199 files changed, 1780 insertions, 1133 deletions
diff --git a/Documentation/serial/driver b/Documentation/serial/driver
index df82116a9f26..88ad615dd338 100644
--- a/Documentation/serial/driver
+++ b/Documentation/serial/driver
@@ -214,12 +214,13 @@ hardware.
        The interaction of the iflag bits is as follows (parity error
        given as an example):
        Parity error    INPCK   IGNPAR
-        None            n/a     n/a     character received
+        n/a             0       n/a     character received, marked as
-        Yes             n/a     0       character discarded
-        Yes             0       1       character received, marked as
                                        TTY_NORMAL
-        Yes             1       1       character received, marked as
+        None            1       n/a     character received, marked as
+                                        TTY_NORMAL
+        Yes             1       0       character received, marked as
                                        TTY_PARITY
+        Yes             1       1       character discarded
        Other flags may be used (eg, xon/xoff characters) if your
        hardware supports hardware "soft" flow control.
diff --git a/MAINTAINERS b/MAINTAINERS
index 31c23e3a2de9..1421f74b6009 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -565,7 +565,19 @@ BROADBAND PROCESSOR ARCHITECTURE
 P:      Arnd Bergmann
 M:      arnd@arndb.de
 L:      linuxppc-dev@ozlabs.org
-W:      http://linuxppc64.org
+W:      http://www.penguinppc.org/ppc64/
+S:      Supported
+BROADCOM BNX2 GIGABIT ETHERNET DRIVER
+P:      Michael Chan
+M:      mchan@broadcom.com
+L:      netdev@vger.kernel.org
+S:      Supported
+BROADCOM TG3 GIGABIT ETHERNET DRIVER
+P:      Michael Chan
+M:      mchan@broadcom.com
+L:      netdev@vger.kernel.org
 S:      Supported
 BTTV VIDEO4LINUX DRIVER
@@ -1722,7 +1734,7 @@ M:	paulus@au.ibm.com
 P:      Anton Blanchard
 M:      anton@samba.org
 M:      anton@au.ibm.com
-W:      http://linuxppc64.org
+W:      http://www.penguinppc.org/ppc64/
 L:      linuxppc-dev@ozlabs.org
 S:      Supported
@@ -1883,6 +1895,11 @@ L:	linux-kernel@vger.kernel.org
 W:      http://www.atnf.csiro.au/~rgooch/linux/kernel-patches.html
 S:      Maintained
+MULTIMEDIA CARD SUBSYSTEM
+P:      Russell King
+M:      rmk+mmc@arm.linux.org.uk
+S:      Maintained
 MULTISOUND SOUND DRIVER
 P:      Andrew Veliath
 M:      andrewtv@usa.net
diff --git a/Makefile b/Makefile
index 435d209f42d8..a3a7baad8555 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 17
-EXTRAVERSION =-rc5
+EXTRAVERSION =-rc6
-NAME=Lordi Rules
+NAME=Crazed Snow-Weasel
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
index c645c5e14786..2b245ad731ee 100644
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ b/arch/alpha/kernel/alpha_ksyms.c
@@ -182,7 +182,6 @@ EXPORT_SYMBOL(smp_num_cpus);
 EXPORT_SYMBOL(smp_call_function);
 EXPORT_SYMBOL(smp_call_function_on_cpu);
 EXPORT_SYMBOL(_atomic_dec_and_lock);
-EXPORT_SYMBOL(cpu_present_mask);
 #endif /* CONFIG_SMP */
 /*
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index 9924fd07743a..c760a831fd1a 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -94,7 +94,7 @@ common_shutdown_1(void *generic_ptr)
        if (cpuid != boot_cpuid) {
                flags |= 0x00040000UL; /* "remain halted" */
                *pflags = flags;
-                clear_bit(cpuid, &cpu_present_mask);
+                cpu_clear(cpuid, cpu_present_map);
                halt();
        }
 #endif
@@ -120,8 +120,8 @@ common_shutdown_1(void *generic_ptr)
 #ifdef CONFIG_SMP
        /* Wait for the secondaries to halt. */
-        cpu_clear(boot_cpuid, cpu_possible_map);
+        cpu_clear(boot_cpuid, cpu_present_map);
-        while (cpus_weight(cpu_possible_map))
+        while (cpus_weight(cpu_present_map))
                barrier();
 #endif
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 185255416e85..4dc273e537fd 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -68,7 +68,6 @@ enum ipi_message_type {
 static int smp_secondary_alive __initdata = 0;
 /* Which cpus ids came online.  */
-cpumask_t cpu_present_mask;
 cpumask_t cpu_online_map;
 EXPORT_SYMBOL(cpu_online_map);
@@ -439,7 +438,7 @@ setup_smp(void)
                        if ((cpu->flags & 0x1cc) == 0x1cc) {
                                smp_num_probed++;
                                /* Assume here that "whami" == index */
-                                cpu_set(i, cpu_present_mask);
+                                cpu_set(i, cpu_present_map);
                                cpu->pal_revision = boot_cpu_palrev;
                        }
@@ -450,11 +449,10 @@ setup_smp(void)
                }
        } else {
                smp_num_probed = 1;
-                cpu_set(boot_cpuid, cpu_present_mask);
        }
-        printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
+        printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_map = %lx\n",
-               smp_num_probed, cpu_possible_map.bits[0]);
+               smp_num_probed, cpu_present_map.bits[0]);
 }
 /*
@@ -473,7 +471,7 @@ smp_prepare_cpus(unsigned int max_cpus)
        /* Nothing to do on a UP box, or when told not to.  */
        if (smp_num_probed == 1 || max_cpus == 0) {
-                cpu_present_mask = cpumask_of_cpu(boot_cpuid);
+                cpu_present_map = cpumask_of_cpu(boot_cpuid);
                printk(KERN_INFO "SMP mode deactivated.\n");
                return;
        }
@@ -486,10 +484,6 @@ smp_prepare_cpus(unsigned int max_cpus)
 void __devinit
 smp_prepare_boot_cpu(void)
 {
-        /*
-         * Mark the boot cpu (current cpu) as online
-         */ 
-        cpu_set(smp_processor_id(), cpu_online_map);
 }
 int __devinit
diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index 5f84417eeb7b..2551fb49ae09 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -66,7 +66,7 @@ titan_update_irq_hw(unsigned long mask)
        register int bcpu = boot_cpuid;
 #ifdef CONFIG_SMP
-        cpumask_t cpm = cpu_present_mask;
+        cpumask_t cpm = cpu_present_map;
        volatile unsigned long *dim0, *dim1, *dim2, *dim3;
        unsigned long mask0, mask1, mask2, mask3, dummy;
diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
index 5d3acff8c596..d22f38b957db 100644
--- a/arch/arm/Kconfig.debug
+++ b/arch/arm/Kconfig.debug
@@ -101,7 +101,7 @@ config DEBUG_S3C2410_UART
        help
          Choice for UART for kernel low-level using S3C2410 UARTS,
          should be between zero and two. The port must have been
-          initalised by the boot-loader before use.
+          initialised by the boot-loader before use.
          The uncompressor code port configuration is now handled
          by CONFIG_S3C2410_LOWLEVEL_UART_PORT.
diff --git a/arch/arm/mach-ixp23xx/core.c b/arch/arm/mach-ixp23xx/core.c
index 092ee12ced42..affd1d5d7440 100644
--- a/arch/arm/mach-ixp23xx/core.c
+++ b/arch/arm/mach-ixp23xx/core.c
@@ -178,8 +178,12 @@ static int ixp23xx_irq_set_type(unsigned int irq, unsigned int type)
 static void ixp23xx_irq_mask(unsigned int irq)
 {
-        volatile unsigned long *intr_reg = IXP23XX_INTR_EN1 + (irq / 32);
+        volatile unsigned long *intr_reg;
+        if (irq >= 56)
+                irq += 8;
+        intr_reg = IXP23XX_INTR_EN1 + (irq / 32);
        *intr_reg &= ~(1 << (irq % 32));
 }
@@ -199,17 +203,25 @@ static void ixp23xx_irq_ack(unsigned int irq)
 */
 static void ixp23xx_irq_level_unmask(unsigned int irq)
 {
-        volatile unsigned long *intr_reg = IXP23XX_INTR_EN1 + (irq / 32);
+        volatile unsigned long *intr_reg;
        ixp23xx_irq_ack(irq);
+        if (irq >= 56)
+                irq += 8;
+        intr_reg = IXP23XX_INTR_EN1 + (irq / 32);
        *intr_reg |= (1 << (irq % 32));
 }
 static void ixp23xx_irq_edge_unmask(unsigned int irq)
 {
-        volatile unsigned long *intr_reg = IXP23XX_INTR_EN1 + (irq / 32);
+        volatile unsigned long *intr_reg;
+        if (irq >= 56)
+                irq += 8;
+        intr_reg = IXP23XX_INTR_EN1 + (irq / 32);
        *intr_reg |= (1 << (irq % 32));
 }
diff --git a/arch/arm/mach-ixp4xx/Kconfig b/arch/arm/mach-ixp4xx/Kconfig
index 2a39f9e481ad..3b23f43cb160 100644
--- a/arch/arm/mach-ixp4xx/Kconfig
+++ b/arch/arm/mach-ixp4xx/Kconfig
@@ -141,7 +141,7 @@ config IXP4XX_INDIRECT_PCI
          2) If > 64MB of memory space is required, the IXP4xx can be 
             configured to use indirect registers to access PCI This allows 
             for up to 128MB (0x48000000 to 0x4fffffff) of memory on the bus. 
-             The disadvantadge of this is that every PCI access requires 
+             The disadvantage of this is that every PCI access requires 
             three local register accesses plus a spinlock, but in some 
             cases the performance hit is acceptable. In addition, you cannot 
             mmap() PCI devices in this case due to the indirect nature
diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c
index 02e188d98e7d..b307f11951df 100644
--- a/arch/arm/mach-pxa/mainstone.c
+++ b/arch/arm/mach-pxa/mainstone.c
@@ -493,6 +493,7 @@ static void __init mainstone_map_io(void)
 MACHINE_START(MAINSTONE, "Intel HCDDBBVA0 Development Platform (aka Mainstone)")
        /* Maintainer: MontaVista Software Inc. */
        .phys_io        = 0x40000000,
+        .boot_params    = 0xa0000100,   /* BLOB boot parameter setting */
        .io_pg_offst    = (io_p2v(0x40000000) >> 18) & 0xfffc,
        .map_io         = mainstone_map_io,
        .init_irq       = mainstone_init_irq,
diff --git a/arch/arm/mach-s3c2410/Kconfig b/arch/arm/mach-s3c2410/Kconfig
index ce7d81000695..970f98dadffc 100644
--- a/arch/arm/mach-s3c2410/Kconfig
+++ b/arch/arm/mach-s3c2410/Kconfig
@@ -170,7 +170,7 @@ config S3C2410_PM_DEBUG
        depends on ARCH_S3C2410 && PM
        help
          Say Y here if you want verbose debugging from the PM Suspend and
-          Resume code. See `Documentation/arm/Samsing-S3C24XX/Suspend.txt`
+          Resume code. See <file:Documentation/arm/Samsung-S3C24XX/Suspend.txt>
          for more information.
 config S3C2410_PM_CHECK
diff --git a/arch/arm/mm/mm-armv.c b/arch/arm/mm/mm-armv.c
index f14b2d0f3690..95273de4f772 100644
--- a/arch/arm/mm/mm-armv.c
+++ b/arch/arm/mm/mm-armv.c
@@ -376,7 +376,7 @@ void __init build_mem_type_table(void)
                ecc_mask = 0;
        }
-        if (cpu_arch <= CPU_ARCH_ARMv5TEJ) {
+        if (cpu_arch <= CPU_ARCH_ARMv5TEJ && !cpu_is_xscale()) {
                for (i = 0; i < ARRAY_SIZE(mem_types); i++) {
                        if (mem_types[i].prot_l1)
                                mem_types[i].prot_l1 |= PMD_BIT4;
@@ -631,7 +631,7 @@ void setup_mm_for_reboot(char mode)
                pgd = init_mm.pgd;
        base_pmdval = PMD_SECT_AP_WRITE | PMD_SECT_AP_READ | PMD_TYPE_SECT;
-        if (cpu_architecture() <= CPU_ARCH_ARMv5TEJ)
+        if (cpu_architecture() <= CPU_ARCH_ARMv5TEJ && !cpu_is_xscale())
                base_pmdval |= PMD_BIT4;
        for (i = 0; i < FIRST_USER_PGD_NR + USER_PTRS_PER_PGD; i++, pgd++) {
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index 80873b36c3f7..8d32e21fe151 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -427,12 +427,13 @@ __xsc3_setup:
 #endif
        mcr     p15, 0, r0, c1, c0, 1           @ set auxiliary control reg
        mrc     p15, 0, r0, c1, c0, 0           @ get control register
-        bic     r0, r0, #0x0200                 @ .... ..R. .... ....
        bic     r0, r0, #0x0002                 @ .... .... .... ..A.
        orr     r0, r0, #0x0005                 @ .... .... .... .C.M
 #if BTB_ENABLE
+        bic     r0, r0, #0x0200                 @ .... ..R. .... ....
        orr     r0, r0, #0x3900                 @ ..VI Z..S .... ....
 #else
+        bic     r0, r0, #0x0a00                 @ .... Z.R. .... ....
        orr     r0, r0, #0x3100                 @ ..VI ...S .... ....
 #endif
 #if L2_CACHE_ENABLE
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index daee69579b1c..40e5aba3ad3d 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -1066,14 +1066,6 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
                     },
         },
-        {
-         .callback = disable_acpi_pci,
-         .ident = "HP xw9300",
-         .matches = {
-                    DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                    DMI_MATCH(DMI_PRODUCT_NAME, "HP xw9300 Workstation"),
-                    },
-        },
        {}
 };
diff --git a/arch/i386/mach-generic/probe.c b/arch/i386/mach-generic/probe.c
index cea5b3ce4b57..d55fa7b187ab 100644
--- a/arch/i386/mach-generic/probe.c
+++ b/arch/i386/mach-generic/probe.c
@@ -93,9 +93,11 @@ int __init mps_oem_check(struct mp_config_table *mpc, char *oem, char *productid
        int i;
        for (i = 0; apic_probe[i]; ++i) { 
                if (apic_probe[i]->mps_oem_check(mpc,oem,productid)) { 
-                        genapic = apic_probe[i];
+                        if (!cmdline_apic) {
-                        printk(KERN_INFO "Switched to APIC driver `%s'.\n", 
+                                genapic = apic_probe[i];
-                               genapic->name);
+                                printk(KERN_INFO "Switched to APIC driver `%s'.\n",
+                                       genapic->name);
+                        }
                        return 1;
                } 
        } 
@@ -107,9 +109,11 @@ int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
        int i;
        for (i = 0; apic_probe[i]; ++i) { 
                if (apic_probe[i]->acpi_madt_oem_check(oem_id, oem_table_id)) { 
-                        genapic = apic_probe[i];
+                        if (!cmdline_apic) {
-                        printk(KERN_INFO "Switched to APIC driver `%s'.\n", 
+                                genapic = apic_probe[i];
-                               genapic->name);
+                                printk(KERN_INFO "Switched to APIC driver `%s'.\n",
+                                       genapic->name);
+                        }
                        return 1;
                } 
        } 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index ee5fbb02b28f..e8ff09fe73d9 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -13,7 +13,7 @@ choice
        default SGI_IP22
 config MIPS_MTX1
-        bool "Support for 4G Systems MTX-1 board"
+        bool "4G Systems MTX-1 board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select SOC_AU1500
@@ -120,7 +120,7 @@ config MIPS_MIRAGE
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config MIPS_COBALT
-        bool "Support for Cobalt Server"
+        bool "Cobalt Server"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select I8259
@@ -132,7 +132,7 @@ config MIPS_COBALT
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config MACH_DECSTATION
-        bool "Support for DECstations"
+        bool "DECstations"
        select BOOT_ELF32
        select DMA_NONCOHERENT
        select EARLY_PRINTK
@@ -158,7 +158,7 @@ config MACH_DECSTATION
          otherwise choose R3000.
 config MIPS_EV64120
-        bool "Support for Galileo EV64120 Evaluation board (EXPERIMENTAL)"
+        bool "Galileo EV64120 Evaluation board (EXPERIMENTAL)"
        depends on EXPERIMENTAL
        select DMA_NONCOHERENT
        select HW_HAS_PCI
@@ -175,7 +175,7 @@ config MIPS_EV64120
          kernel for this platform.
 config MIPS_EV96100
-        bool "Support for Galileo EV96100 Evaluation board (EXPERIMENTAL)"
+        bool "Galileo EV96100 Evaluation board (EXPERIMENTAL)"
        depends on EXPERIMENTAL
        select DMA_NONCOHERENT
        select HW_HAS_PCI
@@ -195,7 +195,7 @@ config MIPS_EV96100
          here if you wish to build a kernel for this platform.
 config MIPS_IVR
-        bool "Support for Globespan IVR board"
+        bool "Globespan IVR board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select ITE_BOARD_GEN
@@ -211,7 +211,7 @@ config MIPS_IVR
          build a kernel for this platform.
 config MIPS_ITE8172
-        bool "Support for ITE 8172G board"
+        bool "ITE 8172G board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select ITE_BOARD_GEN
@@ -228,7 +228,7 @@ config MIPS_ITE8172
          a kernel for this platform.
 config MACH_JAZZ
-        bool "Support for the Jazz family of machines"
+        bool "Jazz family of machines"
        select ARC
        select ARC32
        select ARCH_MAY_HAVE_PC_FDC
@@ -246,7 +246,7 @@ config MACH_JAZZ
         Olivetti M700-10 workstations.
 config LASAT
-        bool "Support for LASAT Networks platforms"
+        bool "LASAT Networks platforms"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select MIPS_GT64120
@@ -258,7 +258,7 @@ config LASAT
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config MIPS_ATLAS
-        bool "Support for MIPS Atlas board"
+        bool "MIPS Atlas board"
        select BOOT_ELF32
        select DMA_NONCOHERENT
        select IRQ_CPU
@@ -283,7 +283,7 @@ config MIPS_ATLAS
          board.
 config MIPS_MALTA
-        bool "Support for MIPS Malta board"
+        bool "MIPS Malta board"
        select ARCH_MAY_HAVE_PC_FDC
        select BOOT_ELF32
        select HAVE_STD_PC_SERIAL_PORT
@@ -311,7 +311,7 @@ config MIPS_MALTA
          board.
 config MIPS_SEAD
-        bool "Support for MIPS SEAD board (EXPERIMENTAL)"
+        bool "MIPS SEAD board (EXPERIMENTAL)"
        depends on EXPERIMENTAL
        select IRQ_CPU
        select DMA_NONCOHERENT
@@ -328,7 +328,7 @@ config MIPS_SEAD
          board.
 config MIPS_SIM
-        bool 'Support for MIPS simulator (MIPSsim)'
+        bool 'MIPS simulator (MIPSsim)'
        select DMA_NONCOHERENT
        select IRQ_CPU
        select SYS_HAS_CPU_MIPS32_R1
@@ -341,7 +341,7 @@ config MIPS_SIM
          emulator.
 config MOMENCO_JAGUAR_ATX
-        bool "Support for Momentum Jaguar board"
+        bool "Momentum Jaguar board"
        select BOOT_ELF32
        select DMA_NONCOHERENT
        select HW_HAS_PCI
@@ -361,7 +361,7 @@ config MOMENCO_JAGUAR_ATX
          Momentum Computer <http://www.momenco.com/>.
 config MOMENCO_OCELOT
-        bool "Support for Momentum Ocelot board"
+        bool "Momentum Ocelot board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select IRQ_CPU
@@ -378,7 +378,7 @@ config MOMENCO_OCELOT
          Momentum Computer <http://www.momenco.com/>.
 config MOMENCO_OCELOT_3
-        bool "Support for Momentum Ocelot-3 board"
+        bool "Momentum Ocelot-3 board"
        select BOOT_ELF32
        select DMA_NONCOHERENT
        select HW_HAS_PCI
@@ -397,7 +397,7 @@ config MOMENCO_OCELOT_3
          PMC-Sierra Rm79000 core.
 config MOMENCO_OCELOT_C
-        bool "Support for Momentum Ocelot-C board"
+        bool "Momentum Ocelot-C board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select IRQ_CPU
@@ -414,7 +414,7 @@ config MOMENCO_OCELOT_C
          Momentum Computer <http://www.momenco.com/>.
 config MOMENCO_OCELOT_G
-        bool "Support for Momentum Ocelot-G board"
+        bool "Momentum Ocelot-G board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select IRQ_CPU
@@ -431,23 +431,23 @@ config MOMENCO_OCELOT_G
          Momentum Computer <http://www.momenco.com/>.
 config MIPS_XXS1500
-        bool "Support for MyCable XXS1500 board"
+        bool "MyCable XXS1500 board"
        select DMA_NONCOHERENT
        select SOC_AU1500
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config PNX8550_V2PCI
-        bool "Support for Philips PNX8550 based Viper2-PCI board"
+        bool "Philips PNX8550 based Viper2-PCI board"
        select PNX8550
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config PNX8550_JBS
-        bool "Support for Philips PNX8550 based JBS board"
+        bool "Philips PNX8550 based JBS board"
        select PNX8550
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config DDB5074
-        bool "Support for NEC DDB Vrc-5074 (EXPERIMENTAL)"
+        bool "NEC DDB Vrc-5074 (EXPERIMENTAL)"
        depends on EXPERIMENTAL
        select DDB5XXX_COMMON
        select DMA_NONCOHERENT
@@ -465,7 +465,7 @@ config DDB5074
          evaluation board.
 config DDB5476
-        bool "Support for NEC DDB Vrc-5476"
+        bool "NEC DDB Vrc-5476"
        select DDB5XXX_COMMON
        select DMA_NONCOHERENT
        select HAVE_STD_PC_SERIAL_PORT
@@ -486,7 +486,7 @@ config DDB5476
          IDE controller, PS2 keyboard, PS2 mouse, etc.
 config DDB5477
-        bool "Support for NEC DDB Vrc-5477"
+        bool "NEC DDB Vrc-5477"
        select DDB5XXX_COMMON
        select DMA_NONCOHERENT
        select HW_HAS_PCI
@@ -504,13 +504,13 @@ config DDB5477
          ether port USB, AC97, PCI, etc.
 config MACH_VR41XX
-        bool "Support for NEC VR4100 series based machines"
+        bool "NEC VR41XX-based machines"
        select SYS_HAS_CPU_VR41XX
        select SYS_SUPPORTS_32BIT_KERNEL
        select SYS_SUPPORTS_64BIT_KERNEL if EXPERIMENTAL
 config PMC_YOSEMITE
-        bool "Support for PMC-Sierra Yosemite eval board"
+        bool "PMC-Sierra Yosemite eval board"
        select DMA_COHERENT
        select HW_HAS_PCI
        select IRQ_CPU
@@ -527,7 +527,7 @@ config PMC_YOSEMITE
          manufactured by PMC-Sierra.
 config QEMU
-        bool "Support for Qemu"
+        bool "Qemu"
        select DMA_COHERENT
        select GENERIC_ISA_DMA
        select HAVE_STD_PC_SERIAL_PORT
@@ -547,7 +547,7 @@ config QEMU
          can be found at http://www.linux-mips.org/wiki/Qemu.
 config SGI_IP22
-        bool "Support for SGI IP22 (Indy/Indigo2)"
+        bool "SGI IP22 (Indy/Indigo2)"
        select ARC
        select ARC32
        select BOOT_ELF32
@@ -567,7 +567,7 @@ config SGI_IP22
          that runs on these, say Y here.
 config SGI_IP27
-        bool "Support for SGI IP27 (Origin200/2000)"
+        bool "SGI IP27 (Origin200/2000)"
        select ARC
        select ARC64
        select BOOT_ELF64
@@ -583,7 +583,7 @@ config SGI_IP27
          here.
 config SGI_IP32
-        bool "Support for SGI IP32 (O2) (EXPERIMENTAL)"
+        bool "SGI IP32 (O2) (EXPERIMENTAL)"
        depends on EXPERIMENTAL
        select ARC
        select ARC32
@@ -604,7 +604,7 @@ config SGI_IP32
          If you want this kernel to run on SGI O2 workstation, say Y here.
 config SIBYTE_BIGSUR
-        bool "Support for Sibyte BCM91480B-BigSur"
+        bool "Sibyte BCM91480B-BigSur"
        select BOOT_ELF32
        select DMA_COHERENT
        select PCI_DOMAINS
@@ -615,7 +615,7 @@ config SIBYTE_BIGSUR
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_SWARM
-        bool "Support for Sibyte BCM91250A-SWARM"
+        bool "Sibyte BCM91250A-SWARM"
        select BOOT_ELF32
        select DMA_COHERENT
        select SIBYTE_SB1250
@@ -626,7 +626,7 @@ config SIBYTE_SWARM
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_SENTOSA
-        bool "Support for Sibyte BCM91250E-Sentosa"
+        bool "Sibyte BCM91250E-Sentosa"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -637,7 +637,7 @@ config SIBYTE_SENTOSA
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_RHONE
-        bool "Support for Sibyte BCM91125E-Rhone"
+        bool "Sibyte BCM91125E-Rhone"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -648,7 +648,7 @@ config SIBYTE_RHONE
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_CARMEL
-        bool "Support for Sibyte BCM91120x-Carmel"
+        bool "Sibyte BCM91120x-Carmel"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -659,7 +659,7 @@ config SIBYTE_CARMEL
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_PTSWARM
-        bool "Support for Sibyte BCM91250PT-PTSWARM"
+        bool "Sibyte BCM91250PT-PTSWARM"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -671,7 +671,7 @@ config SIBYTE_PTSWARM
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_LITTLESUR
-        bool "Support for Sibyte BCM91250C2-LittleSur"
+        bool "Sibyte BCM91250C2-LittleSur"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -683,7 +683,7 @@ config SIBYTE_LITTLESUR
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_CRHINE
-        bool "Support for Sibyte BCM91120C-CRhine"
+        bool "Sibyte BCM91120C-CRhine"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -694,7 +694,7 @@ config SIBYTE_CRHINE
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SIBYTE_CRHONE
-        bool "Support for Sibyte BCM91125C-CRhone"
+        bool "Sibyte BCM91125C-CRhone"
        depends on EXPERIMENTAL
        select BOOT_ELF32
        select DMA_COHERENT
@@ -706,7 +706,7 @@ config SIBYTE_CRHONE
        select SYS_SUPPORTS_LITTLE_ENDIAN
 config SNI_RM200_PCI
-        bool "Support for SNI RM200 PCI"
+        bool "SNI RM200 PCI"
        select ARC
        select ARC32
        select ARCH_MAY_HAVE_PC_FDC
@@ -732,7 +732,7 @@ config SNI_RM200_PCI
          support this machine type.
 config TOSHIBA_JMR3927
-        bool "Support for Toshiba JMR-TX3927 board"
+        bool "Toshiba JMR-TX3927 board"
        select DMA_NONCOHERENT
        select HW_HAS_PCI
        select MIPS_TX3927
@@ -743,7 +743,7 @@ config TOSHIBA_JMR3927
        select TOSHIBA_BOARDS
 config TOSHIBA_RBTX4927
-        bool "Support for Toshiba TBTX49[23]7 board"
+        bool "Toshiba TBTX49[23]7 board"
        select DMA_NONCOHERENT
        select HAS_TXX9_SERIAL
        select HW_HAS_PCI
@@ -760,7 +760,7 @@ config TOSHIBA_RBTX4927
          support this machine type
 config TOSHIBA_RBTX4938
-        bool "Support for Toshiba RBTX4938 board"
+        bool "Toshiba RBTX4938 board"
        select HAVE_STD_PC_SERIAL_PORT
        select DMA_NONCOHERENT
        select GENERIC_ISA_DMA
@@ -1411,13 +1411,12 @@ config PAGE_SIZE_8KB
 config PAGE_SIZE_16KB
        bool "16kB"
-        depends on EXPERIMENTAL && !CPU_R3000 && !CPU_TX39XX
+        depends on !CPU_R3000 && !CPU_TX39XX
        help
          Using 16kB page size will result in higher performance kernel at
          the price of higher memory consumption.  This option is available on
-          all non-R3000 family processor.  Not that at the time of this
+          all non-R3000 family processors.  Note that you will need a suitable
-          writing this option is still high experimental; there are also
+          Linux distribution to support this.
-          issues with compatibility of user applications.
 config PAGE_SIZE_64KB
        bool "64kB"
@@ -1426,8 +1425,7 @@ config PAGE_SIZE_64KB
          Using 64kB page size will result in higher performance kernel at
          the price of higher memory consumption.  This option is available on
          all non-R3000 family processor.  Not that at the time of this
-          writing this option is still high experimental; there are also
+          writing this option is still high experimental.
-          issues with compatibility of user applications.
 endchoice
diff --git a/arch/mips/au1000/common/irq.c b/arch/mips/au1000/common/irq.c
index da61de776154..afe05ec12c27 100644
--- a/arch/mips/au1000/common/irq.c
+++ b/arch/mips/au1000/common/irq.c
@@ -68,6 +68,7 @@
 extern void set_debug_traps(void);
 extern irq_cpustat_t irq_stat [NR_CPUS];
+extern void mips_timer_interrupt(struct pt_regs *regs);
 static void setup_local_irq(unsigned int irq, int type, int int_req);
 static unsigned int startup_irq(unsigned int irq);
diff --git a/arch/mips/au1000/common/prom.c b/arch/mips/au1000/common/prom.c
index 9c171afd9a53..ae7d8c57bf3f 100644
--- a/arch/mips/au1000/common/prom.c
+++ b/arch/mips/au1000/common/prom.c
@@ -1,10 +1,9 @@
 /*
 *
 * BRIEF MODULE DESCRIPTION
- *    PROM library initialisation code, assuming a version of
+ *    PROM library initialisation code, assuming YAMON is the boot loader.
- *    pmon is the boot code.
 *
- * Copyright 2000,2001 MontaVista Software Inc.
+ * Copyright 2000, 2001, 2006 MontaVista Software Inc.
 * Author: MontaVista Software, Inc.
 *              ppopov@mvista.com or source@mvista.com
 *
@@ -49,9 +48,9 @@ extern char **prom_argv, **prom_envp;
 typedef struct
 {
-    char *name;
+        char *name;
-/*    char *val; */
+        char *val;
-}t_env_var;
+} t_env_var;
 char * prom_getcmdline(void)
@@ -85,21 +84,16 @@ char *prom_getenv(char *envname)
 {
        /*
         * Return a pointer to the given environment variable.
-         * Environment variables are stored in the form of "memsize=64".
         */
        t_env_var *env = (t_env_var *)prom_envp;
-        int i;
-        i = strlen(envname);
-        while(env->name) {
+        while (env->name) {
-                if(strncmp(envname, env->name, i) == 0) {
+                if (strcmp(envname, env->name) == 0)
-                        return(env->name + strlen(envname) + 1);
+                        return env->val;
-                }
                env++;
        }
-        return(NULL);
+        return NULL;
 }
 inline unsigned char str2hexnum(unsigned char c)
diff --git a/arch/mips/au1000/common/sleeper.S b/arch/mips/au1000/common/sleeper.S
index 44dac3b0df3b..683d9da84b66 100644
--- a/arch/mips/au1000/common/sleeper.S
+++ b/arch/mips/au1000/common/sleeper.S
@@ -112,6 +112,11 @@ sdsleep:
        mtc0    k0, CP0_PAGEMASK
        lw      k0, 0x14(sp)
        mtc0    k0, CP0_CONFIG
+        /* We need to catch the ealry Alchemy SOCs with
+         * the write-only Config[OD] bit and set it back to one...
+         */
+        jal     au1x00_fixup_config_od
        lw      $1, PT_R1(sp)
        lw      $2, PT_R2(sp)
        lw      $3, PT_R3(sp)
diff --git a/arch/mips/au1000/common/time.c b/arch/mips/au1000/common/time.c
index f85f1524b366..f74d66a58a21 100644
--- a/arch/mips/au1000/common/time.c
+++ b/arch/mips/au1000/common/time.c
@@ -116,6 +116,7 @@ void mips_timer_interrupt(struct pt_regs *regs)
 null:
        ack_r4ktimer(0);
+        irq_exit();
 }
 #ifdef CONFIG_PM
diff --git a/arch/mips/ddb5xxx/ddb5476/dbg_io.c b/arch/mips/ddb5xxx/ddb5476/dbg_io.c
index 85e9e5013679..f2296a999953 100644
--- a/arch/mips/ddb5xxx/ddb5476/dbg_io.c
+++ b/arch/mips/ddb5xxx/ddb5476/dbg_io.c
@@ -86,7 +86,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/ddb5xxx/ddb5477/kgdb_io.c b/arch/mips/ddb5xxx/ddb5477/kgdb_io.c
index 1d18d590495b..385bbdb10170 100644
--- a/arch/mips/ddb5xxx/ddb5477/kgdb_io.c
+++ b/arch/mips/ddb5xxx/ddb5477/kgdb_io.c
@@ -86,7 +86,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/gt64120/ev64120/serialGT.c b/arch/mips/gt64120/ev64120/serialGT.c
index 16e34a546e54..8f0d835491ff 100644
--- a/arch/mips/gt64120/ev64120/serialGT.c
+++ b/arch/mips/gt64120/ev64120/serialGT.c
@@ -149,7 +149,7 @@ void serial_set(int channel, unsigned long baud)
 #else
        /*
         * Note: Set baud rate, hardcoded here for rate of 115200
-         * since became unsure of above "buad rate" algorithm (??).
+         * since became unsure of above "baud rate" algorithm (??).
         */
        outreg(channel, LCR, 0x83);
        outreg(channel, DLM, 0x00);     // See note above
diff --git a/arch/mips/gt64120/momenco_ocelot/dbg_io.c b/arch/mips/gt64120/momenco_ocelot/dbg_io.c
index 8720bccfdea2..f0a6a38fcf4d 100644
--- a/arch/mips/gt64120/momenco_ocelot/dbg_io.c
+++ b/arch/mips/gt64120/momenco_ocelot/dbg_io.c
@@ -73,7 +73,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/ite-boards/generic/dbg_io.c b/arch/mips/ite-boards/generic/dbg_io.c
index c4f8530fd07e..6a7ccaf93502 100644
--- a/arch/mips/ite-boards/generic/dbg_io.c
+++ b/arch/mips/ite-boards/generic/dbg_io.c
@@ -72,7 +72,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index 92b28b674d6f..0facfaf4e950 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -272,8 +272,8 @@ void output_sc_defines(void)
        text("/* Linux sigcontext offsets. */");
        offset("#define SC_REGS       ", struct sigcontext, sc_regs);
        offset("#define SC_FPREGS     ", struct sigcontext, sc_fpregs);
-        offset("#define SC_MDHI       ", struct sigcontext, sc_hi);
+        offset("#define SC_MDHI       ", struct sigcontext, sc_mdhi);
-        offset("#define SC_MDLO       ", struct sigcontext, sc_lo);
+        offset("#define SC_MDLO       ", struct sigcontext, sc_mdlo);
        offset("#define SC_PC         ", struct sigcontext, sc_pc);
        offset("#define SC_FPC_CSR    ", struct sigcontext, sc_fpc_csr);
        linefeed;
diff --git a/arch/mips/kernel/cpu-bugs64.c b/arch/mips/kernel/cpu-bugs64.c
index 47a087b6c11b..d268827c62bd 100644
--- a/arch/mips/kernel/cpu-bugs64.c
+++ b/arch/mips/kernel/cpu-bugs64.c
@@ -206,7 +206,7 @@ static inline void check_daddi(void)
                "daddi  %0, %1, %3\n\t"
                ".set   pop"
                : "=r" (v), "=&r" (tmp)
-                : "I" (0xffffffffffffdb9a), "I" (0x1234));
+                : "I" (0xffffffffffffdb9aUL), "I" (0x1234));
        set_except_vector(12, handler);
        local_irq_restore(flags);
@@ -224,7 +224,7 @@ static inline void check_daddi(void)
                "dsrl   %1, %1, 1\n\t"
                "daddi  %0, %1, %3"
                : "=r" (v), "=&r" (tmp)
-                : "I" (0xffffffffffffdb9a), "I" (0x1234));
+                : "I" (0xffffffffffffdb9aUL), "I" (0x1234));
        set_except_vector(12, handler);
        local_irq_restore(flags);
@@ -280,7 +280,7 @@ static inline void check_daddiu(void)
                "daddu  %1, %2\n\t"
                ".set   pop"
                : "=&r" (v), "=&r" (w), "=&r" (tmp)
-                : "I" (0xffffffffffffdb9a), "I" (0x1234));
+                : "I" (0xffffffffffffdb9aUL), "I" (0x1234));
        if (v == w) {
                printk("no.\n");
@@ -296,7 +296,7 @@ static inline void check_daddiu(void)
                "addiu  %1, $0, %4\n\t"
                "daddu  %1, %2"
                : "=&r" (v), "=&r" (w), "=&r" (tmp)
-                : "I" (0xffffffffffffdb9a), "I" (0x1234));
+                : "I" (0xffffffffffffdb9aUL), "I" (0x1234));
        if (v == w) {
                printk("yes.\n");
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 58b3b14873cb..8c2c359a05f4 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -121,6 +121,7 @@ static inline void check_wait(void)
        case CPU_24K:
        case CPU_25KF:
        case CPU_34K:
+        case CPU_74K:
        case CPU_PR4450:
                cpu_wait = r4k_wait;
                printk(" available.\n");
@@ -432,6 +433,15 @@ static inline void cpu_probe_legacy(struct cpuinfo_mips *c)
                             MIPS_CPU_LLSC;
                c->tlbsize = 64;
                break;
+        case PRID_IMP_R14000:
+                c->cputype = CPU_R14000;
+                c->isa_level = MIPS_CPU_ISA_IV;
+                c->options = MIPS_CPU_TLB | MIPS_CPU_4K_CACHE | MIPS_CPU_4KEX |
+                             MIPS_CPU_FPU | MIPS_CPU_32FPR |
+                             MIPS_CPU_COUNTER | MIPS_CPU_WATCH |
+                             MIPS_CPU_LLSC;
+                c->tlbsize = 64;
+                break;
        }
 }
@@ -593,6 +603,9 @@ static inline void cpu_probe_mips(struct cpuinfo_mips *c)
        case PRID_IMP_34K:
                c->cputype = CPU_34K;
                break;
+        case PRID_IMP_74K:
+                c->cputype = CPU_74K;
+                break;
        }
 }
@@ -642,7 +655,7 @@ static inline void cpu_probe_sibyte(struct cpuinfo_mips *c)
        case PRID_IMP_SB1:
                c->cputype = CPU_SB1;
                /* FPU in pass1 is known to have issues. */
-                if ((c->processor_id & 0xff) < 0x20)
+                if ((c->processor_id & 0xff) < 0x02)
                        c->options &= ~(MIPS_CPU_FPU | MIPS_CPU_32FPR);
                break;
        case PRID_IMP_SB1A:
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index d101d2fb24ca..a9c6de1b9542 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -101,7 +101,7 @@ FEXPORT(restore_all)			# restore full frame
        EMT
 1:
        mfc0    v1, CP0_TCSTATUS
-        /* We set IXMT above, XOR should cler it here */
+        /* We set IXMT above, XOR should clear it here */
        xori    v1, v1, TCSTATUS_IXMT
        or      v1, v0, v1
        mtc0    v1, CP0_TCSTATUS
diff --git a/arch/mips/kernel/gdb-low.S b/arch/mips/kernel/gdb-low.S
index 10f28fb9f008..5fd7a8af0c62 100644
--- a/arch/mips/kernel/gdb-low.S
+++ b/arch/mips/kernel/gdb-low.S
@@ -54,9 +54,11 @@
                 */
                mfc0    k0, CP0_CAUSE
                andi    k0, k0, 0x7c
-                add     k1, k1, k0
+#ifdef CONFIG_64BIT
-                PTR_L   k0, saved_vectors(k1)
+                dsll    k0, k0, 1
-                jr      k0
+#endif
+                PTR_L   k1, saved_vectors(k0)
+                jr      k1
                nop
 1:
                move    k0, sp
diff --git a/arch/mips/kernel/module.c b/arch/mips/kernel/module.c
index e54a7f442f8a..d7bf0215bc1d 100644
--- a/arch/mips/kernel/module.c
+++ b/arch/mips/kernel/module.c
@@ -288,6 +288,9 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strtab,
                sym = (Elf_Sym *)sechdrs[symindex].sh_addr
                        + ELF_MIPS_R_SYM(rel[i]);
                if (!sym->st_value) {
+                        /* Ignore unresolved weak symbol */
+                        if (ELF_ST_BIND(sym->st_info) == STB_WEAK)
+                                continue;
                        printk(KERN_WARNING "%s: Unknown symbol %s\n",
                               me->name, strtab + sym->st_name);
                        return -ENOENT;
@@ -325,6 +328,9 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
                sym = (Elf_Sym *)sechdrs[symindex].sh_addr
                        + ELF_MIPS_R_SYM(rel[i]);
                if (!sym->st_value) {
+                        /* Ignore unresolved weak symbol */
+                        if (ELF_ST_BIND(sym->st_info) == STB_WEAK)
+                                continue;
                        printk(KERN_WARNING "%s: Unknown symbol %s\n",
                               me->name, strtab + sym->st_name);
                        return -ENOENT;
diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c
index 84ab959f924a..9def554f335b 100644
--- a/arch/mips/kernel/proc.c
+++ b/arch/mips/kernel/proc.c
@@ -42,6 +42,7 @@ static const char *cpu_name[] = {
        [CPU_R8000]     = "R8000",
        [CPU_R10000]    = "R10000",
        [CPU_R12000]    = "R12000",
+        [CPU_R14000]    = "R14000",
        [CPU_R4300]     = "R4300",
        [CPU_R4650]     = "R4650",
        [CPU_R4700]     = "R4700",
@@ -74,6 +75,7 @@ static const char *cpu_name[] = {
        [CPU_24K]       = "MIPS 24K",
        [CPU_25KF]      = "MIPS 25Kf",
        [CPU_34K]       = "MIPS 34K",
+        [CPU_74K]       = "MIPS 74K",
        [CPU_VR4111]    = "NEC VR4111",
        [CPU_VR4121]    = "NEC VR4121",
        [CPU_VR4122]    = "NEC VR4122",
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index b53a9207f530..8efb23a84131 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -209,7 +209,7 @@ sys_call_table:
        PTR     sys_fork
        PTR     sys_read
        PTR     sys_write
-        PTR     sys_open                        /* 4005 */
+        PTR     compat_sys_open                 /* 4005 */
        PTR     sys_close
        PTR     sys_waitpid
        PTR     sys_creat
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index bcf1b10e518f..397a70e651b5 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -246,7 +246,7 @@ static inline int parse_rd_cmdline(unsigned long* rd_start, unsigned long* rd_en
 #ifdef CONFIG_64BIT
        /* HACK: Guess if the sign extension was forgotten */
        if (start > 0x0000000080000000 && start < 0x00000000ffffffff)
-                start |= 0xffffffff00000000;
+                start |= 0xffffffff00000000UL;
 #endif
        end = start + size;
@@ -355,8 +355,6 @@ static inline void bootmem_init(void)
        }
 #endif
-        memory_present(0, first_usable_pfn, max_low_pfn);
        /* Initialize the boot-time allocator with low memory only.  */
        bootmap_size = init_bootmem(first_usable_pfn, max_low_pfn);
@@ -410,6 +408,7 @@ static inline void bootmem_init(void)
                /* Register lowmem ranges */
                free_bootmem(PFN_PHYS(curr_pfn), PFN_PHYS(size));
+                memory_present(0, curr_pfn, curr_pfn + size - 1);
        }
        /* Reserve the bootmap memory.  */
@@ -419,17 +418,20 @@ static inline void bootmem_init(void)
 #ifdef CONFIG_BLK_DEV_INITRD
        initrd_below_start_ok = 1;
        if (initrd_start) {
-                unsigned long initrd_size = ((unsigned char *)initrd_end) - ((unsigned char *)initrd_start);
+                unsigned long initrd_size = ((unsigned char *)initrd_end) -
+                        ((unsigned char *)initrd_start);
+                const int width = sizeof(long) * 2;
                printk("Initial ramdisk at: 0x%p (%lu bytes)\n",
                       (void *)initrd_start, initrd_size);
                if (CPHYSADDR(initrd_end) > PFN_PHYS(max_low_pfn)) {
                        printk("initrd extends beyond end of memory "
                               "(0x%0*Lx > 0x%0*Lx)\ndisabling initrd\n",
-                               sizeof(long) * 2,
+                               width,
-                               (unsigned long long)CPHYSADDR(initrd_end),
+                               (unsigned long long) CPHYSADDR(initrd_end),
-                               sizeof(long) * 2,
+                               width,
-                               (unsigned long long)PFN_PHYS(max_low_pfn));
+                               (unsigned long long) PFN_PHYS(max_low_pfn));
                        initrd_start = initrd_end = 0;
                        initrd_reserve_bootmem = 0;
                }
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index 3ca786215d48..ce6cb915c0a7 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -31,7 +31,6 @@ setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
        save_gp_reg(31);
 #undef save_gp_reg
-#ifdef CONFIG_32BIT
        err |= __put_user(regs->hi, &sc->sc_mdhi);
        err |= __put_user(regs->lo, &sc->sc_mdlo);
        if (cpu_has_dsp) {
@@ -43,20 +42,6 @@ setup_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                err |= __put_user(mflo3(), &sc->sc_lo3);
                err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
        }
-#endif
-#ifdef CONFIG_64BIT
-        err |= __put_user(regs->hi, &sc->sc_hi[0]);
-        err |= __put_user(regs->lo, &sc->sc_lo[0]);
-        if (cpu_has_dsp) {
-                err |= __put_user(mfhi1(), &sc->sc_hi[1]);
-                err |= __put_user(mflo1(), &sc->sc_lo[1]);
-                err |= __put_user(mfhi2(), &sc->sc_hi[2]);
-                err |= __put_user(mflo2(), &sc->sc_lo[2]);
-                err |= __put_user(mfhi3(), &sc->sc_hi[3]);
-                err |= __put_user(mflo3(), &sc->sc_lo[3]);
-                err |= __put_user(rddsp(DSP_MASK), &sc->sc_dsp);
-        }
-#endif
        err |= __put_user(!!used_math(), &sc->sc_used_math);
@@ -92,7 +77,6 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
        current_thread_info()->restart_block.fn = do_no_restart_syscall;
        err |= __get_user(regs->cp0_epc, &sc->sc_pc);
-#ifdef CONFIG_32BIT
        err |= __get_user(regs->hi, &sc->sc_mdhi);
        err |= __get_user(regs->lo, &sc->sc_mdlo);
        if (cpu_has_dsp) {
@@ -104,20 +88,6 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc)
                err |= __get_user(treg, &sc->sc_lo3); mtlo3(treg);
                err |= __get_user(treg, &sc->sc_dsp); wrdsp(treg, DSP_MASK);
        }
-#endif
-#ifdef CONFIG_64BIT
-        err |= __get_user(regs->hi, &sc->sc_hi[0]);
-        err |= __get_user(regs->lo, &sc->sc_lo[0]);
-        if (cpu_has_dsp) {
-                err |= __get_user(treg, &sc->sc_hi[1]); mthi1(treg);
-                err |= __get_user(treg, &sc->sc_lo[1]); mthi1(treg);
-                err |= __get_user(treg, &sc->sc_hi[2]); mthi2(treg);
-                err |= __get_user(treg, &sc->sc_lo[2]); mthi2(treg);
-                err |= __get_user(treg, &sc->sc_hi[3]); mthi3(treg);
-                err |= __get_user(treg, &sc->sc_lo[3]); mthi3(treg);
-                err |= __get_user(treg, &sc->sc_dsp); wrdsp(treg, DSP_MASK);
-        }
-#endif
 #define restore_gp_reg(i) do {                                          \
        err |= __get_user(regs->regs[i], &sc->sc_regs[i]);              \
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index d42f358754ad..298f82fe8440 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -247,6 +247,9 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
        current_thread_info()->cpu = 0;
        smp_tune_scheduling();
        plat_prepare_cpus(max_cpus);
+#ifndef CONFIG_HOTPLUG_CPU
+        cpu_present_map = cpu_possible_map;
+#endif
 }
 /* preload SMP state for boot cpu */
@@ -442,7 +445,7 @@ static int __init topology_init(void)
        int cpu;
        int ret;
-        for_each_cpu(cpu) {
+        for_each_present_cpu(cpu) {
                ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu, NULL);
                if (ret)
                        printk(KERN_WARNING "topology_init: register_cpu %d "
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 2aeaa2fd4b32..5e8a18a8e2bd 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -276,31 +276,9 @@ void sys_set_thread_area(unsigned long addr)
 asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
 {
-        int     tmp, len;
+        int     tmp;
-        char    __user *name;
        switch(cmd) {
-        case SETNAME: {
-                char nodename[__NEW_UTS_LEN + 1];
-                if (!capable(CAP_SYS_ADMIN))
-                        return -EPERM;
-                name = (char __user *) arg1;
-                len = strncpy_from_user(nodename, name, __NEW_UTS_LEN);
-                if (len < 0)
-                        return -EFAULT;
-                down_write(&uts_sem);
-                strncpy(system_utsname.nodename, nodename, len);
-                nodename[__NEW_UTS_LEN] = '\0';
-                strlcpy(system_utsname.nodename, nodename,
-                        sizeof(system_utsname.nodename));
-                up_write(&uts_sem);
-                return 0;
-        }
        case MIPS_ATOMIC_SET:
                printk(KERN_CRIT "How did I get here?\n");
                return -EINVAL;
@@ -313,9 +291,6 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
        case FLUSH_CACHE:
                __flush_cache_all();
                return 0;
-        case MIPS_RDNVRAM:
-                return -EIO;
        }
        return -EINVAL;
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 4901f0a37fca..a7564b08eb4d 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -819,15 +819,30 @@ asmlinkage void do_watch(struct pt_regs *regs)
 asmlinkage void do_mcheck(struct pt_regs *regs)
 {
+        const int field = 2 * sizeof(unsigned long);
+        int multi_match = regs->cp0_status & ST0_TS;
        show_regs(regs);
-        dump_tlb_all();
+        if (multi_match) {
+                printk("Index   : %0x\n", read_c0_index());
+                printk("Pagemask: %0x\n", read_c0_pagemask());
+                printk("EntryHi : %0*lx\n", field, read_c0_entryhi());
+                printk("EntryLo0: %0*lx\n", field, read_c0_entrylo0());
+                printk("EntryLo1: %0*lx\n", field, read_c0_entrylo1());
+                printk("\n");
+                dump_tlb_all();
+        }
+        show_code((unsigned int *) regs->cp0_epc);
        /*
         * Some chips may have other causes of machine check (e.g. SB1
         * graduation timer)
         */
        panic("Caught Machine Check exception - %scaused by multiple "
              "matching entries in the TLB.",
-              (regs->cp0_status & ST0_TS) ? "" : "not ");
+              (multi_match) ? "" : "not ");
 }
 asmlinkage void do_mt(struct pt_regs *regs)
@@ -902,6 +917,7 @@ static inline void parity_protection_init(void)
 {
        switch (current_cpu_data.cputype) {
        case CPU_24K:
+        case CPU_34K:
        case CPU_5KC:
                write_c0_ecc(0x80000000);
                back_to_back_c0_hazard();
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 14fa00e3cdfa..b84d1f9ce28e 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -151,23 +151,13 @@ SECTIONS
  /* This is the MIPS specific mdebug section.  */
  .mdebug : { *(.mdebug) }
-  /* These are needed for ELF backends which have not yet been
-     converted to the new style linker.  */
+  STABS_DEBUG
-  .stab 0 : { *(.stab) }
-  .stabstr 0 : { *(.stabstr) }
+  DWARF_DEBUG
-  /* DWARF debug sections.
-     Symbols in the .debug DWARF section are relative to the beginning of the
-     section so we begin .debug at 0.  It's not clear yet what needs to happen
-     for the others.   */
-  .debug          0 : { *(.debug) }
-  .debug_srcinfo  0 : { *(.debug_srcinfo) }
-  .debug_aranges  0 : { *(.debug_aranges) }
-  .debug_pubnames 0 : { *(.debug_pubnames) }
-  .debug_sfnames  0 : { *(.debug_sfnames) }
-  .line           0 : { *(.line) }
  /* These must appear regardless of  .  */
  .gptab.sdata : { *(.gptab.data) *(.gptab.sdata) }
  .gptab.sbss : { *(.gptab.bss) *(.gptab.sbss) }
-  .comment : { *(.comment) }
  .note : { *(.note) }
 }
diff --git a/arch/mips/math-emu/dp_fint.c b/arch/mips/math-emu/dp_fint.c
index a1962eb460f8..39a71de16f47 100644
--- a/arch/mips/math-emu/dp_fint.c
+++ b/arch/mips/math-emu/dp_fint.c
@@ -29,7 +29,9 @@
 ieee754dp ieee754dp_fint(int x)
 {
-        COMPXDP;
+        u64 xm;
+        int xe;
+        int xs;
        CLEARCX;
diff --git a/arch/mips/math-emu/dp_flong.c b/arch/mips/math-emu/dp_flong.c
index eae90a866aa1..f08f223e488a 100644
--- a/arch/mips/math-emu/dp_flong.c
+++ b/arch/mips/math-emu/dp_flong.c
@@ -29,7 +29,9 @@
 ieee754dp ieee754dp_flong(s64 x)
 {
-        COMPXDP;
+        u64 xm;
+        int xe;
+        int xs;
        CLEARCX;
diff --git a/arch/mips/math-emu/sp_fint.c b/arch/mips/math-emu/sp_fint.c
index 7aac13afb09a..e88e125e01c2 100644
--- a/arch/mips/math-emu/sp_fint.c
+++ b/arch/mips/math-emu/sp_fint.c
@@ -29,7 +29,9 @@
 ieee754sp ieee754sp_fint(int x)
 {
-        COMPXSP;
+        unsigned xm;
+        int xe;
+        int xs;
        CLEARCX;
diff --git a/arch/mips/math-emu/sp_flong.c b/arch/mips/math-emu/sp_flong.c
index 3d6c1d11c178..26d6919a269a 100644
--- a/arch/mips/math-emu/sp_flong.c
+++ b/arch/mips/math-emu/sp_flong.c
@@ -29,7 +29,9 @@
 ieee754sp ieee754sp_flong(s64 x)
 {
-        COMPXDP;                /* <--- need 64-bit mantissa temp */
+        u64 xm;         /* <--- need 64-bit mantissa temp */
+        int xe;
+        int xs;
        CLEARCX;
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 4182e1176fae..4a43924cd4fc 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -29,6 +29,27 @@
 #include <asm/war.h>
 #include <asm/cacheflush.h> /* for run_uncached() */
+/*
+ * Special Variant of smp_call_function for use by cache functions:
+ *
+ *  o No return value
+ *  o collapses to normal function call on UP kernels
+ *  o collapses to normal function call on systems with a single shared
+ *    primary cache.
+ */
+static inline void r4k_on_each_cpu(void (*func) (void *info), void *info,
+                                   int retry, int wait)
+{
+        preempt_disable();
+#if !defined(CONFIG_MIPS_MT_SMP) && !defined(CONFIG_MIPS_MT_SMTC)
+        smp_call_function(func, info, retry, wait);
+#endif
+        func(info);
+        preempt_enable();
+}
 /*
 * Must die.
 */
@@ -299,7 +320,7 @@ static void r4k_flush_cache_all(void)
        if (!cpu_has_dc_aliases)
                return;
-        on_each_cpu(local_r4k_flush_cache_all, NULL, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_cache_all, NULL, 1, 1);
 }
 static inline void local_r4k___flush_cache_all(void * args)
@@ -314,13 +335,14 @@ static inline void local_r4k___flush_cache_all(void * args)
        case CPU_R4400MC:
        case CPU_R10000:
        case CPU_R12000:
+        case CPU_R14000:
                r4k_blast_scache();
        }
 }
 static void r4k___flush_cache_all(void)
 {
-        on_each_cpu(local_r4k___flush_cache_all, NULL, 1, 1);
+        r4k_on_each_cpu(local_r4k___flush_cache_all, NULL, 1, 1);
 }
 static inline void local_r4k_flush_cache_range(void * args)
@@ -341,7 +363,7 @@ static inline void local_r4k_flush_cache_range(void * args)
 static void r4k_flush_cache_range(struct vm_area_struct *vma,
        unsigned long start, unsigned long end)
 {
-        on_each_cpu(local_r4k_flush_cache_range, vma, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_cache_range, vma, 1, 1);
 }
 static inline void local_r4k_flush_cache_mm(void * args)
@@ -370,7 +392,7 @@ static void r4k_flush_cache_mm(struct mm_struct *mm)
        if (!cpu_has_dc_aliases)
                return;
-        on_each_cpu(local_r4k_flush_cache_mm, mm, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_cache_mm, mm, 1, 1);
 }
 struct flush_cache_page_args {
@@ -461,7 +483,7 @@ static void r4k_flush_cache_page(struct vm_area_struct *vma,
        args.addr = addr;
        args.pfn = pfn;
-        on_each_cpu(local_r4k_flush_cache_page, &args, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_cache_page, &args, 1, 1);
 }
 static inline void local_r4k_flush_data_cache_page(void * addr)
@@ -471,7 +493,7 @@ static inline void local_r4k_flush_data_cache_page(void * addr)
 static void r4k_flush_data_cache_page(unsigned long addr)
 {
-        on_each_cpu(local_r4k_flush_data_cache_page, (void *) addr, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_data_cache_page, (void *) addr, 1, 1);
 }
 struct flush_icache_range_args {
@@ -514,7 +536,7 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end)
        args.start = start;
        args.end = end;
-        on_each_cpu(local_r4k_flush_icache_range, &args, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_icache_range, &args, 1, 1);
        instruction_hazard();
 }
@@ -590,7 +612,7 @@ static void r4k_flush_icache_page(struct vm_area_struct *vma,
        args.vma = vma;
        args.page = page;
-        on_each_cpu(local_r4k_flush_icache_page, &args, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_icache_page, &args, 1, 1);
 }
@@ -689,7 +711,7 @@ static void local_r4k_flush_cache_sigtramp(void * arg)
 static void r4k_flush_cache_sigtramp(unsigned long addr)
 {
-        on_each_cpu(local_r4k_flush_cache_sigtramp, (void *) addr, 1, 1);
+        r4k_on_each_cpu(local_r4k_flush_cache_sigtramp, (void *) addr, 1, 1);
 }
 static void r4k_flush_icache_all(void)
@@ -812,6 +834,7 @@ static void __init probe_pcache(void)
        case CPU_R10000:
        case CPU_R12000:
+        case CPU_R14000:
                icache_size = 1 << (12 + ((config & R10K_CONF_IC) >> 29));
                c->icache.linesz = 64;
                c->icache.ways = 2;
@@ -965,9 +988,11 @@ static void __init probe_pcache(void)
                c->dcache.flags |= MIPS_CACHE_PINDEX;
        case CPU_R10000:
        case CPU_R12000:
+        case CPU_R14000:
        case CPU_SB1:
                break;
        case CPU_24K:
+        case CPU_34K:
                if (!(read_c0_config7() & (1 << 16)))
        default:
                        if (c->dcache.waysize > PAGE_SIZE)
@@ -1091,6 +1116,7 @@ static void __init setup_scache(void)
        case CPU_R10000:
        case CPU_R12000:
+        case CPU_R14000:
                scache_size = 0x80000 << ((config & R10K_CONF_SS) >> 16);
                c->scache.linesz = 64 << ((config >> 13) & 1);
                c->scache.ways = 2;
@@ -1135,6 +1161,31 @@ static void __init setup_scache(void)
        c->options |= MIPS_CPU_SUBSET_CACHES;
 }
+void au1x00_fixup_config_od(void)
+{
+        /*
+         * c0_config.od (bit 19) was write only (and read as 0)
+         * on the early revisions of Alchemy SOCs.  It disables the bus
+         * transaction overlapping and needs to be set to fix various errata.
+         */
+        switch (read_c0_prid()) {
+        case 0x00030100: /* Au1000 DA */
+        case 0x00030201: /* Au1000 HA */
+        case 0x00030202: /* Au1000 HB */
+        case 0x01030200: /* Au1500 AB */
+        /*
+         * Au1100 errata actually keeps silence about this bit, so we set it
+         * just in case for those revisions that require it to be set according
+         * to arch/mips/au1000/common/cputable.c
+         */
+        case 0x02030200: /* Au1100 AB */
+        case 0x02030201: /* Au1100 BA */
+        case 0x02030202: /* Au1100 BC */
+                set_c0_config(1 << 19);
+                break;
+        }
+}
 static inline void coherency_setup(void)
 {
        change_c0_config(CONF_CM_CMASK, CONF_CM_DEFAULT);
@@ -1155,6 +1206,15 @@ static inline void coherency_setup(void)
        case CPU_R4400MC:
                clear_c0_config(CONF_CU);
                break;
+        /*
+         * We need to catch the ealry Alchemy SOCs with
+         * the write-only co_config.od bit and set it back to one...
+         */
+        case CPU_AU1000: /* rev. DA, HA, HB */
+        case CPU_AU1100: /* rev. AB, BA, BC ?? */
+        case CPU_AU1500: /* rev. AB */
+                au1x00_fixup_config_od();
+                break;
        }
 }
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index c22308b93ff0..33f6e1cdfd5b 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -227,7 +227,7 @@ void __init mem_init(void)
        for (tmp = 0; tmp < max_low_pfn; tmp++)
                if (page_is_ram(tmp)) {
                        ram++;
-                        if (PageReserved(mem_map+tmp))
+                        if (PageReserved(pfn_to_page(tmp)))
                                reservedpages++;
                }
diff --git a/arch/mips/mm/pg-r4k.c b/arch/mips/mm/pg-r4k.c
index e4390dc3eb48..b7c749232ffe 100644
--- a/arch/mips/mm/pg-r4k.c
+++ b/arch/mips/mm/pg-r4k.c
@@ -357,6 +357,7 @@ void __init build_clear_page(void)
                case CPU_R10000:
                case CPU_R12000:
+                case CPU_R14000:
                        pref_src_mode = Pref_LoadStreamed;
                        pref_dst_mode = Pref_StoreStreamed;
                        break;
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 053dbacac56b..54507be2ab5b 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -875,6 +875,7 @@ static __init void build_tlb_write_entry(u32 **p, struct label **l,
        case CPU_R10000:
        case CPU_R12000:
+        case CPU_R14000:
        case CPU_4KC:
        case CPU_SB1:
        case CPU_SB1A:
@@ -906,6 +907,7 @@ static __init void build_tlb_write_entry(u32 **p, struct label **l,
        case CPU_4KEC:
        case CPU_24K:
        case CPU_34K:
+        case CPU_74K:
                i_ehb(p);
                tlbw(p);
                break;
diff --git a/arch/mips/momentum/jaguar_atx/dbg_io.c b/arch/mips/momentum/jaguar_atx/dbg_io.c
index 542eac82b63c..d7dea0a136aa 100644
--- a/arch/mips/momentum/jaguar_atx/dbg_io.c
+++ b/arch/mips/momentum/jaguar_atx/dbg_io.c
@@ -73,7 +73,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/momentum/ocelot_c/dbg_io.c b/arch/mips/momentum/ocelot_c/dbg_io.c
index 8720bccfdea2..f0a6a38fcf4d 100644
--- a/arch/mips/momentum/ocelot_c/dbg_io.c
+++ b/arch/mips/momentum/ocelot_c/dbg_io.c
@@ -73,7 +73,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/momentum/ocelot_g/dbg_io.c b/arch/mips/momentum/ocelot_g/dbg_io.c
index 8720bccfdea2..f0a6a38fcf4d 100644
--- a/arch/mips/momentum/ocelot_g/dbg_io.c
+++ b/arch/mips/momentum/ocelot_g/dbg_io.c
@@ -73,7 +73,7 @@ void debugInit(uint32 baud, uint8 data, uint8 parity, uint8 stop)
        /* disable interrupts */
        UART16550_WRITE(OFS_INTR_ENABLE, 0);
-        /* set up buad rate */
+        /* set up baud rate */
        {
                uint32 divisor;
diff --git a/arch/mips/oprofile/common.c b/arch/mips/oprofile/common.c
index f2b4862aaae5..c31e4cff64e0 100644
--- a/arch/mips/oprofile/common.c
+++ b/arch/mips/oprofile/common.c
@@ -14,8 +14,8 @@
 #include "op_impl.h"
-extern struct op_mips_model op_model_mipsxx __attribute__((weak));
+extern struct op_mips_model op_model_mipsxx_ops __attribute__((weak));
-extern struct op_mips_model op_model_rm9000 __attribute__((weak));
+extern struct op_mips_model op_model_rm9000_ops __attribute__((weak));
 static struct op_mips_model *model;
@@ -80,13 +80,14 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
        case CPU_24K:
        case CPU_25KF:
        case CPU_34K:
+        case CPU_74K:
        case CPU_SB1:
        case CPU_SB1A:
-                lmodel = &op_model_mipsxx;
+                lmodel = &op_model_mipsxx_ops;
                break;
        case CPU_RM9000:
-                lmodel = &op_model_rm9000;
+                lmodel = &op_model_rm9000_ops;
                break;
        };
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index 95d488ca0754..f26a00e13204 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -23,7 +23,7 @@
 #define M_COUNTER_OVERFLOW              (1UL    << 31)
-struct op_mips_model op_model_mipsxx;
+struct op_mips_model op_model_mipsxx_ops;
 static struct mipsxx_register_config {
        unsigned int control[4];
@@ -34,7 +34,7 @@ static struct mipsxx_register_config {
 static void mipsxx_reg_setup(struct op_counter_config *ctr)
 {
-        unsigned int counters = op_model_mipsxx.num_counters;
+        unsigned int counters = op_model_mipsxx_ops.num_counters;
        int i;
        /* Compute the performance counter control word.  */
@@ -62,7 +62,7 @@ static void mipsxx_reg_setup(struct op_counter_config *ctr)
 static void mipsxx_cpu_setup (void *args)
 {
-        unsigned int counters = op_model_mipsxx.num_counters;
+        unsigned int counters = op_model_mipsxx_ops.num_counters;
        switch (counters) {
        case 4:
@@ -83,7 +83,7 @@ static void mipsxx_cpu_setup (void *args)
 /* Start all counters on current CPU */
 static void mipsxx_cpu_start(void *args)
 {
-        unsigned int counters = op_model_mipsxx.num_counters;
+        unsigned int counters = op_model_mipsxx_ops.num_counters;
        switch (counters) {
        case 4:
@@ -100,7 +100,7 @@ static void mipsxx_cpu_start(void *args)
 /* Stop all counters on current CPU */
 static void mipsxx_cpu_stop(void *args)
 {
-        unsigned int counters = op_model_mipsxx.num_counters;
+        unsigned int counters = op_model_mipsxx_ops.num_counters;
        switch (counters) {
        case 4:
@@ -116,7 +116,7 @@ static void mipsxx_cpu_stop(void *args)
 static int mipsxx_perfcount_handler(struct pt_regs *regs)
 {
-        unsigned int counters = op_model_mipsxx.num_counters;
+        unsigned int counters = op_model_mipsxx_ops.num_counters;
        unsigned int control;
        unsigned int counter;
        int handled = 0;
@@ -187,33 +187,37 @@ static int __init mipsxx_init(void)
        reset_counters(counters);
-        op_model_mipsxx.num_counters = counters;
+        op_model_mipsxx_ops.num_counters = counters;
        switch (current_cpu_data.cputype) {
        case CPU_20KC:
-                op_model_mipsxx.cpu_type = "mips/20K";
+                op_model_mipsxx_ops.cpu_type = "mips/20K";
                break;
        case CPU_24K:
-                op_model_mipsxx.cpu_type = "mips/24K";
+                op_model_mipsxx_ops.cpu_type = "mips/24K";
                break;
        case CPU_25KF:
-                op_model_mipsxx.cpu_type = "mips/25K";
+                op_model_mipsxx_ops.cpu_type = "mips/25K";
                break;
 #ifndef CONFIG_SMP
        case CPU_34K:
-                op_model_mipsxx.cpu_type = "mips/34K";
+                op_model_mipsxx_ops.cpu_type = "mips/34K";
+                break;
+        case CPU_74K:
+                op_model_mipsxx_ops.cpu_type = "mips/74K";
                break;
 #endif
        case CPU_5KC:
-                op_model_mipsxx.cpu_type = "mips/5K";
+                op_model_mipsxx_ops.cpu_type = "mips/5K";
                break;
        case CPU_SB1:
        case CPU_SB1A:
-                op_model_mipsxx.cpu_type = "mips/sb1";
+                op_model_mipsxx_ops.cpu_type = "mips/sb1";
                break;
        default:
@@ -229,12 +233,12 @@ static int __init mipsxx_init(void)
 static void mipsxx_exit(void)
 {
-        reset_counters(op_model_mipsxx.num_counters);
+        reset_counters(op_model_mipsxx_ops.num_counters);
        perf_irq = null_perf_irq;
 }
-struct op_mips_model op_model_mipsxx = {
+struct op_mips_model op_model_mipsxx_ops = {
        .reg_setup      = mipsxx_reg_setup,
        .cpu_setup      = mipsxx_cpu_setup,
        .init           = mipsxx_init,
diff --git a/arch/mips/oprofile/op_model_rm9000.c b/arch/mips/oprofile/op_model_rm9000.c
index 9b75e41c78ef..b7063fefa65b 100644
--- a/arch/mips/oprofile/op_model_rm9000.c
+++ b/arch/mips/oprofile/op_model_rm9000.c
@@ -126,7 +126,7 @@ static void rm9000_exit(void)
        free_irq(rm9000_perfcount_irq, NULL);
 }
-struct op_mips_model op_model_rm9000 = {
+struct op_mips_model op_model_rm9000_ops = {
        .reg_setup      = rm9000_reg_setup,
        .cpu_setup      = rm9000_cpu_setup,
        .init           = rm9000_init,
diff --git a/arch/mips/sgi-ip32/ip32-irq.c b/arch/mips/sgi-ip32/ip32-irq.c
index de01c9815bdd..8ba08047d164 100644
--- a/arch/mips/sgi-ip32/ip32-irq.c
+++ b/arch/mips/sgi-ip32/ip32-irq.c
@@ -31,12 +31,12 @@
 /* issue a PIO read to make sure no PIO writes are pending */
 static void inline flush_crime_bus(void)
 {
-        volatile unsigned long junk = crime->control;
+        crime->control;
 }
 static void inline flush_mace_bus(void)
 {
-        volatile unsigned long junk = mace->perif.ctrl.misc;
+        mace->perif.ctrl.misc;
 }
 #undef DEBUG_IRQ
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 2d80653aa2af..41e9ab40cd54 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -2057,10 +2057,45 @@ static void __init flatten_device_tree(void)
 }
+#ifdef CONFIG_PPC_MAPLE
-static void __init fixup_device_tree(void)
+/* PIBS Version 1.05.0000 04/26/2005 has an incorrect /ht/isa/ranges property.
+ * The values are bad, and it doesn't even have the right number of cells. */
+static void __init fixup_device_tree_maple(void)
 {
+        phandle isa;
+        u32 isa_ranges[6];
+        isa = call_prom("finddevice", 1, 1, ADDR("/ht@0/isa@4"));
+        if (!PHANDLE_VALID(isa))
+                return;
+        if (prom_getprop(isa, "ranges", isa_ranges, sizeof(isa_ranges))
+                == PROM_ERROR)
+                return;
+        if (isa_ranges[0] != 0x1 ||
+                isa_ranges[1] != 0xf4000000 ||
+                isa_ranges[2] != 0x00010000)
+                return;
+        prom_printf("fixing up bogus ISA range on Maple...\n");
+        isa_ranges[0] = 0x1;
+        isa_ranges[1] = 0x0;
+        isa_ranges[2] = 0x01002000; /* IO space; PCI device = 4 */
+        isa_ranges[3] = 0x0;
+        isa_ranges[4] = 0x0;
+        isa_ranges[5] = 0x00010000;
+        prom_setprop(isa, "/ht@0/isa@4", "ranges",
+                        isa_ranges, sizeof(isa_ranges));
+}
+#else
+#define fixup_device_tree_maple()
+#endif
 #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC)
+static void __init fixup_device_tree_pmac(void)
+{
        phandle u3, i2c, mpic;
        u32 u3_rev;
        u32 interrupts[2];
@@ -2097,9 +2132,16 @@ static void __init fixup_device_tree(void)
        parent = (u32)mpic;
        prom_setprop(i2c, "/u3@0,f8000000/i2c@f8001000", "interrupt-parent",
                     &parent, sizeof(parent));
-#endif
 }
+#else
+#define fixup_device_tree_pmac()
+#endif
+static void __init fixup_device_tree(void)
+{
+        fixup_device_tree_maple();
+        fixup_device_tree_pmac();
+}
 static void __init prom_find_boot_cpu(void)
 {
diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c
index df2343e1956b..c896ce83d412 100644
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1157,6 +1157,7 @@ EXPORT_SYMBOL_GPL(pmac_i2c_xfer);
 /* some quirks for platform function decoding */
 enum {
        pmac_i2c_quirk_invmask = 0x00000001u,
+        pmac_i2c_quirk_skip = 0x00000002u,
 };
 static void pmac_i2c_devscan(void (*callback)(struct device_node *dev,
@@ -1172,6 +1173,15 @@ static void pmac_i2c_devscan(void (*callback)(struct device_node *dev,
                /* XXX Study device-tree's & apple drivers are get the quirks
                 * right !
                 */
+                /* Workaround: It seems that running the clockspreading
+                 * properties on the eMac will cause lockups during boot.
+                 * The machine seems to work fine without that. So for now,
+                 * let's make sure i2c-hwclock doesn't match about "imic"
+                 * clocks and we'll figure out if we really need to do
+                 * something special about those later.
+                 */
+                { "i2c-hwclock", "imic5002", pmac_i2c_quirk_skip },
+                { "i2c-hwclock", "imic5003", pmac_i2c_quirk_skip },
                { "i2c-hwclock", NULL, pmac_i2c_quirk_invmask },
                { "i2c-cpu-voltage", NULL, 0},
                {  "temp-monitor", NULL, 0 },
@@ -1198,6 +1208,8 @@ static void pmac_i2c_devscan(void (*callback)(struct device_node *dev,
                                if (p->compatible &&
                                    !device_is_compatible(np, p->compatible))
                                        continue;
+                                if (p->quirks & pmac_i2c_quirk_skip)
+                                        break;
                                callback(np, p->quirks);
                                break;
                        }
diff --git a/arch/powerpc/platforms/powermac/pfunc_core.c b/arch/powerpc/platforms/powermac/pfunc_core.c
index 4baa75b1d36f..f08173b0f065 100644
--- a/arch/powerpc/platforms/powermac/pfunc_core.c
+++ b/arch/powerpc/platforms/powermac/pfunc_core.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
 #include <linux/module.h>
+#include <linux/mutex.h>
 #include <asm/semaphore.h>
 #include <asm/prom.h>
@@ -546,6 +547,7 @@ struct pmf_device {
 static LIST_HEAD(pmf_devices);
 static spinlock_t pmf_lock = SPIN_LOCK_UNLOCKED;
+static DEFINE_MUTEX(pmf_irq_mutex);
 static void pmf_release_device(struct kref *kref)
 {
@@ -864,15 +866,17 @@ int pmf_register_irq_client(struct device_node *target,
        spin_lock_irqsave(&pmf_lock, flags);
        func = __pmf_find_function(target, name, PMF_FLAGS_INT_GEN);
-        if (func == NULL) {
+        if (func)
-                spin_unlock_irqrestore(&pmf_lock, flags);
+                func = pmf_get_function(func);
+        spin_unlock_irqrestore(&pmf_lock, flags);
+        if (func == NULL)
                return -ENODEV;
-        }
+        mutex_lock(&pmf_irq_mutex);
        if (list_empty(&func->irq_clients))
                func->dev->handlers->irq_enable(func);
        list_add(&client->link, &func->irq_clients);
        client->func = func;
-        spin_unlock_irqrestore(&pmf_lock, flags);
+        mutex_unlock(&pmf_irq_mutex);
        return 0;
 }
@@ -881,16 +885,16 @@ EXPORT_SYMBOL_GPL(pmf_register_irq_client);
 void pmf_unregister_irq_client(struct pmf_irq_client *client)
 {
        struct pmf_function *func = client->func;
-        unsigned long flags;
        BUG_ON(func == NULL);
-        spin_lock_irqsave(&pmf_lock, flags);
+        mutex_lock(&pmf_irq_mutex);
        client->func = NULL;
        list_del(&client->link);
        if (list_empty(&func->irq_clients))
                func->dev->handlers->irq_disable(func);
-        spin_unlock_irqrestore(&pmf_lock, flags);
+        mutex_unlock(&pmf_irq_mutex);
+        pmf_put_function(func);
 }
 EXPORT_SYMBOL_GPL(pmf_unregister_irq_client);
diff --git a/arch/ppc/kernel/asm-offsets.c b/arch/ppc/kernel/asm-offsets.c
index cc7c4aea9397..2f5c5e157617 100644
--- a/arch/ppc/kernel/asm-offsets.c
+++ b/arch/ppc/kernel/asm-offsets.c
@@ -134,7 +134,7 @@ main(void)
        DEFINE(TI_TASK, offsetof(struct thread_info, task));
        DEFINE(TI_EXECDOMAIN, offsetof(struct thread_info, exec_domain));
        DEFINE(TI_FLAGS, offsetof(struct thread_info, flags));
-        DEFINE(TI_LOCAL_FLAGS, offsetof(struct thread_info, flags));
+        DEFINE(TI_LOCAL_FLAGS, offsetof(struct thread_info, local_flags));
        DEFINE(TI_CPU, offsetof(struct thread_info, cpu));
        DEFINE(TI_PREEMPT, offsetof(struct thread_info, preempt_count));
diff --git a/arch/ppc/platforms/mpc8272ads_setup.c b/arch/ppc/platforms/mpc8272ads_setup.c
index e62b75707f7a..abb7154de2c7 100644
--- a/arch/ppc/platforms/mpc8272ads_setup.c
+++ b/arch/ppc/platforms/mpc8272ads_setup.c
@@ -279,11 +279,11 @@ static int mpc8272ads_platform_notify(struct device *dev)
        static const struct platform_notify_dev_map dev_map[] = {
                {
                        .bus_id = "fsl-cpm-fcc",
-                        .rtn = mpc8272ads_fixup_enet_pdata
+                        .rtn = mpc8272ads_fixup_enet_pdata,
                },
                {
                        .bus_id = "fsl-cpm-scc:uart",
-                        .rtn = mpc
+                        .rtn = mpc8272ads_fixup_uart_pdata,
                },
                {
                        .bus_id = NULL
@@ -335,15 +335,15 @@ struct platform_device* early_uart_get_pdev(int index)
        struct platform_device* pdev = NULL;
        if(index) { /*assume SCC4 here*/
                pdev = &ppc_sys_platform_devices[MPC82xx_CPM_SCC4];
-                pinfo = &mpc8272<F12>_uart_pdata[1];
+                pinfo = &mpc8272_uart_pdata[fsid_scc4_uart];
        } else { /*over SCC1*/
                pdev = &ppc_sys_platform_devices[MPC82xx_CPM_SCC1];
-                pinfo = &mpc8272_uart_pdata[0];
+                pinfo = &mpc8272_uart_pdata[fsid_scc1_uart];
        }
        pinfo->uart_clk = bd->bi_intfreq;
        pdev->dev.platform_data = pinfo;
-        ppc_sys_fixup_mem_resource(pdev, IMAP_ADDR);
+        ppc_sys_fixup_mem_resource(pdev, CPM_MAP_ADDR);
        return NULL;
 }
diff --git a/arch/ppc/syslib/pq2_devices.c b/arch/ppc/syslib/pq2_devices.c
index 0636aed7b827..8692d00c08c4 100644
--- a/arch/ppc/syslib/pq2_devices.c
+++ b/arch/ppc/syslib/pq2_devices.c
@@ -121,13 +121,13 @@ struct platform_device ppc_sys_platform_devices[] = {
                .num_resources   = 3,
                .resource = (struct resource[]) {
                        {
-                                .name   = "scc_mem",
+                                .name   = "regs",
                                .start  = 0x11A00,
                                .end    = 0x11A1F,
                                .flags  = IORESOURCE_MEM,
                        },
                        {
-                                .name   = "scc_pram",
+                                .name   = "pram",
                                .start  = 0x8000,
                                .end    = 0x80ff,
                                .flags  = IORESOURCE_MEM,
@@ -145,13 +145,13 @@ struct platform_device ppc_sys_platform_devices[] = {
                .num_resources   = 3,
                .resource = (struct resource[]) {
                        {
-                                .name   = "scc_mem",
+                                .name   = "regs",
                                .start  = 0x11A20,
                                .end    = 0x11A3F,
                                .flags  = IORESOURCE_MEM,
                        },
                        {
-                                .name   = "scc_pram",
+                                .name   = "pram",
                                .start  = 0x8100,
                                .end    = 0x81ff,
                                .flags  = IORESOURCE_MEM,
@@ -169,13 +169,13 @@ struct platform_device ppc_sys_platform_devices[] = {
                .num_resources   = 3,
                .resource = (struct resource[]) {
                        {
-                                .name   = "scc_mem",
+                                .name   = "regs",
                                .start  = 0x11A40,
                                .end    = 0x11A5F,
                                .flags  = IORESOURCE_MEM,
                        },
                        {
-                                .name   = "scc_pram",
+                                .name   = "pram",
                                .start  = 0x8200,
                                .end    = 0x82ff,
                                .flags  = IORESOURCE_MEM,
@@ -193,13 +193,13 @@ struct platform_device ppc_sys_platform_devices[] = {
                .num_resources   = 3,
                .resource = (struct resource[]) {
                        {
-                                .name   = "scc_mem",
+                                .name   = "regs",
                                .start  = 0x11A60,
                                .end    = 0x11A7F,
                                .flags  = IORESOURCE_MEM,
                        },
                        {
-                                .name   = "scc_pram",
+                                .name   = "pram",
                                .start  = 0x8300,
                                .end    = 0x83ff,
                                .flags  = IORESOURCE_MEM,
diff --git a/arch/ppc/syslib/pq2_sys.c b/arch/ppc/syslib/pq2_sys.c
index 433b0fa203e1..fee8948162b9 100644
--- a/arch/ppc/syslib/pq2_sys.c
+++ b/arch/ppc/syslib/pq2_sys.c
@@ -139,13 +139,13 @@ struct ppc_sys_spec ppc_sys_specs[] = {
                .ppc_sys_name   = "8272",
                .mask           = 0x0000ff00,
                .value          = 0x00000c00,
-                .num_devices    = 11,
+                .num_devices    = 12,
                .device_list = (enum ppc_sys_devices[])
                {
                        MPC82xx_CPM_FCC1, MPC82xx_CPM_FCC2, MPC82xx_CPM_SCC1,
-                        MPC82xx_CPM_SCC2, MPC82xx_CPM_SCC3, MPC82xx_CPM_SMC1,
+                        MPC82xx_CPM_SCC2, MPC82xx_CPM_SCC3, MPC82xx_CPM_SCC4,
-                        MPC82xx_CPM_SMC2, MPC82xx_CPM_SPI, MPC82xx_CPM_I2C,
+                        MPC82xx_CPM_SMC1, MPC82xx_CPM_SMC2, MPC82xx_CPM_SPI,
-                        MPC82xx_CPM_USB, MPC82xx_SEC1,
+                        MPC82xx_CPM_I2C, MPC82xx_CPM_USB, MPC82xx_SEC1,
                },
        },
        /* below is a list of the 8280 family of processors */
diff --git a/arch/sparc64/kernel/head.S b/arch/sparc64/kernel/head.S
index 3eadac5e171e..31c5892f5acc 100644
--- a/arch/sparc64/kernel/head.S
+++ b/arch/sparc64/kernel/head.S
@@ -10,6 +10,7 @@
 #include <linux/config.h>
 #include <linux/version.h>
 #include <linux/errno.h>
+#include <linux/threads.h>
 #include <asm/thread_info.h>
 #include <asm/asi.h>
 #include <asm/pstate.h>
@@ -493,6 +494,35 @@ tlb_fixup_done:
        call    prom_init
         mov    %l7, %o0                        ! OpenPROM cif handler
+        /* Initialize current_thread_info()->cpu as early as possible.
+         * In order to do that accurately we have to patch up the get_cpuid()
+         * assembler sequences.  And that, in turn, requires that we know
+         * if we are on a Starfire box or not.  While we're here, patch up
+         * the sun4v sequences as well.
+         */
+        call    check_if_starfire
+         nop
+        call    per_cpu_patch
+         nop
+        call    sun4v_patch
+         nop
+#ifdef CONFIG_SMP
+        call    hard_smp_processor_id
+         nop
+        cmp     %o0, NR_CPUS
+        blu,pt  %xcc, 1f
+         nop
+        call    boot_cpu_id_too_large
+         nop
+        /* Not reached... */
+1:
+#else
+        mov     0, %o0
+#endif
+        stb     %o0, [%g6 + TI_CPU]
        /* Off we go.... */
        call    start_kernel
         nop
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index 005167f82419..9cf1c88cd774 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -220,7 +220,7 @@ char reboot_command[COMMAND_LINE_SIZE];
 static struct pt_regs fake_swapper_regs = { { 0, }, 0, 0, 0, 0 };
-static void __init per_cpu_patch(void)
+void __init per_cpu_patch(void)
 {
        struct cpuid_patch_entry *p;
        unsigned long ver;
@@ -280,7 +280,7 @@ static void __init per_cpu_patch(void)
        }
 }
-static void __init sun4v_patch(void)
+void __init sun4v_patch(void)
 {
        struct sun4v_1insn_patch_entry *p1;
        struct sun4v_2insn_patch_entry *p2;
@@ -315,6 +315,15 @@ static void __init sun4v_patch(void)
        }
 }
+#ifdef CONFIG_SMP
+void __init boot_cpu_id_too_large(int cpu)
+{
+        prom_printf("Serious problem, boot cpu id (%d) >= NR_CPUS (%d)\n",
+                    cpu, NR_CPUS);
+        prom_halt();
+}
+#endif
 void __init setup_arch(char **cmdline_p)
 {
        /* Initialize PROM console and command line. */
@@ -332,16 +341,6 @@ void __init setup_arch(char **cmdline_p)
        conswitchp = &prom_con;
 #endif
-        /* Work out if we are starfire early on */
-        check_if_starfire();
-        /* Now we know enough to patch the get_cpuid sequences
-         * used by trap code.
-         */
-        per_cpu_patch();
-        sun4v_patch();
        boot_flags_init(*cmdline_p);
        idprom_init();
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 90eaca3ec9a6..4e8cd79156e0 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -1264,7 +1264,6 @@ void __init smp_tick_init(void)
        boot_cpu_id = hard_smp_processor_id();
        current_tick_offset = timer_tick_offset;
-        cpu_set(boot_cpu_id, cpu_online_map);
        prof_counter(boot_cpu_id) = prof_multiplier(boot_cpu_id) = 1;
 }
@@ -1345,18 +1344,6 @@ void __init smp_setup_cpu_possible_map(void)
 void __devinit smp_prepare_boot_cpu(void)
 {
-        int cpu = hard_smp_processor_id();
-        if (cpu >= NR_CPUS) {
-                prom_printf("Serious problem, boot cpu id >= NR_CPUS\n");
-                prom_halt();
-        }
-        current_thread_info()->cpu = cpu;
-        __local_per_cpu_offset = __per_cpu_offset(cpu);
-        cpu_set(smp_processor_id(), cpu_online_map);
-        cpu_set(smp_processor_id(), phys_cpu_present_map);
 }
 int __devinit __cpu_up(unsigned int cpu)
@@ -1433,4 +1420,7 @@ void __init setup_per_cpu_areas(void)
        for (i = 0; i < NR_CPUS; i++, ptr += size)
                memcpy(ptr, __per_cpu_start, __per_cpu_end - __per_cpu_start);
+        /* Setup %g5 for the boot cpu.  */
+        __local_per_cpu_offset = __per_cpu_offset(smp_processor_id());
 }
diff --git a/arch/sparc64/lib/checksum.S b/arch/sparc64/lib/checksum.S
index ba9cd3ccc2b2..1d230f693dc4 100644
--- a/arch/sparc64/lib/checksum.S
+++ b/arch/sparc64/lib/checksum.S
@@ -165,8 +165,9 @@ csum_partial_end_cruft:
        sll             %g1, 8, %g1
        or              %o5, %g1, %o4
-1:      add             %o2, %o4, %o2
+1:      addcc           %o2, %o4, %o2
+        addc            %g0, %o2, %o2
 csum_partial_finish:
        retl
-         mov            %o2, %o0
+         srl            %o2, 0, %o0
diff --git a/arch/sparc64/lib/csum_copy.S b/arch/sparc64/lib/csum_copy.S
index 71af48839064..e566c770a0f6 100644
--- a/arch/sparc64/lib/csum_copy.S
+++ b/arch/sparc64/lib/csum_copy.S
@@ -221,11 +221,12 @@ FUNC_NAME:		/* %o0=src, %o1=dst, %o2=len, %o3=sum */
        sll             %g1, 8, %g1
        or              %o5, %g1, %o4
-1:      add             %o3, %o4, %o3
+1:      addcc           %o3, %o4, %o3
+        addc            %g0, %o3, %o3
 70:
        retl
-         mov            %o3, %o0
+         srl            %o3, 0, %o0
 95:     mov             0, GLOBAL_SPARE
        brlez,pn        %o2, 4f
diff --git a/arch/um/Makefile-i386 b/arch/um/Makefile-i386
index 7a0e04e34bf9..b65ca115ef77 100644
--- a/arch/um/Makefile-i386
+++ b/arch/um/Makefile-i386
@@ -33,5 +33,9 @@ include $(srctree)/arch/i386/Makefile.cpu
 # prevent gcc from keeping the stack 16 byte aligned. Taken from i386.
 cflags-y += $(call cc-option,-mpreferred-stack-boundary=2)
+# Prevent sprintf in nfsd from being converted to strcpy and resulting in
+# an unresolved reference.
+cflags-y += -ffreestanding
 CFLAGS += $(cflags-y)
 USER_CFLAGS += $(cflags-y)
diff --git a/arch/um/include/kern_util.h b/arch/um/include/kern_util.h
index efa3d33c0be6..310980b32173 100644
--- a/arch/um/include/kern_util.h
+++ b/arch/um/include/kern_util.h
@@ -120,20 +120,11 @@ extern int is_syscall(unsigned long addr);
 extern void free_irq(unsigned int, void *);
 extern int cpu(void);
+extern void time_init_kern(void);
 /* Are we disallowed to sleep? Used to choose between GFP_KERNEL and GFP_ATOMIC. */
 extern int __cant_sleep(void);
 extern void segv_handler(int sig, union uml_pt_regs *regs);
 extern void sigio_handler(int sig, union uml_pt_regs *regs);
 #endif
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/time_kern.c b/arch/um/kernel/time_kern.c
index 528cf623f8b4..86f51d04c98d 100644
--- a/arch/um/kernel/time_kern.c
+++ b/arch/um/kernel/time_kern.c
@@ -84,6 +84,16 @@ void timer_irq(union uml_pt_regs *regs)
        }
 }
+void time_init_kern(void)
+{
+        unsigned long long nsecs;
+        nsecs = os_nsecs();
+        set_normalized_timespec(&wall_to_monotonic, -nsecs / BILLION,
+                                -nsecs % BILLION);
+}
 void do_boot_timer_handler(struct sigcontext * sc)
 {
        struct pt_regs regs;
diff --git a/arch/um/os-Linux/main.c b/arch/um/os-Linux/main.c
index 3a0ac38e978b..90912aaca7aa 100644
--- a/arch/um/os-Linux/main.c
+++ b/arch/um/os-Linux/main.c
@@ -59,7 +59,7 @@ static __init void do_uml_initcalls(void)
        initcall_t *call;
        call = &__uml_initcall_start;
-        while (call < &__uml_initcall_end){;
+        while (call < &__uml_initcall_end){
                (*call)();
                call++;
        }
diff --git a/arch/um/os-Linux/time.c b/arch/um/os-Linux/time.c
index 6f7626775acb..280c4fb9b585 100644
--- a/arch/um/os-Linux/time.c
+++ b/arch/um/os-Linux/time.c
@@ -81,20 +81,12 @@ void uml_idle_timer(void)
        set_interval(ITIMER_REAL);
 }
-extern void ktime_get_ts(struct timespec *ts);
-#define do_posix_clock_monotonic_gettime(ts) ktime_get_ts(ts)
 void time_init(void)
 {
-        struct timespec now;
        if(signal(SIGVTALRM, boot_timer_handler) == SIG_ERR)
                panic("Couldn't set SIGVTALRM handler");
        set_interval(ITIMER_VIRTUAL);
+        time_init_kern();
-        do_posix_clock_monotonic_gettime(&now);
-        wall_to_monotonic.tv_sec = -now.tv_sec;
-        wall_to_monotonic.tv_nsec = -now.tv_nsec;
 }
 unsigned long long os_nsecs(void)
diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
index 749dd1bfe60f..710d5fb807e1 100644
--- a/arch/um/sys-i386/syscalls.c
+++ b/arch/um/sys-i386/syscalls.c
@@ -99,11 +99,12 @@ long sys_ipc (uint call, int first, int second,
        switch (call) {
        case SEMOP:
-                return sys_semtimedop(first, (struct sembuf *) ptr, second,
+                return sys_semtimedop(first, (struct sembuf __user *) ptr,
-                                      NULL);
+                                      second, NULL);
        case SEMTIMEDOP:
-                return sys_semtimedop(first, (struct sembuf *) ptr, second,
+                return sys_semtimedop(first, (struct sembuf __user *) ptr,
-                                      (const struct timespec *) fifth);
+                                      second,
+                                      (const struct timespec __user *) fifth);
        case SEMGET:
                return sys_semget (first, second, third);
        case SEMCTL: {
diff --git a/arch/um/sys-x86_64/signal.c b/arch/um/sys-x86_64/signal.c
index a4c46a8af008..9edf114faf79 100644
--- a/arch/um/sys-x86_64/signal.c
+++ b/arch/um/sys-x86_64/signal.c
@@ -21,7 +21,7 @@
 #include "skas.h"
 static int copy_sc_from_user_skas(struct pt_regs *regs,
-                                 struct sigcontext *from)
+                                 struct sigcontext __user *from)
 {
       int err = 0;
@@ -54,7 +54,8 @@ static int copy_sc_from_user_skas(struct pt_regs *regs,
       return(err);
 }
-int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
+int copy_sc_to_user_skas(struct sigcontext __user *to,
+                         struct _fpstate __user *to_fp,
                         struct pt_regs *regs, unsigned long mask,
                         unsigned long sp)
 {
@@ -106,10 +107,11 @@ int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
 #endif
 #ifdef CONFIG_MODE_TT
-int copy_sc_from_user_tt(struct sigcontext *to, struct sigcontext *from,
+int copy_sc_from_user_tt(struct sigcontext *to, struct sigcontext __user *from,
                         int fpsize)
 {
-        struct _fpstate *to_fp, *from_fp;
+        struct _fpstate *to_fp;
+        struct _fpstate __user *from_fp;
        unsigned long sigs;
        int err;
@@ -124,13 +126,14 @@ int copy_sc_from_user_tt(struct sigcontext *to, struct sigcontext *from,
        return(err);
 }
-int copy_sc_to_user_tt(struct sigcontext *to, struct _fpstate *fp,
+int copy_sc_to_user_tt(struct sigcontext __user *to, struct _fpstate __user *fp,
                       struct sigcontext *from, int fpsize, unsigned long sp)
 {
-        struct _fpstate *to_fp, *from_fp;
+        struct _fpstate __user *to_fp;
+        struct _fpstate *from_fp;
        int err;
-        to_fp = (fp ? fp : (struct _fpstate *) (to + 1));
+        to_fp = (fp ? fp : (struct _fpstate __user *) (to + 1));
        from_fp = from->fpstate;
        err = copy_to_user(to, from, sizeof(*to));
        /* The SP in the sigcontext is the updated one for the signal
@@ -158,7 +161,8 @@ static int copy_sc_from_user(struct pt_regs *to, void __user *from)
       return(ret);
 }
-static int copy_sc_to_user(struct sigcontext *to, struct _fpstate *fp,
+static int copy_sc_to_user(struct sigcontext __user *to,
+                           struct _fpstate __user *fp,
                           struct pt_regs *from, unsigned long mask,
                           unsigned long sp)
 {
@@ -169,7 +173,7 @@ static int copy_sc_to_user(struct sigcontext *to, struct _fpstate *fp,
 struct rt_sigframe
 {
-       char *pretcode;
+       char __user *pretcode;
       struct ucontext uc;
       struct siginfo info;
 };
@@ -188,7 +192,7 @@ int setup_signal_stack_si(unsigned long stack_top, int sig,
        frame = (struct rt_sigframe __user *)
                round_down(stack_top - sizeof(struct rt_sigframe), 16) - 8;
-        frame = (struct rt_sigframe *) ((unsigned long) frame - 128);
+        frame = (struct rt_sigframe __user *) ((unsigned long) frame - 128);
        if (!access_ok(VERIFY_WRITE, fp, sizeof(struct _fpstate)))
                goto out;
diff --git a/arch/um/sys-x86_64/syscalls.c b/arch/um/sys-x86_64/syscalls.c
index 6acee5c4ada6..6fce9f45dfdc 100644
--- a/arch/um/sys-x86_64/syscalls.c
+++ b/arch/um/sys-x86_64/syscalls.c
@@ -45,7 +45,7 @@ static long arch_prctl_tt(int code, unsigned long addr)
        case ARCH_GET_GS:
                ret = arch_prctl(code, (unsigned long) &tmp);
                if(!ret)
-                        ret = put_user(tmp, &addr);
+                        ret = put_user(tmp, (long __user *)addr);
                break;
        default:
                ret = -EINVAL;
diff --git a/arch/x86_64/ia32/ia32_binfmt.c b/arch/x86_64/ia32/ia32_binfmt.c
index e776139afb20..926c4743d13b 100644
--- a/arch/x86_64/ia32/ia32_binfmt.c
+++ b/arch/x86_64/ia32/ia32_binfmt.c
@@ -339,7 +339,7 @@ int ia32_setup_arg_pages(struct linux_binprm *bprm, unsigned long stack_top,
        struct mm_struct *mm = current->mm;
        int i, ret;
-        stack_base = IA32_STACK_TOP - MAX_ARG_PAGES * PAGE_SIZE;
+        stack_base = stack_top - MAX_ARG_PAGES * PAGE_SIZE;
        mm->arg_start = bprm->p + stack_base;
        bprm->p += stack_base;
@@ -357,7 +357,7 @@ int ia32_setup_arg_pages(struct linux_binprm *bprm, unsigned long stack_top,
        {
                mpnt->vm_mm = mm;
                mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
-                mpnt->vm_end = IA32_STACK_TOP;
+                mpnt->vm_end = stack_top;
                if (executable_stack == EXSTACK_ENABLE_X)
                        mpnt->vm_flags = VM_STACK_FLAGS |  VM_EXEC;
                else if (executable_stack == EXSTACK_DISABLE_X)
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 222b5b46d2b2..1ef6028f721e 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -149,7 +149,7 @@ unsigned long __init find_e820_area(unsigned long start, unsigned long end, unsi
                        addr = start;
                if (addr > ei->addr + ei->size) 
                        continue; 
-                while (bad_addr(&addr, size) && addr+size < ei->addr + ei->size)
+                while (bad_addr(&addr, size) && addr+size <= ei->addr+ei->size)
                        ;
                last = addr + size;
                if (last > ei->addr + ei->size)
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index c946e4fe67a7..586b34c00c48 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -281,12 +281,7 @@ tracesys:
        ja  1f
        movq %r10,%rcx  /* fixup for C */
        call *sys_call_table(,%rax,8)
-        movq %rax,RAX-ARGOFFSET(%rsp)
+1:      movq %rax,RAX-ARGOFFSET(%rsp)
-1:      SAVE_REST
-        movq %rsp,%rdi
-        call syscall_trace_leave
-        RESTORE_TOP_OF_STACK %rbx
-        RESTORE_REST
        /* Use IRET because user could have changed frame */
        jmp int_ret_from_sys_call
        CFI_ENDPROC
diff --git a/arch/x86_64/kernel/pci-dma.c b/arch/x86_64/kernel/pci-dma.c
index af035ede70cd..a9275c9557cf 100644
--- a/arch/x86_64/kernel/pci-dma.c
+++ b/arch/x86_64/kernel/pci-dma.c
@@ -54,6 +54,10 @@ dma_alloc_pages(struct device *dev, gfp_t gfp, unsigned order)
        else
 #endif
                node = numa_node_id();
+        if (node < first_node(node_online_map))
+                node = first_node(node_online_map);
        page = alloc_pages_node(node, gfp, order);
        return page ? page_address(page) : NULL;
 }
diff --git a/arch/x86_64/kernel/pci-gart.c b/arch/x86_64/kernel/pci-gart.c
index 2480d3f08a47..82a7c9bfdfa0 100644
--- a/arch/x86_64/kernel/pci-gart.c
+++ b/arch/x86_64/kernel/pci-gart.c
@@ -631,10 +631,8 @@ static int __init pci_iommu_init(void)
                printk(KERN_INFO "PCI-DMA: Disabling IOMMU.\n");
                if (end_pfn > MAX_DMA32_PFN) {
                        printk(KERN_ERR "WARNING more than 4GB of memory "
-                                        "but IOMMU not compiled in.\n"
+                                        "but IOMMU not available.\n"
-                               KERN_ERR "WARNING 32bit PCI may malfunction.\n"
+                               KERN_ERR "WARNING 32bit PCI may malfunction.\n");
-                               KERN_ERR "You might want to enable "
-                                        "CONFIG_GART_IOMMU\n");
                }
                return -1;
        }
diff --git a/arch/x86_64/kernel/pmtimer.c b/arch/x86_64/kernel/pmtimer.c
index b0444a415bd6..bf421ed26808 100644
--- a/arch/x86_64/kernel/pmtimer.c
+++ b/arch/x86_64/kernel/pmtimer.c
@@ -68,7 +68,7 @@ int pmtimer_mark_offset(void)
        offset_delay = delta % (USEC_PER_SEC / HZ);
        rdtscll(tsc);
-        vxtime.last_tsc = tsc - offset_delay * cpu_khz;
+        vxtime.last_tsc = tsc - offset_delay * (u64)cpu_khz / 1000;
        /* don't calculate delay for first run,
           or if we've got less then a tick */
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index f0870bef24d1..655b9192eeb3 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -1051,7 +1051,7 @@ static void srat_detect_node(void)
           for now. */
        node = apicid_to_node[hard_smp_processor_id()];
        if (node == NUMA_NO_NODE)
-                node = 0;
+                node = first_node(node_online_map);
        numa_set_node(cpu, node);
        if (acpi_numa > 0)
diff --git a/arch/x86_64/mm/srat.c b/arch/x86_64/mm/srat.c
index e1513532df29..474df22c6ed2 100644
--- a/arch/x86_64/mm/srat.c
+++ b/arch/x86_64/mm/srat.c
@@ -399,8 +399,10 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
        /* First clean up the node list */
        for (i = 0; i < MAX_NUMNODES; i++) {
                cutoff_node(i, start, end);
-                if ((nodes[i].end - nodes[i].start) < NODE_MIN_SIZE)
+                if ((nodes[i].end - nodes[i].start) < NODE_MIN_SIZE) {
                        unparse_node(i);
+                        node_set_offline(i);
+                }
        }
        if (acpi_numa <= 0)
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index 2540dfaa3e38..8e9d84825e1c 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -33,7 +33,7 @@ static int cfq_slice_idle = HZ / 70;
 #define CFQ_KEY_ASYNC           (0)
-static DEFINE_RWLOCK(cfq_exit_lock);
+static DEFINE_SPINLOCK(cfq_exit_lock);
 /*
 * for the hash of cfqq inside the cfqd
@@ -133,6 +133,7 @@ struct cfq_data {
        mempool_t *crq_pool;
        int rq_in_driver;
+        int hw_tag;
        /*
         * schedule slice state info
@@ -500,10 +501,13 @@ static void cfq_resort_rr_list(struct cfq_queue *cfqq, int preempted)
        /*
         * if queue was preempted, just add to front to be fair. busy_rr
-         * isn't sorted.
+         * isn't sorted, but insert at the back for fairness.
         */
        if (preempted || list == &cfqd->busy_rr) {
-                list_add(&cfqq->cfq_list, list);
+                if (preempted)
+                        list = list->prev;
+                list_add_tail(&cfqq->cfq_list, list);
                return;
        }
@@ -664,6 +668,15 @@ static void cfq_activate_request(request_queue_t *q, struct request *rq)
        struct cfq_data *cfqd = q->elevator->elevator_data;
        cfqd->rq_in_driver++;
+        /*
+         * If the depth is larger 1, it really could be queueing. But lets
+         * make the mark a little higher - idling could still be good for
+         * low queueing, and a low queueing number could also just indicate
+         * a SCSI mid layer like behaviour where limit+1 is often seen.
+         */
+        if (!cfqd->hw_tag && cfqd->rq_in_driver > 4)
+                cfqd->hw_tag = 1;
 }
 static void cfq_deactivate_request(request_queue_t *q, struct request *rq)
@@ -879,6 +892,13 @@ static struct cfq_queue *cfq_set_active_queue(struct cfq_data *cfqd)
                cfqq = list_entry_cfqq(cfqd->cur_rr.next);
        /*
+         * If no new queues are available, check if the busy list has some
+         * before falling back to idle io.
+         */
+        if (!cfqq && !list_empty(&cfqd->busy_rr))
+                cfqq = list_entry_cfqq(cfqd->busy_rr.next);
+        /*
         * if we have idle queues and no rt or be queues had pending
         * requests, either allow immediate service if the grace period
         * has passed or arm the idle grace timer
@@ -1284,7 +1304,7 @@ static void cfq_exit_io_context(struct io_context *ioc)
        /*
         * put the reference this task is holding to the various queues
         */
-        read_lock_irqsave(&cfq_exit_lock, flags);
+        spin_lock_irqsave(&cfq_exit_lock, flags);
        n = rb_first(&ioc->cic_root);
        while (n != NULL) {
@@ -1294,7 +1314,7 @@ static void cfq_exit_io_context(struct io_context *ioc)
                n = rb_next(n);
        }
-        read_unlock_irqrestore(&cfq_exit_lock, flags);
+        spin_unlock_irqrestore(&cfq_exit_lock, flags);
 }
 static struct cfq_io_context *
@@ -1400,17 +1420,17 @@ static int cfq_ioc_set_ioprio(struct io_context *ioc, unsigned int ioprio)
        struct cfq_io_context *cic;
        struct rb_node *n;
-        write_lock(&cfq_exit_lock);
+        spin_lock(&cfq_exit_lock);
        n = rb_first(&ioc->cic_root);
        while (n != NULL) {
                cic = rb_entry(n, struct cfq_io_context, rb_node);
- 
                changed_ioprio(cic);
                n = rb_next(n);
        }
-        write_unlock(&cfq_exit_lock);
+        spin_unlock(&cfq_exit_lock);
        return 0;
 }
@@ -1458,7 +1478,8 @@ retry:
                 * set ->slice_left to allow preemption for a new process
                 */
                cfqq->slice_left = 2 * cfqd->cfq_slice_idle;
-                cfq_mark_cfqq_idle_window(cfqq);
+                if (!cfqd->hw_tag)
+                        cfq_mark_cfqq_idle_window(cfqq);
                cfq_mark_cfqq_prio_changed(cfqq);
                cfq_init_prio_data(cfqq);
        }
@@ -1475,9 +1496,10 @@ out:
 static void
 cfq_drop_dead_cic(struct io_context *ioc, struct cfq_io_context *cic)
 {
-        read_lock(&cfq_exit_lock);
+        spin_lock(&cfq_exit_lock);
        rb_erase(&cic->rb_node, &ioc->cic_root);
-        read_unlock(&cfq_exit_lock);
+        list_del_init(&cic->queue_list);
+        spin_unlock(&cfq_exit_lock);
        kmem_cache_free(cfq_ioc_pool, cic);
        atomic_dec(&ioc_count);
 }
@@ -1545,11 +1567,11 @@ restart:
                        BUG();
        }
-        read_lock(&cfq_exit_lock);
+        spin_lock(&cfq_exit_lock);
        rb_link_node(&cic->rb_node, parent, p);
        rb_insert_color(&cic->rb_node, &ioc->cic_root);
        list_add(&cic->queue_list, &cfqd->cic_list);
-        read_unlock(&cfq_exit_lock);
+        spin_unlock(&cfq_exit_lock);
 }
 /*
@@ -1648,7 +1670,7 @@ cfq_update_idle_window(struct cfq_data *cfqd, struct cfq_queue *cfqq,
 {
        int enable_idle = cfq_cfqq_idle_window(cfqq);
-        if (!cic->ioc->task || !cfqd->cfq_slice_idle)
+        if (!cic->ioc->task || !cfqd->cfq_slice_idle || cfqd->hw_tag)
                enable_idle = 0;
        else if (sample_valid(cic->ttime_samples)) {
                if (cic->ttime_mean > cfqd->cfq_slice_idle)
@@ -1739,14 +1761,24 @@ cfq_crq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
        cfqq->next_crq = cfq_choose_req(cfqd, cfqq->next_crq, crq);
+        cic = crq->io_context;
        /*
         * we never wait for an async request and we don't allow preemption
         * of an async request. so just return early
         */
-        if (!cfq_crq_is_sync(crq))
+        if (!cfq_crq_is_sync(crq)) {
+                /*
+                 * sync process issued an async request, if it's waiting
+                 * then expire it and kick rq handling.
+                 */
+                if (cic == cfqd->active_cic &&
+                    del_timer(&cfqd->idle_slice_timer)) {
+                        cfq_slice_expired(cfqd, 0);
+                        cfq_start_queueing(cfqd, cfqq);
+                }
                return;
+        }
-        cic = crq->io_context;
        cfq_update_io_thinktime(cfqd, cic);
        cfq_update_io_seektime(cfqd, cic, crq);
@@ -2164,10 +2196,9 @@ static void cfq_idle_class_timer(unsigned long data)
         * race with a non-idle queue, reset timer
         */
        end = cfqd->last_end_request + CFQ_IDLE_GRACE;
-        if (!time_after_eq(jiffies, end)) {
+        if (!time_after_eq(jiffies, end))
-                cfqd->idle_class_timer.expires = end;
+                mod_timer(&cfqd->idle_class_timer, end);
-                add_timer(&cfqd->idle_class_timer);
+        else
-        } else
                cfq_schedule_dispatch(cfqd);
        spin_unlock_irqrestore(cfqd->queue->queue_lock, flags);
@@ -2187,7 +2218,7 @@ static void cfq_exit_queue(elevator_t *e)
        cfq_shutdown_timer_wq(cfqd);
-        write_lock(&cfq_exit_lock);
+        spin_lock(&cfq_exit_lock);
        spin_lock_irq(q->queue_lock);
        if (cfqd->active_queue)
@@ -2210,7 +2241,7 @@ static void cfq_exit_queue(elevator_t *e)
        }
        spin_unlock_irq(q->queue_lock);
-        write_unlock(&cfq_exit_lock);
+        spin_unlock(&cfq_exit_lock);
        cfq_shutdown_timer_wq(cfqd);
diff --git a/drivers/base/power/suspend.c b/drivers/base/power/suspend.c
index 662209d3f42d..2a769cc6f5f9 100644
--- a/drivers/base/power/suspend.c
+++ b/drivers/base/power/suspend.c
@@ -8,7 +8,6 @@
 *
 */
-#include <linux/vt_kern.h>
 #include <linux/device.h>
 #include <linux/kallsyms.h>
 #include <linux/pm.h>
@@ -66,6 +65,7 @@ int suspend_device(struct device * dev, pm_message_t state)
        return error;
 }
 /**
 *      device_suspend - Save state and stop all devices in system.
 *      @state:         Power state to put each device in.
@@ -85,9 +85,6 @@ int device_suspend(pm_message_t state)
 {
        int error = 0;
-        if (!is_console_suspend_safe())
-                return -EINVAL;
        down(&dpm_sem);
        down(&dpm_list_sem);
        while (!list_empty(&dpm_active) && error == 0) {
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 0b9cf9c59a21..7c88c060a9e6 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -86,7 +86,7 @@ config AGP_NVIDIA
 config AGP_SIS
        tristate "SiS chipset support"
-        depends on AGP && X86_32
+        depends on AGP
        help
          This option gives you AGP support for the GLX component of
          X on Silicon Integrated Systems [SiS] chipsets.
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 36517d4d1ad9..ac3c33a2e37d 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -617,6 +617,9 @@ static int agp_amd64_resume(struct pci_dev *pdev)
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
+        if (pdev->vendor == PCI_VENDOR_ID_NVIDIA)
+                nforce3_agp_init(pdev);
        return amd_8151_configure();
 }
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 97b0a890ba7f..b8ec25d17478 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -345,6 +345,12 @@ static struct agp_device_ids via_agp_device_ids[] __devinitdata =
                .chipset_name   = "PT880",
        },
+        /* PT880 Ultra */
+        {
+                .device_id      = PCI_DEVICE_ID_VIA_PT880ULTRA,
+                .chipset_name   = "PT880 Ultra",
+        },
        /* PT890 */
        {
                .device_id      = PCI_DEVICE_ID_VIA_8783_0,
@@ -511,6 +517,7 @@ static struct pci_device_id agp_via_pci_table[] = {
        ID(PCI_DEVICE_ID_VIA_8763_0),
        ID(PCI_DEVICE_ID_VIA_8378_0),
        ID(PCI_DEVICE_ID_VIA_PT880),
+        ID(PCI_DEVICE_ID_VIA_PT880ULTRA),
        ID(PCI_DEVICE_ID_VIA_8783_0),
        ID(PCI_DEVICE_ID_VIA_PX8X0_0),
        ID(PCI_DEVICE_ID_VIA_3269_0),
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index b36eef0e9d19..02a7dd7a8a55 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1184,20 +1184,20 @@ static void port_outl(struct si_sm_io *io, unsigned int offset,
 static void port_cleanup(struct smi_info *info)
 {
        unsigned int addr = info->io.addr_data;
-        int          mapsize;
+        int          idx;
        if (addr) {
-                mapsize = ((info->io_size * info->io.regspacing)
+                for (idx = 0; idx < info->io_size; idx++) {
-                           - (info->io.regspacing - info->io.regsize));
+                        release_region(addr + idx * info->io.regspacing,
+                                       info->io.regsize);
-                release_region (addr, mapsize);
+                }
        }
 }
 static int port_setup(struct smi_info *info)
 {
        unsigned int addr = info->io.addr_data;
-        int          mapsize;
+        int          idx;
        if (!addr)
                return -ENODEV;
@@ -1225,16 +1225,22 @@ static int port_setup(struct smi_info *info)
                return -EINVAL;
        }
-        /* Calculate the total amount of memory to claim.  This is an
+        /* Some BIOSes reserve disjoint I/O regions in their ACPI
-         * unusual looking calculation, but it avoids claiming any
+         * tables.  This causes problems when trying to register the
-         * more memory than it has to.  It will claim everything
+         * entire I/O region.  Therefore we must register each I/O
-         * between the first address to the end of the last full
+         * port separately.
-         * register. */
+         */
-        mapsize = ((info->io_size * info->io.regspacing)
+        for (idx = 0; idx < info->io_size; idx++) {
-                   - (info->io.regspacing - info->io.regsize));
+                if (request_region(addr + idx * info->io.regspacing,
+                                   info->io.regsize, DEVICE_NAME) == NULL) {
-        if (request_region(addr, mapsize, DEVICE_NAME) == NULL)
+                        /* Undo allocations */
-                return -EIO;
+                        while (idx--) {
+                                release_region(addr + idx * info->io.regspacing,
+                                               info->io.regsize);
+                        }
+                        return -EIO;
+                }
+        }
        return 0;
 }
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 128b2632512d..eab5394da666 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -149,7 +149,7 @@ struct cm4000_dev {
 #define ZERO_DEV(dev)                                           \
        memset(&dev->atr_csum,0,                                \
                sizeof(struct cm4000_dev) -                     \
-                /*link*/ sizeof(struct pcmcia_device) -         \
+                /*link*/ sizeof(struct pcmcia_device *) -       \
                /*node*/ sizeof(dev_node_t) -                   \
                /*atr*/ MAX_ATR*sizeof(char) -                  \
                /*rbuf*/ 512*sizeof(char) -                     \
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index e45f0d3d12de..a611972024e6 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -105,6 +105,12 @@ static const char* tcpa_event_type_strings[] = {
        "Non-Host Info"
 };
+struct tcpa_pc_event {
+        u32 event_id;
+        u32 event_size;
+        u8 event_data[0];
+};
 enum tcpa_pc_event_ids {
        SMBIOS = 1,
        BIS_CERT,
@@ -114,14 +120,15 @@ enum tcpa_pc_event_ids {
        NVRAM,
        OPTION_ROM_EXEC,
        OPTION_ROM_CONFIG,
-        OPTION_ROM_MICROCODE,
+        OPTION_ROM_MICROCODE = 10,
        S_CRTM_VERSION,
        S_CRTM_CONTENTS,
        POST_CONTENTS,
+        HOST_TABLE_OF_DEVICES,
 };
 static const char* tcpa_pc_event_id_strings[] = {
-        ""
+        "",
        "SMBIOS",
        "BIS Certificate",
        "POST BIOS ",
@@ -130,11 +137,12 @@ static const char* tcpa_pc_event_id_strings[] = {
        "NVRAM",
        "Option ROM",
        "Option ROM config",
-        "Option ROM microcode",
+        "",
+        "Option ROM microcode ",
        "S-CRTM Version",
-        "S-CRTM Contents",
+        "S-CRTM Contents ",
-        "S-CRTM POST Contents",
+        "POST Contents ",
-        "POST Contents",
+        "Table of Devices",
 };
 /* returns pointer to start of pos. entry of tcg log */
@@ -206,7 +214,7 @@ static int get_event_name(char *dest, struct tcpa_event *event,
        const char *name = "";
        char data[40] = "";
        int i, n_len = 0, d_len = 0;
-        u32 event_id;
+        struct tcpa_pc_event *pc_event;
        switch(event->event_type) {
        case PREBOOT:
@@ -235,31 +243,32 @@ static int get_event_name(char *dest, struct tcpa_event *event,
                }
                break;
        case EVENT_TAG:
-                event_id = be32_to_cpu(*((u32 *)event_entry));
+                pc_event = (struct tcpa_pc_event *)event_entry;
                /* ToDo Row data -> Base64 */
-                switch (event_id) {
+                switch (pc_event->event_id) {
                case SMBIOS:
                case BIS_CERT:
                case CMOS:
                case NVRAM:
                case OPTION_ROM_EXEC:
                case OPTION_ROM_CONFIG:
-                case OPTION_ROM_MICROCODE:
                case S_CRTM_VERSION:
-                case S_CRTM_CONTENTS:
+                        name = tcpa_pc_event_id_strings[pc_event->event_id];
-                case POST_CONTENTS:
-                        name = tcpa_pc_event_id_strings[event_id];
                        n_len = strlen(name);
                        break;
+                /* hash data */
                case POST_BIOS_ROM:
                case ESCD:
-                        name = tcpa_pc_event_id_strings[event_id];
+                case OPTION_ROM_MICROCODE:
+                case S_CRTM_CONTENTS:
+                case POST_CONTENTS:
+                        name = tcpa_pc_event_id_strings[pc_event->event_id];
                        n_len = strlen(name);
                        for (i = 0; i < 20; i++)
-                                d_len += sprintf(data, "%02x",
+                                d_len += sprintf(&data[2*i], "%02x",
-                                                event_entry[8 + i]);
+                                                pc_event->event_data[i]);
                        break;
                default:
                        break;
@@ -275,53 +284,13 @@ static int get_event_name(char *dest, struct tcpa_event *event,
 static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
 {
+        struct tcpa_event *event = v;
+        char *data = v;
+        int i;
-        char *eventname;
+        for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
-        char data[4];
-        u32 help;
-        int i, len;
-        struct tcpa_event *event = (struct tcpa_event *) v;
-        unsigned char *event_entry =
-            (unsigned char *) (v + sizeof(struct tcpa_event));
-        eventname = kmalloc(MAX_TEXT_EVENT, GFP_KERNEL);
-        if (!eventname) {
-                printk(KERN_ERR "%s: ERROR - No Memory for event name\n ",
-                       __func__);
-                return -ENOMEM;
-        }
-        /* 1st: PCR used is in little-endian format (4 bytes) */
-        help = le32_to_cpu(event->pcr_index);
-        memcpy(data, &help, 4);
-        for (i = 0; i < 4; i++)
-                seq_putc(m, data[i]);
-        /* 2nd: SHA1 (20 bytes) */
-        for (i = 0; i < 20; i++)
-                seq_putc(m, event->pcr_value[i]);
-        /* 3rd: event type identifier (4 bytes) */
-        help = le32_to_cpu(event->event_type);
-        memcpy(data, &help, 4);
-        for (i = 0; i < 4; i++)
                seq_putc(m, data[i]);
-        len = 0;
-        len += get_event_name(eventname, event, event_entry);
-        /* 4th:  filename <= 255 + \'0' delimiter */
-        if (len > TCG_EVENT_NAME_LEN_MAX)
-                len = TCG_EVENT_NAME_LEN_MAX;
-        for (i = 0; i < len; i++)
-                seq_putc(m, eventname[i]);
-        /* 5th: delimiter */
-        seq_putc(m, '\0');
-        kfree(eventname);
        return 0;
 }
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index acc5d47844eb..6c94879e0b99 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -3238,14 +3238,6 @@ void vcs_scr_writew(struct vc_data *vc, u16 val, u16 *org)
        }
 }
-int is_console_suspend_safe(void)
-{
-        /* It is unsafe to suspend devices while X has control of the
-         * hardware. Make sure we are running on a kernel-controlled console.
-         */
-        return vc_cons[fg_console].d->vc_mode == KD_TEXT;
-}
 /*
 *      Visible symbols for modules
 */
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index 43b96e298363..27c9eb989a9a 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -345,17 +345,17 @@ sgiioc4_resetproc(ide_drive_t * drive)
 static u8
 sgiioc4_INB(unsigned long port)
 {
-        u8 reg = (u8) inb(port);
+        u8 reg = (u8) readb((void __iomem *) port);
        if ((port & 0xFFF) == 0x11C) {  /* Status register of IOC4 */
                if (reg & 0x51) {       /* Not busy...check for interrupt */
                        unsigned long other_ir = port - 0x110;
-                        unsigned int intr_reg = (u32) inl(other_ir);
+                        unsigned int intr_reg = (u32) readl((void __iomem *) other_ir);
                        /* Clear the Interrupt, Error bits on the IOC4 */
                        if (intr_reg & 0x03) {
-                                outl(0x03, other_ir);
+                                writel(0x03, (void __iomem *) other_ir);
-                                intr_reg = (u32) inl(other_ir);
+                                intr_reg = (u32) readl((void __iomem *) other_ir);
                        }
                }
        }
@@ -606,6 +606,12 @@ ide_init_sgiioc4(ide_hwif_t * hwif)
        hwif->ide_dma_host_off = &sgiioc4_ide_dma_host_off;
        hwif->ide_dma_lostirq = &sgiioc4_ide_dma_lostirq;
        hwif->ide_dma_timeout = &__ide_dma_timeout;
+        /*
+         * The IOC4 uses MMIO rather than Port IO.
+         * It also needs special workarounds for INB.
+         */
+        default_hwif_mmiops(hwif);
        hwif->INB = &sgiioc4_INB;
 }
@@ -743,6 +749,6 @@ ioc4_ide_exit(void)
 module_init(ioc4_ide_init);
 module_exit(ioc4_ide_exit);
-MODULE_AUTHOR("Aniket Malatpure - Silicon Graphics Inc. (SGI)");
+MODULE_AUTHOR("Aniket Malatpure/Jeremy Higdon");
 MODULE_DESCRIPTION("IDE PCI driver module for SGI IOC4 Base-IO Card");
 MODULE_LICENSE("GPL");
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 8a23fb54c693..5413dc43b9f1 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -845,7 +845,7 @@ static struct scsi_id_instance_data *sbp2_alloc_device(struct unit_directory *ud
                        &sbp2_highlevel, ud->ne->host, &sbp2_ops,
                        sizeof(struct sbp2_status_block), sizeof(quadlet_t),
                        0x010000000000ULL, CSR1212_ALL_SPACE_END);
-        if (!scsi_id->status_fifo_addr) {
+        if (scsi_id->status_fifo_addr == ~0ULL) {
                SBP2_ERR("failed to allocate status FIFO address range");
                goto failed_alloc;
        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index a54da42849ae..8406839b91cf 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -275,6 +275,7 @@ static void ipoib_ib_handle_wc(struct net_device *dev,
                spin_lock_irqsave(&priv->tx_lock, flags);
                ++priv->tx_tail;
                if (netif_queue_stopped(dev) &&
+                    test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags) &&
                    priv->tx_head - priv->tx_tail <= ipoib_sendq_size >> 1)
                        netif_wake_queue(dev);
                spin_unlock_irqrestore(&priv->tx_lock, flags);
diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 2b2ec1057dee..95c0de7964a0 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -589,7 +589,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
        struct sw *sw;
        struct input_dev *input_dev;
        int i, j, k, l;
-        int err;
+        int err = 0;
        unsigned char *buf = NULL;      /* [SW_LENGTH] */
        unsigned char *idbuf = NULL;    /* [SW_LENGTH] */
        unsigned char m = 1;
@@ -776,7 +776,10 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
                        goto fail4;
        }
-        return 0;
+ out:   kfree(buf);
+        kfree(idbuf);
+        return err;
 fail4: input_free_device(sw->dev[i]);
 fail3: while (--i >= 0)
@@ -784,9 +787,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
 fail2: gameport_close(gameport);
 fail1: gameport_set_drvdata(gameport, NULL);
        kfree(sw);
-        kfree(buf);
+        goto out;
-        kfree(idbuf);
-        return err;
 }
 static void sw_disconnect(struct gameport *gameport)
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
index 96c6bf77248a..1f0e720267d7 100644
--- a/drivers/input/keyboard/corgikbd.c
+++ b/drivers/input/keyboard/corgikbd.c
@@ -245,9 +245,9 @@ static void corgikbd_hinge_timer(unsigned long data)
                if (hinge_count >= HINGE_STABLE_COUNT) {
                        spin_lock_irqsave(&corgikbd_data->lock, flags);
-                        input_report_switch(corgikbd_data->input, SW_0, ((sharpsl_hinge_state & CORGI_SCP_SWA) != 0));
+                        input_report_switch(corgikbd_data->input, SW_LID, ((sharpsl_hinge_state & CORGI_SCP_SWA) != 0));
-                        input_report_switch(corgikbd_data->input, SW_1, ((sharpsl_hinge_state & CORGI_SCP_SWB) != 0));
+                        input_report_switch(corgikbd_data->input, SW_TABLET_MODE, ((sharpsl_hinge_state & CORGI_SCP_SWB) != 0));
-                        input_report_switch(corgikbd_data->input, SW_2, (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0));
+                        input_report_switch(corgikbd_data->input, SW_HEADPHONE_INSERT, (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0));
                        input_sync(corgikbd_data->input);
                        spin_unlock_irqrestore(&corgikbd_data->lock, flags);
@@ -340,9 +340,9 @@ static int __init corgikbd_probe(struct platform_device *pdev)
        for (i = 0; i < ARRAY_SIZE(corgikbd_keycode); i++)
                set_bit(corgikbd->keycode[i], input_dev->keybit);
        clear_bit(0, input_dev->keybit);
-        set_bit(SW_0, input_dev->swbit);
+        set_bit(SW_LID, input_dev->swbit);
-        set_bit(SW_1, input_dev->swbit);
+        set_bit(SW_TABLET_MODE, input_dev->swbit);
-        set_bit(SW_2, input_dev->swbit);
+        set_bit(SW_HEADPHONE_INSERT, input_dev->swbit);
        input_register_device(corgikbd->input);
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index 1d238a9d52d6..c5d03fb77bcb 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -299,9 +299,9 @@ static void spitzkbd_hinge_timer(unsigned long data)
        if (hinge_count >= HINGE_STABLE_COUNT) {
                spin_lock_irqsave(&spitzkbd_data->lock, flags);
-                input_report_switch(spitzkbd_data->input, SW_0, ((GPLR(SPITZ_GPIO_SWA) & GPIO_bit(SPITZ_GPIO_SWA)) != 0));
+                input_report_switch(spitzkbd_data->input, SW_LID, ((GPLR(SPITZ_GPIO_SWA) & GPIO_bit(SPITZ_GPIO_SWA)) != 0));
-                input_report_switch(spitzkbd_data->input, SW_1, ((GPLR(SPITZ_GPIO_SWB) & GPIO_bit(SPITZ_GPIO_SWB)) != 0));
+                input_report_switch(spitzkbd_data->input, SW_TABLET_MODE, ((GPLR(SPITZ_GPIO_SWB) & GPIO_bit(SPITZ_GPIO_SWB)) != 0));
-                input_report_switch(spitzkbd_data->input, SW_2, ((GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT)) != 0));
+                input_report_switch(spitzkbd_data->input, SW_HEADPHONE_INSERT, ((GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT)) != 0));
                input_sync(spitzkbd_data->input);
                spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
@@ -398,9 +398,9 @@ static int __init spitzkbd_probe(struct platform_device *dev)
        for (i = 0; i < ARRAY_SIZE(spitzkbd_keycode); i++)
                set_bit(spitzkbd->keycode[i], input_dev->keybit);
        clear_bit(0, input_dev->keybit);
-        set_bit(SW_0, input_dev->swbit);
+        set_bit(SW_LID, input_dev->swbit);
-        set_bit(SW_1, input_dev->swbit);
+        set_bit(SW_TABLET_MODE, input_dev->swbit);
-        set_bit(SW_2, input_dev->swbit);
+        set_bit(SW_HEADPHONE_INSERT, input_dev->swbit);
        input_register_device(input_dev);
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 36cd2e07fce8..e4e5be111c96 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -318,6 +318,16 @@ static struct key_entry keymap_acer_travelmate_240[] = {
        { KE_END, 0 }
 };
+static struct key_entry keymap_aopen_1559as[] = {
+        { KE_KEY,  0x01, KEY_HELP },
+        { KE_KEY,  0x06, KEY_PROG3 },
+        { KE_KEY,  0x11, KEY_PROG1 },
+        { KE_KEY,  0x12, KEY_PROG2 },
+        { KE_WIFI, 0x30, 0 },
+        { KE_KEY,  0x31, KEY_MAIL },
+        { KE_KEY,  0x36, KEY_WWW },
+};
 /*
 * If your machine is not here (which is currently rather likely), please send
 * a list of buttons and their key codes (reported when loading this module
@@ -369,6 +379,15 @@ static struct dmi_system_id dmi_ids[] = {
                },
                .driver_data = keymap_acer_travelmate_240
        },
+        {
+                .callback = dmi_matched,
+                .ident = "AOpen 1559AS",
+                .matches = {
+                        DMI_MATCH(DMI_PRODUCT_NAME, "E2U"),
+                        DMI_MATCH(DMI_BOARD_NAME, "E2U"),
+                },
+                .driver_data = keymap_aopen_1559as
+        },
        { NULL, }
 };
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 2141501e9f2e..a0e2e797c6d5 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -100,8 +100,8 @@ static void alps_process_packet(struct psmouse *psmouse, struct pt_regs *regs)
        }
        if (priv->i->flags & ALPS_OLDPROTO) {
-                left = packet[2] & 0x08;
+                left = packet[2] & 0x10;
-                right = packet[2] & 0x10;
+                right = packet[2] & 0x08;
                middle = 0;
                x = packet[1] | ((packet[0] & 0x07) << 7);
                y = packet[4] | ((packet[3] & 0x07) << 7);
diff --git a/drivers/input/mouse/lifebook.c b/drivers/input/mouse/lifebook.c
index 5ccc3ef3b89e..c14395ba7980 100644
--- a/drivers/input/mouse/lifebook.c
+++ b/drivers/input/mouse/lifebook.c
@@ -22,12 +22,36 @@
 static struct dmi_system_id lifebook_dmi_table[] = {
       {
+               .ident = "LifeBook B",
+               .matches = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B Series"),
+               },
+       },
+       {
               .ident = "Lifebook B",
               .matches = {
                       DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK B Series"),
               },
       },
       {
+               .ident = "Lifebook B213x/B2150",
+               .matches = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B2131/B2133/B2150"),
+               },
+       },
+       {
+               .ident = "Zephyr",
+               .matches = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "ZEPHYR"),
+               },
+       },
+       {
+               .ident = "CF-18",
+               .matches = {
+                       DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"),
+               },
+       },
+       {
               .ident = "Lifebook B142",
               .matches = {
                       DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
diff --git a/drivers/input/mouse/logips2pp.c b/drivers/input/mouse/logips2pp.c
index 40333d61093c..2f0d28840810 100644
--- a/drivers/input/mouse/logips2pp.c
+++ b/drivers/input/mouse/logips2pp.c
@@ -19,6 +19,7 @@
 #define PS2PP_KIND_WHEEL        1
 #define PS2PP_KIND_MX           2
 #define PS2PP_KIND_TP3          3
+#define PS2PP_KIND_TRACKMAN     4
 /* Logitech mouse features */
 #define PS2PP_WHEEL             0x01
@@ -223,6 +224,7 @@ static struct ps2pp_info *get_model_info(unsigned char model)
                { 73,   0,                      PS2PP_SIDE_BTN },
                { 75,   PS2PP_KIND_WHEEL,       PS2PP_WHEEL },
                { 76,   PS2PP_KIND_WHEEL,       PS2PP_WHEEL },
+                { 79,   PS2PP_KIND_TRACKMAN,    PS2PP_WHEEL },          /* TrackMan with wheel */
                { 80,   PS2PP_KIND_WHEEL,       PS2PP_SIDE_BTN | PS2PP_WHEEL },
                { 81,   PS2PP_KIND_WHEEL,       PS2PP_WHEEL },
                { 83,   PS2PP_KIND_WHEEL,       PS2PP_WHEEL },
@@ -298,6 +300,10 @@ static void ps2pp_set_model_properties(struct psmouse *psmouse, struct ps2pp_inf
                        psmouse->name = "TouchPad 3";
                        break;
+                case PS2PP_KIND_TRACKMAN:
+                        psmouse->name = "TrackMan";
+                        break;
                default:
                        /*
                         * Set name to "Mouse" only when using PS2++,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index ec802913f977..f19b874753a9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -167,6 +167,15 @@ void md_new_event(mddev_t *mddev)
 }
 EXPORT_SYMBOL_GPL(md_new_event);
+/* Alternate version that can be called from interrupts
+ * when calling sysfs_notify isn't needed.
+ */
+void md_new_event_inintr(mddev_t *mddev)
+{
+        atomic_inc(&md_event_count);
+        wake_up(&md_event_waiters);
+}
 /*
 * Enables to iterate over all existing md arrays
 * all_mddevs_lock protects this list.
@@ -4149,7 +4158,7 @@ void md_error(mddev_t *mddev, mdk_rdev_t *rdev)
        set_bit(MD_RECOVERY_INTR, &mddev->recovery);
        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
        md_wakeup_thread(mddev->thread);
-        md_new_event(mddev);
+        md_new_event_inintr(mddev);
 }
 /* seq_file implementation /proc/mdstat */
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 9080853fe283..a30084076ac8 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -1605,6 +1605,21 @@ mpt_resume(struct pci_dev *pdev)
 }
 #endif
+static int
+mpt_signal_reset(int index, MPT_ADAPTER *ioc, int reset_phase)
+{
+        if ((MptDriverClass[index] == MPTSPI_DRIVER &&
+             ioc->bus_type != SPI) ||
+            (MptDriverClass[index] == MPTFC_DRIVER &&
+             ioc->bus_type != FC) ||
+            (MptDriverClass[index] == MPTSAS_DRIVER &&
+             ioc->bus_type != SAS))
+                /* make sure we only call the relevant reset handler
+                 * for the bus */
+                return 0;
+        return (MptResetHandlers[index])(ioc, reset_phase);
+}
 /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/
 /*
 *      mpt_do_ioc_recovery - Initialize or recover MPT adapter.
@@ -1885,14 +1900,14 @@ mpt_do_ioc_recovery(MPT_ADAPTER *ioc, u32 reason, int sleepFlag)
                        if ((ret == 0) && MptResetHandlers[ii]) {
                                dprintk((MYIOC_s_INFO_FMT "Calling IOC post_reset handler #%d\n",
                                                ioc->name, ii));
-                                rc += (*(MptResetHandlers[ii]))(ioc, MPT_IOC_POST_RESET);
+                                rc += mpt_signal_reset(ii, ioc, MPT_IOC_POST_RESET);
                                handlers++;
                        }
                        if (alt_ioc_ready && MptResetHandlers[ii]) {
                                drsprintk((MYIOC_s_INFO_FMT "Calling alt-%s post_reset handler #%d\n",
                                                ioc->name, ioc->alt_ioc->name, ii));
-                                rc += (*(MptResetHandlers[ii]))(ioc->alt_ioc, MPT_IOC_POST_RESET);
+                                rc += mpt_signal_reset(ii, ioc->alt_ioc, MPT_IOC_POST_RESET);
                                handlers++;
                        }
                }
@@ -3267,11 +3282,11 @@ mpt_diag_reset(MPT_ADAPTER *ioc, int ignore, int sleepFlag)
                                if (MptResetHandlers[ii]) {
                                        dprintk((MYIOC_s_INFO_FMT "Calling IOC pre_reset handler #%d\n",
                                                        ioc->name, ii));
-                                        r += (*(MptResetHandlers[ii]))(ioc, MPT_IOC_PRE_RESET);
+                                        r += mpt_signal_reset(ii, ioc, MPT_IOC_PRE_RESET);
                                        if (ioc->alt_ioc) {
                                                dprintk((MYIOC_s_INFO_FMT "Calling alt-%s pre_reset handler #%d\n",
                                                                ioc->name, ioc->alt_ioc->name, ii));
-                                                r += (*(MptResetHandlers[ii]))(ioc->alt_ioc, MPT_IOC_PRE_RESET);
+                                                r += mpt_signal_reset(ii, ioc->alt_ioc, MPT_IOC_PRE_RESET);
                                        }
                                }
                        }
@@ -5706,11 +5721,11 @@ mpt_HardResetHandler(MPT_ADAPTER *ioc, int sleepFlag)
                        if (MptResetHandlers[ii]) {
                                dtmprintk((MYIOC_s_INFO_FMT "Calling IOC reset_setup handler #%d\n",
                                                ioc->name, ii));
-                                r += (*(MptResetHandlers[ii]))(ioc, MPT_IOC_SETUP_RESET);
+                                r += mpt_signal_reset(ii, ioc, MPT_IOC_SETUP_RESET);
                                if (ioc->alt_ioc) {
                                        dtmprintk((MYIOC_s_INFO_FMT "Calling alt-%s setup reset handler #%d\n",
                                                        ioc->name, ioc->alt_ioc->name, ii));
-                                        r += (*(MptResetHandlers[ii]))(ioc->alt_ioc, MPT_IOC_SETUP_RESET);
+                                        r += mpt_signal_reset(ii, ioc->alt_ioc, MPT_IOC_SETUP_RESET);
                                }
                        }
                }
diff --git a/drivers/mmc/Kconfig b/drivers/mmc/Kconfig
index 003b077c2324..45bcf098e762 100644
--- a/drivers/mmc/Kconfig
+++ b/drivers/mmc/Kconfig
@@ -84,7 +84,7 @@ config MMC_WBSD
 config MMC_AU1X
        tristate "Alchemy AU1XX0 MMC Card Interface support"
-        depends on SOC_AU1X00 && MMC
+        depends on MMC && SOC_AU1200
        help
          This selects the AMD Alchemy(R) Multimedia card interface.
          If you have a Alchemy platform with a MMC slot, say Y or M here.
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index cfdf0b24ffc1..6ed7f599eba3 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -871,13 +871,16 @@ e1000_intr_test(struct e1000_adapter *adapter, uint64_t *data)
        *data = 0;
        /* Hook up test interrupt handler just for this test */
-        if (!request_irq(irq, &e1000_test_intr, 0, netdev->name, netdev)) {
+        if (!request_irq(irq, &e1000_test_intr, SA_PROBEIRQ, netdev->name,
-                shared_int = FALSE;
+                         netdev)) {
-        } else if (request_irq(irq, &e1000_test_intr, SA_SHIRQ,
+                shared_int = FALSE;
+        } else if (request_irq(irq, &e1000_test_intr, SA_SHIRQ,
                              netdev->name, netdev)){
                *data = 1;
                return -1;
        }
+        DPRINTK(PROBE,INFO, "testing %s interrupt\n",
+                (shared_int ? "shared" : "unshared"));
        /* Disable all the interrupts */
        E1000_WRITE_REG(&adapter->hw, IMC, 0xFFFFFFFF);
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 564fab4914e1..56c7492e3e91 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3509,7 +3509,7 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
        buffer_info = &rx_ring->buffer_info[i];
        while (rx_desc->status & E1000_RXD_STAT_DD) {
-                struct sk_buff *skb, *next_skb;
+                struct sk_buff *skb;
                u8 status;
 #ifdef CONFIG_E1000_NAPI
                if (*work_done >= work_to_do)
@@ -3527,8 +3527,6 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                prefetch(next_rxd);
                next_buffer = &rx_ring->buffer_info[i];
-                next_skb = next_buffer->skb;
-                prefetch(next_skb->data - NET_IP_ALIGN);
                cleaned = TRUE;
                cleaned_count++;
@@ -3659,7 +3657,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
        struct e1000_buffer *buffer_info, *next_buffer;
        struct e1000_ps_page *ps_page;
        struct e1000_ps_page_dma *ps_page_dma;
-        struct sk_buff *skb, *next_skb;
+        struct sk_buff *skb;
        unsigned int i, j;
        uint32_t length, staterr;
        int cleaned_count = 0;
@@ -3689,8 +3687,6 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                prefetch(next_rxd);
                next_buffer = &rx_ring->buffer_info[i];
-                next_skb = next_buffer->skb;
-                prefetch(next_skb->data - NET_IP_ALIGN);
                cleaned = TRUE;
                cleaned_count++;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 66ea5fc5c2e2..5669b95162b3 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -2675,6 +2675,18 @@ static int nv_nway_reset(struct net_device *dev)
        return ret;
 }
+#ifdef NETIF_F_TSO
+static int nv_set_tso(struct net_device *dev, u32 value)
+{
+        struct fe_priv *np = netdev_priv(dev);
+        if ((np->driver_data & DEV_HAS_CHECKSUM))
+                return ethtool_op_set_tso(dev, value);
+        else
+                return value ? -EOPNOTSUPP : 0;
+}
+#endif
 static struct ethtool_ops ops = {
        .get_drvinfo = nv_get_drvinfo,
        .get_link = ethtool_op_get_link,
@@ -2686,6 +2698,10 @@ static struct ethtool_ops ops = {
        .get_regs = nv_get_regs,
        .nway_reset = nv_nway_reset,
        .get_perm_addr = ethtool_op_get_perm_addr,
+#ifdef NETIF_F_TSO
+        .get_tso = ethtool_op_get_tso,
+        .set_tso = nv_set_tso
+#endif
 };
 static void nv_vlan_rx_register(struct net_device *dev, struct vlan_group *grp)
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 87933cba7e22..e1feb58bd661 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -44,6 +44,7 @@
 #include <linux/string.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include <linux/etherdevice.h>
 #include <linux/if_ether.h>
 #include <linux/if_vlan.h>
@@ -62,7 +63,6 @@
 #include <net/checksum.h>
 #include <asm/byteorder.h>
 #include <asm/io.h>
-#include <asm/pci.h>
 #include <asm/processor.h>
 #ifdef CONFIG_MTRR
 #include <asm/mtrr.h>
@@ -71,7 +71,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
-#define MYRI10GE_VERSION_STR "0.9.0"
+#define MYRI10GE_VERSION_STR "1.0.0"
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
@@ -480,7 +480,19 @@ static int myri10ge_load_hotplug_firmware(struct myri10ge_priv *mgp, u32 * size)
                goto abort_with_fw;
        crc = crc32(~0, fw->data, fw->size);
-        memcpy_toio(mgp->sram + MYRI10GE_FW_OFFSET, fw->data, fw->size);
+        if (mgp->tx.boundary == 2048) {
+                /* Avoid PCI burst on chipset with unaligned completions. */
+                int i;
+                __iomem u32 *ptr = (__iomem u32 *) (mgp->sram +
+                                                    MYRI10GE_FW_OFFSET);
+                for (i = 0; i < fw->size / 4; i++) {
+                        __raw_writel(((u32 *) fw->data)[i], ptr + i);
+                        wmb();
+                }
+        } else {
+                myri10ge_pio_copy(mgp->sram + MYRI10GE_FW_OFFSET, fw->data,
+                                  fw->size);
+        }
        /* corruption checking is good for parity recovery and buggy chipset */
        memcpy_fromio(fw->data, mgp->sram + MYRI10GE_FW_OFFSET, fw->size);
        reread_crc = crc32(~0, fw->data, fw->size);
@@ -536,6 +548,7 @@ static int myri10ge_load_firmware(struct myri10ge_priv *mgp)
        u32 dma_low, dma_high, size;
        int status, i;
+        size = 0;
        status = myri10ge_load_hotplug_firmware(mgp, &size);
        if (status) {
                dev_warn(&mgp->pdev->dev, "hotplug firmware loading failed\n");
@@ -778,7 +791,7 @@ myri10ge_submit_8rx(struct mcp_kreq_ether_recv __iomem * dst,
 }
 /*
- * Set of routunes to get a new receive buffer.  Any buffer which
+ * Set of routines to get a new receive buffer.  Any buffer which
 * crosses a 4KB boundary must start on a 4KB boundary due to PCIe
 * wdma restrictions. We also try to align any smaller allocation to
 * at least a 16 byte boundary for efficiency.  We assume the linux
@@ -1349,7 +1362,7 @@ static struct ethtool_ops myri10ge_ethtool_ops = {
        .get_rx_csum = myri10ge_get_rx_csum,
        .set_rx_csum = myri10ge_set_rx_csum,
        .get_tx_csum = ethtool_op_get_tx_csum,
-        .set_tx_csum = ethtool_op_set_tx_csum,
+        .set_tx_csum = ethtool_op_set_tx_hw_csum,
        .get_sg = ethtool_op_get_sg,
        .set_sg = ethtool_op_set_sg,
 #ifdef NETIF_F_TSO
@@ -2615,12 +2628,13 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                dev_err(&pdev->dev, "Error %d setting DMA mask\n", status);
                goto abort_with_netdev;
        }
-        mgp->cmd = pci_alloc_consistent(pdev, sizeof(*mgp->cmd), &mgp->cmd_bus);
+        mgp->cmd = dma_alloc_coherent(&pdev->dev, sizeof(*mgp->cmd),
+                                      &mgp->cmd_bus, GFP_KERNEL);
        if (mgp->cmd == NULL)
                goto abort_with_netdev;
-        mgp->fw_stats = pci_alloc_consistent(pdev, sizeof(*mgp->fw_stats),
+        mgp->fw_stats = dma_alloc_coherent(&pdev->dev, sizeof(*mgp->fw_stats),
-                                             &mgp->fw_stats_bus);
+                                           &mgp->fw_stats_bus, GFP_KERNEL);
        if (mgp->fw_stats == NULL)
                goto abort_with_cmd;
@@ -2659,8 +2673,8 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        /* allocate rx done ring */
        bytes = myri10ge_max_intr_slots * sizeof(*mgp->rx_done.entry);
-        mgp->rx_done.entry =
+        mgp->rx_done.entry = dma_alloc_coherent(&pdev->dev, bytes,
-            pci_alloc_consistent(pdev, bytes, &mgp->rx_done.bus);
+                                                &mgp->rx_done.bus, GFP_KERNEL);
        if (mgp->rx_done.entry == NULL)
                goto abort_with_ioremap;
        memset(mgp->rx_done.entry, 0, bytes);
@@ -2750,7 +2764,8 @@ abort_with_firmware:
 abort_with_rx_done:
        bytes = myri10ge_max_intr_slots * sizeof(*mgp->rx_done.entry);
-        pci_free_consistent(pdev, bytes, mgp->rx_done.entry, mgp->rx_done.bus);
+        dma_free_coherent(&pdev->dev, bytes,
+                          mgp->rx_done.entry, mgp->rx_done.bus);
 abort_with_ioremap:
        iounmap(mgp->sram);
@@ -2760,11 +2775,12 @@ abort_with_wc:
        if (mgp->mtrr >= 0)
                mtrr_del(mgp->mtrr, mgp->iomem_base, mgp->board_span);
 #endif
-        pci_free_consistent(pdev, sizeof(*mgp->fw_stats),
+        dma_free_coherent(&pdev->dev, sizeof(*mgp->fw_stats),
-                            mgp->fw_stats, mgp->fw_stats_bus);
+                          mgp->fw_stats, mgp->fw_stats_bus);
 abort_with_cmd:
-        pci_free_consistent(pdev, sizeof(*mgp->cmd), mgp->cmd, mgp->cmd_bus);
+        dma_free_coherent(&pdev->dev, sizeof(*mgp->cmd),
+                          mgp->cmd, mgp->cmd_bus);
 abort_with_netdev:
@@ -2799,7 +2815,8 @@ static void myri10ge_remove(struct pci_dev *pdev)
        myri10ge_dummy_rdma(mgp, 0);
        bytes = myri10ge_max_intr_slots * sizeof(*mgp->rx_done.entry);
-        pci_free_consistent(pdev, bytes, mgp->rx_done.entry, mgp->rx_done.bus);
+        dma_free_coherent(&pdev->dev, bytes,
+                          mgp->rx_done.entry, mgp->rx_done.bus);
        iounmap(mgp->sram);
@@ -2807,19 +2824,20 @@ static void myri10ge_remove(struct pci_dev *pdev)
        if (mgp->mtrr >= 0)
                mtrr_del(mgp->mtrr, mgp->iomem_base, mgp->board_span);
 #endif
-        pci_free_consistent(pdev, sizeof(*mgp->fw_stats),
+        dma_free_coherent(&pdev->dev, sizeof(*mgp->fw_stats),
-                            mgp->fw_stats, mgp->fw_stats_bus);
+                          mgp->fw_stats, mgp->fw_stats_bus);
-        pci_free_consistent(pdev, sizeof(*mgp->cmd), mgp->cmd, mgp->cmd_bus);
+        dma_free_coherent(&pdev->dev, sizeof(*mgp->cmd),
+                          mgp->cmd, mgp->cmd_bus);
        free_netdev(netdev);
        pci_set_drvdata(pdev, NULL);
 }
-#define PCI_DEVICE_ID_MYIRCOM_MYRI10GE_Z8E      0x0008
+#define PCI_DEVICE_ID_MYRICOM_MYRI10GE_Z8E      0x0008
 static struct pci_device_id myri10ge_pci_tbl[] = {
-        {PCI_DEVICE(PCI_VENDOR_ID_MYRICOM, PCI_DEVICE_ID_MYIRCOM_MYRI10GE_Z8E)},
+        {PCI_DEVICE(PCI_VENDOR_ID_MYRICOM, PCI_DEVICE_ID_MYRICOM_MYRI10GE_Z8E)},
        {0},
 };
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 66e74f740261..bf58db29e2ed 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -107,7 +107,7 @@ static int init_netconsole(void)
        if(!configured) {
                printk("netconsole: not configured, aborting\n");
-                return -EINVAL;
+                return 0;
        }
        if(netpoll_setup(&np))
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 4260c2128f47..a8f6bfc96fd2 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -1204,7 +1204,7 @@ static int mace_rx(struct net_device *dev, unsigned char RxCnt)
        dev->last_rx = jiffies;
        lp->linux_stats.rx_packets++;
-        lp->linux_stats.rx_bytes += skb->len;
+        lp->linux_stats.rx_bytes += pkt_len;
        outb(0xFF, ioaddr + AM2150_RCV_NEXT); /* skip to next frame */
        continue;
      } else {
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 475dc930380f..0d101a18026a 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -861,6 +861,9 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb)
                 * give dev_queue_xmit something it can free.
                 */
                skb2 = skb_clone(skb, GFP_ATOMIC);
+                if (skb2 == NULL)
+                        goto abort;
        }
        ph = (struct pppoe_hdr *) skb_push(skb2, sizeof(struct pppoe_hdr));
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 5ca5a1b546a1..536dd1cf7f79 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -44,12 +44,13 @@
 #include "skge.h"
 #define DRV_NAME                "skge"
-#define DRV_VERSION             "1.5"
+#define DRV_VERSION             "1.6"
 #define PFX                     DRV_NAME " "
 #define DEFAULT_TX_RING_SIZE    128
 #define DEFAULT_RX_RING_SIZE    512
 #define MAX_TX_RING_SIZE        1024
+#define TX_LOW_WATER            (MAX_SKB_FRAGS + 1)
 #define MAX_RX_RING_SIZE        4096
 #define RX_COPY_THRESHOLD       128
 #define RX_BUF_SIZE             1536
@@ -401,7 +402,7 @@ static int skge_set_ring_param(struct net_device *dev,
        int err;
        if (p->rx_pending == 0 || p->rx_pending > MAX_RX_RING_SIZE ||
-            p->tx_pending < MAX_SKB_FRAGS+1 || p->tx_pending > MAX_TX_RING_SIZE)
+            p->tx_pending < TX_LOW_WATER || p->tx_pending > MAX_TX_RING_SIZE)
                return -EINVAL;
        skge->rx_ring.count = p->rx_pending;
@@ -603,7 +604,7 @@ static void skge_led(struct skge_port *skge, enum led_mode mode)
        struct skge_hw *hw = skge->hw;
        int port = skge->port;
-        spin_lock_bh(&hw->phy_lock);
+        mutex_lock(&hw->phy_mutex);
        if (hw->chip_id == CHIP_ID_GENESIS) {
                switch (mode) {
                case LED_MODE_OFF:
@@ -663,7 +664,7 @@ static void skge_led(struct skge_port *skge, enum led_mode mode)
                                     PHY_M_LED_MO_RX(MO_LED_ON));
                }
        }
-        spin_unlock_bh(&hw->phy_lock);
+        mutex_unlock(&hw->phy_mutex);
 }
 /* blink LED's for finding board */
@@ -2038,7 +2039,7 @@ static void skge_phy_reset(struct skge_port *skge)
        netif_stop_queue(skge->netdev);
        netif_carrier_off(skge->netdev);
-        spin_lock_bh(&hw->phy_lock);
+        mutex_lock(&hw->phy_mutex);
        if (hw->chip_id == CHIP_ID_GENESIS) {
                genesis_reset(hw, port);
                genesis_mac_init(hw, port);
@@ -2046,7 +2047,7 @@ static void skge_phy_reset(struct skge_port *skge)
                yukon_reset(hw, port);
                yukon_init(hw, port);
        }
-        spin_unlock_bh(&hw->phy_lock);
+        mutex_unlock(&hw->phy_mutex);
 }
 /* Basic MII support */
@@ -2067,12 +2068,12 @@ static int skge_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                /* fallthru */
        case SIOCGMIIREG: {
                u16 val = 0;
-                spin_lock_bh(&hw->phy_lock);
+                mutex_lock(&hw->phy_mutex);
                if (hw->chip_id == CHIP_ID_GENESIS)
                        err = __xm_phy_read(hw, skge->port, data->reg_num & 0x1f, &val);
                else
                        err = __gm_phy_read(hw, skge->port, data->reg_num & 0x1f, &val);
-                spin_unlock_bh(&hw->phy_lock);
+                mutex_unlock(&hw->phy_mutex);
                data->val_out = val;
                break;
        }
@@ -2081,14 +2082,14 @@ static int skge_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
-                spin_lock_bh(&hw->phy_lock);
+                mutex_lock(&hw->phy_mutex);
                if (hw->chip_id == CHIP_ID_GENESIS)
                        err = xm_phy_write(hw, skge->port, data->reg_num & 0x1f,
                                   data->val_in);
                else
                        err = gm_phy_write(hw, skge->port, data->reg_num & 0x1f,
                                   data->val_in);
-                spin_unlock_bh(&hw->phy_lock);
+                mutex_unlock(&hw->phy_mutex);
                break;
        }
        return err;
@@ -2191,12 +2192,12 @@ static int skge_up(struct net_device *dev)
                goto free_rx_ring;
        /* Initialize MAC */
-        spin_lock_bh(&hw->phy_lock);
+        mutex_lock(&hw->phy_mutex);
        if (hw->chip_id == CHIP_ID_GENESIS)
                genesis_mac_init(hw, port);
        else
                yukon_mac_init(hw, port);
-        spin_unlock_bh(&hw->phy_lock);
+        mutex_unlock(&hw->phy_mutex);
        /* Configure RAMbuffers */
        chunk = hw->ram_size / ((hw->ports + 1)*2);
@@ -2302,21 +2303,20 @@ static int skge_xmit_frame(struct sk_buff *skb, struct net_device *dev)
 {
        struct skge_port *skge = netdev_priv(dev);
        struct skge_hw *hw = skge->hw;
-        struct skge_ring *ring = &skge->tx_ring;
        struct skge_element *e;
        struct skge_tx_desc *td;
        int i;
        u32 control, len;
        u64 map;
+        unsigned long flags;
        skb = skb_padto(skb, ETH_ZLEN);
        if (!skb)
                return NETDEV_TX_OK;
-        if (!spin_trylock(&skge->tx_lock)) {
+        if (!spin_trylock_irqsave(&skge->tx_lock, flags))
                /* Collision - tell upper layer to requeue */
                return NETDEV_TX_LOCKED;
-        }
        if (unlikely(skge_avail(&skge->tx_ring) < skb_shinfo(skb)->nr_frags + 1)) {
                if (!netif_queue_stopped(dev)) {
@@ -2325,12 +2325,13 @@ static int skge_xmit_frame(struct sk_buff *skb, struct net_device *dev)
                        printk(KERN_WARNING PFX "%s: ring full when queue awake!\n",
                               dev->name);
                }
-                spin_unlock(&skge->tx_lock);
+                spin_unlock_irqrestore(&skge->tx_lock, flags);
                return NETDEV_TX_BUSY;
        }
-        e = ring->to_use;
+        e = skge->tx_ring.to_use;
        td = e->desc;
+        BUG_ON(td->control & BMU_OWN);
        e->skb = skb;
        len = skb_headlen(skb);
        map = pci_map_single(hw->pdev, skb->data, len, PCI_DMA_TODEVICE);
@@ -2371,8 +2372,10 @@ static int skge_xmit_frame(struct sk_buff *skb, struct net_device *dev)
                                           frag->size, PCI_DMA_TODEVICE);
                        e = e->next;
-                        e->skb = NULL;
+                        e->skb = skb;
                        tf = e->desc;
+                        BUG_ON(tf->control & BMU_OWN);
                        tf->dma_lo = map;
                        tf->dma_hi = (u64) map >> 32;
                        pci_unmap_addr_set(e, mapaddr, map);
@@ -2389,56 +2392,68 @@ static int skge_xmit_frame(struct sk_buff *skb, struct net_device *dev)
        skge_write8(hw, Q_ADDR(txqaddr[skge->port], Q_CSR), CSR_START);
-        if (netif_msg_tx_queued(skge))
+        if (unlikely(netif_msg_tx_queued(skge)))
                printk(KERN_DEBUG "%s: tx queued, slot %td, len %d\n",
-                       dev->name, e - ring->start, skb->len);
+                       dev->name, e - skge->tx_ring.start, skb->len);
-        ring->to_use = e->next;
+        skge->tx_ring.to_use = e->next;
-        if (skge_avail(&skge->tx_ring) <= MAX_SKB_FRAGS + 1) {
+        if (skge_avail(&skge->tx_ring) <= TX_LOW_WATER) {
                pr_debug("%s: transmit queue full\n", dev->name);
                netif_stop_queue(dev);
        }
-        mmiowb();
+        spin_unlock_irqrestore(&skge->tx_lock, flags);
-        spin_unlock(&skge->tx_lock);
        dev->trans_start = jiffies;
        return NETDEV_TX_OK;
 }
-static void skge_tx_complete(struct skge_port *skge, struct skge_element *last)
+/* Free resources associated with this reing element */
+static void skge_tx_free(struct skge_port *skge, struct skge_element *e,
+                         u32 control)
 {
        struct pci_dev *pdev = skge->hw->pdev;
-        struct skge_element *e;
-        for (e = skge->tx_ring.to_clean; e != last; e = e->next) {
+        BUG_ON(!e->skb);
-                struct sk_buff *skb = e->skb;
-                int i;
-                e->skb = NULL;
+        /* skb header vs. fragment */
+        if (control & BMU_STF)
                pci_unmap_single(pdev, pci_unmap_addr(e, mapaddr),
-                                 skb_headlen(skb), PCI_DMA_TODEVICE);
+                                 pci_unmap_len(e, maplen),
+                                 PCI_DMA_TODEVICE);
+        else
+                pci_unmap_page(pdev, pci_unmap_addr(e, mapaddr),
+                               pci_unmap_len(e, maplen),
+                               PCI_DMA_TODEVICE);
-                for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+        if (control & BMU_EOF) {
-                        e = e->next;
+                if (unlikely(netif_msg_tx_done(skge)))
-                        pci_unmap_page(pdev, pci_unmap_addr(e, mapaddr),
+                        printk(KERN_DEBUG PFX "%s: tx done slot %td\n",
-                                       skb_shinfo(skb)->frags[i].size,
+                               skge->netdev->name, e - skge->tx_ring.start);
-                                       PCI_DMA_TODEVICE);
-                }
-                dev_kfree_skb(skb);
+                dev_kfree_skb_any(e->skb);
        }
-        skge->tx_ring.to_clean = e;
+        e->skb = NULL;
 }
+/* Free all buffers in transmit ring */
 static void skge_tx_clean(struct skge_port *skge)
 {
+        struct skge_element *e;
+        unsigned long flags;
+        spin_lock_irqsave(&skge->tx_lock, flags);
+        for (e = skge->tx_ring.to_clean; e != skge->tx_ring.to_use; e = e->next) {
+                struct skge_tx_desc *td = e->desc;
+                skge_tx_free(skge, e, td->control);
+                td->control = 0;
+        }
-        spin_lock_bh(&skge->tx_lock);
+        skge->tx_ring.to_clean = e;
-        skge_tx_complete(skge, skge->tx_ring.to_use);
        netif_wake_queue(skge->netdev);
-        spin_unlock_bh(&skge->tx_lock);
+        spin_unlock_irqrestore(&skge->tx_lock, flags);
 }
 static void skge_tx_timeout(struct net_device *dev)
@@ -2664,32 +2679,28 @@ resubmit:
        return NULL;
 }
-static void skge_tx_done(struct skge_port *skge)
+/* Free all buffers in Tx ring which are no longer owned by device */
+static void skge_txirq(struct net_device *dev)
 {
+        struct skge_port *skge = netdev_priv(dev);
        struct skge_ring *ring = &skge->tx_ring;
-        struct skge_element *e, *last;
+        struct skge_element *e;
+        rmb();
        spin_lock(&skge->tx_lock);
-        last = ring->to_clean;
        for (e = ring->to_clean; e != ring->to_use; e = e->next) {
                struct skge_tx_desc *td = e->desc;
                if (td->control & BMU_OWN)
                        break;
-                if (td->control & BMU_EOF) {
+                skge_tx_free(skge, e, td->control);
-                        last = e->next;
-                        if (unlikely(netif_msg_tx_done(skge)))
-                                printk(KERN_DEBUG PFX "%s: tx done slot %td\n",
-                                       skge->netdev->name, e - ring->start);
-                }
        }
+        skge->tx_ring.to_clean = e;
-        skge_tx_complete(skge, last);
+        if (netif_queue_stopped(skge->netdev)
+            && skge_avail(&skge->tx_ring) > TX_LOW_WATER)
-        skge_write8(skge->hw, Q_ADDR(txqaddr[skge->port], Q_CSR), CSR_IRQ_CL_F);
-        if (skge_avail(&skge->tx_ring) > MAX_SKB_FRAGS + 1)
                netif_wake_queue(skge->netdev);
        spin_unlock(&skge->tx_lock);
@@ -2704,8 +2715,6 @@ static int skge_poll(struct net_device *dev, int *budget)
        int to_do = min(dev->quota, *budget);
        int work_done = 0;
-        skge_tx_done(skge);
        for (e = ring->to_clean; prefetch(e->next), work_done < to_do; e = e->next) {
                struct skge_rx_desc *rd = e->desc;
                struct sk_buff *skb;
@@ -2737,10 +2746,12 @@ static int skge_poll(struct net_device *dev, int *budget)
                return 1; /* not done */
        netif_rx_complete(dev);
-        mmiowb();
-        hw->intr_mask |= skge->port == 0 ? (IS_R1_F|IS_XA1_F) : (IS_R2_F|IS_XA2_F);
+        spin_lock_irq(&hw->hw_lock);
+        hw->intr_mask |= rxirqmask[skge->port];
        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        mmiowb();
+        spin_unlock_irq(&hw->hw_lock);
        return 0;
 }
@@ -2847,16 +2858,16 @@ static void skge_error_irq(struct skge_hw *hw)
 }
 /*
- * Interrupt from PHY are handled in tasklet (soft irq)
+ * Interrupt from PHY are handled in work queue
 * because accessing phy registers requires spin wait which might
 * cause excess interrupt latency.
 */
-static void skge_extirq(unsigned long data)
+static void skge_extirq(void *arg)
 {
-        struct skge_hw *hw = (struct skge_hw *) data;
+        struct skge_hw *hw = arg;
        int port;
-        spin_lock(&hw->phy_lock);
+        mutex_lock(&hw->phy_mutex);
        for (port = 0; port < hw->ports; port++) {
                struct net_device *dev = hw->dev[port];
                struct skge_port *skge = netdev_priv(dev);
@@ -2868,10 +2879,12 @@ static void skge_extirq(unsigned long data)
                                bcom_phy_intr(skge);
                }
        }
-        spin_unlock(&hw->phy_lock);
+        mutex_unlock(&hw->phy_mutex);
+        spin_lock_irq(&hw->hw_lock);
        hw->intr_mask |= IS_EXT_REG;
        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock_irq(&hw->hw_lock);
 }
 static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
@@ -2884,54 +2897,68 @@ static irqreturn_t skge_intr(int irq, void *dev_id, struct pt_regs *regs)
        if (status == 0)
                return IRQ_NONE;
+        spin_lock(&hw->hw_lock);
+        status &= hw->intr_mask;
        if (status & IS_EXT_REG) {
                hw->intr_mask &= ~IS_EXT_REG;
-                tasklet_schedule(&hw->ext_tasklet);
+                schedule_work(&hw->phy_work);
        }
-        if (status & (IS_R1_F|IS_XA1_F)) {
+        if (status & IS_XA1_F) {
-                skge_write8(hw, Q_ADDR(Q_R1, Q_CSR), CSR_IRQ_CL_F);
+                skge_write8(hw, Q_ADDR(Q_XA1, Q_CSR), CSR_IRQ_CL_F);
-                hw->intr_mask &= ~(IS_R1_F|IS_XA1_F);
+                skge_txirq(hw->dev[0]);
-                netif_rx_schedule(hw->dev[0]);
        }
-        if (status & (IS_R2_F|IS_XA2_F)) {
+        if (status & IS_R1_F) {
-                skge_write8(hw, Q_ADDR(Q_R2, Q_CSR), CSR_IRQ_CL_F);
+                skge_write8(hw, Q_ADDR(Q_R1, Q_CSR), CSR_IRQ_CL_F);
-                hw->intr_mask &= ~(IS_R2_F|IS_XA2_F);
+                hw->intr_mask &= ~IS_R1_F;
-                netif_rx_schedule(hw->dev[1]);
+                netif_rx_schedule(hw->dev[0]);
        }
-        if (likely((status & hw->intr_mask) == 0))
+        if (status & IS_PA_TO_TX1)
-                return IRQ_HANDLED;
+                skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_TX1);
        if (status & IS_PA_TO_RX1) {
                struct skge_port *skge = netdev_priv(hw->dev[0]);
-                ++skge->net_stats.rx_over_errors;
-                skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_RX1);
-        }
-        if (status & IS_PA_TO_RX2) {
-                struct skge_port *skge = netdev_priv(hw->dev[1]);
                ++skge->net_stats.rx_over_errors;
-                skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_RX2);
+                skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_RX1);
        }
-        if (status & IS_PA_TO_TX1)
-                skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_TX1);
-        if (status & IS_PA_TO_TX2)
-                skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_TX2);
        if (status & IS_MAC1)
                skge_mac_intr(hw, 0);
-        if (status & IS_MAC2)
+        if (hw->dev[1]) {
-                skge_mac_intr(hw, 1);
+                if (status & IS_XA2_F) {
+                        skge_write8(hw, Q_ADDR(Q_XA2, Q_CSR), CSR_IRQ_CL_F);
+                        skge_txirq(hw->dev[1]);
+                }
+                if (status & IS_R2_F) {
+                        skge_write8(hw, Q_ADDR(Q_R2, Q_CSR), CSR_IRQ_CL_F);
+                        hw->intr_mask &= ~IS_R2_F;
+                        netif_rx_schedule(hw->dev[1]);
+                }
+                if (status & IS_PA_TO_RX2) {
+                        struct skge_port *skge = netdev_priv(hw->dev[1]);
+                        ++skge->net_stats.rx_over_errors;
+                        skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_RX2);
+                }
+                if (status & IS_PA_TO_TX2)
+                        skge_write16(hw, B3_PA_CTRL, PA_CLR_TO_TX2);
+                if (status & IS_MAC2)
+                        skge_mac_intr(hw, 1);
+        }
        if (status & IS_HW_ERR)
                skge_error_irq(hw);
        skge_write32(hw, B0_IMSK, hw->intr_mask);
+        spin_unlock(&hw->hw_lock);
        return IRQ_HANDLED;
 }
@@ -2957,7 +2984,7 @@ static int skge_set_mac_address(struct net_device *dev, void *p)
        if (!is_valid_ether_addr(addr->sa_data))
                return -EADDRNOTAVAIL;
-        spin_lock_bh(&hw->phy_lock);
+        mutex_lock(&hw->phy_mutex);
        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
        memcpy_toio(hw->regs + B2_MAC_1 + port*8,
                    dev->dev_addr, ETH_ALEN);
@@ -2970,7 +2997,7 @@ static int skge_set_mac_address(struct net_device *dev, void *p)
                gma_set_addr(hw, port, GM_SRC_ADDR_1L, dev->dev_addr);
                gma_set_addr(hw, port, GM_SRC_ADDR_2L, dev->dev_addr);
        }
-        spin_unlock_bh(&hw->phy_lock);
+        mutex_unlock(&hw->phy_mutex);
        return 0;
 }
@@ -3082,6 +3109,7 @@ static int skge_reset(struct skge_hw *hw)
        else
                hw->ram_size = t8 * 4096;
+        spin_lock_init(&hw->hw_lock);
        hw->intr_mask = IS_HW_ERR | IS_EXT_REG | IS_PORT_1;
        if (hw->ports > 1)
                hw->intr_mask |= IS_PORT_2;
@@ -3150,14 +3178,14 @@ static int skge_reset(struct skge_hw *hw)
        skge_write32(hw, B0_IMSK, hw->intr_mask);
-        spin_lock_bh(&hw->phy_lock);
+        mutex_lock(&hw->phy_mutex);
        for (i = 0; i < hw->ports; i++) {
                if (hw->chip_id == CHIP_ID_GENESIS)
                        genesis_reset(hw, i);
                else
                        yukon_reset(hw, i);
        }
-        spin_unlock_bh(&hw->phy_lock);
+        mutex_unlock(&hw->phy_mutex);
        return 0;
 }
@@ -3305,8 +3333,8 @@ static int __devinit skge_probe(struct pci_dev *pdev,
        }
        hw->pdev = pdev;
-        spin_lock_init(&hw->phy_lock);
+        mutex_init(&hw->phy_mutex);
-        tasklet_init(&hw->ext_tasklet, skge_extirq, (unsigned long) hw);
+        INIT_WORK(&hw->phy_work, skge_extirq, hw);
        hw->regs = ioremap_nocache(pci_resource_start(pdev, 0), 0x4000);
        if (!hw->regs) {
@@ -3334,6 +3362,14 @@ static int __devinit skge_probe(struct pci_dev *pdev,
        if ((dev = skge_devinit(hw, 0, using_dac)) == NULL)
                goto err_out_led_off;
+        if (!is_valid_ether_addr(dev->dev_addr)) {
+                printk(KERN_ERR PFX "%s: bad (zero?) ethernet address in rom\n",
+                       pci_name(pdev));
+                err = -EIO;
+                goto err_out_free_netdev;
+        }
        err = register_netdev(dev);
        if (err) {
                printk(KERN_ERR PFX "%s: cannot register net device\n",
@@ -3388,11 +3424,15 @@ static void __devexit skge_remove(struct pci_dev *pdev)
        dev0 = hw->dev[0];
        unregister_netdev(dev0);
+        spin_lock_irq(&hw->hw_lock);
+        hw->intr_mask = 0;
        skge_write32(hw, B0_IMSK, 0);
+        spin_unlock_irq(&hw->hw_lock);
        skge_write16(hw, B0_LED, LED_STAT_OFF);
        skge_write8(hw, B0_CTST, CS_RST_SET);
-        tasklet_kill(&hw->ext_tasklet);
+        flush_scheduled_work();
        free_irq(pdev->irq, hw);
        pci_release_regions(pdev);
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index 1f1ce88c8186..ed19ff47ce11 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -2388,6 +2388,7 @@ struct skge_ring {
 struct skge_hw {
        void __iomem         *regs;
        struct pci_dev       *pdev;
+        spinlock_t           hw_lock;
        u32                  intr_mask;
        struct net_device    *dev[2];
@@ -2399,9 +2400,8 @@ struct skge_hw {
        u32                  ram_size;
        u32                  ram_offset;
        u16                  phy_addr;
+        struct work_struct   phy_work;
-        struct tasklet_struct ext_tasklet;
+        struct mutex         phy_mutex;
-        spinlock_t           phy_lock;
 };
 enum {
diff --git a/drivers/net/via-velocity.h b/drivers/net/via-velocity.h
index d9a774b91ddc..f1b2640ebdc6 100644
--- a/drivers/net/via-velocity.h
+++ b/drivers/net/via-velocity.h
@@ -307,7 +307,7 @@ enum  velocity_owner {
 #define TX_QUEUE_NO         4
 #define MAX_HW_MIB_COUNTER  32
-#define VELOCITY_MIN_MTU    (1514-14)
+#define VELOCITY_MIN_MTU    (64)
 #define VELOCITY_MAX_MTU    (9000)
 /*
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index d7691c482835..30ec235e6935 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -531,6 +531,23 @@ config PRISM54
          say M here and read <file:Documentation/modules.txt>.  The module
          will be called prism54.ko.
+config USB_ZD1201
+        tristate "USB ZD1201 based Wireless device support"
+        depends on USB && NET_RADIO
+        select FW_LOADER
+        ---help---
+          Say Y if you want to use wireless LAN adapters based on the ZyDAS
+          ZD1201 chip.
+          This driver makes the adapter appear as a normal Ethernet interface,
+          typically on wlan0.
+          The zd1201 device requires external firmware to be loaded.
+          This can be found at http://linux-lc100020.sourceforge.net/
+          To compile this driver as a module, choose M here: the
+          module will be called zd1201.
 source "drivers/net/wireless/hostap/Kconfig"
 source "drivers/net/wireless/bcm43xx/Kconfig"
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index c86779879361..512603de309a 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -40,3 +40,5 @@ obj-$(CONFIG_BCM43XX)		+= bcm43xx/
 # 16-bit wireless PCMCIA client drivers
 obj-$(CONFIG_PCMCIA_RAYCS)      += ray_cs.o
 obj-$(CONFIG_PCMCIA_WL3501)     += wl3501_cs.o
+obj-$(CONFIG_USB_ZD1201)        += zd1201.o
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index bbecba02e697..d0318e525ba7 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -624,25 +624,28 @@ err_destroy_tx0:
 static u16 generate_cookie(struct bcm43xx_dmaring *ring,
                           int slot)
 {
-        u16 cookie = 0x0000;
+        u16 cookie = 0xF000;
        /* Use the upper 4 bits of the cookie as
         * DMA controller ID and store the slot number
-         * in the lower 12 bits
+         * in the lower 12 bits.
+         * Note that the cookie must never be 0, as this
+         * is a special value used in RX path.
         */
        switch (ring->mmio_base) {
        default:
                assert(0);
        case BCM43xx_MMIO_DMA1_BASE:
+                cookie = 0xA000;
                break;
        case BCM43xx_MMIO_DMA2_BASE:
-                cookie = 0x1000;
+                cookie = 0xB000;
                break;
        case BCM43xx_MMIO_DMA3_BASE:
-                cookie = 0x2000;
+                cookie = 0xC000;
                break;
        case BCM43xx_MMIO_DMA4_BASE:
-                cookie = 0x3000;
+                cookie = 0xD000;
                break;
        }
        assert(((u16)slot & 0xF000) == 0x0000);
@@ -660,16 +663,16 @@ struct bcm43xx_dmaring * parse_cookie(struct bcm43xx_private *bcm,
        struct bcm43xx_dmaring *ring = NULL;
        switch (cookie & 0xF000) {
-        case 0x0000:
+        case 0xA000:
                ring = dma->tx_ring0;
                break;
-        case 0x1000:
+        case 0xB000:
                ring = dma->tx_ring1;
                break;
-        case 0x2000:
+        case 0xC000:
                ring = dma->tx_ring2;
                break;
-        case 0x3000:
+        case 0xD000:
                ring = dma->tx_ring3;
                break;
        default:
@@ -839,8 +842,18 @@ static void dma_rx(struct bcm43xx_dmaring *ring,
                /* We received an xmit status. */
                struct bcm43xx_hwxmitstatus *hw = (struct bcm43xx_hwxmitstatus *)skb->data;
                struct bcm43xx_xmitstatus stat;
+                int i = 0;
                stat.cookie = le16_to_cpu(hw->cookie);
+                while (stat.cookie == 0) {
+                        if (unlikely(++i >= 10000)) {
+                                assert(0);
+                                break;
+                        }
+                        udelay(2);
+                        barrier();
+                        stat.cookie = le16_to_cpu(hw->cookie);
+                }
                stat.flags = hw->flags;
                stat.cnt1 = hw->cnt1;
                stat.cnt2 = hw->cnt2;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index c0502905a956..736dde96c4a3 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -3555,7 +3555,7 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
        unsigned long flags;
        int keyidx;
        
-        dprintk(KERN_INFO PFX "set security called\n");
+        dprintk(KERN_INFO PFX "set security called");
        bcm43xx_lock_mmio(bcm, flags);
@@ -3568,24 +3568,25 @@ static void bcm43xx_ieee80211_set_security(struct net_device *net_dev,
        
        if (sec->flags & SEC_ACTIVE_KEY) {
                secinfo->active_key = sec->active_key;
-                dprintk(KERN_INFO PFX "   .active_key = %d\n", sec->active_key);
+                dprintk(", .active_key = %d", sec->active_key);
        }
        if (sec->flags & SEC_UNICAST_GROUP) {
                secinfo->unicast_uses_group = sec->unicast_uses_group;
-                dprintk(KERN_INFO PFX "   .unicast_uses_group = %d\n", sec->unicast_uses_group);
+                dprintk(", .unicast_uses_group = %d", sec->unicast_uses_group);
        }
        if (sec->flags & SEC_LEVEL) {
                secinfo->level = sec->level;
-                dprintk(KERN_INFO PFX "   .level = %d\n", sec->level);
+                dprintk(", .level = %d", sec->level);
        }
        if (sec->flags & SEC_ENABLED) {
                secinfo->enabled = sec->enabled;
-                dprintk(KERN_INFO PFX "   .enabled = %d\n", sec->enabled);
+                dprintk(", .enabled = %d", sec->enabled);
        }
        if (sec->flags & SEC_ENCRYPT) {
                secinfo->encrypt = sec->encrypt;
-                dprintk(KERN_INFO PFX "   .encrypt = %d\n", sec->encrypt);
+                dprintk(", .encrypt = %d", sec->encrypt);
        }
+        dprintk("\n");
        if (bcm->initialized && !bcm->ieee->host_encrypt) {
                if (secinfo->enabled) {
                        /* upload WEP keys to hardware */
diff --git a/drivers/usb/net/zd1201.c b/drivers/net/wireless/zd1201.c
index 9b1e4ed1d07e..662ecc8a33ff 100644
--- a/drivers/usb/net/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -33,7 +33,7 @@ static struct usb_device_id zd1201_table[] = {
        {}
 };
-static int ap = 0;      /* Are we an AP or a normal station? */
+static int ap;  /* Are we an AP or a normal station? */
 #define ZD1201_VERSION  "0.15"
@@ -49,7 +49,7 @@ MODULE_DEVICE_TABLE(usb, zd1201_table);
 static int zd1201_fw_upload(struct usb_device *dev, int apfw)
 {
        const struct firmware *fw_entry;
-        char* data;
+        char *data;
        unsigned long len;
        int err;
        unsigned char ret;
@@ -65,7 +65,7 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
        if (err) {
                dev_err(&dev->dev, "Failed to load %s firmware file!\n", fwfile);
                dev_err(&dev->dev, "Make sure the hotplug firmware loader is installed.\n");
-                dev_err(&dev->dev, "Goto http://linux-lc100020.sourceforge.net for more info\n");
+                dev_err(&dev->dev, "Goto http://linux-lc100020.sourceforge.net for more info.\n");
                return err;
        }
@@ -94,12 +94,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
            USB_DIR_OUT | 0x40, 0, 0, NULL, 0, ZD1201_FW_TIMEOUT);
        if (err < 0)
                goto exit;
-                                                                                                                                                                
        err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
            USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
        if (err < 0)
                goto exit;
-                                                                                                                                                                                                                                                                                        
        if (ret & 0x80) {
                err = -EIO;
                goto exit;
@@ -166,13 +166,13 @@ static int zd1201_docmd(struct zd1201 *zd, int cmd, int parm0,
                return -ENOMEM;
        }
        usb_fill_bulk_urb(urb, zd->usb, usb_sndbulkpipe(zd->usb, zd->endp_out2),
-             command, 16, zd1201_usbfree, zd);
+                          command, 16, zd1201_usbfree, zd);
        ret = usb_submit_urb(urb, GFP_ATOMIC);
        if (ret) {
                kfree(command);
                usb_free_urb(urb);
        }
-        
        return ret;
 }
@@ -316,7 +316,7 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
                fc = le16_to_cpu(*(__le16 *)&data[datalen-16]);
                seq = le16_to_cpu(*(__le16 *)&data[datalen-24]);
-                if(zd->monitor) {
+                if (zd->monitor) {
                        if (datalen < 24)
                                goto resubmit;
                        if (!(skb = dev_alloc_skb(datalen+24)))
@@ -364,7 +364,7 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
                                goto resubmit;
                        }
                        hlist_for_each_entry(frag, node, &zd->fraglist, fnode)
-                                if(frag->seq == (seq&IEEE80211_SCTL_SEQ))
+                                if (frag->seq == (seq&IEEE80211_SCTL_SEQ))
                                        break;
                        if (!frag)
                                goto resubmit;
@@ -376,7 +376,6 @@ static void zd1201_usbrx(struct urb *urb, struct pt_regs *regs)
                                goto resubmit;
                        hlist_del_init(&frag->fnode);
                        kfree(frag);
-                        /* Fallthrough */
                } else {
                        if (datalen<14)
                                goto resubmit;
@@ -422,7 +421,7 @@ static int zd1201_getconfig(struct zd1201 *zd, int rid, void *riddata,
        int rid_fid;
        int length;
        unsigned char *pdata;
-        
        zd->rxdatas = 0;
        err = zd1201_docmd(zd, ZD1201_CMDCODE_ACCESS, rid, 0, 0);
        if (err)
@@ -471,11 +470,11 @@ static int zd1201_getconfig(struct zd1201 *zd, int rid, void *riddata,
        length = zd->rxlen;
        do {
-                int  actual_length;
+                int actual_length;
                actual_length = (length > 64) ? 64 : length;
-                if(pdata[0] != 0x3) {
+                if (pdata[0] != 0x3) {
                        dev_dbg(&zd->usb->dev, "Rx Resource packet type error: %02X\n",
                            pdata[0]);
                        return -EINVAL;
@@ -487,11 +486,10 @@ static int zd1201_getconfig(struct zd1201 *zd, int rid, void *riddata,
                }
                /* Skip the 4 bytes header (RID length and RID) */
-                if(i == 0) {
+                if (i == 0) {
                        pdata += 8;
                        actual_length -= 8;
-                }
+                } else {
-                else {
                        pdata += 4;
                        actual_length -= 4;
                }
@@ -620,7 +618,7 @@ static int zd1201_drvr_start(struct zd1201 *zd)
        short max;
        __le16 zdmax;
        unsigned char *buffer;
-        
        buffer = kzalloc(ZD1201_RXSIZE, GFP_KERNEL);
        if (!buffer)
                return -ENOMEM;
@@ -632,7 +630,7 @@ static int zd1201_drvr_start(struct zd1201 *zd)
        err = usb_submit_urb(zd->rx_urb, GFP_KERNEL);
        if (err)
                goto err_buffer;
-        
        err = zd1201_docmd(zd, ZD1201_CMDCODE_INIT, 0, 0, 0);
        if (err)
                goto err_urb;
@@ -684,7 +682,7 @@ static int zd1201_enable(struct zd1201 *zd)
 static int zd1201_disable(struct zd1201 *zd)
 {
        int err;
-        
        if (!zd->mac_enabled)
                return 0;
        if (zd->monitor) {
@@ -764,7 +762,6 @@ static int zd1201_net_open(struct net_device *dev)
 static int zd1201_net_stop(struct net_device *dev)
 {
        netif_stop_queue(dev);
-        
        return 0;
 }
@@ -915,7 +912,6 @@ static int zd1201_get_name(struct net_device *dev,
    struct iw_request_info *info, char *name, char *extra)
 {
        strcpy(name, "IEEE 802.11b");
        return 0;
 }
@@ -1013,11 +1009,10 @@ static int zd1201_set_mode(struct net_device *dev,
                        if (err)
                                return err;
        }
-        zd->monitor=monitor;
+        zd->monitor = monitor;
        /* If monitor mode is set we don't actually turn it on here since it
         * is done during mac reset anyway (see zd1201_mac_enable).
         */
        zd1201_mac_reset(zd);
        return 0;
@@ -1117,7 +1112,7 @@ static int zd1201_get_wap(struct net_device *dev,
                zd->iwstats.qual.updated = 2;
        }
-        return zd1201_getconfig(zd,ZD1201_RID_CURRENTBSSID,ap_addr->sa_data,6);
+        return zd1201_getconfig(zd, ZD1201_RID_CURRENTBSSID, ap_addr->sa_data, 6);
 }
 static int zd1201_set_scan(struct net_device *dev,
@@ -1275,7 +1270,7 @@ static int zd1201_set_rate(struct net_device *dev,
        if (!rrq->fixed) { /* Also enable all lower bitrates */
                rate |= rate-1;
        }
-        
        err = zd1201_setconfig16(zd, ZD1201_RID_TXRATECNTL, rate);
        if (err)
                return err;
@@ -1486,7 +1481,7 @@ static int zd1201_get_encode(struct net_device *dev,
                return -EINVAL;
        erq->flags |= i+1;
-        
        erq->length = zd->encode_keylen[i];
        memcpy(key, zd->encode_keys[i], erq->length);
@@ -1529,11 +1524,7 @@ static int zd1201_set_power(struct net_device *dev,
                return -EINVAL;
        }
 out:
-        err = zd1201_setconfig16(zd, ZD1201_RID_CNFPMENABLED, enabled);
+        return zd1201_setconfig16(zd, ZD1201_RID_CNFPMENABLED, enabled);
-        if (err)
-                return err;
-        return 0;
 }
 static int zd1201_get_power(struct net_device *dev,
@@ -1627,15 +1618,11 @@ static int zd1201_set_hostauth(struct net_device *dev,
    struct iw_request_info *info, struct iw_param *rrq, char *extra)
 {
        struct zd1201 *zd = (struct zd1201 *)dev->priv;
-        int err;
        if (!zd->ap)
                return -EOPNOTSUPP;
-        err = zd1201_setconfig16(zd, ZD1201_RID_CNFHOSTAUTH, rrq->value);
+        return zd1201_setconfig16(zd, ZD1201_RID_CNFHOSTAUTH, rrq->value);
-        if (err)
-                return err;
-        return 0;
 }
 static int zd1201_get_hostauth(struct net_device *dev,
@@ -1744,7 +1731,7 @@ static int zd1201_probe(struct usb_interface *interface,
 {
        struct zd1201 *zd;
        struct usb_device *usb;
-        int i, err;
+        int err;
        short porttype;
        char buf[IW_ESSID_MAX_SIZE+2];
@@ -1773,9 +1760,7 @@ static int zd1201_probe(struct usb_interface *interface,
        if (!zd->rx_urb || !zd->tx_urb)
                goto err_zd;
-        for(i = 0; i<100; i++)
+        mdelay(100);
-                udelay(1000);
        err = zd1201_drvr_start(zd);
        if (err)
                goto err_zd;
@@ -1833,7 +1818,7 @@ static int zd1201_probe(struct usb_interface *interface,
                goto err_net;
        dev_info(&usb->dev, "%s: ZD1201 USB Wireless interface\n",
            zd->dev->name);
-        
        usb_set_intfdata(interface, zd);
        return 0;
diff --git a/drivers/usb/net/zd1201.h b/drivers/net/wireless/zd1201.h
index 235f0ee34b24..235f0ee34b24 100644
--- a/drivers/usb/net/zd1201.h
+++ b/drivers/net/wireless/zd1201.h
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 48d3b3d30c21..74b3124e8247 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -1143,6 +1143,12 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 {
        struct pcmcia_socket *s = pcmcia_get_socket(skt);
+        if (!s) {
+                printk(KERN_ERR "PCMCIA obtaining reference to socket %p " \
+                        "failed, event 0x%x lost!\n", skt, event);
+                return -ENODEV;
+        }
        ds_dbg(1, "ds_event(0x%06x, %d, 0x%p)\n",
               event, priority, skt);
diff --git a/drivers/rtc/rtc-m48t86.c b/drivers/rtc/rtc-m48t86.c
index f6e7ee04f3dc..8c0d1a6739ad 100644
--- a/drivers/rtc/rtc-m48t86.c
+++ b/drivers/rtc/rtc-m48t86.c
@@ -48,33 +48,33 @@ static int m48t86_rtc_read_time(struct device *dev, struct rtc_time *tm)
        struct platform_device *pdev = to_platform_device(dev);
        struct m48t86_ops *ops = pdev->dev.platform_data;
-        reg = ops->readb(M48T86_REG_B);
+        reg = ops->readbyte(M48T86_REG_B);
        if (reg & M48T86_REG_B_DM) {
                /* data (binary) mode */
-                tm->tm_sec      = ops->readb(M48T86_REG_SEC);
+                tm->tm_sec      = ops->readbyte(M48T86_REG_SEC);
-                tm->tm_min      = ops->readb(M48T86_REG_MIN);
+                tm->tm_min      = ops->readbyte(M48T86_REG_MIN);
-                tm->tm_hour     = ops->readb(M48T86_REG_HOUR) & 0x3F;
+                tm->tm_hour     = ops->readbyte(M48T86_REG_HOUR) & 0x3F;
-                tm->tm_mday     = ops->readb(M48T86_REG_DOM);
+                tm->tm_mday     = ops->readbyte(M48T86_REG_DOM);
                /* tm_mon is 0-11 */
-                tm->tm_mon      = ops->readb(M48T86_REG_MONTH) - 1;
+                tm->tm_mon      = ops->readbyte(M48T86_REG_MONTH) - 1;
-                tm->tm_year     = ops->readb(M48T86_REG_YEAR) + 100;
+                tm->tm_year     = ops->readbyte(M48T86_REG_YEAR) + 100;
-                tm->tm_wday     = ops->readb(M48T86_REG_DOW);
+                tm->tm_wday     = ops->readbyte(M48T86_REG_DOW);
        } else {
                /* bcd mode */
-                tm->tm_sec      = BCD2BIN(ops->readb(M48T86_REG_SEC));
+                tm->tm_sec      = BCD2BIN(ops->readbyte(M48T86_REG_SEC));
-                tm->tm_min      = BCD2BIN(ops->readb(M48T86_REG_MIN));
+                tm->tm_min      = BCD2BIN(ops->readbyte(M48T86_REG_MIN));
-                tm->tm_hour     = BCD2BIN(ops->readb(M48T86_REG_HOUR) & 0x3F);
+                tm->tm_hour     = BCD2BIN(ops->readbyte(M48T86_REG_HOUR) & 0x3F);
-                tm->tm_mday     = BCD2BIN(ops->readb(M48T86_REG_DOM));
+                tm->tm_mday     = BCD2BIN(ops->readbyte(M48T86_REG_DOM));
                /* tm_mon is 0-11 */
-                tm->tm_mon      = BCD2BIN(ops->readb(M48T86_REG_MONTH)) - 1;
+                tm->tm_mon      = BCD2BIN(ops->readbyte(M48T86_REG_MONTH)) - 1;
-                tm->tm_year     = BCD2BIN(ops->readb(M48T86_REG_YEAR)) + 100;
+                tm->tm_year     = BCD2BIN(ops->readbyte(M48T86_REG_YEAR)) + 100;
-                tm->tm_wday     = BCD2BIN(ops->readb(M48T86_REG_DOW));
+                tm->tm_wday     = BCD2BIN(ops->readbyte(M48T86_REG_DOW));
        }
        /* correct the hour if the clock is in 12h mode */
        if (!(reg & M48T86_REG_B_H24))
-                if (ops->readb(M48T86_REG_HOUR) & 0x80)
+                if (ops->readbyte(M48T86_REG_HOUR) & 0x80)
                        tm->tm_hour += 12;
        return 0;
@@ -86,35 +86,35 @@ static int m48t86_rtc_set_time(struct device *dev, struct rtc_time *tm)
        struct platform_device *pdev = to_platform_device(dev);
        struct m48t86_ops *ops = pdev->dev.platform_data;
-        reg = ops->readb(M48T86_REG_B);
+        reg = ops->readbyte(M48T86_REG_B);
        /* update flag and 24h mode */
        reg |= M48T86_REG_B_SET | M48T86_REG_B_H24;
-        ops->writeb(reg, M48T86_REG_B);
+        ops->writebyte(reg, M48T86_REG_B);
        if (reg & M48T86_REG_B_DM) {
                /* data (binary) mode */
-                ops->writeb(tm->tm_sec, M48T86_REG_SEC);
+                ops->writebyte(tm->tm_sec, M48T86_REG_SEC);
-                ops->writeb(tm->tm_min, M48T86_REG_MIN);
+                ops->writebyte(tm->tm_min, M48T86_REG_MIN);
-                ops->writeb(tm->tm_hour, M48T86_REG_HOUR);
+                ops->writebyte(tm->tm_hour, M48T86_REG_HOUR);
-                ops->writeb(tm->tm_mday, M48T86_REG_DOM);
+                ops->writebyte(tm->tm_mday, M48T86_REG_DOM);
-                ops->writeb(tm->tm_mon + 1, M48T86_REG_MONTH);
+                ops->writebyte(tm->tm_mon + 1, M48T86_REG_MONTH);
-                ops->writeb(tm->tm_year % 100, M48T86_REG_YEAR);
+                ops->writebyte(tm->tm_year % 100, M48T86_REG_YEAR);
-                ops->writeb(tm->tm_wday, M48T86_REG_DOW);
+                ops->writebyte(tm->tm_wday, M48T86_REG_DOW);
        } else {
                /* bcd mode */
-                ops->writeb(BIN2BCD(tm->tm_sec), M48T86_REG_SEC);
+                ops->writebyte(BIN2BCD(tm->tm_sec), M48T86_REG_SEC);
-                ops->writeb(BIN2BCD(tm->tm_min), M48T86_REG_MIN);
+                ops->writebyte(BIN2BCD(tm->tm_min), M48T86_REG_MIN);
-                ops->writeb(BIN2BCD(tm->tm_hour), M48T86_REG_HOUR);
+                ops->writebyte(BIN2BCD(tm->tm_hour), M48T86_REG_HOUR);
-                ops->writeb(BIN2BCD(tm->tm_mday), M48T86_REG_DOM);
+                ops->writebyte(BIN2BCD(tm->tm_mday), M48T86_REG_DOM);
-                ops->writeb(BIN2BCD(tm->tm_mon + 1), M48T86_REG_MONTH);
+                ops->writebyte(BIN2BCD(tm->tm_mon + 1), M48T86_REG_MONTH);
-                ops->writeb(BIN2BCD(tm->tm_year % 100), M48T86_REG_YEAR);
+                ops->writebyte(BIN2BCD(tm->tm_year % 100), M48T86_REG_YEAR);
-                ops->writeb(BIN2BCD(tm->tm_wday), M48T86_REG_DOW);
+                ops->writebyte(BIN2BCD(tm->tm_wday), M48T86_REG_DOW);
        }
        /* update ended */
        reg &= ~M48T86_REG_B_SET;
-        ops->writeb(reg, M48T86_REG_B);
+        ops->writebyte(reg, M48T86_REG_B);
        return 0;
 }
@@ -125,12 +125,12 @@ static int m48t86_rtc_proc(struct device *dev, struct seq_file *seq)
        struct platform_device *pdev = to_platform_device(dev);
        struct m48t86_ops *ops = pdev->dev.platform_data;
-        reg = ops->readb(M48T86_REG_B);
+        reg = ops->readbyte(M48T86_REG_B);
        seq_printf(seq, "mode\t\t: %s\n",
                 (reg & M48T86_REG_B_DM) ? "binary" : "bcd");
-        reg = ops->readb(M48T86_REG_D);
+        reg = ops->readbyte(M48T86_REG_D);
        seq_printf(seq, "battery\t\t: %s\n",
                 (reg & M48T86_REG_D_VRT) ? "ok" : "exhausted");
@@ -157,7 +157,7 @@ static int __devinit m48t86_rtc_probe(struct platform_device *dev)
        platform_set_drvdata(dev, rtc);
        /* read battery status */
-        reg = ops->readb(M48T86_REG_D);
+        reg = ops->readbyte(M48T86_REG_D);
        dev_info(&dev->dev, "battery %s\n",
                (reg & M48T86_REG_D_VRT) ? "ok" : "exhausted");
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 74a257b23383..e210f89a2449 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -45,11 +45,11 @@ struct pgid {
        union {
                __u8 fc;        /* SPID function code */
                struct path_state ps;   /* SNID path state */
-        } inf;
+        } __attribute__ ((packed)) inf;
        union {
                __u32 cpu_addr  : 16;   /* CPU address */
                struct extended_cssid ext_cssid;
-        } pgid_high;
+        } __attribute__ ((packed)) pgid_high;
        __u32 cpu_id    : 24;   /* CPU identification */
        __u32 cpu_model : 16;   /* CPU model */
        __u32 tod_high;         /* high word TOD clock */
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 180b3bf8b90d..49ec562d7f60 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -749,7 +749,7 @@ ccw_device_irq(struct ccw_device *cdev, enum dev_event dev_event)
                        /* Unit check but no sense data. Need basic sense. */
                        if (ccw_device_do_sense(cdev, irb) != 0)
                                goto call_handler_unsol;
-                        memcpy(irb, &cdev->private->irb, sizeof(struct irb));
+                        memcpy(&cdev->private->irb, irb, sizeof(struct irb));
                        cdev->private->state = DEV_STATE_W4SENSE;
                        cdev->private->intparm = 0;
                        return;
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index fa476e7e0a48..b046ffa22101 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -4297,6 +4297,7 @@ static int ata_start_drive(struct ata_port *ap, struct ata_device *dev)
 int ata_device_resume(struct ata_port *ap, struct ata_device *dev)
 {
        if (ap->flags & ATA_FLAG_SUSPENDED) {
+                ata_busy_wait(ap, ATA_BUSY | ATA_DRQ, 200000);
                ap->flags &= ~ATA_FLAG_SUSPENDED;
                ata_set_mode(ap);
        }
diff --git a/drivers/scsi/ppa.c b/drivers/scsi/ppa.c
index fee843fab1c7..108910f512e4 100644
--- a/drivers/scsi/ppa.c
+++ b/drivers/scsi/ppa.c
@@ -982,6 +982,12 @@ static int device_check(ppa_struct *dev)
        return -ENODEV;
 }
+static int ppa_adjust_queue(struct scsi_device *device)
+{
+        blk_queue_bounce_limit(device->request_queue, BLK_BOUNCE_HIGH);
+        return 0;
+}
 static struct scsi_host_template ppa_template = {
        .module                 = THIS_MODULE,
        .proc_name              = "ppa",
@@ -997,6 +1003,7 @@ static struct scsi_host_template ppa_template = {
        .cmd_per_lun            = 1,
        .use_clustering         = ENABLE_CLUSTERING,
        .can_queue              = 1,
+        .slave_alloc            = ppa_adjust_queue,
 };
 /***************************************************************************
diff --git a/drivers/scsi/sata_sil24.c b/drivers/scsi/sata_sil24.c
index f7264fd611c2..cb9082fd7e2f 100644
--- a/drivers/scsi/sata_sil24.c
+++ b/drivers/scsi/sata_sil24.c
@@ -454,7 +454,7 @@ static int sil24_softreset(struct ata_port *ap, int verbose,
         */
        msleep(10);
-        prb->ctrl = PRB_CTRL_SRST;
+        prb->ctrl = cpu_to_le16(PRB_CTRL_SRST);
        prb->fis[1] = 0; /* no PM yet */
        writel((u32)paddr, port + PORT_CMD_ACTIVATE);
@@ -551,9 +551,9 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
                if (qc->tf.protocol != ATA_PROT_ATAPI_NODATA) {
                        if (qc->tf.flags & ATA_TFLAG_WRITE)
-                                prb->ctrl = PRB_CTRL_PACKET_WRITE;
+                                prb->ctrl = cpu_to_le16(PRB_CTRL_PACKET_WRITE);
                        else
-                                prb->ctrl = PRB_CTRL_PACKET_READ;
+                                prb->ctrl = cpu_to_le16(PRB_CTRL_PACKET_READ);
                } else
                        prb->ctrl = 0;
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 941c1e15c899..62f8cb7b3d2b 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -165,6 +165,7 @@ static struct {
        {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD},
        {"HP", "C1557A", NULL, BLIST_FORCELUN},
        {"HP", "C3323-300", "4269", BLIST_NOTQ},
+        {"HP", "C5713A", NULL, BLIST_NOREPORTLUN},
        {"IBM", "AuSaV1S2", NULL, BLIST_FORCELUN},
        {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN},
        {"IBM", "2105", NULL, BLIST_RETRY_HWERROR},
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 764a8b375ead..faee4757c03a 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -367,7 +367,7 @@ static int scsi_req_map_sg(struct request *rq, struct scatterlist *sgl,
                           int nsegs, unsigned bufflen, gfp_t gfp)
 {
        struct request_queue *q = rq->q;
-        int nr_pages = (bufflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
+        int nr_pages = (bufflen + sgl[0].offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
        unsigned int data_len = 0, len, bytes, off;
        struct page *page;
        struct bio *bio = NULL;
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 8b6d65e21bae..f3b16066387c 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -955,7 +955,8 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
        list_for_each_entry(rphy, &sas_host->rphy_list, list) {
                struct sas_phy *parent = dev_to_phy(rphy->dev.parent);
-                if (rphy->scsi_target_id == -1)
+                if (rphy->identify.device_type != SAS_END_DEVICE ||
+                    rphy->scsi_target_id == -1)
                        continue;
                if ((channel == SCAN_WILD_CARD || channel == parent->port_identifier) &&
@@ -977,7 +978,6 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
 #define SETUP_TEMPLATE(attrb, field, perm, test)                                \
        i->private_##attrb[count] = class_device_attr_##field;          \
        i->private_##attrb[count].attr.mode = perm;                     \
-        i->private_##attrb[count].store = NULL;                         \
        i->attrb[count] = &i->private_##attrb[count];                   \
        if (test)                                                       \
                count++
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 969f94900431..5cba59ad7dc5 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -1164,14 +1164,16 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
        struct fs_uart_platform_info *pdata;
        struct platform_device* pdev = early_uart_get_pdev(co->index);
-        port =
-            (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
-        pinfo = (struct uart_cpm_port *)port;
        if (!pdev) {
                pr_info("cpm_uart: console: compat mode\n");
                /* compatibility - will be cleaned up */
                cpm_uart_init_portdesc();
+        }
+        port =
+            (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
+        pinfo = (struct uart_cpm_port *)port;
+        if (!pdev) {
                if (pinfo->set_lineif)
                        pinfo->set_lineif(pinfo);
        } else {
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm2.c b/drivers/serial/cpm_uart/cpm_uart_cpm2.c
index 4b2de08f46d0..cdba128250a9 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm2.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm2.c
@@ -213,7 +213,7 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
            L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
        if (is_con) {
                mem_addr = alloc_bootmem(memsz);
-                dma_addr = mem_addr;
+                dma_addr = virt_to_bus(mem_addr);
        }
        else
                mem_addr = dma_alloc_coherent(NULL, memsz, &dma_addr,
diff --git a/drivers/usb/net/Kconfig b/drivers/usb/net/Kconfig
index efd6ca7e4ac5..054059632a21 100644
--- a/drivers/usb/net/Kconfig
+++ b/drivers/usb/net/Kconfig
@@ -301,21 +301,4 @@ config USB_NET_ZAURUS
          some cases CDC MDLM) protocol, not "g_ether".
-config USB_ZD1201
-        tristate "USB ZD1201 based Wireless device support"
-        depends on NET_RADIO
-        select FW_LOADER
-        ---help---
-          Say Y if you want to use wireless LAN adapters based on the ZyDAS
-          ZD1201 chip.
-          This driver makes the adapter appear as a normal Ethernet interface,
-          typically on wlan0.
-          
-          The zd1201 device requires external firmware to be loaded.
-          This can be found at http://linux-lc100020.sourceforge.net/
-          
-          To compile this driver as a module, choose M here: the
-          module will be called zd1201.
 endmenu
diff --git a/drivers/usb/net/Makefile b/drivers/usb/net/Makefile
index a21e6eaabaf6..160f19dbdf12 100644
--- a/drivers/usb/net/Makefile
+++ b/drivers/usb/net/Makefile
@@ -15,7 +15,6 @@ obj-$(CONFIG_USB_NET_RNDIS_HOST)	+= rndis_host.o
 obj-$(CONFIG_USB_NET_CDC_SUBSET)        += cdc_subset.o
 obj-$(CONFIG_USB_NET_ZAURUS)    += zaurus.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
-obj-$(CONFIG_USB_ZD1201)        += zd1201.o
 ifeq ($(CONFIG_USB_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index 3d04b2def0f1..789450bb0bc9 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -214,10 +214,13 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 */
 int au1100fb_fb_setcolreg(unsigned regno, unsigned red, unsigned green, unsigned blue, unsigned transp, struct fb_info *fbi)
 {
-        struct au1100fb_device *fbdev = to_au1100fb_device(fbi);
+        struct au1100fb_device *fbdev;
-        u32 *palette = fbdev->regs->lcd_pallettebase;
+        u32 *palette;
        u32 value;
+        fbdev = to_au1100fb_device(fbi);
+        palette = fbdev->regs->lcd_pallettebase;
        if (regno > (AU1100_LCD_NBR_PALETTE_ENTRIES - 1))
                return -EINVAL;
@@ -316,9 +319,11 @@ int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi)
 */
 int au1100fb_fb_pan_display(struct fb_var_screeninfo *var, struct fb_info *fbi)
 {
-        struct au1100fb_device *fbdev = to_au1100fb_device(fbi);
+        struct au1100fb_device *fbdev;
        int dy;
+        fbdev = to_au1100fb_device(fbi);
        print_dbg("fb_pan_display %p %p", var, fbi);
        if (!var || !fbdev) {
@@ -382,10 +387,12 @@ void au1100fb_fb_rotate(struct fb_info *fbi, int angle)
 */
 int au1100fb_fb_mmap(struct fb_info *fbi, struct vm_area_struct *vma)
 {
-        struct au1100fb_device *fbdev = to_au1100fb_device(fbi);
+        struct au1100fb_device *fbdev;
        unsigned int len;
        unsigned long start=0, off;
+        fbdev = to_au1100fb_device(fbi);
        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
                return -EINVAL;
        }
@@ -467,7 +474,7 @@ int au1100fb_drv_probe(struct device *dev)
        if (!request_mem_region(au1100fb_fix.mmio_start, au1100fb_fix.mmio_len,
                                DRIVER_NAME)) {
-                print_err("fail to lock memory region at 0x%08x",
+                print_err("fail to lock memory region at 0x%08lx",
                                au1100fb_fix.mmio_start);
                return -EBUSY;
        }
@@ -595,13 +602,13 @@ int au1100fb_drv_remove(struct device *dev)
        return 0;
 }
-int au1100fb_drv_suspend(struct device *dev, u32 state, u32 level)
+int au1100fb_drv_suspend(struct device *dev, pm_message_t state)
 {
        /* TODO */
        return 0;
 }
-int au1100fb_drv_resume(struct device *dev, u32 level)
+int au1100fb_drv_resume(struct device *dev)
 {
        /* TODO */
        return 0;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index ca020719d20b..953eb8c171d6 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2631,7 +2631,7 @@ static int fbcon_scrolldelta(struct vc_data *vc, int lines)
                                        scr_memcpyw((u16 *) q, (u16 *) p,
                                                    vc->vc_size_row);
                                }
-                                softback_in = p;
+                                softback_in = softback_curr = p;
                                update_region(vc, vc->vc_origin,
                                              logo_lines * vc->vc_cols);
                        }
diff --git a/drivers/video/maxinefb.c b/drivers/video/maxinefb.c
index 743e7ad26acc..f85421bf7cb5 100644
--- a/drivers/video/maxinefb.c
+++ b/drivers/video/maxinefb.c
@@ -55,7 +55,7 @@ static struct fb_var_screeninfo maxinefb_defined = {
 };
 static struct fb_fix_screeninfo maxinefb_fix = {
-        .id =           "Maxine onboard graphics 1024x768x8",
+        .id =           "Maxine",
        .smem_len =     (1024*768),
        .type =         FB_TYPE_PACKED_PIXELS,
        .visual =       FB_VISUAL_PSEUDOCOLOR,
@@ -107,8 +107,6 @@ static int maxinefb_setcolreg(unsigned regno, unsigned red, unsigned green,
 static struct fb_ops maxinefb_ops = {
        .owner          = THIS_MODULE,
-        .fb_get_fix     = gen_get_fix,
-        .fb_get_var     = gen_get_var,
        .fb_setcolreg   = maxinefb_setcolreg,
        .fb_fillrect    = cfb_fillrect,
        .fb_copyarea    = cfb_copyarea,
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 1a27ecb46c9a..7271bb0257f6 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,10 @@
+Version 1.43
+------------
+POSIX locking to servers which support CIFS POSIX Extensions
+(disabled by default controlled by proc/fs/cifs/Experimental).
+Handle conversion of long share names (especially Asian languages)
+to Unicode during mount. 
 Version 1.42
 ------------
 Fix slow oplock break when mounted to different servers at the same time and
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 4e829dc672a6..c98755dca868 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -99,5 +99,5 @@ extern ssize_t	cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
 extern int cifs_ioctl (struct inode * inode, struct file * filep,
                       unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.42"
+#define CIFS_VERSION   "1.43"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 2879ba343ca7..310ea2f0e0bf 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -267,7 +267,7 @@ extern int CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
                        const int waitFlag);
 extern int CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                        const __u16 smb_file_id, const int get_flag,
-                        const __u64 len, const __u64 offset, 
+                        const __u64 len, struct file_lock *, 
                        const __u16 lock_type, const int waitFlag);
 extern int CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon);
 extern int CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index fd36892eda55..925881e00ff2 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1355,7 +1355,8 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 int
 CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                const __u16 smb_file_id, const int get_flag, const __u64 len,
-                const __u64 lkoffset, const __u16 lock_type, const int waitFlag)
+                struct file_lock *pLockData, const __u16 lock_type, 
+                const int waitFlag)
 {
        struct smb_com_transaction2_sfi_req *pSMB  = NULL;
        struct smb_com_transaction2_sfi_rsp *pSMBr = NULL;
@@ -1366,6 +1367,10 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
        __u16 params, param_offset, offset, byte_count, count;
        cFYI(1, ("Posix Lock"));
+        if(pLockData == NULL)
+                return EINVAL;
        rc = small_smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB);
        if (rc)
@@ -1404,10 +1409,10 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
        parm_data->lock_type = cpu_to_le16(lock_type);
        if(waitFlag)
-                parm_data->lock_flags = 1;
+                parm_data->lock_flags = cpu_to_le16(1);
        parm_data->pid = cpu_to_le32(current->tgid);
-        parm_data->start = lkoffset;
+        parm_data->start = cpu_to_le64(pLockData->fl_start);
-        parm_data->length = len;  /* normalize negative numbers */
+        parm_data->length = cpu_to_le64(len);  /* normalize negative numbers */
        pSMB->DataOffset = cpu_to_le16(offset);
        pSMB->Fid = smb_file_id;
@@ -1419,8 +1424,33 @@ CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
                        (struct smb_hdr *) pSMBr, &bytes_returned, 0);
        if (rc) {
                cFYI(1, ("Send error in Posix Lock = %d", rc));
-        }
+        } else if (get_flag) {
+                /* lock structure can be returned on get */
+                __u16 data_offset;
+                __u16 data_count;
+                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
+                if (rc || (pSMBr->ByteCount < sizeof(struct cifs_posix_lock))) {
+                        rc = -EIO;      /* bad smb */
+                        goto plk_err_exit;
+                }
+                if(pLockData == NULL) {
+                        rc = -EINVAL;
+                        goto plk_err_exit;
+                }
+                data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+                data_count  = le16_to_cpu(pSMBr->t2.DataCount);
+                if(data_count < sizeof(struct cifs_posix_lock)) {
+                        rc = -EIO;
+                        goto plk_err_exit;
+                }
+                parm_data = (struct cifs_posix_lock *)
+                        ((char *)&pSMBr->hdr.Protocol + data_offset);
+                if(parm_data->lock_type == cpu_to_le16(CIFS_UNLCK))
+                        pLockData->fl_type = F_UNLCK;
+        }
+ 
+plk_err_exit:
        if (pSMB)
                cifs_small_buf_release(pSMB);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index d2ec806a4f32..bae1479318d1 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2148,6 +2148,8 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
+                                if(ses->serverOS)
+                                        kfree(ses->serverOS);
                                ses->serverOS = kzalloc(2 * (len + 1), GFP_KERNEL);
                                if(ses->serverOS == NULL)
                                        goto sesssetup_nomem;
@@ -2160,6 +2162,8 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                if (remaining_words > 0) {
                                        len = UniStrnlen((wchar_t *)bcc_ptr,
                                                         remaining_words-1);
+                                        if(ses->serverNOS)
+                                                kfree(ses->serverNOS);
                                        ses->serverNOS = kzalloc(2 * (len + 1),GFP_KERNEL);
                                        if(ses->serverNOS == NULL)
                                                goto sesssetup_nomem;
@@ -2177,6 +2181,8 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                        if (remaining_words > 0) {
                                                len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words);
          /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain =
                                                    kzalloc(2*(len+1),GFP_KERNEL);
                                                if(ses->serverDomain == NULL)
@@ -2187,15 +2193,22 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                ses->serverDomain[2*len] = 0;
                                                ses->serverDomain[1+(2*len)] = 0;
                                        } /* else no more room so create dummy domain string */
-                                        else
+                                        else {
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain = 
                                                        kzalloc(2, GFP_KERNEL);
+                                        }
                                } else {        /* no room so create dummy domain and NOS string */
                                        /* if these kcallocs fail not much we
                                           can do, but better to not fail the
                                           sesssetup itself */
+                                        if(ses->serverDomain)
+                                                kfree(ses->serverDomain);
                                        ses->serverDomain =
                                            kzalloc(2, GFP_KERNEL);
+                                        if(ses->serverNOS)
+                                                kfree(ses->serverNOS);
                                        ses->serverNOS =
                                            kzalloc(2, GFP_KERNEL);
                                }
@@ -2204,6 +2217,8 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                if (((long) bcc_ptr + len) - (long)
                                    pByteArea(smb_buffer_response)
                                            <= BCC(smb_buffer_response)) {
+                                        if(ses->serverOS)
+                                                kfree(ses->serverOS);
                                        ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
                                        if(ses->serverOS == NULL)
                                                goto sesssetup_nomem;
@@ -2214,6 +2229,8 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                        bcc_ptr++;
                                        len = strnlen(bcc_ptr, 1024);
+                                        if(ses->serverNOS)
+                                                kfree(ses->serverNOS);
                                        ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
                                        if(ses->serverNOS == NULL)
                                                goto sesssetup_nomem;
@@ -2223,6 +2240,8 @@ CIFSSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                        bcc_ptr++;
                                        len = strnlen(bcc_ptr, 1024);
+                                        if(ses->serverDomain)
+                                                kfree(ses->serverDomain);
                                        ses->serverDomain = kzalloc(len + 1,GFP_KERNEL);
                                        if(ses->serverDomain == NULL)
                                                goto sesssetup_nomem;
@@ -2427,6 +2446,8 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
+                                        if(ses->serverOS)
+                                                kfree(ses->serverOS);
                                        ses->serverOS =
                                            kzalloc(2 * (len + 1), GFP_KERNEL);
                                        cifs_strfromUCS_le(ses->serverOS,
@@ -2441,6 +2462,8 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                len = UniStrnlen((wchar_t *)bcc_ptr,
                                                                 remaining_words
                                                                 - 1);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS =
                                                    kzalloc(2 * (len + 1),
                                                            GFP_KERNEL);
@@ -2454,7 +2477,9 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                remaining_words -= len + 1;
                                                if (remaining_words > 0) {
                                                        len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
-                            /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
+                     /* last string not null terminated (e.g.Windows XP/2000) */
+                                                        if(ses->serverDomain)
+                                                                kfree(ses->serverDomain);
                                                        ses->serverDomain = kzalloc(2*(len+1),GFP_KERNEL);
                                                        cifs_strfromUCS_le(ses->serverDomain,
                                                             (__le16 *)bcc_ptr, 
@@ -2463,11 +2488,18 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                        ses->serverDomain[2*len] = 0;
                                                        ses->serverDomain[1+(2*len)] = 0;
                                                } /* else no more room so create dummy domain string */
-                                                else
+                                                else {
+                                                        if(ses->serverDomain)
+                                                                kfree(ses->serverDomain);
                                                        ses->serverDomain =
                                                            kzalloc(2,GFP_KERNEL);
-                                        } else {        /* no room so create dummy domain and NOS string */
+                                                }
+                                        } else {/* no room use dummy domain&NOS */
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain = kzalloc(2, GFP_KERNEL);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS = kzalloc(2, GFP_KERNEL);
                                        }
                                } else {        /* ASCII */
@@ -2476,6 +2508,8 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                        if (((long) bcc_ptr + len) - (long)
                                            pByteArea(smb_buffer_response)
                                            <= BCC(smb_buffer_response)) {
+                                                if(ses->serverOS)
+                                                        kfree(ses->serverOS);
                                                ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
                                                strncpy(ses->serverOS, bcc_ptr, len);
@@ -2484,6 +2518,8 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                bcc_ptr++;
                                                len = strnlen(bcc_ptr, 1024);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS = kzalloc(len + 1,GFP_KERNEL);
                                                strncpy(ses->serverNOS, bcc_ptr, len);
                                                bcc_ptr += len;
@@ -2491,6 +2527,8 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                bcc_ptr++;
                                                len = strnlen(bcc_ptr, 1024);
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain = kzalloc(len + 1, GFP_KERNEL);
                                                strncpy(ses->serverDomain, bcc_ptr, len);
                                                bcc_ptr += len;
@@ -2728,6 +2766,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 /* We look for obvious messed up bcc or strings in response so we do not go off
   the end since (at least) WIN2K and Windows XP have a major bug in not null
   terminating last Unicode string in response  */
+                                        if(ses->serverOS)
+                                                kfree(ses->serverOS);
                                        ses->serverOS =
                                            kzalloc(2 * (len + 1), GFP_KERNEL);
                                        cifs_strfromUCS_le(ses->serverOS,
@@ -2743,6 +2783,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                                 bcc_ptr,
                                                                 remaining_words
                                                                 - 1);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS =
                                                    kzalloc(2 * (len + 1),
                                                            GFP_KERNEL);
@@ -2760,6 +2802,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                if (remaining_words > 0) {
                                                        len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
           /* last string is not always null terminated (for e.g. for Windows XP & 2000) */
+                                                        if(ses->serverDomain)
+                                                                kfree(ses->serverDomain);
                                                        ses->serverDomain =
                                                            kzalloc(2 *
                                                                    (len +
@@ -2777,13 +2821,20 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                                [1 + (2 * len)]
                                                            = 0;
                                                } /* else no more room so create dummy domain string */
-                                                else
+                                                else {
+                                                        if(ses->serverDomain)
+                                                                kfree(ses->serverDomain);
                                                        ses->serverDomain =
                                                            kzalloc(2,
                                                                    GFP_KERNEL);
+                                                }
                                        } else {        /* no room so create dummy domain and NOS string */
+                                                if(ses->serverDomain);
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain =
                                                    kzalloc(2, GFP_KERNEL);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS =
                                                    kzalloc(2, GFP_KERNEL);
                                        }
@@ -2792,6 +2843,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                        if (((long) bcc_ptr + len) - (long)
                                            pByteArea(smb_buffer_response)
                                            <= BCC(smb_buffer_response)) {
+                                                if(ses->serverOS)
+                                                        kfree(ses->serverOS);
                                                ses->serverOS =
                                                    kzalloc(len + 1,
                                                            GFP_KERNEL);
@@ -2803,6 +2856,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                bcc_ptr++;
                                                len = strnlen(bcc_ptr, 1024);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS =
                                                    kzalloc(len + 1,
                                                            GFP_KERNEL);
@@ -2812,6 +2867,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                bcc_ptr++;
                                                len = strnlen(bcc_ptr, 1024);
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain =
                                                    kzalloc(len + 1,
                                                            GFP_KERNEL);
@@ -3116,6 +3173,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
 /* We look for obvious messed up bcc or strings in response so we do not go off
  the end since (at least) WIN2K and Windows XP have a major bug in not null
  terminating last Unicode string in response  */
+                                        if(ses->serverOS)
+                                                kfree(ses->serverOS);
                                        ses->serverOS =
                                            kzalloc(2 * (len + 1), GFP_KERNEL);
                                        cifs_strfromUCS_le(ses->serverOS,
@@ -3131,6 +3190,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                                 bcc_ptr,
                                                                 remaining_words
                                                                 - 1);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS =
                                                    kzalloc(2 * (len + 1),
                                                            GFP_KERNEL);
@@ -3147,6 +3208,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                if (remaining_words > 0) {
                                                        len = UniStrnlen((wchar_t *) bcc_ptr, remaining_words); 
     /* last string not always null terminated (e.g. for Windows XP & 2000) */
+                                                        if(ses->serverDomain)
+                                                                kfree(ses->serverDomain);
                                                        ses->serverDomain =
                                                            kzalloc(2 *
                                                                    (len +
@@ -3172,10 +3235,17 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                                          len)]
                                                            = 0;
                                                } /* else no more room so create dummy domain string */
-                                                else
+                                                else {
+                                                        if(ses->serverDomain)
+                                                                kfree(ses->serverDomain);
                                                        ses->serverDomain = kzalloc(2,GFP_KERNEL);
+                                                }
                                        } else {  /* no room so create dummy domain and NOS string */
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain = kzalloc(2, GFP_KERNEL);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS = kzalloc(2, GFP_KERNEL);
                                        }
                                } else {        /* ASCII */
@@ -3183,6 +3253,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                        if (((long) bcc_ptr + len) - 
                        (long) pByteArea(smb_buffer_response) 
                            <= BCC(smb_buffer_response)) {
+                                                if(ses->serverOS)
+                                                        kfree(ses->serverOS);
                                                ses->serverOS = kzalloc(len + 1,GFP_KERNEL);
                                                strncpy(ses->serverOS,bcc_ptr, len);
@@ -3191,6 +3263,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                bcc_ptr++;
                                                len = strnlen(bcc_ptr, 1024);
+                                                if(ses->serverNOS)
+                                                        kfree(ses->serverNOS);
                                                ses->serverNOS = kzalloc(len+1,GFP_KERNEL);
                                                strncpy(ses->serverNOS, bcc_ptr, len);  
                                                bcc_ptr += len;
@@ -3198,6 +3272,8 @@ CIFSNTLMSSPAuthSessSetup(unsigned int xid, struct cifsSesInfo *ses,
                                                bcc_ptr++;
                                                len = strnlen(bcc_ptr, 1024);
+                                                if(ses->serverDomain)
+                                                        kfree(ses->serverDomain);
                                                ses->serverDomain = kzalloc(len+1,GFP_KERNEL);
                                                strncpy(ses->serverDomain, bcc_ptr, len);
                                                bcc_ptr += len;
@@ -3282,7 +3358,8 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                bcc_ptr++; /* align */
        }
-        if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+        if(ses->server->secMode & 
+                        (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
                smb_buffer->Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
        if (ses->capabilities & CAP_STATUS32) {
@@ -3294,8 +3371,10 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
        if (ses->capabilities & CAP_UNICODE) {
                smb_buffer->Flags2 |= SMBFLG2_UNICODE;
                length =
-                    cifs_strtoUCS((__le16 *) bcc_ptr, tree, 100, nls_codepage);
+                    cifs_strtoUCS((__le16 *) bcc_ptr, tree, 
-                bcc_ptr += 2 * length;  /* convert num of 16 bit words to bytes */
+                        6 /* max utf8 char length in bytes */ * 
+                        (/* server len*/ + 256 /* share len */), nls_codepage);
+                bcc_ptr += 2 * length;  /* convert num 16 bit words to bytes */
                bcc_ptr += 2;   /* skip trailing null */
        } else {                /* ASCII */
                strcpy(bcc_ptr, tree);
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index e152bf6afa60..e2b4ce1dad66 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -84,6 +84,8 @@ static inline int cifs_get_disposition(unsigned int flags)
                return FILE_OVERWRITE_IF;
        else if ((flags & O_CREAT) == O_CREAT)
                return FILE_OPEN_IF;
+        else if ((flags & O_TRUNC) == O_TRUNC)
+                return FILE_OVERWRITE;
        else
                return FILE_OPEN;
 }
@@ -656,7 +658,7 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                        else
                                posix_lock_type = CIFS_WRLCK;
                        rc = CIFSSMBPosixLock(xid, pTcon, netfid, 1 /* get */,
-                                        length, pfLock->fl_start,
+                                        length, pfLock,
                                        posix_lock_type, wait_flag);
                        FreeXid(xid);
                        return rc;
@@ -704,7 +706,7 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                        return -EOPNOTSUPP;
                }
                rc = CIFSSMBPosixLock(xid, pTcon, netfid, 0 /* set */,
-                                      length, pfLock->fl_start,
+                                      length, pfLock,
                                      posix_lock_type, wait_flag);
        } else
                rc = CIFSSMBLock(xid, pTcon, netfid, length, pfLock->fl_start,
@@ -904,8 +906,10 @@ static ssize_t cifs_write(struct file *file, const char *write_data,
                                if (rc != 0)
                                        break;
                        }
-                        if(experimEnabled || (pTcon->ses->server->secMode & 
+                        if(experimEnabled || (pTcon->ses->server &&
-                         (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) == 0) {
+                                ((pTcon->ses->server->secMode & 
+                                (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                                == 0))) {
                                struct kvec iov[2];
                                unsigned int len;
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 8aac5334680d..34b39e9a1e5a 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -767,7 +767,6 @@ int ext3_group_add(struct super_block *sb, struct ext3_new_group_data *input)
        if (input->group != sbi->s_groups_count) {
                ext3_warning(sb, __FUNCTION__,
                             "multiple resizers run on filesystem!");
-                unlock_super(sb);
                err = -EBUSY;
                goto exit_journal;
        }
diff --git a/fs/namei.c b/fs/namei.c
index 96723ae83c89..d6e2ee251736 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1080,8 +1080,8 @@ static int fastcall do_path_lookup(int dfd, const char *name,
        nd->flags = flags;
        nd->depth = 0;
-        read_lock(&current->fs->lock);
        if (*name=='/') {
+                read_lock(&current->fs->lock);
                if (current->fs->altroot && !(nd->flags & LOOKUP_NOALT)) {
                        nd->mnt = mntget(current->fs->altrootmnt);
                        nd->dentry = dget(current->fs->altroot);
@@ -1092,33 +1092,35 @@ static int fastcall do_path_lookup(int dfd, const char *name,
                }
                nd->mnt = mntget(current->fs->rootmnt);
                nd->dentry = dget(current->fs->root);
+                read_unlock(&current->fs->lock);
        } else if (dfd == AT_FDCWD) {
+                read_lock(&current->fs->lock);
                nd->mnt = mntget(current->fs->pwdmnt);
                nd->dentry = dget(current->fs->pwd);
+                read_unlock(&current->fs->lock);
        } else {
                struct dentry *dentry;
                file = fget_light(dfd, &fput_needed);
                retval = -EBADF;
                if (!file)
-                        goto unlock_fail;
+                        goto out_fail;
                dentry = file->f_dentry;
                retval = -ENOTDIR;
                if (!S_ISDIR(dentry->d_inode->i_mode))
-                        goto fput_unlock_fail;
+                        goto fput_fail;
                retval = file_permission(file, MAY_EXEC);
                if (retval)
-                        goto fput_unlock_fail;
+                        goto fput_fail;
                nd->mnt = mntget(file->f_vfsmnt);
                nd->dentry = dget(dentry);
                fput_light(file, fput_needed);
        }
-        read_unlock(&current->fs->lock);
        current->total_link_count = 0;
        retval = link_path_walk(name, nd);
 out:
@@ -1127,13 +1129,12 @@ out:
                                nd->dentry->d_inode))
                audit_inode(name, nd->dentry->d_inode, flags);
        }
+out_fail:
        return retval;
-fput_unlock_fail:
+fput_fail:
        fput_light(file, fput_needed);
-unlock_fail:
+        goto out_fail;
-        read_unlock(&current->fs->lock);
-        return retval;
 }
 int fastcall path_lookup(const char *name, unsigned int flags,
diff --git a/include/asm-alpha/smp.h b/include/asm-alpha/smp.h
index 9950706abdf8..e1432102be05 100644
--- a/include/asm-alpha/smp.h
+++ b/include/asm-alpha/smp.h
@@ -45,10 +45,8 @@ extern struct cpuinfo_alpha cpu_data[NR_CPUS];
 #define hard_smp_processor_id() __hard_smp_processor_id()
 #define raw_smp_processor_id()  (current_thread_info()->cpu)
-extern cpumask_t cpu_present_mask;
-extern cpumask_t cpu_online_map;
 extern int smp_num_cpus;
-#define cpu_possible_map        cpu_present_mask
+#define cpu_possible_map        cpu_present_map
 int smp_call_function_on_cpu(void (*func) (void *info), void *info,int retry, int wait, cpumask_t cpu);
diff --git a/include/asm-arm/arch-ixp23xx/memory.h b/include/asm-arm/arch-ixp23xx/memory.h
index 6e19f46d54d1..c85fc06a043c 100644
--- a/include/asm-arm/arch-ixp23xx/memory.h
+++ b/include/asm-arm/arch-ixp23xx/memory.h
@@ -49,7 +49,7 @@ static inline int __ixp23xx_arch_is_coherent(void)
 {
        extern unsigned int processor_id;
-        if (((processor_id & 15) >= 2) || machine_is_roadrunner())
+        if (((processor_id & 15) >= 4) || machine_is_roadrunner())
                return 1;
        return 0;
diff --git a/include/asm-arm/arch-l7200/serial_l7200.h b/include/asm-arm/arch-l7200/serial_l7200.h
index 238c595d97ea..b1008a9d23e5 100644
--- a/include/asm-arm/arch-l7200/serial_l7200.h
+++ b/include/asm-arm/arch-l7200/serial_l7200.h
@@ -28,7 +28,7 @@
 #define UARTDR                  0x00    /* Tx/Rx data */
 #define RXSTAT                  0x04    /* Rx status */
 #define H_UBRLCR                0x08    /* mode register high */
-#define M_UBRLCR                0x0C    /* mode reg mid (MSB of buad)*/
+#define M_UBRLCR                0x0C    /* mode reg mid (MSB of baud)*/
 #define L_UBRLCR                0x10    /* mode reg low (LSB of baud)*/
 #define UARTCON                 0x14    /* control register */
 #define UARTFLG                 0x18    /* flag register */
diff --git a/include/asm-arm/arch-l7200/uncompress.h b/include/asm-arm/arch-l7200/uncompress.h
index 9fcd40aee3e3..04be2a088639 100644
--- a/include/asm-arm/arch-l7200/uncompress.h
+++ b/include/asm-arm/arch-l7200/uncompress.h
@@ -6,7 +6,7 @@
 * Changelog:
 *  05-01-2000  SJH     Created
 *  05-13-2000  SJH     Filled in function bodies
- *  07-26-2000  SJH     Removed hard coded buad rate
+ *  07-26-2000  SJH     Removed hard coded baud rate
 */
 #include <asm/hardware.h>
diff --git a/include/asm-arm/system.h b/include/asm-arm/system.h
index 95b3abf4851b..7c9568d30307 100644
--- a/include/asm-arm/system.h
+++ b/include/asm-arm/system.h
@@ -127,6 +127,12 @@ static inline int cpu_is_xsc3(void)
 }
 #endif
+#if !defined(CONFIG_CPU_XSCALE) && !defined(CONFIG_CPU_XSC3)
+#define cpu_is_xscale() 0
+#else
+#define cpu_is_xscale() 1
+#endif
 #define set_cr(x)                                       \
        __asm__ __volatile__(                           \
        "mcr    p15, 0, %0, c1, c0, 0   @ set CR"       \
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
index 358e4d309ceb..c2059a3a0621 100644
--- a/include/asm-generic/pgtable.h
+++ b/include/asm-generic/pgtable.h
@@ -159,17 +159,8 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 #define lazy_mmu_prot_update(pte)       do { } while (0)
 #endif
-#ifndef __HAVE_ARCH_MULTIPLE_ZERO_PAGE
+#ifndef __HAVE_ARCH_MOVE_PTE
 #define move_pte(pte, prot, old_addr, new_addr) (pte)
-#else
-#define move_pte(pte, prot, old_addr, new_addr)                         \
-({                                                                      \
-        pte_t newpte = (pte);                                           \
-        if (pte_present(pte) && pfn_valid(pte_pfn(pte)) &&              \
-                        pte_page(pte) == ZERO_PAGE(old_addr))           \
-                newpte = mk_pte(ZERO_PAGE(new_addr), (prot));           \
-        newpte;                                                         \
-})
 #endif
 /*
diff --git a/include/asm-mips/addrspace.h b/include/asm-mips/addrspace.h
index 42520cc84b0f..1386af1cb7d9 100644
--- a/include/asm-mips/addrspace.h
+++ b/include/asm-mips/addrspace.h
@@ -129,6 +129,7 @@
 #if defined (CONFIG_CPU_R4300)                                          \
    || defined (CONFIG_CPU_R4X00)                                       \
    || defined (CONFIG_CPU_R5000)                                       \
+    || defined (CONFIG_CPU_RM7000)                                      \
    || defined (CONFIG_CPU_NEVADA)                                      \
    || defined (CONFIG_CPU_TX49XX)                                      \
    || defined (CONFIG_CPU_MIPS64)
diff --git a/include/asm-mips/cpu.h b/include/asm-mips/cpu.h
index 818b9a97e214..dff2a0a52f8f 100644
--- a/include/asm-mips/cpu.h
+++ b/include/asm-mips/cpu.h
@@ -51,6 +51,7 @@
 #define PRID_IMP_R4300          0x0b00
 #define PRID_IMP_VR41XX         0x0c00
 #define PRID_IMP_R12000         0x0e00
+#define PRID_IMP_R14000         0x0f00
 #define PRID_IMP_R8000          0x1000
 #define PRID_IMP_PR4450         0x1200
 #define PRID_IMP_R4600          0x2000
@@ -87,6 +88,7 @@
 #define PRID_IMP_24K            0x9300
 #define PRID_IMP_34K            0x9500
 #define PRID_IMP_24KE           0x9600
+#define PRID_IMP_74K            0x9700
 /*
 * These are the PRID's for when 23:16 == PRID_COMP_SIBYTE
@@ -196,7 +198,9 @@
 #define CPU_34K                 60
 #define CPU_PR4450              61
 #define CPU_SB1A                62
-#define CPU_LAST                62
+#define CPU_74K                 63
+#define CPU_R14000              64
+#define CPU_LAST                64
 /*
 * ISA Level encodings
diff --git a/include/asm-mips/delay.h b/include/asm-mips/delay.h
index 64dd45150f64..928f30f8c45c 100644
--- a/include/asm-mips/delay.h
+++ b/include/asm-mips/delay.h
@@ -19,20 +19,22 @@ static inline void __delay(unsigned long loops)
 {
        if (sizeof(long) == 4)
                __asm__ __volatile__ (
-                ".set\tnoreorder\n"
+                "       .set    noreorder                               \n"
-                "1:\tbnez\t%0,1b\n\t"
+                "       .align  3                                       \n"
-                "subu\t%0,1\n\t"
+                "1:     bnez    %0, 1b                                  \n"
-                ".set\treorder"
+                "       subu    %0, 1                                   \n"
+                "       .set    reorder                                 \n"
                : "=r" (loops)
                : "0" (loops));
        else if (sizeof(long) == 8)
                __asm__ __volatile__ (
-                ".set\tnoreorder\n"
+                "       .set    noreorder                               \n"
-                "1:\tbnez\t%0,1b\n\t"
+                "       .align  3                                       \n"
-                "dsubu\t%0,1\n\t"
+                "1:     bnez    %0, 1b                                  \n"
-                ".set\treorder"
+                "       dsubu   %0, 1                                   \n"
-                :"=r" (loops)
+                "       .set    reorder                                 \n"
-                :"0" (loops));
+                : "=r" (loops)
+                : "0" (loops));
 }
diff --git a/include/asm-mips/futex.h b/include/asm-mips/futex.h
index a554089991f2..12d118f1bc9c 100644
--- a/include/asm-mips/futex.h
+++ b/include/asm-mips/futex.h
@@ -7,6 +7,7 @@
 #include <linux/futex.h>
 #include <asm/errno.h>
 #include <asm/uaccess.h>
+#include <asm/war.h>
 #ifdef CONFIG_SMP
 #define __FUTEX_SMP_SYNC "      sync                                    \n"
@@ -16,30 +17,58 @@
 #define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)              \
 {                                                                       \
-        __asm__ __volatile__(                                           \
+        if (cpu_has_llsc && R10000_LLSC_WAR) {                          \
-        "       .set    push                                    \n"     \
+                __asm__ __volatile__(                                   \
-        "       .set    noat                                    \n"     \
+                "       .set    push                            \n"     \
-        "       .set    mips3                                   \n"     \
+                "       .set    noat                            \n"     \
-        "1:     ll      %1, (%3)        # __futex_atomic_op1    \n"     \
+                "       .set    mips3                           \n"     \
-        "       .set    mips0                                   \n"     \
+                "1:     ll      %1, (%3)        # __futex_atomic_op     \n" \
-        "       " insn  "                                       \n"     \
+                "       .set    mips0                           \n"     \
-        "       .set    mips3                                   \n"     \
+                "       " insn  "                               \n"     \
-        "2:     sc      $1, (%3)                                \n"     \
+                "       .set    mips3                           \n"     \
-        "       beqzl   $1, 1b                                  \n"     \
+                "2:     sc      $1, (%3)                        \n"     \
-        __FUTEX_SMP_SYNC                                                \
+                "       beqzl   $1, 1b                          \n"     \
-        "3:                                                     \n"     \
+                __FUTEX_SMP_SYNC                                        \
-        "       .set    pop                                     \n"     \
+                "3:                                             \n"     \
-        "       .set    mips0                                   \n"     \
+                "       .set    pop                             \n"     \
-        "       .section .fixup,\"ax\"                          \n"     \
+                "       .set    mips0                           \n"     \
-        "4:     li      %0, %5                                  \n"     \
+                "       .section .fixup,\"ax\"                  \n"     \
-        "       j       2b                                      \n"     \
+                "4:     li      %0, %5                          \n"     \
-        "       .previous                                       \n"     \
+                "       j       2b                              \n"     \
-        "       .section __ex_table,\"a\"                       \n"     \
+                "       .previous                               \n"     \
-        "       "__UA_ADDR "\t1b, 4b                            \n"     \
+                "       .section __ex_table,\"a\"               \n"     \
-        "       "__UA_ADDR "\t2b, 4b                            \n"     \
+                "       "__UA_ADDR "\t1b, 4b                    \n"     \
-        "       .previous                                       \n"     \
+                "       "__UA_ADDR "\t2b, 4b                    \n"     \
-        : "=r" (ret), "=r" (oldval)                                     \
+                "       .previous                               \n"     \
-        : "0" (0), "r" (uaddr), "Jr" (oparg), "i" (-EFAULT));           \
+                : "=r" (ret), "=r" (oldval)                             \
+                : "0" (0), "r" (uaddr), "Jr" (oparg), "i" (-EFAULT));   \
+        } else if (cpu_has_llsc) {                                      \
+                __asm__ __volatile__(                                   \
+                "       .set    push                            \n"     \
+                "       .set    noat                            \n"     \
+                "       .set    mips3                           \n"     \
+                "1:     ll      %1, (%3)        # __futex_atomic_op     \n" \
+                "       .set    mips0                           \n"     \
+                "       " insn  "                               \n"     \
+                "       .set    mips3                           \n"     \
+                "2:     sc      $1, (%3)                        \n"     \
+                "       beqz    $1, 1b                          \n"     \
+                __FUTEX_SMP_SYNC                                        \
+                "3:                                             \n"     \
+                "       .set    pop                             \n"     \
+                "       .set    mips0                           \n"     \
+                "       .section .fixup,\"ax\"                  \n"     \
+                "4:     li      %0, %5                          \n"     \
+                "       j       2b                              \n"     \
+                "       .previous                               \n"     \
+                "       .section __ex_table,\"a\"               \n"     \
+                "       "__UA_ADDR "\t1b, 4b                    \n"     \
+                "       "__UA_ADDR "\t2b, 4b                    \n"     \
+                "       .previous                               \n"     \
+                : "=r" (ret), "=r" (oldval)                             \
+                : "0" (0), "r" (uaddr), "Jr" (oparg), "i" (-EFAULT));   \
+        } else                                                          \
+                ret = -ENOSYS;                                          \
 }
 static inline int
@@ -102,7 +131,69 @@ futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
 static inline int
 futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
 {
-        return -ENOSYS;
+        int retval;
+        if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+                return -EFAULT;
+        if (cpu_has_llsc && R10000_LLSC_WAR) {
+                __asm__ __volatile__(
+                "# futex_atomic_cmpxchg_inatomic                        \n"
+                "       .set    push                                    \n"
+                "       .set    noat                                    \n"
+                "       .set    mips3                                   \n"
+                "1:     ll      %0, %2                                  \n"
+                "       bne     %0, %z3, 3f                             \n"
+                "       .set    mips0                                   \n"
+                "       move    $1, %z4                                 \n"
+                "       .set    mips3                                   \n"
+                "2:     sc      $1, %1                                  \n"
+                "       beqzl   $1, 1b                                  \n"
+                __FUTEX_SMP_SYNC
+                "3:                                                     \n"
+                "       .set    pop                                     \n"
+                "       .section .fixup,\"ax\"                          \n"
+                "4:     li      %0, %5                                  \n"
+                "       j       3b                                      \n"
+                "       .previous                                       \n"
+                "       .section __ex_table,\"a\"                       \n"
+                "       "__UA_ADDR "\t1b, 4b                            \n"
+                "       "__UA_ADDR "\t2b, 4b                            \n"
+                "       .previous                                       \n"
+                : "=&r" (retval), "=R" (*uaddr)
+                : "R" (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT)
+                : "memory");
+        } else if (cpu_has_llsc) {
+                __asm__ __volatile__(
+                "# futex_atomic_cmpxchg_inatomic                        \n"
+                "       .set    push                                    \n"
+                "       .set    noat                                    \n"
+                "       .set    mips3                                   \n"
+                "1:     ll      %0, %2                                  \n"
+                "       bne     %0, %z3, 3f                             \n"
+                "       .set    mips0                                   \n"
+                "       move    $1, %z4                                 \n"
+                "       .set    mips3                                   \n"
+                "2:     sc      $1, %1                                  \n"
+                "       beqz    $1, 1b                                  \n"
+                __FUTEX_SMP_SYNC
+                "3:                                                     \n"
+                "       .set    pop                                     \n"
+                "       .section .fixup,\"ax\"                          \n"
+                "4:     li      %0, %5                                  \n"
+                "       j       3b                                      \n"
+                "       .previous                                       \n"
+                "       .section __ex_table,\"a\"                       \n"
+                "       "__UA_ADDR "\t1b, 4b                            \n"
+                "       "__UA_ADDR "\t2b, 4b                            \n"
+                "       .previous                                       \n"
+                : "=&r" (retval), "=R" (*uaddr)
+                : "R" (*uaddr), "Jr" (oldval), "Jr" (newval), "i" (-EFAULT)
+                : "memory");
+        } else
+                return -ENOSYS;
+        return retval;
 }
 #endif
diff --git a/include/asm-mips/inst.h b/include/asm-mips/inst.h
index e0745f4ff624..1ed8d0f62577 100644
--- a/include/asm-mips/inst.h
+++ b/include/asm-mips/inst.h
@@ -6,6 +6,7 @@
 * for more details.
 *
 * Copyright (C) 1996, 2000 by Ralf Baechle
+ * Copyright (C) 2006 by Thiemo Seufer
 */
 #ifndef _ASM_INST_H
 #define _ASM_INST_H
@@ -21,14 +22,14 @@ enum major_op {
        cop0_op, cop1_op, cop2_op, cop1x_op,
        beql_op, bnel_op, blezl_op, bgtzl_op,
        daddi_op, daddiu_op, ldl_op, ldr_op,
-        major_1c_op, jalx_op, major_1e_op, major_1f_op,
+        spec2_op, jalx_op, mdmx_op, spec3_op,
        lb_op, lh_op, lwl_op, lw_op,
        lbu_op, lhu_op, lwr_op, lwu_op,
        sb_op, sh_op, swl_op, sw_op,
        sdl_op, sdr_op, swr_op, cache_op,
        ll_op, lwc1_op, lwc2_op, pref_op,
        lld_op, ldc1_op, ldc2_op, ld_op,
-        sc_op, swc1_op, swc2_op, rdhwr_op,
+        sc_op, swc1_op, swc2_op, major_3b_op,
        scd_op, sdc1_op, sdc2_op, sd_op
 };
@@ -37,7 +38,7 @@ enum major_op {
 */
 enum spec_op {
        sll_op, movc_op, srl_op, sra_op,
-        sllv_op, srlv_op, srav_op, spec1_unused_op, /* Opcode 0x07 is unused */
+        sllv_op, pmon_op, srlv_op, srav_op,
        jr_op, jalr_op, movz_op, movn_op,
        syscall_op, break_op, spim_op, sync_op,
        mfhi_op, mthi_op, mflo_op, mtlo_op,
@@ -55,6 +56,28 @@ enum spec_op {
 };
 /*
+ * func field of spec2 opcode.
+ */
+enum spec2_op {
+        madd_op, maddu_op, mul_op, spec2_3_unused_op,
+        msub_op, msubu_op, /* more unused ops */
+        clz_op = 0x20, clo_op,
+        dclz_op = 0x24, dclo_op,
+        sdbpp_op = 0x3f
+};
+/*
+ * func field of spec3 opcode.
+ */
+enum spec3_op {
+        ext_op, dextm_op, dextu_op, dext_op,
+        ins_op, dinsm_op, dinsu_op, dins_op,
+        bshfl_op = 0x20,
+        dbshfl_op = 0x24,
+        rdhwr_op = 0x3f
+};
+/*
 * rt field of bcond opcodes.
 */
 enum rt_op {
@@ -151,8 +174,8 @@ enum cop1x_func {
 * func field for mad opcodes (MIPS IV).
 */
 enum mad_func {
-        madd_op      = 0x08, msub_op      = 0x0a,
+        madd_fp_op      = 0x08, msub_fp_op      = 0x0a,
-        nmadd_op     = 0x0c, nmsub_op     = 0x0e
+        nmadd_fp_op     = 0x0c, nmsub_fp_op     = 0x0e
 };
 /*
diff --git a/include/asm-mips/mipsregs.h b/include/asm-mips/mipsregs.h
index a2ef579f6b1a..5af7517fce8a 100644
--- a/include/asm-mips/mipsregs.h
+++ b/include/asm-mips/mipsregs.h
@@ -291,7 +291,7 @@
 #define ST0_DL                  (_ULCAST_(1) << 24)
 /*
- * Enable the MIPS DSP ASE
+ * Enable the MIPS MDMX and DSP ASEs
 */
 #define ST0_MX                  0x01000000
diff --git a/include/asm-mips/page.h b/include/asm-mips/page.h
index a1eab136ff6c..4035ec79ecd4 100644
--- a/include/asm-mips/page.h
+++ b/include/asm-mips/page.h
@@ -139,9 +139,11 @@ typedef struct { unsigned long pgprot; } pgprot_t;
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
+#ifndef CONFIG_SPARSEMEM
 #ifndef CONFIG_NEED_MULTIPLE_NODES
 #define pfn_valid(pfn)          ((pfn) < max_mapnr)
 #endif
+#endif
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
 #define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
diff --git a/include/asm-mips/pgtable-32.h b/include/asm-mips/pgtable-32.h
index 4d6bc45df594..087c20769256 100644
--- a/include/asm-mips/pgtable-32.h
+++ b/include/asm-mips/pgtable-32.h
@@ -177,48 +177,67 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
        ((swp_entry_t) { ((type) << 10) | ((offset) << 15) })
 /*
- * Bits 0, 1, 2, 9 and 10 are taken, split up the 27 bits of offset
+ * Bits 0, 4, 8, and 9 are taken, split up 28 bits of offset into this range:
- * into this range:
 */
-#define PTE_FILE_MAX_BITS       27
+#define PTE_FILE_MAX_BITS       28
-#define pte_to_pgoff(_pte) \
+#define pte_to_pgoff(_pte)      ((((_pte).pte >> 1 ) & 0x07) | \
-        ((((_pte).pte >> 3) & 0x3f ) + (((_pte).pte >> 11) << 8 ))
+                                 (((_pte).pte >> 2 ) & 0x38) | \
+                                 (((_pte).pte >> 10) <<  6 ))
-#define pgoff_to_pte(off) \
+#define pgoff_to_pte(off)       ((pte_t) { (((off) & 0x07) << 1 ) | \
-        ((pte_t) { (((off) & 0x3f) << 3) + (((off) >> 8) << 11) + _PAGE_FILE })
+                                           (((off) & 0x38) << 2 ) | \
+                                           (((off) >>  6 ) << 10) | \
+                                           _PAGE_FILE })
 #else
 /* Swap entries must have VALID and GLOBAL bits cleared. */
+#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#define __swp_type(x)           (((x).val >> 2) & 0x1f)
+#define __swp_offset(x)          ((x).val >> 7)
+#define __swp_entry(type,offset)        \
+                ((swp_entry_t)  { ((type) << 2) | ((offset) << 7) })
+#else
 #define __swp_type(x)           (((x).val >> 8) & 0x1f)
-#define __swp_offset(x)         ((x).val >> 13)
+#define __swp_offset(x)          ((x).val >> 13)
 #define __swp_entry(type,offset)        \
-                ((swp_entry_t) { ((type) << 8) | ((offset) << 13) })
+                ((swp_entry_t)  { ((type) << 8) | ((offset) << 13) })
+#endif /* defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32) */
+#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
 /*
- * Bits 0, 1, 2, 7 and 8 are taken, split up the 27 bits of offset
+ * Bits 0 and 1 of pte_high are taken, use the rest for the page offset...
- * into this range:
 */
-#define PTE_FILE_MAX_BITS       27
+#define PTE_FILE_MAX_BITS       30
-#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32_R1)
+#define pte_to_pgoff(_pte)      ((_pte).pte_high >> 2)
-        /* fixme */
+#define pgoff_to_pte(off)       ((pte_t) { _PAGE_FILE, (off) << 2 })
-#define pte_to_pgoff(_pte) (((_pte).pte_high >> 6) + ((_pte).pte_high & 0x3f))
-#define pgoff_to_pte(off) \
-        ((pte_t){(((off) & 0x3f) + ((off) << 6) + _PAGE_FILE)})
 #else
-#define pte_to_pgoff(_pte) \
+/*
-        ((((_pte).pte >> 3) & 0x1f ) + (((_pte).pte >> 9) << 6 ))
+ * Bits 0, 4, 6, and 7 are taken, split up 28 bits of offset into this range:
+ */
+#define PTE_FILE_MAX_BITS       28
+#define pte_to_pgoff(_pte)      ((((_pte).pte >> 1) & 0x7) | \
+                                 (((_pte).pte >> 2) & 0x8) | \
+                                 (((_pte).pte >> 8) <<  4))
-#define pgoff_to_pte(off) \
+#define pgoff_to_pte(off)       ((pte_t) { (((off) & 0x7) << 1) | \
-        ((pte_t) { (((off) & 0x1f) << 3) + (((off) >> 6) << 9) + _PAGE_FILE })
+                                           (((off) & 0x8) << 2) | \
+                                           (((off) >>  4) << 8) | \
+                                           _PAGE_FILE })
 #endif
 #endif
+#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32)
+#define __pte_to_swp_entry(pte) ((swp_entry_t) { (pte).pte_high })
+#define __swp_entry_to_pte(x)   ((pte_t) { 0, (x).val })
+#else
 #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) })
 #define __swp_entry_to_pte(x)   ((pte_t) { (x).val })
+#endif
 #endif /* _ASM_PGTABLE_32_H */
diff --git a/include/asm-mips/pgtable-64.h b/include/asm-mips/pgtable-64.h
index 82166b254b27..2faf5c9ff127 100644
--- a/include/asm-mips/pgtable-64.h
+++ b/include/asm-mips/pgtable-64.h
@@ -224,15 +224,12 @@ static inline pte_t mk_swap_pte(unsigned long type, unsigned long offset)
 #define __swp_entry_to_pte(x)   ((pte_t) { (x).val })
 /*
- * Bits 0, 1, 2, 7 and 8 are taken, split up the 32 bits of offset
+ * Bits 0, 4, 6, and 7 are taken. Let's leave bits 1, 2, 3, and 5 alone to
- * into this range:
+ * make things easier, and only use the upper 56 bits for the page offset...
 */
-#define PTE_FILE_MAX_BITS       32
+#define PTE_FILE_MAX_BITS       56
-#define pte_to_pgoff(_pte) \
+#define pte_to_pgoff(_pte)      ((_pte).pte >> 8)
-        ((((_pte).pte >> 3) & 0x1f ) + (((_pte).pte >> 9) << 6 ))
+#define pgoff_to_pte(off)       ((pte_t) { ((off) << 8) | _PAGE_FILE })
-#define pgoff_to_pte(off) \
-        ((pte_t) { (((off) & 0x1f) << 3) + (((off) >> 6) << 9) + _PAGE_FILE })
 #endif /* _ASM_PGTABLE_64_H */
diff --git a/include/asm-mips/pgtable.h b/include/asm-mips/pgtable.h
index 702a28fa7a34..d0af2a3b0152 100644
--- a/include/asm-mips/pgtable.h
+++ b/include/asm-mips/pgtable.h
@@ -70,7 +70,15 @@ extern unsigned long zero_page_mask;
 #define ZERO_PAGE(vaddr) \
        (virt_to_page(empty_zero_page + (((unsigned long)(vaddr)) & zero_page_mask)))
-#define __HAVE_ARCH_MULTIPLE_ZERO_PAGE
+#define __HAVE_ARCH_MOVE_PTE
+#define move_pte(pte, prot, old_addr, new_addr)                         \
+({                                                                      \
+        pte_t newpte = (pte);                                           \
+        if (pte_present(pte) && pfn_valid(pte_pfn(pte)) &&              \
+                        pte_page(pte) == ZERO_PAGE(old_addr))           \
+                newpte = mk_pte(ZERO_PAGE(new_addr), (prot));           \
+        newpte;                                                         \
+})
 extern void paging_init(void);
@@ -82,10 +90,11 @@ extern void paging_init(void);
 #define pmd_page(pmd)           (pfn_to_page(pmd_phys(pmd) >> PAGE_SHIFT))
 #define pmd_page_kernel(pmd)    pmd_val(pmd)
-#define pte_none(pte)           (!(pte_val(pte) & ~_PAGE_GLOBAL))
-#define pte_present(pte)        (pte_val(pte) & _PAGE_PRESENT)
 #if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32_R1)
+#define pte_none(pte)           (!(((pte).pte_low | (pte).pte_high) & ~_PAGE_GLOBAL))
+#define pte_present(pte)        ((pte).pte_low & _PAGE_PRESENT)
 static inline void set_pte(pte_t *ptep, pte_t pte)
 {
        ptep->pte_high = pte.pte_high;
@@ -93,27 +102,35 @@ static inline void set_pte(pte_t *ptep, pte_t pte)
        ptep->pte_low = pte.pte_low;
        //printk("pte_high %x pte_low %x\n", ptep->pte_high, ptep->pte_low);
-        if (pte_val(pte) & _PAGE_GLOBAL) {
+        if (pte.pte_low & _PAGE_GLOBAL) {
                pte_t *buddy = ptep_buddy(ptep);
                /*
                 * Make sure the buddy is global too (if it's !none,
                 * it better already be global)
                 */
-                if (pte_none(*buddy))
+                if (pte_none(*buddy)) {
-                        buddy->pte_low |= _PAGE_GLOBAL;
+                        buddy->pte_low  |= _PAGE_GLOBAL;
+                        buddy->pte_high |= _PAGE_GLOBAL;
+                }
        }
 }
 #define set_pte_at(mm,addr,ptep,pteval) set_pte(ptep,pteval)
 static inline void pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
+        pte_t null = __pte(0);
        /* Preserve global status for the pair */
-        if (pte_val(*ptep_buddy(ptep)) & _PAGE_GLOBAL)
+        if (ptep_buddy(ptep)->pte_low & _PAGE_GLOBAL)
-                set_pte_at(mm, addr, ptep, __pte(_PAGE_GLOBAL));
+                null.pte_low = null.pte_high = _PAGE_GLOBAL;
-        else
-                set_pte_at(mm, addr, ptep, __pte(0));
+        set_pte_at(mm, addr, ptep, null);
 }
 #else
+#define pte_none(pte)           (!(pte_val(pte) & ~_PAGE_GLOBAL))
+#define pte_present(pte)        (pte_val(pte) & _PAGE_PRESENT)
 /*
 * Certain architectures need to do special things when pte's
 * within a page table are directly modified.  Thus, the following
@@ -174,75 +191,76 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
 */
 static inline int pte_user(pte_t pte)   { BUG(); return 0; }
 #if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32_R1)
-static inline int pte_read(pte_t pte)   { return (pte).pte_low & _PAGE_READ; }
+static inline int pte_read(pte_t pte)   { return pte.pte_low & _PAGE_READ; }
-static inline int pte_write(pte_t pte)  { return (pte).pte_low & _PAGE_WRITE; }
+static inline int pte_write(pte_t pte)  { return pte.pte_low & _PAGE_WRITE; }
-static inline int pte_dirty(pte_t pte)  { return (pte).pte_low & _PAGE_MODIFIED; }
+static inline int pte_dirty(pte_t pte)  { return pte.pte_low & _PAGE_MODIFIED; }
-static inline int pte_young(pte_t pte)  { return (pte).pte_low & _PAGE_ACCESSED; }
+static inline int pte_young(pte_t pte)  { return pte.pte_low & _PAGE_ACCESSED; }
-static inline int pte_file(pte_t pte)   { return (pte).pte_low & _PAGE_FILE; }
+static inline int pte_file(pte_t pte)   { return pte.pte_low & _PAGE_FILE; }
 static inline pte_t pte_wrprotect(pte_t pte)
 {
-        (pte).pte_low &= ~(_PAGE_WRITE | _PAGE_SILENT_WRITE);
+        pte.pte_low  &= ~(_PAGE_WRITE | _PAGE_SILENT_WRITE);
-        (pte).pte_high &= ~_PAGE_SILENT_WRITE;
+        pte.pte_high &= ~_PAGE_SILENT_WRITE;
        return pte;
 }
 static inline pte_t pte_rdprotect(pte_t pte)
 {
-        (pte).pte_low &= ~(_PAGE_READ | _PAGE_SILENT_READ);
+        pte.pte_low  &= ~(_PAGE_READ | _PAGE_SILENT_READ);
-        (pte).pte_high &= ~_PAGE_SILENT_READ;
+        pte.pte_high &= ~_PAGE_SILENT_READ;
        return pte;
 }
 static inline pte_t pte_mkclean(pte_t pte)
 {
-        (pte).pte_low &= ~(_PAGE_MODIFIED|_PAGE_SILENT_WRITE);
+        pte.pte_low  &= ~(_PAGE_MODIFIED | _PAGE_SILENT_WRITE);
-        (pte).pte_high &= ~_PAGE_SILENT_WRITE;
+        pte.pte_high &= ~_PAGE_SILENT_WRITE;
        return pte;
 }
 static inline pte_t pte_mkold(pte_t pte)
 {
-        (pte).pte_low &= ~(_PAGE_ACCESSED|_PAGE_SILENT_READ);
+        pte.pte_low  &= ~(_PAGE_ACCESSED | _PAGE_SILENT_READ);
-        (pte).pte_high &= ~_PAGE_SILENT_READ;
+        pte.pte_high &= ~_PAGE_SILENT_READ;
        return pte;
 }
 static inline pte_t pte_mkwrite(pte_t pte)
 {
-        (pte).pte_low |= _PAGE_WRITE;
+        pte.pte_low |= _PAGE_WRITE;
-        if ((pte).pte_low & _PAGE_MODIFIED) {
+        if (pte.pte_low & _PAGE_MODIFIED) {
-                (pte).pte_low |= _PAGE_SILENT_WRITE;
+                pte.pte_low  |= _PAGE_SILENT_WRITE;
-                (pte).pte_high |= _PAGE_SILENT_WRITE;
+                pte.pte_high |= _PAGE_SILENT_WRITE;
        }
        return pte;
 }
 static inline pte_t pte_mkread(pte_t pte)
 {
-        (pte).pte_low |= _PAGE_READ;
+        pte.pte_low |= _PAGE_READ;
-        if ((pte).pte_low & _PAGE_ACCESSED) {
+        if (pte.pte_low & _PAGE_ACCESSED) {
-                (pte).pte_low |= _PAGE_SILENT_READ;
+                pte.pte_low  |= _PAGE_SILENT_READ;
-                (pte).pte_high |= _PAGE_SILENT_READ;
+                pte.pte_high |= _PAGE_SILENT_READ;
        }
        return pte;
 }
 static inline pte_t pte_mkdirty(pte_t pte)
 {
-        (pte).pte_low |= _PAGE_MODIFIED;
+        pte.pte_low |= _PAGE_MODIFIED;
-        if ((pte).pte_low & _PAGE_WRITE) {
+        if (pte.pte_low & _PAGE_WRITE) {
-                (pte).pte_low |= _PAGE_SILENT_WRITE;
+                pte.pte_low  |= _PAGE_SILENT_WRITE;
-                (pte).pte_high |= _PAGE_SILENT_WRITE;
+                pte.pte_high |= _PAGE_SILENT_WRITE;
        }
        return pte;
 }
 static inline pte_t pte_mkyoung(pte_t pte)
 {
-        (pte).pte_low |= _PAGE_ACCESSED;
+        pte.pte_low |= _PAGE_ACCESSED;
-        if ((pte).pte_low & _PAGE_READ)
+        if (pte.pte_low & _PAGE_READ)
-                (pte).pte_low |= _PAGE_SILENT_READ;
+                pte.pte_low  |= _PAGE_SILENT_READ;
-                (pte).pte_high |= _PAGE_SILENT_READ;
+                pte.pte_high |= _PAGE_SILENT_READ;
        return pte;
 }
 #else
@@ -335,8 +353,9 @@ static inline pgprot_t pgprot_noncached(pgprot_t _prot)
 #if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32_R1)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
-        pte.pte_low &= _PAGE_CHG_MASK;
+        pte.pte_low  &= _PAGE_CHG_MASK;
-        pte.pte_low |= pgprot_val(newprot);
+        pte.pte_high &= ~0x3f;
+        pte.pte_low  |= pgprot_val(newprot);
        pte.pte_high |= pgprot_val(newprot) & 0x3f;
        return pte;
 }
diff --git a/include/asm-mips/sigcontext.h b/include/asm-mips/sigcontext.h
index 8edabb0be23f..cefa657dd04a 100644
--- a/include/asm-mips/sigcontext.h
+++ b/include/asm-mips/sigcontext.h
@@ -55,8 +55,14 @@ struct sigcontext {
 struct sigcontext {
        unsigned long   sc_regs[32];
        unsigned long   sc_fpregs[32];
-        unsigned long   sc_hi[4];
+        unsigned long   sc_mdhi;
-        unsigned long   sc_lo[4];
+        unsigned long   sc_hi1;
+        unsigned long   sc_hi2;
+        unsigned long   sc_hi3;
+        unsigned long   sc_mdlo;
+        unsigned long   sc_lo1;
+        unsigned long   sc_lo2;
+        unsigned long   sc_lo3;
        unsigned long   sc_pc;
        unsigned int    sc_fpc_csr;
        unsigned int    sc_used_math;
diff --git a/include/asm-mips/smp.h b/include/asm-mips/smp.h
index 75c6fe7c2126..e14e4b69de21 100644
--- a/include/asm-mips/smp.h
+++ b/include/asm-mips/smp.h
@@ -48,7 +48,6 @@ extern struct call_data_struct *call_data;
 #define SMP_CALL_FUNCTION       0x2
 extern cpumask_t phys_cpu_present_map;
-extern cpumask_t cpu_online_map;
 #define cpu_possible_map        phys_cpu_present_map
 extern cpumask_t cpu_callout_map;
@@ -86,9 +85,9 @@ extern void prom_init_secondary(void);
 extern void plat_smp_setup(void);
 /*
- * Called after init_IRQ but before __cpu_up.
+ * Called in smp_prepare_cpus.
 */
-extern void prom_prepare_cpus(unsigned int max_cpus);
+extern void plat_prepare_cpus(unsigned int max_cpus);
 /*
 * Last chance for the board code to finish SMP initialization before
diff --git a/include/asm-mips/sparsemem.h b/include/asm-mips/sparsemem.h
new file mode 100644
index 000000000000..795ac6c23203
--- /dev/null
+++ b/include/asm-mips/sparsemem.h
@@ -0,0 +1,14 @@
+#ifndef _MIPS_SPARSEMEM_H
+#define _MIPS_SPARSEMEM_H
+#ifdef CONFIG_SPARSEMEM
+/*
+ * SECTION_SIZE_BITS            2^N: how big each section will be
+ * MAX_PHYSMEM_BITS             2^N: how much memory we can have in that space
+ */
+#define SECTION_SIZE_BITS       28
+#define MAX_PHYSMEM_BITS        35
+#endif /* CONFIG_SPARSEMEM */
+#endif /* _MIPS_SPARSEMEM_H */
diff --git a/include/asm-s390/lowcore.h b/include/asm-s390/lowcore.h
index db0606c1abd4..bea727904287 100644
--- a/include/asm-s390/lowcore.h
+++ b/include/asm-s390/lowcore.h
@@ -98,8 +98,8 @@
 #define __LC_KERNEL_ASCE                0xD58
 #define __LC_USER_ASCE                  0xD60
 #define __LC_PANIC_STACK                0xD68
-#define __LC_CPUID                      0xD90
+#define __LC_CPUID                      0xD80
-#define __LC_CPUADDR                    0xD98
+#define __LC_CPUADDR                    0xD88
 #define __LC_IPLDEV                     0xDB8
 #define __LC_JIFFY_TIMER                0xDC0
 #define __LC_CURRENT                    0xDD8
diff --git a/include/asm-sparc64/pgtable.h b/include/asm-sparc64/pgtable.h
index c44e7466534e..cd464f469a2c 100644
--- a/include/asm-sparc64/pgtable.h
+++ b/include/asm-sparc64/pgtable.h
@@ -689,6 +689,23 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, pte_t *p
 #define pte_clear(mm,addr,ptep)         \
        set_pte_at((mm), (addr), (ptep), __pte(0UL))
+#ifdef DCACHE_ALIASING_POSSIBLE
+#define __HAVE_ARCH_MOVE_PTE
+#define move_pte(pte, prot, old_addr, new_addr)                         \
+({                                                                      \
+        pte_t newpte = (pte);                                           \
+        if (tlb_type != hypervisor && pte_present(pte)) {               \
+                unsigned long this_pfn = pte_pfn(pte);                  \
+                                                                        \
+                if (pfn_valid(this_pfn) &&                              \
+                    (((old_addr) ^ (new_addr)) & (1 << 13)))            \
+                        flush_dcache_page_all(current->mm,              \
+                                              pfn_to_page(this_pfn));   \
+        }                                                               \
+        newpte;                                                         \
+})
+#endif
 extern pgd_t swapper_pg_dir[2048];
 extern pmd_t swapper_low_pmd_dir[2048];
diff --git a/include/asm-um/irqflags.h b/include/asm-um/irqflags.h
new file mode 100644
index 000000000000..659b9abdfdba
--- /dev/null
+++ b/include/asm-um/irqflags.h
@@ -0,0 +1,6 @@
+#ifndef __UM_IRQFLAGS_H
+#define __UM_IRQFLAGS_H
+/* Empty for now */
+#endif
diff --git a/include/asm-um/uaccess.h b/include/asm-um/uaccess.h
index bea5a015f667..16c734af9193 100644
--- a/include/asm-um/uaccess.h
+++ b/include/asm-um/uaccess.h
@@ -41,11 +41,11 @@
 #define __get_user(x, ptr) \
 ({ \
-        const __typeof__(ptr) __private_ptr = ptr;      \
+        const __typeof__(*(ptr)) __user *__private_ptr = (ptr); \
        __typeof__(x) __private_val;                    \
        int __private_ret = -EFAULT;                    \
        (x) = (__typeof__(*(__private_ptr)))0;                          \
-        if (__copy_from_user((void *) &__private_val, (__private_ptr),  \
+        if (__copy_from_user((__force void *)&__private_val, (__private_ptr),\
                             sizeof(*(__private_ptr))) == 0) {          \
                (x) = (__typeof__(*(__private_ptr))) __private_val;     \
                __private_ret = 0;                                      \
@@ -62,7 +62,7 @@
 #define __put_user(x, ptr) \
 ({ \
-        __typeof__(ptr) __private_ptr = ptr; \
+        __typeof__(*(ptr)) __user *__private_ptr = ptr; \
        __typeof__(*(__private_ptr)) __private_val; \
        int __private_ret = -EFAULT; \
        __private_val = (__typeof__(*(__private_ptr))) (x); \
diff --git a/include/asm-x86_64/elf.h b/include/asm-x86_64/elf.h
index c98633af07d2..b4f8f4a41a6e 100644
--- a/include/asm-x86_64/elf.h
+++ b/include/asm-x86_64/elf.h
@@ -159,7 +159,7 @@ extern int dump_task_fpu (struct task_struct *, elf_fpregset_t *);
 #define ELF_CORE_COPY_FPREGS(tsk, elf_fpregs) dump_task_fpu(tsk, elf_fpregs)
 /* 1GB for 64bit, 8MB for 32bit */
-#define STACK_RND_MASK (is_compat_task() ? 0x7ff : 0x3fffff)
+#define STACK_RND_MASK (test_thread_flag(TIF_IA32) ? 0x7ff : 0x3fffff)
 #endif
diff --git a/include/linux/input.h b/include/linux/input.h
index 50e338d2ffda..ce1a756c4c30 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -345,6 +345,8 @@ struct input_absinfo {
 #define KEY_SAVE                234
 #define KEY_DOCUMENTS           235
+#define KEY_BATTERY             236
 #define KEY_UNKNOWN             240
 #define BTN_MISC                0x100
@@ -577,14 +579,9 @@ struct input_absinfo {
 * Switch events
 */
-#define SW_0                    0x00
+#define SW_LID                  0x00  /* set = lid shut */
-#define SW_1                    0x01
+#define SW_TABLET_MODE          0x01  /* set = tablet mode */
-#define SW_2                    0x02
+#define SW_HEADPHONE_INSERT     0x02  /* set = inserted */
-#define SW_3                    0x03
-#define SW_4                    0x04
-#define SW_5                    0x05
-#define SW_6                    0x06
-#define SW_7                    0x07
 #define SW_MAX                  0x0f
 /*
diff --git a/include/linux/m48t86.h b/include/linux/m48t86.h
index 9065199319d0..915d6b4f0f89 100644
--- a/include/linux/m48t86.h
+++ b/include/linux/m48t86.h
@@ -11,6 +11,6 @@
 struct m48t86_ops
 {
-        void (*writeb)(unsigned char value, unsigned long addr);
+        void (*writebyte)(unsigned char value, unsigned long addr);
-        unsigned char (*readb)(unsigned long addr);
+        unsigned char (*readbyte)(unsigned long addr);
 };
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 36740354d4db..2d8337150493 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -15,6 +15,7 @@
 #include <linux/seqlock.h>
 #include <linux/nodemask.h>
 #include <asm/atomic.h>
+#include <asm/page.h>
 /* Free memory management - zoned buddy allocator.  */
 #ifndef CONFIG_FORCE_MAX_ZONEORDER
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index dce2534ab7dc..c3fe769c9129 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1240,6 +1240,7 @@
 #define PCI_DEVICE_ID_VIA_8380_0        0x0204
 #define PCI_DEVICE_ID_VIA_3238_0        0x0238
 #define PCI_DEVICE_ID_VIA_PT880         0x0258
+#define PCI_DEVICE_ID_VIA_PT880ULTRA    0x0308
 #define PCI_DEVICE_ID_VIA_PX8X0_0       0x0259
 #define PCI_DEVICE_ID_VIA_3269_0        0x0269
 #define PCI_DEVICE_ID_VIA_K8T800PRO_0   0x0282
diff --git a/include/linux/vt_kern.h b/include/linux/vt_kern.h
index 530ae3f4248c..fab5aed8ca31 100644
--- a/include/linux/vt_kern.h
+++ b/include/linux/vt_kern.h
@@ -73,11 +73,6 @@ int con_copy_unimap(struct vc_data *dst_vc, struct vc_data *src_vc);
 int vt_waitactive(int vt);
 void change_console(struct vc_data *new_vc);
 void reset_vc(struct vc_data *vc);
-#ifdef CONFIG_VT
-int is_console_suspend_safe(void);
-#else
-static inline int is_console_suspend_safe(void) { return 1; }
-#endif
 /*
 * vc_screen.c shares this temporary buffer with the console write code so that
diff --git a/include/net/compat.h b/include/net/compat.h
index 8662b8f43df5..e65cbedb6abc 100644
--- a/include/net/compat.h
+++ b/include/net/compat.h
@@ -3,6 +3,8 @@
 #include <linux/config.h>
+struct sock;
 #if defined(CONFIG_COMPAT)
 #include <linux/compat.h>
@@ -23,7 +25,6 @@ struct compat_cmsghdr {
        compat_int_t    cmsg_type;
 };
-struct sock;
 extern int compat_sock_get_timestamp(struct sock *, struct timeval __user *);
 #else /* defined(CONFIG_COMPAT) */
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index 293e920ca59d..d5147770ad47 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -1247,7 +1247,8 @@ extern int ieee80211_set_encryption(struct ieee80211_device *ieee);
 extern int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev);
 extern void ieee80211_txb_free(struct ieee80211_txb *);
 extern int ieee80211_tx_frame(struct ieee80211_device *ieee,
-                              struct ieee80211_hdr *frame, int len);
+                              struct ieee80211_hdr *frame, int hdr_len,
+                              int total_len, int encrypt_mpdu);
 /* ieee80211_rx.c */
 extern int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
diff --git a/include/net/ieee80211softmac.h b/include/net/ieee80211softmac.h
index 703463a8828b..7a483ab4022f 100644
--- a/include/net/ieee80211softmac.h
+++ b/include/net/ieee80211softmac.h
@@ -310,7 +310,7 @@ extern void ieee80211softmac_stop(struct net_device *dev);
 *      - context set to the context data you want passed
 * The return value is 0, or an error.
 */
-typedef void (*notify_function_ptr)(struct net_device *dev, void *context);
+typedef void (*notify_function_ptr)(struct net_device *dev, int event_type, void *context);
 #define ieee80211softmac_notify(dev, event, fun, context) ieee80211softmac_notify_gfp(dev, event, fun, context, GFP_KERNEL);
 #define ieee80211softmac_notify_atomic(dev, event, fun, context) ieee80211softmac_notify_gfp(dev, event, fun, context, GFP_ATOMIC);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index b7f0388bd71c..01fa2ae98a85 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -456,6 +456,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
        return ret;
 }
+EXPORT_SYMBOL_GPL(hrtimer_start);
 /**
 * hrtimer_try_to_cancel - try to deactivate a timer
@@ -484,6 +485,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer)
        return ret;
 }
+EXPORT_SYMBOL_GPL(hrtimer_try_to_cancel);
 /**
 * hrtimer_cancel - cancel a timer and wait for the handler to finish.
@@ -504,6 +506,7 @@ int hrtimer_cancel(struct hrtimer *timer)
                cpu_relax();
        }
 }
+EXPORT_SYMBOL_GPL(hrtimer_cancel);
 /**
 * hrtimer_get_remaining - get remaining time for the timer
@@ -522,6 +525,7 @@ ktime_t hrtimer_get_remaining(const struct hrtimer *timer)
        return rem;
 }
+EXPORT_SYMBOL_GPL(hrtimer_get_remaining);
 #ifdef CONFIG_NO_IDLE_HZ
 /**
@@ -580,6 +584,7 @@ void hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
        timer->base = &bases[clock_id];
        timer->node.rb_parent = HRTIMER_INACTIVE;
 }
+EXPORT_SYMBOL_GPL(hrtimer_init);
 /**
 * hrtimer_get_res - get the timer resolution for a clock
@@ -599,6 +604,7 @@ int hrtimer_get_res(const clockid_t which_clock, struct timespec *tp)
        return 0;
 }
+EXPORT_SYMBOL_GPL(hrtimer_get_res);
 /*
 * Expire the per base hrtimer-queue:
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 1ae2b2cc3a54..70df5c0d957e 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -91,8 +91,8 @@ static void grow_zone_span(struct zone *zone,
        if (start_pfn < zone->zone_start_pfn)
                zone->zone_start_pfn = start_pfn;
-        if (end_pfn > old_zone_end_pfn)
+        zone->spanned_pages = max(old_zone_end_pfn, end_pfn) -
-                zone->spanned_pages = end_pfn - zone->zone_start_pfn;
+                                zone->zone_start_pfn;
        zone_span_writeunlock(zone);
 }
@@ -106,8 +106,8 @@ static void grow_pgdat_span(struct pglist_data *pgdat,
        if (start_pfn < pgdat->node_start_pfn)
                pgdat->node_start_pfn = start_pfn;
-        if (end_pfn > old_pgdat_end_pfn)
+        pgdat->node_spanned_pages = max(old_pgdat_end_pfn, end_pfn) -
-                pgdat->node_spanned_pages = end_pfn - pgdat->node_start_pfn;
+                                        pgdat->node_start_pfn;
 }
 int online_pages(unsigned long pfn, unsigned long nr_pages)
diff --git a/mm/slab.c b/mm/slab.c
index d31a06bfbea5..f1b644eb39d8 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -207,11 +207,6 @@ typedef unsigned int kmem_bufctl_t;
 #define BUFCTL_ACTIVE   (((kmem_bufctl_t)(~0U))-2)
 #define SLAB_LIMIT      (((kmem_bufctl_t)(~0U))-3)
-/* Max number of objs-per-slab for caches which use off-slab slabs.
- * Needed to avoid a possible looping condition in cache_grow().
- */
-static unsigned long offslab_limit;
 /*
 * struct slab
 *
@@ -1356,12 +1351,6 @@ void __init kmem_cache_init(void)
                                        NULL, NULL);
                }
-                /* Inc off-slab bufctl limit until the ceiling is hit. */
-                if (!(OFF_SLAB(sizes->cs_cachep))) {
-                        offslab_limit = sizes->cs_size - sizeof(struct slab);
-                        offslab_limit /= sizeof(kmem_bufctl_t);
-                }
                sizes->cs_dmacachep = kmem_cache_create(names->name_dma,
                                        sizes->cs_size,
                                        ARCH_KMALLOC_MINALIGN,
@@ -1780,6 +1769,7 @@ static void set_up_list3s(struct kmem_cache *cachep, int index)
 static size_t calculate_slab_order(struct kmem_cache *cachep,
                        size_t size, size_t align, unsigned long flags)
 {
+        unsigned long offslab_limit;
        size_t left_over = 0;
        int gfporder;
@@ -1791,9 +1781,18 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
                if (!num)
                        continue;
-                /* More than offslab_limit objects will cause problems */
+                if (flags & CFLGS_OFF_SLAB) {
-                if ((flags & CFLGS_OFF_SLAB) && num > offslab_limit)
+                        /*
-                        break;
+                         * Max number of objs-per-slab for caches which
+                         * use off-slab slabs. Needed to avoid a possible
+                         * looping condition in cache_grow().
+                         */
+                        offslab_limit = size - sizeof(struct slab);
+                        offslab_limit /= sizeof(kmem_bufctl_t);
+                        if (num > offslab_limit)
+                                break;
+                }
                /* Found something acceptable - save it away */
                cachep->num = num;
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index ad1c7af65ec8..f5d47bf4f967 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -300,25 +300,20 @@ int br_add_bridge(const char *name)
        rtnl_lock();
        if (strchr(dev->name, '%')) {
                ret = dev_alloc_name(dev, dev->name);
-                if (ret < 0)
+                if (ret < 0) {
-                        goto err1;
+                        free_netdev(dev);
+                        goto out;
+                }
        }
        ret = register_netdevice(dev);
        if (ret)
-                goto err2;
+                goto out;
        ret = br_sysfs_addbr(dev);
        if (ret)
-                goto err3;
+                unregister_netdevice(dev);
-        rtnl_unlock();
+ out:
-        return 0;
- err3:
-        unregister_netdev(dev);
- err2:
-        free_netdev(dev);
- err1:
        rtnl_unlock();
        return ret;
 }
diff --git a/net/ethernet/Makefile b/net/ethernet/Makefile
index 69b74a9a0fc3..7cef1d8ace27 100644
--- a/net/ethernet/Makefile
+++ b/net/ethernet/Makefile
@@ -3,6 +3,5 @@
 #
 obj-y                                   += eth.o
-obj-$(CONFIG_SYSCTL)                    += sysctl_net_ether.o
 obj-$(subst m,y,$(CONFIG_IPX))          += pe2.o
 obj-$(subst m,y,$(CONFIG_ATALK))        += pe2.o
diff --git a/net/ethernet/sysctl_net_ether.c b/net/ethernet/sysctl_net_ether.c
deleted file mode 100644
index 66b39fc342d2..000000000000
--- a/net/ethernet/sysctl_net_ether.c
+++ /dev/null
@@ -1,14 +0,0 @@
-/* -*- linux-c -*-
- * sysctl_net_ether.c: sysctl interface to net Ethernet subsystem.
- *
- * Begun April 1, 1996, Mike Shaver.
- * Added /proc/sys/net/ether directory entry (empty =) ). [MS]
- */
-#include <linux/mm.h>
-#include <linux/sysctl.h>
-#include <linux/if_ether.h>
-ctl_table ether_table[] = {
-        {0}
-};
diff --git a/net/ieee80211/ieee80211_tx.c b/net/ieee80211/ieee80211_tx.c
index 233d527c6953..6a5de1b84459 100644
--- a/net/ieee80211/ieee80211_tx.c
+++ b/net/ieee80211/ieee80211_tx.c
@@ -555,7 +555,8 @@ int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
 /* Incoming 802.11 strucure is converted to a TXB
 * a block of 802.11 fragment packets (stored as skbs) */
 int ieee80211_tx_frame(struct ieee80211_device *ieee,
-                       struct ieee80211_hdr *frame, int len)
+                       struct ieee80211_hdr *frame, int hdr_len, int total_len,
+                       int encrypt_mpdu)
 {
        struct ieee80211_txb *txb = NULL;
        unsigned long flags;
@@ -565,6 +566,9 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
        spin_lock_irqsave(&ieee->lock, flags);
+        if (encrypt_mpdu && !ieee->sec.encrypt)
+                encrypt_mpdu = 0;
        /* If there is no driver handler to take the TXB, dont' bother
         * creating it... */
        if (!ieee->hard_start_xmit) {
@@ -572,32 +576,41 @@ int ieee80211_tx_frame(struct ieee80211_device *ieee,
                goto success;
        }
-        if (unlikely(len < 24)) {
+        if (unlikely(total_len < 24)) {
                printk(KERN_WARNING "%s: skb too small (%d).\n",
-                       ieee->dev->name, len);
+                       ieee->dev->name, total_len);
                goto success;
        }
+        if (encrypt_mpdu)
+                frame->frame_ctl |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
        /* When we allocate the TXB we allocate enough space for the reserve
         * and full fragment bytes (bytes_per_frag doesn't include prefix,
         * postfix, header, FCS, etc.) */
-        txb = ieee80211_alloc_txb(1, len, ieee->tx_headroom, GFP_ATOMIC);
+        txb = ieee80211_alloc_txb(1, total_len, ieee->tx_headroom, GFP_ATOMIC);
        if (unlikely(!txb)) {
                printk(KERN_WARNING "%s: Could not allocate TXB\n",
                       ieee->dev->name);
                goto failed;
        }
        txb->encrypted = 0;
-        txb->payload_size = len;
+        txb->payload_size = total_len;
        skb_frag = txb->fragments[0];
-        memcpy(skb_put(skb_frag, len), frame, len);
+        memcpy(skb_put(skb_frag, total_len), frame, total_len);
        if (ieee->config &
            (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
                skb_put(skb_frag, 4);
+        /* To avoid overcomplicating things, we do the corner-case frame
+         * encryption in software. The only real situation where encryption is
+         * needed here is during software-based shared key authentication. */
+        if (encrypt_mpdu)
+                ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
      success:
        spin_unlock_irqrestore(&ieee->lock, flags);
diff --git a/net/ieee80211/softmac/Kconfig b/net/ieee80211/softmac/Kconfig
index f2a27cc6ecb1..2811651cb134 100644
--- a/net/ieee80211/softmac/Kconfig
+++ b/net/ieee80211/softmac/Kconfig
@@ -2,6 +2,7 @@ config IEEE80211_SOFTMAC
        tristate "Software MAC add-on to the IEEE 802.11 networking stack"
        depends on IEEE80211 && EXPERIMENTAL
        select WIRELESS_EXT
+        select IEEE80211_CRYPT_WEP
        ---help---
        This option enables the hardware independent software MAC addon
        for the IEEE 802.11 networking stack.
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index 5d90b9a6ee50..5e9a90651d04 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -164,12 +164,28 @@ network_matches_request(struct ieee80211softmac_device *mac, struct ieee80211_ne
 }
 static void
-ieee80211softmac_assoc_notify(struct net_device *dev, void *context)
+ieee80211softmac_assoc_notify_scan(struct net_device *dev, int event_type, void *context)
 {
        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
        ieee80211softmac_assoc_work((void*)mac);
 }
+static void
+ieee80211softmac_assoc_notify_auth(struct net_device *dev, int event_type, void *context)
+{
+        struct ieee80211softmac_device *mac = ieee80211_priv(dev);
+        switch (event_type) {
+        case IEEE80211SOFTMAC_EVENT_AUTHENTICATED:
+                ieee80211softmac_assoc_work((void*)mac);
+                break;
+        case IEEE80211SOFTMAC_EVENT_AUTH_FAILED:
+        case IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT:
+                ieee80211softmac_disassoc(mac);
+                break;
+        }
+}
 /* This function is called to handle userspace requests (asynchronously) */
 void
 ieee80211softmac_assoc_work(void *d)
@@ -249,7 +265,7 @@ ieee80211softmac_assoc_work(void *d)
                         * Maybe we can hope to have more memory after scanning finishes ;)
                         */
                        dprintk(KERN_INFO PFX "Associate: Scanning for networks first.\n");
-                        ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify, NULL);
+                        ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL);
                        if (ieee80211softmac_start_scan(mac))
                                dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
                        return;
@@ -284,7 +300,7 @@ ieee80211softmac_assoc_work(void *d)
                 * otherwise adding the notification would be racy. */
                if (!ieee80211softmac_auth_req(mac, found)) {
                        dprintk(KERN_INFO PFX "cannot associate without being authenticated, requested authentication\n");
-                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify, NULL, GFP_KERNEL);
+                        ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
                } else {
                        printkl(KERN_WARNING PFX "Not authenticated, but requesting authentication failed. Giving up to associate\n");
                        ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED, found);
diff --git a/net/ieee80211/softmac/ieee80211softmac_auth.c b/net/ieee80211/softmac/ieee80211softmac_auth.c
index 084b6211f293..90b8484e509b 100644
--- a/net/ieee80211/softmac/ieee80211softmac_auth.c
+++ b/net/ieee80211/softmac/ieee80211softmac_auth.c
@@ -107,6 +107,7 @@ ieee80211softmac_auth_queue(void *data)
        printkl(KERN_WARNING PFX "Authentication timed out with "MAC_FMT"\n", MAC_ARG(net->bssid));
        /* Remove this item from the queue */
        spin_lock_irqsave(&mac->lock, flags);
+        net->authenticating = 0;
        ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_AUTH_TIMEOUT, net);
        cancel_delayed_work(&auth->work); /* just to make sure... */
        list_del(&auth->list);
@@ -212,13 +213,13 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                        aq->state = IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE; 
                        spin_unlock_irqrestore(&mac->lock, flags);
-                        /* Switch to correct channel for this network */
+                        /* Send our response */
-                        mac->set_channel(mac->dev, net->channel);
-                        
-                        /* Send our response (How to encrypt?) */
                        ieee80211softmac_send_mgt_frame(mac, aq->net, IEEE80211_STYPE_AUTH, aq->state);
-                        break;
+                        return 0;
                case IEEE80211SOFTMAC_AUTH_SHARED_PASS:
+                        kfree(net->challenge);
+                        net->challenge = NULL;
+                        net->challenge_len = 0;
                        /* Check the status code of the response */
                        switch(auth->status) {
                        case WLAN_STATUS_SUCCESS:
@@ -229,6 +230,7 @@ ieee80211softmac_auth_resp(struct net_device *dev, struct ieee80211_auth *auth)
                                spin_unlock_irqrestore(&mac->lock, flags);
                                printkl(KERN_NOTICE PFX "Shared Key Authentication completed with "MAC_FMT"\n", 
                                        MAC_ARG(net->bssid));
+                                ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_AUTHENTICATED, net);
                                break;
                        default:
                                printkl(KERN_NOTICE PFX "Shared Key Authentication with "MAC_FMT" failed, error code: %i\n", 
diff --git a/net/ieee80211/softmac/ieee80211softmac_event.c b/net/ieee80211/softmac/ieee80211softmac_event.c
index 4b153f7cc96c..f34fa2ef666b 100644
--- a/net/ieee80211/softmac/ieee80211softmac_event.c
+++ b/net/ieee80211/softmac/ieee80211softmac_event.c
@@ -78,7 +78,7 @@ ieee80211softmac_notify_callback(void *d)
        struct ieee80211softmac_event event = *(struct ieee80211softmac_event*) d;
        kfree(d);
        
-        event.fun(event.mac->dev, event.context);
+        event.fun(event.mac->dev, event.event_type, event.context);
 }
 int
@@ -167,6 +167,9 @@ ieee80211softmac_call_events_locked(struct ieee80211softmac_device *mac, int eve
                        if ((eventptr->event_type == event || eventptr->event_type == -1)
                                && (eventptr->event_context == NULL || eventptr->event_context == event_ctx)) {
                                list_del(&eventptr->list);
+                                /* User may have subscribed to ANY event, so
+                                 * we tell them which event triggered it. */
+                                eventptr->event_type = event;
                                schedule_work(&eventptr->work);
                        }
                }
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index cc6cd56c85b1..09541611e48c 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -149,6 +149,56 @@ ieee80211softmac_hdr_3addr(struct ieee80211softmac_device *mac,
         * shouldn't the sequence number be in ieee80211? */
 }
+static u16
+ieee80211softmac_capabilities(struct ieee80211softmac_device *mac,
+        struct ieee80211softmac_network *net)
+{
+        u16 capability = 0;
+        /* ESS and IBSS bits are set according to the current mode */
+        switch (mac->ieee->iw_mode) {
+        case IW_MODE_INFRA:
+                capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
+                break;
+        case IW_MODE_ADHOC:
+                capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
+                break;
+        case IW_MODE_AUTO:
+                capability = net->capabilities &
+                        (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
+                break;
+        default:
+                /* bleh. we don't ever go to these modes */
+                printk(KERN_ERR PFX "invalid iw_mode!\n");
+                break;
+        }
+        /* CF Pollable / CF Poll Request */
+        /* Needs to be implemented, for now, the 0's == not supported */
+        /* Privacy Bit */
+        capability |= mac->ieee->sec.level ?
+                cpu_to_le16(WLAN_CAPABILITY_PRIVACY) : 0;
+        /* Short Preamble */
+        /* Always supported: we probably won't ever be powering devices which
+         * dont support this... */
+        capability |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+        /* PBCC */
+        /* Not widely used */
+        /* Channel Agility */
+        /* Not widely used */
+        /* Short Slot */
+        /* Will be implemented later */
+        /* DSSS-OFDM */
+        /* Not widely used */
+        return capability;
+}
 /*****************************************************************************
 * Create Management packets
@@ -179,27 +229,6 @@ ieee80211softmac_assoc_req(struct ieee80211_assoc_request **pkt,
                return 0;
        ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_ASSOC_REQ, net->bssid, net->bssid);
-        /* Fill in capability Info */
-        switch (mac->ieee->iw_mode) {
-        case IW_MODE_INFRA:
-                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_ESS);
-                break;
-        case IW_MODE_ADHOC:
-                (*pkt)->capability = cpu_to_le16(WLAN_CAPABILITY_IBSS);
-                break;
-        case IW_MODE_AUTO:
-                (*pkt)->capability = net->capabilities & (WLAN_CAPABILITY_ESS|WLAN_CAPABILITY_IBSS);
-                break;
-        default:
-                /* bleh. we don't ever go to these modes */
-                printk(KERN_ERR PFX "invalid iw_mode!\n");
-                break;
-        }
-        /* Need to add this
-        (*pkt)->capability |= mac->ieee->short_slot ? 
-                        cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
-         */
-        (*pkt)->capability |= mac->ieee->sec.level ? cpu_to_le16(WLAN_CAPABILITY_PRIVACY) : 0;
        /* Fill in Listen Interval (?) */
        (*pkt)->listen_interval = cpu_to_le16(10);
        
@@ -239,17 +268,9 @@ ieee80211softmac_reassoc_req(struct ieee80211_reassoc_request **pkt,
                return 0;
        ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_REASSOC_REQ, net->bssid, net->bssid);
-        /* Fill in capability Info */
+        /* Fill in the capabilities */
-        (*pkt)->capability = mac->ieee->iw_mode == IW_MODE_MASTER ? 
+        (*pkt)->capability = ieee80211softmac_capabilities(mac, net);
-                                cpu_to_le16(WLAN_CAPABILITY_ESS) :
-                                cpu_to_le16(WLAN_CAPABILITY_IBSS);
-        /*
-        (*pkt)->capability |= mac->ieee->short_slot ? 
-                        cpu_to_le16(WLAN_CAPABILITY_SHORT_SLOT_TIME) : 0;
-         */
-        (*pkt)->capability |= mac->ieee->sec.level ?
-                        cpu_to_le16(WLAN_CAPABILITY_PRIVACY) : 0;
-                
        /* Fill in Listen Interval (?) */
        (*pkt)->listen_interval = cpu_to_le16(10);
        /* Fill in the current AP MAC */
@@ -268,26 +289,27 @@ ieee80211softmac_reassoc_req(struct ieee80211_reassoc_request **pkt,
 static u32
 ieee80211softmac_auth(struct ieee80211_auth **pkt, 
        struct ieee80211softmac_device *mac, struct ieee80211softmac_network *net,
-        u16 transaction, u16 status)
+        u16 transaction, u16 status, int *encrypt_mpdu)
 {
        u8 *data;
+        int auth_mode = mac->ieee->sec.auth_mode;
+        int is_shared_response = (auth_mode == WLAN_AUTH_SHARED_KEY
+                && transaction == IEEE80211SOFTMAC_AUTH_SHARED_RESPONSE);
        /* Allocate Packet */
        (*pkt) = (struct ieee80211_auth *)ieee80211softmac_alloc_mgt(
                2 +             /* Auth Algorithm */
                2 +             /* Auth Transaction Seq */
                2 +             /* Status Code */
                 /* Challenge Text IE */
-                mac->ieee->open_wep ? 0 : 
+                is_shared_response ? 0 : 1 + 1 + net->challenge_len
-                1 + 1 + WLAN_AUTH_CHALLENGE_LEN
+        );
-        );      
        if (unlikely((*pkt) == NULL))
                return 0;
        ieee80211softmac_hdr_3addr(mac, &((*pkt)->header), IEEE80211_STYPE_AUTH, net->bssid, net->bssid);
                
        /* Algorithm */
-        (*pkt)->algorithm = mac->ieee->open_wep ? 
+        (*pkt)->algorithm = cpu_to_le16(auth_mode);
-                cpu_to_le16(WLAN_AUTH_OPEN) :
-                cpu_to_le16(WLAN_AUTH_SHARED_KEY);
        /* Transaction */
        (*pkt)->transaction = cpu_to_le16(transaction);
        /* Status */
@@ -295,18 +317,20 @@ ieee80211softmac_auth(struct ieee80211_auth **pkt,
        
        data = (u8 *)(*pkt)->info_element;
        /* Challenge Text */
-        if(!mac->ieee->open_wep){
+        if (is_shared_response) {
                *data = MFIE_TYPE_CHALLENGE;
                data++;
                
                /* Copy the challenge in */
-                // *data = challenge length
+                *data = net->challenge_len;
-                // data += sizeof(u16);
+                data++;
-                // memcpy(data, challenge, challenge length);
+                memcpy(data, net->challenge, net->challenge_len);
-                // data += challenge length;
+                data += net->challenge_len;
-                
-                /* Add the full size to the packet length */
+                /* Make sure this frame gets encrypted with the shared key */
-        }
+                *encrypt_mpdu = 1;
+        } else
+                *encrypt_mpdu = 0;
        /* Return the packet size */
        return (data - (u8 *)(*pkt));
@@ -396,6 +420,7 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
 {
        void *pkt = NULL;
        u32 pkt_size = 0;
+        int encrypt_mpdu = 0;
        switch(type) {
        case IEEE80211_STYPE_ASSOC_REQ:
@@ -405,7 +430,7 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
                pkt_size = ieee80211softmac_reassoc_req((struct ieee80211_reassoc_request **)(&pkt), mac, (struct ieee80211softmac_network *)ptrarg);
                break;
        case IEEE80211_STYPE_AUTH:
-                pkt_size = ieee80211softmac_auth((struct ieee80211_auth **)(&pkt), mac, (struct ieee80211softmac_network *)ptrarg, (u16)(arg & 0xFFFF), (u16) (arg >> 16));
+                pkt_size = ieee80211softmac_auth((struct ieee80211_auth **)(&pkt), mac, (struct ieee80211softmac_network *)ptrarg, (u16)(arg & 0xFFFF), (u16) (arg >> 16), &encrypt_mpdu);
                break;
        case IEEE80211_STYPE_DISASSOC:
        case IEEE80211_STYPE_DEAUTH:
@@ -434,52 +459,8 @@ ieee80211softmac_send_mgt_frame(struct ieee80211softmac_device *mac,
         * or get rid of it alltogether?
         * Does this work for you now?
         */
-        ieee80211_tx_frame(mac->ieee, (struct ieee80211_hdr *)pkt, pkt_size);
+        ieee80211_tx_frame(mac->ieee, (struct ieee80211_hdr *)pkt,
+                IEEE80211_3ADDR_LEN, pkt_size, encrypt_mpdu);
-        kfree(pkt);
-        return 0;
-}
-/* Create an rts/cts frame */
-static u32
-ieee80211softmac_rts_cts(struct ieee80211_hdr_2addr **pkt,
-        struct ieee80211softmac_device *mac, struct ieee80211softmac_network *net, 
-        u32 type)
-{
-        /* Allocate Packet */
-        (*pkt) = kmalloc(IEEE80211_2ADDR_LEN, GFP_ATOMIC);      
-        memset(*pkt, 0, IEEE80211_2ADDR_LEN);
-        if((*pkt) == NULL)
-                return 0;
-        ieee80211softmac_hdr_2addr(mac, (*pkt), type, net->bssid);
-        return IEEE80211_2ADDR_LEN;
-}
-/* Sends a control packet */
-static int
-ieee80211softmac_send_ctl_frame(struct ieee80211softmac_device *mac,
-        struct ieee80211softmac_network *net, u32 type, u32 arg)
-{
-        void *pkt = NULL;
-        u32 pkt_size = 0;
-        
-        switch(type) {
-        case IEEE80211_STYPE_RTS:
-        case IEEE80211_STYPE_CTS:
-                pkt_size = ieee80211softmac_rts_cts((struct ieee80211_hdr_2addr **)(&pkt), mac, net, type);
-                break;
-        default:
-                printkl(KERN_DEBUG PFX "Unsupported Control Frame type: %i\n", type);
-                return -EINVAL;
-        }
-        if(pkt_size == 0)
-                return -ENOMEM;
-        
-        /* Send the packet to the ieee80211 layer for tx */
-        ieee80211_tx_frame(mac->ieee, (struct ieee80211_hdr *) pkt, pkt_size);
        kfree(pkt);
        return 0;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 3d560dec63ab..d4072533da21 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -170,8 +170,8 @@ config IP_NF_PPTP
          Documentation/modules.txt.  If unsure, say `N'.
 config IP_NF_H323
-        tristate  'H.323 protocol support'
+        tristate  'H.323 protocol support (EXPERIMENTAL)'
-        depends on IP_NF_CONNTRACK
+        depends on IP_NF_CONNTRACK && EXPERIMENTAL
        help
          H.323 is a VoIP signalling protocol from ITU-T. As one of the most
          important VoIP protocols, it is widely used by voice hardware and
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 979a2eac6f00..a297da7bbef5 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                        .tuple.dst.u.tcp.port;
                sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
                        .tuple.dst.ip;
+                memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
                DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
                       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
index 7d3ba4302e9e..8ccfe17bb253 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -469,8 +469,8 @@ pptp_inbound_pkt(struct sk_buff **pskb,
                        DEBUGP("%s but no session\n", pptp_msg_name[msg]);
                        break;
                }
-                if (info->sstate != PPTP_CALL_IN_REP
+                if (info->cstate != PPTP_CALL_IN_REP
-                    && info->sstate != PPTP_CALL_IN_CONF) {
+                    && info->cstate != PPTP_CALL_IN_CONF) {
                        DEBUGP("%s but never sent IN_CALL_REPLY\n",
                                pptp_msg_name[msg]);
                        break;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5bc9f64d7b5b..77d974443c7b 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -348,6 +348,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                        .tuple.dst.u.tcp.port;
                sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
                        .tuple.dst.u3.ip;
+                memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
                DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
                       NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index b72fa55dfb84..ba7c63ca5bb1 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -135,7 +135,8 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                /* Do additive increase */
                if (tp->snd_cwnd < tp->snd_cwnd_clamp) {
-                        tp->snd_cwnd_cnt += ca->ai;
+                        /* cwnd = cwnd + a(w) / cwnd */
+                        tp->snd_cwnd_cnt += ca->ai + 1;
                        if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
                                tp->snd_cwnd_cnt -= tp->snd_cwnd;
                                tp->snd_cwnd++;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 743016baa048..f33c9dddaa12 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -642,7 +642,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
 * eventually). The difference is that pulled data not copied, but
 * immediately discarded.
 */
-static unsigned char *__pskb_trim_head(struct sk_buff *skb, int len)
+static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
        int i, k, eat;
@@ -667,7 +667,6 @@ static unsigned char *__pskb_trim_head(struct sk_buff *skb, int len)
        skb->tail = skb->data;
        skb->data_len -= len;
        skb->len = skb->data_len;
-        return skb->tail;
 }
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
@@ -676,12 +675,11 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
            pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                return -ENOMEM;
-        if (len <= skb_headlen(skb)) {
+        /* If len == headlen, we avoid __skb_pull to preserve alignment. */
+        if (unlikely(len < skb_headlen(skb)))
                __skb_pull(skb, len);
-        } else {
+        else
-                if (__pskb_trim_head(skb, len-skb_headlen(skb)) == NULL)
+                __pskb_trim_head(skb, len - skb_headlen(skb));
-                        return -ENOMEM;
-        }
        TCP_SKB_CB(skb)->seq += len;
        skb->ip_summed = CHECKSUM_HW;
diff --git a/net/irda/irlap.c b/net/irda/irlap.c
index 7029618f5719..a16528657b4c 100644
--- a/net/irda/irlap.c
+++ b/net/irda/irlap.c
@@ -884,7 +884,8 @@ static void irlap_change_speed(struct irlap_cb *self, __u32 speed, int now)
        if (now) {
                /* Send down empty frame to trigger speed change */
                skb = dev_alloc_skb(0);
-                irlap_queue_xmit(self, skb);
+                if (skb)
+                        irlap_queue_xmit(self, skb);
        }
 }
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 55538f6b60ff..58a1b6b42ddd 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -37,14 +37,6 @@ struct ctl_table net_table[] = {
                .mode           = 0555,
                .child          = core_table,
        },
-#ifdef CONFIG_NET
-        {
-                .ctl_name       = NET_ETHER,
-                .procname       = "ethernet",
-                .mode           = 0555,
-                .child          = ether_table,
-        },
-#endif
 #ifdef CONFIG_INET
        {
                .ctl_name       = NET_IPV4,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 21dad415b896..90b4cdc0c948 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4422,6 +4422,7 @@ void selinux_complete_init(void)
        /* Set up any superblocks initialized prior to the policy load. */
        printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
+        spin_lock(&sb_lock);
        spin_lock(&sb_security_lock);
 next_sb:
        if (!list_empty(&superblock_security_head)) {
@@ -4430,19 +4431,20 @@ next_sb:
                                           struct superblock_security_struct,
                                           list);
                struct super_block *sb = sbsec->sb;
-                spin_lock(&sb_lock);
                sb->s_count++;
-                spin_unlock(&sb_lock);
                spin_unlock(&sb_security_lock);
+                spin_unlock(&sb_lock);
                down_read(&sb->s_umount);
                if (sb->s_root)
                        superblock_doinit(sb, NULL);
                drop_super(sb);
+                spin_lock(&sb_lock);
                spin_lock(&sb_security_lock);
                list_del_init(&sbsec->list);
                goto next_sb;
        }
        spin_unlock(&sb_security_lock);
+        spin_unlock(&sb_lock);
 }
 /* SELinux requires early initialization in order to label