc) from 0xc90f6d28-0xc90f6d2b
+
+
+
+If SLUB encounters a corrupted object then it will perform the following
+actions:
+
+1. Isolation and report of the issue
+
+This will be a message in the system log starting with
+
+*** SLUB <slab cache affected>: <What went wrong>@<object address>
+offset=<offset of object into slab> flags=<slabflags>
+inuse=<objects in use in this slab> freelist=<first free object in slab>
+
+2. Report on how the problem was dealt with in order to ensure the continued
+operation of the system.
+
+These are messages in the system log beginning with
+
+@@@ SLUB <slab cache affected>: <corrective action taken>
+
+
+In the above sample SLUB found that the Redzone of an active object has
+been overwritten. Here a string of 8 characters was written into a slab that
+has the length of 8 characters. However, a 8 character string needs a
+terminating 0. That zero has overwritten the first byte of the Redzone field.
+After reporting the details of the issue encountered the @@@ SLUB message
+tell us that SLUB has restored the redzone to its proper value and then
+system operations continue.
+
+Various types of lines can follow the @@@ SLUB line:
+
+Bytes b4 <address> : <bytes>
+        Show a few bytes before the object where the problem was detected.
+        Can be useful if the corruption does not stop with the start of the
+        object.
+
+Object <address> : <bytes>
+        The bytes of the object. If the object is inactive then the bytes
+        typically contain poisoning values. Any non-poison value shows a
+        corruption by a write after free.
+
+Redzone <address> : <bytes>
+        The redzone following the object. The redzone is used to detect
+        writes after the object. All bytes should always have the same
+        value. If there is any deviation then it is due to a write after
+        the object boundary.
+
+Freepointer
+        The pointer to the next free object in the slab. May become
+        corrupted if overwriting continues after the red zone.
+
+Last alloc:
+Last free:
+        Shows the address from which the object was allocated/freed last.
+        We note the pid, the time and the CPU that did so. This is usually
+        the most useful information to figure out where things went wrong.
+        Here get_modalias() did an kmalloc(8) instead of a kmalloc(9).
+
+Filler <address> : <bytes>
+        Unused data to fill up the space in order to get the next object
+        properly aligned. In the debug case we make sure that there are
+        at least 4 bytes of filler. This allow for the detection of writes
+        before the object.
+
+Following the filler will be a stackdump. That stackdump describes the
+location where the error was detected. The cause of the corruption is more
+likely to be found by looking at the information about the last alloc / free.
+
+Christoph Lameter, <clameter@sgi.com>, May 23, 2007
diff --git a/Documentation/watchdog/pcwd-watchdog.txt b/Documentation/watchdog/pcwd-watchdog.txt
index d9ee6336c1d4..4f68052395c0 100644
--- a/Documentation/watchdog/pcwd-watchdog.txt
+++ b/Documentation/watchdog/pcwd-watchdog.txt
@@ -1,3 +1,5 @@
+Last reviewed: 10/05/2007
+
                      Berkshire Products PC Watchdog Card
                    Support for ISA Cards  Revision A and C
            Documentation and Driver by Ken Hollis <kenji@bitgate.com>
@@ -14,8 +16,8 @@
 
  The Watchdog Driver will automatically find your watchdog card, and will
  attach a running driver for use with that card.  After the watchdog
- drivers have initialized, you can then talk to the card using the PC
- Watchdog program, available from http://ftp.bitgate.com/pcwd/.
+ drivers have initialized, you can then talk to the card using a PC
+ Watchdog program.
 
  I suggest putting a "watchdog -d" before the beginning of an fsck, and
  a "watchdog -e -t 1" immediately after the end of an fsck.  (Remember
@@ -62,5 +64,3 @@
  -- Ken Hollis
     (kenji@bitgate.com)
 
-(This documentation may be out of date.  Check
- http://ftp.bitgate.com/pcwd/ for the absolute latest additions.)
diff --git a/Documentation/watchdog/watchdog-api.txt b/Documentation/watchdog/watchdog-api.txt
index 8d16f6f3c4ec..bb7cb1d31ec7 100644
--- a/Documentation/watchdog/watchdog-api.txt
+++ b/Documentation/watchdog/watchdog-api.txt
@@ -1,3 +1,6 @@
+Last reviewed: 10/05/2007
+
+
 The Linux Watchdog driver API.
 
 Copyright 2002 Christer Weingel <wingel@nano-system.com>
@@ -22,7 +25,7 @@ the system.  If userspace fails (RAM error, kernel bug, whatever), the
 notifications cease to occur, and the hardware watchdog will reset the
 system (causing a reboot) after the timeout occurs.
 
-The Linux watchdog API is a rather AD hoc construction and different
+The Linux watchdog API is a rather ad-hoc construction and different
 drivers implement different, and sometimes incompatible, parts of it.
 This file is an attempt to document the existing usage and allow
 future driver writers to use it as a reference.
@@ -46,14 +49,16 @@ some of the drivers support the configuration option "Disable watchdog
 shutdown on close", CONFIG_WATCHDOG_NOWAYOUT.  If it is set to Y when
 compiling the kernel, there is no way of disabling the watchdog once
 it has been started.  So, if the watchdog daemon crashes, the system
-will reboot after the timeout has passed.
+will reboot after the timeout has passed. Watchdog devices also usually
+support the nowayout module parameter so that this option can be controlled
+at runtime.
 
-Some other drivers will not disable the watchdog, unless a specific
-magic character 'V' has been sent /dev/watchdog just before closing
-the file.  If the userspace daemon closes the file without sending
-this special character, the driver will assume that the daemon (and
-userspace in general) died, and will stop pinging the watchdog without
-disabling it first.  This will then cause a reboot.
+Drivers will not disable the watchdog, unless a specific magic character 'V'
+has been sent /dev/watchdog just before closing the file.  If the userspace
+daemon closes the file without sending this special character, the driver
+will assume that the daemon (and userspace in general) died, and will stop
+pinging the watchdog without disabling it first.  This will then cause a
+reboot if the watchdog is not re-opened in sufficient time.
 
 The ioctl API:
 
@@ -227,218 +232,3 @@ The following options are available:
 
 [FIXME -- better explanations]
 
-Implementations in the current drivers in the kernel tree:
-
-Here I have tried to summarize what the different drivers support and
-where they do strange things compared to the other drivers.
-
-acquirewdt.c -- Acquire Single Board Computer
-
-        This driver has a hardcoded timeout of 1 minute
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns KEEPALIVEPING.  GETSTATUS will return 1 if
-        the device is open, 0 if not.  [FIXME -- isn't this rather
-        silly?  To be able to use the ioctl, the device must be open
-        and so GETSTATUS will always return 1].
-
-advantechwdt.c -- Advantech Single Board Computer
-
-        Timeout that defaults to 60 seconds, supports SETTIMEOUT.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns WDIOF_KEEPALIVEPING and WDIOF_SETTIMEOUT.
-        The GETSTATUS call returns if the device is open or not.
-        [FIXME -- silliness again?]
-        
-booke_wdt.c -- PowerPC BookE Watchdog Timer
-
-        Timeout default varies according to frequency, supports
-        SETTIMEOUT
-
-        Watchdog cannot be turned off, CONFIG_WATCHDOG_NOWAYOUT
-        does not make sense
-
-        GETSUPPORT returns the watchdog_info struct, and
-        GETSTATUS returns the supported options. GETBOOTSTATUS
-        returns a 1 if the last reset was caused by the
-        watchdog and a 0 otherwise. This watchdog cannot be
-        disabled once it has been started. The wdt_period kernel
-        parameter selects which bit of the time base changing
-        from 0->1 will trigger the watchdog exception. Changing
-        the timeout from the ioctl calls will change the
-        wdt_period as defined above. Finally if you would like to
-        replace the default Watchdog Handler you can implement the
-        WatchdogHandler() function in your own code.
-
-eurotechwdt.c -- Eurotech CPU-1220/1410
-
-        The timeout can be set using the SETTIMEOUT ioctl and defaults
-        to 60 seconds.
-
-        Also has a module parameter "ev", event type which controls
-        what should happen on a timeout, the string "int" or anything
-        else that causes a reboot.  [FIXME -- better description]
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns CARDRESET and WDIOF_SETTIMEOUT but
-        GETSTATUS is not supported and GETBOOTSTATUS just returns 0.
-
-i810-tco.c -- Intel 810 chipset
-
-        Also has support for a lot of other i8x0 stuff, but the
-        watchdog is one of the things.
-
-        The timeout is set using the module parameter "i810_margin",
-        which is in steps of 0.6 seconds where 2<i810_margin<64.  The
-        driver supports the SETTIMEOUT ioctl.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT.
-
-        GETSUPPORT returns WDIOF_SETTIMEOUT.  The GETSTATUS call
-        returns some kind of timer value which ist not compatible with
-        the other drivers.  GETBOOT status returns some kind of
-        hardware specific boot status.  [FIXME -- describe this]
-
-ib700wdt.c -- IB700 Single Board Computer
-
-        Default timeout of 30 seconds and the timeout is settable
-        using the SETTIMEOUT ioctl.  Note that only a few timeout
-        values are supported.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns WDIOF_KEEPALIVEPING and WDIOF_SETTIMEOUT.
-        The GETSTATUS call returns if the device is open or not.
-        [FIXME -- silliness again?]
-
-machzwd.c -- MachZ ZF-Logic
-
-        Hardcoded timeout of 10 seconds
-
-        Has a module parameter "action" that controls what happens
-        when the timeout runs out which can be 0 = RESET (default), 
-        1 = SMI, 2 = NMI, 3 = SCI.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT and the magic character
-        'V' close handling.
-
-        GETSUPPORT returns WDIOF_KEEPALIVEPING, and the GETSTATUS call
-        returns if the device is open or not.  [FIXME -- silliness
-        again?]
-
-mixcomwd.c -- MixCom Watchdog
-
-        [FIXME -- I'm unable to tell what the timeout is]
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns WDIOF_KEEPALIVEPING, GETSTATUS returns if
-        the device is opened or not [FIXME -- I'm not really sure how
-        this works, there seems to be some magic connected to
-        CONFIG_WATCHDOG_NOWAYOUT]
-
-pcwd.c -- Berkshire PC Watchdog
-
-        Hardcoded timeout of 1.5 seconds
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns WDIOF_OVERHEAT|WDIOF_CARDRESET and both
-        GETSTATUS and GETBOOTSTATUS return something useful.
-
-        The SETOPTIONS call can be used to enable and disable the card
-        and to ask the driver to call panic if the system overheats.
-
-sbc60xxwdt.c -- 60xx Single Board Computer
-
-        Hardcoded timeout of 10 seconds
-
-        Does not support CONFIG_WATCHDOG_NOWAYOUT, but has the magic
-        character 'V' close handling.
-
-        No bits set in GETSUPPORT
-
-scx200.c -- National SCx200 CPUs
-
-        Not in the kernel yet.
-
-        The timeout is set using a module parameter "margin" which
-        defaults to 60 seconds.  The timeout can also be set using
-        SETTIMEOUT and read using GETTIMEOUT.
-
-        Supports a module parameter "nowayout" that is initialized
-        with the value of CONFIG_WATCHDOG_NOWAYOUT.  Also supports the
-        magic character 'V' handling.
-
-shwdt.c -- SuperH 3/4 processors
-
-        [FIXME -- I'm unable to tell what the timeout is]
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns WDIOF_KEEPALIVEPING, and the GETSTATUS call
-        returns if the device is open or not.  [FIXME -- silliness
-        again?]
-
-softdog.c -- Software watchdog
-
-        The timeout is set with the module parameter "soft_margin"
-        which defaults to 60 seconds, the timeout is also settable
-        using the SETTIMEOUT ioctl.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        WDIOF_SETTIMEOUT bit set in GETSUPPORT
-
-w83877f_wdt.c -- W83877F Computer
-
-        Hardcoded timeout of 30 seconds
-
-        Does not support CONFIG_WATCHDOG_NOWAYOUT, but has the magic
-        character 'V' close handling.
-
-        No bits set in GETSUPPORT
-
-w83627hf_wdt.c -- w83627hf watchdog
-
-        Timeout that defaults to 60 seconds, supports SETTIMEOUT.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns WDIOF_KEEPALIVEPING and WDIOF_SETTIMEOUT.
-        The GETSTATUS call returns if the device is open or not.
-
-wdt.c -- ICS WDT500/501 ISA and
-wdt_pci.c -- ICS WDT500/501 PCI
-
-        Default timeout of 60 seconds.  The timeout is also settable
-        using the SETTIMEOUT ioctl.
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        GETSUPPORT returns with bits set depending on the actual
-        card. The WDT501 supports a lot of external monitoring, the
-        WDT500 much less.
-
-wdt285.c -- Footbridge watchdog
-
-        The timeout is set with the module parameter "soft_margin"
-        which defaults to 60 seconds.  The timeout is also settable
-        using the SETTIMEOUT ioctl.
-
-        Does not support CONFIG_WATCHDOG_NOWAYOUT
-
-        WDIOF_SETTIMEOUT bit set in GETSUPPORT
-
-wdt977.c -- Netwinder W83977AF chip
-
-        Hardcoded timeout of 3 minutes
-
-        Supports CONFIG_WATCHDOG_NOWAYOUT
-
-        Does not support any ioctls at all.
-
diff --git a/Documentation/watchdog/watchdog.txt b/Documentation/watchdog/watchdog.txt
deleted file mode 100644
index 4b1ff69cc19a..000000000000
--- a/Documentation/watchdog/watchdog.txt
+++ /dev/null
@@ -1,94 +0,0 @@
-        Watchdog Timer Interfaces For The Linux Operating System
-
-                Alan Cox <alan@lxorguk.ukuu.org.uk>
-
-             Custom Linux Driver And Program Development
-
-
-The following watchdog drivers are currently implemented:
-
-        ICS     WDT501-P
-        ICS     WDT501-P (no fan tachometer)
-        ICS     WDT500-P
-        Software Only
-        SA1100 Internal Watchdog
-        Berkshire Products PC Watchdog Revision A & C (by Ken Hollis)
-
-
-All six interfaces provide /dev/watchdog, which when open must be written
-to within a timeout or the machine will reboot. Each write delays the reboot
-time another timeout. In the case of the software watchdog the ability to 
-reboot will depend on the state of the machines and interrupts. The hardware
-boards physically pull the machine down off their own onboard timers and
-will reboot from almost anything.
-
-A second temperature monitoring interface is available on the WDT501P cards
-and some Berkshire cards. This provides /dev/temperature. This is the machine 
-internal temperature in degrees Fahrenheit. Each read returns a single byte 
-giving the temperature.
-
-The third interface logs kernel messages on additional alert events.
-
-Both software and hardware watchdog drivers are available in the standard
-kernel. If you are using the software watchdog, you probably also want
-to use "panic=60" as a boot argument as well.
-
-The wdt card cannot be safely probed for. Instead you need to pass
-wdt=ioaddr,irq as a boot parameter - eg "wdt=0x240,11".
-
-The SA1100 watchdog module can be configured with the "sa1100_margin"
-commandline argument which specifies timeout value in seconds.
-
-The i810 TCO watchdog modules can be configured with the "i810_margin"
-commandline argument which specifies the counter initial value. The counter
-is decremented every 0.6 seconds and default to 50 (30 seconds). Values can
-range between 3 and 63.
-
-The i810 TCO watchdog driver also implements the WDIOC_GETSTATUS and
-WDIOC_GETBOOTSTATUS ioctl()s. WDIOC_GETSTATUS returns the actual counter value
-and WDIOC_GETBOOTSTATUS returns the value of TCO2 Status Register (see Intel's
-documentation for the 82801AA and 82801AB datasheet). 
-
-Features
---------
-                WDT501P         WDT500P         Software        Berkshire       i810 TCO        SA1100WD
-Reboot Timer       X               X                X               X               X               X
-External Reboot    X               X                o               o               o               X
-I/O Port Monitor   o               o                o               X               o               o
-Temperature        X               o                o               X               o               o
-Fan Speed          X               o                o               o               o               o
-Power Under        X               o                o               o               o               o
-Power Over         X               o                o               o               o               o
-Overheat           X               o                o               o               o               o
-
-The external event interfaces on the WDT boards are not currently supported.
-Minor numbers are however allocated for it.
-
-
-Example Watchdog Driver:  see Documentation/watchdog/src/watchdog-simple.c
-
-
-Contact Information
-
-People keep asking about the WDT watchdog timer hardware: The phone contacts
-for Industrial Computer Source are:
- 
-Industrial Computer Source
-http://www.indcompsrc.com
-ICS Advent, San Diego
-6260 Sequence Dr.
-San Diego, CA 92121-4371
-Phone (858) 677-0877
-FAX: (858) 677-0895
->
-ICS Advent Europe, UK
-Oving Road
-Chichester,
-West Sussex,
-PO19 4ET, UK
-Phone: 00.44.1243.533900
-
-
-and please mention Linux when enquiring.
-
-For full information about the PCWD cards see the pcwd-watchdog.txt document.
diff --git a/Documentation/watchdog/wdt.txt b/Documentation/watchdog/wdt.txt
new file mode 100644
index 000000000000..03fd756d976d
--- /dev/null
+++ b/Documentation/watchdog/wdt.txt
@@ -0,0 +1,43 @@
+Last Reviewed: 10/05/2007
+
+        WDT Watchdog Timer Interfaces For The Linux Operating System
+                Alan Cox <alan@lxorguk.ukuu.org.uk>
+
+        ICS     WDT501-P
+        ICS     WDT501-P (no fan tachometer)
+        ICS     WDT500-P
+
+All the interfaces provide /dev/watchdog, which when open must be written
+to within a timeout or the machine will reboot. Each write delays the reboot
+time another timeout. In the case of the software watchdog the ability to
+reboot will depend on the state of the machines and interrupts. The hardware
+boards physically pull the machine down off their own onboard timers and
+will reboot from almost anything.
+
+A second temperature monitoring interface is available on the WDT501P cards
+This provides /dev/temperature. This is the machine internal temperature in
+degrees Fahrenheit. Each read returns a single byte giving the temperature.
+
+The third interface logs kernel messages on additional alert events.
+
+The wdt card cannot be safely probed for. Instead you need to pass
+wdt=ioaddr,irq as a boot parameter - eg "wdt=0x240,11".
+
+Features
+--------
+                WDT501P         WDT500P
+Reboot Timer       X               X
+External Reboot    X               X
+I/O Port Monitor   o               o
+Temperature        X               o
+Fan Speed          X               o
+Power Under        X               o
+Power Over         X               o
+Overheat           X               o
+
+The external event interfaces on the WDT boards are not currently supported.
+Minor numbers are however allocated for it.
+
+
+Example Watchdog Driver:  see Documentation/watchdog/src/watchdog-simple.c
+
diff --git a/MAINTAINERS b/MAINTAINERS
index 4cc17b993b6a..f3b5a391e074 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -30,8 +30,11 @@ trivial patch so apply some common sense.
         job the maintainers (and especially Linus) do is to keep things
         looking the same. Sometimes this means that the clever hack in
         your driver to get around a problem actually needs to become a
-        generalized kernel feature ready for next time. See
-        Documentation/CodingStyle for guidance here.
+        generalized kernel feature ready for next time.
+
+        PLEASE check your patch with the automated style checker
+        (scripts/checkpatch.pl) to catch trival style violations.
+        See Documentation/CodingStyle for guidance here.
 
         PLEASE try to include any credit lines you want added with the
         patch. It avoids people being missed off by mistake and makes
@@ -972,6 +975,15 @@ M:	johannes@sipsolutions.net
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 
+CHECKPATCH
+P:      Andy Whitcroft
+M:      apw@shadowen.org
+P:      Randy Dunlap
+M:      rdunlap@xenotime.net
+P:      Joel Schopp
+M:      jschopp@austin.ibm.com
+S:      Supported
+
 COMMON INTERNET FILE SYSTEM (CIFS)
 P:      Steve French
 M:      sfrench@samba.org
@@ -1475,6 +1487,13 @@ L:	linux-usb-devel@lists.sourceforge.net
 L:      linuxppc-embedded@ozlabs.org
 S:      Maintained
 
+FREESCALE QUICC ENGINE UCC ETHERNET DRIVER
+P:      Li Yang
+M:      leoli@freescale.com
+L:      netdev@vger.kernel.org
+L:      linuxppc-embedded@ozlabs.org
+S:      Maintained
+
 FILE LOCKING (flock() and fcntl()/lockf())
 P:      Matthew Wilcox
 M:      matthew@wil.cx
@@ -1486,6 +1505,14 @@ P:	Alexander Viro
 M:      viro@zeniv.linux.org.uk
 S:      Maintained
 
+FIREWIRE SUBSYSTEM
+P:      Kristian Hoegsberg, Stefan Richter
+M:      krh@redhat.com, stefanr@s5r6.in-berlin.de
+L:      linux1394-devel@lists.sourceforge.net
+W:      http://www.linux1394.org/
+T:      git kernel.org:/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6.git
+S:      Maintained
+
 FIRMWARE LOADER (request_firmware)
 L:      linux-kernel@vger.kernel.org
 S:      Orphan
@@ -2880,8 +2907,8 @@ W:	ftp://ftp.kernel.org/pub/linux/kernel/people/rml/preempt-kernel
 S:      Supported
 
 PRISM54 WIRELESS DRIVER
-P:      Prism54 Development Team
-M:      developers@islsm.org
+P:      Luis R. Rodriguez
+M:      mcgrof@gmail.com
 L:      linux-wireless@vger.kernel.org
 W:      http://prism54.org
 S:      Maintained
@@ -3525,7 +3552,7 @@ S:	Maintained
 
 TULIP NETWORK DRIVER
 P:      Valerie Henson
-M:      val_henson@linux.intel.com
+M:      val@nmt.edu
 L:      tulip-users@lists.sourceforge.net
 W:      http://sourceforge.net/projects/tulip/
 S:      Maintained
diff --git a/Makefile b/Makefile
index 562a90902cf6..30d685b629a4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 22
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Jeff Thinks I Should Change This, But To What?
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 770f717bd250..79c6e5a24456 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -83,22 +83,20 @@ choice
           check out the Linux/Alpha FAQ, accessible on the WWW from
           <http://www.alphalinux.org/>. In summary:
 
-          Alcor/Alpha-XLT     AS 600
+          Alcor/Alpha-XLT     AS 600, AS 500, XL-300, XL-366
           Alpha-XL            XL-233, XL-266
           AlphaBook1          Alpha laptop
           Avanti              AS 200, AS 205, AS 250, AS 255, AS 300, AS 400
           Cabriolet           AlphaPC64, AlphaPCI64
-          DP264               DP264
+          DP264               DP264 / DS20 / ES40 / DS10 / DS10L
           EB164               EB164 21164 evaluation board
           EB64+               EB64+ 21064 evaluation board
           EB66                EB66 21066 evaluation board
           EB66+               EB66+ 21066 evaluation board
-          Jensen              DECpc 150, DEC 2000 model 300,
-          DEC 2000 model 500
+          Jensen              DECpc 150, DEC 2000 models 300, 500
           LX164               AlphaPC164-LX
           Lynx                AS 2100A
-          Miata               Personal Workstation 433a, 433au, 500a,
-          500au, 600a, or 600au
+          Miata               Personal Workstation 433/500/600 a/au
           Marvel              AlphaServer ES47 / ES80 / GS1280
           Mikasa              AS 1000
           Noname              AXPpci33, UDB (Multia)
@@ -108,9 +106,9 @@ choice
           Ruffian             RPX164-2, AlphaPC164-UX, AlphaPC164-BX
           SX164               AlphaPC164-SX
           Sable               AS 2000, AS 2100
-          Shark               DS 20L
-          Takara              Takara
-          Titan               AlphaServer ES45 / DS25
+          Shark               DS 20L
+          Takara              Takara (OEM)
+          Titan               AlphaServer ES45 / DS25 / DS15
           Wildfire            AlphaServer GS 40/80/160/320
 
           If you don't know what to do, choose "generic".
@@ -481,6 +479,15 @@ config ALPHA_BROKEN_IRQ_MASK
         depends on ALPHA_GENERIC || ALPHA_PC164
         default y
 
+config VGA_HOSE
+        bool
+        depends on ALPHA_GENERIC || ALPHA_TITAN || ALPHA_MARVEL || ALPHA_TSUNAMI
+        default y
+        help
+          Support VGA on an arbitrary hose; needed for several platforms
+          which always have multiple hoses, and whose consoles support it.
+
+
 config ALPHA_SRM
         bool "Use SRM as bootloader" if ALPHA_CABRIOLET || ALPHA_AVANTI_CH || ALPHA_EB64P || ALPHA_PC164 || ALPHA_TAKARA || ALPHA_EB164 || ALPHA_ALCOR || ALPHA_MIATA || ALPHA_LX164 || ALPHA_SX164 || ALPHA_NAUTILUS || ALPHA_NONAME
         default y if ALPHA_JENSEN || ALPHA_MIKASA || ALPHA_SABLE || ALPHA_LYNX || ALPHA_NORITAKE || ALPHA_DP264 || ALPHA_RAWHIDE || ALPHA_EIGER || ALPHA_WILDFIRE || ALPHA_TITAN || ALPHA_SHARK || ALPHA_MARVEL
@@ -537,10 +544,14 @@ config HAVE_DEC_LOCK
         default y
 
 config NR_CPUS
-        int "Maximum number of CPUs (2-64)"
-        range 2 64
+        int "Maximum number of CPUs (2-32)"
+        range 2 32
         depends on SMP
-        default "64"
+        default "32" if ALPHA_GENERIC || ALPHA_MARVEL
+        default "4" if !ALPHA_GENERIC && !ALPHA_MARVEL
+        help
+          MARVEL support can handle a maximum of 32 CPUs, all the others
+          with working support have a maximum of 4 CPUs.
 
 config ARCH_DISCONTIGMEM_ENABLE
         bool "Discontiguous Memory Support (EXPERIMENTAL)"
@@ -644,6 +655,13 @@ source "arch/alpha/oprofile/Kconfig"
 
 source "arch/alpha/Kconfig.debug"
 
+# DUMMY_CONSOLE may be defined in drivers/video/console/Kconfig
+# but we also need it if VGA_HOSE is set
+config DUMMY_CONSOLE
+        bool
+        depends on VGA_HOSE
+        default y
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff --git a/arch/alpha/boot/tools/mkbb.c b/arch/alpha/boot/tools/mkbb.c
index 23c7190b047c..632a7fd6d7dc 100644
--- a/arch/alpha/boot/tools/mkbb.c
+++ b/arch/alpha/boot/tools/mkbb.c
@@ -81,7 +81,7 @@ typedef union __bootblock {
 #define bootblock_label         __u1.__label
 #define bootblock_checksum      __u2.__checksum
 
-main(int argc, char ** argv)
+int main(int argc, char ** argv)
 {
     bootblock           bootblock_from_disk;
     bootblock           bootloader_image;
diff --git a/arch/alpha/kernel/console.c b/arch/alpha/kernel/console.c
index f313b34939bb..da711e37fc97 100644
--- a/arch/alpha/kernel/console.c
+++ b/arch/alpha/kernel/console.c
@@ -9,16 +9,20 @@
 #include <linux/init.h>
 #include <linux/tty.h>
 #include <linux/console.h>
+#include <linux/vt.h>
 #include <asm/vga.h>
 #include <asm/machvec.h>
 
+#include "pci_impl.h"
+
 #ifdef CONFIG_VGA_HOSE
 
-/*
- * Externally-visible vga hose bases
- */
-unsigned long __vga_hose_io_base = 0;   /* base for default hose */
-unsigned long __vga_hose_mem_base = 0;  /* base for default hose */
+struct pci_controller *pci_vga_hose;
+static struct resource alpha_vga = {
+        .name   = "alpha-vga+",
+        .start  = 0x3C0,
+        .end    = 0x3DF
+};
 
 static struct pci_controller * __init 
 default_vga_hose_select(struct pci_controller *h1, struct pci_controller *h2)
@@ -30,36 +34,58 @@ default_vga_hose_select(struct pci_controller *h1, struct pci_controller *h2)
 }
 
 void __init 
-set_vga_hose(struct pci_controller *hose)
-{
-        if (hose) {
-                __vga_hose_io_base = hose->io_space->start;
-                __vga_hose_mem_base = hose->mem_space->start;
-        }
-}
-
-void __init 
 locate_and_init_vga(void *(*sel_func)(void *, void *))
 {
         struct pci_controller *hose = NULL;
         struct pci_dev *dev = NULL;
 
+        /* Default the select function */
         if (!sel_func) sel_func = (void *)default_vga_hose_select;
 
+        /* Find the console VGA device */
         for(dev=NULL; (dev=pci_get_class(PCI_CLASS_DISPLAY_VGA << 8, dev));) {
-                if (!hose) hose = dev->sysdata;
-                else hose = sel_func(hose, dev->sysdata);
+                if (!hose)
+                        hose = dev->sysdata;
+                else
+                        hose = sel_func(hose, dev->sysdata);
         }
 
-        /* Did we already inititialize the correct one? */
-        if (conswitchp == &vga_con &&
-            __vga_hose_io_base == hose->io_space->start &&
-            __vga_hose_mem_base == hose->mem_space->start)
+        /* Did we already initialize the correct one? Is there one? */
+        if (!hose || (conswitchp == &vga_con && pci_vga_hose == hose))
                 return;
 
-        /* Set the VGA hose and init the new console */
-        set_vga_hose(hose);
+        /* Create a new VGA ioport resource WRT the hose it is on. */
+        alpha_vga.start += hose->io_space->start;
+        alpha_vga.end += hose->io_space->start;
+        request_resource(hose->io_space, &alpha_vga);
+
+        /* Set the VGA hose and init the new console. */
+        pci_vga_hose = hose;
         take_over_console(&vga_con, 0, MAX_NR_CONSOLES-1, 1);
 }
 
+void __init
+find_console_vga_hose(void)
+{
+        u64 *pu64 = (u64 *)((u64)hwrpb + hwrpb->ctbt_offset);
+
+        if (pu64[7] == 3) {     /* TERM_TYPE == graphics */
+                struct pci_controller *hose;
+                int h = (pu64[30] >> 24) & 0xff;        /* console hose # */
+
+                /*
+                 * Our hose numbering DOES match the console's, so find
+                 * the right one...
+                 */
+                for (hose = hose_head; hose; hose = hose->next) {
+                        if (hose->index == h) break;
+                }
+
+                if (hose) {
+                        printk("Console graphics on hose %d\n", h);
+                        pci_vga_hose = hose;
+                }
+        }
+}
+
 #endif
diff --git a/arch/alpha/kernel/core_marvel.c b/arch/alpha/kernel/core_marvel.c
index 7f6a98455e74..f10d2eddd2c3 100644
--- a/arch/alpha/kernel/core_marvel.c
+++ b/arch/alpha/kernel/core_marvel.c
@@ -25,6 +25,7 @@
 #include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
 #include <asm/rtc.h>
+#include <asm/vga.h>
 
 #include "proto.h"
 #include "pci_impl.h"
@@ -367,9 +368,8 @@ marvel_io7_present(gct6_node *node)
 }
 
 static void __init
-marvel_init_vga_hose(void)
+marvel_find_console_vga_hose(void)
 {
-#ifdef CONFIG_VGA_HOSE
         u64 *pu64 = (u64 *)((u64)hwrpb + hwrpb->ctbt_offset);
 
         if (pu64[7] == 3) {     /* TERM_TYPE == graphics */
@@ -403,7 +403,6 @@ marvel_init_vga_hose(void)
                         pci_vga_hose = hose;
                 }
         }
-#endif /* CONFIG_VGA_HOSE */
 }
 
 gct6_search_struct gct_wanted_node_list[] = {
@@ -459,7 +458,7 @@ marvel_init_arch(void)
                 marvel_init_io7(io7);
 
         /* Check for graphic console location (if any).  */
-        marvel_init_vga_hose();
+        marvel_find_console_vga_hose();
 }
 
 void
@@ -684,9 +683,6 @@ __marvel_rtc_io(u8 b, unsigned long addr, int write)
 /*
  * IO map support.
  */
-
-#define __marvel_is_mem_vga(a)  (((a) >= 0xa0000) && ((a) <= 0xc0000))
-
 void __iomem *
 marvel_ioremap(unsigned long addr, unsigned long size)
 {
@@ -698,13 +694,9 @@ marvel_ioremap(unsigned long addr, unsigned long size)
         unsigned long pfn;
 
         /*
-         * Adjust the addr.
+         * Adjust the address.
          */ 
-#ifdef CONFIG_VGA_HOSE
-        if (pci_vga_hose && __marvel_is_mem_vga(addr)) {
-                addr += pci_vga_hose->mem_space->start;
-        }
-#endif
+        FIXUP_MEMADDR_VGA(addr);
 
         /*
          * Find the hose.
@@ -781,7 +773,9 @@ marvel_ioremap(unsigned long addr, unsigned long size)
                 return (void __iomem *) vaddr;
         }
 
-        return NULL;
+        /* Assume it was already a reasonable address */
+        vaddr = baddr + hose->mem_space->start;
+        return (void __iomem *) vaddr;
 }
 
 void
@@ -803,21 +797,12 @@ marvel_is_mmio(const volatile void __iomem *xaddr)
                 return (addr & 0xFF000000UL) == 0;
 }
 
-#define __marvel_is_port_vga(a) \
-  (((a) >= 0x3b0) && ((a) < 0x3e0) && ((a) != 0x3b3) && ((a) != 0x3d3))
 #define __marvel_is_port_kbd(a) (((a) == 0x60) || ((a) == 0x64))
 #define __marvel_is_port_rtc(a) (((a) == 0x70) || ((a) == 0x71))
 
 void __iomem *marvel_ioportmap (unsigned long addr)
 {
-        if (__marvel_is_port_rtc (addr) || __marvel_is_port_kbd(addr))
-                ;
-#ifdef CONFIG_VGA_HOSE
-        else if (__marvel_is_port_vga (addr) && pci_vga_hose)
-                addr += pci_vga_hose->io_space->start;
-#endif
-        else
-                return NULL;
+        FIXUP_IOADDR_VGA(addr);
         return (void __iomem *)addr;
 }
 
@@ -829,8 +814,14 @@ marvel_ioread8(void __iomem *xaddr)
                 return 0;
         else if (__marvel_is_port_rtc(addr))
                 return __marvel_rtc_io(0, addr, 0);
-        else
+        else if (marvel_is_ioaddr(addr))
                 return __kernel_ldbu(*(vucp)addr);
+        else
+                /* this should catch other legacy addresses
+                   that would normally fail on MARVEL,
+                   because there really is nothing there...
+                */
+                return ~0;
 }
 
 void
@@ -841,7 +832,7 @@ marvel_iowrite8(u8 b, void __iomem *xaddr)
                 return;
         else if (__marvel_is_port_rtc(addr)) 
                 __marvel_rtc_io(b, addr, 1);
-        else
+        else if (marvel_is_ioaddr(addr))
                 __kernel_stb(b, *(vucp)addr);
 }
 
diff --git a/arch/alpha/kernel/core_titan.c b/arch/alpha/kernel/core_titan.c
index 3662fef7db9a..819326627b96 100644
--- a/arch/alpha/kernel/core_titan.c
+++ b/arch/alpha/kernel/core_titan.c
@@ -21,6 +21,7 @@
 #include <asm/smp.h>
 #include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
+#include <asm/vga.h>
 
 #include "proto.h"
 #include "pci_impl.h"
@@ -35,6 +36,11 @@ struct
 } saved_config[4] __attribute__((common));
 
 /*
+ * Is PChip 1 present? No need to query it more than once.
+ */
+static int titan_pchip1_present;
+
+/*
  * BIOS32-style PCI interface:
  */
 
@@ -344,43 +350,17 @@ titan_init_one_pachip_port(titan_pachip_port *port, int index)
 static void __init
 titan_init_pachips(titan_pachip *pachip0, titan_pachip *pachip1)
 {
-        int pchip1_present = TITAN_cchip->csc.csr & 1L<<14;
+        titan_pchip1_present = TITAN_cchip->csc.csr & 1L<<14;
 
         /* Init the ports in hose order... */
         titan_init_one_pachip_port(&pachip0->g_port, 0);        /* hose 0 */
-        if (pchip1_present)
+        if (titan_pchip1_present)
                 titan_init_one_pachip_port(&pachip1->g_port, 1);/* hose 1 */
         titan_init_one_pachip_port(&pachip0->a_port, 2);        /* hose 2 */
-        if (pchip1_present)
+        if (titan_pchip1_present)
                 titan_init_one_pachip_port(&pachip1->a_port, 3);/* hose 3 */
 }
 
-static void __init
-titan_init_vga_hose(void)
-{
-#ifdef CONFIG_VGA_HOSE
-        u64 *pu64 = (u64 *)((u64)hwrpb + hwrpb->ctbt_offset);
-
-        if (pu64[7] == 3) {     /* TERM_TYPE == graphics */
-                struct pci_controller *hose;
-                int h = (pu64[30] >> 24) & 0xff;        /* console hose # */
-
-                /*
-                 * Our hose numbering matches the console's, so just find
-                 * the right one...
-                 */
-                for (hose = hose_head; hose; hose = hose->next) {
-                        if (hose->index == h) break;
-                }
-
-                if (hose) {
-                        printk("Console graphics on hose %d\n", hose->index);
-                        pci_vga_hose = hose;
-                }
-        }
-#endif /* CONFIG_VGA_HOSE */
-}
-
 void __init
 titan_init_arch(void)
 {
@@ -406,6 +386,7 @@ titan_init_arch(void)
 
         /* With multiple PCI busses, we play with I/O as physical addrs.  */
         ioport_resource.end = ~0UL;
+        iomem_resource.end = ~0UL;
 
         /* PCI DMA Direct Mapping is 1GB at 2GB.  */
         __direct_map_base = 0x80000000;
@@ -415,7 +396,7 @@ titan_init_arch(void)
         titan_init_pachips(TITAN_pachip0, TITAN_pachip1);
 
         /* Check for graphic console location (if any).  */
-        titan_init_vga_hose();
+        find_console_vga_hose();
 }
 
 static void
@@ -441,9 +422,7 @@ titan_kill_one_pachip_port(titan_pachip_port *port, int index)
 static void
 titan_kill_pachips(titan_pachip *pachip0, titan_pachip *pachip1)
 {
-        int pchip1_present = TITAN_cchip->csc.csr & 1L<<14;
-
-        if (pchip1_present) {
+        if (titan_pchip1_present) {
                 titan_kill_one_pachip_port(&pachip1->g_port, 1);
                 titan_kill_one_pachip_port(&pachip1->a_port, 3);
         }
@@ -463,6 +442,14 @@ titan_kill_arch(int mode)
  */
 
 void __iomem *
+titan_ioportmap(unsigned long addr)
+{
+        FIXUP_IOADDR_VGA(addr);
+        return (void __iomem *)(addr + TITAN_IO_BIAS);
+}
+
+
+void __iomem *
 titan_ioremap(unsigned long addr, unsigned long size)
 {
         int h = (addr & TITAN_HOSE_MASK) >> TITAN_HOSE_SHIFT;
@@ -475,14 +462,12 @@ titan_ioremap(unsigned long addr, unsigned long size)
         unsigned long pfn;
 
         /*
-         * Adjust the addr.
+         * Adjust the address and hose, if necessary.
          */ 
-#ifdef CONFIG_VGA_HOSE
-        if (pci_vga_hose && __titan_is_mem_vga(addr)) {
+        if (pci_vga_hose && __is_mem_vga(addr)) {
                 h = pci_vga_hose->index;
                 addr += pci_vga_hose->mem_space->start;
         }
-#endif
 
         /*
          * Find the hose.
@@ -521,8 +506,10 @@ titan_ioremap(unsigned long addr, unsigned long size)
                  * Map it
                  */
                 area = get_vm_area(size, VM_IOREMAP);
-                if (!area)
+                if (!area) {
+                        printk("ioremap failed... no vm_area...\n");
                         return NULL;
+                }
 
                 ptes = hose->sg_pci->ptes;
                 for (vaddr = (unsigned long)area->addr; 
@@ -539,7 +526,7 @@ titan_ioremap(unsigned long addr, unsigned long size)
                         if (__alpha_remap_area_pages(vaddr,
                                                      pfn << PAGE_SHIFT, 
                                                      PAGE_SIZE, 0)) {
-                                printk("FAILED to map...\n");
+                                printk("FAILED to remap_area_pages...\n");
                                 vfree(area->addr);
                                 return NULL;
                         }
@@ -551,7 +538,8 @@ titan_ioremap(unsigned long addr, unsigned long size)
                 return (void __iomem *) vaddr;
         }
 
-        return NULL;
+        /* Assume a legacy (read: VGA) address, and return appropriately. */
+        return (void __iomem *)(addr + TITAN_MEM_BIAS);
 }
 
 void
@@ -574,6 +562,7 @@ titan_is_mmio(const volatile void __iomem *xaddr)
 }
 
 #ifndef CONFIG_ALPHA_GENERIC
+EXPORT_SYMBOL(titan_ioportmap);
 EXPORT_SYMBOL(titan_ioremap);
 EXPORT_SYMBOL(titan_iounmap);
 EXPORT_SYMBOL(titan_is_mmio);
@@ -750,6 +739,7 @@ titan_agp_info(void)
         if (titan_query_agp(port))
                 hosenum = 2;
         if (hosenum < 0 && 
+            titan_pchip1_present &&
             titan_query_agp(port = &TITAN_pachip1->a_port)) 
                 hosenum = 3;
         
diff --git a/arch/alpha/kernel/core_tsunami.c b/arch/alpha/kernel/core_tsunami.c
index ce623c6e55e1..ef91e09590d4 100644
--- a/arch/alpha/kernel/core_tsunami.c
+++ b/arch/alpha/kernel/core_tsunami.c
@@ -19,6 +19,7 @@
 
 #include <asm/ptrace.h>
 #include <asm/smp.h>
+#include <asm/vga.h>
 
 #include "proto.h"
 #include "pci_impl.h"
@@ -349,6 +350,26 @@ tsunami_init_one_pchip(tsunami_pchip *pchip, int index)
         tsunami_pci_tbi(hose, 0, -1);
 }
 
+
+void __iomem *
+tsunami_ioportmap(unsigned long addr)
+{
+        FIXUP_IOADDR_VGA(addr);
+        return (void __iomem *)(addr + TSUNAMI_IO_BIAS);
+}
+
+void __iomem *
+tsunami_ioremap(unsigned long addr, unsigned long size)
+{
+        FIXUP_MEMADDR_VGA(addr);
+        return (void __iomem *)(addr + TSUNAMI_MEM_BIAS);
+}
+
+#ifndef CONFIG_ALPHA_GENERIC
+EXPORT_SYMBOL(tsunami_ioportmap);
+EXPORT_SYMBOL(tsunami_ioremap);
+#endif
+
 void __init
 tsunami_init_arch(void)
 {
@@ -393,6 +414,9 @@ tsunami_init_arch(void)
         tsunami_init_one_pchip(TSUNAMI_pchip0, 0);
         if (TSUNAMI_cchip->csc.csr & 1L<<14)
                 tsunami_init_one_pchip(TSUNAMI_pchip1, 1);
+
+        /* Check for graphic console location (if any).  */
+        find_console_vga_hose();
 }
 
 static void
diff --git a/arch/alpha/kernel/proto.h b/arch/alpha/kernel/proto.h
index 95912ecc65e1..708d5ca87782 100644
--- a/arch/alpha/kernel/proto.h
+++ b/arch/alpha/kernel/proto.h
@@ -108,6 +108,15 @@ extern int wildfire_cpuid_to_nid(int);
 extern unsigned long wildfire_node_mem_start(int);
 extern unsigned long wildfire_node_mem_size(int);
 
+/* console.c */
+#ifdef CONFIG_VGA_HOSE
+extern void find_console_vga_hose(void);
+extern void locate_and_init_vga(void *(*)(void *, void *));
+#else
+static inline void find_console_vga_hose(void) { }
+static inline void locate_and_init_vga(void *(*sel_func)(void *, void *)) { }
+#endif
+
 /* setup.c */
 extern unsigned long srm_hae;
 extern int boot_cpuid;
diff --git a/arch/alpha/kernel/sys_dp264.c b/arch/alpha/kernel/sys_dp264.c
index 85d2f933dd07..c71b0fd7a61f 100644
--- a/arch/alpha/kernel/sys_dp264.c
+++ b/arch/alpha/kernel/sys_dp264.c
@@ -543,6 +543,7 @@ dp264_init_pci(void)
 {
         common_init_pci();
         SMC669_Init(0);
+        locate_and_init_vga(NULL);
 }
 
 static void __init
@@ -551,6 +552,14 @@ monet_init_pci(void)
         common_init_pci();
         SMC669_Init(1);
         es1888_init();
+        locate_and_init_vga(NULL);
+}
+
+static void __init
+clipper_init_pci(void)
+{
+        common_init_pci();
+        locate_and_init_vga(NULL);
 }
 
 static void __init
@@ -655,7 +664,7 @@ struct alpha_machine_vector clipper_mv __initmv = {
         .init_arch              = tsunami_init_arch,
         .init_irq               = clipper_init_irq,
         .init_rtc               = common_init_rtc,
-        .init_pci               = common_init_pci,
+        .init_pci               = clipper_init_pci,
         .kill_arch              = tsunami_kill_arch,
         .pci_map_irq            = clipper_map_irq,
         .pci_swizzle            = common_swizzle,
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index e349f03b830e..0bcb968cb60a 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -22,6 +22,7 @@
 #include <asm/core_marvel.h>
 #include <asm/hwrpb.h>
 #include <asm/tlbflush.h>
+#include <asm/vga.h>
 
 #include "proto.h"
 #include "err_impl.h"
@@ -412,10 +413,7 @@ marvel_init_pci(void)
 
         pci_probe_only = 1;
         common_init_pci();
-
-#ifdef CONFIG_VGA_HOSE
         locate_and_init_vga(NULL);
-#endif
 
         /* Clear any io7 errors.  */
         for (io7 = NULL; (io7 = marvel_next_io7(io7)) != NULL; ) 
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index f009b7bc0943..1d3c1398c428 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -331,9 +331,7 @@ titan_init_pci(void)
         pci_probe_only = 1;
         common_init_pci();
         SMC669_Init(0);
-#ifdef CONFIG_VGA_HOSE
         locate_and_init_vga(NULL);
-#endif
 }
 
 
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 2568d311be21..23348e9561b9 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -247,7 +247,7 @@ not_relocated:	mov	r0, #0
                 mov     r3, r7
                 bl      decompress_kernel
 
-                add     r0, r0, #127
+                add     r0, r0, #127 + 128      @ alignment + stack
                 bic     r0, r0, #127            @ align the kernel length
 /*
  * r0     = decompressed kernel length
@@ -269,6 +269,7 @@ not_relocated:	mov	r0, #0
                 stmia   r1!, {r9 - r14}
                 cmp     r2, r3
                 blo     1b
+                add     sp, r1, #128            @ relocate the stack
 
                 bl      cache_clean_flush
                 add     pc, r5, r0              @ call relocation code
@@ -476,6 +477,7 @@ __common_mmu_cache_on:
  */
                 .align  5
 reloc_start:    add     r9, r5, r0
+                sub     r9, r9, #128            @ do not copy the stack
                 debug_reloc_start
                 mov     r1, r4
 1:
@@ -486,6 +488,7 @@ reloc_start:	add	r9, r5, r0
 
                 cmp     r5, r9
                 blo     1b
+                add     sp, r1, #128            @ relocate the stack
                 debug_reloc_end
 
 call_kernel:    bl      cache_clean_flush
diff --git a/arch/arm/mach-at91/clock.c b/arch/arm/mach-at91/clock.c
index 06c9a0507d0d..848efb2a4ebf 100644
--- a/arch/arm/mach-at91/clock.c
+++ b/arch/arm/mach-at91/clock.c
@@ -364,19 +364,14 @@ static int at91_clk_show(struct seq_file *s, void *unused)
 {
         u32             scsr, pcsr, sr;
         struct clk      *clk;
-        unsigned        i;
 
         seq_printf(s, "SCSR = %8x\n", scsr = at91_sys_read(AT91_PMC_SCSR));
         seq_printf(s, "PCSR = %8x\n", pcsr = at91_sys_read(AT91_PMC_PCSR));
-
         seq_printf(s, "MOR  = %8x\n", at91_sys_read(AT91_CKGR_MOR));
         seq_printf(s, "MCFR = %8x\n", at91_sys_read(AT91_CKGR_MCFR));
         seq_printf(s, "PLLA = %8x\n", at91_sys_read(AT91_CKGR_PLLAR));
         seq_printf(s, "PLLB = %8x\n", at91_sys_read(AT91_CKGR_PLLBR));
-
         seq_printf(s, "MCKR = %8x\n", at91_sys_read(AT91_PMC_MCKR));
-        for (i = 0; i < 4; i++)
-                seq_printf(s, "PCK%d = %8x\n", i, at91_sys_read(AT91_PMC_PCKR(i)));
         seq_printf(s, "SR   = %8x\n", sr = at91_sys_read(AT91_PMC_SR));
 
         seq_printf(s, "\n");
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index ff8db29e989e..47ff676aca5f 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -76,12 +76,11 @@ static int at91_pm_verify_clocks(void)
                         pr_debug("AT91: PM - Suspend-to-RAM with USB still active\n");
                         return 0;
                 }
-        } else if (cpu_is_at91sam9260()) {
-#warning "Check SAM9260 USB clocks"
-        } else if (cpu_is_at91sam9261()) {
-#warning "Check SAM9261 USB clocks"
-        } else if (cpu_is_at91sam9263()) {
-#warning "Check SAM9263 USB clocks"
+        } else if (cpu_is_at91sam9260() || cpu_is_at91sam9261() || cpu_is_at91sam9263()) {
+                if ((scsr & (AT91SAM926x_PMC_UHP | AT91SAM926x_PMC_UDP)) != 0) {
+                        pr_debug("AT91: PM - Suspend-to-RAM with USB still active\n");
+                        return 0;
+                }
         }
 
 #ifdef CONFIG_AT91_PROGRAMMABLE_CLOCKS
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 36440c899583..074b7cb07743 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -630,7 +630,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 
         fs = get_fs();
         set_fs(KERNEL_DS);
-        if thumb_mode(regs) {
+        if (thumb_mode(regs)) {
                 fault = __get_user(tinstr, (u16 *)(instrptr & ~1));
                 if (!(fault))
                         instr = thumb2arm(tinstr);
diff --git a/arch/arm/oprofile/op_model_mpcore.c b/arch/arm/oprofile/op_model_mpcore.c
index 7791da791f5f..75bae067922d 100644
--- a/arch/arm/oprofile/op_model_mpcore.c
+++ b/arch/arm/oprofile/op_model_mpcore.c
@@ -200,8 +200,10 @@ static int em_call_function(int (*fn)(void))
         data.fn = fn;
         data.ret = 0;
 
+        preempt_disable();
         smp_call_function(em_func, &data, 1, 1);
         em_func(&data);
+        preempt_enable();
 
         return data.ret;
 }
diff --git a/arch/h8300/kernel/sys_h8300.c b/arch/h8300/kernel/sys_h8300.c
index 11ba75a05220..de7688cfd573 100644
--- a/arch/h8300/kernel/sys_h8300.c
+++ b/arch/h8300/kernel/sys_h8300.c
@@ -288,9 +288,9 @@ asmlinkage void syscall_print(void *dummy,...)
 int kernel_execve(const char *filename, char *const argv[], char *const envp[])
 {
         register long res __asm__("er0");
+        register char *const *_c __asm__("er3") = envp;
+        register char *const *_b __asm__("er2") = argv;
         register const char * _a __asm__("er1") = filename;
-        register void *_b __asm__("er2") = argv;
-        register void *_c __asm__("er3") = envp;
         __asm__ __volatile__ ("mov.l %1,er0\n\t"
                         "trapa  #0\n\t"
                         : "=r" (res)
diff --git a/arch/h8300/kernel/traps.c b/arch/h8300/kernel/traps.c
index 300e3279ca5a..f97183011c2c 100644
--- a/arch/h8300/kernel/traps.c
+++ b/arch/h8300/kernel/traps.c
@@ -136,7 +136,7 @@ void show_stack(struct task_struct *task, unsigned long *esp)
         printk("\nCall Trace:");
         i = 0;
         stack = esp;
-        while (((unsigned long)stack & (THREAD_SIZE - 1)) == 0) {
+        while (((unsigned long)stack & (THREAD_SIZE - 1)) != 0) {
                 addr = *stack++;
                 /*
                  * If the address is either in the text segment of the
diff --git a/arch/i386/kernel/cpu/mtrr/main.c b/arch/i386/kernel/cpu/mtrr/main.c
index 1cf466df330a..7202b98aac4f 100644
--- a/arch/i386/kernel/cpu/mtrr/main.c
+++ b/arch/i386/kernel/cpu/mtrr/main.c
@@ -734,10 +734,13 @@ void mtrr_ap_init(void)
  */
 void mtrr_save_state(void)
 {
-        if (smp_processor_id() == 0)
+        int cpu = get_cpu();
+
+        if (cpu == 0)
                 mtrr_save_fixed_ranges(NULL);
         else
                 smp_call_function_single(0, mtrr_save_fixed_ranges, NULL, 1, 1);
+        put_cpu();
 }
 
 static int __init mtrr_init_finialize(void)
diff --git a/arch/i386/kernel/microcode.c b/arch/i386/kernel/microcode.c
index 83f825f2e2d7..d865d041bea1 100644
--- a/arch/i386/kernel/microcode.c
+++ b/arch/i386/kernel/microcode.c
@@ -478,7 +478,7 @@ static int __init microcode_dev_init (void)
         return 0;
 }
 
-static void __exit microcode_dev_exit (void)
+static void microcode_dev_exit (void)
 {
         misc_deregister(&microcode_dev);
 }
diff --git a/arch/i386/kernel/reboot.c b/arch/i386/kernel/reboot.c
index 50dfc65319cd..5513f8d5b5be 100644
--- a/arch/i386/kernel/reboot.c
+++ b/arch/i386/kernel/reboot.c
@@ -89,6 +89,14 @@ static int __init set_bios_reboot(struct dmi_system_id *d)
 }
 
 static struct dmi_system_id __initdata reboot_dmi_table[] = {
+        {       /* Handle problems with rebooting on Dell E520's */
+                .callback = set_bios_reboot,
+                .ident = "Dell E520",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Dell DM061"),
+                },
+        },
         {       /* Handle problems with rebooting on Dell 1300's */
                 .callback = set_bios_reboot,
                 .ident = "Dell PowerEdge 1300",
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index 08f07a74a9d3..88baed1e7e83 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -943,10 +943,9 @@ exit:
 
 static void smp_tune_scheduling(void)
 {
-        unsigned long cachesize;       /* kB   */
-
         if (cpu_khz) {
-                cachesize = boot_cpu_data.x86_cache_size;
+                /* cache size in kB */
+                long cachesize = boot_cpu_data.x86_cache_size;
 
                 if (cachesize > 0)
                         max_cache_size = cachesize * 1024;
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index c8726c424b35..c12720d7cbc5 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -27,6 +27,7 @@
 #include <linux/bootmem.h>
 #include <linux/mm.h>
 #include <linux/highmem.h>
+#include <linux/sched.h>
 #include <asm/vmi.h>
 #include <asm/io.h>
 #include <asm/fixmap.h>
diff --git a/arch/i386/mm/fault.c b/arch/i386/mm/fault.c
index 29d7d61543a1..1ecb3e43b523 100644
--- a/arch/i386/mm/fault.c
+++ b/arch/i386/mm/fault.c
@@ -458,6 +458,11 @@ bad_area:
 bad_area_nosemaphore:
         /* User mode accesses just cause a SIGSEGV */
         if (error_code & 4) {
+                /*
+                 * It's possible to have interrupts off here.
+                 */
+                local_irq_enable();
+
                 /* 
                  * Valid to do another page fault here because this one came 
                  * from user space.
diff --git a/arch/i386/oprofile/nmi_int.c b/arch/i386/oprofile/nmi_int.c
index a7c0783b269a..11b7a51566a8 100644
--- a/arch/i386/oprofile/nmi_int.c
+++ b/arch/i386/oprofile/nmi_int.c
@@ -154,7 +154,7 @@ static int allocate_msrs(void)
         size_t counters_size = sizeof(struct op_msr) * model->num_counters;
 
         int i;
-        for_each_online_cpu(i) {
+        for_each_possible_cpu(i) {
                 cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL);
                 if (!cpu_msrs[i].counters) {
                         success = 0;
@@ -211,8 +211,14 @@ static int nmi_setup(void)
         /* Assume saved/restored counters are the same on all CPUs */
         model->fill_in_addresses(&cpu_msrs[0]);
         for_each_possible_cpu (cpu) {
-                if (cpu != 0)
-                        cpu_msrs[cpu] = cpu_msrs[0];
+                if (cpu != 0) {
+                        memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters,
+                                sizeof(struct op_msr) * model->num_counters);
+
+                        memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls,
+                                sizeof(struct op_msr) * model->num_controls);
+                }
+
         }
         on_each_cpu(nmi_save_registers, NULL, 0, 1);
         on_each_cpu(nmi_cpu_setup, NULL, 0, 1);
diff --git a/arch/i386/pci/fixup.c b/arch/i386/pci/fixup.c
index b62eafb997bc..b95b42950ed4 100644
--- a/arch/i386/pci/fixup.c
+++ b/arch/i386/pci/fixup.c
@@ -436,3 +436,14 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_CYRIX, PCI_DEVICE_ID_CYRIX_5530_LEGACY,
                         pci_early_fixup_cyrix_5530);
 DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_CYRIX, PCI_DEVICE_ID_CYRIX_5530_LEGACY,
                         pci_early_fixup_cyrix_5530);
+
+/*
+ * Siemens Nixdorf AG FSC Multiprocessor Interrupt Controller:
+ * prevent update of the BAR0, which doesn't look like a normal BAR.
+ */
+static void __devinit pci_siemens_interrupt_controller(struct pci_dev *dev)
+{
+        dev->resource[0].flags |= IORESOURCE_PCI_FIXED;
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SIEMENS, 0x0015,
+                          pci_siemens_interrupt_controller);
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index b8536c7c0877..85cdd23b0447 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -355,8 +355,9 @@ config RMW_INSNS
           adventurous.
 
 config SINGLE_MEMORY_CHUNK
-        bool "Use one physical chunk of memory only"
-        depends on ADVANCED && !SUN3
+        bool "Use one physical chunk of memory only" if ADVANCED && !SUN3
+        default y if SUN3
+        select NEED_MULTIPLE_NODES
         help
           Ignore all but the first contiguous chunk of physical memory for VM
           purposes.  This will save a few bytes kernel size and may speed up
@@ -377,6 +378,14 @@ config 060_WRITETHROUGH
           is hardwired on.  The 53c710 SCSI driver is known to suffer from
           this problem.
 
+config ARCH_DISCONTIGMEM_ENABLE
+        def_bool !SINGLE_MEMORY_CHUNK
+
+config NODES_SHIFT
+        int
+        default "3"
+        depends on !SINGLE_MEMORY_CHUNK
+
 source "mm/Kconfig"
 
 endmenu
diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile
index c20831a7e1a9..aa383a5ea7ac 100644
--- a/arch/m68k/Makefile
+++ b/arch/m68k/Makefile
@@ -19,6 +19,7 @@ COMPILE_ARCH = $(shell uname -m)
 # override top level makefile
 AS += -m68020
 LDFLAGS := -m m68kelf
+LDFLAGS_MODULE += -T $(srctree)/arch/m68k/kernel/module.lds
 ifneq ($(COMPILE_ARCH),$(ARCH))
         # prefix for cross-compiling binaries
         CROSS_COMPILE = m68k-linux-gnu-
diff --git a/arch/m68k/kernel/Makefile b/arch/m68k/kernel/Makefile
index 0b68ab8d63d1..a806208c7fb5 100644
--- a/arch/m68k/kernel/Makefile
+++ b/arch/m68k/kernel/Makefile
@@ -9,13 +9,12 @@ else
 endif
 extra-y += vmlinux.lds
 
-obj-y   := entry.o process.o traps.o ints.o signal.o ptrace.o \
+obj-y   := entry.o process.o traps.o ints.o signal.o ptrace.o module.o \
            sys_m68k.o time.o semaphore.o setup.o m68k_ksyms.o devres.o
 
 devres-y = ../../../kernel/irq/devres.o
 
 obj-$(CONFIG_PCI)       += bios32.o
-obj-$(CONFIG_MODULES)   += module.o
 obj-y$(CONFIG_MMU_SUN3) += dma.o        # no, it's not a typo
 
 EXTRA_AFLAGS := -traditional
diff --git a/arch/m68k/kernel/module.c b/arch/m68k/kernel/module.c
index 3b1a2ff61ddc..774862bc6977 100644
--- a/arch/m68k/kernel/module.c
+++ b/arch/m68k/kernel/module.c
@@ -1,3 +1,9 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+
 #include <linux/moduleloader.h>
 #include <linux/elf.h>
 #include <linux/vmalloc.h>
@@ -11,6 +17,8 @@
 #define DEBUGP(fmt...)
 #endif
 
+#ifdef CONFIG_MODULES
+
 void *module_alloc(unsigned long size)
 {
         if (size == 0)
@@ -118,11 +126,32 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
 
 int module_finalize(const Elf_Ehdr *hdr,
                     const Elf_Shdr *sechdrs,
-                    struct module *me)
+                    struct module *mod)
 {
+        module_fixup(mod, mod->arch.fixup_start, mod->arch.fixup_end);
+
         return 0;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
 }
+
+#endif /* CONFIG_MODULES */
+
+void module_fixup(struct module *mod, struct m68k_fixup_info *start,
+                  struct m68k_fixup_info *end)
+{
+        struct m68k_fixup_info *fixup;
+
+        for (fixup = start; fixup < end; fixup++) {
+                switch (fixup->type) {
+                case m68k_fixup_memoffset:
+                        *(u32 *)fixup->addr = m68k_memoffset;
+                        break;
+                case m68k_fixup_vnode_shift:
+                        *(u16 *)fixup->addr += m68k_virt_to_node_shift;
+                        break;
+                }
+        }
+}
diff --git a/arch/m68k/kernel/module.lds b/arch/m68k/kernel/module.lds
new file mode 100644
index 000000000000..fda94fa38243
--- /dev/null
+++ b/arch/m68k/kernel/module.lds
@@ -0,0 +1,7 @@
+SECTIONS {
+        .m68k_fixup : {
+                __start_fixup = .;
+                *(.m68k_fixup)
+                __stop_fixup = .;
+        }
+}
diff --git a/arch/m68k/kernel/setup.c b/arch/m68k/kernel/setup.c
index 610319356691..215c7bd43924 100644
--- a/arch/m68k/kernel/setup.c
+++ b/arch/m68k/kernel/setup.c
@@ -60,14 +60,12 @@ extern unsigned long availmem;
 int m68k_num_memory;
 int m68k_realnum_memory;
 EXPORT_SYMBOL(m68k_realnum_memory);
-#ifdef CONFIG_SINGLE_MEMORY_CHUNK
 unsigned long m68k_memoffset;
 EXPORT_SYMBOL(m68k_memoffset);
-#endif
 struct mem_info m68k_memory[NUM_MEMINFO];
 EXPORT_SYMBOL(m68k_memory);
 
-static struct mem_info m68k_ramdisk;
+struct mem_info m68k_ramdisk;
 
 static char m68k_command_line[CL_SIZE];
 
@@ -208,9 +206,6 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
 void __init setup_arch(char **cmdline_p)
 {
         extern int _etext, _edata, _end;
-#ifndef CONFIG_SUN3
-        unsigned long endmem, startmem;
-#endif
         int i;
 
         /* The bootinfo is located right after the kernel bss */
@@ -320,30 +315,16 @@ void __init setup_arch(char **cmdline_p)
                 panic("No configuration setup");
         }
 
-#ifndef CONFIG_SUN3
-        startmem= m68k_memory[0].addr;
-        endmem = startmem + m68k_memory[0].size;
-        high_memory = (void *)PAGE_OFFSET;
-        for (i = 0; i < m68k_num_memory; i++) {
-                m68k_memory[i].size &= MASK_256K;
-                if (m68k_memory[i].addr < startmem)
-                        startmem = m68k_memory[i].addr;
-                if (m68k_memory[i].addr+m68k_memory[i].size > endmem)
-                        endmem = m68k_memory[i].addr+m68k_memory[i].size;
-                high_memory += m68k_memory[i].size;
-        }
-
-        availmem += init_bootmem_node(NODE_DATA(0), availmem >> PAGE_SHIFT,
-                                      startmem >> PAGE_SHIFT, endmem >> PAGE_SHIFT);
-
-        for (i = 0; i < m68k_num_memory; i++)
-                free_bootmem(m68k_memory[i].addr, m68k_memory[i].size);
-
-        reserve_bootmem(m68k_memory[0].addr, availmem - m68k_memory[0].addr);
+        paging_init();
 
+#ifndef CONFIG_SUN3
+        for (i = 1; i < m68k_num_memory; i++)
+                free_bootmem_node(NODE_DATA(i), m68k_memory[i].addr,
+                                  m68k_memory[i].size);
 #ifdef CONFIG_BLK_DEV_INITRD
         if (m68k_ramdisk.size) {
-                reserve_bootmem(m68k_ramdisk.addr, m68k_ramdisk.size);
+                reserve_bootmem_node(__virt_to_node(phys_to_virt(m68k_ramdisk.addr)),
+                                     m68k_ramdisk.addr, m68k_ramdisk.size);
                 initrd_start = (unsigned long)phys_to_virt(m68k_ramdisk.addr);
                 initrd_end = initrd_start + m68k_ramdisk.size;
                 printk("initrd: %08lx - %08lx\n", initrd_start, initrd_end);
@@ -362,8 +343,6 @@ void __init setup_arch(char **cmdline_p)
 
 #endif /* !CONFIG_SUN3 */
 
-        paging_init();
-
 /* set ISA defs early as possible */
 #if defined(CONFIG_ISA) && defined(MULTI_ISA)
 #if defined(CONFIG_Q40)
diff --git a/arch/m68k/kernel/vmlinux-std.lds b/arch/m68k/kernel/vmlinux-std.lds
index 78f139226a1b..40f02b128f22 100644
--- a/arch/m68k/kernel/vmlinux-std.lds
+++ b/arch/m68k/kernel/vmlinux-std.lds
@@ -60,6 +60,11 @@ SECTIONS
   __con_initcall_start = .;
   .con_initcall.init : { *(.con_initcall.init) }
   __con_initcall_end = .;
+  .m68k_fixup : {
+        __start_fixup = .;
+        *(.m68k_fixup)
+        __stop_fixup = .;
+  }
   SECURITY_INIT
 #ifdef CONFIG_BLK_DEV_INITRD
   . = ALIGN(8192);
diff --git a/arch/m68k/kernel/vmlinux-sun3.lds b/arch/m68k/kernel/vmlinux-sun3.lds
index c8999b2db23b..f06425b6d206 100644
--- a/arch/m68k/kernel/vmlinux-sun3.lds
+++ b/arch/m68k/kernel/vmlinux-sun3.lds
@@ -54,6 +54,11 @@ __init_begin = .;
         __con_initcall_start = .;
         .con_initcall.init : { *(.con_initcall.init) }
         __con_initcall_end = .;
+        .m68k_fixup : {
+                __start_fixup = .;
+                *(.m68k_fixup)
+                __stop_fixup = .;
+        }
         SECURITY_INIT
 #ifdef CONFIG_BLK_DEV_INITRD
         . = ALIGN(8192);
diff --git a/arch/m68k/mac/debug.c b/arch/m68k/mac/debug.c
index 7a5bed5bdc57..e8a57138b4a6 100644
--- a/arch/m68k/mac/debug.c
+++ b/arch/m68k/mac/debug.c
@@ -71,7 +71,7 @@ void mac_debugging_short(int pos, short num)
 
         /* calculate current offset */
         pengoffset = (unsigned char *)mac_videobase +
-                (150+line*2) * mac_rowbytes) + 80 * peng;
+                (150+line*2) * mac_rowbytes + 80 * peng;
 
         pptr = pengoffset;
 
diff --git a/arch/m68k/mm/init.c b/arch/m68k/mm/init.c
index ab90213e5c54..f1de19e1dde6 100644
--- a/arch/m68k/mm/init.c
+++ b/arch/m68k/mm/init.c
@@ -7,6 +7,7 @@
  *  to motorola.c and sun3mmu.c
  */
 
+#include <linux/module.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
@@ -31,6 +32,37 @@
 
 DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
 
+static bootmem_data_t __initdata bootmem_data[MAX_NUMNODES];
+
+pg_data_t pg_data_map[MAX_NUMNODES];
+EXPORT_SYMBOL(pg_data_map);
+
+int m68k_virt_to_node_shift;
+
+#ifndef CONFIG_SINGLE_MEMORY_CHUNK
+pg_data_t *pg_data_table[65];
+EXPORT_SYMBOL(pg_data_table);
+#endif
+
+void m68k_setup_node(int node)
+{
+#ifndef CONFIG_SINGLE_MEMORY_CHUNK
+        struct mem_info *info = m68k_memory + node;
+        int i, end;
+
+        i = (unsigned long)phys_to_virt(info->addr) >> __virt_to_node_shift();
+        end = (unsigned long)phys_to_virt(info->addr + info->size - 1) >> __virt_to_node_shift();
+        for (; i <= end; i++) {
+                if (pg_data_table[i])
+                        printk("overlap at %u for chunk %u\n", i, node);
+                pg_data_table[i] = pg_data_map + node;
+        }
+#endif
+        pg_data_map[node].bdata = bootmem_data + node;
+        node_set_online(node);
+}
+
+
 /*
  * ZERO_PAGE is a special page that is used for zero-initialized
  * data and COW.
@@ -40,52 +72,51 @@ void *empty_zero_page;
 
 void show_mem(void)
 {
-    unsigned long i;
-    int free = 0, total = 0, reserved = 0, shared = 0;
-    int cached = 0;
-
-    printk("\nMem-info:\n");
-    show_free_areas();
-    printk("Free swap:       %6ldkB\n", nr_swap_pages<<(PAGE_SHIFT-10));
-    i = max_mapnr;
-    while (i-- > 0) {
-        total++;
-        if (PageReserved(mem_map+i))
-            reserved++;
-        else if (PageSwapCache(mem_map+i))
-            cached++;
-        else if (!page_count(mem_map+i))
-            free++;
-        else
-            shared += page_count(mem_map+i) - 1;
-    }
-    printk("%d pages of RAM\n",total);
-    printk("%d free pages\n",free);
-    printk("%d reserved pages\n",reserved);
-    printk("%d pages shared\n",shared);
-    printk("%d pages swap cached\n",cached);
+        pg_data_t *pgdat;
+        int free = 0, total = 0, reserved = 0, shared = 0;
+        int cached = 0;
+        int i;
+
+        printk("\nMem-info:\n");
+        show_free_areas();
+        printk("Free swap:       %6ldkB\n", nr_swap_pages<<(PAGE_SHIFT-10));
+        for_each_online_pgdat(pgdat) {
+                for (i = 0; i < pgdat->node_spanned_pages; i++) {
+                        struct page *page = pgdat->node_mem_map + i;
+                        total++;
+                        if (PageReserved(page))
+                                reserved++;
+                        else if (PageSwapCache(page))
+                                cached++;
+                        else if (!page_count(page))
+                                free++;
+                        else
+                                shared += page_count(page) - 1;
+                }
+        }
+        printk("%d pages of RAM\n",total);
+        printk("%d free pages\n",free);
+        printk("%d reserved pages\n",reserved);
+        printk("%d pages shared\n",shared);
+        printk("%d pages swap cached\n",cached);
 }
 
 extern void init_pointer_table(unsigned long ptable);
 
 /* References to section boundaries */
 
-extern char _text, _etext, _edata, __bss_start, _end;
-extern char __init_begin, __init_end;
+extern char _text[], _etext[];
+extern char __init_begin[], __init_end[];
 
 extern pmd_t *zero_pgtable;
 
 void __init mem_init(void)
 {
+        pg_data_t *pgdat;
         int codepages = 0;
         int datapages = 0;
         int initpages = 0;
-        unsigned long tmp;
-#ifndef CONFIG_SUN3
         int i;
-#endif
-
-        max_mapnr = num_physpages = (((unsigned long)high_memory - PAGE_OFFSET) >> PAGE_SHIFT);
 
 #ifdef CONFIG_ATARI
         if (MACH_IS_ATARI)
@@ -93,19 +124,25 @@ void __init mem_init(void)
 #endif
 
         /* this will put all memory onto the freelists */
-        totalram_pages = free_all_bootmem();
-
-        for (tmp = PAGE_OFFSET ; tmp < (unsigned long)high_memory; tmp += PAGE_SIZE) {
-                if (PageReserved(virt_to_page(tmp))) {
-                        if (tmp >= (unsigned long)&_text
-                            && tmp < (unsigned long)&_etext)
+        totalram_pages = num_physpages = 0;
+        for_each_online_pgdat(pgdat) {
+                num_physpages += pgdat->node_present_pages;
+
+                totalram_pages += free_all_bootmem_node(pgdat);
+                for (i = 0; i < pgdat->node_spanned_pages; i++) {
+                        struct page *page = pgdat->node_mem_map + i;
+                        char *addr = page_to_virt(page);
+
+                        if (!PageReserved(page))
+                                continue;
+                        if (addr >= _text &&
+                            addr < _etext)
                                 codepages++;
-                        else if (tmp >= (unsigned long) &__init_begin
-                                 && tmp < (unsigned long) &__init_end)
+                        else if (addr >= __init_begin &&
+                                 addr < __init_end)
                                 initpages++;
                         else
                                 datapages++;
-                        continue;
                 }
         }
 
@@ -124,7 +161,7 @@ void __init mem_init(void)
 
         printk("Memory: %luk/%luk available (%dk kernel code, %dk data, %dk init)\n",
                (unsigned long)nr_free_pages() << (PAGE_SHIFT-10),
-               max_mapnr << (PAGE_SHIFT-10),
+               totalram_pages << (PAGE_SHIFT-10),
                codepages << (PAGE_SHIFT-10),
                datapages << (PAGE_SHIFT-10),
                initpages << (PAGE_SHIFT-10));
diff --git a/arch/m68k/mm/memory.c b/arch/m68k/mm/memory.c
index 13c0b4ad01eb..b7473525b431 100644
--- a/arch/m68k/mm/memory.c
+++ b/arch/m68k/mm/memory.c
@@ -127,67 +127,6 @@ int free_pointer_table (pmd_t *ptable)
         return 0;
 }
 
-#ifdef DEBUG_INVALID_PTOV
-int mm_inv_cnt = 5;
-#endif
-
-#ifndef CONFIG_SINGLE_MEMORY_CHUNK
-/*
- * The following two routines map from a physical address to a kernel
- * virtual address and vice versa.
- */
-unsigned long mm_vtop(unsigned long vaddr)
-{
-        int i=0;
-        unsigned long voff = (unsigned long)vaddr - PAGE_OFFSET;
-
-        do {
-                if (voff < m68k_memory[i].size) {
-#ifdef DEBUGPV
-                        printk ("VTOP(%p)=%lx\n", vaddr,
-                                m68k_memory[i].addr + voff);
-#endif
-                        return m68k_memory[i].addr + voff;
-                }
-                voff -= m68k_memory[i].size;
-        } while (++i < m68k_num_memory);
-
-        /* As a special case allow `__pa(high_memory)'.  */
-        if (voff == 0)
-                return m68k_memory[i-1].addr + m68k_memory[i-1].size;
-
-        return -1;
-}
-EXPORT_SYMBOL(mm_vtop);
-
-unsigned long mm_ptov (unsigned long paddr)
-{
-        int i = 0;
-        unsigned long poff, voff = PAGE_OFFSET;
-
-        do {
-                poff = paddr - m68k_memory[i].addr;
-                if (poff < m68k_memory[i].size) {
-#ifdef DEBUGPV
-                        printk ("PTOV(%lx)=%lx\n", paddr, poff + voff);
-#endif
-                        return poff + voff;
-                }
-                voff += m68k_memory[i].size;
-        } while (++i < m68k_num_memory);
-
-#ifdef DEBUG_INVALID_PTOV
-        if (mm_inv_cnt > 0) {
-                mm_inv_cnt--;
-                printk("Invalid use of phys_to_virt(0x%lx) at 0x%p!\n",
-                        paddr, __builtin_return_address(0));
-        }
-#endif
-        return -1;
-}
-EXPORT_SYMBOL(mm_ptov);
-#endif
-
 /* invalidate page in both caches */
 static inline void clear040(unsigned long paddr)
 {
@@ -354,15 +293,3 @@ void cache_push (unsigned long paddr, int len)
 }
 EXPORT_SYMBOL(cache_push);
 
-#ifndef CONFIG_SINGLE_MEMORY_CHUNK
-int mm_end_of_chunk (unsigned long addr, int len)
-{
-        int i;
-
-        for (i = 0; i < m68k_num_memory; i++)
-                if (m68k_memory[i].addr + m68k_memory[i].size == addr + len)
-                        return 1;
-        return 0;
-}
-EXPORT_SYMBOL(mm_end_of_chunk);
-#endif
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index afcccdc6ad45..7d571a2b44dd 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -43,6 +43,11 @@ unsigned long mm_cachebits;
 EXPORT_SYMBOL(mm_cachebits);
 #endif
 
+/* size of memory already mapped in head.S */
+#define INIT_MAPPED_SIZE        (4UL<<20)
+
+extern unsigned long availmem;
+
 static pte_t * __init kernel_page_table(void)
 {
         pte_t *ptablep;
@@ -98,19 +103,20 @@ static pmd_t * __init kernel_ptr_table(void)
         return last_pgtable;
 }
 
-static unsigned long __init
-map_chunk (unsigned long addr, long size)
+static void __init map_node(int node)
 {
 #define PTRTREESIZE (256*1024)
 #define ROOTTREESIZE (32*1024*1024)
-        static unsigned long virtaddr = PAGE_OFFSET;
-        unsigned long physaddr;
+        unsigned long physaddr, virtaddr, size;
         pgd_t *pgd_dir;
         pmd_t *pmd_dir;
         pte_t *pte_dir;
 
-        physaddr = (addr | m68k_supervisor_cachemode |
-                    _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_DIRTY);
+        size = m68k_memory[node].size;
+        physaddr = m68k_memory[node].addr;
+        virtaddr = (unsigned long)phys_to_virt(physaddr);
+        physaddr |= m68k_supervisor_cachemode |
+                    _PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_DIRTY;
         if (CPU_IS_040_OR_060)
                 physaddr |= _PAGE_GLOBAL040;
 
@@ -190,8 +196,6 @@ map_chunk (unsigned long addr, long size)
 #ifdef DEBUG
         printk("\n");
 #endif
-
-        return virtaddr;
 }
 
 /*
@@ -200,15 +204,16 @@ map_chunk (unsigned long addr, long size)
  */
 void __init paging_init(void)
 {
-        int chunk;
-        unsigned long mem_avail = 0;
         unsigned long zones_size[MAX_NR_ZONES] = { 0, };
+        unsigned long min_addr, max_addr;
+        unsigned long addr, size, end;
+        int i;
 
 #ifdef DEBUG
         {
                 extern unsigned long availmem;
-                printk ("start of paging_init (%p, %lx, %lx, %lx)\n",
-                        kernel_pg_dir, availmem, start_mem, end_mem);
+                printk ("start of paging_init (%p, %lx)\n",
+                        kernel_pg_dir, availmem);
         }
 #endif
 
@@ -222,24 +227,62 @@ void __init paging_init(void)
                         pgprot_val(protection_map[i]) |= _PAGE_CACHE040;
         }
 
+        min_addr = m68k_memory[0].addr;
+        max_addr = min_addr + m68k_memory[0].size;
+        for (i = 1; i < m68k_num_memory;) {
+                if (m68k_memory[i].addr < min_addr) {
+                        printk("Ignoring memory chunk at 0x%lx:0x%lx before the first chunk\n",
+                                m68k_memory[i].addr, m68k_memory[i].size);
+                        printk("Fix your bootloader or use a memfile to make use of this area!\n");
+                        m68k_num_memory--;
+                        memmove(m68k_memory + i, m68k_memory + i + 1,
+                                (m68k_num_memory - i) * sizeof(struct mem_info));
+                        continue;
+                }
+                addr = m68k_memory[i].addr + m68k_memory[i].size;
+                if (addr > max_addr)
+                        max_addr = addr;
+                i++;
+        }
+        m68k_memoffset = min_addr - PAGE_OFFSET;
+        m68k_virt_to_node_shift = fls(max_addr - min_addr - 1) - 6;
+
+        module_fixup(NULL, __start_fixup, __stop_fixup);
+        flush_icache();
+
+        high_memory = phys_to_virt(max_addr);
+
+        min_low_pfn = availmem >> PAGE_SHIFT;
+        max_low_pfn = max_addr >> PAGE_SHIFT;
+
+        for (i = 0; i < m68k_num_memory; i++) {
+                addr = m68k_memory[i].addr;
+                end = addr + m68k_memory[i].size;
+                m68k_setup_node(i);
+                availmem = PAGE_ALIGN(availmem);
+                availmem += init_bootmem_node(NODE_DATA(i),
+                                              availmem >> PAGE_SHIFT,
+                                              addr >> PAGE_SHIFT,
+                                              end >> PAGE_SHIFT);
+        }
+
         /*
          * Map the physical memory available into the kernel virtual
-         * address space.  It may allocate some memory for page
-         * tables and thus modify availmem.
+         * address space. First initialize the bootmem allocator with
+         * the memory we already mapped, so map_node() has something
+         * to allocate.
          */
+        addr = m68k_memory[0].addr;
+        size = m68k_memory[0].size;
+        free_bootmem_node(NODE_DATA(0), availmem, min(INIT_MAPPED_SIZE, size) - (availmem - addr));
+        map_node(0);
+        if (size > INIT_MAPPED_SIZE)
+                free_bootmem_node(NODE_DATA(0), addr + INIT_MAPPED_SIZE, size - INIT_MAPPED_SIZE);
 
-        for (chunk = 0; chunk < m68k_num_memory; chunk++) {
-                mem_avail = map_chunk (m68k_memory[chunk].addr,
-                                       m68k_memory[chunk].size);
-
-        }
+        for (i = 1; i < m68k_num_memory; i++)
+                map_node(i);
 
         flush_tlb_all();
-#ifdef DEBUG
-        printk ("memory available is %ldKB\n", mem_avail >> 10);
-        printk ("start_mem is %#lx\nvirtual_end is %#lx\n",
-                start_mem, end_mem);
-#endif
 
         /*
          * initialize the bad page table and bad page to point
@@ -256,14 +299,11 @@ void __init paging_init(void)
 #ifdef DEBUG
         printk ("before free_area_init\n");
 #endif
-        zones_size[ZONE_DMA] = (mach_max_dma_address < (unsigned long)high_memory ?
-                                (mach_max_dma_address+1) : (unsigned long)high_memory);
-        zones_size[ZONE_NORMAL] = (unsigned long)high_memory - zones_size[0];
-
-        zones_size[ZONE_DMA] = (zones_size[ZONE_DMA] - PAGE_OFFSET) >> PAGE_SHIFT;
-        zones_size[ZONE_NORMAL] >>= PAGE_SHIFT;
-
-        free_area_init(zones_size);
+        for (i = 0; i < m68k_num_memory; i++) {
+                zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
+                free_area_init_node(i, pg_data_map + i, zones_size,
+                                    m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+        }
 }
 
 extern char __init_begin, __init_end;
diff --git a/arch/m68k/sun3/config.c b/arch/m68k/sun3/config.c
index 4851b8437a87..c0fbd278fbb1 100644
--- a/arch/m68k/sun3/config.c
+++ b/arch/m68k/sun3/config.c
@@ -21,6 +21,7 @@
 #include <asm/contregs.h>
 #include <asm/movs.h>
 #include <asm/pgtable.h>
+#include <asm/pgalloc.h>
 #include <asm/sun3-head.h>
 #include <asm/sun3mmu.h>
 #include <asm/rtc.h>
@@ -127,6 +128,7 @@ void __init sun3_bootmem_alloc(unsigned long memory_start, unsigned long memory_
         high_memory = (void *)memory_end;
         availmem = memory_start;
 
+        m68k_setup_node(0);
         availmem += init_bootmem_node(NODE_DATA(0), start_page, 0, num_pages);
         availmem = (availmem + (PAGE_SIZE-1)) & PAGE_MASK;
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 0f09412e1b7f..9528ee90640a 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -747,9 +747,9 @@ config EARLY_PRINTK
           to print messages very early in the bootup process.
 
           This is useful for kernel debugging when your machine crashes very
-          early before the console code is initialized. For normal operation
-          it is not recommended because it looks on some machines ugly and
-          oesn't cooperate with an X server. You should normally N here,
+          early before the console code is initialized. For normal operation,
+          it is not recommended because it looks ugly on some machines and
+          doesn't cooperate with an X server. You should normally say N here,
           unless you want to debug such a crash.
 
 config SYS_HAS_EARLY_PRINTK
diff --git a/arch/mips/emma2rh/markeins/setup.c b/arch/mips/emma2rh/markeins/setup.c
index b29a44739230..2f060e1ed36c 100644
--- a/arch/mips/emma2rh/markeins/setup.c
+++ b/arch/mips/emma2rh/markeins/setup.c
@@ -115,30 +115,6 @@ extern void markeins_irq_setup(void);
 
 static void inline __init markeins_sio_setup(void)
 {
-#ifdef CONFIG_KGDB_8250
-        struct uart_port emma_port;
-
-        memset(&emma_port, 0, sizeof(emma_port));
-
-        emma_port.flags =
-            UPF_BOOT_AUTOCONF | UPF_SKIP_TEST;
-        emma_port.iotype = UPIO_MEM;
-        emma_port.regshift = 4; /* I/O addresses are every 8 bytes */
-        emma_port.uartclk = 18544000;   /* Clock rate of the chip */
-
-        emma_port.line = 0;
-        emma_port.mapbase = KSEG1ADDR(EMMA2RH_PFUR0_BASE + 3);
-        emma_port.membase = (u8*)emma_port.mapbase;
-        early_serial_setup(&emma_port);
-
-        emma_port.line = 1;
-        emma_port.mapbase = KSEG1ADDR(EMMA2RH_PFUR1_BASE + 3);
-        emma_port.membase = (u8*)emma_port.mapbase;
-        early_serial_setup(&emma_port);
-
-        emma_port.irq = EMMA2RH_IRQ_PFUR1;
-        kgdb8250_add_port(1, &emma_port);
-#endif
 }
 
 void __init plat_mem_setup(void)
diff --git a/arch/mips/jmr3927/rbhma3100/kgdb_io.c b/arch/mips/jmr3927/rbhma3100/kgdb_io.c
index 2604f2c9a96e..342579cfdc01 100644
--- a/arch/mips/jmr3927/rbhma3100/kgdb_io.c
+++ b/arch/mips/jmr3927/rbhma3100/kgdb_io.c
@@ -36,7 +36,7 @@
 #define TIMEOUT       0xffffff
 
 static int remoteDebugInitialized = 0;
-static void debugInit(int baud)
+static void debugInit(int baud);
 
 int putDebugChar(unsigned char c)
 {
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 37849edd0645..06e04da211d5 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -556,6 +556,16 @@ asmlinkage long sys32_sync_file_range(int fd, int __pad,
                         flags);
 }
 
+asmlinkage long sys32_fadvise64_64(int fd, int __pad,
+        unsigned long a2, unsigned long a3,
+        unsigned long a4, unsigned long a5,
+        int flags)
+{
+        return sys_fadvise64_64(fd,
+                        merge_64(a2, a3), merge_64(a4, a5),
+                        flags);
+}
+
 save_static_function(sys32_clone);
 __attribute_used__ noinline static int
 _sys32_clone(nabi_no_regargs struct pt_regs regs)
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index cc566cf12246..06729596812f 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -174,7 +174,7 @@ LEAF(_init_fpu)
         or      t0, t1
         mtc0    t0, CP0_STATUS
 #endif /* CONFIG_MIPS_MT_SMTC */
-        fpu_enable_hazard
+        enable_fpu_hazard
 
         li      t1, FPU_DEFAULT
         ctc1    t1, fcr31
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 6eac28337423..1631035ffc24 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -299,7 +299,7 @@ EXPORT(sysn32_call_table)
         PTR     sys_ni_syscall                  /* res. for afs_syscall */
         PTR     sys_ni_syscall                  /* res. for security */
         PTR     sys_gettid
-        PTR     sys32_readahead
+        PTR     sys_readahead
         PTR     sys_setxattr                    /* 6180 */
         PTR     sys_lsetxattr
         PTR     sys_fsetxattr
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 7e74b412a782..2aa99426ac1c 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -459,7 +459,7 @@ sys_call_table:
         PTR     sys_remap_file_pages
         PTR     sys_set_tid_address
         PTR     sys_restart_syscall
-        PTR     sys_fadvise64_64
+        PTR     sys32_fadvise64_64
         PTR     compat_sys_statfs64             /* 4255 */
         PTR     compat_sys_fstatfs64
         PTR     compat_sys_timer_create
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 200de027f354..3f58b6ac1358 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -927,12 +927,6 @@ asmlinkage void do_reserved(struct pt_regs *regs)
               (regs->cp0_cause & 0x7f) >> 2);
 }
 
-static asmlinkage void do_default_vi(void)
-{
-        show_regs(get_irq_regs());
-        panic("Caught unexpected vectored interrupt.");
-}
-
 /*
  * Some MIPS CPUs can enable/disable for cache parity detection, but do
  * it different ways.
@@ -1128,6 +1122,12 @@ void mips_srs_free(int set)
         clear_bit(set, &sr->sr_allocated);
 }
 
+static asmlinkage void do_default_vi(void)
+{
+        show_regs(get_irq_regs());
+        panic("Caught unexpected vectored interrupt.");
+}
+
 static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs)
 {
         unsigned long handler;
diff --git a/arch/mips/mips-boards/atlas/atlas_setup.c b/arch/mips/mips-boards/atlas/atlas_setup.c
index 0c6b0ce15028..1cc6ebbedfdd 100644
--- a/arch/mips/mips-boards/atlas/atlas_setup.c
+++ b/arch/mips/mips-boards/atlas/atlas_setup.c
@@ -48,6 +48,8 @@ const char *get_system_type(void)
         return "MIPS Atlas";
 }
 
+const char display_string[] = "        LINUX ON ATLAS       ";
+
 void __init plat_mem_setup(void)
 {
         mips_pcibios_init();
diff --git a/arch/mips/mips-boards/generic/display.c b/arch/mips/mips-boards/generic/display.c
index 548dbe5ce7c8..5d600054090a 100644
--- a/arch/mips/mips-boards/generic/display.c
+++ b/arch/mips/mips-boards/generic/display.c
@@ -19,9 +19,14 @@
  */
 
 #include <linux/compiler.h>
+#include <linux/timer.h>
 #include <asm/io.h>
 #include <asm/mips-boards/generic.h>
 
+extern const char display_string[];
+static unsigned int display_count;
+static unsigned int max_display_count;
+
 void mips_display_message(const char *str)
 {
         static unsigned int __iomem *display = NULL;
@@ -37,3 +42,22 @@ void mips_display_message(const char *str)
                          writel(' ', display + i);
         }
 }
+
+static void scroll_display_message(unsigned long data);
+static DEFINE_TIMER(mips_scroll_timer, scroll_display_message, HZ, 0);
+
+static void scroll_display_message(unsigned long data)
+{
+        mips_display_message(&display_string[display_count++]);
+        if (display_count == max_display_count)
+                display_count = 0;
+
+        mod_timer(&mips_scroll_timer, jiffies + HZ);
+}
+
+void mips_scroll_message(void)
+{
+        del_timer_sync(&mips_scroll_timer);
+        max_display_count = strlen(display_string) + 1 - 8;
+        mod_timer(&mips_scroll_timer, jiffies + 1);
+}
diff --git a/arch/mips/mips-boards/generic/time.c b/arch/mips/mips-boards/generic/time.c
index df2a2bd3aa5d..37735bfc3afd 100644
--- a/arch/mips/mips-boards/generic/time.c
+++ b/arch/mips/mips-boards/generic/time.c
@@ -53,37 +53,11 @@
 
 unsigned long cpu_khz;
 
-#if defined(CONFIG_MIPS_ATLAS)
-static char display_string[] = "        LINUX ON ATLAS       ";
-#endif
-#if defined(CONFIG_MIPS_MALTA)
-#if defined(CONFIG_MIPS_MT_SMTC)
-static char display_string[] = "       SMTC LINUX ON MALTA       ";
-#else
-static char display_string[] = "        LINUX ON MALTA       ";
-#endif /* CONFIG_MIPS_MT_SMTC */
-#endif
-#if defined(CONFIG_MIPS_SEAD)
-static char display_string[] = "        LINUX ON SEAD       ";
-#endif
-static unsigned int display_count;
-#define MAX_DISPLAY_COUNT (sizeof(display_string) - 8)
-
 #define CPUCTR_IMASKBIT (0x100 << MIPSCPU_INT_CPUCTR)
 
-static unsigned int timer_tick_count;
 static int mips_cpu_timer_irq;
 extern void smtc_timer_broadcast(int);
 
-static inline void scroll_display_message(void)
-{
-        if ((timer_tick_count++ % HZ) == 0) {
-                mips_display_message(&display_string[display_count++]);
-                if (display_count == MAX_DISPLAY_COUNT)
-                        display_count = 0;
-        }
-}
-
 static void mips_timer_dispatch(void)
 {
         do_IRQ(mips_cpu_timer_irq);
@@ -143,7 +117,6 @@ irqreturn_t mips_timer_interrupt(int irq, void *dev_id)
                 if (cpu_data[cpu].vpe_id == 0) {
                                 timer_interrupt(irq, NULL);
                                 smtc_timer_broadcast(cpu_data[cpu].vpe_id);
-                                scroll_display_message();
                 } else {
                         write_c0_compare(read_c0_count() +
                                          (mips_hpt_frequency/HZ));
@@ -167,8 +140,6 @@ irqreturn_t mips_timer_interrupt(int irq, void *dev_id)
                 /* we keep interrupt disabled all the time */
                 if (!r2 || (read_c0_cause() & (1 << 30)))
                         timer_interrupt(irq, NULL);
-
-                scroll_display_message();
         } else {
                 /* Everyone else needs to reset the timer int here as
                    ll_local_timer_interrupt doesn't */
@@ -262,6 +233,8 @@ void __init mips_time_init(void)
                (est_freq%1000000)*100/1000000);
 
         cpu_khz = est_freq / 1000;
+
+        mips_scroll_message();
 }
 
 void __init plat_timer_setup(struct irqaction *irq)
diff --git a/arch/mips/mips-boards/malta/malta_setup.c b/arch/mips/mips-boards/malta/malta_setup.c
index 7873932532a1..c14b7bf89950 100644
--- a/arch/mips/mips-boards/malta/malta_setup.c
+++ b/arch/mips/mips-boards/malta/malta_setup.c
@@ -56,6 +56,12 @@ const char *get_system_type(void)
         return "MIPS Malta";
 }
 
+#if defined(CONFIG_MIPS_MT_SMTC)
+const char display_string[] = "       SMTC LINUX ON MALTA       ";
+#else
+const char display_string[] = "        LINUX ON MALTA       ";
+#endif /* CONFIG_MIPS_MT_SMTC */
+
 #ifdef CONFIG_BLK_DEV_FD
 void __init fd_activate(void)
 {
diff --git a/arch/mips/mips-boards/sead/sead_setup.c b/arch/mips/mips-boards/sead/sead_setup.c
index a189dec7c7bc..811aba100605 100644
--- a/arch/mips/mips-boards/sead/sead_setup.c
+++ b/arch/mips/mips-boards/sead/sead_setup.c
@@ -43,6 +43,8 @@ const char *get_system_type(void)
         return "MIPS SEAD";
 }
 
+const char display_string[] = "        LINUX ON SEAD       ";
+
 void __init plat_mem_setup(void)
 {
         ioport_resource.end = 0x7fffffff;
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index f0eb29917d9a..76903c727647 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -168,8 +168,9 @@ int dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
                 addr = (unsigned long) page_address(sg->page);
                 if (!plat_device_is_coherent(dev) && addr)
                         __dma_sync(addr + sg->offset, sg->length, direction);
-                sg->dma_address = plat_map_dma_mem_page(dev, sg->page) +
-                                  sg->offset;
+                sg->dma_address = plat_map_dma_mem(dev,
+                                                   (void *)(addr + sg->offset),
+                                                   sg->length);
         }
 
         return nents;
diff --git a/arch/mips/pci/pci-ocelot.c b/arch/mips/pci/pci-ocelot.c
index 7f94f26d35ae..1421d34535ef 100644
--- a/arch/mips/pci/pci-ocelot.c
+++ b/arch/mips/pci/pci-ocelot.c
@@ -71,19 +71,19 @@ static inline void pci0WriteConfigReg(unsigned int offset, unsigned int data)
 }
 
 static struct resource ocelot_mem_resource = {
-        start   = GT_PCI_MEM_BASE;
-        end     = GT_PCI_MEM_BASE + GT_PCI_MEM_BASE - 1;
+        .start  = GT_PCI_MEM_BASE,
+        .end    = GT_PCI_MEM_BASE + GT_PCI_MEM_BASE - 1,
 };
 
 static struct resource ocelot_io_resource = {
-        start   = GT_PCI_IO_BASE;
-        end     = GT_PCI_IO_BASE + GT_PCI_IO_SIZE - 1;
+        .start  = GT_PCI_IO_BASE,
+        .end    = GT_PCI_IO_BASE + GT_PCI_IO_SIZE - 1,
 };
 
 static struct pci_controller ocelot_pci_controller = {
-        .pci_ops        = gt64xxx_pci0_ops;
-        .mem_resource   = &ocelot_mem_resource;
-        .io_resource    = &ocelot_io_resource;
+        .pci_ops        = gt64xxx_pci0_ops,
+        .mem_resource   = &ocelot_mem_resource,
+        .io_resource    = &ocelot_io_resource,
 };
 
 static int __init ocelot_pcibios_init(void)
diff --git a/arch/mips/qemu/q-irq.c b/arch/mips/qemu/q-irq.c
index f5ea2fe10f14..89891e984b3b 100644
--- a/arch/mips/qemu/q-irq.c
+++ b/arch/mips/qemu/q-irq.c
@@ -7,8 +7,6 @@
 #include <asm/system.h>
 #include <asm/time.h>
 
-extern asmlinkage void qemu_handle_int(void);
-
 asmlinkage void plat_irq_dispatch(void)
 {
         unsigned int pending = read_c0_status() & read_c0_cause();
diff --git a/arch/mips/sni/pcimt.c b/arch/mips/sni/pcimt.c
index 9ee208daa8b1..97b234361b4d 100644
--- a/arch/mips/sni/pcimt.c
+++ b/arch/mips/sni/pcimt.c
@@ -6,7 +6,7 @@
  * for more details.
  *
  * Copyright (C) 1996, 97, 98, 2000, 03, 04, 06 Ralf Baechle (ralf@linux-mips.org)
- * Copyright (C) 2006 Thomas Bogendoerfer (tsbogend@alpha.franken.de)
+ * Copyright (C) 2006,2007 Thomas Bogendoerfer (tsbogend@alpha.franken.de)
  */
 
 #include <linux/init.h>
@@ -131,6 +131,19 @@ static struct resource pcimt_io_resources[] = {
         }
 };
 
+static struct resource pcimt_mem_resources[] = {
+        {
+                /*
+                 * this region should only be 4 bytes long,
+                 * but it's 16MB on all RM300C I've checked
+                 */
+                .start  = 0x1a000000,
+                .end    = 0x1affffff,
+                .name   = "PCI INT ACK",
+                .flags  = IORESOURCE_BUSY
+        }
+};
+
 static struct resource sni_mem_resource = {
         .start  = 0x18000000UL,
         .end    = 0x1fbfffffUL,
@@ -145,6 +158,9 @@ static void __init sni_pcimt_resource_init(void)
         /* request I/O space for devices used on all i[345]86 PCs */
         for (i = 0; i < ARRAY_SIZE(pcimt_io_resources); i++)
                 request_resource(&sni_io_resource, pcimt_io_resources + i);
+        /* request MEM space for devices used on all i[345]86 PCs */
+        for (i = 0; i < ARRAY_SIZE(pcimt_mem_resources); i++)
+                request_resource(&sni_mem_resource, pcimt_mem_resources + i);
 }
 
 extern struct pci_ops sni_pcimt_ops;
diff --git a/arch/mips/sni/setup.c b/arch/mips/sni/setup.c
index 68d7cf609b4f..4fedfbda0c79 100644
--- a/arch/mips/sni/setup.c
+++ b/arch/mips/sni/setup.c
@@ -6,7 +6,7 @@
  * for more details.
  *
  * Copyright (C) 1996, 97, 98, 2000, 03, 04, 06 Ralf Baechle (ralf@linux-mips.org)
- * Copyright (C) 2006 Thomas Bogendoerfer (tsbogend@alpha.franken.de)
+ * Copyright (C) 2006,2007 Thomas Bogendoerfer (tsbogend@alpha.franken.de)
  */
 #include <linux/eisa.h>
 #include <linux/init.h>
@@ -92,3 +92,34 @@ void __init plat_mem_setup(void)
 
         sni_display_setup();
 }
+
+#if CONFIG_PCI
+
+#include <linux/pci.h>
+#include <video/vga.h>
+#include <video/cirrus.h>
+
+static void __devinit quirk_cirrus_ram_size(struct pci_dev *dev)
+{
+        u16 cmd;
+
+        /*
+         * firmware doesn't set the ram size correct, so we
+         * need to do it here, otherwise we get screen corruption
+         * on older Cirrus chips
+         */
+        pci_read_config_word (dev, PCI_COMMAND, &cmd);
+        if ((cmd & (PCI_COMMAND_IO|PCI_COMMAND_MEMORY))
+                == (PCI_COMMAND_IO|PCI_COMMAND_MEMORY)) {
+                vga_wseq (NULL, CL_SEQR6, 0x12);        /* unlock all extension registers */
+                vga_wseq (NULL, CL_SEQRF, 0x18);
+        }
+}
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5434_8,
+                        quirk_cirrus_ram_size);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5436,
+                        quirk_cirrus_ram_size);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_5446,
+                        quirk_cirrus_ram_size);
+#endif
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 6238b5875fd1..fbafd965dcd2 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -142,7 +142,6 @@ drivers-$(CONFIG_OPROFILE)	+= arch/powerpc/oprofile/
 
 # Default to zImage, override when needed
 defaultimage-y                  := zImage
-defaultimage-$(CONFIG_PPC_ISERIES) := vmlinux
 defaultimage-$(CONFIG_DEFAULT_UIMAGE) := uImage
 KBUILD_IMAGE := $(defaultimage-y)
 all: $(KBUILD_IMAGE)
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 83788986b93b..ff2701949ee1 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -11,20 +11,18 @@
 #       bootloader and increase compatibility with OpenFirmware.
 #
 #       To this end we need to define BOOTCC, etc, as the tools
-#       needed to build the 32 bit image.  These are normally HOSTCC,
-#       but may be a third compiler if, for example, you are cross
-#       compiling from an intel box.  Once the 64bit ppc gcc is
-#       stable it will probably simply be a compiler switch to
-#       compile for 32bit mode.
+#       needed to build the 32 bit image.  That's normally the same
+#       compiler for the rest of the kernel, with the -m32 flag added.
 #       To make it easier to setup a cross compiler,
 #       CROSS32_COMPILE is setup as a prefix just like CROSS_COMPILE
 #       in the toplevel makefile.
 
 all: $(obj)/zImage
 
-HOSTCC          := gcc
-BOOTCFLAGS      := $(HOSTCFLAGS) -fno-builtin -nostdinc -isystem \
-                   $(shell $(CROSS32CC) -print-file-name=include) -fPIC
+BOOTCFLAGS    := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+                 -fno-strict-aliasing -Os -msoft-float -pipe \
+                 -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
+                 -isystem $(shell $(CROSS32CC) -print-file-name=include)
 BOOTAFLAGS      := -D__ASSEMBLY__ $(BOOTCFLAGS) -traditional -nostdinc
 
 ifeq ($(call cc-option-yn, -fstack-protector),y)
@@ -33,8 +31,8 @@ endif
 
 BOOTCFLAGS      += -I$(obj) -I$(srctree)/$(obj)
 
-$(obj)/44x.o: BOOTCFLAGS += -Wa,-mbooke
-$(obj)/ebony.o: BOOTCFLAGS += -Wa,-mbooke
+$(obj)/44x.o: BOOTCFLAGS += -mcpu=440
+$(obj)/ebony.o: BOOTCFLAGS += -mcpu=440
 
 zlib       := inffast.c inflate.c inftrees.c
 zlibheader := inffast.h inffixed.h inflate.h inftrees.h infutil.h
@@ -136,6 +134,7 @@ image-$(CONFIG_PPC_EFIKA)		+= zImage.chrp
 image-$(CONFIG_PPC_PMAC)                += zImage.pmac
 image-$(CONFIG_PPC_HOLLY)               += zImage.holly-elf
 image-$(CONFIG_PPC_PRPMC2800)           += zImage.prpmc2800
+image-$(CONFIG_PPC_ISERIES)             += zImage.iseries
 image-$(CONFIG_DEFAULT_UIMAGE)          += uImage
 
 ifneq ($(CONFIG_DEVICE_TREE),"")
@@ -185,6 +184,9 @@ $(obj)/zImage.initrd.%: vmlinux $(wrapperbits)
 $(obj)/zImage.%: vmlinux $(wrapperbits)
         $(call if_changed,wrap,$*)
 
+$(obj)/zImage.iseries: vmlinux
+        $(STRIP) -s -R .comment $< -o $@
+
 $(obj)/zImage.ps3: vmlinux
         $(STRIP) -s -R .comment $< -o $@
 
diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
index 5a4215c4b014..f1c4dfc635be 100644
--- a/arch/powerpc/boot/crt0.S
+++ b/arch/powerpc/boot/crt0.S
@@ -13,6 +13,7 @@
 
         .text
         /* a procedure descriptor used when booting this as a COFF file */
+        .globl  _zimage_start_opd
 _zimage_start_opd:
         .long   _zimage_start, 0, 0, 0
 
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index 2ed8b8b3f0ec..da77adc73078 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -129,7 +129,7 @@ case "$platform" in
 pmac|pseries|chrp)
     platformo=$object/of.o
     ;;
-pmaccoff)
+coff)
     platformo=$object/of.o
     lds=$object/zImage.coff.lds
     ;;
@@ -220,7 +220,7 @@ case "$platform" in
 pseries|chrp)
     $object/addnote "$ofile"
     ;;
-pmaccoff)
+coff)
     ${CROSS}objcopy -O aixcoff-rs6000 --set-start "$entry" "$ofile"
     $object/hack-coff "$ofile"
     ;;
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 068377a2a8dc..42c8ed6ed528 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -489,7 +489,7 @@ struct irq_host *irq_alloc_host(unsigned int revmap_type,
         case IRQ_HOST_MAP_LINEAR:
                 rmap = (unsigned int *)(host + 1);
                 for (i = 0; i < revmap_arg; i++)
-                        rmap[i] = IRQ_NONE;
+                        rmap[i] = NO_IRQ;
                 host->revmap_data.linear.size = revmap_arg;
                 smp_wmb();
                 host->revmap_data.linear.revmap = rmap;
@@ -614,7 +614,7 @@ unsigned int irq_create_mapping(struct irq_host *host,
          * host->ops->map() to update the flags
          */
         virq = irq_find_mapping(host, hwirq);
-        if (virq != IRQ_NONE) {
+        if (virq != NO_IRQ) {
                 if (host->ops->remap)
                         host->ops->remap(host, virq, hwirq);
                 pr_debug("irq: -> existing mapping on virq %d\n", virq);
@@ -741,7 +741,7 @@ void irq_dispose_mapping(unsigned int virq)
         switch(host->revmap_type) {
         case IRQ_HOST_MAP_LINEAR:
                 if (hwirq < host->revmap_data.linear.size)
-                        host->revmap_data.linear.revmap[hwirq] = IRQ_NONE;
+                        host->revmap_data.linear.revmap[hwirq] = NO_IRQ;
                 break;
         case IRQ_HOST_MAP_TREE:
                 /* Check if radix tree allocated yet */
diff --git a/arch/powerpc/kernel/of_platform.c b/arch/powerpc/kernel/of_platform.c
index d501c23e5159..d454f61c9c7c 100644
--- a/arch/powerpc/kernel/of_platform.c
+++ b/arch/powerpc/kernel/of_platform.c
@@ -433,7 +433,7 @@ static int __devinit of_pci_phb_probe(struct of_device *dev,
          * Note also that we don't do ISA, this will also be fixed with a
          * more massive rework.
          */
-        pci_setup_phb_io(phb, 0);
+        pci_setup_phb_io(phb, pci_io_base == 0);
 
         /* Init pci_dn data structures */
         pci_devs_phb_init_dynamic(phb);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 066a6a7a25b8..af42ddab3ab4 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -1171,11 +1171,12 @@ EXPORT_SYMBOL(of_find_node_by_name);
 
 /**
  *      of_find_node_by_type - Find a node by its "device_type" property
- *      @from:  The node to start searching from or NULL, the node
- *              you pass will not be searched, only the next one
- *              will; typically, you pass what the previous call
- *              returned. of_node_put() will be called on it
- *      @name:  The type string to match against
+ *      @from:  The node to start searching from, or NULL to start searching
+ *              the entire device tree. The node you pass will not be
+ *              searched, only the next one will; typically, you pass
+ *              what the previous call returned. of_node_put() will be
+ *              called on from for you.
+ *      @type:  The type string to match against
  *
  *      Returns a node pointer with refcount incremented, use
  *      of_node_put() on it when done.
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index f4f391cdd8f5..bf76562167c3 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -218,6 +218,7 @@ set_single_step(struct task_struct *task)
                 regs->msr |= MSR_SE;
 #endif
         }
+        set_tsk_thread_flag(task, TIF_SINGLESTEP);
 }
 
 static inline void
@@ -233,6 +234,7 @@ clear_single_step(struct task_struct *task)
                 regs->msr &= ~MSR_SE;
 #endif
         }
+        clear_tsk_thread_flag(task, TIF_SINGLESTEP);
 }
 #endif /* CONFIG_PPC32 */
 
diff --git a/arch/powerpc/platforms/cell/cbe_cpufreq.c b/arch/powerpc/platforms/cell/cbe_cpufreq.c
index f9ac3fe3be97..ac445998d831 100644
--- a/arch/powerpc/platforms/cell/cbe_cpufreq.c
+++ b/arch/powerpc/platforms/cell/cbe_cpufreq.c
@@ -67,6 +67,7 @@ static u64 MIC_Slow_Next_Timer_table[] = {
         0x00003FC000000000ull,
 };
 
+static unsigned int pmi_frequency_limit = 0;
 /*
  * hardware specific functions
  */
@@ -164,7 +165,6 @@ static int set_pmode(int cpu, unsigned int slow_mode) {
 
 static void cbe_cpufreq_handle_pmi(struct of_device *dev, pmi_message_t pmi_msg)
 {
-        struct cpufreq_policy policy;
         u8 cpu;
         u8 cbe_pmode_new;
 
@@ -173,15 +173,27 @@ static void cbe_cpufreq_handle_pmi(struct of_device *dev, pmi_message_t pmi_msg)
         cpu = cbe_node_to_cpu(pmi_msg.data1);
         cbe_pmode_new = pmi_msg.data2;
 
-        cpufreq_get_policy(&policy, cpu);
+        pmi_frequency_limit = cbe_freqs[cbe_pmode_new].frequency;
 
-        policy.max = min(policy.max, cbe_freqs[cbe_pmode_new].frequency);
-        policy.min = min(policy.min, policy.max);
+        pr_debug("cbe_handle_pmi: max freq=%d\n", pmi_frequency_limit);
+}
+
+static int pmi_notifier(struct notifier_block *nb,
+                                       unsigned long event, void *data)
+{
+        struct cpufreq_policy *policy = data;
 
-        pr_debug("cbe_handle_pmi: new policy.min=%d policy.max=%d\n", policy.min, policy.max);
-        cpufreq_set_policy(&policy);
+        if (event != CPUFREQ_INCOMPATIBLE)
+                return 0;
+
+        cpufreq_verify_within_limits(policy, 0, pmi_frequency_limit);
+        return 0;
 }
 
+static struct notifier_block pmi_notifier_block = {
+        .notifier_call = pmi_notifier,
+};
+
 static struct pmi_handler cbe_pmi_handler = {
         .type                   = PMI_TYPE_FREQ_CHANGE,
         .handle_pmi_message     = cbe_cpufreq_handle_pmi,
@@ -238,12 +250,21 @@ static int cbe_cpufreq_cpu_init(struct cpufreq_policy *policy)
 
         cpufreq_frequency_table_get_attr(cbe_freqs, policy->cpu);
 
+        if (pmi_dev) {
+                /* frequency might get limited later, initialize limit with max_freq */
+                pmi_frequency_limit = max_freq;
+                cpufreq_register_notifier(&pmi_notifier_block, CPUFREQ_POLICY_NOTIFIER);
+        }
+
         /* this ensures that policy->cpuinfo_min and policy->cpuinfo_max are set correctly */
         return cpufreq_frequency_table_cpuinfo(policy, cbe_freqs);
 }
 
 static int cbe_cpufreq_cpu_exit(struct cpufreq_policy *policy)
 {
+        if (pmi_dev)
+                cpufreq_unregister_notifier(&pmi_notifier_block, CPUFREQ_POLICY_NOTIFIER);
+
         cpufreq_frequency_table_put_attr(policy->cpu);
         return 0;
 }
diff --git a/arch/powerpc/platforms/cell/spufs/context.c b/arch/powerpc/platforms/cell/spufs/context.c
index 8654749e317b..7c51cb54bca1 100644
--- a/arch/powerpc/platforms/cell/spufs/context.c
+++ b/arch/powerpc/platforms/cell/spufs/context.c
@@ -39,7 +39,7 @@ struct spu_context *alloc_spu_context(struct spu_gang *gang)
         if (spu_init_csa(&ctx->csa))
                 goto out_free;
         spin_lock_init(&ctx->mmio_lock);
-        spin_lock_init(&ctx->mapping_lock);
+        mutex_init(&ctx->mapping_lock);
         kref_init(&ctx->kref);
         mutex_init(&ctx->state_mutex);
         mutex_init(&ctx->run_mutex);
@@ -103,6 +103,7 @@ void spu_forget(struct spu_context *ctx)
 
 void spu_unmap_mappings(struct spu_context *ctx)
 {
+        mutex_lock(&ctx->mapping_lock);
         if (ctx->local_store)
                 unmap_mapping_range(ctx->local_store, 0, LS_SIZE, 1);
         if (ctx->mfc)
@@ -117,6 +118,7 @@ void spu_unmap_mappings(struct spu_context *ctx)
                 unmap_mapping_range(ctx->mss, 0, 0x1000, 1);
         if (ctx->psmap)
                 unmap_mapping_range(ctx->psmap, 0, 0x20000, 1);
+        mutex_unlock(&ctx->mapping_lock);
 }
 
 /**
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
index 45614c73c784..b1e7e2f8a2e9 100644
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -45,11 +45,11 @@ spufs_mem_open(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         file->private_data = ctx;
         if (!i->i_openers++)
                 ctx->local_store = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -59,10 +59,10 @@ spufs_mem_release(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->local_store = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -217,6 +217,7 @@ unsigned long spufs_get_unmapped_area(struct file *file, unsigned long addr,
 
 static const struct file_operations spufs_mem_fops = {
         .open                   = spufs_mem_open,
+        .release                = spufs_mem_release,
         .read                   = spufs_mem_read,
         .write                  = spufs_mem_write,
         .llseek                 = generic_file_llseek,
@@ -309,11 +310,11 @@ static int spufs_cntl_open(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         file->private_data = ctx;
         if (!i->i_openers++)
                 ctx->cntl = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return simple_attr_open(inode, file, spufs_cntl_get,
                                         spufs_cntl_set, "0x%08lx");
 }
@@ -326,10 +327,10 @@ spufs_cntl_release(struct inode *inode, struct file *file)
 
         simple_attr_close(inode, file);
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->cntl = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -812,11 +813,11 @@ static int spufs_signal1_open(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         file->private_data = ctx;
         if (!i->i_openers++)
                 ctx->signal1 = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return nonseekable_open(inode, file);
 }
 
@@ -826,10 +827,10 @@ spufs_signal1_release(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->signal1 = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -936,11 +937,11 @@ static int spufs_signal2_open(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         file->private_data = ctx;
         if (!i->i_openers++)
                 ctx->signal2 = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return nonseekable_open(inode, file);
 }
 
@@ -950,10 +951,10 @@ spufs_signal2_release(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->signal2 = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -1154,10 +1155,10 @@ static int spufs_mss_open(struct inode *inode, struct file *file)
 
         file->private_data = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!i->i_openers++)
                 ctx->mss = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return nonseekable_open(inode, file);
 }
 
@@ -1167,10 +1168,10 @@ spufs_mss_release(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->mss = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -1211,11 +1212,11 @@ static int spufs_psmap_open(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         file->private_data = i->i_ctx;
         if (!i->i_openers++)
                 ctx->psmap = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return nonseekable_open(inode, file);
 }
 
@@ -1225,10 +1226,10 @@ spufs_psmap_release(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->psmap = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
@@ -1281,11 +1282,11 @@ static int spufs_mfc_open(struct inode *inode, struct file *file)
         if (atomic_read(&inode->i_count) != 1)
                 return -EBUSY;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         file->private_data = ctx;
         if (!i->i_openers++)
                 ctx->mfc = inode->i_mapping;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return nonseekable_open(inode, file);
 }
 
@@ -1295,10 +1296,10 @@ spufs_mfc_release(struct inode *inode, struct file *file)
         struct spufs_inode_info *i = SPUFS_I(inode);
         struct spu_context *ctx = i->i_ctx;
 
-        spin_lock(&ctx->mapping_lock);
+        mutex_lock(&ctx->mapping_lock);
         if (!--i->i_openers)
                 ctx->mfc = NULL;
-        spin_unlock(&ctx->mapping_lock);
+        mutex_unlock(&ctx->mapping_lock);
         return 0;
 }
 
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 7150730e2ff1..9807206e0219 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -177,7 +177,7 @@ static int spufs_rmdir(struct inode *parent, struct dentry *dir)
 static int spufs_fill_dir(struct dentry *dir, struct tree_descr *files,
                           int mode, struct spu_context *ctx)
 {
-        struct dentry *dentry;
+        struct dentry *dentry, *tmp;
         int ret;
 
         while (files->name && files->name[0]) {
@@ -193,7 +193,20 @@ static int spufs_fill_dir(struct dentry *dir, struct tree_descr *files,
         }
         return 0;
 out:
-        spufs_prune_dir(dir);
+        /*
+         * remove all children from dir. dir->inode is not set so don't
+         * just simply use spufs_prune_dir() and panic afterwards :)
+         * dput() looks like it will do the right thing:
+         * - dec parent's ref counter
+         * - remove child from parent's child list
+         * - free child's inode if possible
+         * - free child
+         */
+        list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
+                dput(dentry);
+        }
+
+        shrink_dcache_parent(dir);
         return ret;
 }
 
@@ -274,6 +287,7 @@ spufs_mkdir(struct inode *dir, struct dentry *dentry, unsigned int flags,
         goto out;
 
 out_free_ctx:
+        spu_forget(ctx);
         put_spu_context(ctx);
 out_iput:
         iput(inode);
@@ -349,37 +363,6 @@ out:
         return ret;
 }
 
-static int spufs_rmgang(struct inode *root, struct dentry *dir)
-{
-        /* FIXME: this fails if the dir is not empty,
-                  which causes a leak of gangs. */
-        return simple_rmdir(root, dir);
-}
-
-static int spufs_gang_close(struct inode *inode, struct file *file)
-{
-        struct inode *parent;
-        struct dentry *dir;
-        int ret;
-
-        dir = file->f_path.dentry;
-        parent = dir->d_parent->d_inode;
-
-        ret = spufs_rmgang(parent, dir);
-        WARN_ON(ret);
-
-        return dcache_dir_close(inode, file);
-}
-
-const struct file_operations spufs_gang_fops = {
-        .open           = dcache_dir_open,
-        .release        = spufs_gang_close,
-        .llseek         = dcache_dir_lseek,
-        .read           = generic_read_dir,
-        .readdir        = dcache_readdir,
-        .fsync          = simple_sync_file,
-};
-
 static int
 spufs_mkgang(struct inode *dir, struct dentry *dentry, int mode)
 {
@@ -407,7 +390,6 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, int mode)
         inode->i_fop = &simple_dir_operations;
 
         d_instantiate(dentry, inode);
-        dget(dentry);
         dir->i_nlink++;
         dentry->d_inode->i_nlink++;
         return ret;
@@ -437,7 +419,7 @@ static int spufs_gang_open(struct dentry *dentry, struct vfsmount *mnt)
                 goto out;
         }
 
-        filp->f_op = &spufs_gang_fops;
+        filp->f_op = &simple_dir_operations;
         fd_install(ret, filp);
 out:
         return ret;
@@ -458,8 +440,10 @@ static int spufs_create_gang(struct inode *inode,
          * in error path of *_open().
          */
         ret = spufs_gang_open(dget(dentry), mntget(mnt));
-        if (ret < 0)
-                WARN_ON(spufs_rmgang(inode, dentry));
+        if (ret < 0) {
+                int err = simple_rmdir(inode, dentry);
+                WARN_ON(err);
+        }
 
 out:
         mutex_unlock(&inode->i_mutex);
@@ -600,6 +584,10 @@ spufs_create_root(struct super_block *sb, void *data)
         struct inode *inode;
         int ret;
 
+        ret = -ENODEV;
+        if (!spu_management_ops)
+                goto out;
+
         ret = -ENOMEM;
         inode = spufs_new_inode(sb, S_IFDIR | 0775);
         if (!inode)
diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c
index b6ecb30e7d58..3b831e07f1ed 100644
--- a/arch/powerpc/platforms/cell/spufs/sched.c
+++ b/arch/powerpc/platforms/cell/spufs/sched.c
@@ -93,43 +93,6 @@ void spu_stop_tick(struct spu_context *ctx)
         }
 }
 
-void spu_sched_tick(struct work_struct *work)
-{
-        struct spu_context *ctx =
-                container_of(work, struct spu_context, sched_work.work);
-        struct spu *spu;
-        int preempted = 0;
-
-        /*
-         * If this context is being stopped avoid rescheduling from the
-         * scheduler tick because we would block on the state_mutex.
-         * The caller will yield the spu later on anyway.
-         */
-        if (test_bit(SPU_SCHED_EXITING, &ctx->sched_flags))
-                return;
-
-        mutex_lock(&ctx->state_mutex);
-        spu = ctx->spu;
-        if (spu) {
-                int best = sched_find_first_bit(spu_prio->bitmap);
-                if (best <= ctx->prio) {
-                        spu_deactivate(ctx);
-                        preempted = 1;
-                }
-        }
-        mutex_unlock(&ctx->state_mutex);
-
-        if (preempted) {
-                /*
-                 * We need to break out of the wait loop in spu_run manually
-                 * to ensure this context gets put on the runqueue again
-                 * ASAP.
-                 */
-                wake_up(&ctx->stop_wq);
-        } else
-                spu_start_tick(ctx);
-}
-
 /**
  * spu_add_to_active_list - add spu to active list
  * @spu:        spu to add to the active list
@@ -273,34 +236,6 @@ static void spu_prio_wait(struct spu_context *ctx)
         remove_wait_queue(&ctx->stop_wq, &wait);
 }
 
-/**
- * spu_reschedule - try to find a runnable context for a spu
- * @spu:       spu available
- *
- * This function is called whenever a spu becomes idle.  It looks for the
- * most suitable runnable spu context and schedules it for execution.
- */
-static void spu_reschedule(struct spu *spu)
-{
-        int best;
-
-        spu_free(spu);
-
-        spin_lock(&spu_prio->runq_lock);
-        best = sched_find_first_bit(spu_prio->bitmap);
-        if (best < MAX_PRIO) {
-                struct list_head *rq = &spu_prio->runq[best];
-                struct spu_context *ctx;
-
-                BUG_ON(list_empty(rq));
-
-                ctx = list_entry(rq->next, struct spu_context, rq);
-                __spu_del_from_rq(ctx);
-                wake_up(&ctx->stop_wq);
-        }
-        spin_unlock(&spu_prio->runq_lock);
-}
-
 static struct spu *spu_get_idle(struct spu_context *ctx)
 {
         struct spu *spu = NULL;
@@ -429,6 +364,51 @@ int spu_activate(struct spu_context *ctx, unsigned long flags)
 }
 
 /**
+ * grab_runnable_context - try to find a runnable context
+ *
+ * Remove the highest priority context on the runqueue and return it
+ * to the caller.  Returns %NULL if no runnable context was found.
+ */
+static struct spu_context *grab_runnable_context(int prio)
+{
+        struct spu_context *ctx = NULL;
+        int best;
+
+        spin_lock(&spu_prio->runq_lock);
+        best = sched_find_first_bit(spu_prio->bitmap);
+        if (best < prio) {
+                struct list_head *rq = &spu_prio->runq[best];
+
+                BUG_ON(list_empty(rq));
+
+                ctx = list_entry(rq->next, struct spu_context, rq);
+                __spu_del_from_rq(ctx);
+        }
+        spin_unlock(&spu_prio->runq_lock);
+
+        return ctx;
+}
+
+static int __spu_deactivate(struct spu_context *ctx, int force, int max_prio)
+{
+        struct spu *spu = ctx->spu;
+        struct spu_context *new = NULL;
+
+        if (spu) {
+                new = grab_runnable_context(max_prio);
+                if (new || force) {
+                        spu_unbind_context(spu, ctx);
+                        spu_free(spu);
+                        if (new)
+                                wake_up(&new->stop_wq);
+                }
+
+        }
+
+        return new != NULL;
+}
+
+/**
  * spu_deactivate - unbind a context from it's physical spu
  * @ctx:        spu context to unbind
  *
@@ -437,12 +417,7 @@ int spu_activate(struct spu_context *ctx, unsigned long flags)
  */
 void spu_deactivate(struct spu_context *ctx)
 {
-        struct spu *spu = ctx->spu;
-
-        if (spu) {
-                spu_unbind_context(spu, ctx);
-                spu_reschedule(spu);
-        }
+        __spu_deactivate(ctx, 1, MAX_PRIO);
 }
 
 /**
@@ -455,21 +430,43 @@ void spu_deactivate(struct spu_context *ctx)
  */
 void spu_yield(struct spu_context *ctx)
 {
-        struct spu *spu;
-
-        if (mutex_trylock(&ctx->state_mutex)) {
-                if ((spu = ctx->spu) != NULL) {
-                        int best = sched_find_first_bit(spu_prio->bitmap);
-                        if (best < MAX_PRIO) {
-                                pr_debug("%s: yielding SPU %d NODE %d\n",
-                                         __FUNCTION__, spu->number, spu->node);
-                                spu_deactivate(ctx);
-                        }
-                }
+        if (!(ctx->flags & SPU_CREATE_NOSCHED)) {
+                mutex_lock(&ctx->state_mutex);
+                __spu_deactivate(ctx, 0, MAX_PRIO);
                 mutex_unlock(&ctx->state_mutex);
         }
 }
 
+void spu_sched_tick(struct work_struct *work)
+{
+        struct spu_context *ctx =
+                container_of(work, struct spu_context, sched_work.work);
+        int preempted;
+
+        /*
+         * If this context is being stopped avoid rescheduling from the
+         * scheduler tick because we would block on the state_mutex.
+         * The caller will yield the spu later on anyway.
+         */
+        if (test_bit(SPU_SCHED_EXITING, &ctx->sched_flags))
+                return;
+
+        mutex_lock(&ctx->state_mutex);
+        preempted = __spu_deactivate(ctx, 0, ctx->prio + 1);
+        mutex_unlock(&ctx->state_mutex);
+
+        if (preempted) {
+                /*
+                 * We need to break out of the wait loop in spu_run manually
+                 * to ensure this context gets put on the runqueue again
+                 * ASAP.
+                 */
+                wake_up(&ctx->stop_wq);
+        } else {
+                spu_start_tick(ctx);
+        }
+}
+
 int __init spu_sched_init(void)
 {
         int i;
diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h
index 0a947fd7de57..47617e8014a5 100644
--- a/arch/powerpc/platforms/cell/spufs/spufs.h
+++ b/arch/powerpc/platforms/cell/spufs/spufs.h
@@ -55,7 +55,7 @@ struct spu_context {
         struct address_space *signal2;     /* 'signal2' area mappings. */
         struct address_space *mss;         /* 'mss' area mappings. */
         struct address_space *psmap;       /* 'psmap' area mappings. */
-        spinlock_t mapping_lock;
+        struct mutex mapping_lock;
         u64 object_id;             /* user space pointer for oprofile */
 
         enum { SPU_STATE_RUNNABLE, SPU_STATE_SAVED } state;
diff --git a/arch/powerpc/platforms/celleb/Makefile b/arch/powerpc/platforms/celleb/Makefile
index f4f82520dc4f..5240046d8671 100644
--- a/arch/powerpc/platforms/celleb/Makefile
+++ b/arch/powerpc/platforms/celleb/Makefile
@@ -4,5 +4,5 @@ obj-y				+= interrupt.o iommu.o setup.o \
 
 obj-$(CONFIG_SMP)               += smp.o
 obj-$(CONFIG_PPC_UDBG_BEAT)     += udbg_beat.o
-obj-$(CONFIG_HAS_TXX9_SERIAL)   += scc_sio.o
+obj-$(CONFIG_SERIAL_TXX9)       += scc_sio.o
 obj-$(CONFIG_SPU_BASE)          += spu_priv1.o
diff --git a/arch/powerpc/platforms/pasemi/idle.c b/arch/powerpc/platforms/pasemi/idle.c
index 03cd45d8fefa..3c962d5757be 100644
--- a/arch/powerpc/platforms/pasemi/idle.c
+++ b/arch/powerpc/platforms/pasemi/idle.c
@@ -26,6 +26,7 @@
 
 #include <asm/machdep.h>
 #include <asm/reg.h>
+#include <asm/smp.h>
 
 #include "pasemi.h"
 
diff --git a/arch/powerpc/platforms/pasemi/iommu.c b/arch/powerpc/platforms/pasemi/iommu.c
index 95fa6a7d15ee..f33b21b9f5d4 100644
--- a/arch/powerpc/platforms/pasemi/iommu.c
+++ b/arch/powerpc/platforms/pasemi/iommu.c
@@ -31,8 +31,6 @@
 #define IOBMAP_PAGE_SIZE        (1 << IOBMAP_PAGE_SHIFT)
 #define IOBMAP_PAGE_MASK        (IOBMAP_PAGE_SIZE - 1)
 
-#define IOBMAP_PAGE_FACTOR      (PAGE_SHIFT - IOBMAP_PAGE_SHIFT)
-
 #define IOB_BASE                0xe0000000
 #define IOB_SIZE                0x3000
 /* Configuration registers */
@@ -97,9 +95,6 @@ static void iobmap_build(struct iommu_table *tbl, long index,
 
         bus_addr = (tbl->it_offset + index) << PAGE_SHIFT;
 
-        npages <<= IOBMAP_PAGE_FACTOR;
-        index <<= IOBMAP_PAGE_FACTOR;
-
         ip = ((u32 *)tbl->it_base) + index;
 
         while (npages--) {
@@ -125,9 +120,6 @@ static void iobmap_free(struct iommu_table *tbl, long index,
 
         bus_addr = (tbl->it_offset + index) << PAGE_SHIFT;
 
-        npages <<= IOBMAP_PAGE_FACTOR;
-        index <<= IOBMAP_PAGE_FACTOR;
-
         ip = ((u32 *)tbl->it_base) + index;
 
         while (npages--) {
diff --git a/arch/powerpc/platforms/ps3/interrupt.c b/arch/powerpc/platforms/ps3/interrupt.c
index 9da82c266ba9..ec9030dbb5f1 100644
--- a/arch/powerpc/platforms/ps3/interrupt.c
+++ b/arch/powerpc/platforms/ps3/interrupt.c
@@ -25,6 +25,7 @@
 #include <asm/machdep.h>
 #include <asm/udbg.h>
 #include <asm/lv1call.h>
+#include <asm/smp.h>
 
 #include "platform.h"
 
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index b854e7f1001c..f1df942072bb 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -752,6 +752,7 @@ skip_gserver_check:
 void xics_request_IPIs(void)
 {
         unsigned int ipi;
+        int rc;
 
         ipi = irq_create_mapping(xics_host, XICS_IPI);
         BUG_ON(ipi == NO_IRQ);
@@ -762,11 +763,12 @@ void xics_request_IPIs(void)
          */
         set_irq_handler(ipi, handle_percpu_irq);
         if (firmware_has_feature(FW_FEATURE_LPAR))
-                request_irq(ipi, xics_ipi_action_lpar, IRQF_DISABLED,
-                            "IPI", NULL);
+                rc = request_irq(ipi, xics_ipi_action_lpar, IRQF_DISABLED,
+                                "IPI", NULL);
         else
-                request_irq(ipi, xics_ipi_action_direct, IRQF_DISABLED,
-                            "IPI", NULL);
+                rc = request_irq(ipi, xics_ipi_action_direct, IRQF_DISABLED,
+                                "IPI", NULL);
+        BUG_ON(rc);
 }
 #endif /* CONFIG_SMP */
 
diff --git a/arch/ppc/syslib/ibm_ocp.c b/arch/ppc/syslib/ibm_ocp.c
index 3f6e55c79181..2ee176610e7c 100644
--- a/arch/ppc/syslib/ibm_ocp.c
+++ b/arch/ppc/syslib/ibm_ocp.c
@@ -1,4 +1,5 @@
 #include <linux/module.h>
+#include <asm/ibm4xx.h>
 #include <asm/ocp.h>
 
 struct ocp_sys_info_data ocp_sys_info = {
diff --git a/arch/s390/hypfs/hypfs_diag.c b/arch/s390/hypfs/hypfs_diag.c
index 2782cf9da5b4..b9a1ce1f28e4 100644
--- a/arch/s390/hypfs/hypfs_diag.c
+++ b/arch/s390/hypfs/hypfs_diag.c
@@ -481,9 +481,17 @@ out:
 
 /* Diagnose 224 functions */
 
-static void diag224(void *ptr)
+static int diag224(void *ptr)
 {
-        asm volatile("diag %0,%1,0x224" : :"d" (0), "d"(ptr) : "memory");
+        int rc = -ENOTSUPP;
+
+        asm volatile(
+                "       diag    %1,%2,0x224\n"
+                "0:     lhi     %0,0x0\n"
+                "1:\n"
+                EX_TABLE(0b,1b)
+                : "+d" (rc) :"d" (0), "d" (ptr) : "memory");
+        return rc;
 }
 
 static int diag224_get_name_table(void)
@@ -492,7 +500,10 @@ static int diag224_get_name_table(void)
         diag224_cpu_names = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
         if (!diag224_cpu_names)
                 return -ENOMEM;
-        diag224(diag224_cpu_names);
+        if (diag224(diag224_cpu_names)) {
+                kfree(diag224_cpu_names);
+                return -ENOTSUPP;
+        }
         EBCASC(diag224_cpu_names + 16, (*diag224_cpu_names + 1) * 16);
         return 0;
 }
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index dca6eaf82c80..1b2f5ce45320 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -163,7 +163,7 @@ unsigned int debug_feature_version = __DEBUG_FEATURE_VERSION;
 
 static debug_info_t *debug_area_first = NULL;
 static debug_info_t *debug_area_last = NULL;
-static DECLARE_MUTEX(debug_lock);
+static DEFINE_MUTEX(debug_mutex);
 
 static int initialized;
 
@@ -576,7 +576,7 @@ debug_input(struct file *file, const char __user *user_buf, size_t length,
         int rc = 0;
         file_private_info_t *p_info;
 
-        down(&debug_lock);
+        mutex_lock(&debug_mutex);
         p_info = ((file_private_info_t *) file->private_data);
         if (p_info->view->input_proc)
                 rc = p_info->view->input_proc(p_info->debug_info_org,
@@ -584,7 +584,7 @@ debug_input(struct file *file, const char __user *user_buf, size_t length,
                                               length, offset);
         else
                 rc = -EPERM;
-        up(&debug_lock);
+        mutex_unlock(&debug_mutex);
         return rc;              /* number of input characters */
 }
 
@@ -602,7 +602,7 @@ debug_open(struct inode *inode, struct file *file)
         file_private_info_t *p_info;
         debug_info_t *debug_info, *debug_info_snapshot;
 
-        down(&debug_lock);
+        mutex_lock(&debug_mutex);
         debug_info = file->f_path.dentry->d_inode->i_private;
         /* find debug view */
         for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
@@ -653,7 +653,7 @@ found:
         file->private_data = p_info;
         debug_info_get(debug_info);
 out:
-        up(&debug_lock);
+        mutex_unlock(&debug_mutex);
         return rc;
 }
 
@@ -688,7 +688,7 @@ debug_register (char *name, int pages_per_area, int nr_areas, int buf_size)
 
         if (!initialized)
                 BUG();
-        down(&debug_lock);
+        mutex_lock(&debug_mutex);
 
         /* create new debug_info */
 
@@ -702,7 +702,7 @@ out:
         if (!rc){
                 printk(KERN_ERR "debug: debug_register failed for %s\n",name);
         }
-        up(&debug_lock);
+        mutex_unlock(&debug_mutex);
         return rc;
 }
 
@@ -716,9 +716,9 @@ debug_unregister(debug_info_t * id)
 {
         if (!id)
                 goto out;
-        down(&debug_lock);
+        mutex_lock(&debug_mutex);
         debug_info_put(id);
-        up(&debug_lock);
+        mutex_unlock(&debug_mutex);
 
 out:
         return;
@@ -1054,11 +1054,11 @@ __init debug_init(void)
         int rc = 0;
 
         s390dbf_sysctl_header = register_sysctl_table(s390dbf_dir_table);
-        down(&debug_lock);
+        mutex_lock(&debug_mutex);
         debug_debugfs_root_entry = debugfs_create_dir(DEBUG_DIR_ROOT,NULL);
         printk(KERN_INFO "debug: Initialization complete\n");
         initialized = 1;
-        up(&debug_lock);
+        mutex_unlock(&debug_mutex);
 
         return rc;
 }
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 6bfb0889eb10..51d6309e7f3b 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -102,7 +102,7 @@ static struct resource data_resource = {
 /*
  * cpu_init() initializes state that is per-CPU.
  */
-void __devinit cpu_init (void)
+void __cpuinit cpu_init(void)
 {
         int addr = hard_smp_processor_id();
 
@@ -915,7 +915,7 @@ setup_arch(char **cmdline_p)
         setup_zfcpdump(console_devno);
 }
 
-void print_cpu_info(struct cpuinfo_S390 *cpuinfo)
+void __cpuinit print_cpu_info(struct cpuinfo_S390 *cpuinfo)
 {
    printk("cpu %d "
 #ifdef CONFIG_SMP
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 09f028a3266b..8ff2feaf9b00 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -492,7 +492,7 @@ static unsigned int __init smp_count_cpus(void)
 /*
  *      Activate a secondary processor.
  */
-int __devinit start_secondary(void *cpuvoid)
+int __cpuinit start_secondary(void *cpuvoid)
 {
         /* Setup the cpu */
         cpu_init();
@@ -741,7 +741,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
                         smp_create_idle(cpu);
 }
 
-void __devinit smp_prepare_boot_cpu(void)
+void __init smp_prepare_boot_cpu(void)
 {
         BUG_ON(smp_processor_id() != 0);
 
@@ -750,7 +750,7 @@ void __devinit smp_prepare_boot_cpu(void)
         current_set[0] = current;
 }
 
-void smp_cpus_done(unsigned int max_cpus)
+void __init smp_cpus_done(unsigned int max_cpus)
 {
         cpu_present_map = cpu_possible_map;
 }
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 7b1122417050..883b03b040c4 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -39,7 +39,7 @@ cflags-$(CONFIG_CPU_SH2A)		:= -m2a $(call cc-option,-m2a-nofpu,)
 cflags-$(CONFIG_CPU_SH3)                := -m3
 cflags-$(CONFIG_CPU_SH4)                := -m4 \
         $(call cc-option,-mno-implicit-fp,-m4-nofpu)
-cflags-$(CONFIG_CPU_SH4A)               := -m4a $(call cc-option,-m4a-nofpu,)
+cflags-$(CONFIG_CPU_SH4A)               := $(call cc-option,-m4a,) $(call cc-option,-m4a-nofpu,)
 
 cflags-$(CONFIG_CPU_BIG_ENDIAN)         += -mb
 cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -ml
diff --git a/arch/sh/boards/se/73180/setup.c b/arch/sh/boards/se/73180/setup.c
index 911ce1cdbd7f..e143017c8975 100644
--- a/arch/sh/boards/se/73180/setup.c
+++ b/arch/sh/boards/se/73180/setup.c
@@ -38,8 +38,8 @@ static struct platform_device *se73180_devices[] __initdata = {
 
 static int __init se73180_devices_setup(void)
 {
-        return platform_add_devices(sh7343se_platform_devices,
-                                    ARRAY_SIZE(sh7343se_platform_devices));
+        return platform_add_devices(se73180_devices,
+                                    ARRAY_SIZE(se73180_devices));
 }
 __initcall(se73180_devices_setup);
 
diff --git a/arch/sh/boards/superh/microdev/irq.c b/arch/sh/boards/superh/microdev/irq.c
index cc1cb04fa618..4d335077a3ff 100644
--- a/arch/sh/boards/superh/microdev/irq.c
+++ b/arch/sh/boards/superh/microdev/irq.c
@@ -11,6 +11,7 @@
 
 #include <linux/init.h>
 #include <linux/irq.h>
+#include <linux/interrupt.h>
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/microdev.h>
diff --git a/arch/sh/cchips/voyagergx/irq.c b/arch/sh/cchips/voyagergx/irq.c
index 70f12907647f..d70e5c8461b5 100644
--- a/arch/sh/cchips/voyagergx/irq.c
+++ b/arch/sh/cchips/voyagergx/irq.c
@@ -28,7 +28,7 @@ static void disable_voyagergx_irq(unsigned int irq)
         unsigned long val;
         unsigned long mask = 1 << (irq - VOYAGER_IRQ_BASE);
 
-        pr_debug("disable_voyagergx_irq(%d): mask=%x\n", irq, mask);
+        pr_debug("disable_voyagergx_irq(%d): mask=%lx\n", irq, mask);
         val = readl((void __iomem *)VOYAGER_INT_MASK);
         val &= ~mask;
         writel(val, (void __iomem *)VOYAGER_INT_MASK);
@@ -39,7 +39,7 @@ static void enable_voyagergx_irq(unsigned int irq)
         unsigned long val;
         unsigned long mask = 1 << (irq - VOYAGER_IRQ_BASE);
 
-        pr_debug("disable_voyagergx_irq(%d): mask=%x\n", irq, mask);
+        pr_debug("disable_voyagergx_irq(%d): mask=%lx\n", irq, mask);
         val = readl((void __iomem *)VOYAGER_INT_MASK);
         val |= mask;
         writel(val, (void __iomem *)VOYAGER_INT_MASK);
@@ -125,11 +125,12 @@ int voyagergx_irq_demux(int irq)
                         i = 17;
                 else
                         printk("Unexpected IRQ irq = %d status = 0x%08lx\n", irq, val);
-                pr_debug("voyagergx_irq_demux %d \n", i);
-                if (i < VOYAGER_IRQ_NUM) {
+                pr_debug("voyagergx_irq_demux %ld \n", i);
+                if (i < VOYAGER_IRQ_NUM) {
                         irq = VOYAGER_IRQ_BASE + i;
-                        if (voyagergx_demux[i].func != 0)
-                                irq = voyagergx_demux[i].func(irq, voyagergx_demux[i].dev);
+                        if (voyagergx_demux[i].func != 0)
+                                irq = voyagergx_demux[i].func(irq,
+                                                voyagergx_demux[i].dev);
                 }
         }
         return irq;
diff --git a/arch/sh/drivers/dma/dma-api.c b/arch/sh/drivers/dma/dma-api.c
index 8057a27a1bc6..cf8e11994330 100644
--- a/arch/sh/drivers/dma/dma-api.c
+++ b/arch/sh/drivers/dma/dma-api.c
@@ -16,6 +16,7 @@
 #include <linux/list.h>
 #include <linux/platform_device.h>
 #include <linux/mm.h>
+#include <linux/sched.h>
 #include <asm/dma.h>
 
 DEFINE_SPINLOCK(dma_spin_lock);
diff --git a/arch/sh/kernel/cf-enabler.c b/arch/sh/kernel/cf-enabler.c
index 849a9e191391..ebc73b85094a 100644
--- a/arch/sh/kernel/cf-enabler.c
+++ b/arch/sh/kernel/cf-enabler.c
@@ -12,6 +12,7 @@
 #include <linux/init.h>
 #include <linux/mm.h>
 #include <linux/vmalloc.h>
+#include <linux/interrupt.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 
@@ -149,6 +150,11 @@ static int __init cf_init_se(void)
         ctrl_outb(0x42, PA_MRSHPC_MW2 + 0x200);
         return 0;
 }
+#else
+static int __init cf_init_se(void)
+{
+        return -1;
+}
 #endif
 
 int __init cf_init(void)
diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S
index 832c0b4a1e6c..b0b59d4a33ca 100644
--- a/arch/sh/kernel/cpu/sh3/entry.S
+++ b/arch/sh/kernel/cpu/sh3/entry.S
@@ -320,6 +320,9 @@ skip_restore:
 
         .align  2
 5:      .long   0x00001000      ! DSP
+#ifdef CONFIG_KGDB_NMI
+6:      .long   in_nmi
+#endif
 7:      .long   0x30000000
 
 ! common exception handler
diff --git a/arch/sh/kernel/cpu/sh4/clock-sh4-202.c b/arch/sh/kernel/cpu/sh4/clock-sh4-202.c
index fcb2c41bc34e..a33429463e96 100644
--- a/arch/sh/kernel/cpu/sh4/clock-sh4-202.c
+++ b/arch/sh/kernel/cpu/sh4/clock-sh4-202.c
@@ -111,7 +111,7 @@ static int shoc_clk_verify_rate(struct clk *clk, unsigned long rate)
         return 0;
 }
 
-static int shoc_clk_set_rate(struct clk *clk, unsigned long rate)
+static int shoc_clk_set_rate(struct clk *clk, unsigned long rate, int algo_id)
 {
         unsigned long frqcr3;
         unsigned int tmp;
diff --git a/arch/sh/kernel/cpu/sh4/probe.c b/arch/sh/kernel/cpu/sh4/probe.c
index 8cd04904c77a..fab2eb07196b 100644
--- a/arch/sh/kernel/cpu/sh4/probe.c
+++ b/arch/sh/kernel/cpu/sh4/probe.c
@@ -12,6 +12,7 @@
  */
 #include <linux/init.h>
 #include <linux/io.h>
+#include <linux/smp.h>
 #include <asm/processor.h>
 #include <asm/cache.h>
 
diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c
index dbebaddcfe39..283e1425ced5 100644
--- a/arch/sh/kernel/smp.c
+++ b/arch/sh/kernel/smp.c
@@ -10,6 +10,8 @@
  * Free Software Foundation; either version 2 of the License, or (at your
  * option) any later version.
  */
+
+#include <linux/err.h>
 #include <linux/cache.h>
 #include <linux/cpumask.h>
 #include <linux/delay.h>
diff --git a/arch/sh/kernel/timers/timer.c b/arch/sh/kernel/timers/timer.c
index a6bcc913d25e..4e7e747d1b69 100644
--- a/arch/sh/kernel/timers/timer.c
+++ b/arch/sh/kernel/timers/timer.c
@@ -13,7 +13,7 @@
 #include <linux/string.h>
 #include <asm/timer.h>
 
-static struct sys_timer *sys_timers[] __initdata = {
+static struct sys_timer *sys_timers[] = {
 #ifdef CONFIG_SH_TMU
         &tmu_timer,
 #endif
@@ -26,7 +26,7 @@ static struct sys_timer *sys_timers[] __initdata = {
         NULL,
 };
 
-static char timer_override[10] __initdata;
+static char timer_override[10];
 static int __init timer_setup(char *str)
 {
         if (str)
@@ -53,4 +53,3 @@ struct sys_timer *get_sys_timer(void)
 
         return NULL;
 }
-
diff --git a/arch/sh/kernel/vsyscall/vsyscall.c b/arch/sh/kernel/vsyscall/vsyscall.c
index e146bafcd14f..2aa9438361bc 100644
--- a/arch/sh/kernel/vsyscall/vsyscall.c
+++ b/arch/sh/kernel/vsyscall/vsyscall.c
@@ -17,6 +17,7 @@
 #include <linux/gfp.h>
 #include <linux/module.h>
 #include <linux/elf.h>
+#include <linux/sched.h>
 
 /*
  * Should the kernel map a VDSO page into processes and pass its
diff --git a/arch/sh/mm/ioremap.c b/arch/sh/mm/ioremap.c
index be03d74e99cb..0c7b7e33abdc 100644
--- a/arch/sh/mm/ioremap.c
+++ b/arch/sh/mm/ioremap.c
@@ -22,6 +22,7 @@
 #include <asm/addrspace.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
+#include <asm/mmu.h>
 
 /*
  * Remap an arbitrary physical address space into the kernel virtual
diff --git a/arch/sparc/lib/atomic32.c b/arch/sparc/lib/atomic32.c
index 617d29832e19..cbddeb38ffda 100644
--- a/arch/sparc/lib/atomic32.c
+++ b/arch/sparc/lib/atomic32.c
@@ -124,10 +124,10 @@ unsigned long __cmpxchg_u32(volatile u32 *ptr, u32 old, u32 new)
         unsigned long flags;
         u32 prev;
 
-        spin_lock_irqsave(ATOMIC_HASH(addr), flags);
+        spin_lock_irqsave(ATOMIC_HASH(ptr), flags);
         if ((prev = *ptr) == old)
                 *ptr = new;
-        spin_unlock_irqrestore(ATOMIC_HASH(addr), flags);
+        spin_unlock_irqrestore(ATOMIC_HASH(ptr), flags);
 
         return (unsigned long)prev;
 }
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index bd00f89eed1e..89a1b469b93d 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -396,6 +396,15 @@ config SCHED_SMT
           when dealing with UltraSPARC cpus at a cost of slightly increased
           overhead in some places. If unsure say N here.
 
+config SCHED_MC
+        bool "Multi-core scheduler support"
+        depends on SMP
+        default y
+        help
+          Multi-core scheduler support improves the CPU scheduler's decision
+          making when dealing with multi-core CPU chips at a cost of slightly
+          increased overhead in some places. If unsure say N here.
+
 source "kernel/Kconfig.preempt"
 
 config CMDLINE_BOOL
diff --git a/arch/sparc64/kernel/Makefile b/arch/sparc64/kernel/Makefile
index d8d19093d12f..f964bf28d21a 100644
--- a/arch/sparc64/kernel/Makefile
+++ b/arch/sparc64/kernel/Makefile
@@ -1,4 +1,4 @@
-# $Id: Makefile,v 1.70 2002/02/09 19:49:30 davem Exp $
+#
 # Makefile for the linux kernel.
 #
 
@@ -8,7 +8,7 @@ EXTRA_CFLAGS := -Werror
 extra-y         := head.o init_task.o vmlinux.lds
 
 obj-y           := process.o setup.o cpu.o idprom.o \
-                   traps.o auxio.o una_asm.o \
+                   traps.o auxio.o una_asm.o sysfs.o \
                    irq.o ptrace.o time.o sys_sparc.o signal.o \
                    unaligned.o central.o pci.o starfire.o semaphore.o \
                    power.o sbus.o iommu_common.o sparc64_ksyms.o chmc.o \
diff --git a/arch/sparc64/kernel/entry.S b/arch/sparc64/kernel/entry.S
index 8f10dda0f5c0..7d1a11822a1e 100644
--- a/arch/sparc64/kernel/entry.S
+++ b/arch/sparc64/kernel/entry.S
@@ -2498,3 +2498,97 @@ sun4v_vintr_set_target:
         retl
          nop
         .size   sun4v_vintr_set_target, .-sun4v_vintr_set_target
+
+        /* %o0: NCS sub-function
+         * %o1: sub-function arg real-address
+         * %o2: sub-function arg size
+         *
+         * returns %o0: status
+         */
+        .globl  sun4v_ncs_request
+        .type   sun4v_ncs_request,#function
+sun4v_ncs_request:
+        mov     HV_FAST_NCS_REQUEST, %o5
+        ta      HV_FAST_TRAP
+        retl
+         nop
+        .size   sun4v_ncs_request, .-sun4v_ncs_request
+
+        .globl  sun4v_svc_send
+        .type   sun4v_svc_send,#function
+sun4v_svc_send:
+        save    %sp, -192, %sp
+        mov     %i0, %o0
+        mov     %i1, %o1
+        mov     %i2, %o2
+        mov     HV_FAST_SVC_SEND, %o5
+        ta      HV_FAST_TRAP
+        stx     %o1, [%i3]
+        ret
+        restore
+        .size   sun4v_svc_send, .-sun4v_svc_send
+
+        .globl  sun4v_svc_recv
+        .type   sun4v_svc_recv,#function
+sun4v_svc_recv:
+        save    %sp, -192, %sp
+        mov     %i0, %o0
+        mov     %i1, %o1
+        mov     %i2, %o2
+        mov     HV_FAST_SVC_RECV, %o5
+        ta      HV_FAST_TRAP
+        stx     %o1, [%i3]
+        ret
+        restore
+        .size   sun4v_svc_recv, .-sun4v_svc_recv
+
+        .globl  sun4v_svc_getstatus
+        .type   sun4v_svc_getstatus,#function
+sun4v_svc_getstatus:
+        mov     HV_FAST_SVC_GETSTATUS, %o5
+        mov     %o1, %o4
+        ta      HV_FAST_TRAP
+        stx     %o1, [%o4]
+        retl
+         nop
+        .size   sun4v_svc_getstatus, .-sun4v_svc_getstatus
+
+        .globl  sun4v_svc_setstatus
+        .type   sun4v_svc_setstatus,#function
+sun4v_svc_setstatus:
+        mov     HV_FAST_SVC_SETSTATUS, %o5
+        ta      HV_FAST_TRAP
+        retl
+         nop
+        .size   sun4v_svc_setstatus, .-sun4v_svc_setstatus
+
+        .globl  sun4v_svc_clrstatus
+        .type   sun4v_svc_clrstatus,#function
+sun4v_svc_clrstatus:
+        mov     HV_FAST_SVC_CLRSTATUS, %o5
+        ta      HV_FAST_TRAP
+        retl
+         nop
+        .size   sun4v_svc_clrstatus, .-sun4v_svc_clrstatus
+
+        .globl  sun4v_mmustat_conf
+        .type   sun4v_mmustat_conf,#function
+sun4v_mmustat_conf:
+        mov     %o1, %o4
+        mov     HV_FAST_MMUSTAT_CONF, %o5
+        ta      HV_FAST_TRAP
+        stx     %o1, [%o4]
+        retl
+         nop
+        .size   sun4v_mmustat_conf, .-sun4v_mmustat_conf
+
+        .globl  sun4v_mmustat_info
+        .type   sun4v_mmustat_info,#function
+sun4v_mmustat_info:
+        mov     %o0, %o4
+        mov     HV_FAST_MMUSTAT_INFO, %o5
+        ta      HV_FAST_TRAP
+        stx     %o1, [%o4]
+        retl
+         nop
+        .size   sun4v_mmustat_info, .-sun4v_mmustat_info
diff --git a/arch/sparc64/kernel/mdesc.c b/arch/sparc64/kernel/mdesc.c
index 9246c2cf9574..f0e16045fb16 100644
--- a/arch/sparc64/kernel/mdesc.c
+++ b/arch/sparc64/kernel/mdesc.c
@@ -473,6 +473,53 @@ static void __init set_core_ids(void)
         }
 }
 
+static void __init mark_proc_ids(struct mdesc_node *mp, int proc_id)
+{
+        int i;
+
+        for (i = 0; i < mp->num_arcs; i++) {
+                struct mdesc_node *t = mp->arcs[i].arc;
+                const u64 *id;
+
+                if (strcmp(mp->arcs[i].name, "back"))
+                        continue;
+
+                if (strcmp(t->name, "cpu"))
+                        continue;
+
+                id = md_get_property(t, "id", NULL);
+                if (*id < NR_CPUS)
+                        cpu_data(*id).proc_id = proc_id;
+        }
+}
+
+static void __init __set_proc_ids(const char *exec_unit_name)
+{
+        struct mdesc_node *mp;
+        int idx;
+
+        idx = 0;
+        md_for_each_node_by_name(mp, exec_unit_name) {
+                const char *type;
+                int len;
+
+                type = md_get_property(mp, "type", &len);
+                if (!find_in_proplist(type, "int", len) &&
+                    !find_in_proplist(type, "integer", len))
+                        continue;
+
+                mark_proc_ids(mp, idx);
+
+                idx++;
+        }
+}
+
+static void __init set_proc_ids(void)
+{
+        __set_proc_ids("exec_unit");
+        __set_proc_ids("exec-unit");
+}
+
 static void __init get_one_mondo_bits(const u64 *p, unsigned int *mask, unsigned char def)
 {
         u64 val;
@@ -574,9 +621,15 @@ static void __init mdesc_fill_in_cpu_data(void)
 #endif
 
                 c->core_id = 0;
+                c->proc_id = -1;
         }
 
+#ifdef CONFIG_SMP
+        sparc64_multi_core = 1;
+#endif
+
         set_core_ids();
+        set_proc_ids();
 
         smp_fill_in_sib_core_maps();
 }
diff --git a/arch/sparc64/kernel/pci_sabre.c b/arch/sparc64/kernel/pci_sabre.c
index 323d6c278518..22e1be5c7489 100644
--- a/arch/sparc64/kernel/pci_sabre.c
+++ b/arch/sparc64/kernel/pci_sabre.c
@@ -636,13 +636,18 @@ static void apb_init(struct pci_bus *sabre_bus)
 static void sabre_scan_bus(struct pci_pbm_info *pbm)
 {
         static int once;
-        struct pci_bus *pbus;
 
         /* The APB bridge speaks to the Sabre host PCI bridge
          * at 66Mhz, but the front side of APB runs at 33Mhz
          * for both segments.
+         *
+         * Hummingbird systems do not use APB, so they run
+         * at 66MHZ.
          */
-        pbm->is_66mhz_capable = 0;
+        if (hummingbird_p)
+                pbm->is_66mhz_capable = 1;
+        else
+                pbm->is_66mhz_capable = 0;
 
         /* This driver has not been verified to handle
          * multiple SABREs yet, so trap this.
@@ -656,13 +661,13 @@ static void sabre_scan_bus(struct pci_pbm_info *pbm)
         }
         once++;
 
-        pbus = pci_scan_one_pbm(pbm);
-        if (!pbus)
+        pbm->pci_bus = pci_scan_one_pbm(pbm);
+        if (!pbm->pci_bus)
                 return;
 
-        sabre_root_bus = pbus;
+        sabre_root_bus = pbm->pci_bus;
 
-        apb_init(pbus);
+        apb_init(pbm->pci_bus);
 
         sabre_register_error_handlers(pbm);
 }
diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c
index dad4b3ba705f..61036b346664 100644
--- a/arch/sparc64/kernel/prom.c
+++ b/arch/sparc64/kernel/prom.c
@@ -933,29 +933,29 @@ static void __init fire_irq_trans_init(struct device_node *dp)
  * This should conform to both Sunfire/Wildfire server and Fusion
  * desktop designs.
  */
-#define SYSIO_IMAP_SLOT0        0x2c04UL
-#define SYSIO_IMAP_SLOT1        0x2c0cUL
-#define SYSIO_IMAP_SLOT2        0x2c14UL
-#define SYSIO_IMAP_SLOT3        0x2c1cUL
-#define SYSIO_IMAP_SCSI         0x3004UL
-#define SYSIO_IMAP_ETH          0x300cUL
-#define SYSIO_IMAP_BPP          0x3014UL
-#define SYSIO_IMAP_AUDIO        0x301cUL
-#define SYSIO_IMAP_PFAIL        0x3024UL
-#define SYSIO_IMAP_KMS          0x302cUL
-#define SYSIO_IMAP_FLPY         0x3034UL
-#define SYSIO_IMAP_SHW          0x303cUL
-#define SYSIO_IMAP_KBD          0x3044UL
-#define SYSIO_IMAP_MS           0x304cUL
-#define SYSIO_IMAP_SER          0x3054UL
-#define SYSIO_IMAP_TIM0         0x3064UL
-#define SYSIO_IMAP_TIM1         0x306cUL
-#define SYSIO_IMAP_UE           0x3074UL
-#define SYSIO_IMAP_CE           0x307cUL
-#define SYSIO_IMAP_SBERR        0x3084UL
-#define SYSIO_IMAP_PMGMT        0x308cUL
-#define SYSIO_IMAP_GFX          0x3094UL
-#define SYSIO_IMAP_EUPA         0x309cUL
+#define SYSIO_IMAP_SLOT0        0x2c00UL
+#define SYSIO_IMAP_SLOT1        0x2c08UL
+#define SYSIO_IMAP_SLOT2        0x2c10UL
+#define SYSIO_IMAP_SLOT3        0x2c18UL
+#define SYSIO_IMAP_SCSI         0x3000UL
+#define SYSIO_IMAP_ETH          0x3008UL
+#define SYSIO_IMAP_BPP          0x3010UL
+#define SYSIO_IMAP_AUDIO        0x3018UL
+#define SYSIO_IMAP_PFAIL        0x3020UL
+#define SYSIO_IMAP_KMS          0x3028UL
+#define SYSIO_IMAP_FLPY         0x3030UL
+#define SYSIO_IMAP_SHW          0x3038UL
+#define SYSIO_IMAP_KBD          0x3040UL
+#define SYSIO_IMAP_MS           0x3048UL
+#define SYSIO_IMAP_SER          0x3050UL
+#define SYSIO_IMAP_TIM0         0x3060UL
+#define SYSIO_IMAP_TIM1         0x3068UL
+#define SYSIO_IMAP_UE           0x3070UL
+#define SYSIO_IMAP_CE           0x3078UL
+#define SYSIO_IMAP_SBERR        0x3080UL
+#define SYSIO_IMAP_PMGMT        0x3088UL
+#define SYSIO_IMAP_GFX          0x3090UL
+#define SYSIO_IMAP_EUPA         0x3098UL
 
 #define bogon     ((unsigned long) -1)
 static unsigned long sysio_irq_offsets[] = {
@@ -1006,10 +1006,10 @@ static unsigned long sysio_irq_offsets[] = {
  * Interrupt Clear register pointer, SYSIO specific version.
  */
 #define SYSIO_ICLR_UNUSED0      0x3400UL
-#define SYSIO_ICLR_SLOT0        0x340cUL
-#define SYSIO_ICLR_SLOT1        0x344cUL
-#define SYSIO_ICLR_SLOT2        0x348cUL
-#define SYSIO_ICLR_SLOT3        0x34ccUL
+#define SYSIO_ICLR_SLOT0        0x3408UL
+#define SYSIO_ICLR_SLOT1        0x3448UL
+#define SYSIO_ICLR_SLOT2        0x3488UL
+#define SYSIO_ICLR_SLOT3        0x34c8UL
 static unsigned long sysio_imap_to_iclr(unsigned long imap)
 {
         unsigned long diff = SYSIO_ICLR_UNUSED0 - SYSIO_IMAP_SLOT0;
@@ -1781,6 +1781,10 @@ static void __init of_fill_in_cpu_data(void)
                         }
 
                         cpu_data(cpuid).core_id = portid + 1;
+                        cpu_data(cpuid).proc_id = portid;
+#ifdef CONFIG_SMP
+                        sparc64_multi_core = 1;
+#endif
                 } else {
                         cpu_data(cpuid).dcache_size =
                                 of_getintprop_default(dp, "dcache-size", 16 * 1024);
@@ -1799,6 +1803,7 @@ static void __init of_fill_in_cpu_data(void)
                                 of_getintprop_default(dp, "ecache-line-size", 64);
 
                         cpu_data(cpuid).core_id = 0;
+                        cpu_data(cpuid).proc_id = -1;
                 }
 
 #ifdef CONFIG_SMP
diff --git a/arch/sparc64/kernel/sbus.c b/arch/sparc64/kernel/sbus.c
index 91f6e2a74ad5..a1fd9bcc0b87 100644
--- a/arch/sparc64/kernel/sbus.c
+++ b/arch/sparc64/kernel/sbus.c
@@ -629,29 +629,29 @@ void sbus_set_sbus64(struct sbus_dev *sdev, int bursts)
  * This should conform to both Sunfire/Wildfire server and Fusion
  * desktop designs.
  */
-#define SYSIO_IMAP_SLOT0        0x2c04UL
-#define SYSIO_IMAP_SLOT1        0x2c0cUL
-#define SYSIO_IMAP_SLOT2        0x2c14UL
-#define SYSIO_IMAP_SLOT3        0x2c1cUL
-#define SYSIO_IMAP_SCSI         0x3004UL
-#define SYSIO_IMAP_ETH          0x300cUL
-#define SYSIO_IMAP_BPP          0x3014UL
-#define SYSIO_IMAP_AUDIO        0x301cUL
-#define SYSIO_IMAP_PFAIL        0x3024UL
-#define SYSIO_IMAP_KMS          0x302cUL
-#define SYSIO_IMAP_FLPY         0x3034UL
-#define SYSIO_IMAP_SHW          0x303cUL
-#define SYSIO_IMAP_KBD          0x3044UL
-#define SYSIO_IMAP_MS           0x304cUL
-#define SYSIO_IMAP_SER          0x3054UL
-#define SYSIO_IMAP_TIM0         0x3064UL
-#define SYSIO_IMAP_TIM1         0x306cUL
-#define SYSIO_IMAP_UE           0x3074UL
-#define SYSIO_IMAP_CE           0x307cUL
-#define SYSIO_IMAP_SBERR        0x3084UL
-#define SYSIO_IMAP_PMGMT        0x308cUL
-#define SYSIO_IMAP_GFX          0x3094UL
-#define SYSIO_IMAP_EUPA         0x309cUL
+#define SYSIO_IMAP_SLOT0        0x2c00UL
+#define SYSIO_IMAP_SLOT1        0x2c08UL
+#define SYSIO_IMAP_SLOT2        0x2c10UL
+#define SYSIO_IMAP_SLOT3        0x2c18UL
+#define SYSIO_IMAP_SCSI         0x3000UL
+#define SYSIO_IMAP_ETH          0x3008UL
+#define SYSIO_IMAP_BPP          0x3010UL
+#define SYSIO_IMAP_AUDIO        0x3018UL
+#define SYSIO_IMAP_PFAIL        0x3020UL
+#define SYSIO_IMAP_KMS          0x3028UL
+#define SYSIO_IMAP_FLPY         0x3030UL
+#define SYSIO_IMAP_SHW          0x3038UL
+#define SYSIO_IMAP_KBD          0x3040UL
+#define SYSIO_IMAP_MS           0x3048UL
+#define SYSIO_IMAP_SER          0x3050UL
+#define SYSIO_IMAP_TIM0         0x3060UL
+#define SYSIO_IMAP_TIM1         0x3068UL
+#define SYSIO_IMAP_UE           0x3070UL
+#define SYSIO_IMAP_CE           0x3078UL
+#define SYSIO_IMAP_SBERR        0x3080UL
+#define SYSIO_IMAP_PMGMT        0x3088UL
+#define SYSIO_IMAP_GFX          0x3090UL
+#define SYSIO_IMAP_EUPA         0x3098UL
 
 #define bogon     ((unsigned long) -1)
 static unsigned long sysio_irq_offsets[] = {
@@ -700,10 +700,10 @@ static unsigned long sysio_irq_offsets[] = {
  * Interrupt Clear register pointer, SYSIO specific version.
  */
 #define SYSIO_ICLR_UNUSED0      0x3400UL
-#define SYSIO_ICLR_SLOT0        0x340cUL
-#define SYSIO_ICLR_SLOT1        0x344cUL
-#define SYSIO_ICLR_SLOT2        0x348cUL
-#define SYSIO_ICLR_SLOT3        0x34ccUL
+#define SYSIO_ICLR_SLOT0        0x3408UL
+#define SYSIO_ICLR_SLOT1        0x3448UL
+#define SYSIO_ICLR_SLOT2        0x3488UL
+#define SYSIO_ICLR_SLOT3        0x34c8UL
 static unsigned long sysio_imap_to_iclr(unsigned long imap)
 {
         unsigned long diff = SYSIO_ICLR_UNUSED0 - SYSIO_IMAP_SLOT0;
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index de9b4c13f1c7..7490cc670a53 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -513,22 +513,3 @@ void sun_do_break(void)
 
 int serial_console = -1;
 int stop_a_enabled = 1;
-
-static int __init topology_init(void)
-{
-        int i, err;
-
-        err = -ENOMEM;
-
-        for_each_possible_cpu(i) {
-                struct cpu *p = kzalloc(sizeof(*p), GFP_KERNEL);
-                if (p) {
-                        register_cpu(p, i);
-                        err = 0;
-                }
-        }
-
-        return err;
-}
-
-subsys_initcall(topology_init);
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index c550bba3490a..4dcd7d0b60f2 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -44,6 +44,8 @@
 
 extern void calibrate_delay(void);
 
+int sparc64_multi_core __read_mostly;
+
 /* Please don't make this stuff initdata!!!  --DaveM */
 unsigned char boot_cpu_id;
 
@@ -51,6 +53,8 @@ cpumask_t cpu_online_map __read_mostly = CPU_MASK_NONE;
 cpumask_t phys_cpu_present_map __read_mostly = CPU_MASK_NONE;
 cpumask_t cpu_sibling_map[NR_CPUS] __read_mostly =
         { [0 ... NR_CPUS-1] = CPU_MASK_NONE };
+cpumask_t cpu_core_map[NR_CPUS] __read_mostly =
+        { [0 ... NR_CPUS-1] = CPU_MASK_NONE };
 static cpumask_t smp_commenced_mask;
 static cpumask_t cpu_callout_map;
 
@@ -1217,13 +1221,28 @@ void __devinit smp_fill_in_sib_core_maps(void)
                 unsigned int j;
 
                 if (cpu_data(i).core_id == 0) {
-                        cpu_set(i, cpu_sibling_map[i]);
+                        cpu_set(i, cpu_core_map[i]);
                         continue;
                 }
 
                 for_each_possible_cpu(j) {
                         if (cpu_data(i).core_id ==
                             cpu_data(j).core_id)
+                                cpu_set(j, cpu_core_map[i]);
+                }
+        }
+
+        for_each_possible_cpu(i) {
+                unsigned int j;
+
+                if (cpu_data(i).proc_id == -1) {
+                        cpu_set(i, cpu_sibling_map[i]);
+                        continue;
+                }
+
+                for_each_possible_cpu(j) {
+                        if (cpu_data(i).proc_id ==
+                            cpu_data(j).proc_id)
                                 cpu_set(j, cpu_sibling_map[i]);
                 }
         }
diff --git a/arch/sparc64/kernel/sysfs.c b/arch/sparc64/kernel/sysfs.c
new file mode 100644
index 000000000000..cdb1477af89f
--- /dev/null
+++ b/arch/sparc64/kernel/sysfs.c
@@ -0,0 +1,297 @@
+/* sysfs.c: Toplogy sysfs support code for sparc64.
+ *
+ * Copyright (C) 2007 David S. Miller <davem@davemloft.net>
+ */
+#include <linux/sysdev.h>
+#include <linux/cpu.h>
+#include <linux/smp.h>
+#include <linux/percpu.h>
+#include <linux/init.h>
+
+#include <asm/hypervisor.h>
+#include <asm/spitfire.h>
+
+static DEFINE_PER_CPU(struct hv_mmu_statistics, mmu_stats) __attribute__((aligned(64)));
+
+#define SHOW_MMUSTAT_ULONG(NAME) \
+static ssize_t show_##NAME(struct sys_device *dev, char *buf) \
+{ \
+        struct hv_mmu_statistics *p = &per_cpu(mmu_stats, dev->id); \
+        return sprintf(buf, "%lu\n", p->NAME); \
+} \
+static SYSDEV_ATTR(NAME, 0444, show_##NAME, NULL)
+
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctx0_8k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctx0_8k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctx0_64k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctx0_64k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctx0_4mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctx0_4mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctx0_256mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctx0_256mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctxnon0_8k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctxnon0_8k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctxnon0_64k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctxnon0_64k_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctxnon0_4mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctxnon0_4mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_hits_ctxnon0_256mb_tte);
+SHOW_MMUSTAT_ULONG(immu_tsb_ticks_ctxnon0_256mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctx0_8k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctx0_8k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctx0_64k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctx0_64k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctx0_4mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctx0_4mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctx0_256mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctx0_256mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctxnon0_8k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctxnon0_8k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctxnon0_64k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctxnon0_64k_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctxnon0_4mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctxnon0_4mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_hits_ctxnon0_256mb_tte);
+SHOW_MMUSTAT_ULONG(dmmu_tsb_ticks_ctxnon0_256mb_tte);
+
+static struct attribute *mmu_stat_attrs[] = {
+        &attr_immu_tsb_hits_ctx0_8k_tte.attr,
+        &attr_immu_tsb_ticks_ctx0_8k_tte.attr,
+        &attr_immu_tsb_hits_ctx0_64k_tte.attr,
+        &attr_immu_tsb_ticks_ctx0_64k_tte.attr,
+        &attr_immu_tsb_hits_ctx0_4mb_tte.attr,
+        &attr_immu_tsb_ticks_ctx0_4mb_tte.attr,
+        &attr_immu_tsb_hits_ctx0_256mb_tte.attr,
+        &attr_immu_tsb_ticks_ctx0_256mb_tte.attr,
+        &attr_immu_tsb_hits_ctxnon0_8k_tte.attr,
+        &attr_immu_tsb_ticks_ctxnon0_8k_tte.attr,
+        &attr_immu_tsb_hits_ctxnon0_64k_tte.attr,
+        &attr_immu_tsb_ticks_ctxnon0_64k_tte.attr,
+        &attr_immu_tsb_hits_ctxnon0_4mb_tte.attr,
+        &attr_immu_tsb_ticks_ctxnon0_4mb_tte.attr,
+        &attr_immu_tsb_hits_ctxnon0_256mb_tte.attr,
+        &attr_immu_tsb_ticks_ctxnon0_256mb_tte.attr,
+        &attr_dmmu_tsb_hits_ctx0_8k_tte.attr,
+        &attr_dmmu_tsb_ticks_ctx0_8k_tte.attr,
+        &attr_dmmu_tsb_hits_ctx0_64k_tte.attr,
+        &attr_dmmu_tsb_ticks_ctx0_64k_tte.attr,
+        &attr_dmmu_tsb_hits_ctx0_4mb_tte.attr,
+        &attr_dmmu_tsb_ticks_ctx0_4mb_tte.attr,
+        &attr_dmmu_tsb_hits_ctx0_256mb_tte.attr,
+        &attr_dmmu_tsb_ticks_ctx0_256mb_tte.attr,
+        &attr_dmmu_tsb_hits_ctxnon0_8k_tte.attr,
+        &attr_dmmu_tsb_ticks_ctxnon0_8k_tte.attr,
+        &attr_dmmu_tsb_hits_ctxnon0_64k_tte.attr,
+        &attr_dmmu_tsb_ticks_ctxnon0_64k_tte.attr,
+        &attr_dmmu_tsb_hits_ctxnon0_4mb_tte.attr,
+        &attr_dmmu_tsb_ticks_ctxnon0_4mb_tte.attr,
+        &attr_dmmu_tsb_hits_ctxnon0_256mb_tte.attr,
+        &attr_dmmu_tsb_ticks_ctxnon0_256mb_tte.attr,
+        NULL,
+};
+
+static struct attribute_group mmu_stat_group = {
+        .attrs = mmu_stat_attrs,
+        .name = "mmu_stats",
+};
+
+/* XXX convert to rusty's on_one_cpu */
+static unsigned long run_on_cpu(unsigned long cpu,
+                                unsigned long (*func)(unsigned long),
+                                unsigned long arg)
+{
+        cpumask_t old_affinity = current->cpus_allowed;
+        unsigned long ret;
+
+        /* should return -EINVAL to userspace */
+        if (set_cpus_allowed(current, cpumask_of_cpu(cpu)))
+                return 0;
+
+        ret = func(arg);
+
+        set_cpus_allowed(current, old_affinity);
+
+        return ret;
+}
+
+static unsigned long read_mmustat_enable(unsigned long junk)
+{
+        unsigned long ra = 0;
+
+        sun4v_mmustat_info(&ra);
+
+        return ra != 0;
+}
+
+static unsigned long write_mmustat_enable(unsigned long val)
+{
+        unsigned long ra, orig_ra;
+
+        if (val)
+                ra = __pa(&per_cpu(mmu_stats, smp_processor_id()));
+        else
+                ra = 0UL;
+
+        return sun4v_mmustat_conf(ra, &orig_ra);
+}
+
+static ssize_t show_mmustat_enable(struct sys_device *s, char *buf)
+{
+        unsigned long val = run_on_cpu(s->id, read_mmustat_enable, 0);
+        return sprintf(buf, "%lx\n", val);
+}
+
+static ssize_t store_mmustat_enable(struct sys_device *s, const char *buf, size_t count)
+{
+        unsigned long val, err;
+        int ret = sscanf(buf, "%ld", &val);
+
+        if (ret != 1)
+                return -EINVAL;
+
+        err = run_on_cpu(s->id, write_mmustat_enable, val);
+        if (err)
+                return -EIO;
+
+        return count;
+}
+
+static SYSDEV_ATTR(mmustat_enable, 0644, show_mmustat_enable, store_mmustat_enable);
+
+static int mmu_stats_supported;
+
+static int register_mmu_stats(struct sys_device *s)
+{
+        if (!mmu_stats_supported)
+                return 0;
+        sysdev_create_file(s, &attr_mmustat_enable);
+        return sysfs_create_group(&s->kobj, &mmu_stat_group);
+}
+
+#ifdef CONFIG_HOTPLUG_CPU
+static void unregister_mmu_stats(struct sys_device *s)
+{
+        if (!mmu_stats_supported)
+                return;
+        sysfs_remove_group(&s->kobj, &mmu_stat_group);
+        sysdev_remove_file(s, &attr_mmustat_enable);
+}
+#endif
+
+#define SHOW_CPUDATA_ULONG_NAME(NAME, MEMBER) \
+static ssize_t show_##NAME(struct sys_device *dev, char *buf) \
+{ \
+        cpuinfo_sparc *c = &cpu_data(dev->id); \
+        return sprintf(buf, "%lu\n", c->MEMBER); \
+}
+
+#define SHOW_CPUDATA_UINT_NAME(NAME, MEMBER) \
+static ssize_t show_##NAME(struct sys_device *dev, char *buf) \
+{ \
+        cpuinfo_sparc *c = &cpu_data(dev->id); \
+        return sprintf(buf, "%u\n", c->MEMBER); \
+}
+
+SHOW_CPUDATA_ULONG_NAME(clock_tick, clock_tick);
+SHOW_CPUDATA_ULONG_NAME(udelay_val, udelay_val);
+SHOW_CPUDATA_UINT_NAME(l1_dcache_size, dcache_size);
+SHOW_CPUDATA_UINT_NAME(l1_dcache_line_size, dcache_line_size);
+SHOW_CPUDATA_UINT_NAME(l1_icache_size, icache_size);
+SHOW_CPUDATA_UINT_NAME(l1_icache_line_size, icache_line_size);
+SHOW_CPUDATA_UINT_NAME(l2_cache_size, ecache_size);
+SHOW_CPUDATA_UINT_NAME(l2_cache_line_size, ecache_line_size);
+
+static struct sysdev_attribute cpu_core_attrs[] = {
+        _SYSDEV_ATTR(clock_tick,          0444, show_clock_tick, NULL),
+        _SYSDEV_ATTR(udelay_val,          0444, show_udelay_val, NULL),
+        _SYSDEV_ATTR(l1_dcache_size,      0444, show_l1_dcache_size, NULL),
+        _SYSDEV_ATTR(l1_dcache_line_size, 0444, show_l1_dcache_line_size, NULL),
+        _SYSDEV_ATTR(l1_icache_size,      0444, show_l1_icache_size, NULL),
+        _SYSDEV_ATTR(l1_icache_line_size, 0444, show_l1_icache_line_size, NULL),
+        _SYSDEV_ATTR(l2_cache_size,       0444, show_l2_cache_size, NULL),
+        _SYSDEV_ATTR(l2_cache_line_size,  0444, show_l2_cache_line_size, NULL),
+};
+
+static DEFINE_PER_CPU(struct cpu, cpu_devices);
+
+static void register_cpu_online(unsigned int cpu)
+{
+        struct cpu *c = &per_cpu(cpu_devices, cpu);
+        struct sys_device *s = &c->sysdev;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cpu_core_attrs); i++)
+                sysdev_create_file(s, &cpu_core_attrs[i]);
+
+        register_mmu_stats(s);
+}
+
+#ifdef CONFIG_HOTPLUG_CPU
+static void unregister_cpu_online(unsigned int cpu)
+{
+        struct cpu *c = &per_cpu(cpu_devices, cpu);
+        struct sys_device *s = &c->sysdev;
+        int i;
+
+        unregister_mmu_stats(s);
+        for (i = 0; i < ARRAY_SIZE(cpu_core_attrs); i++)
+                sysdev_remove_file(s, &cpu_core_attrs[i]);
+}
+#endif
+
+static int __cpuinit sysfs_cpu_notify(struct notifier_block *self,
+                                      unsigned long action, void *hcpu)
+{
+        unsigned int cpu = (unsigned int)(long)hcpu;
+
+        switch (action) {
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+                register_cpu_online(cpu);
+                break;
+#ifdef CONFIG_HOTPLUG_CPU
+        case CPU_DEAD:
+        case CPU_DEAD_FROZEN:
+                unregister_cpu_online(cpu);
+                break;
+#endif
+        }
+        return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata sysfs_cpu_nb = {
+        .notifier_call  = sysfs_cpu_notify,
+};
+
+static void __init check_mmu_stats(void)
+{
+        unsigned long dummy1, err;
+
+        if (tlb_type != hypervisor)
+                return;
+
+        err = sun4v_mmustat_info(&dummy1);
+        if (!err)
+                mmu_stats_supported = 1;
+}
+
+static int __init topology_init(void)
+{
+        int cpu;
+
+        check_mmu_stats();
+
+        register_cpu_notifier(&sysfs_cpu_nb);
+
+        for_each_possible_cpu(cpu) {
+                struct cpu *c = &per_cpu(cpu_devices, cpu);
+
+                register_cpu(c, cpu);
+                if (cpu_online(cpu))
+                        register_cpu_online(cpu);
+        }
+
+        return 0;
+}
+
+subsys_initcall(topology_init);
diff --git a/arch/sparc64/kernel/vmlinux.lds.S b/arch/sparc64/kernel/vmlinux.lds.S
index fb648de18a8d..3ad10f3027e4 100644
--- a/arch/sparc64/kernel/vmlinux.lds.S
+++ b/arch/sparc64/kernel/vmlinux.lds.S
@@ -1,5 +1,6 @@
 /* ld script to make UltraLinux kernel */
 
+#include <asm/page.h>
 #include <asm-generic/vmlinux.lds.h>
 
 OUTPUT_FORMAT("elf64-sparc", "elf64-sparc", "elf64-sparc")
@@ -23,7 +24,7 @@ SECTIONS
   _etext = .;
   PROVIDE (etext = .);
 
-  RODATA
+  RO_DATA(PAGE_SIZE)
 
   .data    :
   {
@@ -44,7 +45,7 @@ SECTIONS
   __ex_table : { *(__ex_table) }
   __stop___ex_table = .;
 
-  . = ALIGN(8192);
+  . = ALIGN(PAGE_SIZE);
   __init_begin = .;
   .init.text : { 
         _sinittext = .;
@@ -83,17 +84,17 @@ SECTIONS
   __sun4v_2insn_patch_end = .;
 
 #ifdef CONFIG_BLK_DEV_INITRD
-  . = ALIGN(8192); 
+  . = ALIGN(PAGE_SIZE);
   __initramfs_start = .;
   .init.ramfs : { *(.init.ramfs) }
   __initramfs_end = .;
 #endif
 
-  . = ALIGN(8192);
+  . = ALIGN(PAGE_SIZE);
   __per_cpu_start = .;
   .data.percpu  : { *(.data.percpu) }
   __per_cpu_end = .;
-  . = ALIGN(8192);
+  . = ALIGN(PAGE_SIZE);
   __init_end = .;
   __bss_start = .;
   .sbss      : { *(.sbss) *(.scommon) }
diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
index bfb62a13d7ee..635e58d443d7 100644
--- a/arch/x86_64/mm/fault.c
+++ b/arch/x86_64/mm/fault.c
@@ -476,6 +476,12 @@ bad_area:
 bad_area_nosemaphore:
         /* User mode accesses just cause a SIGSEGV */
         if (error_code & PF_USER) {
+
+                /*
+                 * It's possible to have interrupts off here.
+                 */
+                local_irq_enable();
+
                 if (is_prefetch(regs, address, error_code))
                         return;
 
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 1336da8bdee1..1ad5111aec38 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -761,3 +761,9 @@ int in_gate_area_no_task(unsigned long addr)
 {
         return (addr >= VSYSCALL_START) && (addr < VSYSCALL_END);
 }
+
+void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+{
+        return __alloc_bootmem_core(pgdat->bdata, size,
+                        SMP_CACHE_BYTES, (4UL*1024*1024*1024), 0);
+}
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index 3ff4e1f0f032..ac6dce2e7596 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -298,7 +298,7 @@ static inline int cryptd_create_thread(struct cryptd_state *state,
         mutex_init(&state->mutex);
         crypto_init_queue(&state->queue, CRYPTD_MAX_QLEN);
 
-        state->task = kthread_create(fn, state, name);
+        state->task = kthread_run(fn, state, name);
         if (IS_ERR(state->task))
                 return PTR_ERR(state->task);
 
@@ -316,6 +316,8 @@ static int cryptd_thread(void *data)
         struct cryptd_state *state = data;
         int stop;
 
+        current->flags |= PF_NOFREEZE;
+
         do {
                 struct crypto_async_request *req, *backlog;
 
diff --git a/drivers/acpi/asus_acpi.c b/drivers/acpi/asus_acpi.c
index b770deab968c..6d7d4157e049 100644
--- a/drivers/acpi/asus_acpi.c
+++ b/drivers/acpi/asus_acpi.c
@@ -1357,7 +1357,7 @@ static struct backlight_ops asus_backlight_data = {
         .update_status  = set_brightness_status,
 };
 
-static void __exit asus_acpi_exit(void)
+static void asus_acpi_exit(void)
 {
         if (asus_backlight_device)
                 backlight_device_unregister(asus_backlight_device);
diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c
index a2efae8a4c4e..0c9f15c54e8c 100644
--- a/drivers/acpi/numa.c
+++ b/drivers/acpi/numa.c
@@ -59,7 +59,7 @@ int node_to_pxm(int node)
         return node_to_pxm_map[node];
 }
 
-int __cpuinit acpi_map_pxm_to_node(int pxm)
+int acpi_map_pxm_to_node(int pxm)
 {
         int node = pxm_to_node_map[pxm];
 
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index b998340e23d4..58ceb18ec997 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -33,6 +33,7 @@
 #include <linux/interrupt.h>
 #include <linux/kmod.h>
 #include <linux/delay.h>
+#include <linux/dmi.h>
 #include <linux/workqueue.h>
 #include <linux/nmi.h>
 #include <linux/acpi.h>
@@ -73,6 +74,21 @@ static void *acpi_irq_context;
 static struct workqueue_struct *kacpid_wq;
 static struct workqueue_struct *kacpi_notify_wq;
 
+#define OSI_STRING_LENGTH_MAX 64        /* arbitrary */
+static char osi_additional_string[OSI_STRING_LENGTH_MAX];
+
+#define OSI_LINUX_ENABLED
+#ifdef  OSI_LINUX_ENABLED
+int osi_linux = 1;      /* enable _OSI(Linux) by default */
+#else
+int osi_linux;          /* disable _OSI(Linux) by default */
+#endif
+
+
+#ifdef CONFIG_DMI
+static struct __initdata dmi_system_id acpi_osl_dmi_table[];
+#endif
+
 static void __init acpi_request_region (struct acpi_generic_address *addr,
         unsigned int length, char *desc)
 {
@@ -121,8 +137,9 @@ static int __init acpi_reserve_resources(void)
 }
 device_initcall(acpi_reserve_resources);
 
-acpi_status acpi_os_initialize(void)
+acpi_status __init acpi_os_initialize(void)
 {
+        dmi_check_system(acpi_osl_dmi_table);
         return AE_OK;
 }
 
@@ -960,20 +977,38 @@ static int __init acpi_os_name_setup(char *str)
 
 __setup("acpi_os_name=", acpi_os_name_setup);
 
+static void enable_osi_linux(int enable) {
+
+        if (osi_linux != enable)
+                printk(KERN_INFO PREFIX "%sabled _OSI(Linux)\n",
+                        enable ? "En": "Dis");
+
+        osi_linux = enable;
+        return;
+}
+
 /*
- * _OSI control
+ * Modify the list of "OS Interfaces" reported to BIOS via _OSI
+ *
  * empty string disables _OSI
- * TBD additional string adds to _OSI
+ * string starting with '!' disables that string
+ * otherwise string is added to list, augmenting built-in strings
  */
 static int __init acpi_osi_setup(char *str)
 {
         if (str == NULL || *str == '\0') {
                 printk(KERN_INFO PREFIX "_OSI method disabled\n");
                 acpi_gbl_create_osi_method = FALSE;
-        } else {
-                /* TBD */
-                printk(KERN_ERR PREFIX "_OSI additional string ignored -- %s\n",
-                       str);
+        } else if (*str == '!') {
+                if (acpi_osi_invalidate(++str) == AE_OK)
+                        printk(KERN_INFO PREFIX "Deleted _OSI(%s)\n", str);
+        } else if (!strcmp("!Linux", str)) {
+                enable_osi_linux(0);
+        } else if (!strcmp("Linux", str)) {
+                enable_osi_linux(1);
+        } else if (*osi_additional_string == '\0') {
+                strncpy(osi_additional_string, str, OSI_STRING_LENGTH_MAX);
+                printk(KERN_INFO PREFIX "Added _OSI(%s)\n", str);
         }
 
         return 1;
@@ -1143,11 +1178,28 @@ acpi_status acpi_os_release_object(acpi_cache_t * cache, void *object)
 acpi_status
 acpi_os_validate_interface (char *interface)
 {
-
-    return AE_SUPPORT;
+        if (!strncmp(osi_additional_string, interface, OSI_STRING_LENGTH_MAX))
+                return AE_OK;
+        if (!strcmp("Linux", interface)) {
+                printk(KERN_WARNING PREFIX
+                        "System BIOS is requesting _OSI(Linux)\n");
+#ifdef  OSI_LINUX_ENABLED
+                printk(KERN_WARNING PREFIX
+                        "Please test with \"acpi_osi=!Linux\"\n"
+                        "Please send dmidecode "
+                        "to linux-acpi@vger.kernel.org\n");
+#else
+                printk(KERN_WARNING PREFIX
+                        "If \"acpi_osi=Linux\" works better,\n"
+                        "Please send dmidecode "
+                        "to linux-acpi@vger.kernel.org\n");
+#endif
+                if(osi_linux)
+                        return AE_OK;
+        }
+        return AE_SUPPORT;
 }
 
-
 /******************************************************************************
  *
  * FUNCTION:    acpi_os_validate_address
@@ -1174,5 +1226,51 @@ acpi_os_validate_address (
     return AE_OK;
 }
 
+#ifdef CONFIG_DMI
+#ifdef  OSI_LINUX_ENABLED
+static int dmi_osi_not_linux(struct dmi_system_id *d)
+{
+        printk(KERN_NOTICE "%s detected: requires not _OSI(Linux)\n", d->ident);
+        enable_osi_linux(0);
+        return 0;
+}
+#else
+static int dmi_osi_linux(struct dmi_system_id *d)
+{
+        printk(KERN_NOTICE "%s detected: requires _OSI(Linux)\n", d->ident);
+        enable_osi_linux(1);
+        return 0;
+}
+#endif
+
+static struct dmi_system_id acpi_osl_dmi_table[] __initdata = {
+#ifdef  OSI_LINUX_ENABLED
+        /*
+         * Boxes that need NOT _OSI(Linux)
+         */
+        {
+         .callback = dmi_osi_not_linux,
+         .ident = "Toshiba Satellite P100",
+         .matches = {
+                     DMI_MATCH(DMI_BOARD_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_BOARD_NAME, "Satellite P100"),
+                     },
+         },
+#else
+        /*
+         * Boxes that need _OSI(Linux)
+         */
+        {
+         .callback = dmi_osi_linux,
+         .ident = "Intel Napa CRB",
+         .matches = {
+                     DMI_MATCH(DMI_BOARD_VENDOR, "Intel Corporation"),
+                     DMI_MATCH(DMI_BOARD_NAME, "MPAD-MSAE Customer Reference Boards"),
+                     },
+         },
+#endif
+        {}
+};
+#endif /* CONFIG_DMI */
 
 #endif
diff --git a/drivers/acpi/tables/tbinstal.c b/drivers/acpi/tables/tbinstal.c
index 0e7b121a99ce..3bc0c67a9283 100644
--- a/drivers/acpi/tables/tbinstal.c
+++ b/drivers/acpi/tables/tbinstal.c
@@ -123,14 +123,14 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc,
                 }
         }
 
-        /* The table must be either an SSDT or a PSDT */
+        /* The table must be either an SSDT or a PSDT or an OEMx */
 
         if ((!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_PSDT))
             &&
-            (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT)))
-        {
+            (!ACPI_COMPARE_NAME(table_desc->pointer->signature, ACPI_SIG_SSDT))
+            && (strncmp(table_desc->pointer->signature, "OEM", 3))) {
                 ACPI_ERROR((AE_INFO,
-                            "Table has invalid signature [%4.4s], must be SSDT or PSDT",
+                            "Table has invalid signature [%4.4s], must be SSDT, PSDT or OEMx",
                             table_desc->pointer->signature));
                 return_ACPI_STATUS(AE_BAD_SIGNATURE);
         }
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index 1ada017d01ef..194ecfe8b360 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -827,6 +827,7 @@ static int acpi_thermal_temp_open_fs(struct inode *inode, struct file *file)
 static int acpi_thermal_trip_seq_show(struct seq_file *seq, void *offset)
 {
         struct acpi_thermal *tz = seq->private;
+        struct acpi_device *device;
         int i = 0;
         int j = 0;
 
@@ -849,9 +850,8 @@ static int acpi_thermal_trip_seq_show(struct seq_file *seq, void *offset)
                            tz->trips.passive.tc1, tz->trips.passive.tc2,
                            tz->trips.passive.tsp);
                 for (j = 0; j < tz->trips.passive.devices.count; j++) {
-
-                        seq_printf(seq, "0x%p ",
-                                   tz->trips.passive.devices.handles[j]);
+                        acpi_bus_get_device(tz->trips.passive.devices.handles[j], &device);
+                        seq_printf(seq, "%4.4s ", acpi_device_bid(device));
                 }
                 seq_puts(seq, "\n");
         }
@@ -862,9 +862,10 @@ static int acpi_thermal_trip_seq_show(struct seq_file *seq, void *offset)
                 seq_printf(seq, "active[%d]:               %ld C: devices=",
                            i,
                            KELVIN_TO_CELSIUS(tz->trips.active[i].temperature));
-                for (j = 0; j < tz->trips.active[i].devices.count; j++)
-                        seq_printf(seq, "0x%p ",
-                                   tz->trips.active[i].devices.handles[j]);
+                for (j = 0; j < tz->trips.active[i].devices.count; j++){
+                        acpi_bus_get_device(tz->trips.active[i].devices.handles[j], &device);
+                        seq_printf(seq, "%4.4s ", acpi_device_bid(device));
+                }
                 seq_puts(seq, "\n");
         }
 
diff --git a/drivers/acpi/toshiba_acpi.c b/drivers/acpi/toshiba_acpi.c
index 3906d47b9783..1cfbecb0ac10 100644
--- a/drivers/acpi/toshiba_acpi.c
+++ b/drivers/acpi/toshiba_acpi.c
@@ -538,7 +538,7 @@ static struct backlight_ops toshiba_backlight_data = {
         .update_status  = set_lcd_status,
 };
 
-static void __exit toshiba_acpi_exit(void)
+static void toshiba_acpi_exit(void)
 {
         if (toshiba_backlight_device)
                 backlight_device_unregister(toshiba_backlight_device);
diff --git a/drivers/acpi/utilities/utcopy.c b/drivers/acpi/utilities/utcopy.c
index 4c1e00874dff..879eaa10d3ae 100644
--- a/drivers/acpi/utilities/utcopy.c
+++ b/drivers/acpi/utilities/utcopy.c
@@ -68,6 +68,10 @@ acpi_ut_copy_esimple_to_isimple(union acpi_object *user_obj,
                                 union acpi_operand_object **return_obj);
 
 static acpi_status
+acpi_ut_copy_epackage_to_ipackage(union acpi_object *external_object,
+                                  union acpi_operand_object **internal_object);
+
+static acpi_status
 acpi_ut_copy_simple_object(union acpi_operand_object *source_desc,
                            union acpi_operand_object *dest_desc);
 
@@ -518,77 +522,73 @@ acpi_ut_copy_esimple_to_isimple(union acpi_object *external_object,
         return_ACPI_STATUS(AE_NO_MEMORY);
 }
 
-#ifdef ACPI_FUTURE_IMPLEMENTATION
-/* Code to convert packages that are parameters to control methods */
-
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ut_copy_epackage_to_ipackage
  *
- * PARAMETERS:  *internal_object   - Pointer to the object we are returning
- *              *Buffer            - Where the object is returned
- *              *space_used        - Where the length of the object is returned
+ * PARAMETERS:  external_object     - The external object to be converted
+ *              internal_object     - Where the internal object is returned
  *
  * RETURN:      Status
  *
- * DESCRIPTION: This function is called to place a package object in a user
- *              buffer.  A package object by definition contains other objects.
- *
- *              The buffer is assumed to have sufficient space for the object.
- *              The caller must have verified the buffer length needed using the
- *              acpi_ut_get_object_size function before calling this function.
+ * DESCRIPTION: Copy an external package object to an internal package.
+ *              Handles nested packages.
  *
  ******************************************************************************/
 
 static acpi_status
-acpi_ut_copy_epackage_to_ipackage(union acpi_operand_object *internal_object,
-                                  u8 * buffer, u32 * space_used)
+acpi_ut_copy_epackage_to_ipackage(union acpi_object *external_object,
+                                  union acpi_operand_object **internal_object)
 {
-        u8 *free_space;
-        union acpi_object *external_object;
-        u32 length = 0;
-        u32 this_index;
-        u32 object_space = 0;
-        union acpi_operand_object *this_internal_obj;
-        union acpi_object *this_external_obj;
+        acpi_status status = AE_OK;
+        union acpi_operand_object *package_object;
+        union acpi_operand_object **package_elements;
+        acpi_native_uint i;
 
         ACPI_FUNCTION_TRACE(ut_copy_epackage_to_ipackage);
 
-        /*
-         * First package at head of the buffer
-         */
-        external_object = (union acpi_object *)buffer;
+        /* Create the package object */
 
-        /*
-         * Free space begins right after the first package
-         */
-        free_space = buffer + sizeof(union acpi_object);
+        package_object =
+            acpi_ut_create_package_object(external_object->package.count);
+        if (!package_object) {
+                return_ACPI_STATUS(AE_NO_MEMORY);
+        }
 
-        external_object->type = ACPI_GET_OBJECT_TYPE(internal_object);
-        external_object->package.count = internal_object->package.count;
-        external_object->package.elements = (union acpi_object *)free_space;
+        package_elements = package_object->package.elements;
 
         /*
-         * Build an array of ACPI_OBJECTS in the buffer
-         * and move the free space past it
+         * Recursive implementation. Probably ok, since nested external packages
+         * as parameters should be very rare.
          */
-        free_space +=
-            external_object->package.count * sizeof(union acpi_object);
+        for (i = 0; i < external_object->package.count; i++) {
+                status =
+                    acpi_ut_copy_eobject_to_iobject(&external_object->package.
+                                                    elements[i],
+                                                    &package_elements[i]);
+                if (ACPI_FAILURE(status)) {
 
-        /* Call walk_package */
+                        /* Truncate package and delete it */
 
-}
+                        package_object->package.count = i;
+                        package_elements[i] = NULL;
+                        acpi_ut_remove_reference(package_object);
+                        return_ACPI_STATUS(status);
+                }
+        }
 
-#endif                          /* Future implementation */
+        *internal_object = package_object;
+        return_ACPI_STATUS(status);
+}
 
 /*******************************************************************************
  *
  * FUNCTION:    acpi_ut_copy_eobject_to_iobject
  *
- * PARAMETERS:  *internal_object   - The external object to be converted
- *              *buffer_ptr     - Where the internal object is returned
+ * PARAMETERS:  external_object     - The external object to be converted
+ *              internal_object     - Where the internal object is returned
  *
- * RETURN:      Status          - the status of the call
+ * RETURN:      Status              - the status of the call
  *
  * DESCRIPTION: Converts an external object to an internal object.
  *
@@ -603,16 +603,10 @@ acpi_ut_copy_eobject_to_iobject(union acpi_object *external_object,
         ACPI_FUNCTION_TRACE(ut_copy_eobject_to_iobject);
 
         if (external_object->type == ACPI_TYPE_PACKAGE) {
-                /*
-                 * Packages as external input to control methods are not supported,
-                 */
-                ACPI_ERROR((AE_INFO,
-                            "Packages as parameters not implemented!"));
-
-                return_ACPI_STATUS(AE_NOT_IMPLEMENTED);
-        }
-
-        else {
+                status =
+                    acpi_ut_copy_epackage_to_ipackage(external_object,
+                                                      internal_object);
+        } else {
                 /*
                  * Build a simple object (no nested objects)
                  */
@@ -803,33 +797,19 @@ acpi_ut_copy_ielement_to_ielement(u8 object_type,
                  * Create and build the package object
                  */
                 target_object =
-                    acpi_ut_create_internal_object(ACPI_TYPE_PACKAGE);
+                    acpi_ut_create_package_object(source_object->package.count);
                 if (!target_object) {
                         return (AE_NO_MEMORY);
                 }
 
-                target_object->package.count = source_object->package.count;
                 target_object->common.flags = source_object->common.flags;
 
-                /*
-                 * Create the object array
-                 */
-                target_object->package.elements =
-                    ACPI_ALLOCATE_ZEROED(((acpi_size) source_object->package.
-                                          count + 1) * sizeof(void *));
-                if (!target_object->package.elements) {
-                        status = AE_NO_MEMORY;
-                        goto error_exit;
-                }
+                /* Pass the new package object back to the package walk routine */
 
-                /*
-                 * Pass the new package object back to the package walk routine
-                 */
                 state->pkg.this_target_obj = target_object;
 
-                /*
-                 * Store the object pointer in the parent package object
-                 */
+                /* Store the object pointer in the parent package object */
+
                 *this_target_ptr = target_object;
                 break;
 
diff --git a/drivers/acpi/utilities/uteval.c b/drivers/acpi/utilities/uteval.c
index 13d5879cd98b..8ec6f8e48138 100644
--- a/drivers/acpi/utilities/uteval.c
+++ b/drivers/acpi/utilities/uteval.c
@@ -59,10 +59,9 @@ acpi_ut_translate_one_cid(union acpi_operand_object *obj_desc,
 /*
  * Strings supported by the _OSI predefined (internal) method.
  */
-static const char *acpi_interfaces_supported[] = {
+static char *acpi_interfaces_supported[] = {
         /* Operating System Vendor Strings */
 
-        "Linux",
         "Windows 2000",
         "Windows 2001",
         "Windows 2001 SP0",
@@ -158,6 +157,31 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_osi_invalidate
+ *
+ * PARAMETERS:  interface_string
+ *
+ * RETURN:      Status
+ *
+ * DESCRIPTION: invalidate string in pre-defiend _OSI string list
+ *
+ ******************************************************************************/
+
+acpi_status acpi_osi_invalidate(char *interface)
+{
+        int i;
+
+        for (i = 0; i < ACPI_ARRAY_LENGTH(acpi_interfaces_supported); i++) {
+                if (!ACPI_STRCMP(interface, acpi_interfaces_supported[i])) {
+                        *acpi_interfaces_supported[i] = '\0';
+                        return AE_OK;
+                }
+        }
+        return AE_NOT_FOUND;
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ut_evaluate_object
  *
  * PARAMETERS:  prefix_node         - Starting node
diff --git a/drivers/acpi/utilities/utobject.c b/drivers/acpi/utilities/utobject.c
index 4696124759e1..db0b9bac7945 100644
--- a/drivers/acpi/utilities/utobject.c
+++ b/drivers/acpi/utilities/utobject.c
@@ -146,6 +146,48 @@ union acpi_operand_object *acpi_ut_create_internal_object_dbg(char *module_name,
 
 /*******************************************************************************
  *
+ * FUNCTION:    acpi_ut_create_package_object
+ *
+ * PARAMETERS:  Count               - Number of package elements
+ *
+ * RETURN:      Pointer to a new Package object, null on failure
+ *
+ * DESCRIPTION: Create a fully initialized package object
+ *
+ ******************************************************************************/
+
+union acpi_operand_object *acpi_ut_create_package_object(u32 count)
+{
+        union acpi_operand_object *package_desc;
+        union acpi_operand_object **package_elements;
+
+        ACPI_FUNCTION_TRACE_U32(ut_create_package_object, count);
+
+        /* Create a new Package object */
+
+        package_desc = acpi_ut_create_internal_object(ACPI_TYPE_PACKAGE);
+        if (!package_desc) {
+                return_PTR(NULL);
+        }
+
+        /*
+         * Create the element array. Count+1 allows the array to be null
+         * terminated.
+         */
+        package_elements = ACPI_ALLOCATE_ZEROED((acpi_size)
+                                                (count + 1) * sizeof(void *));
+        if (!package_elements) {
+                ACPI_FREE(package_desc);
+                return_PTR(NULL);
+        }
+
+        package_desc->package.count = count;
+        package_desc->package.elements = package_elements;
+        return_PTR(package_desc);
+}
+
+/*******************************************************************************
+ *
  * FUNCTION:    acpi_ut_create_buffer_object
  *
  * PARAMETERS:  buffer_size            - Size of buffer to be created
diff --git a/drivers/acpi/utilities/utxface.c b/drivers/acpi/utilities/utxface.c
index e9a57806cd34..2d496918b3cd 100644
--- a/drivers/acpi/utilities/utxface.c
+++ b/drivers/acpi/utilities/utxface.c
@@ -61,7 +61,7 @@ ACPI_MODULE_NAME("utxface")
  *              called, so any early initialization belongs here.
  *
  ******************************************************************************/
-acpi_status acpi_initialize_subsystem(void)
+acpi_status __init acpi_initialize_subsystem(void)
 {
         acpi_status status;
 
@@ -108,8 +108,6 @@ acpi_status acpi_initialize_subsystem(void)
         return_ACPI_STATUS(status);
 }
 
-ACPI_EXPORT_SYMBOL(acpi_initialize_subsystem)
-
 /*******************************************************************************
  *
  * FUNCTION:    acpi_enable_subsystem
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3ca9c610c110..4733f009c7c9 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3783,6 +3783,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "FUJITSU MHT2060BH",  NULL,           ATA_HORKAGE_NONCQ },
         /* NCQ is broken */
         { "Maxtor 6L250S0",     "BANC1G10",     ATA_HORKAGE_NONCQ },
+        { "Maxtor 6B200M0",     "BANC1B10",     ATA_HORKAGE_NONCQ },
         /* NCQ hard hangs device under heavier load, needs hard power cycle */
         { "Maxtor 6B250S0",     "BANC1B70",     ATA_HORKAGE_NONCQ },
         /* Blacklist entries taken from Silicon Image 3124/3132
@@ -3932,10 +3933,13 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
         /* set up set-features taskfile */
         DPRINTK("set features - xfer mode\n");
 
+        /* Some controllers and ATAPI devices show flaky interrupt
+         * behavior after setting xfer mode.  Use polling instead.
+         */
         ata_tf_init(dev, &tf);
         tf.command = ATA_CMD_SET_FEATURES;
         tf.feature = SETFEATURES_XFER;
-        tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+        tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE | ATA_TFLAG_POLLING;
         tf.protocol = ATA_PROT_NODATA;
         tf.nsect = dev->xfer_mode;
 
@@ -5413,14 +5417,6 @@ unsigned int ata_qc_issue_prot(struct ata_queued_cmd *qc)
                 }
         }
 
-        /* Some controllers show flaky interrupt behavior after
-         * setting xfer mode.  Use polling instead.
-         */
-        if (unlikely(qc->tf.command == ATA_CMD_SET_FEATURES &&
-                     qc->tf.feature == SETFEATURES_XFER) &&
-            (ap->flags & ATA_FLAG_SETXFER_POLLING))
-                qc->tf.flags |= ATA_TFLAG_POLLING;
-
         /* select the device */
         ata_dev_select(ap, qc->dev->devno, 1, 0);
 
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index a8462f1e890b..63eca299c62b 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -452,7 +452,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* Early VIA without UDMA support */
         static const struct ata_port_info via_mwdma_info = {
                 .sht = &via_sht,
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SETXFER_POLLING,
+                .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
                 .mwdma_mask = 0x07,
                 .port_ops = &via_port_ops
@@ -460,7 +460,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* Ditto with IRQ masking required */
         static const struct ata_port_info via_mwdma_info_borked = {
                 .sht = &via_sht,
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SETXFER_POLLING,
+                .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
                 .mwdma_mask = 0x07,
                 .port_ops = &via_port_ops_noirq,
@@ -468,7 +468,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* VIA UDMA 33 devices (and borked 66) */
         static const struct ata_port_info via_udma33_info = {
                 .sht = &via_sht,
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SETXFER_POLLING,
+                .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
                 .mwdma_mask = 0x07,
                 .udma_mask = 0x7,
@@ -477,7 +477,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* VIA UDMA 66 devices */
         static const struct ata_port_info via_udma66_info = {
                 .sht = &via_sht,
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SETXFER_POLLING,
+                .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
                 .mwdma_mask = 0x07,
                 .udma_mask = 0x1f,
@@ -486,7 +486,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* VIA UDMA 100 devices */
         static const struct ata_port_info via_udma100_info = {
                 .sht = &via_sht,
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SETXFER_POLLING,
+                .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
                 .mwdma_mask = 0x07,
                 .udma_mask = 0x3f,
@@ -495,7 +495,7 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
         /* UDMA133 with bad AST (All current 133) */
         static const struct ata_port_info via_udma133_info = {
                 .sht = &via_sht,
-                .flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SETXFER_POLLING,
+                .flags = ATA_FLAG_SLAVE_POSS,
                 .pio_mask = 0x1f,
                 .mwdma_mask = 0x07,
                 .udma_mask = 0x7f,      /* FIXME: should check north bridge */
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 9c67df5ccfa4..7f6d02ce1b5f 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1475,6 +1475,7 @@ static void top_off_fp (struct fs_dev *dev, struct freepool *fp,
         struct FS_BPENTRY *qe, *ne;
         struct sk_buff *skb;
         int n = 0;
+        u32 qe_tmp;
 
         fs_dprintk (FS_DEBUG_QUEUE, "Topping off queue at %x (%d-%d/%d)\n", 
                     fp->offset, read_fs (dev, FP_CNT (fp->offset)), fp->n, 
@@ -1502,10 +1503,16 @@ static void top_off_fp (struct fs_dev *dev, struct freepool *fp,
                 ne->skb = skb;
                 ne->fp = fp;
 
-                qe = (struct FS_BPENTRY *) (read_fs (dev, FP_EA(fp->offset)));
-                fs_dprintk (FS_DEBUG_QUEUE, "link at %p\n", qe);
-                if (qe) {
-                        qe = bus_to_virt ((long) qe);
+                /*
+                 * FIXME: following code encodes and decodes
+                 * machine pointers (could be 64-bit) into a
+                 * 32-bit register.
+                 */
+
+                qe_tmp = read_fs (dev, FP_EA(fp->offset));
+                fs_dprintk (FS_DEBUG_QUEUE, "link at %x\n", qe_tmp);
+                if (qe_tmp) {
+                        qe = bus_to_virt ((long) qe_tmp);
                         qe->next = virt_to_bus(ne);
                         qe->flags &= ~FP_FLAGS_EPI;
                 } else
diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig
index 2e18a63ead36..ea4fe3e48f33 100644
--- a/drivers/auxdisplay/Kconfig
+++ b/drivers/auxdisplay/Kconfig
@@ -68,6 +68,10 @@ config CFAG12864B
         depends on X86
         depends on FB
         depends on KS0108
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
         default n
         ---help---
           If you have a Crystalfontz 128x64 2-color LCD, cfag12864b Series,
diff --git a/drivers/auxdisplay/cfag12864bfb.c b/drivers/auxdisplay/cfag12864bfb.c
index 66fafbb1d087..307c190699e0 100644
--- a/drivers/auxdisplay/cfag12864bfb.c
+++ b/drivers/auxdisplay/cfag12864bfb.c
@@ -73,9 +73,11 @@ static int cfag12864bfb_mmap(struct fb_info *info, struct vm_area_struct *vma)
 
 static struct fb_ops cfag12864bfb_ops = {
         .owner = THIS_MODULE,
-        .fb_fillrect = cfb_fillrect,
-        .fb_copyarea = cfb_copyarea,
-        .fb_imageblit = cfb_imageblit,
+        .fb_read = fb_sys_read,
+        .fb_write = fb_sys_write,
+        .fb_fillrect = sys_fillrect,
+        .fb_copyarea = sys_copyarea,
+        .fb_imageblit = sys_imageblit,
         .fb_mmap = cfag12864bfb_mmap,
 };
 
diff --git a/drivers/char/drm/drm_drawable.c b/drivers/char/drm/drm_drawable.c
index de37d5f74563..b33313be2547 100644
--- a/drivers/char/drm/drm_drawable.c
+++ b/drivers/char/drm/drm_drawable.c
@@ -172,38 +172,49 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 
                 bitfield_length = idx + 1;
 
-                if (idx != id / (8 * sizeof(*bitfield)))
-                        bitfield = drm_alloc(bitfield_length *
-                                             sizeof(*bitfield), DRM_MEM_BUFS);
+                bitfield = NULL;
 
-                if (!bitfield && bitfield_length) {
-                        bitfield = dev->drw_bitfield;
-                        bitfield_length = dev->drw_bitfield_length;
+                if (bitfield_length) {
+                        if (bitfield_length != dev->drw_bitfield_length)
+                                bitfield = drm_alloc(bitfield_length *
+                                                     sizeof(*bitfield),
+                                                     DRM_MEM_BUFS);
+
+                        if (!bitfield) {
+                                bitfield = dev->drw_bitfield;
+                                bitfield_length = dev->drw_bitfield_length;
+                        }
                 }
         }
 
         if (bitfield != dev->drw_bitfield) {
                 info_length = 8 * sizeof(*bitfield) * bitfield_length;
 
-                info = drm_alloc(info_length * sizeof(*info), DRM_MEM_BUFS);
+                if (info_length) {
+                        info = drm_alloc(info_length * sizeof(*info),
+                                         DRM_MEM_BUFS);
 
-                if (!info && info_length) {
-                        info = dev->drw_info;
-                        info_length = dev->drw_info_length;
-                }
+                        if (!info) {
+                                info = dev->drw_info;
+                                info_length = dev->drw_info_length;
+                        }
+                } else
+                        info = NULL;
 
                 spin_lock_irqsave(&dev->drw_lock, irqflags);
 
-                memcpy(bitfield, dev->drw_bitfield, bitfield_length *
-                       sizeof(*bitfield));
+                if (bitfield)
+                        memcpy(bitfield, dev->drw_bitfield, bitfield_length *
+                               sizeof(*bitfield));
                 drm_free(dev->drw_bitfield, sizeof(*bitfield) *
                          dev->drw_bitfield_length, DRM_MEM_BUFS);
                 dev->drw_bitfield = bitfield;
                 dev->drw_bitfield_length = bitfield_length;
 
                 if (info != dev->drw_info) {
-                        memcpy(info, dev->drw_info, info_length *
-                               sizeof(*info));
+                        if (info)
+                                memcpy(info, dev->drw_info, info_length *
+                                       sizeof(*info));
                         drm_free(dev->drw_info, sizeof(*info) *
                                  dev->drw_info_length, DRM_MEM_BUFS);
                         dev->drw_info = info;
diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
index 31cdde83713b..177ccc07f968 100644
--- a/drivers/char/drm/drm_pciids.h
+++ b/drivers/char/drm/drm_pciids.h
@@ -102,13 +102,20 @@
         {0x1002, 0x5653, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x5834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|RADEON_IS_IGP}, \
         {0x1002, 0x5835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
+        {0x1002, 0x5954, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
         {0x1002, 0x5955, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
+        {0x1002, 0x5974, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
+        {0x1002, 0x5975, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
         {0x1002, 0x5960, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5961, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5962, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5964, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5965, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5969, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
+        {0x1002, 0x5a41, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
+        {0x1002, 0x5a42, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
+        {0x1002, 0x5a61, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
+        {0x1002, 0x5a62, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS400|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
         {0x1002, 0x5b60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x5b62, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x5b63, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_NEW_MEMMAP}, \
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index 78c1ae28f17c..b92062a239f1 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -582,7 +582,7 @@ void i915_driver_irq_postinstall(drm_device_t * dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 
-        dev_priv->swaps_lock = SPIN_LOCK_UNLOCKED;
+        spin_lock_init(&dev_priv->swaps_lock);
         INIT_LIST_HEAD(&dev_priv->vbl_swaps.head);
         dev_priv->swaps_pending = 0;
 
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index b3d4ccc33a47..154f42203b05 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -1191,6 +1191,7 @@ static int job_control(struct tty_struct *tty, struct file *file)
                             is_current_pgrp_orphaned())
                                 return -EIO;
                         kill_pgrp(task_pgrp(current), SIGTTIN, 1);
+                        set_thread_flag(TIF_SIGPENDING);
                         return -ERESTARTSYS;
                 }
         }
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 75d2a46e106f..3752edc30c36 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1148,7 +1148,8 @@ int tty_check_change(struct tty_struct * tty)
                 return 0;
         if (is_current_pgrp_orphaned())
                 return -EIO;
-        (void) kill_pgrp(task_pgrp(current), SIGTTOU, 1);
+        kill_pgrp(task_pgrp(current), SIGTTOU, 1);
+        set_thread_flag(TIF_SIGPENDING);
         return -ERESTARTSYS;
 }
 
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index 1cad32c62ed3..53f5538c0c05 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -115,6 +115,13 @@ config IXP4XX_WATCHDOG
 
           Say N if you are unsure.
 
+config KS8695_WATCHDOG
+        tristate "KS8695 watchdog"
+        depends on ARCH_KS8695
+        help
+          Watchdog timer embedded into KS8695 processor. This will reboot your
+          system when the timeout is reached.
+
 config S3C2410_WATCHDOG
         tristate "S3C2410 Watchdog"
         depends on ARCH_S3C2410
diff --git a/drivers/char/watchdog/Makefile b/drivers/char/watchdog/Makefile
index 8bfc00cc7c2b..d90f649038c2 100644
--- a/drivers/char/watchdog/Makefile
+++ b/drivers/char/watchdog/Makefile
@@ -29,6 +29,7 @@ obj-$(CONFIG_21285_WATCHDOG) += wdt285.o
 obj-$(CONFIG_977_WATCHDOG) += wdt977.o
 obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
 obj-$(CONFIG_IXP4XX_WATCHDOG) += ixp4xx_wdt.o
+obj-$(CONFIG_KS8695_WATCHDOG) += ks8695_wdt.o
 obj-$(CONFIG_S3C2410_WATCHDOG) += s3c2410_wdt.o
 obj-$(CONFIG_SA1100_WATCHDOG) += sa1100_wdt.o
 obj-$(CONFIG_MPCORE_WATCHDOG) += mpcore_wdt.o
diff --git a/drivers/char/watchdog/ixp2000_wdt.c b/drivers/char/watchdog/ixp2000_wdt.c
index fd955dbd588c..dc7548dcaf35 100644
--- a/drivers/char/watchdog/ixp2000_wdt.c
+++ b/drivers/char/watchdog/ixp2000_wdt.c
@@ -205,7 +205,7 @@ static void __exit ixp2000_wdt_exit(void)
 module_init(ixp2000_wdt_init);
 module_exit(ixp2000_wdt_exit);
 
-MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net">);
+MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net>");
 MODULE_DESCRIPTION("IXP2000 Network Processor Watchdog");
 
 module_param(heartbeat, int, 0);
diff --git a/drivers/char/watchdog/ks8695_wdt.c b/drivers/char/watchdog/ks8695_wdt.c
new file mode 100644
index 000000000000..7150fb945eaf
--- /dev/null
+++ b/drivers/char/watchdog/ks8695_wdt.c
@@ -0,0 +1,308 @@
+/*
+ * Watchdog driver for Kendin/Micrel KS8695.
+ *
+ * (C) 2007 Andrew Victor
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/platform_device.h>
+#include <linux/types.h>
+#include <linux/watchdog.h>
+#include <asm/bitops.h>
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/arch/regs-timer.h>
+
+
+#define WDT_DEFAULT_TIME        5       /* seconds */
+#define WDT_MAX_TIME            171     /* seconds */
+
+static int wdt_time = WDT_DEFAULT_TIME;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(wdt_time, int, 0);
+MODULE_PARM_DESC(wdt_time, "Watchdog time in seconds. (default="__MODULE_STRING(WDT_DEFAULT_TIME) ")");
+
+#ifdef CONFIG_WATCHDOG_NOWAYOUT
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+#endif
+
+
+static unsigned long ks8695wdt_busy;
+
+/* ......................................................................... */
+
+/*
+ * Disable the watchdog.
+ */
+static void inline ks8695_wdt_stop(void)
+{
+        unsigned long tmcon;
+
+        /* disable timer0 */
+        tmcon = __raw_readl(KS8695_TMR_VA + KS8695_TMCON);
+        __raw_writel(tmcon & ~TMCON_T0EN, KS8695_TMR_VA + KS8695_TMCON);
+}
+
+/*
+ * Enable and reset the watchdog.
+ */
+static void inline ks8695_wdt_start(void)
+{
+        unsigned long tmcon;
+        unsigned long tval = wdt_time * CLOCK_TICK_RATE;
+
+        /* disable timer0 */
+        tmcon = __raw_readl(KS8695_TMR_VA + KS8695_TMCON);
+        __raw_writel(tmcon & ~TMCON_T0EN, KS8695_TMR_VA + KS8695_TMCON);
+
+        /* program timer0 */
+        __raw_writel(tval | T0TC_WATCHDOG, KS8695_TMR_VA + KS8695_T0TC);
+
+        /* re-enable timer0 */
+        tmcon = __raw_readl(KS8695_TMR_VA + KS8695_TMCON);
+        __raw_writel(tmcon | TMCON_T0EN, KS8695_TMR_VA + KS8695_TMCON);
+}
+
+/*
+ * Reload the watchdog timer.  (ie, pat the watchdog)
+ */
+static void inline ks8695_wdt_reload(void)
+{
+        unsigned long tmcon;
+
+        /* disable, then re-enable timer0 */
+        tmcon = __raw_readl(KS8695_TMR_VA + KS8695_TMCON);
+        __raw_writel(tmcon & ~TMCON_T0EN, KS8695_TMR_VA + KS8695_TMCON);
+        __raw_writel(tmcon | TMCON_T0EN, KS8695_TMR_VA + KS8695_TMCON);
+}
+
+/*
+ * Change the watchdog time interval.
+ */
+static int ks8695_wdt_settimeout(int new_time)
+{
+        /*
+         * All counting occurs at SLOW_CLOCK / 128 = 0.256 Hz
+         *
+         * Since WDV is a 16-bit counter, the maximum period is
+         * 65536 / 0.256 = 256 seconds.
+         */
+        if ((new_time <= 0) || (new_time > WDT_MAX_TIME))
+                return -EINVAL;
+
+        /* Set new watchdog time. It will be used when ks8695_wdt_start() is called. */
+        wdt_time = new_time;
+        return 0;
+}
+
+/* ......................................................................... */
+
+/*
+ * Watchdog device is opened, and watchdog starts running.
+ */
+static int ks8695_wdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(0, &ks8695wdt_busy))
+                return -EBUSY;
+
+        ks8695_wdt_start();
+        return nonseekable_open(inode, file);
+}
+
+/*
+ * Close the watchdog device.
+ * If CONFIG_WATCHDOG_NOWAYOUT is NOT defined then the watchdog is also
+ *  disabled.
+ */
+static int ks8695_wdt_close(struct inode *inode, struct file *file)
+{
+        if (!nowayout)
+                ks8695_wdt_stop();      /* Disable the watchdog when file is closed */
+
+        clear_bit(0, &ks8695wdt_busy);
+        return 0;
+}
+
+static struct watchdog_info ks8695_wdt_info = {
+        .identity       = "ks8695 watchdog",
+        .options        = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+};
+
+/*
+ * Handle commands from user-space.
+ */
+static int ks8695_wdt_ioctl(struct inode *inode, struct file *file,
+                unsigned int cmd, unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int new_value;
+
+        switch(cmd) {
+                case WDIOC_KEEPALIVE:
+                        ks8695_wdt_reload();    /* pat the watchdog */
+                        return 0;
+
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(argp, &ks8695_wdt_info, sizeof(ks8695_wdt_info)) ? -EFAULT : 0;
+
+                case WDIOC_SETTIMEOUT:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+
+                        if (ks8695_wdt_settimeout(new_value))
+                                return -EINVAL;
+
+                        /* Enable new time value */
+                        ks8695_wdt_start();
+
+                        /* Return current value */
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETTIMEOUT:
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETSTATUS:
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user(0, p);
+
+                case WDIOC_SETOPTIONS:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+
+                        if (new_value & WDIOS_DISABLECARD)
+                                ks8695_wdt_stop();
+                        if (new_value & WDIOS_ENABLECARD)
+                                ks8695_wdt_start();
+                        return 0;
+
+                default:
+                        return -ENOTTY;
+        }
+}
+
+/*
+ * Pat the watchdog whenever device is written to.
+ */
+static ssize_t ks8695_wdt_write(struct file *file, const char *data, size_t len, loff_t *ppos)
+{
+        ks8695_wdt_reload();            /* pat the watchdog */
+        return len;
+}
+
+/* ......................................................................... */
+
+static const struct file_operations ks8695wdt_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .ioctl          = ks8695_wdt_ioctl,
+        .open           = ks8695_wdt_open,
+        .release        = ks8695_wdt_close,
+        .write          = ks8695_wdt_write,
+};
+
+static struct miscdevice ks8695wdt_miscdev = {
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &ks8695wdt_fops,
+};
+
+static int __init ks8695wdt_probe(struct platform_device *pdev)
+{
+        int res;
+
+        if (ks8695wdt_miscdev.parent)
+                return -EBUSY;
+        ks8695wdt_miscdev.parent = &pdev->dev;
+
+        res = misc_register(&ks8695wdt_miscdev);
+        if (res)
+                return res;
+
+        printk("KS8695 Watchdog Timer enabled (%d seconds%s)\n", wdt_time, nowayout ? ", nowayout" : "");
+        return 0;
+}
+
+static int __exit ks8695wdt_remove(struct platform_device *pdev)
+{
+        int res;
+
+        res = misc_deregister(&ks8695wdt_miscdev);
+        if (!res)
+                ks8695wdt_miscdev.parent = NULL;
+
+        return res;
+}
+
+static void ks8695wdt_shutdown(struct platform_device *pdev)
+{
+        ks8695_wdt_stop();
+}
+
+#ifdef CONFIG_PM
+
+static int ks8695wdt_suspend(struct platform_device *pdev, pm_message_t message)
+{
+        ks8695_wdt_stop();
+        return 0;
+}
+
+static int ks8695wdt_resume(struct platform_device *pdev)
+{
+        if (ks8695wdt_busy)
+                ks8695_wdt_start();
+        return 0;
+}
+
+#else
+#define ks8695wdt_suspend NULL
+#define ks8695wdt_resume        NULL
+#endif
+
+static struct platform_driver ks8695wdt_driver = {
+        .probe          = ks8695wdt_probe,
+        .remove         = __exit_p(ks8695wdt_remove),
+        .shutdown       = ks8695wdt_shutdown,
+        .suspend        = ks8695wdt_suspend,
+        .resume         = ks8695wdt_resume,
+        .driver         = {
+                .name   = "ks8695_wdt",
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init ks8695_wdt_init(void)
+{
+        /* Check that the heartbeat value is within range; if not reset to the default */
+        if (ks8695_wdt_settimeout(wdt_time)) {
+                ks8695_wdt_settimeout(WDT_DEFAULT_TIME);
+                pr_info("ks8695_wdt: wdt_time value must be 1 <= wdt_time <= %i, using %d\n", wdt_time, WDT_MAX_TIME);
+        }
+
+        return platform_driver_register(&ks8695wdt_driver);
+}
+
+static void __exit ks8695_wdt_exit(void)
+{
+        platform_driver_unregister(&ks8695wdt_driver);
+}
+
+module_init(ks8695_wdt_init);
+module_exit(ks8695_wdt_exit);
+
+MODULE_AUTHOR("Andrew Victor");
+MODULE_DESCRIPTION("Watchdog driver for KS8695");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 636151a64add..9eb1edacd825 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -407,11 +407,6 @@ fw_card_add(struct fw_card *card,
         card->link_speed = link_speed;
         card->guid = guid;
 
-        /* Activate link_on bit and contender bit in our self ID packets.*/
-        if (card->driver->update_phy_reg(card, 4, 0,
-                                         PHY_LINK_ACTIVE | PHY_CONTENDER) < 0)
-                return -EIO;
-
         /*
          * The subsystem grabs a reference when the card is added and
          * drops it when the driver calls fw_core_remove_card.
diff --git a/drivers/firewire/fw-cdev.c b/drivers/firewire/fw-cdev.c
index 3ab3585d3601..5d402d63799f 100644
--- a/drivers/firewire/fw-cdev.c
+++ b/drivers/firewire/fw-cdev.c
@@ -677,12 +677,21 @@ static int ioctl_create_iso_context(struct client *client, void *buffer)
         return 0;
 }
 
+/* Macros for decoding the iso packet control header. */
+#define GET_PAYLOAD_LENGTH(v)   ((v) & 0xffff)
+#define GET_INTERRUPT(v)        (((v) >> 16) & 0x01)
+#define GET_SKIP(v)             (((v) >> 17) & 0x01)
+#define GET_TAG(v)              (((v) >> 18) & 0x02)
+#define GET_SY(v)               (((v) >> 20) & 0x04)
+#define GET_HEADER_LENGTH(v)    (((v) >> 24) & 0xff)
+
 static int ioctl_queue_iso(struct client *client, void *buffer)
 {
         struct fw_cdev_queue_iso *request = buffer;
         struct fw_cdev_iso_packet __user *p, *end, *next;
         struct fw_iso_context *ctx = client->iso_context;
         unsigned long payload, buffer_end, header_length;
+        u32 control;
         int count;
         struct {
                 struct fw_iso_packet packet;
@@ -717,8 +726,14 @@ static int ioctl_queue_iso(struct client *client, void *buffer)
         end = (void __user *)p + request->size;
         count = 0;
         while (p < end) {
-                if (__copy_from_user(&u.packet, p, sizeof(*p)))
+                if (get_user(control, &p->control))
                         return -EFAULT;
+                u.packet.payload_length = GET_PAYLOAD_LENGTH(control);
+                u.packet.interrupt = GET_INTERRUPT(control);
+                u.packet.skip = GET_SKIP(control);
+                u.packet.tag = GET_TAG(control);
+                u.packet.sy = GET_SY(control);
+                u.packet.header_length = GET_HEADER_LENGTH(control);
 
                 if (ctx->type == FW_ISO_CONTEXT_TRANSMIT) {
                         header_length = u.packet.header_length;
diff --git a/drivers/firewire/fw-device.h b/drivers/firewire/fw-device.h
index 0ba9d64ccf4c..af1723eae4ba 100644
--- a/drivers/firewire/fw-device.h
+++ b/drivers/firewire/fw-device.h
@@ -99,6 +99,7 @@ fw_unit(struct device *dev)
 #define CSR_DEPENDENT_INFO      0x14
 #define CSR_MODEL               0x17
 #define CSR_INSTANCE            0x18
+#define CSR_DIRECTORY_ID        0x20
 
 #define SBP2_COMMAND_SET_SPECIFIER      0x38
 #define SBP2_COMMAND_SET                0x39
diff --git a/drivers/firewire/fw-ohci.c b/drivers/firewire/fw-ohci.c
index 2e4cfa57126d..0d08bf9b78c2 100644
--- a/drivers/firewire/fw-ohci.c
+++ b/drivers/firewire/fw-ohci.c
@@ -417,12 +417,21 @@ ar_context_init(struct ar_context *ctx, struct fw_ohci *ohci, u32 regs)
         ctx->current_buffer = ab.next;
         ctx->pointer = ctx->current_buffer->data;
 
-        reg_write(ctx->ohci, COMMAND_PTR(ctx->regs),
-                  le32_to_cpu(ab.descriptor.branch_address));
+        return 0;
+}
+
+static void ar_context_run(struct ar_context *ctx)
+{
+        struct ar_buffer *ab = ctx->current_buffer;
+        dma_addr_t ab_bus;
+        size_t offset;
+
+        offset = offsetof(struct ar_buffer, data);
+        ab_bus = ab->descriptor.data_address - offset;
+
+        reg_write(ctx->ohci, COMMAND_PTR(ctx->regs), ab_bus | 1);
         reg_write(ctx->ohci, CONTROL_SET(ctx->regs), CONTEXT_RUN);
         flush_writes(ctx->ohci);
-
-        return 0;
 }
 
 static void context_tasklet(unsigned long data)
@@ -1039,11 +1048,78 @@ static irqreturn_t irq_handler(int irq, void *data)
         return IRQ_HANDLED;
 }
 
+static int software_reset(struct fw_ohci *ohci)
+{
+        int i;
+
+        reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_softReset);
+
+        for (i = 0; i < OHCI_LOOP_COUNT; i++) {
+                if ((reg_read(ohci, OHCI1394_HCControlSet) &
+                     OHCI1394_HCControl_softReset) == 0)
+                        return 0;
+                msleep(1);
+        }
+
+        return -EBUSY;
+}
+
 static int ohci_enable(struct fw_card *card, u32 *config_rom, size_t length)
 {
         struct fw_ohci *ohci = fw_ohci(card);
         struct pci_dev *dev = to_pci_dev(card->device);
 
+        if (software_reset(ohci)) {
+                fw_error("Failed to reset ohci card.\n");
+                return -EBUSY;
+        }
+
+        /*
+         * Now enable LPS, which we need in order to start accessing
+         * most of the registers.  In fact, on some cards (ALI M5251),
+         * accessing registers in the SClk domain without LPS enabled
+         * will lock up the machine.  Wait 50msec to make sure we have
+         * full link enabled.
+         */
+        reg_write(ohci, OHCI1394_HCControlSet,
+                  OHCI1394_HCControl_LPS |
+                  OHCI1394_HCControl_postedWriteEnable);
+        flush_writes(ohci);
+        msleep(50);
+
+        reg_write(ohci, OHCI1394_HCControlClear,
+                  OHCI1394_HCControl_noByteSwapData);
+
+        reg_write(ohci, OHCI1394_LinkControlSet,
+                  OHCI1394_LinkControl_rcvSelfID |
+                  OHCI1394_LinkControl_cycleTimerEnable |
+                  OHCI1394_LinkControl_cycleMaster);
+
+        reg_write(ohci, OHCI1394_ATRetries,
+                  OHCI1394_MAX_AT_REQ_RETRIES |
+                  (OHCI1394_MAX_AT_RESP_RETRIES << 4) |
+                  (OHCI1394_MAX_PHYS_RESP_RETRIES << 8));
+
+        ar_context_run(&ohci->ar_request_ctx);
+        ar_context_run(&ohci->ar_response_ctx);
+
+        reg_write(ohci, OHCI1394_SelfIDBuffer, ohci->self_id_bus);
+        reg_write(ohci, OHCI1394_PhyUpperBound, 0x00010000);
+        reg_write(ohci, OHCI1394_IntEventClear, ~0);
+        reg_write(ohci, OHCI1394_IntMaskClear, ~0);
+        reg_write(ohci, OHCI1394_IntMaskSet,
+                  OHCI1394_selfIDComplete |
+                  OHCI1394_RQPkt | OHCI1394_RSPkt |
+                  OHCI1394_reqTxComplete | OHCI1394_respTxComplete |
+                  OHCI1394_isochRx | OHCI1394_isochTx |
+                  OHCI1394_masterIntEnable |
+                  OHCI1394_cycle64Seconds);
+
+        /* Activate link_on bit and contender bit in our self ID packets.*/
+        if (ohci_update_phy_reg(card, 4, 0,
+                                PHY_LINK_ACTIVE | PHY_CONTENDER) < 0)
+                return -EIO;
+
         /*
          * When the link is not yet enabled, the atomic config rom
          * update mechanism described below in ohci_set_config_rom()
@@ -1701,22 +1777,6 @@ static const struct fw_card_driver ohci_driver = {
         .stop_iso               = ohci_stop_iso,
 };
 
-static int software_reset(struct fw_ohci *ohci)
-{
-        int i;
-
-        reg_write(ohci, OHCI1394_HCControlSet, OHCI1394_HCControl_softReset);
-
-        for (i = 0; i < OHCI_LOOP_COUNT; i++) {
-                if ((reg_read(ohci, OHCI1394_HCControlSet) &
-                     OHCI1394_HCControl_softReset) == 0)
-                        return 0;
-                msleep(1);
-        }
-
-        return -EBUSY;
-}
-
 static int __devinit
 pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
 {
@@ -1762,33 +1822,6 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
                 goto fail_iomem;
         }
 
-        if (software_reset(ohci)) {
-                fw_error("Failed to reset ohci card.\n");
-                err = -EBUSY;
-                goto fail_registers;
-        }
-
-        /*
-         * Now enable LPS, which we need in order to start accessing
-         * most of the registers.  In fact, on some cards (ALI M5251),
-         * accessing registers in the SClk domain without LPS enabled
-         * will lock up the machine.  Wait 50msec to make sure we have
-         * full link enabled.
-         */
-        reg_write(ohci, OHCI1394_HCControlSet,
-                  OHCI1394_HCControl_LPS |
-                  OHCI1394_HCControl_postedWriteEnable);
-        flush_writes(ohci);
-        msleep(50);
-
-        reg_write(ohci, OHCI1394_HCControlClear,
-                  OHCI1394_HCControl_noByteSwapData);
-
-        reg_write(ohci, OHCI1394_LinkControlSet,
-                  OHCI1394_LinkControl_rcvSelfID |
-                  OHCI1394_LinkControl_cycleTimerEnable |
-                  OHCI1394_LinkControl_cycleMaster);
-
         ar_context_init(&ohci->ar_request_ctx, ohci,
                         OHCI1394_AsReqRcvContextControlSet);
 
@@ -1801,11 +1834,6 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
         context_init(&ohci->at_response_ctx, ohci, AT_BUFFER_SIZE,
                      OHCI1394_AsRspTrContextControlSet, handle_at_packet);
 
-        reg_write(ohci, OHCI1394_ATRetries,
-                  OHCI1394_MAX_AT_REQ_RETRIES |
-                  (OHCI1394_MAX_AT_RESP_RETRIES << 4) |
-                  (OHCI1394_MAX_PHYS_RESP_RETRIES << 8));
-
         reg_write(ohci, OHCI1394_IsoRecvIntMaskSet, ~0);
         ohci->it_context_mask = reg_read(ohci, OHCI1394_IsoRecvIntMaskSet);
         reg_write(ohci, OHCI1394_IsoRecvIntMaskClear, ~0);
@@ -1835,18 +1863,6 @@ pci_probe(struct pci_dev *dev, const struct pci_device_id *ent)
                 goto fail_registers;
         }
 
-        reg_write(ohci, OHCI1394_SelfIDBuffer, ohci->self_id_bus);
-        reg_write(ohci, OHCI1394_PhyUpperBound, 0x00010000);
-        reg_write(ohci, OHCI1394_IntEventClear, ~0);
-        reg_write(ohci, OHCI1394_IntMaskClear, ~0);
-        reg_write(ohci, OHCI1394_IntMaskSet,
-                  OHCI1394_selfIDComplete |
-                  OHCI1394_RQPkt | OHCI1394_RSPkt |
-                  OHCI1394_reqTxComplete | OHCI1394_respTxComplete |
-                  OHCI1394_isochRx | OHCI1394_isochTx |
-                  OHCI1394_masterIntEnable |
-                  OHCI1394_cycle64Seconds);
-
         bus_options = reg_read(ohci, OHCI1394_BusOptions);
         max_receive = (bus_options >> 12) & 0xf;
         link_speed = bus_options & 0x7;
@@ -1908,6 +1924,45 @@ static void pci_remove(struct pci_dev *dev)
         fw_notify("Removed fw-ohci device.\n");
 }
 
+#ifdef CONFIG_PM
+static int pci_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct fw_ohci *ohci = pci_get_drvdata(pdev);
+        int err;
+
+        software_reset(ohci);
+        free_irq(pdev->irq, ohci);
+        err = pci_save_state(pdev);
+        if (err) {
+                fw_error("pci_save_state failed with %d", err);
+                return err;
+        }
+        err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        if (err) {
+                fw_error("pci_set_power_state failed with %d", err);
+                return err;
+        }
+
+        return 0;
+}
+
+static int pci_resume(struct pci_dev *pdev)
+{
+        struct fw_ohci *ohci = pci_get_drvdata(pdev);
+        int err;
+
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        err = pci_enable_device(pdev);
+        if (err) {
+                fw_error("pci_enable_device failed with %d", err);
+                return err;
+        }
+
+        return ohci_enable(&ohci->card, ohci->config_rom, CONFIG_ROM_SIZE);
+}
+#endif
+
 static struct pci_device_id pci_table[] = {
         { PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_FIREWIRE_OHCI, ~0) },
         { }
@@ -1920,6 +1975,10 @@ static struct pci_driver fw_ohci_pci_driver = {
         .id_table       = pci_table,
         .probe          = pci_probe,
         .remove         = pci_remove,
+#ifdef CONFIG_PM
+        .resume         = pci_resume,
+        .suspend        = pci_suspend,
+#endif
 };
 
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index 68300414e5f4..a98d3915e26f 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -1108,6 +1108,58 @@ static int sbp2_scsi_abort(struct scsi_cmnd *cmd)
         return SUCCESS;
 }
 
+/*
+ * Format of /sys/bus/scsi/devices/.../ieee1394_id:
+ * u64 EUI-64 : u24 directory_ID : u16 LUN  (all printed in hexadecimal)
+ *
+ * This is the concatenation of target port identifier and logical unit
+ * identifier as per SAM-2...SAM-4 annex A.
+ */
+static ssize_t
+sbp2_sysfs_ieee1394_id_show(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        struct scsi_device *sdev = to_scsi_device(dev);
+        struct sbp2_device *sd;
+        struct fw_unit *unit;
+        struct fw_device *device;
+        u32 directory_id;
+        struct fw_csr_iterator ci;
+        int key, value, lun;
+
+        if (!sdev)
+                return 0;
+        sd = (struct sbp2_device *)sdev->host->hostdata;
+        unit = sd->unit;
+        device = fw_device(unit->device.parent);
+
+        /* implicit directory ID */
+        directory_id = ((unit->directory - device->config_rom) * 4
+                        + CSR_CONFIG_ROM) & 0xffffff;
+
+        /* explicit directory ID, overrides implicit ID if present */
+        fw_csr_iterator_init(&ci, unit->directory);
+        while (fw_csr_iterator_next(&ci, &key, &value))
+                if (key == CSR_DIRECTORY_ID) {
+                        directory_id = value;
+                        break;
+                }
+
+        /* FIXME: Make this work for multi-lun devices. */
+        lun = 0;
+
+        return sprintf(buf, "%08x%08x:%06x:%04x\n",
+                        device->config_rom[3], device->config_rom[4],
+                        directory_id, lun);
+}
+
+static DEVICE_ATTR(ieee1394_id, S_IRUGO, sbp2_sysfs_ieee1394_id_show, NULL);
+
+static struct device_attribute *sbp2_scsi_sysfs_attrs[] = {
+        &dev_attr_ieee1394_id,
+        NULL
+};
+
 static struct scsi_host_template scsi_driver_template = {
         .module                 = THIS_MODULE,
         .name                   = "SBP-2 IEEE-1394",
@@ -1121,6 +1173,7 @@ static struct scsi_host_template scsi_driver_template = {
         .use_clustering         = ENABLE_CLUSTERING,
         .cmd_per_lun            = 1,
         .can_queue              = 1,
+        .sdev_attrs             = sbp2_scsi_sysfs_attrs,
 };
 
 MODULE_AUTHOR("Kristian Hoegsberg <krh@bitplanet.net>");
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 835937e38529..81b3864d2ba7 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -976,7 +976,8 @@ static struct unit_directory *nodemgr_process_unit_directory
 
         ud->ne = ne;
         ud->ignore_driver = ignore_drivers;
-        ud->address = ud_kv->offset + CSR1212_CONFIG_ROM_SPACE_BASE;
+        ud->address = ud_kv->offset + CSR1212_REGISTER_SPACE_BASE;
+        ud->directory_id = ud->address & 0xffffff;
         ud->ud_kv = ud_kv;
         ud->id = (*id)++;
 
@@ -1085,6 +1086,10 @@ static struct unit_directory *nodemgr_process_unit_directory
 
                         break;
 
+                case CSR1212_KV_ID_DIRECTORY_ID:
+                        ud->directory_id = kv->value.immediate;
+                        break;
+
                 default:
                         break;
                 }
diff --git a/drivers/ieee1394/nodemgr.h b/drivers/ieee1394/nodemgr.h
index e7ac683c72c7..4530b29d941c 100644
--- a/drivers/ieee1394/nodemgr.h
+++ b/drivers/ieee1394/nodemgr.h
@@ -75,6 +75,7 @@ struct unit_directory {
         struct csr1212_keyval *model_name_kv;
         quadlet_t specifier_id;
         quadlet_t version;
+        quadlet_t directory_id;
 
         unsigned int id;
 
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 875eadd5e8f5..3f873cc7e247 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -194,6 +194,27 @@ MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
         ", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
         ", or a combination)");
 
+/*
+ * This influences the format of the sysfs attribute
+ * /sys/bus/scsi/devices/.../ieee1394_id.
+ *
+ * The default format is like in older kernels:  %016Lx:%d:%d
+ * It contains the target's EUI-64, a number given to the logical unit by
+ * the ieee1394 driver's nodemgr (starting at 0), and the LUN.
+ *
+ * The long format is:  %016Lx:%06x:%04x
+ * It contains the target's EUI-64, the unit directory's directory_ID as per
+ * IEEE 1212 clause 7.7.19, and the LUN.  This format comes closest to the
+ * format of SBP(-3) target port and logical unit identifier as per SAM (SCSI
+ * Architecture Model) rev.2 to 4 annex A.  Therefore and because it is
+ * independent of the implementation of the ieee1394 nodemgr, the longer format
+ * is recommended for future use.
+ */
+static int sbp2_long_sysfs_ieee1394_id;
+module_param_named(long_ieee1394_id, sbp2_long_sysfs_ieee1394_id, bool, 0644);
+MODULE_PARM_DESC(long_ieee1394_id, "8+3+2 bytes format of ieee1394_id in sysfs "
+                 "(default = backwards-compatible = N, SAM-conforming = Y)");
+
 
 #define SBP2_INFO(fmt, args...) HPSB_INFO("sbp2: "fmt, ## args)
 #define SBP2_ERR(fmt, args...)  HPSB_ERR("sbp2: "fmt, ## args)
@@ -2100,8 +2121,14 @@ static ssize_t sbp2_sysfs_ieee1394_id_show(struct device *dev,
         if (!(lu = (struct sbp2_lu *)sdev->host->hostdata[0]))
                 return 0;
 
-        return sprintf(buf, "%016Lx:%d:%d\n", (unsigned long long)lu->ne->guid,
-                       lu->ud->id, ORB_SET_LUN(lu->lun));
+        if (sbp2_long_sysfs_ieee1394_id)
+                return sprintf(buf, "%016Lx:%06x:%04x\n",
+                                (unsigned long long)lu->ne->guid,
+                                lu->ud->directory_id, ORB_SET_LUN(lu->lun));
+        else
+                return sprintf(buf, "%016Lx:%d:%d\n",
+                                (unsigned long long)lu->ne->guid,
+                                lu->ud->id, ORB_SET_LUN(lu->lun));
 }
 
 MODULE_AUTHOR("Ben Collins <bcollins@debian.org>");
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 58bc272bd407..0aecea67f3e6 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -672,7 +672,7 @@ static int c2_up(struct net_device *netdev)
          * rdma interface.
          */
         in_dev = in_dev_get(netdev);
-        in_dev->cnf.arp_ignore = 1;
+        IN_DEV_CONF_SET(in_dev, ARP_IGNORE, 1);
         in_dev_put(in_dev);
 
         return 0;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index b234729706be..be6b93c20f60 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -699,9 +699,9 @@ static void evdev_disconnect(struct input_handle *handle)
         if (evdev->open) {
                 input_flush_device(handle, NULL);
                 input_close_device(handle);
-                wake_up_interruptible(&evdev->wait);
                 list_for_each_entry(client, &evdev->client_list, node)
                         kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+                wake_up_interruptible(&evdev->wait);
         } else
                 evdev_free(evdev);
 }
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 06f0541b24da..10e3b7bc925f 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -594,9 +594,9 @@ static void joydev_disconnect(struct input_handle *handle)
 
         if (joydev->open) {
                 input_close_device(handle);
-                wake_up_interruptible(&joydev->wait);
                 list_for_each_entry(client, &joydev->client_list, node)
                         kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+                wake_up_interruptible(&joydev->wait);
         } else
                 joydev_free(joydev);
 }
diff --git a/drivers/input/joystick/db9.c b/drivers/input/joystick/db9.c
index 86ad1027e12a..b069ee18e353 100644
--- a/drivers/input/joystick/db9.c
+++ b/drivers/input/joystick/db9.c
@@ -54,7 +54,7 @@ static struct db9_config db9_cfg[DB9_MAX_PORTS] __initdata;
 
 module_param_array_named(dev, db9_cfg[0].args, int, &db9_cfg[0].nargs, 0);
 MODULE_PARM_DESC(dev, "Describes first attached device (<parport#>,<type>)");
-module_param_array_named(dev2, db9_cfg[1].args, int, &db9_cfg[0].nargs, 0);
+module_param_array_named(dev2, db9_cfg[1].args, int, &db9_cfg[1].nargs, 0);
 MODULE_PARM_DESC(dev2, "Describes second attached device (<parport#>,<type>)");
 module_param_array_named(dev3, db9_cfg[2].args, int, &db9_cfg[2].nargs, 0);
 MODULE_PARM_DESC(dev3, "Describes third attached device (<parport#>,<type>)");
diff --git a/drivers/input/keyboard/pxa27x_keyboard.c b/drivers/input/keyboard/pxa27x_keyboard.c
index 06eaf766d9d2..f9e82c9ca421 100644
--- a/drivers/input/keyboard/pxa27x_keyboard.c
+++ b/drivers/input/keyboard/pxa27x_keyboard.c
@@ -104,7 +104,7 @@ static int pxakbd_open(struct input_dev *dev)
         KPREC = 0x7F;
 
         /* Enable unit clock */
-        pxa_set_cken(CKEN19_KEYPAD, 1);
+        pxa_set_cken(CKEN_KEYPAD, 1);
 
         return 0;
 }
@@ -112,7 +112,7 @@ static int pxakbd_open(struct input_dev *dev)
 static void pxakbd_close(struct input_dev *dev)
 {
         /* Disable clock unit */
-        pxa_set_cken(CKEN19_KEYPAD, 0);
+        pxa_set_cken(CKEN_KEYPAD, 0);
 }
 
 #ifdef CONFIG_PM
@@ -185,7 +185,7 @@ static int __devinit pxakbd_probe(struct platform_device *pdev)
                             DRIVER_NAME, pdev);
         if (error) {
                 printk(KERN_ERR "Cannot request keypad IRQ\n");
-                pxa_set_cken(CKEN19_KEYPAD, 0);
+                pxa_set_cken(CKEN_KEYPAD, 0);
                 goto err_free_dev;
         }
 
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index eb0167e9f0cb..50e06e8dd05d 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -48,7 +48,7 @@ config MOUSE_PS2_ALPS
           If unsure, say Y.
 
 config MOUSE_PS2_LOGIPS2PP
-        bool "Logictech PS/2++ mouse protocol extension" if EMBEDDED
+        bool "Logitech PS/2++ mouse protocol extension" if EMBEDDED
         default y
         depends on MOUSE_PS2
         help
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 8675f9509393..3f4866d8d18c 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -766,9 +766,9 @@ static void mousedev_disconnect(struct input_handle *handle)
 
         if (mousedev->open) {
                 input_close_device(handle);
-                wake_up_interruptible(&mousedev->wait);
                 list_for_each_entry(client, &mousedev->client_list, node)
                         kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+                wake_up_interruptible(&mousedev->wait);
         } else
                 mousedev_free(mousedev);
 }
diff --git a/drivers/input/tsdev.c b/drivers/input/tsdev.c
index 8238b13874c2..2db364898e15 100644
--- a/drivers/input/tsdev.c
+++ b/drivers/input/tsdev.c
@@ -476,9 +476,9 @@ static void tsdev_disconnect(struct input_handle *handle)
 
         if (tsdev->open) {
                 input_close_device(handle);
-                wake_up_interruptible(&tsdev->wait);
                 list_for_each_entry(client, &tsdev->client_list, node)
                         kill_fasync(&client->fasync, SIGIO, POLL_HUP);
+                wake_up_interruptible(&tsdev->wait);
         } else
                 tsdev_free(tsdev);
 }
diff --git a/drivers/isdn/Kconfig b/drivers/isdn/Kconfig
index d42fe89cddf6..3e088c42b222 100644
--- a/drivers/isdn/Kconfig
+++ b/drivers/isdn/Kconfig
@@ -26,9 +26,9 @@ menu "Old ISDN4Linux"
         depends on NET && ISDN
 
 config ISDN_I4L
-        tristate "Old ISDN4Linux (obsolete)"
+        tristate "Old ISDN4Linux (deprecated)"
         ---help---
-          This driver allows you to use an ISDN-card for networking
+          This driver allows you to use an ISDN adapter for networking
           connections and as dialin/out device.  The isdn-tty's have a built
           in AT-compatible modem emulator.  Network devices support autodial,
           channel-bundling, callback and caller-authentication without having
@@ -39,8 +39,9 @@ config ISDN_I4L
 
           ISDN support in the linux kernel is moving towards a new API,
           called CAPI (Common ISDN Application Programming Interface).
-          Therefore the old ISDN4Linux layer is becoming obsolete. It is 
-          still usable, though, if you select this option.
+          Therefore the old ISDN4Linux layer will eventually become obsolete.
+          It is still available, though, for use with adapters that are not
+          supported by the new CAPI subsystem yet.
 
 if ISDN_I4L
 source "drivers/isdn/i4l/Kconfig"
diff --git a/drivers/isdn/hardware/eicon/diva_didd.c b/drivers/isdn/hardware/eicon/diva_didd.c
index 14298b8c835f..d755d904e62c 100644
--- a/drivers/isdn/hardware/eicon/diva_didd.c
+++ b/drivers/isdn/hardware/eicon/diva_didd.c
@@ -99,7 +99,7 @@ static int DIVA_INIT_FUNCTION create_proc(void)
         return (0);
 }
 
-static void DIVA_EXIT_FUNCTION remove_proc(void)
+static void remove_proc(void)
 {
         remove_proc_entry(DRIVERLNAME, proc_net_eicon);
         remove_proc_entry("net/eicon", NULL);
diff --git a/drivers/isdn/hardware/eicon/divasfunc.c b/drivers/isdn/hardware/eicon/divasfunc.c
index df61e510a28b..46fc21a3f8ff 100644
--- a/drivers/isdn/hardware/eicon/divasfunc.c
+++ b/drivers/isdn/hardware/eicon/divasfunc.c
@@ -231,7 +231,7 @@ int DIVA_INIT_FUNCTION divasfunc_init(int dbgmask)
 /*
  * exit
  */
-void DIVA_EXIT_FUNCTION divasfunc_exit(void)
+void divasfunc_exit(void)
 {
         divasa_xdi_driver_unload();
         disconnect_didd();
diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
index ea5f30d4a5a2..4e5f87c1e714 100644
--- a/drivers/isdn/i4l/isdn_tty.c
+++ b/drivers/isdn/i4l/isdn_tty.c
@@ -2693,8 +2693,9 @@ isdn_tty_getdial(char *p, char *q,int cnt)
         int limit = ISDN_MSNLEN - 1;    /* MUST match the size of interface var to avoid
                                         buffer overflow */
 
-        while (strchr(" 0123456789,#.*WPTS-", *p) && *p && --cnt>0) {
+        while (strchr(" 0123456789,#.*WPTSR-", *p) && *p && --cnt>0) {
                 if ((*p >= '0' && *p <= '9') || ((*p == 'S') && first) ||
+                    ((*p == 'R') && first) ||
                     (*p == '*') || (*p == '#')) {
                         *q++ = *p;
                         limit--;
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index e6e4d240b2a6..184238e2ece4 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -639,7 +639,7 @@ static void free_vmcs(struct vmcs *vmcs)
         free_pages((unsigned long)vmcs, vmcs_descriptor.order);
 }
 
-static __exit void free_kvm_area(void)
+static void free_kvm_area(void)
 {
         int cpu;
 
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index f44c94abd883..ee699a7d6214 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -114,7 +114,7 @@ config PMAC_SMU
 config PMAC_APM_EMU
         tristate "APM emulation"
         select APM_EMULATION
-        depends on ADB_PMU && PM
+        depends on ADB_PMU && PM && PPC32
 
 config PMAC_MEDIABAY
         bool "Support PowerBook hotswap media bay"
diff --git a/drivers/mfd/ucb1x00-ts.c b/drivers/mfd/ucb1x00-ts.c
index 7772bd1d92b4..38e815a2e871 100644
--- a/drivers/mfd/ucb1x00-ts.c
+++ b/drivers/mfd/ucb1x00-ts.c
@@ -291,7 +291,7 @@ static void ucb1x00_ts_irq(int idx, void *id)
 
 static int ucb1x00_ts_open(struct input_dev *idev)
 {
-        struct ucb1x00_ts *ts = idev->private;
+        struct ucb1x00_ts *ts = input_get_drvdata(idev);
         int ret = 0;
 
         BUG_ON(ts->rtask);
@@ -328,7 +328,7 @@ static int ucb1x00_ts_open(struct input_dev *idev)
  */
 static void ucb1x00_ts_close(struct input_dev *idev)
 {
-        struct ucb1x00_ts *ts = idev->private;
+        struct ucb1x00_ts *ts = input_get_drvdata(idev);
 
         if (ts->rtask)
                 kthread_stop(ts->rtask);
@@ -380,7 +380,6 @@ static int ucb1x00_ts_add(struct ucb1x00_dev *dev)
         ts->idev = idev;
         ts->adcsync = adcsync ? UCB_SYNC : UCB_NOSYNC;
 
-        idev->private    = ts;
         idev->name       = "Touchscreen panel";
         idev->id.product = ts->ucb->id;
         idev->open       = ucb1x00_ts_open;
@@ -391,6 +390,8 @@ static int ucb1x00_ts_add(struct ucb1x00_dev *dev)
         __set_bit(ABS_Y, idev->absbit);
         __set_bit(ABS_PRESSURE, idev->absbit);
 
+        input_set_drvdata(idev, ts);
+
         err = input_register_device(idev);
         if (err)
                 goto fail;
diff --git a/drivers/misc/thinkpad_acpi.c b/drivers/misc/thinkpad_acpi.c
index 6c36a55cb3d1..95c0b96e83f2 100644
--- a/drivers/misc/thinkpad_acpi.c
+++ b/drivers/misc/thinkpad_acpi.c
@@ -740,7 +740,7 @@ static ssize_t hotkey_enable_store(struct device *dev,
 }
 
 static struct device_attribute dev_attr_hotkey_enable =
-        __ATTR(enable, S_IWUSR | S_IRUGO,
+        __ATTR(hotkey_enable, S_IWUSR | S_IRUGO,
                 hotkey_enable_show, hotkey_enable_store);
 
 /* sysfs hotkey mask --------------------------------------------------- */
@@ -775,7 +775,7 @@ static ssize_t hotkey_mask_store(struct device *dev,
 }
 
 static struct device_attribute dev_attr_hotkey_mask =
-        __ATTR(mask, S_IWUSR | S_IRUGO,
+        __ATTR(hotkey_mask, S_IWUSR | S_IRUGO,
                 hotkey_mask_show, hotkey_mask_store);
 
 /* sysfs hotkey bios_enabled ------------------------------------------- */
@@ -787,7 +787,7 @@ static ssize_t hotkey_bios_enabled_show(struct device *dev,
 }
 
 static struct device_attribute dev_attr_hotkey_bios_enabled =
-        __ATTR(bios_enabled, S_IRUGO, hotkey_bios_enabled_show, NULL);
+        __ATTR(hotkey_bios_enabled, S_IRUGO, hotkey_bios_enabled_show, NULL);
 
 /* sysfs hotkey bios_mask ---------------------------------------------- */
 static ssize_t hotkey_bios_mask_show(struct device *dev,
@@ -798,7 +798,7 @@ static ssize_t hotkey_bios_mask_show(struct device *dev,
 }
 
 static struct device_attribute dev_attr_hotkey_bios_mask =
-        __ATTR(bios_mask, S_IRUGO, hotkey_bios_mask_show, NULL);
+        __ATTR(hotkey_bios_mask, S_IRUGO, hotkey_bios_mask_show, NULL);
 
 /* --------------------------------------------------------------------- */
 
@@ -824,8 +824,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
                 str_supported(tp_features.hotkey));
 
         if (tp_features.hotkey) {
-                hotkey_dev_attributes = create_attr_set(4,
-                                                TPACPI_HOTKEY_SYSFS_GROUP);
+                hotkey_dev_attributes = create_attr_set(4, NULL);
                 if (!hotkey_dev_attributes)
                         return -ENOMEM;
                 res = add_to_attr_set(hotkey_dev_attributes,
@@ -1050,7 +1049,7 @@ static ssize_t bluetooth_enable_store(struct device *dev,
 }
 
 static struct device_attribute dev_attr_bluetooth_enable =
-        __ATTR(enable, S_IWUSR | S_IRUGO,
+        __ATTR(bluetooth_enable, S_IWUSR | S_IRUGO,
                 bluetooth_enable_show, bluetooth_enable_store);
 
 /* --------------------------------------------------------------------- */
@@ -1061,7 +1060,6 @@ static struct attribute *bluetooth_attributes[] = {
 };
 
 static const struct attribute_group bluetooth_attr_group = {
-        .name = TPACPI_BLUETH_SYSFS_GROUP,
         .attrs = bluetooth_attributes,
 };
 
@@ -1215,7 +1213,7 @@ static ssize_t wan_enable_store(struct device *dev,
 }
 
 static struct device_attribute dev_attr_wan_enable =
-        __ATTR(enable, S_IWUSR | S_IRUGO,
+        __ATTR(wwan_enable, S_IWUSR | S_IRUGO,
                 wan_enable_show, wan_enable_store);
 
 /* --------------------------------------------------------------------- */
@@ -1226,7 +1224,6 @@ static struct attribute *wan_attributes[] = {
 };
 
 static const struct attribute_group wan_attr_group = {
-        .name = TPACPI_WAN_SYSFS_GROUP,
         .attrs = wan_attributes,
 };
 
diff --git a/drivers/misc/thinkpad_acpi.h b/drivers/misc/thinkpad_acpi.h
index 440145a02617..72d62f2dabb9 100644
--- a/drivers/misc/thinkpad_acpi.h
+++ b/drivers/misc/thinkpad_acpi.h
@@ -278,8 +278,6 @@ static int beep_write(char *buf);
  * Bluetooth subdriver
  */
 
-#define TPACPI_BLUETH_SYSFS_GROUP "bluetooth"
-
 enum {
         /* ACPI GBDC/SBDC bits */
         TP_ACPI_BLUETOOTH_HWPRESENT     = 0x01, /* Bluetooth hw available */
@@ -416,8 +414,6 @@ static int fan_write_cmd_watchdog(const char *cmd, int *rc);
  * Hotkey subdriver
  */
 
-#define TPACPI_HOTKEY_SYSFS_GROUP "hotkey"
-
 static int hotkey_orig_status;
 static int hotkey_orig_mask;
 
@@ -553,8 +549,6 @@ static int volume_write(char *buf);
  * Wan subdriver
  */
 
-#define TPACPI_WAN_SYSFS_GROUP "wwan"
-
 enum {
         /* ACPI GWAN/SWAN bits */
         TP_ACPI_WANCARD_HWPRESENT       = 0x01, /* Wan hw available */
diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c
index c08ad8f823d2..2d1b3df95c5b 100644
--- a/drivers/misc/tifm_7xx1.c
+++ b/drivers/misc/tifm_7xx1.c
@@ -343,7 +343,7 @@ static int tifm_7xx1_probe(struct pci_dev *dev,
         if (!fm->addr)
                 goto err_out_free;
 
-        rc = request_irq(dev->irq, tifm_7xx1_isr, SA_SHIRQ, DRIVER_NAME, fm);
+        rc = request_irq(dev->irq, tifm_7xx1_isr, IRQF_SHARED, DRIVER_NAME, fm);
         if (rc)
                 goto err_out_unmap;
 
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 92055405cb30..451adcc52b3c 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -1,10 +1,9 @@
 #
 # Makefile for the memory technology device drivers.
 #
-# $Id: Makefile.common,v 1.7 2005/07/11 10:39:27 gleixner Exp $
 
 # Core functionality.
-mtd-y                           := mtdcore.o
+mtd-y                           := mtdcore.o mtdsuper.o
 mtd-$(CONFIG_MTD_PARTITIONS)    += mtdpart.o
 obj-$(CONFIG_MTD)               += $(mtd-y)
 
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index a4873ab84e6b..e8f686f7a357 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -650,7 +650,7 @@ MODULE_DESCRIPTION(PMC551_VERSION);
  */
 static int msize = 0;
 #if defined(CONFIG_MTD_PMC551_APERTURE_SIZE)
-static int asize = CONFIG_MTD_PMC551_APERTURE_SIZE
+static int asize = CONFIG_MTD_PMC551_APERTURE_SIZE;
 #else
 static int asize = 0;
 #endif
diff --git a/drivers/mtd/maps/uclinux.c b/drivers/mtd/maps/uclinux.c
index 389fea28b9a6..14ffb1a9302a 100644
--- a/drivers/mtd/maps/uclinux.c
+++ b/drivers/mtd/maps/uclinux.c
@@ -16,7 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/fs.h>
 #include <linux/major.h>
-#include <linux/root_dev.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
 #include <linux/mtd/partitions.h>
@@ -89,10 +88,6 @@ int __init uclinux_mtd_init(void)
         uclinux_ram_mtdinfo = mtd;
         add_mtd_partitions(mtd, uclinux_romfs, NUM_PARTITIONS);
 
-        printk("uclinux[mtd]: set %s to be root filesystem\n",
-                uclinux_romfs[0].name);
-        ROOT_DEV = MKDEV(MTD_BLOCK_MAJOR, 0);
-
         return(0);
 }
 
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
new file mode 100644
index 000000000000..aca331971201
--- /dev/null
+++ b/drivers/mtd/mtdsuper.c
@@ -0,0 +1,232 @@
+/* MTD-based superblock management
+ *
+ * Copyright © 2001-2007 Red Hat, Inc. All Rights Reserved.
+ * Written by:  David Howells <dhowells@redhat.com>
+ *              David Woodhouse <dwmw2@infradead.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/mtd/super.h>
+#include <linux/namei.h>
+#include <linux/ctype.h>
+
+/*
+ * compare superblocks to see if they're equivalent
+ * - they are if the underlying MTD device is the same
+ */
+static int get_sb_mtd_compare(struct super_block *sb, void *_mtd)
+{
+        struct mtd_info *mtd = _mtd;
+
+        if (sb->s_mtd == mtd) {
+                DEBUG(2, "MTDSB: Match on device %d (\"%s\")\n",
+                      mtd->index, mtd->name);
+                return 1;
+        }
+
+        DEBUG(2, "MTDSB: No match, device %d (\"%s\"), device %d (\"%s\")\n",
+              sb->s_mtd->index, sb->s_mtd->name, mtd->index, mtd->name);
+        return 0;
+}
+
+/*
+ * mark the superblock by the MTD device it is using
+ * - set the device number to be the correct MTD block device for pesuperstence
+ *   of NFS exports
+ */
+static int get_sb_mtd_set(struct super_block *sb, void *_mtd)
+{
+        struct mtd_info *mtd = _mtd;
+
+        sb->s_mtd = mtd;
+        sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
+        return 0;
+}
+
+/*
+ * get a superblock on an MTD-backed filesystem
+ */
+static int get_sb_mtd_aux(struct file_system_type *fs_type, int flags,
+                          const char *dev_name, void *data,
+                          struct mtd_info *mtd,
+                          int (*fill_super)(struct super_block *, void *, int),
+                          struct vfsmount *mnt)
+{
+        struct super_block *sb;
+        int ret;
+
+        sb = sget(fs_type, get_sb_mtd_compare, get_sb_mtd_set, mtd);
+        if (IS_ERR(sb))
+                goto out_error;
+
+        if (sb->s_root)
+                goto already_mounted;
+
+        /* fresh new superblock */
+        DEBUG(1, "MTDSB: New superblock for device %d (\"%s\")\n",
+              mtd->index, mtd->name);
+
+        ret = fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
+        if (ret < 0) {
+                up_write(&sb->s_umount);
+                deactivate_super(sb);
+                return ret;
+        }
+
+        /* go */
+        sb->s_flags |= MS_ACTIVE;
+        return simple_set_mnt(mnt, sb);
+
+        /* new mountpoint for an already mounted superblock */
+already_mounted:
+        DEBUG(1, "MTDSB: Device %d (\"%s\") is already mounted\n",
+              mtd->index, mtd->name);
+        ret = simple_set_mnt(mnt, sb);
+        goto out_put;
+
+out_error:
+        ret = PTR_ERR(sb);
+out_put:
+        put_mtd_device(mtd);
+        return ret;
+}
+
+/*
+ * get a superblock on an MTD-backed filesystem by MTD device number
+ */
+static int get_sb_mtd_nr(struct file_system_type *fs_type, int flags,
+                         const char *dev_name, void *data, int mtdnr,
+                         int (*fill_super)(struct super_block *, void *, int),
+                         struct vfsmount *mnt)
+{
+        struct mtd_info *mtd;
+
+        mtd = get_mtd_device(NULL, mtdnr);
+        if (IS_ERR(mtd)) {
+                DEBUG(0, "MTDSB: Device #%u doesn't appear to exist\n", mtdnr);
+                return PTR_ERR(mtd);
+        }
+
+        return get_sb_mtd_aux(fs_type, flags, dev_name, data, mtd, fill_super,
+                              mnt);
+}
+
+/*
+ * set up an MTD-based superblock
+ */
+int get_sb_mtd(struct file_system_type *fs_type, int flags,
+               const char *dev_name, void *data,
+               int (*fill_super)(struct super_block *, void *, int),
+               struct vfsmount *mnt)
+{
+        struct nameidata nd;
+        int mtdnr, ret;
+
+        if (!dev_name)
+                return -EINVAL;
+
+        DEBUG(2, "MTDSB: dev_name \"%s\"\n", dev_name);
+
+        /* the preferred way of mounting in future; especially when
+         * CONFIG_BLOCK=n - we specify the underlying MTD device by number or
+         * by name, so that we don't require block device support to be present
+         * in the kernel. */
+        if (dev_name[0] == 'm' && dev_name[1] == 't' && dev_name[2] == 'd') {
+                if (dev_name[3] == ':') {
+                        struct mtd_info *mtd;
+
+                        /* mount by MTD device name */
+                        DEBUG(1, "MTDSB: mtd:%%s, name \"%s\"\n",
+                              dev_name + 4);
+
+                        for (mtdnr = 0; mtdnr < MAX_MTD_DEVICES; mtdnr++) {
+                                mtd = get_mtd_device(NULL, mtdnr);
+                                if (!IS_ERR(mtd)) {
+                                        if (!strcmp(mtd->name, dev_name + 4))
+                                                return get_sb_mtd_aux(
+                                                        fs_type, flags,
+                                                        dev_name, data, mtd,
+                                                        fill_super, mnt);
+
+                                        put_mtd_device(mtd);
+                                }
+                        }
+
+                        printk(KERN_NOTICE "MTD:"
+                               " MTD device with name \"%s\" not found.\n",
+                               dev_name + 4);
+
+                } else if (isdigit(dev_name[3])) {
+                        /* mount by MTD device number name */
+                        char *endptr;
+
+                        mtdnr = simple_strtoul(dev_name + 3, &endptr, 0);
+                        if (!*endptr) {
+                                /* It was a valid number */
+                                DEBUG(1, "MTDSB: mtd%%d, mtdnr %d\n",
+                                      mtdnr);
+                                return get_sb_mtd_nr(fs_type, flags,
+                                                     dev_name, data,
+                                                     mtdnr, fill_super, mnt);
+                        }
+                }
+        }
+
+        /* try the old way - the hack where we allowed users to mount
+         * /dev/mtdblock$(n) but didn't actually _use_ the blockdev
+         */
+        ret = path_lookup(dev_name, LOOKUP_FOLLOW, &nd);
+
+        DEBUG(1, "MTDSB: path_lookup() returned %d, inode %p\n",
+              ret, nd.dentry ? nd.dentry->d_inode : NULL);
+
+        if (ret)
+                return ret;
+
+        ret = -EINVAL;
+
+        if (!S_ISBLK(nd.dentry->d_inode->i_mode))
+                goto out;
+
+        if (nd.mnt->mnt_flags & MNT_NODEV) {
+                ret = -EACCES;
+                goto out;
+        }
+
+        if (imajor(nd.dentry->d_inode) != MTD_BLOCK_MAJOR)
+                goto not_an_MTD_device;
+
+        mtdnr = iminor(nd.dentry->d_inode);
+        path_release(&nd);
+
+        return get_sb_mtd_nr(fs_type, flags, dev_name, data, mtdnr, fill_super,
+                             mnt);
+
+not_an_MTD_device:
+        if (!(flags & MS_SILENT))
+                printk(KERN_NOTICE
+                       "MTD: Attempt to mount non-MTD device \"%s\"\n",
+                       dev_name);
+out:
+        path_release(&nd);
+        return ret;
+
+}
+
+EXPORT_SYMBOL_GPL(get_sb_mtd);
+
+/*
+ * destroy an MTD-based superblock
+ */
+void kill_mtd_super(struct super_block *sb)
+{
+        generic_shutdown_super(sb);
+        put_mtd_device(sb->s_mtd);
+        sb->s_mtd = NULL;
+}
+
+EXPORT_SYMBOL_GPL(kill_mtd_super);
diff --git a/drivers/mtd/nand/autcpu12.c b/drivers/mtd/nand/autcpu12.c
index fe94ae9ae1f2..e3744eb8eccb 100644
--- a/drivers/mtd/nand/autcpu12.c
+++ b/drivers/mtd/nand/autcpu12.c
@@ -101,7 +101,7 @@ static void autcpu12_hwcontrol(struct mtd_info *mtd, int cmd,
         struct nand_chip *chip = mtd->priv;
 
         if (ctrl & NAND_CTRL_CHANGE) {
-                void __iomem *addr
+                void __iomem *addr;
                 unsigned char bits;
 
                 addr = CS89712_VIRT_BASE + AUTCPU12_SMC_PORT_OFFSET;
diff --git a/drivers/mtd/nand/ppchameleonevb.c b/drivers/mtd/nand/ppchameleonevb.c
index eb7d4d443deb..082073acf20f 100644
--- a/drivers/mtd/nand/ppchameleonevb.c
+++ b/drivers/mtd/nand/ppchameleonevb.c
@@ -81,7 +81,7 @@ __setup("ppchameleonevb_fio_pbase=", ppchameleonevb_fio_pbase);
  */
 static struct mtd_partition partition_info_hi[] = {
       { .name = "PPChameleon HI Nand Flash",
-        offset = 0,
+        .offset = 0,
         .size = 128 * 1024 * 1024
       }
 };
@@ -424,9 +424,9 @@ static void __exit ppchameleonevb_cleanup(void)
 
         /* Release iomaps */
         this = (struct nand_chip *) &ppchameleon_mtd[1];
-        iounmap((void *) this->IO_ADDR_R;
+        iounmap((void *) this->IO_ADDR_R);
         this = (struct nand_chip *) &ppchameleonevb_mtd[1];
-        iounmap((void *) this->IO_ADDR_R;
+        iounmap((void *) this->IO_ADDR_R);
 
         /* Free the MTD device structure */
         kfree (ppchameleon_mtd);
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index e8c9f27817b0..a804965e6542 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -435,20 +435,12 @@ static void cp_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
 
         spin_lock_irqsave(&cp->lock, flags);
         cp->vlgrp = grp;
-        cp->cpcmd |= RxVlanOn;
-        cpw16(CpCmd, cp->cpcmd);
-        spin_unlock_irqrestore(&cp->lock, flags);
-}
-
-static void cp_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct cp_private *cp = netdev_priv(dev);
-        unsigned long flags;
+        if (grp)
+                cp->cpcmd |= RxVlanOn;
+        else
+                cp->cpcmd &= ~RxVlanOn;
 
-        spin_lock_irqsave(&cp->lock, flags);
-        cp->cpcmd &= ~RxVlanOn;
         cpw16(CpCmd, cp->cpcmd);
-        vlan_group_set_device(cp->vlgrp, vid, NULL);
         spin_unlock_irqrestore(&cp->lock, flags);
 }
 #endif /* CP_VLAN_TAG_USED */
@@ -1944,7 +1936,6 @@ static int cp_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
 #if CP_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register = cp_vlan_rx_register;
-        dev->vlan_rx_kill_vid = cp_vlan_rx_kill_vid;
 #endif
 
         if (pci_using_dac)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 1798a9f9fb25..7d57f4a25dc1 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2280,6 +2280,7 @@ config GFAR_NAPI
 config UCC_GETH
         tristate "Freescale QE Gigabit Ethernet"
         depends on QUICC_ENGINE
+        select PHYLIB
         help
           This driver supports the Gigabit Ethernet mode of the QUICC Engine,
           which is available on some Freescale SOCs.
diff --git a/drivers/net/acenic.c b/drivers/net/acenic.c
index 7122b7ba8d61..04382f979c99 100644
--- a/drivers/net/acenic.c
+++ b/drivers/net/acenic.c
@@ -480,12 +480,10 @@ static int __devinit acenic_probe_one(struct pci_dev *pdev,
 #if ACENIC_DO_VLAN
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register = ace_vlan_rx_register;
-        dev->vlan_rx_kill_vid = ace_vlan_rx_kill_vid;
 #endif
-        if (1) {
-                dev->tx_timeout = &ace_watchdog;
-                dev->watchdog_timeo = 5*HZ;
-        }
+
+        dev->tx_timeout = &ace_watchdog;
+        dev->watchdog_timeo = 5*HZ;
 
         dev->open = &ace_open;
         dev->stop = &ace_close;
@@ -2283,19 +2281,6 @@ static void ace_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
         ace_unmask_irq(dev);
         local_irq_restore(flags);
 }
-
-
-static void ace_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct ace_private *ap = netdev_priv(dev);
-        unsigned long flags;
-
-        local_irq_save(flags);
-        ace_mask_irq(dev);
-        vlan_group_set_device(ap->vlgrp, vid, NULL);
-        ace_unmask_irq(dev);
-        local_irq_restore(flags);
-}
 #endif /* ACENIC_DO_VLAN */
 
 
diff --git a/drivers/net/acenic.h b/drivers/net/acenic.h
index 8ca8534d70bf..60ed1837fa8f 100644
--- a/drivers/net/acenic.h
+++ b/drivers/net/acenic.h
@@ -787,7 +787,6 @@ static struct net_device_stats *ace_get_stats(struct net_device *dev);
 static int read_eeprom_byte(struct net_device *dev, unsigned long offset);
 #if ACENIC_DO_VLAN
 static void ace_vlan_rx_register(struct net_device *dev, struct vlan_group *grp);
-static void ace_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid);
 #endif
 
 #endif /* _ACENIC_H_ */
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 675fe918421b..a61b2f89fc33 100644
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -155,7 +155,7 @@ This function will write into PHY registers.
 */
 static int amd8111e_write_phy(struct amd8111e_priv* lp,int phy_id, int reg, u32 val)
 {
-        unsigned int repeat = REPEAT_CNT
+        unsigned int repeat = REPEAT_CNT;
         void __iomem *mmio = lp->mmio;
         unsigned int reg_val;
 
@@ -1728,15 +1728,8 @@ static void amd8111e_vlan_rx_register(struct net_device *dev, struct vlan_group
         lp->vlgrp = grp;
         spin_unlock_irq(&lp->lock);
 }
-
-static void amd8111e_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct amd8111e_priv *lp = netdev_priv(dev);
-        spin_lock_irq(&lp->lock);
-        vlan_group_set_device(lp->vlgrp, vid, NULL);
-        spin_unlock_irq(&lp->lock);
-}
 #endif
+
 static int amd8111e_enable_magicpkt(struct amd8111e_priv* lp)
 {
         writel( VAL1|MPPLBA, lp->mmio + CMD3);
@@ -1996,7 +1989,6 @@ static int __devinit amd8111e_probe_one(struct pci_dev *pdev,
 #if AMD8111E_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX ;
         dev->vlan_rx_register =amd8111e_vlan_rx_register;
-        dev->vlan_rx_kill_vid = amd8111e_vlan_rx_kill_vid;
 #endif
 
         lp = netdev_priv(dev);
@@ -2049,7 +2041,6 @@ static int __devinit amd8111e_probe_one(struct pci_dev *pdev,
 #if AMD8111E_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register =amd8111e_vlan_rx_register;
-        dev->vlan_rx_kill_vid = amd8111e_vlan_rx_kill_vid;
 #endif
         /* Probe the external PHY */
         amd8111e_probe_ext_phy(dev);
diff --git a/drivers/net/amd8111e.h b/drivers/net/amd8111e.h
index 2007510c4eb6..e65080a5994a 100644
--- a/drivers/net/amd8111e.h
+++ b/drivers/net/amd8111e.h
@@ -615,7 +615,7 @@ typedef enum {
 #define SSTATE  2
 
 /* Assume contoller gets data 10 times the maximum processing time */
-#define  REPEAT_CNT                     10;
+#define  REPEAT_CNT                     10
 
 /* amd8111e decriptor flag definitions */
 typedef enum {
diff --git a/drivers/net/atl1/atl1_main.c b/drivers/net/atl1/atl1_main.c
index 78cf00ff3d38..6862c11ff864 100644
--- a/drivers/net/atl1/atl1_main.c
+++ b/drivers/net/atl1/atl1_main.c
@@ -1229,39 +1229,9 @@ static void atl1_vlan_rx_register(struct net_device *netdev,
         spin_unlock_irqrestore(&adapter->lock, flags);
 }
 
-/* FIXME: justify or remove -- CHS */
-static void atl1_vlan_rx_add_vid(struct net_device *netdev, u16 vid)
-{
-        /* We don't do Vlan filtering */
-        return;
-}
-
-/* FIXME: this looks wrong too -- CHS */
-static void atl1_vlan_rx_kill_vid(struct net_device *netdev, u16 vid)
-{
-        struct atl1_adapter *adapter = netdev_priv(netdev);
-        unsigned long flags;
-
-        spin_lock_irqsave(&adapter->lock, flags);
-        /* atl1_irq_disable(adapter); */
-        vlan_group_set_device(adapter->vlgrp, vid, NULL);
-        /* atl1_irq_enable(adapter); */
-        spin_unlock_irqrestore(&adapter->lock, flags);
-        /* We don't do Vlan filtering */
-        return;
-}
-
 static void atl1_restore_vlan(struct atl1_adapter *adapter)
 {
         atl1_vlan_rx_register(adapter->netdev, adapter->vlgrp);
-        if (adapter->vlgrp) {
-                u16 vid;
-                for (vid = 0; vid < VLAN_GROUP_ARRAY_LEN; vid++) {
-                        if (!vlan_group_get_device(adapter->vlgrp, vid))
-                                continue;
-                        atl1_vlan_rx_add_vid(adapter->netdev, vid);
-                }
-        }
 }
 
 static u16 tpd_avail(struct atl1_tpd_ring *tpd_ring)
@@ -2203,8 +2173,7 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
         netdev->poll_controller = atl1_poll_controller;
 #endif
         netdev->vlan_rx_register = atl1_vlan_rx_register;
-        netdev->vlan_rx_add_vid = atl1_vlan_rx_add_vid;
-        netdev->vlan_rx_kill_vid = atl1_vlan_rx_kill_vid;
+
         netdev->ethtool_ops = &atl1_ethtool_ops;
         adapter->bd_number = cards_found;
         adapter->pci_using_64 = pci_using_64;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 88b33c6ddda8..ce3ed67a878e 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.10"
-#define DRV_MODULE_RELDATE      "May 1, 2007"
+#define DRV_MODULE_VERSION      "1.5.11"
+#define DRV_MODULE_RELDATE      "June 4, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -1778,6 +1778,15 @@ bnx2_init_5709_context(struct bnx2 *bp)
         val = BNX2_CTX_COMMAND_ENABLED | BNX2_CTX_COMMAND_MEM_INIT | (1 << 12);
         val |= (BCM_PAGE_BITS - 8) << 16;
         REG_WR(bp, BNX2_CTX_COMMAND, val);
+        for (i = 0; i < 10; i++) {
+                val = REG_RD(bp, BNX2_CTX_COMMAND);
+                if (!(val & BNX2_CTX_COMMAND_MEM_INIT))
+                        break;
+                udelay(2);
+        }
+        if (val & BNX2_CTX_COMMAND_MEM_INIT)
+                return -EBUSY;
+
         for (i = 0; i < bp->ctx_pages; i++) {
                 int j;
 
@@ -1811,6 +1820,7 @@ bnx2_init_context(struct bnx2 *bp)
         vcid = 96;
         while (vcid) {
                 u32 vcid_addr, pcid_addr, offset;
+                int i;
 
                 vcid--;
 
@@ -1831,16 +1841,20 @@ bnx2_init_context(struct bnx2 *bp)
                         pcid_addr = vcid_addr;
                 }
 
-                REG_WR(bp, BNX2_CTX_VIRT_ADDR, 0x00);
-                REG_WR(bp, BNX2_CTX_PAGE_TBL, pcid_addr);
+                for (i = 0; i < (CTX_SIZE / PHY_CTX_SIZE); i++) {
+                        vcid_addr += (i << PHY_CTX_SHIFT);
+                        pcid_addr += (i << PHY_CTX_SHIFT);
 
-                /* Zero out the context. */
-                for (offset = 0; offset < PHY_CTX_SIZE; offset += 4) {
-                        CTX_WR(bp, 0x00, offset, 0);
-                }
+                        REG_WR(bp, BNX2_CTX_VIRT_ADDR, 0x00);
+                        REG_WR(bp, BNX2_CTX_PAGE_TBL, pcid_addr);
+
+                        /* Zero out the context. */
+                        for (offset = 0; offset < PHY_CTX_SIZE; offset += 4)
+                                CTX_WR(bp, 0x00, offset, 0);
 
-                REG_WR(bp, BNX2_CTX_VIRT_ADDR, vcid_addr);
-                REG_WR(bp, BNX2_CTX_PAGE_TBL, pcid_addr);
+                        REG_WR(bp, BNX2_CTX_VIRT_ADDR, vcid_addr);
+                        REG_WR(bp, BNX2_CTX_PAGE_TBL, pcid_addr);
+                }
         }
 }
 
@@ -3691,9 +3705,11 @@ bnx2_init_chip(struct bnx2 *bp)
 
         /* Initialize context mapping and zero out the quick contexts.  The
          * context block must have already been enabled. */
-        if (CHIP_NUM(bp) == CHIP_NUM_5709)
-                bnx2_init_5709_context(bp);
-        else
+        if (CHIP_NUM(bp) == CHIP_NUM_5709) {
+                rc = bnx2_init_5709_context(bp);
+                if (rc)
+                        return rc;
+        } else
                 bnx2_init_context(bp);
 
         if ((rc = bnx2_init_cpus(bp)) != 0)
@@ -3772,7 +3788,10 @@ bnx2_init_chip(struct bnx2 *bp)
         REG_WR(bp, BNX2_HC_CMD_TICKS,
                (bp->cmd_ticks_int << 16) | bp->cmd_ticks);
 
-        REG_WR(bp, BNX2_HC_STATS_TICKS, bp->stats_ticks & 0xffff00);
+        if (CHIP_NUM(bp) == CHIP_NUM_5708)
+                REG_WR(bp, BNX2_HC_STATS_TICKS, 0);
+        else
+                REG_WR(bp, BNX2_HC_STATS_TICKS, bp->stats_ticks & 0xffff00);
         REG_WR(bp, BNX2_HC_STAT_COLLECT_TICKS, 0xbb8);  /* 3ms */
 
         if (CHIP_ID(bp) == CHIP_ID_5706_A1)
@@ -3799,6 +3818,11 @@ bnx2_init_chip(struct bnx2 *bp)
         /* Initialize the receive filter. */
         bnx2_set_rx_mode(bp->dev);
 
+        if (CHIP_NUM(bp) == CHIP_NUM_5709) {
+                val = REG_RD(bp, BNX2_MISC_NEW_CORE_CTL);
+                val |= BNX2_MISC_NEW_CORE_CTL_DMA_ENABLE;
+                REG_WR(bp, BNX2_MISC_NEW_CORE_CTL, val);
+        }
         rc = bnx2_fw_sync(bp, BNX2_DRV_MSG_DATA_WAIT2 | BNX2_DRV_MSG_CODE_RESET,
                           0);
 
@@ -4620,6 +4644,11 @@ bnx2_timer(unsigned long data)
 
         bp->stats_blk->stat_FwRxDrop = REG_RD_IND(bp, BNX2_FW_RX_DROP_COUNT);
 
+        /* workaround occasional corrupted counters */
+        if (CHIP_NUM(bp) == CHIP_NUM_5708 && bp->stats_ticks)
+                REG_WR(bp, BNX2_HC_COMMAND, bp->hc_cmd |
+                                            BNX2_HC_COMMAND_STATS_NOW);
+
         if (bp->phy_flags & PHY_SERDES_FLAG) {
                 if (CHIP_NUM(bp) == CHIP_NUM_5706)
                         bnx2_5706_serdes_timer(bp);
@@ -4786,19 +4815,6 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
 
         bnx2_netif_start(bp);
 }
-
-/* Called with rtnl_lock */
-static void
-bnx2_vlan_rx_kill_vid(struct net_device *dev, uint16_t vid)
-{
-        struct bnx2 *bp = netdev_priv(dev);
-
-        bnx2_netif_stop(bp);
-        vlan_group_set_device(bp->vlgrp, vid, NULL);
-        bnx2_set_rx_mode(dev);
-
-        bnx2_netif_start(bp);
-}
 #endif
 
 /* Called with netif_tx_lock.
@@ -5430,6 +5446,10 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
                 0xff;
 
         bp->stats_ticks = coal->stats_block_coalesce_usecs;
+        if (CHIP_NUM(bp) == CHIP_NUM_5708) {
+                if (bp->stats_ticks != 0 && bp->stats_ticks != USEC_PER_SEC)
+                        bp->stats_ticks = USEC_PER_SEC;
+        }
         if (bp->stats_ticks > 0xffff00) bp->stats_ticks = 0xffff00;
         bp->stats_ticks &= 0xffff00;
 
@@ -6453,7 +6473,6 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->watchdog_timeo = TX_TIMEOUT;
 #ifdef BCM_VLAN
         dev->vlan_rx_register = bnx2_vlan_rx_register;
-        dev->vlan_rx_kill_vid = bnx2_vlan_rx_kill_vid;
 #endif
         dev->poll = bnx2_poll;
         dev->ethtool_ops = &bnx2_ethtool_ops;
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index bd6288d6350f..49a5de253b17 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -1373,6 +1373,7 @@ struct l2_fhdr {
 #define BNX2_MISC_NEW_CORE_CTL                          0x000008c8
 #define BNX2_MISC_NEW_CORE_CTL_LINK_HOLDOFF_SUCCESS      (1L<<0)
 #define BNX2_MISC_NEW_CORE_CTL_LINK_HOLDOFF_REQ          (1L<<1)
+#define BNX2_MISC_NEW_CORE_CTL_DMA_ENABLE                (1L<<16)
 #define BNX2_MISC_NEW_CORE_CTL_RESERVED_CMN              (0x3fffL<<2)
 #define BNX2_MISC_NEW_CORE_CTL_RESERVED_TC               (0xffffL<<16)
 
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 9fe3a38883ee..59b9943b077d 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -4920,7 +4920,7 @@ static int __devinit cas_init_one(struct pci_dev *pdev,
         pci_cmd |= PCI_COMMAND_PARITY;
         pci_write_config_word(pdev, PCI_COMMAND, pci_cmd);
         if (pci_set_mwi(pdev))
-                printk(KERN_WARNING PFX "Could enable MWI for %s\n",
+                printk(KERN_WARNING PFX "Could not enable MWI for %s\n",
                        pci_name(pdev));
 
         /*
diff --git a/drivers/net/chelsio/cxgb2.c b/drivers/net/chelsio/cxgb2.c
index 125c9b105869..231ce43b97cf 100644
--- a/drivers/net/chelsio/cxgb2.c
+++ b/drivers/net/chelsio/cxgb2.c
@@ -883,15 +883,6 @@ static void vlan_rx_register(struct net_device *dev,
         t1_set_vlan_accel(adapter, grp != NULL);
         spin_unlock_irq(&adapter->async_lock);
 }
-
-static void vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct adapter *adapter = dev->priv;
-
-        spin_lock_irq(&adapter->async_lock);
-        vlan_group_set_device(adapter->vlan_grp, vid, NULL);
-        spin_unlock_irq(&adapter->async_lock);
-}
 #endif
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -1099,7 +1090,6 @@ static int __devinit init_one(struct pci_dev *pdev,
                         netdev->features |=
                                 NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
                         netdev->vlan_rx_register = vlan_rx_register;
-                        netdev->vlan_rx_kill_vid = vlan_rx_kill_vid;
 #endif
 
                         /* T204: disable TSO */
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index 67b4b219d927..1b20f4060e2d 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -2067,11 +2067,6 @@ static void vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
         t3_synchronize_rx(adapter, pi);
 }
 
-static void vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        /* nothing */
-}
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void cxgb_netpoll(struct net_device *dev)
 {
@@ -2409,7 +2404,6 @@ static int __devinit init_one(struct pci_dev *pdev,
 
                 netdev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
                 netdev->vlan_rx_register = vlan_rx_register;
-                netdev->vlan_rx_kill_vid = vlan_rx_kill_vid;
 
                 netdev->open = cxgb_open;
                 netdev->stop = cxgb_close;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 9ec35b7a8207..cf8af928a69c 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -1142,13 +1142,16 @@ e1000_probe(struct pci_dev *pdev,
             !e1000_check_mng_mode(&adapter->hw))
                 e1000_get_hw_control(adapter);
 
-        strcpy(netdev->name, "eth%d");
-        if ((err = register_netdev(netdev)))
-                goto err_register;
-
         /* tell the stack to leave us alone until e1000_open() is called */
         netif_carrier_off(netdev);
         netif_stop_queue(netdev);
+#ifdef CONFIG_E1000_NAPI
+        netif_poll_disable(netdev);
+#endif
+
+        strcpy(netdev->name, "eth%d");
+        if ((err = register_netdev(netdev)))
+                goto err_register;
 
         DPRINTK(PROBE, INFO, "Intel(R) PRO/1000 Network Connection\n");
 
diff --git a/drivers/net/fec_8xx/fec_main.c b/drivers/net/fec_8xx/fec_main.c
index 88efe9731bab..e5502af5b8e2 100644
--- a/drivers/net/fec_8xx/fec_main.c
+++ b/drivers/net/fec_8xx/fec_main.c
@@ -550,7 +550,7 @@ static int fec_enet_rx_common(struct net_device *dev, int *budget)
                                 skbn = dev_alloc_skb(pkt_len + 2);
                                 if (skbn != NULL) {
                                         skb_reserve(skbn, 2);   /* align IP header */
-                                        skb_copy_from_linear_data(skb
+                                        skb_copy_from_linear_data(skb,
                                                                   skbn->data,
                                                                   pkt_len);
                                         /* swap */
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 4154fd000746..32788ca40d25 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -4605,12 +4605,7 @@ static void nv_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
         writel(np->txrxctl_bits, get_hwbase(dev) + NvRegTxRxControl);
 
         spin_unlock_irq(&np->lock);
-};
-
-static void nv_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        /* nothing to do */
-};
+}
 
 /* The mgmt unit and driver use a semaphore to access the phy during init */
 static int nv_mgmt_acquire_sema(struct net_device *dev)
@@ -4956,7 +4951,6 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 np->vlanctl_bits = NVREG_VLANCONTROL_ENABLE;
                 dev->features |= NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX;
                 dev->vlan_rx_register = nv_vlan_rx_register;
-                dev->vlan_rx_kill_vid = nv_vlan_rx_kill_vid;
         }
 
         np->msi_flags = 0;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index f5b3cba23fc5..6822bf14267b 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -140,7 +140,6 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit);
 static int gfar_process_frame(struct net_device *dev, struct sk_buff *skb, int length);
 static void gfar_vlan_rx_register(struct net_device *netdev,
                                 struct vlan_group *grp);
-static void gfar_vlan_rx_kill_vid(struct net_device *netdev, uint16_t vid);
 void gfar_halt(struct net_device *dev);
 void gfar_start(struct net_device *dev);
 static void gfar_clear_exact_match(struct net_device *dev);
@@ -284,7 +283,6 @@ static int gfar_probe(struct platform_device *pdev)
 
         if (priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_VLAN) {
                 dev->vlan_rx_register = gfar_vlan_rx_register;
-                dev->vlan_rx_kill_vid = gfar_vlan_rx_kill_vid;
 
                 dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
 
@@ -1133,20 +1131,6 @@ static void gfar_vlan_rx_register(struct net_device *dev,
         spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
-
-static void gfar_vlan_rx_kill_vid(struct net_device *dev, uint16_t vid)
-{
-        struct gfar_private *priv = netdev_priv(dev);
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->rxlock, flags);
-
-        vlan_group_set_device(priv->vlgrp, vid, NULL);
-
-        spin_unlock_irqrestore(&priv->rxlock, flags);
-}
-
-
 static int gfar_change_mtu(struct net_device *dev, int new_mtu)
 {
         int tempsize, tempval;
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 8118a6750b61..8caa591c5649 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -3005,7 +3005,7 @@ static int __init hp100_isa_init(void)
         return cards > 0 ? 0 : -ENODEV;
 }
 
-static void __exit hp100_isa_cleanup(void)
+static void hp100_isa_cleanup(void)
 {
         int i;
 
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 5d14be7405a3..b53b7ad999bc 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -1472,6 +1472,7 @@ static const struct ethtool_ops myri10ge_ethtool_ops = {
         .set_sg = ethtool_op_set_sg,
         .get_tso = ethtool_op_get_tso,
         .set_tso = ethtool_op_set_tso,
+        .get_link = ethtool_op_get_link,
         .get_strings = myri10ge_get_strings,
         .get_stats_count = myri10ge_get_stats_count,
         .get_ethtool_stats = myri10ge_get_ethtool_stats,
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 2c5c6d20e6e9..c61181f23bd5 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -654,8 +654,6 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
         if (adapter->portnum == 0)
                 netxen_free_adapter_offload(adapter);
 
-        if (adapter->irq)
-                free_irq(adapter->irq, adapter);
         if(adapter->portnum == 0) {
                 /* leave the hw in the same state as reboot */
                 writel(0, NETXEN_CRB_NORMALIZE(adapter, CRB_CMDPEG_STATE));
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 3439f8c649f9..717d8e9b9833 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -506,17 +506,6 @@ static void ns83820_vlan_rx_register(struct net_device *ndev, struct vlan_group
         spin_unlock(&dev->tx_lock);
         spin_unlock_irq(&dev->misc_lock);
 }
-
-static void ns83820_vlan_rx_kill_vid(struct net_device *ndev, unsigned short vid)
-{
-        struct ns83820 *dev = PRIV(ndev);
-
-        spin_lock_irq(&dev->misc_lock);
-        spin_lock(&dev->tx_lock);
-        vlan_group_set_device(dev->vlgrp, vid, NULL);
-        spin_unlock(&dev->tx_lock);
-        spin_unlock_irq(&dev->misc_lock);
-}
 #endif
 
 /* Packet Receiver
@@ -2083,7 +2072,6 @@ static int __devinit ns83820_init_one(struct pci_dev *pci_dev, const struct pci_
         /* We also support hardware vlan acceleration */
         ndev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         ndev->vlan_rx_register = ns83820_vlan_rx_register;
-        ndev->vlan_rx_kill_vid = ns83820_vlan_rx_kill_vid;
 #endif
 
         if (using_dac) {
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index d8766c0e8255..585be044ebbb 100755
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -4044,7 +4044,7 @@ static int __devinit ql3xxx_probe(struct pci_dev *pdev,
         if (pci_using_dac)
                 ndev->features |= NETIF_F_HIGHDMA;
         if (qdev->device_id == QL3032_DEVICE_ID)
-                ndev->features |= (NETIF_F_HW_CSUM | NETIF_F_SG);
+                ndev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
 
         qdev->mem_map_registers =
             ioremap_nocache(pci_resource_start(pdev, 1),
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 45876a854f00..5ec7752caa48 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -886,16 +886,6 @@ static void rtl8169_vlan_rx_register(struct net_device *dev,
         spin_unlock_irqrestore(&tp->lock, flags);
 }
 
-static void rtl8169_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct rtl8169_private *tp = netdev_priv(dev);
-        unsigned long flags;
-
-        spin_lock_irqsave(&tp->lock, flags);
-        vlan_group_set_device(tp->vlgrp, vid, NULL);
-        spin_unlock_irqrestore(&tp->lock, flags);
-}
-
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
                                struct sk_buff *skb)
 {
@@ -1671,7 +1661,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 #ifdef CONFIG_R8169_VLAN
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register = rtl8169_vlan_rx_register;
-        dev->vlan_rx_kill_vid = rtl8169_vlan_rx_kill_vid;
 #endif
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index e3e6d410d72c..c6ba3dee8ae0 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -340,17 +340,6 @@ static void s2io_vlan_rx_register(struct net_device *dev,
 /* A flag indicating whether 'RX_PA_CFG_STRIP_VLAN_TAG' bit is set or not */
 static int vlan_strip_flag;
 
-/* Unregister the vlan */
-static void s2io_vlan_rx_kill_vid(struct net_device *dev, unsigned long vid)
-{
-        struct s2io_nic *nic = dev->priv;
-        unsigned long flags;
-
-        spin_lock_irqsave(&nic->tx_lock, flags);
-        vlan_group_set_device(nic->vlgrp, vid, NULL);
-        spin_unlock_irqrestore(&nic->tx_lock, flags);
-}
-
 /*
  * Constants to be programmed into the Xena's registers, to configure
  * the XAUI.
@@ -7412,7 +7401,6 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register = s2io_vlan_rx_register;
-        dev->vlan_rx_kill_vid = (void *)s2io_vlan_rx_kill_vid;
 
         /*
          * will use eth_mac_addr() for  dev->set_mac_address
diff --git a/drivers/net/skfp/smt.c b/drivers/net/skfp/smt.c
index fe847800acdc..75afc1f07ba0 100644
--- a/drivers/net/skfp/smt.c
+++ b/drivers/net/skfp/smt.c
@@ -1748,7 +1748,7 @@ char *addr_to_string(struct fddi_addr *addr)
 #endif
 
 #ifdef  AM29K
-smt_ifconfig(int argc, char *argv[])
+int smt_ifconfig(int argc, char *argv[])
 {
         if (argc >= 2 && !strcmp(argv[0],"opt_bypass") &&
             !strcmp(argv[1],"yes")) {
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index adfbe81693a6..fe01b961b597 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1049,26 +1049,22 @@ static void sky2_vlan_rx_register(struct net_device *dev, struct vlan_group *grp
         u16 port = sky2->port;
 
         netif_tx_lock_bh(dev);
+        netif_poll_disable(sky2->hw->dev[0]);
 
-        sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T), RX_VLAN_STRIP_ON);
-        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T), TX_VLAN_TAG_ON);
         sky2->vlgrp = grp;
+        if (grp) {
+                sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T),
+                             RX_VLAN_STRIP_ON);
+                sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                             TX_VLAN_TAG_ON);
+        } else {
+                sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T),
+                             RX_VLAN_STRIP_OFF);
+                sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T),
+                             TX_VLAN_TAG_OFF);
+        }
 
-        netif_tx_unlock_bh(dev);
-}
-
-static void sky2_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct sky2_port *sky2 = netdev_priv(dev);
-        struct sky2_hw *hw = sky2->hw;
-        u16 port = sky2->port;
-
-        netif_tx_lock_bh(dev);
-
-        sky2_write32(hw, SK_REG(port, RX_GMF_CTRL_T), RX_VLAN_STRIP_OFF);
-        sky2_write32(hw, SK_REG(port, TX_GMF_CTRL_T), TX_VLAN_TAG_OFF);
-        vlan_group_set_device(sky2->vlgrp, vid, NULL);
-
+        netif_poll_enable(sky2->hw->dev[0]);
         netif_tx_unlock_bh(dev);
 }
 #endif
@@ -3484,7 +3480,6 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
 #ifdef SKY2_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register = sky2_vlan_rx_register;
-        dev->vlan_rx_kill_vid = sky2_vlan_rx_kill_vid;
 #endif
 
         /* read the mac address */
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 111f23d05764..506bffcbc6dc 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -281,17 +281,14 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 
 #elif   defined(CONFIG_SUPERH)
 
-#if defined(CONFIG_SH_7780_SOLUTION_ENGINE) || defined(CONFIG_SH_7722_SOLUTION_ENGINE)
+#ifdef CONFIG_SOLUTION_ENGINE
 #define SMC_CAN_USE_8BIT       0
 #define SMC_CAN_USE_16BIT      1
 #define SMC_CAN_USE_32BIT      0
 #define SMC_IO_SHIFT           0
 #define SMC_NOWAIT             1
 
-#define SMC_inb(a, r)          (inw((a) + ((r)&~1)) >> (8*(r%2)))&0xff
 #define SMC_inw(a, r)          inw((a) + (r))
-#define SMC_outb(v, a, r)      outw(((inw((a)+((r)&~1))*(0xff<<8*(r%2)))) | ((v)<<(8*(r&2)))), (a) + ((r)&~1))
-
 #define SMC_outw(v, a, r)      outw(v, (a) + (r))
 #define SMC_insw(a, r, p, l)   insw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)  outsw((a) + (r), p, l)
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index ef84d7c757a0..b47ad1df2e0c 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -1191,43 +1191,6 @@ spider_net_poll(struct net_device *netdev, int *budget)
 }
 
 /**
- * spider_net_vlan_rx_reg - initializes VLAN structures in the driver and card
- * @netdev: interface device structure
- * @grp: vlan_group structure that is registered (NULL on destroying interface)
- */
-static void
-spider_net_vlan_rx_reg(struct net_device *netdev, struct vlan_group *grp)
-{
-        /* further enhancement... yet to do */
-        return;
-}
-
-/**
- * spider_net_vlan_rx_add - adds VLAN id to the card filter
- * @netdev: interface device structure
- * @vid: VLAN id to add
- */
-static void
-spider_net_vlan_rx_add(struct net_device *netdev, uint16_t vid)
-{
-        /* further enhancement... yet to do */
-        /* add vid to card's VLAN filter table */
-        return;
-}
-
-/**
- * spider_net_vlan_rx_kill - removes VLAN id to the card filter
- * @netdev: interface device structure
- * @vid: VLAN id to remove
- */
-static void
-spider_net_vlan_rx_kill(struct net_device *netdev, uint16_t vid)
-{
-        /* further enhancement... yet to do */
-        /* remove vid from card's VLAN filter table */
-}
-
-/**
  * spider_net_get_stats - get interface statistics
  * @netdev: interface device structure
  *
@@ -2177,9 +2140,6 @@ spider_net_setup_netdev_ops(struct net_device *netdev)
         netdev->poll = &spider_net_poll;
         netdev->weight = SPIDER_NET_NAPI_WEIGHT;
         /* HW VLAN */
-        netdev->vlan_rx_register = &spider_net_vlan_rx_reg;
-        netdev->vlan_rx_add_vid = &spider_net_vlan_rx_add;
-        netdev->vlan_rx_kill_vid = &spider_net_vlan_rx_kill;
 #ifdef CONFIG_NET_POLL_CONTROLLER
         /* poll controller */
         netdev->poll_controller = &spider_net_poll_controller;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 923b9c725cc3..2f3184184ad9 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.76"
-#define DRV_MODULE_RELDATE      "May 5, 2007"
+#define DRV_MODULE_VERSION      "3.77"
+#define DRV_MODULE_RELDATE      "May 31, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -9121,21 +9121,6 @@ static void tg3_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
         if (netif_running(dev))
                 tg3_netif_start(tp);
 }
-
-static void tg3_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct tg3 *tp = netdev_priv(dev);
-
-        if (netif_running(dev))
-                tg3_netif_stop(tp);
-
-        tg3_full_lock(tp, 0);
-        vlan_group_set_device(tp->vlgrp, vid, NULL);
-        tg3_full_unlock(tp);
-
-        if (netif_running(dev))
-                tg3_netif_start(tp);
-}
 #endif
 
 static int tg3_get_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
@@ -10976,6 +10961,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
          * upon subsystem IDs.
          */
         if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 &&
             !(tp->tg3_flags2 & TG3_FLG2_PHY_SERDES)) {
                 tp->tg3_flags |= (TG3_FLAG_USE_MI_INTERRUPT |
                                   TG3_FLAG_USE_LINKCHG_REG);
@@ -11778,7 +11764,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 #if TG3_VLAN_TAG_USED
         dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
         dev->vlan_rx_register = tg3_vlan_rx_register;
-        dev->vlan_rx_kill_vid = tg3_vlan_rx_kill_vid;
 #endif
 
         tp = netdev_priv(dev);
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index f72573594121..15b2fb8aa492 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -741,15 +741,6 @@ typhoon_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
         spin_unlock_bh(&tp->state_lock);
 }
 
-static void
-typhoon_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
-{
-        struct typhoon *tp = netdev_priv(dev);
-        spin_lock_bh(&tp->state_lock);
-        vlan_group_set_device(tp->vlgrp, vid, NULL);
-        spin_unlock_bh(&tp->state_lock);
-}
-
 static inline void
 typhoon_tso_fill(struct sk_buff *skb, struct transmit_ring *txRing,
                         u32 ring_dma)
@@ -2542,7 +2533,7 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->get_stats          = typhoon_get_stats;
         dev->set_mac_address    = typhoon_set_mac_address;
         dev->vlan_rx_register   = typhoon_vlan_rx_register;
-        dev->vlan_rx_kill_vid   = typhoon_vlan_rx_kill_vid;
+
         SET_ETHTOOL_OPS(dev, &typhoon_ethtool_ops);
 
         /* We can handle scatter gather, up to 16 entries, and
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index d9cbd586ae4b..be1df85e5e2d 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -15,10 +15,10 @@
 #include <linux/pci.h>
 #include <linux/proc_fs.h>
 #include <linux/msi.h>
+#include <linux/smp.h>
 
 #include <asm/errno.h>
 #include <asm/io.h>
-#include <asm/smp.h>
 
 #include "pci.h"
 #include "msi.h"
@@ -333,7 +333,7 @@ static int msi_capability_init(struct pci_dev *dev)
                         msi_mask_bits_reg(pos, is_64bit_address(control)),
                         maskbits);
         }
-        list_add(&entry->list, &dev->msi_list);
+        list_add_tail(&entry->list, &dev->msi_list);
 
         /* Configure MSI capability structure */
         ret = arch_setup_msi_irqs(dev, 1, PCI_CAP_ID_MSI);
@@ -404,7 +404,7 @@ static int msix_capability_init(struct pci_dev *dev,
                 entry->dev = dev;
                 entry->mask_base = base;
 
-                list_add(&entry->list, &dev->msi_list);
+                list_add_tail(&entry->list, &dev->msi_list);
         }
 
         ret = arch_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSIX);
@@ -558,12 +558,12 @@ static int msi_free_irqs(struct pci_dev* dev)
 
         list_for_each_entry_safe(entry, tmp, &dev->msi_list, list) {
                 if (entry->msi_attrib.type == PCI_CAP_ID_MSIX) {
-                        if (list_is_last(&entry->list, &dev->msi_list))
-                                iounmap(entry->mask_base);
-
                         writel(1, entry->mask_base + entry->msi_attrib.entry_nr
                                   * PCI_MSIX_ENTRY_SIZE
                                   + PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+
+                        if (list_is_last(&entry->list, &dev->msi_list))
+                                iounmap(entry->mask_base);
                 }
                 list_del(&entry->list);
                 kfree(entry);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 6ccc2e95930a..01d8f8a8843c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1625,18 +1625,22 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_NVIDIA,  PCI_DEVICE_ID_NVIDIA_CK804_PCIE,
                         quirk_nvidia_ck804_pcie_aer_ext_cap);
 
 #ifdef CONFIG_PCI_MSI
-/* The Serverworks PCI-X chipset does not support MSI. We cannot easily rely
- * on setting PCI_BUS_FLAGS_NO_MSI in its bus flags because there are actually
- * some other busses controlled by the chipset even if Linux is not aware of it.
- * Instead of setting the flag on all busses in the machine, simply disable MSI
- * globally.
+/* Some chipsets do not support MSI. We cannot easily rely on setting
+ * PCI_BUS_FLAGS_NO_MSI in its bus flags because there are actually
+ * some other busses controlled by the chipset even if Linux is not
+ * aware of it.  Instead of setting the flag on all busses in the
+ * machine, simply disable MSI globally.
  */
-static void __init quirk_svw_msi(struct pci_dev *dev)
+static void __init quirk_disable_all_msi(struct pci_dev *dev)
 {
         pci_no_msi();
         printk(KERN_WARNING "PCI: MSI quirk detected. MSI deactivated.\n");
 }
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_GCNB_LE, quirk_svw_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_GCNB_LE, quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT1000_PCIX, quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, quirk_disable_all_msi);
 
 /* Disable MSI on chipsets that are known to not support it */
 static void __devinit quirk_disable_msi(struct pci_dev *dev)
@@ -1649,8 +1653,6 @@ static void __devinit quirk_disable_msi(struct pci_dev *dev)
         }
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, quirk_disable_msi);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, quirk_disable_msi);
 
 /* Go through the list of Hypertransport capabilities and
  * return 1 if a HT MSI capability is found and enabled */
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index b137a27472c7..c13232435dc0 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -403,10 +403,11 @@ const struct pci_device_id *pci_find_present(const struct pci_device_id *ids)
         while (ids->vendor || ids->subvendor || ids->class_mask) {
                 list_for_each_entry(dev, &pci_devices, global_list) {
                         if ((found = pci_match_one_device(ids, dev)) != NULL)
-                                break;
+                                goto exit;
                 }
                 ids++;
         }
+exit:
         up_read(&pci_bus_sem);
         return found;
 }
diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
index 948efc775a78..eb6abd3f9221 100644
--- a/drivers/pcmcia/at91_cf.c
+++ b/drivers/pcmcia/at91_cf.c
@@ -336,16 +336,21 @@ static int at91_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
                 enable_irq_wake(board->det_pin);
                 if (board->irq_pin)
                         enable_irq_wake(board->irq_pin);
-        } else {
-                disable_irq_wake(board->det_pin);
-                if (board->irq_pin)
-                        disable_irq_wake(board->irq_pin);
         }
         return 0;
 }
 
 static int at91_cf_resume(struct platform_device *pdev)
 {
+        struct at91_cf_socket   *cf = platform_get_drvdata(pdev);
+        struct at91_cf_data     *board = cf->board;
+
+        if (device_may_wakeup(&pdev->dev)) {
+                disable_irq_wake(board->det_pin);
+                if (board->irq_pin)
+                        disable_irq_wake(board->irq_pin);
+        }
+
         pcmcia_socket_dev_resume(&pdev->dev);
         return 0;
 }
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 6085261aa2c1..e24ea82dc35b 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -641,9 +641,16 @@ cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id)
          * drivers can't provide shutdown() methods to disable IRQs.
          * Or better yet, fix PNP to allow those methods...
          */
-        return cmos_do_probe(&pnp->dev,
-                        &pnp->res.port_resource[0],
-                        pnp->res.irq_resource[0].start);
+        if (pnp_port_start(pnp,0) == 0x70 && !pnp_irq_valid(pnp,0))
+                /* Some machines contain a PNP entry for the RTC, but
+                 * don't define the IRQ. It should always be safe to
+                 * hardcode it in these cases
+                 */
+                return cmos_do_probe(&pnp->dev, &pnp->res.port_resource[0], 8);
+        else
+                return cmos_do_probe(&pnp->dev,
+                                     &pnp->res.port_resource[0],
+                                     pnp->res.irq_resource[0].start);
 }
 
 static void __exit cmos_pnp_remove(struct pnp_dev *pnp)
diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
index a1dc8c466ec9..0c081a664ee8 100644
--- a/drivers/s390/block/dasd_eer.c
+++ b/drivers/s390/block/dasd_eer.c
@@ -14,9 +14,9 @@
 #include <linux/moduleparam.h>
 #include <linux/device.h>
 #include <linux/poll.h>
+#include <linux/mutex.h>
 
 #include <asm/uaccess.h>
-#include <asm/semaphore.h>
 #include <asm/atomic.h>
 #include <asm/ebcdic.h>
 
@@ -514,7 +514,7 @@ void dasd_eer_disable(struct dasd_device *device)
  * to transfer in a readbuffer, which is protected by the readbuffer_mutex.
  */
 static char readbuffer[PAGE_SIZE];
-static DECLARE_MUTEX(readbuffer_mutex);
+static DEFINE_MUTEX(readbuffer_mutex);
 
 static int dasd_eer_open(struct inode *inp, struct file *filp)
 {
@@ -579,7 +579,7 @@ static ssize_t dasd_eer_read(struct file *filp, char __user *buf,
         struct eerbuffer *eerb;
 
         eerb = (struct eerbuffer *) filp->private_data;
-        if (down_interruptible(&readbuffer_mutex))
+        if (mutex_lock_interruptible(&readbuffer_mutex))
                 return -ERESTARTSYS;
 
         spin_lock_irqsave(&bufferlock, flags);
@@ -588,7 +588,7 @@ static ssize_t dasd_eer_read(struct file *filp, char __user *buf,
                                   /* has been deleted             */
                 eerb->residual = 0;
                 spin_unlock_irqrestore(&bufferlock, flags);
-                up(&readbuffer_mutex);
+                mutex_unlock(&readbuffer_mutex);
                 return -EIO;
         } else if (eerb->residual > 0) {
                 /* OK we still have a second half of a record to deliver */
@@ -602,7 +602,7 @@ static ssize_t dasd_eer_read(struct file *filp, char __user *buf,
                         if (!tc) {
                                 /* no data available */
                                 spin_unlock_irqrestore(&bufferlock, flags);
-                                up(&readbuffer_mutex);
+                                mutex_unlock(&readbuffer_mutex);
                                 if (filp->f_flags & O_NONBLOCK)
                                         return -EAGAIN;
                                 rc = wait_event_interruptible(
@@ -610,7 +610,7 @@ static ssize_t dasd_eer_read(struct file *filp, char __user *buf,
                                         eerb->head != eerb->tail);
                                 if (rc)
                                         return rc;
-                                if (down_interruptible(&readbuffer_mutex))
+                                if (mutex_lock_interruptible(&readbuffer_mutex))
                                         return -ERESTARTSYS;
                                 spin_lock_irqsave(&bufferlock, flags);
                         }
@@ -626,11 +626,11 @@ static ssize_t dasd_eer_read(struct file *filp, char __user *buf,
         spin_unlock_irqrestore(&bufferlock, flags);
 
         if (copy_to_user(buf, readbuffer, effective_count)) {
-                up(&readbuffer_mutex);
+                mutex_unlock(&readbuffer_mutex);
                 return -EFAULT;
         }
 
-        up(&readbuffer_mutex);
+        mutex_unlock(&readbuffer_mutex);
         return effective_count;
 }
 
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index f6ef90ee3e7d..743944ad61ec 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -487,7 +487,7 @@ struct raw3270_ua {	/* Query Reply structure for Usable Area */
 } __attribute__ ((packed));
 
 static struct diag210 raw3270_init_diag210;
-static DECLARE_MUTEX(raw3270_init_sem);
+static DEFINE_MUTEX(raw3270_init_mutex);
 
 static int
 raw3270_init_irq(struct raw3270_view *view, struct raw3270_request *rq,
@@ -713,7 +713,7 @@ raw3270_size_device(struct raw3270 *rp)
 {
         int rc;
 
-        down(&raw3270_init_sem);
+        mutex_lock(&raw3270_init_mutex);
         rp->view = &raw3270_init_view;
         raw3270_init_view.dev = rp;
         if (MACHINE_IS_VM)
@@ -722,7 +722,7 @@ raw3270_size_device(struct raw3270 *rp)
                 rc = __raw3270_size_device(rp);
         raw3270_init_view.dev = NULL;
         rp->view = NULL;
-        up(&raw3270_init_sem);
+        mutex_unlock(&raw3270_init_mutex);
         if (rc == 0) {  /* Found something. */
                 /* Try to find a model. */
                 rp->model = 0;
@@ -749,7 +749,7 @@ raw3270_reset_device(struct raw3270 *rp)
 {
         int rc;
 
-        down(&raw3270_init_sem);
+        mutex_lock(&raw3270_init_mutex);
         memset(&rp->init_request, 0, sizeof(rp->init_request));
         memset(&rp->init_data, 0, sizeof(rp->init_data));
         /* Store reset data stream to init_data/init_request */
@@ -764,7 +764,7 @@ raw3270_reset_device(struct raw3270 *rp)
         rc = raw3270_start_init(rp, &raw3270_init_view, &rp->init_request);
         raw3270_init_view.dev = NULL;
         rp->view = NULL;
-        up(&raw3270_init_sem);
+        mutex_unlock(&raw3270_init_mutex);
         return rc;
 }
 
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index a8b373f69cf0..6b264bdb5bfb 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -296,30 +296,57 @@ static void ccw_device_unregister(struct ccw_device *cdev)
                 device_del(&cdev->dev);
 }
 
+static void ccw_device_remove_orphan_cb(struct device *dev)
+{
+        struct ccw_device *cdev = to_ccwdev(dev);
+
+        ccw_device_unregister(cdev);
+        put_device(&cdev->dev);
+}
+
+static void ccw_device_remove_sch_cb(struct device *dev)
+{
+        struct subchannel *sch;
+
+        sch = to_subchannel(dev);
+        css_sch_device_unregister(sch);
+        /* Reset intparm to zeroes. */
+        sch->schib.pmcw.intparm = 0;
+        cio_modify(sch);
+        put_device(&sch->dev);
+}
+
 static void
 ccw_device_remove_disconnected(struct ccw_device *cdev)
 {
-        struct subchannel *sch;
         unsigned long flags;
+        int rc;
+
         /*
          * Forced offline in disconnected state means
          * 'throw away device'.
          */
         if (ccw_device_is_orphan(cdev)) {
-                /* Deregister ccw device. */
+                /*
+                 * Deregister ccw device.
+                 * Unfortunately, we cannot do this directly from the
+                 * attribute method.
+                 */
                 spin_lock_irqsave(cdev->ccwlock, flags);
                 cdev->private->state = DEV_STATE_NOT_OPER;
                 spin_unlock_irqrestore(cdev->ccwlock, flags);
-                ccw_device_unregister(cdev);
-                put_device(&cdev->dev);
-                return ;
+                rc = device_schedule_callback(&cdev->dev,
+                                              ccw_device_remove_orphan_cb);
+                if (rc)
+                        dev_info(&cdev->dev, "Couldn't unregister orphan\n");
+                return;
         }
-        sch = to_subchannel(cdev->dev.parent);
-        css_sch_device_unregister(sch);
-        /* Reset intparm to zeroes. */
-        sch->schib.pmcw.intparm = 0;
-        cio_modify(sch);
-        put_device(&sch->dev);
+        /* Deregister subchannel, which will kill the ccw device. */
+        rc = device_schedule_callback(cdev->dev.parent,
+                                      ccw_device_remove_sch_cb);
+        if (rc)
+                dev_info(&cdev->dev,
+                         "Couldn't unregister disconnected device\n");
 }
 
 int
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 898ec3b2bebb..6bba80929577 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -688,6 +688,12 @@ ccw_device_disband_done(struct ccw_device *cdev, int err)
                 ccw_device_done(cdev, DEV_STATE_BOXED);
                 break;
         default:
+                cdev->private->flags.donotify = 0;
+                if (get_device(&cdev->dev)) {
+                        PREPARE_WORK(&cdev->private->kick_work,
+                                     ccw_device_call_sch_unregister);
+                        queue_work(ccw_device_work, &cdev->private->kick_work);
+                }
                 ccw_device_done(cdev, DEV_STATE_NOT_OPER);
                 break;
         }
diff --git a/drivers/sbus/char/flash.c b/drivers/sbus/char/flash.c
index 262f01e68592..44e039865aa9 100644
--- a/drivers/sbus/char/flash.c
+++ b/drivers/sbus/char/flash.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/smp_lock.h>
 #include <linux/spinlock.h>
+#include <linux/mm.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 572034ceb143..2b2f5c12019b 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1532,6 +1532,7 @@ source "drivers/scsi/arm/Kconfig"
 config JAZZ_ESP
         bool "MIPS JAZZ FAS216 SCSI support"
         depends on MACH_JAZZ && SCSI
+        select SCSI_SPI_ATTRS
         help
           This is the driver for the onboard SCSI host adapter of MIPS Magnum
           4000, Acer PICA, Olivetti M700-10 and a few other identical OEM
@@ -1756,6 +1757,7 @@ config SUN3X_ESP
 config SCSI_SUNESP
         tristate "Sparc ESP Scsi Driver"
         depends on SBUS && SCSI
+        select SCSI_SPI_ATTRS
         help
           This is the driver for the Sun ESP SCSI host adapter. The ESP
           chipset is present in most SPARC SBUS-based computers.
diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
index bb3cb3360541..88ea5a1fb606 100644
--- a/drivers/scsi/NCR5380.c
+++ b/drivers/scsi/NCR5380.c
@@ -2625,7 +2625,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance) {
 #ifdef REAL_DMA
 static void NCR5380_dma_complete(NCR5380_instance * instance) {
         NCR5380_local_declare();
-        struct NCR5380_hostdata *hostdata = (struct NCR5380_hostdata * instance->hostdata);
+        struct NCR5380_hostdata *hostdata = (struct NCR5380_hostdata *) instance->hostdata;
         int transferred;
         NCR5380_setup(instance);
 
diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 350ea7feb61d..5c487ff096c7 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -863,6 +863,14 @@ static struct scsi_host_template aac_driver_template = {
         .emulated                       = 1,
 };
 
+static void __aac_shutdown(struct aac_dev * aac)
+{
+        kthread_stop(aac->thread);
+        aac_send_shutdown(aac);
+        aac_adapter_disable_int(aac);
+        free_irq(aac->pdev->irq, aac);
+}
+
 static int __devinit aac_probe_one(struct pci_dev *pdev,
                 const struct pci_device_id *id)
 {
@@ -1015,10 +1023,7 @@ static int __devinit aac_probe_one(struct pci_dev *pdev,
         return 0;
 
  out_deinit:
-        kthread_stop(aac->thread);
-        aac_send_shutdown(aac);
-        aac_adapter_disable_int(aac);
-        free_irq(pdev->irq, aac);
+        __aac_shutdown(aac);
  out_unmap:
         aac_fib_map_free(aac);
         pci_free_consistent(aac->pdev, aac->comm_size, aac->comm_addr, aac->comm_phys);
@@ -1038,7 +1043,8 @@ static void aac_shutdown(struct pci_dev *dev)
 {
         struct Scsi_Host *shost = pci_get_drvdata(dev);
         struct aac_dev *aac = (struct aac_dev *)shost->hostdata;
-        aac_send_shutdown(aac);
+        scsi_block_requests(shost);
+        __aac_shutdown(aac);
 }
 
 static void __devexit aac_remove_one(struct pci_dev *pdev)
@@ -1048,16 +1054,12 @@ static void __devexit aac_remove_one(struct pci_dev *pdev)
 
         scsi_remove_host(shost);
 
-        kthread_stop(aac->thread);
-
-        aac_send_shutdown(aac);
-        aac_adapter_disable_int(aac);
+        __aac_shutdown(aac);
         aac_fib_map_free(aac);
         pci_free_consistent(aac->pdev, aac->comm_size, aac->comm_addr,
                         aac->comm_phys);
         kfree(aac->queues);
 
-        free_irq(pdev->irq, aac);
         aac_adapter_ioremap(aac, 0);
         
         kfree(aac->fibs);
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 9ddc6e4a74b0..05f692bd0adc 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -5180,7 +5180,7 @@ ahd_handle_devreset(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
                         cur_lun = lun;
                         max_lun = lun;
                 }
-                for (cur_lun <= max_lun; cur_lun++) {
+                for (;cur_lun <= max_lun; cur_lun++) {
                         struct ahd_tmode_lstate* lstate;
 
                         lstate = tstate->enabled_luns[cur_lun];
diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
index eff846ae0aff..03dbe60c264a 100644
--- a/drivers/scsi/atari_NCR5380.c
+++ b/drivers/scsi/atari_NCR5380.c
@@ -894,45 +894,6 @@ static int NCR5380_init(struct Scsi_Host *instance, int flags)
 }
 
 /*
- * our own old-style timeout update
- */
-/*
- * The strategy is to cause the timer code to call scsi_times_out()
- * when the soonest timeout is pending.
- * The arguments are used when we are queueing a new command, because
- * we do not want to subtract the time used from this time, but when we
- * set the timer, we want to take this value into account.
- */
-
-int atari_scsi_update_timeout(Scsi_Cmnd * SCset, int timeout)
-{
-        int rtn;
-
-        /*
-         * We are using the new error handling code to actually register/deregister
-         * timers for timeout.
-         */
-
-        if (!timer_pending(&SCset->eh_timeout))
-                rtn = 0;
-        else
-                rtn = SCset->eh_timeout.expires - jiffies;
-
-        if (timeout == 0) {
-                del_timer(&SCset->eh_timeout);
-                SCset->eh_timeout.data = (unsigned long)NULL;
-                SCset->eh_timeout.expires = 0;
-        } else {
-                if (SCset->eh_timeout.data != (unsigned long)NULL)
-                        del_timer(&SCset->eh_timeout);
-                SCset->eh_timeout.data = (unsigned long)SCset;
-                SCset->eh_timeout.expires = jiffies + timeout;
-                add_timer(&SCset->eh_timeout);
-        }
-        return rtn;
-}
-
-/*
  * Function : int NCR5380_queue_command (Scsi_Cmnd *cmd,
  *      void (*done)(Scsi_Cmnd *))
  *
@@ -956,7 +917,6 @@ static int NCR5380_queue_command(Scsi_Cmnd *cmd, void (*done)(Scsi_Cmnd *))
         Scsi_Cmnd *tmp;
         int oldto;
         unsigned long flags;
-        // extern int update_timeout(Scsi_Cmnd * SCset, int timeout);
 
 #if (NDEBUG & NDEBUG_NO_WRITE)
         switch (cmd->cmnd[0]) {
@@ -1029,9 +989,9 @@ static int NCR5380_queue_command(Scsi_Cmnd *cmd, void (*done)(Scsi_Cmnd *))
          * alter queues and touch the lock.
          */
         if (!IS_A_TT()) {
-                oldto = atari_scsi_update_timeout(cmd, 0);
+                /* perhaps stop command timer here */
                 falcon_get_lock();
-                atari_scsi_update_timeout(cmd, oldto);
+                /* perhaps restart command timer here */
         }
         if (!(hostdata->issue_queue) || (cmd->cmnd[0] == REQUEST_SENSE)) {
                 LIST(cmd, hostdata->issue_queue);
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index dd076da86a46..b98136adaaae 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2590,7 +2590,7 @@ qla2x00_down_timeout(struct semaphore *sema, unsigned long timeout)
                         return 0;
                 if (msleep_interruptible(step))
                         break;
-        } while (--iterations >= 0);
+        } while (--iterations > 0);
 
         return -ETIMEDOUT;
 }
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index a67f315244d7..662577fbe7a8 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -184,6 +184,15 @@ int scsi_complete_async_scans(void)
 /* Only exported for the benefit of scsi_wait_scan */
 EXPORT_SYMBOL_GPL(scsi_complete_async_scans);
 
+#ifndef MODULE
+/*
+ * For async scanning we need to wait for all the scans to complete before
+ * trying to mount the root fs.  Otherwise non-modular drivers may not be ready
+ * yet.
+ */
+late_initcall(scsi_complete_async_scans);
+#endif
+
 /**
  * scsi_unlock_floptical - unlock device via a special MODE SENSE command
  * @sdev:       scsi device to send command to
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 00d1255e4c12..e88da72f8304 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -167,9 +167,9 @@ static void pl010_rx_chars(struct uart_amba_port *uap)
         ignore_char:
                 status = readb(uap->port.membase + UART01x_FR);
         }
-        spin_unlock(&port->lock);
+        spin_unlock(&uap->port.lock);
         tty_flip_buffer_push(tty);
-        spin_lock(&port->lock);
+        spin_lock(&uap->port.lock);
 }
 
 static void pl010_tx_chars(struct uart_amba_port *uap)
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
index 1d8a2f6bb8eb..8b2601de3630 100644
--- a/drivers/spi/atmel_spi.c
+++ b/drivers/spi/atmel_spi.c
@@ -113,16 +113,16 @@ static void atmel_spi_next_xfer(struct spi_master *master,
 
         len = as->remaining_bytes;
 
-        tx_dma = xfer->tx_dma;
-        rx_dma = xfer->rx_dma;
+        tx_dma = xfer->tx_dma + xfer->len - len;
+        rx_dma = xfer->rx_dma + xfer->len - len;
 
         /* use scratch buffer only when rx or tx data is unspecified */
-        if (rx_dma == INVALID_DMA_ADDRESS) {
+        if (!xfer->rx_buf) {
                 rx_dma = as->buffer_dma;
                 if (len > BUFFER_SIZE)
                         len = BUFFER_SIZE;
         }
-        if (tx_dma == INVALID_DMA_ADDRESS) {
+        if (!xfer->tx_buf) {
                 tx_dma = as->buffer_dma;
                 if (len > BUFFER_SIZE)
                         len = BUFFER_SIZE;
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index c3219b29b5ac..4831edbae2d5 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -411,7 +411,7 @@ EXPORT_SYMBOL_GPL(spi_alloc_master);
  */
 int spi_register_master(struct spi_master *master)
 {
-        static atomic_t         dyn_bus_id = ATOMIC_INIT((1<<16) - 1);
+        static atomic_t         dyn_bus_id = ATOMIC_INIT((1<<15) - 1);
         struct device           *dev = master->cdev.dev;
         int                     status = -ENODEV;
         int                     dynamic = 0;
diff --git a/drivers/spi/spi_imx.c b/drivers/spi/spi_imx.c
index 51daa212c6b7..656be4a5094a 100644
--- a/drivers/spi/spi_imx.c
+++ b/drivers/spi/spi_imx.c
@@ -121,7 +121,7 @@
                                                         32.768 KHz Clock */
 
 /* SPI DMA Register Bit Fields & Masks */
-#define SPI_DMA_RHDMA   (0xF << 4)      /* RXFIFO Half Status */
+#define SPI_DMA_RHDMA   (0x1 << 4)      /* RXFIFO Half Status */
 #define SPI_DMA_RFDMA   (0x1 << 5)      /* RXFIFO Full Status */
 #define SPI_DMA_TEDMA   (0x1 << 6)      /* TXFIFO Empty Status */
 #define SPI_DMA_THDMA   (0x1 << 7)      /* TXFIFO Half Status */
@@ -1355,6 +1355,7 @@ static int setup(struct spi_device *spi)
                 spi->bits_per_word,
                 spi_speed_hz(SPI_CONTROL_DATARATE_MIN),
                 spi->max_speed_hz);
+        return status;
 
 err_first_setup:
         kfree(chip);
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 6e1f1ea21b38..403dac787ebf 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -755,7 +755,7 @@ config FB_LEO
 
 config FB_IGA
         bool "IGA 168x display support"
-        depends on FB && SPARC32
+        depends on (FB = y) && SPARC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -765,7 +765,7 @@ config FB_IGA
 
 config FB_XVR500
         bool "Sun XVR-500 3DLABS Wildcat support"
-        depends on FB && PCI && SPARC64
+        depends on (FB = y) && PCI && SPARC64
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
@@ -778,7 +778,7 @@ config FB_XVR500
 
 config FB_XVR2500
         bool "Sun XVR-2500 3DLABS Wildcat support"
-        depends on FB && PCI && SPARC64
+        depends on (FB = y) && PCI && SPARC64
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c
index ba6fede5c466..8a1b07c74394 100644
--- a/drivers/video/arkfb.c
+++ b/drivers/video/arkfb.c
@@ -1055,9 +1055,10 @@ err_enable_device:
 static void __devexit ark_pci_remove(struct pci_dev *dev)
 {
         struct fb_info *info = pci_get_drvdata(dev);
-        struct arkfb_info *par = info->par;
 
         if (info) {
+                struct arkfb_info *par = info->par;
+
 #ifdef CONFIG_MTRR
                 if (par->mtrr_reg >= 0) {
                         mtrr_del(par->mtrr_reg, 0, 0);
diff --git a/drivers/video/console/Makefile b/drivers/video/console/Makefile
index 9b26dda18a38..ac46cc3f6a2a 100644
--- a/drivers/video/console/Makefile
+++ b/drivers/video/console/Makefile
@@ -47,7 +47,7 @@ targets := promcon_tbl.c
 quiet_cmd_conmakehash = CNMKHSH $@
       cmd_conmakehash = scripts/conmakehash $< | \
                 sed -e '/\#include <[^>]*>/p' -e 's/types/init/' \
-                -e 's/dfont\(_uni.*\]\)/promfont\1 __initdata/' > $@
+                -e 's/dfont\(_uni.*\]\)/promfont\1 /' > $@
 
 $(obj)/promcon_tbl.c: $(src)/prom.uni
         $(call cmd,conmakehash)
diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
index 71f24e00fcd0..8e6ef4bc7a5c 100644
--- a/drivers/video/console/fbcon.h
+++ b/drivers/video/console/fbcon.h
@@ -176,7 +176,6 @@ extern void fbcon_set_tileops(struct vc_data *vc, struct fb_info *info);
 #endif
 extern void fbcon_set_bitops(struct fbcon_ops *ops);
 extern int  soft_cursor(struct fb_info *info, struct fb_cursor *cursor);
-extern struct class *fb_class;
 
 #define FBCON_ATTRIBUTE_UNDERLINE 1
 #define FBCON_ATTRIBUTE_REVERSE   2
diff --git a/drivers/video/ffb.c b/drivers/video/ffb.c
index 1d4e8354b561..3f6c98fad437 100644
--- a/drivers/video/ffb.c
+++ b/drivers/video/ffb.c
@@ -656,7 +656,7 @@ static int ffb_setcolreg(unsigned regno,
 {
         u32 value;
 
-        if (regno >= 256)
+        if (regno >= 16)
                 return 1;
 
         red >>= 8;
@@ -903,7 +903,7 @@ ffb_init_fix(struct fb_info *info)
 struct all_info {
         struct fb_info info;
         struct ffb_par par;
-        u32 pseudo_palette[256];
+        u32 pseudo_palette[16];
 };
 
 static int ffb_init_one(struct of_device *op)
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index bd30aba242d0..731d7a5c5aa2 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -1286,34 +1286,36 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
         if (regno >= fb->cmap.len || regno > 255)
                 return -EINVAL;
 
-        switch (fb->var.bits_per_pixel) {
-        case 8:
+        if (fb->var.bits_per_pixel <= 8) {
                 outb(regno, 0x3c8);
 
                 outb(red >> 10, 0x3c9);
                 outb(green >> 10, 0x3c9);
                 outb(blue >> 10, 0x3c9);
-                break;
-        case 16:
-                ((u32 *) fb->pseudo_palette)[regno] =
+        } else if (regno < 16) {
+                switch (fb->var.bits_per_pixel) {
+                case 16:
+                        ((u32 *) fb->pseudo_palette)[regno] =
                                 ((red & 0xf800)) | ((green & 0xfc00) >> 5) |
                                 ((blue & 0xf800) >> 11);
-                break;
-        case 24:
-                ((u32 *) fb->pseudo_palette)[regno] =
+                        break;
+                case 24:
+                        ((u32 *) fb->pseudo_palette)[regno] =
                                 ((red & 0xff00) << 8) | ((green & 0xff00)) |
                                 ((blue & 0xff00) >> 8);
-                break;
+                        break;
 #ifdef NO_32BIT_SUPPORT_YET
-        case 32:
-                ((u32 *) fb->pseudo_palette)[regno] =
+                case 32:
+                        ((u32 *) fb->pseudo_palette)[regno] =
                                 ((transp & 0xff00) << 16) | ((red & 0xff00) << 8) |
                                 ((green & 0xff00)) | ((blue & 0xff00) >> 8);
-                break;
+                        break;
 #endif
-        default:
-                return 1;
+                default:
+                        return 1;
+                }
         }
+
         return 0;
 }
 
diff --git a/drivers/video/pm3fb.c b/drivers/video/pm3fb.c
index 616a0c08e30c..b52e883f0a52 100644
--- a/drivers/video/pm3fb.c
+++ b/drivers/video/pm3fb.c
@@ -498,7 +498,7 @@ static int pm3fb_set_par(struct fb_info *info)
         else
                 par->video |= PM3VideoControl_LINE_DOUBLE_OFF;
 
-        if (info->var.activate == FB_ACTIVATE_NOW)
+        if ((info->var.activate & FB_ACTIVATE_MASK) == FB_ACTIVATE_NOW)
                 par->video |= PM3VideoControl_ENABLE;
         else {
                 par->video |= PM3VideoControl_DISABLE;
diff --git a/drivers/video/skeletonfb.c b/drivers/video/skeletonfb.c
index 836a612af977..64779e70408f 100644
--- a/drivers/video/skeletonfb.c
+++ b/drivers/video/skeletonfb.c
@@ -132,7 +132,6 @@ static struct fb_info info;
 static struct xxx_par __initdata current_par;
 
 int xxxfb_init(void);
-int xxxfb_setup(char*);
 
 /**
  *      xxxfb_open - Optional function. Called when the framebuffer is
@@ -975,6 +974,21 @@ static struct platform_device xxxfb_device = {
         .name = "xxxfb",
 };
 
+#ifndef MODULE
+    /*
+     *  Setup
+     */
+
+/*
+ * Only necessary if your driver takes special options,
+ * otherwise we fall back on the generic fb_setup().
+ */
+int __init xxxfb_setup(char *options)
+{
+    /* Parse user speficied options (`video=xxxfb:') */
+}
+#endif /* MODULE */
+
 static int __init xxxfb_init(void)
 {
         int ret;
@@ -1006,21 +1020,6 @@ static void __exit xxxfb_exit(void)
 }
 #endif /* CONFIG_PCI */
 
-#ifdef MODULE
-    /*
-     *  Setup
-     */
-
-/* 
- * Only necessary if your driver takes special options,
- * otherwise we fall back on the generic fb_setup().
- */
-int __init xxxfb_setup(char *options)
-{
-    /* Parse user speficied options (`video=xxxfb:') */
-}
-#endif /* MODULE */
-
 /* ------------------------------------------------------------------------- */
 
 
diff --git a/drivers/video/sunxvr2500.c b/drivers/video/sunxvr2500.c
index 4316c7fe8e21..c3869a96ab58 100644
--- a/drivers/video/sunxvr2500.c
+++ b/drivers/video/sunxvr2500.c
@@ -28,7 +28,7 @@ struct s3d_info {
         unsigned int            depth;
         unsigned int            fb_size;
 
-        u32                     pseudo_palette[256];
+        u32                     pseudo_palette[16];
 };
 
 static int __devinit s3d_get_props(struct s3d_info *sp)
@@ -52,15 +52,14 @@ static int s3d_setcolreg(unsigned regno,
 {
         u32 value;
 
-        if (regno >= 256)
-                return 1;
+        if (regno < 16) {
+                red >>= 8;
+                green >>= 8;
+                blue >>= 8;
 
-        red >>= 8;
-        green >>= 8;
-        blue >>= 8;
-
-        value = (blue << 24) | (green << 16) | (red << 8);
-        ((u32 *)info->pseudo_palette)[regno] = value;
+                value = (blue << 24) | (green << 16) | (red << 8);
+                ((u32 *)info->pseudo_palette)[regno] = value;
+        }
 
         return 0;
 }
diff --git a/drivers/video/sunxvr500.c b/drivers/video/sunxvr500.c
index 08880a62bfa3..71bf3f1f00bc 100644
--- a/drivers/video/sunxvr500.c
+++ b/drivers/video/sunxvr500.c
@@ -50,7 +50,7 @@ struct e3d_info {
         u32                     fb8_0_off;
         u32                     fb8_1_off;
 
-        u32                     pseudo_palette[256];
+        u32                     pseudo_palette[16];
 };
 
 static int __devinit e3d_get_props(struct e3d_info *ep)
@@ -126,7 +126,9 @@ static int e3d_setcolreg(unsigned regno,
         blue_8 = blue >> 8;
 
         value = (blue_8 << 24) | (green_8 << 16) | (red_8 << 8);
-        ((u32 *)info->pseudo_palette)[regno] = value;
+
+        if (info->fix.visual == FB_VISUAL_TRUECOLOR && regno < 16)
+                ((u32 *)info->pseudo_palette)[regno] = value;
 
 
         red_10 = red >> 6;
diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
index 5e9755e464a1..30c0b948852b 100644
--- a/drivers/video/vt8623fb.c
+++ b/drivers/video/vt8623fb.c
@@ -778,9 +778,10 @@ err_enable_device:
 static void __devexit vt8623_pci_remove(struct pci_dev *dev)
 {
         struct fb_info *info = pci_get_drvdata(dev);
-        struct vt8623fb_info *par = info->par;
 
         if (info) {
+                struct vt8623fb_info *par = info->par;
+
 #ifdef CONFIG_MTRR
                 if (par->mtrr_reg >= 0) {
                         mtrr_del(par->mtrr_reg, 0, 0);
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 2dac3ad2c44b..2c55dd94a1de 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -17,6 +17,8 @@
 #include <linux/rxrpc.h>
 #include <linux/key.h>
 #include <linux/workqueue.h>
+#include <linux/sched.h>
+
 #include "afs.h"
 #include "afs_vl.h"
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 8a23483ca8d0..3b64bb16c727 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -30,15 +30,15 @@
 void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
                 unsigned long *blockgrpp, ext4_grpblk_t *offsetp)
 {
-        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
         ext4_grpblk_t offset;
 
-        blocknr = blocknr - le32_to_cpu(es->s_first_data_block);
+        blocknr = blocknr - le32_to_cpu(es->s_first_data_block);
         offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb));
         if (offsetp)
                 *offsetp = offset;
         if (blockgrpp)
-                *blockgrpp = blocknr;
+                *blockgrpp = blocknr;
 
 }
 
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index a0f0c04e79b2..b9ce24129070 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -374,7 +374,7 @@ ext4_ext_binsearch_idx(struct inode *inode, struct ext4_ext_path *path, int bloc
                                        le32_to_cpu(ix[-1].ei_block));
                         }
                         BUG_ON(k && le32_to_cpu(ix->ei_block)
-                                           <= le32_to_cpu(ix[-1].ei_block));
+                                           <= le32_to_cpu(ix[-1].ei_block));
                         if (block < le32_to_cpu(ix->ei_block))
                                 break;
                         chix = ix;
@@ -423,8 +423,8 @@ ext4_ext_binsearch(struct inode *inode, struct ext4_ext_path *path, int block)
 
         path->p_ext = l - 1;
         ext_debug("  -> %d:%llu:%d ",
-                        le32_to_cpu(path->p_ext->ee_block),
-                        ext_pblock(path->p_ext),
+                        le32_to_cpu(path->p_ext->ee_block),
+                        ext_pblock(path->p_ext),
                         le16_to_cpu(path->p_ext->ee_len));
 
 #ifdef CHECK_BINSEARCH
@@ -435,7 +435,7 @@ ext4_ext_binsearch(struct inode *inode, struct ext4_ext_path *path, int block)
                 chex = ex = EXT_FIRST_EXTENT(eh);
                 for (k = 0; k < le16_to_cpu(eh->eh_entries); k++, ex++) {
                         BUG_ON(k && le32_to_cpu(ex->ee_block)
-                                          <= le32_to_cpu(ex[-1].ee_block));
+                                          <= le32_to_cpu(ex[-1].ee_block));
                         if (block < le32_to_cpu(ex->ee_block))
                                 break;
                         chex = ex;
@@ -577,7 +577,7 @@ static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
         curp->p_hdr->eh_entries = cpu_to_le16(le16_to_cpu(curp->p_hdr->eh_entries)+1);
 
         BUG_ON(le16_to_cpu(curp->p_hdr->eh_entries)
-                             > le16_to_cpu(curp->p_hdr->eh_max));
+                             > le16_to_cpu(curp->p_hdr->eh_max));
         BUG_ON(ix > EXT_LAST_INDEX(curp->p_hdr));
 
         err = ext4_ext_dirty(handle, inode, curp);
@@ -621,12 +621,12 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
                 border = path[depth].p_ext[1].ee_block;
                 ext_debug("leaf will be split."
                                 " next leaf starts at %d\n",
-                                  le32_to_cpu(border));
+                                  le32_to_cpu(border));
         } else {
                 border = newext->ee_block;
                 ext_debug("leaf will be added."
                                 " next leaf starts at %d\n",
-                                le32_to_cpu(border));
+                                le32_to_cpu(border));
         }
 
         /*
@@ -684,9 +684,9 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
         while (path[depth].p_ext <=
                         EXT_MAX_EXTENT(path[depth].p_hdr)) {
                 ext_debug("move %d:%llu:%d in new leaf %llu\n",
-                                le32_to_cpu(path[depth].p_ext->ee_block),
-                                ext_pblock(path[depth].p_ext),
-                                le16_to_cpu(path[depth].p_ext->ee_len),
+                                le32_to_cpu(path[depth].p_ext->ee_block),
+                                ext_pblock(path[depth].p_ext),
+                                le16_to_cpu(path[depth].p_ext->ee_len),
                                 newblock);
                 /*memmove(ex++, path[depth].p_ext++,
                                 sizeof(struct ext4_extent));
@@ -765,9 +765,9 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
                                 EXT_LAST_INDEX(path[i].p_hdr));
                 while (path[i].p_idx <= EXT_MAX_INDEX(path[i].p_hdr)) {
                         ext_debug("%d: move %d:%d in new index %llu\n", i,
-                                        le32_to_cpu(path[i].p_idx->ei_block),
-                                        idx_pblock(path[i].p_idx),
-                                        newblock);
+                                        le32_to_cpu(path[i].p_idx->ei_block),
+                                        idx_pblock(path[i].p_idx),
+                                        newblock);
                         /*memmove(++fidx, path[i].p_idx++,
                                         sizeof(struct ext4_extent_idx));
                         neh->eh_entries++;
@@ -1128,6 +1128,55 @@ ext4_can_extents_be_merged(struct inode *inode, struct ext4_extent *ex1,
 }
 
 /*
+ * check if a portion of the "newext" extent overlaps with an
+ * existing extent.
+ *
+ * If there is an overlap discovered, it updates the length of the newext
+ * such that there will be no overlap, and then returns 1.
+ * If there is no overlap found, it returns 0.
+ */
+unsigned int ext4_ext_check_overlap(struct inode *inode,
+                                    struct ext4_extent *newext,
+                                    struct ext4_ext_path *path)
+{
+        unsigned long b1, b2;
+        unsigned int depth, len1;
+        unsigned int ret = 0;
+
+        b1 = le32_to_cpu(newext->ee_block);
+        len1 = le16_to_cpu(newext->ee_len);
+        depth = ext_depth(inode);
+        if (!path[depth].p_ext)
+                goto out;
+        b2 = le32_to_cpu(path[depth].p_ext->ee_block);
+
+        /*
+         * get the next allocated block if the extent in the path
+         * is before the requested block(s) 
+         */
+        if (b2 < b1) {
+                b2 = ext4_ext_next_allocated_block(path);
+                if (b2 == EXT_MAX_BLOCK)
+                        goto out;
+        }
+
+        /* check for wrap through zero */
+        if (b1 + len1 < b1) {
+                len1 = EXT_MAX_BLOCK - b1;
+                newext->ee_len = cpu_to_le16(len1);
+                ret = 1;
+        }
+
+        /* check for overlap */
+        if (b1 + len1 > b2) {
+                newext->ee_len = cpu_to_le16(b2 - b1);
+                ret = 1;
+        }
+out:
+        return ret;
+}
+
+/*
  * ext4_ext_insert_extent:
  * tries to merge requsted extent into the existing extent or
  * inserts requested extent as new one into the tree,
@@ -1212,12 +1261,12 @@ has_space:
         if (!nearex) {
                 /* there is no extent in this leaf, create first one */
                 ext_debug("first extent in the leaf: %d:%llu:%d\n",
-                                le32_to_cpu(newext->ee_block),
-                                ext_pblock(newext),
-                                le16_to_cpu(newext->ee_len));
+                                le32_to_cpu(newext->ee_block),
+                                ext_pblock(newext),
+                                le16_to_cpu(newext->ee_len));
                 path[depth].p_ext = EXT_FIRST_EXTENT(eh);
         } else if (le32_to_cpu(newext->ee_block)
-                           > le32_to_cpu(nearex->ee_block)) {
+                           > le32_to_cpu(nearex->ee_block)) {
 /*              BUG_ON(newext->ee_block == nearex->ee_block); */
                 if (nearex != EXT_LAST_EXTENT(eh)) {
                         len = EXT_MAX_EXTENT(eh) - nearex;
@@ -1225,9 +1274,9 @@ has_space:
                         len = len < 0 ? 0 : len;
                         ext_debug("insert %d:%llu:%d after: nearest 0x%p, "
                                         "move %d from 0x%p to 0x%p\n",
-                                        le32_to_cpu(newext->ee_block),
-                                        ext_pblock(newext),
-                                        le16_to_cpu(newext->ee_len),
+                                        le32_to_cpu(newext->ee_block),
+                                        ext_pblock(newext),
+                                        le16_to_cpu(newext->ee_len),
                                         nearex, len, nearex + 1, nearex + 2);
                         memmove(nearex + 2, nearex + 1, len);
                 }
@@ -1358,9 +1407,9 @@ int ext4_ext_walk_space(struct inode *inode, unsigned long block,
                         cbex.ec_start = 0;
                         cbex.ec_type = EXT4_EXT_CACHE_GAP;
                 } else {
-                        cbex.ec_block = le32_to_cpu(ex->ee_block);
-                        cbex.ec_len = le16_to_cpu(ex->ee_len);
-                        cbex.ec_start = ext_pblock(ex);
+                        cbex.ec_block = le32_to_cpu(ex->ee_block);
+                        cbex.ec_len = le16_to_cpu(ex->ee_len);
+                        cbex.ec_start = ext_pblock(ex);
                         cbex.ec_type = EXT4_EXT_CACHE_EXTENT;
                 }
 
@@ -1431,16 +1480,16 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
                 len = le32_to_cpu(ex->ee_block) - block;
                 ext_debug("cache gap(before): %lu [%lu:%lu]",
                                 (unsigned long) block,
-                                (unsigned long) le32_to_cpu(ex->ee_block),
-                                (unsigned long) le16_to_cpu(ex->ee_len));
+                                (unsigned long) le32_to_cpu(ex->ee_block),
+                                (unsigned long) le16_to_cpu(ex->ee_len));
         } else if (block >= le32_to_cpu(ex->ee_block)
-                            + le16_to_cpu(ex->ee_len)) {
-                lblock = le32_to_cpu(ex->ee_block)
-                         + le16_to_cpu(ex->ee_len);
+                            + le16_to_cpu(ex->ee_len)) {
+                lblock = le32_to_cpu(ex->ee_block)
+                         + le16_to_cpu(ex->ee_len);
                 len = ext4_ext_next_allocated_block(path);
                 ext_debug("cache gap(after): [%lu:%lu] %lu",
-                                (unsigned long) le32_to_cpu(ex->ee_block),
-                                (unsigned long) le16_to_cpu(ex->ee_len),
+                                (unsigned long) le32_to_cpu(ex->ee_block),
+                                (unsigned long) le16_to_cpu(ex->ee_len),
                                 (unsigned long) block);
                 BUG_ON(len == lblock);
                 len = len - lblock;
@@ -1468,9 +1517,9 @@ ext4_ext_in_cache(struct inode *inode, unsigned long block,
         BUG_ON(cex->ec_type != EXT4_EXT_CACHE_GAP &&
                         cex->ec_type != EXT4_EXT_CACHE_EXTENT);
         if (block >= cex->ec_block && block < cex->ec_block + cex->ec_len) {
-                ex->ee_block = cpu_to_le32(cex->ec_block);
+                ex->ee_block = cpu_to_le32(cex->ec_block);
                 ext4_ext_store_pblock(ex, cex->ec_start);
-                ex->ee_len = cpu_to_le16(cex->ec_len);
+                ex->ee_len = cpu_to_le16(cex->ec_len);
                 ext_debug("%lu cached by %lu:%lu:%llu\n",
                                 (unsigned long) block,
                                 (unsigned long) cex->ec_block,
@@ -1956,9 +2005,9 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                         /* we should allocate requested block */
                 } else if (goal == EXT4_EXT_CACHE_EXTENT) {
                         /* block is already allocated */
-                        newblock = iblock
-                                   - le32_to_cpu(newex.ee_block)
-                                   + ext_pblock(&newex);
+                        newblock = iblock
+                                   - le32_to_cpu(newex.ee_block)
+                                   + ext_pblock(&newex);
                         /* number of remaining blocks in the extent */
                         allocated = le16_to_cpu(newex.ee_len) -
                                         (iblock - le32_to_cpu(newex.ee_block));
@@ -1987,7 +2036,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
 
         ex = path[depth].p_ext;
         if (ex) {
-                unsigned long ee_block = le32_to_cpu(ex->ee_block);
+                unsigned long ee_block = le32_to_cpu(ex->ee_block);
                 ext4_fsblk_t ee_start = ext_pblock(ex);
                 unsigned short ee_len  = le16_to_cpu(ex->ee_len);
 
@@ -2000,7 +2049,7 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                 if (ee_len > EXT_MAX_LEN)
                         goto out2;
                 /* if found extent covers block, simply return it */
-                if (iblock >= ee_block && iblock < ee_block + ee_len) {
+                if (iblock >= ee_block && iblock < ee_block + ee_len) {
                         newblock = iblock - ee_block + ee_start;
                         /* number of remaining blocks in the extent */
                         allocated = ee_len - (iblock - ee_block);
@@ -2031,7 +2080,15 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
 
         /* allocate new block */
         goal = ext4_ext_find_goal(inode, path, iblock);
-        allocated = max_blocks;
+
+        /* Check if we can really insert (iblock)::(iblock+max_blocks) extent */
+        newex.ee_block = cpu_to_le32(iblock);
+        newex.ee_len = cpu_to_le16(max_blocks);
+        err = ext4_ext_check_overlap(inode, &newex, path);
+        if (err)
+                allocated = le16_to_cpu(newex.ee_len);
+        else
+                allocated = max_blocks;
         newblock = ext4_new_blocks(handle, inode, goal, &allocated, &err);
         if (!newblock)
                 goto out2;
@@ -2039,12 +2096,15 @@ int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
                         goal, newblock, allocated);
 
         /* try to insert new extent into found leaf and return */
-        newex.ee_block = cpu_to_le32(iblock);
         ext4_ext_store_pblock(&newex, newblock);
         newex.ee_len = cpu_to_le16(allocated);
         err = ext4_ext_insert_extent(handle, inode, path, &newex);
-        if (err)
+        if (err) {
+                /* free data blocks we just allocated */
+                ext4_free_blocks(handle, inode, ext_pblock(&newex),
+                                        le16_to_cpu(newex.ee_len));
                 goto out2;
+        }
 
         if (extend_disksize && inode->i_size > EXT4_I(inode)->i_disksize)
                 EXT4_I(inode)->i_disksize = inode->i_size;
@@ -2157,11 +2217,3 @@ int ext4_ext_writepage_trans_blocks(struct inode *inode, int num)
 
         return needed;
 }
-
-EXPORT_SYMBOL(ext4_mark_inode_dirty);
-EXPORT_SYMBOL(ext4_ext_invalidate_cache);
-EXPORT_SYMBOL(ext4_ext_insert_extent);
-EXPORT_SYMBOL(ext4_ext_walk_space);
-EXPORT_SYMBOL(ext4_ext_find_goal);
-EXPORT_SYMBOL(ext4_ext_calc_credits_for_insert);
-
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index b34182b6ee4d..0bcf62a750ff 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -255,8 +255,8 @@ static int verify_chain(Indirect *from, Indirect *to)
  *      @inode: inode in question (we are only interested in its superblock)
  *      @i_block: block number to be parsed
  *      @offsets: array to store the offsets in
- *      @boundary: set this non-zero if the referred-to block is likely to be
- *             followed (on disk) by an indirect block.
+ *      @boundary: set this non-zero if the referred-to block is likely to be
+ *             followed (on disk) by an indirect block.
  *
  *      To store the locations of file's data ext4 uses a data structure common
  *      for UNIX filesystems - tree of pointers anchored in the inode, with
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index 4ec57be5baf5..2811e5720ad0 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -46,7 +46,7 @@
  */
 #define NAMEI_RA_CHUNKS  2
 #define NAMEI_RA_BLOCKS  4
-#define NAMEI_RA_SIZE        (NAMEI_RA_CHUNKS * NAMEI_RA_BLOCKS)
+#define NAMEI_RA_SIZE        (NAMEI_RA_CHUNKS * NAMEI_RA_BLOCKS)
 #define NAMEI_RA_INDEX(c,b)  (((c) * NAMEI_RA_BLOCKS) + (b))
 
 static struct buffer_head *ext4_append(handle_t *handle,
@@ -241,7 +241,7 @@ static inline unsigned dx_node_limit (struct inode *dir)
 static void dx_show_index (char * label, struct dx_entry *entries)
 {
         int i, n = dx_get_count (entries);
-        printk("%s index ", label);
+        printk("%s index ", label);
         for (i = 0; i < n; i++) {
                 printk("%x->%u ", i? dx_get_hash(entries + i) :
                                 0, dx_get_block(entries + i));
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cb9afdd0e26e..175b68c60968 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1985,7 +1985,7 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb,
 
         if (bd_claim(bdev, sb)) {
                 printk(KERN_ERR
-                        "EXT4: failed to claim external journal device.\n");
+                        "EXT4: failed to claim external journal device.\n");
                 blkdev_put(bdev);
                 return NULL;
         }
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 479c1038ed4a..8c90cbc903fa 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -12,6 +12,7 @@
 #include <linux/fs.h>
 #include <linux/security.h>
 #include <linux/module.h>
+#include <linux/kallsyms.h>
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -20,6 +21,7 @@ static long do_ioctl(struct file *filp, unsigned int cmd,
                 unsigned long arg)
 {
         int error = -ENOTTY;
+        void *f;
 
         if (!filp->f_op)
                 goto out;
@@ -29,10 +31,16 @@ static long do_ioctl(struct file *filp, unsigned int cmd,
                 if (error == -ENOIOCTLCMD)
                         error = -EINVAL;
                 goto out;
-        } else if (filp->f_op->ioctl) {
+        } else if ((f = filp->f_op->ioctl)) {
                 lock_kernel();
-                error = filp->f_op->ioctl(filp->f_path.dentry->d_inode,
-                                          filp, cmd, arg);
+                if (!filp->f_op->ioctl) {
+                        printk("%s: ioctl %p disappeared\n", __FUNCTION__, f);
+                        print_symbol("symbol: %s\n", (unsigned long)f);
+                        dump_stack();
+                } else {
+                        error = filp->f_op->ioctl(filp->f_path.dentry->d_inode,
+                                                  filp, cmd, arg);
+                }
                 unlock_kernel();
         }
 
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 4884d5edfe65..12e83f67eee4 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -229,9 +229,16 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
            check anyway. */
         if (!tn->fn->size) {
                 if (rii->mdata_tn) {
-                        /* We had a candidate mdata node already */
-                        dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
-                        jffs2_kill_tn(c, rii->mdata_tn);
+                        if (rii->mdata_tn->version < tn->version) {
+                                /* We had a candidate mdata node already */
+                                dbg_readinode("kill old mdata with ver %d\n", rii->mdata_tn->version);
+                                jffs2_kill_tn(c, rii->mdata_tn);
+                        } else {
+                                dbg_readinode("kill new mdata with ver %d (older than existing %d\n",
+                                              tn->version, rii->mdata_tn->version);
+                                jffs2_kill_tn(c, tn);
+                                return 0;
+                        }
                 }
                 rii->mdata_tn = tn;
                 dbg_readinode("keep new mdata with ver %d\n", tn->version);
@@ -1044,7 +1051,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
 
                 case JFFS2_NODETYPE_DIRENT:
 
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_dirent) &&
+                            len < sizeof(struct jffs2_raw_dirent)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_raw_dirent), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
@@ -1058,7 +1066,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
 
                 case JFFS2_NODETYPE_INODE:
 
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_raw_inode) &&
+                            len < sizeof(struct jffs2_raw_inode)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_raw_inode), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
@@ -1071,7 +1080,8 @@ static int jffs2_get_inode_nodes(struct jffs2_sb_info *c, struct jffs2_inode_inf
                         break;
 
                 default:
-                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node)) {
+                        if (JFFS2_MIN_NODE_HEADER < sizeof(struct jffs2_unknown_node) &&
+                            len < sizeof(struct jffs2_unknown_node)) {
                                 err = read_more(c, ref, sizeof(struct jffs2_unknown_node), &len, buf);
                                 if (unlikely(err))
                                         goto free_out;
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 6488af43bc9b..e220d3bd610d 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -19,7 +19,7 @@
 #include <linux/mount.h>
 #include <linux/jffs2.h>
 #include <linux/pagemap.h>
-#include <linux/mtd/mtd.h>
+#include <linux/mtd/super.h>
 #include <linux/ctype.h>
 #include <linux/namei.h>
 #include "compr.h"
@@ -75,69 +75,27 @@ static const struct super_operations jffs2_super_operations =
         .sync_fs =      jffs2_sync_fs,
 };
 
-static int jffs2_sb_compare(struct super_block *sb, void *data)
-{
-        struct jffs2_sb_info *p = data;
-        struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
-
-        /* The superblocks are considered to be equivalent if the underlying MTD
-           device is the same one */
-        if (c->mtd == p->mtd) {
-                D1(printk(KERN_DEBUG "jffs2_sb_compare: match on device %d (\"%s\")\n", p->mtd->index, p->mtd->name));
-                return 1;
-        } else {
-                D1(printk(KERN_DEBUG "jffs2_sb_compare: No match, device %d (\"%s\"), device %d (\"%s\")\n",
-                          c->mtd->index, c->mtd->name, p->mtd->index, p->mtd->name));
-                return 0;
-        }
-}
-
-static int jffs2_sb_set(struct super_block *sb, void *data)
-{
-        struct jffs2_sb_info *p = data;
-
-        /* For persistence of NFS exports etc. we use the same s_dev
-           each time we mount the device, don't just use an anonymous
-           device */
-        sb->s_fs_info = p;
-        p->os_priv = sb;
-        sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, p->mtd->index);
-
-        return 0;
-}
-
-static int jffs2_get_sb_mtd(struct file_system_type *fs_type,
-                            int flags, const char *dev_name,
-                            void *data, struct mtd_info *mtd,
-                            struct vfsmount *mnt)
+/*
+ * fill in the superblock
+ */
+static int jffs2_fill_super(struct super_block *sb, void *data, int silent)
 {
-        struct super_block *sb;
         struct jffs2_sb_info *c;
-        int ret;
+
+        D1(printk(KERN_DEBUG "jffs2_get_sb_mtd():"
+                  " New superblock for device %d (\"%s\")\n",
+                  sb->s_mtd->index, sb->s_mtd->name));
 
         c = kzalloc(sizeof(*c), GFP_KERNEL);
         if (!c)
                 return -ENOMEM;
-        c->mtd = mtd;
-
-        sb = sget(fs_type, jffs2_sb_compare, jffs2_sb_set, c);
-
-        if (IS_ERR(sb))
-                goto out_error;
-
-        if (sb->s_root) {
-                /* New mountpoint for JFFS2 which is already mounted */
-                D1(printk(KERN_DEBUG "jffs2_get_sb_mtd(): Device %d (\"%s\") is already mounted\n",
-                          mtd->index, mtd->name));
-                ret = simple_set_mnt(mnt, sb);
-                goto out_put;
-        }
 
-        D1(printk(KERN_DEBUG "jffs2_get_sb_mtd(): New superblock for device %d (\"%s\")\n",
-                  mtd->index, mtd->name));
+        c->mtd = sb->s_mtd;
+        c->os_priv = sb;
+        sb->s_fs_info = c;
 
-        /* Initialize JFFS2 superblock locks, the further initialization will be
-         * done later */
+        /* Initialize JFFS2 superblock locks, the further initialization will
+         * be done later */
         init_MUTEX(&c->alloc_sem);
         init_MUTEX(&c->erase_free_sem);
         init_waitqueue_head(&c->erase_wait);
@@ -146,133 +104,20 @@ static int jffs2_get_sb_mtd(struct file_system_type *fs_type,
         spin_lock_init(&c->inocache_lock);
 
         sb->s_op = &jffs2_super_operations;
-        sb->s_flags = flags | MS_NOATIME;
+        sb->s_flags = sb->s_flags | MS_NOATIME;
         sb->s_xattr = jffs2_xattr_handlers;
 #ifdef CONFIG_JFFS2_FS_POSIX_ACL
         sb->s_flags |= MS_POSIXACL;
 #endif
-        ret = jffs2_do_fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
-
-        if (ret) {
-                /* Failure case... */
-                up_write(&sb->s_umount);
-                deactivate_super(sb);
-                return ret;
-        }
-
-        sb->s_flags |= MS_ACTIVE;
-        return simple_set_mnt(mnt, sb);
-
-out_error:
-        ret = PTR_ERR(sb);
- out_put:
-        kfree(c);
-        put_mtd_device(mtd);
-
-        return ret;
-}
-
-static int jffs2_get_sb_mtdnr(struct file_system_type *fs_type,
-                              int flags, const char *dev_name,
-                              void *data, int mtdnr,
-                              struct vfsmount *mnt)
-{
-        struct mtd_info *mtd;
-
-        mtd = get_mtd_device(NULL, mtdnr);
-        if (IS_ERR(mtd)) {
-                D1(printk(KERN_DEBUG "jffs2: MTD device #%u doesn't appear to exist\n", mtdnr));
-                return PTR_ERR(mtd);
-        }
-
-        return jffs2_get_sb_mtd(fs_type, flags, dev_name, data, mtd, mnt);
+        return jffs2_do_fill_super(sb, data, silent);
 }
 
 static int jffs2_get_sb(struct file_system_type *fs_type,
                         int flags, const char *dev_name,
                         void *data, struct vfsmount *mnt)
 {
-        int err;
-        struct nameidata nd;
-        int mtdnr;
-
-        if (!dev_name)
-                return -EINVAL;
-
-        D1(printk(KERN_DEBUG "jffs2_get_sb(): dev_name \"%s\"\n", dev_name));
-
-        /* The preferred way of mounting in future; especially when
-           CONFIG_BLK_DEV is implemented - we specify the underlying
-           MTD device by number or by name, so that we don't require
-           block device support to be present in the kernel. */
-
-        /* FIXME: How to do the root fs this way? */
-
-        if (dev_name[0] == 'm' && dev_name[1] == 't' && dev_name[2] == 'd') {
-                /* Probably mounting without the blkdev crap */
-                if (dev_name[3] == ':') {
-                        struct mtd_info *mtd;
-
-                        /* Mount by MTD device name */
-                        D1(printk(KERN_DEBUG "jffs2_get_sb(): mtd:%%s, name \"%s\"\n", dev_name+4));
-                        for (mtdnr = 0; mtdnr < MAX_MTD_DEVICES; mtdnr++) {
-                                mtd = get_mtd_device(NULL, mtdnr);
-                                if (!IS_ERR(mtd)) {
-                                        if (!strcmp(mtd->name, dev_name+4))
-                                                return jffs2_get_sb_mtd(fs_type, flags, dev_name, data, mtd, mnt);
-                                        put_mtd_device(mtd);
-                                }
-                        }
-                        printk(KERN_NOTICE "jffs2_get_sb(): MTD device with name \"%s\" not found.\n", dev_name+4);
-                } else if (isdigit(dev_name[3])) {
-                        /* Mount by MTD device number name */
-                        char *endptr;
-
-                        mtdnr = simple_strtoul(dev_name+3, &endptr, 0);
-                        if (!*endptr) {
-                                /* It was a valid number */
-                                D1(printk(KERN_DEBUG "jffs2_get_sb(): mtd%%d, mtdnr %d\n", mtdnr));
-                                return jffs2_get_sb_mtdnr(fs_type, flags, dev_name, data, mtdnr, mnt);
-                        }
-                }
-        }
-
-        /* Try the old way - the hack where we allowed users to mount
-           /dev/mtdblock$(n) but didn't actually _use_ the blkdev */
-
-        err = path_lookup(dev_name, LOOKUP_FOLLOW, &nd);
-
-        D1(printk(KERN_DEBUG "jffs2_get_sb(): path_lookup() returned %d, inode %p\n",
-                  err, nd.dentry->d_inode));
-
-        if (err)
-                return err;
-
-        err = -EINVAL;
-
-        if (!S_ISBLK(nd.dentry->d_inode->i_mode))
-                goto out;
-
-        if (nd.mnt->mnt_flags & MNT_NODEV) {
-                err = -EACCES;
-                goto out;
-        }
-
-        if (imajor(nd.dentry->d_inode) != MTD_BLOCK_MAJOR) {
-                if (!(flags & MS_SILENT))
-                        printk(KERN_NOTICE "Attempt to mount non-MTD device \"%s\" as JFFS2\n",
-                               dev_name);
-                goto out;
-        }
-
-        mtdnr = iminor(nd.dentry->d_inode);
-        path_release(&nd);
-
-        return jffs2_get_sb_mtdnr(fs_type, flags, dev_name, data, mtdnr, mnt);
-
-out:
-        path_release(&nd);
-        return err;
+        return get_sb_mtd(fs_type, flags, dev_name, data, jffs2_fill_super,
+                          mnt);
 }
 
 static void jffs2_put_super (struct super_block *sb)
@@ -307,8 +152,7 @@ static void jffs2_kill_sb(struct super_block *sb)
         struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
         if (!(sb->s_flags & MS_RDONLY))
                 jffs2_stop_garbage_collect_thread(c);
-        generic_shutdown_super(sb);
-        put_mtd_device(c->mtd);
+        kill_mtd_super(sb);
         kfree(c);
 }
 
diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
index 78fc08893a6c..e48665984cb3 100644
--- a/fs/jffs2/xattr.c
+++ b/fs/jffs2/xattr.c
@@ -754,6 +754,10 @@ void jffs2_clear_xattr_subsystem(struct jffs2_sb_info *c)
                 list_del(&xd->xindex);
                 jffs2_free_xattr_datum(xd);
         }
+        list_for_each_entry_safe(xd, _xd, &c->xattr_unchecked, xindex) {
+                list_del(&xd->xindex);
+                jffs2_free_xattr_datum(xd);
+        }
 }
 
 #define XREF_TMPHASH_SIZE       (128)
@@ -825,7 +829,7 @@ void jffs2_build_xattr_subsystem(struct jffs2_sb_info *c)
                            ref->xd and ref->ic are not valid yet. */
                         xd = jffs2_find_xattr_datum(c, ref->xid);
                         ic = jffs2_get_ino_cache(c, ref->ino);
-                        if (!xd || !ic) {
+                        if (!xd || !ic || !ic->nlink) {
                                 dbg_xattr("xref(ino=%u, xid=%u, xseqno=%u) is orphan.\n",
                                           ref->ino, ref->xid, ref->xseqno);
                                 ref->xseqno |= XREF_DELETE_MARKER;
diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
index 074791ce4ab2..b532a730cec2 100644
--- a/fs/ntfs/inode.c
+++ b/fs/ntfs/inode.c
@@ -140,7 +140,7 @@ static int ntfs_init_locked_inode(struct inode *vi, ntfs_attr *na)
                 if (!ni->name)
                         return -ENOMEM;
                 memcpy(ni->name, na->name, i);
-                ni->name[i] = 0;
+                ni->name[na->name_len] = 0;
         }
         return 0;
 }
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index c8461551e108..1f0129405cf4 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -460,8 +460,8 @@ static struct buffer_head * inode_getblk(struct inode * inode, sector_t block,
         kernel_long_ad laarr[EXTENT_MERGE_SIZE];
         struct extent_position prev_epos, cur_epos, next_epos;
         int count = 0, startnum = 0, endnum = 0;
-        uint32_t elen = 0;
-        kernel_lb_addr eloc;
+        uint32_t elen = 0, tmpelen;
+        kernel_lb_addr eloc, tmpeloc;
         int c = 1;
         loff_t lbcount = 0, b_off = 0;
         uint32_t newblocknum, newblock;
@@ -520,8 +520,12 @@ static struct buffer_head * inode_getblk(struct inode * inode, sector_t block,
 
         b_off -= lbcount;
         offset = b_off >> inode->i_sb->s_blocksize_bits;
-        /* Move into indirect extent if we are at a pointer to it */
-        udf_next_aext(inode, &prev_epos, &eloc, &elen, 0);
+        /*
+         * Move prev_epos and cur_epos into indirect extent if we are at
+         * the pointer to it
+         */
+        udf_next_aext(inode, &prev_epos, &tmpeloc, &tmpelen, 0);
+        udf_next_aext(inode, &cur_epos, &tmpeloc, &tmpelen, 0);
 
         /* if the extent is allocated and recorded, return the block
        if the extent is not a multiple of the blocksize, round up */
diff --git a/fs/udf/super.c b/fs/udf/super.c
index 3a743d854c17..6658afb41cc7 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1351,7 +1351,7 @@ udf_load_partition(struct super_block *sb, kernel_lb_addr *fileset)
 
         for (i=0; i<UDF_SB_NUMPARTS(sb); i++)
         {
-                switch UDF_SB_PARTTYPE(sb, i)
+                switch (UDF_SB_PARTTYPE(sb, i))
                 {
                         case UDF_VIRTUAL_MAP15:
                         case UDF_VIRTUAL_MAP20:
diff --git a/include/acpi/acpi_numa.h b/include/acpi/acpi_numa.h
index b62cd36ff324..e2fcee2b340d 100644
--- a/include/acpi/acpi_numa.h
+++ b/include/acpi/acpi_numa.h
@@ -13,7 +13,7 @@
 
 extern int pxm_to_node(int);
 extern int node_to_pxm(int);
-extern int __cpuinit acpi_map_pxm_to_node(int);
+extern int acpi_map_pxm_to_node(int);
 extern void __cpuinit acpi_unmap_pxm_to_node(int);
 
 #endif                          /* CONFIG_ACPI_NUMA */
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index 5e07db0d46e9..ca882b8e7d10 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -78,7 +78,7 @@ struct acpi_signal_fatal_info {
 /*
  * OSL Initialization and shutdown primitives
  */
-acpi_status acpi_os_initialize(void);
+acpi_status __initdata acpi_os_initialize(void);
 
 acpi_status acpi_os_terminate(void);
 
@@ -236,6 +236,7 @@ acpi_os_derive_pci_id(acpi_handle rhandle,
  * Miscellaneous
  */
 acpi_status acpi_os_validate_interface(char *interface);
+acpi_status acpi_osi_invalidate(char* interface);
 
 acpi_status
 acpi_os_validate_address(u8 space_id,
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index e08f7df85a4f..b5cca5daa348 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -55,7 +55,7 @@ acpi_status
 acpi_initialize_tables(struct acpi_table_desc *initial_storage,
                        u32 initial_table_count, u8 allow_resize);
 
-acpi_status acpi_initialize_subsystem(void);
+acpi_status __init acpi_initialize_subsystem(void);
 
 acpi_status acpi_enable_subsystem(u32 flags);
 
diff --git a/include/acpi/acutils.h b/include/acpi/acutils.h
index 15a838862cd4..a87ef1c8d46b 100644
--- a/include/acpi/acutils.h
+++ b/include/acpi/acutils.h
@@ -390,6 +390,8 @@ void acpi_ut_delete_object_desc(union acpi_operand_object *object);
 
 u8 acpi_ut_valid_internal_object(void *object);
 
+union acpi_operand_object *acpi_ut_create_package_object(u32 count);
+
 union acpi_operand_object *acpi_ut_create_buffer_object(acpi_size buffer_size);
 
 union acpi_operand_object *acpi_ut_create_string_object(acpi_size string_size);
diff --git a/include/asm-alpha/core_t2.h b/include/asm-alpha/core_t2.h
index 457c34b6eb09..90e6b5d6c214 100644
--- a/include/asm-alpha/core_t2.h
+++ b/include/asm-alpha/core_t2.h
@@ -437,9 +437,15 @@ static inline void t2_outl(u32 b, unsigned long addr)
 
 static DEFINE_SPINLOCK(t2_hae_lock);
 
+/*
+ * NOTE: take T2_DENSE_MEM off in each readX/writeX routine, since
+ *       they may be called directly, rather than through the
+ *       ioreadNN/iowriteNN routines.
+ */
+
 __EXTERN_INLINE u8 t2_readb(const volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long result, msb;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -453,7 +459,7 @@ __EXTERN_INLINE u8 t2_readb(const volatile void __iomem *xaddr)
 
 __EXTERN_INLINE u16 t2_readw(const volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long result, msb;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -471,7 +477,7 @@ __EXTERN_INLINE u16 t2_readw(const volatile void __iomem *xaddr)
  */
 __EXTERN_INLINE u32 t2_readl(const volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long result, msb;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -485,7 +491,7 @@ __EXTERN_INLINE u32 t2_readl(const volatile void __iomem *xaddr)
 
 __EXTERN_INLINE u64 t2_readq(const volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long r0, r1, work, msb;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -501,7 +507,7 @@ __EXTERN_INLINE u64 t2_readq(const volatile void __iomem *xaddr)
 
 __EXTERN_INLINE void t2_writeb(u8 b, volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long msb, w;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -515,7 +521,7 @@ __EXTERN_INLINE void t2_writeb(u8 b, volatile void __iomem *xaddr)
 
 __EXTERN_INLINE void t2_writew(u16 b, volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long msb, w;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -533,7 +539,7 @@ __EXTERN_INLINE void t2_writew(u16 b, volatile void __iomem *xaddr)
  */
 __EXTERN_INLINE void t2_writel(u32 b, volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long msb;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -546,7 +552,7 @@ __EXTERN_INLINE void t2_writel(u32 b, volatile void __iomem *xaddr)
 
 __EXTERN_INLINE void t2_writeq(u64 b, volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long) xaddr;
+        unsigned long addr = (unsigned long) xaddr - T2_DENSE_MEM;
         unsigned long msb, work;
         unsigned long flags;
         spin_lock_irqsave(&t2_hae_lock, flags);
@@ -587,14 +593,14 @@ __EXTERN_INLINE int t2_is_mmio(const volatile void __iomem *addr)
 __EXTERN_INLINE unsigned int t2_ioread##NS(void __iomem *xaddr)         \
 {                                                                       \
         if (t2_is_mmio(xaddr))                                          \
-                return t2_read##OS(xaddr - T2_DENSE_MEM);               \
+                return t2_read##OS(xaddr);                              \
         else                                                            \
                 return t2_in##OS((unsigned long)xaddr - T2_IO);         \
 }                                                                       \
 __EXTERN_INLINE void t2_iowrite##NS(u##NS b, void __iomem *xaddr)       \
 {                                                                       \
         if (t2_is_mmio(xaddr))                                          \
-                t2_write##OS(b, xaddr - T2_DENSE_MEM);                  \
+                t2_write##OS(b, xaddr);                                 \
         else                                                            \
                 t2_out##OS(b, (unsigned long)xaddr - T2_IO);            \
 }
diff --git a/include/asm-alpha/core_titan.h b/include/asm-alpha/core_titan.h
index a64ccbff7d98..a17f6f33b68e 100644
--- a/include/asm-alpha/core_titan.h
+++ b/include/asm-alpha/core_titan.h
@@ -380,12 +380,7 @@ struct el_PRIVATEER_envdata_mcheck {
 /*
  * Memory functions.  all accesses are done through linear space.
  */
-
-__EXTERN_INLINE void __iomem *titan_ioportmap(unsigned long addr)
-{
-        return (void __iomem *)(addr + TITAN_IO_BIAS);
-}
-
+extern void __iomem *titan_ioportmap(unsigned long addr);
 extern void __iomem *titan_ioremap(unsigned long addr, unsigned long size);
 extern void titan_iounmap(volatile void __iomem *addr);
 
diff --git a/include/asm-alpha/core_tsunami.h b/include/asm-alpha/core_tsunami.h
index 44e635d2c571..58d4fe48742c 100644
--- a/include/asm-alpha/core_tsunami.h
+++ b/include/asm-alpha/core_tsunami.h
@@ -2,6 +2,7 @@
 #define __ALPHA_TSUNAMI__H__
 
 #include <linux/types.h>
+#include <linux/pci.h>
 #include <asm/compiler.h>
 
 /*
@@ -302,18 +303,8 @@ struct el_TSUNAMI_sysdata_mcheck {
 /*
  * Memory functions.  all accesses are done through linear space.
  */
-
-__EXTERN_INLINE void __iomem *tsunami_ioportmap(unsigned long addr)
-{
-        return (void __iomem *)(addr + TSUNAMI_IO_BIAS);
-}
-
-__EXTERN_INLINE void __iomem *tsunami_ioremap(unsigned long addr, 
-                                              unsigned long size)
-{
-        return (void __iomem *)(addr + TSUNAMI_MEM_BIAS);
-}
-
+extern void __iomem *tsunami_ioportmap(unsigned long addr);
+extern void __iomem *tsunami_ioremap(unsigned long addr, unsigned long size);
 __EXTERN_INLINE int tsunami_is_ioaddr(unsigned long addr)
 {
         return addr >= TSUNAMI_BASE;
diff --git a/include/asm-alpha/core_wildfire.h b/include/asm-alpha/core_wildfire.h
index 12af803d445a..cd562f544ba2 100644
--- a/include/asm-alpha/core_wildfire.h
+++ b/include/asm-alpha/core_wildfire.h
@@ -295,7 +295,7 @@ __EXTERN_INLINE int wildfire_is_ioaddr(unsigned long addr)
 
 __EXTERN_INLINE int wildfire_is_mmio(const volatile void __iomem *xaddr)
 {
-        unsigned long addr = (unsigned long)addr;
+        unsigned long addr = (unsigned long)xaddr;
         return (addr & 0x100000000UL) == 0;
 }
 
diff --git a/include/asm-alpha/vga.h b/include/asm-alpha/vga.h
index ed06f59b544d..e8df1e7aae6b 100644
--- a/include/asm-alpha/vga.h
+++ b/include/asm-alpha/vga.h
@@ -46,6 +46,37 @@ extern void scr_memcpyw(u16 *d, const u16 *s, unsigned int count);
 #define vga_readb(a)    readb((u8 __iomem *)(a))
 #define vga_writeb(v,a) writeb(v, (u8 __iomem *)(a))
 
+#ifdef CONFIG_VGA_HOSE
+#include <linux/ioport.h>
+#include <linux/pci.h>
+
+extern struct pci_controller *pci_vga_hose;
+
+# define __is_port_vga(a)       \
+        (((a) >= 0x3b0) && ((a) < 0x3e0) && \
+         ((a) != 0x3b3) && ((a) != 0x3d3))
+
+# define __is_mem_vga(a) \
+        (((a) >= 0xa0000) && ((a) <= 0xc0000))
+
+# define FIXUP_IOADDR_VGA(a) do {                       \
+        if (pci_vga_hose && __is_port_vga(a))     \
+                (a) += pci_vga_hose->io_space->start;     \
+ } while(0)
+
+# define FIXUP_MEMADDR_VGA(a) do {                       \
+        if (pci_vga_hose && __is_mem_vga(a))     \
+                (a) += pci_vga_hose->mem_space->start; \
+ } while(0)
+
+#else /* CONFIG_VGA_HOSE */
+# define pci_vga_hose 0
+# define __is_port_vga(a) 0
+# define __is_mem_vga(a) 0
+# define FIXUP_IOADDR_VGA(a)
+# define FIXUP_MEMADDR_VGA(a)
+#endif /* CONFIG_VGA_HOSE */
+
 #define VGA_MAP_MEM(x,s)        ((unsigned long) ioremap(x, s))
 
 #endif
diff --git a/include/asm-arm/arch-at91/at91_shdwc.h b/include/asm-arm/arch-at91/at91_shdwc.h
index 795fcc266228..01b433de2272 100644
--- a/include/asm-arm/arch-at91/at91_shdwc.h
+++ b/include/asm-arm/arch-at91/at91_shdwc.h
@@ -14,8 +14,8 @@
 #define AT91_SHDWC_H
 
 #define AT91_SHDW_CR            (AT91_SHDWC + 0x00)     /* Shut Down Control Register */
-#define         AT91_SHDW_SHDW          (1    << 0)             /* Processor Reset */
-#define         AT91_SHDW_KEY           (0xff << 24)            /* KEY Password */
+#define         AT91_SHDW_SHDW          (1    << 0)             /* Shut Down command */
+#define         AT91_SHDW_KEY           (0xa5 << 24)            /* KEY Password */
 
 #define AT91_SHDW_MR            (AT91_SHDWC + 0x04)     /* Shut Down Mode Register */
 #define         AT91_SHDW_WKMODE0       (3 << 0)                /* Wake-up 0 Mode Selection */
diff --git a/include/asm-arm/arch-at91/at91_wdt.h b/include/asm-arm/arch-at91/at91_wdt.h
index 7251a344c740..1014e9bf181f 100644
--- a/include/asm-arm/arch-at91/at91_wdt.h
+++ b/include/asm-arm/arch-at91/at91_wdt.h
@@ -15,7 +15,7 @@
 
 #define AT91_WDT_CR             (AT91_WDT + 0x00)       /* Watchdog Control Register */
 #define         AT91_WDT_WDRSTT         (1    << 0)             /* Restart */
-#define         AT91_WDT_KEY            (0xff << 24)            /* KEY Password */
+#define         AT91_WDT_KEY            (0xa5 << 24)            /* KEY Password */
 
 #define AT91_WDT_MR             (AT91_WDT + 0x04)       /* Watchdog Mode Register */
 #define         AT91_WDT_WDV            (0xfff << 0)            /* Counter Value */
diff --git a/include/asm-arm/arch-pxa/gpio.h b/include/asm-arm/arch-pxa/gpio.h
index aeba24347f8e..9e99241f3edf 100644
--- a/include/asm-arm/arch-pxa/gpio.h
+++ b/include/asm-arm/arch-pxa/gpio.h
@@ -45,7 +45,8 @@ static inline int gpio_direction_input(unsigned gpio)
 
 static inline int gpio_direction_output(unsigned gpio, int value)
 {
-        return pxa_gpio_mode(gpio | GPIO_OUT | (value ? 0 : GPIO_DFLT_LOW));
+        return pxa_gpio_mode(gpio | GPIO_OUT |
+                         (value ? GPIO_DFLT_HIGH : GPIO_DFLT_LOW));
 }
 
 static inline int __gpio_get_value(unsigned gpio)
diff --git a/include/asm-frv/system.h b/include/asm-frv/system.h
index be303b3eef40..6931af525da3 100644
--- a/include/asm-frv/system.h
+++ b/include/asm-frv/system.h
@@ -12,6 +12,7 @@
 #ifndef _ASM_SYSTEM_H
 #define _ASM_SYSTEM_H
 
+#include <linux/types.h>
 #include <linux/linkage.h>
 
 struct thread_struct;
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 8307b1bb337a..84155eb67f1d 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -14,8 +14,8 @@
         *(.data)                                                        \
         *(.data.init.refok)
 
-#define RODATA                                                          \
-        . = ALIGN(4096);                                                \
+#define RO_DATA(align)                                                  \
+        . = ALIGN((align));                                             \
         .rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {           \
                 VMLINUX_SYMBOL(__start_rodata) = .;                     \
                 *(.rodata) *(.rodata.*)                                 \
@@ -135,7 +135,11 @@
                 VMLINUX_SYMBOL(__end_rodata) = .;                       \
         }                                                               \
                                                                         \
-        . = ALIGN(4096);
+        . = ALIGN((align));
+
+/* RODATA provided for backward compatibility.
+ * All archs are supposed to use RO_DATA() */
+#define RODATA RO_DATA(4096)
 
 #define SECURITY_INIT                                                   \
         .security_initcall.init : AT(ADDR(.security_initcall.init) - LOAD_OFFSET) { \
diff --git a/include/asm-h8300/processor.h b/include/asm-h8300/processor.h
index 99b664aa2083..49fc886a6232 100644
--- a/include/asm-h8300/processor.h
+++ b/include/asm-h8300/processor.h
@@ -78,7 +78,7 @@ struct thread_struct {
 do {                                                            \
         set_fs(USER_DS);           /* reads from user space */  \
         (_regs)->pc = (_pc);                                    \
-        (_regs)->ccr &= 0x00;      /* clear kernel flag */      \
+        (_regs)->ccr = 0x00;       /* clear all flags */        \
         (_regs)->er5 = current->mm->start_data; /* GOT base */  \
         wrusp((unsigned long)(_usp) - sizeof(unsigned long)*3); \
 } while(0)
diff --git a/include/asm-m68k/mmzone.h b/include/asm-m68k/mmzone.h
new file mode 100644
index 000000000000..e1f1ec7b7006
--- /dev/null
+++ b/include/asm-m68k/mmzone.h
@@ -0,0 +1,9 @@
+#ifndef _ASM_M68K_MMZONE_H_
+#define _ASM_M68K_MMZONE_H_
+
+extern pg_data_t pg_data_map[];
+
+#define NODE_DATA(nid)          (&pg_data_map[nid])
+#define NODE_MEM_MAP(nid)       (NODE_DATA(nid)->node_mem_map)
+
+#endif /* _ASM_M68K_MMZONE_H_ */
diff --git a/include/asm-m68k/module.h b/include/asm-m68k/module.h
index c6d75af2d8d3..382d20a6fc18 100644
--- a/include/asm-m68k/module.h
+++ b/include/asm-m68k/module.h
@@ -1,7 +1,39 @@
 #ifndef _ASM_M68K_MODULE_H
 #define _ASM_M68K_MODULE_H
-struct mod_arch_specific { };
+
+struct mod_arch_specific {
+        struct m68k_fixup_info *fixup_start, *fixup_end;
+};
+
+#define MODULE_ARCH_INIT {                              \
+        .fixup_start            = __start_fixup,        \
+        .fixup_end              = __stop_fixup,         \
+}
+
 #define Elf_Shdr Elf32_Shdr
 #define Elf_Sym Elf32_Sym
 #define Elf_Ehdr Elf32_Ehdr
+
+
+enum m68k_fixup_type {
+        m68k_fixup_memoffset,
+        m68k_fixup_vnode_shift,
+};
+
+struct m68k_fixup_info {
+        enum m68k_fixup_type type;
+        void *addr;
+};
+
+#define m68k_fixup(type, addr)                  \
+        "       .section \".m68k_fixup\",\"aw\"\n"      \
+        "       .long " #type "," #addr "\n"    \
+        "       .previous\n"
+
+extern struct m68k_fixup_info __start_fixup[], __stop_fixup[];
+
+struct module;
+extern void module_fixup(struct module *mod, struct m68k_fixup_info *start,
+                         struct m68k_fixup_info *end);
+
 #endif /* _ASM_M68K_MODULE_H */
diff --git a/include/asm-m68k/motorola_pgtable.h b/include/asm-m68k/motorola_pgtable.h
index 61e4406ed96a..b5b78c01eb6c 100644
--- a/include/asm-m68k/motorola_pgtable.h
+++ b/include/asm-m68k/motorola_pgtable.h
@@ -130,7 +130,7 @@ static inline void pgd_set(pgd_t *pgdp, pmd_t *pmdp)
 #define pte_present(pte)        (pte_val(pte) & (_PAGE_PRESENT | _PAGE_PROTNONE))
 #define pte_clear(mm,addr,ptep)         ({ pte_val(*(ptep)) = 0; })
 
-#define pte_page(pte)           (mem_map + ((unsigned long)(__va(pte_val(pte)) - PAGE_OFFSET) >> PAGE_SHIFT))
+#define pte_page(pte)           virt_to_page(__va(pte_val(pte)))
 #define pte_pfn(pte)            (pte_val(pte) >> PAGE_SHIFT)
 #define pfn_pte(pfn, prot)      __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
 
@@ -143,7 +143,7 @@ static inline void pgd_set(pgd_t *pgdp, pmd_t *pmdp)
         while (--__i >= 0)                      \
                 *__ptr++ = 0;                   \
 })
-#define pmd_page(pmd)           (mem_map + ((unsigned long)(__va(pmd_val(pmd)) - PAGE_OFFSET) >> PAGE_SHIFT))
+#define pmd_page(pmd)           virt_to_page(__va(pmd_val(pmd)))
 
 
 #define pgd_none(pgd)           (!pgd_val(pgd))
@@ -223,10 +223,10 @@ static inline pte_t *pte_offset_kernel(pmd_t *pmdp, unsigned long address)
         return (pte_t *)__pmd_page(*pmdp) + ((address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1));
 }
 
-#define pte_offset_map(pmdp,address) ((pte_t *)kmap(pmd_page(*pmdp)) + ((address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)))
+#define pte_offset_map(pmdp,address) ((pte_t *)__pmd_page(*pmdp) + (((address) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1)))
 #define pte_offset_map_nested(pmdp, address) pte_offset_map(pmdp, address)
-#define pte_unmap(pte) kunmap(pte)
-#define pte_unmap_nested(pte) kunmap(pte)
+#define pte_unmap(pte)          ((void)0)
+#define pte_unmap_nested(pte)   ((void)0)
 
 /*
  * Allocate and free page tables. The xxx_kernel() versions are
diff --git a/include/asm-m68k/page.h b/include/asm-m68k/page.h
index fcc165ddd09e..9e6d0d6debdb 100644
--- a/include/asm-m68k/page.h
+++ b/include/asm-m68k/page.h
@@ -27,6 +27,8 @@
 
 #ifndef __ASSEMBLY__
 
+#include <asm/module.h>
+
 #define get_user_page(vaddr)            __get_free_page(GFP_KERNEL)
 #define free_user_page(page, addr)      free_page(addr)
 
@@ -114,18 +116,33 @@ typedef struct { unsigned long pgprot; } pgprot_t;
 
 #ifndef __ASSEMBLY__
 
+extern unsigned long m68k_memoffset;
+
 #ifndef CONFIG_SUN3
 
 #define WANT_PAGE_VIRTUAL
-#ifdef CONFIG_SINGLE_MEMORY_CHUNK
-extern unsigned long m68k_memoffset;
 
-#define __pa(vaddr)             ((unsigned long)(vaddr)+m68k_memoffset)
-#define __va(paddr)             ((void *)((unsigned long)(paddr)-m68k_memoffset))
-#else
-#define __pa(vaddr)             virt_to_phys((void *)(vaddr))
-#define __va(paddr)             phys_to_virt((unsigned long)(paddr))
-#endif
+static inline unsigned long ___pa(void *vaddr)
+{
+        unsigned long paddr;
+        asm (
+                "1:     addl #0,%0\n"
+                m68k_fixup(%c2, 1b+2)
+                : "=r" (paddr)
+                : "0" (vaddr), "i" (m68k_fixup_memoffset));
+        return paddr;
+}
+#define __pa(vaddr)     ___pa((void *)(vaddr))
+static inline void *__va(unsigned long paddr)
+{
+        void *vaddr;
+        asm (
+                "1:     subl #0,%0\n"
+                m68k_fixup(%c2, 1b+2)
+                : "=r" (vaddr)
+                : "0" (paddr), "i" (m68k_fixup_memoffset));
+        return vaddr;
+}
 
 #else   /* !CONFIG_SUN3 */
 /* This #define is a horrible hack to suppress lots of warnings. --m */
@@ -161,11 +178,47 @@ static inline void *__va(unsigned long x)
 #define virt_to_pfn(kaddr)      (__pa(kaddr) >> PAGE_SHIFT)
 #define pfn_to_virt(pfn)        __va((pfn) << PAGE_SHIFT)
 
-#define virt_to_page(kaddr)     (mem_map + (((unsigned long)(kaddr)-PAGE_OFFSET) >> PAGE_SHIFT))
-#define page_to_virt(page)      ((((page) - mem_map) << PAGE_SHIFT) + PAGE_OFFSET)
+extern int m68k_virt_to_node_shift;
+
+#ifdef CONFIG_SINGLE_MEMORY_CHUNK
+#define __virt_to_node(addr)    (&pg_data_map[0])
+#else
+extern struct pglist_data *pg_data_table[];
+
+static inline __attribute_const__ int __virt_to_node_shift(void)
+{
+        int shift;
+
+        asm (
+                "1:     moveq   #0,%0\n"
+                m68k_fixup(%c1, 1b)
+                : "=d" (shift)
+                : "i" (m68k_fixup_vnode_shift));
+        return shift;
+}
+
+#define __virt_to_node(addr)    (pg_data_table[(unsigned long)(addr) >> __virt_to_node_shift()])
+#endif
 
-#define pfn_to_page(pfn)        virt_to_page(pfn_to_virt(pfn))
-#define page_to_pfn(page)       virt_to_pfn(page_to_virt(page))
+#define virt_to_page(addr) ({                                           \
+        pfn_to_page(virt_to_pfn(addr));                                 \
+})
+#define page_to_virt(page) ({                                           \
+        pfn_to_virt(page_to_pfn(page));                                 \
+})
+
+#define pfn_to_page(pfn) ({                                             \
+        unsigned long __pfn = (pfn);                                    \
+        struct pglist_data *pgdat;                                      \
+        pgdat = __virt_to_node((unsigned long)pfn_to_virt(__pfn));      \
+        pgdat->node_mem_map + (__pfn - pgdat->node_start_pfn);          \
+})
+#define page_to_pfn(_page) ({                                           \
+        struct page *__p = (_page);                                     \
+        struct pglist_data *pgdat;                                      \
+        pgdat = &pg_data_map[page_to_nid(__p)];                         \
+        ((__p) - pgdat->node_mem_map) + pgdat->node_start_pfn;          \
+})
 
 #define virt_addr_valid(kaddr)  ((void *)(kaddr) >= (void *)PAGE_OFFSET && (void *)(kaddr) < high_memory)
 #define pfn_valid(pfn)          virt_addr_valid(pfn_to_virt(pfn))
diff --git a/include/asm-m68k/pgalloc.h b/include/asm-m68k/pgalloc.h
index a9cfb4b99d88..4cb1a57ab763 100644
--- a/include/asm-m68k/pgalloc.h
+++ b/include/asm-m68k/pgalloc.h
@@ -8,11 +8,12 @@
 #include <asm/virtconvert.h>
 
 
-
 #ifdef CONFIG_SUN3
 #include <asm/sun3_pgalloc.h>
 #else
 #include <asm/motorola_pgalloc.h>
 #endif
 
+extern void m68k_setup_node(int node);
+
 #endif /* M68K_PGALLOC_H */
diff --git a/include/asm-m68k/pgtable.h b/include/asm-m68k/pgtable.h
index 555b87a1f7e3..778a4c538eb2 100644
--- a/include/asm-m68k/pgtable.h
+++ b/include/asm-m68k/pgtable.h
@@ -107,22 +107,7 @@ extern void *empty_zero_page;
 /* 64-bit machines, beware!  SRB. */
 #define SIZEOF_PTR_LOG2                        2
 
-/*
- * Check if the addr/len goes up to the end of a physical
- * memory chunk.  Used for DMA functions.
- */
-#ifdef CONFIG_SINGLE_MEMORY_CHUNK
-/*
- * It makes no sense to consider whether we cross a memory boundary if
- * we support just one physical chunk of memory.
- */
-static inline int mm_end_of_chunk(unsigned long addr, int len)
-{
-        return 0;
-}
-#else
-int mm_end_of_chunk (unsigned long addr, int len);
-#endif
+#define mm_end_of_chunk(addr, len)      0
 
 extern void kernel_set_cachemode(void *addr, unsigned long size, int cmode);
 
diff --git a/include/asm-m68k/sun3_pgtable.h b/include/asm-m68k/sun3_pgtable.h
index 5156a28a18d8..b9e62c1e7ae3 100644
--- a/include/asm-m68k/sun3_pgtable.h
+++ b/include/asm-m68k/sun3_pgtable.h
@@ -132,8 +132,8 @@ static inline void pte_clear (struct mm_struct *mm, unsigned long addr, pte_t *p
 #define pfn_pte(pfn, pgprot) \
 ({ pte_t __pte; pte_val(__pte) = pfn | pgprot_val(pgprot); __pte; })
 
-#define pte_page(pte)           (mem_map+((__pte_page(pte) - PAGE_OFFSET) >> PAGE_SHIFT))
-#define pmd_page(pmd)           (mem_map+((__pmd_page(pmd) - PAGE_OFFSET) >> PAGE_SHIFT))
+#define pte_page(pte)           virt_to_page(__pte_page(pte))
+#define pmd_page(pmd)           virt_to_page(__pmd_page(pmd))
 
 
 static inline int pmd_none2 (pmd_t *pmd) { return !pmd_val (*pmd); }
diff --git a/include/asm-m68k/virtconvert.h b/include/asm-m68k/virtconvert.h
index 83a87c9b1a16..dea32fbc7e51 100644
--- a/include/asm-m68k/virtconvert.h
+++ b/include/asm-m68k/virtconvert.h
@@ -8,56 +8,35 @@
 #ifdef __KERNEL__
 
 #include <linux/compiler.h>
+#include <linux/mmzone.h>
 #include <asm/setup.h>
 #include <asm/page.h>
 
-#ifdef CONFIG_AMIGA
-#include <asm/amigahw.h>
-#endif
-
 /*
  * Change virtual addresses to physical addresses and vv.
  */
-#ifndef CONFIG_SUN3
-extern unsigned long mm_vtop(unsigned long addr) __attribute_const__;
-extern unsigned long mm_ptov(unsigned long addr) __attribute_const__;
-#else
-static inline unsigned long mm_vtop(unsigned long vaddr)
-{
-        return __pa(vaddr);
-}
-
-static inline unsigned long mm_ptov(unsigned long paddr)
-{
-        return (unsigned long)__va(paddr);
-}
-#endif
-
-#ifdef CONFIG_SINGLE_MEMORY_CHUNK
-static inline unsigned long virt_to_phys(void *vaddr)
-{
-        return (unsigned long)vaddr - PAGE_OFFSET + m68k_memory[0].addr;
-}
-
-static inline void * phys_to_virt(unsigned long paddr)
-{
-        return (void *)(paddr - m68k_memory[0].addr + PAGE_OFFSET);
-}
-#else
 static inline unsigned long virt_to_phys(void *address)
 {
-        return mm_vtop((unsigned long)address);
+        return __pa(address);
 }
 
 static inline void *phys_to_virt(unsigned long address)
 {
-        return (void *) mm_ptov(address);
+        return __va(address);
 }
-#endif
 
 /* Permanent address of a page. */
-#define __page_address(page)    (PAGE_OFFSET + (((page) - mem_map) << PAGE_SHIFT))
-#define page_to_phys(page)      virt_to_phys((void *)__page_address(page))
+#ifdef CONFIG_SINGLE_MEMORY_CHUNK
+#define page_to_phys(page) \
+        __pa(PAGE_OFFSET + (((page) - pg_data_map[0].node_mem_map) << PAGE_SHIFT))
+#else
+#define page_to_phys(_page) ({                                          \
+        struct page *__page = _page;                                    \
+        struct pglist_data *pgdat;                                      \
+        pgdat = pg_data_table[page_to_nid(__page)];                     \
+        page_to_pfn(__page) << PAGE_SHIFT;                              \
+})
+#endif
 
 /*
  * IO bus memory addresses are 1:1 with the physical address,
diff --git a/include/asm-mips/asmmacro.h b/include/asm-mips/asmmacro.h
index 92e62ef711ed..c5f20df780e9 100644
--- a/include/asm-mips/asmmacro.h
+++ b/include/asm-mips/asmmacro.h
@@ -52,21 +52,6 @@
         .endm
 #endif /* CONFIG_MIPS_MT_SMTC */
 
-#ifdef CONFIG_CPU_SB1
-        .macro  fpu_enable_hazard
-        .set    push
-        .set    noreorder
-        .set    mips2
-        SSNOP
-        bnezl   $0, .+4
-         SSNOP
-        .set    pop
-        .endm
-#else
-        .macro  fpu_enable_hazard
-        .endm
-#endif
-
 /*
  * Temporary until all gas have MT ASE support
  */
diff --git a/include/asm-mips/mips-boards/prom.h b/include/asm-mips/mips-boards/prom.h
index daaf9f98fc63..a9db576a9768 100644
--- a/include/asm-mips/mips-boards/prom.h
+++ b/include/asm-mips/mips-boards/prom.h
@@ -33,6 +33,7 @@ extern void prom_meminit(void);
 extern void prom_fixup_mem_map(unsigned long start_mem, unsigned long end_mem);
 extern void mips_display_message(const char *str);
 extern void mips_display_word(unsigned int num);
+extern void mips_scroll_message(void);
 extern int get_ethernet_addr(char *ethernet_addr);
 
 /* Memory descriptor management. */
diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h
index 2f1087b3a202..91c306fcfb72 100644
--- a/include/asm-mips/unistd.h
+++ b/include/asm-mips/unistd.h
@@ -949,7 +949,6 @@
 #define __ARCH_WANT_SYS_UTIME
 #define __ARCH_WANT_SYS_WAITPID
 #define __ARCH_WANT_SYS_SOCKETCALL
-#define __ARCH_WANT_SYS_FADVISE64
 #define __ARCH_WANT_SYS_GETPGRP
 #define __ARCH_WANT_SYS_LLSEEK
 #define __ARCH_WANT_SYS_NICE
diff --git a/include/asm-powerpc/pgalloc-64.h b/include/asm-powerpc/pgalloc-64.h
index d9a3a8ca58a1..94d0294341d6 100644
--- a/include/asm-powerpc/pgalloc-64.h
+++ b/include/asm-powerpc/pgalloc-64.h
@@ -90,7 +90,8 @@ static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
 static inline struct page *pte_alloc_one(struct mm_struct *mm,
                                          unsigned long address)
 {
-        return virt_to_page(pte_alloc_one_kernel(mm, address));
+        pte_t *pte = pte_alloc_one_kernel(mm, address);
+        return pte ? virt_to_page(pte) : NULL;
 }
 
 static inline void pte_free_kernel(pte_t *pte)
diff --git a/include/asm-powerpc/tlb.h b/include/asm-powerpc/tlb.h
index 0a17682663d8..66714042e438 100644
--- a/include/asm-powerpc/tlb.h
+++ b/include/asm-powerpc/tlb.h
@@ -38,6 +38,15 @@ extern void pte_free_finish(void);
 
 static inline void tlb_flush(struct mmu_gather *tlb)
 {
+        struct ppc64_tlb_batch *tlbbatch = &__get_cpu_var(ppc64_tlb_batch);
+
+        /* If there's a TLB batch pending, then we must flush it because the
+         * pages are going to be freed and we really don't want to have a CPU
+         * access a freed page because it has a stale TLB
+         */
+        if (tlbbatch->index)
+                __flush_tlb_pending(tlbbatch);
+
         pte_free_finish();
 }
 
diff --git a/include/asm-sh/cpu-sh4/freq.h b/include/asm-sh/cpu-sh4/freq.h
index 86564e7a26ae..39f41fcd509d 100644
--- a/include/asm-sh/cpu-sh4/freq.h
+++ b/include/asm-sh/cpu-sh4/freq.h
@@ -24,6 +24,9 @@
 #define FRQMR1                  0xffc80014
 #else
 #define FRQCR                   0xffc00000
+#define FRQCR_PSTBY             0x0200
+#define FRQCR_PLLEN             0x0400
+#define FRQCR_CKOEN             0x0800
 #endif
 #define MIN_DIVISOR_NR          0
 #define MAX_DIVISOR_NR          3
diff --git a/include/asm-sh/dma.h b/include/asm-sh/dma.h
index faf3051cd429..6034d4a29e73 100644
--- a/include/asm-sh/dma.h
+++ b/include/asm-sh/dma.h
@@ -13,6 +13,7 @@
 
 #include <linux/spinlock.h>
 #include <linux/wait.h>
+#include <linux/sched.h>
 #include <linux/sysdev.h>
 #include <asm/cpu/dma.h>
 
diff --git a/include/asm-sh/io.h b/include/asm-sh/io.h
index a0e55b09e4fd..aa80930ce8e4 100644
--- a/include/asm-sh/io.h
+++ b/include/asm-sh/io.h
@@ -116,13 +116,13 @@ void __raw_readsl(unsigned long addr, void *data, int longlen);
  * redefined by userlevel programs.
  */
 #ifdef __readb
-# define readb(a)       ({ unsigned long r_ = __raw_readb(a); mb(); r_; })
+# define readb(a)       ({ unsigned int r_ = __raw_readb(a); mb(); r_; })
 #endif
 #ifdef __raw_readw
-# define readw(a)       ({ unsigned long r_ = __raw_readw(a); mb(); r_; })
+# define readw(a)       ({ unsigned int r_ = __raw_readw(a); mb(); r_; })
 #endif
 #ifdef __raw_readl
-# define readl(a)       ({ unsigned long r_ = __raw_readl(a); mb(); r_; })
+# define readl(a)       ({ unsigned int r_ = __raw_readl(a); mb(); r_; })
 #endif
 
 #ifdef __raw_writeb
diff --git a/include/asm-sh/se73180.h b/include/asm-sh/se73180.h
index 3a4acb3e38a1..907c062b4c9a 100644
--- a/include/asm-sh/se73180.h
+++ b/include/asm-sh/se73180.h
@@ -1,9 +1,7 @@
-#ifndef __ASM_SH_HITACHI_SE73180_H
-#define __ASM_SH_HITACHI_SE73180_H
+#ifndef __ASM_SH_SE73180_H
+#define __ASM_SH_SE73180_H
 
 /*
- * include/asm-sh/se/se73180.h
- *
  * Copyright (C) 2003 Takashi Kusuda <kusuda-takashi@hitachi-ul.co.jp>
  *
  * SH-Mobile SolutionEngine 73180 support
@@ -62,4 +60,7 @@
 #define __IO_PREFIX     sh73180se
 #include <asm/io_generic.h>
 
-#endif  /* __ASM_SH_HITACHI_SE73180_H */
+/* arch/sh/boards/se/73180/irq.c */
+int shmse_irq_demux(int irq);
+
+#endif  /* __ASM_SH_SE73180_H */
diff --git a/include/asm-sh/smp.h b/include/asm-sh/smp.h
index 71ecddf70db3..caa7b93f1bce 100644
--- a/include/asm-sh/smp.h
+++ b/include/asm-sh/smp.h
@@ -15,7 +15,7 @@
 
 #ifdef CONFIG_SMP
 
-#include <asm/spinlock.h>
+#include <linux/spinlock.h>
 #include <asm/atomic.h>
 #include <asm/current.h>
 
diff --git a/include/asm-sh/spinlock.h b/include/asm-sh/spinlock.h
index 2586eef07d57..92f6e2008b2e 100644
--- a/include/asm-sh/spinlock.h
+++ b/include/asm-sh/spinlock.h
@@ -11,6 +11,7 @@
 #define __ASM_SH_SPINLOCK_H
 
 #include <asm/atomic.h>
+#include <asm/spinlock_types.h>
 
 /*
  * Your basic SMP spinlocks, allowing only a single CPU anywhere
@@ -42,7 +43,7 @@ static inline void __raw_spin_lock(raw_spinlock_t *lock)
 
 static inline void __raw_spin_unlock(raw_spinlock_t *lock)
 {
-        assert_spin_locked(lock);
+        //assert_spin_locked(lock);
 
         lock->lock = 0;
 }
@@ -88,6 +89,11 @@ static inline void __raw_write_unlock(raw_rwlock_t *rw)
         __raw_spin_unlock(&rw->lock);
 }
 
+static inline int __raw_write_can_lock(raw_rwlock_t *rw)
+{
+        return (atomic_read(&rw->counter) == RW_LOCK_BIAS);
+}
+
 static inline int __raw_read_trylock(raw_rwlock_t *lock)
 {
         atomic_t *count = (atomic_t*)lock;
diff --git a/include/asm-sh/spinlock_types.h b/include/asm-sh/spinlock_types.h
index 8c41b6c3aac8..5c58134f2c4e 100644
--- a/include/asm-sh/spinlock_types.h
+++ b/include/asm-sh/spinlock_types.h
@@ -9,7 +9,9 @@ typedef struct {
         volatile unsigned long lock;
 } raw_spinlock_t;
 
-#define __SPIN_LOCK_UNLOCKED            { 0 }
+#define __RAW_SPIN_LOCK_UNLOCKED        { 1 }
+
+#include <asm/atomic.h>
 
 typedef struct {
         raw_spinlock_t lock;
diff --git a/include/asm-sparc64/cpudata.h b/include/asm-sparc64/cpudata.h
index 03c385de7619..445026fbec35 100644
--- a/include/asm-sparc64/cpudata.h
+++ b/include/asm-sparc64/cpudata.h
@@ -31,7 +31,7 @@ typedef struct {
         unsigned int    ecache_size;
         unsigned int    ecache_line_size;
         int             core_id;
-        unsigned int    __pad3;
+        int             proc_id;
 } cpuinfo_sparc;
 
 DECLARE_PER_CPU(cpuinfo_sparc, __cpu_data);
diff --git a/include/asm-sparc64/dma-mapping.h b/include/asm-sparc64/dma-mapping.h
index 9329429fb7f6..4e21c2f3065c 100644
--- a/include/asm-sparc64/dma-mapping.h
+++ b/include/asm-sparc64/dma-mapping.h
@@ -162,6 +162,22 @@ dma_mapping_error(dma_addr_t dma_addr)
 #else
 
 struct device;
+struct page;
+struct scatterlist;
+
+static inline int
+dma_supported(struct device *dev, u64 mask)
+{
+        BUG();
+        return 0;
+}
+
+static inline int
+dma_set_mask(struct device *dev, u64 dma_mask)
+{
+        BUG();
+        return 0;
+}
 
 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
                          dma_addr_t *dma_handle, gfp_t flag)
@@ -176,6 +192,52 @@ static inline void dma_free_coherent(struct device *dev, size_t size,
         BUG();
 }
 
+static inline dma_addr_t
+dma_map_single(struct device *dev, void *cpu_addr, size_t size,
+               enum dma_data_direction direction)
+{
+        BUG();
+        return 0;
+}
+
+static inline void
+dma_unmap_single(struct device *dev, dma_addr_t dma_addr, size_t size,
+                 enum dma_data_direction direction)
+{
+        BUG();
+}
+
+static inline dma_addr_t
+dma_map_page(struct device *dev, struct page *page,
+             unsigned long offset, size_t size,
+             enum dma_data_direction direction)
+{
+        BUG();
+        return 0;
+}
+
+static inline void
+dma_unmap_page(struct device *dev, dma_addr_t dma_address, size_t size,
+               enum dma_data_direction direction)
+{
+        BUG();
+}
+
+static inline int
+dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
+           enum dma_data_direction direction)
+{
+        BUG();
+        return 0;
+}
+
+static inline void
+dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nhwentries,
+             enum dma_data_direction direction)
+{
+        BUG();
+}
+
 static inline void
 dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle, size_t size,
                         enum dma_data_direction direction)
@@ -190,6 +252,27 @@ dma_sync_single_for_device(struct device *dev, dma_addr_t dma_handle, size_t siz
         BUG();
 }
 
+static inline void
+dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg, int nelems,
+                    enum dma_data_direction direction)
+{
+        BUG();
+}
+
+static inline void
+dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg, int nelems,
+                       enum dma_data_direction direction)
+{
+        BUG();
+}
+
+static inline int
+dma_mapping_error(dma_addr_t dma_addr)
+{
+        BUG();
+        return 0;
+}
+
 #endif /* PCI */
 
 
diff --git a/include/asm-sparc64/hypervisor.h b/include/asm-sparc64/hypervisor.h
index 5cdb1ff04838..5c2f9d4b9f06 100644
--- a/include/asm-sparc64/hypervisor.h
+++ b/include/asm-sparc64/hypervisor.h
@@ -1097,6 +1097,80 @@ extern unsigned long sun4v_mach_set_soft_state(unsigned long soft_state,
  */
 #define HV_FAST_MACH_GET_SOFT_STATE     0x71
 
+/* svc_send()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_SVC_SEND
+ * ARG0:        service ID
+ * ARG1:        buffer real address
+ * ARG2:        buffer size
+ * RET0:        STATUS
+ * RET1:        sent_bytes
+ *
+ * Be careful, all output registers are clobbered by this operation,
+ * so for example it is not possible to save away a value in %o4
+ * across the trap.
+ */
+#define HV_FAST_SVC_SEND                0x80
+
+/* svc_recv()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_SVC_RECV
+ * ARG0:        service ID
+ * ARG1:        buffer real address
+ * ARG2:        buffer size
+ * RET0:        STATUS
+ * RET1:        recv_bytes
+ *
+ * Be careful, all output registers are clobbered by this operation,
+ * so for example it is not possible to save away a value in %o4
+ * across the trap.
+ */
+#define HV_FAST_SVC_RECV                0x81
+
+/* svc_getstatus()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_SVC_GETSTATUS
+ * ARG0:        service ID
+ * RET0:        STATUS
+ * RET1:        status bits
+ */
+#define HV_FAST_SVC_GETSTATUS           0x82
+
+/* svc_setstatus()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_SVC_SETSTATUS
+ * ARG0:        service ID
+ * ARG1:        bits to set
+ * RET0:        STATUS
+ */
+#define HV_FAST_SVC_SETSTATUS           0x83
+
+/* svc_clrstatus()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_SVC_CLRSTATUS
+ * ARG0:        service ID
+ * ARG1:        bits to clear
+ * RET0:        STATUS
+ */
+#define HV_FAST_SVC_CLRSTATUS           0x84
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_svc_send(unsigned long svc_id,
+                                    unsigned long buffer,
+                                    unsigned long buffer_size,
+                                    unsigned long *sent_bytes);
+extern unsigned long sun4v_svc_recv(unsigned long svc_id,
+                                    unsigned long buffer,
+                                    unsigned long buffer_size,
+                                    unsigned long *recv_bytes);
+extern unsigned long sun4v_svc_getstatus(unsigned long svc_id,
+                                         unsigned long *status_bits);
+extern unsigned long sun4v_svc_setstatus(unsigned long svc_id,
+                                         unsigned long status_bits);
+extern unsigned long sun4v_svc_clrstatus(unsigned long svc_id,
+                                         unsigned long status_bits);
+#endif
+
 /* Trap trace services.
  *
  * The hypervisor provides a trap tracing capability for privileged
@@ -2724,6 +2798,105 @@ struct hv_mmu_statistics {
  */
 #define HV_FAST_MMUSTAT_INFO            0x103
 
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_mmustat_conf(unsigned long ra, unsigned long *orig_ra);
+extern unsigned long sun4v_mmustat_info(unsigned long *ra);
+#endif
+
+/* NCS crypto services  */
+
+/* ncs_request() sub-function numbers */
+#define HV_NCS_QCONF                    0x01
+#define HV_NCS_QTAIL_UPDATE             0x02
+
+#ifndef __ASSEMBLY__
+struct hv_ncs_queue_entry {
+        /* MAU Control Register */
+        unsigned long   mau_control;
+#define MAU_CONTROL_INV_PARITY  0x0000000000002000
+#define MAU_CONTROL_STRAND      0x0000000000001800
+#define MAU_CONTROL_BUSY        0x0000000000000400
+#define MAU_CONTROL_INT         0x0000000000000200
+#define MAU_CONTROL_OP          0x00000000000001c0
+#define MAU_CONTROL_OP_SHIFT    6
+#define MAU_OP_LOAD_MA_MEMORY   0x0
+#define MAU_OP_STORE_MA_MEMORY  0x1
+#define MAU_OP_MODULAR_MULT     0x2
+#define MAU_OP_MODULAR_REDUCE   0x3
+#define MAU_OP_MODULAR_EXP_LOOP 0x4
+#define MAU_CONTROL_LEN         0x000000000000003f
+#define MAU_CONTROL_LEN_SHIFT   0
+
+        /* Real address of bytes to load or store bytes
+         * into/out-of the MAU.
+         */
+        unsigned long   mau_mpa;
+
+        /* Modular Arithmetic MA Offset Register.  */
+        unsigned long   mau_ma;
+
+        /* Modular Arithmetic N Prime Register.  */
+        unsigned long   mau_np;
+};
+
+struct hv_ncs_qconf_arg {
+        unsigned long   mid;      /* MAU ID, 1 per core on Niagara */
+        unsigned long   base;     /* Real address base of queue */
+        unsigned long   end;      /* Real address end of queue */
+        unsigned long   num_ents; /* Number of entries in queue */
+};
+
+struct hv_ncs_qtail_update_arg {
+        unsigned long   mid;      /* MAU ID, 1 per core on Niagara */
+        unsigned long   tail;     /* New tail index to use */
+        unsigned long   syncflag; /* only SYNCFLAG_SYNC is implemented */
+#define HV_NCS_SYNCFLAG_SYNC    0x00
+#define HV_NCS_SYNCFLAG_ASYNC   0x01
+};
+#endif
+
+/* ncs_request()
+ * TRAP:        HV_FAST_TRAP
+ * FUNCTION:    HV_FAST_NCS_REQUEST
+ * ARG0:        NCS sub-function
+ * ARG1:        sub-function argument real address
+ * ARG2:        size in bytes of sub-function argument
+ * RET0:        status
+ *
+ * The MAU chip of the Niagara processor is not directly accessible
+ * to privileged code, instead it is programmed indirectly via this
+ * hypervisor API.
+ *
+ * The interfaces defines a queue of MAU operations to perform.
+ * Privileged code registers a queue with the hypervisor by invoking
+ * this HVAPI with the HV_NCS_QCONF sub-function, which defines the
+ * base, end, and number of entries of the queue.  Each queue entry
+ * contains a MAU register struct block.
+ *
+ * The privileged code then proceeds to add entries to the queue and
+ * then invoke the HV_NCS_QTAIL_UPDATE sub-function.  Since only
+ * synchronous operations are supported by the current hypervisor,
+ * HV_NCS_QTAIL_UPDATE will run all the pending queue entries to
+ * completion and return HV_EOK, or return an error code.
+ *
+ * The real address of the sub-function argument must be aligned on at
+ * least an 8-byte boundary.
+ *
+ * The tail argument of HV_NCS_QTAIL_UPDATE is an index, not a byte
+ * offset, into the queue and must be less than or equal the 'num_ents'
+ * argument given in the HV_NCS_QCONF call.
+ */
+#define HV_FAST_NCS_REQUEST             0x110
+
+#ifndef __ASSEMBLY__
+extern unsigned long sun4v_ncs_request(unsigned long request,
+                                       unsigned long arg_ra,
+                                       unsigned long arg_size);
+#endif
+
+#define HV_FAST_FIRE_GET_PERFREG        0x120
+#define HV_FAST_FIRE_SET_PERFREG        0x121
+
 /* Function numbers for HV_CORE_TRAP.  */
 #define HV_CORE_SET_VER                 0x00
 #define HV_CORE_PUTCHAR                 0x01
diff --git a/include/asm-sparc64/smp.h b/include/asm-sparc64/smp.h
index f76e1492add5..4fb8c4bfb848 100644
--- a/include/asm-sparc64/smp.h
+++ b/include/asm-sparc64/smp.h
@@ -33,6 +33,8 @@ extern cpumask_t phys_cpu_present_map;
 #define cpu_possible_map phys_cpu_present_map
 
 extern cpumask_t cpu_sibling_map[NR_CPUS];
+extern cpumask_t cpu_core_map[NR_CPUS];
+extern int sparc64_multi_core;
 
 /*
  *      General functions that each host system must provide.
diff --git a/include/asm-sparc64/topology.h b/include/asm-sparc64/topology.h
index e0d450d600ec..290ac75f385b 100644
--- a/include/asm-sparc64/topology.h
+++ b/include/asm-sparc64/topology.h
@@ -1,12 +1,17 @@
 #ifndef _ASM_SPARC64_TOPOLOGY_H
 #define _ASM_SPARC64_TOPOLOGY_H
 
-#include <asm/spitfire.h>
-#define smt_capable()   (tlb_type == hypervisor)
+#ifdef CONFIG_SMP
+#define topology_physical_package_id(cpu)       (cpu_data(cpu).proc_id)
+#define topology_core_id(cpu)                   (cpu_data(cpu).core_id)
+#define topology_core_siblings(cpu)             (cpu_core_map[cpu])
+#define topology_thread_siblings(cpu)           (cpu_sibling_map[cpu])
+#define mc_capable()                            (sparc64_multi_core)
+#define smt_capable()                           (sparc64_multi_core)
+#endif /* CONFIG_SMP */
 
 #include <asm-generic/topology.h>
 
-#define topology_core_id(cpu)                   (cpu_data(cpu).core_id)
-#define topology_thread_siblings(cpu)           (cpu_sibling_map[cpu])
+#define cpu_coregroup_map(cpu)                  (cpu_core_map[cpu])
 
 #endif /* _ASM_SPARC64_TOPOLOGY_H */
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index e1013156c25e..f317c270d4bf 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -62,6 +62,8 @@ header-y += fadvise.h
 header-y += fd.h
 header-y += fdreg.h
 header-y += fib_rules.h
+header-y += firewire-cdev.h
+header-y += firewire-constants.h
 header-y += fuse.h
 header-y += genetlink.h
 header-y += gen_stats.h
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index 0365ec9fc0c9..c83534ee1e79 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -59,6 +59,7 @@ extern void *__alloc_bootmem_core(struct bootmem_data *bdata,
                                   unsigned long align,
                                   unsigned long goal,
                                   unsigned long limit);
+extern void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size);
 
 #ifndef CONFIG_HAVE_ARCH_BOOTMEM_NODE
 extern void reserve_bootmem(unsigned long addr, unsigned long size);
diff --git a/include/linux/errno.h b/include/linux/errno.h
index d90b80f9b28c..46685832ed99 100644
--- a/include/linux/errno.h
+++ b/include/linux/errno.h
@@ -5,7 +5,12 @@
 
 #ifdef __KERNEL__
 
-/* Should never be seen by user programs */
+/*
+ * These should never be seen by user programs.  To return one of ERESTART*
+ * codes, signal_pending() MUST be set.  Note that ptrace can observe these
+ * at syscall exit tracing, but they will never be left for the debugged user
+ * process to see.
+ */
 #define ERESTARTSYS     512
 #define ERESTARTNOINTR  513
 #define ERESTARTNOHAND  514     /* restart if no handler.. */
diff --git a/include/linux/ext4_fs.h b/include/linux/ext4_fs.h
index 54c576d414c3..de1f9f78625a 100644
--- a/include/linux/ext4_fs.h
+++ b/include/linux/ext4_fs.h
@@ -32,9 +32,9 @@
 /*
  * Define EXT4_RESERVATION to reserve data blocks for expanding files
  */
-#define EXT4_DEFAULT_RESERVE_BLOCKS     8
+#define EXT4_DEFAULT_RESERVE_BLOCKS     8
 /*max window size: 1024(direct blocks) + 3([t,d]indirect blocks) */
-#define EXT4_MAX_RESERVE_BLOCKS         1027
+#define EXT4_MAX_RESERVE_BLOCKS         1027
 #define EXT4_RESERVE_WINDOW_NOT_ALLOCATED 0
 /*
  * Always enable hashed directories
@@ -204,12 +204,12 @@ struct ext4_group_desc
 
 /* Used to pass group descriptor data when online resize is done */
 struct ext4_new_group_input {
-        __u32 group;            /* Group number for this data */
-        __u64 block_bitmap;     /* Absolute block number of block bitmap */
-        __u64 inode_bitmap;     /* Absolute block number of inode bitmap */
-        __u64 inode_table;      /* Absolute block number of inode table start */
-        __u32 blocks_count;     /* Total number of blocks in this group */
-        __u16 reserved_blocks;  /* Number of reserved blocks in this group */
+        __u32 group;            /* Group number for this data */
+        __u64 block_bitmap;     /* Absolute block number of block bitmap */
+        __u64 inode_bitmap;     /* Absolute block number of inode bitmap */
+        __u64 inode_table;      /* Absolute block number of inode table start */
+        __u32 blocks_count;     /* Total number of blocks in this group */
+        __u16 reserved_blocks;  /* Number of reserved blocks in this group */
         __u16 unused;
 };
 
@@ -310,7 +310,7 @@ struct ext4_inode {
                         __u8    l_i_frag;       /* Fragment number */
                         __u8    l_i_fsize;      /* Fragment size */
                         __le16  l_i_file_acl_high;
-                        __le16  l_i_uid_high;   /* these 2 fields    */
+                        __le16  l_i_uid_high;   /* these 2 fields */
                         __le16  l_i_gid_high;   /* were reserved2[0] */
                         __u32   l_i_reserved2;
                 } linux2;
@@ -513,7 +513,14 @@ struct ext4_super_block {
 /*150*/ __le32  s_blocks_count_hi;      /* Blocks count */
         __le32  s_r_blocks_count_hi;    /* Reserved blocks count */
         __le32  s_free_blocks_count_hi; /* Free blocks count */
-        __u32   s_reserved[169];        /* Padding to the end of the block */
+        __u16   s_min_extra_isize;      /* All inodes have at least # bytes */
+        __u16   s_want_extra_isize;     /* New inodes should reserve # bytes */
+        __u32   s_flags;                /* Miscellaneous flags */
+        __u16   s_raid_stride;          /* RAID stride */
+        __u16   s_mmp_interval;         /* # seconds to wait in MMP checking */
+        __u64   s_mmp_block;            /* Block for multi-mount protection */
+        __u32   s_raid_stripe_width;    /* blocks on all data disks (N*stride)*/
+        __u32   s_reserved[163];        /* Padding to the end of the block */
 };
 
 #ifdef __KERNEL__
@@ -780,9 +787,9 @@ void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
  * Ok, these declarations are also in <linux/kernel.h> but none of the
  * ext4 source programs needs to include it so they are duplicated here.
  */
-# define NORET_TYPE    /**/
-# define ATTRIB_NORET  __attribute__((noreturn))
-# define NORET_AND     noreturn,
+# define NORET_TYPE     /**/
+# define ATTRIB_NORET   __attribute__((noreturn))
+# define NORET_AND      noreturn,
 
 /* balloc.c */
 extern unsigned int ext4_block_group(struct super_block *sb,
diff --git a/include/linux/ext4_fs_extents.h b/include/linux/ext4_fs_extents.h
index 7eb1d73fc5d1..acfe59740b03 100644
--- a/include/linux/ext4_fs_extents.h
+++ b/include/linux/ext4_fs_extents.h
@@ -151,8 +151,8 @@ typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
         ((struct ext4_extent_idx *) (((char *) (__hdr__)) +     \
                                      sizeof(struct ext4_extent_header)))
 #define EXT_HAS_FREE_INDEX(__path__) \
-        (le16_to_cpu((__path__)->p_hdr->eh_entries) \
-                                     < le16_to_cpu((__path__)->p_hdr->eh_max))
+        (le16_to_cpu((__path__)->p_hdr->eh_entries) \
+                                     < le16_to_cpu((__path__)->p_hdr->eh_max))
 #define EXT_LAST_EXTENT(__hdr__) \
         (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
 #define EXT_LAST_INDEX(__hdr__) \
@@ -190,6 +190,7 @@ ext4_ext_invalidate_cache(struct inode *inode)
 
 extern int ext4_extent_tree_init(handle_t *, struct inode *);
 extern int ext4_ext_calc_credits_for_insert(struct inode *, struct ext4_ext_path *);
+extern unsigned int ext4_ext_check_overlap(struct inode *, struct ext4_extent *, struct ext4_ext_path *);
 extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path *, struct ext4_extent *);
 extern int ext4_ext_walk_space(struct inode *, unsigned long, unsigned long, ext_prepare_callback, void *);
 extern struct ext4_ext_path * ext4_ext_find_extent(struct inode *, int, struct ext4_ext_path *);
diff --git a/include/linux/ext4_fs_i.h b/include/linux/ext4_fs_i.h
index d5b177e5b395..9de494406995 100644
--- a/include/linux/ext4_fs_i.h
+++ b/include/linux/ext4_fs_i.h
@@ -41,14 +41,14 @@ struct ext4_reserve_window_node {
 
 struct ext4_block_alloc_info {
         /* information about reservation window */
-        struct ext4_reserve_window_node rsv_window_node;
+        struct ext4_reserve_window_node rsv_window_node;
         /*
          * was i_next_alloc_block in ext4_inode_info
          * is the logical (file-relative) number of the
          * most-recently-allocated block in this file.
          * We use this for detecting linearly ascending allocation requests.
          */
-        __u32                   last_alloc_logical_block;
+        __u32 last_alloc_logical_block;
         /*
          * Was i_next_alloc_goal in ext4_inode_info
          * is the *physical* companion to i_next_alloc_block.
@@ -56,7 +56,7 @@ struct ext4_block_alloc_info {
          * allocated to this file.  This give us the goal (target) for the next
          * allocation when we detect linearly ascending requests.
          */
-        ext4_fsblk_t            last_alloc_physical_block;
+        ext4_fsblk_t last_alloc_physical_block;
 };
 
 #define rsv_start rsv_window._rsv_start
diff --git a/include/linux/fb.h b/include/linux/fb.h
index c654d0e9ce33..66226824ab68 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -942,6 +942,7 @@ extern int fb_new_modelist(struct fb_info *info);
 
 extern struct fb_info *registered_fb[FB_MAX];
 extern int num_registered_fb;
+extern struct class *fb_class;
 
 static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
                                            u8 *src, u32 s_pitch, u32 height)
diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
index d4455eb2ae35..efbe1fda1a22 100644
--- a/include/linux/firewire-cdev.h
+++ b/include/linux/firewire-cdev.h
@@ -198,13 +198,15 @@ struct fw_cdev_create_iso_context {
         __u32 handle;
 };
 
+#define FW_CDEV_ISO_PAYLOAD_LENGTH(v)   (v)
+#define FW_CDEV_ISO_INTERRUPT           (1 << 16)
+#define FW_CDEV_ISO_SKIP                (1 << 17)
+#define FW_CDEV_ISO_TAG(v)              ((v) << 18)
+#define FW_CDEV_ISO_SY(v)               ((v) << 20)
+#define FW_CDEV_ISO_HEADER_LENGTH(v)    ((v) << 24)
+
 struct fw_cdev_iso_packet {
-        __u16 payload_length;   /* Length of indirect payload. */
-        __u32 interrupt : 1;    /* Generate interrupt on this packet */
-        __u32 skip : 1;         /* Set to not send packet at all. */
-        __u32 tag : 2;
-        __u32 sy : 4;
-        __u32 header_length : 8;        /* Length of immediate header. */
+        __u32 control;
         __u32 header[0];
 };
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 7cf0c54a46a7..b3ae77cccbb6 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -938,6 +938,7 @@ struct super_block {
         struct list_head        s_files;
 
         struct block_device     *s_bdev;
+        struct mtd_info         *s_mtd;
         struct list_head        s_instances;
         struct quota_info       s_dquot;        /* Diskquota specific options */
 
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index c0f7aec331c2..ae04901aa09a 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -3,6 +3,7 @@
 
 #ifdef __KERNEL__
 
+#include <linux/bitmap.h>
 #include <linux/if.h>
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
@@ -10,28 +11,9 @@
 
 struct ipv4_devconf
 {
-        int     accept_redirects;
-        int     send_redirects;
-        int     secure_redirects;
-        int     shared_media;
-        int     accept_source_route;
-        int     rp_filter;
-        int     proxy_arp;
-        int     bootp_relay;
-        int     log_martians;
-        int     forwarding;
-        int     mc_forwarding;
-        int     tag;
-        int     arp_filter;
-        int     arp_announce;
-        int     arp_ignore;
-        int     arp_accept;
-        int     medium_id;
-        int     no_xfrm;
-        int     no_policy;
-        int     force_igmp_version;
-        int     promote_secondaries;
         void    *sysctl;
+        int     data[__NET_IPV4_CONF_MAX - 1];
+        DECLARE_BITMAP(state, __NET_IPV4_CONF_MAX - 1);
 };
 
 extern struct ipv4_devconf ipv4_devconf;
@@ -60,30 +42,70 @@ struct in_device
         struct rcu_head         rcu_head;
 };
 
-#define IN_DEV_FORWARD(in_dev)          ((in_dev)->cnf.forwarding)
-#define IN_DEV_MFORWARD(in_dev)         (ipv4_devconf.mc_forwarding && (in_dev)->cnf.mc_forwarding)
-#define IN_DEV_RPFILTER(in_dev)         (ipv4_devconf.rp_filter && (in_dev)->cnf.rp_filter)
-#define IN_DEV_SOURCE_ROUTE(in_dev)     (ipv4_devconf.accept_source_route && (in_dev)->cnf.accept_source_route)
-#define IN_DEV_BOOTP_RELAY(in_dev)      (ipv4_devconf.bootp_relay && (in_dev)->cnf.bootp_relay)
-
-#define IN_DEV_LOG_MARTIANS(in_dev)     (ipv4_devconf.log_martians || (in_dev)->cnf.log_martians)
-#define IN_DEV_PROXY_ARP(in_dev)        (ipv4_devconf.proxy_arp || (in_dev)->cnf.proxy_arp)
-#define IN_DEV_SHARED_MEDIA(in_dev)     (ipv4_devconf.shared_media || (in_dev)->cnf.shared_media)
-#define IN_DEV_TX_REDIRECTS(in_dev)     (ipv4_devconf.send_redirects || (in_dev)->cnf.send_redirects)
-#define IN_DEV_SEC_REDIRECTS(in_dev)    (ipv4_devconf.secure_redirects || (in_dev)->cnf.secure_redirects)
-#define IN_DEV_IDTAG(in_dev)            ((in_dev)->cnf.tag)
-#define IN_DEV_MEDIUM_ID(in_dev)        ((in_dev)->cnf.medium_id)
-#define IN_DEV_PROMOTE_SECONDARIES(in_dev)      (ipv4_devconf.promote_secondaries || (in_dev)->cnf.promote_secondaries)
+#define IPV4_DEVCONF(cnf, attr) ((cnf).data[NET_IPV4_CONF_ ## attr - 1])
+#define IPV4_DEVCONF_ALL(attr) IPV4_DEVCONF(ipv4_devconf, attr)
+
+static inline int ipv4_devconf_get(struct in_device *in_dev, int index)
+{
+        index--;
+        return in_dev->cnf.data[index];
+}
+
+static inline void ipv4_devconf_set(struct in_device *in_dev, int index,
+                                    int val)
+{
+        index--;
+        set_bit(index, in_dev->cnf.state);
+        in_dev->cnf.data[index] = val;
+}
+
+static inline void ipv4_devconf_setall(struct in_device *in_dev)
+{
+        bitmap_fill(in_dev->cnf.state, __NET_IPV4_CONF_MAX - 1);
+}
+
+#define IN_DEV_CONF_GET(in_dev, attr) \
+        ipv4_devconf_get((in_dev), NET_IPV4_CONF_ ## attr)
+#define IN_DEV_CONF_SET(in_dev, attr, val) \
+        ipv4_devconf_set((in_dev), NET_IPV4_CONF_ ## attr, (val))
+
+#define IN_DEV_ANDCONF(in_dev, attr) \
+        (IPV4_DEVCONF_ALL(attr) && IN_DEV_CONF_GET((in_dev), attr))
+#define IN_DEV_ORCONF(in_dev, attr) \
+        (IPV4_DEVCONF_ALL(attr) || IN_DEV_CONF_GET((in_dev), attr))
+#define IN_DEV_MAXCONF(in_dev, attr) \
+        (max(IPV4_DEVCONF_ALL(attr), IN_DEV_CONF_GET((in_dev), attr)))
+
+#define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
+#define IN_DEV_MFORWARD(in_dev)         (IPV4_DEVCONF_ALL(MC_FORWARDING) && \
+                                         IPV4_DEVCONF((in_dev)->cnf, \
+                                                      MC_FORWARDING))
+#define IN_DEV_RPFILTER(in_dev)         IN_DEV_ANDCONF((in_dev), RP_FILTER)
+#define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
+                                                       ACCEPT_SOURCE_ROUTE)
+#define IN_DEV_BOOTP_RELAY(in_dev)      IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
+
+#define IN_DEV_LOG_MARTIANS(in_dev)     IN_DEV_ORCONF((in_dev), LOG_MARTIANS)
+#define IN_DEV_PROXY_ARP(in_dev)        IN_DEV_ORCONF((in_dev), PROXY_ARP)
+#define IN_DEV_SHARED_MEDIA(in_dev)     IN_DEV_ORCONF((in_dev), SHARED_MEDIA)
+#define IN_DEV_TX_REDIRECTS(in_dev)     IN_DEV_ORCONF((in_dev), SEND_REDIRECTS)
+#define IN_DEV_SEC_REDIRECTS(in_dev)    IN_DEV_ORCONF((in_dev), \
+                                                      SECURE_REDIRECTS)
+#define IN_DEV_IDTAG(in_dev)            IN_DEV_CONF_GET(in_dev, TAG)
+#define IN_DEV_MEDIUM_ID(in_dev)        IN_DEV_CONF_GET(in_dev, MEDIUM_ID)
+#define IN_DEV_PROMOTE_SECONDARIES(in_dev) \
+                                        IN_DEV_ORCONF((in_dev), \
+                                                      PROMOTE_SECONDARIES)
 
 #define IN_DEV_RX_REDIRECTS(in_dev) \
         ((IN_DEV_FORWARD(in_dev) && \
-          (ipv4_devconf.accept_redirects && (in_dev)->cnf.accept_redirects)) \
+          IN_DEV_ANDCONF((in_dev), ACCEPT_REDIRECTS)) \
          || (!IN_DEV_FORWARD(in_dev) && \
-          (ipv4_devconf.accept_redirects || (in_dev)->cnf.accept_redirects)))
+          IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS)))
 
-#define IN_DEV_ARPFILTER(in_dev)        (ipv4_devconf.arp_filter || (in_dev)->cnf.arp_filter)
-#define IN_DEV_ARP_ANNOUNCE(in_dev)     (max(ipv4_devconf.arp_announce, (in_dev)->cnf.arp_announce))
-#define IN_DEV_ARP_IGNORE(in_dev)       (max(ipv4_devconf.arp_ignore, (in_dev)->cnf.arp_ignore))
+#define IN_DEV_ARPFILTER(in_dev)        IN_DEV_ORCONF((in_dev), ARPFILTER)
+#define IN_DEV_ARP_ANNOUNCE(in_dev)     IN_DEV_MAXCONF((in_dev), ARP_ANNOUNCE)
+#define IN_DEV_ARP_IGNORE(in_dev)       IN_DEV_MAXCONF((in_dev), ARP_IGNORE)
 
 struct in_ifaddr
 {
@@ -108,7 +130,6 @@ extern struct net_device 	*ip_dev_find(__be32 addr);
 extern int              inet_addr_onlink(struct in_device *in_dev, __be32 a, __be32 b);
 extern int              devinet_ioctl(unsigned int cmd, void __user *);
 extern void             devinet_init(void);
-extern struct in_device *inetdev_init(struct net_device *dev);
 extern struct in_device *inetdev_by_index(int);
 extern __be32           inet_select_addr(const struct net_device *dev, __be32 dst, int scope);
 extern __be32           inet_confirm_addr(const struct net_device *dev, __be32 dst, __be32 local, int scope);
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 09ea01a8a99c..648bd1f0912d 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -209,9 +209,8 @@ enum {
         DEVCONF_RTR_PROBE_INTERVAL,
         DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN,
         DEVCONF_PROXY_NDP,
-        __DEVCONF_OPTIMISTIC_DAD,
-        DEVCONF_ACCEPT_SOURCE_ROUTE,
         DEVCONF_OPTIMISTIC_DAD,
+        DEVCONF_ACCEPT_SOURCE_ROUTE,
         DEVCONF_MAX
 };
 
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 85f7b1bd1482..a6a3113120a4 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -171,7 +171,6 @@ enum {
         ATA_FLAG_SKIP_D2H_BSY   = (1 << 12), /* can't wait for the first D2H
                                               * Register FIS clearing BSY */
         ATA_FLAG_DEBUGMSG       = (1 << 13),
-        ATA_FLAG_SETXFER_POLLING= (1 << 14), /* use polling for SETXFER */
         ATA_FLAG_IGN_SIMPLEX    = (1 << 15), /* ignore SIMPLEX */
         ATA_FLAG_NO_IORDY       = (1 << 16), /* controller lacks iordy */
         ATA_FLAG_ACPI_SATA      = (1 << 17), /* need native SATA ACPI layout */
diff --git a/include/linux/mtd/super.h b/include/linux/mtd/super.h
new file mode 100644
index 000000000000..4016dd6fe336
--- /dev/null
+++ b/include/linux/mtd/super.h
@@ -0,0 +1,30 @@
+/* MTD-based superblock handling
+ *
+ * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#ifndef __MTD_SUPER_H__
+#define __MTD_SUPER_H__
+
+#ifdef __KERNEL__
+
+#include <linux/mtd/mtd.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
+
+extern int get_sb_mtd(struct file_system_type *fs_type, int flags,
+                      const char *dev_name, void *data,
+                      int (*fill_super)(struct super_block *, void *, int),
+                      struct vfsmount *mnt);
+extern void kill_mtd_super(struct super_block *sb);
+
+
+#endif /* __KERNEL__ */
+
+#endif /* __MTD_SUPER_H__ */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index f671cd2f133f..3a70f553b28f 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -910,6 +910,17 @@ static inline int netif_rx_reschedule(struct net_device *dev, int undo)
         return 0;
 }
 
+/* same as netif_rx_complete, except that local_irq_save(flags)
+ * has already been issued
+ */
+static inline void __netif_rx_complete(struct net_device *dev)
+{
+        BUG_ON(!test_bit(__LINK_STATE_RX_SCHED, &dev->state));
+        list_del(&dev->poll_list);
+        smp_mb__before_clear_bit();
+        clear_bit(__LINK_STATE_RX_SCHED, &dev->state);
+}
+
 /* Remove interface from poll list: it must be in the poll list
  * on current cpu. This primitive is called by dev->poll(), when
  * it completes the work. The device cannot be out of poll list at this
@@ -920,10 +931,7 @@ static inline void netif_rx_complete(struct net_device *dev)
         unsigned long flags;
 
         local_irq_save(flags);
-        BUG_ON(!test_bit(__LINK_STATE_RX_SCHED, &dev->state));
-        list_del(&dev->poll_list);
-        smp_mb__before_clear_bit();
-        clear_bit(__LINK_STATE_RX_SCHED, &dev->state);
+        __netif_rx_complete(dev);
         local_irq_restore(flags);
 }
 
@@ -940,17 +948,6 @@ static inline void netif_poll_enable(struct net_device *dev)
         clear_bit(__LINK_STATE_RX_SCHED, &dev->state);
 }
 
-/* same as netif_rx_complete, except that local_irq_save(flags)
- * has already been issued
- */
-static inline void __netif_rx_complete(struct net_device *dev)
-{
-        BUG_ON(!test_bit(__LINK_STATE_RX_SCHED, &dev->state));
-        list_del(&dev->poll_list);
-        smp_mb__before_clear_bit();
-        clear_bit(__LINK_STATE_RX_SCHED, &dev->state);
-}
-
 static inline void netif_tx_lock(struct net_device *dev)
 {
         spin_lock(&dev->_xmit_lock);
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index 2f46dd728ee1..e992cd6b28f5 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -264,6 +264,26 @@ ipt_get_target(struct ipt_entry *e)
         __ret;                                                  \
 })
 
+/* fn returns 0 to continue iteration */
+#define IPT_ENTRY_ITERATE_CONTINUE(entries, size, n, fn, args...) \
+({                                                              \
+        unsigned int __i, __n;                                  \
+        int __ret = 0;                                          \
+        struct ipt_entry *__entry;                              \
+                                                                \
+        for (__i = 0, __n = 0; __i < (size);                    \
+             __i += __entry->next_offset, __n++) {              \
+                __entry = (void *)(entries) + __i;              \
+                if (__n < n)                                    \
+                        continue;                               \
+                                                                \
+                __ret = fn(__entry , ## args);                  \
+                if (__ret != 0)                                 \
+                        break;                                  \
+        }                                                       \
+        __ret;                                                  \
+})
+
 /*
  *      Main firewall chains definitions and global var's definitions.
  */
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 4712e269d8d3..6a115cffea34 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1292,6 +1292,7 @@
 #define PCI_DEVICE_ID_VIA_P4M890        0x0327
 #define PCI_DEVICE_ID_VIA_VT3324        0x0324
 #define PCI_DEVICE_ID_VIA_VT3336        0x0336
+#define PCI_DEVICE_ID_VIA_VT3351        0x0351
 #define PCI_DEVICE_ID_VIA_8371_0        0x0391
 #define PCI_DEVICE_ID_VIA_8501_0        0x0501
 #define PCI_DEVICE_ID_VIA_82C561        0x0561
@@ -1437,6 +1438,7 @@
 #define PCI_DEVICE_ID_SERVERWORKS_LE      0x0009
 #define PCI_DEVICE_ID_SERVERWORKS_GCNB_LE 0x0017
 #define PCI_DEVICE_ID_SERVERWORKS_EPB     0x0103
+#define PCI_DEVICE_ID_SERVERWORKS_HT1000_PCIX   0x0104
 #define PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE   0x0132
 #define PCI_DEVICE_ID_SERVERWORKS_OSB4    0x0200
 #define PCI_DEVICE_ID_SERVERWORKS_CSB5    0x0201
@@ -2267,11 +2269,11 @@
 #define PCI_DEVICE_ID_INTEL_ICH8_5      0x283e
 #define PCI_DEVICE_ID_INTEL_ICH8_6      0x2850
 #define PCI_DEVICE_ID_INTEL_ICH9_0      0x2910
-#define PCI_DEVICE_ID_INTEL_ICH9_1      0x2911
+#define PCI_DEVICE_ID_INTEL_ICH9_1      0x2917
 #define PCI_DEVICE_ID_INTEL_ICH9_2      0x2912
 #define PCI_DEVICE_ID_INTEL_ICH9_3      0x2913
 #define PCI_DEVICE_ID_INTEL_ICH9_4      0x2914
-#define PCI_DEVICE_ID_INTEL_ICH9_5      0x2915
+#define PCI_DEVICE_ID_INTEL_ICH9_5      0x2919
 #define PCI_DEVICE_ID_INTEL_ICH9_6      0x2930
 #define PCI_DEVICE_ID_INTEL_82855PM_HB  0x3340
 #define PCI_DEVICE_ID_INTEL_82830_HB    0x3575
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index 7c1ffbab7865..a8a6ea809da0 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -63,7 +63,7 @@ enum rfkill_state {
  * This structure represents a RF switch located on a network device.
  */
 struct rfkill {
-        char *name;
+        const char *name;
         enum rfkill_type type;
 
         enum rfkill_state state;
diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index a3ac4c896831..7f2c99d66e9d 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h
@@ -152,6 +152,7 @@
 #include <linux/sched.h>
 #include <linux/tty.h>
 #include <linux/mutex.h>
+#include <linux/sysrq.h>
 
 struct uart_port;
 struct uart_info;
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index c0398f5a8cb9..65f49fd7deff 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -62,13 +62,11 @@ struct unix_skb_parms {
 #define UNIXCREDS(skb)  (&UNIXCB((skb)).creds)
 #define UNIXSID(skb)    (&UNIXCB((skb)).secid)
 
-#define unix_state_rlock(s)     spin_lock(&unix_sk(s)->lock)
-#define unix_state_runlock(s)   spin_unlock(&unix_sk(s)->lock)
-#define unix_state_wlock(s)     spin_lock(&unix_sk(s)->lock)
-#define unix_state_wlock_nested(s) \
+#define unix_state_lock(s)      spin_lock(&unix_sk(s)->lock)
+#define unix_state_unlock(s)    spin_unlock(&unix_sk(s)->lock)
+#define unix_state_lock_nested(s) \
                                 spin_lock_nested(&unix_sk(s)->lock, \
                                 SINGLE_DEPTH_NESTING)
-#define unix_state_wunlock(s)   spin_unlock(&unix_sk(s)->lock)
 
 #ifdef __KERNEL__
 /* The AF_UNIX socket */
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index ed3a8872c6ca..83e41dd15ccd 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -64,7 +64,7 @@ struct fib_rules_ops
         void                    (*flush_cache)(void);
 
         int                     nlgroup;
-        struct nla_policy       *policy;
+        const struct nla_policy *policy;
         struct list_head        *rules_list;
         struct module           *owner;
 };
diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index adff4c898d50..b6eaca122db8 100644
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -60,7 +60,7 @@ struct genl_ops
 {
         u8                      cmd;
         unsigned int            flags;
-        struct nla_policy       *policy;
+        const struct nla_policy *policy;
         int                    (*doit)(struct sk_buff *skb,
                                        struct genl_info *info);
         int                    (*dumpit)(struct sk_buff *skb,
diff --git a/include/net/ip.h b/include/net/ip.h
index bb207db03675..abf2820a1125 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -143,6 +143,7 @@ struct ip_reply_arg {
         __wsum      csum;
         int         csumoffset; /* u16 offset of csum in iov[0].iov_base */
                                 /* -1 if not needed */ 
+        int         bound_dev_if;
 }; 
 
 void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *arg,
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 5a4a0366c24f..69252cbe05b0 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -213,7 +213,7 @@ extern void fib_select_default(const struct flowi *flp, struct fib_result *res);
 #endif /* CONFIG_IP_MULTIPLE_TABLES */
 
 /* Exported by fib_frontend.c */
-extern struct nla_policy rtm_ipv4_policy[];
+extern const struct nla_policy rtm_ipv4_policy[];
 extern void             ip_fib_init(void);
 extern int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
                                struct net_device *dev, __be32 *spec_dst, u32 *itag);
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 0bf325c29aff..7b510a9edb91 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -222,10 +222,10 @@ extern int		nlmsg_notify(struct sock *sk, struct sk_buff *skb,
                                      gfp_t flags);
 
 extern int              nla_validate(struct nlattr *head, int len, int maxtype,
-                                     struct nla_policy *policy);
+                                     const struct nla_policy *policy);
 extern int              nla_parse(struct nlattr *tb[], int maxtype,
                                   struct nlattr *head, int len,
-                                  struct nla_policy *policy);
+                                  const struct nla_policy *policy);
 extern struct nlattr *  nla_find(struct nlattr *head, int len, int attrtype);
 extern size_t           nla_strlcpy(char *dst, const struct nlattr *nla,
                                     size_t dstsize);
@@ -360,7 +360,7 @@ static inline struct nlmsghdr *nlmsg_next(struct nlmsghdr *nlh, int *remaining)
  */
 static inline int nlmsg_parse(struct nlmsghdr *nlh, int hdrlen,
                               struct nlattr *tb[], int maxtype,
-                              struct nla_policy *policy)
+                              const struct nla_policy *policy)
 {
         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
                 return -EINVAL;
@@ -392,7 +392,7 @@ static inline struct nlattr *nlmsg_find_attr(struct nlmsghdr *nlh,
  * @policy: validation policy
  */
 static inline int nlmsg_validate(struct nlmsghdr *nlh, int hdrlen, int maxtype,
-                                 struct nla_policy *policy)
+                                 const struct nla_policy *policy)
 {
         if (nlh->nlmsg_len < nlmsg_msg_size(hdrlen))
                 return -EINVAL;
@@ -729,7 +729,7 @@ static inline struct nlattr *nla_find_nested(struct nlattr *nla, int attrtype)
  */
 static inline int nla_parse_nested(struct nlattr *tb[], int maxtype,
                                    struct nlattr *nla,
-                                   struct nla_policy *policy)
+                                   const struct nla_policy *policy)
 {
         return nla_parse(tb, maxtype, nla_data(nla), nla_len(nla), policy);
 }
@@ -990,7 +990,7 @@ static inline int nla_nest_cancel(struct sk_buff *skb, struct nlattr *start)
  * Returns 0 on success or a negative error code.
  */
 static inline int nla_validate_nested(struct nlattr *start, int maxtype,
-                                      struct nla_policy *policy)
+                                      const struct nla_policy *policy)
 {
         return nla_validate(nla_data(start), nla_len(start), maxtype, policy);
 }
diff --git a/include/net/sock.h b/include/net/sock.h
index 689b886038da..dfeb8b13024f 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -218,13 +218,13 @@ struct sock {
         atomic_t                sk_rmem_alloc;
         atomic_t                sk_wmem_alloc;
         atomic_t                sk_omem_alloc;
+        int                     sk_sndbuf;
         struct sk_buff_head     sk_receive_queue;
         struct sk_buff_head     sk_write_queue;
         struct sk_buff_head     sk_async_wait_queue;
         int                     sk_wmem_queued;
         int                     sk_forward_alloc;
         gfp_t                   sk_allocation;
-        int                     sk_sndbuf;
         int                     sk_route_caps;
         int                     sk_gso_type;
         int                     sk_rcvlowat;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index e22b4f0305a3..a8af9ae00177 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -254,6 +254,12 @@ static inline int between(__u32 seq1, __u32 seq2, __u32 seq3)
         return seq3 - seq2 >= seq1 - seq2;
 }
 
+static inline int tcp_too_many_orphans(struct sock *sk, int num)
+{
+        return (num > sysctl_tcp_max_orphans) ||
+                (sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
+                 atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2]);
+}
 
 extern struct proto tcp_prot;
 
diff --git a/include/net/udp.h b/include/net/udp.h
index 496f89d45c8b..98755ebaf163 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -119,16 +119,9 @@ static inline void udp_lib_close(struct sock *sk, long timeout)
 }
 
 
-struct udp_get_port_ops {
-        int (*saddr_cmp)(const struct sock *sk1, const struct sock *sk2);
-        int (*saddr_any)(const struct sock *sk);
-        unsigned int (*hash_port_and_rcv_saddr)(__u16 port,
-                                                const struct sock *sk);
-};
-
 /* net/ipv4/udp.c */
 extern int      udp_get_port(struct sock *sk, unsigned short snum,
-                             const struct udp_get_port_ops *ops);
+                             int (*saddr_cmp)(const struct sock *, const struct sock *));
 extern void     udp_err(struct sk_buff *, u32);
 
 extern int      udp_sendmsg(struct kiocb *iocb, struct sock *sk,
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 50b4b424d1ca..635b0eafca95 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -120,5 +120,5 @@ static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
 
 extern void     udplite4_register(void);
 extern int      udplite_get_port(struct sock *sk, unsigned short snum,
-                                 const struct udp_get_port_ops *ops);
+                        int (*scmp)(const struct sock *, const struct sock *));
 #endif  /* _UDPLITE_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 39ef925d39dd..311f25af5e1a 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -237,7 +237,6 @@ extern int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
 extern int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
 extern void km_policy_notify(struct xfrm_policy *xp, int dir, struct km_event *c);
 extern void km_state_notify(struct xfrm_state *x, struct km_event *c);
-#define XFRM_ACQ_EXPIRES        30
 
 struct xfrm_tmpl;
 extern int km_query(struct xfrm_state *x, struct xfrm_tmpl *t, struct xfrm_policy *pol);
@@ -965,7 +964,7 @@ struct xfrmk_spdinfo {
 
 extern struct xfrm_state *xfrm_find_acq_byseq(u32 seq);
 extern int xfrm_state_delete(struct xfrm_state *x);
-extern void xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info);
+extern int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info);
 extern void xfrm_sad_getinfo(struct xfrmk_sadinfo *si);
 extern void xfrm_spd_getinfo(struct xfrmk_spdinfo *si);
 extern int xfrm_replay_check(struct xfrm_state *x, __be32 seq);
@@ -1021,13 +1020,13 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                                           struct xfrm_sec_ctx *ctx, int delete,
                                           int *err);
 struct xfrm_policy *xfrm_policy_byid(u8, int dir, u32 id, int delete, int *err);
-void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
+int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
 u32 xfrm_get_acqseq(void);
 void xfrm_alloc_spi(struct xfrm_state *x, __be32 minspi, __be32 maxspi);
 struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
                                   xfrm_address_t *daddr, xfrm_address_t *saddr,
                                   int create, unsigned short family);
-extern void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
+extern int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info);
 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
 extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
                           struct flowi *fl, int family, int strict);
diff --git a/include/sound/version.h b/include/sound/version.h
index 50ee4fd420fa..8e5b2f0f5946 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
-#define CONFIG_SND_VERSION "1.0.14rc4"
-#define CONFIG_SND_DATE " (Wed May 16 09:45:46 2007 UTC)"
+#define CONFIG_SND_VERSION "1.0.14"
+#define CONFIG_SND_DATE " (Thu May 31 09:03:25 2007 UTC)"
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index 338a9b489fbc..27478948b318 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -144,20 +144,21 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
         struct timespec ts;
         ktime_t t, *tp = NULL;
         int val2 = 0;
+        int cmd = op & FUTEX_CMD_MASK;
 
-        if (utime && (op == FUTEX_WAIT || op == FUTEX_LOCK_PI)) {
+        if (utime && (cmd == FUTEX_WAIT || cmd == FUTEX_LOCK_PI)) {
                 if (get_compat_timespec(&ts, utime))
                         return -EFAULT;
                 if (!timespec_valid(&ts))
                         return -EINVAL;
 
                 t = timespec_to_ktime(ts);
-                if (op == FUTEX_WAIT)
+                if (cmd == FUTEX_WAIT)
                         t = ktime_add(ktime_get(), t);
                 tp = &t;
         }
-        if (op == FUTEX_REQUEUE || op == FUTEX_CMP_REQUEUE
-            || op == FUTEX_CMP_REQUEUE_PI)
+        if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE
+            || cmd == FUTEX_CMP_REQUEUE_PI)
                 val2 = (int) (unsigned long) utime;
 
         return do_futex(uaddr, op, val, tp, uaddr2, val2, val3);
diff --git a/kernel/signal.c b/kernel/signal.c
index acdfc0549c6f..fe590e00db8d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -105,7 +105,11 @@ static int recalc_sigpending_tsk(struct task_struct *t)
                 set_tsk_thread_flag(t, TIF_SIGPENDING);
                 return 1;
         }
-        clear_tsk_thread_flag(t, TIF_SIGPENDING);
+        /*
+         * We must never clear the flag in another thread, or in current
+         * when it's possible the current syscall is returning -ERESTART*.
+         * So we don't clear it here, and only callers who know they should do.
+         */
         return 0;
 }
 
@@ -121,7 +125,9 @@ void recalc_sigpending_and_wake(struct task_struct *t)
 
 void recalc_sigpending(void)
 {
-        recalc_sigpending_tsk(current);
+        if (!recalc_sigpending_tsk(current))
+                clear_thread_flag(TIF_SIGPENDING);
+
 }
 
 /* Given the mask, find the first available signal that should be serviced. */
@@ -385,7 +391,8 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
                         }
                 }
         }
-        recalc_sigpending_tsk(tsk);
+        if (likely(tsk == current))
+                recalc_sigpending();
         if (signr && unlikely(sig_kernel_stop(signr))) {
                 /*
                  * Set a marker that we have dequeued a stop signal.  Our
@@ -1580,8 +1587,9 @@ static void ptrace_stop(int exit_code, int nostop_code, siginfo_t *info)
         /*
          * Queued signals ignored us while we were stopped for tracing.
          * So check for any that we should take before resuming user mode.
+         * This sets TIF_SIGPENDING, but never clears it.
          */
-        recalc_sigpending();
+        recalc_sigpending_tsk(current);
 }
 
 void ptrace_notify(int exit_code)
diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
index 868f1bceb07f..321693724ad7 100644
--- a/kernel/time/timer_stats.c
+++ b/kernel/time/timer_stats.c
@@ -117,21 +117,6 @@ static struct entry entries[MAX_ENTRIES];
 
 static atomic_t overflow_count;
 
-static void reset_entries(void)
-{
-        nr_entries = 0;
-        memset(entries, 0, sizeof(entries));
-        atomic_set(&overflow_count, 0);
-}
-
-static struct entry *alloc_entry(void)
-{
-        if (nr_entries >= MAX_ENTRIES)
-                return NULL;
-
-        return entries + nr_entries++;
-}
-
 /*
  * The entries are in a hash-table, for fast lookup:
  */
@@ -149,6 +134,22 @@ static struct entry *alloc_entry(void)
 
 static struct entry *tstat_hash_table[TSTAT_HASH_SIZE] __read_mostly;
 
+static void reset_entries(void)
+{
+        nr_entries = 0;
+        memset(entries, 0, sizeof(entries));
+        memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
+        atomic_set(&overflow_count, 0);
+}
+
+static struct entry *alloc_entry(void)
+{
+        if (nr_entries >= MAX_ENTRIES)
+                return NULL;
+
+        return entries + nr_entries++;
+}
+
 static int match_entries(struct entry *entry1, struct entry *entry2)
 {
         return entry1->timer       == entry2->timer       &&
@@ -202,12 +203,15 @@ static struct entry *tstat_lookup(struct entry *entry, char *comm)
         if (curr) {
                 *curr = *entry;
                 curr->count = 0;
+                curr->next = NULL;
                 memcpy(curr->comm, comm, TASK_COMM_LEN);
+
+                smp_mb(); /* Ensure that curr is initialized before insert */
+
                 if (prev)
                         prev->next = curr;
                 else
                         *head = curr;
-                curr->next = NULL;
         }
  out_unlock:
         spin_unlock(&table_lock);
@@ -232,10 +236,15 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
         /*
          * It doesnt matter which lock we take:
          */
-        spinlock_t *lock = &per_cpu(lookup_lock, raw_smp_processor_id());
+        spinlock_t *lock;
         struct entry *entry, input;
         unsigned long flags;
 
+        if (likely(!active))
+                return;
+
+        lock = &per_cpu(lookup_lock, raw_smp_processor_id());
+
         input.timer = timer;
         input.start_func = startf;
         input.expire_func = timerf;
@@ -360,6 +369,7 @@ static ssize_t tstats_write(struct file *file, const char __user *buf,
                 if (!active) {
                         reset_entries();
                         time_start = ktime_get();
+                        smp_mb();
                         active = 1;
                 }
                 break;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 1ba77ca7d165..da95e10cfd70 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -126,7 +126,10 @@ config TIMER_STATS
           reprogrammed. The statistics can be read from /proc/timer_stats.
           The statistics collection is started by writing 1 to /proc/timer_stats,
           writing 0 stops it. This feature is useful to collect information
-          about timer usage patterns in kernel and userspace.
+          about timer usage patterns in kernel and userspace. This feature
+          is lightweight if enabled in the kernel config but not activated
+          (it defaults to deactivated on bootup and will only be activated
+          if some application like powertop activates it explicitly).
 
 config DEBUG_SLAB
         bool "Debug slab memory allocations"
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 84279127fcd3..df9d554bea30 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -65,7 +65,7 @@ static int __add_zone(struct zone *zone, unsigned long phys_start_pfn)
         int zone_type;
 
         zone_type = zone - pgdat->node_zones;
-        if (!populated_zone(zone)) {
+        if (!zone->wait_table) {
                 int ret = 0;
                 ret = init_currently_empty_zone(zone, phys_start_pfn,
                                                 nr_pages, MEMMAP_HOTPLUG);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d8970623c566..bd8e33582d25 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -2689,7 +2689,7 @@ static void __init_refok alloc_node_mem_map(struct pglist_data *pgdat)
                         map = alloc_bootmem_node(pgdat, size);
                 pgdat->node_mem_map = map + (pgdat->node_start_pfn - start);
         }
-#ifdef CONFIG_FLATMEM
+#ifndef CONFIG_NEED_MULTIPLE_NODES
         /*
          * With no DISCONTIG, the global mem_map is just set as node 0's
          */
diff --git a/mm/slub.c b/mm/slub.c
index 3e5aefcb4075..51663a3c3c24 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2435,6 +2435,7 @@ void __init kmem_cache_init(void)
          */
         create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
                 sizeof(struct kmem_cache_node), GFP_KERNEL);
+        kmalloc_caches[0].refcount = -1;
 #endif
 
         /* Able to allocate the per node structures */
@@ -2482,6 +2483,12 @@ static int slab_unmergeable(struct kmem_cache *s)
         if (s->ctor)
                 return 1;
 
+        /*
+         * We may have set a slab to be unmergeable during bootstrap.
+         */
+        if (s->refcount < 0)
+                return 1;
+
         return 0;
 }
 
@@ -2601,6 +2608,19 @@ static void for_all_slabs(void (*func)(struct kmem_cache *, int), int cpu)
 }
 
 /*
+ * Version of __flush_cpu_slab for the case that interrupts
+ * are enabled.
+ */
+static void cpu_slab_flush(struct kmem_cache *s, int cpu)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        __flush_cpu_slab(s, cpu);
+        local_irq_restore(flags);
+}
+
+/*
  * Use the cpu notifier to insure that the cpu slabs are flushed when
  * necessary.
  */
@@ -2614,7 +2634,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
         case CPU_UP_CANCELED_FROZEN:
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
-                for_all_slabs(__flush_cpu_slab, cpu);
+                for_all_slabs(cpu_slab_flush, cpu);
                 break;
         default:
                 break;
diff --git a/mm/sparse.c b/mm/sparse.c
index 1302f8348d51..545e4d3afcdf 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -209,6 +209,12 @@ static int __meminit sparse_init_one_section(struct mem_section *ms,
         return 1;
 }
 
+__attribute__((weak))
+void *alloc_bootmem_high_node(pg_data_t *pgdat, unsigned long size)
+{
+        return NULL;
+}
+
 static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
 {
         struct page *map;
@@ -219,6 +225,11 @@ static struct page __init *sparse_early_mem_map_alloc(unsigned long pnum)
         if (map)
                 return map;
 
+        map = alloc_bootmem_high_node(NODE_DATA(nid),
+                       sizeof(struct page) * PAGES_PER_SECTION);
+        if (map)
+                return map;
+
         map = alloc_bootmem_node(NODE_DATA(nid),
                         sizeof(struct page) * PAGES_PER_SECTION);
         if (map)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index bd93c45778d4..de78c9dd713b 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -240,10 +240,8 @@ static int unregister_vlan_dev(struct net_device *real_dev,
                          * interlock with HW accelerating devices or SW vlan
                          * input packet processing.
                          */
-                        if (real_dev->features &
-                            (NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_FILTER)) {
+                        if (real_dev->features & NETIF_F_HW_VLAN_FILTER)
                                 real_dev->vlan_rx_kill_vid(real_dev, vlan_id);
-                        }
 
                         vlan_group_set_device(grp, vlan_id, NULL);
                         synchronize_net();
@@ -409,16 +407,14 @@ static struct net_device *register_vlan_device(const char *eth_IF_name,
         }
 
         if ((real_dev->features & NETIF_F_HW_VLAN_RX) &&
-            (real_dev->vlan_rx_register == NULL ||
-             real_dev->vlan_rx_kill_vid == NULL)) {
+            !real_dev->vlan_rx_register) {
                 printk(VLAN_DBG "%s: Device %s has buggy VLAN hw accel.\n",
                         __FUNCTION__, real_dev->name);
                 goto out_put_dev;
         }
 
         if ((real_dev->features & NETIF_F_HW_VLAN_FILTER) &&
-            (real_dev->vlan_rx_add_vid == NULL ||
-             real_dev->vlan_rx_kill_vid == NULL)) {
+            (!real_dev->vlan_rx_add_vid || !real_dev->vlan_rx_kill_vid)) {
                 printk(VLAN_DBG "%s: Device %s has buggy VLAN hw accel.\n",
                         __FUNCTION__, real_dev->name);
                 goto out_put_dev;
@@ -740,8 +736,7 @@ static int vlan_ioctl_handler(void __user *arg)
         case SET_VLAN_NAME_TYPE_CMD:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
-                if ((args.u.name_type >= 0) &&
-                    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
+                if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
                         vlan_name_type = args.u.name_type;
                         err = 0;
                 } else {
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 91b017016d5b..3fc697293819 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -121,6 +121,7 @@ void br_fdb_cleanup(unsigned long _data)
 {
         struct net_bridge *br = (struct net_bridge *)_data;
         unsigned long delay = hold_time(br);
+        unsigned long next_timer = jiffies + br->forward_delay;
         int i;
 
         spin_lock_bh(&br->hash_lock);
@@ -129,14 +130,21 @@ void br_fdb_cleanup(unsigned long _data)
                 struct hlist_node *h, *n;
 
                 hlist_for_each_entry_safe(f, h, n, &br->hash[i], hlist) {
-                        if (!f->is_static &&
-                            time_before_eq(f->ageing_timer + delay, jiffies))
+                        unsigned long this_timer;
+                        if (f->is_static)
+                                continue;
+                        this_timer = f->ageing_timer + delay;
+                        if (time_before_eq(this_timer, jiffies))
                                 fdb_delete(f);
+                        else if (this_timer < next_timer)
+                                next_timer = this_timer;
                 }
         }
         spin_unlock_bh(&br->hash_lock);
 
-        mod_timer(&br->gc_timer, jiffies + HZ/10);
+        /* Add HZ/4 to ensure we round the jiffies upwards to be after the next
+         * timer, otherwise we might round down and will have no-op run. */
+        mod_timer(&br->gc_timer, round_jiffies(next_timer + HZ/4));
 }
 
 /* Completely flush all dynamic entries in forwarding database.*/
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index 0e035d6162cc..e38034aa56f5 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -178,7 +178,8 @@ void br_transmit_config(struct net_bridge_port *p)
                 br_send_config_bpdu(p, &bpdu);
                 p->topology_change_ack = 0;
                 p->config_pending = 0;
-                mod_timer(&p->hold_timer, jiffies + BR_HOLD_TIME);
+                mod_timer(&p->hold_timer,
+                          round_jiffies(jiffies + BR_HOLD_TIME));
         }
 }
 
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index 24e0ca4a3131..77f5255e6915 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -42,7 +42,7 @@ static void br_hello_timer_expired(unsigned long arg)
         if (br->dev->flags & IFF_UP) {
                 br_config_bpdu_generation(br);
 
-                mod_timer(&br->hello_timer, jiffies + br->hello_time);
+                mod_timer(&br->hello_timer, round_jiffies(jiffies + br->hello_time));
         }
         spin_unlock(&br->lock);
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 5a7f20f78574..26090621ea6b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2577,7 +2577,7 @@ unsigned dev_get_flags(const struct net_device *dev)
 
 int dev_change_flags(struct net_device *dev, unsigned flags)
 {
-        int ret;
+        int ret, changes;
         int old_flags = dev->flags;
 
         /*
@@ -2632,8 +2632,10 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
                 dev_set_allmulti(dev, inc);
         }
 
-        if (old_flags ^ dev->flags)
-                rtmsg_ifinfo(RTM_NEWLINK, dev, old_flags ^ dev->flags);
+        /* Exclude state transition flags, already notified */
+        changes = (old_flags ^ dev->flags) & ~(IFF_UP | IFF_RUNNING);
+        if (changes)
+                rtmsg_ifinfo(RTM_NEWLINK, dev, changes);
 
         return ret;
 }
diff --git a/net/core/dst.c b/net/core/dst.c
index 764bccb3d992..c6a05879d58c 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -111,13 +111,7 @@ out:
         spin_unlock(&dst_lock);
 }
 
-static int dst_discard_in(struct sk_buff *skb)
-{
-        kfree_skb(skb);
-        return 0;
-}
-
-static int dst_discard_out(struct sk_buff *skb)
+static int dst_discard(struct sk_buff *skb)
 {
         kfree_skb(skb);
         return 0;
@@ -138,8 +132,7 @@ void * dst_alloc(struct dst_ops * ops)
         dst->ops = ops;
         dst->lastuse = jiffies;
         dst->path = dst;
-        dst->input = dst_discard_in;
-        dst->output = dst_discard_out;
+        dst->input = dst->output = dst_discard;
 #if RT_CACHE_DEBUG >= 2
         atomic_inc(&dst_total);
 #endif
@@ -153,8 +146,7 @@ static void ___dst_free(struct dst_entry * dst)
            protocol module is unloaded.
          */
         if (dst->dev == NULL || !(dst->dev->flags&IFF_UP)) {
-                dst->input = dst_discard_in;
-                dst->output = dst_discard_out;
+                dst->input = dst->output = dst_discard;
         }
         dst->obsolete = 2;
 }
@@ -242,8 +234,7 @@ static inline void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
                 return;
 
         if (!unregister) {
-                dst->input = dst_discard_in;
-                dst->output = dst_discard_out;
+                dst->input = dst->output = dst_discard;
         } else {
                 dst->dev = &loopback_dev;
                 dev_hold(&loopback_dev);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 6f3bb73053c2..9df26a07f067 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1761,7 +1761,7 @@ static inline struct neigh_parms *lookup_neigh_params(struct neigh_table *tbl,
         return NULL;
 }
 
-static struct nla_policy nl_neightbl_policy[NDTA_MAX+1] __read_mostly = {
+static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = {
         [NDTA_NAME]             = { .type = NLA_STRING },
         [NDTA_THRESH1]          = { .type = NLA_U32 },
         [NDTA_THRESH2]          = { .type = NLA_U32 },
@@ -1770,7 +1770,7 @@ static struct nla_policy nl_neightbl_policy[NDTA_MAX+1] __read_mostly = {
         [NDTA_PARMS]            = { .type = NLA_NESTED },
 };
 
-static struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] __read_mostly = {
+static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = {
         [NDTPA_IFINDEX]                 = { .type = NLA_U32 },
         [NDTPA_QUEUE_LEN]               = { .type = NLA_U32 },
         [NDTPA_PROXY_QLEN]              = { .type = NLA_U32 },
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 27da9cdec6a8..02e8bf084277 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -551,7 +551,7 @@ cont:
         return skb->len;
 }
 
-static struct nla_policy ifla_policy[IFLA_MAX+1] __read_mostly = {
+static const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_IFNAME]           = { .type = NLA_STRING, .len = IFNAMSIZ-1 },
         [IFLA_MAP]              = { .len = sizeof(struct rtnl_link_ifmap) },
         [IFLA_MTU]              = { .type = NLA_U32 },
@@ -580,7 +580,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 
         err = -EINVAL;
         ifm = nlmsg_data(nlh);
-        if (ifm->ifi_index >= 0)
+        if (ifm->ifi_index > 0)
                 dev = dev_get_by_index(ifm->ifi_index);
         else if (tb[IFLA_IFNAME])
                 dev = dev_get_by_name(ifname);
@@ -672,7 +672,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
          * name provided implies that a name change has been
          * requested.
          */
-        if (ifm->ifi_index >= 0 && ifname[0]) {
+        if (ifm->ifi_index > 0 && ifname[0]) {
                 err = dev_change_name(dev, ifname);
                 if (err < 0)
                         goto errout_dev;
@@ -740,7 +740,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 return err;
 
         ifm = nlmsg_data(nlh);
-        if (ifm->ifi_index >= 0) {
+        if (ifm->ifi_index > 0) {
                 dev = dev_get_by_index(ifm->ifi_index);
                 if (dev == NULL)
                         return -ENODEV;
diff --git a/net/core/sock.c b/net/core/sock.c
index 7e51d3a5e4f6..c14ce0198d25 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -998,7 +998,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
         __sk_dst_set(sk, dst);
         sk->sk_route_caps = dst->dev->features;
         if (sk->sk_route_caps & NETIF_F_GSO)
-                sk->sk_route_caps |= NETIF_F_GSO_MASK;
+                sk->sk_route_caps |= NETIF_F_GSO_SOFTWARE;
         if (sk_can_gso(sk)) {
                 if (dst->header_len)
                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index f34aca041a25..6d5ea9762040 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -25,6 +25,7 @@ extern int sysctl_core_destroy_delay;
 extern u32 sysctl_xfrm_aevent_etime;
 extern u32 sysctl_xfrm_aevent_rseqth;
 extern int sysctl_xfrm_larval_drop;
+extern u32 sysctl_xfrm_acq_expires;
 #endif
 
 ctl_table core_table[] = {
@@ -127,6 +128,14 @@ ctl_table core_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec
         },
+        {
+                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "xfrm_acq_expires",
+                .data           = &sysctl_xfrm_acq_expires,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec
+        },
 #endif /* CONFIG_XFRM */
 #endif /* CONFIG_NET */
         {
diff --git a/net/core/utils.c b/net/core/utils.c
index adecfd281ae9..2030bb8c2d30 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -139,16 +139,16 @@ int in4_pton(const char *src, int srclen,
         while(1) {
                 int c;
                 c = xdigit2bin(srclen > 0 ? *s : '\0', delim);
-                if (!(c & (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM))) {
+                if (!(c & (IN6PTON_DIGIT | IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK))) {
                         goto out;
                 }
-                if (c & (IN6PTON_DOT | IN6PTON_DELIM)) {
+                if (c & (IN6PTON_DOT | IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
                         if (w == 0)
                                 goto out;
                         *d++ = w & 0xff;
                         w = 0;
                         i++;
-                        if (c & IN6PTON_DELIM) {
+                        if (c & (IN6PTON_DELIM | IN6PTON_COLON_MASK)) {
                                 if (i != 4)
                                         goto out;
                                 break;
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 1f5e3ba62065..43a3adb027e7 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -128,7 +128,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
         int error = 0, cnt = 0;
         unsigned char *tbuf;
 
-        if (!buf || len < 0)
+        if (!buf)
                 return -EINVAL;
 
         if (len == 0)
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 764a56a13e38..ab41c1879fd4 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -638,7 +638,7 @@ static struct dn_dev *dn_dev_by_index(int ifindex)
         return dn_dev;
 }
 
-static struct nla_policy dn_ifa_policy[IFA_MAX+1] __read_mostly = {
+static const struct nla_policy dn_ifa_policy[IFA_MAX+1] = {
         [IFA_ADDRESS]           = { .type = NLA_U16 },
         [IFA_LOCAL]             = { .type = NLA_U16 },
         [IFA_LABEL]             = { .type = NLA_STRING,
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 17a1932216d6..84ff3dd37070 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -108,7 +108,7 @@ errout:
         return err;
 }
 
-static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
+static const struct nla_policy dn_fib_rule_policy[FRA_MAX+1] = {
         FRA_GENERIC_POLICY,
 };
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7110779a0244..e00767e8ebd9 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -877,7 +877,7 @@ static int arp_process(struct sk_buff *skb)
 
         n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 
-        if (ipv4_devconf.arp_accept) {
+        if (IPV4_DEVCONF_ALL(ARP_ACCEPT)) {
                 /* Unsolicited ARP is not accepted by default.
                    It is possible, that this option should be enabled for some
                    devices (strip is candidate)
@@ -987,11 +987,11 @@ static int arp_req_set(struct arpreq *r, struct net_device * dev)
                         return 0;
                 }
                 if (dev == NULL) {
-                        ipv4_devconf.proxy_arp = 1;
+                        IPV4_DEVCONF_ALL(PROXY_ARP) = 1;
                         return 0;
                 }
                 if (__in_dev_get_rtnl(dev)) {
-                        __in_dev_get_rtnl(dev)->cnf.proxy_arp = 1;
+                        IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, 1);
                         return 0;
                 }
                 return -ENXIO;
@@ -1093,11 +1093,12 @@ static int arp_req_delete(struct arpreq *r, struct net_device * dev)
                         return pneigh_delete(&arp_tbl, &ip, dev);
                 if (mask == 0) {
                         if (dev == NULL) {
-                                ipv4_devconf.proxy_arp = 0;
+                                IPV4_DEVCONF_ALL(PROXY_ARP) = 0;
                                 return 0;
                         }
                         if (__in_dev_get_rtnl(dev)) {
-                                __in_dev_get_rtnl(dev)->cnf.proxy_arp = 0;
+                                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev),
+                                                PROXY_ARP, 0);
                                 return 0;
                         }
                         return -ENXIO;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index dd02a45d0f67..0301dd468cf4 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -50,8 +50,12 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                RT_CONN_FLAGS(sk), oif,
                                sk->sk_protocol,
                                inet->sport, usin->sin_port, sk, 1);
-        if (err)
+        if (err) {
+                if (err == -ENETUNREACH)
+                        IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
                 return err;
+        }
+
         if ((rt->rt_flags & RTCF_BROADCAST) && !sock_flag(sk, SOCK_BROADCAST)) {
                 ip_rt_put(rt);
                 return -EACCES;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 7f95e6e9beeb..fa97b96a3d89 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -64,21 +64,27 @@
 #include <net/rtnetlink.h>
 
 struct ipv4_devconf ipv4_devconf = {
-        .accept_redirects = 1,
-        .send_redirects =  1,
-        .secure_redirects = 1,
-        .shared_media =   1,
+        .data = {
+                [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
+                [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
+                [NET_IPV4_CONF_SECURE_REDIRECTS - 1] = 1,
+                [NET_IPV4_CONF_SHARED_MEDIA - 1] = 1,
+        },
 };
 
 static struct ipv4_devconf ipv4_devconf_dflt = {
-        .accept_redirects =  1,
-        .send_redirects =    1,
-        .secure_redirects =  1,
-        .shared_media =      1,
-        .accept_source_route = 1,
+        .data = {
+                [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
+                [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
+                [NET_IPV4_CONF_SECURE_REDIRECTS - 1] = 1,
+                [NET_IPV4_CONF_SHARED_MEDIA - 1] = 1,
+                [NET_IPV4_CONF_ACCEPT_SOURCE_ROUTE - 1] = 1,
+        },
 };
 
-static struct nla_policy ifa_ipv4_policy[IFA_MAX+1] __read_mostly = {
+#define IPV4_DEVCONF_DFLT(attr) IPV4_DEVCONF(ipv4_devconf_dflt, attr)
+
+static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
         [IFA_LOCAL]             = { .type = NLA_U32 },
         [IFA_ADDRESS]           = { .type = NLA_U32 },
         [IFA_BROADCAST]         = { .type = NLA_U32 },
@@ -141,7 +147,7 @@ void in_dev_finish_destroy(struct in_device *idev)
         }
 }
 
-struct in_device *inetdev_init(struct net_device *dev)
+static struct in_device *inetdev_init(struct net_device *dev)
 {
         struct in_device *in_dev;
 
@@ -399,12 +405,10 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
         ASSERT_RTNL();
 
         if (!in_dev) {
-                in_dev = inetdev_init(dev);
-                if (!in_dev) {
-                        inet_free_ifa(ifa);
-                        return -ENOBUFS;
-                }
+                inet_free_ifa(ifa);
+                return -ENOBUFS;
         }
+        ipv4_devconf_setall(in_dev);
         if (ifa->ifa_dev != in_dev) {
                 BUG_TRAP(!ifa->ifa_dev);
                 in_dev_hold(in_dev);
@@ -514,13 +518,12 @@ static struct in_ifaddr *rtm_to_ifaddr(struct nlmsghdr *nlh)
 
         in_dev = __in_dev_get_rtnl(dev);
         if (in_dev == NULL) {
-                in_dev = inetdev_init(dev);
-                if (in_dev == NULL) {
-                        err = -ENOBUFS;
-                        goto errout;
-                }
+                err = -ENOBUFS;
+                goto errout;
         }
 
+        ipv4_devconf_setall(in_dev);
+
         ifa = inet_alloc_ifa();
         if (ifa == NULL) {
                 /*
@@ -1057,11 +1060,12 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
         if (!in_dev) {
                 if (event == NETDEV_REGISTER) {
                         in_dev = inetdev_init(dev);
-                        if (!in_dev)
-                                panic("devinet: Failed to create loopback\n");
                         if (dev == &loopback_dev) {
-                                in_dev->cnf.no_xfrm = 1;
-                                in_dev->cnf.no_policy = 1;
+                                if (!in_dev)
+                                        panic("devinet: "
+                                              "Failed to create loopback\n");
+                                IN_DEV_CONF_SET(in_dev, NOXFRM, 1);
+                                IN_DEV_CONF_SET(in_dev, NOPOLICY, 1);
                         }
                 }
                 goto out;
@@ -1237,13 +1241,98 @@ errout:
 
 #ifdef CONFIG_SYSCTL
 
+static void devinet_copy_dflt_conf(int i)
+{
+        struct net_device *dev;
+
+        read_lock(&dev_base_lock);
+        for_each_netdev(dev) {
+                struct in_device *in_dev;
+                rcu_read_lock();
+                in_dev = __in_dev_get_rcu(dev);
+                if (in_dev && !test_bit(i, in_dev->cnf.state))
+                        in_dev->cnf.data[i] = ipv4_devconf_dflt.data[i];
+                rcu_read_unlock();
+        }
+        read_unlock(&dev_base_lock);
+}
+
+static int devinet_conf_proc(ctl_table *ctl, int write,
+                             struct file* filp, void __user *buffer,
+                             size_t *lenp, loff_t *ppos)
+{
+        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+
+        if (write) {
+                struct ipv4_devconf *cnf = ctl->extra1;
+                int i = (int *)ctl->data - cnf->data;
+
+                set_bit(i, cnf->state);
+
+                if (cnf == &ipv4_devconf_dflt)
+                        devinet_copy_dflt_conf(i);
+        }
+
+        return ret;
+}
+
+static int devinet_conf_sysctl(ctl_table *table, int __user *name, int nlen,
+                               void __user *oldval, size_t __user *oldlenp,
+                               void __user *newval, size_t newlen)
+{
+        struct ipv4_devconf *cnf;
+        int *valp = table->data;
+        int new;
+        int i;
+
+        if (!newval || !newlen)
+                return 0;
+
+        if (newlen != sizeof(int))
+                return -EINVAL;
+
+        if (get_user(new, (int __user *)newval))
+                return -EFAULT;
+
+        if (new == *valp)
+                return 0;
+
+        if (oldval && oldlenp) {
+                size_t len;
+
+                if (get_user(len, oldlenp))
+                        return -EFAULT;
+
+                if (len) {
+                        if (len > table->maxlen)
+                                len = table->maxlen;
+                        if (copy_to_user(oldval, valp, len))
+                                return -EFAULT;
+                        if (put_user(len, oldlenp))
+                                return -EFAULT;
+                }
+        }
+
+        *valp = new;
+
+        cnf = table->extra1;
+        i = (int *)table->data - cnf->data;
+
+        set_bit(i, cnf->state);
+
+        if (cnf == &ipv4_devconf_dflt)
+                devinet_copy_dflt_conf(i);
+
+        return 1;
+}
+
 void inet_forward_change(void)
 {
         struct net_device *dev;
-        int on = ipv4_devconf.forwarding;
+        int on = IPV4_DEVCONF_ALL(FORWARDING);
 
-        ipv4_devconf.accept_redirects = !on;
-        ipv4_devconf_dflt.forwarding = on;
+        IPV4_DEVCONF_ALL(ACCEPT_REDIRECTS) = !on;
+        IPV4_DEVCONF_DFLT(FORWARDING) = on;
 
         read_lock(&dev_base_lock);
         for_each_netdev(dev) {
@@ -1251,7 +1340,7 @@ void inet_forward_change(void)
                 rcu_read_lock();
                 in_dev = __in_dev_get_rcu(dev);
                 if (in_dev)
-                        in_dev->cnf.forwarding = on;
+                        IN_DEV_CONF_SET(in_dev, FORWARDING, on);
                 rcu_read_unlock();
         }
         read_unlock(&dev_base_lock);
@@ -1268,9 +1357,9 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
         int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
 
         if (write && *valp != val) {
-                if (valp == &ipv4_devconf.forwarding)
+                if (valp == &IPV4_DEVCONF_ALL(FORWARDING))
                         inet_forward_change();
-                else if (valp != &ipv4_devconf_dflt.forwarding)
+                else if (valp != &IPV4_DEVCONF_DFLT(FORWARDING))
                         rt_cache_flush(0);
         }
 
@@ -1295,42 +1384,43 @@ int ipv4_doint_and_flush_strategy(ctl_table *table, int __user *name, int nlen,
                                   void __user *oldval, size_t __user *oldlenp,
                                   void __user *newval, size_t newlen)
 {
-        int *valp = table->data;
-        int new;
+        int ret = devinet_conf_sysctl(table, name, nlen, oldval, oldlenp,
+                                      newval, newlen);
 
-        if (!newval || !newlen)
-                return 0;
+        if (ret == 1)
+                rt_cache_flush(0);
 
-        if (newlen != sizeof(int))
-                return -EINVAL;
+        return ret;
+}
 
-        if (get_user(new, (int __user *)newval))
-                return -EFAULT;
 
-        if (new == *valp)
-                return 0;
+#define DEVINET_SYSCTL_ENTRY(attr, name, mval, proc, sysctl) \
+        { \
+                .ctl_name       = NET_IPV4_CONF_ ## attr, \
+                .procname       = name, \
+                .data           = ipv4_devconf.data + \
+                                  NET_IPV4_CONF_ ## attr - 1, \
+                .maxlen         = sizeof(int), \
+                .mode           = mval, \
+                .proc_handler   = proc, \
+                .strategy       = sysctl, \
+                .extra1         = &ipv4_devconf, \
+        }
 
-        if (oldval && oldlenp) {
-                size_t len;
+#define DEVINET_SYSCTL_RW_ENTRY(attr, name) \
+        DEVINET_SYSCTL_ENTRY(attr, name, 0644, devinet_conf_proc, \
+                             devinet_conf_sysctl)
 
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
+#define DEVINET_SYSCTL_RO_ENTRY(attr, name) \
+        DEVINET_SYSCTL_ENTRY(attr, name, 0444, devinet_conf_proc, \
+                             devinet_conf_sysctl)
 
-                if (len) {
-                        if (len > table->maxlen)
-                                len = table->maxlen;
-                        if (copy_to_user(oldval, valp, len))
-                                return -EFAULT;
-                        if (put_user(len, oldlenp))
-                                return -EFAULT;
-                }
-        }
-
-        *valp = new;
-        rt_cache_flush(0);
-        return 1;
-}
+#define DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, proc, sysctl) \
+        DEVINET_SYSCTL_ENTRY(attr, name, 0644, proc, sysctl)
 
+#define DEVINET_SYSCTL_FLUSHING_ENTRY(attr, name) \
+        DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush, \
+                                     ipv4_doint_and_flush_strategy)
 
 static struct devinet_sysctl_table {
         struct ctl_table_header *sysctl_header;
@@ -1341,178 +1431,34 @@ static struct devinet_sysctl_table {
         ctl_table               devinet_root_dir[2];
 } devinet_sysctl = {
         .devinet_vars = {
-                {
-                        .ctl_name       = NET_IPV4_CONF_FORWARDING,
-                        .procname       = "forwarding",
-                        .data           = &ipv4_devconf.forwarding,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &devinet_sysctl_forward,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_MC_FORWARDING,
-                        .procname       = "mc_forwarding",
-                        .data           = &ipv4_devconf.mc_forwarding,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0444,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_ACCEPT_REDIRECTS,
-                        .procname       = "accept_redirects",
-                        .data           = &ipv4_devconf.accept_redirects,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_SECURE_REDIRECTS,
-                        .procname       = "secure_redirects",
-                        .data           = &ipv4_devconf.secure_redirects,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_SHARED_MEDIA,
-                        .procname       = "shared_media",
-                        .data           = &ipv4_devconf.shared_media,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_RP_FILTER,
-                        .procname       = "rp_filter",
-                        .data           = &ipv4_devconf.rp_filter,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_SEND_REDIRECTS,
-                        .procname       = "send_redirects",
-                        .data           = &ipv4_devconf.send_redirects,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_ACCEPT_SOURCE_ROUTE,
-                        .procname       = "accept_source_route",
-                        .data           = &ipv4_devconf.accept_source_route,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_PROXY_ARP,
-                        .procname       = "proxy_arp",
-                        .data           = &ipv4_devconf.proxy_arp,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_MEDIUM_ID,
-                        .procname       = "medium_id",
-                        .data           = &ipv4_devconf.medium_id,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_BOOTP_RELAY,
-                        .procname       = "bootp_relay",
-                        .data           = &ipv4_devconf.bootp_relay,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_LOG_MARTIANS,
-                        .procname       = "log_martians",
-                        .data           = &ipv4_devconf.log_martians,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_TAG,
-                        .procname       = "tag",
-                        .data           = &ipv4_devconf.tag,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_ARPFILTER,
-                        .procname       = "arp_filter",
-                        .data           = &ipv4_devconf.arp_filter,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_ARP_ANNOUNCE,
-                        .procname       = "arp_announce",
-                        .data           = &ipv4_devconf.arp_announce,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_ARP_IGNORE,
-                        .procname       = "arp_ignore",
-                        .data           = &ipv4_devconf.arp_ignore,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_ARP_ACCEPT,
-                        .procname       = "arp_accept",
-                        .data           = &ipv4_devconf.arp_accept,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &proc_dointvec,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_NOXFRM,
-                        .procname       = "disable_xfrm",
-                        .data           = &ipv4_devconf.no_xfrm,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &ipv4_doint_and_flush,
-                        .strategy       = &ipv4_doint_and_flush_strategy,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_NOPOLICY,
-                        .procname       = "disable_policy",
-                        .data           = &ipv4_devconf.no_policy,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &ipv4_doint_and_flush,
-                        .strategy       = &ipv4_doint_and_flush_strategy,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_FORCE_IGMP_VERSION,
-                        .procname       = "force_igmp_version",
-                        .data           = &ipv4_devconf.force_igmp_version,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &ipv4_doint_and_flush,
-                        .strategy       = &ipv4_doint_and_flush_strategy,
-                },
-                {
-                        .ctl_name       = NET_IPV4_CONF_PROMOTE_SECONDARIES,
-                        .procname       = "promote_secondaries",
-                        .data           = &ipv4_devconf.promote_secondaries,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = &ipv4_doint_and_flush,
-                        .strategy       = &ipv4_doint_and_flush_strategy,
-                },
+                DEVINET_SYSCTL_COMPLEX_ENTRY(FORWARDING, "forwarding",
+                                             devinet_sysctl_forward,
+                                             devinet_conf_sysctl),
+                DEVINET_SYSCTL_RO_ENTRY(MC_FORWARDING, "mc_forwarding"),
+
+                DEVINET_SYSCTL_RW_ENTRY(ACCEPT_REDIRECTS, "accept_redirects"),
+                DEVINET_SYSCTL_RW_ENTRY(SECURE_REDIRECTS, "secure_redirects"),
+                DEVINET_SYSCTL_RW_ENTRY(SHARED_MEDIA, "shared_media"),
+                DEVINET_SYSCTL_RW_ENTRY(RP_FILTER, "rp_filter"),
+                DEVINET_SYSCTL_RW_ENTRY(SEND_REDIRECTS, "send_redirects"),
+                DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
+                                        "accept_source_route"),
+                DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
+                DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
+                DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
+                DEVINET_SYSCTL_RW_ENTRY(LOG_MARTIANS, "log_martians"),
+                DEVINET_SYSCTL_RW_ENTRY(TAG, "tag"),
+                DEVINET_SYSCTL_RW_ENTRY(ARPFILTER, "arp_filter"),
+                DEVINET_SYSCTL_RW_ENTRY(ARP_ANNOUNCE, "arp_announce"),
+                DEVINET_SYSCTL_RW_ENTRY(ARP_IGNORE, "arp_ignore"),
+                DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"),
+
+                DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"),
+                DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"),
+                DEVINET_SYSCTL_FLUSHING_ENTRY(FORCE_IGMP_VERSION,
+                                              "force_igmp_version"),
+                DEVINET_SYSCTL_FLUSHING_ENTRY(PROMOTE_SECONDARIES,
+                                              "promote_secondaries"),
         },
         .devinet_dev = {
                 {
@@ -1561,6 +1507,7 @@ static void devinet_sysctl_register(struct in_device *in_dev,
                 return;
         for (i = 0; i < ARRAY_SIZE(t->devinet_vars) - 1; i++) {
                 t->devinet_vars[i].data += (char *)p - (char *)&ipv4_devconf;
+                t->devinet_vars[i].extra1 = p;
         }
 
         if (dev) {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 837f2957fa83..311d633f7f39 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -250,8 +250,6 @@ e_inval:
         return -EINVAL;
 }
 
-#ifndef CONFIG_IP_NOSIOCRT
-
 static inline __be32 sk_extract_addr(struct sockaddr *addr)
 {
         return ((struct sockaddr_in *) addr)->sin_addr.s_addr;
@@ -443,16 +441,7 @@ int ip_rt_ioctl(unsigned int cmd, void __user *arg)
         return -EINVAL;
 }
 
-#else
-
-int ip_rt_ioctl(unsigned int cmd, void *arg)
-{
-        return -EINVAL;
-}
-
-#endif
-
-struct nla_policy rtm_ipv4_policy[RTA_MAX+1] __read_mostly = {
+const struct nla_policy rtm_ipv4_policy[RTA_MAX+1] = {
         [RTA_DST]               = { .type = NLA_U32 },
         [RTA_SRC]               = { .type = NLA_U32 },
         [RTA_IIF]               = { .type = NLA_U32 },
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 33083ad52e9f..2a947840210e 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -169,7 +169,7 @@ static struct fib_table *fib_empty_table(void)
         return NULL;
 }
 
-static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = {
+static const struct nla_policy fib4_rule_policy[FRA_MAX+1] = {
         FRA_GENERIC_POLICY,
         [FRA_FLOW]      = { .type = NLA_U32 },
 };
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index e238b17f554c..02a899bec196 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -514,12 +514,15 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 
         saddr = iph->daddr;
         if (!(rt->rt_flags & RTCF_LOCAL)) {
-                /* This is broken, skb_in->dev points to the outgoing device
-                 * after the packet passes through ip_output().
-                 */
-                if (skb_in->dev && sysctl_icmp_errors_use_inbound_ifaddr)
-                        saddr = inet_select_addr(skb_in->dev, 0, RT_SCOPE_LINK);
-                else
+                struct net_device *dev = NULL;
+
+                if (rt->fl.iif && sysctl_icmp_errors_use_inbound_ifaddr)
+                        dev = dev_get_by_index(rt->fl.iif);
+
+                if (dev) {
+                        saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
+                        dev_put(dev);
+                } else
                         saddr = 0;
         }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index f4dd47453108..a646409c2d06 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -128,14 +128,16 @@
  * contradict to specs provided this delay is small enough.
  */
 
-#define IGMP_V1_SEEN(in_dev) (ipv4_devconf.force_igmp_version == 1 || \
-                (in_dev)->cnf.force_igmp_version == 1 || \
-                ((in_dev)->mr_v1_seen && \
-                time_before(jiffies, (in_dev)->mr_v1_seen)))
-#define IGMP_V2_SEEN(in_dev) (ipv4_devconf.force_igmp_version == 2 || \
-                (in_dev)->cnf.force_igmp_version == 2 || \
-                ((in_dev)->mr_v2_seen && \
-                time_before(jiffies, (in_dev)->mr_v2_seen)))
+#define IGMP_V1_SEEN(in_dev) \
+        (IPV4_DEVCONF_ALL(FORCE_IGMP_VERSION) == 1 || \
+         IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 1 || \
+         ((in_dev)->mr_v1_seen && \
+          time_before(jiffies, (in_dev)->mr_v1_seen)))
+#define IGMP_V2_SEEN(in_dev) \
+        (IPV4_DEVCONF_ALL(FORCE_IGMP_VERSION) == 2 || \
+         IN_DEV_CONF_GET((in_dev), FORCE_IGMP_VERSION) == 2 || \
+         ((in_dev)->mr_v2_seen && \
+          time_before(jiffies, (in_dev)->mr_v2_seen)))
 
 static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im);
 static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 43fb1600f1f0..fbe7714f21d0 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -31,10 +31,8 @@ EXPORT_SYMBOL(inet_csk_timer_bug_msg);
 
 /*
  * This array holds the first and last local port number.
- * For high-usage systems, use sysctl to change this to
- * 32768-61000
  */
-int sysctl_local_port_range[2] = { 1024, 4999 };
+int sysctl_local_port_range[2] = { 32768, 61000 };
 
 int inet_csk_bind_conflict(const struct sock *sk,
                            const struct inet_bind_bucket *tb)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d6427d918512..34ea4547ebbe 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1352,7 +1352,8 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
         }
 
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
+                struct flowi fl = { .oif = arg->bound_dev_if,
+                                    .nl_u = { .ip4_u =
                                               { .daddr = daddr,
                                                 .saddr = rt->rt_spec_dst,
                                                 .tos = RT_TOS(ip_hdr(skb)->tos) } },
@@ -1376,6 +1377,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
         inet->tos = ip_hdr(skb)->tos;
         sk->sk_priority = skb->priority;
         sk->sk_protocol = ip_hdr(skb)->protocol;
+        sk->sk_bound_dev_if = arg->bound_dev_if;
         ip_append_data(sk, ip_reply_glue_bits, arg->iov->iov_base, len, 0,
                        &ipc, rt, MSG_DONTWAIT);
         if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 0ebae413ae87..d96582acdf69 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -152,9 +152,11 @@ struct net_device *ipmr_new_tunnel(struct vifctl *v)
                         dev->flags |= IFF_MULTICAST;
 
                         in_dev = __in_dev_get_rtnl(dev);
-                        if (in_dev == NULL && (in_dev = inetdev_init(dev)) == NULL)
+                        if (in_dev == NULL)
                                 goto failure;
-                        in_dev->cnf.rp_filter = 0;
+
+                        ipv4_devconf_setall(in_dev);
+                        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
 
                         if (dev_open(dev))
                                 goto failure;
@@ -218,10 +220,15 @@ static struct net_device *ipmr_reg_vif(void)
         }
         dev->iflink = 0;
 
-        if ((in_dev = inetdev_init(dev)) == NULL)
+        rcu_read_lock();
+        if ((in_dev = __in_dev_get_rcu(dev)) == NULL) {
+                rcu_read_unlock();
                 goto failure;
+        }
 
-        in_dev->cnf.rp_filter = 0;
+        ipv4_devconf_setall(in_dev);
+        IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
+        rcu_read_unlock();
 
         if (dev_open(dev))
                 goto failure;
@@ -281,7 +288,7 @@ static int vif_delete(int vifi)
         dev_set_allmulti(dev, -1);
 
         if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
-                in_dev->cnf.mc_forwarding--;
+                IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)--;
                 ip_rt_multicast_event(in_dev);
         }
 
@@ -426,7 +433,7 @@ static int vif_add(struct vifctl *vifc, int mrtsock)
 
         if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
                 return -EADDRNOTAVAIL;
-        in_dev->cnf.mc_forwarding++;
+        IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)++;
         dev_set_allmulti(dev, +1);
         ip_rt_multicast_event(in_dev);
 
@@ -841,7 +848,7 @@ static void mrtsock_destruct(struct sock *sk)
 {
         rtnl_lock();
         if (sk == mroute_socket) {
-                ipv4_devconf.mc_forwarding--;
+                IPV4_DEVCONF_ALL(MC_FORWARDING)--;
 
                 write_lock_bh(&mrt_lock);
                 mroute_socket=NULL;
@@ -890,7 +897,7 @@ int ip_mroute_setsockopt(struct sock *sk,int optname,char __user *optval,int opt
                         mroute_socket=sk;
                         write_unlock_bh(&mrt_lock);
 
-                        ipv4_devconf.mc_forwarding++;
+                        IPV4_DEVCONF_ALL(MC_FORWARDING)++;
                 }
                 rtnl_unlock();
                 return ret;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index e3f83bf160d9..9bacf1a03630 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -499,7 +499,8 @@ check_entry(struct ipt_entry *e, const char *name)
 }
 
 static inline int check_match(struct ipt_entry_match *m, const char *name,
-                                const struct ipt_ip *ip, unsigned int hookmask)
+                                const struct ipt_ip *ip, unsigned int hookmask,
+                                unsigned int *i)
 {
         struct xt_match *match;
         int ret;
@@ -515,6 +516,8 @@ static inline int check_match(struct ipt_entry_match *m, const char *name,
                          m->u.kernel.match->name);
                 ret = -EINVAL;
         }
+        if (!ret)
+                (*i)++;
         return ret;
 }
 
@@ -537,11 +540,10 @@ find_check_match(struct ipt_entry_match *m,
         }
         m->u.kernel.match = match;
 
-        ret = check_match(m, name, ip, hookmask);
+        ret = check_match(m, name, ip, hookmask, i);
         if (ret)
                 goto err;
 
-        (*i)++;
         return 0;
 err:
         module_put(m->u.kernel.match->me);
@@ -1425,7 +1427,7 @@ out:
 }
 
 static inline int
-compat_check_calc_match(struct ipt_entry_match *m,
+compat_find_calc_match(struct ipt_entry_match *m,
             const char *name,
             const struct ipt_ip *ip,
             unsigned int hookmask,
@@ -1449,6 +1451,31 @@ compat_check_calc_match(struct ipt_entry_match *m,
 }
 
 static inline int
+compat_release_match(struct ipt_entry_match *m, unsigned int *i)
+{
+        if (i && (*i)-- == 0)
+                return 1;
+
+        module_put(m->u.kernel.match->me);
+        return 0;
+}
+
+static inline int
+compat_release_entry(struct ipt_entry *e, unsigned int *i)
+{
+        struct ipt_entry_target *t;
+
+        if (i && (*i)-- == 0)
+                return 1;
+
+        /* Cleanup all matches */
+        IPT_MATCH_ITERATE(e, compat_release_match, NULL);
+        t = ipt_get_target(e);
+        module_put(t->u.kernel.target->me);
+        return 0;
+}
+
+static inline int
 check_compat_entry_size_and_hooks(struct ipt_entry *e,
                            struct xt_table_info *newinfo,
                            unsigned int *size,
@@ -1485,10 +1512,10 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
         off = 0;
         entry_offset = (void *)e - (void *)base;
         j = 0;
-        ret = IPT_MATCH_ITERATE(e, compat_check_calc_match, name, &e->ip,
+        ret = IPT_MATCH_ITERATE(e, compat_find_calc_match, name, &e->ip,
                         e->comefrom, &off, &j);
         if (ret != 0)
-                goto cleanup_matches;
+                goto release_matches;
 
         t = ipt_get_target(e);
         target = try_then_request_module(xt_find_target(AF_INET,
@@ -1499,7 +1526,7 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
                                                         t->u.user.name);
                 ret = target ? PTR_ERR(target) : -ENOENT;
-                goto cleanup_matches;
+                goto release_matches;
         }
         t->u.kernel.target = target;
 
@@ -1526,8 +1553,8 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
 
 out:
         module_put(t->u.kernel.target->me);
-cleanup_matches:
-        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+release_matches:
+        IPT_MATCH_ITERATE(e, compat_release_match, &j);
         return ret;
 }
 
@@ -1574,15 +1601,26 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
         return ret;
 }
 
-static inline int compat_check_entry(struct ipt_entry *e, const char *name)
+static inline int compat_check_entry(struct ipt_entry *e, const char *name,
+                                                unsigned int *i)
 {
-        int ret;
+        int j, ret;
 
-        ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip, e->comefrom);
+        j = 0;
+        ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip, e->comefrom, &j);
         if (ret)
-                return ret;
+                goto cleanup_matches;
+
+        ret = check_target(e, name);
+        if (ret)
+                goto cleanup_matches;
 
-        return check_target(e, name);
+        (*i)++;
+        return 0;
+
+ cleanup_matches:
+        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+        return ret;
 }
 
 static int
@@ -1673,10 +1711,17 @@ translate_compat_table(const char *name,
         if (!mark_source_chains(newinfo, valid_hooks, entry1))
                 goto free_newinfo;
 
+        i = 0;
         ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                                                                        name);
-        if (ret)
-                goto free_newinfo;
+                                                                name, &i);
+        if (ret) {
+                j -= i;
+                IPT_ENTRY_ITERATE_CONTINUE(entry1, newinfo->size, i,
+                                                compat_release_entry, &j);
+                IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                xt_free_table_info(newinfo);
+                return ret;
+        }
 
         /* And one copy for every other CPU */
         for_each_possible_cpu(i)
@@ -1691,7 +1736,7 @@ translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
-        IPT_ENTRY_ITERATE(entry0, total_size, cleanup_entry, &j);
+        IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
         return ret;
 out_unlock:
         compat_flush_offsets();
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index fd62a41d69cc..6dc72a815f77 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -133,6 +133,7 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         struct nf_conn_help *help;
+        struct nf_conntrack_helper *helper;
 
         /* This is where we call the helper: as the packet goes out. */
         ct = nf_ct_get(*pskb, &ctinfo);
@@ -140,12 +141,14 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
                 return NF_ACCEPT;
 
         help = nfct_help(ct);
-        if (!help || !help->helper)
+        if (!help)
                 return NF_ACCEPT;
-
-        return help->helper->help(pskb,
-                                  skb_network_offset(*pskb) + ip_hdrlen(*pskb),
-                                  ct, ctinfo);
+        /* rcu_read_lock()ed by nf_hook_slow */
+        helper = rcu_dereference(help->helper);
+        if (!helper)
+                return NF_ACCEPT;
+        return helper->help(pskb, skb_network_offset(*pskb) + ip_hdrlen(*pskb),
+                            ct, ctinfo);
 }
 
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index cdbc6c135849..3b690cf2a4ee 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -260,7 +260,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
                 seq_printf(seq, " %s", snmp4_ipstats_list[i].name);
 
         seq_printf(seq, "\nIp: %d %d",
-                        ipv4_devconf.forwarding ? 1 : 2, sysctl_ip_default_ttl);
+                   IPV4_DEVCONF_ALL(FORWARDING) ? 1 : 2, sysctl_ip_default_ttl);
 
         for (i = 0; snmp4_ipstats_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8603cfb271f2..29ca63e81ced 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1636,7 +1636,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         atomic_set(&rth->u.dst.__refcnt, 1);
         rth->u.dst.flags= DST_HOST;
-        if (in_dev->cnf.no_policy)
+        if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
                 rth->u.dst.flags |= DST_NOPOLICY;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
@@ -1778,9 +1778,9 @@ static inline int __mkroute_input(struct sk_buff *skb,
         if (res->fi->fib_nhs > 1)
                 rth->u.dst.flags |= DST_BALANCED;
 #endif
-        if (in_dev->cnf.no_policy)
+        if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
                 rth->u.dst.flags |= DST_NOPOLICY;
-        if (out_dev->cnf.no_xfrm)
+        if (IN_DEV_CONF_GET(out_dev, NOXFRM))
                 rth->u.dst.flags |= DST_NOXFRM;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
@@ -2021,7 +2021,7 @@ local_input:
 
         atomic_set(&rth->u.dst.__refcnt, 1);
         rth->u.dst.flags= DST_HOST;
-        if (in_dev->cnf.no_policy)
+        if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
                 rth->u.dst.flags |= DST_NOPOLICY;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
@@ -2218,9 +2218,9 @@ static inline int __mkroute_output(struct rtable **result,
                         rth->u.dst.flags |= DST_BALANCED;
         }
 #endif
-        if (in_dev->cnf.no_xfrm)
+        if (IN_DEV_CONF_GET(in_dev, NOXFRM))
                 rth->u.dst.flags |= DST_NOXFRM;
-        if (in_dev->cnf.no_policy)
+        if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
                 rth->u.dst.flags |= DST_NOPOLICY;
 
         rth->fl.fl4_dst = oldflp->fl4_dst;
@@ -2759,7 +2759,7 @@ static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
                 __be32 dst = rt->rt_dst;
 
                 if (MULTICAST(dst) && !LOCAL_MCAST(dst) &&
-                    ipv4_devconf.mc_forwarding) {
+                    IPV4_DEVCONF_ALL(MC_FORWARDING)) {
                         int err = ipmr_get_route(skb, r, nowait);
                         if (err <= 0) {
                                 if (!nowait) {
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 6817d6485df5..53ef0f4bbdaa 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -37,12 +37,12 @@ static
 int ipv4_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
                         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        int val = ipv4_devconf.forwarding;
+        int val = IPV4_DEVCONF_ALL(FORWARDING);
         int ret;
 
         ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
 
-        if (write && ipv4_devconf.forwarding != val)
+        if (write && IPV4_DEVCONF_ALL(FORWARDING) != val)
                 inet_forward_change();
 
         return ret;
@@ -222,7 +222,7 @@ ctl_table ipv4_table[] = {
         {
                 .ctl_name       = NET_IPV4_FORWARD,
                 .procname       = "ip_forward",
-                .data           = &ipv4_devconf.forwarding,
+                .data           = &IPV4_DEVCONF_ALL(FORWARDING),
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = &ipv4_sysctl_forward,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index bd4c295f5d79..cd3c7e95de9e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1674,9 +1674,8 @@ adjudge_to_death:
         }
         if (sk->sk_state != TCP_CLOSE) {
                 sk_stream_mem_reclaim(sk);
-                if (atomic_read(sk->sk_prot->orphan_count) > sysctl_tcp_max_orphans ||
-                    (sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
-                     atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2])) {
+                if (tcp_too_many_orphans(sk,
+                                atomic_read(sk->sk_prot->orphan_count))) {
                         if (net_ratelimit())
                                 printk(KERN_INFO "TCP: too many of orphaned "
                                        "sockets\n");
@@ -2465,13 +2464,10 @@ void __init tcp_init(void)
                         order++)
                 ;
         if (order >= 4) {
-                sysctl_local_port_range[0] = 32768;
-                sysctl_local_port_range[1] = 61000;
                 tcp_death_row.sysctl_max_tw_buckets = 180000;
                 sysctl_tcp_max_orphans = 4096 << (order - 4);
                 sysctl_max_syn_backlog = 1024;
         } else if (order < 3) {
-                sysctl_local_port_range[0] = 1024 * (3 - order);
                 tcp_death_row.sysctl_max_tw_buckets >>= (3 - order);
                 sysctl_tcp_max_orphans >>= (3 - order);
                 sysctl_max_syn_backlog = 128;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 38cb25b48bf3..74683d81c3f1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2407,8 +2407,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         struct sk_buff *skb;
         __u32 now = tcp_time_stamp;
         int acked = 0;
+        int prior_packets = tp->packets_out;
         __s32 seq_rtt = -1;
-        u32 pkts_acked = 0;
         ktime_t last_ackt = ktime_set(0,0);
 
         while ((skb = tcp_write_queue_head(sk)) &&
@@ -2437,7 +2437,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
                  */
                 if (!(scb->flags & TCPCB_FLAG_SYN)) {
                         acked |= FLAG_DATA_ACKED;
-                        ++pkts_acked;
                 } else {
                         acked |= FLAG_SYN_ACKED;
                         tp->retrans_stamp = 0;
@@ -2481,6 +2480,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, __s32 *seq_rtt_p)
         }
 
         if (acked&FLAG_ACKED) {
+                u32 pkts_acked = prior_packets - tp->packets_out;
                 const struct tcp_congestion_ops *ca_ops
                         = inet_csk(sk)->icsk_ca_ops;
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a3e7f839fc5..97e294e82679 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -192,8 +192,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_TCP,
                                inet->sport, usin->sin_port, sk, 1);
-        if (tmp < 0)
+        if (tmp < 0) {
+                if (tmp == -ENETUNREACH)
+                        IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
                 return tmp;
+        }
 
         if (rt->rt_flags & (RTCF_MULTICAST | RTCF_BROADCAST)) {
                 ip_rt_put(rt);
@@ -702,6 +705,8 @@ static void tcp_v4_send_ack(struct tcp_timewait_sock *twsk,
                                       ip_hdr(skb)->saddr, /* XXX */
                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
+        if (twsk)
+                arg.bound_dev_if = twsk->tw_sk.tw_bound_dev_if;
 
         ip_send_reply(tcp_socket->sk, skb, &arg, arg.iov[0].iov_len);
 
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 3938d5dbdf20..d9323dfff826 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -63,6 +63,9 @@ struct {
  * FIXME: causes an extra copy
  */
 static void printl(const char *fmt, ...)
+        __attribute__ ((format (printf, 1, 2)));
+
+static void printl(const char *fmt, ...)
 {
         va_list args;
         int len;
@@ -95,7 +98,7 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         /* Only update if port matches */
         if ((port == 0 || ntohs(inet->dport) == port || ntohs(inet->sport) == port)
             && (full || tp->snd_cwnd != tcpw.lastcwnd)) {
-                printl("%d.%d.%d.%d:%u %d.%d.%d.%d:%u %d %#x %#x %u %u %u\n",
+                printl("%d.%d.%d.%d:%u %d.%d.%d.%d:%u %d %#x %#x %u %u %u %u\n",
                        NIPQUAD(inet->saddr), ntohs(inet->sport),
                        NIPQUAD(inet->daddr), ntohs(inet->dport),
                        skb->len, tp->snd_nxt, tp->snd_una,
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 2ca97b20929d..e9b151b3a598 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -78,9 +78,7 @@ static int tcp_out_of_resources(struct sock *sk, int do_reset)
         if (sk->sk_err_soft)
                 orphans <<= 1;
 
-        if (orphans >= sysctl_tcp_max_orphans ||
-            (sk->sk_wmem_queued > SOCK_MIN_SNDBUF &&
-             atomic_read(&tcp_memory_allocated) > sysctl_tcp_mem[2])) {
+        if (tcp_too_many_orphans(sk, orphans)) {
                 if (net_ratelimit())
                         printk(KERN_INFO "Out of socket memory\n");
 
@@ -294,9 +292,9 @@ static void tcp_retransmit_timer(struct sock *sk)
                  * we cannot allow such beasts to hang infinitely.
                  */
 #ifdef TCP_DEBUG
-                if (net_ratelimit()) {
+                if (1) {
                         struct inet_sock *inet = inet_sk(sk);
-                        printk(KERN_DEBUG "TCP: Treason uncloaked! Peer %u.%u.%u.%u:%u/%u shrinks window %u:%u. Repaired.\n",
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: Treason uncloaked! Peer %u.%u.%u.%u:%u/%u shrinks window %u:%u. Repaired.\n",
                                NIPQUAD(inet->daddr), ntohs(inet->dport),
                                inet->num, tp->snd_una, tp->snd_nxt);
                 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4c7e95fa090d..facb7e29304e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -114,36 +114,14 @@ DEFINE_RWLOCK(udp_hash_lock);
 
 static int udp_port_rover;
 
-/*
- * Note about this hash function :
- * Typical use is probably daddr = 0, only dport is going to vary hash
- */
-static inline unsigned int udp_hash_port(__u16 port)
-{
-        return port;
-}
-
-static inline int __udp_lib_port_inuse(unsigned int hash, int port,
-                                       const struct sock *this_sk,
-                                       struct hlist_head udptable[],
-                                       const struct udp_get_port_ops *ops)
+static inline int __udp_lib_lport_inuse(__u16 num, struct hlist_head udptable[])
 {
         struct sock *sk;
         struct hlist_node *node;
-        struct inet_sock *inet;
 
-        sk_for_each(sk, node, &udptable[hash & (UDP_HTABLE_SIZE - 1)]) {
-                if (sk->sk_hash != hash)
-                        continue;
-                inet = inet_sk(sk);
-                if (inet->num != port)
-                        continue;
-                if (this_sk) {
-                        if (ops->saddr_cmp(sk, this_sk))
-                                return 1;
-                } else if (ops->saddr_any(sk))
+        sk_for_each(sk, node, &udptable[num & (UDP_HTABLE_SIZE - 1)])
+                if (sk->sk_hash == num)
                         return 1;
-        }
         return 0;
 }
 
@@ -154,16 +132,16 @@ static inline int __udp_lib_port_inuse(unsigned int hash, int port,
  *  @snum:        port number to look up
  *  @udptable:    hash list table, must be of UDP_HTABLE_SIZE
  *  @port_rover:  pointer to record of last unallocated port
- *  @ops:         AF-dependent address operations
+ *  @saddr_comp:  AF-dependent comparison of bound local IP addresses
  */
 int __udp_lib_get_port(struct sock *sk, unsigned short snum,
                        struct hlist_head udptable[], int *port_rover,
-                       const struct udp_get_port_ops *ops)
+                       int (*saddr_comp)(const struct sock *sk1,
+                                         const struct sock *sk2 )    )
 {
         struct hlist_node *node;
         struct hlist_head *head;
         struct sock *sk2;
-        unsigned int hash;
         int    error = 1;
 
         write_lock_bh(&udp_hash_lock);
@@ -178,8 +156,7 @@ int __udp_lib_get_port(struct sock *sk, unsigned short snum,
                 for (i = 0; i < UDP_HTABLE_SIZE; i++, result++) {
                         int size;
 
-                        hash = ops->hash_port_and_rcv_saddr(result, sk);
-                        head = &udptable[hash & (UDP_HTABLE_SIZE - 1)];
+                        head = &udptable[result & (UDP_HTABLE_SIZE - 1)];
                         if (hlist_empty(head)) {
                                 if (result > sysctl_local_port_range[1])
                                         result = sysctl_local_port_range[0] +
@@ -204,16 +181,7 @@ int __udp_lib_get_port(struct sock *sk, unsigned short snum,
                                 result = sysctl_local_port_range[0]
                                         + ((result - sysctl_local_port_range[0]) &
                                            (UDP_HTABLE_SIZE - 1));
-                        hash = udp_hash_port(result);
-                        if (__udp_lib_port_inuse(hash, result,
-                                                 NULL, udptable, ops))
-                                continue;
-                        if (ops->saddr_any(sk))
-                                break;
-
-                        hash = ops->hash_port_and_rcv_saddr(result, sk);
-                        if (! __udp_lib_port_inuse(hash, result,
-                                                   sk, udptable, ops))
+                        if (! __udp_lib_lport_inuse(result, udptable))
                                 break;
                 }
                 if (i >= (1 << 16) / UDP_HTABLE_SIZE)
@@ -221,40 +189,21 @@ int __udp_lib_get_port(struct sock *sk, unsigned short snum,
 gotit:
                 *port_rover = snum = result;
         } else {
-                hash = udp_hash_port(snum);
-                head = &udptable[hash & (UDP_HTABLE_SIZE - 1)];
+                head = &udptable[snum & (UDP_HTABLE_SIZE - 1)];
 
                 sk_for_each(sk2, node, head)
-                        if (sk2->sk_hash == hash &&
-                            sk2 != sk &&
-                            inet_sk(sk2)->num == snum &&
-                            (!sk2->sk_reuse || !sk->sk_reuse) &&
-                            (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
-                             sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
-                            ops->saddr_cmp(sk, sk2))
+                        if (sk2->sk_hash == snum                             &&
+                            sk2 != sk                                        &&
+                            (!sk2->sk_reuse        || !sk->sk_reuse)         &&
+                            (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
+                             || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                            (*saddr_comp)(sk, sk2)                             )
                                 goto fail;
-
-                if (!ops->saddr_any(sk)) {
-                        hash = ops->hash_port_and_rcv_saddr(snum, sk);
-                        head = &udptable[hash & (UDP_HTABLE_SIZE - 1)];
-
-                        sk_for_each(sk2, node, head)
-                                if (sk2->sk_hash == hash &&
-                                    sk2 != sk &&
-                                    inet_sk(sk2)->num == snum &&
-                                    (!sk2->sk_reuse || !sk->sk_reuse) &&
-                                    (!sk2->sk_bound_dev_if ||
-                                     !sk->sk_bound_dev_if ||
-                                     sk2->sk_bound_dev_if ==
-                                     sk->sk_bound_dev_if) &&
-                                    ops->saddr_cmp(sk, sk2))
-                                        goto fail;
-                }
         }
         inet_sk(sk)->num = snum;
-        sk->sk_hash = hash;
+        sk->sk_hash = snum;
         if (sk_unhashed(sk)) {
-                head = &udptable[hash & (UDP_HTABLE_SIZE - 1)];
+                head = &udptable[snum & (UDP_HTABLE_SIZE - 1)];
                 sk_add_node(sk, head);
                 sock_prot_inc_use(sk->sk_prot);
         }
@@ -265,12 +214,12 @@ fail:
 }
 
 int udp_get_port(struct sock *sk, unsigned short snum,
-                 const struct udp_get_port_ops *ops)
+                        int (*scmp)(const struct sock *, const struct sock *))
 {
-        return  __udp_lib_get_port(sk, snum, udp_hash, &udp_port_rover, ops);
+        return  __udp_lib_get_port(sk, snum, udp_hash, &udp_port_rover, scmp);
 }
 
-static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
+int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
 {
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
@@ -279,33 +228,9 @@ static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
                    inet1->rcv_saddr == inet2->rcv_saddr      ));
 }
 
-static int ipv4_rcv_saddr_any(const struct sock *sk)
-{
-        return !inet_sk(sk)->rcv_saddr;
-}
-
-static inline unsigned int ipv4_hash_port_and_addr(__u16 port, __be32 addr)
-{
-        addr ^= addr >> 16;
-        addr ^= addr >> 8;
-        return port ^ addr;
-}
-
-static unsigned int ipv4_hash_port_and_rcv_saddr(__u16 port,
-                                                 const struct sock *sk)
-{
-        return ipv4_hash_port_and_addr(port, inet_sk(sk)->rcv_saddr);
-}
-
-const struct udp_get_port_ops udp_ipv4_ops = {
-        .saddr_cmp = ipv4_rcv_saddr_equal,
-        .saddr_any = ipv4_rcv_saddr_any,
-        .hash_port_and_rcv_saddr = ipv4_hash_port_and_rcv_saddr,
-};
-
 static inline int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_get_port(sk, snum, &udp_ipv4_ops);
+        return udp_get_port(sk, snum, ipv4_rcv_saddr_equal);
 }
 
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
@@ -317,77 +242,63 @@ static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
 {
         struct sock *sk, *result = NULL;
         struct hlist_node *node;
-        unsigned int hash, hashwild;
-        int score, best = -1, hport = ntohs(dport);
-
-        hash = ipv4_hash_port_and_addr(hport, daddr);
-        hashwild = udp_hash_port(hport);
+        unsigned short hnum = ntohs(dport);
+        int badness = -1;
 
         read_lock(&udp_hash_lock);
-
-lookup:
-
-        sk_for_each(sk, node, &udptable[hash & (UDP_HTABLE_SIZE - 1)]) {
+        sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (sk->sk_hash != hash || ipv6_only_sock(sk) ||
-                        inet->num != hport)
-                        continue;
-
-                score = (sk->sk_family == PF_INET ? 1 : 0);
-                if (inet->rcv_saddr) {
-                        if (inet->rcv_saddr != daddr)
-                                continue;
-                        score+=2;
-                }
-                if (inet->daddr) {
-                        if (inet->daddr != saddr)
-                                continue;
-                        score+=2;
-                }
-                if (inet->dport) {
-                        if (inet->dport != sport)
-                                continue;
-                        score+=2;
-                }
-                if (sk->sk_bound_dev_if) {
-                        if (sk->sk_bound_dev_if != dif)
-                                continue;
-                        score+=2;
-                }
-                if (score == 9) {
-                        result = sk;
-                        goto found;
-                } else if (score > best) {
-                        result = sk;
-                        best = score;
+                if (sk->sk_hash == hnum && !ipv6_only_sock(sk)) {
+                        int score = (sk->sk_family == PF_INET ? 1 : 0);
+                        if (inet->rcv_saddr) {
+                                if (inet->rcv_saddr != daddr)
+                                        continue;
+                                score+=2;
+                        }
+                        if (inet->daddr) {
+                                if (inet->daddr != saddr)
+                                        continue;
+                                score+=2;
+                        }
+                        if (inet->dport) {
+                                if (inet->dport != sport)
+                                        continue;
+                                score+=2;
+                        }
+                        if (sk->sk_bound_dev_if) {
+                                if (sk->sk_bound_dev_if != dif)
+                                        continue;
+                                score+=2;
+                        }
+                        if (score == 9) {
+                                result = sk;
+                                break;
+                        } else if (score > badness) {
+                                result = sk;
+                                badness = score;
+                        }
                 }
         }
-
-        if (hash != hashwild) {
-                hash = hashwild;
-                goto lookup;
-        }
-found:
         if (result)
                 sock_hold(result);
         read_unlock(&udp_hash_lock);
         return result;
 }
 
-static inline struct sock *udp_v4_mcast_next(struct sock *sk, unsigned int hnum,
-                                             int hport, __be32 loc_addr,
+static inline struct sock *udp_v4_mcast_next(struct sock *sk,
+                                             __be16 loc_port, __be32 loc_addr,
                                              __be16 rmt_port, __be32 rmt_addr,
                                              int dif)
 {
         struct hlist_node *node;
         struct sock *s = sk;
+        unsigned short hnum = ntohs(loc_port);
 
         sk_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
                 if (s->sk_hash != hnum                                  ||
-                    inet->num != hport                                  ||
                     (inet->daddr && inet->daddr != rmt_addr)            ||
                     (inet->dport != rmt_port && inet->dport)            ||
                     (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
@@ -722,8 +633,11 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                                  .dport = dport } } };
                 security_sk_classify_flow(sk, &fl);
                 err = ip_route_output_flow(&rt, &fl, sk, 1);
-                if (err)
+                if (err) {
+                        if (err == -ENETUNREACH)
+                                IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
                         goto out;
+                }
 
                 err = -EACCES;
                 if ((rt->rt_flags & RTCF_BROADCAST) &&
@@ -1218,45 +1132,29 @@ static int __udp4_lib_mcast_deliver(struct sk_buff *skb,
                                     __be32 saddr, __be32 daddr,
                                     struct hlist_head udptable[])
 {
-        struct sock *sk, *skw, *sknext;
+        struct sock *sk;
         int dif;
-        int hport = ntohs(uh->dest);
-        unsigned int hash = ipv4_hash_port_and_addr(hport, daddr);
-        unsigned int hashwild = udp_hash_port(hport);
-
-        dif = skb->dev->ifindex;
 
         read_lock(&udp_hash_lock);
-
-        sk = sk_head(&udptable[hash & (UDP_HTABLE_SIZE - 1)]);
-        skw = sk_head(&udptable[hashwild & (UDP_HTABLE_SIZE - 1)]);
-
-        sk = udp_v4_mcast_next(sk, hash, hport, daddr, uh->source, saddr, dif);
-        if (!sk) {
-                hash = hashwild;
-                sk = udp_v4_mcast_next(skw, hash, hport, daddr, uh->source,
-                        saddr, dif);
-        }
+        sk = sk_head(&udptable[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
+        dif = skb->dev->ifindex;
+        sk = udp_v4_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (sk) {
+                struct sock *sknext = NULL;
+
                 do {
                         struct sk_buff *skb1 = skb;
-                        sknext = udp_v4_mcast_next(sk_next(sk), hash, hport,
-                                                daddr, uh->source, saddr, dif);
-                        if (!sknext && hash != hashwild) {
-                                hash = hashwild;
-                                sknext = udp_v4_mcast_next(skw, hash, hport,
-                                        daddr, uh->source, saddr, dif);
-                        }
+
+                        sknext = udp_v4_mcast_next(sk_next(sk), uh->dest, daddr,
+                                                   uh->source, saddr, dif);
                         if (sknext)
                                 skb1 = skb_clone(skb, GFP_ATOMIC);
 
                         if (skb1) {
                                 int ret = udp_queue_rcv_skb(sk, skb1);
                                 if (ret > 0)
-                                        /*
-                                         * we should probably re-process
-                                         * instead of dropping packets here.
-                                         */
+                                        /* we should probably re-process instead
+                                         * of dropping packets here. */
                                         kfree_skb(skb1);
                         }
                         sk = sknext;
@@ -1343,7 +1241,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
                 return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
 
         sk = __udp4_lib_lookup(saddr, uh->source, daddr, uh->dest,
-                               skb->dev->ifindex, udptable);
+                               skb->dev->ifindex, udptable        );
 
         if (sk != NULL) {
                 int ret = udp_queue_rcv_skb(sk, skb);
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 06d94195e644..820a477cfaa6 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -5,14 +5,14 @@
 #include <net/protocol.h>
 #include <net/inet_common.h>
 
-extern const struct udp_get_port_ops udp_ipv4_ops;
-
 extern int      __udp4_lib_rcv(struct sk_buff *, struct hlist_head [], int );
 extern void     __udp4_lib_err(struct sk_buff *, u32, struct hlist_head []);
 
 extern int      __udp_lib_get_port(struct sock *sk, unsigned short snum,
                                    struct hlist_head udptable[], int *port_rover,
-                                   const struct udp_get_port_ops *ops);
+                                   int (*)(const struct sock*,const struct sock*));
+extern int      ipv4_rcv_saddr_equal(const struct sock *, const struct sock *);
+
 
 extern int      udp_setsockopt(struct sock *sk, int level, int optname,
                                char __user *optval, int optlen);
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 3653b32dce2d..f34fd686a8f1 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -19,15 +19,14 @@ struct hlist_head 	udplite_hash[UDP_HTABLE_SIZE];
 static int              udplite_port_rover;
 
 int udplite_get_port(struct sock *sk, unsigned short p,
-                     const struct udp_get_port_ops *ops)
+                     int (*c)(const struct sock *, const struct sock *))
 {
-        return  __udp_lib_get_port(sk, p, udplite_hash,
-                                   &udplite_port_rover, ops);
+        return  __udp_lib_get_port(sk, p, udplite_hash, &udplite_port_rover, c);
 }
 
 static int udplite_v4_get_port(struct sock *sk, unsigned short snum)
 {
-        return udplite_get_port(sk, snum, &udp_ipv4_ops);
+        return udplite_get_port(sk, snum, ipv4_rcv_saddr_equal);
 }
 
 static int udplite_rcv(struct sk_buff *skb)
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 5ceca951d73f..fa1902dc81b8 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -139,10 +139,8 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
         nf_reset(skb);
 
         if (decaps) {
-                if (!(skb->dev->flags&IFF_LOOPBACK)) {
-                        dst_release(skb->dst);
-                        skb->dst = NULL;
-                }
+                dst_release(skb->dst);
+                skb->dst = NULL;
                 netif_rx(skb);
                 return 0;
         } else {
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index a2f2e6a5ec5d..9963700e74c1 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -85,6 +85,8 @@ static int xfrm4_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->saddr = x->props.saddr.a4;
         top_iph->daddr = x->id.daddr.a4;
 
+        skb->protocol = htons(ETH_P_IP);
+
         memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
         return 0;
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 329de679ac38..5a5f8bd4597a 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2990,7 +2990,7 @@ static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local)
         return pfx;
 }
 
-static struct nla_policy ifa_ipv6_policy[IFA_MAX+1] __read_mostly = {
+static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
         [IFA_ADDRESS]           = { .len = sizeof(struct in6_addr) },
         [IFA_LOCAL]             = { .len = sizeof(struct in6_addr) },
         [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index b696c8401200..128f94c79c64 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -247,7 +247,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(tmp_base, top_iph, sizeof(tmp_base));
 
         tmp_ext = NULL;
-        extlen = skb_transport_offset(skb) + sizeof(struct ipv6hdr);
+        extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
         if (extlen) {
                 extlen += sizeof(*tmp_ext);
                 tmp_ext = kmalloc(extlen, GFP_ATOMIC);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index fc3882c90604..53b3998a486c 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -157,7 +157,7 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
         return 1;
 }
 
-static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
+static const struct nla_policy fib6_rule_policy[FRA_MAX+1] = {
         FRA_GENERIC_POLICY,
 };
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index ca08ee88d07f..662a7d9681fd 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -619,14 +619,6 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 
         ins = &fn->leaf;
 
-        if (fn->fn_flags&RTN_TL_ROOT &&
-            fn->leaf == &ip6_null_entry &&
-            !(rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ){
-                fn->leaf = rt;
-                rt->u.dst.rt6_next = NULL;
-                goto out;
-        }
-
         for (iter = fn->leaf; iter; iter=iter->u.dst.rt6_next) {
                 /*
                  *      Search for duplicates
@@ -666,7 +658,6 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
          *      insert node
          */
 
-out:
         rt->u.dst.rt6_next = iter;
         *ins = rt;
         rt->rt6i_node = fn;
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 6d2a08205111..1b1797f1f33d 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -160,6 +160,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
 {
         struct nf_conn *ct;
         struct nf_conn_help *help;
+        struct nf_conntrack_helper *helper;
         enum ip_conntrack_info ctinfo;
         unsigned int ret, protoff;
         unsigned int extoff = (u8 *)(ipv6_hdr(*pskb) + 1) - (*pskb)->data;
@@ -172,18 +173,21 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
                 goto out;
 
         help = nfct_help(ct);
-        if (!help || !help->helper)
+        if (!help)
+                goto out;
+        /* rcu_read_lock()ed by nf_hook_slow */
+        helper = rcu_dereference(help->helper);
+        if (!helper)
                 goto out;
 
         protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
                                          (*pskb)->len - extoff);
-        if (protoff < 0 || protoff > (*pskb)->len ||
-            pnum == NEXTHDR_FRAGMENT) {
+        if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) {
                 DEBUGP("proto header not found\n");
                 return NF_ACCEPT;
         }
 
-        ret = help->helper->help(pskb, protoff, ct, ctinfo);
+        ret = helper->help(pskb, protoff, ct, ctinfo);
         if (ret != NF_ACCEPT)
                 return ret;
 out:
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 0be790d250f9..8814b95b2326 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -168,8 +168,7 @@ icmpv6_error_message(struct sk_buff *skb,
                                            skb->len - inip6off
                                                     - sizeof(struct ipv6hdr));
 
-        if ((inprotoff < 0) || (inprotoff > skb->len) ||
-            (inprotonum == NEXTHDR_FRAGMENT)) {
+        if ((inprotoff > skb->len) || (inprotonum == NEXTHDR_FRAGMENT)) {
                 DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n");
                 return -NF_ACCEPT;
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1324b06796c0..fe8d9837f9f8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1999,7 +1999,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned mtu)
         fib6_clean_all(rt6_mtu_change_route, 0, &arg);
 }
 
-static struct nla_policy rtm_ipv6_policy[RTA_MAX+1] __read_mostly = {
+static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
         [RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
         [RTA_OIF]               = { .type = NLA_U32 },
         [RTA_IIF]               = { .type = NLA_U32 },
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d1fbddd172e7..4210951edb6e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -52,28 +52,9 @@
 
 DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6) __read_mostly;
 
-static int ipv6_rcv_saddr_any(const struct sock *sk)
-{
-        struct ipv6_pinfo *np = inet6_sk(sk);
-
-        return ipv6_addr_any(&np->rcv_saddr);
-}
-
-static unsigned int ipv6_hash_port_and_rcv_saddr(__u16 port,
-                                                 const struct sock *sk)
-{
-        return port;
-}
-
-const struct udp_get_port_ops udp_ipv6_ops = {
-        .saddr_cmp = ipv6_rcv_saddr_equal,
-        .saddr_any = ipv6_rcv_saddr_any,
-        .hash_port_and_rcv_saddr = ipv6_hash_port_and_rcv_saddr,
-};
-
 static inline int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_get_port(sk, snum, &udp_ipv6_ops);
+        return udp_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
 static struct sock *__udp6_lib_lookup(struct in6_addr *saddr, __be16 sport,
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 36b0c11a28a3..6e252f318f7c 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -6,8 +6,6 @@
 #include <net/addrconf.h>
 #include <net/inet_common.h>
 
-extern const struct udp_get_port_ops udp_ipv6_ops;
-
 extern int      __udp6_lib_rcv(struct sk_buff **, struct hlist_head [], int );
 extern void     __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
                                int , int , int , __be32 , struct hlist_head []);
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index c40a51362f89..f54016a55004 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -37,7 +37,7 @@ static struct inet6_protocol udplitev6_protocol = {
 
 static int udplite_v6_get_port(struct sock *sk, unsigned short snum)
 {
-        return udplite_get_port(sk, snum, &udp_ipv6_ops);
+        return udplite_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
 struct proto udplitev6_prot = {
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index d7ed8aa56ec1..c858537cec4b 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -104,10 +104,8 @@ int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
         nf_reset(skb);
 
         if (decaps) {
-                if (!(skb->dev->flags&IFF_LOOPBACK)) {
-                        dst_release(skb->dst);
-                        skb->dst = NULL;
-                }
+                dst_release(skb->dst);
+                skb->dst = NULL;
                 netif_rx(skb);
                 return -1;
         } else {
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index a6c0cdf46ad6..9fc95bc6509f 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -80,6 +80,7 @@ static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->hop_limit = dst_metric(dst->child, RTAX_HOPLIMIT);
         ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
         ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
+        skb->protocol = htons(ETH_P_IPV6);
         return 0;
 }
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index d302ddae580c..0f8304b0246b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1682,6 +1682,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
         unsigned proto;
         struct km_event c;
         struct xfrm_audit audit_info;
+        int err;
 
         proto = pfkey_satype2proto(hdr->sadb_msg_satype);
         if (proto == 0)
@@ -1689,7 +1690,9 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hd
 
         audit_info.loginuid = audit_get_loginuid(current->audit_context);
         audit_info.secid = 0;
-        xfrm_state_flush(proto, &audit_info);
+        err = xfrm_state_flush(proto, &audit_info);
+        if (err)
+                return err;
         c.data.proto = proto;
         c.seq = hdr->sadb_msg_seq;
         c.pid = hdr->sadb_msg_pid;
@@ -2683,10 +2686,13 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, struct sadb_msg
 {
         struct km_event c;
         struct xfrm_audit audit_info;
+        int err;
 
         audit_info.loginuid = audit_get_loginuid(current->audit_context);
         audit_info.secid = 0;
-        xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
+        err = xfrm_policy_flush(XFRM_POLICY_TYPE_MAIN, &audit_info);
+        if (err)
+                return err;
         c.data.type = XFRM_POLICY_TYPE_MAIN;
         c.event = XFRM_MSG_FLUSHPOLICY;
         c.pid = hdr->sadb_msg_pid;
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 6e36df67f8d5..4e84f24fd439 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -2474,6 +2474,8 @@ static int ieee80211_open(struct net_device *dev)
         if (sdata->type == IEEE80211_IF_TYPE_STA &&
             !local->user_space_mlme)
                 netif_carrier_off(dev);
+        else
+                netif_carrier_on(dev);
 
         netif_start_queue(dev);
         return 0;
@@ -3278,8 +3280,10 @@ ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
                         return TXRX_DROP;
                 }
         }
-        while ((skb = __skb_dequeue(&entry->skb_list)))
+        while ((skb = __skb_dequeue(&entry->skb_list))) {
                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
+                dev_kfree_skb(skb);
+        }
 
         /* Complete frame has been reassembled - process it now */
         rx->fragmented = 1;
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 3e07e9d6fa42..9f30ae4c2ab3 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -1155,6 +1155,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct net_device *dev,
         if (status_code != WLAN_STATUS_SUCCESS) {
                 printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
                        dev->name, status_code);
+                if (status_code == WLAN_STATUS_REASSOC_NO_ASSOC)
+                        ifsta->prev_bssid_set = 0;
                 return;
         }
 
@@ -2995,7 +2997,7 @@ struct sta_info * ieee80211_ibss_add_sta(struct net_device *dev,
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
         struct sta_info *sta;
-        struct ieee80211_sub_if_data *sdata = NULL;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         /* TODO: Could consider removing the least recently used entry and
          * allow new one to be added. */
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index b8869eab7650..0568f2e86b59 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -208,13 +208,14 @@ static int __init nf_conntrack_amanda_init(void)
 {
         int ret, i;
 
-        ret = -ENOMEM;
         for (i = 0; i < ARRAY_SIZE(search); i++) {
                 search[i].ts = textsearch_prepare(ts_algo, search[i].string,
                                                   search[i].len,
                                                   GFP_KERNEL, TS_AUTOLOAD);
-                if (search[i].ts == NULL)
+                if (IS_ERR(search[i].ts)) {
+                        ret = PTR_ERR(search[i].ts);
                         goto err1;
+                }
         }
         ret = nf_conntrack_helper_register(&amanda_helper[0]);
         if (ret < 0)
@@ -227,10 +228,9 @@ static int __init nf_conntrack_amanda_init(void)
 err2:
         nf_conntrack_helper_unregister(&amanda_helper[0]);
 err1:
-        for (; i >= 0; i--) {
-                if (search[i].ts)
-                        textsearch_destroy(search[i].ts);
-        }
+        while (--i >= 0)
+                textsearch_destroy(search[i].ts);
+
         return ret;
 }
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 483e927a9ca4..7a15e30356f2 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -350,9 +350,15 @@ static void death_by_timeout(unsigned long ul_conntrack)
 {
         struct nf_conn *ct = (void *)ul_conntrack;
         struct nf_conn_help *help = nfct_help(ct);
+        struct nf_conntrack_helper *helper;
 
-        if (help && help->helper && help->helper->destroy)
-                help->helper->destroy(ct);
+        if (help) {
+                rcu_read_lock();
+                helper = rcu_dereference(help->helper);
+                if (helper && helper->destroy)
+                        helper->destroy(ct);
+                rcu_read_unlock();
+        }
 
         write_lock_bh(&nf_conntrack_lock);
         /* Inside lock so preempt is disabled on module removal path.
@@ -661,6 +667,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                unsigned int dataoff)
 {
         struct nf_conn *conntrack;
+        struct nf_conn_help *help;
         struct nf_conntrack_tuple repl_tuple;
         struct nf_conntrack_expect *exp;
         u_int32_t features = 0;
@@ -691,6 +698,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
         write_lock_bh(&nf_conntrack_lock);
         exp = find_expectation(tuple);
 
+        help = nfct_help(conntrack);
         if (exp) {
                 DEBUGP("conntrack: expectation arrives ct=%p exp=%p\n",
                         conntrack, exp);
@@ -698,7 +706,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                 __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
                 conntrack->master = exp->master;
                 if (exp->helper)
-                        nfct_help(conntrack)->helper = exp->helper;
+                        rcu_assign_pointer(help->helper, exp->helper);
 #ifdef CONFIG_NF_CONNTRACK_MARK
                 conntrack->mark = exp->master->mark;
 #endif
@@ -708,10 +716,11 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                 nf_conntrack_get(&conntrack->master->ct_general);
                 NF_CT_STAT_INC(expect_new);
         } else {
-                struct nf_conn_help *help = nfct_help(conntrack);
-
-                if (help)
-                        help->helper = __nf_ct_helper_find(&repl_tuple);
+                if (help) {
+                        /* not in hash table yet, so not strictly necessary */
+                        rcu_assign_pointer(help->helper,
+                                           __nf_ct_helper_find(&repl_tuple));
+                }
                 NF_CT_STAT_INC(new);
         }
 
@@ -893,7 +902,8 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
                 helper = __nf_ct_helper_find(newreply);
                 if (helper)
                         memset(&help->help, 0, sizeof(help->help));
-                help->helper = helper;
+                /* not in hash table yet, so not strictly necessary */
+                rcu_assign_pointer(help->helper, helper);
         }
         write_unlock_bh(&nf_conntrack_lock);
 }
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 117cbfdb910c..504fb6c083f9 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -337,6 +337,10 @@ int nf_conntrack_expect_related(struct nf_conntrack_expect *expect)
         NF_CT_ASSERT(master_help);
 
         write_lock_bh(&nf_conntrack_lock);
+        if (!master_help->helper) {
+                ret = -ESHUTDOWN;
+                goto out;
+        }
         list_for_each_entry(i, &nf_conntrack_expect_list, list) {
                 if (expect_matches(i, expect)) {
                         /* Refresh timer: if it's dying, ignore.. */
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 0743be4434b0..f868b7fbd9b4 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -93,7 +93,7 @@ static inline int unhelp(struct nf_conntrack_tuple_hash *i,
 
         if (help && help->helper == me) {
                 nf_conntrack_event(IPCT_HELPER, ct);
-                help->helper = NULL;
+                rcu_assign_pointer(help->helper, NULL);
         }
         return 0;
 }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d6d39e241327..3f73327794ab 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -171,21 +171,29 @@ ctnetlink_dump_helpinfo(struct sk_buff *skb, const struct nf_conn *ct)
 {
         struct nfattr *nest_helper;
         const struct nf_conn_help *help = nfct_help(ct);
+        struct nf_conntrack_helper *helper;
 
-        if (!help || !help->helper)
+        if (!help)
                 return 0;
 
+        rcu_read_lock();
+        helper = rcu_dereference(help->helper);
+        if (!helper)
+                goto out;
+
         nest_helper = NFA_NEST(skb, CTA_HELP);
-        NFA_PUT(skb, CTA_HELP_NAME, strlen(help->helper->name), help->helper->name);
+        NFA_PUT(skb, CTA_HELP_NAME, strlen(helper->name), helper->name);
 
-        if (help->helper->to_nfattr)
-                help->helper->to_nfattr(skb, ct);
+        if (helper->to_nfattr)
+                helper->to_nfattr(skb, ct);
 
         NFA_NEST_END(skb, nest_helper);
-
+out:
+        rcu_read_unlock();
         return 0;
 
 nfattr_failure:
+        rcu_read_unlock();
         return -1;
 }
 
@@ -842,7 +850,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
                 if (help && help->helper) {
                         /* we had a helper before ... */
                         nf_ct_remove_expectations(ct);
-                        help->helper = NULL;
+                        rcu_assign_pointer(help->helper, NULL);
                 }
 
                 return 0;
@@ -866,7 +874,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
 
         /* need to zero data of old helper */
         memset(&help->help, 0, sizeof(help->help));
-        help->helper = helper;
+        rcu_assign_pointer(help->helper, helper);
 
         return 0;
 }
@@ -950,6 +958,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         struct nf_conn *ct;
         int err = -EINVAL;
         struct nf_conn_help *help;
+        struct nf_conntrack_helper *helper = NULL;
 
         ct = nf_conntrack_alloc(otuple, rtuple);
         if (ct == NULL || IS_ERR(ct))
@@ -980,14 +989,17 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
 #endif
 
         help = nfct_help(ct);
-        if (help)
-                help->helper = nf_ct_helper_find_get(rtuple);
+        if (help) {
+                helper = nf_ct_helper_find_get(rtuple);
+                /* not in hash table yet so not strictly necessary */
+                rcu_assign_pointer(help->helper, helper);
+        }
 
         add_timer(&ct->timeout);
         nf_conntrack_hash_insert(ct);
 
-        if (help && help->helper)
-                nf_ct_helper_put(help->helper);
+        if (helper)
+                nf_ct_helper_put(helper);
 
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 5434472420fe..339c397d1b5f 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -100,7 +100,6 @@ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir,
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_ct_gre_keymap **kmp, *km;
 
-        BUG_ON(strcmp(help->helper->name, "pptp"));
         kmp = &help->help.ct_pptp_info.keymap[dir];
         if (*kmp) {
                 /* check whether it's a retransmission */
@@ -137,7 +136,6 @@ void nf_ct_gre_keymap_destroy(struct nf_conn *ct)
         enum ip_conntrack_dir dir;
 
         DEBUGP("entering for ct %p\n", ct);
-        BUG_ON(strcmp(help->helper->name, "pptp"));
 
         write_lock_bh(&nf_ct_gre_lock);
         for (dir = IP_CT_DIR_ORIGINAL; dir < IP_CT_DIR_MAX; dir++) {
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 07e47dbcb0a9..24b660f16ce3 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -59,7 +59,7 @@ static struct genl_family netlbl_cipsov4_gnl_family = {
 };
 
 /* NetLabel Netlink attribute policy */
-static struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
+static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
         [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
         [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
         [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index e8c80f33f3d7..e00fc219c72b 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -59,7 +59,7 @@ static struct genl_family netlbl_mgmt_gnl_family = {
 };
 
 /* NetLabel Netlink attribute policy */
-static struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
+static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
         [NLBL_MGMT_A_DOMAIN] = { .type = NLA_NUL_STRING },
         [NLBL_MGMT_A_PROTOCOL] = { .type = NLA_U32 },
         [NLBL_MGMT_A_VERSION] = { .type = NLA_U32 },
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
index b931edee4b8b..5c303c68af1d 100644
--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -61,7 +61,7 @@ static struct genl_family netlbl_unlabel_gnl_family = {
 };
 
 /* NetLabel Netlink attribute policy */
-static struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
+static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
         [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
 };
 
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
index df5f820a4c32..c591212793ee 100644
--- a/net/netlink/attr.c
+++ b/net/netlink/attr.c
@@ -24,9 +24,9 @@ static u16 nla_attr_minlen[NLA_TYPE_MAX+1] __read_mostly = {
 };
 
 static int validate_nla(struct nlattr *nla, int maxtype,
-                        struct nla_policy *policy)
+                        const struct nla_policy *policy)
 {
-        struct nla_policy *pt;
+        const struct nla_policy *pt;
         int minlen = 0, attrlen = nla_len(nla);
 
         if (nla->nla_type <= 0 || nla->nla_type > maxtype)
@@ -99,7 +99,7 @@ static int validate_nla(struct nlattr *nla, int maxtype,
  * Returns 0 on success or a negative error code.
  */
 int nla_validate(struct nlattr *head, int len, int maxtype,
-                 struct nla_policy *policy)
+                 const struct nla_policy *policy)
 {
         struct nlattr *nla;
         int rem, err;
@@ -130,7 +130,7 @@ errout:
  * Returns 0 on success or a negative error code.
  */
 int nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head, int len,
-              struct nla_policy *policy)
+              const struct nla_policy *policy)
 {
         struct nlattr *nla;
         int rem, err;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 6e31234a4196..b9ab62f938d0 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -472,7 +472,7 @@ static struct sk_buff *ctrl_build_msg(struct genl_family *family, u32 pid,
         return skb;
 }
 
-static struct nla_policy ctrl_policy[CTRL_ATTR_MAX+1] __read_mostly = {
+static const struct nla_policy ctrl_policy[CTRL_ATTR_MAX+1] = {
         [CTRL_ATTR_FAMILY_ID]   = { .type = NLA_U16 },
         [CTRL_ATTR_FAMILY_NAME] = { .type = NLA_NUL_STRING,
                                     .len = GENL_NAMSIZ - 1 },
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 02e401cd683f..f8b83014ccca 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -83,22 +83,6 @@
 #include <net/inet_common.h>
 #endif
 
-#define CONFIG_SOCK_PACKET      1
-
-/*
-   Proposed replacement for SIOC{ADD,DEL}MULTI and
-   IFF_PROMISC, IFF_ALLMULTI flags.
-
-   It is more expensive, but I believe,
-   it is really correct solution: reentereble, safe and fault tolerant.
-
-   IFF_PROMISC/IFF_ALLMULTI/SIOC{ADD/DEL}MULTI are faked by keeping
-   reference count and global flag, so that real status is
-   (gflag|(count != 0)), so that we can use obsolete faulty interface
-   not harming clever users.
- */
-#define CONFIG_PACKET_MULTICAST 1
-
 /*
    Assumptions:
    - if device has no dev->hard_header routine, it adds and removes ll header
@@ -159,7 +143,6 @@ static atomic_t packet_socks_nr;
 
 /* Private packet socket structures. */
 
-#ifdef CONFIG_PACKET_MULTICAST
 struct packet_mclist
 {
         struct packet_mclist    *next;
@@ -179,7 +162,7 @@ struct packet_mreq_max
         unsigned short  mr_alen;
         unsigned char   mr_address[MAX_ADDR_LEN];
 };
-#endif
+
 #ifdef CONFIG_PACKET_MMAP
 static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing);
 #endif
@@ -205,9 +188,7 @@ struct packet_sock {
                                 origdev:1;
         int                     ifindex;        /* bound device         */
         __be16                  num;
-#ifdef CONFIG_PACKET_MULTICAST
         struct packet_mclist    *mclist;
-#endif
 #ifdef CONFIG_PACKET_MMAP
         atomic_t                mapped;
         unsigned int            pg_vec_order;
@@ -263,7 +244,6 @@ static void packet_sock_destruct(struct sock *sk)
 
 static const struct proto_ops packet_ops;
 
-#ifdef CONFIG_SOCK_PACKET
 static const struct proto_ops packet_ops_spkt;
 
 static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,  struct packet_type *pt, struct net_device *orig_dev)
@@ -435,7 +415,6 @@ out_unlock:
                 dev_put(dev);
         return err;
 }
-#endif
 
 static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
                                       unsigned int res)
@@ -851,9 +830,7 @@ static int packet_release(struct socket *sock)
                 __sock_put(sk);
         }
 
-#ifdef CONFIG_PACKET_MULTICAST
         packet_flush_mclist(sk);
-#endif
 
 #ifdef CONFIG_PACKET_MMAP
         if (po->pg_vec) {
@@ -936,8 +913,6 @@ out_unlock:
  *      Bind a packet socket to a device
  */
 
-#ifdef CONFIG_SOCK_PACKET
-
 static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
         struct sock *sk=sock->sk;
@@ -960,7 +935,6 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, int add
         }
         return err;
 }
-#endif
 
 static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
@@ -1012,11 +986,8 @@ static int packet_create(struct socket *sock, int protocol)
 
         if (!capable(CAP_NET_RAW))
                 return -EPERM;
-        if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW
-#ifdef CONFIG_SOCK_PACKET
-            && sock->type != SOCK_PACKET
-#endif
-            )
+        if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW &&
+            sock->type != SOCK_PACKET)
                 return -ESOCKTNOSUPPORT;
 
         sock->state = SS_UNCONNECTED;
@@ -1027,10 +998,9 @@ static int packet_create(struct socket *sock, int protocol)
                 goto out;
 
         sock->ops = &packet_ops;
-#ifdef CONFIG_SOCK_PACKET
         if (sock->type == SOCK_PACKET)
                 sock->ops = &packet_ops_spkt;
-#endif
+
         sock_init_data(sock, sk);
 
         po = pkt_sk(sk);
@@ -1046,10 +1016,10 @@ static int packet_create(struct socket *sock, int protocol)
 
         spin_lock_init(&po->bind_lock);
         po->prot_hook.func = packet_rcv;
-#ifdef CONFIG_SOCK_PACKET
+
         if (sock->type == SOCK_PACKET)
                 po->prot_hook.func = packet_rcv_spkt;
-#endif
+
         po->prot_hook.af_packet_priv = sk;
 
         if (proto) {
@@ -1169,7 +1139,6 @@ out:
         return err;
 }
 
-#ifdef CONFIG_SOCK_PACKET
 static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
                                int *uaddr_len, int peer)
 {
@@ -1190,7 +1159,6 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
 
         return 0;
 }
-#endif
 
 static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
                           int *uaddr_len, int peer)
@@ -1221,7 +1189,6 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         return 0;
 }
 
-#ifdef CONFIG_PACKET_MULTICAST
 static void packet_dev_mc(struct net_device *dev, struct packet_mclist *i, int what)
 {
         switch (i->type) {
@@ -1349,7 +1316,6 @@ static void packet_flush_mclist(struct sock *sk)
         }
         rtnl_unlock();
 }
-#endif
 
 static int
 packet_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
@@ -1362,7 +1328,6 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 return -ENOPROTOOPT;
 
         switch(optname) {
-#ifdef CONFIG_PACKET_MULTICAST
         case PACKET_ADD_MEMBERSHIP:
         case PACKET_DROP_MEMBERSHIP:
         {
@@ -1383,7 +1348,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                         ret = packet_mc_drop(sk, &mreq);
                 return ret;
         }
-#endif
+
 #ifdef CONFIG_PACKET_MMAP
         case PACKET_RX_RING:
         {
@@ -1506,11 +1471,10 @@ static int packet_notifier(struct notifier_block *this, unsigned long msg, void
 
                 switch (msg) {
                 case NETDEV_UNREGISTER:
-#ifdef CONFIG_PACKET_MULTICAST
                         if (po->mclist)
                                 packet_dev_mclist(dev, po->mclist, -1);
-                        // fallthrough
-#endif
+                        /* fallthrough */
+
                 case NETDEV_DOWN:
                         if (dev->ifindex == po->ifindex) {
                                 spin_lock(&po->bind_lock);
@@ -1856,7 +1820,6 @@ out:
 #endif
 
 
-#ifdef CONFIG_SOCK_PACKET
 static const struct proto_ops packet_ops_spkt = {
         .family =       PF_PACKET,
         .owner =        THIS_MODULE,
@@ -1877,7 +1840,6 @@ static const struct proto_ops packet_ops_spkt = {
         .mmap =         sock_no_mmap,
         .sendpage =     sock_no_sendpage,
 };
-#endif
 
 static const struct proto_ops packet_ops = {
         .family =       PF_PACKET,
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 45b3cda86a21..6f8684b5617e 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -164,8 +164,7 @@ static int tcf_pedit(struct sk_buff *skb, struct tc_action *a,
                                 printk("offset must be on 32 bit boundaries\n");
                                 goto bad;
                         }
-                        if (skb->len < 0 ||
-                            (offset > 0 && offset > skb->len)) {
+                        if (offset > 0 && offset > skb->len) {
                                 printk("offset %d cant exceed pkt length %d\n",
                                        offset, skb->len);
                                 goto bad;
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index be7d299acd73..d1c383fca82c 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -599,6 +599,7 @@ static void atm_tc_destroy(struct Qdisc *sch)
         /* races ? */
         while ((flow = p->flows)) {
                 tcf_destroy_chain(flow->filter_list);
+                flow->filter_list = NULL;
                 if (flow->ref > 1)
                         printk(KERN_ERR "atm_destroy: %p->ref = %d\n",flow,
                             flow->ref);
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index a294542cb8e4..ee2d5967d109 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1748,10 +1748,12 @@ cbq_destroy(struct Qdisc* sch)
          * classes from root to leafs which means that filters can still
          * be bound to classes which have been destroyed already. --TGR '04
          */
-        for (h = 0; h < 16; h++)
-                for (cl = q->classes[h]; cl; cl = cl->next)
+        for (h = 0; h < 16; h++) {
+                for (cl = q->classes[h]; cl; cl = cl->next) {
                         tcf_destroy_chain(cl->filter_list);
-
+                        cl->filter_list = NULL;
+                }
+        }
         for (h = 0; h < 16; h++) {
                 struct cbq_class *next;
 
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index cbefe225581e..f4d34480a093 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -224,7 +224,8 @@ void __netdev_watchdog_up(struct net_device *dev)
         if (dev->tx_timeout) {
                 if (dev->watchdog_timeo <= 0)
                         dev->watchdog_timeo = 5*HZ;
-                if (!mod_timer(&dev->watchdog_timer, jiffies + dev->watchdog_timeo))
+                if (!mod_timer(&dev->watchdog_timer,
+                               round_jiffies(jiffies + dev->watchdog_timeo)))
                         dev_hold(dev);
         }
 }
diff --git a/net/sctp/debug.c b/net/sctp/debug.c
index e8c0f7435d7f..80f70aa53386 100644
--- a/net/sctp/debug.c
+++ b/net/sctp/debug.c
@@ -77,8 +77,6 @@ static const char *sctp_cid_tbl[SCTP_NUM_BASE_CHUNK_TYPES] = {
 /* Lookup "chunk type" debug name. */
 const char *sctp_cname(const sctp_subtype_t cid)
 {
-        if (cid.chunk < 0)
-                return "illegal chunk id";
         if (cid.chunk <= SCTP_CID_BASE_MAX)
                 return sctp_cid_tbl[cid.chunk];
 
@@ -146,8 +144,6 @@ static const char *sctp_primitive_tbl[SCTP_NUM_PRIMITIVE_TYPES] = {
 /* Lookup primitive debug name. */
 const char *sctp_pname(const sctp_subtype_t id)
 {
-        if (id.primitive < 0)
-                return "illegal primitive";
         if (id.primitive <= SCTP_EVENT_PRIMITIVE_MAX)
                 return sctp_primitive_tbl[id.primitive];
         return "unknown_primitive";
@@ -161,8 +157,6 @@ static const char *sctp_other_tbl[] = {
 /* Lookup "other" debug name. */
 const char *sctp_oname(const sctp_subtype_t id)
 {
-        if (id.other < 0)
-                return "illegal 'other' event";
         if (id.other <= SCTP_EVENT_OTHER_MAX)
                 return sctp_other_tbl[id.other];
         return "unknown 'other' event";
@@ -184,8 +178,6 @@ static const char *sctp_timer_tbl[] = {
 /* Lookup timer debug name. */
 const char *sctp_tname(const sctp_subtype_t id)
 {
-        if (id.timeout < 0)
-                return "illegal 'timer' event";
         if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX)
                 return sctp_timer_tbl[id.timeout];
         return "unknown_timer";
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 523071c7902f..70a91ece3c49 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -960,7 +960,7 @@ static const sctp_sm_table_entry_t *sctp_chunk_event_lookup(sctp_cid_t cid,
         if (state > SCTP_STATE_MAX)
                 return &bug;
 
-        if (cid >= 0 && cid <= SCTP_CID_BASE_MAX)
+        if (cid <= SCTP_CID_BASE_MAX)
                 return &chunk_event_table[cid][state];
 
         if (sctp_prsctp_enable) {
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index fc12ba51c1fc..d70fa30d4294 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -174,11 +174,11 @@ static struct sock *unix_peer_get(struct sock *s)
 {
         struct sock *peer;
 
-        unix_state_rlock(s);
+        unix_state_lock(s);
         peer = unix_peer(s);
         if (peer)
                 sock_hold(peer);
-        unix_state_runlock(s);
+        unix_state_unlock(s);
         return peer;
 }
 
@@ -369,7 +369,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         unix_remove_socket(sk);
 
         /* Clear state */
-        unix_state_wlock(sk);
+        unix_state_lock(sk);
         sock_orphan(sk);
         sk->sk_shutdown = SHUTDOWN_MASK;
         dentry       = u->dentry;
@@ -378,7 +378,7 @@ static int unix_release_sock (struct sock *sk, int embrion)
         u->mnt       = NULL;
         state = sk->sk_state;
         sk->sk_state = TCP_CLOSE;
-        unix_state_wunlock(sk);
+        unix_state_unlock(sk);
 
         wake_up_interruptible_all(&u->peer_wait);
 
@@ -386,12 +386,12 @@ static int unix_release_sock (struct sock *sk, int embrion)
 
         if (skpair!=NULL) {
                 if (sk->sk_type == SOCK_STREAM || sk->sk_type == SOCK_SEQPACKET) {
-                        unix_state_wlock(skpair);
+                        unix_state_lock(skpair);
                         /* No more writes */
                         skpair->sk_shutdown = SHUTDOWN_MASK;
                         if (!skb_queue_empty(&sk->sk_receive_queue) || embrion)
                                 skpair->sk_err = ECONNRESET;
-                        unix_state_wunlock(skpair);
+                        unix_state_unlock(skpair);
                         skpair->sk_state_change(skpair);
                         read_lock(&skpair->sk_callback_lock);
                         sk_wake_async(skpair,1,POLL_HUP);
@@ -448,7 +448,7 @@ static int unix_listen(struct socket *sock, int backlog)
         err = -EINVAL;
         if (!u->addr)
                 goto out;                       /* No listens on an unbound socket */
-        unix_state_wlock(sk);
+        unix_state_lock(sk);
         if (sk->sk_state != TCP_CLOSE && sk->sk_state != TCP_LISTEN)
                 goto out_unlock;
         if (backlog > sk->sk_max_ack_backlog)
@@ -462,7 +462,7 @@ static int unix_listen(struct socket *sock, int backlog)
         err = 0;
 
 out_unlock:
-        unix_state_wunlock(sk);
+        unix_state_unlock(sk);
 out:
         return err;
 }
@@ -858,6 +858,31 @@ out_mknod_parent:
         goto out_up;
 }
 
+static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
+{
+        if (unlikely(sk1 == sk2) || !sk2) {
+                unix_state_lock(sk1);
+                return;
+        }
+        if (sk1 < sk2) {
+                unix_state_lock(sk1);
+                unix_state_lock_nested(sk2);
+        } else {
+                unix_state_lock(sk2);
+                unix_state_lock_nested(sk1);
+        }
+}
+
+static void unix_state_double_unlock(struct sock *sk1, struct sock *sk2)
+{
+        if (unlikely(sk1 == sk2) || !sk2) {
+                unix_state_unlock(sk1);
+                return;
+        }
+        unix_state_unlock(sk1);
+        unix_state_unlock(sk2);
+}
+
 static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                               int alen, int flags)
 {
@@ -877,11 +902,19 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                     !unix_sk(sk)->addr && (err = unix_autobind(sock)) != 0)
                         goto out;
 
+restart:
                 other=unix_find_other(sunaddr, alen, sock->type, hash, &err);
                 if (!other)
                         goto out;
 
-                unix_state_wlock(sk);
+                unix_state_double_lock(sk, other);
+
+                /* Apparently VFS overslept socket death. Retry. */
+                if (sock_flag(other, SOCK_DEAD)) {
+                        unix_state_double_unlock(sk, other);
+                        sock_put(other);
+                        goto restart;
+                }
 
                 err = -EPERM;
                 if (!unix_may_send(sk, other))
@@ -896,7 +929,7 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
                  *      1003.1g breaking connected state with AF_UNSPEC
                  */
                 other = NULL;
-                unix_state_wlock(sk);
+                unix_state_double_lock(sk, other);
         }
 
         /*
@@ -905,19 +938,19 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         if (unix_peer(sk)) {
                 struct sock *old_peer = unix_peer(sk);
                 unix_peer(sk)=other;
-                unix_state_wunlock(sk);
+                unix_state_double_unlock(sk, other);
 
                 if (other != old_peer)
                         unix_dgram_disconnected(sk, old_peer);
                 sock_put(old_peer);
         } else {
                 unix_peer(sk)=other;
-                unix_state_wunlock(sk);
+                unix_state_double_unlock(sk, other);
         }
         return 0;
 
 out_unlock:
-        unix_state_wunlock(sk);
+        unix_state_double_unlock(sk, other);
         sock_put(other);
 out:
         return err;
@@ -936,7 +969,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
                 (skb_queue_len(&other->sk_receive_queue) >
                  other->sk_max_ack_backlog);
 
-        unix_state_runlock(other);
+        unix_state_unlock(other);
 
         if (sched)
                 timeo = schedule_timeout(timeo);
@@ -994,11 +1027,11 @@ restart:
                 goto out;
 
         /* Latch state of peer */
-        unix_state_rlock(other);
+        unix_state_lock(other);
 
         /* Apparently VFS overslept socket death. Retry. */
         if (sock_flag(other, SOCK_DEAD)) {
-                unix_state_runlock(other);
+                unix_state_unlock(other);
                 sock_put(other);
                 goto restart;
         }
@@ -1048,18 +1081,18 @@ restart:
                 goto out_unlock;
         }
 
-        unix_state_wlock_nested(sk);
+        unix_state_lock_nested(sk);
 
         if (sk->sk_state != st) {
-                unix_state_wunlock(sk);
-                unix_state_runlock(other);
+                unix_state_unlock(sk);
+                unix_state_unlock(other);
                 sock_put(other);
                 goto restart;
         }
 
         err = security_unix_stream_connect(sock, other->sk_socket, newsk);
         if (err) {
-                unix_state_wunlock(sk);
+                unix_state_unlock(sk);
                 goto out_unlock;
         }
 
@@ -1096,7 +1129,7 @@ restart:
         smp_mb__after_atomic_inc();     /* sock_hold() does an atomic_inc() */
         unix_peer(sk)   = newsk;
 
-        unix_state_wunlock(sk);
+        unix_state_unlock(sk);
 
         /* take ten and and send info to listening sock */
         spin_lock(&other->sk_receive_queue.lock);
@@ -1105,14 +1138,14 @@ restart:
          * is installed to listening socket. */
         atomic_inc(&newu->inflight);
         spin_unlock(&other->sk_receive_queue.lock);
-        unix_state_runlock(other);
+        unix_state_unlock(other);
         other->sk_data_ready(other, 0);
         sock_put(other);
         return 0;
 
 out_unlock:
         if (other)
-                unix_state_runlock(other);
+                unix_state_unlock(other);
 
 out:
         if (skb)
@@ -1178,10 +1211,10 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
         wake_up_interruptible(&unix_sk(sk)->peer_wait);
 
         /* attach accepted sock to socket */
-        unix_state_wlock(tsk);
+        unix_state_lock(tsk);
         newsock->state = SS_CONNECTED;
         sock_graft(tsk, newsock);
-        unix_state_wunlock(tsk);
+        unix_state_unlock(tsk);
         return 0;
 
 out:
@@ -1208,7 +1241,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
         }
 
         u = unix_sk(sk);
-        unix_state_rlock(sk);
+        unix_state_lock(sk);
         if (!u->addr) {
                 sunaddr->sun_family = AF_UNIX;
                 sunaddr->sun_path[0] = 0;
@@ -1219,7 +1252,7 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
                 *uaddr_len = addr->len;
                 memcpy(sunaddr, addr->name, *uaddr_len);
         }
-        unix_state_runlock(sk);
+        unix_state_unlock(sk);
         sock_put(sk);
 out:
         return err;
@@ -1337,7 +1370,7 @@ restart:
                         goto out_free;
         }
 
-        unix_state_rlock(other);
+        unix_state_lock(other);
         err = -EPERM;
         if (!unix_may_send(sk, other))
                 goto out_unlock;
@@ -1347,20 +1380,20 @@ restart:
                  *      Check with 1003.1g - what should
                  *      datagram error
                  */
-                unix_state_runlock(other);
+                unix_state_unlock(other);
                 sock_put(other);
 
                 err = 0;
-                unix_state_wlock(sk);
+                unix_state_lock(sk);
                 if (unix_peer(sk) == other) {
                         unix_peer(sk)=NULL;
-                        unix_state_wunlock(sk);
+                        unix_state_unlock(sk);
 
                         unix_dgram_disconnected(sk, other);
                         sock_put(other);
                         err = -ECONNREFUSED;
                 } else {
-                        unix_state_wunlock(sk);
+                        unix_state_unlock(sk);
                 }
 
                 other = NULL;
@@ -1397,14 +1430,14 @@ restart:
         }
 
         skb_queue_tail(&other->sk_receive_queue, skb);
-        unix_state_runlock(other);
+        unix_state_unlock(other);
         other->sk_data_ready(other, len);
         sock_put(other);
         scm_destroy(siocb->scm);
         return len;
 
 out_unlock:
-        unix_state_runlock(other);
+        unix_state_unlock(other);
 out_free:
         kfree_skb(skb);
 out:
@@ -1494,14 +1527,14 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                         goto out_err;
                 }
 
-                unix_state_rlock(other);
+                unix_state_lock(other);
 
                 if (sock_flag(other, SOCK_DEAD) ||
                     (other->sk_shutdown & RCV_SHUTDOWN))
                         goto pipe_err_free;
 
                 skb_queue_tail(&other->sk_receive_queue, skb);
-                unix_state_runlock(other);
+                unix_state_unlock(other);
                 other->sk_data_ready(other, size);
                 sent+=size;
         }
@@ -1512,7 +1545,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
         return sent;
 
 pipe_err_free:
-        unix_state_runlock(other);
+        unix_state_unlock(other);
         kfree_skb(skb);
 pipe_err:
         if (sent==0 && !(msg->msg_flags&MSG_NOSIGNAL))
@@ -1641,7 +1674,7 @@ static long unix_stream_data_wait(struct sock * sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
-        unix_state_rlock(sk);
+        unix_state_lock(sk);
 
         for (;;) {
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
@@ -1654,14 +1687,14 @@ static long unix_stream_data_wait(struct sock * sk, long timeo)
                         break;
 
                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-                unix_state_runlock(sk);
+                unix_state_unlock(sk);
                 timeo = schedule_timeout(timeo);
-                unix_state_rlock(sk);
+                unix_state_lock(sk);
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
 
         finish_wait(sk->sk_sleep, &wait);
-        unix_state_runlock(sk);
+        unix_state_unlock(sk);
         return timeo;
 }
 
@@ -1711,20 +1744,23 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 int chunk;
                 struct sk_buff *skb;
 
+                unix_state_lock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb==NULL)
                 {
                         if (copied >= target)
-                                break;
+                                goto unlock;
 
                         /*
                          *      POSIX 1003.1g mandates this order.
                          */
 
                         if ((err = sock_error(sk)) != 0)
-                                break;
+                                goto unlock;
                         if (sk->sk_shutdown & RCV_SHUTDOWN)
-                                break;
+                                goto unlock;
+
+                        unix_state_unlock(sk);
                         err = -EAGAIN;
                         if (!timeo)
                                 break;
@@ -1738,7 +1774,11 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         }
                         mutex_lock(&u->readlock);
                         continue;
+ unlock:
+                        unix_state_unlock(sk);
+                        break;
                 }
+                unix_state_unlock(sk);
 
                 if (check_creds) {
                         /* Never glue messages from different writers */
@@ -1816,12 +1856,12 @@ static int unix_shutdown(struct socket *sock, int mode)
         mode = (mode+1)&(RCV_SHUTDOWN|SEND_SHUTDOWN);
 
         if (mode) {
-                unix_state_wlock(sk);
+                unix_state_lock(sk);
                 sk->sk_shutdown |= mode;
                 other=unix_peer(sk);
                 if (other)
                         sock_hold(other);
-                unix_state_wunlock(sk);
+                unix_state_unlock(sk);
                 sk->sk_state_change(sk);
 
                 if (other &&
@@ -1833,9 +1873,9 @@ static int unix_shutdown(struct socket *sock, int mode)
                                 peer_mode |= SEND_SHUTDOWN;
                         if (mode&SEND_SHUTDOWN)
                                 peer_mode |= RCV_SHUTDOWN;
-                        unix_state_wlock(other);
+                        unix_state_lock(other);
                         other->sk_shutdown |= peer_mode;
-                        unix_state_wunlock(other);
+                        unix_state_unlock(other);
                         other->sk_state_change(other);
                         read_lock(&other->sk_callback_lock);
                         if (peer_mode == SHUTDOWN_MASK)
@@ -1973,7 +2013,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
         else {
                 struct sock *s = v;
                 struct unix_sock *u = unix_sk(s);
-                unix_state_rlock(s);
+                unix_state_lock(s);
 
                 seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
                         s,
@@ -2001,7 +2041,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
                         for ( ; i < len; i++)
                                 seq_putc(seq, u->addr->name->sun_path[i]);
                 }
-                unix_state_runlock(s);
+                unix_state_unlock(s);
                 seq_putc(seq, '\n');
         }
 
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 7a19e0ede289..849cc06bd914 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -454,7 +454,7 @@ static int wanrouter_device_setup(struct wan_device *wandev,
         }
 
         if (conf->data_size && conf->data) {
-                if (conf->data_size > 128000 || conf->data_size < 0) {
+                if (conf->data_size > 128000) {
                         printk(KERN_INFO
                             "%s: ERROR, Invalid firmware data size %i !\n",
                                         wandev->name, conf->data_size);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b8bab89616a0..157bfbd250ba 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -26,10 +26,11 @@
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <linux/audit.h>
+#include <linux/cache.h>
 
 #include "xfrm_hash.h"
 
-int sysctl_xfrm_larval_drop;
+int sysctl_xfrm_larval_drop __read_mostly;
 
 DEFINE_MUTEX(xfrm_cfg_mutex);
 EXPORT_SYMBOL(xfrm_cfg_mutex);
@@ -833,11 +834,67 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
 }
 EXPORT_SYMBOL(xfrm_policy_byid);
 
-void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+static inline int
+xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
 {
-        int dir;
+        int dir, err = 0;
+
+        for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
+                struct xfrm_policy *pol;
+                struct hlist_node *entry;
+                int i;
+
+                hlist_for_each_entry(pol, entry,
+                                     &xfrm_policy_inexact[dir], bydst) {
+                        if (pol->type != type)
+                                continue;
+                        err = security_xfrm_policy_delete(pol);
+                        if (err) {
+                                xfrm_audit_log(audit_info->loginuid,
+                                               audit_info->secid,
+                                               AUDIT_MAC_IPSEC_DELSPD, 0,
+                                               pol, NULL);
+                                return err;
+                        }
+                }
+                for (i = xfrm_policy_bydst[dir].hmask; i >= 0; i--) {
+                        hlist_for_each_entry(pol, entry,
+                                             xfrm_policy_bydst[dir].table + i,
+                                             bydst) {
+                                if (pol->type != type)
+                                        continue;
+                                err = security_xfrm_policy_delete(pol);
+                                if (err) {
+                                        xfrm_audit_log(audit_info->loginuid,
+                                                       audit_info->secid,
+                                                       AUDIT_MAC_IPSEC_DELSPD,
+                                                       0, pol, NULL);
+                                        return err;
+                                }
+                        }
+                }
+        }
+        return err;
+}
+#else
+static inline int
+xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
+{
+        return 0;
+}
+#endif
+
+int xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
+{
+        int dir, err = 0;
 
         write_lock_bh(&xfrm_policy_lock);
+
+        err = xfrm_policy_flush_secctx_check(type, audit_info);
+        if (err)
+                goto out;
+
         for (dir = 0; dir < XFRM_POLICY_MAX; dir++) {
                 struct xfrm_policy *pol;
                 struct hlist_node *entry;
@@ -890,7 +947,9 @@ void xfrm_policy_flush(u8 type, struct xfrm_audit *audit_info)
                 xfrm_policy_count[dir] -= killed;
         }
         atomic_inc(&flow_cache_genid);
+out:
         write_unlock_bh(&xfrm_policy_lock);
+        return err;
 }
 EXPORT_SYMBOL(xfrm_policy_flush);
 
@@ -2582,4 +2641,3 @@ restore_state:
 }
 EXPORT_SYMBOL(xfrm_migrate);
 #endif
-
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 9955ff4da0a2..85f3f43a6cca 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -21,18 +21,21 @@
 #include <linux/cache.h>
 #include <asm/uaccess.h>
 #include <linux/audit.h>
+#include <linux/cache.h>
 
 #include "xfrm_hash.h"
 
 struct sock *xfrm_nl;
 EXPORT_SYMBOL(xfrm_nl);
 
-u32 sysctl_xfrm_aevent_etime = XFRM_AE_ETIME;
+u32 sysctl_xfrm_aevent_etime __read_mostly = XFRM_AE_ETIME;
 EXPORT_SYMBOL(sysctl_xfrm_aevent_etime);
 
-u32 sysctl_xfrm_aevent_rseqth = XFRM_AE_SEQT_SIZE;
+u32 sysctl_xfrm_aevent_rseqth __read_mostly = XFRM_AE_SEQT_SIZE;
 EXPORT_SYMBOL(sysctl_xfrm_aevent_rseqth);
 
+u32 sysctl_xfrm_acq_expires __read_mostly = 30;
+
 /* Each xfrm_state may be linked to two tables:
 
    1. Hash table by (spi,daddr,ah/esp) to find SA by SPI. (input,ctl)
@@ -388,12 +391,48 @@ int xfrm_state_delete(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(xfrm_state_delete);
 
-void xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+static inline int
+xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
 {
-        int i;
-        int err = 0;
+        int i, err = 0;
+
+        for (i = 0; i <= xfrm_state_hmask; i++) {
+                struct hlist_node *entry;
+                struct xfrm_state *x;
+
+                hlist_for_each_entry(x, entry, xfrm_state_bydst+i, bydst) {
+                        if (xfrm_id_proto_match(x->id.proto, proto) &&
+                           (err = security_xfrm_state_delete(x)) != 0) {
+                                xfrm_audit_log(audit_info->loginuid,
+                                               audit_info->secid,
+                                               AUDIT_MAC_IPSEC_DELSA,
+                                               0, NULL, x);
+
+                                return err;
+                        }
+                }
+        }
+
+        return err;
+}
+#else
+static inline int
+xfrm_state_flush_secctx_check(u8 proto, struct xfrm_audit *audit_info)
+{
+        return 0;
+}
+#endif
+
+int xfrm_state_flush(u8 proto, struct xfrm_audit *audit_info)
+{
+        int i, err = 0;
 
         spin_lock_bh(&xfrm_state_lock);
+        err = xfrm_state_flush_secctx_check(proto, audit_info);
+        if (err)
+                goto out;
+
         for (i = 0; i <= xfrm_state_hmask; i++) {
                 struct hlist_node *entry;
                 struct xfrm_state *x;
@@ -416,8 +455,12 @@ restart:
                         }
                 }
         }
+        err = 0;
+
+out:
         spin_unlock_bh(&xfrm_state_lock);
         wake_up(&km_waitq);
+        return err;
 }
 EXPORT_SYMBOL(xfrm_state_flush);
 
@@ -622,8 +665,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                                 h = xfrm_spi_hash(&x->id.daddr, x->id.spi, x->id.proto, family);
                                 hlist_add_head(&x->byspi, xfrm_state_byspi+h);
                         }
-                        x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
-                        x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
+                        x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
+                        x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
                         add_timer(&x->timer);
                         xfrm_state_num++;
                         xfrm_hash_grow_check(x->bydst.next != NULL);
@@ -772,9 +815,9 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
                 x->props.family = family;
                 x->props.mode = mode;
                 x->props.reqid = reqid;
-                x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
+                x->lft.hard_add_expires_seconds = sysctl_xfrm_acq_expires;
                 xfrm_state_hold(x);
-                x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
+                x->timer.expires = jiffies + sysctl_xfrm_acq_expires*HZ;
                 add_timer(&x->timer);
                 hlist_add_head(&x->bydst, xfrm_state_bydst+h);
                 h = xfrm_src_hash(daddr, saddr, family);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b14c7e590c31..c06883bf620e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1418,10 +1418,13 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct km_event c;
         struct xfrm_usersa_flush *p = NLMSG_DATA(nlh);
         struct xfrm_audit audit_info;
+        int err;
 
         audit_info.loginuid = NETLINK_CB(skb).loginuid;
         audit_info.secid = NETLINK_CB(skb).sid;
-        xfrm_state_flush(p->proto, &audit_info);
+        err = xfrm_state_flush(p->proto, &audit_info);
+        if (err)
+                return err;
         c.data.proto = p->proto;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
@@ -1582,7 +1585,9 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         audit_info.loginuid = NETLINK_CB(skb).loginuid;
         audit_info.secid = NETLINK_CB(skb).sid;
-        xfrm_policy_flush(type, &audit_info);
+        err = xfrm_policy_flush(type, &audit_info);
+        if (err)
+                return err;
         c.data.type = type;
         c.event = nlh->nlmsg_type;
         c.seq = nlh->nlmsg_seq;
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
new file mode 100755
index 000000000000..e216d49624b7
--- /dev/null
+++ b/scripts/checkpatch.pl
@@ -0,0 +1,595 @@
+#!/usr/bin/perl -w
+# (c) 2001, Dave Jones. <davej@codemonkey.org.uk> (the file handling bit)
+# (c) 2005, Joel Scohpp <jschopp@austin.ibm.com> (the ugly bit)
+# (c) 2007, Andy Whitcroft <apw@uk.ibm.com> (new conditions, test suite, etc)
+# Licensed under the terms of the GNU GPL License version 2
+
+use strict;
+
+my $P = $0;
+
+my $V = '0.01';
+
+use Getopt::Long qw(:config no_auto_abbrev);
+
+my $quiet = 0;
+my $tree = 1;
+my $chk_signoff = 1;
+my $chk_patch = 1;
+GetOptions(
+        'q|quiet'       => \$quiet,
+        'tree!'         => \$tree,
+        'signoff!'      => \$chk_signoff,
+        'patch!'        => \$chk_patch,
+) or exit;
+
+my $exit = 0;
+
+if ($#ARGV < 0) {
+        print "usage: patchstylecheckemail.pl [options] patchfile\n";
+        print "version: $V\n";
+        print "options: -q           => quiet\n";
+        print "         --no-tree    => run without a kernel tree\n";
+        exit(1);
+}
+
+if ($tree && !top_of_kernel_tree()) {
+        print "Must be run from the top-level dir. of a kernel tree\n";
+        exit(2);
+}
+
+my @deprecated = ();
+my $removal = 'Documentation/feature-removal-schedule.txt';
+if ($tree && -f $removal) {
+        open(REMOVE, "<$removal") || die "$P: $removal: open failed - $!\n";
+        while (<REMOVE>) {
+                if (/^Files:\s+(.*\S)/) {
+                        for my $file (split(/[, ]+/, $1)) {
+                                if ($file =~ m@include/(.*)@) {
+                                        push(@deprecated, $1);
+                                }
+                        }
+                }
+        }
+}
+
+my @lines = ();
+while (<>) {
+        chomp;
+        push(@lines, $_);
+        if (eof(ARGV)) {
+                if (!process($ARGV, @lines)) {
+                        $exit = 1;
+                }
+                @lines = ();
+        }
+}
+
+exit($exit);
+
+sub top_of_kernel_tree {
+        if ((-f "COPYING") && (-f "CREDITS") && (-f "Kbuild") &&
+            (-f "MAINTAINERS") && (-f "Makefile") && (-f "README") &&
+            (-d "Documentation") && (-d "arch") && (-d "include") &&
+            (-d "drivers") && (-d "fs") && (-d "init") && (-d "ipc") &&
+            (-d "kernel") && (-d "lib") && (-d "scripts")) {
+                return 1;
+        }
+        return 0;
+}
+
+sub expand_tabs {
+        my ($str) = @_;
+
+        my $res = '';
+        my $n = 0;
+        for my $c (split(//, $str)) {
+                if ($c eq "\t") {
+                        $res .= ' ';
+                        $n++;
+                        for (; ($n % 8) != 0; $n++) {
+                                $res .= ' ';
+                        }
+                        next;
+                }
+                $res .= $c;
+                $n++;
+        }
+
+        return $res;
+}
+
+sub cat_vet {
+        my ($vet) = @_;
+
+        $vet =~ s/\t/^I/;
+        $vet =~ s/$/\$/;
+
+        return $vet;
+}
+
+sub process {
+        my $filename = shift;
+        my @lines = @_;
+
+        my $linenr=0;
+        my $prevline="";
+        my $stashline="";
+
+        my $lineforcounting='';
+        my $indent;
+        my $previndent=0;
+        my $stashindent=0;
+
+        my $clean = 1;
+        my $signoff = 0;
+        my $is_patch = 0;
+
+        # Trace the real file/line as we go.
+        my $realfile = '';
+        my $realline = 0;
+        my $realcnt = 0;
+        my $here = '';
+        my $in_comment = 0;
+        my $first_line = 0;
+
+        foreach my $line (@lines) {
+                $linenr++;
+
+#extract the filename as it passes
+                if ($line=~/^\+\+\+\s+(\S+)/) {
+                        $realfile=$1;
+                        $in_comment = 0;
+                        next;
+                }
+#extract the line range in the file after the patch is applied
+                if ($line=~/^\@\@ -\d+,\d+ \+(\d+)(,(\d+))? \@\@/) {
+                        $is_patch = 1;
+                        $first_line = 1;
+                        $in_comment = 0;
+                        $realline=$1-1;
+                        if (defined $2) {
+                                $realcnt=$3+1;
+                        } else {
+                                $realcnt=1+1;
+                        }
+                        next;
+                }
+
+#track the line number as we move through the hunk
+                if ($line=~/^[ \+]/) {
+                        $realline++;
+                        $realcnt-- if ($realcnt != 0);
+
+                        # track any sort of multi-line comment.  Obviously if
+                        # the added text or context do not include the whole
+                        # comment we will not see it. Such is life.
+                        #
+                        # Guestimate if this is a continuing comment.  If this
+                        # is the start of a diff block and this line starts
+                        # ' *' then it is very likely a comment.
+                        if ($first_line and $line =~ m@^.\s*\*@) {
+                                $in_comment = 1;
+                        }
+                        if ($line =~ m@/\*@) {
+                                $in_comment = 1;
+                        }
+                        if ($line =~ m@\*/@) {
+                                $in_comment = 0;
+                        }
+
+                        $lineforcounting = $line;
+                        $lineforcounting =~ s/^\+//;
+                        $lineforcounting = expand_tabs($lineforcounting);
+
+                        my ($white) = ($lineforcounting =~ /^(\s*)/);
+                        $indent = length($white);
+
+                        # Track the previous line.
+                        ($prevline, $stashline) = ($stashline, $line);
+                        ($previndent, $stashindent) = ($stashindent, $indent);
+                        $first_line = 0;
+                }
+
+#make up the handle for any error we report on this line
+                $here = "PATCH: $ARGV:$linenr:";
+                $here .= "\nFILE: $realfile:$realline:" if ($realcnt != 0);
+
+                my $herecurr = "$here\n$line\n\n";
+                my $hereprev = "$here\n$prevline\n$line\n\n";
+
+#check the patch for a signoff:
+                if ($line =~ /^\s*Signed-off-by:\s/) {
+                        $signoff++;
+
+                } elsif ($line =~ /^\s*signed-off-by:/i) {
+                        if (!($line =~ /^\s*Signed-off-by:/)) {
+                                print "use Signed-off-by:\n";
+                                print "$herecurr";
+                                $clean = 0;
+                        }
+                        if ($line =~ /^\s*signed-off-by:\S/i) {
+                                print "need space after Signed-off-by:\n";
+                                print "$herecurr";
+                                $clean = 0;
+                        }
+                }
+
+#ignore lines not being added
+                if ($line=~/^[^\+]/) {next;}
+
+# check we are in a valid source file *.[hcsS] if not then ignore this hunk
+                next if ($realfile !~ /\.[hcsS]$/);
+
+#trailing whitespace
+                if ($line=~/\S\s+$/) {
+                        my $herevet = "$here\n" . cat_vet($line) . "\n\n";
+                        print "trailing whitespace\n";
+                        print "$herevet";
+                        $clean = 0;
+                }
+#80 column limit
+                if (!($prevline=~/\/\*\*/) && length($lineforcounting) > 80) {
+                        print "line over 80 characters\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+# check we are in a valid source file *.[hc] if not then ignore this hunk
+                next if ($realfile !~ /\.[hc]$/);
+
+# at the beginning of a line any tabs must come first and anything
+# more than 8 must use tabs.
+                if ($line=~/^\+\s* \t\s*\S/ or $line=~/^\+\s*        \s*/) {
+                        my $herevet = "$here\n" . cat_vet($line) . "\n\n";
+                        print "use tabs not spaces\n";
+                        print "$herevet";
+                        $clean = 0;
+                }
+
+                #
+                # The rest of our checks refer specifically to C style
+                # only apply those _outside_ comments.
+                #
+                next if ($in_comment);
+
+# no C99 // comments
+                if ($line =~ m@//@ and !($line =~ m@\".*//.*\"@)) {
+                        print "do not use C99 // comments\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+                # Remove comments from the line before processing.
+                $line =~ s@/\*.*\*/@@g;
+                $line =~ s@/\*.*@@;
+                $line =~ s@.*\*/@@;
+                $line =~ s@//.*@@;
+
+#EXPORT_SYMBOL should immediately follow its function closing }.
+                if (($line =~ /EXPORT_SYMBOL.*\(.*\)/) ||
+                    ($line =~ /EXPORT_UNUSED_SYMBOL.*\(.*\)/)) {
+                        if (($prevline !~ /^}/) &&
+                           ($prevline !~ /^\+}/) &&
+                           ($prevline !~ /^ }/)) {
+                                print "EXPORT_SYMBOL(func); should immediately follow its function\n";
+                                print "$herecurr";
+                                $clean = 0;
+                        }
+                }
+
+                # check for static initialisers.
+                if ($line=~/\s*static\s.*=\s+(0|NULL);/) {
+                        print "do not initialise statics to 0 or NULL\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+                # check for new typedefs.
+                if ($line=~/\s*typedef\s/) {
+                        print "do not add new typedefs\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+# * goes on variable not on type
+                if ($line=~/[A-Za-z\d_]+\* [A-Za-z\d_]+/) {
+                        print "\"foo* bar\" should be \"foo *bar\"\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+# # no BUG() or BUG_ON()
+#               if ($line =~ /\b(BUG|BUG_ON)\b/) {
+#                       print "Try to use WARN_ON & Recovery code rather than BUG() or BUG_ON()\n";
+#                       print "$herecurr";
+#                       $clean = 0;
+#               }
+
+# printk should use KERN_* levels
+                if ($line =~ /\bprintk\((?!KERN_)/) {
+                        print "printk() should include KERN_ facility level\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+#function brace can't be on same line, except for #defines of do while, or if closed on same line
+                if (($line=~/[A-Za-z\d_]+\**\s+\**[A-Za-z\d_]+\(.*\).* {/) and
+                    !($line=~/\#define.*do\s{/) and !($line=~/}/)) {
+                        print "braces following function declarations go on the next line\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+                my $opline = $line;
+                $opline =~ s/^.//;
+                if (!($line=~/\#\s*include/)) {
+                        # Check operator spacing.
+                        my @elements = split(/(<<=|>>=|<=|>=|==|!=|\+=|-=|\*=|\/=|%=|\^=|\|=|&=|->|<<|>>|<|>|=|!|~|&&|\|\||,|\^|\+\+|--|;|&|\||\+|-|\*|\/\/|\/)/, $opline);
+                        for (my $n = 0; $n < $#elements; $n += 2) {
+                                # $wN says we have white-space before or after
+                                # $sN says we have a separator before or after
+                                # $oN says we have another operator before or after
+                                my $w1 = $elements[$n] =~ /\s$/;
+                                my $s1 = $elements[$n] =~ /(\[|\(|\s)$/;
+                                my $o1 = $elements[$n] eq '';
+                                my $op = $elements[$n + 1];
+                                my $w2 = 1;
+                                my $s2 = 1;
+                                my $o2 = 0;
+                                # If we have something after the operator handle it.
+                                if (defined $elements[$n + 2]) {
+                                        $w2 = $elements[$n + 2] =~ /^\s/;
+                                        $s2 = $elements[$n + 2] =~ /^(\s|\)|\]|;)/;
+                                        $o2 = $elements[$n + 2] eq '';
+                                }
+
+                                # Generate the context.
+                                my $at = "here: ";
+                                for (my $m = $n; $m >= 0; $m--) {
+                                        if ($elements[$m] ne '') {
+                                                $at .= $elements[$m];
+                                                last;
+                                        }
+                                }
+                                $at .= $op;
+                                for (my $m = $n + 2; defined $elements[$m]; $m++) {
+                                        if ($elements[$m] ne '') {
+                                                $at .= $elements[$m];
+                                                last;
+                                        }
+                                }
+
+                                ##print "<$s1:$op:$s2> <$elements[$n]:$elements[$n + 1]:$elements[$n + 2]>\n";
+                                # Skip things apparently in quotes.
+                                next if ($line=~/\".*\Q$op\E.*\"/ or $line=~/\'\Q$op\E\'/);
+
+                                # We need ; as an operator.  // is a comment.
+                                if ($op eq ';' or $op eq '//') {
+
+                                # -> should have no spaces
+                                } elsif ($op eq '->') {
+                                        if ($s1 or $s2) {
+                                                print "no spaces around that '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+
+                                # , must have a space on the right.
+                                } elsif ($op eq ',') {
+                                        if (!$s2) {
+                                                print "need space after that '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+
+                                # unary ! and unary ~ are allowed no space on the right
+                                } elsif ($op eq '!' or $op eq '~') {
+                                        if (!$s1 && !$o1) {
+                                                print "need space before that '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+                                        if ($s2) {
+                                                print "no space after that '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+
+                                # unary ++ and unary -- are allowed no space on one side.
+                                } elsif ($op eq '++' or $op eq '--') {
+                                        if (($s1 && $s2) || ((!$s1 && !$o1) && (!$s2 && !$o2))) {
+                                                print "need space one side of that '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+
+                                # & is both unary and binary
+                                # unary:
+                                #       a &b
+                                # binary (consistent spacing):
+                                #       a&b             OK
+                                #       a & b           OK
+                                #
+                                # boiling down to: if there is a space on the right then there
+                                # should be one on the left.
+                                #
+                                # - is the same
+                                #
+                                # * is the same only adding:
+                                # type:
+                                #       (foo *)
+                                #       (foo **)
+                                #
+                                } elsif ($op eq '&' or $op eq '-' or $op eq '*') {
+                                        if ($w2 and !$w1) {
+                                                print "need space before that '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+
+                                # << and >> may either have or not have spaces both sides
+                                } elsif ($op eq '<<' or $op eq '>>' or $op eq '+' or $op eq '/' or
+                                         $op eq '^' or $op eq '|')
+                                {
+                                        if ($s1 != $s2) {
+                                                print "need consistent spacing around '$op' $at\n";
+                                                print "$herecurr";
+                                                $clean = 0;
+                                        }
+
+                                # All the others need spaces both sides.
+                                } elsif (!$s1 or !$s2) {
+                                        print "need spaces around that '$op' $at\n";
+                                        print "$herecurr";
+                                        $clean = 0;
+                                }
+                        }
+                }
+
+#need space before brace following if, while, etc
+                if ($line=~/\(.*\){/) {
+                        print "need a space before the brace\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+#goto labels aren't indented, allow a single space however
+                if ($line=~/^.\s+[A-Za-z\d_]+:/ and
+                   !($line=~/^. [A-Za-z\d_]+:/) and !($line=~/^.\s+default:/)) {
+                        print "labels should not be indented\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+# Need a space before open parenthesis after if, while etc
+                if ($line=~/(if|while|for|switch)\(/) {
+                        print "need a space before the open parenthesis\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+# Check for illegal assignment in if conditional.
+                if ($line=~/(if|while)\s*\(.*[^<>!=]=[^=].*\)/) {
+                        print "do not use assignment in if condition\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+                # Check for }<nl>else {, these must be at the same
+                # indent level to be relevant to each other.
+                if ($prevline=~/}\s*$/ and $line=~/^.\s*else\s*/ and
+                                                $previndent == $indent) {
+                        print "else should follow close brace\n";
+                        print "$hereprev";
+                        $clean = 0;
+                }
+
+                # Check for switch () {<nl>case, these must be at the
+                # same indent.  We will only catch the first one, as our
+                # context is very small but people tend to be consistent
+                # so we will catch them out more often than not.
+                if ($prevline=~/\s*switch\s*\(.*\)/ and $line=~/\s*case\s+/
+                                                and $previndent != $indent) {
+                        print "switch and case should be at the same indent\n";
+                        print "$hereprev";
+                        $clean = 0;
+                }
+
+#studly caps, commented out until figure out how to distinguish between use of existing and adding new
+#               if (($line=~/[\w_][a-z\d]+[A-Z]/) and !($line=~/print/)) {
+#                   print "No studly caps, use _\n";
+#                   print "$herecurr";
+#                   $clean = 0;
+#               }
+
+#no spaces allowed after \ in define
+                if ($line=~/\#define.*\\\s$/) {
+                        print("Whitepspace after \\ makes next lines useless\n");
+                        print "$herecurr";
+                        $clean = 0;
+                }
+
+#warn if <asm/foo.h> is #included and <linux/foo.h> is available.
+                if ($tree && $line =~ qr|\s*\#\s*include\s*\<asm\/(.*)\.h\>|) {
+                        my $checkfile = "include/linux/$1.h";
+                        if (-f $checkfile) {
+                                print "Use #include <linux/$1.h> instead of <asm/$1.h>\n";
+                                print $herecurr;
+                                $clean = 0;
+                        }
+                }
+
+#if/while/etc brace do not go on next line, unless #defining a do while loop, or if that brace on the next line is for something else
+                if ($prevline=~/(if|while|for|switch)\s*\(/) {
+                        my @opened = $prevline=~/\(/g;
+                        my @closed = $prevline=~/\)/g;
+                        my $nr_line = $linenr;
+                        my $remaining = $realcnt;
+                        my $next_line = $line;
+                        my $extra_lines = 0;
+                        my $display_segment = $prevline;
+
+                        while ($remaining > 0 && scalar @opened > scalar @closed) {
+                                $prevline .= $next_line;
+                                $display_segment .= "\n" . $next_line;
+                                $next_line = $lines[$nr_line];
+                                $nr_line++;
+                                $remaining--;
+
+                                @opened = $prevline=~/\(/g;
+                                @closed = $prevline=~/\)/g;
+                        }
+
+                        if (($prevline=~/(if|while|for|switch)\s*\(.*\)\s*$/) and ($next_line=~/{/) and
+                           !($next_line=~/(if|while|for)/) and !($next_line=~/\#define.*do.*while/)) {
+                                print "That { should be on the previous line\n";
+                                print "$display_segment\n$next_line\n\n";
+                                $clean = 0;
+                        }
+                }
+
+#multiline macros should be enclosed in a do while loop
+                if (($prevline=~/\#define.*\\/) and !($prevline=~/do\s+{/) and
+                   !($prevline=~/\(\{/) and ($line=~/;\s*\\/) and
+                   !($line=~/do.*{/) and !($line=~/\(\{/)) {
+                        print "Macros with multiple statements should be enclosed in a do - while loop\n";
+                        print "$hereprev";
+                        $clean = 0;
+                }
+
+# don't include deprecated include files
+                for my $inc (@deprecated) {
+                        if ($line =~ m@\#\s*include\s*\<$inc>@) {
+                                print "Don't use <$inc>: see Documentation/feature-removal-schedule.txt\n";
+                                print "$herecurr";
+                                $clean = 0;
+                        }
+                }
+
+# don't use kernel_thread()
+                if ($line =~ /\bkernel_thread\b/) {
+                        print "Don't use kernel_thread(), use kthread(): see Documentation/feature-removal-schedule.txt\n";
+                        print "$herecurr";
+                        $clean = 0;
+                }
+        }
+
+        if ($chk_patch && !$is_patch) {
+                $clean = 0;
+                print "Does not appear to be a unified-diff format patch\n";
+        }
+        if ($is_patch && $chk_signoff && $signoff == 0) {
+                $clean = 0;
+                print "Missing Signed-off-by: line(s)\n";
+        }
+
+        if ($clean == 1 && $quiet == 0) {
+                print "Your patch has no obvious style problems and is ready for submission.\n"
+        }
+        if ($clean == 0 && $quiet == 0) {
+                print "Your patch has style problems, please review.  If any of these errors\n";
+                print "are false positives report them to the maintainer, see\n";
+                print "CHECKPATCH in MAINTAINERS.\n";
+        }
+        return $clean;
+}
diff --git a/sound/arm/sa11xx-uda1341.c b/sound/arm/sa11xx-uda1341.c
index c7e1b2646193..e7ed868fa7c0 100644
--- a/sound/arm/sa11xx-uda1341.c
+++ b/sound/arm/sa11xx-uda1341.c
@@ -987,7 +987,7 @@ static int __init sa11xx_uda1341_init(void)
                 if (platform_get_drvdata(device))
                         return 0;
                 platform_device_unregister(device);
-                err = -ENODEV
+                err = -ENODEV;
         } else
                 err = PTR_ERR(device);
         platform_driver_unregister(&sa11xx_uda1341_driver);
diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
index e1ed59549c50..cb59f994c68f 100644
--- a/sound/pci/ali5451/ali5451.c
+++ b/sound/pci/ali5451/ali5451.c
@@ -1250,7 +1250,7 @@ static int snd_ali_playback_hw_params(struct snd_pcm_substream *substream,
                         evoice->substream = substream;
                 }
         } else {
-                if (!evoice) {
+                if (evoice) {
                         snd_ali_free_voice(codec, evoice);
                         pvoice->extra = evoice = NULL;
                 }
@@ -1267,7 +1267,7 @@ static int snd_ali_playback_hw_free(struct snd_pcm_substream *substream)
         struct snd_ali_voice *evoice = pvoice ? pvoice->extra : NULL;
 
         snd_pcm_lib_free_pages(substream);
-        if (!evoice) {
+        if (evoice) {
                 snd_ali_free_voice(codec, evoice);
                 pvoice->extra = NULL;
         }
@@ -1356,7 +1356,7 @@ static int snd_ali_playback_prepare(struct snd_pcm_substream *substream)
                                  VOL,
                                  CTRL,
                                  EC);
-        if (!evoice) {
+        if (evoice) {
                 evoice->count = pvoice->count;
                 evoice->eso = pvoice->count << 1;
                 ESO = evoice->eso - 1;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 8e89d56b6400..f87f8f088956 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -713,6 +713,19 @@ static u32 query_amp_caps(struct hda_codec *codec, hda_nid_t nid, int direction)
         return info->amp_caps;
 }
 
+int snd_hda_override_amp_caps(struct hda_codec *codec, hda_nid_t nid, int dir,
+                              unsigned int caps)
+{
+        struct hda_amp_info *info;
+
+        info = get_alloc_amp_hash(codec, HDA_HASH_KEY(nid, dir, 0));
+        if (!info)
+                return -EINVAL;
+        info->amp_caps = caps;
+        info->status |= INFO_AMP_CAPS;
+        return 0;
+}
+
 /*
  * read the current volume to info
  * if the cache exists, read the cache value.
diff --git a/sound/pci/hda/hda_local.h b/sound/pci/hda/hda_local.h
index be12b8814c39..f91ea5ec9f6d 100644
--- a/sound/pci/hda/hda_local.h
+++ b/sound/pci/hda/hda_local.h
@@ -277,5 +277,7 @@ static inline u32 get_wcaps(struct hda_codec *codec, hda_nid_t nid)
         return codec->wcaps[nid - codec->start_nid];
 }
 
+int snd_hda_override_amp_caps(struct hda_codec *codec, hda_nid_t nid, int dir,
+                              unsigned int caps);
 
 #endif /* __SOUND_HDA_LOCAL_H */
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a5a4b2bddf20..bef214bcdddf 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -705,6 +705,17 @@ static struct snd_kcontrol_new cxt5045_test_mixer[] = {
                 .get = conexant_mux_enum_get,
                 .put = conexant_mux_enum_put,
         },
+        /* Audio input controls */
+        HDA_CODEC_VOLUME("Input-1 Volume", 0x1a, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("Input-1 Switch", 0x1a, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("Input-2 Volume", 0x1a, 0x1, HDA_INPUT),
+        HDA_CODEC_MUTE("Input-2 Switch", 0x1a, 0x1, HDA_INPUT),
+        HDA_CODEC_VOLUME("Input-3 Volume", 0x1a, 0x2, HDA_INPUT),
+        HDA_CODEC_MUTE("Input-3 Switch", 0x1a, 0x2, HDA_INPUT),
+        HDA_CODEC_VOLUME("Input-4 Volume", 0x1a, 0x3, HDA_INPUT),
+        HDA_CODEC_MUTE("Input-4 Switch", 0x1a, 0x3, HDA_INPUT),
+        HDA_CODEC_VOLUME("Input-5 Volume", 0x1a, 0x4, HDA_INPUT),
+        HDA_CODEC_MUTE("Input-5 Switch", 0x1a, 0x4, HDA_INPUT),
         { } /* end */
 };
 
@@ -947,6 +958,23 @@ static void cxt5047_hp_automute(struct hda_codec *codec)
         snd_hda_codec_amp_update(codec, 0x1c, 1, HDA_OUTPUT, 0, 0x80, bits);
 }
 
+/* mute internal speaker if HP is plugged */
+static void cxt5047_hp2_automute(struct hda_codec *codec)
+{
+        struct conexant_spec *spec = codec->spec;
+        unsigned int bits;
+
+        spec->hp_present = snd_hda_codec_read(codec, 0x13, 0,
+                                     AC_VERB_GET_PIN_SENSE, 0) & 0x80000000;
+
+        bits = spec->hp_present ? 0x80 : 0;
+        snd_hda_codec_amp_update(codec, 0x1d, 0, HDA_OUTPUT, 0, 0x80, bits);
+        snd_hda_codec_amp_update(codec, 0x1d, 1, HDA_OUTPUT, 0, 0x80, bits);
+        /* Mute/Unmute PCM 2 for good measure - some systems need this */
+        snd_hda_codec_amp_update(codec, 0x1c, 0, HDA_OUTPUT, 0, 0x80, bits);
+        snd_hda_codec_amp_update(codec, 0x1c, 1, HDA_OUTPUT, 0, 0x80, bits);
+}
+
 /* toggle input of built-in and mic jack appropriately */
 static void cxt5047_hp_automic(struct hda_codec *codec)
 {
@@ -985,6 +1013,21 @@ static void cxt5047_hp_unsol_event(struct hda_codec *codec,
         }
 }
 
+/* unsolicited event for HP jack sensing - non-EAPD systems */
+static void cxt5047_hp2_unsol_event(struct hda_codec *codec,
+                                  unsigned int res)
+{
+        res >>= 26;
+        switch (res) {
+        case CONEXANT_HP_EVENT:
+                cxt5047_hp2_automute(codec);
+                break;
+        case CONEXANT_MIC_EVENT:
+                cxt5047_hp_automic(codec);
+                break;
+        }
+}
+
 static struct snd_kcontrol_new cxt5047_mixers[] = {
         HDA_CODEC_VOLUME("Mic Bypass Capture Volume", 0x19, 0x02, HDA_INPUT),
         HDA_CODEC_MUTE("Mic Bypass Capture Switch", 0x19, 0x02, HDA_INPUT),
@@ -1300,19 +1343,20 @@ static int patch_cxt5047(struct hda_codec *codec)
         spec->channel_mode = cxt5047_modes,
 
         codec->patch_ops = conexant_patch_ops;
-        codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
 
         board_config = snd_hda_check_board_config(codec, CXT5047_MODELS,
                                                   cxt5047_models,
                                                   cxt5047_cfg_tbl);
         switch (board_config) {
         case CXT5047_LAPTOP:
+                codec->patch_ops.unsol_event = cxt5047_hp2_unsol_event;
                 break;
         case CXT5047_LAPTOP_HP:
                 spec->input_mux = &cxt5047_hp_capture_source;
                 spec->num_init_verbs = 2;
                 spec->init_verbs[1] = cxt5047_hp_init_verbs;
                 spec->mixers[0] = cxt5047_hp_mixers;
+                codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
                 codec->patch_ops.init = cxt5047_hp_init;
                 break;
         case CXT5047_LAPTOP_EAPD:
@@ -1320,12 +1364,14 @@ static int patch_cxt5047(struct hda_codec *codec)
                 spec->num_init_verbs = 2;
                 spec->init_verbs[1] = cxt5047_toshiba_init_verbs;
                 spec->mixers[0] = cxt5047_toshiba_mixers;
+                codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
                 break;
 #ifdef CONFIG_SND_DEBUG
         case CXT5047_TEST:
                 spec->input_mux = &cxt5047_test_capture_source;
                 spec->mixers[0] = cxt5047_test_mixer;
                 spec->init_verbs[0] = cxt5047_test_init_verbs;
+                codec->patch_ops.unsol_event = cxt5047_hp_unsol_event;
 #endif  
         }
         return 0;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 34ac63469532..4776de93928b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6379,8 +6379,10 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1458, 0xa002, "MSI", ALC883_6ST_DIG),
         SND_PCI_QUIRK(0x1462, 0x6668, "MSI", ALC883_6ST_DIG),
         SND_PCI_QUIRK(0x1462, 0x7187, "MSI", ALC883_6ST_DIG),
+        SND_PCI_QUIRK(0x1462, 0x7250, "MSI", ALC883_6ST_DIG),
         SND_PCI_QUIRK(0x1462, 0x7280, "MSI", ALC883_6ST_DIG),
         SND_PCI_QUIRK(0x1462, 0x0579, "MSI", ALC883_TARGA_2ch_DIG),
+        SND_PCI_QUIRK(0x1462, 0x3729, "MSI S420", ALC883_TARGA_DIG),
         SND_PCI_QUIRK(0x1462, 0x3ef9, "MSI", ALC883_TARGA_DIG),
         SND_PCI_QUIRK(0x1462, 0x3b7f, "MSI", ALC883_TARGA_2ch_DIG),
         SND_PCI_QUIRK(0x1462, 0x3fcc, "MSI", ALC883_TARGA_DIG),
@@ -6391,6 +6393,7 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1462, 0x4324, "MSI", ALC883_TARGA_DIG),
         SND_PCI_QUIRK(0x1462, 0xa422, "MSI", ALC883_TARGA_2ch_DIG),
         SND_PCI_QUIRK(0x1025, 0, "Acer laptop", ALC883_ACER),
+        SND_PCI_QUIRK(0x15d9, 0x8780, "Supermicro PDSBA", ALC883_3ST_6ch),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_MEDION),
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x8086, 0xd601, "D102GGC", ALC883_3ST_6ch),
@@ -8765,7 +8768,6 @@ static struct snd_pci_quirk alc861_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x1338, "ASUS F2/3", ALC861_ASUS_LAPTOP),
         SND_PCI_QUIRK(0x1043, 0x13d7, "ASUS A9rp", ALC861_ASUS_LAPTOP),
         SND_PCI_QUIRK(0x1043, 0x1393, "ASUS", ALC861_ASUS),
-        SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS", ALC660_3ST),
         SND_PCI_QUIRK(0x1179, 0xff00, "Toshiba", ALC861_TOSHIBA),
         SND_PCI_QUIRK(0x1179, 0xff10, "Toshiba", ALC861_TOSHIBA),
         SND_PCI_QUIRK(0x1584, 0x9072, "Uniwill m31", ALC861_UNIWILL_M31),
@@ -9473,6 +9475,7 @@ static const char *alc861vd_models[ALC861VD_MODEL_LAST] = {
 static struct snd_pci_quirk alc861vd_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1043, 0x12e2, "Asus z35m", ALC660VD_3ST),
         SND_PCI_QUIRK(0x1043, 0x1339, "Asus G1", ALC660VD_3ST),
+        SND_PCI_QUIRK(0x1043, 0x81e7, "ASUS", ALC660VD_3ST),
         SND_PCI_QUIRK(0x10de, 0x03f0, "Realtek ALC660 demo", ALC660VD_3ST),
         SND_PCI_QUIRK(0x1019, 0xa88d, "Realtek ALC660 demo", ALC660VD_3ST),
 
diff --git a/sound/pci/hda/patch_si3054.c b/sound/pci/hda/patch_si3054.c
index 6fcda9bcf0cf..43f537ef40bf 100644
--- a/sound/pci/hda/patch_si3054.c
+++ b/sound/pci/hda/patch_si3054.c
@@ -304,6 +304,8 @@ struct hda_codec_preset snd_hda_preset_si3054[] = {
         { .id = 0x10573055, .name = "Si3054", .patch = patch_si3054 },
         { .id = 0x10573057, .name = "Si3054", .patch = patch_si3054 },
         { .id = 0x10573155, .name = "Si3054", .patch = patch_si3054 },
+        /* Asus A8J Modem (SM56) */
+        { .id = 0x15433155, .name = "Si3054", .patch = patch_si3054 },
         {}
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index a6a0a80edc3b..e3964fc4c405 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -51,6 +51,7 @@ enum {
         STAC_925x_REF,
         STAC_M2_2,
         STAC_MA6,
+        STAC_PA6,
         STAC_925x_MODELS
 };
 
@@ -152,6 +153,10 @@ static hda_nid_t stac925x_dac_nids[1] = {
         0x02,
 };
 
+static hda_nid_t stac925x_dmic_nids[1] = {
+        0x15, 
+};
+
 static hda_nid_t stac922x_adc_nids[2] = {
         0x06, 0x07,
 };
@@ -469,6 +474,14 @@ static struct snd_pci_quirk stac9200_cfg_tbl[] = {
                       "Dell Precision M90", STAC_REF),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01d6,
                       "unknown Dell", STAC_REF),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01d8,
+                      "Dell Inspiron 640m", STAC_REF),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f5,
+                      "Dell Inspiron 1501", STAC_REF),
+
+        /* Panasonic */
+        SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_REF),
+
         {} /* terminator */
 };
 
@@ -482,29 +495,38 @@ static unsigned int stac925x_MA6_pin_configs[8] = {
         0x90a70320, 0x90100211, 0x400003f1, 0x9033032e,
 };
 
+static unsigned int stac925x_PA6_pin_configs[8] = {
+        0x40c003f0, 0x424503f2, 0x01813022, 0x02a19021,
+        0x50a103f0, 0x90100211, 0x400003f1, 0x9033032e,
+};
+
 static unsigned int stac925xM2_2_pin_configs[8] = {
-        0x40c003f3, 0x424503f2, 0x041800f4, 0x02a19020,
-        0x50a103F0, 0x90100210, 0x400003f1, 0x9033032e,
+        0x40c003f3, 0x424503f2, 0x04180011, 0x02a19020,
+        0x50a103f0, 0x90100212, 0x400003f1, 0x9033032e,
 };
 
 static unsigned int *stac925x_brd_tbl[STAC_925x_MODELS] = {
         [STAC_REF] = ref925x_pin_configs,
         [STAC_M2_2] = stac925xM2_2_pin_configs,
         [STAC_MA6] = stac925x_MA6_pin_configs,
+        [STAC_PA6] = stac925x_PA6_pin_configs,
 };
 
 static const char *stac925x_models[STAC_925x_MODELS] = {
         [STAC_REF] = "ref",
         [STAC_M2_2] = "m2-2",
         [STAC_MA6] = "m6",
+        [STAC_PA6] = "pa6",
 };
 
 static struct snd_pci_quirk stac925x_cfg_tbl[] = {
         /* SigmaTel reference board */
         SND_PCI_QUIRK(PCI_VENDOR_ID_INTEL, 0x2668, "DFI LanParty", STAC_REF),
+        SND_PCI_QUIRK(0x8384, 0x7632, "Stac9202 Reference Board", STAC_REF),
         SND_PCI_QUIRK(0x107b, 0x0316, "Gateway M255", STAC_REF),
         SND_PCI_QUIRK(0x107b, 0x0366, "Gateway MP6954", STAC_REF),
         SND_PCI_QUIRK(0x107b, 0x0461, "Gateway NX560XL", STAC_MA6),
+        SND_PCI_QUIRK(0x107b, 0x0681, "Gateway NX860", STAC_PA6),
         SND_PCI_QUIRK(0x1002, 0x437b, "Gateway MX6453", STAC_M2_2),
         {} /* terminator */
 };
@@ -1742,6 +1764,21 @@ static void stac92xx_set_pinctl(struct hda_codec *codec, hda_nid_t nid,
         unsigned int pin_ctl = snd_hda_codec_read(codec, nid,
                         0, AC_VERB_GET_PIN_WIDGET_CONTROL, 0x00);
 
+        if (pin_ctl & AC_PINCTL_IN_EN) {
+                /*
+                 * we need to check the current set-up direction of
+                 * shared input pins since they can be switched via
+                 * "xxx as Output" mixer switch
+                 */
+                struct sigmatel_spec *spec = codec->spec;
+                struct auto_pin_cfg *cfg = &spec->autocfg;
+                if ((nid == cfg->input_pins[AUTO_PIN_LINE] &&
+                     spec->line_switch) ||
+                    (nid == cfg->input_pins[AUTO_PIN_MIC] &&
+                     spec->mic_switch))
+                        return;
+        }
+
         /* if setting pin direction bits, clear the current
            direction bits first */
         if (flag & (AC_PINCTL_IN_EN | AC_PINCTL_OUT_EN))
@@ -1911,7 +1948,8 @@ static int patch_stac925x(struct hda_codec *codec)
                                                         stac925x_cfg_tbl);
  again:
         if (spec->board_config < 0) {
-                snd_printdd(KERN_INFO "hda_codec: Unknown model for STAC925x, using BIOS defaults\n");
+                snd_printdd(KERN_INFO "hda_codec: Unknown model for STAC925x," 
+                                      "using BIOS defaults\n");
                 err = stac92xx_save_bios_config_regs(codec);
                 if (err < 0) {
                         stac92xx_free(codec);
@@ -1929,7 +1967,18 @@ static int patch_stac925x(struct hda_codec *codec)
         spec->adc_nids = stac925x_adc_nids;
         spec->mux_nids = stac925x_mux_nids;
         spec->num_muxes = 1;
-        spec->num_dmics = 0;
+        switch (codec->vendor_id) {
+        case 0x83847632: /* STAC9202  */
+        case 0x83847633: /* STAC9202D */
+        case 0x83847636: /* STAC9251  */
+        case 0x83847637: /* STAC9251D */
+                spec->num_dmics = 1;
+                spec->dmic_nids = stac925x_dmic_nids;
+                break;
+        default:
+                spec->num_dmics = 0;
+                break;
+        }
 
         spec->init = stac925x_core_init;
         spec->mixer = stac925x_mixer;
@@ -2110,6 +2159,13 @@ static int patch_stac927x(struct hda_codec *codec)
 
         codec->patch_ops = stac92xx_patch_ops;
 
+        /* Fix Mux capture level; max to 2 */
+        snd_hda_override_amp_caps(codec, 0x12, HDA_OUTPUT,
+                                  (0 << AC_AMPCAP_OFFSET_SHIFT) |
+                                  (2 << AC_AMPCAP_NUM_STEPS_SHIFT) |
+                                  (0x27 << AC_AMPCAP_STEP_SIZE_SHIFT) |
+                                  (0 << AC_AMPCAP_MUTE_SHIFT));
+
         return 0;
 }
 
diff --git a/sound/soc/s3c24xx/s3c24xx-pcm.c b/sound/soc/s3c24xx/s3c24xx-pcm.c
index 21dc6974d6a3..bfbdc3cbd43b 100644
--- a/sound/soc/s3c24xx/s3c24xx-pcm.c
+++ b/sound/soc/s3c24xx/s3c24xx-pcm.c
@@ -337,6 +337,8 @@ static int s3c24xx_pcm_open(struct snd_pcm_substream *substream)
         if (prtd == NULL)
                 return -ENOMEM;
 
+        spin_lock_init(&prtd->lock);
+
         runtime->private_data = prtd;
         return 0;
 }