380 files changed, 9072 insertions, 6991 deletions

diff --git a/Documentation/DocBook/libata.tmpl b/Documentation/DocBook/libata.tmpl
index d260d92089ad..5bcbb6ee3bc0 100644
--- a/Documentation/DocBook/libata.tmpl
+++ b/Documentation/DocBook/libata.tmpl
@@ -120,14 +120,27 @@ void (*dev_config) (struct ata_port *, struct ata_device *);
         <programlisting>
 void (*set_piomode) (struct ata_port *, struct ata_device *);
 void (*set_dmamode) (struct ata_port *, struct ata_device *);
-void (*post_set_mode) (struct ata_port *ap);
+void (*post_set_mode) (struct ata_port *);
+unsigned int (*mode_filter) (struct ata_port *, struct ata_device *, unsigned int);
         </programlisting>
 
         <para>
         Hooks called prior to the issue of SET FEATURES - XFER MODE
-        command.  dev->pio_mode is guaranteed to be valid when
-        ->set_piomode() is called, and dev->dma_mode is guaranteed to be
-        valid when ->set_dmamode() is called.  ->post_set_mode() is
+        command.  The optional ->mode_filter() hook is called when libata
+        has built a mask of the possible modes. This is passed to the 
+        ->mode_filter() function which should return a mask of valid modes
+        after filtering those unsuitable due to hardware limits. It is not
+        valid to use this interface to add modes.
+        </para>
+        <para>
+        dev->pio_mode and dev->dma_mode are guaranteed to be valid when
+        ->set_piomode() and when ->set_dmamode() is called. The timings for
+        any other drive sharing the cable will also be valid at this point.
+        That is the library records the decisions for the modes of each
+        drive on a channel before it attempts to set any of them.
+        </para>
+        <para>
+        ->post_set_mode() is
         called unconditionally, after the SET FEATURES - XFER MODE
         command completes successfully.
         </para>
@@ -230,6 +243,32 @@ void (*dev_select)(struct ata_port *ap, unsigned int device);
 
         </sect2>
 
+        <sect2><title>Private tuning method</title>
+        <programlisting>
+void (*set_mode) (struct ata_port *ap);
+        </programlisting>
+
+        <para>
+        By default libata performs drive and controller tuning in
+        accordance with the ATA timing rules and also applies blacklists
+        and cable limits. Some controllers need special handling and have
+        custom tuning rules, typically raid controllers that use ATA
+        commands but do not actually do drive timing.
+        </para>
+
+        <warning>
+        <para>
+        This hook should not be used to replace the standard controller
+        tuning logic when a controller has quirks. Replacing the default
+        tuning logic in that case would bypass handling for drive and
+        bridge quirks that may be important to data reliability. If a
+        controller needs to filter the mode selection it should use the
+        mode_filter hook instead.
+        </para>
+        </warning>
+
+        </sect2>
+
         <sect2><title>Reset ATA bus</title>
         <programlisting>
 void (*phy_reset) (struct ata_port *ap);
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 495858b236b6..59d0c74c79c9 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -127,13 +127,6 @@ Who:	Christoph Hellwig <hch@lst.de>
 
 ---------------------------
 
-What:   EXPORT_SYMBOL(lookup_hash)
-When:   January 2006
-Why:    Too low-level interface.  Use lookup_one_len or lookup_create instead.
-Who:    Christoph Hellwig <hch@lst.de>
-
----------------------------
-
 What:   CONFIG_FORCED_INLINING
 When:   June 2006
 Why:    Config option is there to see if gcc is good enough. (in january
@@ -241,3 +234,15 @@ Why:	The USB subsystem has changed a lot over time, and it has been
 Who:    Greg Kroah-Hartman <gregkh@suse.de>
 
 ---------------------------
+
+What:   find_trylock_page
+When:   January 2007
+Why:    The interface no longer has any callers left in the kernel. It
+        is an odd interface (compared with other find_*_page functions), in
+        that it does not take a refcount to the page, only the page lock.
+        It should be replaced with find_get_page or find_lock_page if possible.
+        This feature removal can be reevaluated if users of the interface
+        cannot cleanly use something else.
+Who:    Nick Piggin <npiggin@suse.de>
+
+---------------------------
diff --git a/Documentation/leds-class.txt b/Documentation/leds-class.txt
new file mode 100644
index 000000000000..8c35c0426110
--- /dev/null
+++ b/Documentation/leds-class.txt
@@ -0,0 +1,71 @@
+LED handling under Linux
+========================
+
+If you're reading this and thinking about keyboard leds, these are
+handled by the input subsystem and the led class is *not* needed.
+
+In its simplest form, the LED class just allows control of LEDs from
+userspace. LEDs appear in /sys/class/leds/. The brightness file will
+set the brightness of the LED (taking a value 0-255). Most LEDs don't
+have hardware brightness support so will just be turned on for non-zero
+brightness settings.
+
+The class also introduces the optional concept of an LED trigger. A trigger
+is a kernel based source of led events. Triggers can either be simple or
+complex. A simple trigger isn't configurable and is designed to slot into
+existing subsystems with minimal additional code. Examples are the ide-disk,
+nand-disk and sharpsl-charge triggers. With led triggers disabled, the code
+optimises away.
+
+Complex triggers whilst available to all LEDs have LED specific
+parameters and work on a per LED basis. The timer trigger is an example.
+
+You can change triggers in a similar manner to the way an IO scheduler
+is chosen (via /sys/class/leds/<device>/trigger). Trigger specific
+parameters can appear in /sys/class/leds/<device> once a given trigger is
+selected.
+
+
+Design Philosophy
+=================
+
+The underlying design philosophy is simplicity. LEDs are simple devices
+and the aim is to keep a small amount of code giving as much functionality
+as possible.  Please keep this in mind when suggesting enhancements.
+
+
+LED Device Naming
+=================
+
+Is currently of the form:
+
+"devicename:colour"
+
+There have been calls for LED properties such as colour to be exported as
+individual led class attributes. As a solution which doesn't incur as much
+overhead, I suggest these become part of the device name. The naming scheme
+above leaves scope for further attributes should they be needed.
+
+
+Known Issues
+============
+
+The LED Trigger core cannot be a module as the simple trigger functions
+would cause nightmare dependency issues. I see this as a minor issue
+compared to the benefits the simple trigger functionality brings. The
+rest of the LED subsystem can be modular.
+
+Some leds can be programmed to flash in hardware. As this isn't a generic
+LED device property, this should be exported as a device specific sysfs
+attribute rather than part of the class if this functionality is required.
+
+
+Future Development
+==================
+
+At the moment, a trigger can't be created specifically for a single LED.
+There are a number of cases where a trigger might only be mappable to a
+particular LED (ACPI?). The addition of triggers provided by the LED driver
+should cover this option and be possible to add without breaking the
+current interface.
+
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
new file mode 100644
index 000000000000..f8550310a6d5
--- /dev/null
+++ b/Documentation/memory-barriers.txt
@@ -0,0 +1,1913 @@
+                         ============================
+                         LINUX KERNEL MEMORY BARRIERS
+                         ============================
+
+By: David Howells <dhowells@redhat.com>
+
+Contents:
+
+ (*) Abstract memory access model.
+
+     - Device operations.
+     - Guarantees.
+
+ (*) What are memory barriers?
+
+     - Varieties of memory barrier.
+     - What may not be assumed about memory barriers?
+     - Data dependency barriers.
+     - Control dependencies.
+     - SMP barrier pairing.
+     - Examples of memory barrier sequences.
+
+ (*) Explicit kernel barriers.
+
+     - Compiler barrier.
+     - The CPU memory barriers.
+     - MMIO write barrier.
+
+ (*) Implicit kernel memory barriers.
+
+     - Locking functions.
+     - Interrupt disabling functions.
+     - Miscellaneous functions.
+
+ (*) Inter-CPU locking barrier effects.
+
+     - Locks vs memory accesses.
+     - Locks vs I/O accesses.
+
+ (*) Where are memory barriers needed?
+
+     - Interprocessor interaction.
+     - Atomic operations.
+     - Accessing devices.
+     - Interrupts.
+
+ (*) Kernel I/O barrier effects.
+
+ (*) Assumed minimum execution ordering model.
+
+ (*) The effects of the cpu cache.
+
+     - Cache coherency.
+     - Cache coherency vs DMA.
+     - Cache coherency vs MMIO.
+
+ (*) The things CPUs get up to.
+
+     - And then there's the Alpha.
+
+ (*) References.
+
+
+============================
+ABSTRACT MEMORY ACCESS MODEL
+============================
+
+Consider the following abstract model of the system:
+
+                            :                :
+                            :                :
+                            :                :
+                +-------+   :   +--------+   :   +-------+
+                |       |   :   |        |   :   |       |
+                |       |   :   |        |   :   |       |
+                | CPU 1 |<----->| Memory |<----->| CPU 2 |
+                |       |   :   |        |   :   |       |
+                |       |   :   |        |   :   |       |
+                +-------+   :   +--------+   :   +-------+
+                    ^       :       ^        :       ^
+                    |       :       |        :       |
+                    |       :       |        :       |
+                    |       :       v        :       |
+                    |       :   +--------+   :       |
+                    |       :   |        |   :       |
+                    |       :   |        |   :       |
+                    +---------->| Device |<----------+
+                            :   |        |   :
+                            :   |        |   :
+                            :   +--------+   :
+                            :                :
+
+Each CPU executes a program that generates memory access operations.  In the
+abstract CPU, memory operation ordering is very relaxed, and a CPU may actually
+perform the memory operations in any order it likes, provided program causality
+appears to be maintained.  Similarly, the compiler may also arrange the
+instructions it emits in any order it likes, provided it doesn't affect the
+apparent operation of the program.
+
+So in the above diagram, the effects of the memory operations performed by a
+CPU are perceived by the rest of the system as the operations cross the
+interface between the CPU and rest of the system (the dotted lines).
+
+
+For example, consider the following sequence of events:
+
+        CPU 1           CPU 2
+        =============== ===============
+        { A == 1; B == 2 }
+        A = 3;          x = A;
+        B = 4;          y = B;
+
+The set of accesses as seen by the memory system in the middle can be arranged
+in 24 different combinations:
+
+        STORE A=3,      STORE B=4,      x=LOAD A->3,    y=LOAD B->4
+        STORE A=3,      STORE B=4,      y=LOAD B->4,    x=LOAD A->3
+        STORE A=3,      x=LOAD A->3,    STORE B=4,      y=LOAD B->4
+        STORE A=3,      x=LOAD A->3,    y=LOAD B->2,    STORE B=4
+        STORE A=3,      y=LOAD B->2,    STORE B=4,      x=LOAD A->3
+        STORE A=3,      y=LOAD B->2,    x=LOAD A->3,    STORE B=4
+        STORE B=4,      STORE A=3,      x=LOAD A->3,    y=LOAD B->4
+        STORE B=4, ...
+        ...
+
+and can thus result in four different combinations of values:
+
+        x == 1, y == 2
+        x == 1, y == 4
+        x == 3, y == 2
+        x == 3, y == 4
+
+
+Furthermore, the stores committed by a CPU to the memory system may not be
+perceived by the loads made by another CPU in the same order as the stores were
+committed.
+
+
+As a further example, consider this sequence of events:
+
+        CPU 1           CPU 2
+        =============== ===============
+        { A == 1, B == 2, C = 3, P == &A, Q == &C }
+        B = 4;          Q = P;
+        P = &B          D = *Q;
+
+There is an obvious data dependency here, as the value loaded into D depends on
+the address retrieved from P by CPU 2.  At the end of the sequence, any of the
+following results are possible:
+
+        (Q == &A) and (D == 1)
+        (Q == &B) and (D == 2)
+        (Q == &B) and (D == 4)
+
+Note that CPU 2 will never try and load C into D because the CPU will load P
+into Q before issuing the load of *Q.
+
+
+DEVICE OPERATIONS
+-----------------
+
+Some devices present their control interfaces as collections of memory
+locations, but the order in which the control registers are accessed is very
+important.  For instance, imagine an ethernet card with a set of internal
+registers that are accessed through an address port register (A) and a data
+port register (D).  To read internal register 5, the following code might then
+be used:
+
+        *A = 5;
+        x = *D;
+
+but this might show up as either of the following two sequences:
+
+        STORE *A = 5, x = LOAD *D
+        x = LOAD *D, STORE *A = 5
+
+the second of which will almost certainly result in a malfunction, since it set
+the address _after_ attempting to read the register.
+
+
+GUARANTEES
+----------
+
+There are some minimal guarantees that may be expected of a CPU:
+
+ (*) On any given CPU, dependent memory accesses will be issued in order, with
+     respect to itself.  This means that for:
+
+        Q = P; D = *Q;
+
+     the CPU will issue the following memory operations:
+
+        Q = LOAD P, D = LOAD *Q
+
+     and always in that order.
+
+ (*) Overlapping loads and stores within a particular CPU will appear to be
+     ordered within that CPU.  This means that for:
+
+        a = *X; *X = b;
+
+     the CPU will only issue the following sequence of memory operations:
+
+        a = LOAD *X, STORE *X = b
+
+     And for:
+
+        *X = c; d = *X;
+
+     the CPU will only issue:
+
+        STORE *X = c, d = LOAD *X
+
+     (Loads and stores overlap if they are targetted at overlapping pieces of
+     memory).
+
+And there are a number of things that _must_ or _must_not_ be assumed:
+
+ (*) It _must_not_ be assumed that independent loads and stores will be issued
+     in the order given.  This means that for:
+
+        X = *A; Y = *B; *D = Z;
+
+     we may get any of the following sequences:
+
+        X = LOAD *A,  Y = LOAD *B,  STORE *D = Z
+        X = LOAD *A,  STORE *D = Z, Y = LOAD *B
+        Y = LOAD *B,  X = LOAD *A,  STORE *D = Z
+        Y = LOAD *B,  STORE *D = Z, X = LOAD *A
+        STORE *D = Z, X = LOAD *A,  Y = LOAD *B
+        STORE *D = Z, Y = LOAD *B,  X = LOAD *A
+
+ (*) It _must_ be assumed that overlapping memory accesses may be merged or
+     discarded.  This means that for:
+
+        X = *A; Y = *(A + 4);
+
+     we may get any one of the following sequences:
+
+        X = LOAD *A; Y = LOAD *(A + 4);
+        Y = LOAD *(A + 4); X = LOAD *A;
+        {X, Y} = LOAD {*A, *(A + 4) };
+
+     And for:
+
+        *A = X; Y = *A;
+
+     we may get either of:
+
+        STORE *A = X; Y = LOAD *A;
+        STORE *A = Y;
+
+
+=========================
+WHAT ARE MEMORY BARRIERS?
+=========================
+
+As can be seen above, independent memory operations are effectively performed
+in random order, but this can be a problem for CPU-CPU interaction and for I/O.
+What is required is some way of intervening to instruct the compiler and the
+CPU to restrict the order.
+
+Memory barriers are such interventions.  They impose a perceived partial
+ordering between the memory operations specified on either side of the barrier.
+They request that the sequence of memory events generated appears to other
+parts of the system as if the barrier is effective on that CPU.
+
+
+VARIETIES OF MEMORY BARRIER
+---------------------------
+
+Memory barriers come in four basic varieties:
+
+ (1) Write (or store) memory barriers.
+
+     A write memory barrier gives a guarantee that all the STORE operations
+     specified before the barrier will appear to happen before all the STORE
+     operations specified after the barrier with respect to the other
+     components of the system.
+
+     A write barrier is a partial ordering on stores only; it is not required
+     to have any effect on loads.
+
+     A CPU can be viewed as as commiting a sequence of store operations to the
+     memory system as time progresses.  All stores before a write barrier will
+     occur in the sequence _before_ all the stores after the write barrier.
+
+     [!] Note that write barriers should normally be paired with read or data
+     dependency barriers; see the "SMP barrier pairing" subsection.
+
+
+ (2) Data dependency barriers.
+
+     A data dependency barrier is a weaker form of read barrier.  In the case
+     where two loads are performed such that the second depends on the result
+     of the first (eg: the first load retrieves the address to which the second
+     load will be directed), a data dependency barrier would be required to
+     make sure that the target of the second load is updated before the address
+     obtained by the first load is accessed.
+
+     A data dependency barrier is a partial ordering on interdependent loads
+     only; it is not required to have any effect on stores, independent loads
+     or overlapping loads.
+
+     As mentioned in (1), the other CPUs in the system can be viewed as
+     committing sequences of stores to the memory system that the CPU being
+     considered can then perceive.  A data dependency barrier issued by the CPU
+     under consideration guarantees that for any load preceding it, if that
+     load touches one of a sequence of stores from another CPU, then by the
+     time the barrier completes, the effects of all the stores prior to that
+     touched by the load will be perceptible to any loads issued after the data
+     dependency barrier.
+
+     See the "Examples of memory barrier sequences" subsection for diagrams
+     showing the ordering constraints.
+
+     [!] Note that the first load really has to have a _data_ dependency and
+     not a control dependency.  If the address for the second load is dependent
+     on the first load, but the dependency is through a conditional rather than
+     actually loading the address itself, then it's a _control_ dependency and
+     a full read barrier or better is required.  See the "Control dependencies"
+     subsection for more information.
+
+     [!] Note that data dependency barriers should normally be paired with
+     write barriers; see the "SMP barrier pairing" subsection.
+
+
+ (3) Read (or load) memory barriers.
+
+     A read barrier is a data dependency barrier plus a guarantee that all the
+     LOAD operations specified before the barrier will appear to happen before
+     all the LOAD operations specified after the barrier with respect to the
+     other components of the system.
+
+     A read barrier is a partial ordering on loads only; it is not required to
+     have any effect on stores.
+
+     Read memory barriers imply data dependency barriers, and so can substitute
+     for them.
+
+     [!] Note that read barriers should normally be paired with write barriers;
+     see the "SMP barrier pairing" subsection.
+
+
+ (4) General memory barriers.
+
+     A general memory barrier is a combination of both a read memory barrier
+     and a write memory barrier.  It is a partial ordering over both loads and
+     stores.
+
+     General memory barriers imply both read and write memory barriers, and so
+     can substitute for either.
+
+
+And a couple of implicit varieties:
+
+ (5) LOCK operations.
+
+     This acts as a one-way permeable barrier.  It guarantees that all memory
+     operations after the LOCK operation will appear to happen after the LOCK
+     operation with respect to the other components of the system.
+
+     Memory operations that occur before a LOCK operation may appear to happen
+     after it completes.
+
+     A LOCK operation should almost always be paired with an UNLOCK operation.
+
+
+ (6) UNLOCK operations.
+
+     This also acts as a one-way permeable barrier.  It guarantees that all
+     memory operations before the UNLOCK operation will appear to happen before
+     the UNLOCK operation with respect to the other components of the system.
+
+     Memory operations that occur after an UNLOCK operation may appear to
+     happen before it completes.
+
+     LOCK and UNLOCK operations are guaranteed to appear with respect to each
+     other strictly in the order specified.
+
+     The use of LOCK and UNLOCK operations generally precludes the need for
+     other sorts of memory barrier (but note the exceptions mentioned in the
+     subsection "MMIO write barrier").
+
+
+Memory barriers are only required where there's a possibility of interaction
+between two CPUs or between a CPU and a device.  If it can be guaranteed that
+there won't be any such interaction in any particular piece of code, then
+memory barriers are unnecessary in that piece of code.
+
+
+Note that these are the _minimum_ guarantees.  Different architectures may give
+more substantial guarantees, but they may _not_ be relied upon outside of arch
+specific code.
+
+
+WHAT MAY NOT BE ASSUMED ABOUT MEMORY BARRIERS?
+----------------------------------------------
+
+There are certain things that the Linux kernel memory barriers do not guarantee:
+
+ (*) There is no guarantee that any of the memory accesses specified before a
+     memory barrier will be _complete_ by the completion of a memory barrier
+     instruction; the barrier can be considered to draw a line in that CPU's
+     access queue that accesses of the appropriate type may not cross.
+
+ (*) There is no guarantee that issuing a memory barrier on one CPU will have
+     any direct effect on another CPU or any other hardware in the system.  The
+     indirect effect will be the order in which the second CPU sees the effects
+     of the first CPU's accesses occur, but see the next point:
+
+ (*) There is no guarantee that the a CPU will see the correct order of effects
+     from a second CPU's accesses, even _if_ the second CPU uses a memory
+     barrier, unless the first CPU _also_ uses a matching memory barrier (see
+     the subsection on "SMP Barrier Pairing").
+
+ (*) There is no guarantee that some intervening piece of off-the-CPU
+     hardware[*] will not reorder the memory accesses.  CPU cache coherency
+     mechanisms should propagate the indirect effects of a memory barrier
+     between CPUs, but might not do so in order.
+
+        [*] For information on bus mastering DMA and coherency please read:
+
+            Documentation/pci.txt
+            Documentation/DMA-mapping.txt
+            Documentation/DMA-API.txt
+
+
+DATA DEPENDENCY BARRIERS
+------------------------
+
+The usage requirements of data dependency barriers are a little subtle, and
+it's not always obvious that they're needed.  To illustrate, consider the
+following sequence of events:
+
+        CPU 1           CPU 2
+        =============== ===============
+        { A == 1, B == 2, C = 3, P == &A, Q == &C }
+        B = 4;
+        <write barrier>
+        P = &B
+                        Q = P;
+                        D = *Q;
+
+There's a clear data dependency here, and it would seem that by the end of the
+sequence, Q must be either &A or &B, and that:
+
+        (Q == &A) implies (D == 1)
+        (Q == &B) implies (D == 4)
+
+But! CPU 2's perception of P may be updated _before_ its perception of B, thus
+leading to the following situation:
+
+        (Q == &B) and (D == 2) ????
+
+Whilst this may seem like a failure of coherency or causality maintenance, it
+isn't, and this behaviour can be observed on certain real CPUs (such as the DEC
+Alpha).
+
+To deal with this, a data dependency barrier must be inserted between the
+address load and the data load:
+
+        CPU 1           CPU 2
+        =============== ===============
+        { A == 1, B == 2, C = 3, P == &A, Q == &C }
+        B = 4;
+        <write barrier>
+        P = &B
+                        Q = P;
+                        <data dependency barrier>
+                        D = *Q;
+
+This enforces the occurrence of one of the two implications, and prevents the
+third possibility from arising.
+
+[!] Note that this extremely counterintuitive situation arises most easily on
+machines with split caches, so that, for example, one cache bank processes
+even-numbered cache lines and the other bank processes odd-numbered cache
+lines.  The pointer P might be stored in an odd-numbered cache line, and the
+variable B might be stored in an even-numbered cache line.  Then, if the
+even-numbered bank of the reading CPU's cache is extremely busy while the
+odd-numbered bank is idle, one can see the new value of the pointer P (&B),
+but the old value of the variable B (1).
+
+
+Another example of where data dependency barriers might by required is where a
+number is read from memory and then used to calculate the index for an array
+access:
+
+        CPU 1           CPU 2
+        =============== ===============
+        { M[0] == 1, M[1] == 2, M[3] = 3, P == 0, Q == 3 }
+        M[1] = 4;
+        <write barrier>
+        P = 1
+                        Q = P;
+                        <data dependency barrier>
+                        D = M[Q];
+
+
+The data dependency barrier is very important to the RCU system, for example.
+See rcu_dereference() in include/linux/rcupdate.h.  This permits the current
+target of an RCU'd pointer to be replaced with a new modified target, without
+the replacement target appearing to be incompletely initialised.
+
+See also the subsection on "Cache Coherency" for a more thorough example.
+
+
+CONTROL DEPENDENCIES
+--------------------
+
+A control dependency requires a full read memory barrier, not simply a data
+dependency barrier to make it work correctly.  Consider the following bit of
+code:
+
+        q = &a;
+        if (p)
+                q = &b;
+        <data dependency barrier>
+        x = *q;
+
+This will not have the desired effect because there is no actual data
+dependency, but rather a control dependency that the CPU may short-circuit by
+attempting to predict the outcome in advance.  In such a case what's actually
+required is:
+
+        q = &a;
+        if (p)
+                q = &b;
+        <read barrier>
+        x = *q;
+
+
+SMP BARRIER PAIRING
+-------------------
+
+When dealing with CPU-CPU interactions, certain types of memory barrier should
+always be paired.  A lack of appropriate pairing is almost certainly an error.
+
+A write barrier should always be paired with a data dependency barrier or read
+barrier, though a general barrier would also be viable.  Similarly a read
+barrier or a data dependency barrier should always be paired with at least an
+write barrier, though, again, a general barrier is viable:
+
+        CPU 1           CPU 2
+        =============== ===============
+        a = 1;
+        <write barrier>
+        b = 2;          x = a;
+                        <read barrier>
+                        y = b;
+
+Or:
+
+        CPU 1           CPU 2
+        =============== ===============================
+        a = 1;
+        <write barrier>
+        b = &a;         x = b;
+                        <data dependency barrier>
+                        y = *x;
+
+Basically, the read barrier always has to be there, even though it can be of
+the "weaker" type.
+
+
+EXAMPLES OF MEMORY BARRIER SEQUENCES
+------------------------------------
+
+Firstly, write barriers act as a partial orderings on store operations.
+Consider the following sequence of events:
+
+        CPU 1
+        =======================
+        STORE A = 1
+        STORE B = 2
+        STORE C = 3
+        <write barrier>
+        STORE D = 4
+        STORE E = 5
+
+This sequence of events is committed to the memory coherence system in an order
+that the rest of the system might perceive as the unordered set of { STORE A,
+STORE B, STORE C } all occuring before the unordered set of { STORE D, STORE E
+}:
+
+        +-------+       :      :
+        |       |       +------+
+        |       |------>| C=3  |     }     /\
+        |       |  :    +------+     }-----  \  -----> Events perceptible
+        |       |  :    | A=1  |     }        \/       to rest of system
+        |       |  :    +------+     }
+        | CPU 1 |  :    | B=2  |     }
+        |       |       +------+     }
+        |       |   wwwwwwwwwwwwwwww }   <--- At this point the write barrier
+        |       |       +------+     }        requires all stores prior to the
+        |       |  :    | E=5  |     }        barrier to be committed before
+        |       |  :    +------+     }        further stores may be take place.
+        |       |------>| D=4  |     }
+        |       |       +------+
+        +-------+       :      :
+                           |
+                           | Sequence in which stores committed to memory system
+                           | by CPU 1
+                           V
+
+
+Secondly, data dependency barriers act as a partial orderings on data-dependent
+loads.  Consider the following sequence of events:
+
+        CPU 1                   CPU 2
+        ======================= =======================
+        STORE A = 1
+        STORE B = 2
+        <write barrier>
+        STORE C = &B            LOAD X
+        STORE D = 4             LOAD C (gets &B)
+                                LOAD *C (reads B)
+
+Without intervention, CPU 2 may perceive the events on CPU 1 in some
+effectively random order, despite the write barrier issued by CPU 1:
+
+        +-------+       :      :                :       :
+        |       |       +------+                +-------+  | Sequence of update
+        |       |------>| B=2  |-----       --->| Y->8  |  | of perception on
+        |       |  :    +------+     \          +-------+  | CPU 2
+        | CPU 1 |  :    | A=1  |      \     --->| C->&Y |  V
+        |       |       +------+       |        +-------+
+        |       |   wwwwwwwwwwwwwwww   |        :       :
+        |       |       +------+       |        :       :
+        |       |  :    | C=&B |---    |        :       :       +-------+
+        |       |  :    +------+   \   |        +-------+       |       |
+        |       |------>| D=4  |    ----------->| C->&B |------>|       |
+        |       |       +------+       |        +-------+       |       |
+        +-------+       :      :       |        :       :       |       |
+                                       |        :       :       |       |
+                                       |        :       :       | CPU 2 |
+                                       |        +-------+       |       |
+            Apparently incorrect --->  |        | B->7  |------>|       |
+            perception of B (!)        |        +-------+       |       |
+                                       |        :       :       |       |
+                                       |        +-------+       |       |
+            The load of X holds --->    \       | X->9  |------>|       |
+            up the maintenance           \      +-------+       |       |
+            of coherence of B             ----->| B->2  |       +-------+
+                                                +-------+
+                                                :       :
+
+
+In the above example, CPU 2 perceives that B is 7, despite the load of *C
+(which would be B) coming after the the LOAD of C.
+
+If, however, a data dependency barrier were to be placed between the load of C
+and the load of *C (ie: B) on CPU 2, then the following will occur:
+
+        +-------+       :      :                :       :
+        |       |       +------+                +-------+
+        |       |------>| B=2  |-----       --->| Y->8  |
+        |       |  :    +------+     \          +-------+
+        | CPU 1 |  :    | A=1  |      \     --->| C->&Y |
+        |       |       +------+       |        +-------+
+        |       |   wwwwwwwwwwwwwwww   |        :       :
+        |       |       +------+       |        :       :
+        |       |  :    | C=&B |---    |        :       :       +-------+
+        |       |  :    +------+   \   |        +-------+       |       |
+        |       |------>| D=4  |    ----------->| C->&B |------>|       |
+        |       |       +------+       |        +-------+       |       |
+        +-------+       :      :       |        :       :       |       |
+                                       |        :       :       |       |
+                                       |        :       :       | CPU 2 |
+                                       |        +-------+       |       |
+                                        \       | X->9  |------>|       |
+                                         \      +-------+       |       |
+                                          ----->| B->2  |       |       |
+                                                +-------+       |       |
+             Makes sure all effects --->    ddddddddddddddddd   |       |
+             prior to the store of C            +-------+       |       |
+             are perceptible to                 | B->2  |------>|       |
+             successive loads                   +-------+       |       |
+                                                :       :       +-------+
+
+
+And thirdly, a read barrier acts as a partial order on loads.  Consider the
+following sequence of events:
+
+        CPU 1                   CPU 2
+        ======================= =======================
+        STORE A=1
+        STORE B=2
+        STORE C=3
+        <write barrier>
+        STORE D=4
+        STORE E=5
+                                LOAD A
+                                LOAD B
+                                LOAD C
+                                LOAD D
+                                LOAD E
+
+Without intervention, CPU 2 may then choose to perceive the events on CPU 1 in
+some effectively random order, despite the write barrier issued by CPU 1:
+
+        +-------+       :      :
+        |       |       +------+
+        |       |------>| C=3  | }
+        |       |  :    +------+ }
+        |       |  :    | A=1  | }
+        |       |  :    +------+ }
+        | CPU 1 |  :    | B=2  | }---
+        |       |       +------+ }   \
+        |       |   wwwwwwwwwwwww}    \
+        |       |       +------+ }     \          :       :       +-------+
+        |       |  :    | E=5  | }      \         +-------+       |       |
+        |       |  :    +------+ }       \      { | C->3  |------>|       |
+        |       |------>| D=4  | }        \     { +-------+    :  |       |
+        |       |       +------+           \    { | E->5  |    :  |       |
+        +-------+       :      :            \   { +-------+    :  |       |
+                                   Transfer  -->{ | A->1  |    :  | CPU 2 |
+                                  from CPU 1    { +-------+    :  |       |
+                                   to CPU 2     { | D->4  |    :  |       |
+                                                { +-------+    :  |       |
+                                                { | B->2  |------>|       |
+                                                  +-------+       |       |
+                                                  :       :       +-------+
+
+
+If, however, a read barrier were to be placed between the load of C and the
+load of D on CPU 2, then the partial ordering imposed by CPU 1 will be
+perceived correctly by CPU 2.
+
+        +-------+       :      :
+        |       |       +------+
+        |       |------>| C=3  | }
+        |       |  :    +------+ }
+        |       |  :    | A=1  | }---
+        |       |  :    +------+ }   \
+        | CPU 1 |  :    | B=2  | }    \
+        |       |       +------+       \
+        |       |   wwwwwwwwwwwwwwww    \
+        |       |       +------+         \        :       :       +-------+
+        |       |  :    | E=5  | }        \       +-------+       |       |
+        |       |  :    +------+ }---      \    { | C->3  |------>|       |
+        |       |------>| D=4  | }   \      \   { +-------+    :  |       |
+        |       |       +------+      \      -->{ | B->2  |    :  |       |
+        +-------+       :      :       \        { +-------+    :  |       |
+                                        \       { | A->1  |    :  | CPU 2 |
+                                         \        +-------+       |       |
+           At this point the read ---->   \   rrrrrrrrrrrrrrrrr   |       |
+           barrier causes all effects      \      +-------+       |       |
+           prior to the storage of C        \   { | E->5  |    :  |       |
+           to be perceptible to CPU 2        -->{ +-------+    :  |       |
+                                                { | D->4  |------>|       |
+                                                  +-------+       |       |
+                                                  :       :       +-------+
+
+
+========================
+EXPLICIT KERNEL BARRIERS
+========================
+
+The Linux kernel has a variety of different barriers that act at different
+levels:
+
+  (*) Compiler barrier.
+
+  (*) CPU memory barriers.
+
+  (*) MMIO write barrier.
+
+
+COMPILER BARRIER
+----------------
+
+The Linux kernel has an explicit compiler barrier function that prevents the
+compiler from moving the memory accesses either side of it to the other side:
+
+        barrier();
+
+This a general barrier - lesser varieties of compiler barrier do not exist.
+
+The compiler barrier has no direct effect on the CPU, which may then reorder
+things however it wishes.
+
+
+CPU MEMORY BARRIERS
+-------------------
+
+The Linux kernel has eight basic CPU memory barriers:
+
+        TYPE            MANDATORY               SMP CONDITIONAL
+        =============== ======================= ===========================
+        GENERAL         mb()                    smp_mb()
+        WRITE           wmb()                   smp_wmb()
+        READ            rmb()                   smp_rmb()
+        DATA DEPENDENCY read_barrier_depends()  smp_read_barrier_depends()
+
+
+All CPU memory barriers unconditionally imply compiler barriers.
+
+SMP memory barriers are reduced to compiler barriers on uniprocessor compiled
+systems because it is assumed that a CPU will be appear to be self-consistent,
+and will order overlapping accesses correctly with respect to itself.
+
+[!] Note that SMP memory barriers _must_ be used to control the ordering of
+references to shared memory on SMP systems, though the use of locking instead
+is sufficient.
+
+Mandatory barriers should not be used to control SMP effects, since mandatory
+barriers unnecessarily impose overhead on UP systems. They may, however, be
+used to control MMIO effects on accesses through relaxed memory I/O windows.
+These are required even on non-SMP systems as they affect the order in which
+memory operations appear to a device by prohibiting both the compiler and the
+CPU from reordering them.
+
+
+There are some more advanced barrier functions:
+
+ (*) set_mb(var, value)
+ (*) set_wmb(var, value)
+
+     These assign the value to the variable and then insert at least a write
+     barrier after it, depending on the function.  They aren't guaranteed to
+     insert anything more than a compiler barrier in a UP compilation.
+
+
+ (*) smp_mb__before_atomic_dec();
+ (*) smp_mb__after_atomic_dec();
+ (*) smp_mb__before_atomic_inc();
+ (*) smp_mb__after_atomic_inc();
+
+     These are for use with atomic add, subtract, increment and decrement
+     functions, especially when used for reference counting.  These functions
+     do not imply memory barriers.
+
+     As an example, consider a piece of code that marks an object as being dead
+     and then decrements the object's reference count:
+
+        obj->dead = 1;
+        smp_mb__before_atomic_dec();
+        atomic_dec(&obj->ref_count);
+
+     This makes sure that the death mark on the object is perceived to be set
+     *before* the reference counter is decremented.
+
+     See Documentation/atomic_ops.txt for more information.  See the "Atomic
+     operations" subsection for information on where to use these.
+
+
+ (*) smp_mb__before_clear_bit(void);
+ (*) smp_mb__after_clear_bit(void);
+
+     These are for use similar to the atomic inc/dec barriers.  These are
+     typically used for bitwise unlocking operations, so care must be taken as
+     there are no implicit memory barriers here either.
+
+     Consider implementing an unlock operation of some nature by clearing a
+     locking bit.  The clear_bit() would then need to be barriered like this:
+
+        smp_mb__before_clear_bit();
+        clear_bit( ... );
+
+     This prevents memory operations before the clear leaking to after it.  See
+     the subsection on "Locking Functions" with reference to UNLOCK operation
+     implications.
+
+     See Documentation/atomic_ops.txt for more information.  See the "Atomic
+     operations" subsection for information on where to use these.
+
+
+MMIO WRITE BARRIER
+------------------
+
+The Linux kernel also has a special barrier for use with memory-mapped I/O
+writes:
+
+        mmiowb();
+
+This is a variation on the mandatory write barrier that causes writes to weakly
+ordered I/O regions to be partially ordered.  Its effects may go beyond the
+CPU->Hardware interface and actually affect the hardware at some level.
+
+See the subsection "Locks vs I/O accesses" for more information.
+
+
+===============================
+IMPLICIT KERNEL MEMORY BARRIERS
+===============================
+
+Some of the other functions in the linux kernel imply memory barriers, amongst
+which are locking, scheduling and memory allocation functions.
+
+This specification is a _minimum_ guarantee; any particular architecture may
+provide more substantial guarantees, but these may not be relied upon outside
+of arch specific code.
+
+
+LOCKING FUNCTIONS
+-----------------
+
+The Linux kernel has a number of locking constructs:
+
+ (*) spin locks
+ (*) R/W spin locks
+ (*) mutexes
+ (*) semaphores
+ (*) R/W semaphores
+ (*) RCU
+
+In all cases there are variants on "LOCK" operations and "UNLOCK" operations
+for each construct.  These operations all imply certain barriers:
+
+ (1) LOCK operation implication:
+
+     Memory operations issued after the LOCK will be completed after the LOCK
+     operation has completed.
+
+     Memory operations issued before the LOCK may be completed after the LOCK
+     operation has completed.
+
+ (2) UNLOCK operation implication:
+
+     Memory operations issued before the UNLOCK will be completed before the
+     UNLOCK operation has completed.
+
+     Memory operations issued after the UNLOCK may be completed before the
+     UNLOCK operation has completed.
+
+ (3) LOCK vs LOCK implication:
+
+     All LOCK operations issued before another LOCK operation will be completed
+     before that LOCK operation.
+
+ (4) LOCK vs UNLOCK implication:
+
+     All LOCK operations issued before an UNLOCK operation will be completed
+     before the UNLOCK operation.
+
+     All UNLOCK operations issued before a LOCK operation will be completed
+     before the LOCK operation.
+
+ (5) Failed conditional LOCK implication:
+
+     Certain variants of the LOCK operation may fail, either due to being
+     unable to get the lock immediately, or due to receiving an unblocked
+     signal whilst asleep waiting for the lock to become available.  Failed
+     locks do not imply any sort of barrier.
+
+Therefore, from (1), (2) and (4) an UNLOCK followed by an unconditional LOCK is
+equivalent to a full barrier, but a LOCK followed by an UNLOCK is not.
+
+[!] Note: one of the consequence of LOCKs and UNLOCKs being only one-way
+    barriers is that the effects instructions outside of a critical section may
+    seep into the inside of the critical section.
+
+Locks and semaphores may not provide any guarantee of ordering on UP compiled
+systems, and so cannot be counted on in such a situation to actually achieve
+anything at all - especially with respect to I/O accesses - unless combined
+with interrupt disabling operations.
+
+See also the section on "Inter-CPU locking barrier effects".
+
+
+As an example, consider the following:
+
+        *A = a;
+        *B = b;
+        LOCK
+        *C = c;
+        *D = d;
+        UNLOCK
+        *E = e;
+        *F = f;
+
+The following sequence of events is acceptable:
+
+        LOCK, {*F,*A}, *E, {*C,*D}, *B, UNLOCK
+
+        [+] Note that {*F,*A} indicates a combined access.
+
+But none of the following are:
+
+        {*F,*A}, *B,    LOCK, *C, *D,   UNLOCK, *E
+        *A, *B, *C,     LOCK, *D,       UNLOCK, *E, *F
+        *A, *B,         LOCK, *C,       UNLOCK, *D, *E, *F
+        *B,             LOCK, *C, *D,   UNLOCK, {*F,*A}, *E
+
+
+
+INTERRUPT DISABLING FUNCTIONS
+-----------------------------
+
+Functions that disable interrupts (LOCK equivalent) and enable interrupts
+(UNLOCK equivalent) will act as compiler barriers only.  So if memory or I/O
+barriers are required in such a situation, they must be provided from some
+other means.
+
+
+MISCELLANEOUS FUNCTIONS
+-----------------------
+
+Other functions that imply barriers:
+
+ (*) schedule() and similar imply full memory barriers.
+
+ (*) Memory allocation and release functions imply full memory barriers.
+
+
+=================================
+INTER-CPU LOCKING BARRIER EFFECTS
+=================================
+
+On SMP systems locking primitives give a more substantial form of barrier: one
+that does affect memory access ordering on other CPUs, within the context of
+conflict on any particular lock.
+
+
+LOCKS VS MEMORY ACCESSES
+------------------------
+
+Consider the following: the system has a pair of spinlocks (N) and (Q), and
+three CPUs; then should the following sequence of events occur:
+
+        CPU 1                           CPU 2
+        =============================== ===============================
+        *A = a;                         *E = e;
+        LOCK M                          LOCK Q
+        *B = b;                         *F = f;
+        *C = c;                         *G = g;
+        UNLOCK M                        UNLOCK Q
+        *D = d;                         *H = h;
+
+Then there is no guarantee as to what order CPU #3 will see the accesses to *A
+through *H occur in, other than the constraints imposed by the separate locks
+on the separate CPUs. It might, for example, see:
+
+        *E, LOCK M, LOCK Q, *G, *C, *F, *A, *B, UNLOCK Q, *D, *H, UNLOCK M
+
+But it won't see any of:
+
+        *B, *C or *D preceding LOCK M
+        *A, *B or *C following UNLOCK M
+        *F, *G or *H preceding LOCK Q
+        *E, *F or *G following UNLOCK Q
+
+
+However, if the following occurs:
+
+        CPU 1                           CPU 2
+        =============================== ===============================
+        *A = a;
+        LOCK M          [1]
+        *B = b;
+        *C = c;
+        UNLOCK M        [1]
+        *D = d;                         *E = e;
+                                        LOCK M          [2]
+                                        *F = f;
+                                        *G = g;
+                                        UNLOCK M        [2]
+                                        *H = h;
+
+CPU #3 might see:
+
+        *E, LOCK M [1], *C, *B, *A, UNLOCK M [1],
+                LOCK M [2], *H, *F, *G, UNLOCK M [2], *D
+
+But assuming CPU #1 gets the lock first, it won't see any of:
+
+        *B, *C, *D, *F, *G or *H preceding LOCK M [1]
+        *A, *B or *C following UNLOCK M [1]
+        *F, *G or *H preceding LOCK M [2]
+        *A, *B, *C, *E, *F or *G following UNLOCK M [2]
+
+
+LOCKS VS I/O ACCESSES
+---------------------
+
+Under certain circumstances (especially involving NUMA), I/O accesses within
+two spinlocked sections on two different CPUs may be seen as interleaved by the
+PCI bridge, because the PCI bridge does not necessarily participate in the
+cache-coherence protocol, and is therefore incapable of issuing the required
+read memory barriers.
+
+For example:
+
+        CPU 1                           CPU 2
+        =============================== ===============================
+        spin_lock(Q)
+        writel(0, ADDR)
+        writel(1, DATA);
+        spin_unlock(Q);
+                                        spin_lock(Q);
+                                        writel(4, ADDR);
+                                        writel(5, DATA);
+                                        spin_unlock(Q);
+
+may be seen by the PCI bridge as follows:
+
+        STORE *ADDR = 0, STORE *ADDR = 4, STORE *DATA = 1, STORE *DATA = 5
+
+which would probably cause the hardware to malfunction.
+
+
+What is necessary here is to intervene with an mmiowb() before dropping the
+spinlock, for example:
+
+        CPU 1                           CPU 2
+        =============================== ===============================
+        spin_lock(Q)
+        writel(0, ADDR)
+        writel(1, DATA);
+        mmiowb();
+        spin_unlock(Q);
+                                        spin_lock(Q);
+                                        writel(4, ADDR);
+                                        writel(5, DATA);
+                                        mmiowb();
+                                        spin_unlock(Q);
+
+this will ensure that the two stores issued on CPU #1 appear at the PCI bridge
+before either of the stores issued on CPU #2.
+
+
+Furthermore, following a store by a load to the same device obviates the need
+for an mmiowb(), because the load forces the store to complete before the load
+is performed:
+
+        CPU 1                           CPU 2
+        =============================== ===============================
+        spin_lock(Q)
+        writel(0, ADDR)
+        a = readl(DATA);
+        spin_unlock(Q);
+                                        spin_lock(Q);
+                                        writel(4, ADDR);
+                                        b = readl(DATA);
+                                        spin_unlock(Q);
+
+
+See Documentation/DocBook/deviceiobook.tmpl for more information.
+
+
+=================================
+WHERE ARE MEMORY BARRIERS NEEDED?
+=================================
+
+Under normal operation, memory operation reordering is generally not going to
+be a problem as a single-threaded linear piece of code will still appear to
+work correctly, even if it's in an SMP kernel.  There are, however, three
+circumstances in which reordering definitely _could_ be a problem:
+
+ (*) Interprocessor interaction.
+
+ (*) Atomic operations.
+
+ (*) Accessing devices (I/O).
+
+ (*) Interrupts.
+
+
+INTERPROCESSOR INTERACTION
+--------------------------
+
+When there's a system with more than one processor, more than one CPU in the
+system may be working on the same data set at the same time.  This can cause
+synchronisation problems, and the usual way of dealing with them is to use
+locks.  Locks, however, are quite expensive, and so it may be preferable to
+operate without the use of a lock if at all possible.  In such a case
+operations that affect both CPUs may have to be carefully ordered to prevent
+a malfunction.
+
+Consider, for example, the R/W semaphore slow path.  Here a waiting process is
+queued on the semaphore, by virtue of it having a piece of its stack linked to
+the semaphore's list of waiting processes:
+
+        struct rw_semaphore {
+                ...
+                spinlock_t lock;
+                struct list_head waiters;
+        };
+
+        struct rwsem_waiter {
+                struct list_head list;
+                struct task_struct *task;
+        };
+
+To wake up a particular waiter, the up_read() or up_write() functions have to:
+
+ (1) read the next pointer from this waiter's record to know as to where the
+     next waiter record is;
+
+ (4) read the pointer to the waiter's task structure;
+
+ (3) clear the task pointer to tell the waiter it has been given the semaphore;
+
+ (4) call wake_up_process() on the task; and
+
+ (5) release the reference held on the waiter's task struct.
+
+In otherwords, it has to perform this sequence of events:
+
+        LOAD waiter->list.next;
+        LOAD waiter->task;
+        STORE waiter->task;
+        CALL wakeup
+        RELEASE task
+
+and if any of these steps occur out of order, then the whole thing may
+malfunction.
+
+Once it has queued itself and dropped the semaphore lock, the waiter does not
+get the lock again; it instead just waits for its task pointer to be cleared
+before proceeding.  Since the record is on the waiter's stack, this means that
+if the task pointer is cleared _before_ the next pointer in the list is read,
+another CPU might start processing the waiter and might clobber the waiter's
+stack before the up*() function has a chance to read the next pointer.
+
+Consider then what might happen to the above sequence of events:
+
+        CPU 1                           CPU 2
+        =============================== ===============================
+                                        down_xxx()
+                                        Queue waiter
+                                        Sleep
+        up_yyy()
+        LOAD waiter->task;
+        STORE waiter->task;
+                                        Woken up by other event
+        <preempt>
+                                        Resume processing
+                                        down_xxx() returns
+                                        call foo()
+                                        foo() clobbers *waiter
+        </preempt>
+        LOAD waiter->list.next;
+        --- OOPS ---
+
+This could be dealt with using the semaphore lock, but then the down_xxx()
+function has to needlessly get the spinlock again after being woken up.
+
+The way to deal with this is to insert a general SMP memory barrier:
+
+        LOAD waiter->list.next;
+        LOAD waiter->task;
+        smp_mb();
+        STORE waiter->task;
+        CALL wakeup
+        RELEASE task
+
+In this case, the barrier makes a guarantee that all memory accesses before the
+barrier will appear to happen before all the memory accesses after the barrier
+with respect to the other CPUs on the system.  It does _not_ guarantee that all
+the memory accesses before the barrier will be complete by the time the barrier
+instruction itself is complete.
+
+On a UP system - where this wouldn't be a problem - the smp_mb() is just a
+compiler barrier, thus making sure the compiler emits the instructions in the
+right order without actually intervening in the CPU.  Since there there's only
+one CPU, that CPU's dependency ordering logic will take care of everything
+else.
+
+
+ATOMIC OPERATIONS
+-----------------
+
+Though they are technically interprocessor interaction considerations, atomic
+operations are noted specially as they do _not_ generally imply memory
+barriers.  The possible offenders include:
+
+        xchg();
+        cmpxchg();
+        test_and_set_bit();
+        test_and_clear_bit();
+        test_and_change_bit();
+        atomic_cmpxchg();
+        atomic_inc_return();
+        atomic_dec_return();
+        atomic_add_return();
+        atomic_sub_return();
+        atomic_inc_and_test();
+        atomic_dec_and_test();
+        atomic_sub_and_test();
+        atomic_add_negative();
+        atomic_add_unless();
+
+These may be used for such things as implementing LOCK operations or controlling
+the lifetime of objects by decreasing their reference counts.  In such cases
+they need preceding memory barriers.
+
+The following may also be possible offenders as they may be used as UNLOCK
+operations.
+
+        set_bit();
+        clear_bit();
+        change_bit();
+        atomic_set();
+
+
+The following are a little tricky:
+
+        atomic_add();
+        atomic_sub();
+        atomic_inc();
+        atomic_dec();
+
+If they're used for statistics generation, then they probably don't need memory
+barriers, unless there's a coupling between statistical data.
+
+If they're used for reference counting on an object to control its lifetime,
+they probably don't need memory barriers because either the reference count
+will be adjusted inside a locked section, or the caller will already hold
+sufficient references to make the lock, and thus a memory barrier unnecessary.
+
+If they're used for constructing a lock of some description, then they probably
+do need memory barriers as a lock primitive generally has to do things in a
+specific order.
+
+
+Basically, each usage case has to be carefully considered as to whether memory
+barriers are needed or not.  The simplest rule is probably: if the atomic
+operation is protected by a lock, then it does not require a barrier unless
+there's another operation within the critical section with respect to which an
+ordering must be maintained.
+
+See Documentation/atomic_ops.txt for more information.
+
+
+ACCESSING DEVICES
+-----------------
+
+Many devices can be memory mapped, and so appear to the CPU as if they're just
+a set of memory locations.  To control such a device, the driver usually has to
+make the right memory accesses in exactly the right order.
+
+However, having a clever CPU or a clever compiler creates a potential problem
+in that the carefully sequenced accesses in the driver code won't reach the
+device in the requisite order if the CPU or the compiler thinks it is more
+efficient to reorder, combine or merge accesses - something that would cause
+the device to malfunction.
+
+Inside of the Linux kernel, I/O should be done through the appropriate accessor
+routines - such as inb() or writel() - which know how to make such accesses
+appropriately sequential.  Whilst this, for the most part, renders the explicit
+use of memory barriers unnecessary, there are a couple of situations where they
+might be needed:
+
+ (1) On some systems, I/O stores are not strongly ordered across all CPUs, and
+     so for _all_ general drivers locks should be used and mmiowb() must be
+     issued prior to unlocking the critical section.
+
+ (2) If the accessor functions are used to refer to an I/O memory window with
+     relaxed memory access properties, then _mandatory_ memory barriers are
+     required to enforce ordering.
+
+See Documentation/DocBook/deviceiobook.tmpl for more information.
+
+
+INTERRUPTS
+----------
+
+A driver may be interrupted by its own interrupt service routine, and thus the
+two parts of the driver may interfere with each other's attempts to control or
+access the device.
+
+This may be alleviated - at least in part - by disabling local interrupts (a
+form of locking), such that the critical operations are all contained within
+the interrupt-disabled section in the driver.  Whilst the driver's interrupt
+routine is executing, the driver's core may not run on the same CPU, and its
+interrupt is not permitted to happen again until the current interrupt has been
+handled, thus the interrupt handler does not need to lock against that.
+
+However, consider a driver that was talking to an ethernet card that sports an
+address register and a data register.  If that driver's core talks to the card
+under interrupt-disablement and then the driver's interrupt handler is invoked:
+
+        LOCAL IRQ DISABLE
+        writew(ADDR, 3);
+        writew(DATA, y);
+        LOCAL IRQ ENABLE
+        <interrupt>
+        writew(ADDR, 4);
+        q = readw(DATA);
+        </interrupt>
+
+The store to the data register might happen after the second store to the
+address register if ordering rules are sufficiently relaxed:
+
+        STORE *ADDR = 3, STORE *ADDR = 4, STORE *DATA = y, q = LOAD *DATA
+
+
+If ordering rules are relaxed, it must be assumed that accesses done inside an
+interrupt disabled section may leak outside of it and may interleave with
+accesses performed in an interrupt - and vice versa - unless implicit or
+explicit barriers are used.
+
+Normally this won't be a problem because the I/O accesses done inside such
+sections will include synchronous load operations on strictly ordered I/O
+registers that form implicit I/O barriers. If this isn't sufficient then an
+mmiowb() may need to be used explicitly.
+
+
+A similar situation may occur between an interrupt routine and two routines
+running on separate CPUs that communicate with each other. If such a case is
+likely, then interrupt-disabling locks should be used to guarantee ordering.
+
+
+==========================
+KERNEL I/O BARRIER EFFECTS
+==========================
+
+When accessing I/O memory, drivers should use the appropriate accessor
+functions:
+
+ (*) inX(), outX():
+
+     These are intended to talk to I/O space rather than memory space, but
+     that's primarily a CPU-specific concept. The i386 and x86_64 processors do
+     indeed have special I/O space access cycles and instructions, but many
+     CPUs don't have such a concept.
+
+     The PCI bus, amongst others, defines an I/O space concept - which on such
+     CPUs as i386 and x86_64 cpus readily maps to the CPU's concept of I/O
+     space.  However, it may also mapped as a virtual I/O space in the CPU's
+     memory map, particularly on those CPUs that don't support alternate
+     I/O spaces.
+
+     Accesses to this space may be fully synchronous (as on i386), but
+     intermediary bridges (such as the PCI host bridge) may not fully honour
+     that.
+
+     They are guaranteed to be fully ordered with respect to each other.
+
+     They are not guaranteed to be fully ordered with respect to other types of
+     memory and I/O operation.
+
+ (*) readX(), writeX():
+
+     Whether these are guaranteed to be fully ordered and uncombined with
+     respect to each other on the issuing CPU depends on the characteristics
+     defined for the memory window through which they're accessing. On later
+     i386 architecture machines, for example, this is controlled by way of the
+     MTRR registers.
+
+     Ordinarily, these will be guaranteed to be fully ordered and uncombined,,
+     provided they're not accessing a prefetchable device.
+
+     However, intermediary hardware (such as a PCI bridge) may indulge in
+     deferral if it so wishes; to flush a store, a load from the same location
+     is preferred[*], but a load from the same device or from configuration
+     space should suffice for PCI.
+
+     [*] NOTE! attempting to load from the same location as was written to may
+         cause a malfunction - consider the 16550 Rx/Tx serial registers for
+         example.
+
+     Used with prefetchable I/O memory, an mmiowb() barrier may be required to
+     force stores to be ordered.
+
+     Please refer to the PCI specification for more information on interactions
+     between PCI transactions.
+
+ (*) readX_relaxed()
+
+     These are similar to readX(), but are not guaranteed to be ordered in any
+     way. Be aware that there is no I/O read barrier available.
+
+ (*) ioreadX(), iowriteX()
+
+     These will perform as appropriate for the type of access they're actually
+     doing, be it inX()/outX() or readX()/writeX().
+
+
+========================================
+ASSUMED MINIMUM EXECUTION ORDERING MODEL
+========================================
+
+It has to be assumed that the conceptual CPU is weakly-ordered but that it will
+maintain the appearance of program causality with respect to itself.  Some CPUs
+(such as i386 or x86_64) are more constrained than others (such as powerpc or
+frv), and so the most relaxed case (namely DEC Alpha) must be assumed outside
+of arch-specific code.
+
+This means that it must be considered that the CPU will execute its instruction
+stream in any order it feels like - or even in parallel - provided that if an
+instruction in the stream depends on the an earlier instruction, then that
+earlier instruction must be sufficiently complete[*] before the later
+instruction may proceed; in other words: provided that the appearance of
+causality is maintained.
+
+ [*] Some instructions have more than one effect - such as changing the
+     condition codes, changing registers or changing memory - and different
+     instructions may depend on different effects.
+
+A CPU may also discard any instruction sequence that winds up having no
+ultimate effect.  For example, if two adjacent instructions both load an
+immediate value into the same register, the first may be discarded.
+
+
+Similarly, it has to be assumed that compiler might reorder the instruction
+stream in any way it sees fit, again provided the appearance of causality is
+maintained.
+
+
+============================
+THE EFFECTS OF THE CPU CACHE
+============================
+
+The way cached memory operations are perceived across the system is affected to
+a certain extent by the caches that lie between CPUs and memory, and by the
+memory coherence system that maintains the consistency of state in the system.
+
+As far as the way a CPU interacts with another part of the system through the
+caches goes, the memory system has to include the CPU's caches, and memory
+barriers for the most part act at the interface between the CPU and its cache
+(memory barriers logically act on the dotted line in the following diagram):
+
+            <--- CPU --->         :       <----------- Memory ----------->
+                                  :
+        +--------+    +--------+  :   +--------+    +-----------+
+        |        |    |        |  :   |        |    |           |    +--------+
+        |  CPU   |    | Memory |  :   | CPU    |    |           |    |        |
+        |  Core  |--->| Access |----->| Cache  |<-->|           |    |        |
+        |        |    | Queue  |  :   |        |    |           |--->| Memory |
+        |        |    |        |  :   |        |    |           |    |        |
+        +--------+    +--------+  :   +--------+    |           |    |        |
+                                  :                 | Cache     |    +--------+
+                                  :                 | Coherency |
+                                  :                 | Mechanism |    +--------+
+        +--------+    +--------+  :   +--------+    |           |    |        |
+        |        |    |        |  :   |        |    |           |    |        |
+        |  CPU   |    | Memory |  :   | CPU    |    |           |--->| Device |
+        |  Core  |--->| Access |----->| Cache  |<-->|           |    |        |
+        |        |    | Queue  |  :   |        |    |           |    |        |
+        |        |    |        |  :   |        |    |           |    +--------+
+        +--------+    +--------+  :   +--------+    +-----------+
+                                  :
+                                  :
+
+Although any particular load or store may not actually appear outside of the
+CPU that issued it since it may have been satisfied within the CPU's own cache,
+it will still appear as if the full memory access had taken place as far as the
+other CPUs are concerned since the cache coherency mechanisms will migrate the
+cacheline over to the accessing CPU and propagate the effects upon conflict.
+
+The CPU core may execute instructions in any order it deems fit, provided the
+expected program causality appears to be maintained.  Some of the instructions
+generate load and store operations which then go into the queue of memory
+accesses to be performed.  The core may place these in the queue in any order
+it wishes, and continue execution until it is forced to wait for an instruction
+to complete.
+
+What memory barriers are concerned with is controlling the order in which
+accesses cross from the CPU side of things to the memory side of things, and
+the order in which the effects are perceived to happen by the other observers
+in the system.
+
+[!] Memory barriers are _not_ needed within a given CPU, as CPUs always see
+their own loads and stores as if they had happened in program order.
+
+[!] MMIO or other device accesses may bypass the cache system.  This depends on
+the properties of the memory window through which devices are accessed and/or
+the use of any special device communication instructions the CPU may have.
+
+
+CACHE COHERENCY
+---------------
+
+Life isn't quite as simple as it may appear above, however: for while the
+caches are expected to be coherent, there's no guarantee that that coherency
+will be ordered.  This means that whilst changes made on one CPU will
+eventually become visible on all CPUs, there's no guarantee that they will
+become apparent in the same order on those other CPUs.
+
+
+Consider dealing with a system that has pair of CPUs (1 & 2), each of which has
+a pair of parallel data caches (CPU 1 has A/B, and CPU 2 has C/D):
+
+                    :
+                    :                          +--------+
+                    :      +---------+         |        |
+        +--------+  : +--->| Cache A |<------->|        |
+        |        |  : |    +---------+         |        |
+        |  CPU 1 |<---+                        |        |
+        |        |  : |    +---------+         |        |
+        +--------+  : +--->| Cache B |<------->|        |
+                    :      +---------+         |        |
+                    :                          | Memory |
+                    :      +---------+         | System |
+        +--------+  : +--->| Cache C |<------->|        |
+        |        |  : |    +---------+         |        |
+        |  CPU 2 |<---+                        |        |
+        |        |  : |    +---------+         |        |
+        +--------+  : +--->| Cache D |<------->|        |
+                    :      +---------+         |        |
+                    :                          +--------+
+                    :
+
+Imagine the system has the following properties:
+
+ (*) an odd-numbered cache line may be in cache A, cache C or it may still be
+     resident in memory;
+
+ (*) an even-numbered cache line may be in cache B, cache D or it may still be
+     resident in memory;
+
+ (*) whilst the CPU core is interrogating one cache, the other cache may be
+     making use of the bus to access the rest of the system - perhaps to
+     displace a dirty cacheline or to do a speculative load;
+
+ (*) each cache has a queue of operations that need to be applied to that cache
+     to maintain coherency with the rest of the system;
+
+ (*) the coherency queue is not flushed by normal loads to lines already
+     present in the cache, even though the contents of the queue may
+     potentially effect those loads.
+
+Imagine, then, that two writes are made on the first CPU, with a write barrier
+between them to guarantee that they will appear to reach that CPU's caches in
+the requisite order:
+
+        CPU 1           CPU 2           COMMENT
+        =============== =============== =======================================
+                                        u == 0, v == 1 and p == &u, q == &u
+        v = 2;
+        smp_wmb();                      Make sure change to v visible before
+                                         change to p
+        <A:modify v=2>                  v is now in cache A exclusively
+        p = &v;
+        <B:modify p=&v>                 p is now in cache B exclusively
+
+The write memory barrier forces the other CPUs in the system to perceive that
+the local CPU's caches have apparently been updated in the correct order.  But
+now imagine that the second CPU that wants to read those values:
+
+        CPU 1           CPU 2           COMMENT
+        =============== =============== =======================================
+        ...
+                        q = p;
+                        x = *q;
+
+The above pair of reads may then fail to happen in expected order, as the
+cacheline holding p may get updated in one of the second CPU's caches whilst
+the update to the cacheline holding v is delayed in the other of the second
+CPU's caches by some other cache event:
+
+        CPU 1           CPU 2           COMMENT
+        =============== =============== =======================================
+                                        u == 0, v == 1 and p == &u, q == &u
+        v = 2;
+        smp_wmb();
+        <A:modify v=2>  <C:busy>
+                        <C:queue v=2>
+        p = &b;         q = p;
+                        <D:request p>
+        <B:modify p=&v> <D:commit p=&v>
+                        <D:read p>
+                        x = *q;
+                        <C:read *q>     Reads from v before v updated in cache
+                        <C:unbusy>
+                        <C:commit v=2>
+
+Basically, whilst both cachelines will be updated on CPU 2 eventually, there's
+no guarantee that, without intervention, the order of update will be the same
+as that committed on CPU 1.
+
+
+To intervene, we need to interpolate a data dependency barrier or a read
+barrier between the loads.  This will force the cache to commit its coherency
+queue before processing any further requests:
+
+        CPU 1           CPU 2           COMMENT
+        =============== =============== =======================================
+                                        u == 0, v == 1 and p == &u, q == &u
+        v = 2;
+        smp_wmb();
+        <A:modify v=2>  <C:busy>
+                        <C:queue v=2>
+        p = &b;         q = p;
+                        <D:request p>
+        <B:modify p=&v> <D:commit p=&v>
+                        <D:read p>
+                        smp_read_barrier_depends()
+                        <C:unbusy>
+                        <C:commit v=2>
+                        x = *q;
+                        <C:read *q>     Reads from v after v updated in cache
+
+
+This sort of problem can be encountered on DEC Alpha processors as they have a
+split cache that improves performance by making better use of the data bus.
+Whilst most CPUs do imply a data dependency barrier on the read when a memory
+access depends on a read, not all do, so it may not be relied on.
+
+Other CPUs may also have split caches, but must coordinate between the various
+cachelets for normal memory accesss.  The semantics of the Alpha removes the
+need for coordination in absence of memory barriers.
+
+
+CACHE COHERENCY VS DMA
+----------------------
+
+Not all systems maintain cache coherency with respect to devices doing DMA.  In
+such cases, a device attempting DMA may obtain stale data from RAM because
+dirty cache lines may be resident in the caches of various CPUs, and may not
+have been written back to RAM yet.  To deal with this, the appropriate part of
+the kernel must flush the overlapping bits of cache on each CPU (and maybe
+invalidate them as well).
+
+In addition, the data DMA'd to RAM by a device may be overwritten by dirty
+cache lines being written back to RAM from a CPU's cache after the device has
+installed its own data, or cache lines simply present in a CPUs cache may
+simply obscure the fact that RAM has been updated, until at such time as the
+cacheline is discarded from the CPU's cache and reloaded.  To deal with this,
+the appropriate part of the kernel must invalidate the overlapping bits of the
+cache on each CPU.
+
+See Documentation/cachetlb.txt for more information on cache management.
+
+
+CACHE COHERENCY VS MMIO
+-----------------------
+
+Memory mapped I/O usually takes place through memory locations that are part of
+a window in the CPU's memory space that have different properties assigned than
+the usual RAM directed window.
+
+Amongst these properties is usually the fact that such accesses bypass the
+caching entirely and go directly to the device buses.  This means MMIO accesses
+may, in effect, overtake accesses to cached memory that were emitted earlier.
+A memory barrier isn't sufficient in such a case, but rather the cache must be
+flushed between the cached memory write and the MMIO access if the two are in
+any way dependent.
+
+
+=========================
+THE THINGS CPUS GET UP TO
+=========================
+
+A programmer might take it for granted that the CPU will perform memory
+operations in exactly the order specified, so that if a CPU is, for example,
+given the following piece of code to execute:
+
+        a = *A;
+        *B = b;
+        c = *C;
+        d = *D;
+        *E = e;
+
+They would then expect that the CPU will complete the memory operation for each
+instruction before moving on to the next one, leading to a definite sequence of
+operations as seen by external observers in the system:
+
+        LOAD *A, STORE *B, LOAD *C, LOAD *D, STORE *E.
+
+
+Reality is, of course, much messier.  With many CPUs and compilers, the above
+assumption doesn't hold because:
+
+ (*) loads are more likely to need to be completed immediately to permit
+     execution progress, whereas stores can often be deferred without a
+     problem;
+
+ (*) loads may be done speculatively, and the result discarded should it prove
+     to have been unnecessary;
+
+ (*) loads may be done speculatively, leading to the result having being
+     fetched at the wrong time in the expected sequence of events;
+
+ (*) the order of the memory accesses may be rearranged to promote better use
+     of the CPU buses and caches;
+
+ (*) loads and stores may be combined to improve performance when talking to
+     memory or I/O hardware that can do batched accesses of adjacent locations,
+     thus cutting down on transaction setup costs (memory and PCI devices may
+     both be able to do this); and
+
+ (*) the CPU's data cache may affect the ordering, and whilst cache-coherency
+     mechanisms may alleviate this - once the store has actually hit the cache
+     - there's no guarantee that the coherency management will be propagated in
+     order to other CPUs.
+
+So what another CPU, say, might actually observe from the above piece of code
+is:
+
+        LOAD *A, ..., LOAD {*C,*D}, STORE *E, STORE *B
+
+        (Where "LOAD {*C,*D}" is a combined load)
+
+
+However, it is guaranteed that a CPU will be self-consistent: it will see its
+_own_ accesses appear to be correctly ordered, without the need for a memory
+barrier.  For instance with the following code:
+
+        U = *A;
+        *A = V;
+        *A = W;
+        X = *A;
+        *A = Y;
+        Z = *A;
+
+and assuming no intervention by an external influence, it can be assumed that
+the final result will appear to be:
+
+        U == the original value of *A
+        X == W
+        Z == Y
+        *A == Y
+
+The code above may cause the CPU to generate the full sequence of memory
+accesses:
+
+        U=LOAD *A, STORE *A=V, STORE *A=W, X=LOAD *A, STORE *A=Y, Z=LOAD *A
+
+in that order, but, without intervention, the sequence may have almost any
+combination of elements combined or discarded, provided the program's view of
+the world remains consistent.
+
+The compiler may also combine, discard or defer elements of the sequence before
+the CPU even sees them.
+
+For instance:
+
+        *A = V;
+        *A = W;
+
+may be reduced to:
+
+        *A = W;
+
+since, without a write barrier, it can be assumed that the effect of the
+storage of V to *A is lost.  Similarly:
+
+        *A = Y;
+        Z = *A;
+
+may, without a memory barrier, be reduced to:
+
+        *A = Y;
+        Z = Y;
+
+and the LOAD operation never appear outside of the CPU.
+
+
+AND THEN THERE'S THE ALPHA
+--------------------------
+
+The DEC Alpha CPU is one of the most relaxed CPUs there is.  Not only that,
+some versions of the Alpha CPU have a split data cache, permitting them to have
+two semantically related cache lines updating at separate times.  This is where
+the data dependency barrier really becomes necessary as this synchronises both
+caches with the memory coherence system, thus making it seem like pointer
+changes vs new data occur in the right order.
+
+The Alpha defines the Linux's kernel's memory barrier model.
+
+See the subsection on "Cache Coherency" above.
+
+
+==========
+REFERENCES
+==========
+
+Alpha AXP Architecture Reference Manual, Second Edition (Sites & Witek,
+Digital Press)
+        Chapter 5.2: Physical Address Space Characteristics
+        Chapter 5.4: Caches and Write Buffers
+        Chapter 5.5: Data Sharing
+        Chapter 5.6: Read/Write Ordering
+
+AMD64 Architecture Programmer's Manual Volume 2: System Programming
+        Chapter 7.1: Memory-Access Ordering
+        Chapter 7.4: Buffering and Combining Memory Writes
+
+IA-32 Intel Architecture Software Developer's Manual, Volume 3:
+System Programming Guide
+        Chapter 7.1: Locked Atomic Operations
+        Chapter 7.2: Memory Ordering
+        Chapter 7.4: Serializing Instructions
+
+The SPARC Architecture Manual, Version 9
+        Chapter 8: Memory Models
+        Appendix D: Formal Specification of the Memory Models
+        Appendix J: Programming with the Memory Models
+
+UltraSPARC Programmer Reference Manual
+        Chapter 5: Memory Accesses and Cacheability
+        Chapter 15: Sparc-V9 Memory Models
+
+UltraSPARC III Cu User's Manual
+        Chapter 9: Memory Models
+
+UltraSPARC IIIi Processor User's Manual
+        Chapter 8: Memory Models
+
+UltraSPARC Architecture 2005
+        Chapter 9: Memory
+        Appendix D: Formal Specifications of the Memory Models
+
+UltraSPARC T1 Supplement to the UltraSPARC Architecture 2005
+        Chapter 8: Memory Models
+        Appendix F: Caches and Cache Coherency
+
+Solaris Internals, Core Kernel Architecture, p63-68:
+        Chapter 3.3: Hardware Considerations for Locks and
+                        Synchronization
+
+Unix Systems for Modern Architectures, Symmetric Multiprocessing and Caching
+for Kernel Programmers:
+        Chapter 13: Other Memory Models
+
+Intel Itanium Architecture Software Developer's Manual: Volume 1:
+        Section 2.6: Speculation
+        Section 4.4: Memory Access
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
index 1898ea79d0e2..9d6186d50245 100644
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ b/arch/alpha/kernel/alpha_ksyms.c
@@ -216,8 +216,6 @@ EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memchr);
 
-EXPORT_SYMBOL(get_wchan);
-
 #ifdef CONFIG_ALPHA_IRONGATE
 EXPORT_SYMBOL(irongate_ioremap);
 EXPORT_SYMBOL(irongate_iounmap);
diff --git a/arch/alpha/kernel/core_marvel.c b/arch/alpha/kernel/core_marvel.c
index 44866cb26a80..7f6a98455e74 100644
--- a/arch/alpha/kernel/core_marvel.c
+++ b/arch/alpha/kernel/core_marvel.c
@@ -435,7 +435,7 @@ marvel_specify_io7(char *str)
                 str = pchar;
         } while(*str);
 
-        return 0;
+        return 1;
 }
 __setup("io7=", marvel_specify_io7);
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index ba46d779ede7..e91db542eb01 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -839,6 +839,8 @@ source "drivers/misc/Kconfig"
 
 source "drivers/mfd/Kconfig"
 
+source "drivers/leds/Kconfig"
+
 source "drivers/media/Kconfig"
 
 source "drivers/video/Kconfig"
diff --git a/arch/arm/common/sharpsl_pm.c b/arch/arm/common/sharpsl_pm.c
index 978d32e82d39..3cd8c9ee4510 100644
--- a/arch/arm/common/sharpsl_pm.c
+++ b/arch/arm/common/sharpsl_pm.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
+#include <linux/leds.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -75,6 +76,7 @@ static void sharpsl_battery_thread(void *private_);
 struct sharpsl_pm_status sharpsl_pm;
 DECLARE_WORK(toggle_charger, sharpsl_charge_toggle, NULL);
 DECLARE_WORK(sharpsl_bat, sharpsl_battery_thread, NULL);
+DEFINE_LED_TRIGGER(sharpsl_charge_led_trigger);
 
 
 static int get_percentage(int voltage)
@@ -190,10 +192,10 @@ void sharpsl_pm_led(int val)
                 dev_err(sharpsl_pm.dev, "Charging Error!\n");
         } else if (val == SHARPSL_LED_ON) {
                 dev_dbg(sharpsl_pm.dev, "Charge LED On\n");
-
+                led_trigger_event(sharpsl_charge_led_trigger, LED_FULL);
         } else {
                 dev_dbg(sharpsl_pm.dev, "Charge LED Off\n");
-
+                led_trigger_event(sharpsl_charge_led_trigger, LED_OFF);
         }
 }
 
@@ -786,6 +788,8 @@ static int __init sharpsl_pm_probe(struct platform_device *pdev)
         init_timer(&sharpsl_pm.chrg_full_timer);
         sharpsl_pm.chrg_full_timer.function = sharpsl_chrg_full_timer;
 
+        led_trigger_register_simple("sharpsl-charge", &sharpsl_charge_led_trigger);
+
         sharpsl_pm.machinfo->init();
 
         device_create_file(&pdev->dev, &dev_attr_battery_percentage);
@@ -807,6 +811,8 @@ static int sharpsl_pm_remove(struct platform_device *pdev)
         device_remove_file(&pdev->dev, &dev_attr_battery_percentage);
         device_remove_file(&pdev->dev, &dev_attr_battery_voltage);
 
+        led_trigger_unregister_simple(sharpsl_charge_led_trigger);
+
         sharpsl_pm.machinfo->exit();
 
         del_timer_sync(&sharpsl_pm.chrg_full_timer);
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 489c069e5c3e..1ff75cee4b0d 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -474,4 +474,3 @@ unsigned long get_wchan(struct task_struct *p)
         } while (count ++ < 16);
         return 0;
 }
-EXPORT_SYMBOL(get_wchan);
diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
index 68923b1d2b62..d6d726036361 100644
--- a/arch/arm/mach-pxa/corgi.c
+++ b/arch/arm/mach-pxa/corgi.c
@@ -141,6 +141,8 @@ struct corgissp_machinfo corgi_ssp_machinfo = {
  */
 static struct corgibl_machinfo corgi_bl_machinfo = {
         .max_intensity = 0x2f,
+        .default_intensity = 0x1f,
+        .limit_mask = 0x0b,
         .set_bl_intensity = corgi_bl_set_intensity,
 };
 
@@ -164,6 +166,14 @@ static struct platform_device corgikbd_device = {
 
 
 /*
+ * Corgi LEDs
+ */
+static struct platform_device corgiled_device = {
+        .name           = "corgi-led",
+        .id             = -1,
+};
+
+/*
  * Corgi Touch Screen Device
  */
 static struct resource corgits_resources[] = {
@@ -297,6 +307,7 @@ static struct platform_device *devices[] __initdata = {
         &corgikbd_device,
         &corgibl_device,
         &corgits_device,
+        &corgiled_device,
 };
 
 static void __init corgi_init(void)
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 0dbb079ecd25..19b372df544a 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -220,6 +220,8 @@ struct corgissp_machinfo spitz_ssp_machinfo = {
  * Spitz Backlight Device
  */
 static struct corgibl_machinfo spitz_bl_machinfo = {
+        .default_intensity = 0x1f,
+        .limit_mask = 0x0b,
         .max_intensity = 0x2f,
 };
 
@@ -242,6 +244,14 @@ static struct platform_device spitzkbd_device = {
 
 
 /*
+ * Spitz LEDs
+ */
+static struct platform_device spitzled_device = {
+        .name           = "spitz-led",
+        .id             = -1,
+};
+
+/*
  * Spitz Touch Screen Device
  */
 static struct resource spitzts_resources[] = {
@@ -418,6 +428,7 @@ static struct platform_device *devices[] __initdata = {
         &spitzkbd_device,
         &spitzts_device,
         &spitzbl_device,
+        &spitzled_device,
 };
 
 static void __init common_init(void)
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index 66ec71756d0f..76c0e7f0a219 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -251,10 +251,19 @@ static struct platform_device tosakbd_device = {
         .id             = -1,
 };
 
+/*
+ * Tosa LEDs
+ */
+static struct platform_device tosaled_device = {
+    .name   = "tosa-led",
+    .id     = -1,
+};
+
 static struct platform_device *devices[] __initdata = {
         &tosascoop_device,
         &tosascoop_jc_device,
         &tosakbd_device,
+        &tosaled_device,
 };
 
 static void __init tosa_init(void)
diff --git a/arch/arm26/kernel/armksyms.c b/arch/arm26/kernel/armksyms.c
index 811a6376c624..a6a1b3373444 100644
--- a/arch/arm26/kernel/armksyms.c
+++ b/arch/arm26/kernel/armksyms.c
@@ -212,8 +212,6 @@ EXPORT_SYMBOL(sys_open);
 EXPORT_SYMBOL(sys_exit);
 EXPORT_SYMBOL(sys_wait4);
 
-EXPORT_SYMBOL(get_wchan);
-
 #ifdef CONFIG_PREEMPT
 EXPORT_SYMBOL(kernel_flag);
 #endif
diff --git a/arch/frv/kernel/frv_ksyms.c b/arch/frv/kernel/frv_ksyms.c
index aa6b7d0a2109..07c8ffa0dd39 100644
--- a/arch/frv/kernel/frv_ksyms.c
+++ b/arch/frv/kernel/frv_ksyms.c
@@ -79,8 +79,6 @@ EXPORT_SYMBOL(memmove);
 EXPORT_SYMBOL(__outsl_ns);
 EXPORT_SYMBOL(__insl_ns);
 
-EXPORT_SYMBOL(get_wchan);
-
 #ifdef CONFIG_FRV_OUTOFLINE_ATOMIC_OPS
 EXPORT_SYMBOL(atomic_test_and_ANDNOT_mask);
 EXPORT_SYMBOL(atomic_test_and_OR_mask);
diff --git a/arch/h8300/kernel/h8300_ksyms.c b/arch/h8300/kernel/h8300_ksyms.c
index 69d6ad32d56c..b6cd78c972bb 100644
--- a/arch/h8300/kernel/h8300_ksyms.c
+++ b/arch/h8300/kernel/h8300_ksyms.c
@@ -55,8 +55,6 @@ EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memmove);
 
-EXPORT_SYMBOL(get_wchan);
-
 /*
  * libgcc functions - functions that are used internally by the
  * compiler...  (prototypes are not correct though, but that
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index eb5279d23b7f..6273bf74c203 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -415,6 +415,7 @@ void __init init_bsp_APIC(void)
 void __devinit setup_local_APIC(void)
 {
         unsigned long oldvalue, value, ver, maxlvt;
+        int i, j;
 
         /* Pound the ESR really hard over the head with a big hammer - mbligh */
         if (esr_disable) {
@@ -452,6 +453,25 @@ void __devinit setup_local_APIC(void)
         apic_write_around(APIC_TASKPRI, value);
 
         /*
+         * After a crash, we no longer service the interrupts and a pending
+         * interrupt from previous kernel might still have ISR bit set.
+         *
+         * Most probably by now CPU has serviced that pending interrupt and
+         * it might not have done the ack_APIC_irq() because it thought,
+         * interrupt came from i8259 as ExtInt. LAPIC did not get EOI so it
+         * does not clear the ISR bit and cpu thinks it has already serivced
+         * the interrupt. Hence a vector might get locked. It was noticed
+         * for timer irq (vector 0x31). Issue an extra EOI to clear ISR.
+         */
+        for (i = APIC_ISR_NR - 1; i >= 0; i--) {
+                value = apic_read(APIC_ISR + i*0x10);
+                for (j = 31; j >= 0; j--) {
+                        if (value & (1<<j))
+                                ack_APIC_irq();
+                }
+        }
+
+        /*
          * Now that we are all set up, enable the APIC
          */
         value = apic_read(APIC_SPIV);
@@ -732,7 +752,7 @@ static int __init apic_set_verbosity(char *str)
                 printk(KERN_WARNING "APIC Verbosity level %s not recognised"
                                 " use apic=verbose or apic=debug\n", str);
 
-        return 0;
+        return 1;
 }
 
 __setup("apic=", apic_set_verbosity);
diff --git a/arch/i386/kernel/cpu/mcheck/mce.c b/arch/i386/kernel/cpu/mcheck/mce.c
index 6170af3c271a..afa0888f9a1e 100644
--- a/arch/i386/kernel/cpu/mcheck/mce.c
+++ b/arch/i386/kernel/cpu/mcheck/mce.c
@@ -64,13 +64,13 @@ void mcheck_init(struct cpuinfo_x86 *c)
 static int __init mcheck_disable(char *str)
 {
         mce_disabled = 1;
-        return 0;
+        return 1;
 }
 
 static int __init mcheck_enable(char *str)
 {
         mce_disabled = -1;
-        return 0;
+        return 1;
 }
 
 __setup("nomce", mcheck_disable);
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index 3b329af4afc5..f8f132aa5472 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -644,7 +644,7 @@ failed:
 int __init irqbalance_disable(char *str)
 {
         irqbalance_disabled = 1;
-        return 0;
+        return 1;
 }
 
 __setup("noirqbalance", irqbalance_disable);
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index 24b3e745478b..6259afea46d1 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -781,7 +781,6 @@ unsigned long get_wchan(struct task_struct *p)
         } while (count++ < 16);
         return 0;
 }
-EXPORT_SYMBOL(get_wchan);
 
 /*
  * sys_alloc_thread_area: get a yet unused TLS descriptor index.
diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
index ce3ef4fa0551..4f58b9c0efe3 100644
--- a/arch/i386/kernel/syscall_table.S
+++ b/arch/i386/kernel/syscall_table.S
@@ -313,3 +313,4 @@ ENTRY(sys_call_table)
         .long sys_set_robust_list
         .long sys_get_robust_list
         .long sys_splice
+        .long sys_sync_file_range
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 6b63a5aa1e46..e38527994590 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -1193,6 +1193,6 @@ void __init trap_init(void)
 static int __init kstack_setup(char *s)
 {
         kstack_depth_to_print = simple_strtoul(s, NULL, 0);
-        return 0;
+        return 1;
 }
 __setup("kstack=", kstack_setup);
diff --git a/arch/i386/kernel/vsyscall-sigreturn.S b/arch/i386/kernel/vsyscall-sigreturn.S
index fadb5bc3c374..a92262f41659 100644
--- a/arch/i386/kernel/vsyscall-sigreturn.S
+++ b/arch/i386/kernel/vsyscall-sigreturn.S
@@ -44,7 +44,7 @@ __kernel_rt_sigreturn:
 .LSTARTCIEDLSI1:
         .long 0                 /* CIE ID */
         .byte 1                 /* Version number */
-        .string "zR"            /* NUL-terminated augmentation string */
+        .string "zRS"           /* NUL-terminated augmentation string */
         .uleb128 1              /* Code alignment factor */
         .sleb128 -4             /* Data alignment factor */
         .byte 8                 /* Return address register column */
diff --git a/arch/m68k/kernel/m68k_ksyms.c b/arch/m68k/kernel/m68k_ksyms.c
index 3d7f2000b714..c3319514a85e 100644
--- a/arch/m68k/kernel/m68k_ksyms.c
+++ b/arch/m68k/kernel/m68k_ksyms.c
@@ -79,4 +79,3 @@ EXPORT_SYMBOL(__down_failed_interruptible);
 EXPORT_SYMBOL(__down_failed_trylock);
 EXPORT_SYMBOL(__up_wakeup);
 
-EXPORT_SYMBOL(get_wchan);
diff --git a/arch/m68knommu/kernel/m68k_ksyms.c b/arch/m68knommu/kernel/m68k_ksyms.c
index d844c755945a..f9b4ea16c099 100644
--- a/arch/m68knommu/kernel/m68k_ksyms.c
+++ b/arch/m68knommu/kernel/m68k_ksyms.c
@@ -57,8 +57,6 @@ EXPORT_SYMBOL(__down_failed_interruptible);
 EXPORT_SYMBOL(__down_failed_trylock);
 EXPORT_SYMBOL(__up_wakeup);
 
-EXPORT_SYMBOL(get_wchan);
-
 /*
  * libgcc functions - functions that are used internally by the
  * compiler...  (prototypes are not correct though, but that
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index a8f435d82940..c66db5e5ab62 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -419,4 +419,3 @@ unsigned long get_wchan(struct task_struct *p)
         return pc;
 }
 
-EXPORT_SYMBOL(get_wchan);
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 6b3c50964ca9..2fdf21989dc2 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -177,14 +177,10 @@ config ARCH_DISCONTIGMEM_DEFAULT
         def_bool y
         depends on ARCH_DISCONTIGMEM_ENABLE
 
+source "kernel/Kconfig.preempt"
 source "kernel/Kconfig.hz"
 source "mm/Kconfig"
 
-config PREEMPT
-        bool
-#       bool "Preemptible Kernel"
-        default n
-
 config COMPAT
         def_bool y
         depends on 64BIT
diff --git a/arch/parisc/configs/712_defconfig b/arch/parisc/configs/712_defconfig
index 3e013f55df64..41fd0696bbe7 100644
--- a/arch/parisc/configs/712_defconfig
+++ b/arch/parisc/configs/712_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc5-pa1
-# Fri Oct 21 23:04:34 2005
+# Linux kernel version: 2.6.16-pa6
+# Sun Mar 26 19:59:51 2006
 #
 CONFIG_PARISC=y
 CONFIG_MMU=y
@@ -10,14 +10,11 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
-CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-# CONFIG_CLEAN_COMPILE is not set
-CONFIG_BROKEN=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -32,17 +29,18 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -51,8 +49,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -66,6 +66,23 @@ CONFIG_OBSOLETE_MODPARM=y
 CONFIG_KMOD=y
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 # CONFIG_PA7000 is not set
@@ -75,6 +92,10 @@ CONFIG_PA7100LC=y
 # CONFIG_PA8X00 is not set
 CONFIG_PA11=y
 # CONFIG_SMP is not set
+CONFIG_ARCH_FLATMEM_ENABLE=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_PREEMPT is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
@@ -86,7 +107,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_PREEMPT is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4096
 # CONFIG_HPUX is not set
 
 #
@@ -130,6 +151,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -165,7 +187,12 @@ CONFIG_TCP_CONG_BIC=y
 # CONFIG_IPV6 is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
+
+#
+# Core Netfilter Configuration
+#
 # CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -182,64 +209,6 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
-# CONFIG_IP_NF_MATCH_REALM is not set
-CONFIG_IP_NF_MATCH_SCTP=m
-# CONFIG_IP_NF_MATCH_DCCP is not set
-CONFIG_IP_NF_MATCH_COMMENT=m
-CONFIG_IP_NF_MATCH_CONNMARK=m
-CONFIG_IP_NF_MATCH_HASHLIMIT=m
-# CONFIG_IP_NF_MATCH_STRING is not set
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-# CONFIG_IP_NF_TARGET_NFQUEUE is not set
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-# CONFIG_IP_NF_TARGET_TTL is not set
-CONFIG_IP_NF_TARGET_CONNMARK=m
-CONFIG_IP_NF_TARGET_CLUSTERIP=m
-CONFIG_IP_NF_RAW=m
-CONFIG_IP_NF_TARGET_NOTRACK=m
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -250,6 +219,11 @@ CONFIG_IP_NF_ARP_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -263,8 +237,11 @@ CONFIG_LLC2=m
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -304,6 +281,7 @@ CONFIG_PARPORT=y
 CONFIG_PARPORT_PC=m
 # CONFIG_PARPORT_PC_FIFO is not set
 # CONFIG_PARPORT_PC_SUPERIO is not set
+CONFIG_PARPORT_NOT_PC=y
 CONFIG_PARPORT_GSC=y
 # CONFIG_PARPORT_1284 is not set
 
@@ -314,7 +292,6 @@ CONFIG_PARPORT_GSC=y
 #
 # Block devices
 #
-# CONFIG_BLK_DEV_FD is not set
 # CONFIG_PARIDE is not set
 # CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
@@ -325,14 +302,6 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=6144
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 CONFIG_ATA_OVER_ETH=m
 
 #
@@ -376,6 +345,7 @@ CONFIG_SCSI_ISCSI_ATTRS=m
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_SCSI_SATA is not set
 # CONFIG_SCSI_PPA is not set
 # CONFIG_SCSI_IMM is not set
@@ -407,7 +377,6 @@ CONFIG_MD_RAID1=m
 #
 # IEEE 1394 (FireWire) support
 #
-# CONFIG_IEEE1394 is not set
 
 #
 # I2O device support
@@ -471,6 +440,7 @@ CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
 CONFIG_PPP_DEFLATE=m
 CONFIG_PPP_BSDCOMP=m
+CONFIG_PPP_MPPE=m
 CONFIG_PPPOE=m
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
@@ -516,8 +486,8 @@ CONFIG_KEYBOARD_ATKBD_HP_KEYCODES=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
-CONFIG_KEYBOARD_HIL_OLD=y
-# CONFIG_KEYBOARD_HIL is not set
+# CONFIG_KEYBOARD_HIL_OLD is not set
+CONFIG_KEYBOARD_HIL=y
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 CONFIG_MOUSE_SERIAL=m
@@ -554,6 +524,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=17
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
@@ -598,6 +569,8 @@ CONFIG_MAX_RAW_DEVS=256
 #
 # TPM devices
 #
+# CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -605,6 +578,12 @@ CONFIG_MAX_RAW_DEVS=256
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -640,7 +619,6 @@ CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
-CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_MACMODES is not set
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
@@ -655,6 +633,7 @@ CONFIG_DUMMY_CONSOLE=y
 CONFIG_DUMMY_CONSOLE_COLUMNS=128
 CONFIG_DUMMY_CONSOLE_ROWS=48
 CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
 CONFIG_STI_CONSOLE=y
 CONFIG_FONTS=y
 CONFIG_FONT_8x8=y
@@ -695,6 +674,8 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
@@ -724,6 +705,10 @@ CONFIG_SND_HARMONY=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
 
 #
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
 # USB Gadget Support
 #
 # CONFIG_USB_GADGET is not set
@@ -736,10 +721,9 @@ CONFIG_SND_HARMONY=y
 #
 # InfiniBand support
 #
-# CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -765,6 +749,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -800,10 +785,10 @@ CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
-# CONFIG_HUGETLBFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -821,7 +806,6 @@ CONFIG_RAMFS=y
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_SYSV_FS is not set
 CONFIG_UFS_FS=m
-# CONFIG_UFS_FS_WRITE is not set
 
 #
 # Network File Systems
@@ -917,18 +901,22 @@ CONFIG_OPROFILE=m
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_IOREMAP is not set
 # CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_DEBUG_RODATA=y
 
 #
 # Security options
diff --git a/arch/parisc/configs/a500_defconfig b/arch/parisc/configs/a500_defconfig
index 959ad3c4e372..f3b812f04592 100644
--- a/arch/parisc/configs/a500_defconfig
+++ b/arch/parisc/configs/a500_defconfig
@@ -1031,8 +1031,8 @@ CONFIG_NLS_CODEPAGE_850=m
 # CONFIG_NLS_ISO8859_8 is not set
 # CONFIG_NLS_CODEPAGE_1250 is not set
 # CONFIG_NLS_CODEPAGE_1251 is not set
-# CONFIG_NLS_ASCII is not set
-# CONFIG_NLS_ISO8859_1 is not set
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
 # CONFIG_NLS_ISO8859_2 is not set
 # CONFIG_NLS_ISO8859_3 is not set
 # CONFIG_NLS_ISO8859_4 is not set
diff --git a/arch/parisc/configs/b180_defconfig b/arch/parisc/configs/b180_defconfig
index 37e98241ce4b..35093612ad2c 100644
--- a/arch/parisc/configs/b180_defconfig
+++ b/arch/parisc/configs/b180_defconfig
@@ -939,10 +939,10 @@ CONFIG_MSDOS_PARTITION=y
 #
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="iso8859-1"
-# CONFIG_NLS_CODEPAGE_437 is not set
+CONFIG_NLS_CODEPAGE_437=m
 # CONFIG_NLS_CODEPAGE_737 is not set
 # CONFIG_NLS_CODEPAGE_775 is not set
-# CONFIG_NLS_CODEPAGE_850 is not set
+CONFIG_NLS_CODEPAGE_850=m
 # CONFIG_NLS_CODEPAGE_852 is not set
 # CONFIG_NLS_CODEPAGE_855 is not set
 # CONFIG_NLS_CODEPAGE_857 is not set
@@ -962,8 +962,8 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_ISO8859_8 is not set
 # CONFIG_NLS_CODEPAGE_1250 is not set
 # CONFIG_NLS_CODEPAGE_1251 is not set
-# CONFIG_NLS_ASCII is not set
-# CONFIG_NLS_ISO8859_1 is not set
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
 # CONFIG_NLS_ISO8859_2 is not set
 # CONFIG_NLS_ISO8859_3 is not set
 # CONFIG_NLS_ISO8859_4 is not set
@@ -973,10 +973,10 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_ISO8859_9 is not set
 # CONFIG_NLS_ISO8859_13 is not set
 # CONFIG_NLS_ISO8859_14 is not set
-# CONFIG_NLS_ISO8859_15 is not set
+CONFIG_NLS_ISO8859_15=m
 # CONFIG_NLS_KOI8_R is not set
 # CONFIG_NLS_KOI8_U is not set
-# CONFIG_NLS_UTF8 is not set
+CONFIG_NLS_UTF8=m
 
 #
 # Kernel hacking
diff --git a/arch/parisc/configs/c3000_defconfig b/arch/parisc/configs/c3000_defconfig
index 0b1c8c1fa8a3..782906b644dd 100644
--- a/arch/parisc/configs/c3000_defconfig
+++ b/arch/parisc/configs/c3000_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc5-pa1
-# Fri Oct 21 23:06:31 2005
+# Linux kernel version: 2.6.16-pa6
+# Sun Mar 26 20:03:29 2006
 #
 CONFIG_PARISC=y
 CONFIG_MMU=y
@@ -10,14 +10,11 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
-CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-# CONFIG_CLEAN_COMPILE is not set
-CONFIG_BROKEN=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -32,28 +29,30 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-CONFIG_HOTPLUG=y
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_EMBEDDED=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SHMEM=y
 CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -67,6 +66,23 @@ CONFIG_OBSOLETE_MODPARM=y
 CONFIG_KMOD=y
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 # CONFIG_PA7000 is not set
@@ -78,6 +94,10 @@ CONFIG_PA20=y
 CONFIG_PREFETCH=y
 # CONFIG_64BIT is not set
 # CONFIG_SMP is not set
+CONFIG_ARCH_FLATMEM_ENABLE=y
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
+# CONFIG_PREEMPT is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
@@ -89,7 +109,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_PREEMPT is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_HPUX is not set
 
 #
@@ -135,6 +155,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -175,7 +196,12 @@ CONFIG_INET6_TUNNEL=m
 CONFIG_IPV6_TUNNEL=m
 CONFIG_NETFILTER=y
 CONFIG_NETFILTER_DEBUG=y
+
+#
+# Core Netfilter Configuration
+#
 # CONFIG_NETFILTER_NETLINK is not set
+# CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
@@ -192,87 +218,11 @@ CONFIG_IP_NF_TFTP=m
 CONFIG_IP_NF_AMANDA=m
 # CONFIG_IP_NF_PPTP is not set
 CONFIG_IP_NF_QUEUE=m
-CONFIG_IP_NF_IPTABLES=m
-CONFIG_IP_NF_MATCH_LIMIT=m
-CONFIG_IP_NF_MATCH_IPRANGE=m
-CONFIG_IP_NF_MATCH_MAC=m
-CONFIG_IP_NF_MATCH_PKTTYPE=m
-CONFIG_IP_NF_MATCH_MARK=m
-CONFIG_IP_NF_MATCH_MULTIPORT=m
-CONFIG_IP_NF_MATCH_TOS=m
-CONFIG_IP_NF_MATCH_RECENT=m
-CONFIG_IP_NF_MATCH_ECN=m
-CONFIG_IP_NF_MATCH_DSCP=m
-CONFIG_IP_NF_MATCH_AH_ESP=m
-CONFIG_IP_NF_MATCH_LENGTH=m
-CONFIG_IP_NF_MATCH_TTL=m
-CONFIG_IP_NF_MATCH_TCPMSS=m
-CONFIG_IP_NF_MATCH_HELPER=m
-CONFIG_IP_NF_MATCH_STATE=m
-CONFIG_IP_NF_MATCH_CONNTRACK=m
-CONFIG_IP_NF_MATCH_OWNER=m
-# CONFIG_IP_NF_MATCH_ADDRTYPE is not set
-# CONFIG_IP_NF_MATCH_REALM is not set
-# CONFIG_IP_NF_MATCH_SCTP is not set
-# CONFIG_IP_NF_MATCH_DCCP is not set
-# CONFIG_IP_NF_MATCH_COMMENT is not set
-# CONFIG_IP_NF_MATCH_HASHLIMIT is not set
-# CONFIG_IP_NF_MATCH_STRING is not set
-CONFIG_IP_NF_FILTER=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP_NF_TARGET_LOG=m
-CONFIG_IP_NF_TARGET_ULOG=m
-CONFIG_IP_NF_TARGET_TCPMSS=m
-# CONFIG_IP_NF_TARGET_NFQUEUE is not set
-CONFIG_IP_NF_NAT=m
-CONFIG_IP_NF_NAT_NEEDED=y
-CONFIG_IP_NF_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REDIRECT=m
-CONFIG_IP_NF_TARGET_NETMAP=m
-CONFIG_IP_NF_TARGET_SAME=m
-CONFIG_IP_NF_NAT_SNMP_BASIC=m
-CONFIG_IP_NF_NAT_IRC=m
-CONFIG_IP_NF_NAT_FTP=m
-CONFIG_IP_NF_NAT_TFTP=m
-CONFIG_IP_NF_NAT_AMANDA=m
-CONFIG_IP_NF_MANGLE=m
-CONFIG_IP_NF_TARGET_TOS=m
-CONFIG_IP_NF_TARGET_ECN=m
-CONFIG_IP_NF_TARGET_DSCP=m
-CONFIG_IP_NF_TARGET_MARK=m
-CONFIG_IP_NF_TARGET_CLASSIFY=m
-# CONFIG_IP_NF_TARGET_TTL is not set
-# CONFIG_IP_NF_RAW is not set
-CONFIG_IP_NF_ARPTABLES=m
-CONFIG_IP_NF_ARPFILTER=m
-CONFIG_IP_NF_ARP_MANGLE=m
 
 #
 # IPv6: Netfilter Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP6_NF_QUEUE is not set
-CONFIG_IP6_NF_IPTABLES=m
-# CONFIG_IP6_NF_MATCH_LIMIT is not set
-CONFIG_IP6_NF_MATCH_MAC=m
-CONFIG_IP6_NF_MATCH_RT=m
-# CONFIG_IP6_NF_MATCH_OPTS is not set
-# CONFIG_IP6_NF_MATCH_FRAG is not set
-# CONFIG_IP6_NF_MATCH_HL is not set
-# CONFIG_IP6_NF_MATCH_MULTIPORT is not set
-CONFIG_IP6_NF_MATCH_OWNER=m
-# CONFIG_IP6_NF_MATCH_MARK is not set
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-# CONFIG_IP6_NF_MATCH_AHESP is not set
-CONFIG_IP6_NF_MATCH_LENGTH=m
-# CONFIG_IP6_NF_MATCH_EUI64 is not set
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_LOG=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-# CONFIG_IP6_NF_TARGET_NFQUEUE is not set
-CONFIG_IP6_NF_MANGLE=m
-# CONFIG_IP6_NF_TARGET_MARK is not set
-# CONFIG_IP6_NF_TARGET_HL is not set
-# CONFIG_IP6_NF_RAW is not set
 
 #
 # DCCP Configuration (EXPERIMENTAL)
@@ -283,6 +233,11 @@ CONFIG_IP6_NF_MANGLE=m
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -295,8 +250,11 @@ CONFIG_IP6_NF_MANGLE=m
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -341,7 +299,6 @@ CONFIG_FW_LOADER=y
 #
 # Block devices
 #
-# CONFIG_BLK_DEV_FD is not set
 # CONFIG_BLK_CPQ_DA is not set
 # CONFIG_BLK_CPQ_CISS_DA is not set
 # CONFIG_BLK_DEV_DAC960 is not set
@@ -355,14 +312,6 @@ CONFIG_BLK_DEV_CRYPTOLOOP=m
 # CONFIG_BLK_DEV_RAM is not set
 CONFIG_BLK_DEV_RAM_COUNT=16
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
@@ -458,6 +407,7 @@ CONFIG_SCSI_ISCSI_ATTRS=m
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -466,7 +416,6 @@ CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
 # CONFIG_SCSI_DPT_I2O is not set
-# CONFIG_SCSI_ADVANSYS is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
@@ -476,18 +425,18 @@ CONFIG_SCSI_SATA=y
 CONFIG_SCSI_ATA_PIIX=m
 # CONFIG_SCSI_SATA_MV is not set
 # CONFIG_SCSI_SATA_NV is not set
-CONFIG_SCSI_SATA_PROMISE=m
+# CONFIG_SCSI_PDC_ADMA is not set
 # CONFIG_SCSI_SATA_QSTOR is not set
+CONFIG_SCSI_SATA_PROMISE=m
 # CONFIG_SCSI_SATA_SX4 is not set
 CONFIG_SCSI_SATA_SIL=m
+# CONFIG_SCSI_SATA_SIL24 is not set
 # CONFIG_SCSI_SATA_SIS is not set
 # CONFIG_SCSI_SATA_ULI is not set
 CONFIG_SCSI_SATA_VIA=m
 # CONFIG_SCSI_SATA_VITESSE is not set
 CONFIG_SCSI_SATA_INTEL_COMBINED=y
-# CONFIG_SCSI_CPQFCTS is not set
 # CONFIG_SCSI_DMX3191D is not set
-# CONFIG_SCSI_EATA_PIO is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
 # CONFIG_SCSI_INITIO is not set
@@ -496,18 +445,11 @@ CONFIG_SCSI_SYM53C8XX_2=y
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=0
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
-# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+CONFIG_SCSI_SYM53C8XX_MMIO=y
 # CONFIG_SCSI_IPR is not set
-# CONFIG_SCSI_QLOGIC_ISP is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -633,6 +575,7 @@ CONFIG_E1000=m
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=m
@@ -668,6 +611,7 @@ CONFIG_PPP_ASYNC=m
 CONFIG_PPP_SYNC_TTY=m
 CONFIG_PPP_DEFLATE=m
 CONFIG_PPP_BSDCOMP=m
+# CONFIG_PPP_MPPE is not set
 CONFIG_PPPOE=m
 # CONFIG_SLIP is not set
 # CONFIG_NET_FC is not set
@@ -744,6 +688,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=13
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
@@ -753,7 +698,6 @@ CONFIG_SERIAL_8250_SHARE_IRQ=y
 #
 # Non-8250 serial port support
 #
-# CONFIG_SERIAL_MUX is not set
 # CONFIG_PDC_CONSOLE is not set
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
@@ -788,6 +732,7 @@ CONFIG_MAX_RAW_DEVS=256
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -795,6 +740,12 @@ CONFIG_MAX_RAW_DEVS=256
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -830,7 +781,6 @@ CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
-CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_MACMODES is not set
 # CONFIG_FB_MODE_HELPERS is not set
 # CONFIG_FB_TILEBLITTING is not set
@@ -840,6 +790,7 @@ CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
 CONFIG_FB_STI=y
+# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
@@ -853,10 +804,7 @@ CONFIG_FB_STI=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
-# CONFIG_FB_PM3 is not set
-# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -866,6 +814,7 @@ CONFIG_DUMMY_CONSOLE=y
 CONFIG_DUMMY_CONSOLE_COLUMNS=160
 CONFIG_DUMMY_CONSOLE_ROWS=64
 CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
 CONFIG_STI_CONSOLE=y
 # CONFIG_FONTS is not set
 CONFIG_FONT_8x8=y
@@ -898,23 +847,27 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
 #
 # Generic devices
 #
+CONFIG_SND_AC97_CODEC=y
+CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_DUMMY is not set
 # CONFIG_SND_VIRMIDI is not set
 # CONFIG_SND_MTPAV is not set
 # CONFIG_SND_SERIAL_U16550 is not set
 # CONFIG_SND_MPU401 is not set
-CONFIG_SND_AC97_CODEC=y
-CONFIG_SND_AC97_BUS=y
 
 #
 # PCI devices
 #
+CONFIG_SND_AD1889=y
+# CONFIG_SND_AD1889_OPL3 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -923,39 +876,38 @@ CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-CONFIG_SND_AD1889=y
-# CONFIG_SND_AD1889_OPL3 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # USB devices
@@ -998,12 +950,15 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # USB Device Class drivers
 #
 # CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
-# CONFIG_USB_BLUETOOTH_TTY is not set
 # CONFIG_USB_ACM is not set
 CONFIG_USB_PRINTER=m
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
@@ -1015,12 +970,15 @@ CONFIG_USB_STORAGE_USBAT=y
 CONFIG_USB_STORAGE_SDDR09=y
 CONFIG_USB_STORAGE_SDDR55=y
 CONFIG_USB_STORAGE_JUMPSHOT=y
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
 CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
 # CONFIG_USB_AIPTEK is not set
@@ -1034,6 +992,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -1108,7 +1067,7 @@ CONFIG_USB_LEGOTOWER=m
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -1130,6 +1089,7 @@ CONFIG_XFS_EXPORT=y
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1164,10 +1124,10 @@ CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
-# CONFIG_HUGETLBFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1225,10 +1185,10 @@ CONFIG_MSDOS_PARTITION=y
 #
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="iso8859-1"
-# CONFIG_NLS_CODEPAGE_437 is not set
+CONFIG_NLS_CODEPAGE_437=m
 # CONFIG_NLS_CODEPAGE_737 is not set
 # CONFIG_NLS_CODEPAGE_775 is not set
-# CONFIG_NLS_CODEPAGE_850 is not set
+CONFIG_NLS_CODEPAGE_850=m
 # CONFIG_NLS_CODEPAGE_852 is not set
 # CONFIG_NLS_CODEPAGE_855 is not set
 # CONFIG_NLS_CODEPAGE_857 is not set
@@ -1248,8 +1208,8 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_ISO8859_8 is not set
 # CONFIG_NLS_CODEPAGE_1250 is not set
 # CONFIG_NLS_CODEPAGE_1251 is not set
-# CONFIG_NLS_ASCII is not set
-# CONFIG_NLS_ISO8859_1 is not set
+CONFIG_NLS_ASCII=m
+CONFIG_NLS_ISO8859_1=m
 # CONFIG_NLS_ISO8859_2 is not set
 # CONFIG_NLS_ISO8859_3 is not set
 # CONFIG_NLS_ISO8859_4 is not set
@@ -1259,10 +1219,10 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_ISO8859_9 is not set
 # CONFIG_NLS_ISO8859_13 is not set
 # CONFIG_NLS_ISO8859_14 is not set
-# CONFIG_NLS_ISO8859_15 is not set
+CONFIG_NLS_ISO8859_15=m
 # CONFIG_NLS_KOI8_R is not set
 # CONFIG_NLS_KOI8_U is not set
-# CONFIG_NLS_UTF8 is not set
+CONFIG_NLS_UTF8=m
 
 #
 # Profiling support
@@ -1274,18 +1234,22 @@ CONFIG_OPROFILE=m
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=16
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_IOREMAP is not set
 # CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_DEBUG_RODATA=y
 
 #
 # Security options
diff --git a/arch/parisc/defconfig b/arch/parisc/defconfig
index f38a4620d24f..59f7bc38e72e 100644
--- a/arch/parisc/defconfig
+++ b/arch/parisc/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.14-rc5-pa1
-# Fri Oct 21 23:01:33 2005
+# Linux kernel version: 2.6.16-pa6
+# Sun Mar 26 19:50:07 2006
 #
 CONFIG_PARISC=y
 CONFIG_MMU=y
@@ -15,7 +15,6 @@ CONFIG_GENERIC_IRQ_PROBE=y
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
 CONFIG_BROKEN_ON_SMP=y
 CONFIG_INIT_ENV_ARG_LIMIT=32
 
@@ -30,17 +29,18 @@ CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
@@ -49,8 +49,10 @@ CONFIG_CC_ALIGN_FUNCTIONS=0
 CONFIG_CC_ALIGN_LABELS=0
 CONFIG_CC_ALIGN_LOOPS=0
 CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -58,6 +60,23 @@ CONFIG_BASE_SMALL=0
 # CONFIG_MODULES is not set
 
 #
+# Block layer
+#
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+CONFIG_DEFAULT_AS=y
+# CONFIG_DEFAULT_DEADLINE is not set
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="anticipatory"
+
+#
 # Processor type and features
 #
 CONFIG_PA7000=y
@@ -67,6 +86,10 @@ CONFIG_PA7000=y
 # CONFIG_PA8X00 is not set
 CONFIG_PA11=y
 # CONFIG_SMP is not set
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
 # CONFIG_HZ_1000 is not set
@@ -78,7 +101,7 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 # CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_PREEMPT is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4096
 # CONFIG_HPUX is not set
 
 #
@@ -132,6 +155,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+# CONFIG_NETDEBUG is not set
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -174,6 +198,11 @@ CONFIG_IPV6=y
 # SCTP Configuration (EXPERIMENTAL)
 #
 # CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_VLAN_8021Q is not set
@@ -186,8 +215,11 @@ CONFIG_IPV6=y
 # CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
 # CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
 
 #
 # Network testing
@@ -228,6 +260,7 @@ CONFIG_PARPORT_PC=y
 # CONFIG_PARPORT_SERIAL is not set
 # CONFIG_PARPORT_PC_FIFO is not set
 # CONFIG_PARPORT_PC_SUPERIO is not set
+CONFIG_PARPORT_NOT_PC=y
 CONFIG_PARPORT_GSC=y
 # CONFIG_PARPORT_1284 is not set
 
@@ -254,14 +287,6 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
@@ -305,6 +330,7 @@ CONFIG_SCSI_SPI_ATTRS=y
 #
 # SCSI low-level drivers
 #
+# CONFIG_ISCSI_TCP is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -331,7 +357,7 @@ CONFIG_SCSI_SYM53C8XX_2=y
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
 CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
-# CONFIG_SCSI_SYM53C8XX_IOMAPPED is not set
+CONFIG_SCSI_SYM53C8XX_MMIO=y
 # CONFIG_SCSI_IPR is not set
 CONFIG_SCSI_ZALON=y
 CONFIG_SCSI_NCR53C8XX_DEFAULT_TAGS=8
@@ -340,13 +366,7 @@ CONFIG_SCSI_NCR53C8XX_SYNC=20
 # CONFIG_SCSI_NCR53C8XX_PROFILE is not set
 # CONFIG_SCSI_QLOGIC_FC is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
-CONFIG_SCSI_QLA2XXX=y
-# CONFIG_SCSI_QLA21XX is not set
-# CONFIG_SCSI_QLA22XX is not set
-# CONFIG_SCSI_QLA2300 is not set
-# CONFIG_SCSI_QLA2322 is not set
-# CONFIG_SCSI_QLA6312 is not set
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_FC is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_SIM710 is not set
 # CONFIG_SCSI_DC395x is not set
@@ -471,6 +491,7 @@ CONFIG_ACENIC=y
 # CONFIG_R8169 is not set
 # CONFIG_SIS190 is not set
 # CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
 # CONFIG_SK98LIN is not set
 # CONFIG_VIA_VELOCITY is not set
 CONFIG_TIGON3=y
@@ -562,13 +583,13 @@ CONFIG_INPUT_KEYBOARD=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
-CONFIG_KEYBOARD_HIL_OLD=y
+# CONFIG_KEYBOARD_HIL_OLD is not set
 CONFIG_KEYBOARD_HIL=y
 CONFIG_INPUT_MOUSE=y
 # CONFIG_MOUSE_PS2 is not set
 # CONFIG_MOUSE_SERIAL is not set
 # CONFIG_MOUSE_VSXXXAA is not set
-# CONFIG_MOUSE_HIL is not set
+CONFIG_MOUSE_HIL=y
 CONFIG_INPUT_JOYSTICK=y
 # CONFIG_JOYSTICK_ANALOG is not set
 # CONFIG_JOYSTICK_A3D is not set
@@ -628,6 +649,7 @@ CONFIG_HW_CONSOLE=y
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_SERIAL_8250_NR_UARTS=13
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_MANY_PORTS=y
 CONFIG_SERIAL_8250_SHARE_IRQ=y
@@ -675,6 +697,7 @@ CONFIG_GEN_RTC=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
+# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -682,6 +705,12 @@ CONFIG_GEN_RTC=y
 # CONFIG_I2C is not set
 
 #
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
 # Dallas's 1-wire bus
 #
 # CONFIG_W1 is not set
@@ -691,6 +720,7 @@ CONFIG_GEN_RTC=y
 #
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_F71805F is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
@@ -718,7 +748,6 @@ CONFIG_FB=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
-CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_MACMODES is not set
 # CONFIG_FB_MODE_HELPERS is not set
 # CONFIG_FB_TILEBLITTING is not set
@@ -728,6 +757,7 @@ CONFIG_FB_SOFT_CURSOR=y
 # CONFIG_FB_ASILIANT is not set
 # CONFIG_FB_IMSTT is not set
 CONFIG_FB_STI=y
+# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
@@ -741,9 +771,7 @@ CONFIG_FB_STI=y
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
-# CONFIG_FB_CYBLA is not set
 # CONFIG_FB_TRIDENT is not set
-# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -753,15 +781,28 @@ CONFIG_DUMMY_CONSOLE=y
 CONFIG_DUMMY_CONSOLE_COLUMNS=160
 CONFIG_DUMMY_CONSOLE_ROWS=64
 CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
 CONFIG_STI_CONSOLE=y
-# CONFIG_FONTS is not set
-CONFIG_FONT_8x8=y
+CONFIG_FONTS=y
+# CONFIG_FONT_8x8 is not set
 CONFIG_FONT_8x16=y
+# CONFIG_FONT_6x11 is not set
+# CONFIG_FONT_7x14 is not set
+# CONFIG_FONT_PEARL_8x8 is not set
+# CONFIG_FONT_ACORN_8x8 is not set
+# CONFIG_FONT_MINI_4x6 is not set
+# CONFIG_FONT_SUN8x16 is not set
+# CONFIG_FONT_SUN12x22 is not set
+# CONFIG_FONT_10x18 is not set
 
 #
 # Logo configuration
 #
-# CONFIG_LOGO is not set
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+# CONFIG_LOGO_LINUX_CLUT224 is not set
+CONFIG_LOGO_PARISC_CLUT224=y
 # CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
@@ -781,23 +822,27 @@ CONFIG_SND_OSSEMUL=y
 CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_SEQUENCER_OSS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
 # CONFIG_SND_VERBOSE_PRINTK is not set
 # CONFIG_SND_DEBUG is not set
 
 #
 # Generic devices
 #
+CONFIG_SND_AC97_CODEC=y
+CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_DUMMY is not set
 # CONFIG_SND_VIRMIDI is not set
 # CONFIG_SND_MTPAV is not set
 # CONFIG_SND_SERIAL_U16550 is not set
 # CONFIG_SND_MPU401 is not set
-CONFIG_SND_AC97_CODEC=y
-CONFIG_SND_AC97_BUS=y
 
 #
 # PCI devices
 #
+CONFIG_SND_AD1889=y
+# CONFIG_SND_AD1889_OPL3 is not set
 # CONFIG_SND_ALI5451 is not set
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -806,39 +851,38 @@ CONFIG_SND_AC97_BUS=y
 # CONFIG_SND_AU8830 is not set
 # CONFIG_SND_AZT3328 is not set
 # CONFIG_SND_BT87X is not set
-# CONFIG_SND_CS46XX is not set
+# CONFIG_SND_CA0106 is not set
+# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_CS4281 is not set
+# CONFIG_SND_CS46XX is not set
 # CONFIG_SND_EMU10K1 is not set
 # CONFIG_SND_EMU10K1X is not set
-# CONFIG_SND_CA0106 is not set
-# CONFIG_SND_KORG1212 is not set
-# CONFIG_SND_MIXART is not set
-# CONFIG_SND_NM256 is not set
-# CONFIG_SND_RME32 is not set
-# CONFIG_SND_RME96 is not set
-# CONFIG_SND_RME9652 is not set
-# CONFIG_SND_HDSP is not set
-# CONFIG_SND_HDSPM is not set
-# CONFIG_SND_TRIDENT is not set
-# CONFIG_SND_YMFPCI is not set
-CONFIG_SND_AD1889=y
-# CONFIG_SND_AD1889_OPL3 is not set
-# CONFIG_SND_CMIPCI is not set
 # CONFIG_SND_ENS1370 is not set
 # CONFIG_SND_ENS1371 is not set
 # CONFIG_SND_ES1938 is not set
 # CONFIG_SND_ES1968 is not set
-# CONFIG_SND_MAESTRO3 is not set
 # CONFIG_SND_FM801 is not set
+# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_HDSP is not set
+# CONFIG_SND_HDSPM is not set
 # CONFIG_SND_ICE1712 is not set
 # CONFIG_SND_ICE1724 is not set
 # CONFIG_SND_INTEL8X0 is not set
 # CONFIG_SND_INTEL8X0M is not set
+# CONFIG_SND_KORG1212 is not set
+# CONFIG_SND_MAESTRO3 is not set
+# CONFIG_SND_MIXART is not set
+# CONFIG_SND_NM256 is not set
+# CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RME32 is not set
+# CONFIG_SND_RME96 is not set
+# CONFIG_SND_RME9652 is not set
 # CONFIG_SND_SONICVIBES is not set
+# CONFIG_SND_TRIDENT is not set
 # CONFIG_SND_VIA82XX is not set
 # CONFIG_SND_VIA82XX_MODEM is not set
 # CONFIG_SND_VX222 is not set
-# CONFIG_SND_HDA_INTEL is not set
+# CONFIG_SND_YMFPCI is not set
 
 #
 # USB devices
@@ -888,14 +932,18 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # USB Device Class drivers
 #
 # CONFIG_OBSOLETE_OSS_USB_DRIVER is not set
-# CONFIG_USB_BLUETOOTH_TTY is not set
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
+# may also be needed; see USB_STORAGE Help for more information
 #
 # CONFIG_USB_STORAGE is not set
+# CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
@@ -918,6 +966,7 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_YEALINK is not set
 # CONFIG_USB_XPAD is not set
 # CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
 
@@ -994,7 +1043,7 @@ CONFIG_USB_MON=y
 # CONFIG_INFINIBAND is not set
 
 #
-# SN Devices
+# EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
 #
 
 #
@@ -1011,6 +1060,7 @@ CONFIG_JBD=y
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
@@ -1045,6 +1095,7 @@ CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_RELAYFS_FS is not set
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -1151,18 +1202,22 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=15
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
+CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_IOREMAP is not set
 # CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_DEBUG_RODATA=y
 
 #
 # Security options
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index d8a4ca021aac..360b7391cb8c 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -89,7 +89,7 @@ update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t pte)
         if (pfn_valid(page_to_pfn(page)) && page_mapping(page) &&
             test_bit(PG_dcache_dirty, &page->flags)) {
 
-                flush_kernel_dcache_page(page_address(page));
+                flush_kernel_dcache_page(page);
                 clear_bit(PG_dcache_dirty, &page->flags);
         }
 }
@@ -278,7 +278,7 @@ void flush_dcache_page(struct page *page)
                 return;
         }
 
-        flush_kernel_dcache_page(page_address(page));
+        flush_kernel_dcache_page(page);
 
         if (!mapping)
                 return;
@@ -317,7 +317,7 @@ EXPORT_SYMBOL(flush_dcache_page);
 
 /* Defined in arch/parisc/kernel/pacache.S */
 EXPORT_SYMBOL(flush_kernel_dcache_range_asm);
-EXPORT_SYMBOL(flush_kernel_dcache_page);
+EXPORT_SYMBOL(flush_kernel_dcache_page_asm);
 EXPORT_SYMBOL(flush_data_cache_local);
 EXPORT_SYMBOL(flush_kernel_icache_range_asm);
 
diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 9af4b22a6d77..7c95d7663c29 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -563,10 +563,10 @@
         extrd,u,*=      \pte,_PAGE_GATEWAY_BIT+32,1,%r0
         depd            %r0,11,2,\prot  /* If Gateway, Set PL2 to 0 */
 
-        /* Get rid of prot bits and convert to page addr for iitlbt */
+        /* Get rid of prot bits and convert to page addr for iitlbt and idtlbt */
 
         depd            %r0,63,PAGE_SHIFT,\pte
-        extrd,u         \pte,56,32,\pte
+        extrd,s         \pte,(63-PAGE_SHIFT)+(63-58),64-PAGE_SHIFT,\pte
         .endm
 
         /* Identical macro to make_insert_tlb above, except it
@@ -584,7 +584,7 @@
 
         /* Get rid of prot bits and convert to page addr for iitlba */
 
-        depi            0,31,12,\pte
+        depi            0,31,PAGE_SHIFT,\pte
         extru           \pte,24,25,\pte
 
         .endm
@@ -1014,14 +1014,21 @@ intr_restore:
         nop
         nop
 
+#ifndef CONFIG_PREEMPT
+# define intr_do_preempt        intr_restore
+#endif /* !CONFIG_PREEMPT */
+
         .import schedule,code
 intr_do_resched:
-        /* Only do reschedule if we are returning to user space */
+        /* Only call schedule on return to userspace. If we're returning
+         * to kernel space, we may schedule if CONFIG_PREEMPT, otherwise
+         * we jump back to intr_restore.
+         */
         LDREG   PT_IASQ0(%r16), %r20
-        CMPIB= 0,%r20,intr_restore /* backward */
+        CMPIB=  0, %r20, intr_do_preempt
         nop
         LDREG   PT_IASQ1(%r16), %r20
-        CMPIB= 0,%r20,intr_restore /* backward */
+        CMPIB=  0, %r20, intr_do_preempt
         nop
 
 #ifdef CONFIG_64BIT
@@ -1037,6 +1044,32 @@ intr_do_resched:
 #endif
         ldo     R%intr_check_sig(%r2), %r2
 
+        /* preempt the current task on returning to kernel
+         * mode from an interrupt, iff need_resched is set,
+         * and preempt_count is 0. otherwise, we continue on
+         * our merry way back to the current running task.
+         */
+#ifdef CONFIG_PREEMPT
+        .import preempt_schedule_irq,code
+intr_do_preempt:
+        rsm     PSW_SM_I, %r0           /* disable interrupts */
+
+        /* current_thread_info()->preempt_count */
+        mfctl   %cr30, %r1
+        LDREG   TI_PRE_COUNT(%r1), %r19
+        CMPIB<> 0, %r19, intr_restore   /* if preempt_count > 0 */
+        nop                             /* prev insn branched backwards */
+
+        /* check if we interrupted a critical path */
+        LDREG   PT_PSW(%r16), %r20
+        bb,<,n  %r20, 31 - PSW_SM_I, intr_restore
+        nop
+
+        BL      preempt_schedule_irq, %r2
+        nop
+
+        b       intr_restore            /* ssm PSW_SM_I done by intr_restore */
+#endif /* CONFIG_PREEMPT */
 
         .import do_signal,code
 intr_do_signal:
diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
index 9534ee17b9be..7a4f07e8d3c3 100644
--- a/arch/parisc/kernel/pacache.S
+++ b/arch/parisc/kernel/pacache.S
@@ -621,9 +621,9 @@ __clear_user_page_asm:
 
         .procend
 
-        .export flush_kernel_dcache_page
+        .export flush_kernel_dcache_page_asm
 
-flush_kernel_dcache_page:
+flush_kernel_dcache_page_asm:
         .proc
         .callinfo NO_CALLS
         .entry
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 1d00c365f2b1..47ca5c0a323b 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -30,22 +30,7 @@
 #include <linux/syscalls.h>
 
 #include <linux/string.h>
-EXPORT_SYMBOL(memchr);
-EXPORT_SYMBOL(memcmp);
-EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memset);
-EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strcpy);
-EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strncmp);
-EXPORT_SYMBOL(strncpy);
-EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strpbrk);
 
 #include <asm/atomic.h>
@@ -82,16 +67,12 @@ EXPORT_SYMBOL($global$);
 #endif
 
 #include <asm/io.h>
-EXPORT_SYMBOL(__ioremap);
-EXPORT_SYMBOL(iounmap);
 EXPORT_SYMBOL(memcpy_toio);
 EXPORT_SYMBOL(memcpy_fromio);
 EXPORT_SYMBOL(memset_io);
 
 #include <asm/unistd.h>
-EXPORT_SYMBOL(sys_open);
 EXPORT_SYMBOL(sys_lseek);
-EXPORT_SYMBOL(sys_read);
 EXPORT_SYMBOL(sys_write);
 
 #include <asm/semaphore.h>
diff --git a/arch/parisc/kernel/pdc_chassis.c b/arch/parisc/kernel/pdc_chassis.c
index 0cea6958f427..a45e2e2ffd9f 100644
--- a/arch/parisc/kernel/pdc_chassis.c
+++ b/arch/parisc/kernel/pdc_chassis.c
@@ -5,9 +5,8 @@
  *    Copyright (C) 2002-2004 Thibaut VARENE <varenet@parisc-linux.org>
  *
  *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
+ *    it under the terms of the GNU General Public License, version 2, as
+ *    published by the Free Software Foundation.
  *
  *    This program is distributed in the hope that it will be useful,
  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
index 53f861c82f93..ac8ee205c351 100644
--- a/arch/parisc/kernel/perf.c
+++ b/arch/parisc/kernel/perf.c
@@ -805,7 +805,7 @@ static int perf_write_image(uint64_t *memaddr)
                 return -1;
         }
 
-        runway = ioremap(cpu_device->hpa.start, 4096);
+        runway = ioremap_nocache(cpu_device->hpa.start, 4096);
 
         /* Merge intrigue bits into Runway STATUS 0 */
         tmp64 = __raw_readq(runway + RUNWAY_STATUS) & 0xffecfffffffffffful;
diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
index 89b6c56ea0a8..bbeeb614cfab 100644
--- a/arch/parisc/kernel/syscall_table.S
+++ b/arch/parisc/kernel/syscall_table.S
@@ -287,7 +287,7 @@
         ENTRY_SAME(chown)               /* 180 */
         /* setsockopt() used by iptables: SO_SET_REPLACE/SO_SET_ADD_COUNTERS */
         ENTRY_COMP(setsockopt)
-        ENTRY_SAME(getsockopt)
+        ENTRY_COMP(getsockopt)
         ENTRY_COMP(sendmsg)
         ENTRY_COMP(recvmsg)
         ENTRY_SAME(semop)               /* 185 */
diff --git a/arch/parisc/lib/iomap.c b/arch/parisc/lib/iomap.c
index 01bec8fcbd0d..f4a811690ab3 100644
--- a/arch/parisc/lib/iomap.c
+++ b/arch/parisc/lib/iomap.c
@@ -263,11 +263,7 @@ static const struct iomap_ops iomem_ops = {
 
 const struct iomap_ops *iomap_ops[8] = {
         [0] = &ioport_ops,
-#ifdef CONFIG_DEBUG_IOREMAP
-        [6] = &iomem_ops,
-#else
         [7] = &iomem_ops
-#endif
 };
 
 
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 852eda3953dc..3796be67cd53 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -1013,9 +1013,9 @@ void flush_tlb_all(void)
 #ifdef CONFIG_BLK_DEV_INITRD
 void free_initrd_mem(unsigned long start, unsigned long end)
 {
-#if 0
-        if (start < end)
-                printk(KERN_INFO "Freeing initrd memory: %ldk freed\n", (end - start) >> 10);
+        if (start >= end)
+                return;
+        printk(KERN_INFO "Freeing initrd memory: %ldk freed\n", (end - start) >> 10);
         for (; start < end; start += PAGE_SIZE) {
                 ClearPageReserved(virt_to_page(start));
                 init_page_count(virt_to_page(start));
@@ -1023,6 +1023,5 @@ void free_initrd_mem(unsigned long start, unsigned long end)
                 num_physpages++;
                 totalram_pages++;
         }
-#endif
 }
 #endif
diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c
index edd9a9559cba..0db12818d7bc 100644
--- a/arch/parisc/mm/ioremap.c
+++ b/arch/parisc/mm/ioremap.c
@@ -72,7 +72,6 @@ remap_area_pmd(pmd_t *pmd, unsigned long address, unsigned long size,
         return 0;
 }
 
-#if USE_HPPA_IOREMAP
 static int 
 remap_area_pages(unsigned long address, unsigned long phys_addr,
                  unsigned long size, unsigned long flags)
@@ -114,31 +113,6 @@ remap_area_pages(unsigned long address, unsigned long phys_addr,
 
         return error;
 }
-#endif /* USE_HPPA_IOREMAP */
-
-#ifdef CONFIG_DEBUG_IOREMAP
-static unsigned long last = 0;
-
-void gsc_bad_addr(unsigned long addr)
-{
-        if (time_after(jiffies, last + HZ*10)) {
-                printk("gsc_foo() called with bad address 0x%lx\n", addr);
-                dump_stack();
-                last = jiffies;
-        }
-}
-EXPORT_SYMBOL(gsc_bad_addr);
-
-void __raw_bad_addr(const volatile void __iomem *addr)
-{
-        if (time_after(jiffies, last + HZ*10)) {
-                printk("__raw_foo() called with bad address 0x%p\n", addr);
-                dump_stack();
-                last = jiffies;
-        }
-}
-EXPORT_SYMBOL(__raw_bad_addr);
-#endif
 
 /*
  * Generic mapping function (not visible outside):
@@ -154,26 +128,19 @@ EXPORT_SYMBOL(__raw_bad_addr);
  */
 void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned long flags)
 {
-#if !(USE_HPPA_IOREMAP)
+        void *addr;
+        struct vm_struct *area;
+        unsigned long offset, last_addr;
 
+#ifdef CONFIG_EISA
         unsigned long end = phys_addr + size - 1;
         /* Support EISA addresses */
-        if ((phys_addr >= 0x00080000 && end < 0x000fffff)
-                        || (phys_addr >= 0x00500000 && end < 0x03bfffff)) {
-                phys_addr |= 0xfc000000;
+        if ((phys_addr >= 0x00080000 && end < 0x000fffff) ||
+            (phys_addr >= 0x00500000 && end < 0x03bfffff)) {
+                phys_addr |= F_EXTEND(0xfc000000);
         }
-
-#ifdef CONFIG_DEBUG_IOREMAP
-        return (void __iomem *)(phys_addr - (0x1UL << NYBBLE_SHIFT));
-#else
-        return (void __iomem *)phys_addr;
 #endif
 
-#else
-        void *addr;
-        struct vm_struct *area;
-        unsigned long offset, last_addr;
-
         /* Don't allow wraparound or zero size */
         last_addr = phys_addr + size - 1;
         if (!size || last_addr < phys_addr)
@@ -217,15 +184,12 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
         }
 
         return (void __iomem *) (offset + (char *)addr);
-#endif
 }
+EXPORT_SYMBOL(__ioremap);
 
 void iounmap(void __iomem *addr)
 {
-#if !(USE_HPPA_IOREMAP)
-        return;
-#else
         if (addr > high_memory)
                 return vfree((void *) (PAGE_MASK & (unsigned long __force) addr));
-#endif
 }
+EXPORT_SYMBOL(iounmap);
diff --git a/arch/powerpc/kernel/crash_dump.c b/arch/powerpc/kernel/crash_dump.c
index 211d72653ea6..764d07329716 100644
--- a/arch/powerpc/kernel/crash_dump.c
+++ b/arch/powerpc/kernel/crash_dump.c
@@ -61,7 +61,7 @@ static int __init parse_elfcorehdr(char *p)
         if (p)
                 elfcorehdr_addr = memparse(p, &p);
 
-        return 0;
+        return 1;
 }
 __setup("elfcorehdr=", parse_elfcorehdr);
 #endif
@@ -71,7 +71,7 @@ static int __init parse_savemaxmem(char *p)
         if (p)
                 saved_max_pfn = (memparse(p, &p) >> PAGE_SHIFT) - 1;
 
-        return 0;
+        return 1;
 }
 __setup("savemaxmem=", parse_savemaxmem);
 
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 706090c99f47..2dd47d2dd998 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -834,7 +834,6 @@ unsigned long get_wchan(struct task_struct *p)
         } while (count++ < 16);
         return 0;
 }
-EXPORT_SYMBOL(get_wchan);
 
 static int kstack_depth_to_print = 64;
 
diff --git a/arch/powerpc/kernel/vdso32/sigtramp.S b/arch/powerpc/kernel/vdso32/sigtramp.S
index e04642781917..0c6a37b29dde 100644
--- a/arch/powerpc/kernel/vdso32/sigtramp.S
+++ b/arch/powerpc/kernel/vdso32/sigtramp.S
@@ -261,7 +261,7 @@ V_FUNCTION_END(__kernel_sigtramp_rt32)
 .Lcie_start:
         .long 0                 /* CIE ID */
         .byte 1                 /* Version number */
-        .string "zR"            /* NUL-terminated augmentation string */
+        .string "zRS"           /* NUL-terminated augmentation string */
         .uleb128 4              /* Code alignment factor */
         .sleb128 -4             /* Data alignment factor */
         .byte 67                /* Return address register column, ap */
diff --git a/arch/powerpc/kernel/vdso64/sigtramp.S b/arch/powerpc/kernel/vdso64/sigtramp.S
index 31b604ab56de..7479edb101b8 100644
--- a/arch/powerpc/kernel/vdso64/sigtramp.S
+++ b/arch/powerpc/kernel/vdso64/sigtramp.S
@@ -263,7 +263,7 @@ V_FUNCTION_END(__kernel_sigtramp_rt64)
 .Lcie_start:
         .long 0                 /* CIE ID */
         .byte 1                 /* Version number */
-        .string "zR"            /* NUL-terminated augmentation string */
+        .string "zRS"           /* NUL-terminated augmentation string */
         .uleb128 4              /* Code alignment factor */
         .sleb128 -8             /* Data alignment factor */
         .byte 67                /* Return address register column, ap */
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 2b8841f85534..343120c9223d 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -801,7 +801,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
          */
         print_cpu_info(&S390_lowcore.cpu_data);
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 lowcore_ptr[i] = (struct _lowcore *)
                         __get_free_pages(GFP_KERNEL|GFP_DMA, 
                                         sizeof(void*) == 8 ? 1 : 0);
@@ -831,7 +831,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 #endif
         set_prefix((u32)(unsigned long) lowcore_ptr[smp_processor_id()]);
 
-        for_each_cpu(cpu)
+        for_each_possible_cpu(cpu)
                 if (cpu != smp_processor_id())
                         smp_create_idle(cpu);
 }
@@ -868,7 +868,7 @@ static int __init topology_init(void)
         int cpu;
         int ret;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu, NULL);
                 if (ret)
                         printk(KERN_WARNING "topology_init: register_cpu %d "
diff --git a/arch/sh/kernel/cpu/init.c b/arch/sh/kernel/cpu/init.c
index cf94e8ef17c5..868e68b28880 100644
--- a/arch/sh/kernel/cpu/init.c
+++ b/arch/sh/kernel/cpu/init.c
@@ -30,7 +30,7 @@ static int x##_disabled __initdata = 0;		\
 static int __init x##_setup(char *opts)         \
 {                                               \
         x##_disabled = 1;                       \
-        return 0;                               \
+        return 1;                               \
 }                                               \
 __setup("no" __stringify(x), x##_setup);
 
diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
index 7ee4ca203616..bb229ef030f3 100644
--- a/arch/sh/kernel/setup.c
+++ b/arch/sh/kernel/setup.c
@@ -401,7 +401,7 @@ static int __init topology_init(void)
 {
         int cpu_id;
 
-        for_each_cpu(cpu_id)
+        for_each_possible_cpu(cpu_id)
                 register_cpu(&cpu[cpu_id], cpu_id, NULL);
 
         return 0;
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index 5982fe2753e0..05fbb20636cb 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -22,6 +22,9 @@ config SBUS
 config PCI
         bool
 
+config PCMCIA
+        bool
+
 config GENERIC_CALIBRATE_DELAY
         bool
         default y
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 8d14c7a831be..24790bed2054 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -20,7 +20,7 @@ core-y			+= $(ARCH_DIR)/kernel/		\
 
 # Have to precede the include because the included Makefiles reference them.
 SYMLINK_HEADERS := archparam.h system.h sigcontext.h processor.h ptrace.h \
-        module.h vm-flags.h elf.h ldt.h
+        module.h vm-flags.h elf.h host_ldt.h
 SYMLINK_HEADERS := $(foreach header,$(SYMLINK_HEADERS),include/asm-um/$(header))
 
 # XXX: The "os" symlink is only used by arch/um/include/os.h, which includes
@@ -129,7 +129,7 @@ CPPFLAGS_vmlinux.lds = -U$(SUBARCH) \
         -DSTART=$(START) -DELF_ARCH=$(ELF_ARCH) \
         -DELF_FORMAT="$(ELF_FORMAT)" $(CPP_MODE-y) \
         -DKERNEL_STACK_SIZE=$(STACK_SIZE) \
-        -DUNMAP_PATH=arch/um/sys-$(SUBARCH)/unmap_fin.o
+        -DUNMAP_PATH=arch/um/sys-$(SUBARCH)/unmap.o
 
 #The wrappers will select whether using "malloc" or the kernel allocator.
 LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
@@ -150,8 +150,7 @@ CLEAN_FILES += linux x.i gmon.out $(ARCH_DIR)/include/uml-config.h \
         $(ARCH_DIR)/include/user_constants.h \
         $(ARCH_DIR)/include/kern_constants.h $(ARCH_DIR)/Kconfig.arch
 
-MRPROPER_FILES += $(SYMLINK_HEADERS) $(ARCH_SYMLINKS) \
-        $(addprefix $(ARCH_DIR)/kernel/,$(KERN_SYMLINKS)) $(ARCH_DIR)/os
+MRPROPER_FILES += $(ARCH_SYMLINKS)
 
 archclean:
         @find . \( -name '*.bb' -o -name '*.bbg' -o -name '*.da' \
diff --git a/arch/um/Makefile-x86_64 b/arch/um/Makefile-x86_64
index 38df311e75dc..dfd88b652fbe 100644
--- a/arch/um/Makefile-x86_64
+++ b/arch/um/Makefile-x86_64
@@ -1,7 +1,7 @@
 # Copyright 2003 - 2004 Pathscale, Inc
 # Released under the GPL
 
-libs-y += arch/um/sys-x86_64/
+core-y += arch/um/sys-x86_64/
 START := 0x60000000
 
 #We #undef __x86_64__ for kernelspace, not for userspace where
diff --git a/arch/um/drivers/daemon_kern.c b/arch/um/drivers/daemon_kern.c
index a61b7b46bc02..53d09ed78b42 100644
--- a/arch/um/drivers/daemon_kern.c
+++ b/arch/um/drivers/daemon_kern.c
@@ -95,18 +95,7 @@ static struct transport daemon_transport = {
 static int register_daemon(void)
 {
         register_transport(&daemon_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_daemon);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/harddog_kern.c b/arch/um/drivers/harddog_kern.c
index 49acb2badf32..d18a974735e6 100644
--- a/arch/um/drivers/harddog_kern.c
+++ b/arch/um/drivers/harddog_kern.c
@@ -104,7 +104,7 @@ static int harddog_release(struct inode *inode, struct file *file)
 
 extern int ping_watchdog(int fd);
 
-static ssize_t harddog_write(struct file *file, const char *data, size_t len,
+static ssize_t harddog_write(struct file *file, const char __user *data, size_t len,
                              loff_t *ppos)
 {
         /*
@@ -118,6 +118,7 @@ static ssize_t harddog_write(struct file *file, const char *data, size_t len,
 static int harddog_ioctl(struct inode *inode, struct file *file,
                          unsigned int cmd, unsigned long arg)
 {
+        void __user *argp= (void __user *)arg;
         static struct watchdog_info ident = {
                 WDIOC_SETTIMEOUT,
                 0,
@@ -127,13 +128,12 @@ static int harddog_ioctl(struct inode *inode, struct file *file,
                 default:
                         return -ENOTTY;
                 case WDIOC_GETSUPPORT:
-                        if(copy_to_user((struct harddog_info *)arg, &ident,
-                                        sizeof(ident)))
+                        if(copy_to_user(argp, &ident, sizeof(ident)))
                                 return -EFAULT;
                         return 0;
                 case WDIOC_GETSTATUS:
                 case WDIOC_GETBOOTSTATUS:
-                        return put_user(0,(int *)arg);
+                        return put_user(0,(int __user *)argp);
                 case WDIOC_KEEPALIVE:
                         return(ping_watchdog(harddog_out_fd));
         }
diff --git a/arch/um/drivers/hostaudio_kern.c b/arch/um/drivers/hostaudio_kern.c
index 59602b81b240..37232f908cd7 100644
--- a/arch/um/drivers/hostaudio_kern.c
+++ b/arch/um/drivers/hostaudio_kern.c
@@ -67,8 +67,8 @@ MODULE_PARM_DESC(mixer, MIXER_HELP);
 
 /* /dev/dsp file operations */
 
-static ssize_t hostaudio_read(struct file *file, char *buffer, size_t count, 
-                              loff_t *ppos)
+static ssize_t hostaudio_read(struct file *file, char __user *buffer,
+                              size_t count, loff_t *ppos)
 {
         struct hostaudio_state *state = file->private_data;
         void *kbuf;
@@ -94,7 +94,7 @@ static ssize_t hostaudio_read(struct file *file, char *buffer, size_t count,
         return(err);
 }
 
-static ssize_t hostaudio_write(struct file *file, const char *buffer, 
+static ssize_t hostaudio_write(struct file *file, const char __user *buffer,
                                size_t count, loff_t *ppos)
 {
         struct hostaudio_state *state = file->private_data;
@@ -152,7 +152,7 @@ static int hostaudio_ioctl(struct inode *inode, struct file *file,
         case SNDCTL_DSP_CHANNELS:
         case SNDCTL_DSP_SUBDIVIDE:
         case SNDCTL_DSP_SETFRAGMENT:
-                if(get_user(data, (int *) arg))
+                if(get_user(data, (int __user *) arg))
                         return(-EFAULT);
                 break;
         default:
@@ -168,7 +168,7 @@ static int hostaudio_ioctl(struct inode *inode, struct file *file,
         case SNDCTL_DSP_CHANNELS:
         case SNDCTL_DSP_SUBDIVIDE:
         case SNDCTL_DSP_SETFRAGMENT:
-                if(put_user(data, (int *) arg))
+                if(put_user(data, (int __user *) arg))
                         return(-EFAULT);
                 break;
         default:
diff --git a/arch/um/drivers/mcast_kern.c b/arch/um/drivers/mcast_kern.c
index c9b078fba03e..3a7af18cf944 100644
--- a/arch/um/drivers/mcast_kern.c
+++ b/arch/um/drivers/mcast_kern.c
@@ -124,18 +124,7 @@ static struct transport mcast_transport = {
 static int register_mcast(void)
 {
         register_transport(&mcast_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_mcast);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 1488816588ea..28e3760e8b98 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -20,6 +20,8 @@
 #include "linux/namei.h"
 #include "linux/proc_fs.h"
 #include "linux/syscalls.h"
+#include "linux/list.h"
+#include "linux/mm.h"
 #include "linux/console.h"
 #include "asm/irq.h"
 #include "asm/uaccess.h"
@@ -347,6 +349,142 @@ static struct mc_device *mconsole_find_dev(char *name)
         return(NULL);
 }
 
+#define UNPLUGGED_PER_PAGE \
+        ((PAGE_SIZE - sizeof(struct list_head)) / sizeof(unsigned long))
+
+struct unplugged_pages {
+        struct list_head list;
+        void *pages[UNPLUGGED_PER_PAGE];
+};
+
+static unsigned long long unplugged_pages_count = 0;
+static struct list_head unplugged_pages = LIST_HEAD_INIT(unplugged_pages);
+static int unplug_index = UNPLUGGED_PER_PAGE;
+
+static int mem_config(char *str)
+{
+        unsigned long long diff;
+        int err = -EINVAL, i, add;
+        char *ret;
+
+        if(str[0] != '=')
+                goto out;
+
+        str++;
+        if(str[0] == '-')
+                add = 0;
+        else if(str[0] == '+'){
+                add = 1;
+        }
+        else goto out;
+
+        str++;
+        diff = memparse(str, &ret);
+        if(*ret != '\0')
+                goto out;
+
+        diff /= PAGE_SIZE;
+
+        for(i = 0; i < diff; i++){
+                struct unplugged_pages *unplugged;
+                void *addr;
+
+                if(add){
+                        if(list_empty(&unplugged_pages))
+                                break;
+
+                        unplugged = list_entry(unplugged_pages.next,
+                                               struct unplugged_pages, list);
+                        if(unplug_index > 0)
+                                addr = unplugged->pages[--unplug_index];
+                        else {
+                                list_del(&unplugged->list);
+                                addr = unplugged;
+                                unplug_index = UNPLUGGED_PER_PAGE;
+                        }
+
+                        free_page((unsigned long) addr);
+                        unplugged_pages_count--;
+                }
+                else {
+                        struct page *page;
+
+                        page = alloc_page(GFP_ATOMIC);
+                        if(page == NULL)
+                                break;
+
+                        unplugged = page_address(page);
+                        if(unplug_index == UNPLUGGED_PER_PAGE){
+                                INIT_LIST_HEAD(&unplugged->list);
+                                list_add(&unplugged->list, &unplugged_pages);
+                                unplug_index = 0;
+                        }
+                        else {
+                                struct list_head *entry = unplugged_pages.next;
+                                addr = unplugged;
+
+                                unplugged = list_entry(entry,
+                                                       struct unplugged_pages,
+                                                       list);
+                                unplugged->pages[unplug_index++] = addr;
+                                err = os_drop_memory(addr, PAGE_SIZE);
+                                if(err)
+                                        printk("Failed to release memory - "
+                                               "errno = %d\n", err);
+                        }
+
+                        unplugged_pages_count++;
+                }
+        }
+
+        err = 0;
+out:
+        return err;
+}
+
+static int mem_get_config(char *name, char *str, int size, char **error_out)
+{
+        char buf[sizeof("18446744073709551615")];
+        int len = 0;
+
+        sprintf(buf, "%ld", uml_physmem);
+        CONFIG_CHUNK(str, size, len, buf, 1);
+
+        return len;
+}
+
+static int mem_id(char **str, int *start_out, int *end_out)
+{
+        *start_out = 0;
+        *end_out = 0;
+
+        return 0;
+}
+
+static int mem_remove(int n)
+{
+        return -EBUSY;
+}
+
+static struct mc_device mem_mc = {
+        .name           = "mem",
+        .config         = mem_config,
+        .get_config     = mem_get_config,
+        .id             = mem_id,
+        .remove         = mem_remove,
+};
+
+static int mem_mc_init(void)
+{
+        if(can_drop_memory())
+                mconsole_register_dev(&mem_mc);
+        else printk("Can't release memory to the host - memory hotplug won't "
+                    "be supported\n");
+        return 0;
+}
+
+__initcall(mem_mc_init);
+
 #define CONFIG_BUF_SIZE 64
 
 static void mconsole_get_config(int (*get_config)(char *, char *, int,
@@ -478,7 +616,7 @@ static void console_write(struct console *console, const char *string,
                 return;
 
         while(1){
-                n = min(len, ARRAY_SIZE(console_buf) - console_index);
+                n = min((size_t)len, ARRAY_SIZE(console_buf) - console_index);
                 strncpy(&console_buf[console_index], string, n);
                 console_index += n;
                 string += n;
diff --git a/arch/um/drivers/pcap_kern.c b/arch/um/drivers/pcap_kern.c
index 07c80f2156ef..466ff2c2f918 100644
--- a/arch/um/drivers/pcap_kern.c
+++ b/arch/um/drivers/pcap_kern.c
@@ -106,18 +106,7 @@ static struct transport pcap_transport = {
 static int register_pcap(void)
 {
         register_transport(&pcap_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_pcap);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/slip_kern.c b/arch/um/drivers/slip_kern.c
index a62f5ef445cf..163ee0d5f75e 100644
--- a/arch/um/drivers/slip_kern.c
+++ b/arch/um/drivers/slip_kern.c
@@ -93,18 +93,7 @@ static struct transport slip_transport = {
 static int register_slip(void)
 {
         register_transport(&slip_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_slip);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/slirp_kern.c b/arch/um/drivers/slirp_kern.c
index 33d7982be5d3..95e50c943e14 100644
--- a/arch/um/drivers/slirp_kern.c
+++ b/arch/um/drivers/slirp_kern.c
@@ -77,7 +77,7 @@ static int slirp_setup(char *str, char **mac_out, void *data)
         int i=0;
 
         *init = ((struct slirp_init)
-                { argw :                { { "slirp", NULL  } } });
+                { .argw = { { "slirp", NULL  } } });
 
         str = split_if_spec(str, mac_out, NULL);
 
@@ -116,18 +116,7 @@ static struct transport slirp_transport = {
 static int register_slirp(void)
 {
         register_transport(&slirp_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_slirp);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 0336575d2448..0897852b09a3 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -891,7 +891,7 @@ int ubd_driver_init(void){
                              SA_INTERRUPT, "ubd", ubd_dev);
         if(err != 0)
                 printk(KERN_ERR "um_request_irq failed - errno = %d\n", -err);
-        return(err);
+        return 0;
 }
 
 device_initcall(ubd_driver_init);
diff --git a/arch/um/include/kern_util.h b/arch/um/include/kern_util.h
index 07176d92e1c9..42557130a408 100644
--- a/arch/um/include/kern_util.h
+++ b/arch/um/include/kern_util.h
@@ -116,7 +116,11 @@ extern void *get_current(void);
 extern struct task_struct *get_task(int pid, int require);
 extern void machine_halt(void);
 extern int is_syscall(unsigned long addr);
-extern void arch_switch(void);
+
+extern void arch_switch_to_tt(struct task_struct *from, struct task_struct *to);
+
+extern void arch_switch_to_skas(struct task_struct *from, struct task_struct *to);
+
 extern void free_irq(unsigned int, void *);
 extern int cpu(void);
 
diff --git a/arch/um/include/line.h b/arch/um/include/line.h
index 6f4d680dc1d4..6ac0f8252e21 100644
--- a/arch/um/include/line.h
+++ b/arch/um/include/line.h
@@ -58,23 +58,17 @@ struct line {
 };
 
 #define LINE_INIT(str, d) \
-        { init_str :    str, \
-          init_pri :    INIT_STATIC, \
-          valid :       1, \
-          throttled :   0, \
-          lock :        SPIN_LOCK_UNLOCKED, \
-          buffer :      NULL, \
-          head :        NULL, \
-          tail :        NULL, \
-          sigio :       0, \
-          driver :      d, \
-          have_irq :    0 }
+        { .init_str =   str, \
+          .init_pri =   INIT_STATIC, \
+          .valid =      1, \
+          .lock =       SPIN_LOCK_UNLOCKED, \
+          .driver =     d }
 
 struct lines {
         int num;
 };
 
-#define LINES_INIT(n) {  num :          n }
+#define LINES_INIT(n) {  .num = n }
 
 extern void line_close(struct tty_struct *tty, struct file * filp);
 extern int line_open(struct line *lines, struct tty_struct *tty);
diff --git a/arch/um/include/mem_user.h b/arch/um/include/mem_user.h
index a1064c5823bf..a54514d2cc3a 100644
--- a/arch/um/include/mem_user.h
+++ b/arch/um/include/mem_user.h
@@ -49,7 +49,6 @@ extern int iomem_size;
 extern unsigned long host_task_size;
 extern unsigned long task_size;
 
-extern void check_devanon(void);
 extern int init_mem_user(void);
 extern void setup_memory(void *entry);
 extern unsigned long find_iomem(char *driver, unsigned long *len_out);
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index d3d1bc6074ef..f88856c28a66 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -13,6 +13,7 @@
 #include "kern_util.h"
 #include "skas/mm_id.h"
 #include "irq_user.h"
+#include "sysdep/tls.h"
 
 #define OS_TYPE_FILE 1 
 #define OS_TYPE_DIR 2 
@@ -172,6 +173,7 @@ extern int os_fchange_dir(int fd);
 extern void os_early_checks(void);
 extern int can_do_skas(void);
 extern void os_check_bugs(void);
+extern void check_host_supports_tls(int *supports_tls, int *tls_min);
 
 /* Make sure they are clear when running in TT mode. Required by
  * SEGV_MAYBE_FIXABLE */
@@ -205,6 +207,8 @@ extern int os_map_memory(void *virt, int fd, unsigned long long off,
 extern int os_protect_memory(void *addr, unsigned long len, 
                              int r, int w, int x);
 extern int os_unmap_memory(void *addr, int len);
+extern int os_drop_memory(void *addr, int length);
+extern int can_drop_memory(void);
 extern void os_flush_stdout(void);
 
 /* tt.c
@@ -234,8 +238,12 @@ extern int run_helper_thread(int (*proc)(void *), void *arg,
                              int stack_order);
 extern int helper_wait(int pid);
 
-/* umid.c */
 
+/* tls.c */
+extern int os_set_thread_area(user_desc_t *info, int pid);
+extern int os_get_thread_area(user_desc_t *info, int pid);
+
+/* umid.c */
 extern int umid_file_name(char *name, char *buf, int len);
 extern int set_umid(char *name);
 extern char *get_umid(void);
diff --git a/arch/um/include/sysdep-i386/checksum.h b/arch/um/include/sysdep-i386/checksum.h
index 7d3d202d7fff..052bb061a978 100644
--- a/arch/um/include/sysdep-i386/checksum.h
+++ b/arch/um/include/sysdep-i386/checksum.h
@@ -48,7 +48,8 @@ unsigned int csum_partial_copy_nocheck(const unsigned char *src, unsigned char *
  */
 
 static __inline__
-unsigned int csum_partial_copy_from_user(const unsigned char *src, unsigned char *dst,
+unsigned int csum_partial_copy_from_user(const unsigned char __user *src,
+                                         unsigned char *dst,
                                          int len, int sum, int *err_ptr)
 {
         if(copy_from_user(dst, src, len)){
@@ -192,7 +193,7 @@ static __inline__ unsigned short int csum_ipv6_magic(struct in6_addr *saddr,
  */
 #define HAVE_CSUM_COPY_USER
 static __inline__ unsigned int csum_and_copy_to_user(const unsigned char *src,
-                                                     unsigned char *dst,
+                                                     unsigned char __user *dst,
                                                      int len, int sum, int *err_ptr)
 {
         if (access_ok(VERIFY_WRITE, dst, len)){
diff --git a/arch/um/include/sysdep-i386/ptrace.h b/arch/um/include/sysdep-i386/ptrace.h
index c8ee9559f3ab..6670cc992ecb 100644
--- a/arch/um/include/sysdep-i386/ptrace.h
+++ b/arch/um/include/sysdep-i386/ptrace.h
@@ -14,7 +14,12 @@
 #define MAX_REG_NR (UM_FRAME_SIZE / sizeof(unsigned long))
 #define MAX_REG_OFFSET (UM_FRAME_SIZE)
 
+#ifdef UML_CONFIG_PT_PROXY
 extern void update_debugregs(int seq);
+#else
+static inline void update_debugregs(int seq) {}
+#endif
+
 
 /* syscall emulation path in ptrace */
 
diff --git a/arch/um/include/sysdep-i386/tls.h b/arch/um/include/sysdep-i386/tls.h
new file mode 100644
index 000000000000..918fd3c5ff9c
--- /dev/null
+++ b/arch/um/include/sysdep-i386/tls.h
@@ -0,0 +1,32 @@
+#ifndef _SYSDEP_TLS_H
+#define _SYSDEP_TLS_H
+
+# ifndef __KERNEL__
+
+/* Change name to avoid conflicts with the original one from <asm/ldt.h>, which
+ * may be named user_desc (but in 2.4 and in header matching its API was named
+ * modify_ldt_ldt_s). */
+
+typedef struct um_dup_user_desc {
+        unsigned int  entry_number;
+        unsigned int  base_addr;
+        unsigned int  limit;
+        unsigned int  seg_32bit:1;
+        unsigned int  contents:2;
+        unsigned int  read_exec_only:1;
+        unsigned int  limit_in_pages:1;
+        unsigned int  seg_not_present:1;
+        unsigned int  useable:1;
+} user_desc_t;
+
+# else /* __KERNEL__ */
+
+#  include <asm/ldt.h>
+typedef struct user_desc user_desc_t;
+
+# endif /* __KERNEL__ */
+
+#define GDT_ENTRY_TLS_MIN_I386 6
+#define GDT_ENTRY_TLS_MIN_X86_64 12
+
+#endif /* _SYSDEP_TLS_H */
diff --git a/arch/um/include/sysdep-x86_64/tls.h b/arch/um/include/sysdep-x86_64/tls.h
new file mode 100644
index 000000000000..35f19f25bd3b
--- /dev/null
+++ b/arch/um/include/sysdep-x86_64/tls.h
@@ -0,0 +1,29 @@
+#ifndef _SYSDEP_TLS_H
+#define _SYSDEP_TLS_H
+
+# ifndef __KERNEL__
+
+/* Change name to avoid conflicts with the original one from <asm/ldt.h>, which
+ * may be named user_desc (but in 2.4 and in header matching its API was named
+ * modify_ldt_ldt_s). */
+
+typedef struct um_dup_user_desc {
+        unsigned int  entry_number;
+        unsigned int  base_addr;
+        unsigned int  limit;
+        unsigned int  seg_32bit:1;
+        unsigned int  contents:2;
+        unsigned int  read_exec_only:1;
+        unsigned int  limit_in_pages:1;
+        unsigned int  seg_not_present:1;
+        unsigned int  useable:1;
+        unsigned int  lm:1;
+} user_desc_t;
+
+# else /* __KERNEL__ */
+
+#  include <asm/ldt.h>
+typedef struct user_desc user_desc_t;
+
+# endif /* __KERNEL__ */
+#endif /* _SYSDEP_TLS_H */
diff --git a/arch/um/include/user_util.h b/arch/um/include/user_util.h
index 992a7e1e0fca..fe0c29b5144d 100644
--- a/arch/um/include/user_util.h
+++ b/arch/um/include/user_util.h
@@ -8,6 +8,9 @@
 
 #include "sysdep/ptrace.h"
 
+/* Copied from kernel.h */
+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+
 #define CATCH_EINTR(expr) while ((errno = 0, ((expr) < 0)) && (errno == EINTR))
 
 extern int mode_tt;
@@ -31,7 +34,7 @@ extern unsigned long uml_physmem;
 extern unsigned long uml_reserved;
 extern unsigned long end_vm;
 extern unsigned long start_vm;
-extern unsigned long highmem;
+extern unsigned long long highmem;
 
 extern char host_info[];
 
diff --git a/arch/um/kernel/exec_kern.c b/arch/um/kernel/exec_kern.c
index 1ca84319317d..c0cb627bf594 100644
--- a/arch/um/kernel/exec_kern.c
+++ b/arch/um/kernel/exec_kern.c
@@ -22,6 +22,7 @@
 
 void flush_thread(void)
 {
+        arch_flush_thread(&current->thread.arch);
         CHOOSE_MODE(flush_thread_tt(), flush_thread_skas());
 }
 
@@ -58,14 +59,14 @@ long um_execve(char *file, char __user *__user *argv, char __user *__user *env)
         return(err);
 }
 
-long sys_execve(char *file, char __user *__user *argv,
+long sys_execve(char __user *file, char __user *__user *argv,
                 char __user *__user *env)
 {
         long error;
         char *filename;
 
         lock_kernel();
-        filename = getname((char __user *) file);
+        filename = getname(file);
         error = PTR_ERR(filename);
         if (IS_ERR(filename)) goto out;
         error = execve1(filename, argv, env);
@@ -74,14 +75,3 @@ long sys_execve(char *file, char __user *__user *argv,
         unlock_kernel();
         return(error);
 }
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/kernel/mem.c b/arch/um/kernel/mem.c
index 92cce96b5e24..44e41a35f000 100644
--- a/arch/um/kernel/mem.c
+++ b/arch/um/kernel/mem.c
@@ -30,7 +30,7 @@ extern char __binary_start;
 unsigned long *empty_zero_page = NULL;
 unsigned long *empty_bad_page = NULL;
 pgd_t swapper_pg_dir[PTRS_PER_PGD];
-unsigned long highmem;
+unsigned long long highmem;
 int kmalloc_ok = 0;
 
 static unsigned long brk_end;
diff --git a/arch/um/kernel/process_kern.c b/arch/um/kernel/process_kern.c
index 3113cab8675e..f6a5a502120b 100644
--- a/arch/um/kernel/process_kern.c
+++ b/arch/um/kernel/process_kern.c
@@ -156,9 +156,25 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
                 unsigned long stack_top, struct task_struct * p, 
                 struct pt_regs *regs)
 {
+        int ret;
+
         p->thread = (struct thread_struct) INIT_THREAD;
-        return(CHOOSE_MODE_PROC(copy_thread_tt, copy_thread_skas, nr, 
-                                clone_flags, sp, stack_top, p, regs));
+        ret = CHOOSE_MODE_PROC(copy_thread_tt, copy_thread_skas, nr,
+                                clone_flags, sp, stack_top, p, regs);
+
+        if (ret || !current->thread.forking)
+                goto out;
+
+        clear_flushed_tls(p);
+
+        /*
+         * Set a new TLS for the child thread?
+         */
+        if (clone_flags & CLONE_SETTLS)
+                ret = arch_copy_tls(p);
+
+out:
+        return ret;
 }
 
 void initial_thread_cb(void (*proc)(void *), void *arg)
@@ -185,10 +201,6 @@ void default_idle(void)
 {
         CHOOSE_MODE(uml_idle_timer(), (void) 0);
 
-        atomic_inc(&init_mm.mm_count);
-        current->mm = &init_mm;
-        current->active_mm = &init_mm;
-
         while(1){
                 /* endless idle loop with no priority at all */
 
@@ -407,7 +419,7 @@ static int proc_read_sysemu(char *buf, char **start, off_t offset, int size,int
         return strlen(buf);
 }
 
-static int proc_write_sysemu(struct file *file,const char *buf, unsigned long count,void *data)
+static int proc_write_sysemu(struct file *file,const char __user *buf, unsigned long count,void *data)
 {
         char tmp[2];
 
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 98e09395c093..60d2eda995c1 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -46,6 +46,7 @@ extern int poke_user(struct task_struct * child, long addr, long data);
 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 {
         int i, ret;
+        unsigned long __user *p = (void __user *)(unsigned long)data;
 
         switch (request) {
                 /* when I and D space are separate, these will need to be fixed. */
@@ -58,7 +59,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                 copied = access_process_vm(child, addr, &tmp, sizeof(tmp), 0);
                 if (copied != sizeof(tmp))
                         break;
-                ret = put_user(tmp, (unsigned long __user *) data);
+                ret = put_user(tmp, p);
                 break;
         }
 
@@ -136,15 +137,13 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 
 #ifdef PTRACE_GETREGS
         case PTRACE_GETREGS: { /* Get all gp regs from the child. */
-                if (!access_ok(VERIFY_WRITE, (unsigned long *)data, 
-                               MAX_REG_OFFSET)) {
+                if (!access_ok(VERIFY_WRITE, p, MAX_REG_OFFSET)) {
                         ret = -EIO;
                         break;
                 }
                 for ( i = 0; i < MAX_REG_OFFSET; i += sizeof(long) ) {
-                        __put_user(getreg(child, i),
-                                   (unsigned long __user *) data);
-                        data += sizeof(long);
+                        __put_user(getreg(child, i), p);
+                        p++;
                 }
                 ret = 0;
                 break;
@@ -153,15 +152,14 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 #ifdef PTRACE_SETREGS
         case PTRACE_SETREGS: { /* Set all gp regs in the child. */
                 unsigned long tmp = 0;
-                if (!access_ok(VERIFY_READ, (unsigned *)data, 
-                               MAX_REG_OFFSET)) {
+                if (!access_ok(VERIFY_READ, p, MAX_REG_OFFSET)) {
                         ret = -EIO;
                         break;
                 }
                 for ( i = 0; i < MAX_REG_OFFSET; i += sizeof(long) ) {
-                        __get_user(tmp, (unsigned long __user *) data);
+                        __get_user(tmp, p);
                         putreg(child, i, tmp);
-                        data += sizeof(long);
+                        p++;
                 }
                 ret = 0;
                 break;
@@ -187,14 +185,23 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                 ret = set_fpxregs(data, child);
                 break;
 #endif
+        case PTRACE_GET_THREAD_AREA:
+                ret = ptrace_get_thread_area(child, addr,
+                                             (struct user_desc __user *) data);
+                break;
+
+        case PTRACE_SET_THREAD_AREA:
+                ret = ptrace_set_thread_area(child, addr,
+                                             (struct user_desc __user *) data);
+                break;
+
         case PTRACE_FAULTINFO: {
-                /* Take the info from thread->arch->faultinfo,
-                 * but transfer max. sizeof(struct ptrace_faultinfo).
-                 * On i386, ptrace_faultinfo is smaller!
-                 */
-                ret = copy_to_user((unsigned long __user *) data,
-                                   &child->thread.arch.faultinfo,
-                                   sizeof(struct ptrace_faultinfo));
+                /* Take the info from thread->arch->faultinfo,
+                 * but transfer max. sizeof(struct ptrace_faultinfo).
+                 * On i386, ptrace_faultinfo is smaller!
+                 */
+                ret = copy_to_user(p, &child->thread.arch.faultinfo,
+                                   sizeof(struct ptrace_faultinfo));
                 if(ret)
                         break;
                 break;
@@ -204,8 +211,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
         case PTRACE_LDT: {
                 struct ptrace_ldt ldt;
 
-                if(copy_from_user(&ldt, (unsigned long __user *) data,
-                                  sizeof(ldt))){
+                if(copy_from_user(&ldt, p, sizeof(ldt))){
                         ret = -EIO;
                         break;
                 }
diff --git a/arch/um/kernel/skas/process_kern.c b/arch/um/kernel/skas/process_kern.c
index 3f70a2e12f06..2135eaf98a93 100644
--- a/arch/um/kernel/skas/process_kern.c
+++ b/arch/um/kernel/skas/process_kern.c
@@ -35,6 +35,8 @@ void switch_to_skas(void *prev, void *next)
         switch_threads(&from->thread.mode.skas.switch_buf,
                        to->thread.mode.skas.switch_buf);
 
+        arch_switch_to_skas(current->thread.prev_sched, current);
+
         if(current->pid == 0)
                 switch_timers(1);
 }
@@ -89,10 +91,17 @@ void fork_handler(int sig)
                 panic("blech");
 
         schedule_tail(current->thread.prev_sched);
+
+        /* XXX: if interrupt_end() calls schedule, this call to
+         * arch_switch_to_skas isn't needed. We could want to apply this to
+         * improve performance. -bb */
+        arch_switch_to_skas(current->thread.prev_sched, current);
+
         current->thread.prev_sched = NULL;
 
 /* Handle any immediate reschedules or signals */
         interrupt_end();
+
         userspace(&current->thread.regs.regs);
 }
 
@@ -109,6 +118,8 @@ int copy_thread_skas(int nr, unsigned long clone_flags, unsigned long sp,
                 if(sp != 0) REGS_SP(p->thread.regs.regs.skas.regs) = sp;
 
                 handler = fork_handler;
+
+                arch_copy_thread(&current->thread.arch, &p->thread.arch);
         }
         else {
                 init_thread_registers(&p->thread.regs.regs);
diff --git a/arch/um/kernel/syscall_kern.c b/arch/um/kernel/syscall_kern.c
index 8e1a3501ff46..37d3978337d8 100644
--- a/arch/um/kernel/syscall_kern.c
+++ b/arch/um/kernel/syscall_kern.c
@@ -104,7 +104,7 @@ long sys_pipe(unsigned long __user * fildes)
 }
 
 
-long sys_uname(struct old_utsname * name)
+long sys_uname(struct old_utsname __user * name)
 {
         long err;
         if (!name)
@@ -115,7 +115,7 @@ long sys_uname(struct old_utsname * name)
         return err?-EFAULT:0;
 }
 
-long sys_olduname(struct oldold_utsname * name)
+long sys_olduname(struct oldold_utsname __user * name)
 {
         long error;
 
diff --git a/arch/um/kernel/trap_kern.c b/arch/um/kernel/trap_kern.c
index d56046c2aba2..02f6d4d8dc3a 100644
--- a/arch/um/kernel/trap_kern.c
+++ b/arch/um/kernel/trap_kern.c
@@ -198,7 +198,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, void *sc)
                 si.si_signo = SIGBUS;
                 si.si_errno = 0;
                 si.si_code = BUS_ADRERR;
-                si.si_addr = (void *)address;
+                si.si_addr = (void __user *)address;
                 current->thread.arch.faultinfo = fi;
                 force_sig_info(SIGBUS, &si, current);
         } else if (err == -ENOMEM) {
@@ -207,7 +207,7 @@ unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, void *sc)
         } else {
                 BUG_ON(err != -EFAULT);
                 si.si_signo = SIGSEGV;
-                si.si_addr = (void *) address;
+                si.si_addr = (void __user *) address;
                 current->thread.arch.faultinfo = fi;
                 force_sig_info(SIGSEGV, &si, current);
         }
@@ -220,8 +220,8 @@ void bad_segv(struct faultinfo fi, unsigned long ip)
 
         si.si_signo = SIGSEGV;
         si.si_code = SEGV_ACCERR;
-        si.si_addr = (void *) FAULT_ADDRESS(fi);
-        current->thread.arch.faultinfo = fi;
+        si.si_addr = (void __user *) FAULT_ADDRESS(fi);
+        current->thread.arch.faultinfo = fi;
         force_sig_info(SIGSEGV, &si, current);
 }
 
diff --git a/arch/um/kernel/tt/process_kern.c b/arch/um/kernel/tt/process_kern.c
index 295c1ac817b3..a9c1443fc548 100644
--- a/arch/um/kernel/tt/process_kern.c
+++ b/arch/um/kernel/tt/process_kern.c
@@ -51,6 +51,13 @@ void switch_to_tt(void *prev, void *next)
 
         c = 0;
 
+        /* Notice that here we "up" the semaphore on which "to" is waiting, and
+         * below (the read) we wait on this semaphore (which is implemented by
+         * switch_pipe) and go sleeping. Thus, after that, we have resumed in
+         * "to", and can't use any more the value of "from" (which is outdated),
+         * nor the value in "to" (since it was the task which stole us the CPU,
+         * which we don't care about). */
+
         err = os_write_file(to->thread.mode.tt.switch_pipe[1], &c, sizeof(c));
         if(err != sizeof(c))
                 panic("write of switch_pipe failed, err = %d", -err);
@@ -77,7 +84,7 @@ void switch_to_tt(void *prev, void *next)
         change_sig(SIGALRM, alrm);
         change_sig(SIGPROF, prof);
 
-        arch_switch();
+        arch_switch_to_tt(prev_sched, current);
 
         flush_tlb_all();
         local_irq_restore(flags);
@@ -141,7 +148,6 @@ static void new_thread_handler(int sig)
         set_cmdline("(kernel thread)");
 
         change_sig(SIGUSR1, 1);
-        change_sig(SIGVTALRM, 1);
         change_sig(SIGPROF, 1);
         local_irq_enable();
         if(!run_kernel_thread(fn, arg, &current->thread.exec_buf))
diff --git a/arch/um/os-Linux/Makefile b/arch/um/os-Linux/Makefile
index 1659386b42bb..f4bfc4c7ccac 100644
--- a/arch/um/os-Linux/Makefile
+++ b/arch/um/os-Linux/Makefile
@@ -4,7 +4,7 @@
 #
 
 obj-y = aio.o elf_aux.o file.o helper.o irq.o main.o mem.o process.o sigio.o \
-        signal.o start_up.o time.o trap.o tt.o tty.o uaccess.o umid.o \
+        signal.o start_up.o time.o trap.o tt.o tty.o uaccess.o umid.o tls.o \
         user_syms.o util.o drivers/ sys-$(SUBARCH)/
 
 obj-$(CONFIG_MODE_SKAS) += skas/
@@ -12,12 +12,9 @@ obj-$(CONFIG_TTY_LOG) += tty_log.o
 user-objs-$(CONFIG_TTY_LOG) += tty_log.o
 
 USER_OBJS := $(user-objs-y) aio.o elf_aux.o file.o helper.o irq.o main.o mem.o \
-        process.o sigio.o signal.o start_up.o time.o trap.o tt.o tty.o \
+        process.o sigio.o signal.o start_up.o time.o trap.o tt.o tty.o tls.o \
         uaccess.o umid.o util.o
 
-elf_aux.o: $(ARCH_DIR)/kernel-offsets.h
-CFLAGS_elf_aux.o += -I$(objtree)/arch/um
-
 CFLAGS_user_syms.o += -DSUBARCH_$(SUBARCH)
 
 HAVE_AIO_ABI := $(shell [ -r /usr/include/linux/aio_abi.h ] && \
diff --git a/arch/um/os-Linux/drivers/ethertap_kern.c b/arch/um/os-Linux/drivers/ethertap_kern.c
index 6ae4b19d9f50..768606bec233 100644
--- a/arch/um/os-Linux/drivers/ethertap_kern.c
+++ b/arch/um/os-Linux/drivers/ethertap_kern.c
@@ -102,18 +102,7 @@ static struct transport ethertap_transport = {
 static int register_ethertap(void)
 {
         register_transport(&ethertap_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_ethertap);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/os-Linux/drivers/tuntap_kern.c b/arch/um/os-Linux/drivers/tuntap_kern.c
index 4202b9ebad4c..190009a6f89c 100644
--- a/arch/um/os-Linux/drivers/tuntap_kern.c
+++ b/arch/um/os-Linux/drivers/tuntap_kern.c
@@ -87,18 +87,7 @@ static struct transport tuntap_transport = {
 static int register_tuntap(void)
 {
         register_transport(&tuntap_transport);
-        return(1);
+        return 0;
 }
 
 __initcall(register_tuntap);
-
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
index 9d7d69a523bb..6ab372da9657 100644
--- a/arch/um/os-Linux/mem.c
+++ b/arch/um/os-Linux/mem.c
@@ -121,36 +121,11 @@ int create_tmp_file(unsigned long long len)
         return(fd);
 }
 
-static int create_anon_file(unsigned long long len)
-{
-        void *addr;
-        int fd;
-
-        fd = open("/dev/anon", O_RDWR);
-        if(fd < 0) {
-                perror("opening /dev/anon");
-                exit(1);
-        }
-
-        addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
-        if(addr == MAP_FAILED){
-                perror("mapping physmem file");
-                exit(1);
-        }
-        munmap(addr, len);
-
-        return(fd);
-}
-
-extern int have_devanon;
-
 int create_mem_file(unsigned long long len)
 {
         int err, fd;
 
-        if(have_devanon)
-                fd = create_anon_file(len);
-        else fd = create_tmp_file(len);
+        fd = create_tmp_file(len);
 
         err = os_set_exec_close(fd, 1);
         if(err < 0){
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index d261888f39c4..8176b0b52047 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -11,6 +11,7 @@
 #include <linux/unistd.h>
 #include <sys/mman.h>
 #include <sys/wait.h>
+#include <sys/mman.h>
 #include "ptrace_user.h"
 #include "os.h"
 #include "user.h"
@@ -20,6 +21,7 @@
 #include "kern_util.h"
 #include "longjmp.h"
 #include "skas_ptrace.h"
+#include "kern_constants.h"
 
 #define ARBITRARY_ADDR -1
 #define FAILURE_PID    -1
@@ -187,6 +189,48 @@ int os_unmap_memory(void *addr, int len)
         return(0);
 }
 
+#ifndef MADV_REMOVE
+#define MADV_REMOVE     0x5             /* remove these pages & resources */
+#endif
+
+int os_drop_memory(void *addr, int length)
+{
+        int err;
+
+        err = madvise(addr, length, MADV_REMOVE);
+        if(err < 0)
+                err = -errno;
+        return err;
+}
+
+int can_drop_memory(void)
+{
+        void *addr;
+        int fd;
+
+        printk("Checking host MADV_REMOVE support...");
+        fd = create_mem_file(UM_KERN_PAGE_SIZE);
+        if(fd < 0){
+                printk("Creating test memory file failed, err = %d\n", -fd);
+                return 0;
+        }
+
+        addr = mmap64(NULL, UM_KERN_PAGE_SIZE, PROT_READ | PROT_WRITE,
+                      MAP_PRIVATE, fd, 0);
+        if(addr == MAP_FAILED){
+                printk("Mapping test memory file failed, err = %d\n", -errno);
+                return 0;
+        }
+
+        if(madvise(addr, UM_KERN_PAGE_SIZE, MADV_REMOVE) != 0){
+                printk("MADV_REMOVE failed, err = %d\n", -errno);
+                return 0;
+        }
+
+        printk("OK\n");
+        return 1;
+}
+
 void init_new_thread_stack(void *sig_stack, void (*usr1_handler)(int))
 {
         int flags = 0, pages;
diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c
index 32753131f8d8..387e26af301a 100644
--- a/arch/um/os-Linux/start_up.c
+++ b/arch/um/os-Linux/start_up.c
@@ -470,25 +470,6 @@ int can_do_skas(void)
 }
 #endif
 
-int have_devanon = 0;
-
-/* Runs on boot kernel stack - already safe to use printk. */
-
-void check_devanon(void)
-{
-        int fd;
-
-        printk("Checking for /dev/anon on the host...");
-        fd = open("/dev/anon", O_RDWR);
-        if(fd < 0){
-                printk("Not available (open failed with errno %d)\n", errno);
-                return;
-        }
-
-        printk("OK\n");
-        have_devanon = 1;
-}
-
 int __init parse_iomem(char *str, int *add)
 {
         struct iomem_region *new;
@@ -664,6 +645,5 @@ void os_check_bugs(void)
 {
         check_ptrace();
         check_sigio();
-        check_devanon();
 }
 
diff --git a/arch/um/os-Linux/sys-i386/Makefile b/arch/um/os-Linux/sys-i386/Makefile
index 340ef26f5944..b3213613c41c 100644
--- a/arch/um/os-Linux/sys-i386/Makefile
+++ b/arch/um/os-Linux/sys-i386/Makefile
@@ -3,7 +3,7 @@
 # Licensed under the GPL
 #
 
-obj-$(CONFIG_MODE_SKAS) = registers.o
+obj-$(CONFIG_MODE_SKAS) = registers.o tls.o
 
 USER_OBJS := $(obj-y)
 
diff --git a/arch/um/os-Linux/sys-i386/tls.c b/arch/um/os-Linux/sys-i386/tls.c
new file mode 100644
index 000000000000..ba21f0e04a2f
--- /dev/null
+++ b/arch/um/os-Linux/sys-i386/tls.c
@@ -0,0 +1,33 @@
+#include <linux/unistd.h>
+#include "sysdep/tls.h"
+#include "user_util.h"
+
+static _syscall1(int, get_thread_area, user_desc_t *, u_info);
+
+/* Checks whether host supports TLS, and sets *tls_min according to the value
+ * valid on the host.
+ * i386 host have it == 6; x86_64 host have it == 12, for i386 emulation. */
+void check_host_supports_tls(int *supports_tls, int *tls_min) {
+        /* Values for x86 and x86_64.*/
+        int val[] = {GDT_ENTRY_TLS_MIN_I386, GDT_ENTRY_TLS_MIN_X86_64};
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(val); i++) {
+                user_desc_t info;
+                info.entry_number = val[i];
+
+                if (get_thread_area(&info) == 0) {
+                        *tls_min = val[i];
+                        *supports_tls = 1;
+                        return;
+                } else {
+                        if (errno == EINVAL)
+                                continue;
+                        else if (errno == ENOSYS)
+                                *supports_tls = 0;
+                                return;
+                }
+        }
+
+        *supports_tls = 0;
+}
diff --git a/arch/um/os-Linux/tls.c b/arch/um/os-Linux/tls.c
new file mode 100644
index 000000000000..9cb09a45546b
--- /dev/null
+++ b/arch/um/os-Linux/tls.c
@@ -0,0 +1,76 @@
+#include <errno.h>
+#include <sys/ptrace.h>
+#include <asm/ldt.h>
+#include "sysdep/tls.h"
+#include "uml-config.h"
+
+/* TLS support - we basically rely on the host's one.*/
+
+/* In TT mode, this should be called only by the tracing thread, and makes sense
+ * only for PTRACE_SET_THREAD_AREA. In SKAS mode, it's used normally.
+ *
+ */
+
+#ifndef PTRACE_GET_THREAD_AREA
+#define PTRACE_GET_THREAD_AREA 25
+#endif
+
+#ifndef PTRACE_SET_THREAD_AREA
+#define PTRACE_SET_THREAD_AREA 26
+#endif
+
+int os_set_thread_area(user_desc_t *info, int pid)
+{
+        int ret;
+
+        ret = ptrace(PTRACE_SET_THREAD_AREA, pid, info->entry_number,
+                     (unsigned long) info);
+        if (ret < 0)
+                ret = -errno;
+        return ret;
+}
+
+#ifdef UML_CONFIG_MODE_SKAS
+
+int os_get_thread_area(user_desc_t *info, int pid)
+{
+        int ret;
+
+        ret = ptrace(PTRACE_GET_THREAD_AREA, pid, info->entry_number,
+                     (unsigned long) info);
+        if (ret < 0)
+                ret = -errno;
+        return ret;
+}
+
+#endif
+
+#ifdef UML_CONFIG_MODE_TT
+#include "linux/unistd.h"
+
+static _syscall1(int, get_thread_area, user_desc_t *, u_info);
+static _syscall1(int, set_thread_area, user_desc_t *, u_info);
+
+int do_set_thread_area_tt(user_desc_t *info)
+{
+        int ret;
+
+        ret = set_thread_area(info);
+        if (ret < 0) {
+                ret = -errno;
+        }
+        return ret;
+}
+
+int do_get_thread_area_tt(user_desc_t *info)
+{
+        int ret;
+
+        ret = get_thread_area(info);
+        if (ret < 0) {
+                ret = -errno;
+        }
+        return ret;
+}
+
+#endif /* UML_CONFIG_MODE_TT */
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index 2e41cabd3d93..b696b451774c 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -20,25 +20,7 @@ define unprofile
         $(patsubst -pg,,$(patsubst -fprofile-arcs -ftest-coverage,,$(1)))
 endef
 
-
-# cmd_make_link checks to see if the $(foo-dir) variable starts with a /.  If
-# so, it's considered to be a path relative to $(srcdir) rather than
-# $(srcdir)/arch/$(SUBARCH).  This is because x86_64 wants to get ldt.c from
-# arch/um/sys-i386 rather than arch/i386 like the other borrowed files.  So,
-# it sets $(ldt.c-dir) to /arch/um/sys-i386.
-quiet_cmd_make_link = SYMLINK $@
-cmd_make_link       = rm -f $@; ln -sf $(srctree)$(if $(filter-out /%,$($(notdir $@)-dir)),/arch/$(SUBARCH))/$($(notdir $@)-dir)/$(notdir $@) $@
-
-# this needs to be before the foreach, because targets does not accept
-# complete paths like $(obj)/$(f). To make sure this works, use a := assignment
-# or we will get $(obj)/$(f) in the "targets" value.
-# Also, this forces you to use the := syntax when assigning to targets.
-# Otherwise the line below will cause an infinite loop (if you don't know why,
-# just do it).
-
-targets := $(targets) $(SYMLINKS)
-
-SYMLINKS := $(foreach f,$(SYMLINKS),$(obj)/$(f))
-
-$(SYMLINKS): FORCE
-        $(call if_changed,make_link)
+ifdef subarch-obj-y
+obj-y += subarch.o
+subarch-y = $(addprefix ../../$(SUBARCH)/,$(subarch-obj-y))
+endif
diff --git a/arch/um/scripts/Makefile.unmap b/arch/um/scripts/Makefile.unmap
deleted file mode 100644
index b2165188d942..000000000000
--- a/arch/um/scripts/Makefile.unmap
+++ /dev/null
@@ -1,22 +0,0 @@
-clean-files += unmap_tmp.o unmap_fin.o unmap.o
-
-ifdef CONFIG_MODE_TT
-
-#Always build unmap_fin.o
-extra-y += unmap_fin.o
-#Do dependency tracking for unmap.o (it will be always built, but won't get the tracking unless we use this).
-targets += unmap.o
-
-#XXX: partially copied from arch/um/scripts/Makefile.rules
-$(obj)/unmap.o: _c_flags = $(call unprofile,$(CFLAGS))
-
-quiet_cmd_wrapld = LD      $@
-define cmd_wrapld
-        $(LD) $(LDFLAGS) -r -o $(obj)/unmap_tmp.o $< ; \
-        $(OBJCOPY) $(UML_OBJCOPYFLAGS) $(obj)/unmap_tmp.o $@ -G switcheroo
-endef
-
-$(obj)/unmap_fin.o : $(obj)/unmap.o FORCE
-        $(call if_changed,wrapld)
-
-endif
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index f5fd5b0156d0..98b20b7bba4f 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -1,23 +1,18 @@
-obj-y := bitops.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
-        ptrace_user.o semaphore.o signal.o sigcontext.o syscalls.o sysrq.o \
-        sys_call_table.o
+obj-y = bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
+        ptrace_user.o signal.o sigcontext.o syscalls.o sysrq.o \
+        sys_call_table.o tls.o
 
 obj-$(CONFIG_MODE_SKAS) += stub.o stub_segv.o
 
-obj-$(CONFIG_HIGHMEM) += highmem.o
-obj-$(CONFIG_MODULES) += module.o
+subarch-obj-y = lib/bitops.o kernel/semaphore.o
+subarch-obj-$(CONFIG_HIGHMEM) += mm/highmem.o
+subarch-obj-$(CONFIG_MODULES) += kernel/module.o
 
 USER_OBJS := bugs.o ptrace_user.o sigcontext.o fault.o stub_segv.o
 
-SYMLINKS = bitops.c semaphore.c highmem.c module.c
-
 include arch/um/scripts/Makefile.rules
 
-bitops.c-dir = lib
-semaphore.c-dir = kernel
-highmem.c-dir = mm
-module.c-dir = kernel
-
-$(obj)/stub_segv.o : _c_flags = $(call unprofile,$(CFLAGS))
+extra-$(CONFIG_MODE_TT) += unmap.o
 
-include arch/um/scripts/Makefile.unmap
+$(obj)/stub_segv.o $(obj)/unmap.o: \
+        _c_flags = $(call unprofile,$(CFLAGS))
diff --git a/arch/um/sys-i386/ptrace.c b/arch/um/sys-i386/ptrace.c
index 8032a105949a..6028bc7cc01b 100644
--- a/arch/um/sys-i386/ptrace.c
+++ b/arch/um/sys-i386/ptrace.c
@@ -15,9 +15,22 @@
 #include "sysdep/sigcontext.h"
 #include "sysdep/sc.h"
 
-void arch_switch(void)
+void arch_switch_to_tt(struct task_struct *from, struct task_struct *to)
 {
-        update_debugregs(current->thread.arch.debugregs_seq);
+        update_debugregs(to->thread.arch.debugregs_seq);
+        arch_switch_tls_tt(from, to);
+}
+
+void arch_switch_to_skas(struct task_struct *from, struct task_struct *to)
+{
+        int err = arch_switch_tls_skas(from, to);
+        if (!err)
+                return;
+
+        if (err != -EINVAL)
+                printk(KERN_WARNING "arch_switch_tls_skas failed, errno %d, not EINVAL\n", -err);
+        else
+                printk(KERN_WARNING "arch_switch_tls_skas failed, errno = EINVAL\n");
 }
 
 int is_syscall(unsigned long addr)
@@ -124,22 +137,22 @@ unsigned long getreg(struct task_struct *child, int regno)
 int peek_user(struct task_struct *child, long addr, long data)
 {
 /* read the word at location addr in the USER area. */
-        unsigned long tmp;
+        unsigned long tmp;
 
-        if ((addr & 3) || addr < 0)
-                return -EIO;
+        if ((addr & 3) || addr < 0)
+                return -EIO;
 
-        tmp = 0;  /* Default return condition */
-        if(addr < MAX_REG_OFFSET){
-                tmp = getreg(child, addr);
-        }
-        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
-                (addr <= offsetof(struct user, u_debugreg[7]))){
-                addr -= offsetof(struct user, u_debugreg[0]);
-                addr = addr >> 2;
-                tmp = child->thread.arch.debugregs[addr];
-        }
-        return put_user(tmp, (unsigned long *) data);
+        tmp = 0;  /* Default return condition */
+        if(addr < MAX_REG_OFFSET){
+                tmp = getreg(child, addr);
+        }
+        else if((addr >= offsetof(struct user, u_debugreg[0])) &&
+                (addr <= offsetof(struct user, u_debugreg[7]))){
+                addr -= offsetof(struct user, u_debugreg[0]);
+                addr = addr >> 2;
+                tmp = child->thread.arch.debugregs[addr];
+        }
+        return put_user(tmp, (unsigned long __user *) data);
 }
 
 struct i387_fxsave_struct {
diff --git a/arch/um/sys-i386/ptrace_user.c b/arch/um/sys-i386/ptrace_user.c
index 7c376c95de50..9f3bd8ed78f5 100644
--- a/arch/um/sys-i386/ptrace_user.c
+++ b/arch/um/sys-i386/ptrace_user.c
@@ -14,6 +14,7 @@
 #include "sysdep/thread.h"
 #include "user.h"
 #include "os.h"
+#include "uml-config.h"
 
 int ptrace_getregs(long pid, unsigned long *regs_out)
 {
@@ -43,6 +44,7 @@ int ptrace_setfpregs(long pid, unsigned long *regs)
         return 0;
 }
 
+/* All the below stuff is of interest for TT mode only */
 static void write_debugregs(int pid, unsigned long *regs)
 {
         struct user *dummy;
@@ -75,7 +77,6 @@ static void read_debugregs(int pid, unsigned long *regs)
 
 /* Accessed only by the tracing thread */
 static unsigned long kernel_debugregs[8] = { [ 0 ... 7 ] = 0 };
-static int debugregs_seq = 0;
 
 void arch_enter_kernel(void *task, int pid)
 {
@@ -89,6 +90,11 @@ void arch_leave_kernel(void *task, int pid)
         write_debugregs(pid, TASK_DEBUGREGS(task));
 }
 
+#ifdef UML_CONFIG_PT_PROXY
+/* Accessed only by the tracing thread */
+static int debugregs_seq;
+
+/* Only called by the ptrace proxy */
 void ptrace_pokeuser(unsigned long addr, unsigned long data)
 {
         if((addr < offsetof(struct user, u_debugreg[0])) ||
@@ -109,6 +115,7 @@ static void update_debugregs_cb(void *arg)
         write_debugregs(pid, kernel_debugregs);
 }
 
+/* Optimized out in its header when not defined */
 void update_debugregs(int seq)
 {
         int me;
@@ -118,6 +125,7 @@ void update_debugregs(int seq)
         me = os_getpid();
         initial_thread_cb(update_debugregs_cb, &me);
 }
+#endif
 
 /*
  * Overrides for Emacs so that we follow Linus's tabbing style.
diff --git a/arch/um/sys-i386/signal.c b/arch/um/sys-i386/signal.c
index 33a40f5ef0d2..f5d0e1c37ea2 100644
--- a/arch/um/sys-i386/signal.c
+++ b/arch/um/sys-i386/signal.c
@@ -19,7 +19,7 @@
 #include "skas.h"
 
 static int copy_sc_from_user_skas(struct pt_regs *regs,
-                                  struct sigcontext *from)
+                                  struct sigcontext __user *from)
 {
         struct sigcontext sc;
         unsigned long fpregs[HOST_FP_SIZE];
@@ -57,7 +57,7 @@ static int copy_sc_from_user_skas(struct pt_regs *regs,
         return(0);
 }
 
-int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
+int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate __user *to_fp,
                          struct pt_regs *regs, unsigned long sp)
 {
         struct sigcontext sc;
@@ -92,7 +92,7 @@ int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
                        "errno = %d\n", err);
                 return(1);
         }
-        to_fp = (to_fp ? to_fp : (struct _fpstate *) (to + 1));
+        to_fp = (to_fp ? to_fp : (struct _fpstate __user *) (to + 1));
         sc.fpstate = to_fp;
 
         if(err)
@@ -113,10 +113,11 @@ int copy_sc_to_user_skas(struct sigcontext *to, struct _fpstate *to_fp,
  * saved pointer is in the kernel, but the sigcontext is in userspace, so we
  * copy_to_user it.
  */
-int copy_sc_from_user_tt(struct sigcontext *to, struct sigcontext *from,
+int copy_sc_from_user_tt(struct sigcontext *to, struct sigcontext __user *from,
                          int fpsize)
 {
-        struct _fpstate *to_fp, *from_fp;
+        struct _fpstate *to_fp;
+        struct _fpstate __user *from_fp;
         unsigned long sigs;
         int err;
 
@@ -131,13 +132,14 @@ int copy_sc_from_user_tt(struct sigcontext *to, struct sigcontext *from,
         return(err);
 }
 
-int copy_sc_to_user_tt(struct sigcontext *to, struct _fpstate *fp,
+int copy_sc_to_user_tt(struct sigcontext *to, struct _fpstate __user *fp,
                        struct sigcontext *from, int fpsize, unsigned long sp)
 {
-        struct _fpstate *to_fp, *from_fp;
+        struct _fpstate __user *to_fp;
+        struct _fpstate *from_fp;
         int err;
 
-        to_fp = (fp ? fp : (struct _fpstate *) (to + 1));
+        to_fp = (fp ? fp : (struct _fpstate __user *) (to + 1));
         from_fp = from->fpstate;
         err = copy_to_user(to, from, sizeof(*to));
 
@@ -165,7 +167,7 @@ static int copy_sc_from_user(struct pt_regs *to, void __user *from)
         return(ret);
 }
 
-static int copy_sc_to_user(struct sigcontext *to, struct _fpstate *fp,
+static int copy_sc_to_user(struct sigcontext *to, struct _fpstate __user *fp,
                            struct pt_regs *from, unsigned long sp)
 {
         return(CHOOSE_MODE(copy_sc_to_user_tt(to, fp, UPT_SC(&from->regs),
@@ -173,7 +175,7 @@ static int copy_sc_to_user(struct sigcontext *to, struct _fpstate *fp,
                            copy_sc_to_user_skas(to, fp, from, sp)));
 }
 
-static int copy_ucontext_to_user(struct ucontext *uc, struct _fpstate *fp,
+static int copy_ucontext_to_user(struct ucontext __user *uc, struct _fpstate __user *fp,
                                  sigset_t *set, unsigned long sp)
 {
         int err = 0;
@@ -188,7 +190,7 @@ static int copy_ucontext_to_user(struct ucontext *uc, struct _fpstate *fp,
 
 struct sigframe
 {
-        char *pretcode;
+        char __user *pretcode;
         int sig;
         struct sigcontext sc;
         struct _fpstate fpstate;
@@ -198,10 +200,10 @@ struct sigframe
 
 struct rt_sigframe
 {
-        char *pretcode;
+        char __user *pretcode;
         int sig;
-        struct siginfo *pinfo;
-        void *puc;
+        struct siginfo __user *pinfo;
+        void __user *puc;
         struct siginfo info;
         struct ucontext uc;
         struct _fpstate fpstate;
@@ -213,16 +215,16 @@ int setup_signal_stack_sc(unsigned long stack_top, int sig,
                           sigset_t *mask)
 {
         struct sigframe __user *frame;
-        void *restorer;
+        void __user *restorer;
         unsigned long save_sp = PT_REGS_SP(regs);
         int err = 0;
 
         stack_top &= -8UL;
-        frame = (struct sigframe *) stack_top - 1;
+        frame = (struct sigframe __user *) stack_top - 1;
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                 return 1;
 
-        restorer = (void *) frame->retcode;
+        restorer = frame->retcode;
         if(ka->sa.sa_flags & SA_RESTORER)
                 restorer = ka->sa.sa_restorer;
 
@@ -278,16 +280,16 @@ int setup_signal_stack_si(unsigned long stack_top, int sig,
                           siginfo_t *info, sigset_t *mask)
 {
         struct rt_sigframe __user *frame;
-        void *restorer;
+        void __user *restorer;
         unsigned long save_sp = PT_REGS_SP(regs);
         int err = 0;
 
         stack_top &= -8UL;
-        frame = (struct rt_sigframe *) stack_top - 1;
+        frame = (struct rt_sigframe __user *) stack_top - 1;
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                 return 1;
 
-        restorer = (void *) frame->retcode;
+        restorer = frame->retcode;
         if(ka->sa.sa_flags & SA_RESTORER)
                 restorer = ka->sa.sa_restorer;
 
@@ -333,7 +335,7 @@ err:
 long sys_sigreturn(struct pt_regs regs)
 {
         unsigned long sp = PT_REGS_SP(&current->thread.regs);
-        struct sigframe __user *frame = (struct sigframe *)(sp - 8);
+        struct sigframe __user *frame = (struct sigframe __user *)(sp - 8);
         sigset_t set;
         struct sigcontext __user *sc = &frame->sc;
         unsigned long __user *oldmask = &sc->oldmask;
@@ -365,8 +367,8 @@ long sys_sigreturn(struct pt_regs regs)
 
 long sys_rt_sigreturn(struct pt_regs regs)
 {
-        unsigned long __user sp = PT_REGS_SP(&current->thread.regs);
-        struct rt_sigframe __user *frame = (struct rt_sigframe *) (sp - 4);
+        unsigned long sp = PT_REGS_SP(&current->thread.regs);
+        struct rt_sigframe __user *frame = (struct rt_sigframe __user *) (sp - 4);
         sigset_t set;
         struct ucontext __user *uc = &frame->uc;
         int sig_size = _NSIG_WORDS * sizeof(unsigned long);
diff --git a/arch/um/sys-i386/sys_call_table.S b/arch/um/sys-i386/sys_call_table.S
index ad75c27afe38..1ff61474b25c 100644
--- a/arch/um/sys-i386/sys_call_table.S
+++ b/arch/um/sys-i386/sys_call_table.S
@@ -6,8 +6,6 @@
 
 #define sys_vm86old sys_ni_syscall
 #define sys_vm86 sys_ni_syscall
-#define sys_set_thread_area sys_ni_syscall
-#define sys_get_thread_area sys_ni_syscall
 
 #define sys_stime um_stime
 #define sys_time um_time
diff --git a/arch/um/sys-i386/syscalls.c b/arch/um/sys-i386/syscalls.c
index 83e9be820a86..749dd1bfe60f 100644
--- a/arch/um/sys-i386/syscalls.c
+++ b/arch/um/sys-i386/syscalls.c
@@ -61,21 +61,27 @@ long old_select(struct sel_arg_struct __user *arg)
         return sys_select(a.n, a.inp, a.outp, a.exp, a.tvp);
 }
 
-/* The i386 version skips reading from %esi, the fourth argument. So we must do
- * this, too.
+/*
+ * The prototype on i386 is:
+ *
+ *     int clone(int flags, void * child_stack, int * parent_tidptr, struct user_desc * newtls, int * child_tidptr)
+ *
+ * and the "newtls" arg. on i386 is read by copy_thread directly from the
+ * register saved on the stack.
  */
 long sys_clone(unsigned long clone_flags, unsigned long newsp,
-               int __user *parent_tid, int unused, int __user *child_tid)
+               int __user *parent_tid, void *newtls, int __user *child_tid)
 {
         long ret;
 
         if (!newsp)
                 newsp = UPT_SP(&current->thread.regs.regs);
+
         current->thread.forking = 1;
         ret = do_fork(clone_flags, newsp, &current->thread.regs, 0, parent_tid,
                       child_tid);
         current->thread.forking = 0;
-        return(ret);
+        return ret;
 }
 
 /*
@@ -104,7 +110,7 @@ long sys_ipc (uint call, int first, int second,
                 union semun fourth;
                 if (!ptr)
                         return -EINVAL;
-                if (get_user(fourth.__pad, (void **) ptr))
+                if (get_user(fourth.__pad, (void __user * __user *) ptr))
                         return -EFAULT;
                 return sys_semctl (first, second, third, fourth);
         }
diff --git a/arch/um/sys-i386/tls.c b/arch/um/sys-i386/tls.c
new file mode 100644
index 000000000000..a3188e861cc7
--- /dev/null
+++ b/arch/um/sys-i386/tls.c
@@ -0,0 +1,384 @@
+/*
+ * Copyright (C) 2005 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+ * Licensed under the GPL
+ */
+
+#include "linux/config.h"
+#include "linux/kernel.h"
+#include "linux/sched.h"
+#include "linux/slab.h"
+#include "linux/types.h"
+#include "asm/uaccess.h"
+#include "asm/ptrace.h"
+#include "asm/segment.h"
+#include "asm/smp.h"
+#include "asm/desc.h"
+#include "choose-mode.h"
+#include "kern.h"
+#include "kern_util.h"
+#include "mode_kern.h"
+#include "os.h"
+#include "mode.h"
+
+#ifdef CONFIG_MODE_SKAS
+#include "skas.h"
+#endif
+
+/* If needed we can detect when it's uninitialized. */
+static int host_supports_tls = -1;
+int host_gdt_entry_tls_min = -1;
+
+#ifdef CONFIG_MODE_SKAS
+int do_set_thread_area_skas(struct user_desc *info)
+{
+        int ret;
+        u32 cpu;
+
+        cpu = get_cpu();
+        ret = os_set_thread_area(info, userspace_pid[cpu]);
+        put_cpu();
+        return ret;
+}
+
+int do_get_thread_area_skas(struct user_desc *info)
+{
+        int ret;
+        u32 cpu;
+
+        cpu = get_cpu();
+        ret = os_get_thread_area(info, userspace_pid[cpu]);
+        put_cpu();
+        return ret;
+}
+#endif
+
+/*
+ * sys_get_thread_area: get a yet unused TLS descriptor index.
+ * XXX: Consider leaving one free slot for glibc usage at first place. This must
+ * be done here (and by changing GDT_ENTRY_TLS_* macros) and nowhere else.
+ *
+ * Also, this must be tested when compiling in SKAS mode with dinamic linking
+ * and running against NPTL.
+ */
+static int get_free_idx(struct task_struct* task)
+{
+        struct thread_struct *t = &task->thread;
+        int idx;
+
+        if (!t->arch.tls_array)
+                return GDT_ENTRY_TLS_MIN;
+
+        for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
+                if (!t->arch.tls_array[idx].present)
+                        return idx + GDT_ENTRY_TLS_MIN;
+        return -ESRCH;
+}
+
+static inline void clear_user_desc(struct user_desc* info)
+{
+        /* Postcondition: LDT_empty(info) returns true. */
+        memset(info, 0, sizeof(*info));
+
+        /* Check the LDT_empty or the i386 sys_get_thread_area code - we obtain
+         * indeed an empty user_desc.
+         */
+        info->read_exec_only = 1;
+        info->seg_not_present = 1;
+}
+
+#define O_FORCE 1
+
+static int load_TLS(int flags, struct task_struct *to)
+{
+        int ret = 0;
+        int idx;
+
+        for (idx = GDT_ENTRY_TLS_MIN; idx < GDT_ENTRY_TLS_MAX; idx++) {
+                struct uml_tls_struct* curr = &to->thread.arch.tls_array[idx - GDT_ENTRY_TLS_MIN];
+
+                /* Actually, now if it wasn't flushed it gets cleared and
+                 * flushed to the host, which will clear it.*/
+                if (!curr->present) {
+                        if (!curr->flushed) {
+                                clear_user_desc(&curr->tls);
+                                curr->tls.entry_number = idx;
+                        } else {
+                                WARN_ON(!LDT_empty(&curr->tls));
+                                continue;
+                        }
+                }
+
+                if (!(flags & O_FORCE) && curr->flushed)
+                        continue;
+
+                ret = do_set_thread_area(&curr->tls);
+                if (ret)
+                        goto out;
+
+                curr->flushed = 1;
+        }
+out:
+        return ret;
+}
+
+/* Verify if we need to do a flush for the new process, i.e. if there are any
+ * present desc's, only if they haven't been flushed.
+ */
+static inline int needs_TLS_update(struct task_struct *task)
+{
+        int i;
+        int ret = 0;
+
+        for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
+                struct uml_tls_struct* curr = &task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
+
+                /* Can't test curr->present, we may need to clear a descriptor
+                 * which had a value. */
+                if (curr->flushed)
+                        continue;
+                ret = 1;
+                break;
+        }
+        return ret;
+}
+
+/* On a newly forked process, the TLS descriptors haven't yet been flushed. So
+ * we mark them as such and the first switch_to will do the job.
+ */
+void clear_flushed_tls(struct task_struct *task)
+{
+        int i;
+
+        for (i = GDT_ENTRY_TLS_MIN; i < GDT_ENTRY_TLS_MAX; i++) {
+                struct uml_tls_struct* curr = &task->thread.arch.tls_array[i - GDT_ENTRY_TLS_MIN];
+
+                /* Still correct to do this, if it wasn't present on the host it
+                 * will remain as flushed as it was. */
+                if (!curr->present)
+                        continue;
+
+                curr->flushed = 0;
+        }
+}
+
+/* In SKAS0 mode, currently, multiple guest threads sharing the same ->mm have a
+ * common host process. So this is needed in SKAS0 too.
+ *
+ * However, if each thread had a different host process (and this was discussed
+ * for SMP support) this won't be needed.
+ *
+ * And this will not need be used when (and if) we'll add support to the host
+ * SKAS patch. */
+
+int arch_switch_tls_skas(struct task_struct *from, struct task_struct *to)
+{
+        if (!host_supports_tls)
+                return 0;
+
+        /* We have no need whatsoever to switch TLS for kernel threads; beyond
+         * that, that would also result in us calling os_set_thread_area with
+         * userspace_pid[cpu] == 0, which gives an error. */
+        if (likely(to->mm))
+                return load_TLS(O_FORCE, to);
+
+        return 0;
+}
+
+int arch_switch_tls_tt(struct task_struct *from, struct task_struct *to)
+{
+        if (!host_supports_tls)
+                return 0;
+
+        if (needs_TLS_update(to))
+                return load_TLS(0, to);
+
+        return 0;
+}
+
+static int set_tls_entry(struct task_struct* task, struct user_desc *info,
+                         int idx, int flushed)
+{
+        struct thread_struct *t = &task->thread;
+
+        if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+                return -EINVAL;
+
+        t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls = *info;
+        t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present = 1;
+        t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed = flushed;
+
+        return 0;
+}
+
+int arch_copy_tls(struct task_struct *new)
+{
+        struct user_desc info;
+        int idx, ret = -EFAULT;
+
+        if (copy_from_user(&info,
+                           (void __user *) UPT_ESI(&new->thread.regs.regs),
+                           sizeof(info)))
+                goto out;
+
+        ret = -EINVAL;
+        if (LDT_empty(&info))
+                goto out;
+
+        idx = info.entry_number;
+
+        ret = set_tls_entry(new, &info, idx, 0);
+out:
+        return ret;
+}
+
+/* XXX: use do_get_thread_area to read the host value? I'm not at all sure! */
+static int get_tls_entry(struct task_struct* task, struct user_desc *info, int idx)
+{
+        struct thread_struct *t = &task->thread;
+
+        if (!t->arch.tls_array)
+                goto clear;
+
+        if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+                return -EINVAL;
+
+        if (!t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].present)
+                goto clear;
+
+        *info = t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].tls;
+
+out:
+        /* Temporary debugging check, to make sure that things have been
+         * flushed. This could be triggered if load_TLS() failed.
+         */
+        if (unlikely(task == current && !t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
+                printk(KERN_ERR "get_tls_entry: task with pid %d got here "
+                                "without flushed TLS.", current->pid);
+        }
+
+        return 0;
+clear:
+        /* When the TLS entry has not been set, the values read to user in the
+         * tls_array are 0 (because it's cleared at boot, see
+         * arch/i386/kernel/head.S:cpu_gdt_table). Emulate that.
+         */
+        clear_user_desc(info);
+        info->entry_number = idx;
+        goto out;
+}
+
+asmlinkage int sys_set_thread_area(struct user_desc __user *user_desc)
+{
+        struct user_desc info;
+        int idx, ret;
+
+        if (!host_supports_tls)
+                return -ENOSYS;
+
+        if (copy_from_user(&info, user_desc, sizeof(info)))
+                return -EFAULT;
+
+        idx = info.entry_number;
+
+        if (idx == -1) {
+                idx = get_free_idx(current);
+                if (idx < 0)
+                        return idx;
+                info.entry_number = idx;
+                /* Tell the user which slot we chose for him.*/
+                if (put_user(idx, &user_desc->entry_number))
+                        return -EFAULT;
+        }
+
+        ret = CHOOSE_MODE_PROC(do_set_thread_area_tt, do_set_thread_area_skas, &info);
+        if (ret)
+                return ret;
+        return set_tls_entry(current, &info, idx, 1);
+}
+
+/*
+ * Perform set_thread_area on behalf of the traced child.
+ * Note: error handling is not done on the deferred load, and this differ from
+ * i386. However the only possible error are caused by bugs.
+ */
+int ptrace_set_thread_area(struct task_struct *child, int idx,
+                struct user_desc __user *user_desc)
+{
+        struct user_desc info;
+
+        if (!host_supports_tls)
+                return -EIO;
+
+        if (copy_from_user(&info, user_desc, sizeof(info)))
+                return -EFAULT;
+
+        return set_tls_entry(child, &info, idx, 0);
+}
+
+asmlinkage int sys_get_thread_area(struct user_desc __user *user_desc)
+{
+        struct user_desc info;
+        int idx, ret;
+
+        if (!host_supports_tls)
+                return -ENOSYS;
+
+        if (get_user(idx, &user_desc->entry_number))
+                return -EFAULT;
+
+        ret = get_tls_entry(current, &info, idx);
+        if (ret < 0)
+                goto out;
+
+        if (copy_to_user(user_desc, &info, sizeof(info)))
+                ret = -EFAULT;
+
+out:
+        return ret;
+}
+
+/*
+ * Perform get_thread_area on behalf of the traced child.
+ */
+int ptrace_get_thread_area(struct task_struct *child, int idx,
+                struct user_desc __user *user_desc)
+{
+        struct user_desc info;
+        int ret;
+
+        if (!host_supports_tls)
+                return -EIO;
+
+        ret = get_tls_entry(child, &info, idx);
+        if (ret < 0)
+                goto out;
+
+        if (copy_to_user(user_desc, &info, sizeof(info)))
+                ret = -EFAULT;
+out:
+        return ret;
+}
+
+
+/* XXX: This part is probably common to i386 and x86-64. Don't create a common
+ * file for now, do that when implementing x86-64 support.*/
+static int __init __setup_host_supports_tls(void) {
+        check_host_supports_tls(&host_supports_tls, &host_gdt_entry_tls_min);
+        if (host_supports_tls) {
+                printk(KERN_INFO "Host TLS support detected\n");
+                printk(KERN_INFO "Detected host type: ");
+                switch (host_gdt_entry_tls_min) {
+                        case GDT_ENTRY_TLS_MIN_I386:
+                                printk("i386\n");
+                                break;
+                        case GDT_ENTRY_TLS_MIN_X86_64:
+                                printk("x86_64\n");
+                                break;
+                }
+        } else
+                printk(KERN_ERR "  Host TLS support NOT detected! "
+                                "TLS support inside UML will not work\n");
+        return 1;
+}
+
+__initcall(__setup_host_supports_tls);
diff --git a/arch/um/sys-x86_64/Makefile b/arch/um/sys-x86_64/Makefile
index a351091fbd99..b5fc22babddf 100644
--- a/arch/um/sys-x86_64/Makefile
+++ b/arch/um/sys-x86_64/Makefile
@@ -4,31 +4,23 @@
 # Licensed under the GPL
 #
 
-#XXX: why into lib-y?
-lib-y = bitops.o bugs.o csum-partial.o delay.o fault.o ldt.o mem.o memcpy.o \
-        ptrace.o ptrace_user.o sigcontext.o signal.o syscalls.o \
-        syscall_table.o sysrq.o thunk.o
-lib-$(CONFIG_MODE_SKAS) += stub.o stub_segv.o
+obj-y = bugs.o delay.o fault.o ldt.o mem.o ptrace.o ptrace_user.o \
+        sigcontext.o signal.o syscalls.o syscall_table.o sysrq.o ksyms.o \
+        tls.o
 
-obj-y := ksyms.o
-obj-$(CONFIG_MODULES) += module.o um_module.o
+obj-$(CONFIG_MODE_SKAS) += stub.o stub_segv.o
+obj-$(CONFIG_MODULES) += um_module.o
 
-USER_OBJS := ptrace_user.o sigcontext.o stub_segv.o
+subarch-obj-y = lib/bitops.o lib/csum-partial.o lib/memcpy.o lib/thunk.o
+subarch-obj-$(CONFIG_MODULES) += kernel/module.o
 
-SYMLINKS = bitops.c csum-copy.S csum-partial.c csum-wrappers.c ldt.c memcpy.S \
-        thunk.S module.c
+ldt-y = ../sys-i386/ldt.o
 
-include arch/um/scripts/Makefile.rules
+USER_OBJS := ptrace_user.o sigcontext.o stub_segv.o
 
-bitops.c-dir = lib
-csum-copy.S-dir = lib
-csum-partial.c-dir = lib
-csum-wrappers.c-dir = lib
-ldt.c-dir = /arch/um/sys-i386
-memcpy.S-dir = lib
-thunk.S-dir = lib
-module.c-dir = kernel
+include arch/um/scripts/Makefile.rules
 
-$(obj)/stub_segv.o: _c_flags = $(call unprofile,$(CFLAGS))
+extra-$(CONFIG_MODE_TT) += unmap.o
 
-include arch/um/scripts/Makefile.unmap
+$(obj)/stub_segv.o $(obj)/unmap.o: \
+        _c_flags = $(call unprofile,$(CFLAGS))
diff --git a/arch/um/sys-x86_64/tls.c b/arch/um/sys-x86_64/tls.c
new file mode 100644
index 000000000000..ce1bf1b81c43
--- /dev/null
+++ b/arch/um/sys-x86_64/tls.c
@@ -0,0 +1,14 @@
+#include "linux/sched.h"
+
+void debug_arch_force_load_TLS(void)
+{
+}
+
+void clear_flushed_tls(struct task_struct *task)
+{
+}
+
+int arch_copy_tls(struct task_struct *t)
+{
+        return 0;
+}
diff --git a/arch/x86_64/ia32/vsyscall-sigreturn.S b/arch/x86_64/ia32/vsyscall-sigreturn.S
index d90321fe9bba..1384367cdbe1 100644
--- a/arch/x86_64/ia32/vsyscall-sigreturn.S
+++ b/arch/x86_64/ia32/vsyscall-sigreturn.S
@@ -32,9 +32,28 @@ __kernel_rt_sigreturn:
         .size __kernel_rt_sigreturn,.-.LSTART_rt_sigreturn
 
         .section .eh_frame,"a",@progbits
+.LSTARTFRAMES:
+        .long .LENDCIES-.LSTARTCIES
+.LSTARTCIES:
+        .long 0                 /* CIE ID */
+        .byte 1                 /* Version number */
+        .string "zRS"           /* NUL-terminated augmentation string */
+        .uleb128 1              /* Code alignment factor */
+        .sleb128 -4             /* Data alignment factor */
+        .byte 8                 /* Return address register column */
+        .uleb128 1              /* Augmentation value length */
+        .byte 0x1b              /* DW_EH_PE_pcrel|DW_EH_PE_sdata4. */
+        .byte 0x0c              /* DW_CFA_def_cfa */
+        .uleb128 4
+        .uleb128 4
+        .byte 0x88              /* DW_CFA_offset, column 0x8 */
+        .uleb128 1
+        .align 4
+.LENDCIES:
+
         .long .LENDFDE2-.LSTARTFDE2     /* Length FDE */
 .LSTARTFDE2:
-        .long .LSTARTFDE2-.LSTARTFRAME  /* CIE pointer */
+        .long .LSTARTFDE2-.LSTARTFRAMES /* CIE pointer */
         /* HACK: The dwarf2 unwind routines will subtract 1 from the
            return address to get an address in the middle of the
            presumed call instruction.  Since we didn't get here via
@@ -97,7 +116,7 @@ __kernel_rt_sigreturn:
 
         .long .LENDFDE3-.LSTARTFDE3     /* Length FDE */
 .LSTARTFDE3:
-        .long .LSTARTFDE3-.LSTARTFRAME  /* CIE pointer */
+        .long .LSTARTFDE3-.LSTARTFRAMES /* CIE pointer */
         /* HACK: See above wrt unwind library assumptions.  */
         .long .LSTART_rt_sigreturn-1-.  /* PC-relative start address */
         .long .LEND_rt_sigreturn-.LSTART_rt_sigreturn+1
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index d54620147e8e..100a30c40044 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -615,7 +615,7 @@ static int __init apic_set_verbosity(char *str)
                 printk(KERN_WARNING "APIC Verbosity level %s not recognised"
                                 " use apic=verbose or apic=debug", str);
 
-        return 0;
+        return 1;
 }
 
 __setup("apic=", apic_set_verbosity);
@@ -1137,35 +1137,35 @@ int __init APIC_init_uniprocessor (void)
 static __init int setup_disableapic(char *str) 
 { 
         disable_apic = 1;
-        return 0;
+        return 1;
 } 
 
 static __init int setup_nolapic(char *str) 
 { 
         disable_apic = 1;
-        return 0;
+        return 1;
 } 
 
 static __init int setup_noapictimer(char *str) 
 { 
         if (str[0] != ' ' && str[0] != 0)
-                return -1;
+                return 0;
         disable_apic_timer = 1;
-        return 0;
+        return 1;
 } 
 
 static __init int setup_apicmaintimer(char *str)
 {
         apic_runs_main_timer = 1;
         nohpet = 1;
-        return 0;
+        return 1;
 }
 __setup("apicmaintimer", setup_apicmaintimer);
 
 static __init int setup_noapicmaintimer(char *str)
 {
         apic_runs_main_timer = -1;
-        return 0;
+        return 1;
 }
 __setup("noapicmaintimer", setup_noapicmaintimer);
 
diff --git a/arch/x86_64/kernel/early_printk.c b/arch/x86_64/kernel/early_printk.c
index 13af920b6594..b93ef5b51980 100644
--- a/arch/x86_64/kernel/early_printk.c
+++ b/arch/x86_64/kernel/early_printk.c
@@ -221,7 +221,7 @@ int __init setup_early_printk(char *opt)
         char buf[256];
 
         if (early_console_initialized)
-                return -1;
+                return 1;
 
         strlcpy(buf,opt,sizeof(buf));
         space = strchr(buf, ' ');
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 04282ef9fbd4..10b3e348fc99 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -501,7 +501,7 @@ static struct miscdevice mce_log_device = {
 static int __init mcheck_disable(char *str)
 {
         mce_dont_init = 1;
-        return 0;
+        return 1;
 }
 
 /* mce=off disables machine check. Note you can reenable it later
@@ -521,7 +521,7 @@ static int __init mcheck_enable(char *str)
                 get_option(&str, &tolerant);
         else
                 printk("mce= argument %s ignored. Please use /sys", str); 
-        return 0;
+        return 1;
 }
 
 __setup("nomce", mcheck_disable);
diff --git a/arch/x86_64/kernel/pmtimer.c b/arch/x86_64/kernel/pmtimer.c
index ee5ee4891f3d..b0444a415bd6 100644
--- a/arch/x86_64/kernel/pmtimer.c
+++ b/arch/x86_64/kernel/pmtimer.c
@@ -121,7 +121,7 @@ unsigned int do_gettimeoffset_pm(void)
 static int __init nopmtimer_setup(char *s)
 {
         pmtmr_ioport = 0;
-        return 0;
+        return 1;
 }
 
 __setup("nopmtimer", nopmtimer_setup);
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index d1f3e9272c05..0856ad444f90 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -540,7 +540,7 @@ void __init alternative_instructions(void)
 static int __init noreplacement_setup(char *s)
 { 
      no_replacement = 1; 
-     return 0; 
+     return 1;
 } 
 
 __setup("noreplacement", noreplacement_setup); 
diff --git a/arch/x86_64/kernel/setup64.c b/arch/x86_64/kernel/setup64.c
index eabdb63fec31..8a691fa6d393 100644
--- a/arch/x86_64/kernel/setup64.c
+++ b/arch/x86_64/kernel/setup64.c
@@ -55,7 +55,7 @@ int __init nonx_setup(char *str)
                 do_not_nx = 1;
                 __supported_pte_mask &= ~_PAGE_NX;
         }
-        return 0;
+        return 1;
 } 
 __setup("noexec=", nonx_setup); /* parsed early actually */
 
@@ -74,7 +74,7 @@ static int __init nonx32_setup(char *str)
                 force_personality32 &= ~READ_IMPLIES_EXEC;
         else if (!strcmp(str, "off"))
                 force_personality32 |= READ_IMPLIES_EXEC;
-        return 0;
+        return 1;
 }
 __setup("noexec32=", nonx32_setup);
 
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index ea48fa638070..71a7222cf9ce 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -353,7 +353,7 @@ static void __cpuinit tsc_sync_wait(void)
 static __init int notscsync_setup(char *s)
 {
         notscsync = 1;
-        return 0;
+        return 1;
 }
 __setup("notscsync", notscsync_setup);
 
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 473b514b66e4..ef8bc46dc140 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -1306,7 +1306,7 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 static int __init nohpet_setup(char *s) 
 { 
         nohpet = 1;
-        return 0;
+        return 1;
 } 
 
 __setup("nohpet", nohpet_setup);
@@ -1314,7 +1314,7 @@ __setup("nohpet", nohpet_setup);
 int __init notsc_setup(char *s)
 {
         notsc = 1;
-        return 0;
+        return 1;
 }
 
 __setup("notsc", notsc_setup);
diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
index edaa9fe654dc..6bda322d3caf 100644
--- a/arch/x86_64/kernel/traps.c
+++ b/arch/x86_64/kernel/traps.c
@@ -973,14 +973,14 @@ void __init trap_init(void)
 static int __init oops_dummy(char *s)
 { 
         panic_on_oops = 1;
-        return -1; 
+        return 1;
 } 
 __setup("oops=", oops_dummy); 
 
 static int __init kstack_setup(char *s)
 {
         kstack_depth_to_print = simple_strtoul(s,NULL,0);
-        return 0;
+        return 1;
 }
 __setup("kstack=", kstack_setup);
 
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index d96a9348e5a2..d78f46056bda 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -102,8 +102,6 @@ EXPORT_SYMBOL(cpu_callout_map);
 EXPORT_SYMBOL(screen_info);
 #endif
 
-EXPORT_SYMBOL(get_wchan);
-
 EXPORT_SYMBOL(rtc_lock);
 
 EXPORT_SYMBOL_GPL(set_nmi_callback);
diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
index 316c53de47bd..55250593d8c9 100644
--- a/arch/x86_64/mm/fault.c
+++ b/arch/x86_64/mm/fault.c
@@ -623,6 +623,6 @@ void vmalloc_sync_all(void)
 static int __init enable_pagefaulttrace(char *str)
 {
         page_fault_trace = 1;
-        return 0;
+        return 1;
 }
 __setup("pagefaulttrace", enable_pagefaulttrace);
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index efae56a51475..152b9370789b 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -113,8 +113,6 @@ EXPORT_SYMBOL(__xtensa_copy_user);
 // FIXME EXPORT_SYMBOL(screen_info);
 #endif
 
-EXPORT_SYMBOL(get_wchan);
-
 EXPORT_SYMBOL(outsb);
 EXPORT_SYMBOL(outsw);
 EXPORT_SYMBOL(outsl);
diff --git a/block/Kconfig b/block/Kconfig
index 5536839886ff..b6f5f0a79655 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -27,10 +27,10 @@ config BLK_DEV_IO_TRACE
 config LSF
         bool "Support for Large Single Files"
         depends on X86 || (MIPS && 32BIT) || PPC32 || ARCH_S390_31 || SUPERH || UML
-        default n
         help
-          When CONFIG_LBD is disabled, say Y here if you want to
-          handle large file(bigger than 2TB), otherwise say N.
-          When CONFIG_LBD is enabled, Y is set automatically.
+          Say Y here if you want to be able to handle very large files (bigger
+          than 2TB), otherwise say N.
+
+          If unsure, say Y.
 
 source block/Kconfig.iosched
diff --git a/block/elevator.c b/block/elevator.c
index 56c2ed06a9e2..0d6be03d929e 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -145,7 +145,7 @@ static int __init elevator_setup(char *str)
                 strcpy(chosen_elevator, "anticipatory");
         else
                 strncpy(chosen_elevator, str, sizeof(chosen_elevator) - 1);
-        return 0;
+        return 1;
 }
 
 __setup("elevator=", elevator_setup);
diff --git a/block/genhd.c b/block/genhd.c
index db4c60c802d6..5a8d3bf02f17 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -17,8 +17,6 @@
 #include <linux/buffer_head.h>
 #include <linux/mutex.h>
 
-#define MAX_PROBE_HASH 255      /* random */
-
 static struct subsystem block_subsys;
 
 static DEFINE_MUTEX(block_subsys_lock);
@@ -31,108 +29,29 @@ static struct blk_major_name {
         struct blk_major_name *next;
         int major;
         char name[16];
-} *major_names[MAX_PROBE_HASH];
+} *major_names[BLKDEV_MAJOR_HASH_SIZE];
 
 /* index in the above - for now: assume no multimajor ranges */
 static inline int major_to_index(int major)
 {
-        return major % MAX_PROBE_HASH;
-}
-
-struct blkdev_info {
-        int index;
-        struct blk_major_name *bd;
-};
-
-/*
- * iterate over a list of blkdev_info structures.  allows
- * the major_names array to be iterated over from outside this file
- * must be called with the block_subsys_lock held
- */
-void *get_next_blkdev(void *dev)
-{
-        struct blkdev_info *info;
-
-        if (dev == NULL) {
-                info = kmalloc(sizeof(*info), GFP_KERNEL);
-                if (!info)
-                        goto out;
-                info->index=0;
-                info->bd = major_names[info->index];
-                if (info->bd)
-                        goto out;
-        } else {
-                info = dev;
-        }
-
-        while (info->index < ARRAY_SIZE(major_names)) {
-                if (info->bd)
-                        info->bd = info->bd->next;
-                if (info->bd)
-                        goto out;
-                /*
-                 * No devices on this chain, move to the next
-                 */
-                info->index++;
-                info->bd = (info->index < ARRAY_SIZE(major_names)) ?
-                        major_names[info->index] : NULL;
-                if (info->bd)
-                        goto out;
-        }
-
-out:
-        return info;
-}
-
-void *acquire_blkdev_list(void)
-{
-        mutex_lock(&block_subsys_lock);
-        return get_next_blkdev(NULL);
-}
-
-void release_blkdev_list(void *dev)
-{
-        mutex_unlock(&block_subsys_lock);
-        kfree(dev);
+        return major % BLKDEV_MAJOR_HASH_SIZE;
 }
 
+#ifdef CONFIG_PROC_FS
 
-/*
- * Count the number of records in the blkdev_list.
- * must be called with the block_subsys_lock held
- */
-int count_blkdev_list(void)
+void blkdev_show(struct seq_file *f, off_t offset)
 {
-        struct blk_major_name *n;
-        int i, count;
+        struct blk_major_name *dp;
 
-        count = 0;
-
-        for (i = 0; i < ARRAY_SIZE(major_names); i++) {
-                for (n = major_names[i]; n; n = n->next)
-                                count++;
+        if (offset < BLKDEV_MAJOR_HASH_SIZE) {
+                mutex_lock(&block_subsys_lock);
+                for (dp = major_names[offset]; dp; dp = dp->next)
+                        seq_printf(f, "%3d %s\n", dp->major, dp->name);
+                mutex_unlock(&block_subsys_lock);
         }
-
-        return count;
-}
-
-/*
- * extract the major and name values from a blkdev_info struct
- * passed in as a void to *dev.  Must be called with
- * block_subsys_lock held
- */
-int get_blkdev_info(void *dev, int *major, char **name)
-{
-        struct blkdev_info *info = dev;
-
-        if (info->bd == NULL)
-                return 1;
-
-        *major = info->bd->major;
-        *name = info->bd->name;
-        return 0;
 }
 
+#endif /* CONFIG_PROC_FS */
 
 int register_blkdev(unsigned int major, const char *name)
 {
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 9f5c0da57c90..5c91d6afb117 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -64,6 +64,8 @@ source "drivers/usb/Kconfig"
 
 source "drivers/mmc/Kconfig"
 
+source "drivers/leds/Kconfig"
+
 source "drivers/infiniband/Kconfig"
 
 source "drivers/sn/Kconfig"
diff --git a/drivers/Makefile b/drivers/Makefile
index 424955274e60..d6e8ffbd8132 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -69,6 +69,7 @@ obj-$(CONFIG_MCA)		+= mca/
 obj-$(CONFIG_EISA)              += eisa/
 obj-$(CONFIG_CPU_FREQ)          += cpufreq/
 obj-$(CONFIG_MMC)               += mmc/
+obj-$(CONFIG_NEW_LEDS)          += leds/
 obj-$(CONFIG_INFINIBAND)        += infiniband/
 obj-$(CONFIG_SGI_SN)            += sn/
 obj-y                           += firmware/
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 79b09d76c180..eee0864ba300 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -1572,7 +1572,7 @@ static void __exit acpi_ec_exit(void)
 static int __init acpi_fake_ecdt_setup(char *str)
 {
         acpi_fake_ecdt_enabled = 1;
-        return 0;
+        return 1;
 }
 
 __setup("acpi_fake_ecdt", acpi_fake_ecdt_setup);
@@ -1591,7 +1591,7 @@ static int __init acpi_ec_set_intr_mode(char *str)
                 acpi_ec_driver.ops.add = acpi_ec_poll_add;
         }
         printk(KERN_INFO PREFIX "EC %s mode.\n", intr ? "interrupt" : "polling");
-        return 0;
+        return 1;
 }
 
 __setup("ec_intr=", acpi_ec_set_intr_mode);
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index b6e290956214..2a8af685926f 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1850,6 +1850,7 @@ static int __init amiga_floppy_setup (char *str)
                 return 0;
         printk (KERN_INFO "amiflop: Setting default df0 to %x\n", n);
         fd_def_df0 = n;
+        return 1;
 }
 
 __setup("floppy=", amiga_floppy_setup);
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index 107df9fdba4e..edc72a6348a7 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -357,6 +357,12 @@ typedef struct drm_freelist {
         spinlock_t lock;
 } drm_freelist_t;
 
+typedef struct drm_dma_handle {
+        dma_addr_t busaddr;
+        void *vaddr;
+        size_t size;
+} drm_dma_handle_t;
+
 /**
  * Buffer entry.  There is one of this for each buffer size order.
  */
@@ -366,7 +372,7 @@ typedef struct drm_buf_entry {
         drm_buf_t *buflist;             /**< buffer list */
         int seg_count;
         int page_order;
-        unsigned long *seglist;
+        drm_dma_handle_t **seglist;
 
         drm_freelist_t freelist;
 } drm_buf_entry_t;
@@ -483,12 +489,6 @@ typedef struct drm_sigdata {
         drm_hw_lock_t *lock;
 } drm_sigdata_t;
 
-typedef struct drm_dma_handle {
-        dma_addr_t busaddr;
-        void *vaddr;
-        size_t size;
-} drm_dma_handle_t;
-
 /**
  * Mappings list
  */
@@ -813,8 +813,6 @@ extern void drm_mem_init(void);
 extern int drm_mem_info(char *buf, char **start, off_t offset,
                         int request, int *eof, void *data);
 extern void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area);
-extern unsigned long drm_alloc_pages(int order, int area);
-extern void drm_free_pages(unsigned long address, int order, int area);
 extern void *drm_ioremap(unsigned long offset, unsigned long size,
                          drm_device_t * dev);
 extern void *drm_ioremap_nocache(unsigned long offset, unsigned long size,
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index e2637b4d51de..8a9cf12e6183 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -474,8 +474,7 @@ static void drm_cleanup_buf_error(drm_device_t * dev, drm_buf_entry_t * entry)
         if (entry->seg_count) {
                 for (i = 0; i < entry->seg_count; i++) {
                         if (entry->seglist[i]) {
-                                drm_free_pages(entry->seglist[i],
-                                               entry->page_order, DRM_MEM_DMA);
+                                drm_pci_free(dev, entry->seglist[i]);
                         }
                 }
                 drm_free(entry->seglist,
@@ -678,7 +677,7 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
         int total;
         int page_order;
         drm_buf_entry_t *entry;
-        unsigned long page;
+        drm_dma_handle_t *dmah;
         drm_buf_t *buf;
         int alignment;
         unsigned long offset;
@@ -781,8 +780,10 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
         page_count = 0;
 
         while (entry->buf_count < count) {
-                page = drm_alloc_pages(page_order, DRM_MEM_DMA);
-                if (!page) {
+                
+                dmah = drm_pci_alloc(dev, PAGE_SIZE << page_order, 0x1000, 0xfffffffful);
+                
+                if (!dmah) {
                         /* Set count correctly so we free the proper amount. */
                         entry->buf_count = count;
                         entry->seg_count = count;
@@ -794,13 +795,13 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
                         atomic_dec(&dev->buf_alloc);
                         return -ENOMEM;
                 }
-                entry->seglist[entry->seg_count++] = page;
+                entry->seglist[entry->seg_count++] = dmah;
                 for (i = 0; i < (1 << page_order); i++) {
                         DRM_DEBUG("page %d @ 0x%08lx\n",
                                   dma->page_count + page_count,
-                                  page + PAGE_SIZE * i);
+                                  (unsigned long)dmah->vaddr + PAGE_SIZE * i);
                         temp_pagelist[dma->page_count + page_count++]
-                            = page + PAGE_SIZE * i;
+                                = (unsigned long)dmah->vaddr + PAGE_SIZE * i;
                 }
                 for (offset = 0;
                      offset + size <= total && entry->buf_count < count;
@@ -811,7 +812,8 @@ int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request)
                         buf->order = order;
                         buf->used = 0;
                         buf->offset = (dma->byte_count + byte_count + offset);
-                        buf->address = (void *)(page + offset);
+                        buf->address = (void *)(dmah->vaddr + offset);
+                        buf->bus_address = dmah->busaddr + offset;
                         buf->next = NULL;
                         buf->waiting = 0;
                         buf->pending = 0;
diff --git a/drivers/char/drm/drm_dma.c b/drivers/char/drm/drm_dma.c
index 2afab95ca036..892db7096986 100644
--- a/drivers/char/drm/drm_dma.c
+++ b/drivers/char/drm/drm_dma.c
@@ -85,9 +85,7 @@ void drm_dma_takedown(drm_device_t * dev)
                                   dma->bufs[i].seg_count);
                         for (j = 0; j < dma->bufs[i].seg_count; j++) {
                                 if (dma->bufs[i].seglist[j]) {
-                                        drm_free_pages(dma->bufs[i].seglist[j],
-                                                       dma->bufs[i].page_order,
-                                                       DRM_MEM_DMA);
+                                        drm_pci_free(dev, dma->bufs[i].seglist[j]);
                                 }
                         }
                         drm_free(dma->bufs[i].seglist,
diff --git a/drivers/char/drm/drm_memory.c b/drivers/char/drm/drm_memory.c
index 8074771e348f..dddf8de66143 100644
--- a/drivers/char/drm/drm_memory.c
+++ b/drivers/char/drm/drm_memory.c
@@ -79,65 +79,6 @@ void *drm_realloc(void *oldpt, size_t oldsize, size_t size, int area)
         return pt;
 }
 
-/**
- * Allocate pages.
- *
- * \param order size order.
- * \param area memory area. (Not used.)
- * \return page address on success, or zero on failure.
- *
- * Allocate and reserve free pages.
- */
-unsigned long drm_alloc_pages(int order, int area)
-{
-        unsigned long address;
-        unsigned long bytes = PAGE_SIZE << order;
-        unsigned long addr;
-        unsigned int sz;
-
-        address = __get_free_pages(GFP_KERNEL|__GFP_COMP, order);
-        if (!address)
-                return 0;
-
-        /* Zero */
-        memset((void *)address, 0, bytes);
-
-        /* Reserve */
-        for (addr = address, sz = bytes;
-             sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
-                SetPageReserved(virt_to_page(addr));
-        }
-
-        return address;
-}
-
-/**
- * Free pages.
- *
- * \param address address of the pages to free.
- * \param order size order.
- * \param area memory area. (Not used.)
- *
- * Unreserve and free pages allocated by alloc_pages().
- */
-void drm_free_pages(unsigned long address, int order, int area)
-{
-        unsigned long bytes = PAGE_SIZE << order;
-        unsigned long addr;
-        unsigned int sz;
-
-        if (!address)
-                return;
-
-        /* Unreserve */
-        for (addr = address, sz = bytes;
-             sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
-                ClearPageReserved(virt_to_page(addr));
-        }
-
-        free_pages(address, order);
-}
-
 #if __OS_HAS_AGP
 /** Wrapper around agp_allocate_memory() */
 DRM_AGP_MEM *drm_alloc_agp(drm_device_t * dev, int pages, u32 type)
diff --git a/drivers/char/drm/drm_memory_debug.h b/drivers/char/drm/drm_memory_debug.h
index e84605fc54af..7868341817da 100644
--- a/drivers/char/drm/drm_memory_debug.h
+++ b/drivers/char/drm/drm_memory_debug.h
@@ -206,76 +206,6 @@ void drm_free (void *pt, size_t size, int area) {
         }
 }
 
-unsigned long drm_alloc_pages (int order, int area) {
-        unsigned long address;
-        unsigned long bytes = PAGE_SIZE << order;
-        unsigned long addr;
-        unsigned int sz;
-
-        spin_lock(&drm_mem_lock);
-        if ((drm_ram_used >> PAGE_SHIFT)
-            > (DRM_RAM_PERCENT * drm_ram_available) / 100) {
-                spin_unlock(&drm_mem_lock);
-                return 0;
-        }
-        spin_unlock(&drm_mem_lock);
-
-        address = __get_free_pages(GFP_KERNEL|__GFP_COMP, order);
-        if (!address) {
-                spin_lock(&drm_mem_lock);
-                ++drm_mem_stats[area].fail_count;
-                spin_unlock(&drm_mem_lock);
-                return 0;
-        }
-        spin_lock(&drm_mem_lock);
-        ++drm_mem_stats[area].succeed_count;
-        drm_mem_stats[area].bytes_allocated += bytes;
-        drm_ram_used += bytes;
-        spin_unlock(&drm_mem_lock);
-
-        /* Zero outside the lock */
-        memset((void *)address, 0, bytes);
-
-        /* Reserve */
-        for (addr = address, sz = bytes;
-             sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
-                SetPageReserved(virt_to_page(addr));
-        }
-
-        return address;
-}
-
-void drm_free_pages (unsigned long address, int order, int area) {
-        unsigned long bytes = PAGE_SIZE << order;
-        int alloc_count;
-        int free_count;
-        unsigned long addr;
-        unsigned int sz;
-
-        if (!address) {
-                DRM_MEM_ERROR(area, "Attempt to free address 0\n");
-        } else {
-                /* Unreserve */
-                for (addr = address, sz = bytes;
-                     sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
-                        ClearPageReserved(virt_to_page(addr));
-                }
-                free_pages(address, order);
-        }
-
-        spin_lock(&drm_mem_lock);
-        free_count = ++drm_mem_stats[area].free_count;
-        alloc_count = drm_mem_stats[area].succeed_count;
-        drm_mem_stats[area].bytes_freed += bytes;
-        drm_ram_used -= bytes;
-        spin_unlock(&drm_mem_lock);
-        if (free_count > alloc_count) {
-                DRM_MEM_ERROR(area,
-                              "Excess frees: %d frees, %d allocs\n",
-                              free_count, alloc_count);
-        }
-}
-
 void *drm_ioremap (unsigned long offset, unsigned long size,
                     drm_device_t * dev) {
         void *pt;
diff --git a/drivers/char/drm/drm_pci.c b/drivers/char/drm/drm_pci.c
index 1fd7ff164817..b28ca9cea8a2 100644
--- a/drivers/char/drm/drm_pci.c
+++ b/drivers/char/drm/drm_pci.c
@@ -50,6 +50,10 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
                                 dma_addr_t maxaddr)
 {
         drm_dma_handle_t *dmah;
+#if 1
+        unsigned long addr;
+        size_t sz;
+#endif
 #ifdef DRM_DEBUG_MEMORY
         int area = DRM_MEM_DMA;
 
@@ -79,7 +83,7 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
                 return NULL;
 
         dmah->size = size;
-        dmah->vaddr = pci_alloc_consistent(dev->pdev, size, &dmah->busaddr);
+        dmah->vaddr = dma_alloc_coherent(&dev->pdev->dev, size, &dmah->busaddr, GFP_KERNEL | __GFP_COMP);
 
 #ifdef DRM_DEBUG_MEMORY
         if (dmah->vaddr == NULL) {
@@ -104,18 +108,29 @@ drm_dma_handle_t *drm_pci_alloc(drm_device_t * dev, size_t size, size_t align,
 
         memset(dmah->vaddr, 0, size);
 
+        /* XXX - Is virt_to_page() legal for consistent mem? */
+        /* Reserve */
+        for (addr = (unsigned long)dmah->vaddr, sz = size;
+             sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
+                SetPageReserved(virt_to_page(addr));
+        }
+
         return dmah;
 }
 
 EXPORT_SYMBOL(drm_pci_alloc);
 
 /**
- * \brief Free a PCI consistent memory block with freeing its descriptor.
+ * \brief Free a PCI consistent memory block without freeing its descriptor.
  *
  * This function is for internal use in the Linux-specific DRM core code.
  */
 void __drm_pci_free(drm_device_t * dev, drm_dma_handle_t * dmah)
 {
+#if 1
+        unsigned long addr;
+        size_t sz;
+#endif
 #ifdef DRM_DEBUG_MEMORY
         int area = DRM_MEM_DMA;
         int alloc_count;
@@ -127,8 +142,14 @@ void __drm_pci_free(drm_device_t * dev, drm_dma_handle_t * dmah)
                 DRM_MEM_ERROR(area, "Attempt to free address 0\n");
 #endif
         } else {
-                pci_free_consistent(dev->pdev, dmah->size, dmah->vaddr,
-                                    dmah->busaddr);
+                /* XXX - Is virt_to_page() legal for consistent mem? */
+                /* Unreserve */
+                for (addr = (unsigned long)dmah->vaddr, sz = dmah->size;
+                     sz > 0; addr += PAGE_SIZE, sz -= PAGE_SIZE) {
+                        ClearPageReserved(virt_to_page(addr));
+                }
+                dma_free_coherent(&dev->pdev->dev, dmah->size, dmah->vaddr,
+                                  dmah->busaddr);
         }
 
 #ifdef DRM_DEBUG_MEMORY
diff --git a/drivers/char/drm/drm_pciids.h b/drivers/char/drm/drm_pciids.h
index 2c17e88a8847..b1bb3c7b568d 100644
--- a/drivers/char/drm/drm_pciids.h
+++ b/drivers/char/drm/drm_pciids.h
@@ -3,49 +3,69 @@
    Please contact dri-devel@lists.sf.net to add new cards to this list
 */
 #define radeon_PCI_IDS \
-        {0x1002, 0x3150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350},\
+        {0x1002, 0x3150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x3152, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x3154, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x3E50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x3E54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
         {0x1002, 0x4136, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|CHIP_IS_IGP}, \
         {0x1002, 0x4137, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|CHIP_IS_IGP}, \
         {0x1002, 0x4144, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4145, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4146, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4147, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+        {0x1002, 0x4148, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x4149, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x414A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x414B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
         {0x1002, 0x4150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4151, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4152, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4153, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4154, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+        {0x1002, 0x4155, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
         {0x1002, 0x4156, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
-        {0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS250|CHIP_IS_IGP}, \
+        {0x1002, 0x4237, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|CHIP_IS_IGP}, \
         {0x1002, 0x4242, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x4243, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x4336, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4337, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS250|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x4964, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
-        {0x1002, 0x4965, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
-        {0x1002, 0x4966, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
-        {0x1002, 0x4967, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250}, \
-        {0x1002, 0x4A49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
-        {0x1002, 0x4A4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
+        {0x1002, 0x4437, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS200|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4966, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250}, \
+        {0x1002, 0x4967, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250}, \
+        {0x1002, 0x4A48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A4C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A4D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A4E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A4F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4A54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4B49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4B4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4B4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x4B4C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
         {0x1002, 0x4C57, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C58, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C59, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4C5A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x4C65, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R250|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
-        {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+        {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4E47, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
         {0x1002, 0x4E48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
         {0x1002, 0x4E49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
-        {0x1002, 0x4E4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
+        {0x1002, 0x4E4A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
         {0x1002, 0x4E4B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
         {0x1002, 0x4E50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4E51, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4E52, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x4E53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4E54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
         {0x1002, 0x4E56, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350|CHIP_IS_MOBILITY}, \
         {0x1002, 0x5144, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
@@ -53,44 +73,66 @@
         {0x1002, 0x5146, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
         {0x1002, 0x5147, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R100|CHIP_SINGLE_CRTC}, \
         {0x1002, 0x5148, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x5149, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x514A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x514B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x514C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x514D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x514E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x514F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
         {0x1002, 0x5157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200}, \
         {0x1002, 0x5158, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV200}, \
         {0x1002, 0x5159, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
         {0x1002, 0x515A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
         {0x1002, 0x515E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
-        {0x1002, 0x5168, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x5169, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x516A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x516B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x516C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R200}, \
-        {0x1002, 0x5460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV350}, \
-        {0x1002, 0x554F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
+        {0x1002, 0x5460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x5462, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x5464, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_IS_MOBILITY}, \
+        {0x1002, 0x5548, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5549, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x554A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x554B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x554C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x554D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x554E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x554F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5550, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5551, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5552, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5554, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x564A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x564B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x564F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5652, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5653, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
         {0x1002, 0x5834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
         {0x1002, 0x5835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x5836, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
-        {0x1002, 0x5837, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP}, \
         {0x1002, 0x5960, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5961, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5962, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
-        {0x1002, 0x5963, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5964, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
-        {0x1002, 0x5968, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
+        {0x1002, 0x5965, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5969, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV100}, \
-        {0x1002, 0x596A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
-        {0x1002, 0x596B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
+        {0x1002, 0x5b60, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5b62, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5b63, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5b64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5b65, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|CHIP_NEW_MEMMAP}, \
         {0x1002, 0x5c61, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x5c62, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
         {0x1002, 0x5c63, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|CHIP_IS_MOBILITY}, \
-        {0x1002, 0x5c64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280}, \
-        {0x1002, 0x5d4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R350}, \
-        {0x1002, 0x5e4b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420}, \
+        {0x1002, 0x5d48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d49, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d4a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d4c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d4f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d52, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5d57, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R420|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5e48, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5e4a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5e4b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5e4c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5e4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x5e4f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x7834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP|CHIP_NEW_MEMMAP}, \
+        {0x1002, 0x7835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|CHIP_IS_IGP|CHIP_IS_MOBILITY|CHIP_NEW_MEMMAP}, \
         {0, 0, 0}
 
 #define r128_PCI_IDS \
diff --git a/drivers/char/drm/i915_dma.c b/drivers/char/drm/i915_dma.c
index 1ff4c7ca0bff..9f4b8ce4c05e 100644
--- a/drivers/char/drm/i915_dma.c
+++ b/drivers/char/drm/i915_dma.c
@@ -495,8 +495,6 @@ static int i915_dispatch_batchbuffer(drm_device_t * dev,
                 }
         }
 
-        dev_priv->sarea_priv->last_enqueue = dev_priv->counter++;
-
         i915_emit_breadcrumb(dev);
 
         return 0;
diff --git a/drivers/char/drm/i915_irq.c b/drivers/char/drm/i915_irq.c
index d3879ac9970f..a752afd86ab8 100644
--- a/drivers/char/drm/i915_irq.c
+++ b/drivers/char/drm/i915_irq.c
@@ -53,6 +53,8 @@ irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 
         I915_WRITE16(I915REG_INT_IDENTITY_R, temp);
 
+        dev_priv->sarea_priv->last_dispatch = READ_BREADCRUMB(dev_priv);
+
         if (temp & USER_INT_FLAG)
                 DRM_WAKEUP(&dev_priv->irq_queue);
 
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index c08fa5076f05..b108c7f913b2 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -214,13 +214,13 @@ void r300_init_reg_flags(void)
         ADD_RANGE(0x4F54, 1);
 
         ADD_RANGE(R300_TX_FILTER_0, 16);
-        ADD_RANGE(R300_TX_UNK1_0, 16);
+        ADD_RANGE(R300_TX_FILTER1_0, 16);
         ADD_RANGE(R300_TX_SIZE_0, 16);
         ADD_RANGE(R300_TX_FORMAT_0, 16);
         ADD_RANGE(R300_TX_PITCH_0, 16);
         /* Texture offset is dangerous and needs more checking */
         ADD_RANGE_MARK(R300_TX_OFFSET_0, 16, MARK_CHECK_OFFSET);
-        ADD_RANGE(R300_TX_UNK4_0, 16);
+        ADD_RANGE(R300_TX_CHROMA_KEY_0, 16);
         ADD_RANGE(R300_TX_BORDER_COLOR_0, 16);
 
         /* Sporadic registers used as primitives are emitted */
@@ -242,8 +242,10 @@ static __inline__ int r300_check_range(unsigned reg, int count)
         return 0;
 }
 
-  /* we expect offsets passed to the framebuffer to be either within video memory or
-     within AGP space */
+/*
+ * we expect offsets passed to the framebuffer to be either within video 
+ * memory or within AGP space 
+ */
 static __inline__ int r300_check_offset(drm_radeon_private_t *dev_priv,
                                         u32 offset)
 {
@@ -251,11 +253,11 @@ static __inline__ int r300_check_offset(drm_radeon_private_t *dev_priv,
            but this value is not being kept.
            This code is correct for now (does the same thing as the
            code that sets MC_FB_LOCATION) in radeon_cp.c */
-        if ((offset >= dev_priv->fb_location) &&
-            (offset < dev_priv->gart_vm_start))
+        if (offset >= dev_priv->fb_location &&
+            offset < (dev_priv->fb_location + dev_priv->fb_size))
                 return 0;
-        if ((offset >= dev_priv->gart_vm_start) &&
-            (offset < dev_priv->gart_vm_start + dev_priv->gart_size))
+        if (offset >= dev_priv->gart_vm_start &&
+            offset < (dev_priv->gart_vm_start + dev_priv->gart_size))
                 return 0;
         return 1;
 }
@@ -490,6 +492,7 @@ static __inline__ int r300_emit_3d_load_vbpntr(drm_radeon_private_t *dev_priv,
 
         return 0;
 }
+
 static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
                                              drm_radeon_kcmd_buffer_t *cmdbuf)
 {
@@ -701,6 +704,64 @@ static void r300_discard_buffer(drm_device_t * dev, drm_buf_t * buf)
         buf->used = 0;
 }
 
+static int r300_scratch(drm_radeon_private_t *dev_priv,
+                        drm_radeon_kcmd_buffer_t *cmdbuf,
+                        drm_r300_cmd_header_t header)
+{
+        u32 *ref_age_base;
+        u32 i, buf_idx, h_pending;
+        RING_LOCALS;
+        
+        if (cmdbuf->bufsz < 
+            (sizeof(u64) + header.scratch.n_bufs * sizeof(buf_idx))) {
+                return DRM_ERR(EINVAL);
+        }
+        
+        if (header.scratch.reg >= 5) {
+                return DRM_ERR(EINVAL);
+        }
+        
+        dev_priv->scratch_ages[header.scratch.reg]++;
+        
+        ref_age_base = *(u32 **)cmdbuf->buf;
+        
+        cmdbuf->buf += sizeof(u64);
+        cmdbuf->bufsz -= sizeof(u64);
+        
+        for (i=0; i < header.scratch.n_bufs; i++) {
+                buf_idx = *(u32 *)cmdbuf->buf;
+                buf_idx *= 2; /* 8 bytes per buf */
+                
+                if (DRM_COPY_TO_USER(ref_age_base + buf_idx, &dev_priv->scratch_ages[header.scratch.reg], sizeof(u32))) {
+                        return DRM_ERR(EINVAL);
+                }
+                                        
+                if (DRM_COPY_FROM_USER(&h_pending, ref_age_base + buf_idx + 1, sizeof(u32))) {
+                        return DRM_ERR(EINVAL);
+                }
+                                        
+                if (h_pending == 0) {
+                        return DRM_ERR(EINVAL);
+                }
+                                        
+                h_pending--;
+                                                
+                if (DRM_COPY_TO_USER(ref_age_base + buf_idx + 1, &h_pending, sizeof(u32))) {
+                        return DRM_ERR(EINVAL);
+                }
+                                        
+                cmdbuf->buf += sizeof(buf_idx);
+                cmdbuf->bufsz -= sizeof(buf_idx);
+        }
+        
+        BEGIN_RING(2);
+        OUT_RING(CP_PACKET0(RADEON_SCRATCH_REG0 + header.scratch.reg * 4, 0));
+        OUT_RING(dev_priv->scratch_ages[header.scratch.reg]);
+        ADVANCE_RING();
+        
+        return 0;
+}
+
 /**
  * Parses and validates a user-supplied command buffer and emits appropriate
  * commands on the DMA ring buffer.
@@ -838,6 +899,15 @@ int r300_do_cp_cmdbuf(drm_device_t *dev,
                         }
                         break;
 
+                case R300_CMD_SCRATCH:
+                        DRM_DEBUG("R300_CMD_SCRATCH\n");
+                        ret = r300_scratch(dev_priv, cmdbuf, header);
+                        if (ret) {
+                                DRM_ERROR("r300_scratch failed\n");
+                                goto cleanup;
+                        }
+                        break;
+                        
                 default:
                         DRM_ERROR("bad cmd_type %i at %p\n",
                                   header.header.cmd_type,
diff --git a/drivers/char/drm/r300_reg.h b/drivers/char/drm/r300_reg.h
index d1e19954406b..a881f96c983e 100644
--- a/drivers/char/drm/r300_reg.h
+++ b/drivers/char/drm/r300_reg.h
@@ -711,8 +711,22 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_TX_MAX_ANISO_16_TO_1 (8 << 21)
 #       define R300_TX_MAX_ANISO_MASK    (14 << 21)
 
-#define R300_TX_UNK1_0                      0x4440
+#define R300_TX_FILTER1_0                      0x4440
+#       define R300_CHROMA_KEY_MODE_DISABLE    0
+#       define R300_CHROMA_KEY_FORCE           1
+#       define R300_CHROMA_KEY_BLEND           2
+#       define R300_MC_ROUND_NORMAL            (0<<2)
+#       define R300_MC_ROUND_MPEG4             (1<<2)
 #       define R300_LOD_BIAS_MASK           0x1fff
+#       define R300_EDGE_ANISO_EDGE_DIAG       (0<<13)
+#       define R300_EDGE_ANISO_EDGE_ONLY       (1<<13)
+#       define R300_MC_COORD_TRUNCATE_DISABLE  (0<<14)
+#       define R300_MC_COORD_TRUNCATE_MPEG     (1<<14)
+#       define R300_TX_TRI_PERF_0_8            (0<<15)
+#       define R300_TX_TRI_PERF_1_8            (1<<15)
+#       define R300_TX_TRI_PERF_1_4            (2<<15)
+#       define R300_TX_TRI_PERF_3_8            (3<<15)
+#       define R300_ANISO_THRESHOLD_MASK       (7<<17)
 
 #define R300_TX_SIZE_0                      0x4480
 #       define R300_TX_WIDTHMASK_SHIFT           0
@@ -722,6 +736,8 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_TX_UNK23                     (1 << 23)
 #       define R300_TX_SIZE_SHIFT                26     /* largest of width, height */
 #       define R300_TX_SIZE_MASK                 (15 << 26)
+#       define R300_TX_SIZE_PROJECTED                     (1<<30)
+#       define R300_TX_SIZE_TXPITCH_EN                     (1<<31)
 #define R300_TX_FORMAT_0                    0x44C0
         /* The interpretation of the format word by Wladimir van der Laan */
         /* The X, Y, Z and W refer to the layout of the components.
@@ -750,7 +766,8 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_TX_FORMAT_B8G8_B8G8             0x14        /* no swizzle */
 #       define R300_TX_FORMAT_G8R8_G8B8             0x15        /* no swizzle */
                                                   /* 0x16 - some 16 bit green format.. ?? */
-#       define R300_TX_FORMAT_UNK25                (1 << 25)    /* no swizzle */
+#       define R300_TX_FORMAT_UNK25                (1 << 25) /* no swizzle */
+#       define R300_TX_FORMAT_CUBIC_MAP            (1 << 26)
 
         /* gap */
         /* Floating point formats */
@@ -800,18 +817,20 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 
 #       define R300_TX_FORMAT_YUV_MODE          0x00800000
 
-#define R300_TX_PITCH_0                     0x4500
+#define R300_TX_PITCH_0                     0x4500 /* obvious missing in gap */
 #define R300_TX_OFFSET_0                    0x4540
 /* BEGIN: Guess from R200 */
 #       define R300_TXO_ENDIAN_NO_SWAP           (0 << 0)
 #       define R300_TXO_ENDIAN_BYTE_SWAP         (1 << 0)
 #       define R300_TXO_ENDIAN_WORD_SWAP         (2 << 0)
 #       define R300_TXO_ENDIAN_HALFDW_SWAP       (3 << 0)
+#       define R300_TXO_MACRO_TILE               (1 << 2)
+#       define R300_TXO_MICRO_TILE               (1 << 3)
 #       define R300_TXO_OFFSET_MASK              0xffffffe0
 #       define R300_TXO_OFFSET_SHIFT             5
 /* END */
-#define R300_TX_UNK4_0                      0x4580
-#define R300_TX_BORDER_COLOR_0              0x45C0      //ff00ff00 == { 0, 1.0, 0, 1.0 }
+#define R300_TX_CHROMA_KEY_0                      0x4580 /* 32 bit chroma key */
+#define R300_TX_BORDER_COLOR_0              0x45C0 //ff00ff00 == { 0, 1.0, 0, 1.0 }
 
 /* END */
 
@@ -868,7 +887,9 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_PFS_NODE_TEX_OFFSET_MASK     (31 << 12)
 #       define R300_PFS_NODE_TEX_END_SHIFT       17
 #       define R300_PFS_NODE_TEX_END_MASK        (31 << 17)
-#       define R300_PFS_NODE_LAST_NODE           (1 << 22)
+/*#       define R300_PFS_NODE_LAST_NODE           (1 << 22) */
+#               define R300_PFS_NODE_OUTPUT_COLOR        (1 << 22)
+#               define R300_PFS_NODE_OUTPUT_DEPTH        (1 << 23)
 
 /* TEX
 // As far as I can tell, texture instructions cannot write into output
@@ -887,6 +908,7 @@ I am fairly certain that they are correct unless stated otherwise in comments.
  */
 #               define R300_FPITX_OPCODE_SHIFT                  15
 #                       define R300_FPITX_OP_TEX                        1
+#                       define R300_FPITX_OP_KIL                        2
 #                       define R300_FPITX_OP_TXP                        3
 #                       define R300_FPITX_OP_TXB                        4
 
@@ -962,9 +984,11 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_FPI1_SRC2C_CONST             (1 << 17)
 #       define R300_FPI1_DSTC_SHIFT              18
 #       define R300_FPI1_DSTC_MASK               (31 << 18)
+#               define R300_FPI1_DSTC_REG_MASK_SHIFT     23
 #       define R300_FPI1_DSTC_REG_X              (1 << 23)
 #       define R300_FPI1_DSTC_REG_Y              (1 << 24)
 #       define R300_FPI1_DSTC_REG_Z              (1 << 25)
+#               define R300_FPI1_DSTC_OUTPUT_MASK_SHIFT  26
 #       define R300_FPI1_DSTC_OUTPUT_X           (1 << 26)
 #       define R300_FPI1_DSTC_OUTPUT_Y           (1 << 27)
 #       define R300_FPI1_DSTC_OUTPUT_Z           (1 << 28)
@@ -983,6 +1007,7 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_FPI3_DSTA_MASK               (31 << 18)
 #       define R300_FPI3_DSTA_REG                (1 << 23)
 #       define R300_FPI3_DSTA_OUTPUT             (1 << 24)
+#               define R300_FPI3_DSTA_DEPTH              (1 << 27)
 
 #define R300_PFS_INSTR0_0                   0x48C0
 #       define R300_FPI0_ARGC_SRC0C_XYZ          0
@@ -1036,7 +1061,7 @@ I am fairly certain that they are correct unless stated otherwise in comments.
 #       define R300_FPI0_OUTC_FRC                (9 << 23)
 #       define R300_FPI0_OUTC_REPL_ALPHA         (10 << 23)
 #       define R300_FPI0_OUTC_SAT                (1 << 30)
-#       define R300_FPI0_UNKNOWN_31              (1 << 31)
+#       define R300_FPI0_INSERT_NOP              (1 << 31)
 
 #define R300_PFS_INSTR2_0                   0x49C0
 #       define R300_FPI2_ARGA_SRC0C_X            0
diff --git a/drivers/char/drm/radeon_cp.c b/drivers/char/drm/radeon_cp.c
index 9bb8ae0c1c27..7f949c9c9691 100644
--- a/drivers/char/drm/radeon_cp.c
+++ b/drivers/char/drm/radeon_cp.c
@@ -1118,14 +1118,20 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
 {
         u32 ring_start, cur_read_ptr;
         u32 tmp;
-
-        /* Initialize the memory controller */
-        RADEON_WRITE(RADEON_MC_FB_LOCATION,
-                     ((dev_priv->gart_vm_start - 1) & 0xffff0000)
-                     | (dev_priv->fb_location >> 16));
+        
+        /* Initialize the memory controller. With new memory map, the fb location
+         * is not changed, it should have been properly initialized already. Part
+         * of the problem is that the code below is bogus, assuming the GART is
+         * always appended to the fb which is not necessarily the case
+         */
+        if (!dev_priv->new_memmap)
+                RADEON_WRITE(RADEON_MC_FB_LOCATION,
+                             ((dev_priv->gart_vm_start - 1) & 0xffff0000)
+                             | (dev_priv->fb_location >> 16));
 
 #if __OS_HAS_AGP
         if (dev_priv->flags & CHIP_IS_AGP) {
+                RADEON_WRITE(RADEON_AGP_BASE, (unsigned int)dev->agp->base);
                 RADEON_WRITE(RADEON_MC_AGP_LOCATION,
                              (((dev_priv->gart_vm_start - 1 +
                                 dev_priv->gart_size) & 0xffff0000) |
@@ -1153,8 +1159,6 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
 
 #if __OS_HAS_AGP
         if (dev_priv->flags & CHIP_IS_AGP) {
-                /* set RADEON_AGP_BASE here instead of relying on X from user space */
-                RADEON_WRITE(RADEON_AGP_BASE, (unsigned int)dev->agp->base);
                 RADEON_WRITE(RADEON_CP_RB_RPTR_ADDR,
                              dev_priv->ring_rptr->offset
                              - dev->agp->base + dev_priv->gart_vm_start);
@@ -1174,6 +1178,17 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
                           entry->handle + tmp_ofs);
         }
 
+        /* Set ring buffer size */
+#ifdef __BIG_ENDIAN
+        RADEON_WRITE(RADEON_CP_RB_CNTL,
+                     dev_priv->ring.size_l2qw | RADEON_BUF_SWAP_32BIT);
+#else
+        RADEON_WRITE(RADEON_CP_RB_CNTL, dev_priv->ring.size_l2qw);
+#endif
+
+        /* Start with assuming that writeback doesn't work */
+        dev_priv->writeback_works = 0;
+
         /* Initialize the scratch register pointer.  This will cause
          * the scratch register values to be written out to memory
          * whenever they are updated.
@@ -1190,28 +1205,9 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
 
         RADEON_WRITE(RADEON_SCRATCH_UMSK, 0x7);
 
-        /* Writeback doesn't seem to work everywhere, test it first */
-        DRM_WRITE32(dev_priv->ring_rptr, RADEON_SCRATCHOFF(1), 0);
-        RADEON_WRITE(RADEON_SCRATCH_REG1, 0xdeadbeef);
-
-        for (tmp = 0; tmp < dev_priv->usec_timeout; tmp++) {
-                if (DRM_READ32(dev_priv->ring_rptr, RADEON_SCRATCHOFF(1)) ==
-                    0xdeadbeef)
-                        break;
-                DRM_UDELAY(1);
-        }
-
-        if (tmp < dev_priv->usec_timeout) {
-                dev_priv->writeback_works = 1;
-                DRM_DEBUG("writeback test succeeded, tmp=%d\n", tmp);
-        } else {
-                dev_priv->writeback_works = 0;
-                DRM_DEBUG("writeback test failed\n");
-        }
-        if (radeon_no_wb == 1) {
-                dev_priv->writeback_works = 0;
-                DRM_DEBUG("writeback forced off\n");
-        }
+        /* Turn on bus mastering */
+        tmp = RADEON_READ(RADEON_BUS_CNTL) & ~RADEON_BUS_MASTER_DIS;
+        RADEON_WRITE(RADEON_BUS_CNTL, tmp);
 
         dev_priv->sarea_priv->last_frame = dev_priv->scratch[0] = 0;
         RADEON_WRITE(RADEON_LAST_FRAME_REG, dev_priv->sarea_priv->last_frame);
@@ -1223,26 +1219,45 @@ static void radeon_cp_init_ring_buffer(drm_device_t * dev,
         dev_priv->sarea_priv->last_clear = dev_priv->scratch[2] = 0;
         RADEON_WRITE(RADEON_LAST_CLEAR_REG, dev_priv->sarea_priv->last_clear);
 
-        /* Set ring buffer size */
-#ifdef __BIG_ENDIAN
-        RADEON_WRITE(RADEON_CP_RB_CNTL,
-                     dev_priv->ring.size_l2qw | RADEON_BUF_SWAP_32BIT);
-#else
-        RADEON_WRITE(RADEON_CP_RB_CNTL, dev_priv->ring.size_l2qw);
-#endif
-
         radeon_do_wait_for_idle(dev_priv);
 
-        /* Turn on bus mastering */
-        tmp = RADEON_READ(RADEON_BUS_CNTL) & ~RADEON_BUS_MASTER_DIS;
-        RADEON_WRITE(RADEON_BUS_CNTL, tmp);
-
         /* Sync everything up */
         RADEON_WRITE(RADEON_ISYNC_CNTL,
                      (RADEON_ISYNC_ANY2D_IDLE3D |
                       RADEON_ISYNC_ANY3D_IDLE2D |
                       RADEON_ISYNC_WAIT_IDLEGUI |
                       RADEON_ISYNC_CPSCRATCH_IDLEGUI));
+
+}
+
+static void radeon_test_writeback(drm_radeon_private_t * dev_priv)
+{
+        u32 tmp;
+
+        /* Writeback doesn't seem to work everywhere, test it here and possibly
+         * enable it if it appears to work
+         */
+        DRM_WRITE32(dev_priv->ring_rptr, RADEON_SCRATCHOFF(1), 0);
+        RADEON_WRITE(RADEON_SCRATCH_REG1, 0xdeadbeef);
+
+        for (tmp = 0; tmp < dev_priv->usec_timeout; tmp++) {
+                if (DRM_READ32(dev_priv->ring_rptr, RADEON_SCRATCHOFF(1)) ==
+                    0xdeadbeef)
+                        break;
+                DRM_UDELAY(1);
+        }
+
+        if (tmp < dev_priv->usec_timeout) {
+                dev_priv->writeback_works = 1;
+                DRM_INFO("writeback test succeeded in %d usecs\n", tmp);
+        } else {
+                dev_priv->writeback_works = 0;
+                DRM_INFO("writeback test failed\n");
+        }
+        if (radeon_no_wb == 1) {
+                dev_priv->writeback_works = 0;
+                DRM_INFO("writeback forced off\n");
+        }
 }
 
 /* Enable or disable PCI-E GART on the chip */
@@ -1317,6 +1332,14 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
 
         DRM_DEBUG("\n");
 
+        /* if we require new memory map but we don't have it fail */
+        if ((dev_priv->flags & CHIP_NEW_MEMMAP) && !dev_priv->new_memmap)
+        {
+                DRM_ERROR("Cannot initialise DRM on this card\nThis card requires a new X.org DDX\n");
+                radeon_do_cleanup_cp(dev);
+                return DRM_ERR(EINVAL);
+        }
+
         if (init->is_pci && (dev_priv->flags & CHIP_IS_AGP))
         {
                 DRM_DEBUG("Forcing AGP card to PCI mode\n");
@@ -1496,6 +1519,9 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
 
         dev_priv->fb_location = (RADEON_READ(RADEON_MC_FB_LOCATION)
                                  & 0xffff) << 16;
+        dev_priv->fb_size = 
+                ((RADEON_READ(RADEON_MC_FB_LOCATION) & 0xffff0000u) + 0x10000)
+                - dev_priv->fb_location;
 
         dev_priv->front_pitch_offset = (((dev_priv->front_pitch / 64) << 22) |
                                         ((dev_priv->front_offset
@@ -1510,8 +1536,46 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
                                           + dev_priv->fb_location) >> 10));
 
         dev_priv->gart_size = init->gart_size;
-        dev_priv->gart_vm_start = dev_priv->fb_location
-            + RADEON_READ(RADEON_CONFIG_APER_SIZE);
+
+        /* New let's set the memory map ... */
+        if (dev_priv->new_memmap) {
+                u32 base = 0;
+
+                DRM_INFO("Setting GART location based on new memory map\n");
+
+                /* If using AGP, try to locate the AGP aperture at the same
+                 * location in the card and on the bus, though we have to
+                 * align it down.
+                 */
+#if __OS_HAS_AGP
+                if (dev_priv->flags & CHIP_IS_AGP) {
+                        base = dev->agp->base;
+                        /* Check if valid */
+                        if ((base + dev_priv->gart_size) > dev_priv->fb_location &&
+                            base < (dev_priv->fb_location + dev_priv->fb_size)) {
+                                DRM_INFO("Can't use AGP base @0x%08lx, won't fit\n",
+                                         dev->agp->base);
+                                base = 0;
+                        }
+                }
+#endif
+                /* If not or if AGP is at 0 (Macs), try to put it elsewhere */
+                if (base == 0) {
+                        base = dev_priv->fb_location + dev_priv->fb_size;
+                        if (((base + dev_priv->gart_size) & 0xfffffffful)
+                            < base)
+                                base = dev_priv->fb_location
+                                        - dev_priv->gart_size;
+                }               
+                dev_priv->gart_vm_start = base & 0xffc00000u;
+                if (dev_priv->gart_vm_start != base)
+                        DRM_INFO("GART aligned down from 0x%08x to 0x%08x\n",
+                                 base, dev_priv->gart_vm_start);
+        } else {
+                DRM_INFO("Setting GART location based on old memory map\n");
+                dev_priv->gart_vm_start = dev_priv->fb_location +
+                        RADEON_READ(RADEON_CONFIG_APER_SIZE);
+        }
 
 #if __OS_HAS_AGP
         if (dev_priv->flags & CHIP_IS_AGP)
@@ -1596,6 +1660,7 @@ static int radeon_do_init_cp(drm_device_t * dev, drm_radeon_init_t * init)
         dev_priv->last_buf = 0;
 
         radeon_do_engine_reset(dev);
+        radeon_test_writeback(dev_priv);
 
         return 0;
 }
diff --git a/drivers/char/drm/radeon_drm.h b/drivers/char/drm/radeon_drm.h
index 9c177a6b2a4c..c8e279e89c2e 100644
--- a/drivers/char/drm/radeon_drm.h
+++ b/drivers/char/drm/radeon_drm.h
@@ -222,6 +222,7 @@ typedef union {
 #       define R300_WAIT_3D             0x2
 #       define R300_WAIT_2D_CLEAN       0x3
 #       define R300_WAIT_3D_CLEAN       0x4
+#define R300_CMD_SCRATCH                8
 
 typedef union {
         unsigned int u;
@@ -247,6 +248,9 @@ typedef union {
         struct {
                 unsigned char cmd_type, flags, pad0, pad1;
         } wait;
+        struct {
+                unsigned char cmd_type, reg, n_bufs, flags;
+        } scratch;
 } drm_r300_cmd_header_t;
 
 #define RADEON_FRONT                    0x1
@@ -697,6 +701,7 @@ typedef struct drm_radeon_setparam {
 #define RADEON_SETPARAM_FB_LOCATION    1        /* determined framebuffer location */
 #define RADEON_SETPARAM_SWITCH_TILING  2        /* enable/disable color tiling */
 #define RADEON_SETPARAM_PCIGART_LOCATION 3      /* PCI Gart Location */
+#define RADEON_SETPARAM_NEW_MEMMAP 4            /* Use new memory map */
 
 /* 1.14: Clients can allocate/free a surface
  */
diff --git a/drivers/char/drm/radeon_drv.h b/drivers/char/drm/radeon_drv.h
index 1f7d2ab8c4fc..78345cee8f8e 100644
--- a/drivers/char/drm/radeon_drv.h
+++ b/drivers/char/drm/radeon_drv.h
@@ -38,7 +38,7 @@
 
 #define DRIVER_NAME             "radeon"
 #define DRIVER_DESC             "ATI Radeon"
-#define DRIVER_DATE             "20051229"
+#define DRIVER_DATE             "20060225"
 
 /* Interface history:
  *
@@ -91,9 +91,11 @@
  * 1.20- Add support for r300 texrect
  * 1.21- Add support for card type getparam
  * 1.22- Add support for texture cache flushes (R300_TX_CNTL)
+ * 1.23- Add new radeon memory map work from benh
+ * 1.24- Add general-purpose packet for manipulating scratch registers (r300)
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            22
+#define DRIVER_MINOR            24
 #define DRIVER_PATCHLEVEL       0
 
 /*
@@ -101,20 +103,21 @@
  */
 enum radeon_family {
         CHIP_R100,
-        CHIP_RS100,
         CHIP_RV100,
+        CHIP_RS100,
         CHIP_RV200,
-        CHIP_R200,
         CHIP_RS200,
-        CHIP_R250,
-        CHIP_RS250,
+        CHIP_R200,
         CHIP_RV250,
+        CHIP_RS300,
         CHIP_RV280,
         CHIP_R300,
-        CHIP_RS300,
         CHIP_R350,
         CHIP_RV350,
+        CHIP_RV380,
         CHIP_R420,
+        CHIP_RV410,
+        CHIP_RS400,
         CHIP_LAST,
 };
 
@@ -136,9 +139,11 @@ enum radeon_chip_flags {
         CHIP_IS_AGP = 0x00080000UL,
         CHIP_HAS_HIERZ = 0x00100000UL,
         CHIP_IS_PCIE = 0x00200000UL,
+        CHIP_NEW_MEMMAP = 0x00400000UL,
 };
 
-#define GET_RING_HEAD(dev_priv)         DRM_READ32(  (dev_priv)->ring_rptr, 0 )
+#define GET_RING_HEAD(dev_priv) (dev_priv->writeback_works ? \
+        DRM_READ32(  (dev_priv)->ring_rptr, 0 ) : RADEON_READ(RADEON_CP_RB_RPTR))
 #define SET_RING_HEAD(dev_priv,val)     DRM_WRITE32( (dev_priv)->ring_rptr, 0, (val) )
 
 typedef struct drm_radeon_freelist {
@@ -199,6 +204,8 @@ typedef struct drm_radeon_private {
         drm_radeon_sarea_t *sarea_priv;
 
         u32 fb_location;
+        u32 fb_size;
+        int new_memmap;
 
         int gart_size;
         u32 gart_vm_start;
@@ -272,6 +279,8 @@ typedef struct drm_radeon_private {
         unsigned long pcigart_offset;
         drm_ati_pcigart_info gart_info;
 
+        u32 scratch_ages[5];
+
         /* starting from here on, data is preserved accross an open */
         uint32_t flags;         /* see radeon_chip_flags */
 } drm_radeon_private_t;
diff --git a/drivers/char/drm/radeon_state.c b/drivers/char/drm/radeon_state.c
index 7bc27516d425..c5b8f774a599 100644
--- a/drivers/char/drm/radeon_state.c
+++ b/drivers/char/drm/radeon_state.c
@@ -45,22 +45,53 @@ static __inline__ int radeon_check_and_fixup_offset(drm_radeon_private_t *
         u32 off = *offset;
         struct drm_radeon_driver_file_fields *radeon_priv;
 
-        if (off >= dev_priv->fb_location &&
-            off < (dev_priv->gart_vm_start + dev_priv->gart_size))
-                return 0;
-
-        radeon_priv = filp_priv->driver_priv;
-        off += radeon_priv->radeon_fb_delta;
+        /* Hrm ... the story of the offset ... So this function converts
+         * the various ideas of what userland clients might have for an
+         * offset in the card address space into an offset into the card
+         * address space :) So with a sane client, it should just keep
+         * the value intact and just do some boundary checking. However,
+         * not all clients are sane. Some older clients pass us 0 based
+         * offsets relative to the start of the framebuffer and some may
+         * assume the AGP aperture it appended to the framebuffer, so we
+         * try to detect those cases and fix them up.
+         *
+         * Note: It might be a good idea here to make sure the offset lands
+         * in some "allowed" area to protect things like the PCIE GART...
+         */
 
-        DRM_DEBUG("offset fixed up to 0x%x\n", off);
+        /* First, the best case, the offset already lands in either the
+         * framebuffer or the GART mapped space
+         */
+        if ((off >= dev_priv->fb_location &&
+             off < (dev_priv->fb_location + dev_priv->fb_size)) ||
+            (off >= dev_priv->gart_vm_start &&
+             off < (dev_priv->gart_vm_start + dev_priv->gart_size)))
+                return 0;
 
-        if (off < dev_priv->fb_location ||
-            off >= (dev_priv->gart_vm_start + dev_priv->gart_size))
-                return DRM_ERR(EINVAL);
+        /* Ok, that didn't happen... now check if we have a zero based
+         * offset that fits in the framebuffer + gart space, apply the
+         * magic offset we get from SETPARAM or calculated from fb_location
+         */
+        if (off < (dev_priv->fb_size + dev_priv->gart_size)) {
+                radeon_priv = filp_priv->driver_priv;
+                off += radeon_priv->radeon_fb_delta;
+        }
 
-        *offset = off;
+        /* Finally, assume we aimed at a GART offset if beyond the fb */
+        if (off > (dev_priv->fb_location + dev_priv->fb_size))
+                off = off - (dev_priv->fb_location + dev_priv->fb_size) +
+                        dev_priv->gart_vm_start;
 
-        return 0;
+        /* Now recheck and fail if out of bounds */
+        if ((off >= dev_priv->fb_location &&
+             off < (dev_priv->fb_location + dev_priv->fb_size)) ||
+            (off >= dev_priv->gart_vm_start &&
+             off < (dev_priv->gart_vm_start + dev_priv->gart_size))) {
+                DRM_DEBUG("offset fixed up to 0x%x\n", off);
+                *offset = off;
+                return 0;
+        }
+        return DRM_ERR(EINVAL);
 }
 
 static __inline__ int radeon_check_and_fixup_packets(drm_radeon_private_t *
@@ -1939,11 +1970,6 @@ static int radeon_surface_alloc(DRM_IOCTL_ARGS)
         drm_radeon_private_t *dev_priv = dev->dev_private;
         drm_radeon_surface_alloc_t alloc;
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_COPY_FROM_USER_IOCTL(alloc,
                                  (drm_radeon_surface_alloc_t __user *) data,
                                  sizeof(alloc));
@@ -1960,12 +1986,7 @@ static int radeon_surface_free(DRM_IOCTL_ARGS)
         drm_radeon_private_t *dev_priv = dev->dev_private;
         drm_radeon_surface_free_t memfree;
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
-        DRM_COPY_FROM_USER_IOCTL(memfree, (drm_radeon_mem_free_t __user *) data,
+        DRM_COPY_FROM_USER_IOCTL(memfree, (drm_radeon_surface_free_t __user *) data,
                                  sizeof(memfree));
 
         if (free_surface(filp, dev_priv, memfree.address))
@@ -2100,11 +2121,6 @@ static int radeon_cp_vertex(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN(dev, filp);
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);
 
         DRM_COPY_FROM_USER_IOCTL(vertex, (drm_radeon_vertex_t __user *) data,
@@ -2189,11 +2205,6 @@ static int radeon_cp_indices(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN(dev, filp);
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);
 
         DRM_COPY_FROM_USER_IOCTL(elts, (drm_radeon_indices_t __user *) data,
@@ -2340,11 +2351,6 @@ static int radeon_cp_indirect(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN(dev, filp);
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_COPY_FROM_USER_IOCTL(indirect,
                                  (drm_radeon_indirect_t __user *) data,
                                  sizeof(indirect));
@@ -2417,11 +2423,6 @@ static int radeon_cp_vertex2(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN(dev, filp);
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);
 
         DRM_COPY_FROM_USER_IOCTL(vertex, (drm_radeon_vertex2_t __user *) data,
@@ -2738,11 +2739,6 @@ static int radeon_cp_cmdbuf(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN(dev, filp);
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);
 
         DRM_COPY_FROM_USER_IOCTL(cmdbuf,
@@ -2897,11 +2893,6 @@ static int radeon_cp_getparam(DRM_IOCTL_ARGS)
         drm_radeon_getparam_t param;
         int value;
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_COPY_FROM_USER_IOCTL(param, (drm_radeon_getparam_t __user *) data,
                                  sizeof(param));
 
@@ -2981,11 +2972,6 @@ static int radeon_cp_setparam(DRM_IOCTL_ARGS)
         drm_radeon_setparam_t sp;
         struct drm_radeon_driver_file_fields *radeon_priv;
 
-        if (!dev_priv) {
-                DRM_ERROR("%s called with no initialization\n", __FUNCTION__);
-                return DRM_ERR(EINVAL);
-        }
-
         DRM_GET_PRIV_WITH_RETURN(filp_priv, filp);
 
         DRM_COPY_FROM_USER_IOCTL(sp, (drm_radeon_setparam_t __user *) data,
@@ -3012,6 +2998,9 @@ static int radeon_cp_setparam(DRM_IOCTL_ARGS)
         case RADEON_SETPARAM_PCIGART_LOCATION:
                 dev_priv->pcigart_offset = sp.value;
                 break;
+        case RADEON_SETPARAM_NEW_MEMMAP:
+                dev_priv->new_memmap = sp.value;
+                break;
         default:
                 DRM_DEBUG("Invalid parameter %d\n", sp.param);
                 return DRM_ERR(EINVAL);
diff --git a/drivers/char/drm/sis_mm.c b/drivers/char/drm/sis_mm.c
index 6774d2fe3452..5e9936bc307f 100644
--- a/drivers/char/drm/sis_mm.c
+++ b/drivers/char/drm/sis_mm.c
@@ -110,7 +110,7 @@ static int sis_fb_alloc(DRM_IOCTL_ARGS)
 
         DRM_COPY_TO_USER_IOCTL(argp, fb, sizeof(fb));
 
-        DRM_DEBUG("alloc fb, size = %d, offset = %ld\n", fb.size, req.offset);
+        DRM_DEBUG("alloc fb, size = %d, offset = %d\n", fb.size, req.offset);
 
         return retval;
 }
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 932feedda262..e1c95374984c 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -42,7 +42,7 @@
 #include <linux/slab.h>
 #include <linux/devfs_fs_kernel.h>
 #include <linux/ipmi.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/compat.h>
@@ -55,7 +55,7 @@ struct ipmi_file_private
         struct file          *file;
         struct fasync_struct *fasync_queue;
         wait_queue_head_t    wait;
-        struct semaphore     recv_sem;
+        struct mutex         recv_mutex;
         int                  default_retries;
         unsigned int         default_retry_time_ms;
 };
@@ -141,7 +141,7 @@ static int ipmi_open(struct inode *inode, struct file *file)
         INIT_LIST_HEAD(&(priv->recv_msgs));
         init_waitqueue_head(&priv->wait);
         priv->fasync_queue = NULL;
-        sema_init(&(priv->recv_sem), 1);
+        mutex_init(&priv->recv_mutex);
 
         /* Use the low-level defaults. */
         priv->default_retries = -1;
@@ -285,15 +285,15 @@ static int ipmi_ioctl(struct inode  *inode,
                         break;
                 }
 
-                /* We claim a semaphore because we don't want two
+                /* We claim a mutex because we don't want two
                    users getting something from the queue at a time.
                    Since we have to release the spinlock before we can
                    copy the data to the user, it's possible another
                    user will grab something from the queue, too.  Then
                    the messages might get out of order if something
                    fails and the message gets put back onto the
-                   queue.  This semaphore prevents that problem. */
-                down(&(priv->recv_sem));
+                   queue.  This mutex prevents that problem. */
+                mutex_lock(&priv->recv_mutex);
 
                 /* Grab the message off the list. */
                 spin_lock_irqsave(&(priv->recv_msg_lock), flags);
@@ -352,7 +352,7 @@ static int ipmi_ioctl(struct inode  *inode,
                         goto recv_putback_on_err;
                 }
 
-                up(&(priv->recv_sem));
+                mutex_unlock(&priv->recv_mutex);
                 ipmi_free_recv_msg(msg);
                 break;
 
@@ -362,11 +362,11 @@ static int ipmi_ioctl(struct inode  *inode,
                 spin_lock_irqsave(&(priv->recv_msg_lock), flags);
                 list_add(entry, &(priv->recv_msgs));
                 spin_unlock_irqrestore(&(priv->recv_msg_lock), flags);
-                up(&(priv->recv_sem));
+                mutex_unlock(&priv->recv_mutex);
                 break;
 
         recv_err:
-                up(&(priv->recv_sem));
+                mutex_unlock(&priv->recv_mutex);
                 break;
         }
 
diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c
index da1554194d3d..2062675f9e99 100644
--- a/drivers/char/ipmi/ipmi_kcs_sm.c
+++ b/drivers/char/ipmi/ipmi_kcs_sm.c
@@ -227,7 +227,7 @@ static inline int check_ibf(struct si_sm_data *kcs, unsigned char status,
 static inline int check_obf(struct si_sm_data *kcs, unsigned char status,
                             long time)
 {
-        if (! GET_STATUS_OBF(status)) {
+        if (!GET_STATUS_OBF(status)) {
                 kcs->obf_timeout -= time;
                 if (kcs->obf_timeout < 0) {
                     start_error_recovery(kcs, "OBF not ready in time");
@@ -407,7 +407,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
                 }
 
                 if (state == KCS_READ_STATE) {
-                        if (! check_obf(kcs, status, time))
+                        if (!check_obf(kcs, status, time))
                                 return SI_SM_CALL_WITH_DELAY;
                         read_next_byte(kcs);
                 } else {
@@ -447,7 +447,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
                                              "Not in read state for error2");
                         break;
                 }
-                if (! check_obf(kcs, status, time))
+                if (!check_obf(kcs, status, time))
                         return SI_SM_CALL_WITH_DELAY;
 
                 clear_obf(kcs, status);
@@ -462,7 +462,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time)
                         break;
                 }
 
-                if (! check_obf(kcs, status, time))
+                if (!check_obf(kcs, status, time))
                         return SI_SM_CALL_WITH_DELAY;
 
                 clear_obf(kcs, status);
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 40eb005b9d77..0ded046d5aa8 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -38,6 +38,7 @@
 #include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/spinlock.h>
+#include <linux/mutex.h>
 #include <linux/slab.h>
 #include <linux/ipmi.h>
 #include <linux/ipmi_smi.h>
@@ -234,7 +235,7 @@ struct ipmi_smi
 
         /* The list of command receivers that are registered for commands
            on this interface. */
-        struct semaphore cmd_rcvrs_lock;
+        struct mutex     cmd_rcvrs_mutex;
         struct list_head cmd_rcvrs;
 
         /* Events that were queues because no one was there to receive
@@ -387,10 +388,10 @@ static void clean_up_interface_data(ipmi_smi_t intf)
 
         /* Wholesale remove all the entries from the list in the
          * interface and wait for RCU to know that none are in use. */
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         list_add_rcu(&list, &intf->cmd_rcvrs);
         list_del_rcu(&intf->cmd_rcvrs);
-        up(&intf->cmd_rcvrs_lock);
+        mutex_unlock(&intf->cmd_rcvrs_mutex);
         synchronize_rcu();
 
         list_for_each_entry_safe(rcvr, rcvr2, &list, link)
@@ -557,7 +558,7 @@ unsigned int ipmi_addr_length(int addr_type)
 
 static void deliver_response(struct ipmi_recv_msg *msg)
 {
-        if (! msg->user) {
+        if (!msg->user) {
                 ipmi_smi_t    intf = msg->user_msg_data;
                 unsigned long flags;
 
@@ -598,11 +599,11 @@ static int intf_next_seq(ipmi_smi_t           intf,
              (i+1)%IPMI_IPMB_NUM_SEQ != intf->curr_seq;
              i = (i+1)%IPMI_IPMB_NUM_SEQ)
         {
-                if (! intf->seq_table[i].inuse)
+                if (!intf->seq_table[i].inuse)
                         break;
         }
 
-        if (! intf->seq_table[i].inuse) {
+        if (!intf->seq_table[i].inuse) {
                 intf->seq_table[i].recv_msg = recv_msg;
 
                 /* Start with the maximum timeout, when the send response
@@ -763,7 +764,7 @@ int ipmi_create_user(unsigned int          if_num,
         }
 
         new_user = kmalloc(sizeof(*new_user), GFP_KERNEL);
-        if (! new_user)
+        if (!new_user)
                 return -ENOMEM;
 
         spin_lock_irqsave(&interfaces_lock, flags);
@@ -819,14 +820,13 @@ static void free_user(struct kref *ref)
 
 int ipmi_destroy_user(ipmi_user_t user)
 {
-        int              rv = -ENODEV;
         ipmi_smi_t       intf = user->intf;
         int              i;
         unsigned long    flags;
         struct cmd_rcvr  *rcvr;
         struct cmd_rcvr  *rcvrs = NULL;
 
-        user->valid = 1;
+        user->valid = 0;
 
         /* Remove the user from the interface's sequence table. */
         spin_lock_irqsave(&intf->seq_lock, flags);
@@ -847,7 +847,7 @@ int ipmi_destroy_user(ipmi_user_t user)
          * since other things may be using it till we do
          * synchronize_rcu()) then free everything in that list.
          */
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         list_for_each_entry_rcu(rcvr, &intf->cmd_rcvrs, link) {
                 if (rcvr->user == user) {
                         list_del_rcu(&rcvr->link);
@@ -855,7 +855,7 @@ int ipmi_destroy_user(ipmi_user_t user)
                         rcvrs = rcvr;
                 }
         }
-        up(&intf->cmd_rcvrs_lock);
+        mutex_unlock(&intf->cmd_rcvrs_mutex);
         synchronize_rcu();
         while (rcvrs) {
                 rcvr = rcvrs;
@@ -871,7 +871,7 @@ int ipmi_destroy_user(ipmi_user_t user)
 
         kref_put(&user->refcount, free_user);
 
-        return rv;
+        return 0;
 }
 
 void ipmi_get_version(ipmi_user_t   user,
@@ -936,7 +936,8 @@ int ipmi_set_gets_events(ipmi_user_t user, int val)
 
         if (val) {
                 /* Deliver any queued events. */
-                list_for_each_entry_safe(msg, msg2, &intf->waiting_events, link) {
+                list_for_each_entry_safe(msg, msg2, &intf->waiting_events,
+                                         link) {
                         list_del(&msg->link);
                         list_add_tail(&msg->link, &msgs);
                 }
@@ -978,13 +979,13 @@ int ipmi_register_for_cmd(ipmi_user_t   user,
 
 
         rcvr = kmalloc(sizeof(*rcvr), GFP_KERNEL);
-        if (! rcvr)
+        if (!rcvr)
                 return -ENOMEM;
         rcvr->cmd = cmd;
         rcvr->netfn = netfn;
         rcvr->user = user;
 
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         /* Make sure the command/netfn is not already registered. */
         entry = find_cmd_rcvr(intf, netfn, cmd);
         if (entry) {
@@ -995,7 +996,7 @@ int ipmi_register_for_cmd(ipmi_user_t   user,
         list_add_rcu(&rcvr->link, &intf->cmd_rcvrs);
 
  out_unlock:
-        up(&intf->cmd_rcvrs_lock);
+        mutex_unlock(&intf->cmd_rcvrs_mutex);
         if (rv)
                 kfree(rcvr);
 
@@ -1009,17 +1010,17 @@ int ipmi_unregister_for_cmd(ipmi_user_t   user,
         ipmi_smi_t      intf = user->intf;
         struct cmd_rcvr *rcvr;
 
-        down(&intf->cmd_rcvrs_lock);
+        mutex_lock(&intf->cmd_rcvrs_mutex);
         /* Make sure the command/netfn is not already registered. */
         rcvr = find_cmd_rcvr(intf, netfn, cmd);
         if ((rcvr) && (rcvr->user == user)) {
                 list_del_rcu(&rcvr->link);
-                up(&intf->cmd_rcvrs_lock);
+                mutex_unlock(&intf->cmd_rcvrs_mutex);
                 synchronize_rcu();
                 kfree(rcvr);
                 return 0;
         } else {
-                up(&intf->cmd_rcvrs_lock);
+                mutex_unlock(&intf->cmd_rcvrs_mutex);
                 return -ENOENT;
         }
 }
@@ -1514,7 +1515,7 @@ int ipmi_request_settime(ipmi_user_t      user,
         unsigned char saddr, lun;
         int           rv;
 
-        if (! user)
+        if (!user)
                 return -EINVAL;
         rv = check_addr(user->intf, addr, &saddr, &lun);
         if (rv)
@@ -1545,7 +1546,7 @@ int ipmi_request_supply_msgs(ipmi_user_t          user,
         unsigned char saddr, lun;
         int           rv;
 
-        if (! user)
+        if (!user)
                 return -EINVAL;
         rv = check_addr(user->intf, addr, &saddr, &lun);
         if (rv)
@@ -1570,7 +1571,7 @@ static int ipmb_file_read_proc(char *page, char **start, off_t off,
         char       *out = (char *) page;
         ipmi_smi_t intf = data;
         int        i;
-        int        rv= 0;
+        int        rv = 0;
 
         for (i = 0; i < IPMI_MAX_CHANNELS; i++)
                 rv += sprintf(out+rv, "%x ", intf->channels[i].address);
@@ -1989,7 +1990,7 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
         } else {
                 bmc->dev = platform_device_alloc("ipmi_bmc",
                                                  bmc->id.device_id);
-                if (! bmc->dev) {
+                if (!bmc->dev) {
                         printk(KERN_ERR
                                "ipmi_msghandler:"
                                " Unable to allocate platform device\n");
@@ -2305,8 +2306,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                       void                     *send_info,
                       struct ipmi_device_id    *device_id,
                       struct device            *si_dev,
-                      unsigned char            slave_addr,
-                      ipmi_smi_t               *new_intf)
+                      unsigned char            slave_addr)
 {
         int              i, j;
         int              rv;
@@ -2366,7 +2366,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
         spin_lock_init(&intf->events_lock);
         INIT_LIST_HEAD(&intf->waiting_events);
         intf->waiting_events_count = 0;
-        init_MUTEX(&intf->cmd_rcvrs_lock);
+        mutex_init(&intf->cmd_rcvrs_mutex);
         INIT_LIST_HEAD(&intf->cmd_rcvrs);
         init_waitqueue_head(&intf->waitq);
 
@@ -2388,9 +2388,9 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
         if (rv)
                 goto out;
 
-        /* FIXME - this is an ugly kludge, this sets the intf for the
-           caller before sending any messages with it. */
-        *new_intf = intf;
+        rv = handlers->start_processing(send_info, intf);
+        if (rv)
+                goto out;
 
         get_guid(intf);
 
@@ -2622,7 +2622,7 @@ static int handle_ipmb_get_msg_cmd(ipmi_smi_t          intf,
                 spin_unlock_irqrestore(&intf->counter_lock, flags);
 
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         /* We couldn't allocate memory for the
                            message, so requeue it for handling
                            later. */
@@ -2777,7 +2777,7 @@ static int handle_lan_get_msg_cmd(ipmi_smi_t          intf,
                 spin_unlock_irqrestore(&intf->counter_lock, flags);
 
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         /* We couldn't allocate memory for the
                            message, so requeue it for handling
                            later. */
@@ -2869,13 +2869,14 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
            events. */
         rcu_read_lock();
         list_for_each_entry_rcu(user, &intf->users, link) {
-                if (! user->gets_events)
+                if (!user->gets_events)
                         continue;
 
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         rcu_read_unlock();
-                        list_for_each_entry_safe(recv_msg, recv_msg2, &msgs, link) {
+                        list_for_each_entry_safe(recv_msg, recv_msg2, &msgs,
+                                                 link) {
                                 list_del(&recv_msg->link);
                                 ipmi_free_recv_msg(recv_msg);
                         }
@@ -2905,7 +2906,7 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
                 /* No one to receive the message, put it in queue if there's
                    not already too many things in the queue. */
                 recv_msg = ipmi_alloc_recv_msg();
-                if (! recv_msg) {
+                if (!recv_msg) {
                         /* We couldn't allocate memory for the
                            message, so requeue it for handling
                            later. */
@@ -3190,7 +3191,7 @@ void ipmi_smi_watchdog_pretimeout(ipmi_smi_t intf)
 
         rcu_read_lock();
         list_for_each_entry_rcu(user, &intf->users, link) {
-                if (! user->handler->ipmi_watchdog_pretimeout)
+                if (!user->handler->ipmi_watchdog_pretimeout)
                         continue;
 
                 user->handler->ipmi_watchdog_pretimeout(user->handler_data);
@@ -3278,7 +3279,7 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,
 
                 smi_msg = smi_from_recv_msg(intf, ent->recv_msg, slot,
                                             ent->seqid);
-                if (! smi_msg)
+                if (!smi_msg)
                         return;
 
                 spin_unlock_irqrestore(&intf->seq_lock, *flags);
@@ -3314,8 +3315,9 @@ static void ipmi_timeout_handler(long timeout_period)
 
                 /* See if any waiting messages need to be processed. */
                 spin_lock_irqsave(&intf->waiting_msgs_lock, flags);
-                list_for_each_entry_safe(smi_msg, smi_msg2, &intf->waiting_msgs, link) {
-                        if (! handle_new_recv_msg(intf, smi_msg)) {
+                list_for_each_entry_safe(smi_msg, smi_msg2,
+                                         &intf->waiting_msgs, link) {
+                        if (!handle_new_recv_msg(intf, smi_msg)) {
                                 list_del(&smi_msg->link);
                                 ipmi_free_smi_msg(smi_msg);
                         } else {
diff --git a/drivers/char/ipmi/ipmi_poweroff.c b/drivers/char/ipmi/ipmi_poweroff.c
index 786a2802ca34..d0b5c08e7b4e 100644
--- a/drivers/char/ipmi/ipmi_poweroff.c
+++ b/drivers/char/ipmi/ipmi_poweroff.c
@@ -346,7 +346,7 @@ static int ipmi_dell_chassis_detect (ipmi_user_t user)
 {
         const char ipmi_version_major = ipmi_version & 0xF;
         const char ipmi_version_minor = (ipmi_version >> 4) & 0xF;
-        const char mfr[3]=DELL_IANA_MFR_ID;
+        const char mfr[3] = DELL_IANA_MFR_ID;
         if (!memcmp(mfr, &mfg_id, sizeof(mfr)) &&
             ipmi_version_major <= 1 &&
             ipmi_version_minor < 5)
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 35fbd4d8ed4b..a86c0f29953e 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -803,7 +803,7 @@ static int ipmi_thread(void *data)
         set_user_nice(current, 19);
         while (!kthread_should_stop()) {
                 spin_lock_irqsave(&(smi_info->si_lock), flags);
-                smi_result=smi_event_handler(smi_info, 0);
+                smi_result = smi_event_handler(smi_info, 0);
                 spin_unlock_irqrestore(&(smi_info->si_lock), flags);
                 if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
                         /* do nothing */
@@ -972,10 +972,37 @@ static irqreturn_t si_bt_irq_handler(int irq, void *data, struct pt_regs *regs)
         return si_irq_handler(irq, data, regs);
 }
 
+static int smi_start_processing(void       *send_info,
+                                ipmi_smi_t intf)
+{
+        struct smi_info *new_smi = send_info;
+
+        new_smi->intf = intf;
+
+        /* Set up the timer that drives the interface. */
+        setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
+        new_smi->last_timeout_jiffies = jiffies;
+        mod_timer(&new_smi->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
+
+        if (new_smi->si_type != SI_BT) {
+                new_smi->thread = kthread_run(ipmi_thread, new_smi,
+                                              "kipmi%d", new_smi->intf_num);
+                if (IS_ERR(new_smi->thread)) {
+                        printk(KERN_NOTICE "ipmi_si_intf: Could not start"
+                               " kernel thread due to error %ld, only using"
+                               " timers to drive the interface\n",
+                               PTR_ERR(new_smi->thread));
+                        new_smi->thread = NULL;
+                }
+        }
+
+        return 0;
+}
 
 static struct ipmi_smi_handlers handlers =
 {
         .owner                  = THIS_MODULE,
+        .start_processing       = smi_start_processing,
         .sender                 = sender,
         .request_events         = request_events,
         .set_run_to_completion  = set_run_to_completion,
@@ -987,7 +1014,7 @@ static struct ipmi_smi_handlers handlers =
 
 #define SI_MAX_PARMS 4
 static LIST_HEAD(smi_infos);
-static DECLARE_MUTEX(smi_infos_lock);
+static DEFINE_MUTEX(smi_infos_lock);
 static int smi_num; /* Used to sequence the SMIs */
 
 #define DEFAULT_REGSPACING      1
@@ -2162,9 +2189,13 @@ static void setup_xaction_handlers(struct smi_info *smi_info)
 
 static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
 {
-        if (smi_info->thread != NULL && smi_info->thread != ERR_PTR(-ENOMEM))
-                kthread_stop(smi_info->thread);
-        del_timer_sync(&smi_info->si_timer);
+        if (smi_info->intf) {
+                /* The timer and thread are only running if the
+                   interface has been started up and registered. */
+                if (smi_info->thread != NULL)
+                        kthread_stop(smi_info->thread);
+                del_timer_sync(&smi_info->si_timer);
+        }
 }
 
 static struct ipmi_default_vals
@@ -2245,7 +2276,7 @@ static int try_smi_init(struct smi_info *new_smi)
                        new_smi->slave_addr, new_smi->irq);
         }
 
-        down(&smi_infos_lock);
+        mutex_lock(&smi_infos_lock);
         if (!is_new_interface(new_smi)) {
                 printk(KERN_WARNING "ipmi_si: duplicate interface\n");
                 rv = -EBUSY;
@@ -2341,21 +2372,6 @@ static int try_smi_init(struct smi_info *new_smi)
         if (new_smi->irq)
                 new_smi->si_state = SI_CLEARING_FLAGS_THEN_SET_IRQ;
 
-        /* The ipmi_register_smi() code does some operations to
-           determine the channel information, so we must be ready to
-           handle operations before it is called.  This means we have
-           to stop the timer if we get an error after this point. */
-        init_timer(&(new_smi->si_timer));
-        new_smi->si_timer.data = (long) new_smi;
-        new_smi->si_timer.function = smi_timeout;
-        new_smi->last_timeout_jiffies = jiffies;
-        new_smi->si_timer.expires = jiffies + SI_TIMEOUT_JIFFIES;
-
-        add_timer(&(new_smi->si_timer));
-        if (new_smi->si_type != SI_BT)
-                new_smi->thread = kthread_run(ipmi_thread, new_smi,
-                                              "kipmi%d", new_smi->intf_num);
-
         if (!new_smi->dev) {
                 /* If we don't already have a device from something
                  * else (like PCI), then register a new one. */
@@ -2365,7 +2381,7 @@ static int try_smi_init(struct smi_info *new_smi)
                         printk(KERN_ERR
                                "ipmi_si_intf:"
                                " Unable to allocate platform device\n");
-                        goto out_err_stop_timer;
+                        goto out_err;
                 }
                 new_smi->dev = &new_smi->pdev->dev;
                 new_smi->dev->driver = &ipmi_driver;
@@ -2377,7 +2393,7 @@ static int try_smi_init(struct smi_info *new_smi)
                                " Unable to register system interface device:"
                                " %d\n",
                                rv);
-                        goto out_err_stop_timer;
+                        goto out_err;
                 }
                 new_smi->dev_registered = 1;
         }
@@ -2386,8 +2402,7 @@ static int try_smi_init(struct smi_info *new_smi)
                                new_smi,
                                &new_smi->device_id,
                                new_smi->dev,
-                               new_smi->slave_addr,
-                               &(new_smi->intf));
+                               new_smi->slave_addr);
         if (rv) {
                 printk(KERN_ERR
                        "ipmi_si: Unable to register device: error %d\n",
@@ -2417,7 +2432,7 @@ static int try_smi_init(struct smi_info *new_smi)
 
         list_add_tail(&new_smi->link, &smi_infos);
 
-        up(&smi_infos_lock);
+        mutex_unlock(&smi_infos_lock);
 
         printk(" IPMI %s interface initialized\n",si_to_str[new_smi->si_type]);
 
@@ -2454,7 +2469,7 @@ static int try_smi_init(struct smi_info *new_smi)
 
         kfree(new_smi);
 
-        up(&smi_infos_lock);
+        mutex_unlock(&smi_infos_lock);
 
         return rv;
 }
@@ -2512,26 +2527,26 @@ static __devinit int init_ipmi_si(void)
 #endif
 
         if (si_trydefaults) {
-                down(&smi_infos_lock);
+                mutex_lock(&smi_infos_lock);
                 if (list_empty(&smi_infos)) {
                         /* No BMC was found, try defaults. */
-                        up(&smi_infos_lock);
+                        mutex_unlock(&smi_infos_lock);
                         default_find_bmc();
                 } else {
-                        up(&smi_infos_lock);
+                        mutex_unlock(&smi_infos_lock);
                 }
         }
 
-        down(&smi_infos_lock);
+        mutex_lock(&smi_infos_lock);
         if (list_empty(&smi_infos)) {
-                up(&smi_infos_lock);
+                mutex_unlock(&smi_infos_lock);
 #ifdef CONFIG_PCI
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
                 printk("ipmi_si: Unable to find any System Interface(s)\n");
                 return -ENODEV;
         } else {
-                up(&smi_infos_lock);
+                mutex_unlock(&smi_infos_lock);
                 return 0;
         }
 }
@@ -2607,10 +2622,10 @@ static __exit void cleanup_ipmi_si(void)
         pci_unregister_driver(&ipmi_pci_driver);
 #endif
 
-        down(&smi_infos_lock);
+        mutex_lock(&smi_infos_lock);
         list_for_each_entry_safe(e, tmp_e, &smi_infos, link)
                 cleanup_one_si(e);
-        up(&smi_infos_lock);
+        mutex_unlock(&smi_infos_lock);
 
         driver_unregister(&ipmi_driver);
 }
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 7ece9f3c8f70..2d11ddd99e55 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -39,6 +39,7 @@
 #include <linux/watchdog.h>
 #include <linux/miscdevice.h>
 #include <linux/init.h>
+#include <linux/completion.h>
 #include <linux/rwsem.h>
 #include <linux/errno.h>
 #include <asm/uaccess.h>
@@ -303,21 +304,22 @@ static int ipmi_heartbeat(void);
 static void panic_halt_ipmi_heartbeat(void);
 
 
-/* We use a semaphore to make sure that only one thing can send a set
+/* We use a mutex to make sure that only one thing can send a set
    timeout at one time, because we only have one copy of the data.
-   The semaphore is claimed when the set_timeout is sent and freed
+   The mutex is claimed when the set_timeout is sent and freed
    when both messages are free. */
 static atomic_t set_timeout_tofree = ATOMIC_INIT(0);
-static DECLARE_MUTEX(set_timeout_lock);
+static DEFINE_MUTEX(set_timeout_lock);
+static DECLARE_COMPLETION(set_timeout_wait);
 static void set_timeout_free_smi(struct ipmi_smi_msg *msg)
 {
     if (atomic_dec_and_test(&set_timeout_tofree))
-            up(&set_timeout_lock);
+            complete(&set_timeout_wait);
 }
 static void set_timeout_free_recv(struct ipmi_recv_msg *msg)
 {
     if (atomic_dec_and_test(&set_timeout_tofree))
-            up(&set_timeout_lock);
+            complete(&set_timeout_wait);
 }
 static struct ipmi_smi_msg set_timeout_smi_msg =
 {
@@ -399,7 +401,7 @@ static int ipmi_set_timeout(int do_heartbeat)
 
 
         /* We can only send one of these at a time. */
-        down(&set_timeout_lock);
+        mutex_lock(&set_timeout_lock);
 
         atomic_set(&set_timeout_tofree, 2);
 
@@ -407,16 +409,21 @@ static int ipmi_set_timeout(int do_heartbeat)
                                 &set_timeout_recv_msg,
                                 &send_heartbeat_now);
         if (rv) {
-                up(&set_timeout_lock);
-        } else {
-                if ((do_heartbeat == IPMI_SET_TIMEOUT_FORCE_HB)
-                    || ((send_heartbeat_now)
-                        && (do_heartbeat == IPMI_SET_TIMEOUT_HB_IF_NECESSARY)))
-                {
-                        rv = ipmi_heartbeat();
-                }
+                mutex_unlock(&set_timeout_lock);
+                goto out;
         }
 
+        wait_for_completion(&set_timeout_wait);
+
+        if ((do_heartbeat == IPMI_SET_TIMEOUT_FORCE_HB)
+            || ((send_heartbeat_now)
+                && (do_heartbeat == IPMI_SET_TIMEOUT_HB_IF_NECESSARY)))
+        {
+                rv = ipmi_heartbeat();
+        }
+        mutex_unlock(&set_timeout_lock);
+
+out:
         return rv;
 }
 
@@ -458,17 +465,17 @@ static void panic_halt_ipmi_set_timeout(void)
    The semaphore is claimed when the set_timeout is sent and freed
    when both messages are free. */
 static atomic_t heartbeat_tofree = ATOMIC_INIT(0);
-static DECLARE_MUTEX(heartbeat_lock);
-static DECLARE_MUTEX_LOCKED(heartbeat_wait_lock);
+static DEFINE_MUTEX(heartbeat_lock);
+static DECLARE_COMPLETION(heartbeat_wait);
 static void heartbeat_free_smi(struct ipmi_smi_msg *msg)
 {
     if (atomic_dec_and_test(&heartbeat_tofree))
-            up(&heartbeat_wait_lock);
+            complete(&heartbeat_wait);
 }
 static void heartbeat_free_recv(struct ipmi_recv_msg *msg)
 {
     if (atomic_dec_and_test(&heartbeat_tofree))
-            up(&heartbeat_wait_lock);
+            complete(&heartbeat_wait);
 }
 static struct ipmi_smi_msg heartbeat_smi_msg =
 {
@@ -511,14 +518,14 @@ static int ipmi_heartbeat(void)
                 return ipmi_set_timeout(IPMI_SET_TIMEOUT_HB_IF_NECESSARY);
         }
 
-        down(&heartbeat_lock);
+        mutex_lock(&heartbeat_lock);
 
         atomic_set(&heartbeat_tofree, 2);
 
         /* Don't reset the timer if we have the timer turned off, that
            re-enables the watchdog. */
         if (ipmi_watchdog_state == WDOG_TIMEOUT_NONE) {
-                up(&heartbeat_lock);
+                mutex_unlock(&heartbeat_lock);
                 return 0;
         }
 
@@ -539,14 +546,14 @@ static int ipmi_heartbeat(void)
                                       &heartbeat_recv_msg,
                                       1);
         if (rv) {
-                up(&heartbeat_lock);
+                mutex_unlock(&heartbeat_lock);
                 printk(KERN_WARNING PFX "heartbeat failure: %d\n",
                        rv);
                 return rv;
         }
 
         /* Wait for the heartbeat to be sent. */
-        down(&heartbeat_wait_lock);
+        wait_for_completion(&heartbeat_wait);
 
         if (heartbeat_recv_msg.msg.data[0] != 0) {
             /* Got an error in the heartbeat response.  It was already
@@ -555,7 +562,7 @@ static int ipmi_heartbeat(void)
             rv = -EINVAL;
         }
 
-        up(&heartbeat_lock);
+        mutex_unlock(&heartbeat_lock);
 
         return rv;
 }
@@ -589,7 +596,7 @@ static void panic_halt_ipmi_heartbeat(void)
                                  1);
 }
 
-static struct watchdog_info ident=
+static struct watchdog_info ident =
 {
         .options        = 0,    /* WDIOF_SETTIMEOUT, */
         .firmware_version = 1,
@@ -790,13 +797,13 @@ static int ipmi_fasync(int fd, struct file *file, int on)
 
 static int ipmi_close(struct inode *ino, struct file *filep)
 {
-        if (iminor(ino)==WATCHDOG_MINOR)
-        {
+        if (iminor(ino) == WATCHDOG_MINOR) {
                 if (expect_close == 42) {
                         ipmi_watchdog_state = WDOG_TIMEOUT_NONE;
                         ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB);
                 } else {
-                        printk(KERN_CRIT PFX "Unexpected close, not stopping watchdog!\n");
+                        printk(KERN_CRIT PFX
+                               "Unexpected close, not stopping watchdog!\n");
                         ipmi_heartbeat();
                 }
                 clear_bit(0, &ipmi_wdog_open);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index e5247f85a446..ef20c1fc9c4c 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -706,7 +706,6 @@ static int	stli_portcmdstats(stliport_t *portp);
 static int      stli_clrportstats(stliport_t *portp, comstats_t __user *cp);
 static int      stli_getportstruct(stliport_t __user *arg);
 static int      stli_getbrdstruct(stlibrd_t __user *arg);
-static void     *stli_memalloc(int len);
 static stlibrd_t *stli_allocbrd(void);
 
 static void     stli_ecpinit(stlibrd_t *brdp);
@@ -997,17 +996,6 @@ static int stli_parsebrd(stlconf_t *confp, char **argp)
 
 /*****************************************************************************/
 
-/*
- *      Local driver kernel malloc routine.
- */
-
-static void *stli_memalloc(int len)
-{
-        return((void *) kmalloc(len, GFP_KERNEL));
-}
-
-/*****************************************************************************/
-
 static int stli_open(struct tty_struct *tty, struct file *filp)
 {
         stlibrd_t       *brdp;
@@ -3227,13 +3215,12 @@ static int stli_initports(stlibrd_t *brdp)
 #endif
 
         for (i = 0, panelnr = 0, panelport = 0; (i < brdp->nrports); i++) {
-                portp = (stliport_t *) stli_memalloc(sizeof(stliport_t));
-                if (portp == (stliport_t *) NULL) {
+                portp = kzalloc(sizeof(stliport_t), GFP_KERNEL);
+                if (!portp) {
                         printk("STALLION: failed to allocate port structure\n");
                         continue;
                 }
 
-                memset(portp, 0, sizeof(stliport_t));
                 portp->magic = STLI_PORTMAGIC;
                 portp->portnr = i;
                 portp->brdnr = brdp->brdnr;
@@ -4610,14 +4597,13 @@ static stlibrd_t *stli_allocbrd(void)
 {
         stlibrd_t       *brdp;
 
-        brdp = (stlibrd_t *) stli_memalloc(sizeof(stlibrd_t));
-        if (brdp == (stlibrd_t *) NULL) {
+        brdp = kzalloc(sizeof(stlibrd_t), GFP_KERNEL);
+        if (!brdp) {
                 printk(KERN_ERR "STALLION: failed to allocate memory "
                                 "(size=%d)\n", sizeof(stlibrd_t));
-                return((stlibrd_t *) NULL);
+                return NULL;
         }
 
-        memset(brdp, 0, sizeof(stlibrd_t));
         brdp->magic = STLI_BOARDMAGIC;
         return(brdp);
 }
@@ -5210,12 +5196,12 @@ int __init stli_init(void)
 /*
  *      Allocate a temporary write buffer.
  */
-        stli_tmpwritebuf = (char *) stli_memalloc(STLI_TXBUFSIZE);
-        if (stli_tmpwritebuf == (char *) NULL)
+        stli_tmpwritebuf = kmalloc(STLI_TXBUFSIZE, GFP_KERNEL);
+        if (!stli_tmpwritebuf)
                 printk(KERN_ERR "STALLION: failed to allocate memory "
                                 "(size=%d)\n", STLI_TXBUFSIZE);
-        stli_txcookbuf = stli_memalloc(STLI_TXBUFSIZE);
-        if (stli_txcookbuf == (char *) NULL)
+        stli_txcookbuf = kmalloc(STLI_TXBUFSIZE, GFP_KERNEL);
+        if (!stli_txcookbuf)
                 printk(KERN_ERR "STALLION: failed to allocate memory "
                                 "(size=%d)\n", STLI_TXBUFSIZE);
 
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 3f5d6077f39c..a9c5a7230f89 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -504,7 +504,6 @@ static int	stl_echmcaintr(stlbrd_t *brdp);
 static int      stl_echpciintr(stlbrd_t *brdp);
 static int      stl_echpci64intr(stlbrd_t *brdp);
 static void     stl_offintr(void *private);
-static void     *stl_memalloc(int len);
 static stlbrd_t *stl_allocbrd(void);
 static stlport_t *stl_getport(int brdnr, int panelnr, int portnr);
 
@@ -940,17 +939,6 @@ static int stl_parsebrd(stlconf_t *confp, char **argp)
 /*****************************************************************************/
 
 /*
- *      Local driver kernel memory allocation routine.
- */
-
-static void *stl_memalloc(int len)
-{
-        return (void *) kmalloc(len, GFP_KERNEL);
-}
-
-/*****************************************************************************/
-
-/*
  *      Allocate a new board structure. Fill out the basic info in it.
  */
 
@@ -958,14 +946,13 @@ static stlbrd_t *stl_allocbrd(void)
 {
         stlbrd_t        *brdp;
 
-        brdp = (stlbrd_t *) stl_memalloc(sizeof(stlbrd_t));
-        if (brdp == (stlbrd_t *) NULL) {
+        brdp = kzalloc(sizeof(stlbrd_t), GFP_KERNEL);
+        if (!brdp) {
                 printk("STALLION: failed to allocate memory (size=%d)\n",
                         sizeof(stlbrd_t));
-                return (stlbrd_t *) NULL;
+                return NULL;
         }
 
-        memset(brdp, 0, sizeof(stlbrd_t));
         brdp->magic = STL_BOARDMAGIC;
         return brdp;
 }
@@ -1017,9 +1004,9 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
         portp->refcount++;
 
         if ((portp->flags & ASYNC_INITIALIZED) == 0) {
-                if (portp->tx.buf == (char *) NULL) {
-                        portp->tx.buf = (char *) stl_memalloc(STL_TXBUFSIZE);
-                        if (portp->tx.buf == (char *) NULL)
+                if (!portp->tx.buf) {
+                        portp->tx.buf = kmalloc(STL_TXBUFSIZE, GFP_KERNEL);
+                        if (!portp->tx.buf)
                                 return -ENOMEM;
                         portp->tx.head = portp->tx.buf;
                         portp->tx.tail = portp->tx.buf;
@@ -2178,13 +2165,12 @@ static int __init stl_initports(stlbrd_t *brdp, stlpanel_t *panelp)
  *      each ports data structures.
  */
         for (i = 0; (i < panelp->nrports); i++) {
-                portp = (stlport_t *) stl_memalloc(sizeof(stlport_t));
-                if (portp == (stlport_t *) NULL) {
+                portp = kzalloc(sizeof(stlport_t), GFP_KERNEL);
+                if (!portp) {
                         printk("STALLION: failed to allocate memory "
                                 "(size=%d)\n", sizeof(stlport_t));
                         break;
                 }
-                memset(portp, 0, sizeof(stlport_t));
 
                 portp->magic = STL_PORTMAGIC;
                 portp->portnr = i;
@@ -2315,13 +2301,12 @@ static inline int stl_initeio(stlbrd_t *brdp)
  *      can complete the setup.
  */
 
-        panelp = (stlpanel_t *) stl_memalloc(sizeof(stlpanel_t));
-        if (panelp == (stlpanel_t *) NULL) {
+        panelp = kzalloc(sizeof(stlpanel_t), GFP_KERNEL);
+        if (!panelp) {
                 printk(KERN_WARNING "STALLION: failed to allocate memory "
                         "(size=%d)\n", sizeof(stlpanel_t));
-                return(-ENOMEM);
+                return -ENOMEM;
         }
-        memset(panelp, 0, sizeof(stlpanel_t));
 
         panelp->magic = STL_PANELMAGIC;
         panelp->brdnr = brdp->brdnr;
@@ -2490,13 +2475,12 @@ static inline int stl_initech(stlbrd_t *brdp)
                 status = inb(ioaddr + ECH_PNLSTATUS);
                 if ((status & ECH_PNLIDMASK) != nxtid)
                         break;
-                panelp = (stlpanel_t *) stl_memalloc(sizeof(stlpanel_t));
-                if (panelp == (stlpanel_t *) NULL) {
+                panelp = kzalloc(sizeof(stlpanel_t), GFP_KERNEL);
+                if (!panelp) {
                         printk("STALLION: failed to allocate memory "
                                 "(size=%d)\n", sizeof(stlpanel_t));
                         break;
                 }
-                memset(panelp, 0, sizeof(stlpanel_t));
                 panelp->magic = STL_PANELMAGIC;
                 panelp->brdnr = brdp->brdnr;
                 panelp->panelnr = panelnr;
@@ -3074,8 +3058,8 @@ static int __init stl_init(void)
 /*
  *      Allocate a temporary write buffer.
  */
-        stl_tmpwritebuf = (char *) stl_memalloc(STL_TXBUFSIZE);
-        if (stl_tmpwritebuf == (char *) NULL)
+        stl_tmpwritebuf = kmalloc(STL_TXBUFSIZE, GFP_KERNEL);
+        if (!stl_tmpwritebuf)
                 printk("STALLION: failed to allocate memory (size=%d)\n",
                         STL_TXBUFSIZE);
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 0bfd1b63662e..98b126c2ded8 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -376,7 +376,7 @@ int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, s
         return copied;
 }
 
-EXPORT_SYMBOL_GPL(tty_insert_flip_string);
+EXPORT_SYMBOL(tty_insert_flip_string);
 
 int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *chars, const char *flags, size_t size)
 {
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index ca4844c527da..acc5d47844eb 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2328,6 +2328,10 @@ int tioclinux(struct tty_struct *tty, unsigned long arg)
                 case TIOCL_SETVESABLANK:
                         set_vesa_blanking(p);
                         break;
+                case TIOCL_GETKMSGREDIRECT:
+                        data = kmsg_redirect;
+                        ret = __put_user(data, p);
+                        break;
                 case TIOCL_SETKMSGREDIRECT:
                         if (!capable(CAP_SYS_ADMIN)) {
                                 ret = -EPERM;
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index b582d0cdc24f..4f0898400c6d 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -71,7 +71,7 @@ config EDAC_E7XXX
 
 config EDAC_E752X
         tristate "Intel e752x (e7520, e7525, e7320)"
-        depends on EDAC_MM_EDAC && PCI && X86
+        depends on EDAC_MM_EDAC && PCI && X86 && HOTPLUG
         help
           Support for error detection and correction on the Intel
           E7520, E7525, E7320 server chipsets.
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index ccf528d733bf..a5017de72da5 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -61,6 +61,7 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/mutex.h>
+#include <linux/leds.h>
 
 #define _IDE_DISK
 
@@ -317,6 +318,8 @@ static ide_startstop_t ide_do_rw_disk (ide_drive_t *drive, struct request *rq, s
                 return ide_stopped;
         }
 
+        ledtrig_ide_activity();
+
         pr_debug("%s: %sing: block=%llu, sectors=%lu, buffer=0x%08lx\n",
                  drive->name, rq_data_dir(rq) == READ ? "read" : "writ",
                  (unsigned long long)block, rq->nr_sectors,
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 0606bd2f6020..9233b8109a0f 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -375,7 +375,13 @@ static void task_end_request(ide_drive_t *drive, struct request *rq, u8 stat)
                 }
         }
 
-        ide_end_request(drive, 1, rq->hard_nr_sectors);
+        if (rq->rq_disk) {
+                ide_driver_t *drv;
+
+                drv = *(ide_driver_t **)rq->rq_disk->private_data;;
+                drv->end_request(drive, 1, rq->hard_nr_sectors);
+        } else
+                ide_end_request(drive, 1, rq->hard_nr_sectors);
 }
 
 /*
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index f7854b65fd55..ba54c856b0e5 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -227,6 +227,14 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
                         if (!is_vendor_oui(mad_reg_req->oui))
                                 goto error1;
                 }
+                /* Make sure class supplied is consistent with RMPP */
+                if (ib_is_mad_class_rmpp(mad_reg_req->mgmt_class)) {
+                        if (!rmpp_version)
+                                goto error1;
+                } else {
+                        if (rmpp_version)
+                                goto error1;
+                }
                 /* Make sure class supplied is consistent with QP type */
                 if (qp_type == IB_QPT_SMI) {
                         if ((mad_reg_req->mgmt_class !=
@@ -890,6 +898,35 @@ struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
 }
 EXPORT_SYMBOL(ib_create_send_mad);
 
+int ib_get_mad_data_offset(u8 mgmt_class)
+{
+        if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
+                return IB_MGMT_SA_HDR;
+        else if ((mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
+                 (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
+                 (mgmt_class == IB_MGMT_CLASS_BIS))
+                return IB_MGMT_DEVICE_HDR;
+        else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
+                 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
+                return IB_MGMT_VENDOR_HDR;
+        else
+                return IB_MGMT_MAD_HDR;
+}
+EXPORT_SYMBOL(ib_get_mad_data_offset);
+
+int ib_is_mad_class_rmpp(u8 mgmt_class)
+{
+        if ((mgmt_class == IB_MGMT_CLASS_SUBN_ADM) ||
+            (mgmt_class == IB_MGMT_CLASS_DEVICE_MGMT) ||
+            (mgmt_class == IB_MGMT_CLASS_DEVICE_ADM) ||
+            (mgmt_class == IB_MGMT_CLASS_BIS) ||
+            ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
+             (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)))
+                return 1;
+        return 0;
+}
+EXPORT_SYMBOL(ib_is_mad_class_rmpp);
+
 void *ib_get_rmpp_segment(struct ib_mad_send_buf *send_buf, int seg_num)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
@@ -1022,6 +1059,13 @@ int ib_post_send_mad(struct ib_mad_send_buf *send_buf,
                         goto error;
                 }
 
+                if (!ib_is_mad_class_rmpp(((struct ib_mad_hdr *) send_buf->mad)->mgmt_class)) {
+                        if (mad_agent_priv->agent.rmpp_version) {
+                                ret = -EINVAL;
+                                goto error;
+                        }
+                }
+
                 /*
                  * Save pointer to next work request to post in case the
                  * current one completes, and the user modifies the work
@@ -1618,14 +1662,59 @@ static int is_data_mad(struct ib_mad_agent_private *mad_agent_priv,
                 (rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
 }
 
+static inline int rcv_has_same_class(struct ib_mad_send_wr_private *wr,
+                                     struct ib_mad_recv_wc *rwc)
+{
+        return ((struct ib_mad *)(wr->send_buf.mad))->mad_hdr.mgmt_class ==
+                rwc->recv_buf.mad->mad_hdr.mgmt_class;
+}
+
+static inline int rcv_has_same_gid(struct ib_mad_send_wr_private *wr,
+                                   struct ib_mad_recv_wc *rwc )
+{
+        struct ib_ah_attr attr;
+        u8 send_resp, rcv_resp;
+
+        send_resp = ((struct ib_mad *)(wr->send_buf.mad))->
+                     mad_hdr.method & IB_MGMT_METHOD_RESP;
+        rcv_resp = rwc->recv_buf.mad->mad_hdr.method & IB_MGMT_METHOD_RESP;
+
+        if (!send_resp && rcv_resp)
+                /* is request/response. GID/LIDs are both local (same). */
+                return 1;
+
+        if (send_resp == rcv_resp)
+                /* both requests, or both responses. GIDs different */
+                return 0;
+
+        if (ib_query_ah(wr->send_buf.ah, &attr))
+                /* Assume not equal, to avoid false positives. */
+                return 0;
+
+        if (!(attr.ah_flags & IB_AH_GRH) && !(rwc->wc->wc_flags & IB_WC_GRH))
+                return attr.dlid == rwc->wc->slid;
+        else if ((attr.ah_flags & IB_AH_GRH) &&
+                 (rwc->wc->wc_flags & IB_WC_GRH))
+                return memcmp(attr.grh.dgid.raw,
+                              rwc->recv_buf.grh->sgid.raw, 16) == 0;
+        else
+                /* one has GID, other does not.  Assume different */
+                return 0;
+}
 struct ib_mad_send_wr_private*
-ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, __be64 tid)
+ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
+                 struct ib_mad_recv_wc *mad_recv_wc)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
+        struct ib_mad *mad;
+
+        mad = (struct ib_mad *)mad_recv_wc->recv_buf.mad;
 
         list_for_each_entry(mad_send_wr, &mad_agent_priv->wait_list,
                             agent_list) {
-                if (mad_send_wr->tid == tid)
+                if ((mad_send_wr->tid == mad->mad_hdr.tid) &&
+                    rcv_has_same_class(mad_send_wr, mad_recv_wc) &&
+                    rcv_has_same_gid(mad_send_wr, mad_recv_wc))
                         return mad_send_wr;
         }
 
@@ -1636,7 +1725,10 @@ ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, __be64 tid)
         list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
                             agent_list) {
                 if (is_data_mad(mad_agent_priv, mad_send_wr->send_buf.mad) &&
-                    mad_send_wr->tid == tid && mad_send_wr->timeout) {
+                    mad_send_wr->tid == mad->mad_hdr.tid &&
+                    mad_send_wr->timeout &&
+                    rcv_has_same_class(mad_send_wr, mad_recv_wc) &&
+                    rcv_has_same_gid(mad_send_wr, mad_recv_wc)) {
                         /* Verify request has not been canceled */
                         return (mad_send_wr->status == IB_WC_SUCCESS) ?
                                 mad_send_wr : NULL;
@@ -1661,7 +1753,6 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
         struct ib_mad_send_wr_private *mad_send_wr;
         struct ib_mad_send_wc mad_send_wc;
         unsigned long flags;
-        __be64 tid;
 
         INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
         list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
@@ -1677,9 +1768,8 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
 
         /* Complete corresponding request */
         if (response_mad(mad_recv_wc->recv_buf.mad)) {
-                tid = mad_recv_wc->recv_buf.mad->mad_hdr.tid;
                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
-                mad_send_wr = ib_find_send_mad(mad_agent_priv, tid);
+                mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
                 if (!mad_send_wr) {
                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
                         ib_free_recv_mad(mad_recv_wc);
@@ -2408,11 +2498,11 @@ static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
                         }
                 }
                 sg_list.addr = dma_map_single(qp_info->port_priv->
-                                                device->dma_device,
-                                        &mad_priv->grh,
-                                        sizeof *mad_priv -
-                                                sizeof mad_priv->header,
-                                        DMA_FROM_DEVICE);
+                                                device->dma_device,
+                                              &mad_priv->grh,
+                                              sizeof *mad_priv -
+                                                sizeof mad_priv->header,
+                                              DMA_FROM_DEVICE);
                 pci_unmap_addr_set(&mad_priv->header, mapping, sg_list.addr);
                 recv_wr.wr_id = (unsigned long)&mad_priv->header.mad_list;
                 mad_priv->header.mad_list.mad_queue = recv_queue;
diff --git a/drivers/infiniband/core/mad_priv.h b/drivers/infiniband/core/mad_priv.h
index a7125d4b5ccf..6c9c133d71ef 100644
--- a/drivers/infiniband/core/mad_priv.h
+++ b/drivers/infiniband/core/mad_priv.h
@@ -216,7 +216,8 @@ extern kmem_cache_t *ib_mad_cache;
 int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr);
 
 struct ib_mad_send_wr_private *
-ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, __be64 tid);
+ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
+                 struct ib_mad_recv_wc *mad_recv_wc);
 
 void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
                              struct ib_mad_send_wc *mad_send_wc);
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index bacfdd5bddad..dfd4e588ce03 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 2005 Intel Inc. All rights reserved.
- * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
+ * Copyright (c) 2005-2006 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -100,17 +100,6 @@ void ib_cancel_rmpp_recvs(struct ib_mad_agent_private *agent)
         }
 }
 
-static int data_offset(u8 mgmt_class)
-{
-        if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
-                return IB_MGMT_SA_HDR;
-        else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
-                 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
-                return IB_MGMT_VENDOR_HDR;
-        else
-                return IB_MGMT_RMPP_HDR;
-}
-
 static void format_ack(struct ib_mad_send_buf *msg,
                        struct ib_rmpp_mad *data,
                        struct mad_rmpp_recv *rmpp_recv)
@@ -137,7 +126,7 @@ static void ack_recv(struct mad_rmpp_recv *rmpp_recv,
         struct ib_mad_send_buf *msg;
         int ret, hdr_len;
 
-        hdr_len = data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
+        hdr_len = ib_get_mad_data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
         msg = ib_create_send_mad(&rmpp_recv->agent->agent, recv_wc->wc->src_qp,
                                  recv_wc->wc->pkey_index, 1, hdr_len,
                                  0, GFP_KERNEL);
@@ -163,7 +152,7 @@ static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent,
         if (IS_ERR(ah))
                 return (void *) ah;
 
-        hdr_len = data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
+        hdr_len = ib_get_mad_data_offset(recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
         msg = ib_create_send_mad(agent, recv_wc->wc->src_qp,
                                  recv_wc->wc->pkey_index, 1,
                                  hdr_len, 0, GFP_KERNEL);
@@ -408,7 +397,7 @@ static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
 
         rmpp_mad = (struct ib_rmpp_mad *)rmpp_recv->cur_seg_buf->mad;
 
-        hdr_size = data_offset(rmpp_mad->mad_hdr.mgmt_class);
+        hdr_size = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class);
         data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
         pad = IB_MGMT_RMPP_DATA - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
         if (pad > IB_MGMT_RMPP_DATA || pad < 0)
@@ -562,15 +551,15 @@ static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
         return ib_send_mad(mad_send_wr);
 }
 
-static void abort_send(struct ib_mad_agent_private *agent, __be64 tid,
-                       u8 rmpp_status)
+static void abort_send(struct ib_mad_agent_private *agent,
+                       struct ib_mad_recv_wc *mad_recv_wc, u8 rmpp_status)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
         struct ib_mad_send_wc wc;
         unsigned long flags;
 
         spin_lock_irqsave(&agent->lock, flags);
-        mad_send_wr = ib_find_send_mad(agent, tid);
+        mad_send_wr = ib_find_send_mad(agent, mad_recv_wc);
         if (!mad_send_wr)
                 goto out;       /* Unmatched send */
 
@@ -612,8 +601,7 @@ static void process_rmpp_ack(struct ib_mad_agent_private *agent,
 
         rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
         if (rmpp_mad->rmpp_hdr.rmpp_status) {
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_BAD_STATUS);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
                 return;
         }
@@ -621,14 +609,13 @@ static void process_rmpp_ack(struct ib_mad_agent_private *agent,
         seg_num = be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
         newwin = be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
         if (newwin < seg_num) {
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_W2S);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_W2S);
                 return;
         }
 
         spin_lock_irqsave(&agent->lock, flags);
-        mad_send_wr = ib_find_send_mad(agent, rmpp_mad->mad_hdr.tid);
+        mad_send_wr = ib_find_send_mad(agent, mad_recv_wc);
         if (!mad_send_wr)
                 goto out;       /* Unmatched ACK */
 
@@ -639,8 +626,7 @@ static void process_rmpp_ack(struct ib_mad_agent_private *agent,
         if (seg_num > mad_send_wr->send_buf.seg_count ||
             seg_num > mad_send_wr->newwin) {
                 spin_unlock_irqrestore(&agent->lock, flags);
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_S2B);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_S2B);
                 return;
         }
@@ -728,12 +714,10 @@ static void process_rmpp_stop(struct ib_mad_agent_private *agent,
         rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
 
         if (rmpp_mad->rmpp_hdr.rmpp_status != IB_MGMT_RMPP_STATUS_RESX) {
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_BAD_STATUS);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
         } else
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           rmpp_mad->rmpp_hdr.rmpp_status);
+                abort_send(agent, mad_recv_wc, rmpp_mad->rmpp_hdr.rmpp_status);
 }
 
 static void process_rmpp_abort(struct ib_mad_agent_private *agent,
@@ -745,12 +729,10 @@ static void process_rmpp_abort(struct ib_mad_agent_private *agent,
 
         if (rmpp_mad->rmpp_hdr.rmpp_status < IB_MGMT_RMPP_STATUS_ABORT_MIN ||
             rmpp_mad->rmpp_hdr.rmpp_status > IB_MGMT_RMPP_STATUS_ABORT_MAX) {
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_BAD_STATUS);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BAD_STATUS);
         } else
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           rmpp_mad->rmpp_hdr.rmpp_status);
+                abort_send(agent, mad_recv_wc, rmpp_mad->rmpp_hdr.rmpp_status);
 }
 
 struct ib_mad_recv_wc *
@@ -764,8 +746,7 @@ ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
                 return mad_recv_wc;
 
         if (rmpp_mad->rmpp_hdr.rmpp_version != IB_MGMT_RMPP_VERSION) {
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_UNV);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_UNV);
                 goto out;
         }
@@ -783,8 +764,7 @@ ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
                 process_rmpp_abort(agent, mad_recv_wc);
                 break;
         default:
-                abort_send(agent, rmpp_mad->mad_hdr.tid,
-                           IB_MGMT_RMPP_STATUS_BADT);
+                abort_send(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
                 nack_recv(agent, mad_recv_wc, IB_MGMT_RMPP_STATUS_BADT);
                 break;
         }
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index fb6cd42601f9..afe70a549c2f 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -177,17 +177,6 @@ static int queue_packet(struct ib_umad_file *file,
         return ret;
 }
 
-static int data_offset(u8 mgmt_class)
-{
-        if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
-                return IB_MGMT_SA_HDR;
-        else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
-                 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
-                return IB_MGMT_VENDOR_HDR;
-        else
-                return IB_MGMT_RMPP_HDR;
-}
-
 static void send_handler(struct ib_mad_agent *agent,
                          struct ib_mad_send_wc *send_wc)
 {
@@ -283,7 +272,7 @@ static ssize_t copy_recv_mad(char __user *buf, struct ib_umad_packet *packet,
                          */
                         return -ENOSPC;
                 }
-                offset = data_offset(recv_buf->mad->mad_hdr.mgmt_class);
+                offset = ib_get_mad_data_offset(recv_buf->mad->mad_hdr.mgmt_class);
                 max_seg_payload = sizeof (struct ib_mad) - offset;
 
                 for (left = packet->length - seg_payload, buf += seg_payload;
@@ -441,21 +430,14 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
         }
 
         rmpp_mad = (struct ib_rmpp_mad *) packet->mad.data;
-        if (rmpp_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_ADM) {
-                hdr_len = IB_MGMT_SA_HDR;
-                copy_offset = IB_MGMT_RMPP_HDR;
-                rmpp_active = ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
-                              IB_MGMT_RMPP_FLAG_ACTIVE;
-        } else if (rmpp_mad->mad_hdr.mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START &&
-                   rmpp_mad->mad_hdr.mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END) {
-                hdr_len = IB_MGMT_VENDOR_HDR;
+        hdr_len = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class);
+        if (!ib_is_mad_class_rmpp(rmpp_mad->mad_hdr.mgmt_class)) {
+                copy_offset = IB_MGMT_MAD_HDR;
+                rmpp_active = 0;
+        } else {
                 copy_offset = IB_MGMT_RMPP_HDR;
                 rmpp_active = ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
                               IB_MGMT_RMPP_FLAG_ACTIVE;
-        } else {
-                hdr_len = IB_MGMT_MAD_HDR;
-                copy_offset = IB_MGMT_MAD_HDR;
-                rmpp_active = 0;
         }
 
         data_len = count - sizeof (struct ib_user_mad) - hdr_len;
diff --git a/drivers/infiniband/hw/mthca/mthca_av.c b/drivers/infiniband/hw/mthca/mthca_av.c
index f023d3936518..bc5bdcbe51b5 100644
--- a/drivers/infiniband/hw/mthca/mthca_av.c
+++ b/drivers/infiniband/hw/mthca/mthca_av.c
@@ -265,7 +265,7 @@ int __devinit mthca_init_av_table(struct mthca_dev *dev)
         return -ENOMEM;
 }
 
-void __devexit mthca_cleanup_av_table(struct mthca_dev *dev)
+void mthca_cleanup_av_table(struct mthca_dev *dev)
 {
         if (mthca_is_memfree(dev))
                 return;
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 76aabc5bf371..312cf90731ea 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -973,7 +973,7 @@ int __devinit mthca_init_cq_table(struct mthca_dev *dev)
         return err;
 }
 
-void __devexit mthca_cleanup_cq_table(struct mthca_dev *dev)
+void mthca_cleanup_cq_table(struct mthca_dev *dev)
 {
         mthca_array_cleanup(&dev->cq_table.cq, dev->limits.num_cqs);
         mthca_alloc_cleanup(&dev->cq_table.alloc);
diff --git a/drivers/infiniband/hw/mthca/mthca_eq.c b/drivers/infiniband/hw/mthca/mthca_eq.c
index cbdc348fb689..99f109c3815d 100644
--- a/drivers/infiniband/hw/mthca/mthca_eq.c
+++ b/drivers/infiniband/hw/mthca/mthca_eq.c
@@ -765,7 +765,7 @@ static int __devinit mthca_map_eq_regs(struct mthca_dev *dev)
 
 }
 
-static void __devexit mthca_unmap_eq_regs(struct mthca_dev *dev)
+static void mthca_unmap_eq_regs(struct mthca_dev *dev)
 {
         if (mthca_is_memfree(dev)) {
                 mthca_unmap_reg(dev, (pci_resource_len(dev->pdev, 0) - 1) &
@@ -821,7 +821,7 @@ int __devinit mthca_map_eq_icm(struct mthca_dev *dev, u64 icm_virt)
         return ret;
 }
 
-void __devexit mthca_unmap_eq_icm(struct mthca_dev *dev)
+void mthca_unmap_eq_icm(struct mthca_dev *dev)
 {
         u8 status;
 
@@ -954,7 +954,7 @@ err_out_free:
         return err;
 }
 
-void __devexit mthca_cleanup_eq_table(struct mthca_dev *dev)
+void mthca_cleanup_eq_table(struct mthca_dev *dev)
 {
         u8 status;
         int i;
diff --git a/drivers/infiniband/hw/mthca/mthca_mad.c b/drivers/infiniband/hw/mthca/mthca_mad.c
index 4ace6a392f41..dfb482eac9a2 100644
--- a/drivers/infiniband/hw/mthca/mthca_mad.c
+++ b/drivers/infiniband/hw/mthca/mthca_mad.c
@@ -271,7 +271,7 @@ err:
         return PTR_ERR(agent);
 }
 
-void mthca_free_agents(struct mthca_dev *dev)
+void __devexit mthca_free_agents(struct mthca_dev *dev)
 {
         struct ib_mad_agent *agent;
         int p, q;
diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c
index 9965bda9afed..47ca8a9b7247 100644
--- a/drivers/infiniband/hw/mthca/mthca_mcg.c
+++ b/drivers/infiniband/hw/mthca/mthca_mcg.c
@@ -388,7 +388,7 @@ int __devinit mthca_init_mcg_table(struct mthca_dev *dev)
         return 0;
 }
 
-void __devexit mthca_cleanup_mcg_table(struct mthca_dev *dev)
+void mthca_cleanup_mcg_table(struct mthca_dev *dev)
 {
         mthca_alloc_cleanup(&dev->mcg_table.alloc);
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 698b62125765..25e1c1db9a40 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -170,7 +170,7 @@ err_out:
         return -ENOMEM;
 }
 
-static void __devexit mthca_buddy_cleanup(struct mthca_buddy *buddy)
+static void mthca_buddy_cleanup(struct mthca_buddy *buddy)
 {
         int i;
 
@@ -866,7 +866,7 @@ err_mtt_buddy:
         return err;
 }
 
-void __devexit mthca_cleanup_mr_table(struct mthca_dev *dev)
+void mthca_cleanup_mr_table(struct mthca_dev *dev)
 {
         /* XXX check if any MRs are still allocated? */
         if (dev->limits.fmr_reserved_mtts)
diff --git a/drivers/infiniband/hw/mthca/mthca_pd.c b/drivers/infiniband/hw/mthca/mthca_pd.c
index 105fc5faaddf..59df51614c85 100644
--- a/drivers/infiniband/hw/mthca/mthca_pd.c
+++ b/drivers/infiniband/hw/mthca/mthca_pd.c
@@ -77,7 +77,7 @@ int __devinit mthca_init_pd_table(struct mthca_dev *dev)
                                 dev->limits.reserved_pds);
 }
 
-void __devexit mthca_cleanup_pd_table(struct mthca_dev *dev)
+void mthca_cleanup_pd_table(struct mthca_dev *dev)
 {
         /* XXX check if any PDs are still allocated? */
         mthca_alloc_cleanup(&dev->pd_table.alloc);
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 1bc2678c2fae..057c8e6af87b 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -2204,7 +2204,7 @@ int __devinit mthca_init_qp_table(struct mthca_dev *dev)
         return err;
 }
 
-void __devexit mthca_cleanup_qp_table(struct mthca_dev *dev)
+void mthca_cleanup_qp_table(struct mthca_dev *dev)
 {
         int i;
         u8 status;
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 0cfd15802217..2dd3aea05341 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -206,7 +206,7 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
                  roundup_pow_of_two(sizeof (struct mthca_next_seg) +
                                     srq->max_gs * sizeof (struct mthca_data_seg)));
 
-        if (ds > dev->limits.max_desc_sz)
+        if (!mthca_is_memfree(dev) && (ds > dev->limits.max_desc_sz))
                 return -EINVAL;
 
         srq->wqe_shift = long_log2(ds);
@@ -684,7 +684,7 @@ int __devinit mthca_init_srq_table(struct mthca_dev *dev)
         return err;
 }
 
-void __devexit mthca_cleanup_srq_table(struct mthca_dev *dev)
+void mthca_cleanup_srq_table(struct mthca_dev *dev)
 {
         if (!(dev->mthca_flags & MTHCA_FLAG_SRQ))
                 return;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 53a32f65788d..9b0bd7c746ca 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -723,7 +723,7 @@ static int ipoib_hard_header(struct sk_buff *skb,
          * destination address onto the front of the skb so we can
          * figure out where to send the packet later.
          */
-        if (!skb->dst || !skb->dst->neighbour) {
+        if ((!skb->dst || !skb->dst->neighbour) && daddr) {
                 struct ipoib_pseudoheader *phdr =
                         (struct ipoib_pseudoheader *) skb_push(skb, sizeof *phdr);
                 memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 61924cc30e55..fd8a95a9c5d3 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -607,10 +607,10 @@ static void srp_unmap_data(struct scsi_cmnd *scmnd,
          */
         if (likely(scmnd->use_sg)) {
                 nents = scmnd->use_sg;
-                scat  = (struct scatterlist *) scmnd->request_buffer;
+                scat  = scmnd->request_buffer;
         } else {
                 nents = 1;
-                scat  = (struct scatterlist *) scmnd->request_buffer;
+                scat  = &req->fake_sg;
         }
 
         dma_unmap_sg(target->srp_host->dev->dma_device, scat, nents,
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 0a90962c38e7..63f387e4b783 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -66,7 +66,7 @@ static unsigned int hil_kbd_set3[HIL_KEYCODES_SET3_TBLSIZE] =
 static char hil_language[][16] = { HIL_LOCALE_MAP };
 
 struct hil_kbd {
-        struct input_dev dev;
+        struct input_dev *dev;
         struct serio *serio;
 
         /* Input buffer and index for packets from HIL bus. */
@@ -86,7 +86,7 @@ struct hil_kbd {
 /* Process a complete packet after transfer from the HIL */
 static void hil_kbd_process_record(struct hil_kbd *kbd)
 {
-        struct input_dev *dev = &kbd->dev;
+        struct input_dev *dev = kbd->dev;
         hil_packet *data = kbd->data;
         hil_packet p;
         int idx, i, cnt;
@@ -240,8 +240,8 @@ static void hil_kbd_disconnect(struct serio *serio)
                 return;
         }
 
-        input_unregister_device(&kbd->dev);
         serio_close(serio);
+        input_unregister_device(kbd->dev);
         kfree(kbd);
 }
 
@@ -251,16 +251,18 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
         uint8_t         did, *idd;
         int             i;
         
-        kbd = kmalloc(sizeof(*kbd), GFP_KERNEL);
+        kbd = kzalloc(sizeof(*kbd), GFP_KERNEL);
         if (!kbd)
                 return -ENOMEM;
-        memset(kbd, 0, sizeof(struct hil_kbd));
+
+        kbd->dev = input_allocate_device();
+        if (!kbd->dev) goto bail1;
+        kbd->dev->private = kbd;
 
         if (serio_open(serio, drv)) goto bail0;
 
         serio_set_drvdata(serio, kbd);
         kbd->serio = serio;
-        kbd->dev.private = kbd;
 
         init_MUTEX_LOCKED(&(kbd->sem));
 
@@ -302,38 +304,38 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
                         did, hil_language[did & HIL_IDD_DID_TYPE_KB_LANG_MASK]);
                 break;
         default:
-                goto bail1;
+                goto bail2;
         }
 
         if(HIL_IDD_NUM_BUTTONS(idd) || HIL_IDD_NUM_AXES_PER_SET(*idd)) {
                 printk(KERN_INFO PREFIX "keyboards only, no combo devices supported.\n");
-                goto bail1;
+                goto bail2;
         }
 
 
-        kbd->dev.evbit[0]       = BIT(EV_KEY) | BIT(EV_REP);
-        kbd->dev.ledbit[0]      = BIT(LED_NUML) | BIT(LED_CAPSL) | BIT(LED_SCROLLL);
-        kbd->dev.keycodemax     = HIL_KEYCODES_SET1_TBLSIZE;
-        kbd->dev.keycodesize    = sizeof(hil_kbd_set1[0]);
-        kbd->dev.keycode        = hil_kbd_set1;
-        kbd->dev.name           = strlen(kbd->rnm) ? kbd->rnm : HIL_GENERIC_NAME;
-        kbd->dev.phys           = "hpkbd/input0";       /* XXX */
+        kbd->dev->evbit[0]      = BIT(EV_KEY) | BIT(EV_REP);
+        kbd->dev->ledbit[0]     = BIT(LED_NUML) | BIT(LED_CAPSL) | BIT(LED_SCROLLL);
+        kbd->dev->keycodemax    = HIL_KEYCODES_SET1_TBLSIZE;
+        kbd->dev->keycodesize   = sizeof(hil_kbd_set1[0]);
+        kbd->dev->keycode       = hil_kbd_set1;
+        kbd->dev->name          = strlen(kbd->rnm) ? kbd->rnm : HIL_GENERIC_NAME;
+        kbd->dev->phys          = "hpkbd/input0";       /* XXX */
 
-        kbd->dev.id.bustype     = BUS_HIL;
-        kbd->dev.id.vendor      = PCI_VENDOR_ID_HP;
-        kbd->dev.id.product     = 0x0001; /* TODO: get from kbd->rsc */
-        kbd->dev.id.version     = 0x0100; /* TODO: get from kbd->rsc */
-        kbd->dev.dev            = &serio->dev;
+        kbd->dev->id.bustype    = BUS_HIL;
+        kbd->dev->id.vendor     = PCI_VENDOR_ID_HP;
+        kbd->dev->id.product    = 0x0001; /* TODO: get from kbd->rsc */
+        kbd->dev->id.version    = 0x0100; /* TODO: get from kbd->rsc */
+        kbd->dev->dev           = &serio->dev;
 
         for (i = 0; i < 128; i++) {
-                set_bit(hil_kbd_set1[i], kbd->dev.keybit);
-                set_bit(hil_kbd_set3[i], kbd->dev.keybit);
+                set_bit(hil_kbd_set1[i], kbd->dev->keybit);
+                set_bit(hil_kbd_set3[i], kbd->dev->keybit);
         }
-        clear_bit(0, kbd->dev.keybit);
+        clear_bit(0, kbd->dev->keybit);
 
-        input_register_device(&kbd->dev);
+        input_register_device(kbd->dev);
         printk(KERN_INFO "input: %s, ID: %d\n",
-                kbd->dev.name, did);
+                kbd->dev->name, did);
 
         serio->write(serio, 0);
         serio->write(serio, 0);
@@ -343,8 +345,10 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
         up(&(kbd->sem));
 
         return 0;
- bail1:
+ bail2:
         serio_close(serio);
+ bail1:
+        input_free_device(kbd->dev);
  bail0:
         kfree(kbd);
         serio_set_drvdata(serio, NULL);
diff --git a/drivers/input/keyboard/hilkbd.c b/drivers/input/keyboard/hilkbd.c
index e95bc052e32a..33edd030aa75 100644
--- a/drivers/input/keyboard/hilkbd.c
+++ b/drivers/input/keyboard/hilkbd.c
@@ -3,7 +3,7 @@
  *
  *  Copyright (C) 1998 Philip Blundell <philb@gnu.org>
  *  Copyright (C) 1999 Matthew Wilcox <willy@bofh.ai>
- *  Copyright (C) 1999-2003 Helge Deller <deller@gmx.de>
+ *  Copyright (C) 1999-2006 Helge Deller <deller@gmx.de>
  *
  *  Very basic HP Human Interface Loop (HIL) driver.
  *  This driver handles the keyboard on HP300 (m68k) and on some 
@@ -90,7 +90,7 @@ static unsigned int hphilkeyb_keycode[HIL_KEYCODES_SET1_TBLSIZE] =
 
 /* HIL structure */
 static struct {
-        struct input_dev dev;
+        struct input_dev *dev;
 
         unsigned int curdev;
         
@@ -117,7 +117,7 @@ static void poll_finished(void)
                 down = (hil_dev.data[1] & 1) == 0;
                 scode = hil_dev.data[1] >> 1;
                 key = hphilkeyb_keycode[scode];
-                input_report_key(&hil_dev.dev, key, down);
+                input_report_key(hil_dev.dev, key, down);
                 break;
         }
         hil_dev.curdev = 0;
@@ -207,9 +207,14 @@ hil_keyb_init(void)
         unsigned int i, kbid;
         wait_queue_head_t hil_wait;
 
-        if (hil_dev.dev.id.bustype) {
+        if (hil_dev.dev) {
                 return -ENODEV; /* already initialized */
         }
+
+        hil_dev.dev = input_allocate_device();
+        if (!hil_dev.dev)
+                return -ENOMEM;
+        hil_dev.dev->private = &hil_dev;
         
 #if defined(CONFIG_HP300)
         if (!hwreg_present((void *)(HILBASE + HIL_DATA)))
@@ -247,28 +252,26 @@ hil_keyb_init(void)
         c = 0;
         hil_do(HIL_WRITEKBDSADR, &c, 1);
         
-        init_input_dev(&hil_dev.dev);
-
         for (i = 0; i < HIL_KEYCODES_SET1_TBLSIZE; i++)
                 if (hphilkeyb_keycode[i] != KEY_RESERVED)
-                        set_bit(hphilkeyb_keycode[i], hil_dev.dev.keybit);
-
-        hil_dev.dev.evbit[0]    = BIT(EV_KEY) | BIT(EV_REP);
-        hil_dev.dev.ledbit[0]   = BIT(LED_NUML) | BIT(LED_CAPSL) | BIT(LED_SCROLLL);
-        hil_dev.dev.keycodemax  = HIL_KEYCODES_SET1_TBLSIZE;
-        hil_dev.dev.keycodesize = sizeof(hphilkeyb_keycode[0]);
-        hil_dev.dev.keycode     = hphilkeyb_keycode;
-        hil_dev.dev.name        = "HIL keyboard";
-        hil_dev.dev.phys        = "hpkbd/input0";
-
-        hil_dev.dev.id.bustype  = BUS_HIL;
-        hil_dev.dev.id.vendor   = PCI_VENDOR_ID_HP;
-        hil_dev.dev.id.product  = 0x0001;
-        hil_dev.dev.id.version  = 0x0010;
-
-        input_register_device(&hil_dev.dev);
+                        set_bit(hphilkeyb_keycode[i], hil_dev.dev->keybit);
+
+        hil_dev.dev->evbit[0]    = BIT(EV_KEY) | BIT(EV_REP);
+        hil_dev.dev->ledbit[0]   = BIT(LED_NUML) | BIT(LED_CAPSL) | BIT(LED_SCROLLL);
+        hil_dev.dev->keycodemax  = HIL_KEYCODES_SET1_TBLSIZE;
+        hil_dev.dev->keycodesize = sizeof(hphilkeyb_keycode[0]);
+        hil_dev.dev->keycode     = hphilkeyb_keycode;
+        hil_dev.dev->name       = "HIL keyboard";
+        hil_dev.dev->phys       = "hpkbd/input0";
+
+        hil_dev.dev->id.bustype = BUS_HIL;
+        hil_dev.dev->id.vendor  = PCI_VENDOR_ID_HP;
+        hil_dev.dev->id.product = 0x0001;
+        hil_dev.dev->id.version = 0x0010;
+
+        input_register_device(hil_dev.dev);
         printk(KERN_INFO "input: %s, ID %d at 0x%08lx (irq %d) found and attached\n",
-                hil_dev.dev.name, kbid, HILBASE, HIL_IRQ);
+                hil_dev.dev->name, kbid, HILBASE, HIL_IRQ);
 
         return 0;
 }
@@ -329,7 +332,9 @@ static void __exit hil_exit(void)
         /* Turn off interrupts */
         hil_do(HIL_INTOFF, NULL, 0);
 
-        input_unregister_device(&hil_dev.dev);
+        input_unregister_device(hil_dev.dev);
+
+        hil_dev.dev = NULL;
 
 #if defined(CONFIG_PARISC)
         unregister_parisc_driver(&hil_driver);
diff --git a/drivers/input/mouse/hil_ptr.c b/drivers/input/mouse/hil_ptr.c
index c2bf2ed07dc6..bfb564fd8fe2 100644
--- a/drivers/input/mouse/hil_ptr.c
+++ b/drivers/input/mouse/hil_ptr.c
@@ -55,7 +55,7 @@ MODULE_LICENSE("Dual BSD/GPL");
 #define HIL_PTR_MAX_LENGTH 16
 
 struct hil_ptr {
-        struct input_dev dev;
+        struct input_dev *dev;
         struct serio *serio;
 
         /* Input buffer and index for packets from HIL bus. */
@@ -79,7 +79,7 @@ struct hil_ptr {
 /* Process a complete packet after transfer from the HIL */
 static void hil_ptr_process_record(struct hil_ptr *ptr)
 {
-        struct input_dev *dev = &ptr->dev;
+        struct input_dev *dev = ptr->dev;
         hil_packet *data = ptr->data;
         hil_packet p;
         int idx, i, cnt, laxis;
@@ -148,12 +148,12 @@ static void hil_ptr_process_record(struct hil_ptr *ptr)
                 if (absdev) {
                         val = lo + (hi<<8);
 #ifdef TABLET_AUTOADJUST
-                        if (val < ptr->dev.absmin[ABS_X + i])
-                                ptr->dev.absmin[ABS_X + i] = val;
-                        if (val > ptr->dev.absmax[ABS_X + i])
-                                ptr->dev.absmax[ABS_X + i] = val;
+                        if (val < dev->absmin[ABS_X + i])
+                                dev->absmin[ABS_X + i] = val;
+                        if (val > dev->absmax[ABS_X + i])
+                                dev->absmax[ABS_X + i] = val;
 #endif
-                        if (i%3) val = ptr->dev.absmax[ABS_X + i] - val;
+                        if (i%3) val = dev->absmax[ABS_X + i] - val;
                         input_report_abs(dev, ABS_X + i, val);
                 } else {
                         val = (int) (((int8_t)lo) | ((int8_t)hi<<8));
@@ -233,26 +233,29 @@ static void hil_ptr_disconnect(struct serio *serio)
                 return;
         }
 
-        input_unregister_device(&ptr->dev);
         serio_close(serio);
+        input_unregister_device(ptr->dev);
         kfree(ptr);
 }
 
 static int hil_ptr_connect(struct serio *serio, struct serio_driver *driver)
 {
-        struct hil_ptr  *ptr;
-        char            *txt;
-        unsigned int    i, naxsets, btntype;
-        uint8_t         did, *idd;
+        struct hil_ptr   *ptr;
+        char             *txt;
+        unsigned int     i, naxsets, btntype;
+        uint8_t          did, *idd;
 
-        if (!(ptr = kmalloc(sizeof(struct hil_ptr), GFP_KERNEL))) return -ENOMEM;
-        memset(ptr, 0, sizeof(struct hil_ptr));
+        if (!(ptr = kzalloc(sizeof(struct hil_ptr), GFP_KERNEL)))
+                return -ENOMEM;
 
-        if (serio_open(serio, driver)) goto bail0;
+        ptr->dev = input_allocate_device();
+        if (!ptr->dev) goto bail0;
+        ptr->dev->private = ptr;
+
+        if (serio_open(serio, driver)) goto bail1;
 
         serio_set_drvdata(serio, ptr);
         ptr->serio = serio;
-        ptr->dev.private = ptr;
 
         init_MUTEX_LOCKED(&(ptr->sem));
 
@@ -283,25 +286,24 @@ static int hil_ptr_connect(struct serio *serio, struct serio_driver *driver)
 
         up(&(ptr->sem));
 
-        init_input_dev(&ptr->dev);
         did = ptr->idd[0];
         idd = ptr->idd + 1;
         txt = "unknown";
         if ((did & HIL_IDD_DID_TYPE_MASK) == HIL_IDD_DID_TYPE_REL) {
-                ptr->dev.evbit[0] = BIT(EV_REL);
+                ptr->dev->evbit[0] = BIT(EV_REL);
                 txt = "relative";
         }
 
         if ((did & HIL_IDD_DID_TYPE_MASK) == HIL_IDD_DID_TYPE_ABS) {
-                ptr->dev.evbit[0] = BIT(EV_ABS);
+                ptr->dev->evbit[0] = BIT(EV_ABS);
                 txt = "absolute";
         }
-        if (!ptr->dev.evbit[0]) {
-                goto bail1;
+        if (!ptr->dev->evbit[0]) {
+                goto bail2;
         }
 
         ptr->nbtn = HIL_IDD_NUM_BUTTONS(idd);
-        if (ptr->nbtn) ptr->dev.evbit[0] |= BIT(EV_KEY);
+        if (ptr->nbtn) ptr->dev->evbit[0] |= BIT(EV_KEY);
 
         naxsets = HIL_IDD_NUM_AXSETS(*idd);
         ptr->naxes = HIL_IDD_NUM_AXES_PER_SET(*idd);
@@ -325,7 +327,7 @@ static int hil_ptr_connect(struct serio *serio, struct serio_driver *driver)
                 btntype = BTN_MOUSE;
 
         for (i = 0; i < ptr->nbtn; i++) {
-                set_bit(btntype | i, ptr->dev.keybit);
+                set_bit(btntype | i, ptr->dev->keybit);
                 ptr->btnmap[i] = btntype | i;
         }
 
@@ -337,50 +339,52 @@ static int hil_ptr_connect(struct serio *serio, struct serio_driver *driver)
 
         if ((did & HIL_IDD_DID_TYPE_MASK) == HIL_IDD_DID_TYPE_REL) {
                 for (i = 0; i < ptr->naxes; i++) {
-                        set_bit(REL_X + i, ptr->dev.relbit);
+                        set_bit(REL_X + i, ptr->dev->relbit);
                 }
                 for (i = 3; (i < ptr->naxes + 3) && (naxsets > 1); i++) {
-                        set_bit(REL_X + i, ptr->dev.relbit);
+                        set_bit(REL_X + i, ptr->dev->relbit);
                 }
         } else {
                 for (i = 0; i < ptr->naxes; i++) {
-                        set_bit(ABS_X + i, ptr->dev.absbit);
-                        ptr->dev.absmin[ABS_X + i] = 0;
-                        ptr->dev.absmax[ABS_X + i] = 
+                        set_bit(ABS_X + i, ptr->dev->absbit);
+                        ptr->dev->absmin[ABS_X + i] = 0;
+                        ptr->dev->absmax[ABS_X + i] =
                                 HIL_IDD_AXIS_MAX((ptr->idd + 1), i);
                 }
                 for (i = 3; (i < ptr->naxes + 3) && (naxsets > 1); i++) {
-                        set_bit(ABS_X + i, ptr->dev.absbit);
-                        ptr->dev.absmin[ABS_X + i] = 0;
-                        ptr->dev.absmax[ABS_X + i] = 
+                        set_bit(ABS_X + i, ptr->dev->absbit);
+                        ptr->dev->absmin[ABS_X + i] = 0;
+                        ptr->dev->absmax[ABS_X + i] =
                                 HIL_IDD_AXIS_MAX((ptr->idd + 1), (i - 3));
                 }
 #ifdef TABLET_AUTOADJUST
                 for (i = 0; i < ABS_MAX; i++) {
-                        int diff = ptr->dev.absmax[ABS_X + i] / 10;
-                        ptr->dev.absmin[ABS_X + i] += diff;
-                        ptr->dev.absmax[ABS_X + i] -= diff;
+                        int diff = ptr->dev->absmax[ABS_X + i] / 10;
+                        ptr->dev->absmin[ABS_X + i] += diff;
+                        ptr->dev->absmax[ABS_X + i] -= diff;
                 }
 #endif
         }
 
-        ptr->dev.name = strlen(ptr->rnm) ? ptr->rnm : HIL_GENERIC_NAME;
+        ptr->dev->name = strlen(ptr->rnm) ? ptr->rnm : HIL_GENERIC_NAME;
 
-        ptr->dev.id.bustype     = BUS_HIL;
-        ptr->dev.id.vendor      = PCI_VENDOR_ID_HP;
-        ptr->dev.id.product     = 0x0001; /* TODO: get from ptr->rsc */
-        ptr->dev.id.version     = 0x0100; /* TODO: get from ptr->rsc */
-        ptr->dev.dev            = &serio->dev;
+        ptr->dev->id.bustype    = BUS_HIL;
+        ptr->dev->id.vendor     = PCI_VENDOR_ID_HP;
+        ptr->dev->id.product    = 0x0001; /* TODO: get from ptr->rsc */
+        ptr->dev->id.version    = 0x0100; /* TODO: get from ptr->rsc */
+        ptr->dev->dev           = &serio->dev;
 
-        input_register_device(&ptr->dev);
+        input_register_device(ptr->dev);
         printk(KERN_INFO "input: %s (%s), ID: %d\n",
-                ptr->dev.name, 
+                ptr->dev->name,
                 (btntype == BTN_MOUSE) ? "HIL mouse":"HIL tablet or touchpad",
                 did);
 
         return 0;
- bail1:
+ bail2:
         serio_close(serio);
+ bail1:
+        input_free_device(ptr->dev);
  bail0:
         kfree(ptr);
         serio_set_drvdata(serio, NULL);
diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
index a7b0de0f92b2..c0b1e4becad3 100644
--- a/drivers/input/serio/gscps2.c
+++ b/drivers/input/serio/gscps2.c
@@ -1,7 +1,7 @@
 /*
  * drivers/input/serio/gscps2.c
  *
- * Copyright (c) 2004 Helge Deller <deller@gmx.de>
+ * Copyright (c) 2004-2006 Helge Deller <deller@gmx.de>
  * Copyright (c) 2002 Laurent Canet <canetl@esiee.fr>
  * Copyright (c) 2002 Thibaut Varene <varenet@parisc-linux.org>
  *
@@ -354,7 +354,7 @@ static int __init gscps2_probe(struct parisc_device *dev)
         memset(serio, 0, sizeof(struct serio));
         ps2port->port = serio;
         ps2port->padev = dev;
-        ps2port->addr = ioremap(hpa, GSC_STATUS + 4);
+        ps2port->addr = ioremap_nocache(hpa, GSC_STATUS + 4);
         spin_lock_init(&ps2port->lock);
 
         gscps2_reset(ps2port);
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c
index 94c9afb7017c..f4f71226a078 100644
--- a/drivers/isdn/sc/ioctl.c
+++ b/drivers/isdn/sc/ioctl.c
@@ -46,7 +46,8 @@ int sc_ioctl(int card, scs_ioctl *data)
                 pr_debug("%s: SCIOCRESET: ioctl received\n",
                         sc_adapter[card]->devicename);
                 sc_adapter[card]->StartOnReset = 0;
-                return (reset(card));
+                kfree(rcvmsg);
+                return reset(card);
         }
 
         case SCIOCLOAD:
@@ -183,7 +184,7 @@ int sc_ioctl(int card, scs_ioctl *data)
                                 sc_adapter[card]->devicename);
 
                 spid = kmalloc(SCIOC_SPIDSIZE, GFP_KERNEL);
-                if(!spid) {
+                if (!spid) {
                         kfree(rcvmsg);
                         return -ENOMEM;
                 }
@@ -195,10 +196,10 @@ int sc_ioctl(int card, scs_ioctl *data)
                 if (!status) {
                         pr_debug("%s: SCIOCGETSPID: command successful\n",
                                         sc_adapter[card]->devicename);
-                }
-                else {
+                } else {
                         pr_debug("%s: SCIOCGETSPID: command failed (status = %d)\n",
                                 sc_adapter[card]->devicename, status);
+                        kfree(spid);
                         kfree(rcvmsg);
                         return status;
                 }
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
new file mode 100644
index 000000000000..2c4f20b7f021
--- /dev/null
+++ b/drivers/leds/Kconfig
@@ -0,0 +1,77 @@
+
+menu "LED devices"
+
+config NEW_LEDS
+        bool "LED Support"
+        help
+          Say Y to enable Linux LED support.  This is not related to standard
+          keyboard LEDs which are controlled via the input system.
+
+config LEDS_CLASS
+        tristate "LED Class Support"
+        depends NEW_LEDS
+        help
+          This option enables the led sysfs class in /sys/class/leds.  You'll
+          need this to do anything useful with LEDs.  If unsure, say N.
+
+config LEDS_TRIGGERS
+        bool "LED Trigger support"
+        depends NEW_LEDS
+        help
+          This option enables trigger support for the leds class.
+          These triggers allow kernel events to drive the LEDs and can
+          be configured via sysfs. If unsure, say Y.
+
+config LEDS_CORGI
+        tristate "LED Support for the Sharp SL-C7x0 series"
+        depends LEDS_CLASS && PXA_SHARP_C7xx
+        help
+          This option enables support for the LEDs on Sharp Zaurus
+          SL-C7x0 series (C700, C750, C760, C860).
+
+config LEDS_LOCOMO
+        tristate "LED Support for Locomo device"
+        depends LEDS_CLASS && SHARP_LOCOMO
+        help
+          This option enables support for the LEDs on Sharp Locomo.
+          Zaurus models SL-5500 and SL-5600.
+
+config LEDS_SPITZ
+        tristate "LED Support for the Sharp SL-Cxx00 series"
+        depends LEDS_CLASS && PXA_SHARP_Cxx00
+        help
+          This option enables support for the LEDs on Sharp Zaurus
+          SL-Cxx00 series (C1000, C3000, C3100).
+
+config LEDS_IXP4XX
+        tristate "LED Support for GPIO connected LEDs on IXP4XX processors"
+        depends LEDS_CLASS && ARCH_IXP4XX
+        help
+          This option enables support for the LEDs connected to GPIO
+          outputs of the Intel IXP4XX processors.  To be useful the
+          particular board must have LEDs and they must be connected
+          to the GPIO lines.  If unsure, say Y.
+
+config LEDS_TOSA
+        tristate "LED Support for the Sharp SL-6000 series"
+        depends LEDS_CLASS && PXA_SHARPSL
+        help
+          This option enables support for the LEDs on Sharp Zaurus
+          SL-6000 series.
+
+config LEDS_TRIGGER_TIMER
+        tristate "LED Timer Trigger"
+        depends LEDS_TRIGGERS
+        help
+          This allows LEDs to be controlled by a programmable timer
+          via sysfs. If unsure, say Y.
+
+config LEDS_TRIGGER_IDE_DISK
+        bool "LED Timer Trigger"
+        depends LEDS_TRIGGERS && BLK_DEV_IDEDISK
+        help
+          This allows LEDs to be controlled by IDE disk activity.
+          If unsure, say Y.
+
+endmenu
+
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
new file mode 100644
index 000000000000..40699d3cabbf
--- /dev/null
+++ b/drivers/leds/Makefile
@@ -0,0 +1,16 @@
+
+# LED Core
+obj-$(CONFIG_NEW_LEDS)                  += led-core.o
+obj-$(CONFIG_LEDS_CLASS)                += led-class.o
+obj-$(CONFIG_LEDS_TRIGGERS)             += led-triggers.o
+
+# LED Platform Drivers
+obj-$(CONFIG_LEDS_CORGI)                += leds-corgi.o
+obj-$(CONFIG_LEDS_LOCOMO)               += leds-locomo.o
+obj-$(CONFIG_LEDS_SPITZ)                += leds-spitz.o
+obj-$(CONFIG_LEDS_IXP4XX)               += leds-ixp4xx-gpio.o
+obj-$(CONFIG_LEDS_TOSA)                 += leds-tosa.o
+
+# LED Triggers
+obj-$(CONFIG_LEDS_TRIGGER_TIMER)        += ledtrig-timer.o
+obj-$(CONFIG_LEDS_TRIGGER_IDE_DISK)     += ledtrig-ide-disk.o
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
new file mode 100644
index 000000000000..b0b5d05fadd6
--- /dev/null
+++ b/drivers/leds/led-class.c
@@ -0,0 +1,167 @@
+/*
+ * LED Class Core
+ *
+ * Copyright (C) 2005 John Lenz <lenz@cs.wisc.edu>
+ * Copyright (C) 2005-2006 Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/device.h>
+#include <linux/sysdev.h>
+#include <linux/timer.h>
+#include <linux/err.h>
+#include <linux/leds.h>
+#include "leds.h"
+
+static struct class *leds_class;
+
+static ssize_t led_brightness_show(struct class_device *dev, char *buf)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        ssize_t ret = 0;
+
+        /* no lock needed for this */
+        sprintf(buf, "%u\n", led_cdev->brightness);
+        ret = strlen(buf) + 1;
+
+        return ret;
+}
+
+static ssize_t led_brightness_store(struct class_device *dev,
+                                const char *buf, size_t size)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        ssize_t ret = -EINVAL;
+        char *after;
+        unsigned long state = simple_strtoul(buf, &after, 10);
+
+        if (after - buf > 0) {
+                ret = after - buf;
+                led_set_brightness(led_cdev, state);
+        }
+
+        return ret;
+}
+
+static CLASS_DEVICE_ATTR(brightness, 0644, led_brightness_show,
+                        led_brightness_store);
+#ifdef CONFIG_LEDS_TRIGGERS
+static CLASS_DEVICE_ATTR(trigger, 0644, led_trigger_show, led_trigger_store);
+#endif
+
+/**
+ * led_classdev_suspend - suspend an led_classdev.
+ * @led_cdev: the led_classdev to suspend.
+ */
+void led_classdev_suspend(struct led_classdev *led_cdev)
+{
+        led_cdev->flags |= LED_SUSPENDED;
+        led_cdev->brightness_set(led_cdev, 0);
+}
+EXPORT_SYMBOL_GPL(led_classdev_suspend);
+
+/**
+ * led_classdev_resume - resume an led_classdev.
+ * @led_cdev: the led_classdev to resume.
+ */
+void led_classdev_resume(struct led_classdev *led_cdev)
+{
+        led_cdev->brightness_set(led_cdev, led_cdev->brightness);
+        led_cdev->flags &= ~LED_SUSPENDED;
+}
+EXPORT_SYMBOL_GPL(led_classdev_resume);
+
+/**
+ * led_classdev_register - register a new object of led_classdev class.
+ * @dev: The device to register.
+ * @led_cdev: the led_classdev structure for this device.
+ */
+int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
+{
+        led_cdev->class_dev = class_device_create(leds_class, NULL, 0,
+                                                parent, "%s", led_cdev->name);
+        if (unlikely(IS_ERR(led_cdev->class_dev)))
+                return PTR_ERR(led_cdev->class_dev);
+
+        class_set_devdata(led_cdev->class_dev, led_cdev);
+
+        /* register the attributes */
+        class_device_create_file(led_cdev->class_dev,
+                                &class_device_attr_brightness);
+
+        /* add to the list of leds */
+        write_lock(&leds_list_lock);
+        list_add_tail(&led_cdev->node, &leds_list);
+        write_unlock(&leds_list_lock);
+
+#ifdef CONFIG_LEDS_TRIGGERS
+        rwlock_init(&led_cdev->trigger_lock);
+
+        led_trigger_set_default(led_cdev);
+
+        class_device_create_file(led_cdev->class_dev,
+                                &class_device_attr_trigger);
+#endif
+
+        printk(KERN_INFO "Registered led device: %s\n",
+                        led_cdev->class_dev->class_id);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(led_classdev_register);
+
+/**
+ * led_classdev_unregister - unregisters a object of led_properties class.
+ * @led_cdev: the led device to unreigister
+ *
+ * Unregisters a previously registered via led_classdev_register object.
+ */
+void led_classdev_unregister(struct led_classdev *led_cdev)
+{
+        class_device_remove_file(led_cdev->class_dev,
+                                &class_device_attr_brightness);
+#ifdef CONFIG_LEDS_TRIGGERS
+        class_device_remove_file(led_cdev->class_dev,
+                                &class_device_attr_trigger);
+        write_lock(&led_cdev->trigger_lock);
+        if (led_cdev->trigger)
+                led_trigger_set(led_cdev, NULL);
+        write_unlock(&led_cdev->trigger_lock);
+#endif
+
+        class_device_unregister(led_cdev->class_dev);
+
+        write_lock(&leds_list_lock);
+        list_del(&led_cdev->node);
+        write_unlock(&leds_list_lock);
+}
+EXPORT_SYMBOL_GPL(led_classdev_unregister);
+
+static int __init leds_init(void)
+{
+        leds_class = class_create(THIS_MODULE, "leds");
+        if (IS_ERR(leds_class))
+                return PTR_ERR(leds_class);
+        return 0;
+}
+
+static void __exit leds_exit(void)
+{
+        class_destroy(leds_class);
+}
+
+subsys_initcall(leds_init);
+module_exit(leds_exit);
+
+MODULE_AUTHOR("John Lenz, Richard Purdie");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("LED Class Interface");
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
new file mode 100644
index 000000000000..fe6541326c71
--- /dev/null
+++ b/drivers/leds/led-core.c
@@ -0,0 +1,25 @@
+/*
+ * LED Class Core
+ *
+ * Copyright 2005-2006 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/leds.h>
+#include "leds.h"
+
+rwlock_t leds_list_lock = RW_LOCK_UNLOCKED;
+LIST_HEAD(leds_list);
+
+EXPORT_SYMBOL_GPL(leds_list);
+EXPORT_SYMBOL_GPL(leds_list_lock);
diff --git a/drivers/leds/led-triggers.c b/drivers/leds/led-triggers.c
new file mode 100644
index 000000000000..5e2cd8be1191
--- /dev/null
+++ b/drivers/leds/led-triggers.c
@@ -0,0 +1,239 @@
+/*
+ * LED Triggers Core
+ *
+ * Copyright 2005-2006 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/device.h>
+#include <linux/sysdev.h>
+#include <linux/timer.h>
+#include <linux/leds.h>
+#include "leds.h"
+
+/*
+ * Nests outside led_cdev->trigger_lock
+ */
+static rwlock_t triggers_list_lock = RW_LOCK_UNLOCKED;
+static LIST_HEAD(trigger_list);
+
+ssize_t led_trigger_store(struct class_device *dev, const char *buf,
+                        size_t count)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        char trigger_name[TRIG_NAME_MAX];
+        struct led_trigger *trig;
+        size_t len;
+
+        trigger_name[sizeof(trigger_name) - 1] = '\0';
+        strncpy(trigger_name, buf, sizeof(trigger_name) - 1);
+        len = strlen(trigger_name);
+
+        if (len && trigger_name[len - 1] == '\n')
+                trigger_name[len - 1] = '\0';
+
+        if (!strcmp(trigger_name, "none")) {
+                write_lock(&led_cdev->trigger_lock);
+                led_trigger_set(led_cdev, NULL);
+                write_unlock(&led_cdev->trigger_lock);
+                return count;
+        }
+
+        read_lock(&triggers_list_lock);
+        list_for_each_entry(trig, &trigger_list, next_trig) {
+                if (!strcmp(trigger_name, trig->name)) {
+                        write_lock(&led_cdev->trigger_lock);
+                        led_trigger_set(led_cdev, trig);
+                        write_unlock(&led_cdev->trigger_lock);
+
+                        read_unlock(&triggers_list_lock);
+                        return count;
+                }
+        }
+        read_unlock(&triggers_list_lock);
+
+        return -EINVAL;
+}
+
+
+ssize_t led_trigger_show(struct class_device *dev, char *buf)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        struct led_trigger *trig;
+        int len = 0;
+
+        read_lock(&triggers_list_lock);
+        read_lock(&led_cdev->trigger_lock);
+
+        if (!led_cdev->trigger)
+                len += sprintf(buf+len, "[none] ");
+        else
+                len += sprintf(buf+len, "none ");
+
+        list_for_each_entry(trig, &trigger_list, next_trig) {
+                if (led_cdev->trigger && !strcmp(led_cdev->trigger->name,
+                                                        trig->name))
+                        len += sprintf(buf+len, "[%s] ", trig->name);
+                else
+                        len += sprintf(buf+len, "%s ", trig->name);
+        }
+        read_unlock(&led_cdev->trigger_lock);
+        read_unlock(&triggers_list_lock);
+
+        len += sprintf(len+buf, "\n");
+        return len;
+}
+
+void led_trigger_event(struct led_trigger *trigger,
+                        enum led_brightness brightness)
+{
+        struct list_head *entry;
+
+        if (!trigger)
+                return;
+
+        read_lock(&trigger->leddev_list_lock);
+        list_for_each(entry, &trigger->led_cdevs) {
+                struct led_classdev *led_cdev;
+
+                led_cdev = list_entry(entry, struct led_classdev, trig_list);
+                led_set_brightness(led_cdev, brightness);
+        }
+        read_unlock(&trigger->leddev_list_lock);
+}
+
+/* Caller must ensure led_cdev->trigger_lock held */
+void led_trigger_set(struct led_classdev *led_cdev, struct led_trigger *trigger)
+{
+        unsigned long flags;
+
+        /* Remove any existing trigger */
+        if (led_cdev->trigger) {
+                write_lock_irqsave(&led_cdev->trigger->leddev_list_lock, flags);
+                list_del(&led_cdev->trig_list);
+                write_unlock_irqrestore(&led_cdev->trigger->leddev_list_lock, flags);
+                if (led_cdev->trigger->deactivate)
+                        led_cdev->trigger->deactivate(led_cdev);
+        }
+        if (trigger) {
+                write_lock_irqsave(&trigger->leddev_list_lock, flags);
+                list_add_tail(&led_cdev->trig_list, &trigger->led_cdevs);
+                write_unlock_irqrestore(&trigger->leddev_list_lock, flags);
+                if (trigger->activate)
+                        trigger->activate(led_cdev);
+        }
+        led_cdev->trigger = trigger;
+}
+
+void led_trigger_set_default(struct led_classdev *led_cdev)
+{
+        struct led_trigger *trig;
+
+        if (!led_cdev->default_trigger)
+                return;
+
+        read_lock(&triggers_list_lock);
+        write_lock(&led_cdev->trigger_lock);
+        list_for_each_entry(trig, &trigger_list, next_trig) {
+                if (!strcmp(led_cdev->default_trigger, trig->name))
+                        led_trigger_set(led_cdev, trig);
+        }
+        write_unlock(&led_cdev->trigger_lock);
+        read_unlock(&triggers_list_lock);
+}
+
+int led_trigger_register(struct led_trigger *trigger)
+{
+        struct led_classdev *led_cdev;
+
+        rwlock_init(&trigger->leddev_list_lock);
+        INIT_LIST_HEAD(&trigger->led_cdevs);
+
+        /* Add to the list of led triggers */
+        write_lock(&triggers_list_lock);
+        list_add_tail(&trigger->next_trig, &trigger_list);
+        write_unlock(&triggers_list_lock);
+
+        /* Register with any LEDs that have this as a default trigger */
+        read_lock(&leds_list_lock);
+        list_for_each_entry(led_cdev, &leds_list, node) {
+                write_lock(&led_cdev->trigger_lock);
+                if (!led_cdev->trigger && led_cdev->default_trigger &&
+                            !strcmp(led_cdev->default_trigger, trigger->name))
+                        led_trigger_set(led_cdev, trigger);
+                write_unlock(&led_cdev->trigger_lock);
+        }
+        read_unlock(&leds_list_lock);
+
+        return 0;
+}
+
+void led_trigger_register_simple(const char *name, struct led_trigger **tp)
+{
+        struct led_trigger *trigger;
+
+        trigger = kzalloc(sizeof(struct led_trigger), GFP_KERNEL);
+
+        if (trigger) {
+                trigger->name = name;
+                led_trigger_register(trigger);
+        }
+        *tp = trigger;
+}
+
+void led_trigger_unregister(struct led_trigger *trigger)
+{
+        struct led_classdev *led_cdev;
+
+        /* Remove from the list of led triggers */
+        write_lock(&triggers_list_lock);
+        list_del(&trigger->next_trig);
+        write_unlock(&triggers_list_lock);
+
+        /* Remove anyone actively using this trigger */
+        read_lock(&leds_list_lock);
+        list_for_each_entry(led_cdev, &leds_list, node) {
+                write_lock(&led_cdev->trigger_lock);
+                if (led_cdev->trigger == trigger)
+                        led_trigger_set(led_cdev, NULL);
+                write_unlock(&led_cdev->trigger_lock);
+        }
+        read_unlock(&leds_list_lock);
+}
+
+void led_trigger_unregister_simple(struct led_trigger *trigger)
+{
+        led_trigger_unregister(trigger);
+        kfree(trigger);
+}
+
+/* Used by LED Class */
+EXPORT_SYMBOL_GPL(led_trigger_set);
+EXPORT_SYMBOL_GPL(led_trigger_set_default);
+EXPORT_SYMBOL_GPL(led_trigger_show);
+EXPORT_SYMBOL_GPL(led_trigger_store);
+
+/* LED Trigger Interface */
+EXPORT_SYMBOL_GPL(led_trigger_register);
+EXPORT_SYMBOL_GPL(led_trigger_unregister);
+
+/* Simple LED Tigger Interface */
+EXPORT_SYMBOL_GPL(led_trigger_register_simple);
+EXPORT_SYMBOL_GPL(led_trigger_unregister_simple);
+EXPORT_SYMBOL_GPL(led_trigger_event);
+
+MODULE_AUTHOR("Richard Purdie");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("LED Triggers Core");
diff --git a/drivers/leds/leds-corgi.c b/drivers/leds/leds-corgi.c
new file mode 100644
index 000000000000..bb7d84df0121
--- /dev/null
+++ b/drivers/leds/leds-corgi.c
@@ -0,0 +1,121 @@
+/*
+ * LED Triggers Core
+ *
+ * Copyright 2005-2006 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <asm/mach-types.h>
+#include <asm/arch/corgi.h>
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/hardware/scoop.h>
+
+static void corgiled_amber_set(struct led_classdev *led_cdev, enum led_brightness value)
+{
+        if (value)
+                GPSR0 = GPIO_bit(CORGI_GPIO_LED_ORANGE);
+        else
+                GPCR0 = GPIO_bit(CORGI_GPIO_LED_ORANGE);
+}
+
+static void corgiled_green_set(struct led_classdev *led_cdev, enum led_brightness value)
+{
+        if (value)
+                set_scoop_gpio(&corgiscoop_device.dev, CORGI_SCP_LED_GREEN);
+        else
+                reset_scoop_gpio(&corgiscoop_device.dev, CORGI_SCP_LED_GREEN);
+}
+
+static struct led_classdev corgi_amber_led = {
+        .name                   = "corgi:amber",
+        .default_trigger        = "sharpsl-charge",
+        .brightness_set         = corgiled_amber_set,
+};
+
+static struct led_classdev corgi_green_led = {
+        .name                   = "corgi:green",
+        .default_trigger        = "nand-disk",
+        .brightness_set         = corgiled_green_set,
+};
+
+#ifdef CONFIG_PM
+static int corgiled_suspend(struct platform_device *dev, pm_message_t state)
+{
+#ifdef CONFIG_LEDS_TRIGGERS
+        if (corgi_amber_led.trigger && strcmp(corgi_amber_led.trigger->name, "sharpsl-charge"))
+#endif
+                led_classdev_suspend(&corgi_amber_led);
+        led_classdev_suspend(&corgi_green_led);
+        return 0;
+}
+
+static int corgiled_resume(struct platform_device *dev)
+{
+        led_classdev_resume(&corgi_amber_led);
+        led_classdev_resume(&corgi_green_led);
+        return 0;
+}
+#endif
+
+static int corgiled_probe(struct platform_device *pdev)
+{
+        int ret;
+
+        ret = led_classdev_register(&pdev->dev, &corgi_amber_led);
+        if (ret < 0)
+                return ret;
+
+        ret = led_classdev_register(&pdev->dev, &corgi_green_led);
+        if (ret < 0)
+                led_classdev_unregister(&corgi_amber_led);
+
+        return ret;
+}
+
+static int corgiled_remove(struct platform_device *pdev)
+{
+        led_classdev_unregister(&corgi_amber_led);
+        led_classdev_unregister(&corgi_green_led);
+        return 0;
+}
+
+static struct platform_driver corgiled_driver = {
+        .probe          = corgiled_probe,
+        .remove         = corgiled_remove,
+#ifdef CONFIG_PM
+        .suspend        = corgiled_suspend,
+        .resume         = corgiled_resume,
+#endif
+        .driver         = {
+                .name           = "corgi-led",
+        },
+};
+
+static int __init corgiled_init(void)
+{
+        return platform_driver_register(&corgiled_driver);
+}
+
+static void __exit corgiled_exit(void)
+{
+        platform_driver_unregister(&corgiled_driver);
+}
+
+module_init(corgiled_init);
+module_exit(corgiled_exit);
+
+MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
+MODULE_DESCRIPTION("Corgi LED driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/leds-ixp4xx-gpio.c b/drivers/leds/leds-ixp4xx-gpio.c
new file mode 100644
index 000000000000..30ced150e4cf
--- /dev/null
+++ b/drivers/leds/leds-ixp4xx-gpio.c
@@ -0,0 +1,215 @@
+/*
+ * IXP4XX GPIO driver LED driver
+ *
+ * Author: John Bowler <jbowler@acm.org>
+ *
+ * Copyright (c) 2006 John Bowler
+ *
+ * Permission is hereby granted, free of charge, to any
+ * person obtaining a copy of this software and associated
+ * documentation files (the "Software"), to deal in the
+ * Software without restriction, including without
+ * limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the
+ * following conditions:
+ *
+ * The above copyright notice and this permission notice
+ * shall be included in all copies or substantial portions
+ * of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ * ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+ * TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+ * PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+ * SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR
+ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/leds.h>
+#include <asm/arch/hardware.h>
+
+extern spinlock_t gpio_lock;
+
+/* Up to 16 gpio lines are possible. */
+#define GPIO_MAX 16
+static struct ixp4xxgpioled_device {
+        struct led_classdev ancestor;
+        int               flags;
+} ixp4xxgpioled_devices[GPIO_MAX];
+
+void ixp4xxgpioled_brightness_set(struct led_classdev *pled,
+                                enum led_brightness value)
+{
+        const struct ixp4xxgpioled_device *const ixp4xx_dev =
+                container_of(pled, struct ixp4xxgpioled_device, ancestor);
+        const u32 gpio_pin = ixp4xx_dev - ixp4xxgpioled_devices;
+
+        if (gpio_pin < GPIO_MAX && ixp4xx_dev->ancestor.name != 0) {
+                /* Set or clear the 'gpio_pin' bit according to the style
+                 * and the required setting (value > 0 == on)
+                 */
+                const int gpio_value =
+                        (value > 0) == (ixp4xx_dev->flags != IXP4XX_GPIO_LOW) ?
+                                IXP4XX_GPIO_HIGH : IXP4XX_GPIO_LOW;
+
+                {
+                        unsigned long flags;
+                        spin_lock_irqsave(&gpio_lock, flags);
+                        gpio_line_set(gpio_pin, gpio_value);
+                        spin_unlock_irqrestore(&gpio_lock, flags);
+                }
+        }
+}
+
+/* LEDs are described in resources, the following iterates over the valid
+ * LED resources.
+ */
+#define for_all_leds(i, pdev) \
+        for (i=0; i<pdev->num_resources; ++i) \
+                if (pdev->resource[i].start < GPIO_MAX && \
+                        pdev->resource[i].name != 0)
+
+/* The following applies 'operation' to each LED from the given platform,
+ * the function always returns 0 to allow tail call elimination.
+ */
+static int apply_to_all_leds(struct platform_device *pdev,
+        void (*operation)(struct led_classdev *pled))
+{
+        int i;
+
+        for_all_leds(i, pdev)
+                operation(&ixp4xxgpioled_devices[pdev->resource[i].start].ancestor);
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int ixp4xxgpioled_suspend(struct platform_device *pdev,
+                                pm_message_t state)
+{
+        return apply_to_all_leds(pdev, led_classdev_suspend);
+}
+
+static int ixp4xxgpioled_resume(struct platform_device *pdev)
+{
+        return apply_to_all_leds(pdev, led_classdev_resume);
+}
+#endif
+
+static void ixp4xxgpioled_remove_one_led(struct led_classdev *pled)
+{
+        led_classdev_unregister(pled);
+        pled->name = 0;
+}
+
+static int ixp4xxgpioled_remove(struct platform_device *pdev)
+{
+        return apply_to_all_leds(pdev, ixp4xxgpioled_remove_one_led);
+}
+
+static int ixp4xxgpioled_probe(struct platform_device *pdev)
+{
+        /* The board level has to tell the driver where the
+         * LEDs are connected - there is no way to find out
+         * electrically.  It must also say whether the GPIO
+         * lines are active high or active low.
+         *
+         * To do this read the num_resources (the number of
+         * LEDs) and the struct resource (the data for each
+         * LED).  The name comes from the resource, and it
+         * isn't copied.
+         */
+        int i;
+
+        for_all_leds(i, pdev) {
+                const u8 gpio_pin = pdev->resource[i].start;
+                int      rc;
+
+                if (ixp4xxgpioled_devices[gpio_pin].ancestor.name == 0) {
+                        unsigned long flags;
+
+                        spin_lock_irqsave(&gpio_lock, flags);
+                        gpio_line_config(gpio_pin, IXP4XX_GPIO_OUT);
+                        /* The config can, apparently, reset the state,
+                         * I suspect the gpio line may be an input and
+                         * the config may cause the line to be latched,
+                         * so the setting depends on how the LED is
+                         * connected to the line (which affects how it
+                         * floats if not driven).
+                         */
+                        gpio_line_set(gpio_pin, IXP4XX_GPIO_HIGH);
+                        spin_unlock_irqrestore(&gpio_lock, flags);
+
+                        ixp4xxgpioled_devices[gpio_pin].flags =
+                                pdev->resource[i].flags & IORESOURCE_BITS;
+
+                        ixp4xxgpioled_devices[gpio_pin].ancestor.name =
+                                pdev->resource[i].name;
+
+                        /* This is how a board manufacturer makes the LED
+                         * come on on reset - the GPIO line will be high, so
+                         * make the LED light when the line is low...
+                         */
+                        if (ixp4xxgpioled_devices[gpio_pin].flags != IXP4XX_GPIO_LOW)
+                                ixp4xxgpioled_devices[gpio_pin].ancestor.brightness = 100;
+                        else
+                                ixp4xxgpioled_devices[gpio_pin].ancestor.brightness = 0;
+
+                        ixp4xxgpioled_devices[gpio_pin].ancestor.flags = 0;
+
+                        ixp4xxgpioled_devices[gpio_pin].ancestor.brightness_set =
+                                ixp4xxgpioled_brightness_set;
+
+                        ixp4xxgpioled_devices[gpio_pin].ancestor.default_trigger = 0;
+                }
+
+                rc = led_classdev_register(&pdev->dev,
+                                &ixp4xxgpioled_devices[gpio_pin].ancestor);
+                if (rc < 0) {
+                        ixp4xxgpioled_devices[gpio_pin].ancestor.name = 0;
+                        ixp4xxgpioled_remove(pdev);
+                        return rc;
+                }
+        }
+
+        return 0;
+}
+
+static struct platform_driver ixp4xxgpioled_driver = {
+        .probe   = ixp4xxgpioled_probe,
+        .remove  = ixp4xxgpioled_remove,
+#ifdef CONFIG_PM
+        .suspend = ixp4xxgpioled_suspend,
+        .resume  = ixp4xxgpioled_resume,
+#endif
+        .driver  = {
+                .name = "IXP4XX-GPIO-LED",
+        },
+};
+
+static int __init ixp4xxgpioled_init(void)
+{
+        return platform_driver_register(&ixp4xxgpioled_driver);
+}
+
+static void __exit ixp4xxgpioled_exit(void)
+{
+        platform_driver_unregister(&ixp4xxgpioled_driver);
+}
+
+module_init(ixp4xxgpioled_init);
+module_exit(ixp4xxgpioled_exit);
+
+MODULE_AUTHOR("John Bowler <jbowler@acm.org>");
+MODULE_DESCRIPTION("IXP4XX GPIO LED driver");
+MODULE_LICENSE("Dual MIT/GPL");
diff --git a/drivers/leds/leds-locomo.c b/drivers/leds/leds-locomo.c
new file mode 100644
index 000000000000..749a86c2adb6
--- /dev/null
+++ b/drivers/leds/leds-locomo.c
@@ -0,0 +1,95 @@
+/*
+ * linux/drivers/leds/locomo.c
+ *
+ * Copyright (C) 2005 John Lenz <lenz@cs.wisc.edu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/device.h>
+#include <linux/leds.h>
+
+#include <asm/hardware.h>
+#include <asm/hardware/locomo.h>
+
+static void locomoled_brightness_set(struct led_classdev *led_cdev,
+                                enum led_brightness value, int offset)
+{
+        struct locomo_dev *locomo_dev = LOCOMO_DEV(led_cdev->class_dev->dev);
+        unsigned long flags;
+
+        local_irq_save(flags);
+        if (value)
+                locomo_writel(LOCOMO_LPT_TOFH, locomo_dev->mapbase + offset);
+        else
+                locomo_writel(LOCOMO_LPT_TOFL, locomo_dev->mapbase + offset);
+        local_irq_restore(flags);
+}
+
+static void locomoled_brightness_set0(struct led_classdev *led_cdev,
+                                enum led_brightness value)
+{
+        locomoled_brightness_set(led_cdev, value, LOCOMO_LPT0);
+}
+
+static void locomoled_brightness_set1(struct led_classdev *led_cdev,
+                                enum led_brightness value)
+{
+        locomoled_brightness_set(led_cdev, value, LOCOMO_LPT1);
+}
+
+static struct led_classdev locomo_led0 = {
+        .name                   = "locomo:amber",
+        .brightness_set         = locomoled_brightness_set0,
+};
+
+static struct led_classdev locomo_led1 = {
+        .name                   = "locomo:green",
+        .brightness_set         = locomoled_brightness_set1,
+};
+
+static int locomoled_probe(struct locomo_dev *ldev)
+{
+        int ret;
+
+        ret = led_classdev_register(&ldev->dev, &locomo_led0);
+        if (ret < 0)
+                return ret;
+
+        ret = led_classdev_register(&ldev->dev, &locomo_led1);
+        if (ret < 0)
+                led_classdev_unregister(&locomo_led0);
+
+        return ret;
+}
+
+static int locomoled_remove(struct locomo_dev *dev)
+{
+        led_classdev_unregister(&locomo_led0);
+        led_classdev_unregister(&locomo_led1);
+        return 0;
+}
+
+static struct locomo_driver locomoled_driver = {
+        .drv = {
+                .name = "locomoled"
+        },
+        .devid  = LOCOMO_DEVID_LED,
+        .probe  = locomoled_probe,
+        .remove = locomoled_remove,
+};
+
+static int __init locomoled_init(void)
+{
+        return locomo_driver_register(&locomoled_driver);
+}
+module_init(locomoled_init);
+
+MODULE_AUTHOR("John Lenz <lenz@cs.wisc.edu>");
+MODULE_DESCRIPTION("Locomo LED driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/leds-spitz.c b/drivers/leds/leds-spitz.c
new file mode 100644
index 000000000000..65bbef4a5e09
--- /dev/null
+++ b/drivers/leds/leds-spitz.c
@@ -0,0 +1,125 @@
+/*
+ * LED Triggers Core
+ *
+ * Copyright 2005-2006 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <asm/hardware/scoop.h>
+#include <asm/mach-types.h>
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/spitz.h>
+
+static void spitzled_amber_set(struct led_classdev *led_cdev, enum led_brightness value)
+{
+        if (value)
+                set_scoop_gpio(&spitzscoop_device.dev, SPITZ_SCP_LED_ORANGE);
+        else
+                reset_scoop_gpio(&spitzscoop_device.dev, SPITZ_SCP_LED_ORANGE);
+}
+
+static void spitzled_green_set(struct led_classdev *led_cdev, enum led_brightness value)
+{
+        if (value)
+                set_scoop_gpio(&spitzscoop_device.dev, SPITZ_SCP_LED_GREEN);
+        else
+                reset_scoop_gpio(&spitzscoop_device.dev, SPITZ_SCP_LED_GREEN);
+}
+
+static struct led_classdev spitz_amber_led = {
+        .name                   = "spitz:amber",
+        .default_trigger        = "sharpsl-charge",
+        .brightness_set         = spitzled_amber_set,
+};
+
+static struct led_classdev spitz_green_led = {
+        .name                   = "spitz:green",
+        .default_trigger        = "ide-disk",
+        .brightness_set         = spitzled_green_set,
+};
+
+#ifdef CONFIG_PM
+static int spitzled_suspend(struct platform_device *dev, pm_message_t state)
+{
+#ifdef CONFIG_LEDS_TRIGGERS
+        if (spitz_amber_led.trigger && strcmp(spitz_amber_led.trigger->name, "sharpsl-charge"))
+#endif
+                led_classdev_suspend(&spitz_amber_led);
+        led_classdev_suspend(&spitz_green_led);
+        return 0;
+}
+
+static int spitzled_resume(struct platform_device *dev)
+{
+        led_classdev_resume(&spitz_amber_led);
+        led_classdev_resume(&spitz_green_led);
+        return 0;
+}
+#endif
+
+static int spitzled_probe(struct platform_device *pdev)
+{
+        int ret;
+
+        if (machine_is_akita())
+                spitz_green_led.default_trigger = "nand-disk";
+
+        ret = led_classdev_register(&pdev->dev, &spitz_amber_led);
+        if (ret < 0)
+                return ret;
+
+        ret = led_classdev_register(&pdev->dev, &spitz_green_led);
+        if (ret < 0)
+                led_classdev_unregister(&spitz_amber_led);
+
+        return ret;
+}
+
+static int spitzled_remove(struct platform_device *pdev)
+{
+        led_classdev_unregister(&spitz_amber_led);
+        led_classdev_unregister(&spitz_green_led);
+
+        return 0;
+}
+
+static struct platform_driver spitzled_driver = {
+        .probe          = spitzled_probe,
+        .remove         = spitzled_remove,
+#ifdef CONFIG_PM
+        .suspend        = spitzled_suspend,
+        .resume         = spitzled_resume,
+#endif
+        .driver         = {
+                .name           = "spitz-led",
+        },
+};
+
+static int __init spitzled_init(void)
+{
+        return platform_driver_register(&spitzled_driver);
+}
+
+static void __exit spitzled_exit(void)
+{
+        platform_driver_unregister(&spitzled_driver);
+}
+
+module_init(spitzled_init);
+module_exit(spitzled_exit);
+
+MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
+MODULE_DESCRIPTION("Spitz LED driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/leds-tosa.c b/drivers/leds/leds-tosa.c
new file mode 100644
index 000000000000..c9e8cc1ec481
--- /dev/null
+++ b/drivers/leds/leds-tosa.c
@@ -0,0 +1,131 @@
+/*
+ * LED Triggers Core
+ *
+ * Copyright 2005 Dirk Opfer
+ *
+ * Author: Dirk Opfer <Dirk@Opfer-Online.de>
+ *      based on spitz.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+#include <asm/hardware/scoop.h>
+#include <asm/mach-types.h>
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/tosa.h>
+
+static void tosaled_amber_set(struct led_classdev *led_cdev,
+                                enum led_brightness value)
+{
+        if (value)
+                set_scoop_gpio(&tosascoop_jc_device.dev,
+                                TOSA_SCOOP_JC_CHRG_ERR_LED);
+        else
+                reset_scoop_gpio(&tosascoop_jc_device.dev,
+                                TOSA_SCOOP_JC_CHRG_ERR_LED);
+}
+
+static void tosaled_green_set(struct led_classdev *led_cdev,
+                                enum led_brightness value)
+{
+        if (value)
+                set_scoop_gpio(&tosascoop_jc_device.dev,
+                                TOSA_SCOOP_JC_NOTE_LED);
+        else
+                reset_scoop_gpio(&tosascoop_jc_device.dev,
+                                TOSA_SCOOP_JC_NOTE_LED);
+}
+
+static struct led_classdev tosa_amber_led = {
+        .name                   = "tosa:amber",
+        .default_trigger        = "sharpsl-charge",
+        .brightness_set         = tosaled_amber_set,
+};
+
+static struct led_classdev tosa_green_led = {
+        .name                   = "tosa:green",
+        .default_trigger        = "nand-disk",
+        .brightness_set         = tosaled_green_set,
+};
+
+#ifdef CONFIG_PM
+static int tosaled_suspend(struct platform_device *dev, pm_message_t state)
+{
+#ifdef CONFIG_LEDS_TRIGGERS
+        if (tosa_amber_led.trigger && strcmp(tosa_amber_led.trigger->name,
+                                                "sharpsl-charge"))
+#endif
+                led_classdev_suspend(&tosa_amber_led);
+        led_classdev_suspend(&tosa_green_led);
+        return 0;
+}
+
+static int tosaled_resume(struct platform_device *dev)
+{
+        led_classdev_resume(&tosa_amber_led);
+        led_classdev_resume(&tosa_green_led);
+        return 0;
+}
+#else
+#define tosaled_suspend NULL
+#define tosaled_resume NULL
+#endif
+
+static int tosaled_probe(struct platform_device *pdev)
+{
+        int ret;
+
+        ret = led_classdev_register(&pdev->dev, &tosa_amber_led);
+        if (ret < 0)
+                return ret;
+
+        ret = led_classdev_register(&pdev->dev, &tosa_green_led);
+        if (ret < 0)
+                led_classdev_unregister(&tosa_amber_led);
+
+        return ret;
+}
+
+static int tosaled_remove(struct platform_device *pdev)
+{
+        led_classdev_unregister(&tosa_amber_led);
+        led_classdev_unregister(&tosa_green_led);
+
+        return 0;
+}
+
+static struct platform_driver tosaled_driver = {
+        .probe          = tosaled_probe,
+        .remove         = tosaled_remove,
+        .suspend        = tosaled_suspend,
+        .resume         = tosaled_resume,
+        .driver         = {
+                .name           = "tosa-led",
+        },
+};
+
+static int __init tosaled_init(void)
+{
+        return platform_driver_register(&tosaled_driver);
+}
+
+static void __exit tosaled_exit(void)
+{
+        platform_driver_unregister(&tosaled_driver);
+}
+
+module_init(tosaled_init);
+module_exit(tosaled_exit);
+
+MODULE_AUTHOR("Dirk Opfer <Dirk@Opfer-Online.de>");
+MODULE_DESCRIPTION("Tosa LED driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/leds.h b/drivers/leds/leds.h
new file mode 100644
index 000000000000..a715c4ed93ff
--- /dev/null
+++ b/drivers/leds/leds.h
@@ -0,0 +1,44 @@
+/*
+ * LED Core
+ *
+ * Copyright 2005 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#ifndef __LEDS_H_INCLUDED
+#define __LEDS_H_INCLUDED
+
+#include <linux/leds.h>
+
+static inline void led_set_brightness(struct led_classdev *led_cdev,
+                                        enum led_brightness value)
+{
+        if (value > LED_FULL)
+                value = LED_FULL;
+        led_cdev->brightness = value;
+        if (!(led_cdev->flags & LED_SUSPENDED))
+                led_cdev->brightness_set(led_cdev, value);
+}
+
+extern rwlock_t leds_list_lock;
+extern struct list_head leds_list;
+
+#ifdef CONFIG_LEDS_TRIGGERS
+void led_trigger_set_default(struct led_classdev *led_cdev);
+void led_trigger_set(struct led_classdev *led_cdev,
+                        struct led_trigger *trigger);
+#else
+#define led_trigger_set_default(x) do {} while(0)
+#define led_trigger_set(x, y) do {} while(0)
+#endif
+
+ssize_t led_trigger_store(struct class_device *dev, const char *buf,
+                        size_t count);
+ssize_t led_trigger_show(struct class_device *dev, char *buf);
+
+#endif  /* __LEDS_H_INCLUDED */
diff --git a/drivers/leds/ledtrig-ide-disk.c b/drivers/leds/ledtrig-ide-disk.c
new file mode 100644
index 000000000000..fa651886ab4f
--- /dev/null
+++ b/drivers/leds/ledtrig-ide-disk.c
@@ -0,0 +1,62 @@
+/*
+ * LED IDE-Disk Activity Trigger
+ *
+ * Copyright 2006 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/timer.h>
+#include <linux/leds.h>
+
+static void ledtrig_ide_timerfunc(unsigned long data);
+
+DEFINE_LED_TRIGGER(ledtrig_ide);
+static DEFINE_TIMER(ledtrig_ide_timer, ledtrig_ide_timerfunc, 0, 0);
+static int ide_activity;
+static int ide_lastactivity;
+
+void ledtrig_ide_activity(void)
+{
+        ide_activity++;
+        if (!timer_pending(&ledtrig_ide_timer))
+                mod_timer(&ledtrig_ide_timer, jiffies + msecs_to_jiffies(10));
+}
+EXPORT_SYMBOL(ledtrig_ide_activity);
+
+static void ledtrig_ide_timerfunc(unsigned long data)
+{
+        if (ide_lastactivity != ide_activity) {
+                ide_lastactivity = ide_activity;
+                led_trigger_event(ledtrig_ide, LED_FULL);
+                mod_timer(&ledtrig_ide_timer, jiffies + msecs_to_jiffies(10));
+        } else {
+                led_trigger_event(ledtrig_ide, LED_OFF);
+        }
+}
+
+static int __init ledtrig_ide_init(void)
+{
+        led_trigger_register_simple("ide-disk", &ledtrig_ide);
+        return 0;
+}
+
+static void __exit ledtrig_ide_exit(void)
+{
+        led_trigger_unregister_simple(ledtrig_ide);
+}
+
+module_init(ledtrig_ide_init);
+module_exit(ledtrig_ide_exit);
+
+MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
+MODULE_DESCRIPTION("LED IDE Disk Activity Trigger");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/ledtrig-timer.c b/drivers/leds/ledtrig-timer.c
new file mode 100644
index 000000000000..f484b5d6dbf8
--- /dev/null
+++ b/drivers/leds/ledtrig-timer.c
@@ -0,0 +1,170 @@
+/*
+ * LED Kernel Timer Trigger
+ *
+ * Copyright 2005-2006 Openedhand Ltd.
+ *
+ * Author: Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/device.h>
+#include <linux/sysdev.h>
+#include <linux/timer.h>
+#include <linux/leds.h>
+#include "leds.h"
+
+struct timer_trig_data {
+        unsigned long delay_on;         /* milliseconds on */
+        unsigned long delay_off;        /* milliseconds off */
+        struct timer_list timer;
+};
+
+static void led_timer_function(unsigned long data)
+{
+        struct led_classdev *led_cdev = (struct led_classdev *) data;
+        struct timer_trig_data *timer_data = led_cdev->trigger_data;
+        unsigned long brightness = LED_OFF;
+        unsigned long delay = timer_data->delay_off;
+
+        if (!timer_data->delay_on || !timer_data->delay_off) {
+                led_set_brightness(led_cdev, LED_OFF);
+                return;
+        }
+
+        if (!led_cdev->brightness) {
+                brightness = LED_FULL;
+                delay = timer_data->delay_on;
+        }
+
+        led_set_brightness(led_cdev, brightness);
+
+        mod_timer(&timer_data->timer, jiffies + msecs_to_jiffies(delay));
+}
+
+static ssize_t led_delay_on_show(struct class_device *dev, char *buf)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        struct timer_trig_data *timer_data = led_cdev->trigger_data;
+
+        sprintf(buf, "%lu\n", timer_data->delay_on);
+
+        return strlen(buf) + 1;
+}
+
+static ssize_t led_delay_on_store(struct class_device *dev, const char *buf,
+                                size_t size)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        struct timer_trig_data *timer_data = led_cdev->trigger_data;
+        int ret = -EINVAL;
+        char *after;
+        unsigned long state = simple_strtoul(buf, &after, 10);
+
+        if (after - buf > 0) {
+                timer_data->delay_on = state;
+                mod_timer(&timer_data->timer, jiffies + 1);
+                ret = after - buf;
+        }
+
+        return ret;
+}
+
+static ssize_t led_delay_off_show(struct class_device *dev, char *buf)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        struct timer_trig_data *timer_data = led_cdev->trigger_data;
+
+        sprintf(buf, "%lu\n", timer_data->delay_off);
+
+        return strlen(buf) + 1;
+}
+
+static ssize_t led_delay_off_store(struct class_device *dev, const char *buf,
+                                size_t size)
+{
+        struct led_classdev *led_cdev = class_get_devdata(dev);
+        struct timer_trig_data *timer_data = led_cdev->trigger_data;
+        int ret = -EINVAL;
+        char *after;
+        unsigned long state = simple_strtoul(buf, &after, 10);
+
+        if (after - buf > 0) {
+                timer_data->delay_off = state;
+                mod_timer(&timer_data->timer, jiffies + 1);
+                ret = after - buf;
+        }
+
+        return ret;
+}
+
+static CLASS_DEVICE_ATTR(delay_on, 0644, led_delay_on_show,
+                        led_delay_on_store);
+static CLASS_DEVICE_ATTR(delay_off, 0644, led_delay_off_show,
+                        led_delay_off_store);
+
+static void timer_trig_activate(struct led_classdev *led_cdev)
+{
+        struct timer_trig_data *timer_data;
+
+        timer_data = kzalloc(sizeof(struct timer_trig_data), GFP_KERNEL);
+        if (!timer_data)
+                return;
+
+        led_cdev->trigger_data = timer_data;
+
+        init_timer(&timer_data->timer);
+        timer_data->timer.function = led_timer_function;
+        timer_data->timer.data = (unsigned long) led_cdev;
+
+        class_device_create_file(led_cdev->class_dev,
+                                &class_device_attr_delay_on);
+        class_device_create_file(led_cdev->class_dev,
+                                &class_device_attr_delay_off);
+}
+
+static void timer_trig_deactivate(struct led_classdev *led_cdev)
+{
+        struct timer_trig_data *timer_data = led_cdev->trigger_data;
+
+        if (timer_data) {
+                class_device_remove_file(led_cdev->class_dev,
+                                        &class_device_attr_delay_on);
+                class_device_remove_file(led_cdev->class_dev,
+                                        &class_device_attr_delay_off);
+                del_timer_sync(&timer_data->timer);
+                kfree(timer_data);
+        }
+}
+
+static struct led_trigger timer_led_trigger = {
+        .name     = "timer",
+        .activate = timer_trig_activate,
+        .deactivate = timer_trig_deactivate,
+};
+
+static int __init timer_trig_init(void)
+{
+        return led_trigger_register(&timer_led_trigger);
+}
+
+static void __exit timer_trig_exit(void)
+{
+        led_trigger_unregister(&timer_led_trigger);
+}
+
+module_init(timer_trig_init);
+module_exit(timer_trig_exit);
+
+MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
+MODULE_DESCRIPTION("Timer LED trigger");
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 039e071c1007..1ed5152db450 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -215,13 +215,11 @@ static void mddev_put(mddev_t *mddev)
                 return;
         if (!mddev->raid_disks && list_empty(&mddev->disks)) {
                 list_del(&mddev->all_mddevs);
-                /* that blocks */
+                spin_unlock(&all_mddevs_lock);
                 blk_cleanup_queue(mddev->queue);
-                /* that also blocks */
                 kobject_unregister(&mddev->kobj);
-                /* result blows... */
-        }
-        spin_unlock(&all_mddevs_lock);
+        } else
+                spin_unlock(&all_mddevs_lock);
 }
 
 static mddev_t * mddev_find(dev_t unit)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 3cb0872a845d..9b374c91db66 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1135,8 +1135,19 @@ static int end_sync_write(struct bio *bio, unsigned int bytes_done, int error)
                         mirror = i;
                         break;
                 }
-        if (!uptodate)
+        if (!uptodate) {
+                int sync_blocks = 0;
+                sector_t s = r1_bio->sector;
+                long sectors_to_go = r1_bio->sectors;
+                /* make sure these bits doesn't get cleared. */
+                do {
+                        bitmap_end_sync(mddev->bitmap, r1_bio->sector,
+                                        &sync_blocks, 1);
+                        s += sync_blocks;
+                        sectors_to_go -= sync_blocks;
+                } while (sectors_to_go > 0);
                 md_error(mddev, conf->mirrors[mirror].rdev);
+        }
 
         update_head_pos(mirror, r1_bio);
 
diff --git a/drivers/md/raid6main.c b/drivers/md/raid6main.c
index 6df4930fddec..ab64b37e4996 100644
--- a/drivers/md/raid6main.c
+++ b/drivers/md/raid6main.c
@@ -2151,6 +2151,8 @@ static int run(mddev_t *mddev)
         }
 
         /* Ok, everything is just fine now */
+        sysfs_create_group(&mddev->kobj, &raid6_attrs_group);
+
         mddev->array_size =  mddev->size * (mddev->raid_disks - 2);
 
         mddev->queue->unplug_fn = raid6_unplug_device;
diff --git a/drivers/media/video/cpia_pp.c b/drivers/media/video/cpia_pp.c
index 3021f21aae36..0b00e6027dfb 100644
--- a/drivers/media/video/cpia_pp.c
+++ b/drivers/media/video/cpia_pp.c
@@ -873,7 +873,7 @@ static int __init cpia_pp_setup(char *str)
                 parport_nr[parport_ptr++] = PPCPIA_PARPORT_NONE;
         }
 
-        return 0;
+        return 1;
 }
 
 __setup("cpia_pp=", cpia_pp_setup);
diff --git a/drivers/mtd/chips/amd_flash.c b/drivers/mtd/chips/amd_flash.c
index fdb91b6f1d97..57115618c496 100644
--- a/drivers/mtd/chips/amd_flash.c
+++ b/drivers/mtd/chips/amd_flash.c
@@ -664,7 +664,7 @@ static struct mtd_info *amd_flash_probe(struct map_info *map)
         printk("%s: Probing for AMD compatible flash...\n", map->name);
 
         if ((table_pos[0] = probe_new_chip(mtd, 0, NULL, &temp, table,
-                                           sizeof(table)/sizeof(table[0])))
+                                           ARRAY_SIZE(table)))
             == -1) {
                 printk(KERN_WARNING
                        "%s: Found no AMD compatible device at location zero\n",
@@ -696,7 +696,7 @@ static struct mtd_info *amd_flash_probe(struct map_info *map)
              base += (1 << temp.chipshift)) {
                 int numchips = temp.numchips;
                 table_pos[numchips] = probe_new_chip(mtd, base, chips,
-                        &temp, table, sizeof(table)/sizeof(table[0]));
+                        &temp, table, ARRAY_SIZE(table));
         }
 
         mtd->eraseregions = kmalloc(sizeof(struct mtd_erase_region_info) *
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index edb306c03c0a..517ea33e7260 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -34,6 +34,7 @@
 #define MANUFACTURER_MACRONIX   0x00C2
 #define MANUFACTURER_NEC        0x0010
 #define MANUFACTURER_PMC        0x009D
+#define MANUFACTURER_SHARP      0x00b0
 #define MANUFACTURER_SST        0x00BF
 #define MANUFACTURER_ST         0x0020
 #define MANUFACTURER_TOSHIBA    0x0098
@@ -124,6 +125,9 @@
 #define PM49FL004       0x006E
 #define PM49FL008       0x006A
 
+/* Sharp */
+#define LH28F640BF      0x00b0
+
 /* ST - www.st.com */
 #define M29W800DT       0x00D7
 #define M29W800DB       0x005B
@@ -1267,6 +1271,19 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO( 0x01000, 256 )
                 }
+        }, {
+                .mfr_id         = MANUFACTURER_SHARP,
+                .dev_id         = LH28F640BF,
+                .name           = "LH28F640BF",
+                .uaddr          = {
+                        [0] = MTD_UADDR_UNNECESSARY,    /* x8 */
+                },
+                .DevSize        = SIZE_4MiB,
+                .CmdSet         = P_ID_INTEL_STD,
+                .NumEraseRegions= 1,
+                .regions        = {
+                        ERASEINFO(0x40000,16),
+                }
         }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST39LF512,
@@ -2035,7 +2052,7 @@ static int jedec_probe_chip(struct map_info *map, __u32 base,
                 DEBUG(MTD_DEBUG_LEVEL3,
                       "Search for id:(%02x %02x) interleave(%d) type(%d)\n",
                         cfi->mfr, cfi->id, cfi_interleave(cfi), cfi->device_type);
-                for (i=0; i<sizeof(jedec_table)/sizeof(jedec_table[0]); i++) {
+                for (i = 0; i < ARRAY_SIZE(jedec_table); i++) {
                         if ( jedec_match( base, map, cfi, &jedec_table[i] ) ) {
                                 DEBUG( MTD_DEBUG_LEVEL3,
                                        "MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n",
diff --git a/drivers/mtd/chips/sharp.c b/drivers/mtd/chips/sharp.c
index 36f61a6a766e..3cc0b23c5865 100644
--- a/drivers/mtd/chips/sharp.c
+++ b/drivers/mtd/chips/sharp.c
@@ -64,7 +64,7 @@
 
 #undef AUTOUNLOCK  /* automatically unlocks blocks before erasing */
 
-struct mtd_info *sharp_probe(struct map_info *);
+static struct mtd_info *sharp_probe(struct map_info *);
 
 static int sharp_probe_map(struct map_info *map,struct mtd_info *mtd);
 
@@ -96,7 +96,6 @@ struct sharp_info{
         struct flchip chips[1];
 };
 
-struct mtd_info *sharp_probe(struct map_info *map);
 static void sharp_destroy(struct mtd_info *mtd);
 
 static struct mtd_chip_driver sharp_chipdrv = {
@@ -107,7 +106,7 @@ static struct mtd_chip_driver sharp_chipdrv = {
 };
 
 
-struct mtd_info *sharp_probe(struct map_info *map)
+static struct mtd_info *sharp_probe(struct map_info *map)
 {
         struct mtd_info *mtd = NULL;
         struct sharp_info *sharp = NULL;
@@ -581,7 +580,7 @@ static void sharp_destroy(struct mtd_info *mtd)
 
 }
 
-int __init sharp_probe_init(void)
+static int __init sharp_probe_init(void)
 {
         printk("MTD Sharp chip driver <ds@lineo.com>\n");
 
diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
index 6b8bb2e4dcfd..a7a7bfe33879 100644
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -42,7 +42,8 @@
 
 
 /* special size referring to all the remaining space in a partition */
-#define SIZE_REMAINING 0xffffffff
+#define SIZE_REMAINING UINT_MAX
+#define OFFSET_CONTINUOUS UINT_MAX
 
 struct cmdline_mtd_partition {
         struct cmdline_mtd_partition *next;
@@ -75,7 +76,7 @@ static struct mtd_partition * newpart(char *s,
 {
         struct mtd_partition *parts;
         unsigned long size;
-        unsigned long offset = 0;
+        unsigned long offset = OFFSET_CONTINUOUS;
         char *name;
         int name_len;
         unsigned char *extra_mem;
@@ -314,7 +315,7 @@ static int parse_cmdline_partitions(struct mtd_info *master,
                 {
                         for(i = 0, offset = 0; i < part->num_parts; i++)
                         {
-                                if (!part->parts[i].offset)
+                                if (part->parts[i].offset == OFFSET_CONTINUOUS)
                                   part->parts[i].offset = offset;
                                 else
                                   offset = part->parts[i].offset;
diff --git a/drivers/mtd/devices/blkmtd.c b/drivers/mtd/devices/blkmtd.c
index 04f864d238db..79f2e1f23ebd 100644
--- a/drivers/mtd/devices/blkmtd.c
+++ b/drivers/mtd/devices/blkmtd.c
@@ -28,8 +28,9 @@
 #include <linux/pagemap.h>
 #include <linux/list.h>
 #include <linux/init.h>
+#include <linux/mount.h>
 #include <linux/mtd/mtd.h>
-
+#include <linux/mutex.h>
 
 #define err(format, arg...) printk(KERN_ERR "blkmtd: " format "\n" , ## arg)
 #define info(format, arg...) printk(KERN_INFO "blkmtd: " format "\n" , ## arg)
@@ -46,7 +47,7 @@ struct blkmtd_dev {
         struct list_head list;
         struct block_device *blkdev;
         struct mtd_info mtd_info;
-        struct semaphore wrbuf_mutex;
+        struct mutex wrbuf_mutex;
 };
 
 
@@ -268,7 +269,7 @@ static int write_pages(struct blkmtd_dev *dev, const u_char *buf, loff_t to,
         if(end_len)
                 pagecnt++;
 
-        down(&dev->wrbuf_mutex);
+        mutex_lock(&dev->wrbuf_mutex);
 
         DEBUG(3, "blkmtd: write: start_len = %zd len = %zd end_len = %zd pagecnt = %d\n",
               start_len, len, end_len, pagecnt);
@@ -376,7 +377,7 @@ static int write_pages(struct blkmtd_dev *dev, const u_char *buf, loff_t to,
                 blkmtd_write_out(bio);
 
         DEBUG(2, "blkmtd: write: end, retlen = %zd, err = %d\n", *retlen, err);
-        up(&dev->wrbuf_mutex);
+        mutex_unlock(&dev->wrbuf_mutex);
 
         if(retlen)
                 *retlen = thislen;
@@ -614,8 +615,6 @@ static struct mtd_erase_region_info *calc_erase_regions(
 }
 
 
-extern dev_t __init name_to_dev_t(const char *line);
-
 static struct blkmtd_dev *add_device(char *devname, int readonly, int erase_size)
 {
         struct block_device *bdev;
@@ -659,7 +658,7 @@ static struct blkmtd_dev *add_device(char *devname, int readonly, int erase_size
         memset(dev, 0, sizeof(struct blkmtd_dev));
         dev->blkdev = bdev;
         if(!readonly) {
-                init_MUTEX(&dev->wrbuf_mutex);
+                mutex_init(&dev->wrbuf_mutex);
         }
 
         dev->mtd_info.size = dev->blkdev->bd_inode->i_size & PAGE_MASK;
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 7ff403b2a0a0..4160b8334c53 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -18,6 +18,7 @@
 #include <linux/init.h>
 #include <linux/mtd/mtd.h>
 #include <linux/buffer_head.h>
+#include <linux/mutex.h>
 
 #define VERSION "$Revision: 1.30 $"
 
@@ -31,7 +32,7 @@ struct block2mtd_dev {
         struct list_head list;
         struct block_device *blkdev;
         struct mtd_info mtd;
-        struct semaphore write_mutex;
+        struct mutex write_mutex;
 };
 
 
@@ -134,9 +135,9 @@ static int block2mtd_erase(struct mtd_info *mtd, struct erase_info *instr)
         int err;
 
         instr->state = MTD_ERASING;
-        down(&dev->write_mutex);
+        mutex_lock(&dev->write_mutex);
         err = _block2mtd_erase(dev, from, len);
-        up(&dev->write_mutex);
+        mutex_unlock(&dev->write_mutex);
         if (err) {
                 ERROR("erase failed err = %d", err);
                 instr->state = MTD_ERASE_FAILED;
@@ -249,9 +250,9 @@ static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len,
         if (to + len > mtd->size)
                 len = mtd->size - to;
 
-        down(&dev->write_mutex);
+        mutex_lock(&dev->write_mutex);
         err = _block2mtd_write(dev, buf, to, len, retlen);
-        up(&dev->write_mutex);
+        mutex_unlock(&dev->write_mutex);
         if (err > 0)
                 err = 0;
         return err;
@@ -310,7 +311,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size)
                 goto devinit_err;
         }
 
-        init_MUTEX(&dev->write_mutex);
+        mutex_init(&dev->write_mutex);
 
         /* Setup the MTD structure */
         /* make the name contain the block device in */
diff --git a/drivers/mtd/devices/doc2000.c b/drivers/mtd/devices/doc2000.c
index e4345cf744a2..23e7a5c7d2c1 100644
--- a/drivers/mtd/devices/doc2000.c
+++ b/drivers/mtd/devices/doc2000.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/bitops.h>
+#include <linux/mutex.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
@@ -605,7 +606,7 @@ static void DoC2k_init(struct mtd_info *mtd)
 
         this->curfloor = -1;
         this->curchip = -1;
-        init_MUTEX(&this->lock);
+        mutex_init(&this->lock);
 
         /* Ident all the chips present. */
         DoC_ScanChips(this, maxchips);
@@ -645,7 +646,7 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
         if (from >= this->totlen)
                 return -EINVAL;
 
-        down(&this->lock);
+        mutex_lock(&this->lock);
 
         *retlen = 0;
         while (left) {
@@ -774,7 +775,7 @@ static int doc_read_ecc(struct mtd_info *mtd, loff_t from, size_t len,
                 buf += len;
         }
 
-        up(&this->lock);
+        mutex_unlock(&this->lock);
 
         return ret;
 }
@@ -803,7 +804,7 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
         if (to >= this->totlen)
                 return -EINVAL;
 
-        down(&this->lock);
+        mutex_lock(&this->lock);
 
         *retlen = 0;
         while (left) {
@@ -873,7 +874,7 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
                                 printk(KERN_ERR "Error programming flash\n");
                                 /* Error in programming */
                                 *retlen = 0;
-                                up(&this->lock);
+                                mutex_unlock(&this->lock);
                                 return -EIO;
                         }
 
@@ -935,7 +936,7 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
                         printk(KERN_ERR "Error programming flash\n");
                         /* Error in programming */
                         *retlen = 0;
-                        up(&this->lock);
+                        mutex_unlock(&this->lock);
                         return -EIO;
                 }
 
@@ -956,7 +957,7 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
 
                         ret = doc_write_oob_nolock(mtd, to, 8, &dummy, x);
                         if (ret) {
-                                up(&this->lock);
+                                mutex_unlock(&this->lock);
                                 return ret;
                         }
                 }
@@ -966,7 +967,7 @@ static int doc_write_ecc(struct mtd_info *mtd, loff_t to, size_t len,
                 buf += len;
         }
 
-        up(&this->lock);
+        mutex_unlock(&this->lock);
         return 0;
 }
 
@@ -975,13 +976,13 @@ static int doc_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs,
                           u_char *eccbuf, struct nand_oobinfo *oobsel)
 {
         static char static_buf[512];
-        static DECLARE_MUTEX(writev_buf_sem);
+        static DEFINE_MUTEX(writev_buf_mutex);
 
         size_t totretlen = 0;
         size_t thisvecofs = 0;
         int ret= 0;
 
-        down(&writev_buf_sem);
+        mutex_lock(&writev_buf_mutex);
 
         while(count) {
                 size_t thislen, thisretlen;
@@ -1024,7 +1025,7 @@ static int doc_writev_ecc(struct mtd_info *mtd, const struct kvec *vecs,
                 to += thislen;
         }
 
-        up(&writev_buf_sem);
+        mutex_unlock(&writev_buf_mutex);
         *retlen = totretlen;
         return ret;
 }
@@ -1037,7 +1038,7 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t ofs, size_t len,
         int len256 = 0, ret;
         struct Nand *mychip;
 
-        down(&this->lock);
+        mutex_lock(&this->lock);
 
         mychip = &this->chips[ofs >> this->chipshift];
 
@@ -1083,7 +1084,7 @@ static int doc_read_oob(struct mtd_info *mtd, loff_t ofs, size_t len,
 
         ret = DoC_WaitReady(this);
 
-        up(&this->lock);
+        mutex_unlock(&this->lock);
         return ret;
 
 }
@@ -1197,10 +1198,10 @@ static int doc_write_oob(struct mtd_info *mtd, loff_t ofs, size_t len,
         struct DiskOnChip *this = mtd->priv;
         int ret;
 
-        down(&this->lock);
+        mutex_lock(&this->lock);
         ret = doc_write_oob_nolock(mtd, ofs, len, retlen, buf);
 
-        up(&this->lock);
+        mutex_unlock(&this->lock);
         return ret;
 }
 
@@ -1214,10 +1215,10 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *instr)
         struct Nand *mychip;
         int status;
 
-        down(&this->lock);
+        mutex_lock(&this->lock);
 
         if (ofs & (mtd->erasesize-1) || len & (mtd->erasesize-1)) {
-                up(&this->lock);
+                mutex_unlock(&this->lock);
                 return -EINVAL;
         }
 
@@ -1265,7 +1266,7 @@ static int doc_erase(struct mtd_info *mtd, struct erase_info *instr)
  callback:
         mtd_erase_callback(instr);
 
-        up(&this->lock);
+        mutex_unlock(&this->lock);
         return 0;
 }
 
diff --git a/drivers/mtd/devices/lart.c b/drivers/mtd/devices/lart.c
index 1e876fcb0408..29b0ddaa324e 100644
--- a/drivers/mtd/devices/lart.c
+++ b/drivers/mtd/devices/lart.c
@@ -581,8 +581,6 @@ static int flash_write (struct mtd_info *mtd,loff_t to,size_t len,size_t *retlen
 
 /***************************************************************************************************/
 
-#define NB_OF(x) (sizeof (x) / sizeof (x[0]))
-
 static struct mtd_info mtd;
 
 static struct mtd_erase_region_info erase_regions[] = {
@@ -640,7 +638,7 @@ int __init lart_flash_init (void)
    mtd.flags = MTD_CAP_NORFLASH;
    mtd.size = FLASH_BLOCKSIZE_PARAM * FLASH_NUMBLOCKS_16m_PARAM + FLASH_BLOCKSIZE_MAIN * FLASH_NUMBLOCKS_16m_MAIN;
    mtd.erasesize = FLASH_BLOCKSIZE_MAIN;
-   mtd.numeraseregions = NB_OF (erase_regions);
+   mtd.numeraseregions = ARRAY_SIZE(erase_regions);
    mtd.eraseregions = erase_regions;
    mtd.erase = flash_erase;
    mtd.read = flash_read;
@@ -670,9 +668,9 @@ int __init lart_flash_init (void)
                            result,mtd.eraseregions[result].numblocks);
 
 #ifdef HAVE_PARTITIONS
-   printk ("\npartitions = %d\n",NB_OF (lart_partitions));
+   printk ("\npartitions = %d\n", ARRAY_SIZE(lart_partitions));
 
-   for (result = 0; result < NB_OF (lart_partitions); result++)
+   for (result = 0; result < ARRAY_SIZE(lart_partitions); result++)
          printk (KERN_DEBUG
                          "\n\n"
                          "lart_partitions[%d].name = %s\n"
@@ -687,7 +685,7 @@ int __init lart_flash_init (void)
 #ifndef HAVE_PARTITIONS
    result = add_mtd_device (&mtd);
 #else
-   result = add_mtd_partitions (&mtd,lart_partitions,NB_OF (lart_partitions));
+   result = add_mtd_partitions (&mtd,lart_partitions, ARRAY_SIZE(lart_partitions));
 #endif
 
    return (result);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index d5f24089be71..04e65d5dae00 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -186,7 +186,7 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
         struct m25p *flash = mtd_to_m25p(mtd);
         u32 addr,len;
 
-        DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %zd\n",
+        DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %d\n",
                         flash->spi->dev.bus_id, __FUNCTION__, "at",
                         (u32)instr->addr, instr->len);
 
diff --git a/drivers/mtd/devices/ms02-nv.c b/drivers/mtd/devices/ms02-nv.c
index 0ff2e4378244..485f663493d2 100644
--- a/drivers/mtd/devices/ms02-nv.c
+++ b/drivers/mtd/devices/ms02-nv.c
@@ -308,7 +308,7 @@ static int __init ms02nv_init(void)
                 break;
         }
 
-        for (i = 0; i < (sizeof(ms02nv_addrs) / sizeof(*ms02nv_addrs)); i++)
+        for (i = 0; i < ARRAY_SIZE(ms02nv_addrs); i++)
                 if (!ms02nv_init_one(ms02nv_addrs[i] << stride))
                         count++;
 
diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
index 8a544890173d..a3b92479719d 100644
--- a/drivers/mtd/inftlcore.c
+++ b/drivers/mtd/inftlcore.c
@@ -47,9 +47,6 @@
  */
 #define MAX_LOOPS 10000
 
-extern void INFTL_dumptables(struct INFTLrecord *inftl);
-extern void INFTL_dumpVUchains(struct INFTLrecord *inftl);
-
 static void inftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
 {
         struct INFTLrecord *inftl;
@@ -132,7 +129,7 @@ static void inftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
                 return;
         }
 #ifdef PSYCHO_DEBUG
-        printk(KERN_INFO "INFTL: Found new nftl%c\n", nftl->mbd.devnum + 'a');
+        printk(KERN_INFO "INFTL: Found new inftl%c\n", inftl->mbd.devnum + 'a');
 #endif
         return;
 }
@@ -885,8 +882,6 @@ static struct mtd_blktrans_ops inftl_tr = {
         .owner          = THIS_MODULE,
 };
 
-extern char inftlmountrev[];
-
 static int __init init_inftl(void)
 {
         printk(KERN_INFO "INFTL: inftlcore.c $Revision: 1.19 $, "
diff --git a/drivers/mtd/maps/alchemy-flash.c b/drivers/mtd/maps/alchemy-flash.c
index a57791a6ce40..b933a2a27b18 100644
--- a/drivers/mtd/maps/alchemy-flash.c
+++ b/drivers/mtd/maps/alchemy-flash.c
@@ -126,8 +126,6 @@ static struct mtd_partition alchemy_partitions[] = {
         }
 };
 
-#define NB_OF(x)  (sizeof(x)/sizeof(x[0]))
-
 static struct mtd_info *mymtd;
 
 int __init alchemy_mtd_init(void)
@@ -154,7 +152,7 @@ int __init alchemy_mtd_init(void)
          * Static partition definition selection
          */
         parts = alchemy_partitions;
-        nb_parts = NB_OF(alchemy_partitions);
+        nb_parts = ARRAY_SIZE(alchemy_partitions);
         alchemy_map.size = window_size;
 
         /*
diff --git a/drivers/mtd/maps/cfi_flagadm.c b/drivers/mtd/maps/cfi_flagadm.c
index 6a8c0415bde8..fd0f0d3187de 100644
--- a/drivers/mtd/maps/cfi_flagadm.c
+++ b/drivers/mtd/maps/cfi_flagadm.c
@@ -86,7 +86,7 @@ struct mtd_partition flagadm_parts[] = {
         }
 };
 
-#define PARTITION_COUNT (sizeof(flagadm_parts)/sizeof(struct mtd_partition))
+#define PARTITION_COUNT ARRAY_SIZE(flagadm_parts)
 
 static struct mtd_info *mymtd;
 
diff --git a/drivers/mtd/maps/dbox2-flash.c b/drivers/mtd/maps/dbox2-flash.c
index 49d90542fc75..652813cd6c2d 100644
--- a/drivers/mtd/maps/dbox2-flash.c
+++ b/drivers/mtd/maps/dbox2-flash.c
@@ -57,7 +57,7 @@ static struct mtd_partition partition_info[]= {
         }
 };
 
-#define NUM_PARTITIONS (sizeof(partition_info) / sizeof(partition_info[0]))
+#define NUM_PARTITIONS ARRAY_SIZE(partition_info)
 
 #define WINDOW_ADDR 0x10000000
 #define WINDOW_SIZE 0x800000
diff --git a/drivers/mtd/maps/dilnetpc.c b/drivers/mtd/maps/dilnetpc.c
index efb221692641..c299d10b33e6 100644
--- a/drivers/mtd/maps/dilnetpc.c
+++ b/drivers/mtd/maps/dilnetpc.c
@@ -300,7 +300,7 @@ static struct mtd_partition partition_info[]=
         },
 };
 
-#define NUM_PARTITIONS (sizeof(partition_info)/sizeof(partition_info[0]))
+#define NUM_PARTITIONS ARRAY_SIZE(partition_info)
 
 static struct mtd_info *mymtd;
 static struct mtd_info *lowlvl_parts[NUM_PARTITIONS];
@@ -345,7 +345,7 @@ static struct mtd_partition higlvl_partition_info[]=
         },
 };
 
-#define NUM_HIGHLVL_PARTITIONS (sizeof(higlvl_partition_info)/sizeof(partition_info[0]))
+#define NUM_HIGHLVL_PARTITIONS ARRAY_SIZE(higlvl_partition_info)
 
 
 static int dnp_adnp_probe(void)
diff --git a/drivers/mtd/maps/dmv182.c b/drivers/mtd/maps/dmv182.c
index b993ac01a9a5..2bb3c0f0f970 100644
--- a/drivers/mtd/maps/dmv182.c
+++ b/drivers/mtd/maps/dmv182.c
@@ -99,7 +99,7 @@ static struct mtd_info *this_mtd;
 static int __init init_svme182(void)
 {
         struct mtd_partition *partitions;
-        int num_parts = sizeof(svme182_partitions) / sizeof(struct mtd_partition);
+        int num_parts = ARRAY_SIZE(svme182_partitions);
 
         partitions = svme182_partitions;
 
diff --git a/drivers/mtd/maps/h720x-flash.c b/drivers/mtd/maps/h720x-flash.c
index 319094821101..0667101ccbe1 100644
--- a/drivers/mtd/maps/h720x-flash.c
+++ b/drivers/mtd/maps/h720x-flash.c
@@ -59,7 +59,7 @@ static struct mtd_partition h720x_partitions[] = {
         }
 };
 
-#define NUM_PARTITIONS  (sizeof(h720x_partitions)/sizeof(h720x_partitions[0]))
+#define NUM_PARTITIONS ARRAY_SIZE(h720x_partitions)
 
 static int                   nr_mtd_parts;
 static struct mtd_partition *mtd_parts;
diff --git a/drivers/mtd/maps/netsc520.c b/drivers/mtd/maps/netsc520.c
index 33060a315722..ed215470158b 100644
--- a/drivers/mtd/maps/netsc520.c
+++ b/drivers/mtd/maps/netsc520.c
@@ -76,7 +76,7 @@ static struct mtd_partition partition_info[]={
             .size = 0x80000
     },
 };
-#define NUM_PARTITIONS (sizeof(partition_info)/sizeof(partition_info[0]))
+#define NUM_PARTITIONS ARRAY_SIZE(partition_info)
 
 #define WINDOW_SIZE     0x00100000
 #define WINDOW_ADDR     0x00200000
@@ -88,7 +88,7 @@ static struct map_info netsc520_map = {
         .phys = WINDOW_ADDR,
 };
 
-#define NUM_FLASH_BANKS (sizeof(netsc520_map)/sizeof(struct map_info))
+#define NUM_FLASH_BANKS ARRAY_SIZE(netsc520_map)
 
 static struct mtd_info *mymtd;
 
diff --git a/drivers/mtd/maps/nettel.c b/drivers/mtd/maps/nettel.c
index 632eb2aa968f..54a3102ab19a 100644
--- a/drivers/mtd/maps/nettel.c
+++ b/drivers/mtd/maps/nettel.c
@@ -128,8 +128,7 @@ static struct mtd_partition nettel_amd_partitions[] = {
         }
 };
 
-#define NUM_AMD_PARTITIONS \
-        (sizeof(nettel_amd_partitions)/sizeof(nettel_amd_partitions[0]))
+#define NUM_AMD_PARTITIONS ARRAY_SIZE(nettel_amd_partitions)
 
 /****************************************************************************/
 
diff --git a/drivers/mtd/maps/ocotea.c b/drivers/mtd/maps/ocotea.c
index c223514ca2eb..a21fcd195ab4 100644
--- a/drivers/mtd/maps/ocotea.c
+++ b/drivers/mtd/maps/ocotea.c
@@ -58,8 +58,6 @@ static struct mtd_partition ocotea_large_partitions[] = {
         }
 };
 
-#define NB_OF(x)  (sizeof(x)/sizeof(x[0]))
-
 int __init init_ocotea(void)
 {
         u8 fpga0_reg;
@@ -97,7 +95,7 @@ int __init init_ocotea(void)
         if (flash) {
                 flash->owner = THIS_MODULE;
                 add_mtd_partitions(flash, ocotea_small_partitions,
-                                        NB_OF(ocotea_small_partitions));
+                                        ARRAY_SIZE(ocotea_small_partitions));
         } else {
                 printk("map probe failed for flash\n");
                 return -ENXIO;
@@ -118,7 +116,7 @@ int __init init_ocotea(void)
         if (flash) {
                 flash->owner = THIS_MODULE;
                 add_mtd_partitions(flash, ocotea_large_partitions,
-                                        NB_OF(ocotea_large_partitions));
+                                        ARRAY_SIZE(ocotea_large_partitions));
         } else {
                 printk("map probe failed for flash\n");
                 return -ENXIO;
diff --git a/drivers/mtd/maps/pci.c b/drivers/mtd/maps/pci.c
index 21822c2edbe4..d2ab1bae9c34 100644
--- a/drivers/mtd/maps/pci.c
+++ b/drivers/mtd/maps/pci.c
@@ -334,9 +334,6 @@ mtd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
         return 0;
 
 release:
-        if (mtd)
-                map_destroy(mtd);
-
         if (map) {
                 map->exit(dev, map);
                 kfree(map);
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index f988c817e196..8bbc751a6021 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -616,7 +616,7 @@ static void pcmciamtd_config(dev_link_t *link)
         } else if(mem_type == 2) {
                 mtd = do_map_probe("map_rom", &dev->pcmcia_map);
         } else {
-                for(i = 0; i < sizeof(probes) / sizeof(char *); i++) {
+                for(i = 0; i < ARRAY_SIZE(probes); i++) {
                         DEBUG(1, "Trying %s", probes[i]);
                         mtd = do_map_probe(probes[i], &dev->pcmcia_map);
                         if(mtd)
diff --git a/drivers/mtd/maps/redwood.c b/drivers/mtd/maps/redwood.c
index 5b76ed886185..50b14033613f 100644
--- a/drivers/mtd/maps/redwood.c
+++ b/drivers/mtd/maps/redwood.c
@@ -121,8 +121,7 @@ struct map_info redwood_flash_map = {
 };
 
 
-#define NUM_REDWOOD_FLASH_PARTITIONS \
-        (sizeof(redwood_flash_partitions)/sizeof(redwood_flash_partitions[0]))
+#define NUM_REDWOOD_FLASH_PARTITIONS ARRAY_SIZE(redwood_flash_partitions)
 
 static struct mtd_info *redwood_mtd;
 
diff --git a/drivers/mtd/maps/sbc8240.c b/drivers/mtd/maps/sbc8240.c
index 225cdd9ba5b2..350286dc1d2e 100644
--- a/drivers/mtd/maps/sbc8240.c
+++ b/drivers/mtd/maps/sbc8240.c
@@ -66,7 +66,7 @@ static struct map_info sbc8240_map[2] = {
         }
 };
 
-#define NUM_FLASH_BANKS (sizeof(sbc8240_map) / sizeof(struct map_info))
+#define NUM_FLASH_BANKS ARRAY_SIZE(sbc8240_map)
 
 /*
  * The following defines the partition layout of SBC8240 boards.
@@ -125,8 +125,6 @@ static struct mtd_partition sbc8240_fs_partitions [] = {
         }
 };
 
-#define NB_OF(x) (sizeof (x) / sizeof (x[0]))
-
 /* trivial struct to describe partition information */
 struct mtd_part_def
 {
@@ -190,10 +188,10 @@ int __init init_sbc8240_mtd (void)
 #ifdef CONFIG_MTD_PARTITIONS
         sbc8240_part_banks[0].mtd_part   = sbc8240_uboot_partitions;
         sbc8240_part_banks[0].type       = "static image";
-        sbc8240_part_banks[0].nums       = NB_OF(sbc8240_uboot_partitions);
+        sbc8240_part_banks[0].nums       = ARRAY_SIZE(sbc8240_uboot_partitions);
         sbc8240_part_banks[1].mtd_part   = sbc8240_fs_partitions;
         sbc8240_part_banks[1].type       = "static file system";
-        sbc8240_part_banks[1].nums       = NB_OF(sbc8240_fs_partitions);
+        sbc8240_part_banks[1].nums       = ARRAY_SIZE(sbc8240_fs_partitions);
 
         for (i = 0; i < NUM_FLASH_BANKS; i++) {
 
diff --git a/drivers/mtd/maps/sc520cdp.c b/drivers/mtd/maps/sc520cdp.c
index ed92afadd8a9..e8c130e1efd3 100644
--- a/drivers/mtd/maps/sc520cdp.c
+++ b/drivers/mtd/maps/sc520cdp.c
@@ -107,7 +107,7 @@ static struct map_info sc520cdp_map[] = {
         },
 };
 
-#define NUM_FLASH_BANKS (sizeof(sc520cdp_map)/sizeof(struct map_info))
+#define NUM_FLASH_BANKS ARRAY_SIZE(sc520cdp_map)
 
 static struct mtd_info *mymtd[NUM_FLASH_BANKS];
 static struct mtd_info *merged_mtd;
diff --git a/drivers/mtd/maps/scx200_docflash.c b/drivers/mtd/maps/scx200_docflash.c
index 2c91dff8bb60..28b8a571a91a 100644
--- a/drivers/mtd/maps/scx200_docflash.c
+++ b/drivers/mtd/maps/scx200_docflash.c
@@ -70,7 +70,7 @@ static struct mtd_partition partition_info[] = {
                 .size   = 0x80000
         },
 };
-#define NUM_PARTITIONS (sizeof(partition_info)/sizeof(partition_info[0]))
+#define NUM_PARTITIONS ARRAY_SIZE(partition_info)
 #endif
 
 
diff --git a/drivers/mtd/maps/sharpsl-flash.c b/drivers/mtd/maps/sharpsl-flash.c
index 999f4bb3d845..12fe53c0d2fc 100644
--- a/drivers/mtd/maps/sharpsl-flash.c
+++ b/drivers/mtd/maps/sharpsl-flash.c
@@ -49,8 +49,6 @@ static struct mtd_partition sharpsl_partitions[1] = {
         }
 };
 
-#define NB_OF(x)  (sizeof(x)/sizeof(x[0]))
-
 int __init init_sharpsl(void)
 {
         struct mtd_partition *parts;
@@ -92,7 +90,7 @@ int __init init_sharpsl(void)
         }
 
         parts = sharpsl_partitions;
-        nb_parts = NB_OF(sharpsl_partitions);
+        nb_parts = ARRAY_SIZE(sharpsl_partitions);
 
         printk(KERN_NOTICE "Using %s partision definition\n", part_type);
         add_mtd_partitions(mymtd, parts, nb_parts);
diff --git a/drivers/mtd/maps/ts5500_flash.c b/drivers/mtd/maps/ts5500_flash.c
index 4b372bcb17f1..a7422c200567 100644
--- a/drivers/mtd/maps/ts5500_flash.c
+++ b/drivers/mtd/maps/ts5500_flash.c
@@ -64,7 +64,7 @@ static struct mtd_partition ts5500_partitions[] = {
         }
 };
 
-#define NUM_PARTITIONS (sizeof(ts5500_partitions)/sizeof(struct mtd_partition))
+#define NUM_PARTITIONS ARRAY_SIZE(ts5500_partitions)
 
 static struct mtd_info *mymtd;
 
diff --git a/drivers/mtd/maps/uclinux.c b/drivers/mtd/maps/uclinux.c
index 79d92808b766..f7264dc2ac9b 100644
--- a/drivers/mtd/maps/uclinux.c
+++ b/drivers/mtd/maps/uclinux.c
@@ -37,7 +37,7 @@ struct mtd_partition uclinux_romfs[] = {
         { .name = "ROMfs" }
 };
 
-#define NUM_PARTITIONS  (sizeof(uclinux_romfs) / sizeof(uclinux_romfs[0]))
+#define NUM_PARTITIONS  ARRAY_SIZE(uclinux_romfs)
 
 /****************************************************************************/
 
diff --git a/drivers/mtd/maps/vmax301.c b/drivers/mtd/maps/vmax301.c
index e0063941c0df..b3e487395435 100644
--- a/drivers/mtd/maps/vmax301.c
+++ b/drivers/mtd/maps/vmax301.c
@@ -182,7 +182,7 @@ int __init init_vmax301(void)
                 }
         }
 
-        if (!vmax_mtd[1] && !vmax_mtd[2]) {
+        if (!vmax_mtd[0] && !vmax_mtd[1]) {
                 iounmap((void *)iomapadr);
                 return -ENXIO;
         }
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 840dd66ce2dc..458d3c8ae1ee 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -19,12 +19,12 @@
 #include <linux/spinlock.h>
 #include <linux/hdreg.h>
 #include <linux/init.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 #include <asm/uaccess.h>
 
 static LIST_HEAD(blktrans_majors);
 
-extern struct semaphore mtd_table_mutex;
+extern struct mutex mtd_table_mutex;
 extern struct mtd_info *mtd_table[];
 
 struct mtd_blkcore_priv {
@@ -122,9 +122,9 @@ static int mtd_blktrans_thread(void *arg)
 
                 spin_unlock_irq(rq->queue_lock);
 
-                down(&dev->sem);
+                mutex_lock(&dev->lock);
                 res = do_blktrans_request(tr, dev, req);
-                up(&dev->sem);
+                mutex_unlock(&dev->lock);
 
                 spin_lock_irq(rq->queue_lock);
 
@@ -235,8 +235,8 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
         int last_devnum = -1;
         struct gendisk *gd;
 
-        if (!down_trylock(&mtd_table_mutex)) {
-                up(&mtd_table_mutex);
+        if (!!mutex_trylock(&mtd_table_mutex)) {
+                mutex_unlock(&mtd_table_mutex);
                 BUG();
         }
 
@@ -267,7 +267,7 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
                 return -EBUSY;
         }
 
-        init_MUTEX(&new->sem);
+        mutex_init(&new->lock);
         list_add_tail(&new->list, &tr->devs);
  added:
         if (!tr->writesect)
@@ -313,8 +313,8 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new)
 
 int del_mtd_blktrans_dev(struct mtd_blktrans_dev *old)
 {
-        if (!down_trylock(&mtd_table_mutex)) {
-                up(&mtd_table_mutex);
+        if (!!mutex_trylock(&mtd_table_mutex)) {
+                mutex_unlock(&mtd_table_mutex);
                 BUG();
         }
 
@@ -378,14 +378,14 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
 
         memset(tr->blkcore_priv, 0, sizeof(*tr->blkcore_priv));
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         ret = register_blkdev(tr->major, tr->name);
         if (ret) {
                 printk(KERN_WARNING "Unable to register %s block device on major %d: %d\n",
                        tr->name, tr->major, ret);
                 kfree(tr->blkcore_priv);
-                up(&mtd_table_mutex);
+                mutex_unlock(&mtd_table_mutex);
                 return ret;
         }
         spin_lock_init(&tr->blkcore_priv->queue_lock);
@@ -396,7 +396,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
         if (!tr->blkcore_priv->rq) {
                 unregister_blkdev(tr->major, tr->name);
                 kfree(tr->blkcore_priv);
-                up(&mtd_table_mutex);
+                mutex_unlock(&mtd_table_mutex);
                 return -ENOMEM;
         }
 
@@ -407,7 +407,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
                 blk_cleanup_queue(tr->blkcore_priv->rq);
                 unregister_blkdev(tr->major, tr->name);
                 kfree(tr->blkcore_priv);
-                up(&mtd_table_mutex);
+                mutex_unlock(&mtd_table_mutex);
                 return ret;
         }
 
@@ -419,7 +419,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
                         tr->add_mtd(tr, mtd_table[i]);
         }
 
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
 
         return 0;
 }
@@ -428,7 +428,7 @@ int deregister_mtd_blktrans(struct mtd_blktrans_ops *tr)
 {
         struct list_head *this, *next;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         /* Clean up the kernel thread */
         tr->blkcore_priv->exiting = 1;
@@ -446,7 +446,7 @@ int deregister_mtd_blktrans(struct mtd_blktrans_ops *tr)
         blk_cleanup_queue(tr->blkcore_priv->rq);
         unregister_blkdev(tr->major, tr->name);
 
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
 
         kfree(tr->blkcore_priv);
 
diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c
index e84756644fd1..2cef280e388c 100644
--- a/drivers/mtd/mtdblock.c
+++ b/drivers/mtd/mtdblock.c
@@ -19,11 +19,13 @@
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/blktrans.h>
+#include <linux/mutex.h>
+
 
 static struct mtdblk_dev {
         struct mtd_info *mtd;
         int count;
-        struct semaphore cache_sem;
+        struct mutex cache_mutex;
         unsigned char *cache_data;
         unsigned long cache_offset;
         unsigned int cache_size;
@@ -284,7 +286,7 @@ static int mtdblock_open(struct mtd_blktrans_dev *mbd)
         mtdblk->count = 1;
         mtdblk->mtd = mtd;
 
-        init_MUTEX (&mtdblk->cache_sem);
+        mutex_init(&mtdblk->cache_mutex);
         mtdblk->cache_state = STATE_EMPTY;
         if ((mtdblk->mtd->flags & MTD_CAP_RAM) != MTD_CAP_RAM &&
             mtdblk->mtd->erasesize) {
@@ -306,9 +308,9 @@ static int mtdblock_release(struct mtd_blktrans_dev *mbd)
 
         DEBUG(MTD_DEBUG_LEVEL1, "mtdblock_release\n");
 
-        down(&mtdblk->cache_sem);
+        mutex_lock(&mtdblk->cache_mutex);
         write_cached_data(mtdblk);
-        up(&mtdblk->cache_sem);
+        mutex_unlock(&mtdblk->cache_mutex);
 
         if (!--mtdblk->count) {
                 /* It was the last usage. Free the device */
@@ -327,9 +329,9 @@ static int mtdblock_flush(struct mtd_blktrans_dev *dev)
 {
         struct mtdblk_dev *mtdblk = mtdblks[dev->devnum];
 
-        down(&mtdblk->cache_sem);
+        mutex_lock(&mtdblk->cache_mutex);
         write_cached_data(mtdblk);
-        up(&mtdblk->cache_sem);
+        mutex_unlock(&mtdblk->cache_mutex);
 
         if (mtdblk->mtd->sync)
                 mtdblk->mtd->sync(mtdblk->mtd);
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index dade02ab0687..9905870f56e5 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -19,15 +19,13 @@
 #include <linux/ioctl.h>
 #include <linux/init.h>
 #include <linux/mtd/compatmac.h>
-#ifdef CONFIG_PROC_FS
 #include <linux/proc_fs.h>
-#endif
 
 #include <linux/mtd/mtd.h>
 
 /* These are exported solely for the purpose of mtd_blkdevs.c. You
    should not use them for _anything_ else */
-DECLARE_MUTEX(mtd_table_mutex);
+DEFINE_MUTEX(mtd_table_mutex);
 struct mtd_info *mtd_table[MAX_MTD_DEVICES];
 
 EXPORT_SYMBOL_GPL(mtd_table_mutex);
@@ -49,7 +47,7 @@ int add_mtd_device(struct mtd_info *mtd)
 {
         int i;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         for (i=0; i < MAX_MTD_DEVICES; i++)
                 if (!mtd_table[i]) {
@@ -67,7 +65,7 @@ int add_mtd_device(struct mtd_info *mtd)
                                 not->add(mtd);
                         }
 
-                        up(&mtd_table_mutex);
+                        mutex_unlock(&mtd_table_mutex);
                         /* We _know_ we aren't being removed, because
                            our caller is still holding us here. So none
                            of this try_ nonsense, and no bitching about it
@@ -76,7 +74,7 @@ int add_mtd_device(struct mtd_info *mtd)
                         return 0;
                 }
 
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
         return 1;
 }
 
@@ -94,7 +92,7 @@ int del_mtd_device (struct mtd_info *mtd)
 {
         int ret;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         if (mtd_table[mtd->index] != mtd) {
                 ret = -ENODEV;
@@ -118,7 +116,7 @@ int del_mtd_device (struct mtd_info *mtd)
                 ret = 0;
         }
 
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
         return ret;
 }
 
@@ -135,7 +133,7 @@ void register_mtd_user (struct mtd_notifier *new)
 {
         int i;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         list_add(&new->list, &mtd_notifiers);
 
@@ -145,7 +143,7 @@ void register_mtd_user (struct mtd_notifier *new)
                 if (mtd_table[i])
                         new->add(mtd_table[i]);
 
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
 }
 
 /**
@@ -162,7 +160,7 @@ int unregister_mtd_user (struct mtd_notifier *old)
 {
         int i;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         module_put(THIS_MODULE);
 
@@ -171,7 +169,7 @@ int unregister_mtd_user (struct mtd_notifier *old)
                         old->remove(mtd_table[i]);
 
         list_del(&old->list);
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
         return 0;
 }
 
@@ -193,7 +191,7 @@ struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num)
         struct mtd_info *ret = NULL;
         int i;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         if (num == -1) {
                 for (i=0; i< MAX_MTD_DEVICES; i++)
@@ -211,7 +209,7 @@ struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num)
         if (ret)
                 ret->usecount++;
 
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
         return ret;
 }
 
@@ -219,9 +217,9 @@ void put_mtd_device(struct mtd_info *mtd)
 {
         int c;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
         c = --mtd->usecount;
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
         BUG_ON(c < 0);
 
         module_put(mtd->owner);
@@ -296,10 +294,11 @@ EXPORT_SYMBOL(unregister_mtd_user);
 EXPORT_SYMBOL(default_mtd_writev);
 EXPORT_SYMBOL(default_mtd_readv);
 
+#ifdef CONFIG_PROC_FS
+
 /*====================================================================*/
 /* Support for /proc/mtd */
 
-#ifdef CONFIG_PROC_FS
 static struct proc_dir_entry *proc_mtd;
 
 static inline int mtd_proc_info (char *buf, int i)
@@ -319,7 +318,7 @@ static int mtd_read_proc (char *page, char **start, off_t off, int count,
         int len, l, i;
         off_t   begin = 0;
 
-        down(&mtd_table_mutex);
+        mutex_lock(&mtd_table_mutex);
 
         len = sprintf(page, "dev:    size   erasesize  name\n");
         for (i=0; i< MAX_MTD_DEVICES; i++) {
@@ -337,38 +336,34 @@ static int mtd_read_proc (char *page, char **start, off_t off, int count,
         *eof = 1;
 
 done:
-        up(&mtd_table_mutex);
+        mutex_unlock(&mtd_table_mutex);
         if (off >= len+begin)
                 return 0;
         *start = page + (off-begin);
         return ((count < begin+len-off) ? count : begin+len-off);
 }
 
-#endif /* CONFIG_PROC_FS */
-
 /*====================================================================*/
 /* Init code */
 
 static int __init init_mtd(void)
 {
-#ifdef CONFIG_PROC_FS
         if ((proc_mtd = create_proc_entry( "mtd", 0, NULL )))
                 proc_mtd->read_proc = mtd_read_proc;
-#endif
         return 0;
 }
 
 static void __exit cleanup_mtd(void)
 {
-#ifdef CONFIG_PROC_FS
         if (proc_mtd)
                 remove_proc_entry( "mtd", NULL);
-#endif
 }
 
 module_init(init_mtd);
 module_exit(cleanup_mtd);
 
+#endif /* CONFIG_PROC_FS */
+
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 1fc4c134d939..cfe288a6e853 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -178,17 +178,16 @@ config MTD_NAND_DISKONCHIP_BBTWRITE
           Even if you leave this disabled, you can enable BBT writes at module
           load time (assuming you build diskonchip as a module) with the module
           parameter "inftl_bbt_write=1".
-          
- config MTD_NAND_SHARPSL
-        bool "Support for NAND Flash on Sharp SL Series (C7xx + others)"
-        depends on MTD_NAND && ARCH_PXA
- 
- config MTD_NAND_NANDSIM
-        bool "Support for NAND Flash Simulator"
-        depends on MTD_NAND && MTD_PARTITIONS
 
+config MTD_NAND_SHARPSL
+        tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
+        depends on MTD_NAND && ARCH_PXA
+
+config MTD_NAND_NANDSIM
+        tristate "Support for NAND Flash Simulator"
+        depends on MTD_NAND && MTD_PARTITIONS
         help
           The simulator may simulate verious NAND flash chips for the
           MTD nand layer.
- 
+
 endmenu
diff --git a/drivers/mtd/nand/au1550nd.c b/drivers/mtd/nand/au1550nd.c
index 201e1362da14..bde3550910a2 100644
--- a/drivers/mtd/nand/au1550nd.c
+++ b/drivers/mtd/nand/au1550nd.c
@@ -55,8 +55,6 @@ static const struct mtd_partition partition_info[] = {
                 .size   =    MTDPART_SIZ_FULL
         }
 };
-#define NB_OF(x)  (sizeof(x)/sizeof(x[0]))
-
 
 /**
  * au_read_byte -  read one byte from the chip
@@ -462,7 +460,7 @@ int __init au1xxx_nand_init (void)
         }
 
         /* Register the partitions */
-        add_mtd_partitions(au1550_mtd, partition_info, NB_OF(partition_info));
+        add_mtd_partitions(au1550_mtd, partition_info, ARRAY_SIZE(partition_info));
 
         return 0;
 
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 5d222460b42a..95e96fa1fceb 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -80,6 +80,7 @@
 #include <linux/mtd/compatmac.h>
 #include <linux/interrupt.h>
 #include <linux/bitops.h>
+#include <linux/leds.h>
 #include <asm/io.h>
 
 #ifdef CONFIG_MTD_PARTITIONS
@@ -515,6 +516,8 @@ static int nand_block_checkbad (struct mtd_info *mtd, loff_t ofs, int getchip, i
         return nand_isbad_bbt (mtd, ofs, allowbbt);
 }
 
+DEFINE_LED_TRIGGER(nand_led_trigger);
+
 /*
  * Wait for the ready pin, after a command
  * The timeout is catched later.
@@ -524,12 +527,14 @@ static void nand_wait_ready(struct mtd_info *mtd)
         struct nand_chip *this = mtd->priv;
         unsigned long   timeo = jiffies + 2;
 
+        led_trigger_event(nand_led_trigger, LED_FULL);
         /* wait until command is processed or timeout occures */
         do {
                 if (this->dev_ready(mtd))
-                        return;
+                        break;
                 touch_softlockup_watchdog();
         } while (time_before(jiffies, timeo));
+        led_trigger_event(nand_led_trigger, LED_OFF);
 }
 
 /**
@@ -817,6 +822,8 @@ static int nand_wait(struct mtd_info *mtd, struct nand_chip *this, int state)
         else
                  timeo += (HZ * 20) / 1000;
 
+        led_trigger_event(nand_led_trigger, LED_FULL);
+
         /* Apply this short delay always to ensure that we do wait tWB in
          * any case on any machine. */
         ndelay (100);
@@ -840,6 +847,8 @@ static int nand_wait(struct mtd_info *mtd, struct nand_chip *this, int state)
                 }
                 cond_resched();
         }
+        led_trigger_event(nand_led_trigger, LED_OFF);
+
         status = (int) this->read_byte(mtd);
         return status;
 }
@@ -2724,6 +2733,21 @@ void nand_release (struct mtd_info *mtd)
 EXPORT_SYMBOL_GPL (nand_scan);
 EXPORT_SYMBOL_GPL (nand_release);
 
+
+static int __init nand_base_init(void)
+{
+        led_trigger_register_simple("nand-disk", &nand_led_trigger);
+        return 0;
+}
+
+static void __exit nand_base_exit(void)
+{
+        led_trigger_unregister_simple(nand_led_trigger);
+}
+
+module_init(nand_base_init);
+module_exit(nand_base_exit);
+
 MODULE_LICENSE ("GPL");
 MODULE_AUTHOR ("Steven J. Hill <sjhill@realitydiluted.com>, Thomas Gleixner <tglx@linutronix.de>");
 MODULE_DESCRIPTION ("Generic NAND flash driver code");
diff --git a/drivers/mtd/redboot.c b/drivers/mtd/redboot.c
index 8815c8dbef2d..c077d2ec9cdd 100644
--- a/drivers/mtd/redboot.c
+++ b/drivers/mtd/redboot.c
@@ -85,10 +85,6 @@ static int parse_redboot_partitions(struct mtd_info *master,
 
         numslots = (master->erasesize / sizeof(struct fis_image_desc));
         for (i = 0; i < numslots; i++) {
-                if (buf[i].name[0] == 0xff) {
-                        i = numslots;
-                        break;
-                }
                 if (!memcmp(buf[i].name, "FIS directory", 14)) {
                         /* This is apparently the FIS directory entry for the
                          * FIS directory itself.  The FIS directory size is
@@ -128,7 +124,7 @@ static int parse_redboot_partitions(struct mtd_info *master,
                 struct fis_list *new_fl, **prev;
 
                 if (buf[i].name[0] == 0xff)
-                        break;
+                        continue;
                 if (!redboot_checksum(&buf[i]))
                         break;
 
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 70f63891b19c..274b0138d442 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -788,7 +788,7 @@ struct vortex_private {
         int options;                                            /* User-settable misc. driver options. */
         unsigned int media_override:4,          /* Passed-in media type. */
                 default_media:4,                                /* Read from the EEPROM/Wn3_Config. */
-                full_duplex:1, force_fd:1, autoselect:1,
+                full_duplex:1, autoselect:1,
                 bus_master:1,                                   /* Vortex can only do a fragment bus-m. */
                 full_bus_master_tx:1, full_bus_master_rx:2, /* Boomerang  */
                 flow_ctrl:1,                                    /* Use 802.3x flow control (PAUSE only) */
@@ -1633,12 +1633,6 @@ vortex_set_duplex(struct net_device *dev)
                         ((vp->full_duplex && vp->flow_ctrl && vp->partner_flow_ctrl) ?
                                         0x100 : 0),
                         ioaddr + Wn3_MAC_Ctrl);
-
-        issue_and_wait(dev, TxReset);
-        /*
-         * Don't reset the PHY - that upsets autonegotiation during DHCP operations.
-         */
-        issue_and_wait(dev, RxReset|0x04);
 }
 
 static void vortex_check_media(struct net_device *dev, unsigned int init)
@@ -1663,7 +1657,7 @@ vortex_up(struct net_device *dev)
         struct vortex_private *vp = netdev_priv(dev);
         void __iomem *ioaddr = vp->ioaddr;
         unsigned int config;
-        int i;
+        int i, mii_reg1, mii_reg5;
 
         if (VORTEX_PCI(vp)) {
                 pci_set_power_state(VORTEX_PCI(vp), PCI_D0);    /* Go active */
@@ -1723,14 +1717,23 @@ vortex_up(struct net_device *dev)
                 printk(KERN_DEBUG "vortex_up(): writing 0x%x to InternalConfig\n", config);
         iowrite32(config, ioaddr + Wn3_Config);
 
-        netif_carrier_off(dev);
         if (dev->if_port == XCVR_MII || dev->if_port == XCVR_NWAY) {
                 EL3WINDOW(4);
+                mii_reg1 = mdio_read(dev, vp->phys[0], MII_BMSR);
+                mii_reg5 = mdio_read(dev, vp->phys[0], MII_LPA);
+                vp->partner_flow_ctrl = ((mii_reg5 & 0x0400) != 0);
+
                 vortex_check_media(dev, 1);
         }
         else
                 vortex_set_duplex(dev);
 
+        issue_and_wait(dev, TxReset);
+        /*
+         * Don't reset the PHY - that upsets autonegotiation during DHCP operations.
+         */
+        issue_and_wait(dev, RxReset|0x04);
+
 
         iowrite16(SetStatusEnb | 0x00, ioaddr + EL3_CMD);
 
@@ -2083,16 +2086,14 @@ vortex_error(struct net_device *dev, int status)
                 }
                 if (tx_status & 0x14)  vp->stats.tx_fifo_errors++;
                 if (tx_status & 0x38)  vp->stats.tx_aborted_errors++;
+                if (tx_status & 0x08)  vp->xstats.tx_max_collisions++;
                 iowrite8(0, ioaddr + TxStatus);
                 if (tx_status & 0x30) {                 /* txJabber or txUnderrun */
                         do_tx_reset = 1;
-                } else if (tx_status & 0x08) {  /* maxCollisions */
-                        vp->xstats.tx_max_collisions++;
-                        if (vp->drv_flags & MAX_COLLISION_RESET) {
-                                do_tx_reset = 1;
-                                reset_mask = 0x0108;            /* Reset interface logic, but not download logic */
-                        }
-                } else {                                                /* Merely re-enable the transmitter. */
+                } else if ((tx_status & 0x08) && (vp->drv_flags & MAX_COLLISION_RESET))  {      /* maxCollisions */
+                        do_tx_reset = 1;
+                        reset_mask = 0x0108;            /* Reset interface logic, but not download logic */
+                } else {                                /* Merely re-enable the transmitter. */
                         iowrite16(TxEnable, ioaddr + EL3_CMD);
                 }
         }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index e20b849a22e8..bdaaad8f2123 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2313,13 +2313,11 @@ config S2IO_NAPI
 
 endmenu
 
-if !UML
 source "drivers/net/tokenring/Kconfig"
 
 source "drivers/net/wireless/Kconfig"
 
 source "drivers/net/pcmcia/Kconfig"
-endif
 
 source "drivers/net/wan/Kconfig"
 
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index edd1b5306b16..75b35ad760de 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -94,7 +94,7 @@ static struct console netconsole = {
 static int option_setup(char *opt)
 {
         configured = !netpoll_parse_options(&np, opt);
-        return 0;
+        return 1;
 }
 
 __setup("netconsole=", option_setup);
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index eed496803fe4..e8f849e12976 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -1973,7 +1973,7 @@ static int __init setup_xirc2ps_cs(char *str)
         MAYBE_SET(lockup_hack, 6);
 #undef  MAYBE_SET
 
-        return 0;
+        return 1;
 }
 
 __setup("xirc2ps_cs=", setup_xirc2ps_cs);
diff --git a/drivers/net/tokenring/Kconfig b/drivers/net/tokenring/Kconfig
index e4cfc80b283b..99c4c1922f19 100644
--- a/drivers/net/tokenring/Kconfig
+++ b/drivers/net/tokenring/Kconfig
@@ -3,7 +3,7 @@
 #
 
 menu "Token Ring devices"
-        depends on NETDEVICES
+        depends on NETDEVICES && !UML
 
 # So far, we only have PCI, ISA, and MCA token ring devices
 config TR
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index f85e30190008..bad09ebdb50b 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -356,7 +356,7 @@ config PCI_HERMES
 
 config ATMEL
       tristate "Atmel at76c50x chipset  802.11b support"
-      depends on NET_RADIO
+      depends on NET_RADIO && (PCI || PCMCIA)
       select FW_LOADER
       select CRC32
        ---help---
diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c
index 93f8a8fa8890..a5d826237b26 100644
--- a/drivers/parisc/ccio-dma.c
+++ b/drivers/parisc/ccio-dma.c
@@ -1560,7 +1560,7 @@ static int ccio_probe(struct parisc_device *dev)
         *ioc_p = ioc;
 
         ioc->hw_path = dev->hw_path;
-        ioc->ioc_regs = ioremap(dev->hpa.start, 4096);
+        ioc->ioc_regs = ioremap_nocache(dev->hpa.start, 4096);
         ccio_ioc_init(ioc);
         ccio_init_resources(ioc);
         hppa_dma_ops = &ccio_ops;
diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 3d1a7f98c676..6e8ed0c81a6c 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -5,6 +5,7 @@
 **      (c) Copyright 1999 SuSE GmbH
 **      (c) Copyright 1999,2000 Hewlett-Packard Company
 **      (c) Copyright 2000 Grant Grundler
+**      (c) Copyright 2006 Helge Deller
 **
 **      This program is free software; you can redistribute it and/or modify
 **      it under the terms of the GNU General Public License as published by
@@ -785,7 +786,7 @@ dino_bridge_init(struct dino_device *dino_dev, const char *name)
                 if((io_addr & (1 << i)) == 0)
                         continue;
 
-                start = (unsigned long)(signed int)(0xf0000000 | (i << 23));
+                start = F_EXTEND(0xf0000000UL) | (i << 23);
                 end = start + 8 * 1024 * 1024 - 1;
 
                 DBG("DINO RANGE %d is at 0x%lx-0x%lx\n", count,
@@ -996,7 +997,7 @@ static int __init dino_probe(struct parisc_device *dev)
         }
 
         dino_dev->hba.dev = dev;
-        dino_dev->hba.base_addr = ioremap(hpa, 4096);
+        dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
         dino_dev->hba.lmmio_space_offset = 0;   /* CPU addrs == bus addrs */
         spin_lock_init(&dino_dev->dinosaur_pen);
         dino_dev->hba.iommu = ccio_get_iommu(dev);
diff --git a/drivers/parisc/eisa.c b/drivers/parisc/eisa.c
index 3d94d86c1c9f..9d3bd15bf53b 100644
--- a/drivers/parisc/eisa.c
+++ b/drivers/parisc/eisa.c
@@ -366,7 +366,7 @@ static int __devinit eisa_probe(struct parisc_device *dev)
                         eisa_dev.eeprom_addr = MIRAGE_EEPROM_BASE_ADDR;
                 }
         }
-        eisa_eeprom_addr = ioremap(eisa_dev.eeprom_addr, HPEE_MAX_LENGTH);
+        eisa_eeprom_addr = ioremap_nocache(eisa_dev.eeprom_addr, HPEE_MAX_LENGTH);
         result = eisa_enumerator(eisa_dev.eeprom_addr, &eisa_dev.hba.io_space,
                         &eisa_dev.hba.lmmio_space);
         init_eisa_pic();
diff --git a/drivers/parisc/iosapic.c b/drivers/parisc/iosapic.c
index 8d7a36392eb8..7a458d5bc751 100644
--- a/drivers/parisc/iosapic.c
+++ b/drivers/parisc/iosapic.c
@@ -879,7 +879,7 @@ void *iosapic_register(unsigned long hpa)
                 return NULL;
         }
 
-        isi->addr = ioremap(hpa, 4096);
+        isi->addr = ioremap_nocache(hpa, 4096);
         isi->isi_hpa = hpa;
         isi->isi_version = iosapic_rd_version(isi);
         isi->isi_num_vectors = IOSAPIC_IRDT_MAX_ENTRY(isi->isi_version) + 1;
diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c
index e8a2a4a852f5..3fe4a77fa16a 100644
--- a/drivers/parisc/lba_pci.c
+++ b/drivers/parisc/lba_pci.c
@@ -1213,7 +1213,7 @@ lba_pat_resources(struct parisc_device *pa_dev, struct lba_device *lba_dev)
                         ** Postable I/O port space is per PCI host adapter.
                         ** base of 64MB PIOP region
                         */
-                        lba_dev->iop_base = ioremap(p->start, 64 * 1024 * 1024);
+                        lba_dev->iop_base = ioremap_nocache(p->start, 64 * 1024 * 1024);
 
                         sprintf(lba_dev->hba.io_name, "PCI%02lx Ports",
                                         lba_dev->hba.bus_num.start);
@@ -1525,7 +1525,7 @@ lba_driver_probe(struct parisc_device *dev)
         u32 func_class;
         void *tmp_obj;
         char *version;
-        void __iomem *addr = ioremap(dev->hpa.start, 4096);
+        void __iomem *addr = ioremap_nocache(dev->hpa.start, 4096);
 
         /* Read HW Rev First */
         func_class = READ_REG32(addr + LBA_FCLASS);
@@ -1619,7 +1619,7 @@ lba_driver_probe(struct parisc_device *dev)
         } else {
                 if (!astro_iop_base) {
                         /* Sprockets PDC uses NPIOP region */
-                        astro_iop_base = ioremap(LBA_PORT_BASE, 64 * 1024);
+                        astro_iop_base = ioremap_nocache(LBA_PORT_BASE, 64 * 1024);
                         pci_port = &lba_astro_port_ops;
                 }
 
@@ -1700,7 +1700,7 @@ void __init lba_init(void)
 */
 void lba_set_iregs(struct parisc_device *lba, u32 ibase, u32 imask)
 {
-        void __iomem * base_addr = ioremap(lba->hpa.start, 4096);
+        void __iomem * base_addr = ioremap_nocache(lba->hpa.start, 4096);
 
         imask <<= 2;    /* adjust for hints - 2 more bits */
 
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index a28e17898fbd..4e53be9c03ab 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -4,9 +4,8 @@
  *    Copyright (C) 2005-2006 Thibaut VARENE <varenet@parisc-linux.org>
  *
  *    This program is free software; you can redistribute it and/or modify
- *    it under the terms of the GNU General Public License as published by
- *    the Free Software Foundation; either version 2 of the License, or
- *    (at your option) any later version.
+ *    it under the terms of the GNU General Public License, version 2, as
+ *    published by the Free Software Foundation.
  *
  *    This program is distributed in the hope that it will be useful,
  *    but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 0821747e44cf..42b32ff2fca6 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -1642,9 +1642,9 @@ sba_ioc_init(struct parisc_device *sba, struct ioc *ioc, int ioc_num)
 **
 **************************************************************************/
 
-static void __iomem *ioc_remap(struct sba_device *sba_dev, int offset)
+static void __iomem *ioc_remap(struct sba_device *sba_dev, unsigned int offset)
 {
-        return ioremap(sba_dev->dev->hpa.start + offset, SBA_FUNC_SIZE);
+        return ioremap_nocache(sba_dev->dev->hpa.start + offset, SBA_FUNC_SIZE);
 }
 
 static void sba_hw_init(struct sba_device *sba_dev)
@@ -2040,7 +2040,7 @@ sba_driver_callback(struct parisc_device *dev)
         u32 func_class;
         int i;
         char *version;
-        void __iomem *sba_addr = ioremap(dev->hpa.start, SBA_FUNC_SIZE);
+        void __iomem *sba_addr = ioremap_nocache(dev->hpa.start, SBA_FUNC_SIZE);
         struct proc_dir_entry *info_entry, *bitmap_entry, *root;
 
         sba_dump_ranges(sba_addr);
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index ad6d3b28a3a6..719b863bc20e 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -12,6 +12,7 @@
  *      (C) Copyright 2001 John Marvin <jsm fc hp com>
  *      (C) Copyright 2003 Grant Grundler <grundler parisc-linux org>
  *      (C) Copyright 2005 Kyle McMartin <kyle@parisc-linux.org>
+ *      (C) Copyright 2006 Helge Deller <deller@gmx.de>
  *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License as
@@ -388,43 +389,34 @@ int superio_fixup_irq(struct pci_dev *pcidev)
         return local_irq;
 }
 
-static struct uart_port serial[] = {
-        {
-                .iotype         = UPIO_PORT,
-                .line           = 0,
-                .type           = PORT_16550A,
-                .uartclk        = 115200*16,
-                .fifosize       = 16,
-        },
-        {
-                .iotype         = UPIO_PORT,
-                .line           = 1,
-                .type           = PORT_16550A,
-                .uartclk        = 115200*16,
-                .fifosize       = 16,
-        }
-};
-
 static void __devinit superio_serial_init(void)
 {
 #ifdef CONFIG_SERIAL_8250
         int retval;
-        
-        serial[0].iobase = sio_dev.sp1_base;
-        serial[0].irq = SP1_IRQ;
-        spin_lock_init(&serial[0].lock);
-
-        retval = early_serial_setup(&serial[0]);
+        struct uart_port serial_port;
+
+        memset(&serial_port, 0, sizeof(serial_port));
+        serial_port.iotype      = UPIO_PORT;
+        serial_port.type        = PORT_16550A;
+        serial_port.uartclk     = 115200*16;
+        serial_port.fifosize    = 16;
+        spin_lock_init(&serial_port.lock);
+
+        /* serial port #1 */
+        serial_port.iobase      = sio_dev.sp1_base;
+        serial_port.irq         = SP1_IRQ;
+        serial_port.line        = 0;
+        retval = early_serial_setup(&serial_port);
         if (retval < 0) {
                 printk(KERN_WARNING PFX "Register Serial #0 failed.\n");
                 return;
         }
 
-        serial[1].iobase = sio_dev.sp2_base;
-        serial[1].irq = SP2_IRQ;
-        spin_lock_init(&serial[1].lock);
-        retval = early_serial_setup(&serial[1]);
-
+        /* serial port #2 */
+        serial_port.iobase      = sio_dev.sp2_base;
+        serial_port.irq         = SP2_IRQ;
+        serial_port.line        = 1;
+        retval = early_serial_setup(&serial_port);
         if (retval < 0)
                 printk(KERN_WARNING PFX "Register Serial #1 failed.\n");
 #endif /* CONFIG_SERIAL_8250 */
diff --git a/drivers/pcmcia/vrc4171_card.c b/drivers/pcmcia/vrc4171_card.c
index 0574efd7828a..459e6e1946fd 100644
--- a/drivers/pcmcia/vrc4171_card.c
+++ b/drivers/pcmcia/vrc4171_card.c
@@ -634,7 +634,7 @@ static void vrc4171_remove_sockets(void)
 static int __devinit vrc4171_card_setup(char *options)
 {
         if (options == NULL || *options == '\0')
-                return 0;
+                return 1;
 
         if (strncmp(options, "irq:", 4) == 0) {
                 int irq;
@@ -644,7 +644,7 @@ static int __devinit vrc4171_card_setup(char *options)
                         vrc4171_irq = irq;
 
                 if (*options != ',')
-                        return 0;
+                        return 1;
                 options++;
         }
 
@@ -663,10 +663,10 @@ static int __devinit vrc4171_card_setup(char *options)
                         }
 
                         if (*options != ',')
-                                return 0;
+                                return 1;
                         options++;
                 } else
-                        return 0;
+                        return 1;
 
         }
 
@@ -688,7 +688,7 @@ static int __devinit vrc4171_card_setup(char *options)
                         }
 
                         if (*options != ',')
-                                return 0;
+                                return 1;
                         options++;
 
                         if (strncmp(options, "memnoprobe", 10) == 0)
@@ -700,7 +700,7 @@ static int __devinit vrc4171_card_setup(char *options)
                 }
         }
 
-        return 0;
+        return 1;
 }
 
 __setup("vrc4171_card=", vrc4171_card_setup);
diff --git a/drivers/pcmcia/vrc4173_cardu.c b/drivers/pcmcia/vrc4173_cardu.c
index 57f38dba0a48..6004196f7cc1 100644
--- a/drivers/pcmcia/vrc4173_cardu.c
+++ b/drivers/pcmcia/vrc4173_cardu.c
@@ -516,7 +516,7 @@ static int __devinit vrc4173_cardu_probe(struct pci_dev *dev,
 static int __devinit vrc4173_cardu_setup(char *options)
 {
         if (options == NULL || *options == '\0')
-                return 0;
+                return 1;
 
         if (strncmp(options, "cardu1:", 7) == 0) {
                 options += 7;
@@ -527,9 +527,9 @@ static int __devinit vrc4173_cardu_setup(char *options)
                         }
 
                         if (*options != ',')
-                                return 0;
+                                return 1;
                 } else
-                        return 0;
+                        return 1;
         }
 
         if (strncmp(options, "cardu2:", 7) == 0) {
@@ -538,7 +538,7 @@ static int __devinit vrc4173_cardu_setup(char *options)
                         cardu_sockets[CARDU2].noprobe = 1;
         }
 
-        return 0;
+        return 1;
 }
 
 __setup("vrc4173_cardu=", vrc4173_cardu_setup);
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index ffba65656a83..1bd82c4e52a0 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -293,6 +293,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           board_ahci }, /* JMicron JMB360 */
         { 0x197b, 0x2363, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
           board_ahci }, /* JMicron JMB363 */
+        { PCI_VENDOR_ID_ATI, 0x4380, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+          board_ahci }, /* ATI SB600 non-raid */
+        { PCI_VENDOR_ID_ATI, 0x4381, PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+          board_ahci }, /* ATI SB600 raid */
         { }     /* terminate list */
 };
 
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 2d5be84d8bd4..24e71b555172 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -301,7 +301,7 @@ static struct piix_map_db ich6_map_db = {
         .mask = 0x3,
         .map = {
                 /* PM   PS   SM   SS       MAP */
-                {  P0,  P1,  P2,  P3 }, /* 00b */
+                {  P0,  P2,  P1,  P3 }, /* 00b */
                 { IDE, IDE,  P1,  P3 }, /* 01b */
                 {  P0,  P2, IDE, IDE }, /* 10b */
                 {  RV,  RV,  RV,  RV },
@@ -312,7 +312,7 @@ static struct piix_map_db ich6m_map_db = {
         .mask = 0x3,
         .map = {
                 /* PM   PS   SM   SS       MAP */
-                {  P0,  P1,  P2,  P3 }, /* 00b */
+                {  P0,  P2,  RV,  RV }, /* 00b */
                 {  RV,  RV,  RV,  RV },
                 {  P0,  P2, IDE, IDE }, /* 10b */
                 {  RV,  RV,  RV,  RV },
diff --git a/drivers/scsi/ibmmca.c b/drivers/scsi/ibmmca.c
index 3a8462e8d063..24eb59e143a9 100644
--- a/drivers/scsi/ibmmca.c
+++ b/drivers/scsi/ibmmca.c
@@ -2488,7 +2488,7 @@ static int option_setup(char *str)
         }
         ints[0] = i - 1;
         internal_ibmmca_scsi_setup(cur, ints);
-        return 0;
+        return 1;
 }
 
 __setup("ibmmcascsi=", option_setup);
diff --git a/drivers/scsi/lasi700.c b/drivers/scsi/lasi700.c
index 459a4daebece..eb7bd310cc82 100644
--- a/drivers/scsi/lasi700.c
+++ b/drivers/scsi/lasi700.c
@@ -112,7 +112,7 @@ lasi700_probe(struct parisc_device *dev)
 
         hostdata->dev = &dev->dev;
         dma_set_mask(&dev->dev, DMA_32BIT_MASK);
-        hostdata->base = ioremap(base, 0x100);
+        hostdata->base = ioremap_nocache(base, 0x100);
         hostdata->differential = 0;
 
         if (dev->id.sversion == LASI_700_SVERSION) {
diff --git a/drivers/scsi/libata-bmdma.c b/drivers/scsi/libata-bmdma.c
index 95d81d86d8b7..835dff0bafdc 100644
--- a/drivers/scsi/libata-bmdma.c
+++ b/drivers/scsi/libata-bmdma.c
@@ -703,6 +703,7 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
         struct ata_probe_ent *probe_ent =
                 ata_probe_ent_alloc(pci_dev_to_dev(pdev), port[0]);
         int p = 0;
+        unsigned long bmdma;
 
         if (!probe_ent)
                 return NULL;
@@ -716,7 +717,12 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
                 probe_ent->port[p].altstatus_addr =
                 probe_ent->port[p].ctl_addr =
                         pci_resource_start(pdev, 1) | ATA_PCI_CTL_OFS;
-                probe_ent->port[p].bmdma_addr = pci_resource_start(pdev, 4);
+                bmdma = pci_resource_start(pdev, 4);
+                if (bmdma) {
+                        if (inb(bmdma + 2) & 0x80)
+                                probe_ent->host_set_flags |= ATA_HOST_SIMPLEX;
+                        probe_ent->port[p].bmdma_addr = bmdma;
+                }
                 ata_std_ports(&probe_ent->port[p]);
                 p++;
         }
@@ -726,7 +732,13 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int
                 probe_ent->port[p].altstatus_addr =
                 probe_ent->port[p].ctl_addr =
                         pci_resource_start(pdev, 3) | ATA_PCI_CTL_OFS;
-                probe_ent->port[p].bmdma_addr = pci_resource_start(pdev, 4) + 8;
+                bmdma = pci_resource_start(pdev, 4);
+                if (bmdma) {
+                        bmdma += 8;
+                        if(inb(bmdma + 2) & 0x80)
+                        probe_ent->host_set_flags |= ATA_HOST_SIMPLEX;
+                        probe_ent->port[p].bmdma_addr = bmdma;
+                }
                 ata_std_ports(&probe_ent->port[p]);
                 p++;
         }
@@ -740,6 +752,7 @@ static struct ata_probe_ent *ata_pci_init_legacy_port(struct pci_dev *pdev,
                                 struct ata_port_info *port, int port_num)
 {
         struct ata_probe_ent *probe_ent;
+        unsigned long bmdma;
 
         probe_ent = ata_probe_ent_alloc(pci_dev_to_dev(pdev), port);
         if (!probe_ent)
@@ -766,8 +779,13 @@ static struct ata_probe_ent *ata_pci_init_legacy_port(struct pci_dev *pdev,
                         break;
         }
 
-        probe_ent->port[0].bmdma_addr =
-                pci_resource_start(pdev, 4) + 8 * port_num;
+        bmdma = pci_resource_start(pdev, 4);
+        if (bmdma != 0) {
+                bmdma += 8 * port_num;
+                probe_ent->port[0].bmdma_addr = bmdma;
+                if (inb(bmdma + 2) & 0x80)
+                        probe_ent->host_set_flags |= ATA_HOST_SIMPLEX;
+        }
         ata_std_ports(&probe_ent->port[0]);
 
         return probe_ent;
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index d279666dcb38..e63c1ff1e102 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -62,7 +62,9 @@
 #include "libata.h"
 
 static unsigned int ata_dev_init_params(struct ata_port *ap,
-                                        struct ata_device *dev);
+                                        struct ata_device *dev,
+                                        u16 heads,
+                                        u16 sectors);
 static void ata_set_mode(struct ata_port *ap);
 static unsigned int ata_dev_set_xfermode(struct ata_port *ap,
                                          struct ata_device *dev);
@@ -276,7 +278,7 @@ static void ata_unpack_xfermask(unsigned int xfer_mask,
 }
 
 static const struct ata_xfer_ent {
-        unsigned int shift, bits;
+        int shift, bits;
         u8 base;
 } ata_xfer_tbl[] = {
         { ATA_SHIFT_PIO, ATA_BITS_PIO, XFER_PIO_0 },
@@ -987,9 +989,7 @@ ata_exec_internal(struct ata_port *ap, struct ata_device *dev,
         qc->private_data = &wait;
         qc->complete_fn = ata_qc_complete_internal;
 
-        qc->err_mask = ata_qc_issue(qc);
-        if (qc->err_mask)
-                ata_qc_complete(qc);
+        ata_qc_issue(qc);
 
         spin_unlock_irqrestore(&ap->host_set->lock, flags);
 
@@ -1081,9 +1081,8 @@ unsigned int ata_pio_need_iordy(const struct ata_device *adev)
  *
  *      Read ID data from the specified device.  ATA_CMD_ID_ATA is
  *      performed on ATA devices and ATA_CMD_ID_ATAPI on ATAPI
- *      devices.  This function also takes care of EDD signature
- *      misreporting (to be removed once EDD support is gone) and
- *      issues ATA_CMD_INIT_DEV_PARAMS for pre-ATA4 drives.
+ *      devices.  This function also issues ATA_CMD_INIT_DEV_PARAMS
+ *      for pre-ATA4 drives.
  *
  *      LOCKING:
  *      Kernel thread context (may sleep)
@@ -1095,7 +1094,6 @@ static int ata_dev_read_id(struct ata_port *ap, struct ata_device *dev,
                            unsigned int *p_class, int post_reset, u16 **p_id)
 {
         unsigned int class = *p_class;
-        unsigned int using_edd;
         struct ata_taskfile tf;
         unsigned int err_mask = 0;
         u16 *id;
@@ -1104,12 +1102,6 @@ static int ata_dev_read_id(struct ata_port *ap, struct ata_device *dev,
 
         DPRINTK("ENTER, host %u, dev %u\n", ap->id, dev->devno);
 
-        if (ap->ops->probe_reset ||
-            ap->flags & (ATA_FLAG_SRST | ATA_FLAG_SATA_RESET))
-                using_edd = 0;
-        else
-                using_edd = 1;
-
         ata_dev_select(ap, dev->devno, 1, 1); /* select device 0/1 */
 
         id = kmalloc(sizeof(id[0]) * ATA_ID_WORDS, GFP_KERNEL);
@@ -1139,39 +1131,16 @@ static int ata_dev_read_id(struct ata_port *ap, struct ata_device *dev,
 
         err_mask = ata_exec_internal(ap, dev, &tf, DMA_FROM_DEVICE,
                                      id, sizeof(id[0]) * ATA_ID_WORDS);
-
         if (err_mask) {
                 rc = -EIO;
                 reason = "I/O error";
-
-                if (err_mask & ~AC_ERR_DEV)
-                        goto err_out;
-
-                /*
-                 * arg!  EDD works for all test cases, but seems to return
-                 * the ATA signature for some ATAPI devices.  Until the
-                 * reason for this is found and fixed, we fix up the mess
-                 * here.  If IDENTIFY DEVICE returns command aborted
-                 * (as ATAPI devices do), then we issue an
-                 * IDENTIFY PACKET DEVICE.
-                 *
-                 * ATA software reset (SRST, the default) does not appear
-                 * to have this problem.
-                 */
-                if ((using_edd) && (class == ATA_DEV_ATA)) {
-                        u8 err = tf.feature;
-                        if (err & ATA_ABORTED) {
-                                class = ATA_DEV_ATAPI;
-                                goto retry;
-                        }
-                }
                 goto err_out;
         }
 
         swap_buf_le16(id, ATA_ID_WORDS);
 
         /* sanity check */
-        if ((class == ATA_DEV_ATA) != ata_id_is_ata(id)) {
+        if ((class == ATA_DEV_ATA) != (ata_id_is_ata(id) | ata_id_is_cfa(id))) {
                 rc = -EINVAL;
                 reason = "device reports illegal type";
                 goto err_out;
@@ -1187,7 +1156,7 @@ static int ata_dev_read_id(struct ata_port *ap, struct ata_device *dev,
                  * Some drives were very specific about that exact sequence.
                  */
                 if (ata_id_major_version(id) < 4 || !ata_id_has_lba(id)) {
-                        err_mask = ata_dev_init_params(ap, dev);
+                        err_mask = ata_dev_init_params(ap, dev, id[3], id[6]);
                         if (err_mask) {
                                 rc = -EIO;
                                 reason = "INIT_DEV_PARAMS failed";
@@ -1440,7 +1409,11 @@ static int ata_bus_probe(struct ata_port *ap)
         if (!found)
                 goto err_out_disable;
 
-        ata_set_mode(ap);
+        if (ap->ops->set_mode)
+                ap->ops->set_mode(ap);
+        else
+                ata_set_mode(ap);
+
         if (ap->flags & ATA_FLAG_PORT_DISABLED)
                 goto err_out_disable;
 
@@ -1845,7 +1818,7 @@ static void ata_host_set_dma(struct ata_port *ap)
  */
 static void ata_set_mode(struct ata_port *ap)
 {
-        int i, rc;
+        int i, rc, used_dma = 0;
 
         /* step 1: calculate xfer_mask */
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
@@ -1863,6 +1836,9 @@ static void ata_set_mode(struct ata_port *ap)
                 dma_mask = ata_pack_xfermask(0, dev->mwdma_mask, dev->udma_mask);
                 dev->pio_mode = ata_xfer_mask2mode(pio_mask);
                 dev->dma_mode = ata_xfer_mask2mode(dma_mask);
+
+                if (dev->dma_mode)
+                        used_dma = 1;
         }
 
         /* step 2: always set host PIO timings */
@@ -1884,6 +1860,17 @@ static void ata_set_mode(struct ata_port *ap)
                         goto err_out;
         }
 
+        /*
+         *      Record simplex status. If we selected DMA then the other
+         *      host channels are not permitted to do so.
+         */
+
+        if (used_dma && (ap->host_set->flags & ATA_HOST_SIMPLEX))
+                ap->host_set->simplex_claimed = 1;
+
+        /*
+         *      Chip specific finalisation
+         */
         if (ap->ops->post_set_mode)
                 ap->ops->post_set_mode(ap);
 
@@ -2005,45 +1992,6 @@ static void ata_bus_post_reset(struct ata_port *ap, unsigned int devmask)
                 ap->ops->dev_select(ap, 0);
 }
 
-/**
- *      ata_bus_edd - Issue EXECUTE DEVICE DIAGNOSTIC command.
- *      @ap: Port to reset and probe
- *
- *      Use the EXECUTE DEVICE DIAGNOSTIC command to reset and
- *      probe the bus.  Not often used these days.
- *
- *      LOCKING:
- *      PCI/etc. bus probe sem.
- *      Obtains host_set lock.
- *
- */
-
-static unsigned int ata_bus_edd(struct ata_port *ap)
-{
-        struct ata_taskfile tf;
-        unsigned long flags;
-
-        /* set up execute-device-diag (bus reset) taskfile */
-        /* also, take interrupts to a known state (disabled) */
-        DPRINTK("execute-device-diag\n");
-        ata_tf_init(ap, &tf, 0);
-        tf.ctl |= ATA_NIEN;
-        tf.command = ATA_CMD_EDD;
-        tf.protocol = ATA_PROT_NODATA;
-
-        /* do bus reset */
-        spin_lock_irqsave(&ap->host_set->lock, flags);
-        ata_tf_to_host(ap, &tf);
-        spin_unlock_irqrestore(&ap->host_set->lock, flags);
-
-        /* spec says at least 2ms.  but who knows with those
-         * crazy ATAPI devices...
-         */
-        msleep(150);
-
-        return ata_busy_sleep(ap, ATA_TMOUT_BOOT_QUICK, ATA_TMOUT_BOOT);
-}
-
 static unsigned int ata_bus_softreset(struct ata_port *ap,
                                       unsigned int devmask)
 {
@@ -2078,13 +2026,12 @@ static unsigned int ata_bus_softreset(struct ata_port *ap,
          */
         msleep(150);
 
-
         /* Before we perform post reset processing we want to see if
-           the bus shows 0xFF because the odd clown forgets the D7 pulldown
-           resistor */
-
+         * the bus shows 0xFF because the odd clown forgets the D7
+         * pulldown resistor.
+         */
         if (ata_check_status(ap) == 0xFF)
-                return 1;       /* Positive is failure for some reason */
+                return AC_ERR_OTHER;
 
         ata_bus_post_reset(ap, devmask);
 
@@ -2116,7 +2063,7 @@ void ata_bus_reset(struct ata_port *ap)
         struct ata_ioports *ioaddr = &ap->ioaddr;
         unsigned int slave_possible = ap->flags & ATA_FLAG_SLAVE_POSS;
         u8 err;
-        unsigned int dev0, dev1 = 0, rc = 0, devmask = 0;
+        unsigned int dev0, dev1 = 0, devmask = 0;
 
         DPRINTK("ENTER, host %u, port %u\n", ap->id, ap->port_no);
 
@@ -2139,18 +2086,8 @@ void ata_bus_reset(struct ata_port *ap)
 
         /* issue bus reset */
         if (ap->flags & ATA_FLAG_SRST)
-                rc = ata_bus_softreset(ap, devmask);
-        else if ((ap->flags & ATA_FLAG_SATA_RESET) == 0) {
-                /* set up device control */
-                if (ap->flags & ATA_FLAG_MMIO)
-                        writeb(ap->ctl, (void __iomem *) ioaddr->ctl_addr);
-                else
-                        outb(ap->ctl, ioaddr->ctl_addr);
-                rc = ata_bus_edd(ap);
-        }
-
-        if (rc)
-                goto err_out;
+                if (ata_bus_softreset(ap, devmask))
+                        goto err_out;
 
         /*
          * determine by signature whether we have ATA or ATAPI devices
@@ -2223,9 +2160,9 @@ static int sata_phy_resume(struct ata_port *ap)
  *      so makes reset sequence different from the original
  *      ->phy_reset implementation and Jeff nervous.  :-P
  */
-extern void ata_std_probeinit(struct ata_port *ap)
+void ata_std_probeinit(struct ata_port *ap)
 {
-        if (ap->flags & ATA_FLAG_SATA && ap->ops->scr_read) {
+        if ((ap->flags & ATA_FLAG_SATA) && ap->ops->scr_read) {
                 sata_phy_resume(ap);
                 if (sata_dev_present(ap))
                         ata_busy_sleep(ap, ATA_TMOUT_BOOT_QUICK, ATA_TMOUT_BOOT);
@@ -2714,18 +2651,23 @@ static int ata_dma_blacklisted(const struct ata_device *dev)
  *      known limits including host controller limits, device
  *      blacklist, etc...
  *
+ *      FIXME: The current implementation limits all transfer modes to
+ *      the fastest of the lowested device on the port.  This is not
+ *      required on most controllers.
+ *
  *      LOCKING:
  *      None.
  */
 static void ata_dev_xfermask(struct ata_port *ap, struct ata_device *dev)
 {
+        struct ata_host_set *hs = ap->host_set;
         unsigned long xfer_mask;
         int i;
 
         xfer_mask = ata_pack_xfermask(ap->pio_mask, ap->mwdma_mask,
                                       ap->udma_mask);
 
-        /* use port-wide xfermask for now */
+        /* FIXME: Use port-wide xfermask for now */
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
                 struct ata_device *d = &ap->device[i];
                 if (!ata_dev_present(d))
@@ -2735,12 +2677,23 @@ static void ata_dev_xfermask(struct ata_port *ap, struct ata_device *dev)
                 xfer_mask &= ata_id_xfermask(d->id);
                 if (ata_dma_blacklisted(d))
                         xfer_mask &= ~(ATA_MASK_MWDMA | ATA_MASK_UDMA);
+                /* Apply cable rule here. Don't apply it early because when
+                   we handle hot plug the cable type can itself change */
+                if (ap->cbl == ATA_CBL_PATA40)
+                        xfer_mask &= ~(0xF8 << ATA_SHIFT_UDMA);
         }
 
         if (ata_dma_blacklisted(dev))
                 printk(KERN_WARNING "ata%u: dev %u is on DMA blacklist, "
                        "disabling DMA\n", ap->id, dev->devno);
 
+        if (hs->flags & ATA_HOST_SIMPLEX) {
+                if (hs->simplex_claimed)
+                        xfer_mask &= ~(ATA_MASK_MWDMA | ATA_MASK_UDMA);
+        }
+        if (ap->ops->mode_filter)
+                xfer_mask = ap->ops->mode_filter(ap, dev, xfer_mask);
+
         ata_unpack_xfermask(xfer_mask, &dev->pio_mask, &dev->mwdma_mask,
                             &dev->udma_mask);
 }
@@ -2795,16 +2748,16 @@ static unsigned int ata_dev_set_xfermode(struct ata_port *ap,
  */
 
 static unsigned int ata_dev_init_params(struct ata_port *ap,
-                                        struct ata_device *dev)
+                                        struct ata_device *dev,
+                                        u16 heads,
+                                        u16 sectors)
 {
         struct ata_taskfile tf;
         unsigned int err_mask;
-        u16 sectors = dev->id[6];
-        u16 heads   = dev->id[3];
 
         /* Number of sectors per track 1-255. Number of heads 1-16 */
         if (sectors < 1 || sectors > 255 || heads < 1 || heads > 16)
-                return 0;
+                return AC_ERR_INVALID;
 
         /* set up init dev params taskfile */
         DPRINTK("init dev params \n");
@@ -4042,15 +3995,14 @@ static inline int ata_should_dma_map(struct ata_queued_cmd *qc)
  *
  *      LOCKING:
  *      spin_lock_irqsave(host_set lock)
- *
- *      RETURNS:
- *      Zero on success, AC_ERR_* mask on failure
  */
-
-unsigned int ata_qc_issue(struct ata_queued_cmd *qc)
+void ata_qc_issue(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
 
+        qc->ap->active_tag = qc->tag;
+        qc->flags |= ATA_QCFLAG_ACTIVE;
+
         if (ata_should_dma_map(qc)) {
                 if (qc->flags & ATA_QCFLAG_SG) {
                         if (ata_sg_setup(qc))
@@ -4065,17 +4017,18 @@ unsigned int ata_qc_issue(struct ata_queued_cmd *qc)
 
         ap->ops->qc_prep(qc);
 
-        qc->ap->active_tag = qc->tag;
-        qc->flags |= ATA_QCFLAG_ACTIVE;
-
-        return ap->ops->qc_issue(qc);
+        qc->err_mask |= ap->ops->qc_issue(qc);
+        if (unlikely(qc->err_mask))
+                goto err;
+        return;
 
 sg_err:
         qc->flags &= ~ATA_QCFLAG_DMAMAP;
-        return AC_ERR_SYSTEM;
+        qc->err_mask |= AC_ERR_SYSTEM;
+err:
+        ata_qc_complete(qc);
 }
 
-
 /**
  *      ata_qc_issue_prot - issue taskfile to device in proto-dependent manner
  *      @qc: command to issue to device
@@ -4536,6 +4489,14 @@ static struct ata_port * ata_host_add(const struct ata_probe_ent *ent,
         int rc;
 
         DPRINTK("ENTER\n");
+
+        if (!ent->port_ops->probe_reset &&
+            !(ent->host_flags & (ATA_FLAG_SATA_RESET | ATA_FLAG_SRST))) {
+                printk(KERN_ERR "ata%u: no reset mechanism available\n",
+                       port_no);
+                return NULL;
+        }
+
         host = scsi_host_alloc(ent->sht, sizeof(struct ata_port));
         if (!host)
                 return NULL;
@@ -4596,6 +4557,7 @@ int ata_device_add(const struct ata_probe_ent *ent)
         host_set->mmio_base = ent->mmio_base;
         host_set->private_data = ent->private_data;
         host_set->ops = ent->port_ops;
+        host_set->flags = ent->host_set_flags;
 
         /* register each port bound to this device */
         for (i = 0; i < ent->n_ports; i++) {
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 628191bfd990..53f5b0d9161c 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -1431,9 +1431,7 @@ static void ata_scsi_translate(struct ata_port *ap, struct ata_device *dev,
                 goto early_finish;
 
         /* select device, send command to hardware */
-        qc->err_mask = ata_qc_issue(qc);
-        if (qc->err_mask)
-                ata_qc_complete(qc);
+        ata_qc_issue(qc);
 
         VPRINTK("EXIT\n");
         return;
@@ -2199,9 +2197,7 @@ static void atapi_request_sense(struct ata_queued_cmd *qc)
 
         qc->complete_fn = atapi_sense_complete;
 
-        qc->err_mask = ata_qc_issue(qc);
-        if (qc->err_mask)
-                ata_qc_complete(qc);
+        ata_qc_issue(qc);
 
         DPRINTK("EXIT\n");
 }
diff --git a/drivers/scsi/libata.h b/drivers/scsi/libata.h
index 65f52beea884..1c755b14521a 100644
--- a/drivers/scsi/libata.h
+++ b/drivers/scsi/libata.h
@@ -47,7 +47,7 @@ extern struct ata_queued_cmd *ata_qc_new_init(struct ata_port *ap,
 extern int ata_rwcmd_protocol(struct ata_queued_cmd *qc);
 extern void ata_port_flush_task(struct ata_port *ap);
 extern void ata_qc_free(struct ata_queued_cmd *qc);
-extern unsigned int ata_qc_issue(struct ata_queued_cmd *qc);
+extern void ata_qc_issue(struct ata_queued_cmd *qc);
 extern int ata_check_atapi_dma(struct ata_queued_cmd *qc);
 extern void ata_dev_select(struct ata_port *ap, unsigned int device,
                            unsigned int wait, unsigned int can_sleep);
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index 275ed9bd898c..fa901fd65085 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -1010,7 +1010,7 @@ static void mv_fill_sg(struct ata_queued_cmd *qc)
 
                         pp->sg_tbl[i].addr = cpu_to_le32(addr & 0xffffffff);
                         pp->sg_tbl[i].addr_hi = cpu_to_le32((addr >> 16) >> 16);
-                        pp->sg_tbl[i].flags_size = cpu_to_le32(len);
+                        pp->sg_tbl[i].flags_size = cpu_to_le32(len & 0xffff);
 
                         sg_len -= len;
                         addr += len;
@@ -1350,7 +1350,6 @@ static void mv_host_intr(struct ata_host_set *host_set, u32 relevant,
 {
         void __iomem *mmio = host_set->mmio_base;
         void __iomem *hc_mmio = mv_hc_base(mmio, hc);
-        struct ata_port *ap;
         struct ata_queued_cmd *qc;
         u32 hc_irq_cause;
         int shift, port, port0, hard_port, handled;
@@ -1373,25 +1372,32 @@ static void mv_host_intr(struct ata_host_set *host_set, u32 relevant,
 
         for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
                 u8 ata_status = 0;
-                ap = host_set->ports[port];
+                struct ata_port *ap = host_set->ports[port];
+                struct mv_port_priv *pp = ap->private_data;
+
                 hard_port = port & MV_PORT_MASK;        /* range 0-3 */
                 handled = 0;    /* ensure ata_status is set if handled++ */
 
-                if ((CRPB_DMA_DONE << hard_port) & hc_irq_cause) {
-                        /* new CRPB on the queue; just one at a time until NCQ
-                         */
-                        ata_status = mv_get_crpb_status(ap);
-                        handled++;
-                } else if ((DEV_IRQ << hard_port) & hc_irq_cause) {
-                        /* received ATA IRQ; read the status reg to clear INTRQ
-                         */
-                        ata_status = readb((void __iomem *)
+                /* Note that DEV_IRQ might happen spuriously during EDMA,
+                 * and should be ignored in such cases.  We could mask it,
+                 * but it's pretty rare and may not be worth the overhead.
+                 */ 
+                if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
+                        /* EDMA: check for response queue interrupt */
+                        if ((CRPB_DMA_DONE << hard_port) & hc_irq_cause) {
+                                ata_status = mv_get_crpb_status(ap);
+                                handled = 1;
+                        }
+                } else {
+                        /* PIO: check for device (drive) interrupt */
+                        if ((DEV_IRQ << hard_port) & hc_irq_cause) {
+                                ata_status = readb((void __iomem *)
                                            ap->ioaddr.status_addr);
-                        handled++;
+                                handled = 1;
+                        }
                 }
 
-                if (ap &&
-                    (ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR)))
+                if (ap->flags & (ATA_FLAG_PORT_DISABLED | ATA_FLAG_NOINTR))
                         continue;
 
                 err_mask = ac_err_mask(ata_status);
@@ -1403,12 +1409,12 @@ static void mv_host_intr(struct ata_host_set *host_set, u32 relevant,
                 if ((PORT0_ERR << shift) & relevant) {
                         mv_err_intr(ap);
                         err_mask |= AC_ERR_OTHER;
-                        handled++;
+                        handled = 1;
                 }
 
-                if (handled && ap) {
+                if (handled) {
                         qc = ata_qc_from_tag(ap, ap->active_tag);
-                        if (NULL != qc) {
+                        if (qc && (qc->flags & ATA_QCFLAG_ACTIVE)) {
                                 VPRINTK("port %u IRQ found for qc, "
                                         "ata_status 0x%x\n", port,ata_status);
                                 /* mark qc status appropriately */
diff --git a/drivers/scsi/zalon.c b/drivers/scsi/zalon.c
index b131432c677d..a6cfbb3b361c 100644
--- a/drivers/scsi/zalon.c
+++ b/drivers/scsi/zalon.c
@@ -88,7 +88,7 @@ zalon_probe(struct parisc_device *dev)
         struct gsc_irq gsc_irq;
         u32 zalon_vers;
         int error = -ENODEV;
-        void __iomem *zalon = ioremap(dev->hpa.start, 4096);
+        void __iomem *zalon = ioremap_nocache(dev->hpa.start, 4096);
         void __iomem *io_port = zalon + GSC_SCSI_ZALON_OFFSET;
         static int unit = 0;
         struct Scsi_Host *host;
diff --git a/drivers/serial/8250_gsc.c b/drivers/serial/8250_gsc.c
index 8b4947933d9b..913c71cc0569 100644
--- a/drivers/serial/8250_gsc.c
+++ b/drivers/serial/8250_gsc.c
@@ -52,13 +52,14 @@ serial_init_chip(struct parisc_device *dev)
                 address += 0x800;
         }
 
-        memset(&port, 0, sizeof(struct uart_port));
-        port.mapbase = address;
-        port.irq = dev->irq;
-        port.iotype = UPIO_MEM;
-        port.flags = UPF_IOREMAP | UPF_BOOT_AUTOCONF;
-        port.uartclk = LASI_BASE_BAUD * 16;
-        port.dev = &dev->dev;
+        memset(&port, 0, sizeof(port));
+        port.iotype     = UPIO_MEM;
+        port.uartclk    = LASI_BASE_BAUD * 16;
+        port.mapbase    = address;
+        port.membase    = ioremap_nocache(address, 16);
+        port.irq        = dev->irq;
+        port.flags      = UPF_BOOT_AUTOCONF;
+        port.dev        = &dev->dev;
 
         err = serial8250_register_port(&port);
         if (err < 0) {
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 4d48b625cd3d..7d823705193c 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -142,12 +142,14 @@ static void jsm_tty_send_xchar(struct uart_port *port, char ch)
 {
         unsigned long lock_flags;
         struct jsm_channel *channel = (struct jsm_channel *)port;
+        struct termios *termios;
 
         spin_lock_irqsave(&port->lock, lock_flags);
-        if (ch == port->info->tty->termios->c_cc[VSTART])
+        termios = port->info->tty->termios;
+        if (ch == termios->c_cc[VSTART])
                 channel->ch_bd->bd_ops->send_start_character(channel);
 
-        if (ch == port->info->tty->termios->c_cc[VSTOP])
+        if (ch == termios->c_cc[VSTOP])
                 channel->ch_bd->bd_ops->send_stop_character(channel);
         spin_unlock_irqrestore(&port->lock, lock_flags);
 }
@@ -178,6 +180,7 @@ static int jsm_tty_open(struct uart_port *port)
         struct jsm_board *brd;
         int rc = 0;
         struct jsm_channel *channel = (struct jsm_channel *)port;
+        struct termios *termios;
 
         /* Get board pointer from our array of majors we have allocated */
         brd = channel->ch_bd;
@@ -239,12 +242,13 @@ static int jsm_tty_open(struct uart_port *port)
         channel->ch_cached_lsr = 0;
         channel->ch_stops_sent = 0;
 
-        channel->ch_c_cflag     = port->info->tty->termios->c_cflag;
-        channel->ch_c_iflag     = port->info->tty->termios->c_iflag;
-        channel->ch_c_oflag     = port->info->tty->termios->c_oflag;
-        channel->ch_c_lflag     = port->info->tty->termios->c_lflag;
-        channel->ch_startc = port->info->tty->termios->c_cc[VSTART];
-        channel->ch_stopc = port->info->tty->termios->c_cc[VSTOP];
+        termios = port->info->tty->termios;
+        channel->ch_c_cflag     = termios->c_cflag;
+        channel->ch_c_iflag     = termios->c_iflag;
+        channel->ch_c_oflag     = termios->c_oflag;
+        channel->ch_c_lflag     = termios->c_lflag;
+        channel->ch_startc      = termios->c_cc[VSTART];
+        channel->ch_stopc       = termios->c_cc[VSTOP];
 
         /* Tell UART to init itself */
         brd->bd_ops->uart_init(channel);
@@ -784,6 +788,7 @@ static void jsm_carrier(struct jsm_channel *ch)
 
 void jsm_check_queue_flow_control(struct jsm_channel *ch)
 {
+        struct board_ops *bd_ops = ch->ch_bd->bd_ops;
         int qleft = 0;
 
         /* Store how much space we have left in the queue */
@@ -809,7 +814,7 @@ void jsm_check_queue_flow_control(struct jsm_channel *ch)
                 /* HWFLOW */
                 if (ch->ch_c_cflag & CRTSCTS) {
                         if(!(ch->ch_flags & CH_RECEIVER_OFF)) {
-                                ch->ch_bd->bd_ops->disable_receiver(ch);
+                                bd_ops->disable_receiver(ch);
                                 ch->ch_flags |= (CH_RECEIVER_OFF);
                                 jsm_printk(READ, INFO, &ch->ch_bd->pci_dev,
                                         "Internal queue hit hilevel mark (%d)! Turning off interrupts.\n",
@@ -819,7 +824,7 @@ void jsm_check_queue_flow_control(struct jsm_channel *ch)
                 /* SWFLOW */
                 else if (ch->ch_c_iflag & IXOFF) {
                         if (ch->ch_stops_sent <= MAX_STOPS_SENT) {
-                                ch->ch_bd->bd_ops->send_stop_character(ch);
+                                bd_ops->send_stop_character(ch);
                                 ch->ch_stops_sent++;
                                 jsm_printk(READ, INFO, &ch->ch_bd->pci_dev,
                                         "Sending stop char! Times sent: %x\n", ch->ch_stops_sent);
@@ -846,7 +851,7 @@ void jsm_check_queue_flow_control(struct jsm_channel *ch)
                 /* HWFLOW */
                 if (ch->ch_c_cflag & CRTSCTS) {
                         if (ch->ch_flags & CH_RECEIVER_OFF) {
-                                ch->ch_bd->bd_ops->enable_receiver(ch);
+                                bd_ops->enable_receiver(ch);
                                 ch->ch_flags &= ~(CH_RECEIVER_OFF);
                                 jsm_printk(READ, INFO, &ch->ch_bd->pci_dev,
                                         "Internal queue hit lowlevel mark (%d)! Turning on interrupts.\n",
@@ -856,7 +861,7 @@ void jsm_check_queue_flow_control(struct jsm_channel *ch)
                 /* SWFLOW */
                 else if (ch->ch_c_iflag & IXOFF && ch->ch_stops_sent) {
                         ch->ch_stops_sent = 0;
-                        ch->ch_bd->bd_ops->send_start_character(ch);
+                        bd_ops->send_start_character(ch);
                         jsm_printk(READ, INFO, &ch->ch_bd->pci_dev, "Sending start char!\n");
                 }
         }
diff --git a/drivers/serial/mux.c b/drivers/serial/mux.c
index 868eaf4a1a68..64c0e89124c9 100644
--- a/drivers/serial/mux.c
+++ b/drivers/serial/mux.c
@@ -51,7 +51,7 @@
 #define MUX_BREAK(status) ((status & 0xF000) == 0x2000)
 
 #define MUX_NR 256
-static unsigned int port_cnt = 0;
+static unsigned int port_cnt __read_mostly;
 static struct uart_port mux_ports[MUX_NR];
 
 static struct uart_driver mux_driver = {
@@ -461,7 +461,7 @@ static int __init mux_probe(struct parisc_device *dev)
                 port->iobase    = 0;
                 port->mapbase   = dev->hpa.start + MUX_OFFSET +
                                                 (i * MUX_LINE_OFFSET);
-                port->membase   = ioremap(port->mapbase, MUX_LINE_OFFSET);
+                port->membase   = ioremap_nocache(port->mapbase, MUX_LINE_OFFSET);
                 port->iotype    = UPIO_MEM;
                 port->type      = PORT_MUX;
                 port->irq       = NO_IRQ;
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 22e9d696fdd2..f87c0171f4ec 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -904,18 +904,6 @@ config FB_MATROX_MULTIHEAD
           There is no need for enabling 'Matrox multihead support' if you have
           only one Matrox card in the box.
 
-config FB_RADEON_OLD
-        tristate "ATI Radeon display support (Old driver)"
-        depends on FB && PCI
-        select FB_CFB_FILLRECT
-        select FB_CFB_COPYAREA
-        select FB_CFB_IMAGEBLIT
-        select FB_MACMODES if PPC
-        help
-          Choose this option if you want to use an ATI Radeon graphics card as
-          a framebuffer device.  There are both PCI and AGP versions.  You
-          don't need to choose this to run the Radeon in plain VGA mode.
-
 config FB_RADEON
         tristate "ATI Radeon display support"
         depends on FB && PCI
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index cb90218515ac..23de3b2c7856 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -39,7 +39,6 @@ obj-$(CONFIG_FB_KYRO)             += kyro/
 obj-$(CONFIG_FB_SAVAGE)           += savage/
 obj-$(CONFIG_FB_GEODE)            += geode/
 obj-$(CONFIG_FB_I810)             += vgastate.o
-obj-$(CONFIG_FB_RADEON_OLD)       += radeonfb.o
 obj-$(CONFIG_FB_NEOMAGIC)         += neofb.o vgastate.o
 obj-$(CONFIG_FB_VIRGE)            += virgefb.o
 obj-$(CONFIG_FB_3DFX)             += tdfxfb.o
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index 9d996f2c10d5..b895eaaa73fd 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -43,11 +43,11 @@ config LCD_DEVICE
         default y
 
 config BACKLIGHT_CORGI
-        tristate "Sharp Corgi Backlight Driver (SL-C7xx Series)"
+        tristate "Sharp Corgi Backlight Driver (SL Series)"
         depends on BACKLIGHT_DEVICE && PXA_SHARPSL
         default y
         help
-          If you have a Sharp Zaurus SL-C7xx, say y to enable the
+          If you have a Sharp Zaurus SL-C7xx, SL-Cxx00 or SL-6000x say y to enable the
           backlight driver.
 
 config BACKLIGHT_HP680
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 151fda8dded0..334b1db1bd7c 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -16,14 +16,12 @@
 
 static ssize_t backlight_show_power(struct class_device *cdev, char *buf)
 {
-        int rc;
+        int rc = -ENXIO;
         struct backlight_device *bd = to_backlight_device(cdev);
 
         down(&bd->sem);
-        if (likely(bd->props && bd->props->get_power))
-                rc = sprintf(buf, "%d\n", bd->props->get_power(bd));
-        else
-                rc = -ENXIO;
+        if (likely(bd->props))
+                rc = sprintf(buf, "%d\n", bd->props->power);
         up(&bd->sem);
 
         return rc;
@@ -31,7 +29,7 @@ static ssize_t backlight_show_power(struct class_device *cdev, char *buf)
 
 static ssize_t backlight_store_power(struct class_device *cdev, const char *buf, size_t count)
 {
-        int rc, power;
+        int rc = -ENXIO, power;
         char *endp;
         struct backlight_device *bd = to_backlight_device(cdev);
 
@@ -40,12 +38,13 @@ static ssize_t backlight_store_power(struct class_device *cdev, const char *buf,
                 return -EINVAL;
 
         down(&bd->sem);
-        if (likely(bd->props && bd->props->set_power)) {
+        if (likely(bd->props)) {
                 pr_debug("backlight: set power to %d\n", power);
-                bd->props->set_power(bd, power);
+                bd->props->power = power;
+                if (likely(bd->props->update_status))
+                        bd->props->update_status(bd);
                 rc = count;
-        } else
-                rc = -ENXIO;
+        }
         up(&bd->sem);
 
         return rc;
@@ -53,14 +52,12 @@ static ssize_t backlight_store_power(struct class_device *cdev, const char *buf,
 
 static ssize_t backlight_show_brightness(struct class_device *cdev, char *buf)
 {
-        int rc;
+        int rc = -ENXIO;
         struct backlight_device *bd = to_backlight_device(cdev);
 
         down(&bd->sem);
-        if (likely(bd->props && bd->props->get_brightness))
-                rc = sprintf(buf, "%d\n", bd->props->get_brightness(bd));
-        else
-                rc = -ENXIO;
+        if (likely(bd->props))
+                rc = sprintf(buf, "%d\n", bd->props->brightness);
         up(&bd->sem);
 
         return rc;
@@ -68,7 +65,7 @@ static ssize_t backlight_show_brightness(struct class_device *cdev, char *buf)
 
 static ssize_t backlight_store_brightness(struct class_device *cdev, const char *buf, size_t count)
 {
-        int rc, brightness;
+        int rc = -ENXIO, brightness;
         char *endp;
         struct backlight_device *bd = to_backlight_device(cdev);
 
@@ -77,12 +74,18 @@ static ssize_t backlight_store_brightness(struct class_device *cdev, const char
                 return -EINVAL;
 
         down(&bd->sem);
-        if (likely(bd->props && bd->props->set_brightness)) {
-                pr_debug("backlight: set brightness to %d\n", brightness);
-                bd->props->set_brightness(bd, brightness);
-                rc = count;
-        } else
-                rc = -ENXIO;
+        if (likely(bd->props)) {
+                if (brightness > bd->props->max_brightness)
+                        rc = -EINVAL;
+                else {
+                        pr_debug("backlight: set brightness to %d\n",
+                                 brightness);
+                        bd->props->brightness = brightness;
+                        if (likely(bd->props->update_status))
+                                bd->props->update_status(bd);
+                        rc = count;
+                }
+        }
         up(&bd->sem);
 
         return rc;
@@ -90,14 +93,26 @@ static ssize_t backlight_store_brightness(struct class_device *cdev, const char
 
 static ssize_t backlight_show_max_brightness(struct class_device *cdev, char *buf)
 {
-        int rc;
+        int rc = -ENXIO;
         struct backlight_device *bd = to_backlight_device(cdev);
 
         down(&bd->sem);
         if (likely(bd->props))
                 rc = sprintf(buf, "%d\n", bd->props->max_brightness);
-        else
-                rc = -ENXIO;
+        up(&bd->sem);
+
+        return rc;
+}
+
+static ssize_t backlight_show_actual_brightness(struct class_device *cdev,
+                                                char *buf)
+{
+        int rc = -ENXIO;
+        struct backlight_device *bd = to_backlight_device(cdev);
+
+        down(&bd->sem);
+        if (likely(bd->props && bd->props->get_brightness))
+                rc = sprintf(buf, "%d\n", bd->props->get_brightness(bd));
         up(&bd->sem);
 
         return rc;
@@ -123,7 +138,10 @@ static struct class backlight_class = {
 
 static struct class_device_attribute bl_class_device_attributes[] = {
         DECLARE_ATTR(power, 0644, backlight_show_power, backlight_store_power),
-        DECLARE_ATTR(brightness, 0644, backlight_show_brightness, backlight_store_brightness),
+        DECLARE_ATTR(brightness, 0644, backlight_show_brightness,
+                     backlight_store_brightness),
+        DECLARE_ATTR(actual_brightness, 0444, backlight_show_actual_brightness,
+                     NULL),
         DECLARE_ATTR(max_brightness, 0444, backlight_show_max_brightness, NULL),
 };
 
@@ -144,8 +162,12 @@ static int fb_notifier_callback(struct notifier_block *self,
         bd = container_of(self, struct backlight_device, fb_notif);
         down(&bd->sem);
         if (bd->props)
-                if (!bd->props->check_fb || bd->props->check_fb(evdata->info))
-                        bd->props->set_power(bd, *(int *)evdata->data);
+                if (!bd->props->check_fb ||
+                    bd->props->check_fb(evdata->info)) {
+                        bd->props->fb_blank = *(int *)evdata->data;
+                        if (likely(bd->props && bd->props->update_status))
+                                bd->props->update_status(bd);
+                }
         up(&bd->sem);
         return 0;
 }
@@ -231,6 +253,12 @@ void backlight_device_unregister(struct backlight_device *bd)
                                          &bl_class_device_attributes[i]);
 
         down(&bd->sem);
+        if (likely(bd->props && bd->props->update_status)) {
+                bd->props->brightness = 0;
+                bd->props->power = 0;
+                bd->props->update_status(bd);
+        }
+
         bd->props = NULL;
         up(&bd->sem);
 
diff --git a/drivers/video/backlight/corgi_bl.c b/drivers/video/backlight/corgi_bl.c
index d0aaf450e8c7..2ebbfd95145f 100644
--- a/drivers/video/backlight/corgi_bl.c
+++ b/drivers/video/backlight/corgi_bl.c
@@ -1,7 +1,7 @@
 /*
- *  Backlight Driver for Sharp Corgi
+ *  Backlight Driver for Sharp Zaurus Handhelds (various models)
  *
- *  Copyright (c) 2004-2005 Richard Purdie
+ *  Copyright (c) 2004-2006 Richard Purdie
  *
  *  Based on Sharp's 2.4 Backlight Driver
  *
@@ -15,80 +15,63 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
-#include <linux/spinlock.h>
+#include <linux/mutex.h>
 #include <linux/fb.h>
 #include <linux/backlight.h>
-
 #include <asm/arch/sharpsl.h>
 #include <asm/hardware/sharpsl_pm.h>
 
-#define CORGI_DEFAULT_INTENSITY         0x1f
-#define CORGI_LIMIT_MASK                0x0b
-
-static int corgibl_powermode = FB_BLANK_UNBLANK;
-static int current_intensity = 0;
-static int corgibl_limit = 0;
-static void (*corgibl_mach_set_intensity)(int intensity);
-static spinlock_t bl_lock = SPIN_LOCK_UNLOCKED;
+static int corgibl_intensity;
+static DEFINE_MUTEX(bl_mutex);
 static struct backlight_properties corgibl_data;
+static struct backlight_device *corgi_backlight_device;
+static struct corgibl_machinfo *bl_machinfo;
 
-static void corgibl_send_intensity(int intensity)
+static unsigned long corgibl_flags;
+#define CORGIBL_SUSPENDED     0x01
+#define CORGIBL_BATTLOW       0x02
+
+static int corgibl_send_intensity(struct backlight_device *bd)
 {
-        unsigned long flags;
         void (*corgi_kick_batt)(void);
+        int intensity = bd->props->brightness;
 
-        if (corgibl_powermode != FB_BLANK_UNBLANK) {
+        if (bd->props->power != FB_BLANK_UNBLANK)
                 intensity = 0;
-        } else {
-                if (corgibl_limit)
-                        intensity &= CORGI_LIMIT_MASK;
-        }
-
-        spin_lock_irqsave(&bl_lock, flags);
+        if (bd->props->fb_blank != FB_BLANK_UNBLANK)
+                intensity = 0;
+        if (corgibl_flags & CORGIBL_SUSPENDED)
+                intensity = 0;
+        if (corgibl_flags & CORGIBL_BATTLOW)
+                intensity &= bl_machinfo->limit_mask;
 
-        corgibl_mach_set_intensity(intensity);
+        mutex_lock(&bl_mutex);
+        bl_machinfo->set_bl_intensity(intensity);
+        mutex_unlock(&bl_mutex);
 
-        spin_unlock_irqrestore(&bl_lock, flags);
+        corgibl_intensity = intensity;
 
         corgi_kick_batt = symbol_get(sharpsl_battery_kick);
         if (corgi_kick_batt) {
                 corgi_kick_batt();
                 symbol_put(sharpsl_battery_kick);
         }
-}
 
-static void corgibl_blank(int blank)
-{
-        switch(blank) {
-
-        case FB_BLANK_NORMAL:
-        case FB_BLANK_VSYNC_SUSPEND:
-        case FB_BLANK_HSYNC_SUSPEND:
-        case FB_BLANK_POWERDOWN:
-                if (corgibl_powermode == FB_BLANK_UNBLANK) {
-                        corgibl_send_intensity(0);
-                        corgibl_powermode = blank;
-                }
-                break;
-        case FB_BLANK_UNBLANK:
-                if (corgibl_powermode != FB_BLANK_UNBLANK) {
-                        corgibl_powermode = blank;
-                        corgibl_send_intensity(current_intensity);
-                }
-                break;
-        }
+        return 0;
 }
 
 #ifdef CONFIG_PM
 static int corgibl_suspend(struct platform_device *dev, pm_message_t state)
 {
-        corgibl_blank(FB_BLANK_POWERDOWN);
+        corgibl_flags |= CORGIBL_SUSPENDED;
+        corgibl_send_intensity(corgi_backlight_device);
         return 0;
 }
 
 static int corgibl_resume(struct platform_device *dev)
 {
-        corgibl_blank(FB_BLANK_UNBLANK);
+        corgibl_flags &= ~CORGIBL_SUSPENDED;
+        corgibl_send_intensity(corgi_backlight_device);
         return 0;
 }
 #else
@@ -96,68 +79,55 @@ static int corgibl_resume(struct platform_device *dev)
 #define corgibl_resume  NULL
 #endif
 
-
-static int corgibl_set_power(struct backlight_device *bd, int state)
-{
-        corgibl_blank(state);
-        return 0;
-}
-
-static int corgibl_get_power(struct backlight_device *bd)
+static int corgibl_get_intensity(struct backlight_device *bd)
 {
-        return corgibl_powermode;
+        return corgibl_intensity;
 }
 
-static int corgibl_set_intensity(struct backlight_device *bd, int intensity)
+static int corgibl_set_intensity(struct backlight_device *bd)
 {
-        if (intensity > corgibl_data.max_brightness)
-                intensity = corgibl_data.max_brightness;
-        corgibl_send_intensity(intensity);
-        current_intensity=intensity;
+        corgibl_send_intensity(corgi_backlight_device);
         return 0;
 }
 
-static int corgibl_get_intensity(struct backlight_device *bd)
-{
-        return current_intensity;
-}
-
 /*
  * Called when the battery is low to limit the backlight intensity.
  * If limit==0 clear any limit, otherwise limit the intensity
  */
 void corgibl_limit_intensity(int limit)
 {
-        corgibl_limit = (limit ? 1 : 0);
-        corgibl_send_intensity(current_intensity);
+        if (limit)
+                corgibl_flags |= CORGIBL_BATTLOW;
+        else
+                corgibl_flags &= ~CORGIBL_BATTLOW;
+        corgibl_send_intensity(corgi_backlight_device);
 }
 EXPORT_SYMBOL(corgibl_limit_intensity);
 
 
 static struct backlight_properties corgibl_data = {
-        .owner          = THIS_MODULE,
-        .get_power      = corgibl_get_power,
-        .set_power      = corgibl_set_power,
+        .owner          = THIS_MODULE,
         .get_brightness = corgibl_get_intensity,
-        .set_brightness = corgibl_set_intensity,
+        .update_status  = corgibl_set_intensity,
 };
 
-static struct backlight_device *corgi_backlight_device;
-
 static int __init corgibl_probe(struct platform_device *pdev)
 {
         struct corgibl_machinfo *machinfo = pdev->dev.platform_data;
 
+        bl_machinfo = machinfo;
         corgibl_data.max_brightness = machinfo->max_intensity;
-        corgibl_mach_set_intensity = machinfo->set_bl_intensity;
+        if (!machinfo->limit_mask)
+                machinfo->limit_mask = -1;
 
         corgi_backlight_device = backlight_device_register ("corgi-bl",
                 NULL, &corgibl_data);
         if (IS_ERR (corgi_backlight_device))
                 return PTR_ERR (corgi_backlight_device);
 
-        corgibl_set_intensity(NULL, CORGI_DEFAULT_INTENSITY);
-        corgibl_limit_intensity(0);
+        corgibl_data.power = FB_BLANK_UNBLANK;
+        corgibl_data.brightness = machinfo->default_intensity;
+        corgibl_send_intensity(corgi_backlight_device);
 
         printk("Corgi Backlight Driver Initialized.\n");
         return 0;
@@ -167,8 +137,6 @@ static int corgibl_remove(struct platform_device *dev)
 {
         backlight_device_unregister(corgi_backlight_device);
 
-        corgibl_set_intensity(NULL, 0);
-
         printk("Corgi Backlight Driver Unloaded\n");
         return 0;
 }
diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
index 95da4c9ed1f1..a71e984c93d4 100644
--- a/drivers/video/backlight/hp680_bl.c
+++ b/drivers/video/backlight/hp680_bl.c
@@ -13,7 +13,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/device.h>
+#include <linux/platform_device.h>
 #include <linux/spinlock.h>
 #include <linux/fb.h>
 #include <linux/backlight.h>
@@ -25,66 +25,58 @@
 #define HP680_MAX_INTENSITY 255
 #define HP680_DEFAULT_INTENSITY 10
 
-static int hp680bl_powermode = FB_BLANK_UNBLANK;
+static int hp680bl_suspended;
 static int current_intensity = 0;
 static spinlock_t bl_lock = SPIN_LOCK_UNLOCKED;
+static struct backlight_device *hp680_backlight_device;
 
-static void hp680bl_send_intensity(int intensity)
+static void hp680bl_send_intensity(struct backlight_device *bd)
 {
         unsigned long flags;
+        u16 v;
+        int intensity = bd->props->brightness;
 
-        if (hp680bl_powermode != FB_BLANK_UNBLANK)
+        if (bd->props->power != FB_BLANK_UNBLANK)
+                intensity = 0;
+        if (bd->props->fb_blank != FB_BLANK_UNBLANK)
+                intensity = 0;
+        if (hp680bl_suspended)
                 intensity = 0;
 
         spin_lock_irqsave(&bl_lock, flags);
-        sh_dac_output(255-(u8)intensity, DAC_LCD_BRIGHTNESS);
+        if (intensity && current_intensity == 0) {
+                sh_dac_enable(DAC_LCD_BRIGHTNESS);
+                v = inw(HD64461_GPBDR);
+                v &= ~HD64461_GPBDR_LCDOFF;
+                outw(v, HD64461_GPBDR);
+                sh_dac_output(255-(u8)intensity, DAC_LCD_BRIGHTNESS);
+        } else if (intensity == 0 && current_intensity != 0) {
+                sh_dac_output(255-(u8)intensity, DAC_LCD_BRIGHTNESS);
+                sh_dac_disable(DAC_LCD_BRIGHTNESS);
+                v = inw(HD64461_GPBDR);
+                v |= HD64461_GPBDR_LCDOFF;
+                outw(v, HD64461_GPBDR);
+        } else if (intensity) {
+                sh_dac_output(255-(u8)intensity, DAC_LCD_BRIGHTNESS);
+        }
         spin_unlock_irqrestore(&bl_lock, flags);
-}
 
-static void hp680bl_blank(int blank)
-{
-        u16 v;
-
-        switch(blank) {
-
-        case FB_BLANK_NORMAL:
-        case FB_BLANK_VSYNC_SUSPEND:
-        case FB_BLANK_HSYNC_SUSPEND:
-        case FB_BLANK_POWERDOWN:
-                if (hp680bl_powermode == FB_BLANK_UNBLANK) {
-                        hp680bl_send_intensity(0);
-                        hp680bl_powermode = blank;
-                        sh_dac_disable(DAC_LCD_BRIGHTNESS);
-                        v = inw(HD64461_GPBDR);
-                        v |= HD64461_GPBDR_LCDOFF;
-                        outw(v, HD64461_GPBDR);
-                }
-                break;
-        case FB_BLANK_UNBLANK:
-                if (hp680bl_powermode != FB_BLANK_UNBLANK) {
-                        sh_dac_enable(DAC_LCD_BRIGHTNESS);
-                        v = inw(HD64461_GPBDR);
-                        v &= ~HD64461_GPBDR_LCDOFF;
-                        outw(v, HD64461_GPBDR);
-                        hp680bl_powermode = blank;
-                        hp680bl_send_intensity(current_intensity);
-                }
-                break;
-        }
+        current_intensity = intensity;
 }
 
+
 #ifdef CONFIG_PM
-static int hp680bl_suspend(struct device *dev, pm_message_t state, u32 level)
+static int hp680bl_suspend(struct platform_device *dev, pm_message_t state)
 {
-        if (level == SUSPEND_POWER_DOWN)
-                hp680bl_blank(FB_BLANK_POWERDOWN);
+        hp680bl_suspended = 1;
+        hp680bl_send_intensity(hp680_backlight_device);
         return 0;
 }
 
-static int hp680bl_resume(struct device *dev, u32 level)
+static int hp680bl_resume(struct platform_device *dev)
 {
-        if (level == RESUME_POWER_ON)
-                hp680bl_blank(FB_BLANK_UNBLANK);
+        hp680bl_suspended = 0;
+        hp680bl_send_intensity(hp680_backlight_device);
         return 0;
 }
 #else
@@ -92,24 +84,9 @@ static int hp680bl_resume(struct device *dev, u32 level)
 #define hp680bl_resume  NULL
 #endif
 
-
-static int hp680bl_set_power(struct backlight_device *bd, int state)
+static int hp680bl_set_intensity(struct backlight_device *bd)
 {
-        hp680bl_blank(state);
-        return 0;
-}
-
-static int hp680bl_get_power(struct backlight_device *bd)
-{
-        return hp680bl_powermode;
-}
-
-static int hp680bl_set_intensity(struct backlight_device *bd, int intensity)
-{
-        if (intensity > HP680_MAX_INTENSITY)
-                intensity = HP680_MAX_INTENSITY;
-        hp680bl_send_intensity(intensity);
-        current_intensity = intensity;
+        hp680bl_send_intensity(bd);
         return 0;
 }
 
@@ -120,65 +97,67 @@ static int hp680bl_get_intensity(struct backlight_device *bd)
 
 static struct backlight_properties hp680bl_data = {
         .owner          = THIS_MODULE,
-        .get_power      = hp680bl_get_power,
-        .set_power      = hp680bl_set_power,
         .max_brightness = HP680_MAX_INTENSITY,
         .get_brightness = hp680bl_get_intensity,
-        .set_brightness = hp680bl_set_intensity,
+        .update_status  = hp680bl_set_intensity,
 };
 
-static struct backlight_device *hp680_backlight_device;
-
-static int __init hp680bl_probe(struct device *dev)
+static int __init hp680bl_probe(struct platform_device *dev)
 {
         hp680_backlight_device = backlight_device_register ("hp680-bl",
                 NULL, &hp680bl_data);
         if (IS_ERR (hp680_backlight_device))
                 return PTR_ERR (hp680_backlight_device);
 
-        hp680bl_set_intensity(NULL, HP680_DEFAULT_INTENSITY);
+        hp680_backlight_device->props->brightness = HP680_DEFAULT_INTENSITY;
+        hp680bl_send_intensity(hp680_backlight_device);
 
         return 0;
 }
 
-static int hp680bl_remove(struct device *dev)
+static int hp680bl_remove(struct platform_device *dev)
 {
         backlight_device_unregister(hp680_backlight_device);
 
         return 0;
 }
 
-static struct device_driver hp680bl_driver = {
-        .name           = "hp680-bl",
-        .bus            = &platform_bus_type,
+static struct platform_driver hp680bl_driver = {
         .probe          = hp680bl_probe,
         .remove         = hp680bl_remove,
         .suspend        = hp680bl_suspend,
         .resume         = hp680bl_resume,
+        .driver         = {
+                .name   = "hp680-bl",
+        },
 };
 
-static struct platform_device hp680bl_device = {
-        .name   = "hp680-bl",
-        .id     = -1,
-};
+static struct platform_device *hp680bl_device;
 
 static int __init hp680bl_init(void)
 {
         int ret;
 
-        ret=driver_register(&hp680bl_driver);
+        ret = platform_driver_register(&hp680bl_driver);
         if (!ret) {
-                ret = platform_device_register(&hp680bl_device);
-                if (ret)
-                        driver_unregister(&hp680bl_driver);
+                hp680bl_device = platform_device_alloc("hp680-bl", -1);
+                if (!hp680bl_device)
+                        return -ENOMEM;
+
+                ret = platform_device_add(hp680bl_device);
+
+                if (ret) {
+                        platform_device_put(hp680bl_device);
+                        platform_driver_unregister(&hp680bl_driver);
+                }
         }
         return ret;
 }
 
 static void __exit hp680bl_exit(void)
 {
-        platform_device_unregister(&hp680bl_device);
-        driver_unregister(&hp680bl_driver);
+        platform_device_unregister(hp680bl_device);
+        platform_driver_unregister(&hp680bl_driver);
 }
 
 module_init(hp680bl_init);
diff --git a/drivers/video/cfbimgblt.c b/drivers/video/cfbimgblt.c
index 910e2338a27e..8ba6152db2fd 100644
--- a/drivers/video/cfbimgblt.c
+++ b/drivers/video/cfbimgblt.c
@@ -169,7 +169,7 @@ static inline void slow_imageblit(const struct fb_image *image, struct fb_info *
 
                 while (j--) {
                         l--;
-                        color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor;
+                        color = (*s & (1 << l)) ? fgcolor : bgcolor;
                         val |= FB_SHIFT_HIGH(color, shift);
                         
                         /* Did the bitshift spill bits to the next long? */
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 041d06987861..ca020719d20b 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -466,7 +466,7 @@ static int __init fb_console_setup(char *this_opt)
         int i, j;
 
         if (!this_opt || !*this_opt)
-                return 0;
+                return 1;
 
         while ((options = strsep(&this_opt, ",")) != NULL) {
                 if (!strncmp(options, "font:", 5))
@@ -481,10 +481,10 @@ static int __init fb_console_setup(char *this_opt)
                                         options++;
                                 }
                                 if (*options != ',')
-                                        return 0;
+                                        return 1;
                                 options++;
                         } else
-                                return 0;
+                                return 1;
                 }
                 
                 if (!strncmp(options, "map:", 4)) {
@@ -496,7 +496,7 @@ static int __init fb_console_setup(char *this_opt)
                                         con2fb_map_boot[i] =
                                                 (options[j++]-'0') % FB_MAX;
                                 }
-                        return 0;
+                        return 1;
                 }
 
                 if (!strncmp(options, "vc:", 3)) {
@@ -518,7 +518,7 @@ static int __init fb_console_setup(char *this_opt)
                                 rotate = 0;
                 }
         }
-        return 0;
+        return 1;
 }
 
 __setup("fbcon=", fb_console_setup);
@@ -1142,6 +1142,7 @@ static void fbcon_init(struct vc_data *vc, int init)
                 set_blitting_type(vc, info);
         }
 
+        ops->p = &fb_display[fg_console];
 }
 
 static void fbcon_deinit(struct vc_data *vc)
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index 0339f5640a78..74ac2acaf72c 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -275,7 +275,7 @@ static int __init sti_setup(char *str)
         if (str)
                 strlcpy (default_sti_path, str, sizeof (default_sti_path));
         
-        return 0;
+        return 1;
 }
 
 /*      Assuming the machine has multiple STI consoles (=graphic cards) which
@@ -321,7 +321,7 @@ static int __init sti_font_setup(char *str)
                 i++;
         }
 
-        return 0;
+        return 1;
 }
 
 /*      The optional linux kernel parameter "sti_font" defines which font
@@ -373,7 +373,7 @@ sti_dump_globcfg(struct sti_glob_cfg *glob_cfg, unsigned int sti_mem_request)
                 glob_cfg->save_addr));
 
         /* dump extended cfg */ 
-        cfg = PTR_STI(glob_cfg->ext_ptr);
+        cfg = PTR_STI((unsigned long)glob_cfg->ext_ptr);
         DPRINTK(( KERN_INFO
                 "monitor %d\n"
                 "in friendly mode: %d\n"
@@ -453,25 +453,11 @@ sti_init_glob_cfg(struct sti_struct *sti,
                 sti->regions_phys[i] =
                         REGION_OFFSET_TO_PHYS(sti->regions[i], newhpa);
                 
-                /* remap virtually */
-                /* FIXME: add BTLB support if btlb==1 */
                 len = sti->regions[i].region_desc.length * 4096;
-
-/* XXX: Enabling IOREMAP debugging causes a crash, so we must be passing
- * a virtual address to something expecting a physical address that doesn't
- * go through a readX macro */
-#if 0
-                if (len)
-                   glob_cfg->region_ptrs[i] = (unsigned long) (
-                        sti->regions[i].region_desc.cache ?
-                        ioremap(sti->regions_phys[i], len) :
-                        ioremap_nocache(sti->regions_phys[i], len) );
-#else
                 if (len)
                         glob_cfg->region_ptrs[i] = sti->regions_phys[i];
-#endif
                 
-                DPRINTK(("region #%d: phys %08lx, virt %08x, len=%lukB, "
+                DPRINTK(("region #%d: phys %08lx, region_ptr %08x, len=%lukB, "
                          "btlb=%d, sysonly=%d, cache=%d, last=%d\n",
                         i, sti->regions_phys[i], glob_cfg->region_ptrs[i],
                         len/1024,
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index b1a8dca76430..944855b3e4af 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1588,7 +1588,7 @@ static int __init video_setup(char *options)
                 }
         }
 
-        return 0;
+        return 1;
 }
 __setup("video=", video_setup);
 #endif
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 53ad61f1038c..809fc5eefc15 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -232,9 +232,9 @@ static int pxafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
         if (var->yres < MIN_YRES)
                 var->yres = MIN_YRES;
         if (var->xres > fbi->max_xres)
-                var->xres = fbi->max_xres;
+                return -EINVAL;
         if (var->yres > fbi->max_yres)
-                var->yres = fbi->max_yres;
+                return -EINVAL;
         var->xres_virtual =
                 max(var->xres_virtual, var->xres);
         var->yres_virtual =
@@ -781,7 +781,7 @@ static void pxafb_disable_controller(struct pxafb_info *fbi)
         LCCR0 &= ~LCCR0_LDM;    /* Enable LCD Disable Done Interrupt */
         LCCR0 |= LCCR0_DIS;     /* Disable LCD Controller */
 
-        schedule_timeout(20 * HZ / 1000);
+        schedule_timeout(200 * HZ / 1000);
         remove_wait_queue(&fbi->ctrlr_wait, &wait);
 
         /* disable LCD controller clock */
@@ -1274,7 +1274,7 @@ int __init pxafb_probe(struct platform_device *dev)
         struct pxafb_mach_info *inf;
         int ret;
 
-        dev_dbg(dev, "pxafb_probe\n");
+        dev_dbg(&dev->dev, "pxafb_probe\n");
 
         inf = dev->dev.platform_data;
         ret = -ENOMEM;
diff --git a/drivers/video/radeonfb.c b/drivers/video/radeonfb.c
deleted file mode 100644
index afb6c2ead599..000000000000
--- a/drivers/video/radeonfb.c
+++ /dev/null
@@ -1,3167 +0,0 @@
-/*
- *      drivers/video/radeonfb.c
- *      framebuffer driver for ATI Radeon chipset video boards
- *
- *      Copyright 2000  Ani Joshi <ajoshi@kernel.crashing.org>
- *
- *
- *      ChangeLog:
- *      2000-08-03      initial version 0.0.1
- *      2000-09-10      more bug fixes, public release 0.0.5
- *      2001-02-19      mode bug fixes, 0.0.7
- *      2001-07-05      fixed scrolling issues, engine initialization,
- *                      and minor mode tweaking, 0.0.9
- *      2001-09-07      Radeon VE support, Nick Kurshev
- *                      blanking, pan_display, and cmap fixes, 0.1.0
- *      2001-10-10      Radeon 7500 and 8500 support, and experimental
- *                      flat panel support, 0.1.1
- *      2001-11-17      Radeon M6 (ppc) support, Daniel Berlin, 0.1.2
- *      2001-11-18      DFP fixes, Kevin Hendricks, 0.1.3
- *      2001-11-29      more cmap, backlight fixes, Benjamin Herrenschmidt
- *      2002-01-18      DFP panel detection via BIOS, Michael Clark, 0.1.4
- *      2002-06-02      console switching, mode set fixes, accel fixes
- *      2002-06-03      MTRR support, Peter Horton, 0.1.5
- *      2002-09-21      rv250, r300, m9 initial support,
- *                      added mirror option, 0.1.6
- *
- *      Special thanks to ATI DevRel team for their hardware donations.
- *
- */
-
-
-#define RADEON_VERSION  "0.1.6"
-
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/tty.h>
-#include <linux/slab.h>
-#include <linux/delay.h>
-#include <linux/fb.h>
-#include <linux/ioport.h>
-#include <linux/init.h>
-#include <linux/pci.h>
-#include <linux/vmalloc.h>
-
-#include <asm/io.h>
-#include <asm/uaccess.h>
-#if defined(__powerpc__)
-#include <asm/prom.h>
-#include <asm/pci-bridge.h>
-#include "macmodes.h"
-
-#ifdef CONFIG_NVRAM
-#include <linux/nvram.h>
-#endif
-
-#ifdef CONFIG_PMAC_BACKLIGHT
-#include <asm/backlight.h>
-#endif
-
-#ifdef CONFIG_BOOTX_TEXT
-#include <asm/btext.h>
-#endif
-
-#ifdef CONFIG_ADB_PMU
-#include <linux/adb.h>
-#include <linux/pmu.h>
-#endif
-
-#endif /* __powerpc__ */
-
-#ifdef CONFIG_MTRR
-#include <asm/mtrr.h>
-#endif
-
-#include <video/radeon.h>
-#include <linux/radeonfb.h>
-
-#define DEBUG  0
-
-#if DEBUG
-#define RTRACE          printk
-#else
-#define RTRACE          if(0) printk
-#endif
-
-// XXX
-#undef CONFIG_PMAC_PBOOK
-
-
-enum radeon_chips {
-        RADEON_QD,
-        RADEON_QE,
-        RADEON_QF,
-        RADEON_QG,
-        RADEON_QY,
-        RADEON_QZ,
-        RADEON_LW,
-        RADEON_LX,
-        RADEON_LY,
-        RADEON_LZ,
-        RADEON_QL,
-        RADEON_QN,
-        RADEON_QO,
-        RADEON_Ql,
-        RADEON_BB,
-        RADEON_QW,
-        RADEON_QX,
-        RADEON_Id,
-        RADEON_Ie,
-        RADEON_If,
-        RADEON_Ig,
-        RADEON_Ya,
-        RADEON_Yd,
-        RADEON_Ld,
-        RADEON_Le,
-        RADEON_Lf,
-        RADEON_Lg,
-        RADEON_ND,
-        RADEON_NE,
-        RADEON_NF,
-        RADEON_NG,
-        RADEON_QM
-};
-
-enum radeon_arch {
-        RADEON_R100,
-        RADEON_RV100,
-        RADEON_R200,
-        RADEON_RV200,
-        RADEON_RV250,
-        RADEON_R300,
-        RADEON_M6,
-        RADEON_M7,
-        RADEON_M9
-};
-
-static struct radeon_chip_info {
-        const char *name;
-        unsigned char arch;
-} radeon_chip_info[] __devinitdata = {
-        { "QD", RADEON_R100 },
-        { "QE", RADEON_R100 },
-        { "QF", RADEON_R100 },
-        { "QG", RADEON_R100 },
-        { "VE QY", RADEON_RV100 },
-        { "VE QZ", RADEON_RV100 },
-        { "M7 LW", RADEON_M7 },
-        { "M7 LX", RADEON_M7 },
-        { "M6 LY", RADEON_M6 },
-        { "M6 LZ", RADEON_M6 },
-        { "8500 QL", RADEON_R200 },
-        { "8500 QN", RADEON_R200 },
-        { "8500 QO", RADEON_R200 },
-        { "8500 Ql", RADEON_R200 },
-        { "8500 BB", RADEON_R200 },
-        { "7500 QW", RADEON_RV200 },
-        { "7500 QX", RADEON_RV200 },
-        { "9000 Id", RADEON_RV250 },
-        { "9000 Ie", RADEON_RV250 },
-        { "9000 If", RADEON_RV250 },
-        { "9000 Ig", RADEON_RV250 },
-        { "M9 Ld", RADEON_M9 },
-        { "M9 Le", RADEON_M9 },
-        { "M9 Lf", RADEON_M9 },
-        { "M9 Lg", RADEON_M9 },
-        { "9700 ND", RADEON_R300 },
-        { "9700 NE", RADEON_R300 },
-        { "9700 NF", RADEON_R300 },
-        { "9700 NG", RADEON_R300 },
-        { "9100 QM", RADEON_R200 }
-};
-
-
-enum radeon_montype
-{
-        MT_NONE,
-        MT_CRT,         /* CRT */
-        MT_LCD,         /* LCD */
-        MT_DFP,         /* DVI */
-        MT_CTV,         /* composite TV */
-        MT_STV          /* S-Video out */
-};
-
-
-static struct pci_device_id radeonfb_pci_table[] = {
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QD, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QD},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QE},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QF},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QG, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QG},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QY, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QY},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QZ, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QZ},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_LW, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_LW},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_LX, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_LX},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_LY, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_LY},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_LZ, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_LZ},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QL, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QL},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QN, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QN},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QO, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QO},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Ql, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Ql},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_BB, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_BB},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QW, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QW},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QX, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QX},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Id, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Id},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Ie, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Ie},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_If, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_If},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Ig, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Ig},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Ya, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Ya},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Yd, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Yd},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Ld, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Ld},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Le, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Le},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Lf, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Lf},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_Lg, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_Lg},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_ND, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_ND},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_NE, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_NE},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_NF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_NF},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_NG, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_NG},
-        { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QM, PCI_ANY_ID, PCI_ANY_ID, 0, 0, RADEON_QM},
-        { 0, }
-};
-MODULE_DEVICE_TABLE(pci, radeonfb_pci_table);
-
-
-typedef struct {
-        u16 reg;
-        u32 val;
-} reg_val;
-
-
-/* these common regs are cleared before mode setting so they do not
- * interfere with anything
- */
-static reg_val common_regs[] = {
-        { OVR_CLR, 0 }, 
-        { OVR_WID_LEFT_RIGHT, 0 },
-        { OVR_WID_TOP_BOTTOM, 0 },
-        { OV0_SCALE_CNTL, 0 },
-        { SUBPIC_CNTL, 0 },
-        { VIPH_CONTROL, 0 },
-        { I2C_CNTL_1, 0 },
-        { GEN_INT_CNTL, 0 },
-        { CAP0_TRIG_CNTL, 0 },
-};
-
-static reg_val common_regs_m6[] = {
-        { OVR_CLR,      0 },
-        { OVR_WID_LEFT_RIGHT,   0 },
-        { OVR_WID_TOP_BOTTOM,   0 },
-        { OV0_SCALE_CNTL,   0 },
-        { SUBPIC_CNTL,      0 },
-        { GEN_INT_CNTL,     0 },
-        { CAP0_TRIG_CNTL,   0 } 
-};
-
-typedef struct {
-        u8 clock_chip_type;
-        u8 struct_size;
-        u8 accelerator_entry;
-        u8 VGA_entry;
-        u16 VGA_table_offset;
-        u16 POST_table_offset;
-        u16 XCLK;
-        u16 MCLK;
-        u8 num_PLL_blocks;
-        u8 size_PLL_blocks;
-        u16 PCLK_ref_freq;
-        u16 PCLK_ref_divider;
-        u32 PCLK_min_freq;
-        u32 PCLK_max_freq;
-        u16 MCLK_ref_freq;
-        u16 MCLK_ref_divider;
-        u32 MCLK_min_freq;
-        u32 MCLK_max_freq;
-        u16 XCLK_ref_freq;
-        u16 XCLK_ref_divider;
-        u32 XCLK_min_freq;
-        u32 XCLK_max_freq;
-} __attribute__ ((packed)) PLL_BLOCK;
-
-
-struct pll_info {
-        int ppll_max;
-        int ppll_min;
-        int xclk;
-        int ref_div;
-        int ref_clk;
-};
-
-
-struct ram_info {
-        int ml;
-        int mb;
-        int trcd;
-        int trp;
-        int twr;
-        int cl;
-        int tr2w;
-        int loop_latency;
-        int rloop;
-};
-
-
-struct radeon_regs {
-        /* CRTC regs */
-        u32 crtc_h_total_disp;
-        u32 crtc_h_sync_strt_wid;
-        u32 crtc_v_total_disp;
-        u32 crtc_v_sync_strt_wid;
-        u32 crtc_pitch;
-        u32 crtc_gen_cntl;
-        u32 crtc_ext_cntl;
-        u32 dac_cntl;
-
-        u32 flags;
-        u32 pix_clock;
-        int xres, yres;
-
-        /* DDA regs */
-        u32 dda_config;
-        u32 dda_on_off;
-
-        /* PLL regs */
-        u32 ppll_div_3;
-        u32 ppll_ref_div;
-        u32 vclk_ecp_cntl;
-        
-        /* Flat panel regs */
-        u32 fp_crtc_h_total_disp;
-        u32 fp_crtc_v_total_disp;
-        u32 fp_gen_cntl;
-        u32 fp_h_sync_strt_wid;
-        u32 fp_horz_stretch;
-        u32 fp_panel_cntl;
-        u32 fp_v_sync_strt_wid;
-        u32 fp_vert_stretch;
-        u32 lvds_gen_cntl;
-        u32 lvds_pll_cntl;
-        u32 tmds_crc;
-        u32 tmds_transmitter_cntl;
-
-#if defined(__BIG_ENDIAN)
-        u32 surface_cntl;
-#endif
-};
-
-
-struct radeonfb_info {
-        struct fb_info info;
-
-        struct radeon_regs state;
-        struct radeon_regs init_state;
-
-        char name[32];
-        char ram_type[12];
-
-        unsigned long mmio_base_phys;
-        unsigned long fb_base_phys;
-
-        void __iomem *mmio_base;
-        void __iomem *fb_base;
-
-        struct pci_dev *pdev;
-
-        unsigned char *EDID;
-        unsigned char __iomem *bios_seg;
-
-        u32 pseudo_palette[17];
-        struct { u8 red, green, blue, pad; } palette[256];
-
-        int chipset;
-        unsigned char arch;
-        int video_ram;
-        u8 rev;
-        int pitch, bpp, depth;
-        int xres, yres, pixclock;
-        int xres_virtual, yres_virtual;
-        u32 accel_flags;
-
-        int use_default_var;
-        int got_dfpinfo;
-
-        int hasCRTC2;
-        int crtDisp_type;
-        int dviDisp_type;
-
-        int panel_xres, panel_yres;
-        int clock;
-        int hOver_plus, hSync_width, hblank;
-        int vOver_plus, vSync_width, vblank;
-        int hAct_high, vAct_high, interlaced;
-        int synct, misc;
-
-        u32 dp_gui_master_cntl;
-
-        struct pll_info pll;
-        int pll_output_freq, post_div, fb_div;
-
-        struct ram_info ram;
-
-        int mtrr_hdl;
-
-#ifdef CONFIG_PMAC_PBOOK
-        int pm_reg;
-        u32 save_regs[64];
-        u32 mdll, mdll2;
-#endif /* CONFIG_PMAC_PBOOK */
-        int asleep;
-        
-        struct radeonfb_info *next;
-};
-
-
-static struct fb_var_screeninfo radeonfb_default_var = {
-        640, 480, 640, 480, 0, 0, 8, 0,
-        {0, 6, 0}, {0, 6, 0}, {0, 6, 0}, {0, 0, 0},
-        0, 0, -1, -1, 0, 39721, 40, 24, 32, 11, 96, 2,
-        0, FB_VMODE_NONINTERLACED
-};
-
-/*
- * IO macros
- */
-
-#define INREG8(addr)            readb((rinfo->mmio_base)+addr)
-#define OUTREG8(addr,val)       writeb(val, (rinfo->mmio_base)+addr)
-#define INREG(addr)             readl((rinfo->mmio_base)+addr)
-#define OUTREG(addr,val)        writel(val, (rinfo->mmio_base)+addr)
-
-#define OUTPLL(addr,val)        \
-        do {    \
-                OUTREG8(CLOCK_CNTL_INDEX, (addr & 0x0000003f) | 0x00000080); \
-                OUTREG(CLOCK_CNTL_DATA, val); \
-        } while(0)
-
-#define OUTPLLP(addr,val,mask)                                          \
-        do {                                                            \
-                unsigned int _tmp = INPLL(addr);                        \
-                _tmp &= (mask);                                         \
-                _tmp |= (val);                                          \
-                OUTPLL(addr, _tmp);                                     \
-        } while (0)
-
-#define OUTREGP(addr,val,mask)                                          \
-        do {                                                            \
-                unsigned int _tmp = INREG(addr);                        \
-                _tmp &= (mask);                                         \
-                _tmp |= (val);                                          \
-                OUTREG(addr, _tmp);                                     \
-        } while (0)
-
-
-static __inline__ u32 _INPLL(struct radeonfb_info *rinfo, u32 addr)
-{
-        OUTREG8(CLOCK_CNTL_INDEX, addr & 0x0000003f);
-        return (INREG(CLOCK_CNTL_DATA));
-}
-
-#define INPLL(addr)             _INPLL(rinfo, addr)
-
-#define PRIMARY_MONITOR(rinfo)  ((rinfo->dviDisp_type != MT_NONE) &&    \
-                                 (rinfo->dviDisp_type != MT_STV) &&     \
-                                 (rinfo->dviDisp_type != MT_CTV) ?      \
-                                 rinfo->dviDisp_type : rinfo->crtDisp_type)
-
-static char *GET_MON_NAME(int type)
-{
-        char *pret = NULL;
-
-        switch (type) {
-                case MT_NONE:
-                        pret = "no";
-                        break;
-                case MT_CRT:
-                        pret = "CRT";
-                        break;
-                case MT_DFP:
-                        pret = "DFP";
-                        break;
-                case MT_LCD:
-                        pret = "LCD";
-                        break;
-                case MT_CTV:
-                        pret = "CTV";
-                        break;
-                case MT_STV:
-                        pret = "STV";
-                        break;
-        }
-
-        return pret;
-}
-
-
-/*
- * 2D engine routines
- */
-
-static __inline__ void radeon_engine_flush (struct radeonfb_info *rinfo)
-{
-        int i;
-
-        /* initiate flush */
-        OUTREGP(RB2D_DSTCACHE_CTLSTAT, RB2D_DC_FLUSH_ALL,
-                ~RB2D_DC_FLUSH_ALL);
-
-        for (i=0; i < 2000000; i++) {
-                if (!(INREG(RB2D_DSTCACHE_CTLSTAT) & RB2D_DC_BUSY))
-                        break;
-        }
-}
-
-
-static __inline__ void _radeon_fifo_wait (struct radeonfb_info *rinfo, int entries)
-{
-        int i;
-
-        for (i=0; i<2000000; i++)
-                if ((INREG(RBBM_STATUS) & 0x7f) >= entries)
-                        return;
-}
-
-
-static __inline__ void _radeon_engine_idle (struct radeonfb_info *rinfo)
-{
-        int i;
-
-        /* ensure FIFO is empty before waiting for idle */
-        _radeon_fifo_wait (rinfo, 64);
-
-        for (i=0; i<2000000; i++) {
-                if (((INREG(RBBM_STATUS) & GUI_ACTIVE)) == 0) {
-                        radeon_engine_flush (rinfo);
-                        return;
-                }
-        }
-}
-
-
-#define radeon_engine_idle()            _radeon_engine_idle(rinfo)
-#define radeon_fifo_wait(entries)       _radeon_fifo_wait(rinfo,entries)
-
-
-
-/*
- * helper routines
- */
-
-static __inline__ u32 radeon_get_dstbpp(u16 depth)
-{
-        switch (depth) {
-                case 8:
-                        return DST_8BPP;
-                case 15:
-                        return DST_15BPP;
-                case 16:
-                        return DST_16BPP;
-                case 32:
-                        return DST_32BPP;
-                default:
-                        return 0;
-        }
-}
-
-
-static inline int var_to_depth(const struct fb_var_screeninfo *var)
-{
-        if (var->bits_per_pixel != 16)
-                return var->bits_per_pixel;
-        return (var->green.length == 6) ? 16 : 15;
-}
-
-
-static void _radeon_engine_reset(struct radeonfb_info *rinfo)
-{
-        u32 clock_cntl_index, mclk_cntl, rbbm_soft_reset;
-
-        radeon_engine_flush (rinfo);
-
-        clock_cntl_index = INREG(CLOCK_CNTL_INDEX);
-        mclk_cntl = INPLL(MCLK_CNTL);
-
-        OUTPLL(MCLK_CNTL, (mclk_cntl |
-                           FORCEON_MCLKA |
-                           FORCEON_MCLKB |
-                           FORCEON_YCLKA |
-                           FORCEON_YCLKB |
-                           FORCEON_MC |
-                           FORCEON_AIC));
-        rbbm_soft_reset = INREG(RBBM_SOFT_RESET);
-
-        OUTREG(RBBM_SOFT_RESET, rbbm_soft_reset |
-                                SOFT_RESET_CP |
-                                SOFT_RESET_HI |
-                                SOFT_RESET_SE |
-                                SOFT_RESET_RE |
-                                SOFT_RESET_PP |
-                                SOFT_RESET_E2 |
-                                SOFT_RESET_RB);
-        INREG(RBBM_SOFT_RESET);
-        OUTREG(RBBM_SOFT_RESET, rbbm_soft_reset & (u32)
-                                ~(SOFT_RESET_CP |
-                                  SOFT_RESET_HI |
-                                  SOFT_RESET_SE |
-                                  SOFT_RESET_RE |
-                                  SOFT_RESET_PP |
-                                  SOFT_RESET_E2 |
-                                  SOFT_RESET_RB));
-        INREG(RBBM_SOFT_RESET);
-
-        OUTPLL(MCLK_CNTL, mclk_cntl);
-        OUTREG(CLOCK_CNTL_INDEX, clock_cntl_index);
-        OUTREG(RBBM_SOFT_RESET, rbbm_soft_reset);
-
-        return;
-}
-
-#define radeon_engine_reset()           _radeon_engine_reset(rinfo)
-
-
-static __inline__ int round_div(int num, int den)
-{
-        return (num + (den / 2)) / den;
-}
-
-
-
-static __inline__ int min_bits_req(int val)
-{
-        int bits_req = 0;
-                
-        if (val == 0)
-                bits_req = 1;
-                        
-        while (val) {
-                val >>= 1;
-                bits_req++;
-        }       
-
-        return (bits_req);
-}
-
-
-static __inline__ int _max(int val1, int val2)
-{
-        if (val1 >= val2)
-                return val1;
-        else
-                return val2;
-}                       
-
-
-
-/*
- * globals
- */
-
-#ifndef MODULE
-static char *mode_option;
-#endif
-
-static char noaccel = 0;
-static char mirror = 0;
-static int panel_yres = 0;
-static char force_dfp = 0;
-static struct radeonfb_info *board_list = NULL;
-static char nomtrr = 0;
-
-/*
- * prototypes
- */
-
-static void radeon_save_state (struct radeonfb_info *rinfo,
-                               struct radeon_regs *save);
-static void radeon_engine_init (struct radeonfb_info *rinfo);
-static void radeon_write_mode (struct radeonfb_info *rinfo,
-                               struct radeon_regs *mode);
-static int __devinit radeon_set_fbinfo (struct radeonfb_info *rinfo);
-static int __devinit radeon_init_disp (struct radeonfb_info *rinfo);
-static int radeon_init_disp_var (struct radeonfb_info *rinfo, struct fb_var_screeninfo *var);
-static void __iomem *radeon_find_rom(struct radeonfb_info *rinfo);
-static void radeon_get_pllinfo(struct radeonfb_info *rinfo, void __iomem *bios_seg);
-static void radeon_get_moninfo (struct radeonfb_info *rinfo);
-static int radeon_get_dfpinfo (struct radeonfb_info *rinfo);
-static int radeon_get_dfpinfo_BIOS(struct radeonfb_info *rinfo);
-static void radeon_get_EDID(struct radeonfb_info *rinfo);
-static int radeon_dfp_parse_EDID(struct radeonfb_info *rinfo);
-static void radeon_update_default_var(struct radeonfb_info *rinfo);
-
-#ifdef CONFIG_PPC_OF
-
-static int radeon_read_OF (struct radeonfb_info *rinfo);
-static int radeon_get_EDID_OF(struct radeonfb_info *rinfo);
-extern struct device_node *pci_device_to_OF_node(struct pci_dev *dev);
-
-#ifdef CONFIG_PMAC_PBOOK
-int radeon_sleep_notify(struct pmu_sleep_notifier *self, int when);
-static struct pmu_sleep_notifier radeon_sleep_notifier = {
-        radeon_sleep_notify, SLEEP_LEVEL_VIDEO,
-};
-#endif /* CONFIG_PMAC_PBOOK */
-#ifdef CONFIG_PMAC_BACKLIGHT
-static int radeon_set_backlight_enable(int on, int level, void *data);
-static int radeon_set_backlight_level(int level, void *data);
-static struct backlight_controller radeon_backlight_controller = {
-        radeon_set_backlight_enable,
-        radeon_set_backlight_level
-};
-#endif /* CONFIG_PMAC_BACKLIGHT */
-
-#endif /* CONFIG_PPC_OF */
-
-
-static void __iomem *radeon_find_rom(struct radeonfb_info *rinfo)
-{       
-#if defined(__i386__)
-        u32  segstart;
-        char __iomem *rom_base;
-        char __iomem *rom;
-        int  stage;
-        int  i,j;       
-        char aty_rom_sig[] = "761295520";
-        char *radeon_sig[] = {
-          "RG6",
-          "RADEON"
-        };
-                                                
-        for(segstart=0x000c0000; segstart<0x000f0000; segstart+=0x00001000) {
-                        
-                stage = 1;
-                
-                rom_base = ioremap(segstart, 0x1000);
-
-                if ((*rom_base == 0x55) && (((*(rom_base + 1)) & 0xff) == 0xaa))
-                        stage = 2;
-                
-                    
-                if (stage != 2) {
-                        iounmap(rom_base);
-                        continue;
-                }
-                                              
-                rom = rom_base;
-                     
-                for (i = 0; (i < 128 - strlen(aty_rom_sig)) && (stage != 3); i++) {
-                        if (aty_rom_sig[0] == *rom)
-                                if (strncmp(aty_rom_sig, rom,
-                                                strlen(aty_rom_sig)) == 0)
-                                        stage = 3;
-                        rom++;
-                }
-                if (stage != 3) {
-                        iounmap(rom_base);
-                        continue;
-                }
-                rom = rom_base;
-        
-                for (i = 0; (i < 512) && (stage != 4); i++) {
-                    for (j = 0; j < ARRAY_SIZE(radeon_sig); j++) {
-                        if (radeon_sig[j][0] == *rom)
-                                if (strncmp(radeon_sig[j], rom,
-                                            strlen(radeon_sig[j])) == 0) {
-                                              stage = 4;
-                                              break;
-                                            }
-                    }                           
-                        rom++;
-                }       
-                if (stage != 4) {
-                        iounmap(rom_base);
-                        continue;
-                }       
-                
-                return rom_base;
-        }
-#endif          
-        return NULL;
-}
-
-
-
-
-static void radeon_get_pllinfo(struct radeonfb_info *rinfo, void __iomem *bios_seg)
-{
-        void __iomem *bios_header;
-        void __iomem *header_ptr;
-        u16 bios_header_offset, pll_info_offset;
-        PLL_BLOCK pll;
-
-        if (bios_seg) {
-                bios_header = bios_seg + 0x48L;
-                header_ptr  = bios_header;
-        
-                bios_header_offset = readw(header_ptr);
-                bios_header = bios_seg + bios_header_offset;
-                bios_header += 0x30;
-        
-                header_ptr = bios_header;
-                pll_info_offset = readw(header_ptr);
-                header_ptr = bios_seg + pll_info_offset;
-        
-                memcpy_fromio(&pll, header_ptr, 50);
-        
-                rinfo->pll.xclk = (u32)pll.XCLK;
-                rinfo->pll.ref_clk = (u32)pll.PCLK_ref_freq;
-                rinfo->pll.ref_div = (u32)pll.PCLK_ref_divider;
-                rinfo->pll.ppll_min = pll.PCLK_min_freq;
-                rinfo->pll.ppll_max = pll.PCLK_max_freq;
-
-                printk("radeonfb: ref_clk=%d, ref_div=%d, xclk=%d from BIOS\n",
-                        rinfo->pll.ref_clk, rinfo->pll.ref_div, rinfo->pll.xclk);
-        } else {
-#ifdef CONFIG_PPC_OF
-                if (radeon_read_OF(rinfo)) {
-                        unsigned int tmp, Nx, M, ref_div, xclk;
-
-                        tmp = INPLL(M_SPLL_REF_FB_DIV);
-                        ref_div = INPLL(PPLL_REF_DIV) & 0x3ff;
-
-                        Nx = (tmp & 0xff00) >> 8;
-                        M = (tmp & 0xff);
-                        xclk = ((((2 * Nx * rinfo->pll.ref_clk) + (M)) /
-                                (2 * M)));
-
-                        rinfo->pll.xclk = xclk;
-                        rinfo->pll.ref_div = ref_div;
-                        rinfo->pll.ppll_min = 12000;
-                        rinfo->pll.ppll_max = 35000;
-
-                        printk("radeonfb: ref_clk=%d, ref_div=%d, xclk=%d from OF\n",
-                                rinfo->pll.ref_clk, rinfo->pll.ref_div, rinfo->pll.xclk);
-
-                        return;
-                }
-#endif
-                /* no BIOS or BIOS not found, use defaults */
-                switch (rinfo->chipset) {
-                        case PCI_DEVICE_ID_ATI_RADEON_QW:
-                        case PCI_DEVICE_ID_ATI_RADEON_QX:
-                                rinfo->pll.ppll_max = 35000;
-                                rinfo->pll.ppll_min = 12000;
-                                rinfo->pll.xclk = 23000;
-                                rinfo->pll.ref_div = 12;
-                                rinfo->pll.ref_clk = 2700;
-                                break;
-                        case PCI_DEVICE_ID_ATI_RADEON_QL:
-                        case PCI_DEVICE_ID_ATI_RADEON_QN:
-                        case PCI_DEVICE_ID_ATI_RADEON_QO:
-                        case PCI_DEVICE_ID_ATI_RADEON_Ql:
-                        case PCI_DEVICE_ID_ATI_RADEON_BB:
-                                rinfo->pll.ppll_max = 35000;
-                                rinfo->pll.ppll_min = 12000;
-                                rinfo->pll.xclk = 27500;
-                                rinfo->pll.ref_div = 12;
-                                rinfo->pll.ref_clk = 2700;
-                                break;
-                        case PCI_DEVICE_ID_ATI_RADEON_Id:
-                        case PCI_DEVICE_ID_ATI_RADEON_Ie:
-                        case PCI_DEVICE_ID_ATI_RADEON_If:
-                        case PCI_DEVICE_ID_ATI_RADEON_Ig:
-                                rinfo->pll.ppll_max = 35000;
-                                rinfo->pll.ppll_min = 12000;
-                                rinfo->pll.xclk = 25000;
-                                rinfo->pll.ref_div = 12;
-                                rinfo->pll.ref_clk = 2700;
-                                break;
-                        case PCI_DEVICE_ID_ATI_RADEON_ND:
-                        case PCI_DEVICE_ID_ATI_RADEON_NE:
-                        case PCI_DEVICE_ID_ATI_RADEON_NF:
-                        case PCI_DEVICE_ID_ATI_RADEON_NG:
-                                rinfo->pll.ppll_max = 40000;
-                                rinfo->pll.ppll_min = 20000;
-                                rinfo->pll.xclk = 27000;
-                                rinfo->pll.ref_div = 12;
-                                rinfo->pll.ref_clk = 2700;
-                                break;
-                        case PCI_DEVICE_ID_ATI_RADEON_QD:
-                        case PCI_DEVICE_ID_ATI_RADEON_QE:
-                        case PCI_DEVICE_ID_ATI_RADEON_QF:
-                        case PCI_DEVICE_ID_ATI_RADEON_QG:
-                        default:
-                                rinfo->pll.ppll_max = 35000;
-                                rinfo->pll.ppll_min = 12000;
-                                rinfo->pll.xclk = 16600;
-                                rinfo->pll.ref_div = 67;
-                                rinfo->pll.ref_clk = 2700;
-                                break;
-                }
-
-                printk("radeonfb: ref_clk=%d, ref_div=%d, xclk=%d defaults\n",
-                        rinfo->pll.ref_clk, rinfo->pll.ref_div, rinfo->pll.xclk);
-        }
-}
-
-
-static void radeon_get_moninfo (struct radeonfb_info *rinfo)
-{
-        unsigned int tmp;
-
-        if (force_dfp) {
-                rinfo->dviDisp_type = MT_DFP;
-                return;
-        }
-
-        tmp = INREG(BIOS_4_SCRATCH);
-        printk(KERN_DEBUG "radeon_get_moninfo: bios 4 scratch = %x\n", tmp);
-        
-        if (rinfo->hasCRTC2) {
-                /* primary DVI port */
-                if (tmp & 0x08)
-                        rinfo->dviDisp_type = MT_DFP;
-                else if (tmp & 0x4)
-                        rinfo->dviDisp_type = MT_LCD;
-                else if (tmp & 0x200)
-                        rinfo->dviDisp_type = MT_CRT;
-                else if (tmp & 0x10)
-                        rinfo->dviDisp_type = MT_CTV;
-                else if (tmp & 0x20)
-                        rinfo->dviDisp_type = MT_STV;
-
-                /* secondary CRT port */
-                if (tmp & 0x2)
-                        rinfo->crtDisp_type = MT_CRT;
-                else if (tmp & 0x800)
-                        rinfo->crtDisp_type = MT_DFP;
-                else if (tmp & 0x400)
-                        rinfo->crtDisp_type = MT_LCD;
-                else if (tmp & 0x1000)
-                        rinfo->crtDisp_type = MT_CTV;
-                else if (tmp & 0x2000)
-                        rinfo->crtDisp_type = MT_STV;
-        } else {
-                rinfo->dviDisp_type = MT_NONE;
-
-                tmp = INREG(FP_GEN_CNTL);
-
-                if (tmp & FP_EN_TMDS)
-                        rinfo->crtDisp_type = MT_DFP;
-                else
-                        rinfo->crtDisp_type = MT_CRT;
-        }
-}
-
-
-
-static void radeon_get_EDID(struct radeonfb_info *rinfo)
-{
-#ifdef CONFIG_PPC_OF
-        if (!radeon_get_EDID_OF(rinfo))
-                RTRACE("radeonfb: could not retrieve EDID from OF\n");
-#else
-        /* XXX use other methods later */
-#endif
-}
-
-
-#ifdef CONFIG_PPC_OF
-static int radeon_get_EDID_OF(struct radeonfb_info *rinfo)
-{
-        struct device_node *dp;
-        unsigned char *pedid = NULL;
-        static char *propnames[] = { "DFP,EDID", "LCD,EDID", "EDID", "EDID1", NULL };
-        int i;  
-
-        dp = pci_device_to_OF_node(rinfo->pdev);
-        while (dp != NULL) {
-                for (i = 0; propnames[i] != NULL; ++i) {
-                        pedid = (unsigned char *)
-                                get_property(dp, propnames[i], NULL);
-                        if (pedid != NULL) {
-                                rinfo->EDID = pedid;
-                                return 1;
-                        }
-                }
-                dp = dp->child;
-        }
-        return 0;
-}
-#endif /* CONFIG_PPC_OF */
-
-
-static int radeon_dfp_parse_EDID(struct radeonfb_info *rinfo)
-{
-        unsigned char *block = rinfo->EDID;
-
-        if (!block)
-                return 0;
-
-        /* jump to the detailed timing block section */
-        block += 54;
-
-        rinfo->clock = (block[0] + (block[1] << 8));
-        rinfo->panel_xres = (block[2] + ((block[4] & 0xf0) << 4));
-        rinfo->hblank = (block[3] + ((block[4] & 0x0f) << 8));
-        rinfo->panel_yres = (block[5] + ((block[7] & 0xf0) << 4));
-        rinfo->vblank = (block[6] + ((block[7] & 0x0f) << 8));
-        rinfo->hOver_plus = (block[8] + ((block[11] & 0xc0) << 2));
-        rinfo->hSync_width = (block[9] + ((block[11] & 0x30) << 4));
-        rinfo->vOver_plus = ((block[10] >> 4) + ((block[11] & 0x0c) << 2));
-        rinfo->vSync_width = ((block[10] & 0x0f) + ((block[11] & 0x03) << 4));
-        rinfo->interlaced = ((block[17] & 0x80) >> 7);
-        rinfo->synct = ((block[17] & 0x18) >> 3);
-        rinfo->misc = ((block[17] & 0x06) >> 1);
-        rinfo->hAct_high = rinfo->vAct_high = 0;
-        if (rinfo->synct == 3) {
-                if (rinfo->misc & 2)
-                        rinfo->hAct_high = 1;
-                if (rinfo->misc & 1)
-                        rinfo->vAct_high = 1;
-        }
-
-        printk("radeonfb: detected DFP panel size from EDID: %dx%d\n",
-                rinfo->panel_xres, rinfo->panel_yres);
-
-        rinfo->got_dfpinfo = 1;
-
-        return 1;
-}
-
-
-static void radeon_update_default_var(struct radeonfb_info *rinfo)
-{
-        struct fb_var_screeninfo *var = &radeonfb_default_var;
-
-        var->xres = rinfo->panel_xres;
-        var->yres = rinfo->panel_yres;
-        var->xres_virtual = rinfo->panel_xres;
-        var->yres_virtual = rinfo->panel_yres;
-        var->xoffset = var->yoffset = 0;
-        var->bits_per_pixel = 8;
-        var->pixclock = 100000000 / rinfo->clock;
-        var->left_margin = (rinfo->hblank - rinfo->hOver_plus - rinfo->hSync_width);
-        var->right_margin = rinfo->hOver_plus;
-        var->upper_margin = (rinfo->vblank - rinfo->vOver_plus - rinfo->vSync_width);
-        var->lower_margin = rinfo->vOver_plus;
-        var->hsync_len = rinfo->hSync_width;
-        var->vsync_len = rinfo->vSync_width;
-        var->sync = 0;
-        if (rinfo->synct == 3) {
-                if (rinfo->hAct_high)
-                        var->sync |= FB_SYNC_HOR_HIGH_ACT;
-                if (rinfo->vAct_high)
-                        var->sync |= FB_SYNC_VERT_HIGH_ACT;
-        }
-
-        var->vmode = 0;
-        if (rinfo->interlaced)
-                var->vmode |= FB_VMODE_INTERLACED;
-
-        rinfo->use_default_var = 1;
-}
-
-
-static int radeon_get_dfpinfo_BIOS(struct radeonfb_info *rinfo)
-{
-        char __iomem *fpbiosstart, *tmp, *tmp0;
-        char stmp[30];
-        int i;
-
-        if (!rinfo->bios_seg)
-                return 0;
-
-        if (!(fpbiosstart = rinfo->bios_seg + readw(rinfo->bios_seg + 0x48))) {
-                printk("radeonfb: Failed to detect DFP panel info using BIOS\n");
-                return 0;
-        }
-
-        if (!(tmp = rinfo->bios_seg + readw(fpbiosstart + 0x40))) {
-                printk("radeonfb: Failed to detect DFP panel info using BIOS\n");
-                return 0;
-        }
-
-        for(i=0; i<24; i++)
-                stmp[i] = readb(tmp+i+1);
-        stmp[24] = 0;
-        printk("radeonfb: panel ID string: %s\n", stmp);
-        rinfo->panel_xres = readw(tmp + 25);
-        rinfo->panel_yres = readw(tmp + 27);
-        printk("radeonfb: detected DFP panel size from BIOS: %dx%d\n",
-                rinfo->panel_xres, rinfo->panel_yres);
-
-        for(i=0; i<32; i++) {
-                tmp0 = rinfo->bios_seg + readw(tmp+64+i*2);
-                if (tmp0 == 0)
-                        break;
-                if ((readw(tmp0) == rinfo->panel_xres) &&
-                    (readw(tmp0+2) == rinfo->panel_yres)) {
-                        rinfo->hblank = (readw(tmp0+17) - readw(tmp0+19)) * 8;
-                        rinfo->hOver_plus = ((readw(tmp0+21) - readw(tmp0+19) -1) * 8) & 0x7fff;
-                        rinfo->hSync_width = readb(tmp0+23) * 8;
-                        rinfo->vblank = readw(tmp0+24) - readw(tmp0+26);
-                        rinfo->vOver_plus = (readw(tmp0+28) & 0x7ff) - readw(tmp0+26);
-                        rinfo->vSync_width = (readw(tmp0+28) & 0xf800) >> 11;
-                        rinfo->clock = readw(tmp0+9);
-
-                        rinfo->got_dfpinfo = 1;
-                        return 1;
-                }
-        }
-
-        return 0;
-}
-
-
-
-static int radeon_get_dfpinfo (struct radeonfb_info *rinfo)
-{
-        unsigned int tmp;
-        unsigned short a, b;
-
-        if (radeon_get_dfpinfo_BIOS(rinfo))
-                radeon_update_default_var(rinfo);
-
-        if (radeon_dfp_parse_EDID(rinfo))
-                radeon_update_default_var(rinfo);
-
-        if (!rinfo->got_dfpinfo) {
-                /*
-                 * it seems all else has failed now and we
-                 * resort to probing registers for our DFP info
-                 */
-                if (panel_yres) {
-                        rinfo->panel_yres = panel_yres;
-                } else {
-                        tmp = INREG(FP_VERT_STRETCH);
-                        tmp &= 0x00fff000;
-                        rinfo->panel_yres = (unsigned short)(tmp >> 0x0c) + 1;
-                }
-
-                switch (rinfo->panel_yres) {
-                        case 480:
-                                rinfo->panel_xres = 640;
-                                break;
-                        case 600:
-                                rinfo->panel_xres = 800;
-                                break;
-                        case 768:
-#if defined(__powerpc__)
-                                if (rinfo->dviDisp_type == MT_LCD)
-                                        rinfo->panel_xres = 1152;
-                                else
-#endif
-                                rinfo->panel_xres = 1024;
-                                break;
-                        case 1024:
-                                rinfo->panel_xres = 1280;
-                                break;
-                        case 1050:
-                                rinfo->panel_xres = 1400;
-                                break;
-                        case 1200:
-                                rinfo->panel_xres = 1600;
-                                break;
-                        default:
-                                printk("radeonfb: Failed to detect DFP panel size\n");
-                                return 0;
-                }
-
-                printk("radeonfb: detected DFP panel size from registers: %dx%d\n",
-                        rinfo->panel_xres, rinfo->panel_yres);
-
-                tmp = INREG(FP_CRTC_H_TOTAL_DISP);
-                a = (tmp & FP_CRTC_H_TOTAL_MASK) + 4;
-                b = (tmp & 0x01ff0000) >> FP_CRTC_H_DISP_SHIFT;
-                rinfo->hblank = (a - b + 1) * 8;
-
-                tmp = INREG(FP_H_SYNC_STRT_WID);
-                rinfo->hOver_plus = (unsigned short) ((tmp & FP_H_SYNC_STRT_CHAR_MASK) >>
-                                        FP_H_SYNC_STRT_CHAR_SHIFT) - b - 1;
-                rinfo->hOver_plus *= 8;
-                rinfo->hSync_width = (unsigned short) ((tmp & FP_H_SYNC_WID_MASK) >>
-                                        FP_H_SYNC_WID_SHIFT);
-                rinfo->hSync_width *= 8;
-                tmp = INREG(FP_CRTC_V_TOTAL_DISP);
-                a = (tmp & FP_CRTC_V_TOTAL_MASK) + 1;
-                b = (tmp & FP_CRTC_V_DISP_MASK) >> FP_CRTC_V_DISP_SHIFT;
-                rinfo->vblank = a - b /* + 24 */ ;
-
-                tmp = INREG(FP_V_SYNC_STRT_WID);
-                rinfo->vOver_plus = (unsigned short) (tmp & FP_V_SYNC_STRT_MASK)
-                                        - b + 1;
-                rinfo->vSync_width = (unsigned short) ((tmp & FP_V_SYNC_WID_MASK) >>
-                                        FP_V_SYNC_WID_SHIFT);
-
-                return 1;
-        }
-
-        return 1;
-}
-
-
-#ifdef CONFIG_PPC_OF
-static int radeon_read_OF (struct radeonfb_info *rinfo)
-{
-        struct device_node *dp;
-        unsigned int *xtal;
-
-        dp = pci_device_to_OF_node(rinfo->pdev);
-
-        xtal = (unsigned int *) get_property(dp, "ATY,RefCLK", NULL);
-
-        rinfo->pll.ref_clk = *xtal / 10;
-
-        if (*xtal)
-                return 1;
-        else
-                return 0;
-}
-#endif  
-
-
-static void radeon_engine_init (struct radeonfb_info *rinfo)
-{
-        u32 temp;
-
-        /* disable 3D engine */
-        OUTREG(RB3D_CNTL, 0);
-
-        radeon_engine_reset ();
-
-        radeon_fifo_wait (1);
-        OUTREG(RB2D_DSTCACHE_MODE, 0);
-
-        radeon_fifo_wait (1);
-        temp = INREG(DEFAULT_PITCH_OFFSET);
-        OUTREG(DEFAULT_PITCH_OFFSET, ((temp & 0xc0000000) | 
-                                      (rinfo->pitch << 0x16)));
-
-        radeon_fifo_wait (1);
-        OUTREGP(DP_DATATYPE, 0, ~HOST_BIG_ENDIAN_EN);
-
-        radeon_fifo_wait (1);
-        OUTREG(DEFAULT_SC_BOTTOM_RIGHT, (DEFAULT_SC_RIGHT_MAX |
-                                         DEFAULT_SC_BOTTOM_MAX));
-
-        temp = radeon_get_dstbpp(rinfo->depth);
-        rinfo->dp_gui_master_cntl = ((temp << 8) | GMC_CLR_CMP_CNTL_DIS);
-        radeon_fifo_wait (1);
-        OUTREG(DP_GUI_MASTER_CNTL, (rinfo->dp_gui_master_cntl |
-                                    GMC_BRUSH_SOLID_COLOR |
-                                    GMC_SRC_DATATYPE_COLOR));
-
-        radeon_fifo_wait (7);
-
-        /* clear line drawing regs */
-        OUTREG(DST_LINE_START, 0);
-        OUTREG(DST_LINE_END, 0);
-
-        /* set brush color regs */
-        OUTREG(DP_BRUSH_FRGD_CLR, 0xffffffff);
-        OUTREG(DP_BRUSH_BKGD_CLR, 0x00000000);
-
-        /* set source color regs */
-        OUTREG(DP_SRC_FRGD_CLR, 0xffffffff);
-        OUTREG(DP_SRC_BKGD_CLR, 0x00000000);
-
-        /* default write mask */
-        OUTREG(DP_WRITE_MSK, 0xffffffff);
-
-        radeon_engine_idle ();
-}
-
-
-static int __devinit radeon_init_disp (struct radeonfb_info *rinfo)
-{
-        struct fb_info *info = &rinfo->info;
-        struct fb_var_screeninfo var;
-
-        var = radeonfb_default_var;
-        if ((radeon_init_disp_var(rinfo, &var)) < 0)
-                return -1;
-
-        rinfo->depth = var_to_depth(&var);
-        rinfo->bpp = var.bits_per_pixel;
-        
-        info->var = var;
-        fb_alloc_cmap(&info->cmap, 256, 0);
-
-        var.activate = FB_ACTIVATE_NOW;
-        return 0;
-}
-
-
-static int radeon_init_disp_var (struct radeonfb_info *rinfo,
-                                 struct fb_var_screeninfo *var)
-{
-#ifndef MODULE
-        if (mode_option)
-                fb_find_mode (var, &rinfo->info, mode_option,
-                              NULL, 0, NULL, 8);
-        else
-#endif
-        if (rinfo->use_default_var)
-                /* We will use the modified default far */
-                *var = radeonfb_default_var;
-        else
-
-                fb_find_mode (var, &rinfo->info, "640x480-8@60",
-                              NULL, 0, NULL, 0);
-
-        if (noaccel)
-                var->accel_flags &= ~FB_ACCELF_TEXT;
-        else
-                var->accel_flags |= FB_ACCELF_TEXT;
- 
-        return 0;
-}
-
-
-static int radeon_do_maximize(struct radeonfb_info *rinfo,
-                                struct fb_var_screeninfo *var,
-                                struct fb_var_screeninfo *v,
-                                int nom, int den)
-{
-        static struct {
-                int xres, yres;
-        } modes[] = {
-                {1600, 1280},
-                {1280, 1024},
-                {1024, 768},
-                {800, 600},
-                {640, 480},
-                {-1, -1}
-        };
-        int i;
-  
-        /* use highest possible virtual resolution */
-        if (v->xres_virtual == -1 && v->yres_virtual == -1) {
-                printk("radeonfb: using max available virtual resolution\n");
-                for (i=0; modes[i].xres != -1; i++) {
-                        if (modes[i].xres * nom / den * modes[i].yres <
-                            rinfo->video_ram / 2)
-                                break;
-                }
-                if (modes[i].xres == -1) {
-                        printk("radeonfb: could not find virtual resolution that fits into video memory!\n");
-                        return -EINVAL;
-                }
-                v->xres_virtual = modes[i].xres;  
-                v->yres_virtual = modes[i].yres;
-                
-                printk("radeonfb: virtual resolution set to max of %dx%d\n",
-                        v->xres_virtual, v->yres_virtual);
-        } else if (v->xres_virtual == -1) {
-                v->xres_virtual = (rinfo->video_ram * den /   
-                                (nom * v->yres_virtual * 2)) & ~15;
-        } else if (v->yres_virtual == -1) {
-                v->xres_virtual = (v->xres_virtual + 15) & ~15;
-                v->yres_virtual = rinfo->video_ram * den /
-                        (nom * v->xres_virtual *2);
-        } else {
-                if (v->xres_virtual * nom / den * v->yres_virtual >
-                        rinfo->video_ram) {
-                        return -EINVAL;
-                }
-        }
-                
-        if (v->xres_virtual * nom / den >= 8192) {
-                v->xres_virtual = 8192 * den / nom - 16;
-        }       
-        
-        if (v->xres_virtual < v->xres)
-                return -EINVAL;
-                
-        if (v->yres_virtual < v->yres)
-                return -EINVAL;
-                                
-        return 0;
-}
-
-
-static int radeonfb_check_var (struct fb_var_screeninfo *var, struct fb_info *info)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *) info->par;
-        struct fb_var_screeninfo v;
-        int nom, den;
-
-        memcpy (&v, var, sizeof (v));
-
-        switch (v.bits_per_pixel) {
-                case 0 ... 8:
-                        v.bits_per_pixel = 8;
-                        break;
-                case 9 ... 16:
-                        v.bits_per_pixel = 16;
-                        break;
-                case 17 ... 24:
-#if 0 /* Doesn't seem to work */
-                        v.bits_per_pixel = 24;
-                        break;
-#endif                  
-                        return -EINVAL;
-                case 25 ... 32:
-                        v.bits_per_pixel = 32;
-                        break;
-                default:
-                        return -EINVAL;
-        }
-
-        switch (var_to_depth(&v)) {
-                case 8:
-                        nom = den = 1;
-                        v.red.offset = v.green.offset = v.blue.offset = 0;
-                        v.red.length = v.green.length = v.blue.length = 8;
-                        v.transp.offset = v.transp.length = 0;
-                        break;
-                case 15:
-                        nom = 2;
-                        den = 1;
-                        v.red.offset = 10;
-                        v.green.offset = 5;
-                        v.blue.offset = 0;
-                        v.red.length = v.green.length = v.blue.length = 5;
-                        v.transp.offset = v.transp.length = 0;
-                        break;
-                case 16:
-                        nom = 2;
-                        den = 1;
-                        v.red.offset = 11;
-                        v.green.offset = 5;
-                        v.blue.offset = 0;
-                        v.red.length = 5;
-                        v.green.length = 6;
-                        v.blue.length = 5;
-                        v.transp.offset = v.transp.length = 0;
-                        break;                          
-                case 24:
-                        nom = 4;
-                        den = 1;
-                        v.red.offset = 16;
-                        v.green.offset = 8;
-                        v.blue.offset = 0;
-                        v.red.length = v.blue.length = v.green.length = 8;
-                        v.transp.offset = v.transp.length = 0;
-                        break;
-                case 32:
-                        nom = 4;
-                        den = 1;
-                        v.red.offset = 16;
-                        v.green.offset = 8;
-                        v.blue.offset = 0;
-                        v.red.length = v.blue.length = v.green.length = 8;
-                        v.transp.offset = 24;
-                        v.transp.length = 8;
-                        break;
-                default:
-                        printk ("radeonfb: mode %dx%dx%d rejected, color depth invalid\n",
-                                var->xres, var->yres, var->bits_per_pixel);
-                        return -EINVAL;
-        }
-
-        if (radeon_do_maximize(rinfo, var, &v, nom, den) < 0)
-                return -EINVAL;  
-                
-        if (v.xoffset < 0)
-                v.xoffset = 0;
-        if (v.yoffset < 0)
-                v.yoffset = 0;
-         
-        if (v.xoffset > v.xres_virtual - v.xres)
-                v.xoffset = v.xres_virtual - v.xres - 1;
-                        
-        if (v.yoffset > v.yres_virtual - v.yres)
-                v.yoffset = v.yres_virtual - v.yres - 1;
-         
-        v.red.msb_right = v.green.msb_right = v.blue.msb_right =
-                          v.transp.offset = v.transp.length =
-                          v.transp.msb_right = 0;
-
-        if (noaccel)
-                v.accel_flags = 0;
-                        
-        memcpy(var, &v, sizeof(v));
-        
-        return 0;
-}
-
-
-static int radeonfb_pan_display (struct fb_var_screeninfo *var,
-                                 struct fb_info *info)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *) info;
-
-        if ((var->xoffset + var->xres > var->xres_virtual)
-            || (var->yoffset + var->yres > var->yres_virtual))
-               return -EINVAL;
-                
-        if (rinfo->asleep)
-                return 0;
-
-        OUTREG(CRTC_OFFSET, ((var->yoffset * var->xres_virtual + var->xoffset)
-                             * var->bits_per_pixel / 8) & ~7);
-        return 0;
-}
-
-
-static int radeonfb_ioctl (struct fb_info *info, unsigned int cmd,
-                           unsigned long arg)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *) info;
-        unsigned int tmp;
-        u32 value = 0;
-        int rc;
-
-        switch (cmd) {
-                /*
-                 * TODO:  set mirror accordingly for non-Mobility chipsets with 2 CRTC's
-                 */
-                case FBIO_RADEON_SET_MIRROR:
-                        switch (rinfo->arch) {
-                                case RADEON_R100:
-                                case RADEON_RV100:
-                                case RADEON_R200:
-                                case RADEON_RV200:
-                                case RADEON_RV250:
-                                case RADEON_R300:
-                                        return -EINVAL;
-                                default:
-                                        /* RADEON M6, RADEON_M7, RADEON_M9 */
-                                        break;
-                        }
-
-                        rc = get_user(value, (__u32 __user *)arg);
-
-                        if (rc)
-                                return rc;
-
-                        if (value & 0x01) {
-                                tmp = INREG(LVDS_GEN_CNTL);
-
-                                tmp |= (LVDS_ON | LVDS_BLON);
-                        } else {
-                                tmp = INREG(LVDS_GEN_CNTL);
-
-                                tmp &= ~(LVDS_ON | LVDS_BLON);
-                        }
-
-                        OUTREG(LVDS_GEN_CNTL, tmp);
-
-                        if (value & 0x02) {
-                                tmp = INREG(CRTC_EXT_CNTL);
-                                tmp |= CRTC_CRT_ON;
-
-                                mirror = 1;
-                        } else {
-                                tmp = INREG(CRTC_EXT_CNTL);
-                                tmp &= ~CRTC_CRT_ON;
-
-                                mirror = 0;
-                        }
-
-                        OUTREG(CRTC_EXT_CNTL, tmp);
-
-                        break;
-                case FBIO_RADEON_GET_MIRROR:
-                        switch (rinfo->arch) {
-                                case RADEON_R100:
-                                case RADEON_RV100:
-                                case RADEON_R200:
-                                case RADEON_RV200:
-                                case RADEON_RV250:
-                                case RADEON_R300:
-                                        return -EINVAL;
-                                default:
-                                        /* RADEON M6, RADEON_M7, RADEON_M9 */
-                                        break;
-                        }
-
-                        tmp = INREG(LVDS_GEN_CNTL);
-                        if ((LVDS_ON | LVDS_BLON) & tmp)
-                                value |= 0x01;
-
-                        tmp = INREG(CRTC_EXT_CNTL);
-                        if (CRTC_CRT_ON & tmp)
-                                value |= 0x02;
-
-                        return put_user(value, (__u32 __user *)arg);
-                default:
-                        return -EINVAL;
-        }
-
-        return -EINVAL;
-}
-
-
-static int radeonfb_blank (int blank, struct fb_info *info)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *) info;
-        u32 val = INREG(CRTC_EXT_CNTL);
-        u32 val2 = INREG(LVDS_GEN_CNTL);
-
-        if (rinfo->asleep)
-                return 0;
-                
-#ifdef CONFIG_PMAC_BACKLIGHT
-        if (rinfo->dviDisp_type == MT_LCD && machine_is(powermac)) {
-                set_backlight_enable(!blank);
-                return 0;
-        }
-#endif
-                        
-        /* reset it */
-        val &= ~(CRTC_DISPLAY_DIS | CRTC_HSYNC_DIS |
-                 CRTC_VSYNC_DIS);
-        val2 &= ~(LVDS_DISPLAY_DIS);
-
-        switch (blank) {
-                case FB_BLANK_UNBLANK:
-                case FB_BLANK_NORMAL:
-                        break;
-                case FB_BLANK_VSYNC_SUSPEND:
-                        val |= (CRTC_DISPLAY_DIS | CRTC_VSYNC_DIS);
-                        break;
-                case FB_BLANK_HSYNC_SUSPEND:
-                        val |= (CRTC_DISPLAY_DIS | CRTC_HSYNC_DIS);
-                        break;
-                case FB_BLANK_POWERDOWN:
-                        val |= (CRTC_DISPLAY_DIS | CRTC_VSYNC_DIS | 
-                                CRTC_HSYNC_DIS);
-                        val2 |= (LVDS_DISPLAY_DIS);
-                        break;
-        }
-
-        switch (rinfo->dviDisp_type) {
-                case MT_LCD:
-                        OUTREG(LVDS_GEN_CNTL, val2);
-                        break;
-                case MT_CRT:
-                default:
-                        OUTREG(CRTC_EXT_CNTL, val);
-                        break;
-        }
-
-        /* let fbcon do a soft blank for us */
-        return (blank == FB_BLANK_NORMAL) ? 1 : 0;
-}
-
-
-static int radeonfb_setcolreg (unsigned regno, unsigned red, unsigned green,
-                             unsigned blue, unsigned transp, struct fb_info *info)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *) info;
-        u32 pindex, vclk_cntl;
-        unsigned int i;
-        
-        if (regno > 255)
-                return 1;
-
-        red >>= 8;
-        green >>= 8;
-        blue >>= 8;
-        rinfo->palette[regno].red = red;
-        rinfo->palette[regno].green = green;
-        rinfo->palette[regno].blue = blue;
-
-        /* default */
-        pindex = regno;
-
-        if (!rinfo->asleep) {
-                vclk_cntl = INPLL(VCLK_ECP_CNTL);
-                OUTPLL(VCLK_ECP_CNTL, vclk_cntl & ~PIXCLK_DAC_ALWAYS_ONb);
-
-                if (rinfo->bpp == 16) {
-                        pindex = regno * 8;
-
-                        if (rinfo->depth == 16 && regno > 63)
-                                return 1;
-                        if (rinfo->depth == 15 && regno > 31)
-                                return 1;
-
-                        /* For 565, the green component is mixed one order below */
-                        if (rinfo->depth == 16) {
-                                OUTREG(PALETTE_INDEX, pindex>>1);
-                                OUTREG(PALETTE_DATA, (rinfo->palette[regno>>1].red << 16) |
-                                        (green << 8) | (rinfo->palette[regno>>1].blue));
-                                green = rinfo->palette[regno<<1].green;
-                        }
-                }
-
-                if (rinfo->depth != 16 || regno < 32) {
-                        OUTREG(PALETTE_INDEX, pindex);
-                        OUTREG(PALETTE_DATA, (red << 16) | (green << 8) | blue);
-                }
-
-                OUTPLL(VCLK_ECP_CNTL, vclk_cntl);
-        }
-        if (regno < 16) {
-                switch (rinfo->depth) {
-                case 15:
-                        ((u16 *) (info->pseudo_palette))[regno] =
-                            (regno << 10) | (regno << 5) | regno;
-                        break;
-                case 16:
-                        ((u16 *) (info->pseudo_palette))[regno] =
-                            (regno << 11) | (regno << 6) | regno;
-                        break;
-                case 24:
-                        ((u32 *) (info->pseudo_palette))[regno] =
-                            (regno << 16) | (regno << 8) | regno;
-                        break;
-                case 32:
-                        i = (regno << 8) | regno;
-                        ((u32 *) (info->pseudo_palette))[regno] =
-                            (i << 16) | i;
-                        break;
-                }
-        }
-        return 0;
-}
-
-
-
-static void radeon_save_state (struct radeonfb_info *rinfo,
-                               struct radeon_regs *save)
-{
-        /* CRTC regs */
-        save->crtc_gen_cntl = INREG(CRTC_GEN_CNTL);
-        save->crtc_ext_cntl = INREG(CRTC_EXT_CNTL);
-        save->dac_cntl = INREG(DAC_CNTL);
-        save->crtc_h_total_disp = INREG(CRTC_H_TOTAL_DISP);
-        save->crtc_h_sync_strt_wid = INREG(CRTC_H_SYNC_STRT_WID);
-        save->crtc_v_total_disp = INREG(CRTC_V_TOTAL_DISP);
-        save->crtc_v_sync_strt_wid = INREG(CRTC_V_SYNC_STRT_WID);
-        save->crtc_pitch = INREG(CRTC_PITCH);
-#if defined(__BIG_ENDIAN)
-        save->surface_cntl = INREG(SURFACE_CNTL);
-#endif
-
-        /* FP regs */
-        save->fp_crtc_h_total_disp = INREG(FP_CRTC_H_TOTAL_DISP);
-        save->fp_crtc_v_total_disp = INREG(FP_CRTC_V_TOTAL_DISP);
-        save->fp_gen_cntl = INREG(FP_GEN_CNTL);
-        save->fp_h_sync_strt_wid = INREG(FP_H_SYNC_STRT_WID);
-        save->fp_horz_stretch = INREG(FP_HORZ_STRETCH);
-        save->fp_v_sync_strt_wid = INREG(FP_V_SYNC_STRT_WID);
-        save->fp_vert_stretch = INREG(FP_VERT_STRETCH);
-        save->lvds_gen_cntl = INREG(LVDS_GEN_CNTL);
-        save->lvds_pll_cntl = INREG(LVDS_PLL_CNTL);
-        save->tmds_crc = INREG(TMDS_CRC);
-        save->tmds_transmitter_cntl = INREG(TMDS_TRANSMITTER_CNTL);
-        save->vclk_ecp_cntl = INPLL(VCLK_ECP_CNTL);
-}
-
-
-
-static int radeonfb_set_par (struct fb_info *info)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *)info->par;
-        struct fb_var_screeninfo *mode = &info->var;
-        struct radeon_regs newmode;
-        int hTotal, vTotal, hSyncStart, hSyncEnd,
-            hSyncPol, vSyncStart, vSyncEnd, vSyncPol, cSync;
-        u8 hsync_adj_tab[] = {0, 0x12, 9, 9, 6, 5};
-        u8 hsync_fudge_fp[] = {2, 2, 0, 0, 5, 5};
-        u32 dotClock = 1000000000 / mode->pixclock,
-            sync, h_sync_pol, v_sync_pol;
-        int freq = dotClock / 10;  /* x 100 */
-        int xclk_freq, vclk_freq, xclk_per_trans, xclk_per_trans_precise;
-        int useable_precision, roff, ron;
-        int min_bits, format = 0;
-        int hsync_start, hsync_fudge, bytpp, hsync_wid, vsync_wid;
-        int primary_mon = PRIMARY_MONITOR(rinfo);
-        int depth = var_to_depth(mode);
-        int accel = (mode->accel_flags & FB_ACCELF_TEXT) != 0;
-
-        rinfo->xres = mode->xres;
-        rinfo->yres = mode->yres;
-        rinfo->xres_virtual = mode->xres_virtual;
-        rinfo->yres_virtual = mode->yres_virtual;
-        rinfo->pixclock = mode->pixclock;
-
-        hSyncStart = mode->xres + mode->right_margin;
-        hSyncEnd = hSyncStart + mode->hsync_len;
-        hTotal = hSyncEnd + mode->left_margin;
-
-        vSyncStart = mode->yres + mode->lower_margin;
-        vSyncEnd = vSyncStart + mode->vsync_len;
-        vTotal = vSyncEnd + mode->upper_margin;
-
-        if ((primary_mon == MT_DFP) || (primary_mon == MT_LCD)) {
-                if (rinfo->panel_xres < mode->xres)
-                        rinfo->xres = mode->xres = rinfo->panel_xres;
-                if (rinfo->panel_yres < mode->yres)
-                        rinfo->yres = mode->yres = rinfo->panel_yres;
-
-                hTotal = mode->xres + rinfo->hblank;
-                hSyncStart = mode->xres + rinfo->hOver_plus;
-                hSyncEnd = hSyncStart + rinfo->hSync_width;
-
-                vTotal = mode->yres + rinfo->vblank;
-                vSyncStart = mode->yres + rinfo->vOver_plus;
-                vSyncEnd = vSyncStart + rinfo->vSync_width;
-        }
-
-        sync = mode->sync;
-        h_sync_pol = sync & FB_SYNC_HOR_HIGH_ACT ? 0 : 1;
-        v_sync_pol = sync & FB_SYNC_VERT_HIGH_ACT ? 0 : 1;
-
-        RTRACE("hStart = %d, hEnd = %d, hTotal = %d\n",
-                hSyncStart, hSyncEnd, hTotal);
-        RTRACE("vStart = %d, vEnd = %d, vTotal = %d\n",
-                vSyncStart, vSyncEnd, vTotal);
-
-        hsync_wid = (hSyncEnd - hSyncStart) / 8;
-        vsync_wid = vSyncEnd - vSyncStart;
-        if (hsync_wid == 0)
-                hsync_wid = 1;
-        else if (hsync_wid > 0x3f)      /* max */
-                hsync_wid = 0x3f;
-
-        if (vsync_wid == 0)
-                vsync_wid = 1;
-        else if (vsync_wid > 0x1f)      /* max */
-                vsync_wid = 0x1f;
-
-        hSyncPol = mode->sync & FB_SYNC_HOR_HIGH_ACT ? 0 : 1;
-        vSyncPol = mode->sync & FB_SYNC_VERT_HIGH_ACT ? 0 : 1;
-
-        cSync = mode->sync & FB_SYNC_COMP_HIGH_ACT ? (1 << 4) : 0;
-
-        format = radeon_get_dstbpp(depth);
-        bytpp = mode->bits_per_pixel >> 3;
-
-        if ((primary_mon == MT_DFP) || (primary_mon == MT_LCD))
-                hsync_fudge = hsync_fudge_fp[format-1];
-        else
-                hsync_fudge = hsync_adj_tab[format-1];
-
-        hsync_start = hSyncStart - 8 + hsync_fudge;
-
-        newmode.crtc_gen_cntl = CRTC_EXT_DISP_EN | CRTC_EN |
-                                (format << 8);
-
-        if ((primary_mon == MT_DFP) || (primary_mon == MT_LCD)) {
-                newmode.crtc_ext_cntl = VGA_ATI_LINEAR | XCRT_CNT_EN;
-                if (mirror)
-                        newmode.crtc_ext_cntl |= CRTC_CRT_ON;
-
-                newmode.crtc_gen_cntl &= ~(CRTC_DBL_SCAN_EN |
-                                           CRTC_INTERLACE_EN);
-        } else {
-                newmode.crtc_ext_cntl = VGA_ATI_LINEAR | XCRT_CNT_EN |
-                                        CRTC_CRT_ON;
-        }
-
-        newmode.dac_cntl = /* INREG(DAC_CNTL) | */ DAC_MASK_ALL | DAC_VGA_ADR_EN |
-                           DAC_8BIT_EN;
-
-        newmode.crtc_h_total_disp = ((((hTotal / 8) - 1) & 0x3ff) |
-                                     (((mode->xres / 8) - 1) << 16));
-
-        newmode.crtc_h_sync_strt_wid = ((hsync_start & 0x1fff) |
-                                        (hsync_wid << 16) | (h_sync_pol << 23));
-
-        newmode.crtc_v_total_disp = ((vTotal - 1) & 0xffff) |
-                                    ((mode->yres - 1) << 16);
-
-        newmode.crtc_v_sync_strt_wid = (((vSyncStart - 1) & 0xfff) |
-                                         (vsync_wid << 16) | (v_sync_pol  << 23));
-
-        if (accel) {
-                /* We first calculate the engine pitch */
-                rinfo->pitch = ((mode->xres_virtual * ((mode->bits_per_pixel + 1) / 8) + 0x3f)
-                                & ~(0x3f)) >> 6;
-
-                /* Then, re-multiply it to get the CRTC pitch */
-                newmode.crtc_pitch = (rinfo->pitch << 3) / ((mode->bits_per_pixel + 1) / 8);
-        } else
-                newmode.crtc_pitch = (mode->xres_virtual >> 3);
-        newmode.crtc_pitch |= (newmode.crtc_pitch << 16);
-
-#if defined(__BIG_ENDIAN)
-        /*
-         * It looks like recent chips have a problem with SURFACE_CNTL,
-         * setting SURF_TRANSLATION_DIS completely disables the
-         * swapper as well, so we leave it unset now.
-         */
-        newmode.surface_cntl = 0;
-
-        /* Setup swapping on both apertures, though we currently
-         * only use aperture 0, enabling swapper on aperture 1
-         * won't harm
-         */
-        switch (mode->bits_per_pixel) {
-                case 16:
-                        newmode.surface_cntl |= NONSURF_AP0_SWP_16BPP;
-                        newmode.surface_cntl |= NONSURF_AP1_SWP_16BPP;
-                        break;
-                case 24:        
-                case 32:
-                        newmode.surface_cntl |= NONSURF_AP0_SWP_32BPP;
-                        newmode.surface_cntl |= NONSURF_AP1_SWP_32BPP;
-                        break;
-        }
-#endif
-
-        rinfo->pitch = ((mode->xres_virtual * ((mode->bits_per_pixel + 1) / 8) + 0x3f)
-                        & ~(0x3f)) / 64;
-
-        RTRACE("h_total_disp = 0x%x\t   hsync_strt_wid = 0x%x\n",
-                newmode.crtc_h_total_disp, newmode.crtc_h_sync_strt_wid);
-        RTRACE("v_total_disp = 0x%x\t   vsync_strt_wid = 0x%x\n",
-                newmode.crtc_v_total_disp, newmode.crtc_v_sync_strt_wid);
-
-        newmode.xres = mode->xres;
-        newmode.yres = mode->yres;
-
-        rinfo->bpp = mode->bits_per_pixel;
-        rinfo->depth = depth;
-
-        if (freq > rinfo->pll.ppll_max)
-                freq = rinfo->pll.ppll_max;
-        if (freq*12 < rinfo->pll.ppll_min)
-                freq = rinfo->pll.ppll_min / 12;
-
-        {
-                struct {
-                        int divider;
-                        int bitvalue;
-                } *post_div,
-                  post_divs[] = {
-                        { 1,  0 },
-                        { 2,  1 },
-                        { 4,  2 },
-                        { 8,  3 },
-                        { 3,  4 },
-                        { 16, 5 },
-                        { 6,  6 },
-                        { 12, 7 },
-                        { 0,  0 },
-                };
-
-                for (post_div = &post_divs[0]; post_div->divider; ++post_div) {
-                        rinfo->pll_output_freq = post_div->divider * freq;
-                        if (rinfo->pll_output_freq >= rinfo->pll.ppll_min  &&
-                            rinfo->pll_output_freq <= rinfo->pll.ppll_max)
-                                break;
-                }
-
-                rinfo->post_div = post_div->divider;
-                rinfo->fb_div = round_div(rinfo->pll.ref_div*rinfo->pll_output_freq,
-                                          rinfo->pll.ref_clk);
-                newmode.ppll_ref_div = rinfo->pll.ref_div;
-                newmode.ppll_div_3 = rinfo->fb_div | (post_div->bitvalue << 16);
-        }
-        newmode.vclk_ecp_cntl = rinfo->init_state.vclk_ecp_cntl;
-
-#ifdef CONFIG_PPC_OF
-        /* Gross hack for iBook with M7 until I find out a proper fix */
-        if (machine_is_compatible("PowerBook4,3") && rinfo->arch == RADEON_M7)
-                newmode.ppll_div_3 = 0x000600ad;
-#endif /* CONFIG_PPC_OF */      
-
-        RTRACE("post div = 0x%x\n", rinfo->post_div);
-        RTRACE("fb_div = 0x%x\n", rinfo->fb_div);
-        RTRACE("ppll_div_3 = 0x%x\n", newmode.ppll_div_3);
-
-        /* DDA */
-        vclk_freq = round_div(rinfo->pll.ref_clk * rinfo->fb_div,
-                              rinfo->pll.ref_div * rinfo->post_div);
-        xclk_freq = rinfo->pll.xclk;
-
-        xclk_per_trans = round_div(xclk_freq * 128, vclk_freq * mode->bits_per_pixel);
-
-        min_bits = min_bits_req(xclk_per_trans);
-        useable_precision = min_bits + 1;
-
-        xclk_per_trans_precise = round_div((xclk_freq * 128) << (11 - useable_precision),
-                                           vclk_freq * mode->bits_per_pixel);
-
-        ron = (4 * rinfo->ram.mb + 3 * _max(rinfo->ram.trcd - 2, 0) +
-               2 * rinfo->ram.trp + rinfo->ram.twr + rinfo->ram.cl + rinfo->ram.tr2w +
-               xclk_per_trans) << (11 - useable_precision);
-        roff = xclk_per_trans_precise * (32 - 4);
-
-        RTRACE("ron = %d, roff = %d\n", ron, roff);
-        RTRACE("vclk_freq = %d, per = %d\n", vclk_freq, xclk_per_trans_precise);
-
-        if ((ron + rinfo->ram.rloop) >= roff) {
-                printk("radeonfb: error ron out of range\n");
-                return -EINVAL;
-        }
-
-        newmode.dda_config = (xclk_per_trans_precise |
-                              (useable_precision << 16) |
-                              (rinfo->ram.rloop << 20));
-        newmode.dda_on_off = (ron << 16) | roff;
-
-        if ((primary_mon == MT_DFP) || (primary_mon == MT_LCD)) {
-                unsigned int hRatio, vRatio;
-
-                /* We force the pixel clock to be always enabled. Allowing it
-                 * to be power managed during blanking would save power, but has
-                 * nasty interactions with the 2D engine & sleep code that haven't
-                 * been solved yet. --BenH
-                 */
-                newmode.vclk_ecp_cntl &= ~PIXCLK_DAC_ALWAYS_ONb;
-                
-                if (mode->xres > rinfo->panel_xres)
-                        mode->xres = rinfo->panel_xres;
-                if (mode->yres > rinfo->panel_yres)
-                        mode->yres = rinfo->panel_yres;
-
-                newmode.fp_horz_stretch = (((rinfo->panel_xres / 8) - 1)
-                                           << HORZ_PANEL_SHIFT);
-                newmode.fp_vert_stretch = ((rinfo->panel_yres - 1)
-                                           << VERT_PANEL_SHIFT);
-
-                if (mode->xres != rinfo->panel_xres) {
-                        hRatio = round_div(mode->xres * HORZ_STRETCH_RATIO_MAX,
-                                           rinfo->panel_xres);
-                        newmode.fp_horz_stretch = (((((unsigned long)hRatio) & HORZ_STRETCH_RATIO_MASK)) |
-                                                   (newmode.fp_horz_stretch &
-                                                    (HORZ_PANEL_SIZE | HORZ_FP_LOOP_STRETCH |
-                                                     HORZ_AUTO_RATIO_INC)));
-                        newmode.fp_horz_stretch |= (HORZ_STRETCH_BLEND |
-                                                    HORZ_STRETCH_ENABLE);
-                }
-                newmode.fp_horz_stretch &= ~HORZ_AUTO_RATIO;
-
-                if (mode->yres != rinfo->panel_yres) {
-                        vRatio = round_div(mode->yres * VERT_STRETCH_RATIO_MAX,
-                                           rinfo->panel_yres);
-                        newmode.fp_vert_stretch = (((((unsigned long)vRatio) & VERT_STRETCH_RATIO_MASK)) |
-                                                   (newmode.fp_vert_stretch &
-                                                   (VERT_PANEL_SIZE | VERT_STRETCH_RESERVED)));
-                        newmode.fp_vert_stretch |= (VERT_STRETCH_BLEND |
-                                                    VERT_STRETCH_ENABLE);
-                }
-                newmode.fp_vert_stretch &= ~VERT_AUTO_RATIO_EN;
-
-                newmode.fp_gen_cntl = (rinfo->init_state.fp_gen_cntl & (u32)
-                                       ~(FP_SEL_CRTC2 |
-                                         FP_RMX_HVSYNC_CONTROL_EN |
-                                         FP_DFP_SYNC_SEL |
-                                         FP_CRT_SYNC_SEL |
-                                         FP_CRTC_LOCK_8DOT |
-                                         FP_USE_SHADOW_EN |
-                                         FP_CRTC_USE_SHADOW_VEND |
-                                         FP_CRT_SYNC_ALT));
-
-                newmode.fp_gen_cntl |= (FP_CRTC_DONT_SHADOW_VPAR |
-                                        FP_CRTC_DONT_SHADOW_HEND);
-
-                newmode.lvds_gen_cntl = rinfo->init_state.lvds_gen_cntl;
-                newmode.lvds_pll_cntl = rinfo->init_state.lvds_pll_cntl;
-                newmode.tmds_crc = rinfo->init_state.tmds_crc;
-                newmode.tmds_transmitter_cntl = rinfo->init_state.tmds_transmitter_cntl;
-
-                if (primary_mon == MT_LCD) {
-                        newmode.lvds_gen_cntl |= (LVDS_ON | LVDS_BLON);
-                        newmode.fp_gen_cntl &= ~(FP_FPON | FP_TMDS_EN);
-                } else {
-                        /* DFP */
-                        newmode.fp_gen_cntl |= (FP_FPON | FP_TMDS_EN);
-                        newmode.tmds_transmitter_cntl = (TMDS_RAN_PAT_RST |
-                                                         TMDS_ICHCSEL | TMDS_PLL_EN) &
-                                                         ~(TMDS_PLLRST);
-                        newmode.crtc_ext_cntl &= ~CRTC_CRT_ON;
-                }
-
-                newmode.fp_crtc_h_total_disp = (((rinfo->hblank / 8) & 0x3ff) |
-                                (((mode->xres / 8) - 1) << 16));
-                newmode.fp_crtc_v_total_disp = (rinfo->vblank & 0xffff) |
-                                ((mode->yres - 1) << 16);
-                newmode.fp_h_sync_strt_wid = ((rinfo->hOver_plus & 0x1fff) |
-                                (hsync_wid << 16) | (h_sync_pol << 23));
-                newmode.fp_v_sync_strt_wid = ((rinfo->vOver_plus & 0xfff) |
-                                (vsync_wid << 16) | (v_sync_pol  << 23));
-        }
-
-        /* do it! */
-        if (!rinfo->asleep) {
-                radeon_write_mode (rinfo, &newmode);
-                /* (re)initialize the engine */
-                if (noaccel)
-                        radeon_engine_init (rinfo);
-        
-        }
-        /* Update fix */
-        if (accel)
-                info->fix.line_length = rinfo->pitch*64;
-        else
-                info->fix.line_length = mode->xres_virtual * ((mode->bits_per_pixel + 1) / 8);
-        info->fix.visual = rinfo->depth == 8 ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_DIRECTCOLOR;
-
-#ifdef CONFIG_BOOTX_TEXT
-        /* Update debug text engine */
-        btext_update_display(rinfo->fb_base_phys, mode->xres, mode->yres,
-                             rinfo->depth, info->fix.line_length);
-#endif
-
-        return 0;
-}
-
-
-static void radeon_write_mode (struct radeonfb_info *rinfo,
-                               struct radeon_regs *mode)
-{
-        int i;
-        int primary_mon = PRIMARY_MONITOR(rinfo);
-
-        radeonfb_blank(VESA_POWERDOWN, (struct fb_info *)rinfo);
-
-
-        if (rinfo->arch == RADEON_M6) {
-                for (i=0; i<7; i++)
-                        OUTREG(common_regs_m6[i].reg, common_regs_m6[i].val);
-        } else {
-                for (i=0; i<9; i++)
-                        OUTREG(common_regs[i].reg, common_regs[i].val);
-        }
-
-        OUTREG(CRTC_GEN_CNTL, mode->crtc_gen_cntl);
-        OUTREGP(CRTC_EXT_CNTL, mode->crtc_ext_cntl,
-                CRTC_HSYNC_DIS | CRTC_VSYNC_DIS | CRTC_DISPLAY_DIS);
-        OUTREGP(DAC_CNTL, mode->dac_cntl, DAC_RANGE_CNTL | DAC_BLANKING);
-        OUTREG(CRTC_H_TOTAL_DISP, mode->crtc_h_total_disp);
-        OUTREG(CRTC_H_SYNC_STRT_WID, mode->crtc_h_sync_strt_wid);
-        OUTREG(CRTC_V_TOTAL_DISP, mode->crtc_v_total_disp);
-        OUTREG(CRTC_V_SYNC_STRT_WID, mode->crtc_v_sync_strt_wid);
-        OUTREG(CRTC_OFFSET, 0);
-        OUTREG(CRTC_OFFSET_CNTL, 0);
-        OUTREG(CRTC_PITCH, mode->crtc_pitch);
-
-#if defined(__BIG_ENDIAN)
-        OUTREG(SURFACE_CNTL, mode->surface_cntl);
-#endif
-
-        while ((INREG(CLOCK_CNTL_INDEX) & PPLL_DIV_SEL_MASK) !=
-               PPLL_DIV_SEL_MASK) {
-                OUTREGP(CLOCK_CNTL_INDEX, PPLL_DIV_SEL_MASK, 0xffff);
-        }
-
-        OUTPLLP(PPLL_CNTL, PPLL_RESET, 0xffff);
-
-        while ((INPLL(PPLL_REF_DIV) & PPLL_REF_DIV_MASK) !=
-               (mode->ppll_ref_div & PPLL_REF_DIV_MASK)) {
-                OUTPLLP(PPLL_REF_DIV, mode->ppll_ref_div, ~PPLL_REF_DIV_MASK);
-        }
-
-        while ((INPLL(PPLL_DIV_3) & PPLL_FB3_DIV_MASK) !=
-               (mode->ppll_div_3 & PPLL_FB3_DIV_MASK)) {
-                OUTPLLP(PPLL_DIV_3, mode->ppll_div_3, ~PPLL_FB3_DIV_MASK);
-        }
-
-        while ((INPLL(PPLL_DIV_3) & PPLL_POST3_DIV_MASK) !=
-               (mode->ppll_div_3 & PPLL_POST3_DIV_MASK)) {
-                OUTPLLP(PPLL_DIV_3, mode->ppll_div_3, ~PPLL_POST3_DIV_MASK);
-        }
-
-        OUTPLL(HTOTAL_CNTL, 0);
-
-        OUTPLLP(PPLL_CNTL, 0, ~PPLL_RESET);
-
-//      OUTREG(DDA_CONFIG, mode->dda_config);
-//      OUTREG(DDA_ON_OFF, mode->dda_on_off);
-
-        if ((primary_mon == MT_DFP) || (primary_mon == MT_LCD)) {
-                OUTREG(FP_CRTC_H_TOTAL_DISP, mode->fp_crtc_h_total_disp);
-                OUTREG(FP_CRTC_V_TOTAL_DISP, mode->fp_crtc_v_total_disp);
-                OUTREG(FP_H_SYNC_STRT_WID, mode->fp_h_sync_strt_wid);
-                OUTREG(FP_V_SYNC_STRT_WID, mode->fp_v_sync_strt_wid);
-                OUTREG(FP_HORZ_STRETCH, mode->fp_horz_stretch);
-                OUTREG(FP_VERT_STRETCH, mode->fp_vert_stretch);
-                OUTREG(FP_GEN_CNTL, mode->fp_gen_cntl);
-                OUTREG(TMDS_CRC, mode->tmds_crc);
-                OUTREG(TMDS_TRANSMITTER_CNTL, mode->tmds_transmitter_cntl);
-
-                if (primary_mon == MT_LCD) {
-                        unsigned int tmp = INREG(LVDS_GEN_CNTL);
-
-                        mode->lvds_gen_cntl &= ~LVDS_STATE_MASK;
-                        mode->lvds_gen_cntl |= (rinfo->init_state.lvds_gen_cntl & LVDS_STATE_MASK);
-
-                        if ((tmp & (LVDS_ON | LVDS_BLON)) ==
-                            (mode->lvds_gen_cntl & (LVDS_ON | LVDS_BLON))) {
-                                OUTREG(LVDS_GEN_CNTL, mode->lvds_gen_cntl);
-                        } else {
-                                if (mode->lvds_gen_cntl & (LVDS_ON | LVDS_BLON)) {
-                                        udelay(1000);
-                                        OUTREG(LVDS_GEN_CNTL, mode->lvds_gen_cntl);
-                                } else {
-                                        OUTREG(LVDS_GEN_CNTL, mode->lvds_gen_cntl |
-                                               LVDS_BLON);
-                                        udelay(1000);
-                                        OUTREG(LVDS_GEN_CNTL, mode->lvds_gen_cntl);
-                                }
-                        }
-                }
-        }
-
-        radeonfb_blank(VESA_NO_BLANKING, (struct fb_info *)rinfo);
-
-        OUTPLL(VCLK_ECP_CNTL, mode->vclk_ecp_cntl);
-        
-        return;
-}
-
-static struct fb_ops radeonfb_ops = {
-        .owner                  = THIS_MODULE,
-        .fb_check_var           = radeonfb_check_var,
-        .fb_set_par             = radeonfb_set_par,
-        .fb_setcolreg           = radeonfb_setcolreg,
-        .fb_pan_display         = radeonfb_pan_display,
-        .fb_blank               = radeonfb_blank,
-        .fb_ioctl               = radeonfb_ioctl,
-#if 0
-        .fb_fillrect    = radeonfb_fillrect,
-        .fb_copyarea    = radeonfb_copyarea,
-        .fb_imageblit   = radeonfb_imageblit,
-        .fb_rasterimg   = radeonfb_rasterimg,
-#else
-        .fb_fillrect    = cfb_fillrect,
-        .fb_copyarea    = cfb_copyarea,
-        .fb_imageblit   = cfb_imageblit,
-#endif
-};
-
-
-static int __devinit radeon_set_fbinfo (struct radeonfb_info *rinfo)
-{
-        struct fb_info *info;
-
-        info = &rinfo->info;
-
-        info->par = rinfo;
-        info->pseudo_palette = rinfo->pseudo_palette;
-        info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN;
-        info->fbops = &radeonfb_ops;
-        info->screen_base = rinfo->fb_base;
-
-        /* Fill fix common fields */
-        strlcpy(info->fix.id, rinfo->name, sizeof(info->fix.id));
-        info->fix.smem_start = rinfo->fb_base_phys;
-        info->fix.smem_len = rinfo->video_ram;
-        info->fix.type = FB_TYPE_PACKED_PIXELS;
-        info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-        info->fix.xpanstep = 8;
-        info->fix.ypanstep = 1;
-        info->fix.ywrapstep = 0;
-        info->fix.type_aux = 0;
-        info->fix.mmio_start = rinfo->mmio_base_phys;
-        info->fix.mmio_len = RADEON_REGSIZE;
-        if (noaccel)
-                info->fix.accel = FB_ACCEL_NONE;
-        else
-                info->fix.accel = FB_ACCEL_ATI_RADEON;
-
-        if (radeon_init_disp (rinfo) < 0)
-                return -1;   
-
-        return 0;
-}
-
-
-#ifdef CONFIG_PMAC_BACKLIGHT
-
-/* TODO: Dbl check these tables, we don't go up to full ON backlight
- * in these, possibly because we noticed MacOS doesn't, but I'd prefer
- * having some more official numbers from ATI
- */
-static int backlight_conv_m6[] = {
-        0xff, 0xc0, 0xb5, 0xaa, 0x9f, 0x94, 0x89, 0x7e,
-        0x73, 0x68, 0x5d, 0x52, 0x47, 0x3c, 0x31, 0x24
-};
-static int backlight_conv_m7[] = {
-        0x00, 0x3f, 0x4a, 0x55, 0x60, 0x6b, 0x76, 0x81,
-        0x8c, 0x97, 0xa2, 0xad, 0xb8, 0xc3, 0xce, 0xd9
-};
-
-#define BACKLIGHT_LVDS_OFF
-#undef BACKLIGHT_DAC_OFF
-
-/* We turn off the LCD completely instead of just dimming the backlight.
- * This provides some greater power saving and the display is useless
- * without backlight anyway.
- */
-
-static int radeon_set_backlight_enable(int on, int level, void *data)
-{
-        struct radeonfb_info *rinfo = (struct radeonfb_info *)data;
-        unsigned int lvds_gen_cntl = INREG(LVDS_GEN_CNTL);
-        int* conv_table;
-
-        /* Pardon me for that hack... maybe some day we can figure
-         * out in what direction backlight should work on a given
-         * panel ?
-         */
-        if ((rinfo->arch == RADEON_M7 || rinfo->arch == RADEON_M9)
-                && !machine_is_compatible("PowerBook4,3"))
-                conv_table = backlight_conv_m7;
-        else
-                conv_table = backlight_conv_m6;
-
-        lvds_gen_cntl |= (LVDS_BL_MOD_EN | LVDS_BLON);
-        if (on && (level > BACKLIGHT_OFF)) {
-                lvds_gen_cntl |= LVDS_DIGON;
-                if (!(lvds_gen_cntl & LVDS_ON)) {
-                        lvds_gen_cntl &= ~LVDS_BLON;
-                        OUTREG(LVDS_GEN_CNTL, lvds_gen_cntl);
-                        (void)INREG(LVDS_GEN_CNTL);
-                        mdelay(10);
-                        lvds_gen_cntl |= LVDS_BLON;
-                        OUTREG(LVDS_GEN_CNTL, lvds_gen_cntl);
-                }
-                lvds_gen_cntl &= ~LVDS_BL_MOD_LEVEL_MASK;
-                lvds_gen_cntl |= (conv_table[level] <<
-                                  LVDS_BL_MOD_LEVEL_SHIFT);
-                lvds_gen_cntl |= (LVDS_ON | LVDS_EN);
-                lvds_gen_cntl &= ~LVDS_DISPLAY_DIS;
-        } else {
-                lvds_gen_cntl &= ~LVDS_BL_MOD_LEVEL_MASK;
-                lvds_gen_cntl |= (conv_table[0] <<
-                                  LVDS_BL_MOD_LEVEL_SHIFT);
-                lvds_gen_cntl |= LVDS_DISPLAY_DIS;
-                OUTREG(LVDS_GEN_CNTL, lvds_gen_cntl);
-                udelay(10);
-                lvds_gen_cntl &= ~(LVDS_ON | LVDS_EN | LVDS_BLON | LVDS_DIGON);
-        }
-
-        OUTREG(LVDS_GEN_CNTL, lvds_gen_cntl);
-        rinfo->init_state.lvds_gen_cntl &= ~LVDS_STATE_MASK;
-        rinfo->init_state.lvds_gen_cntl |= (lvds_gen_cntl & LVDS_STATE_MASK);
-
-        return 0;
-}
-
-static int radeon_set_backlight_level(int level, void *data)
-{
-        return radeon_set_backlight_enable(1, level, data);
-}
-#endif /* CONFIG_PMAC_BACKLIGHT */
-
-
-#ifdef CONFIG_PMAC_PBOOK
-
-static u32 dbg_clk;
-
-/*
- * Radeon M6 Power Management code. This code currently only supports
- * the mobile chips, it's based from some informations provided by ATI
- * along with hours of tracing of MacOS drivers
- */
- 
-static void radeon_pm_save_regs(struct radeonfb_info *rinfo)
-{
-        rinfo->save_regs[0] = INPLL(PLL_PWRMGT_CNTL);
-        rinfo->save_regs[1] = INPLL(CLK_PWRMGT_CNTL);
-        rinfo->save_regs[2] = INPLL(MCLK_CNTL);
-        rinfo->save_regs[3] = INPLL(SCLK_CNTL);
-        rinfo->save_regs[4] = INPLL(CLK_PIN_CNTL);
-        rinfo->save_regs[5] = INPLL(VCLK_ECP_CNTL);
-        rinfo->save_regs[6] = INPLL(PIXCLKS_CNTL);
-        rinfo->save_regs[7] = INPLL(MCLK_MISC);
-        rinfo->save_regs[8] = INPLL(P2PLL_CNTL);
-        
-        rinfo->save_regs[9] = INREG(DISP_MISC_CNTL);
-        rinfo->save_regs[10] = INREG(DISP_PWR_MAN);
-        rinfo->save_regs[11] = INREG(LVDS_GEN_CNTL);
-        rinfo->save_regs[12] = INREG(LVDS_PLL_CNTL);
-        rinfo->save_regs[13] = INREG(TV_DAC_CNTL);
-        rinfo->save_regs[14] = INREG(BUS_CNTL1);
-        rinfo->save_regs[15] = INREG(CRTC_OFFSET_CNTL);
-        rinfo->save_regs[16] = INREG(AGP_CNTL);
-        rinfo->save_regs[17] = (INREG(CRTC_GEN_CNTL) & 0xfdffffff) | 0x04000000;
-        rinfo->save_regs[18] = (INREG(CRTC2_GEN_CNTL) & 0xfdffffff) | 0x04000000;
-        rinfo->save_regs[19] = INREG(GPIOPAD_A);
-        rinfo->save_regs[20] = INREG(GPIOPAD_EN);
-        rinfo->save_regs[21] = INREG(GPIOPAD_MASK);
-        rinfo->save_regs[22] = INREG(ZV_LCDPAD_A);
-        rinfo->save_regs[23] = INREG(ZV_LCDPAD_EN);
-        rinfo->save_regs[24] = INREG(ZV_LCDPAD_MASK);
-        rinfo->save_regs[25] = INREG(GPIO_VGA_DDC);
-        rinfo->save_regs[26] = INREG(GPIO_DVI_DDC);
-        rinfo->save_regs[27] = INREG(GPIO_MONID);
-        rinfo->save_regs[28] = INREG(GPIO_CRT2_DDC);
-
-        rinfo->save_regs[29] = INREG(SURFACE_CNTL);
-        rinfo->save_regs[30] = INREG(MC_FB_LOCATION);
-        rinfo->save_regs[31] = INREG(DISPLAY_BASE_ADDR);
-        rinfo->save_regs[32] = INREG(MC_AGP_LOCATION);
-        rinfo->save_regs[33] = INREG(CRTC2_DISPLAY_BASE_ADDR);
-}
-
-static void radeon_pm_restore_regs(struct radeonfb_info *rinfo)
-{
-        OUTPLL(P2PLL_CNTL, rinfo->save_regs[8] & 0xFFFFFFFE); /* First */
-        
-        OUTPLL(PLL_PWRMGT_CNTL, rinfo->save_regs[0]);
-        OUTPLL(CLK_PWRMGT_CNTL, rinfo->save_regs[1]);
-        OUTPLL(MCLK_CNTL, rinfo->save_regs[2]);
-        OUTPLL(SCLK_CNTL, rinfo->save_regs[3]);
-        OUTPLL(CLK_PIN_CNTL, rinfo->save_regs[4]);
-        OUTPLL(VCLK_ECP_CNTL, rinfo->save_regs[5]);
-        OUTPLL(PIXCLKS_CNTL, rinfo->save_regs[6]);
-        OUTPLL(MCLK_MISC, rinfo->save_regs[7]);
-        
-        OUTREG(DISP_MISC_CNTL, rinfo->save_regs[9]);
-        OUTREG(DISP_PWR_MAN, rinfo->save_regs[10]);
-        OUTREG(LVDS_GEN_CNTL, rinfo->save_regs[11]);
-        OUTREG(LVDS_PLL_CNTL,rinfo->save_regs[12]);
-        OUTREG(TV_DAC_CNTL, rinfo->save_regs[13]);
-        OUTREG(BUS_CNTL1, rinfo->save_regs[14]);
-        OUTREG(CRTC_OFFSET_CNTL, rinfo->save_regs[15]);
-        OUTREG(AGP_CNTL, rinfo->save_regs[16]);
-        OUTREG(CRTC_GEN_CNTL, rinfo->save_regs[17]);
-        OUTREG(CRTC2_GEN_CNTL, rinfo->save_regs[18]);
-
-        // wait VBL before that one  ?
-        OUTPLL(P2PLL_CNTL, rinfo->save_regs[8]);
-        
-        OUTREG(GPIOPAD_A, rinfo->save_regs[19]);
-        OUTREG(GPIOPAD_EN, rinfo->save_regs[20]);
-        OUTREG(GPIOPAD_MASK, rinfo->save_regs[21]);
-        OUTREG(ZV_LCDPAD_A, rinfo->save_regs[22]);
-        OUTREG(ZV_LCDPAD_EN, rinfo->save_regs[23]);
-        OUTREG(ZV_LCDPAD_MASK, rinfo->save_regs[24]);
-        OUTREG(GPIO_VGA_DDC, rinfo->save_regs[25]);
-        OUTREG(GPIO_DVI_DDC, rinfo->save_regs[26]);
-        OUTREG(GPIO_MONID, rinfo->save_regs[27]);
-        OUTREG(GPIO_CRT2_DDC, rinfo->save_regs[28]);
-}
-
-static void radeon_pm_disable_iopad(struct radeonfb_info *rinfo)
-{               
-        OUTREG(GPIOPAD_MASK, 0x0001ffff);
-        OUTREG(GPIOPAD_EN, 0x00000400);
-        OUTREG(GPIOPAD_A, 0x00000000);          
-        OUTREG(ZV_LCDPAD_MASK, 0x00000000);
-        OUTREG(ZV_LCDPAD_EN, 0x00000000);
-        OUTREG(ZV_LCDPAD_A, 0x00000000);        
-        OUTREG(GPIO_VGA_DDC, 0x00030000);
-        OUTREG(GPIO_DVI_DDC, 0x00000000);
-        OUTREG(GPIO_MONID, 0x00030000);
-        OUTREG(GPIO_CRT2_DDC, 0x00000000);
-}
-
-static void radeon_pm_program_v2clk(struct radeonfb_info *rinfo)
-{
-//
-//      u32 reg;
-//
-//      OUTPLL(P2PLL_REF_DIV, 0x0c);
-//
-//      .../... figure out what macos does here
-}
-
-static void radeon_pm_low_current(struct radeonfb_info *rinfo)
-{
-        u32 reg;
-
-        reg  = INREG(BUS_CNTL1);
-        reg &= ~BUS_CNTL1_MOBILE_PLATFORM_SEL_MASK;
-        reg |= BUS_CNTL1_AGPCLK_VALID | (1<<BUS_CNTL1_MOBILE_PLATFORM_SEL_SHIFT);
-        OUTREG(BUS_CNTL1, reg);
-        
-        reg  = INPLL(PLL_PWRMGT_CNTL);
-        reg |= PLL_PWRMGT_CNTL_SPLL_TURNOFF | PLL_PWRMGT_CNTL_PPLL_TURNOFF |
-                PLL_PWRMGT_CNTL_P2PLL_TURNOFF | PLL_PWRMGT_CNTL_TVPLL_TURNOFF;
-        reg &= ~PLL_PWRMGT_CNTL_SU_MCLK_USE_BCLK;
-        reg &= ~PLL_PWRMGT_CNTL_MOBILE_SU;
-        OUTPLL(PLL_PWRMGT_CNTL, reg);
-
-//      reg  = INPLL(TV_PLL_CNTL1);
-//      reg |= TV_PLL_CNTL1__TVPLL_RESET | TV_PLL_CNTL1__TVPLL_SLEEP;
-//      OUTPLL(TV_PLL_CNTL1, reg);
-        
-        reg  = INREG(TV_DAC_CNTL);
-        reg &= ~(TV_DAC_CNTL_BGADJ_MASK |TV_DAC_CNTL_DACADJ_MASK);
-        reg |=TV_DAC_CNTL_BGSLEEP | TV_DAC_CNTL_RDACPD | TV_DAC_CNTL_GDACPD |
-                TV_DAC_CNTL_BDACPD |
-                (8<<TV_DAC_CNTL_BGADJ__SHIFT) | (8<<TV_DAC_CNTL_DACADJ__SHIFT);
-        OUTREG(TV_DAC_CNTL, reg);
-        
-        reg  = INREG(TMDS_TRANSMITTER_CNTL);
-        reg &= ~(TMDS_PLL_EN |TMDS_PLLRST);
-        OUTREG(TMDS_TRANSMITTER_CNTL, reg);
-
-//      lvds_pll_cntl  = regr32(g, LVDS_PLL_CNTL);
-//      lvds_pll_cntl &= ~LVDS_PLL_CNTL__LVDS_PLL_EN;                                                                                   
-//      lvds_pll_cntl |=  LVDS_PLL_CNTL__LVDS_PLL_RESET;        
-//      regw32(g, LVDS_PLL_CNTL, lvds_pll_cntl);
-
-        reg = INREG(DAC_CNTL);
-        reg &= ~DAC_CMP_EN;
-        OUTREG(DAC_CNTL, reg);
-
-        reg = INREG(DAC_CNTL2);
-        reg &= ~DAC2_CMP_EN;
-        OUTREG(DAC_CNTL2, reg);
-        
-        reg  = INREG(TV_DAC_CNTL);
-        reg &= ~TV_DAC_CNTL_DETECT;
-        OUTREG(TV_DAC_CNTL, reg);
-}
-
-static void radeon_pm_setup_for_suspend(struct radeonfb_info *rinfo)
-{
-        /* This code is disabled. It does what is in the pm_init
-         * function of the MacOS driver code ATI sent me. However,
-         * it doesn't fix my sleep problem, and is causing other issues
-         * on wakeup (bascially the machine dying when switching consoles
-         * I haven't had time to investigate this yet
-         */
-#if 0
-        u32 disp_misc_cntl;
-        u32 disp_pwr_man;
-        u32 temp;
-
-        // set SPLL, MPLL, PPLL, P2PLL, TVPLL, SCLK, MCLK, PCLK, P2CLK,
-        // TCLK and TEST_MODE to 0
-        temp = INPLL(CLK_PWRMGT_CNTL);
-        OUTPLL(CLK_PWRMGT_CNTL , temp & ~0xc00002ff);
-
-        // Turn on Power Management
-        temp = INPLL(CLK_PWRMGT_CNTL);
-        OUTPLL(CLK_PWRMGT_CNTL , temp | 0x00000400);
-
-        // Turn off display clock if using mobile chips
-        temp = INPLL(CLK_PWRMGT_CNTL);
-        OUTREG(CLK_PWRMGT_CNTL , temp | 0x00100000);
-
-        // Force PIXCLK_ALWAYS_ON and PIXCLK_DAC_ALWAYS_ON
-        temp = INPLL(VCLK_ECP_CNTL);
-        OUTPLL(VCLK_ECP_CNTL, temp & ~0x000000c0);
-
-        // Force ECP_FORCE_ON to 1
-        temp = INPLL(VCLK_ECP_CNTL);
-        OUTPLL(VCLK_ECP_CNTL, temp | 0x00040000);
-
-        // Force PIXCLK_BLEND_ALWAYS_ON and PIXCLK_GV_ALWAYS_ON
-        temp = INPLL(PIXCLKS_CNTL);
-        OUTPLL(PIXCLKS_CNTL, temp & ~0x00001800);
-
-        // Forcing SCLK_CNTL to ON
-        OUTPLL(SCLK_CNTL, (INPLL(SCLK_CNTL)& 0x00000007) | 0xffff8000 );
-
-        // Set PM control over XTALIN pad
-        temp = INPLL(CLK_PIN_CNTL);
-        OUTPLL(CLK_PIN_CNTL, temp | 0x00080000);
-
-        // Force MCLK and YCLK and MC as dynamic
-        temp = INPLL(MCLK_CNTL);
-        OUTPLL(MCLK_CNTL, temp & 0xffeaffff);
-
-        // PLL_TURNOFF
-        temp = INPLL(PLL_PWRMGT_CNTL);
-        OUTPLL(PLL_PWRMGT_CNTL, temp | 0x0000001f);
- 
-        // set MOBILE_SU to 1 if M6 or DDR64 is detected
-        temp = INPLL(PLL_PWRMGT_CNTL);
-        OUTPLL(PLL_PWRMGT_CNTL, temp | 0x00010000);
-
-        // select PM access mode (PM_MODE_SEL) (use ACPI mode)
-//      temp = INPLL(PLL_PWRMGT_CNTL);
-//      OUTPLL(PLL_PWRMGT_CNTL, temp | 0x00002000);
-        temp = INPLL(PLL_PWRMGT_CNTL);
-        OUTPLL(PLL_PWRMGT_CNTL, temp & ~0x00002000);
-
-        // set DISP_MISC_CNTL register
-        disp_misc_cntl = INREG(DISP_MISC_CNTL);
-        disp_misc_cntl &= ~(    DISP_MISC_CNTL_SOFT_RESET_GRPH_PP |
-                                DISP_MISC_CNTL_SOFT_RESET_SUBPIC_PP |
-                                DISP_MISC_CNTL_SOFT_RESET_OV0_PP |
-                                DISP_MISC_CNTL_SOFT_RESET_GRPH_SCLK |
-                                DISP_MISC_CNTL_SOFT_RESET_SUBPIC_SCLK |
-                                DISP_MISC_CNTL_SOFT_RESET_OV0_SCLK |
-                                DISP_MISC_CNTL_SOFT_RESET_GRPH2_PP |
-                                DISP_MISC_CNTL_SOFT_RESET_GRPH2_SCLK |
-                                DISP_MISC_CNTL_SOFT_RESET_LVDS |
-                                DISP_MISC_CNTL_SOFT_RESET_TMDS |
-                                DISP_MISC_CNTL_SOFT_RESET_DIG_TMDS |
-                                DISP_MISC_CNTL_SOFT_RESET_TV);
-        OUTREG(DISP_MISC_CNTL, disp_misc_cntl);
-
-        // set DISP_PWR_MAN register
-        disp_pwr_man = INREG(DISP_PWR_MAN);
-        // clau - 9.29.2000 - changes made to bit23:18 to set to 1 as requested by George
-        disp_pwr_man |= (DISP_PWR_MAN_DIG_TMDS_ENABLE_RST |
-                    DISP_PWR_MAN_TV_ENABLE_RST |
- //                 DISP_PWR_MAN_AUTO_PWRUP_EN |
-                    DISP_PWR_MAN_DISP_D3_GRPH_RST |
-                    DISP_PWR_MAN_DISP_D3_SUBPIC_RST |
-                    DISP_PWR_MAN_DISP_D3_OV0_RST |
-                    DISP_PWR_MAN_DISP_D1D2_GRPH_RST |
-                    DISP_PWR_MAN_DISP_D1D2_SUBPIC_RST |
-                    DISP_PWR_MAN_DISP_D1D2_OV0_RST);
-        disp_pwr_man &= ~(DISP_PWR_MAN_DISP_PWR_MAN_D3_CRTC_EN |
-                    DISP_PWR_MAN_DISP2_PWR_MAN_D3_CRTC2_EN|
-                    DISP_PWR_MAN_DISP_D3_RST |
-                    DISP_PWR_MAN_DISP_D3_REG_RST);
-        OUTREG(DISP_PWR_MAN, disp_pwr_man);
-
-        // clau - 10.24.2000
-        // - add in setting for BUS_CNTL1 b27:26 = 0x01 and b31 = 0x1
-        // - add in setting for AGP_CNTL  b7:0 = 0x20
-        // - add in setting for DVI_DDC_DATA_OUT_EN b17:16 = 0x0
-
-        // the following settings (two lines) are applied at a later part of this function, only on mobile platform
-        // requres -mobile flag
-        OUTREG(BUS_CNTL1, (INREG(BUS_CNTL1) & 0xf3ffffff) | 0x04000000);
-        OUTREG(BUS_CNTL1,  INREG(BUS_CNTL1) | 0x80000000);
-        OUTREG(AGP_CNTL, (INREG(AGP_CNTL) & 0xffffff00) | 0x20);
-        OUTREG(GPIO_DVI_DDC, INREG(GPIO_DVI_DDC) & 0xfffcffff);
-
-        // yulee - 12.12.2000
-        // A12 only
-        // EN_MCLK_TRISTATE_IN_SUSPEND@MCLK_MISC = 1
-        // ACCESS_REGS_IN_SUSPEND@CLK_PIN_CNTL = 0
-        // only on mobile platform
-        OUTPLL(MCLK_MISC, INPLL(MCLK_MISC) | 0x00040000 );
-        
-        // yulee -12.12.2000
-        // AGPCLK_VALID@BUS_CNTL1 = 1
-        // MOBILE_PLATFORM_SEL@BUS_CNTL1 = 01
-        // CRTC_STEREO_SYNC_OUT_EN@CRTC_OFFSET_CNTL = 0
-        // CG_CLK_TO_OUTPIN@CLK_PIN_CNTL = 0
-        // only on mobile platform
-        OUTPLL(CLK_PIN_CNTL, INPLL(CLK_PIN_CNTL ) & 0xFFFFF7FF );
-        OUTREG(BUS_CNTL1, (INREG(BUS_CNTL1 ) & 0xF3FFFFFF) | 0x84000000 );
-        OUTREG(CRTC_OFFSET_CNTL, INREG(CRTC_OFFSET_CNTL ) & 0xFFEFFFFF );
-
-        mdelay(100);
-#endif
-
-        /* Disable CRTCs */
-        OUTREG(CRTC_GEN_CNTL, (INREG(CRTC_GEN_CNTL) & ~CRTC_EN) | CRTC_DISP_REQ_EN_B);
-        OUTREG(CRTC2_GEN_CNTL, (INREG(CRTC2_GEN_CNTL) & ~CRTC2_EN) | CRTC2_DISP_REQ_EN_B);
-        (void)INREG(CRTC2_GEN_CNTL);
-        mdelay(17);
-}
-
-static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
-{
-        u16 pwr_cmd;
-
-        if (!rinfo->pm_reg)
-                return;
-
-        /* Set the chip into appropriate suspend mode (we use D2,
-         * D3 would require a compete re-initialization of the chip,
-         * including PCI config registers, clocks, AGP conf, ...)
-         */
-        if (suspend) {
-                /* According to ATI, we should program V2CLK here, I have
-                 * to verify what's up exactly
-                 */
-                /* Save some registers */
-                radeon_pm_save_regs(rinfo);
-
-                /* Check that on M7 too, might work might not. M7 may also
-                 * need explicit enabling of PM
-                 */
-                if (rinfo->arch == RADEON_M6) {
-                        /* Program V2CLK */
-                        radeon_pm_program_v2clk(rinfo);
-                
-                        /* Disable IO PADs */
-                        radeon_pm_disable_iopad(rinfo);
-
-                        /* Set low current */
-                        radeon_pm_low_current(rinfo);
-
-                        /* Prepare chip for power management */
-                        radeon_pm_setup_for_suspend(rinfo);
-
-                        /* Reset the MDLL */
-                        OUTPLL(MDLL_CKO, INPLL(MDLL_CKO) | MCKOA_RESET);
-                        (void)INPLL(MDLL_RDCKA);
-                        OUTPLL(MDLL_CKO, INPLL(MDLL_CKO) & ~MCKOA_RESET);
-                        (void)INPLL(MDLL_RDCKA);
-                }
-
-                /* Switch PCI power managment to D2. */
-                for (;;) {
-                        pci_read_config_word(
-                                rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL,
-                                &pwr_cmd);
-                        if (pwr_cmd & 2)
-                                break;                  
-                        pci_write_config_word(
-                                rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL,
-                                (pwr_cmd & ~PCI_PM_CTRL_STATE_MASK) | 2);
-                        mdelay(500);
-                }
-        } else {
-                /* Switch back PCI powermanagment to D0 */
-                mdelay(200);
-                pci_write_config_word(rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL, 0);
-                mdelay(500);
-
-                dbg_clk = INPLL(1);
-
-                /* Do we need that on M7 ? */
-                if (rinfo->arch == RADEON_M6) {
-                        /* Restore the MDLL */
-                        OUTPLL(MDLL_CKO, INPLL(MDLL_CKO) & ~MCKOA_RESET);
-                        (void)INPLL(MDLL_CKO);                  
-                }
-                
-                /* Restore some registers */
-                radeon_pm_restore_regs(rinfo);
-        }
-}
-
-/*
- * Save the contents of the framebuffer when we go to sleep,
- * and restore it when we wake up again.
- */
-
-int radeon_sleep_notify(struct pmu_sleep_notifier *self, int when)
-{
-        struct radeonfb_info *rinfo;
-
-        for (rinfo = board_list; rinfo != NULL; rinfo = rinfo->next) {
-                struct fb_fix_screeninfo fix;
-                int nb;
-                struct display *disp;  
-
-                disp = (rinfo->currcon < 0) ? rinfo->info.disp : &fb_display[rinfo->currcon];
-
-                switch (rinfo->arch) {
-                        case RADEON_M6:
-                        case RADEON_M7:
-                        case RADEON_M9:
-                                break;
-                        default:
-                                return PBOOK_SLEEP_REFUSE;
-                }
-
-                radeonfb_get_fix(&fix, fg_console, (struct fb_info *)rinfo);
-                nb = fb_display[fg_console].var.yres * fix.line_length;
-
-                switch (when) {
-                        case PBOOK_SLEEP_NOW:
-                                acquire_console_sem();
-                                disp->dispsw = &fbcon_dummy;
-
-                                if (!noaccel) {
-                                        /* Make sure engine is reset */
-                                        radeon_engine_reset();
-                                        radeon_engine_idle();
-                                }
-
-                                /* Blank display and LCD */
-                                radeonfb_blank(VESA_POWERDOWN+1,
-                                               (struct fb_info *)rinfo);
-
-                                /* Sleep */
-                                rinfo->asleep = 1;
-                                radeon_set_suspend(rinfo, 1);
-                                release_console_sem();
-                                
-                                break;
-                        case PBOOK_WAKE:
-                                acquire_console_sem();
-                                /* Wakeup */
-                                radeon_set_suspend(rinfo, 0);
-
-                                if (!noaccel)
-                                        radeon_engine_init(rinfo);
-                                rinfo->asleep = 0;
-                                radeon_set_dispsw(rinfo, disp);
-                                radeon_load_video_mode(rinfo, &disp->var);
-                                do_install_cmap(rinfo->currcon < 0 ? 0 : rinfo->currcon,
-                                                (struct fb_info *)rinfo);
-
-                                radeonfb_blank(0, (struct fb_info *)rinfo);
-                                release_console_sem();
-                                printk("CLK_PIN_CNTL on wakeup was: %08x\n", dbg_clk);
-                                break;
-                }
-        }
-
-        return PBOOK_SLEEP_OK;
-}
-
-#endif /* CONFIG_PMAC_PBOOK */
-
-static int radeonfb_pci_register (struct pci_dev *pdev,
-                                  const struct pci_device_id *ent)
-{
-        struct radeonfb_info *rinfo;
-        struct radeon_chip_info *rci = &radeon_chip_info[ent->driver_data];
-        u32 tmp;
-
-        RTRACE("radeonfb_pci_register BEGIN\n");
-
-        /* Enable device in PCI config */
-        if (pci_enable_device(pdev) != 0) {
-                printk(KERN_ERR "radeonfb: Cannot enable PCI device\n");
-                return -ENODEV;
-        }
-
-        rinfo = kmalloc (sizeof (struct radeonfb_info), GFP_KERNEL);
-        if (!rinfo) {
-                printk ("radeonfb: could not allocate memory\n");
-                return -ENODEV;
-        }
-
-        memset (rinfo, 0, sizeof (struct radeonfb_info));
-        //info = &rinfo->info;
-        rinfo->pdev = pdev;
-        strcpy(rinfo->name, rci->name);
-        rinfo->arch = rci->arch;
-
-        /* Set base addrs */
-        rinfo->fb_base_phys = pci_resource_start (pdev, 0);
-        rinfo->mmio_base_phys = pci_resource_start (pdev, 2);
-
-        /* request the mem regions */
-        if (!request_mem_region (rinfo->fb_base_phys,
-                                 pci_resource_len(pdev, 0), "radeonfb")) {
-                printk ("radeonfb: cannot reserve FB region\n");
-                kfree (rinfo);
-                return -ENODEV;
-        }
-
-        if (!request_mem_region (rinfo->mmio_base_phys,
-                                 pci_resource_len(pdev, 2), "radeonfb")) {
-                printk ("radeonfb: cannot reserve MMIO region\n");
-                release_mem_region (rinfo->fb_base_phys,
-                                    pci_resource_len(pdev, 0));
-                kfree (rinfo);
-                return -ENODEV;
-        }
-
-        /* map the regions */
-        rinfo->mmio_base = ioremap (rinfo->mmio_base_phys, RADEON_REGSIZE);
-        if (!rinfo->mmio_base) {
-                printk ("radeonfb: cannot map MMIO\n");
-                release_mem_region (rinfo->mmio_base_phys,
-                                    pci_resource_len(pdev, 2));
-                release_mem_region (rinfo->fb_base_phys,
-                                    pci_resource_len(pdev, 0));
-                kfree (rinfo);
-                return -ENODEV;
-        }
-
-        rinfo->chipset = pdev->device;
-
-        switch (rinfo->arch) {
-                case RADEON_R100:
-                        rinfo->hasCRTC2 = 0;
-                        break;
-                default:
-                        /* all the rest have it */
-                        rinfo->hasCRTC2 = 1;
-                        break;
-        }
-#if 0
-        if (rinfo->arch == RADEON_M7) {
-                /*
-                 * Noticed some errors in accel with M7, will have to work these out...
-                 */
-                noaccel = 1;
-        }
-#endif
-        if (mirror)
-                printk("radeonfb: mirroring display to CRT\n");
-
-        /* framebuffer size */
-        tmp = INREG(CONFIG_MEMSIZE);
-
-        /* mem size is bits [28:0], mask off the rest */
-        rinfo->video_ram = tmp & CONFIG_MEMSIZE_MASK;
-
-        /* ram type */
-        tmp = INREG(MEM_SDRAM_MODE_REG);
-        switch ((MEM_CFG_TYPE & tmp) >> 30) {
-                case 0:
-                        /* SDR SGRAM (2:1) */
-                        strcpy(rinfo->ram_type, "SDR SGRAM");
-                        rinfo->ram.ml = 4;
-                        rinfo->ram.mb = 4;
-                        rinfo->ram.trcd = 1;
-                        rinfo->ram.trp = 2;
-                        rinfo->ram.twr = 1;
-                        rinfo->ram.cl = 2;
-                        rinfo->ram.loop_latency = 16;
-                        rinfo->ram.rloop = 16;
-        
-                        break;
-                case 1:
-                        /* DDR SGRAM */
-                        strcpy(rinfo->ram_type, "DDR SGRAM");
-                        rinfo->ram.ml = 4;
-                        rinfo->ram.mb = 4;
-                        rinfo->ram.trcd = 3;
-                        rinfo->ram.trp = 3;
-                        rinfo->ram.twr = 2;
-                        rinfo->ram.cl = 3;
-                        rinfo->ram.tr2w = 1;
-                        rinfo->ram.loop_latency = 16;
-                        rinfo->ram.rloop = 16;
-
-                        break;
-                default:
-                        /* 64-bit SDR SGRAM */
-                        strcpy(rinfo->ram_type, "SDR SGRAM 64");
-                        rinfo->ram.ml = 4;
-                        rinfo->ram.mb = 8;
-                        rinfo->ram.trcd = 3;
-                        rinfo->ram.trp = 3;
-                        rinfo->ram.twr = 1;
-                        rinfo->ram.cl = 3;
-                        rinfo->ram.tr2w = 1;
-                        rinfo->ram.loop_latency = 17;
-                        rinfo->ram.rloop = 17;
-
-                        break;
-        }
-
-        rinfo->bios_seg = radeon_find_rom(rinfo);
-        radeon_get_pllinfo(rinfo, rinfo->bios_seg);
-
-        /*
-         * Hack to get around some busted production M6's
-         * reporting no ram
-         */
-        if (rinfo->video_ram == 0) {
-                switch (pdev->device) {
-                        case PCI_DEVICE_ID_ATI_RADEON_LY:
-                        case PCI_DEVICE_ID_ATI_RADEON_LZ:
-                                rinfo->video_ram = 8192 * 1024;
-                                break;
-                        default:
-                                break;
-                }
-        }
-
-
-        RTRACE("radeonfb: probed %s %dk videoram\n", (rinfo->ram_type), (rinfo->video_ram/1024));
-
-#if !defined(__powerpc__)
-        radeon_get_moninfo(rinfo);
-#else
-        switch (pdev->device) {
-                case PCI_DEVICE_ID_ATI_RADEON_LW:
-                case PCI_DEVICE_ID_ATI_RADEON_LX:
-                case PCI_DEVICE_ID_ATI_RADEON_LY:
-                case PCI_DEVICE_ID_ATI_RADEON_LZ:
-                        rinfo->dviDisp_type = MT_LCD;
-                        break;
-                default:
-                        radeon_get_moninfo(rinfo);
-                        break;
-        }
-#endif
-
-        radeon_get_EDID(rinfo);
-
-        if ((rinfo->dviDisp_type == MT_DFP) || (rinfo->dviDisp_type == MT_LCD) ||
-            (rinfo->crtDisp_type == MT_DFP)) {
-                if (!radeon_get_dfpinfo(rinfo)) {
-                        iounmap(rinfo->mmio_base);
-                        release_mem_region (rinfo->mmio_base_phys,
-                                            pci_resource_len(pdev, 2));
-                        release_mem_region (rinfo->fb_base_phys,
-                                            pci_resource_len(pdev, 0));
-                        kfree (rinfo);
-                        return -ENODEV;
-                }
-        }
-
-        rinfo->fb_base = ioremap (rinfo->fb_base_phys, rinfo->video_ram);
-        if (!rinfo->fb_base) {
-                printk ("radeonfb: cannot map FB\n");
-                iounmap(rinfo->mmio_base);
-                release_mem_region (rinfo->mmio_base_phys,
-                                    pci_resource_len(pdev, 2));
-                release_mem_region (rinfo->fb_base_phys,
-                                    pci_resource_len(pdev, 0));
-                kfree (rinfo);
-                return -ENODEV;
-        }
-
-        /* I SHOULD FIX THAT CRAP ! I should probably mimmic XFree DRI
-         * driver setup here.
-         * 
-         * On PPC, OF based cards setup the internal memory
-         * mapping in strange ways. We change it so that the
-         * framebuffer is mapped at 0 and given half of the card's
-         * address space (2Gb). AGP is mapped high (0xe0000000) and
-         * can use up to 512Mb. Once DRI is fully implemented, we
-         * will have to setup the PCI remapper to remap the agp_special_page
-         * memory page somewhere between those regions so that the card
-         * use a normal PCI bus master cycle to access the ring read ptr.
-         * --BenH.
-         */
-#ifdef CONFIG_ALL_PPC
-        if (rinfo->hasCRTC2)
-                OUTREG(CRTC2_GEN_CNTL,
-                        (INREG(CRTC2_GEN_CNTL) & ~CRTC2_EN) | CRTC2_DISP_REQ_EN_B);
-        OUTREG(CRTC_EXT_CNTL, INREG(CRTC_EXT_CNTL) | CRTC_DISPLAY_DIS);
-        OUTREG(MC_FB_LOCATION, 0x7fff0000);
-        OUTREG(MC_AGP_LOCATION, 0xffffe000);
-        OUTREG(DISPLAY_BASE_ADDR, 0x00000000);
-        if (rinfo->hasCRTC2)
-                OUTREG(CRTC2_DISPLAY_BASE_ADDR, 0x00000000);
-        OUTREG(SRC_OFFSET, 0x00000000);
-        OUTREG(DST_OFFSET, 0x00000000);
-        mdelay(10);
-        OUTREG(CRTC_EXT_CNTL, INREG(CRTC_EXT_CNTL) & ~CRTC_DISPLAY_DIS);
-#endif /* CONFIG_ALL_PPC */
-
-        /* save current mode regs before we switch into the new one
-         * so we can restore this upon __exit
-         */
-        radeon_save_state (rinfo, &rinfo->init_state);
-
-        /* set all the vital stuff */
-        radeon_set_fbinfo (rinfo);
-
-        pci_set_drvdata(pdev, rinfo);
-        rinfo->next = board_list;
-        board_list = rinfo;
-        ((struct fb_info *) rinfo)->device = &pdev->dev;
-        if (register_framebuffer ((struct fb_info *) rinfo) < 0) {
-                printk ("radeonfb: could not register framebuffer\n");
-                iounmap(rinfo->fb_base);
-                iounmap(rinfo->mmio_base);
-                release_mem_region (rinfo->mmio_base_phys,
-                                    pci_resource_len(pdev, 2));
-                release_mem_region (rinfo->fb_base_phys,
-                                    pci_resource_len(pdev, 0));
-                kfree (rinfo);
-                return -ENODEV;
-        }
-
-#ifdef CONFIG_MTRR
-        rinfo->mtrr_hdl = nomtrr ? -1 : mtrr_add(rinfo->fb_base_phys,
-                                                 rinfo->video_ram,
-                                                 MTRR_TYPE_WRCOMB, 1);
-#endif
-
-#ifdef CONFIG_PMAC_BACKLIGHT
-        if (rinfo->dviDisp_type == MT_LCD)
-                register_backlight_controller(&radeon_backlight_controller,
-                                              rinfo, "ati");
-#endif
-
-#ifdef CONFIG_PMAC_PBOOK
-        if (rinfo->dviDisp_type == MT_LCD) {
-                rinfo->pm_reg = pci_find_capability(pdev, PCI_CAP_ID_PM);
-                pmu_register_sleep_notifier(&radeon_sleep_notifier);
-        }
-#endif
-
-        printk ("radeonfb: ATI Radeon %s %s %d MB\n", rinfo->name, rinfo->ram_type,
-                (rinfo->video_ram/(1024*1024)));
-
-        if (rinfo->hasCRTC2) {
-                printk("radeonfb: DVI port %s monitor connected\n",
-                        GET_MON_NAME(rinfo->dviDisp_type));
-                printk("radeonfb: CRT port %s monitor connected\n",
-                        GET_MON_NAME(rinfo->crtDisp_type));
-        } else {
-                printk("radeonfb: CRT port %s monitor connected\n",
-                        GET_MON_NAME(rinfo->crtDisp_type));
-        }
-
-        RTRACE("radeonfb_pci_register END\n");
-
-        return 0;
-}
-
-
-
-static void __devexit radeonfb_pci_unregister (struct pci_dev *pdev)
-{
-        struct radeonfb_info *rinfo = pci_get_drvdata(pdev);
- 
-        if (!rinfo)
-                return;
- 
-        /* restore original state
-         * 
-         * Doesn't quite work yet, possibly because of the PPC hacking
-         * I do on startup, disable for now. --BenH
-         */
-        radeon_write_mode (rinfo, &rinfo->init_state);
- 
-#ifdef CONFIG_MTRR
-        if (rinfo->mtrr_hdl >= 0)
-                mtrr_del(rinfo->mtrr_hdl, 0, 0);
-#endif
-
-        unregister_framebuffer ((struct fb_info *) rinfo);
-                
-        iounmap(rinfo->mmio_base);
-        iounmap(rinfo->fb_base);
- 
-        release_mem_region (rinfo->mmio_base_phys,
-                            pci_resource_len(pdev, 2));
-        release_mem_region (rinfo->fb_base_phys,
-                            pci_resource_len(pdev, 0));
-        
-        kfree (rinfo);
-}
-
-
-static struct pci_driver radeonfb_driver = {
-        .name           = "radeonfb",
-        .id_table       = radeonfb_pci_table,
-        .probe          = radeonfb_pci_register,
-        .remove         = __devexit_p(radeonfb_pci_unregister),
-};
-
-#ifndef MODULE
-static int __init radeonfb_old_setup (char *options)
-{
-        char *this_opt;
-
-        if (!options || !*options)
-                return 0;
- 
-        while ((this_opt = strsep (&options, ",")) != NULL) {
-                if (!*this_opt)
-                        continue;
-                if (!strncmp(this_opt, "noaccel", 7)) {
-                        noaccel = 1;
-                } else if (!strncmp(this_opt, "mirror", 6)) {
-                        mirror = 1;
-                } else if (!strncmp(this_opt, "dfp", 3)) {
-                        force_dfp = 1;
-                } else if (!strncmp(this_opt, "panel_yres:", 11)) {
-                        panel_yres = simple_strtoul((this_opt+11), NULL, 0);
-                } else if (!strncmp(this_opt, "nomtrr", 6)) {
-                        nomtrr = 1;
-                } else
-                        mode_option = this_opt;
-        }
-
-        return 0;
-}
-#endif  /*  MODULE  */
-
-static int __init radeonfb_old_init (void)
-{
-#ifndef MODULE
-        char *option = NULL;
-
-        if (fb_get_options("radeonfb_old", &option))
-                return -ENODEV;
-        radeonfb_old_setup(option);
-#endif
-        return pci_register_driver (&radeonfb_driver);
-}
-
-
-static void __exit radeonfb_old_exit (void)
-{
-        pci_unregister_driver (&radeonfb_driver);
-}
-
-module_init(radeonfb_old_init);
-module_exit(radeonfb_old_exit);
-
-
-MODULE_AUTHOR("Ani Joshi");
-MODULE_DESCRIPTION("framebuffer driver for ATI Radeon chipset");
-MODULE_LICENSE("GPL");
diff --git a/drivers/video/sticore.h b/drivers/video/sticore.h
index dc93336af557..1a9a60c74be3 100644
--- a/drivers/video/sticore.h
+++ b/drivers/video/sticore.h
@@ -34,36 +34,20 @@
  * for them to fix it and steal their solution.   prumpf
  */
  
-#define STI_WAIT 1
-
-#include <asm/io.h> /* for USE_HPPA_IOREMAP */
-
-#if USE_HPPA_IOREMAP
+#include <asm/io.h>
 
-#define STI_PTR(p)      (p)
-#define PTR_STI(p)      (p)
-static inline int STI_CALL( unsigned long func, 
-                void *flags, void *inptr, void *outptr, void *glob_cfg )
-{
-       int (*f)(void *,void *,void *,void *);
-       f = (void*)func;
-       return f(flags, inptr, outptr, glob_cfg);
-}
-
-#else /* !USE_HPPA_IOREMAP */
+#define STI_WAIT 1
 
 #define STI_PTR(p)      ( virt_to_phys(p) )
-#define PTR_STI(p)      ( phys_to_virt((long)p) )
-#define STI_CALL(func, flags, inptr, outptr, glob_cfg) \
-       ({                                                      \
-               pdc_sti_call( func, (unsigned long)STI_PTR(flags), \
-                                   (unsigned long)STI_PTR(inptr), \
-                                   (unsigned long)STI_PTR(outptr), \
-                                   (unsigned long)STI_PTR(glob_cfg)); \
+#define PTR_STI(p)      ( phys_to_virt((unsigned long)p) )
+#define STI_CALL(func, flags, inptr, outptr, glob_cfg)  \
+       ({                                               \
+               pdc_sti_call( func, STI_PTR(flags),      \
+                                   STI_PTR(inptr),      \
+                                   STI_PTR(outptr),     \
+                                   STI_PTR(glob_cfg));  \
        })
 
-#endif /* USE_HPPA_IOREMAP */
-
 
 #define sti_onscreen_x(sti) (sti->glob_cfg->onscreen_x)
 #define sti_onscreen_y(sti) (sti->glob_cfg->onscreen_y)
@@ -352,8 +336,9 @@ struct sti_struct {
         struct sti_conf_outptr outptr; /* configuration */
         struct sti_conf_outptr_ext outptr_ext;
 
-        /* PCI data structures (pg. 17ff from sti.pdf) */
         struct pci_dev *pd;
+
+        /* PCI data structures (pg. 17ff from sti.pdf) */
         u8 rm_entry[16]; /* pci region mapper array == pci config space offset */
 
         /* pointer to the fb_info where this STI device is used */
diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
index 56d71d6e9a72..4a292aae6eb2 100644
--- a/drivers/video/stifb.c
+++ b/drivers/video/stifb.c
@@ -3,7 +3,7 @@
  * Low level Frame buffer driver for HP workstations with 
  * STI (standard text interface) video firmware.
  *
- * Copyright (C) 2001-2005 Helge Deller <deller@gmx.de>
+ * Copyright (C) 2001-2006 Helge Deller <deller@gmx.de>
  * Portions Copyright (C) 2001 Thomas Bogendoerfer <tsbogend@alpha.franken.de>
  * 
  * Based on:
@@ -514,7 +514,7 @@ rattlerSetupPlanes(struct stifb_info *fb)
         SETUP_HW(fb);
         WRITE_BYTE(1, fb, REG_16b1);
 
-        fb_memset(fb->info.fix.smem_start, 0xff,
+        fb_memset((void*)fb->info.fix.smem_start, 0xff,
                 fb->info.var.yres*fb->info.fix.line_length);
     
         CRX24_SET_OVLY_MASK(fb);
@@ -908,83 +908,6 @@ SETUP_HCRX(struct stifb_info *fb)
 
 /* ------------------- driver specific functions --------------------------- */
 
-#define TMPBUFLEN 2048
-
-static ssize_t
-stifb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
-{
-        unsigned long p = *ppos;
-        struct inode *inode = file->f_dentry->d_inode;
-        int fbidx = iminor(inode);
-        struct fb_info *info = registered_fb[fbidx];
-        char tmpbuf[TMPBUFLEN];
-
-        if (!info || ! info->screen_base)
-                return -ENODEV;
-
-        if (p >= info->fix.smem_len)
-            return 0;
-        if (count >= info->fix.smem_len)
-            count = info->fix.smem_len;
-        if (count + p > info->fix.smem_len)
-                count = info->fix.smem_len - p;
-        if (count > sizeof(tmpbuf))
-                count = sizeof(tmpbuf);
-        if (count) {
-            char *base_addr;
-
-            base_addr = info->screen_base;
-            memcpy_fromio(&tmpbuf, base_addr+p, count);
-            count -= copy_to_user(buf, &tmpbuf, count);
-            if (!count)
-                return -EFAULT;
-            *ppos += count;
-        }
-        return count;
-}
-
-static ssize_t
-stifb_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
-{
-        struct inode *inode = file->f_dentry->d_inode;
-        int fbidx = iminor(inode);
-        struct fb_info *info = registered_fb[fbidx];
-        unsigned long p = *ppos;
-        size_t c;
-        int err;
-        char tmpbuf[TMPBUFLEN];
-
-        if (!info || !info->screen_base)
-                return -ENODEV;
-
-        if (p > info->fix.smem_len)
-            return -ENOSPC;
-        if (count >= info->fix.smem_len)
-            count = info->fix.smem_len;
-        err = 0;
-        if (count + p > info->fix.smem_len) {
-            count = info->fix.smem_len - p;
-            err = -ENOSPC;
-        }
-
-        p += (unsigned long)info->screen_base;
-        c = count;
-        while (c) {
-            int len = c > sizeof(tmpbuf) ? sizeof(tmpbuf) : c;
-            err = -EFAULT;
-            if (copy_from_user(&tmpbuf, buf, len))
-                    break;
-            memcpy_toio(p, &tmpbuf, len);
-            c -= len;
-            p += len;
-            buf += len;
-            *ppos += len;
-        }
-        if (count-c)
-                return (count-c);
-        return err;
-}
-
 static int
 stifb_setcolreg(u_int regno, u_int red, u_int green,
               u_int blue, u_int transp, struct fb_info *info)
@@ -1137,8 +1060,6 @@ stifb_init_display(struct stifb_info *fb)
 
 static struct fb_ops stifb_ops = {
         .owner          = THIS_MODULE,
-        .fb_read        = stifb_read,
-        .fb_write       = stifb_write,
         .fb_setcolreg   = stifb_setcolreg,
         .fb_blank       = stifb_blank,
         .fb_fillrect    = cfb_fillrect,
@@ -1162,7 +1083,7 @@ stifb_init_fb(struct sti_struct *sti, int bpp_pref)
         char *dev_name;
         int bpp, xres, yres;
 
-        fb = kmalloc(sizeof(*fb), GFP_ATOMIC);
+        fb = kzalloc(sizeof(*fb), GFP_ATOMIC);
         if (!fb) {
                 printk(KERN_ERR "stifb: Could not allocate stifb structure\n");
                 return -ENODEV;
@@ -1171,7 +1092,6 @@ stifb_init_fb(struct sti_struct *sti, int bpp_pref)
         info = &fb->info;
 
         /* set struct to a known state */
-        memset(fb, 0, sizeof(*fb));
         fix = &info->fix;
         var = &info->var;
 
@@ -1234,7 +1154,7 @@ stifb_init_fb(struct sti_struct *sti, int bpp_pref)
         case S9000_ID_TOMCAT:   /* Dual CRX, behaves else like a CRX */
                 /* FIXME: TomCat supports two heads:
                  * fb.iobase = REGION_BASE(fb_info,3);
-                 * fb.screen_base = (void*) REGION_BASE(fb_info,2);
+                 * fb.screen_base = ioremap_nocache(REGION_BASE(fb_info,2),xxx);
                  * for now we only support the left one ! */
                 xres = fb->ngle_rom.x_size_visible;
                 yres = fb->ngle_rom.y_size_visible;
@@ -1327,7 +1247,8 @@ stifb_init_fb(struct sti_struct *sti, int bpp_pref)
 
         strcpy(fix->id, "stifb");
         info->fbops = &stifb_ops;
-        info->screen_base = (void*) REGION_BASE(fb,1);
+        info->screen_base = ioremap_nocache(REGION_BASE(fb,1), fix->smem_len);
+        info->screen_size = fix->smem_len;
         info->flags = FBINFO_DEFAULT;
         info->pseudo_palette = &fb->pseudo_palette;
 
@@ -1457,7 +1378,7 @@ stifb_setup(char *options)
         int i;
         
         if (!options || !*options)
-                return 0;
+                return 1;
         
         if (strncmp(options, "off", 3) == 0) {
                 stifb_disabled = 1;
@@ -1472,7 +1393,7 @@ stifb_setup(char *options)
                         stifb_bpp_pref[i] = simple_strtoul(options, &options, 10);
                 }
         }
-        return 0;
+        return 1;
 }
 
 __setup("stifb=", stifb_setup);
diff --git a/drivers/video/w100fb.c b/drivers/video/w100fb.c
index f6e24ee85f07..5fc86ea20692 100644
--- a/drivers/video/w100fb.c
+++ b/drivers/video/w100fb.c
@@ -4,8 +4,9 @@
  * Frame Buffer Device for ATI Imageon w100 (Wallaby)
  *
  * Copyright (C) 2002, ATI Corp.
- * Copyright (C) 2004-2005 Richard Purdie
+ * Copyright (C) 2004-2006 Richard Purdie
  * Copyright (c) 2005 Ian Molton
+ * Copyright (c) 2006 Alberto Mardegan
  *
  * Rewritten for 2.6 by Richard Purdie <rpurdie@rpsys.net>
  *
@@ -14,6 +15,9 @@
  *
  * w32xx support by Ian Molton
  *
+ * Hardware acceleration support by Alberto Mardegan
+ * <mardy@users.sourceforge.net>
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -47,6 +51,7 @@ static void w100_set_dispregs(struct w100fb_par*);
 static void w100_update_enable(void);
 static void w100_update_disable(void);
 static void calc_hsync(struct w100fb_par *par);
+static void w100_init_graphic_engine(struct w100fb_par *par);
 struct w100_pll_info *w100_get_xtal_table(unsigned int freq);
 
 /* Pseudo palette size */
@@ -248,6 +253,152 @@ static int w100fb_blank(int blank_mode, struct fb_info *info)
 }
 
 
+static void w100_fifo_wait(int entries)
+{
+        union rbbm_status_u status;
+        int i;
+
+        for (i = 0; i < 2000000; i++) {
+                status.val = readl(remapped_regs + mmRBBM_STATUS);
+                if (status.f.cmdfifo_avail >= entries)
+                        return;
+                udelay(1);
+        }
+        printk(KERN_ERR "w100fb: FIFO Timeout!\n");
+}
+
+
+static int w100fb_sync(struct fb_info *info)
+{
+        union rbbm_status_u status;
+        int i;
+
+        for (i = 0; i < 2000000; i++) {
+                status.val = readl(remapped_regs + mmRBBM_STATUS);
+                if (!status.f.gui_active)
+                        return 0;
+                udelay(1);
+        }
+        printk(KERN_ERR "w100fb: Graphic engine timeout!\n");
+        return -EBUSY;
+}
+
+
+static void w100_init_graphic_engine(struct w100fb_par *par)
+{
+        union dp_gui_master_cntl_u gmc;
+        union dp_mix_u dp_mix;
+        union dp_datatype_u dp_datatype;
+        union dp_cntl_u dp_cntl;
+
+        w100_fifo_wait(4);
+        writel(W100_FB_BASE, remapped_regs + mmDST_OFFSET);
+        writel(par->xres, remapped_regs + mmDST_PITCH);
+        writel(W100_FB_BASE, remapped_regs + mmSRC_OFFSET);
+        writel(par->xres, remapped_regs + mmSRC_PITCH);
+
+        w100_fifo_wait(3);
+        writel(0, remapped_regs + mmSC_TOP_LEFT);
+        writel((par->yres << 16) | par->xres, remapped_regs + mmSC_BOTTOM_RIGHT);
+        writel(0x1fff1fff, remapped_regs + mmSRC_SC_BOTTOM_RIGHT);
+
+        w100_fifo_wait(4);
+        dp_cntl.val = 0;
+        dp_cntl.f.dst_x_dir = 1;
+        dp_cntl.f.dst_y_dir = 1;
+        dp_cntl.f.src_x_dir = 1;
+        dp_cntl.f.src_y_dir = 1;
+        dp_cntl.f.dst_major_x = 1;
+        dp_cntl.f.src_major_x = 1;
+        writel(dp_cntl.val, remapped_regs + mmDP_CNTL);
+
+        gmc.val = 0;
+        gmc.f.gmc_src_pitch_offset_cntl = 1;
+        gmc.f.gmc_dst_pitch_offset_cntl = 1;
+        gmc.f.gmc_src_clipping = 1;
+        gmc.f.gmc_dst_clipping = 1;
+        gmc.f.gmc_brush_datatype = GMC_BRUSH_NONE;
+        gmc.f.gmc_dst_datatype = 3; /* from DstType_16Bpp_444 */
+        gmc.f.gmc_src_datatype = SRC_DATATYPE_EQU_DST;
+        gmc.f.gmc_byte_pix_order = 1;
+        gmc.f.gmc_default_sel = 0;
+        gmc.f.gmc_rop3 = ROP3_SRCCOPY;
+        gmc.f.gmc_dp_src_source = DP_SRC_MEM_RECTANGULAR;
+        gmc.f.gmc_clr_cmp_fcn_dis = 1;
+        gmc.f.gmc_wr_msk_dis = 1;
+        gmc.f.gmc_dp_op = DP_OP_ROP;
+        writel(gmc.val, remapped_regs + mmDP_GUI_MASTER_CNTL);
+
+        dp_datatype.val = dp_mix.val = 0;
+        dp_datatype.f.dp_dst_datatype = gmc.f.gmc_dst_datatype;
+        dp_datatype.f.dp_brush_datatype = gmc.f.gmc_brush_datatype;
+        dp_datatype.f.dp_src2_type = 0;
+        dp_datatype.f.dp_src2_datatype = gmc.f.gmc_src_datatype;
+        dp_datatype.f.dp_src_datatype = gmc.f.gmc_src_datatype;
+        dp_datatype.f.dp_byte_pix_order = gmc.f.gmc_byte_pix_order;
+        writel(dp_datatype.val, remapped_regs + mmDP_DATATYPE);
+
+        dp_mix.f.dp_src_source = gmc.f.gmc_dp_src_source;
+        dp_mix.f.dp_src2_source = 1;
+        dp_mix.f.dp_rop3 = gmc.f.gmc_rop3;
+        dp_mix.f.dp_op = gmc.f.gmc_dp_op;
+        writel(dp_mix.val, remapped_regs + mmDP_MIX);
+}
+
+
+static void w100fb_fillrect(struct fb_info *info,
+                            const struct fb_fillrect *rect)
+{
+        union dp_gui_master_cntl_u gmc;
+
+        if (info->state != FBINFO_STATE_RUNNING)
+                return;
+        if (info->flags & FBINFO_HWACCEL_DISABLED) {
+                cfb_fillrect(info, rect);
+                return;
+        }
+
+        gmc.val = readl(remapped_regs + mmDP_GUI_MASTER_CNTL);
+        gmc.f.gmc_rop3 = ROP3_PATCOPY;
+        gmc.f.gmc_brush_datatype = GMC_BRUSH_SOLID_COLOR;
+        w100_fifo_wait(2);
+        writel(gmc.val, remapped_regs + mmDP_GUI_MASTER_CNTL);
+        writel(rect->color, remapped_regs + mmDP_BRUSH_FRGD_CLR);
+
+        w100_fifo_wait(2);
+        writel((rect->dy << 16) | (rect->dx & 0xffff), remapped_regs + mmDST_Y_X);
+        writel((rect->width << 16) | (rect->height & 0xffff),
+               remapped_regs + mmDST_WIDTH_HEIGHT);
+}
+
+
+static void w100fb_copyarea(struct fb_info *info,
+                            const struct fb_copyarea *area)
+{
+        u32 dx = area->dx, dy = area->dy, sx = area->sx, sy = area->sy;
+        u32 h = area->height, w = area->width;
+        union dp_gui_master_cntl_u gmc;
+
+        if (info->state != FBINFO_STATE_RUNNING)
+                return;
+        if (info->flags & FBINFO_HWACCEL_DISABLED) {
+                cfb_copyarea(info, area);
+                return;
+        }
+
+        gmc.val = readl(remapped_regs + mmDP_GUI_MASTER_CNTL);
+        gmc.f.gmc_rop3 = ROP3_SRCCOPY;
+        gmc.f.gmc_brush_datatype = GMC_BRUSH_NONE;
+        w100_fifo_wait(1);
+        writel(gmc.val, remapped_regs + mmDP_GUI_MASTER_CNTL);
+
+        w100_fifo_wait(3);
+        writel((sy << 16) | (sx & 0xffff), remapped_regs + mmSRC_Y_X);
+        writel((dy << 16) | (dx & 0xffff), remapped_regs + mmDST_Y_X);
+        writel((w << 16) | (h & 0xffff), remapped_regs + mmDST_WIDTH_HEIGHT);
+}
+
+
 /*
  *  Change the resolution by calling the appropriate hardware functions
  */
@@ -265,6 +416,7 @@ static void w100fb_activate_var(struct w100fb_par *par)
         w100_init_lcd(par);
         w100_set_dispregs(par);
         w100_update_enable();
+        w100_init_graphic_engine(par);
 
         calc_hsync(par);
 
@@ -394,9 +546,10 @@ static struct fb_ops w100fb_ops = {
         .fb_set_par   = w100fb_set_par,
         .fb_setcolreg = w100fb_setcolreg,
         .fb_blank     = w100fb_blank,
-        .fb_fillrect  = cfb_fillrect,
-        .fb_copyarea  = cfb_copyarea,
+        .fb_fillrect  = w100fb_fillrect,
+        .fb_copyarea  = w100fb_copyarea,
         .fb_imageblit = cfb_imageblit,
+        .fb_sync      = w100fb_sync,
 };
 
 #ifdef CONFIG_PM
@@ -543,7 +696,8 @@ int __init w100fb_probe(struct platform_device *pdev)
         }
 
         info->fbops = &w100fb_ops;
-        info->flags = FBINFO_DEFAULT;
+        info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
+                FBINFO_HWACCEL_FILLRECT;
         info->node = -1;
         info->screen_base = remapped_fbuf + (W100_FB_BASE-MEM_WINDOW_BASE);
         info->screen_size = REMAPPED_FB_LEN;
diff --git a/drivers/video/w100fb.h b/drivers/video/w100fb.h
index 7a58a1e3e427..fffae7b4f6e9 100644
--- a/drivers/video/w100fb.h
+++ b/drivers/video/w100fb.h
@@ -122,15 +122,32 @@
 /* Block DISPLAY End: */
 
 /* Block GFX Start: */
+#define mmDST_OFFSET          0x1004
+#define mmDST_PITCH           0x1008
+#define mmDST_Y_X             0x1038
+#define mmDST_WIDTH_HEIGHT    0x1198
+#define mmDP_GUI_MASTER_CNTL  0x106C
 #define mmBRUSH_OFFSET        0x108C
 #define mmBRUSH_Y_X           0x1074
+#define mmDP_BRUSH_FRGD_CLR   0x107C
+#define mmSRC_OFFSET          0x11AC
+#define mmSRC_PITCH           0x11B0
+#define mmSRC_Y_X             0x1034
 #define mmDEFAULT_PITCH_OFFSET      0x10A0
 #define mmDEFAULT_SC_BOTTOM_RIGHT   0x10A8
 #define mmDEFAULT2_SC_BOTTOM_RIGHT  0x10AC
+#define mmSC_TOP_LEFT         0x11BC
+#define mmSC_BOTTOM_RIGHT     0x11C0
+#define mmSRC_SC_BOTTOM_RIGHT 0x11C4
 #define mmGLOBAL_ALPHA        0x1210
 #define mmFILTER_COEF         0x1214
 #define mmMVC_CNTL_START      0x11E0
 #define mmE2_ARITHMETIC_CNTL  0x1220
+#define mmDP_CNTL             0x11C8
+#define mmDP_CNTL_DST_DIR     0x11CC
+#define mmDP_DATATYPE         0x12C4
+#define mmDP_MIX              0x12C8
+#define mmDP_WRITE_MSK        0x12CC
 #define mmENG_CNTL            0x13E8
 #define mmENG_PERF_CNT        0x13F0
 /* Block GFX End: */
@@ -179,6 +196,7 @@
 /* Block RBBM Start: */
 #define mmWAIT_UNTIL        0x1400
 #define mmISYNC_CNTL        0x1404
+#define mmRBBM_STATUS       0x0140
 #define mmRBBM_CNTL         0x0144
 #define mmNQWAIT_UNTIL      0x0150
 /* Block RBBM End: */
@@ -225,147 +243,147 @@
 /* Register structure definitions */
 
 struct wrap_top_dir_t {
-        unsigned long top_addr  : 23;
-        unsigned long           : 9;
+        u32 top_addr  : 23;
+        u32           : 9;
 } __attribute__((packed));
 
 union wrap_top_dir_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct wrap_top_dir_t f;
 } __attribute__((packed));
 
 struct wrap_start_dir_t {
-        unsigned long start_addr : 23;
-        unsigned long            : 9;
+        u32 start_addr : 23;
+        u32            : 9;
 } __attribute__((packed));
 
 union wrap_start_dir_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct wrap_start_dir_t f;
 } __attribute__((packed));
 
 struct cif_cntl_t {
-        unsigned long swap_reg                 : 2;
-        unsigned long swap_fbuf_1              : 2;
-        unsigned long swap_fbuf_2              : 2;
-        unsigned long swap_fbuf_3              : 2;
-        unsigned long pmi_int_disable          : 1;
-        unsigned long pmi_schmen_disable       : 1;
-        unsigned long intb_oe                  : 1;
-        unsigned long en_wait_to_compensate_dq_prop_dly  : 1;
-        unsigned long compensate_wait_rd_size  : 2;
-        unsigned long wait_asserted_timeout_val  : 2;
-        unsigned long wait_masked_val          : 2;
-        unsigned long en_wait_timeout          : 1;
-        unsigned long en_one_clk_setup_before_wait  : 1;
-        unsigned long interrupt_active_high    : 1;
-        unsigned long en_overwrite_straps      : 1;
-        unsigned long strap_wait_active_hi     : 1;
-        unsigned long lat_busy_count           : 2;
-        unsigned long lat_rd_pm4_sclk_busy     : 1;
-        unsigned long dis_system_bits          : 1;
-        unsigned long dis_mr                   : 1;
-        unsigned long cif_spare_1              : 4;
+        u32 swap_reg                 : 2;
+        u32 swap_fbuf_1              : 2;
+        u32 swap_fbuf_2              : 2;
+        u32 swap_fbuf_3              : 2;
+        u32 pmi_int_disable          : 1;
+        u32 pmi_schmen_disable       : 1;
+        u32 intb_oe                  : 1;
+        u32 en_wait_to_compensate_dq_prop_dly  : 1;
+        u32 compensate_wait_rd_size  : 2;
+        u32 wait_asserted_timeout_val  : 2;
+        u32 wait_masked_val          : 2;
+        u32 en_wait_timeout          : 1;
+        u32 en_one_clk_setup_before_wait  : 1;
+        u32 interrupt_active_high    : 1;
+        u32 en_overwrite_straps      : 1;
+        u32 strap_wait_active_hi     : 1;
+        u32 lat_busy_count           : 2;
+        u32 lat_rd_pm4_sclk_busy     : 1;
+        u32 dis_system_bits          : 1;
+        u32 dis_mr                   : 1;
+        u32 cif_spare_1              : 4;
 } __attribute__((packed));
 
 union cif_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct cif_cntl_t f;
 } __attribute__((packed));
 
 struct cfgreg_base_t {
-        unsigned long cfgreg_base  : 24;
-        unsigned long              : 8;
+        u32 cfgreg_base  : 24;
+        u32              : 8;
 } __attribute__((packed));
 
 union cfgreg_base_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct cfgreg_base_t f;
 } __attribute__((packed));
 
 struct cif_io_t {
-        unsigned long dq_srp     : 1;
-        unsigned long dq_srn     : 1;
-        unsigned long dq_sp      : 4;
-        unsigned long dq_sn      : 4;
-        unsigned long waitb_srp  : 1;
-        unsigned long waitb_srn  : 1;
-        unsigned long waitb_sp   : 4;
-        unsigned long waitb_sn   : 4;
-        unsigned long intb_srp   : 1;
-        unsigned long intb_srn   : 1;
-        unsigned long intb_sp    : 4;
-        unsigned long intb_sn    : 4;
-        unsigned long            : 2;
+        u32 dq_srp     : 1;
+        u32 dq_srn     : 1;
+        u32 dq_sp      : 4;
+        u32 dq_sn      : 4;
+        u32 waitb_srp  : 1;
+        u32 waitb_srn  : 1;
+        u32 waitb_sp   : 4;
+        u32 waitb_sn   : 4;
+        u32 intb_srp   : 1;
+        u32 intb_srn   : 1;
+        u32 intb_sp    : 4;
+        u32 intb_sn    : 4;
+        u32            : 2;
 } __attribute__((packed));
 
 union cif_io_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct cif_io_t f;
 } __attribute__((packed));
 
 struct cif_read_dbg_t {
-        unsigned long unpacker_pre_fetch_trig_gen  : 2;
-        unsigned long dly_second_rd_fetch_trig     : 1;
-        unsigned long rst_rd_burst_id              : 1;
-        unsigned long dis_rd_burst_id              : 1;
-        unsigned long en_block_rd_when_packer_is_not_emp : 1;
-        unsigned long dis_pre_fetch_cntl_sm        : 1;
-        unsigned long rbbm_chrncy_dis              : 1;
-        unsigned long rbbm_rd_after_wr_lat         : 2;
-        unsigned long dis_be_during_rd             : 1;
-        unsigned long one_clk_invalidate_pulse     : 1;
-        unsigned long dis_chnl_priority            : 1;
-        unsigned long rst_read_path_a_pls          : 1;
-        unsigned long rst_read_path_b_pls          : 1;
-        unsigned long dis_reg_rd_fetch_trig        : 1;
-        unsigned long dis_rd_fetch_trig_from_ind_addr : 1;
-        unsigned long dis_rd_same_byte_to_trig_fetch : 1;
-        unsigned long dis_dir_wrap                 : 1;
-        unsigned long dis_ring_buf_to_force_dec    : 1;
-        unsigned long dis_addr_comp_in_16bit       : 1;
-        unsigned long clr_w                        : 1;
-        unsigned long err_rd_tag_is_3              : 1;
-        unsigned long err_load_when_ful_a          : 1;
-        unsigned long err_load_when_ful_b          : 1;
-        unsigned long                              : 7;
+        u32 unpacker_pre_fetch_trig_gen  : 2;
+        u32 dly_second_rd_fetch_trig     : 1;
+        u32 rst_rd_burst_id              : 1;
+        u32 dis_rd_burst_id              : 1;
+        u32 en_block_rd_when_packer_is_not_emp : 1;
+        u32 dis_pre_fetch_cntl_sm        : 1;
+        u32 rbbm_chrncy_dis              : 1;
+        u32 rbbm_rd_after_wr_lat         : 2;
+        u32 dis_be_during_rd             : 1;
+        u32 one_clk_invalidate_pulse     : 1;
+        u32 dis_chnl_priority            : 1;
+        u32 rst_read_path_a_pls          : 1;
+        u32 rst_read_path_b_pls          : 1;
+        u32 dis_reg_rd_fetch_trig        : 1;
+        u32 dis_rd_fetch_trig_from_ind_addr : 1;
+        u32 dis_rd_same_byte_to_trig_fetch : 1;
+        u32 dis_dir_wrap                 : 1;
+        u32 dis_ring_buf_to_force_dec    : 1;
+        u32 dis_addr_comp_in_16bit       : 1;
+        u32 clr_w                        : 1;
+        u32 err_rd_tag_is_3              : 1;
+        u32 err_load_when_ful_a          : 1;
+        u32 err_load_when_ful_b          : 1;
+        u32                              : 7;
 } __attribute__((packed));
 
 union cif_read_dbg_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct cif_read_dbg_t f;
 } __attribute__((packed));
 
 struct cif_write_dbg_t {
-        unsigned long packer_timeout_count          : 2;
-        unsigned long en_upper_load_cond            : 1;
-        unsigned long en_chnl_change_cond           : 1;
-        unsigned long dis_addr_comp_cond            : 1;
-        unsigned long dis_load_same_byte_addr_cond  : 1;
-        unsigned long dis_timeout_cond              : 1;
-        unsigned long dis_timeout_during_rbbm       : 1;
-        unsigned long dis_packer_ful_during_rbbm_timeout : 1;
-        unsigned long en_dword_split_to_rbbm        : 1;
-        unsigned long en_dummy_val                  : 1;
-        unsigned long dummy_val_sel                 : 1;
-        unsigned long mask_pm4_wrptr_dec            : 1;
-        unsigned long dis_mc_clean_cond             : 1;
-        unsigned long err_two_reqi_during_ful       : 1;
-        unsigned long err_reqi_during_idle_clk      : 1;
-        unsigned long err_global                    : 1;
-        unsigned long en_wr_buf_dbg_load            : 1;
-        unsigned long en_wr_buf_dbg_path            : 1;
-        unsigned long sel_wr_buf_byte               : 3;
-        unsigned long dis_rd_flush_wr               : 1;
-        unsigned long dis_packer_ful_cond           : 1;
-        unsigned long dis_invalidate_by_ops_chnl    : 1;
-        unsigned long en_halt_when_reqi_err         : 1;
-        unsigned long cif_spare_2                   : 5;
-        unsigned long                               : 1;
+        u32 packer_timeout_count          : 2;
+        u32 en_upper_load_cond            : 1;
+        u32 en_chnl_change_cond           : 1;
+        u32 dis_addr_comp_cond            : 1;
+        u32 dis_load_same_byte_addr_cond  : 1;
+        u32 dis_timeout_cond              : 1;
+        u32 dis_timeout_during_rbbm       : 1;
+        u32 dis_packer_ful_during_rbbm_timeout : 1;
+        u32 en_dword_split_to_rbbm        : 1;
+        u32 en_dummy_val                  : 1;
+        u32 dummy_val_sel                 : 1;
+        u32 mask_pm4_wrptr_dec            : 1;
+        u32 dis_mc_clean_cond             : 1;
+        u32 err_two_reqi_during_ful       : 1;
+        u32 err_reqi_during_idle_clk      : 1;
+        u32 err_global                    : 1;
+        u32 en_wr_buf_dbg_load            : 1;
+        u32 en_wr_buf_dbg_path            : 1;
+        u32 sel_wr_buf_byte               : 3;
+        u32 dis_rd_flush_wr               : 1;
+        u32 dis_packer_ful_cond           : 1;
+        u32 dis_invalidate_by_ops_chnl    : 1;
+        u32 en_halt_when_reqi_err         : 1;
+        u32 cif_spare_2                   : 5;
+        u32                               : 1;
 } __attribute__((packed));
 
 union cif_write_dbg_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct cif_write_dbg_t f;
 } __attribute__((packed));
 
@@ -403,327 +421,327 @@ union cpu_defaults_u {
 } __attribute__((packed));
 
 struct crtc_total_t {
-        unsigned long crtc_h_total : 10;
-        unsigned long              : 6;
-        unsigned long crtc_v_total : 10;
-        unsigned long              : 6;
+        u32 crtc_h_total : 10;
+        u32              : 6;
+        u32 crtc_v_total : 10;
+        u32              : 6;
 } __attribute__((packed));
 
 union crtc_total_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct crtc_total_t f;
 } __attribute__((packed));
 
 struct crtc_ss_t {
-        unsigned long ss_start    : 10;
-        unsigned long             : 6;
-        unsigned long ss_end      : 10;
-        unsigned long             : 2;
-        unsigned long ss_align    : 1;
-        unsigned long ss_pol      : 1;
-        unsigned long ss_run_mode : 1;
-        unsigned long ss_en       : 1;
+        u32 ss_start    : 10;
+        u32             : 6;
+        u32 ss_end      : 10;
+        u32             : 2;
+        u32 ss_align    : 1;
+        u32 ss_pol      : 1;
+        u32 ss_run_mode : 1;
+        u32 ss_en       : 1;
 } __attribute__((packed));
 
 union crtc_ss_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct crtc_ss_t f;
 } __attribute__((packed));
 
 struct active_h_disp_t {
-        unsigned long active_h_start  : 10;
-        unsigned long                 : 6;
-        unsigned long active_h_end    : 10;
-        unsigned long                 : 6;
+        u32 active_h_start  : 10;
+        u32                 : 6;
+        u32 active_h_end    : 10;
+        u32                 : 6;
 } __attribute__((packed));
 
 union active_h_disp_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct active_h_disp_t f;
 } __attribute__((packed));
 
 struct active_v_disp_t {
-        unsigned long active_v_start  : 10;
-        unsigned long                 : 6;
-        unsigned long active_v_end    : 10;
-        unsigned long                 : 6;
+        u32 active_v_start  : 10;
+        u32                 : 6;
+        u32 active_v_end    : 10;
+        u32                 : 6;
 } __attribute__((packed));
 
 union active_v_disp_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct active_v_disp_t f;
 } __attribute__((packed));
 
 struct graphic_h_disp_t {
-        unsigned long graphic_h_start : 10;
-        unsigned long                 : 6;
-        unsigned long graphic_h_end   : 10;
-        unsigned long                 : 6;
+        u32 graphic_h_start : 10;
+        u32                 : 6;
+        u32 graphic_h_end   : 10;
+        u32                 : 6;
 } __attribute__((packed));
 
 union graphic_h_disp_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct graphic_h_disp_t f;
 } __attribute__((packed));
 
 struct graphic_v_disp_t {
-        unsigned long graphic_v_start : 10;
-        unsigned long                 : 6;
-        unsigned long graphic_v_end   : 10;
-        unsigned long                 : 6;
+        u32 graphic_v_start : 10;
+        u32                 : 6;
+        u32 graphic_v_end   : 10;
+        u32                 : 6;
 } __attribute__((packed));
 
 union graphic_v_disp_u{
-        unsigned long val : 32;
+        u32 val : 32;
         struct graphic_v_disp_t f;
 } __attribute__((packed));
 
 struct graphic_ctrl_t_w100 {
-        unsigned long color_depth       : 3;
-        unsigned long portrait_mode     : 2;
-        unsigned long low_power_on      : 1;
-        unsigned long req_freq          : 4;
-        unsigned long en_crtc           : 1;
-        unsigned long en_graphic_req    : 1;
-        unsigned long en_graphic_crtc   : 1;
-        unsigned long total_req_graphic : 9;
-        unsigned long lcd_pclk_on       : 1;
-        unsigned long lcd_sclk_on       : 1;
-        unsigned long pclk_running      : 1;
-        unsigned long sclk_running      : 1;
-        unsigned long                   : 6;
+        u32 color_depth       : 3;
+        u32 portrait_mode     : 2;
+        u32 low_power_on      : 1;
+        u32 req_freq          : 4;
+        u32 en_crtc           : 1;
+        u32 en_graphic_req    : 1;
+        u32 en_graphic_crtc   : 1;
+        u32 total_req_graphic : 9;
+        u32 lcd_pclk_on       : 1;
+        u32 lcd_sclk_on       : 1;
+        u32 pclk_running      : 1;
+        u32 sclk_running      : 1;
+        u32                   : 6;
 } __attribute__((packed));
 
 struct graphic_ctrl_t_w32xx {
-        unsigned long color_depth       : 3;
-        unsigned long portrait_mode     : 2;
-        unsigned long low_power_on      : 1;
-        unsigned long req_freq          : 4;
-        unsigned long en_crtc           : 1;
-        unsigned long en_graphic_req    : 1;
-        unsigned long en_graphic_crtc   : 1;
-        unsigned long total_req_graphic : 10;
-        unsigned long lcd_pclk_on       : 1;
-        unsigned long lcd_sclk_on       : 1;
-        unsigned long pclk_running      : 1;
-        unsigned long sclk_running      : 1;
-        unsigned long                   : 5;
+        u32 color_depth       : 3;
+        u32 portrait_mode     : 2;
+        u32 low_power_on      : 1;
+        u32 req_freq          : 4;
+        u32 en_crtc           : 1;
+        u32 en_graphic_req    : 1;
+        u32 en_graphic_crtc   : 1;
+        u32 total_req_graphic : 10;
+        u32 lcd_pclk_on       : 1;
+        u32 lcd_sclk_on       : 1;
+        u32 pclk_running      : 1;
+        u32 sclk_running      : 1;
+        u32                   : 5;
 } __attribute__((packed));
 
 union graphic_ctrl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct graphic_ctrl_t_w100 f_w100;
         struct graphic_ctrl_t_w32xx f_w32xx;
 } __attribute__((packed));
 
 struct video_ctrl_t {
-        unsigned long video_mode       : 1;
-        unsigned long keyer_en         : 1;
-        unsigned long en_video_req     : 1;
-        unsigned long en_graphic_req_video  : 1;
-        unsigned long en_video_crtc    : 1;
-        unsigned long video_hor_exp    : 2;
-        unsigned long video_ver_exp    : 2;
-        unsigned long uv_combine       : 1;
-        unsigned long total_req_video  : 9;
-        unsigned long video_ch_sel     : 1;
-        unsigned long video_portrait   : 2;
-        unsigned long yuv2rgb_en       : 1;
-        unsigned long yuv2rgb_option   : 1;
-        unsigned long video_inv_hor    : 1;
-        unsigned long video_inv_ver    : 1;
-        unsigned long gamma_sel        : 2;
-        unsigned long dis_limit        : 1;
-        unsigned long en_uv_hblend     : 1;
-        unsigned long rgb_gamma_sel    : 2;
+        u32 video_mode       : 1;
+        u32 keyer_en         : 1;
+        u32 en_video_req     : 1;
+        u32 en_graphic_req_video  : 1;
+        u32 en_video_crtc    : 1;
+        u32 video_hor_exp    : 2;
+        u32 video_ver_exp    : 2;
+        u32 uv_combine       : 1;
+        u32 total_req_video  : 9;
+        u32 video_ch_sel     : 1;
+        u32 video_portrait   : 2;
+        u32 yuv2rgb_en       : 1;
+        u32 yuv2rgb_option   : 1;
+        u32 video_inv_hor    : 1;
+        u32 video_inv_ver    : 1;
+        u32 gamma_sel        : 2;
+        u32 dis_limit        : 1;
+        u32 en_uv_hblend     : 1;
+        u32 rgb_gamma_sel    : 2;
 } __attribute__((packed));
 
 union video_ctrl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct video_ctrl_t f;
 } __attribute__((packed));
 
 struct disp_db_buf_cntl_rd_t {
-        unsigned long en_db_buf           : 1;
-        unsigned long update_db_buf_done  : 1;
-        unsigned long db_buf_cntl         : 6;
-        unsigned long                     : 24;
+        u32 en_db_buf           : 1;
+        u32 update_db_buf_done  : 1;
+        u32 db_buf_cntl         : 6;
+        u32                     : 24;
 } __attribute__((packed));
 
 union disp_db_buf_cntl_rd_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct disp_db_buf_cntl_rd_t f;
 } __attribute__((packed));
 
 struct disp_db_buf_cntl_wr_t {
-        unsigned long en_db_buf      : 1;
-        unsigned long update_db_buf  : 1;
-        unsigned long db_buf_cntl    : 6;
-        unsigned long                : 24;
+        u32 en_db_buf      : 1;
+        u32 update_db_buf  : 1;
+        u32 db_buf_cntl    : 6;
+        u32                : 24;
 } __attribute__((packed));
 
 union disp_db_buf_cntl_wr_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct disp_db_buf_cntl_wr_t f;
 } __attribute__((packed));
 
 struct gamma_value1_t {
-        unsigned long gamma1   : 8;
-        unsigned long gamma2   : 8;
-        unsigned long gamma3   : 8;
-        unsigned long gamma4   : 8;
+        u32 gamma1   : 8;
+        u32 gamma2   : 8;
+        u32 gamma3   : 8;
+        u32 gamma4   : 8;
 } __attribute__((packed));
 
 union gamma_value1_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct gamma_value1_t f;
 } __attribute__((packed));
 
 struct gamma_value2_t {
-        unsigned long gamma5   : 8;
-        unsigned long gamma6   : 8;
-        unsigned long gamma7   : 8;
-        unsigned long gamma8   : 8;
+        u32 gamma5   : 8;
+        u32 gamma6   : 8;
+        u32 gamma7   : 8;
+        u32 gamma8   : 8;
 } __attribute__((packed));
 
 union gamma_value2_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct gamma_value2_t f;
 } __attribute__((packed));
 
 struct gamma_slope_t {
-        unsigned long slope1   : 3;
-        unsigned long slope2   : 3;
-        unsigned long slope3   : 3;
-        unsigned long slope4   : 3;
-        unsigned long slope5   : 3;
-        unsigned long slope6   : 3;
-        unsigned long slope7   : 3;
-        unsigned long slope8   : 3;
-        unsigned long          : 8;
+        u32 slope1   : 3;
+        u32 slope2   : 3;
+        u32 slope3   : 3;
+        u32 slope4   : 3;
+        u32 slope5   : 3;
+        u32 slope6   : 3;
+        u32 slope7   : 3;
+        u32 slope8   : 3;
+        u32          : 8;
 } __attribute__((packed));
 
 union gamma_slope_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct gamma_slope_t f;
 } __attribute__((packed));
 
 struct mc_ext_mem_location_t {
-        unsigned long mc_ext_mem_start : 16;
-        unsigned long mc_ext_mem_top   : 16;
+        u32 mc_ext_mem_start : 16;
+        u32 mc_ext_mem_top   : 16;
 } __attribute__((packed));
 
 union mc_ext_mem_location_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct mc_ext_mem_location_t f;
 } __attribute__((packed));
 
 struct mc_fb_location_t {
-        unsigned long mc_fb_start      : 16;
-        unsigned long mc_fb_top        : 16;
+        u32 mc_fb_start      : 16;
+        u32 mc_fb_top        : 16;
 } __attribute__((packed));
 
 union mc_fb_location_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct mc_fb_location_t f;
 } __attribute__((packed));
 
 struct clk_pin_cntl_t {
-        unsigned long osc_en           : 1;
-        unsigned long osc_gain         : 5;
-        unsigned long dont_use_xtalin  : 1;
-        unsigned long xtalin_pm_en     : 1;
-        unsigned long xtalin_dbl_en    : 1;
-        unsigned long                  : 7;
-        unsigned long cg_debug         : 16;
+        u32 osc_en           : 1;
+        u32 osc_gain         : 5;
+        u32 dont_use_xtalin  : 1;
+        u32 xtalin_pm_en     : 1;
+        u32 xtalin_dbl_en    : 1;
+        u32                  : 7;
+        u32 cg_debug         : 16;
 } __attribute__((packed));
 
 union clk_pin_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct clk_pin_cntl_t f;
 } __attribute__((packed));
 
 struct pll_ref_fb_div_t {
-        unsigned long pll_ref_div      : 4;
-        unsigned long                  : 4;
-        unsigned long pll_fb_div_int   : 6;
-        unsigned long                  : 2;
-        unsigned long pll_fb_div_frac  : 3;
-        unsigned long                  : 1;
-        unsigned long pll_reset_time   : 4;
-        unsigned long pll_lock_time    : 8;
+        u32 pll_ref_div      : 4;
+        u32                  : 4;
+        u32 pll_fb_div_int   : 6;
+        u32                  : 2;
+        u32 pll_fb_div_frac  : 3;
+        u32                  : 1;
+        u32 pll_reset_time   : 4;
+        u32 pll_lock_time    : 8;
 } __attribute__((packed));
 
 union pll_ref_fb_div_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct pll_ref_fb_div_t f;
 } __attribute__((packed));
 
 struct pll_cntl_t {
-        unsigned long pll_pwdn        : 1;
-        unsigned long pll_reset       : 1;
-        unsigned long pll_pm_en       : 1;
-        unsigned long pll_mode        : 1;
-        unsigned long pll_refclk_sel  : 1;
-        unsigned long pll_fbclk_sel   : 1;
-        unsigned long pll_tcpoff      : 1;
-        unsigned long pll_pcp         : 3;
-        unsigned long pll_pvg         : 3;
-        unsigned long pll_vcofr       : 1;
-        unsigned long pll_ioffset     : 2;
-        unsigned long pll_pecc_mode   : 2;
-        unsigned long pll_pecc_scon   : 2;
-        unsigned long pll_dactal      : 4;
-        unsigned long pll_cp_clip     : 2;
-        unsigned long pll_conf        : 3;
-        unsigned long pll_mbctrl      : 2;
-        unsigned long pll_ring_off    : 1;
+        u32 pll_pwdn        : 1;
+        u32 pll_reset       : 1;
+        u32 pll_pm_en       : 1;
+        u32 pll_mode        : 1;
+        u32 pll_refclk_sel  : 1;
+        u32 pll_fbclk_sel   : 1;
+        u32 pll_tcpoff      : 1;
+        u32 pll_pcp         : 3;
+        u32 pll_pvg         : 3;
+        u32 pll_vcofr       : 1;
+        u32 pll_ioffset     : 2;
+        u32 pll_pecc_mode   : 2;
+        u32 pll_pecc_scon   : 2;
+        u32 pll_dactal      : 4;
+        u32 pll_cp_clip     : 2;
+        u32 pll_conf        : 3;
+        u32 pll_mbctrl      : 2;
+        u32 pll_ring_off    : 1;
 } __attribute__((packed));
 
 union pll_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct pll_cntl_t f;
 } __attribute__((packed));
 
 struct sclk_cntl_t {
-        unsigned long sclk_src_sel         : 2;
-        unsigned long                      : 2;
-        unsigned long sclk_post_div_fast   : 4;
-        unsigned long sclk_clkon_hys       : 3;
-        unsigned long sclk_post_div_slow   : 4;
-        unsigned long disp_cg_ok2switch_en : 1;
-        unsigned long sclk_force_reg       : 1;
-        unsigned long sclk_force_disp      : 1;
-        unsigned long sclk_force_mc        : 1;
-        unsigned long sclk_force_extmc     : 1;
-        unsigned long sclk_force_cp        : 1;
-        unsigned long sclk_force_e2        : 1;
-        unsigned long sclk_force_e3        : 1;
-        unsigned long sclk_force_idct      : 1;
-        unsigned long sclk_force_bist      : 1;
-        unsigned long busy_extend_cp       : 1;
-        unsigned long busy_extend_e2       : 1;
-        unsigned long busy_extend_e3       : 1;
-        unsigned long busy_extend_idct     : 1;
-        unsigned long                      : 3;
+        u32 sclk_src_sel         : 2;
+        u32                      : 2;
+        u32 sclk_post_div_fast   : 4;
+        u32 sclk_clkon_hys       : 3;
+        u32 sclk_post_div_slow   : 4;
+        u32 disp_cg_ok2switch_en : 1;
+        u32 sclk_force_reg       : 1;
+        u32 sclk_force_disp      : 1;
+        u32 sclk_force_mc        : 1;
+        u32 sclk_force_extmc     : 1;
+        u32 sclk_force_cp        : 1;
+        u32 sclk_force_e2        : 1;
+        u32 sclk_force_e3        : 1;
+        u32 sclk_force_idct      : 1;
+        u32 sclk_force_bist      : 1;
+        u32 busy_extend_cp       : 1;
+        u32 busy_extend_e2       : 1;
+        u32 busy_extend_e3       : 1;
+        u32 busy_extend_idct     : 1;
+        u32                      : 3;
 } __attribute__((packed));
 
 union sclk_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct sclk_cntl_t f;
 } __attribute__((packed));
 
 struct pclk_cntl_t {
-        unsigned long pclk_src_sel     : 2;
-        unsigned long                  : 2;
-        unsigned long pclk_post_div    : 4;
-        unsigned long                  : 8;
-        unsigned long pclk_force_disp  : 1;
-        unsigned long                  : 15;
+        u32 pclk_src_sel     : 2;
+        u32                  : 2;
+        u32 pclk_post_div    : 4;
+        u32                  : 8;
+        u32 pclk_force_disp  : 1;
+        u32                  : 15;
 } __attribute__((packed));
 
 union pclk_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct pclk_cntl_t f;
 } __attribute__((packed));
 
@@ -735,36 +753,176 @@ union pclk_cntl_u {
 #define TESTCLK_SRC_XTAL  0x06
 
 struct clk_test_cntl_t {
-        unsigned long testclk_sel      : 4;
-        unsigned long                  : 3;
-        unsigned long start_check_freq : 1;
-        unsigned long tstcount_rst     : 1;
-        unsigned long                  : 15;
-        unsigned long test_count       : 8;
+        u32 testclk_sel      : 4;
+        u32                  : 3;
+        u32 start_check_freq : 1;
+        u32 tstcount_rst     : 1;
+        u32                  : 15;
+        u32 test_count       : 8;
 } __attribute__((packed));
 
 union clk_test_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct clk_test_cntl_t f;
 } __attribute__((packed));
 
 struct pwrmgt_cntl_t {
-        unsigned long pwm_enable           : 1;
-        unsigned long                      : 1;
-        unsigned long pwm_mode_req         : 2;
-        unsigned long pwm_wakeup_cond      : 2;
-        unsigned long pwm_fast_noml_hw_en  : 1;
-        unsigned long pwm_noml_fast_hw_en  : 1;
-        unsigned long pwm_fast_noml_cond   : 4;
-        unsigned long pwm_noml_fast_cond   : 4;
-        unsigned long pwm_idle_timer       : 8;
-        unsigned long pwm_busy_timer       : 8;
+        u32 pwm_enable           : 1;
+        u32                      : 1;
+        u32 pwm_mode_req         : 2;
+        u32 pwm_wakeup_cond      : 2;
+        u32 pwm_fast_noml_hw_en  : 1;
+        u32 pwm_noml_fast_hw_en  : 1;
+        u32 pwm_fast_noml_cond   : 4;
+        u32 pwm_noml_fast_cond   : 4;
+        u32 pwm_idle_timer       : 8;
+        u32 pwm_busy_timer       : 8;
 } __attribute__((packed));
 
 union pwrmgt_cntl_u {
-        unsigned long val : 32;
+        u32 val : 32;
         struct pwrmgt_cntl_t f;
 } __attribute__((packed));
 
+#define SRC_DATATYPE_EQU_DST    3
+
+#define ROP3_SRCCOPY    0xcc
+#define ROP3_PATCOPY    0xf0
+
+#define GMC_BRUSH_SOLID_COLOR   13
+#define GMC_BRUSH_NONE                  15
+
+#define DP_SRC_MEM_RECTANGULAR  2
+
+#define DP_OP_ROP       0
+
+struct dp_gui_master_cntl_t {
+        u32 gmc_src_pitch_offset_cntl : 1;
+        u32 gmc_dst_pitch_offset_cntl : 1;
+        u32 gmc_src_clipping          : 1;
+        u32 gmc_dst_clipping          : 1;
+        u32 gmc_brush_datatype        : 4;
+        u32 gmc_dst_datatype          : 4;
+        u32 gmc_src_datatype          : 3;
+        u32 gmc_byte_pix_order        : 1;
+        u32 gmc_default_sel           : 1;
+        u32 gmc_rop3                  : 8;
+        u32 gmc_dp_src_source         : 3;
+        u32 gmc_clr_cmp_fcn_dis       : 1;
+        u32                           : 1;
+        u32 gmc_wr_msk_dis            : 1;
+        u32 gmc_dp_op                 : 1;
+} __attribute__((packed));
+
+union dp_gui_master_cntl_u {
+        u32 val : 32;
+        struct dp_gui_master_cntl_t f;
+} __attribute__((packed));
+
+struct rbbm_status_t {
+        u32 cmdfifo_avail   : 7;
+        u32                 : 1;
+        u32 hirq_on_rbb     : 1;
+        u32 cprq_on_rbb     : 1;
+        u32 cfrq_on_rbb     : 1;
+        u32 hirq_in_rtbuf   : 1;
+        u32 cprq_in_rtbuf   : 1;
+        u32 cfrq_in_rtbuf   : 1;
+        u32 cf_pipe_busy    : 1;
+        u32 eng_ev_busy     : 1;
+        u32 cp_cmdstrm_busy : 1;
+        u32 e2_busy         : 1;
+        u32 rb2d_busy       : 1;
+        u32 rb3d_busy       : 1;
+        u32 se_busy         : 1;
+        u32 re_busy         : 1;
+        u32 tam_busy        : 1;
+        u32 tdm_busy        : 1;
+        u32 pb_busy         : 1;
+        u32                 : 6;
+        u32 gui_active      : 1;
+} __attribute__((packed));
+
+union rbbm_status_u {
+        u32 val : 32;
+        struct rbbm_status_t f;
+} __attribute__((packed));
+
+struct dp_datatype_t {
+        u32 dp_dst_datatype   : 4;
+        u32                   : 4;
+        u32 dp_brush_datatype : 4;
+        u32 dp_src2_type      : 1;
+        u32 dp_src2_datatype  : 3;
+        u32 dp_src_datatype   : 3;
+        u32                   : 11;
+        u32 dp_byte_pix_order : 1;
+        u32                   : 1;
+} __attribute__((packed));
+
+union dp_datatype_u {
+        u32 val : 32;
+        struct dp_datatype_t f;
+} __attribute__((packed));
+
+struct dp_mix_t {
+        u32                : 8;
+        u32 dp_src_source  : 3;
+        u32 dp_src2_source : 3;
+        u32                : 2;
+        u32 dp_rop3        : 8;
+        u32 dp_op          : 1;
+        u32                : 7;
+} __attribute__((packed));
+
+union dp_mix_u {
+        u32 val : 32;
+        struct dp_mix_t f;
+} __attribute__((packed));
+
+struct eng_cntl_t {
+        u32 erc_reg_rd_ws            : 1;
+        u32 erc_reg_wr_ws            : 1;
+        u32 erc_idle_reg_wr          : 1;
+        u32 dis_engine_triggers      : 1;
+        u32 dis_rop_src_uses_dst_w_h : 1;
+        u32 dis_src_uses_dst_dirmaj  : 1;
+        u32                          : 6;
+        u32 force_3dclk_when_2dclk   : 1;
+        u32                          : 19;
+} __attribute__((packed));
+
+union eng_cntl_u {
+        u32 val : 32;
+        struct eng_cntl_t f;
+} __attribute__((packed));
+
+struct dp_cntl_t {
+        u32 dst_x_dir   : 1;
+        u32 dst_y_dir   : 1;
+        u32 src_x_dir   : 1;
+        u32 src_y_dir   : 1;
+        u32 dst_major_x : 1;
+        u32 src_major_x : 1;
+        u32             : 26;
+} __attribute__((packed));
+
+union dp_cntl_u {
+        u32 val : 32;
+        struct dp_cntl_t f;
+} __attribute__((packed));
+
+struct dp_cntl_dst_dir_t {
+        u32           : 15;
+        u32 dst_y_dir : 1;
+        u32           : 15;
+        u32 dst_x_dir : 1;
+} __attribute__((packed));
+
+union dp_cntl_dst_dir_u {
+        u32 val : 32;
+        struct dp_cntl_dst_dir_t f;
+} __attribute__((packed));
+
 #endif
 
diff --git a/fs/Makefile b/fs/Makefile
index f3a4f7077175..83bf478e786b 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -10,7 +10,7 @@ obj-y :=	open.o read_write.o file_table.o buffer.o  bio.o super.o \
                 ioctl.o readdir.o select.o fifo.o locks.o dcache.o inode.o \
                 attr.o bad_inode.o file.o filesystems.o namespace.o aio.o \
                 seq_file.o xattr.o libfs.o fs-writeback.o mpage.o direct-io.o \
-                ioprio.o pnode.o drop_caches.o splice.o
+                ioprio.o pnode.o drop_caches.o splice.o sync.o
 
 obj-$(CONFIG_INOTIFY)           += inotify.o
 obj-$(CONFIG_EPOLL)             += eventpoll.o
diff --git a/fs/char_dev.c b/fs/char_dev.c
index 4e1b849f912f..f3418f7a6e9d 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/smp_lock.h>
 #include <linux/devfs_fs_kernel.h>
+#include <linux/seq_file.h>
 
 #include <linux/kobject.h>
 #include <linux/kobj_map.h>
@@ -27,8 +28,6 @@
 
 static struct kobj_map *cdev_map;
 
-#define MAX_PROBE_HASH 255      /* random */
-
 static DEFINE_MUTEX(chrdevs_lock);
 
 static struct char_device_struct {
@@ -39,93 +38,29 @@ static struct char_device_struct {
         char name[64];
         struct file_operations *fops;
         struct cdev *cdev;              /* will die */
-} *chrdevs[MAX_PROBE_HASH];
+} *chrdevs[CHRDEV_MAJOR_HASH_SIZE];
 
 /* index in the above */
 static inline int major_to_index(int major)
 {
-        return major % MAX_PROBE_HASH;
-}
-
-struct chrdev_info {
-        int index;
-        struct char_device_struct *cd;
-};
-
-void *get_next_chrdev(void *dev)
-{
-        struct chrdev_info *info;
-
-        if (dev == NULL) {
-                info = kmalloc(sizeof(*info), GFP_KERNEL);
-                if (!info)
-                        goto out;
-                info->index=0;
-                info->cd = chrdevs[info->index];
-                if (info->cd)
-                        goto out;
-        } else {
-                info = dev;
-        }
-
-        while (info->index < ARRAY_SIZE(chrdevs)) {
-                if (info->cd)
-                        info->cd = info->cd->next;
-                if (info->cd)
-                        goto out;
-                /*
-                 * No devices on this chain, move to the next
-                 */
-                info->index++;
-                info->cd = (info->index < ARRAY_SIZE(chrdevs)) ?
-                        chrdevs[info->index] : NULL;
-                if (info->cd)
-                        goto out;
-        }
-
-out:
-        return info;
-}
-
-void *acquire_chrdev_list(void)
-{
-        mutex_lock(&chrdevs_lock);
-        return get_next_chrdev(NULL);
-}
-
-void release_chrdev_list(void *dev)
-{
-        mutex_unlock(&chrdevs_lock);
-        kfree(dev);
+        return major % CHRDEV_MAJOR_HASH_SIZE;
 }
 
+#ifdef CONFIG_PROC_FS
 
-int count_chrdev_list(void)
+void chrdev_show(struct seq_file *f, off_t offset)
 {
         struct char_device_struct *cd;
-        int i, count;
-
-        count = 0;
 
-        for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
-                for (cd = chrdevs[i]; cd; cd = cd->next)
-                        count++;
+        if (offset < CHRDEV_MAJOR_HASH_SIZE) {
+                mutex_lock(&chrdevs_lock);
+                for (cd = chrdevs[offset]; cd; cd = cd->next)
+                        seq_printf(f, "%3d %s\n", cd->major, cd->name);
+                mutex_unlock(&chrdevs_lock);
         }
-
-        return count;
 }
 
-int get_chrdev_info(void *dev, int *major, char **name)
-{
-        struct chrdev_info *info = dev;
-
-        if (info->cd == NULL)
-                return 1;
-
-        *major = info->cd->major;
-        *name = info->cd->name;
-        return 0;
-}
+#endif /* CONFIG_PROC_FS */
 
 /*
  * Register a single major with a specified minor range.
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index cb68efba35db..8a2de038882e 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,21 @@
+Version 1.42
+------------
+Fix slow oplock break when mounted to different servers at the same time and
+the tids match and we try to find matching fid on wrong server.
+
+Version 1.41
+------------
+Fix NTLMv2 security (can be enabled in /proc/fs/cifs) so customers can
+configure stronger authentication.  Fix sfu symlinks so they can
+be followed (not just recognized).  Fix wraparound of bcc on
+read responses when buffer size over 64K and also fix wrap of
+max smb buffer size when CIFSMaxBufSize over 64K.  Fix oops in
+cifs_user_read and cifs_readpages (when EAGAIN on send of smb
+on socket is returned over and over).  Add POSIX (advisory) byte range
+locking support (requires server with newest CIFS UNIX Extensions
+to the protocol implemented). Slow down negprot slightly in port 139
+RFC1001 case to give session_init time on buggy servers.
+
 Version 1.40
 ------------
 Use fsuid (fsgid) more consistently instead of uid (gid). Improve performance
diff --git a/fs/cifs/Makefile b/fs/cifs/Makefile
index 7384947a0f93..58c77254a23b 100644
--- a/fs/cifs/Makefile
+++ b/fs/cifs/Makefile
@@ -3,4 +3,4 @@
 #
 obj-$(CONFIG_CIFS) += cifs.o
 
-cifs-objs := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o readdir.o ioctl.o
+cifs-objs := cifsfs.o cifssmb.o cifs_debug.o connect.o dir.o file.o inode.o link.o misc.o netmisc.o smbdes.o smbencrypt.o transport.o asn1.o md4.o md5.o cifs_unicode.o nterr.o xattr.o cifsencrypt.o fcntl.o readdir.o ioctl.o ntlmssp.o
diff --git a/fs/cifs/README b/fs/cifs/README
index b0070d1b149d..b2b4d0803761 100644
--- a/fs/cifs/README
+++ b/fs/cifs/README
@@ -422,6 +422,13 @@ A partial list of the supported mount options follows:
  nomapchars     Do not translate any of these seven characters (default).
  nocase         Request case insensitive path name matching (case
                 sensitive is the default if the server suports it).
+ posixpaths     If CIFS Unix extensions are supported, attempt to
+                negotiate posix path name support which allows certain
+                characters forbidden in typical CIFS filenames, without
+                requiring remapping. (default)
+ noposixpaths   If CIFS Unix extensions are supported, do not request
+                posix path name support (this may cause servers to
+                reject creatingfile with certain reserved characters).
  nobrl          Do not send byte range lock requests to the server.
                 This is necessary for certain applications that break
                 with cifs style mandatory byte range locks (and most
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index a2c24858d40f..e7d63737e651 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsencrypt.c
  *
- *   Copyright (C) International Business Machines  Corp., 2005
+ *   Copyright (C) International Business Machines  Corp., 2005,2006
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -36,7 +36,8 @@
 extern void mdfour(unsigned char *out, unsigned char *in, int n);
 extern void E_md4hash(const unsigned char *passwd, unsigned char *p16);
         
-static int cifs_calculate_signature(const struct smb_hdr * cifs_pdu, const char * key, char * signature)
+static int cifs_calculate_signature(const struct smb_hdr * cifs_pdu, 
+                                    const char * key, char * signature)
 {
         struct  MD5Context context;
 
@@ -56,9 +57,6 @@ int cifs_sign_smb(struct smb_hdr * cifs_pdu, struct TCP_Server_Info * server,
         int rc = 0;
         char smb_signature[20];
 
-        /* BB remember to initialize sequence number elsewhere and initialize mac_signing key elsewhere BB */
-        /* BB remember to add code to save expected sequence number in midQ entry BB */
-
         if((cifs_pdu == NULL) || (server == NULL))
                 return -EINVAL;
 
@@ -85,20 +83,33 @@ int cifs_sign_smb(struct smb_hdr * cifs_pdu, struct TCP_Server_Info * server,
 static int cifs_calc_signature2(const struct kvec * iov, int n_vec,
                                 const char * key, char * signature)
 {
-        struct  MD5Context context;
-
-        if((iov == NULL) || (signature == NULL))
-                return -EINVAL;
+        struct  MD5Context context;
+        int i;
 
-        MD5Init(&context);
-        MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
+        if((iov == NULL) || (signature == NULL))
+                return -EINVAL;
 
-/*        MD5Update(&context,cifs_pdu->Protocol,cifs_pdu->smb_buf_length); */ /* BB FIXME BB */
+        MD5Init(&context);
+        MD5Update(&context,key,CIFS_SESSION_KEY_SIZE+16);
+        for(i=0;i<n_vec;i++) {
+                if(iov[i].iov_base == NULL) {
+                        cERROR(1,("null iovec entry"));
+                        return -EIO;
+                } else if(iov[i].iov_len == 0)
+                        break; /* bail out if we are sent nothing to sign */
+                /* The first entry includes a length field (which does not get 
+                   signed that occupies the first 4 bytes before the header */
+                if(i==0) {
+                        if (iov[0].iov_len <= 8 ) /* cmd field at offset 9 */
+                                break; /* nothing to sign or corrupt header */
+                        MD5Update(&context,iov[0].iov_base+4, iov[0].iov_len-4);
+                } else
+                        MD5Update(&context,iov[i].iov_base, iov[i].iov_len);
+        }
 
-        MD5Final(signature,&context);
+        MD5Final(signature,&context);
 
-        return -EOPNOTSUPP;
-/*        return 0; */
+        return 0;
 }
 
 
@@ -259,4 +270,5 @@ void CalcNTLMv2_response(const struct cifsSesInfo * ses,char * v2_session_respon
 /*      hmac_md5_update(v2_session_response+16)client thing,8,&context); */ /* BB fix */
 
         hmac_md5_final(v2_session_response,&context);
+        cifs_dump_mem("v2_sess_rsp: ", v2_session_response, 32); /* BB removeme BB */
 }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 4bbc544857bc..d4b713e5affb 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -93,13 +93,10 @@ cifs_read_super(struct super_block *sb, void *data,
         int rc = 0;
 
         sb->s_flags |= MS_NODIRATIME; /* and probably even noatime */
-        sb->s_fs_info = kmalloc(sizeof(struct cifs_sb_info),GFP_KERNEL);
+        sb->s_fs_info = kzalloc(sizeof(struct cifs_sb_info),GFP_KERNEL);
         cifs_sb = CIFS_SB(sb);
         if(cifs_sb == NULL)
                 return -ENOMEM;
-        else
-                memset(cifs_sb,0,sizeof(struct cifs_sb_info));
-        
 
         rc = cifs_mount(sb, cifs_sb, data, devname);
 
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 74f405ae4da3..4e829dc672a6 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -99,5 +99,5 @@ extern ssize_t	cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t  cifs_listxattr(struct dentry *, char *, size_t);
 extern int cifs_ioctl (struct inode * inode, struct file * filep,
                        unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.40"
+#define CIFS_VERSION   "1.42"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 7bed27601ce5..006eb33bff5f 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsglob.h
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2005
+ *   Copyright (C) International Business Machines  Corp., 2002,2006
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -430,6 +430,15 @@ struct dir_notify_req {
 #define   CIFS_LARGE_BUFFER     2
 #define   CIFS_IOVEC            4    /* array of response buffers */
 
+/* Type of session setup needed */
+#define   CIFS_PLAINTEXT        0
+#define   CIFS_LANMAN           1
+#define   CIFS_NTLM             2
+#define   CIFS_NTLMSSP_NEG      3
+#define   CIFS_NTLMSSP_AUTH     4
+#define   CIFS_SPNEGO_INIT      5
+#define   CIFS_SPNEGO_TARG      6
+
 /*
  *****************************************************************
  * All constants go here
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index cc2471094ca5..b2233ac05bd2 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -859,7 +859,10 @@ typedef struct smb_com_lock_req {
         LOCKING_ANDX_RANGE Locks[1];
 } __attribute__((packed)) LOCK_REQ;
 
-
+/* lock type */
+#define CIFS_RDLCK      0
+#define CIFS_WRLCK      1
+#define CIFS_UNLCK      2
 typedef struct cifs_posix_lock {
         __le16  lock_type;  /* 0 = Read, 1 = Write, 2 = Unlock */
         __le16  lock_flags; /* 1 = Wait (only valid for setlock) */
@@ -1786,7 +1789,13 @@ typedef struct {
 #define CIFS_UNIX_POSIX_ACL_CAP         0x00000002 /* support getfacl/setfacl */
 #define CIFS_UNIX_XATTR_CAP             0x00000004 /* support new namespace   */
 #define CIFS_UNIX_EXTATTR_CAP           0x00000008 /* support chattr/chflag   */
-#define CIFS_UNIX_POSIX_PATHNAMES_CAP   0x00000010 /* Use POSIX pathnames on the wire. */
+#define CIFS_UNIX_POSIX_PATHNAMES_CAP   0x00000010 /* Allow POSIX path chars  */
+#ifdef CONFIG_CIFS_POSIX
+#define CIFS_UNIX_CAP_MASK              0x0000001b
+#else 
+#define CIFS_UNIX_CAP_MASK              0x00000013
+#endif /* CONFIG_CIFS_POSIX */
+
 
 #define CIFS_POSIX_EXTENSIONS           0x00000010 /* support for new QFSInfo */
 
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 7b25463d3c14..2879ba343ca7 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifsproto.h
  *
- *   Copyright (c) International Business Machines  Corp., 2002,2005
+ *   Copyright (c) International Business Machines  Corp., 2002,2006
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -64,6 +64,14 @@ extern int map_smb_to_linux_error(struct smb_hdr *smb);
 extern void header_assemble(struct smb_hdr *, char /* command */ ,
                             const struct cifsTconInfo *, int /* length of
                             fixed section (word count) in two byte units */);
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+extern int small_smb_init_no_tc(const int smb_cmd, const int wct,
+                                struct cifsSesInfo *ses,
+                                void ** request_buf);
+extern int CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses,
+                             const int stage, int * pNTLMv2_flg,
+                             const struct nls_table *nls_cp);
+#endif
 extern __u16 GetNextMid(struct TCP_Server_Info *server);
 extern struct oplock_q_entry * AllocOplockQEntry(struct inode *, u16, 
                                                  struct cifsTconInfo *);
@@ -257,7 +265,10 @@ extern int CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
                         const __u64 offset, const __u32 numUnlock,
                         const __u32 numLock, const __u8 lockType,
                         const int waitFlag);
-
+extern int CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
+                        const __u16 smb_file_id, const int get_flag,
+                        const __u64 len, const __u64 offset, 
+                        const __u16 lock_type, const int waitFlag);
 extern int CIFSSMBTDis(const int xid, struct cifsTconInfo *tcon);
 extern int CIFSSMBLogoff(const int xid, struct cifsSesInfo *ses);
 
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index a243fe2792d5..d705500aa283 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/cifssmb.c
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2005
+ *   Copyright (C) International Business Machines  Corp., 2002,2006
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   Contains the routines for constructing the SMB PDUs themselves
@@ -186,7 +186,35 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 cifs_stats_inc(&tcon->num_smbs_sent);
 
         return rc;
-}  
+}
+
+#ifdef CONFIG_CIFS_EXPERIMENTAL  
+int
+small_smb_init_no_tc(const int smb_command, const int wct, 
+                     struct cifsSesInfo *ses, void **request_buf)
+{
+        int rc;
+        struct smb_hdr * buffer;
+
+        rc = small_smb_init(smb_command, wct, NULL, request_buf);
+        if(rc)
+                return rc;
+
+        buffer = (struct smb_hdr *)*request_buf;
+        buffer->Mid = GetNextMid(ses->server);
+        if (ses->capabilities & CAP_UNICODE)
+                buffer->Flags2 |= SMBFLG2_UNICODE;
+        if (ses->capabilities & CAP_STATUS32)
+                buffer->Flags2 |= SMBFLG2_ERR_STATUS;
+
+        /* uid, tid can stay at zero as set in header assemble */
+
+        /* BB add support for turning on the signing when 
+        this function is used after 1st of session setup requests */
+
+        return rc;
+}
+#endif  /* CONFIG_CIFS_EXPERIMENTAL */
 
 /* If the return code is zero, this function must fill in request_buf pointer */
 static int
@@ -1042,7 +1070,7 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon,
                 }
         }
 
-        cifs_small_buf_release(pSMB);
+/*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         if(*buf) {
                 if(resp_buf_type == CIFS_SMALL_BUFFER)
                         cifs_small_buf_release(iov[0].iov_base);
@@ -1246,7 +1274,7 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
                 *nbytes += le16_to_cpu(pSMBr->Count);
         } 
 
-        cifs_small_buf_release(pSMB);
+/*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         if(resp_buf_type == CIFS_SMALL_BUFFER)
                 cifs_small_buf_release(iov[0].iov_base);
         else if(resp_buf_type == CIFS_LARGE_BUFFER)
@@ -1325,6 +1353,85 @@ CIFSSMBLock(const int xid, struct cifsTconInfo *tcon,
 }
 
 int
+CIFSSMBPosixLock(const int xid, struct cifsTconInfo *tcon,
+                const __u16 smb_file_id, const int get_flag, const __u64 len,
+                const __u64 lkoffset, const __u16 lock_type, const int waitFlag)
+{
+        struct smb_com_transaction2_sfi_req *pSMB  = NULL;
+        struct smb_com_transaction2_sfi_rsp *pSMBr = NULL;
+        char *data_offset;
+        struct cifs_posix_lock *parm_data;
+        int rc = 0;
+        int bytes_returned = 0;
+        __u16 params, param_offset, offset, byte_count, count;
+
+        cFYI(1, ("Posix Lock"));
+        rc = small_smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB);
+
+        if (rc)
+                return rc;
+
+        pSMBr = (struct smb_com_transaction2_sfi_rsp *)pSMB;
+
+        params = 6; 
+        pSMB->MaxSetupCount = 0;
+        pSMB->Reserved = 0;
+        pSMB->Flags = 0;
+        pSMB->Timeout = 0;
+        pSMB->Reserved2 = 0;
+        param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
+        offset = param_offset + params;
+
+        data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
+
+        count = sizeof(struct cifs_posix_lock);
+        pSMB->MaxParameterCount = cpu_to_le16(2);
+        pSMB->MaxDataCount = cpu_to_le16(1000); /* BB find max SMB PDU from sess */
+        pSMB->SetupCount = 1;
+        pSMB->Reserved3 = 0;
+        if(get_flag)
+                pSMB->SubCommand = cpu_to_le16(TRANS2_QUERY_FILE_INFORMATION);
+        else
+                pSMB->SubCommand = cpu_to_le16(TRANS2_SET_FILE_INFORMATION);
+        byte_count = 3 /* pad */  + params + count;
+        pSMB->DataCount = cpu_to_le16(count);
+        pSMB->ParameterCount = cpu_to_le16(params);
+        pSMB->TotalDataCount = pSMB->DataCount;
+        pSMB->TotalParameterCount = pSMB->ParameterCount;
+        pSMB->ParameterOffset = cpu_to_le16(param_offset);
+        parm_data = (struct cifs_posix_lock *) 
+                        (((char *) &pSMB->hdr.Protocol) + offset);
+
+        parm_data->lock_type = cpu_to_le16(lock_type);
+        if(waitFlag)
+                parm_data->lock_flags = 1;
+        parm_data->pid = cpu_to_le32(current->tgid);
+        parm_data->start = lkoffset;
+        parm_data->length = len;  /* normalize negative numbers */
+
+        pSMB->DataOffset = cpu_to_le16(offset);
+        pSMB->Fid = smb_file_id;
+        pSMB->InformationLevel = cpu_to_le16(SMB_SET_POSIX_LOCK);
+        pSMB->Reserved4 = 0;
+        pSMB->hdr.smb_buf_length += byte_count;
+        pSMB->ByteCount = cpu_to_le16(byte_count);
+        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
+                        (struct smb_hdr *) pSMBr, &bytes_returned, 0);
+        if (rc) {
+                cFYI(1, ("Send error in Posix Lock = %d", rc));
+        }
+
+        if (pSMB)
+                cifs_small_buf_release(pSMB);
+
+        /* Note: On -EAGAIN error only caller can retry on handle based calls
+           since file handle passed in no longer valid */
+
+        return rc;
+}
+
+
+int
 CIFSSMBClose(const int xid, struct cifsTconInfo *tcon, int smb_file_id)
 {
         int rc = 0;
@@ -2578,7 +2685,7 @@ qsec_out:
                 cifs_small_buf_release(iov[0].iov_base);
         else if(buf_type == CIFS_LARGE_BUFFER)
                 cifs_buf_release(iov[0].iov_base);
-        cifs_small_buf_release(pSMB);
+/*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         return rc;
 }
 
@@ -2954,7 +3061,8 @@ findFirstRetry:
         pSMB->TotalParameterCount = cpu_to_le16(params);
         pSMB->ParameterCount = pSMB->TotalParameterCount;
         pSMB->ParameterOffset = cpu_to_le16(
-          offsetof(struct smb_com_transaction2_ffirst_req, SearchAttributes) - 4);
+              offsetof(struct smb_com_transaction2_ffirst_req, SearchAttributes)
+                - 4);
         pSMB->DataCount = 0;
         pSMB->DataOffset = 0;
         pSMB->SetupCount = 1;   /* one byte, no need to make endian neutral */
@@ -2977,12 +3085,12 @@ findFirstRetry:
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
         cifs_stats_inc(&tcon->num_ffirst);
 
-        if (rc) {/* BB add logic to retry regular search if Unix search rejected unexpectedly by server */
+        if (rc) {/* BB add logic to retry regular search if Unix search
+                        rejected unexpectedly by server */
                 /* BB Add code to handle unsupported level rc */
                 cFYI(1, ("Error in FindFirst = %d", rc));
 
-                if (pSMB)
-                        cifs_buf_release(pSMB);
+                cifs_buf_release(pSMB);
 
                 /* BB eventually could optimize out free and realloc of buf */
                 /*    for this case */
@@ -2998,6 +3106,7 @@ findFirstRetry:
                                 psrch_inf->unicode = FALSE;
 
                         psrch_inf->ntwrk_buf_start = (char *)pSMBr;
+                        psrch_inf->smallBuf = 0;
                         psrch_inf->srch_entries_start = 
                                 (char *) &pSMBr->hdr.Protocol + 
                                         le16_to_cpu(pSMBr->t2.DataOffset);
@@ -3118,9 +3227,14 @@ int CIFSFindNext(const int xid, struct cifsTconInfo *tcon,
                         parms = (T2_FNEXT_RSP_PARMS *)response_data;
                         response_data = (char *)&pSMBr->hdr.Protocol +
                                 le16_to_cpu(pSMBr->t2.DataOffset);
-                        cifs_buf_release(psrch_inf->ntwrk_buf_start);
+                        if(psrch_inf->smallBuf)
+                                cifs_small_buf_release(
+                                        psrch_inf->ntwrk_buf_start);
+                        else
+                                cifs_buf_release(psrch_inf->ntwrk_buf_start);
                         psrch_inf->srch_entries_start = response_data;
                         psrch_inf->ntwrk_buf_start = (char *)pSMB;
+                        psrch_inf->smallBuf = 0;
                         if(parms->EndofSearch)
                                 psrch_inf->endOfSearch = TRUE;
                         else
@@ -3834,6 +3948,7 @@ CIFSSMBSetFSUnixInfo(const int xid, struct cifsTconInfo *tcon, __u64 cap)
 
         cFYI(1, ("In SETFSUnixInfo"));
 SETFSUnixRetry:
+        /* BB switch to small buf init to save memory */
         rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
                       (void **) &pSMBr);
         if (rc)
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 2a0c1f4ca0ae..0b86d5ca9014 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/connect.c
  *
- *   Copyright (C) International Business Machines  Corp., 2002,2005
+ *   Copyright (C) International Business Machines  Corp., 2002,2006
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
@@ -564,7 +564,7 @@ cifs_demultiplex_thread(struct TCP_Server_Info *server)
         
 
                 dump_smb(smb_buffer, length);
-                if (checkSMB (smb_buffer, smb_buffer->Mid, total_read+4)) {
+                if (checkSMB(smb_buffer, smb_buffer->Mid, total_read+4)) {
                         cifs_dump_mem("Bad SMB: ", smb_buffer, 48);
                         continue;
                 }
@@ -1476,6 +1476,14 @@ ipv4_connect(struct sockaddr_in *psin_server, struct socket **csocket,
                         rc = smb_send(*csocket, smb_buf, 0x44,
                                 (struct sockaddr *)psin_server);
                         kfree(ses_init_buf);
+                        msleep(1); /* RFC1001 layer in at least one server 
+                                      requires very short break before negprot
+                                      presumably because not expecting negprot
+                                      to follow so fast.  This is a simple
+                                      solution that works without 
+                                      complicating the code and causes no
+                                      significant slowing down on mount
+                                      for everyone else */
                 }
                 /* else the negprot may still work without this 
                 even though malloc failed */
@@ -1920,27 +1928,34 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 cifs_sb->tcon = tcon;
                 tcon->ses = pSesInfo;
 
-                /* do not care if following two calls succeed - informational only */
+                /* do not care if following two calls succeed - informational */
                 CIFSSMBQFSDeviceInfo(xid, tcon);
                 CIFSSMBQFSAttributeInfo(xid, tcon);
+
                 if (tcon->ses->capabilities & CAP_UNIX) {
                         if(!CIFSSMBQFSUnixInfo(xid, tcon)) {
-                                if(!volume_info.no_psx_acl) {
-                                        if(CIFS_UNIX_POSIX_ACL_CAP & 
-                                           le64_to_cpu(tcon->fsUnixInfo.Capability))
-                                                cFYI(1,("server negotiated posix acl support"));
-                                                sb->s_flags |= MS_POSIXACL;
+                                __u64 cap = 
+                                       le64_to_cpu(tcon->fsUnixInfo.Capability);
+                                cap &= CIFS_UNIX_CAP_MASK;
+                                if(volume_info.no_psx_acl)
+                                        cap &= ~CIFS_UNIX_POSIX_ACL_CAP;
+                                else if(CIFS_UNIX_POSIX_ACL_CAP & cap) {
+                                        cFYI(1,("negotiated posix acl support"));
+                                        sb->s_flags |= MS_POSIXACL;
                                 }
 
-                                /* Try and negotiate POSIX pathnames if we can. */
-                                if (volume_info.posix_paths && (CIFS_UNIX_POSIX_PATHNAMES_CAP &
-                                    le64_to_cpu(tcon->fsUnixInfo.Capability))) {
-                                        if (!CIFSSMBSetFSUnixInfo(xid, tcon, CIFS_UNIX_POSIX_PATHNAMES_CAP))  {
-                                                cFYI(1,("negotiated posix pathnames support"));
-                                                cifs_sb->mnt_cifs_flags |= CIFS_MOUNT_POSIX_PATHS;
-                                        } else {
-                                                cFYI(1,("posix pathnames support requested but not supported"));
-                                        }
+                                if(volume_info.posix_paths == 0)
+                                        cap &= ~CIFS_UNIX_POSIX_PATHNAMES_CAP;
+                                else if(cap & CIFS_UNIX_POSIX_PATHNAMES_CAP) {
+                                        cFYI(1,("negotiate posix pathnames"));
+                                        cifs_sb->mnt_cifs_flags |= 
+                                                CIFS_MOUNT_POSIX_PATHS;
+                                }
+                                        
+                                cFYI(1,("Negotiate caps 0x%x",(int)cap));
+
+                                if (CIFSSMBSetFSUnixInfo(xid, tcon, cap)) {
+                                        cFYI(1,("setting capabilities failed"));
                                 }
                         }
                 }
@@ -2278,6 +2293,8 @@ CIFSSpnegoSessSetup(unsigned int xid, struct cifsSesInfo *ses,
         smb_buffer->Mid = GetNextMid(ses->server);
         pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
         pSMB->req.AndXCommand = 0xFF;
+        if(ses->server->maxBuf > 64*1024)
+                ses->server->maxBuf = (64*1023);
         pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
         pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
 
@@ -2525,7 +2542,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
         __u32 negotiate_flags, capabilities;
         __u16 count;
 
-        cFYI(1, ("In NTLMSSP sesssetup (negotiate) "));
+        cFYI(1, ("In NTLMSSP sesssetup (negotiate)"));
         if(ses == NULL)
                 return -EINVAL;
         domain = ses->domainName;
@@ -2575,7 +2592,8 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
         SecurityBlob->MessageType = NtLmNegotiate;
         negotiate_flags =
             NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM |
-            NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM | 0x80000000 |
+            NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_NTLM |
+            NTLMSSP_NEGOTIATE_56 |
             /* NTLMSSP_NEGOTIATE_ALWAYS_SIGN | */ NTLMSSP_NEGOTIATE_128;
         if(sign_CIFS_PDUs)
                 negotiate_flags |= NTLMSSP_NEGOTIATE_SIGN;
@@ -2588,26 +2606,11 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
         SecurityBlob->WorkstationName.Length = 0;
         SecurityBlob->WorkstationName.MaximumLength = 0;
 
-        if (domain == NULL) {
-                SecurityBlob->DomainName.Buffer = 0;
-                SecurityBlob->DomainName.Length = 0;
-                SecurityBlob->DomainName.MaximumLength = 0;
-        } else {
-                __u16 len;
-                negotiate_flags |= NTLMSSP_NEGOTIATE_DOMAIN_SUPPLIED;
-                strncpy(bcc_ptr, domain, 63);
-                len = strnlen(domain, 64);
-                SecurityBlob->DomainName.MaximumLength =
-                    cpu_to_le16(len);
-                SecurityBlob->DomainName.Buffer =
-                    cpu_to_le32((long) &SecurityBlob->
-                                DomainString -
-                                (long) &SecurityBlob->Signature);
-                bcc_ptr += len;
-                SecurityBlobLength += len;
-                SecurityBlob->DomainName.Length =
-                    cpu_to_le16(len);
-        }
+        /* Domain not sent on first Sesssetup in NTLMSSP, instead it is sent
+        along with username on auth request (ie the response to challenge) */
+        SecurityBlob->DomainName.Buffer = 0;
+        SecurityBlob->DomainName.Length = 0;
+        SecurityBlob->DomainName.MaximumLength = 0;
         if (ses->capabilities & CAP_UNICODE) {
                 if ((long) bcc_ptr % 2) {
                         *bcc_ptr = 0;
@@ -2677,7 +2680,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                               SecurityBlob2->MessageType));
                 } else if (ses) {
                         ses->Suid = smb_buffer_response->Uid; /* UID left in le format */ 
-                        cFYI(1, ("UID = %d ", ses->Suid));
+                        cFYI(1, ("UID = %d", ses->Suid));
                         if ((pSMBr->resp.hdr.WordCount == 3)
                             || ((pSMBr->resp.hdr.WordCount == 4)
                                 && (blob_len <
@@ -2685,17 +2688,17 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
 
                                 if (pSMBr->resp.hdr.WordCount == 4) {
                                         bcc_ptr += blob_len;
-                                        cFYI(1,
-                                             ("Security Blob Length %d ",
+                                        cFYI(1, ("Security Blob Length %d",
                                               blob_len));
                                 }
 
-                                cFYI(1, ("NTLMSSP Challenge rcvd "));
+                                cFYI(1, ("NTLMSSP Challenge rcvd"));
 
                                 memcpy(ses->server->cryptKey,
                                        SecurityBlob2->Challenge,
                                        CIFS_CRYPTO_KEY_SIZE);
-                                if(SecurityBlob2->NegotiateFlags & cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
+                                if(SecurityBlob2->NegotiateFlags & 
+                                        cpu_to_le32(NTLMSSP_NEGOTIATE_NTLMV2))
                                         *pNTLMv2_flag = TRUE;
 
                                 if((SecurityBlob2->NegotiateFlags & 
@@ -2818,7 +2821,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                                                 bcc_ptr++;
                                         } else
                                                 cFYI(1,
-                                                     ("Variable field of length %d extends beyond end of smb ",
+                                                     ("Variable field of length %d extends beyond end of smb",
                                                       len));
                                 }
                         } else {
@@ -2830,7 +2833,7 @@ CIFSNTLMSSPNegotiateSessSetup(unsigned int xid,
                 }
         } else {
                 cERROR(1,
-                       (" Invalid Word count %d: ",
+                       (" Invalid Word count %d:",
                         smb_buffer_response->WordCount));
                 rc = -EIO;
         }
@@ -3447,7 +3450,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                 if (extended_security
                                 && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
                                 && (pSesInfo->server->secType == NTLMSSP)) {
-                        cFYI(1, ("New style sesssetup "));
+                        cFYI(1, ("New style sesssetup"));
                         rc = CIFSSpnegoSessSetup(xid, pSesInfo,
                                 NULL /* security blob */, 
                                 0 /* blob length */,
@@ -3455,7 +3458,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                 } else if (extended_security
                            && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
                            && (pSesInfo->server->secType == RawNTLMSSP)) {
-                        cFYI(1, ("NTLMSSP sesssetup "));
+                        cFYI(1, ("NTLMSSP sesssetup"));
                         rc = CIFSNTLMSSPNegotiateSessSetup(xid,
                                                 pSesInfo,
                                                 &ntlmv2_flag,
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 632561dd9c50..1d0ca3eaaca5 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -48,13 +48,14 @@ build_path_from_dentry(struct dentry *direntry)
         struct dentry *temp;
         int namelen = 0;
         char *full_path;
-        char dirsep = CIFS_DIR_SEP(CIFS_SB(direntry->d_sb));
+        char dirsep;
 
         if(direntry == NULL)
                 return NULL;  /* not much we can do if dentry is freed and
                 we need to reopen the file after it was closed implicitly
                 when the server crashed */
 
+        dirsep = CIFS_DIR_SEP(CIFS_SB(direntry->d_sb));
 cifs_bp_rename_retry:
         for (temp = direntry; !IS_ROOT(temp);) {
                 namelen += (1 + temp->d_name.len);
@@ -255,12 +256,10 @@ cifs_create(struct inode *inode, struct dentry *direntry, int mode,
                         CIFSSMBClose(xid, pTcon, fileHandle);
                 } else if(newinode) {
                         pCifsFile =
-                           kmalloc(sizeof (struct cifsFileInfo), GFP_KERNEL);
+                           kzalloc(sizeof (struct cifsFileInfo), GFP_KERNEL);
                         
                         if(pCifsFile == NULL)
                                 goto cifs_create_out;
-                        memset((char *)pCifsFile, 0,
-                               sizeof (struct cifsFileInfo));
                         pCifsFile->netfid = fileHandle;
                         pCifsFile->pid = current->tgid;
                         pCifsFile->pInode = newinode;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index fb49aef1f2ec..5c497c529772 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -555,7 +555,10 @@ int cifs_closedir(struct inode *inode, struct file *file)
                 if (ptmp) {
                         cFYI(1, ("closedir free smb buf in srch struct"));
                         pCFileStruct->srch_inf.ntwrk_buf_start = NULL;
-                        cifs_buf_release(ptmp);
+                        if(pCFileStruct->srch_inf.smallBuf)
+                                cifs_small_buf_release(ptmp);
+                        else
+                                cifs_buf_release(ptmp);
                 }
                 ptmp = pCFileStruct->search_resume_name;
                 if (ptmp) {
@@ -574,13 +577,14 @@ int cifs_closedir(struct inode *inode, struct file *file)
 int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
 {
         int rc, xid;
-        __u32 lockType = LOCKING_ANDX_LARGE_FILES;
         __u32 numLock = 0;
         __u32 numUnlock = 0;
         __u64 length;
         int wait_flag = FALSE;
         struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *pTcon;
+        __u16 netfid;
+        __u8 lockType = LOCKING_ANDX_LARGE_FILES;
 
         length = 1 + pfLock->fl_end - pfLock->fl_start;
         rc = -EACCES;
@@ -592,11 +596,11 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                 pfLock->fl_end));
 
         if (pfLock->fl_flags & FL_POSIX)
-                cFYI(1, ("Posix "));
+                cFYI(1, ("Posix"));
         if (pfLock->fl_flags & FL_FLOCK)
-                cFYI(1, ("Flock "));
+                cFYI(1, ("Flock"));
         if (pfLock->fl_flags & FL_SLEEP) {
-                cFYI(1, ("Blocking lock "));
+                cFYI(1, ("Blocking lock"));
                 wait_flag = TRUE;
         }
         if (pfLock->fl_flags & FL_ACCESS)
@@ -612,21 +616,23 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                 cFYI(1, ("F_WRLCK "));
                 numLock = 1;
         } else if (pfLock->fl_type == F_UNLCK) {
-                cFYI(1, ("F_UNLCK "));
+                cFYI(1, ("F_UNLCK"));
                 numUnlock = 1;
+                /* Check if unlock includes more than
+                one lock range */
         } else if (pfLock->fl_type == F_RDLCK) {
-                cFYI(1, ("F_RDLCK "));
+                cFYI(1, ("F_RDLCK"));
                 lockType |= LOCKING_ANDX_SHARED_LOCK;
                 numLock = 1;
         } else if (pfLock->fl_type == F_EXLCK) {
-                cFYI(1, ("F_EXLCK "));
+                cFYI(1, ("F_EXLCK"));
                 numLock = 1;
         } else if (pfLock->fl_type == F_SHLCK) {
-                cFYI(1, ("F_SHLCK "));
+                cFYI(1, ("F_SHLCK"));
                 lockType |= LOCKING_ANDX_SHARED_LOCK;
                 numLock = 1;
         } else
-                cFYI(1, ("Unknown type of lock "));
+                cFYI(1, ("Unknown type of lock"));
 
         cifs_sb = CIFS_SB(file->f_dentry->d_sb);
         pTcon = cifs_sb->tcon;
@@ -635,27 +641,41 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                 FreeXid(xid);
                 return -EBADF;
         }
+        netfid = ((struct cifsFileInfo *)file->private_data)->netfid;
+
 
+        /* BB add code here to normalize offset and length to
+        account for negative length which we can not accept over the
+        wire */
         if (IS_GETLK(cmd)) {
-                rc = CIFSSMBLock(xid, pTcon,
-                                 ((struct cifsFileInfo *)file->
-                                  private_data)->netfid,
-                                 length,
-                                 pfLock->fl_start, 0, 1, lockType,
-                                 0 /* wait flag */ );
+                if(experimEnabled && 
+                   (cifs_sb->tcon->ses->capabilities & CAP_UNIX) &&
+                   (CIFS_UNIX_FCNTL_CAP & 
+                        le64_to_cpu(cifs_sb->tcon->fsUnixInfo.Capability))) {
+                        int posix_lock_type;
+                        if(lockType & LOCKING_ANDX_SHARED_LOCK)
+                                posix_lock_type = CIFS_RDLCK;
+                        else
+                                posix_lock_type = CIFS_WRLCK;
+                        rc = CIFSSMBPosixLock(xid, pTcon, netfid, 1 /* get */,
+                                        length, pfLock->fl_start,
+                                        posix_lock_type, wait_flag);
+                        FreeXid(xid);
+                        return rc;
+                }
+
+                /* BB we could chain these into one lock request BB */
+                rc = CIFSSMBLock(xid, pTcon, netfid, length, pfLock->fl_start,
+                                 0, 1, lockType, 0 /* wait flag */ );
                 if (rc == 0) {
-                        rc = CIFSSMBLock(xid, pTcon,
-                                         ((struct cifsFileInfo *) file->
-                                          private_data)->netfid,
-                                         length,
+                        rc = CIFSSMBLock(xid, pTcon, netfid, length, 
                                          pfLock->fl_start, 1 /* numUnlock */ ,
                                          0 /* numLock */ , lockType,
                                          0 /* wait flag */ );
                         pfLock->fl_type = F_UNLCK;
                         if (rc != 0)
                                 cERROR(1, ("Error unlocking previously locked "
-                                           "range %d during test of lock ",
-                                           rc));
+                                           "range %d during test of lock", rc));
                         rc = 0;
 
                 } else {
@@ -667,12 +687,30 @@ int cifs_lock(struct file *file, int cmd, struct file_lock *pfLock)
                 FreeXid(xid);
                 return rc;
         }
-
-        rc = CIFSSMBLock(xid, pTcon,
-                         ((struct cifsFileInfo *) file->private_data)->
-                         netfid, length,
-                         pfLock->fl_start, numUnlock, numLock, lockType,
-                         wait_flag);
+        if (experimEnabled &&
+                (cifs_sb->tcon->ses->capabilities & CAP_UNIX) &&
+                (CIFS_UNIX_FCNTL_CAP &
+                         le64_to_cpu(cifs_sb->tcon->fsUnixInfo.Capability))) {
+                int posix_lock_type;
+                if(lockType & LOCKING_ANDX_SHARED_LOCK)
+                        posix_lock_type = CIFS_RDLCK;
+                else
+                        posix_lock_type = CIFS_WRLCK;
+                
+                if(numUnlock == 1)
+                        posix_lock_type = CIFS_UNLCK;
+                else if(numLock == 0) {
+                        /* if no lock or unlock then nothing
+                        to do since we do not know what it is */
+                        FreeXid(xid);
+                        return -EOPNOTSUPP;
+                }
+                rc = CIFSSMBPosixLock(xid, pTcon, netfid, 0 /* set */,
+                                      length, pfLock->fl_start,
+                                      posix_lock_type, wait_flag);
+        } else
+                rc = CIFSSMBLock(xid, pTcon, netfid, length, pfLock->fl_start,
+                                numUnlock, numLock, lockType, wait_flag);
         if (pfLock->fl_flags & FL_POSIX)
                 posix_lock_file_wait(file, pfLock);
         FreeXid(xid);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 598eec9778f6..957ddd1571c6 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -565,11 +565,14 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
         struct cifsInodeInfo *cifsInode;
         FILE_BASIC_INFO *pinfo_buf;
 
-        cFYI(1, ("cifs_unlink, inode = 0x%p with ", inode));
+        cFYI(1, ("cifs_unlink, inode = 0x%p", inode));
 
         xid = GetXid();
 
-        cifs_sb = CIFS_SB(inode->i_sb);
+        if(inode)
+                cifs_sb = CIFS_SB(inode->i_sb);
+        else
+                cifs_sb = CIFS_SB(direntry->d_sb);
         pTcon = cifs_sb->tcon;
 
         /* Unlink can be called from rename so we can not grab the sem here
@@ -609,9 +612,8 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                 }
         } else if (rc == -EACCES) {
                 /* try only if r/o attribute set in local lookup data? */
-                pinfo_buf = kmalloc(sizeof(FILE_BASIC_INFO), GFP_KERNEL);
+                pinfo_buf = kzalloc(sizeof(FILE_BASIC_INFO), GFP_KERNEL);
                 if (pinfo_buf) {
-                        memset(pinfo_buf, 0, sizeof(FILE_BASIC_INFO));
                         /* ATTRS set to normal clears r/o bit */
                         pinfo_buf->Attributes = cpu_to_le32(ATTR_NORMAL);
                         if (!(pTcon->ses->flags & CIFS_SES_NT4))
@@ -693,9 +695,11 @@ int cifs_unlink(struct inode *inode, struct dentry *direntry)
                                            when needed */
                 direntry->d_inode->i_ctime = current_fs_time(inode->i_sb);
         }
-        inode->i_ctime = inode->i_mtime = current_fs_time(inode->i_sb);
-        cifsInode = CIFS_I(inode);
-        cifsInode->time = 0;    /* force revalidate of dir as well */
+        if(inode) {
+                inode->i_ctime = inode->i_mtime = current_fs_time(inode->i_sb);
+                cifsInode = CIFS_I(inode);
+                cifsInode->time = 0;    /* force revalidate of dir as well */
+        }
 
         kfree(full_path);
         FreeXid(xid);
@@ -1167,7 +1171,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                                                 nfid, npid, FALSE);
                         atomic_dec(&open_file->wrtPending);
                         cFYI(1,("SetFSize for attrs rc = %d", rc));
-                        if(rc == -EINVAL) {
+                        if((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
                                 int bytes_written;
                                 rc = CIFSSMBWrite(xid, pTcon,
                                                   nfid, 0, attrs->ia_size,
@@ -1189,7 +1193,7 @@ int cifs_setattr(struct dentry *direntry, struct iattr *attrs)
                                            cifs_sb->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                         cFYI(1, ("SetEOF by path (setattrs) rc = %d", rc));
-                        if(rc == -EINVAL) {
+                        if((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
                                 __u16 netfid;
                                 int oplock = FALSE;
 
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index 8d0da7c87c7b..9562f5bba65c 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -67,7 +67,7 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode,
                                         cifs_sb_target->local_nls, 
                                         cifs_sb_target->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
-                if(rc == -EIO)
+                if((rc == -EIO) || (rc == -EINVAL))
                         rc = -EOPNOTSUPP;  
         }
 
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 432ba15e2c2d..fafd056426e4 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -72,10 +72,9 @@ sesInfoAlloc(void)
         struct cifsSesInfo *ret_buf;
 
         ret_buf =
-            (struct cifsSesInfo *) kmalloc(sizeof (struct cifsSesInfo),
+            (struct cifsSesInfo *) kzalloc(sizeof (struct cifsSesInfo),
                                            GFP_KERNEL);
         if (ret_buf) {
-                memset(ret_buf, 0, sizeof (struct cifsSesInfo));
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&sesInfoAllocCount);
                 ret_buf->status = CifsNew;
@@ -110,10 +109,9 @@ tconInfoAlloc(void)
 {
         struct cifsTconInfo *ret_buf;
         ret_buf =
-            (struct cifsTconInfo *) kmalloc(sizeof (struct cifsTconInfo),
+            (struct cifsTconInfo *) kzalloc(sizeof (struct cifsTconInfo),
                                             GFP_KERNEL);
         if (ret_buf) {
-                memset(ret_buf, 0, sizeof (struct cifsTconInfo));
                 write_lock(&GlobalSMBSeslock);
                 atomic_inc(&tconInfoAllocCount);
                 list_add(&ret_buf->cifsConnectionList,
@@ -423,9 +421,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
 {
         __u32 len = smb->smb_buf_length;
         __u32 clc_len;  /* calculated length */
-        cFYI(0,
-             ("Entering checkSMB with Length: %x, smb_buf_length: %x",
-              length, len));
+        cFYI(0, ("checkSMB Length: 0x%x, smb_buf_length: 0x%x", length, len));
         if (((unsigned int)length < 2 + sizeof (struct smb_hdr)) ||
             (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)) {
                 if ((unsigned int)length < 2 + sizeof (struct smb_hdr)) {
@@ -433,29 +429,36 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
                                 sizeof (struct smb_hdr) - 1)
                             && (smb->Status.CifsError != 0)) {
                                 smb->WordCount = 0;
-                                return 0;       /* some error cases do not return wct and bcc */
+                                /* some error cases do not return wct and bcc */
+                                return 0;
                         } else {
                                 cERROR(1, ("Length less than smb header size"));
                         }
-
                 }
                 if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
-                        cERROR(1,
-                               ("smb_buf_length greater than MaxBufSize"));
-                cERROR(1,
-                       ("bad smb detected. Illegal length. mid=%d",
-                        smb->Mid));
+                        cERROR(1, ("smb length greater than MaxBufSize, mid=%d",
+                                   smb->Mid));
                 return 1;
         }
 
         if (checkSMBhdr(smb, mid))
                 return 1;
         clc_len = smbCalcSize_LE(smb);
-        if ((4 + len != clc_len)
-            || (4 + len != (unsigned int)length)) {
-                cERROR(1, ("Calculated size 0x%x vs actual length 0x%x",
-                                clc_len, 4 + len));
-                cERROR(1, ("bad smb size detected for Mid=%d", smb->Mid));
+
+        if(4 + len != (unsigned int)length) {
+                cERROR(1, ("Length read does not match RFC1001 length %d",len));
+                return 1;
+        }
+
+        if (4 + len != clc_len) {
+                /* check if bcc wrapped around for large read responses */
+                if((len > 64 * 1024) && (len > clc_len)) {
+                        /* check if lengths match mod 64K */
+                        if(((4 + len) & 0xFFFF) == (clc_len & 0xFFFF))
+                                return 0; /* bcc wrapped */                     
+                }
+                cFYI(1, ("Calculated size %d vs length %d mismatch for mid %d",
+                                clc_len, 4 + len, smb->Mid));
                 /* Windows XP can return a few bytes too much, presumably
                 an illegal pad, at the end of byte range lock responses 
                 so we allow for that three byte pad, as long as actual
@@ -469,8 +472,11 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
                 wct and bcc to minimum size and drop the t2 parms and data */
                 if((4+len > clc_len) && (len <= clc_len + 512))
                         return 0;
-                else
+                else {
+                        cERROR(1, ("RFC1001 size %d bigger than SMB for Mid=%d",
+                                        len, smb->Mid));
                         return 1;
+                }
         }
         return 0;
 }
diff --git a/fs/cifs/ntlmssp.c b/fs/cifs/ntlmssp.c
new file mode 100644
index 000000000000..78866f925747
--- /dev/null
+++ b/fs/cifs/ntlmssp.c
@@ -0,0 +1,129 @@
+/*
+ *   fs/cifs/ntlmssp.h
+ *
+ *   Copyright (c) International Business Machines  Corp., 2006
+ *   Author(s): Steve French (sfrench@us.ibm.com)
+ *
+ *   This library is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU Lesser General Public License as published
+ *   by the Free Software Foundation; either version 2.1 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This library is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
+ *   the GNU Lesser General Public License for more details.
+ *
+ *   You should have received a copy of the GNU Lesser General Public License
+ *   along with this library; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#include "cifspdu.h"
+#include "cifsglob.h"
+#include "cifsproto.h"
+#include "cifs_unicode.h"
+#include "cifs_debug.h"
+#include "ntlmssp.h"
+#include "nterr.h"
+
+#ifdef CONFIG_CIFS_EXPERIMENTAL
+static __u32 cifs_ssetup_hdr(struct cifsSesInfo *ses, SESSION_SETUP_ANDX *pSMB)
+{
+        __u32 capabilities = 0;
+
+        /* init fields common to all four types of SessSetup */
+        /* note that header is initialized to zero in header_assemble */
+        pSMB->req.AndXCommand = 0xFF;
+        pSMB->req.MaxBufferSize = cpu_to_le16(ses->server->maxBuf);
+        pSMB->req.MaxMpxCount = cpu_to_le16(ses->server->maxReq);
+
+        /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
+
+        /* BB verify whether signing required on neg or just on auth frame 
+           (and NTLM case) */
+
+        capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
+                        CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
+
+        if(ses->server->secMode & (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
+
+        if (ses->capabilities & CAP_UNICODE) {
+                pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
+                capabilities |= CAP_UNICODE;
+        }
+        if (ses->capabilities & CAP_STATUS32) {
+                pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
+                capabilities |= CAP_STATUS32;
+        }
+        if (ses->capabilities & CAP_DFS) {
+                pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
+                capabilities |= CAP_DFS;
+        }
+
+        /* BB check whether to init vcnum BB */
+        return capabilities;
+}
+int 
+CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, const int type,
+                  int * pNTLMv2_flg, const struct nls_table *nls_cp)
+{
+        int rc = 0;
+        int wct;
+        struct smb_hdr *smb_buffer;
+        char *bcc_ptr;
+        SESSION_SETUP_ANDX *pSMB;
+        __u32 capabilities;
+
+        if(ses == NULL)
+                return -EINVAL;
+
+        cFYI(1,("SStp type: %d",type));
+        if(type < CIFS_NTLM) {
+#ifndef CONFIG_CIFS_WEAK_PW_HASH
+                /* LANMAN and plaintext are less secure and off by default.
+                So we make this explicitly be turned on in kconfig (in the
+                build) and turned on at runtime (changed from the default)
+                in proc/fs/cifs or via mount parm.  Unfortunately this is
+                needed for old Win (e.g. Win95), some obscure NAS and OS/2 */
+                return -EOPNOTSUPP;
+#endif
+                wct = 10; /* lanman 2 style sessionsetup */
+        } else if(type < CIFS_NTLMSSP_NEG)
+                wct = 13; /* old style NTLM sessionsetup */
+        else /* same size for negotiate or auth, NTLMSSP or extended security */
+                wct = 12;
+
+        rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
+                            (void **)&smb_buffer);
+        if(rc)
+                return rc;
+
+        pSMB = (SESSION_SETUP_ANDX *)smb_buffer;
+
+        capabilities = cifs_ssetup_hdr(ses, pSMB);
+        bcc_ptr = pByteArea(smb_buffer);
+        if(type > CIFS_NTLM) {
+                pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
+                capabilities |= CAP_EXTENDED_SECURITY;
+                pSMB->req.Capabilities = cpu_to_le32(capabilities);
+                /* BB set password lengths */
+        } else if(type < CIFS_NTLM) /* lanman */ {
+                /* no capabilities flags in old lanman negotiation */
+                /* pSMB->old_req.PasswordLength = */ /* BB fixme BB */
+        } else /* type CIFS_NTLM */ {
+                pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
+                pSMB->req_no_secext.CaseInsensitivePasswordLength =
+                        cpu_to_le16(CIFS_SESSION_KEY_SIZE);
+                pSMB->req_no_secext.CaseSensitivePasswordLength =
+                        cpu_to_le16(CIFS_SESSION_KEY_SIZE);
+        }
+
+
+/*      rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buf_type, 0); */
+        /* SMB request buf freed in SendReceive2 */
+
+        return rc;
+}
+#endif /* CONFIG_CIFS_EXPERIMENTAL */
diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
index 803389b64a2c..d39b712a11c5 100644
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -1,7 +1,7 @@
 /*
  *   fs/cifs/ntlmssp.h
  *
- *   Copyright (c) International Business Machines  Corp., 2002
+ *   Copyright (c) International Business Machines  Corp., 2002,2006
  *   Author(s): Steve French (sfrench@us.ibm.com)
  *
  *   This library is free software; you can redistribute it and/or modify
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 488bd0d81dcf..2f6e2825571e 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -604,7 +604,12 @@ static int find_cifs_entry(const int xid, struct cifsTconInfo *pTcon,
                 cifsFile->search_resume_name = NULL;
                 if(cifsFile->srch_inf.ntwrk_buf_start) {
                         cFYI(1,("freeing SMB ff cache buf on search rewind"));
-                        cifs_buf_release(cifsFile->srch_inf.ntwrk_buf_start);
+                        if(cifsFile->srch_inf.smallBuf)
+                                cifs_small_buf_release(cifsFile->srch_inf.
+                                                ntwrk_buf_start);
+                        else
+                                cifs_buf_release(cifsFile->srch_inf.
+                                                ntwrk_buf_start);
                 }
                 rc = initiate_cifs_search(xid,file);
                 if(rc) {
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b12cb8a7da7c..3da80409466c 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -309,17 +309,16 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         
         *pRespBufType = CIFS_NO_BUFFER;  /* no response buf yet */
 
-        if (ses == NULL) {
-                cERROR(1,("Null smb session"));
-                return -EIO;
-        }
-        if(ses->server == NULL) {
-                cERROR(1,("Null tcp session"));
+        if ((ses == NULL) || (ses->server == NULL)) {
+                cifs_small_buf_release(in_buf);
+                cERROR(1,("Null session"));
                 return -EIO;
         }
 
-        if(ses->server->tcpStatus == CifsExiting)
+        if(ses->server->tcpStatus == CifsExiting) {
+                cifs_small_buf_release(in_buf);
                 return -ENOENT;
+        }
 
         /* Ensure that we do not send more than 50 overlapping requests 
            to the same server. We may make this configurable later or
@@ -346,6 +345,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                         } else {
                                 if(ses->server->tcpStatus == CifsExiting) {
                                         spin_unlock(&GlobalMid_Lock);
+                                        cifs_small_buf_release(in_buf);
                                         return -ENOENT;
                                 }
 
@@ -385,6 +385,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         midQ = AllocMidQEntry(in_buf, ses);
         if (midQ == NULL) {
                 up(&ses->server->tcpSem);
+                cifs_small_buf_release(in_buf);
                 /* If not lock req, update # of requests on wire to server */
                 if(long_op < 3) {
                         atomic_dec(&ses->server->inFlight); 
@@ -408,14 +409,18 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         if(rc < 0) {
                 DeleteMidQEntry(midQ);
                 up(&ses->server->tcpSem);
+                cifs_small_buf_release(in_buf);
                 /* If not lock req, update # of requests on wire to server */
                 if(long_op < 3) {
                         atomic_dec(&ses->server->inFlight); 
                         wake_up(&ses->server->request_q);
                 }
                 return rc;
-        } else
+        } else {
                 up(&ses->server->tcpSem);
+                cifs_small_buf_release(in_buf);
+        }
+
         if (long_op == -1)
                 goto cifs_no_response_exit2;
         else if (long_op == 2) /* writes past end of file can take loong time */
@@ -543,6 +548,7 @@ cifs_no_response_exit2:
 
 out_unlock2:
         up(&ses->server->tcpSem);
+        cifs_small_buf_release(in_buf);
         /* If not lock req, update # of requests on wire to server */
         if(long_op < 3) {
                 atomic_dec(&ses->server->inFlight); 
diff --git a/fs/dcache.c b/fs/dcache.c
index 19458d399502..940d188e5d14 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1101,6 +1101,32 @@ next:
 }
 
 /**
+ * d_hash_and_lookup - hash the qstr then search for a dentry
+ * @dir: Directory to search in
+ * @name: qstr of name we wish to find
+ *
+ * On hash failure or on lookup failure NULL is returned.
+ */
+struct dentry *d_hash_and_lookup(struct dentry *dir, struct qstr *name)
+{
+        struct dentry *dentry = NULL;
+
+        /*
+         * Check for a fs-specific hash function. Note that we must
+         * calculate the standard hash first, as the d_op->d_hash()
+         * routine may choose to leave the hash value unchanged.
+         */
+        name->hash = full_name_hash(name->name, name->len);
+        if (dir->d_op && dir->d_op->d_hash) {
+                if (dir->d_op->d_hash(dir, name) < 0)
+                        goto out;
+        }
+        dentry = d_lookup(dir, name);
+out:
+        return dentry;
+}
+
+/**
  * d_validate - verify dentry provided from insecure source
  * @dentry: The dentry alleged to be valid child of @dparent
  * @dparent: The parent dentry (known to be valid)
@@ -1172,11 +1198,11 @@ void d_delete(struct dentry * dentry)
         spin_lock(&dentry->d_lock);
         isdir = S_ISDIR(dentry->d_inode->i_mode);
         if (atomic_read(&dentry->d_count) == 1) {
-                /* remove this and other inotify debug checks after 2.6.18 */
-                dentry->d_flags &= ~DCACHE_INOTIFY_PARENT_WATCHED;
-
                 dentry_iput(dentry);
                 fsnotify_nameremove(dentry, isdir);
+
+                /* remove this and other inotify debug checks after 2.6.18 */
+                dentry->d_flags &= ~DCACHE_INOTIFY_PARENT_WATCHED;
                 return;
         }
 
@@ -1616,26 +1642,12 @@ ino_t find_inode_number(struct dentry *dir, struct qstr *name)
         struct dentry * dentry;
         ino_t ino = 0;
 
-        /*
-         * Check for a fs-specific hash function. Note that we must
-         * calculate the standard hash first, as the d_op->d_hash()
-         * routine may choose to leave the hash value unchanged.
-         */
-        name->hash = full_name_hash(name->name, name->len);
-        if (dir->d_op && dir->d_op->d_hash)
-        {
-                if (dir->d_op->d_hash(dir, name) != 0)
-                        goto out;
-        }
-
-        dentry = d_lookup(dir, name);
-        if (dentry)
-        {
+        dentry = d_hash_and_lookup(dir, name);
+        if (dentry) {
                 if (dentry->d_inode)
                         ino = dentry->d_inode->i_ino;
                 dput(dentry);
         }
-out:
         return ino;
 }
 
diff --git a/fs/hppfs/hppfs_kern.c b/fs/hppfs/hppfs_kern.c
index 2ba20cdb5baa..5e6363be246f 100644
--- a/fs/hppfs/hppfs_kern.c
+++ b/fs/hppfs/hppfs_kern.c
@@ -216,10 +216,10 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
 static struct inode_operations hppfs_file_iops = {
 };
 
-static ssize_t read_proc(struct file *file, char *buf, ssize_t count,
+static ssize_t read_proc(struct file *file, char __user *buf, ssize_t count,
                          loff_t *ppos, int is_user)
 {
-        ssize_t (*read)(struct file *, char *, size_t, loff_t *);
+        ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
         ssize_t n;
 
         read = file->f_dentry->d_inode->i_fop->read;
@@ -236,7 +236,7 @@ static ssize_t read_proc(struct file *file, char *buf, ssize_t count,
         return n;
 }
 
-static ssize_t hppfs_read_file(int fd, char *buf, ssize_t count)
+static ssize_t hppfs_read_file(int fd, char __user *buf, ssize_t count)
 {
         ssize_t n;
         int cur, err;
@@ -274,7 +274,7 @@ static ssize_t hppfs_read_file(int fd, char *buf, ssize_t count)
         return n;
 }
 
-static ssize_t hppfs_read(struct file *file, char *buf, size_t count,
+static ssize_t hppfs_read(struct file *file, char __user *buf, size_t count,
                           loff_t *ppos)
 {
         struct hppfs_private *hppfs = file->private_data;
@@ -313,12 +313,12 @@ static ssize_t hppfs_read(struct file *file, char *buf, size_t count,
         return(count);
 }
 
-static ssize_t hppfs_write(struct file *file, const char *buf, size_t len,
+static ssize_t hppfs_write(struct file *file, const char __user *buf, size_t len,
                            loff_t *ppos)
 {
         struct hppfs_private *data = file->private_data;
         struct file *proc_file = data->proc_file;
-        ssize_t (*write)(struct file *, const char *, size_t, loff_t *);
+        ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
         int err;
 
         write = proc_file->f_dentry->d_inode->i_fop->write;
@@ -658,7 +658,7 @@ static struct super_operations hppfs_sbops = {
         .statfs         = hppfs_statfs,
 };
 
-static int hppfs_readlink(struct dentry *dentry, char *buffer, int buflen)
+static int hppfs_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
         struct file *proc_file;
         struct dentry *proc_dentry;
diff --git a/fs/locks.c b/fs/locks.c
index 4d9e71d43e7e..dda83d6cd48b 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -168,18 +168,9 @@ static void locks_release_private(struct file_lock *fl)
 /* Free a lock which is not in use. */
 static void locks_free_lock(struct file_lock *fl)
 {
-        if (fl == NULL) {
-                BUG();
-                return;
-        }
-        if (waitqueue_active(&fl->fl_wait))
-                panic("Attempting to free lock with active wait queue");
-
-        if (!list_empty(&fl->fl_block))
-                panic("Attempting to free lock with active block list");
-
-        if (!list_empty(&fl->fl_link))
-                panic("Attempting to free lock on active lock list");
+        BUG_ON(waitqueue_active(&fl->fl_wait));
+        BUG_ON(!list_empty(&fl->fl_block));
+        BUG_ON(!list_empty(&fl->fl_link));
 
         locks_release_private(fl);
         kmem_cache_free(filelock_cache, fl);
@@ -735,8 +726,9 @@ EXPORT_SYMBOL(posix_locks_deadlock);
  * at the head of the list, but that's secret knowledge known only to
  * flock_lock_file and posix_lock_file.
  */
-static int flock_lock_file(struct file *filp, struct file_lock *new_fl)
+static int flock_lock_file(struct file *filp, struct file_lock *request)
 {
+        struct file_lock *new_fl = NULL;
         struct file_lock **before;
         struct inode * inode = filp->f_dentry->d_inode;
         int error = 0;
@@ -751,17 +743,19 @@ static int flock_lock_file(struct file *filp, struct file_lock *new_fl)
                         continue;
                 if (filp != fl->fl_file)
                         continue;
-                if (new_fl->fl_type == fl->fl_type)
+                if (request->fl_type == fl->fl_type)
                         goto out;
                 found = 1;
                 locks_delete_lock(before);
                 break;
         }
-        unlock_kernel();
 
-        if (new_fl->fl_type == F_UNLCK)
-                return 0;
+        if (request->fl_type == F_UNLCK)
+                goto out;
 
+        new_fl = locks_alloc_lock();
+        if (new_fl == NULL)
+                goto out;
         /*
          * If a higher-priority process was blocked on the old file lock,
          * give it the opportunity to lock the file.
@@ -769,26 +763,27 @@ static int flock_lock_file(struct file *filp, struct file_lock *new_fl)
         if (found)
                 cond_resched();
 
-        lock_kernel();
         for_each_lock(inode, before) {
                 struct file_lock *fl = *before;
                 if (IS_POSIX(fl))
                         break;
                 if (IS_LEASE(fl))
                         continue;
-                if (!flock_locks_conflict(new_fl, fl))
+                if (!flock_locks_conflict(request, fl))
                         continue;
                 error = -EAGAIN;
-                if (new_fl->fl_flags & FL_SLEEP) {
-                        locks_insert_block(fl, new_fl);
-                }
+                if (request->fl_flags & FL_SLEEP)
+                        locks_insert_block(fl, request);
                 goto out;
         }
+        locks_copy_lock(new_fl, request);
         locks_insert_lock(&inode->i_flock, new_fl);
-        error = 0;
+        new_fl = NULL;
 
 out:
         unlock_kernel();
+        if (new_fl)
+                locks_free_lock(new_fl);
         return error;
 }
 
@@ -1569,9 +1564,7 @@ asmlinkage long sys_flock(unsigned int fd, unsigned int cmd)
                 error = flock_lock_file_wait(filp, lock);
 
  out_free:
-        if (list_empty(&lock->fl_link)) {
-                locks_free_lock(lock);
-        }
+        locks_free_lock(lock);
 
  out_putf:
         fput(filp);
diff --git a/fs/msdos/namei.c b/fs/msdos/namei.c
index 626a367bcd81..5b76ccd19e3f 100644
--- a/fs/msdos/namei.c
+++ b/fs/msdos/namei.c
@@ -12,14 +12,6 @@
 #include <linux/msdos_fs.h>
 #include <linux/smp_lock.h>
 
-/* MS-DOS "device special files" */
-static const unsigned char *reserved_names[] = {
-        "CON     ", "PRN     ", "NUL     ", "AUX     ",
-        "LPT1    ", "LPT2    ", "LPT3    ", "LPT4    ",
-        "COM1    ", "COM2    ", "COM3    ", "COM4    ",
-        NULL
-};
-
 /* Characters that are undesirable in an MS-DOS file name */
 static unsigned char bad_chars[] = "*?<>|\"";
 static unsigned char bad_if_strict_pc[] = "+=,; ";
@@ -40,7 +32,6 @@ static int msdos_format_name(const unsigned char *name, int len,
          */
 {
         unsigned char *walk;
-        const unsigned char **reserved;
         unsigned char c;
         int space;
 
@@ -127,11 +118,7 @@ static int msdos_format_name(const unsigned char *name, int len,
         }
         while (walk - res < MSDOS_NAME)
                 *walk++ = ' ';
-        if (!opts->atari)
-                /* GEMDOS is less stupid and has no reserved names */
-                for (reserved = reserved_names; *reserved; reserved++)
-                        if (!strncmp(res, *reserved, 8))
-                                return -EINVAL;
+
         return 0;
 }
 
diff --git a/fs/namei.c b/fs/namei.c
index 22f6e8d16aa8..96723ae83c89 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1254,7 +1254,7 @@ out:
         return dentry;
 }
 
-struct dentry * lookup_hash(struct nameidata *nd)
+static struct dentry *lookup_hash(struct nameidata *nd)
 {
         return __lookup_hash(&nd->last, nd->dentry, nd);
 }
@@ -2697,7 +2697,6 @@ EXPORT_SYMBOL(follow_up);
 EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
 EXPORT_SYMBOL(getname);
 EXPORT_SYMBOL(lock_rename);
-EXPORT_SYMBOL(lookup_hash);
 EXPORT_SYMBOL(lookup_one_len);
 EXPORT_SYMBOL(page_follow_link_light);
 EXPORT_SYMBOL(page_put_link);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8f1f49ceebec..a3a3eecef689 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -534,12 +534,15 @@ static int proc_oom_score(struct task_struct *task, char *buffer)
 
 /* If the process being read is separated by chroot from the reading process,
  * don't let the reader access the threads.
+ *
+ * note: this does dput(root) and mntput(vfsmnt) on exit.
  */
 static int proc_check_chroot(struct dentry *root, struct vfsmount *vfsmnt)
 {
         struct dentry *de, *base;
         struct vfsmount *our_vfsmnt, *mnt;
         int res = 0;
+
         read_lock(&current->fs->lock);
         our_vfsmnt = mntget(current->fs->rootmnt);
         base = dget(current->fs->root);
@@ -549,11 +552,11 @@ static int proc_check_chroot(struct dentry *root, struct vfsmount *vfsmnt)
         de = root;
         mnt = vfsmnt;
 
-        while (vfsmnt != our_vfsmnt) {
-                if (vfsmnt == vfsmnt->mnt_parent)
+        while (mnt != our_vfsmnt) {
+                if (mnt == mnt->mnt_parent)
                         goto out;
-                de = vfsmnt->mnt_mountpoint;
-                vfsmnt = vfsmnt->mnt_parent;
+                de = mnt->mnt_mountpoint;
+                mnt = mnt->mnt_parent;
         }
 
         if (!is_subdir(de, base))
@@ -564,7 +567,7 @@ exit:
         dput(base);
         mntput(our_vfsmnt);
         dput(root);
-        mntput(mnt);
+        mntput(vfsmnt);
         return res;
 out:
         spin_unlock(&vfsmount_lock);
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index ef5a3323f4b5..5c10ea157425 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -249,144 +249,60 @@ static int cpuinfo_open(struct inode *inode, struct file *file)
         return seq_open(file, &cpuinfo_op);
 }
 
-enum devinfo_states {
-        CHR_HDR,
-        CHR_LIST,
-        BLK_HDR,
-        BLK_LIST,
-        DEVINFO_DONE
-};
-
-struct devinfo_state {
-        void *chrdev;
-        void *blkdev;
-        unsigned int num_records;
-        unsigned int cur_record;
-        enum devinfo_states state;
+static struct file_operations proc_cpuinfo_operations = {
+        .open           = cpuinfo_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
 };
 
-static void *devinfo_start(struct seq_file *f, loff_t *pos)
+static int devinfo_show(struct seq_file *f, void *v)
 {
-        struct devinfo_state *info = f->private;
+        int i = *(loff_t *) v;
 
-        if (*pos) {
-                if ((info) && (*pos <= info->num_records))
-                        return info;
-                return NULL;
+        if (i < CHRDEV_MAJOR_HASH_SIZE) {
+                if (i == 0)
+                        seq_printf(f, "Character devices:\n");
+                chrdev_show(f, i);
+        } else {
+                i -= CHRDEV_MAJOR_HASH_SIZE;
+                if (i == 0)
+                        seq_printf(f, "\nBlock devices:\n");
+                blkdev_show(f, i);
         }
-        info = kmalloc(sizeof(*info), GFP_KERNEL);
-        f->private = info;
-        info->chrdev = acquire_chrdev_list();
-        info->blkdev = acquire_blkdev_list();
-        info->state = CHR_HDR;
-        info->num_records = count_chrdev_list();
-        info->num_records += count_blkdev_list();
-        info->num_records += 2; /* Character and Block headers */
-        *pos = 1;
-        info->cur_record = *pos;
-        return info;
+        return 0;
 }
 
-static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
+static void *devinfo_start(struct seq_file *f, loff_t *pos)
 {
-        int idummy;
-        char *ndummy;
-        struct devinfo_state *info = f->private;
-
-        switch (info->state) {
-                case CHR_HDR:
-                        info->state = CHR_LIST;
-                        (*pos)++;
-                        /*fallthrough*/
-                case CHR_LIST:
-                        if (get_chrdev_info(info->chrdev,&idummy,&ndummy)) {
-                                /*
-                                 * The character dev list is complete
-                                 */
-                                info->state = BLK_HDR;
-                        } else {
-                                info->chrdev = get_next_chrdev(info->chrdev);
-                        }
-                        (*pos)++;
-                        break;
-                case BLK_HDR:
-                        info->state = BLK_LIST;
-                        (*pos)++;
-                        /*fallthrough*/
-                case BLK_LIST:
-                        if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
-                                /*
-                                 * The block dev list is complete
-                                 */
-                                info->state = DEVINFO_DONE;
-                        } else {
-                                info->blkdev = get_next_blkdev(info->blkdev);
-                        }
-                        (*pos)++;
-                        break;
-                case DEVINFO_DONE:
-                        (*pos)++;
-                        info->cur_record = *pos;
-                        info = NULL;
-                        break;
-                default:
-                        break;
-        }
-        if (info)
-                info->cur_record = *pos;
-        return info;
+        if (*pos < (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
+                return pos;
+        return NULL;
 }
 
-static void devinfo_stop(struct seq_file *f, void *v)
+static void *devinfo_next(struct seq_file *f, void *v, loff_t *pos)
 {
-        struct devinfo_state *info = f->private;
-
-        if (info) {
-                release_chrdev_list(info->chrdev);
-                release_blkdev_list(info->blkdev);
-                f->private = NULL;
-                kfree(info);
-        }
+        (*pos)++;
+        if (*pos >= (BLKDEV_MAJOR_HASH_SIZE + CHRDEV_MAJOR_HASH_SIZE))
+                return NULL;
+        return pos;
 }
 
-static int devinfo_show(struct seq_file *f, void *arg)
-{
-        int major;
-        char *name;
-        struct devinfo_state *info = f->private;
-
-        switch(info->state) {
-                case CHR_HDR:
-                        seq_printf(f,"Character devices:\n");
-                        /* fallthrough */
-                case CHR_LIST:
-                        if (!get_chrdev_info(info->chrdev,&major,&name))
-                                seq_printf(f,"%3d %s\n",major,name);
-                        break;
-                case BLK_HDR:
-                        seq_printf(f,"\nBlock devices:\n");
-                        /* fallthrough */
-                case BLK_LIST:
-                        if (!get_blkdev_info(info->blkdev,&major,&name))
-                                seq_printf(f,"%3d %s\n",major,name);
-                        break;
-                default:
-                        break;
-        }
-
-        return 0;
+static void devinfo_stop(struct seq_file *f, void *v)
+{
+        /* Nothing to do */
 }
 
-static  struct seq_operations devinfo_op = {
-        .start  = devinfo_start,
-        .next   = devinfo_next,
-        .stop   = devinfo_stop,
-        .show   = devinfo_show,
+static struct seq_operations devinfo_ops = {
+        .start = devinfo_start,
+        .next  = devinfo_next,
+        .stop  = devinfo_stop,
+        .show  = devinfo_show
 };
 
-static int devinfo_open(struct inode *inode, struct file *file)
+static int devinfo_open(struct inode *inode, struct file *filp)
 {
-        return seq_open(file, &devinfo_op);
+        return seq_open(filp, &devinfo_ops);
 }
 
 static struct file_operations proc_devinfo_operations = {
@@ -396,13 +312,6 @@ static struct file_operations proc_devinfo_operations = {
         .release        = seq_release,
 };
 
-static struct file_operations proc_cpuinfo_operations = {
-        .open           = cpuinfo_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = seq_release,
-};
-
 extern struct seq_operations vmstat_op;
 static int vmstat_open(struct inode *inode, struct file *file)
 {
diff --git a/fs/select.c b/fs/select.c
index b3a3a1326af6..071660fa7b01 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -314,7 +314,7 @@ static int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
         int ret, size, max_fdset;
         struct fdtable *fdt;
         /* Allocate small arguments on the stack to save memory and be faster */
-        char stack_fds[SELECT_STACK_ALLOC];
+        long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
 
         ret = -EINVAL;
         if (n < 0)
@@ -639,8 +639,10 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds, s64 *timeout)
         struct poll_list *walk;
         struct fdtable *fdt;
         int max_fdset;
-        /* Allocate small arguments on the stack to save memory and be faster */
-        char stack_pps[POLL_STACK_ALLOC];
+        /* Allocate small arguments on the stack to save memory and be
+           faster - use long to make sure the buffer is aligned properly
+           on 64 bit archs to avoid unaligned access */
+        long stack_pps[POLL_STACK_ALLOC/sizeof(long)];
         struct poll_list *stack_pp = NULL;
 
         /* Do a sanity check on nfds ... */
diff --git a/fs/splice.c b/fs/splice.c
index 4a026f95884f..7c2bbf18d7a7 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -22,6 +22,7 @@
 #include <linux/pipe_fs_i.h>
 #include <linux/mm_inline.h>
 #include <linux/swap.h>
+#include <linux/module.h>
 
 /*
  * Passed to the actors
@@ -567,6 +568,9 @@ ssize_t generic_splice_sendpage(struct inode *inode, struct file *out,
         return move_from_pipe(inode, out, len, flags, pipe_to_sendpage);
 }
 
+EXPORT_SYMBOL(generic_file_splice_write);
+EXPORT_SYMBOL(generic_file_splice_read);
+
 static long do_splice_from(struct inode *pipe, struct file *out, size_t len,
                            unsigned int flags)
 {
diff --git a/fs/sync.c b/fs/sync.c
new file mode 100644
index 000000000000..8616006d2094
--- /dev/null
+++ b/fs/sync.c
@@ -0,0 +1,164 @@
+/*
+ * High-level sync()-related operations
+ */
+
+#include <linux/kernel.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+#include <linux/writeback.h>
+#include <linux/syscalls.h>
+#include <linux/linkage.h>
+#include <linux/pagemap.h>
+
+#define VALID_FLAGS (SYNC_FILE_RANGE_WAIT_BEFORE|SYNC_FILE_RANGE_WRITE| \
+                        SYNC_FILE_RANGE_WAIT_AFTER)
+
+/*
+ * sys_sync_file_range() permits finely controlled syncing over a segment of
+ * a file in the range offset .. (offset+nbytes-1) inclusive.  If nbytes is
+ * zero then sys_sync_file_range() will operate from offset out to EOF.
+ *
+ * The flag bits are:
+ *
+ * SYNC_FILE_RANGE_WAIT_BEFORE: wait upon writeout of all pages in the range
+ * before performing the write.
+ *
+ * SYNC_FILE_RANGE_WRITE: initiate writeout of all those dirty pages in the
+ * range which are not presently under writeback.
+ *
+ * SYNC_FILE_RANGE_WAIT_AFTER: wait upon writeout of all pages in the range
+ * after performing the write.
+ *
+ * Useful combinations of the flag bits are:
+ *
+ * SYNC_FILE_RANGE_WAIT_BEFORE|SYNC_FILE_RANGE_WRITE: ensures that all pages
+ * in the range which were dirty on entry to sys_sync_file_range() are placed
+ * under writeout.  This is a start-write-for-data-integrity operation.
+ *
+ * SYNC_FILE_RANGE_WRITE: start writeout of all dirty pages in the range which
+ * are not presently under writeout.  This is an asynchronous flush-to-disk
+ * operation.  Not suitable for data integrity operations.
+ *
+ * SYNC_FILE_RANGE_WAIT_BEFORE (or SYNC_FILE_RANGE_WAIT_AFTER): wait for
+ * completion of writeout of all pages in the range.  This will be used after an
+ * earlier SYNC_FILE_RANGE_WAIT_BEFORE|SYNC_FILE_RANGE_WRITE operation to wait
+ * for that operation to complete and to return the result.
+ *
+ * SYNC_FILE_RANGE_WAIT_BEFORE|SYNC_FILE_RANGE_WRITE|SYNC_FILE_RANGE_WAIT_AFTER:
+ * a traditional sync() operation.  This is a write-for-data-integrity operation
+ * which will ensure that all pages in the range which were dirty on entry to
+ * sys_sync_file_range() are committed to disk.
+ *
+ *
+ * SYNC_FILE_RANGE_WAIT_BEFORE and SYNC_FILE_RANGE_WAIT_AFTER will detect any
+ * I/O errors or ENOSPC conditions and will return those to the caller, after
+ * clearing the EIO and ENOSPC flags in the address_space.
+ *
+ * It should be noted that none of these operations write out the file's
+ * metadata.  So unless the application is strictly performing overwrites of
+ * already-instantiated disk blocks, there are no guarantees here that the data
+ * will be available after a crash.
+ */
+asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
+                                        int flags)
+{
+        int ret;
+        struct file *file;
+        loff_t endbyte;                 /* inclusive */
+        int fput_needed;
+        umode_t i_mode;
+
+        ret = -EINVAL;
+        if (flags & ~VALID_FLAGS)
+                goto out;
+
+        endbyte = offset + nbytes;
+
+        if ((s64)offset < 0)
+                goto out;
+        if ((s64)endbyte < 0)
+                goto out;
+        if (endbyte < offset)
+                goto out;
+
+        if (sizeof(pgoff_t) == 4) {
+                if (offset >= (0x100000000ULL << PAGE_CACHE_SHIFT)) {
+                        /*
+                         * The range starts outside a 32 bit machine's
+                         * pagecache addressing capabilities.  Let it "succeed"
+                         */
+                        ret = 0;
+                        goto out;
+                }
+                if (endbyte >= (0x100000000ULL << PAGE_CACHE_SHIFT)) {
+                        /*
+                         * Out to EOF
+                         */
+                        nbytes = 0;
+                }
+        }
+
+        if (nbytes == 0)
+                endbyte = -1;
+        else
+                endbyte--;              /* inclusive */
+
+        ret = -EBADF;
+        file = fget_light(fd, &fput_needed);
+        if (!file)
+                goto out;
+
+        i_mode = file->f_dentry->d_inode->i_mode;
+        ret = -ESPIPE;
+        if (!S_ISREG(i_mode) && !S_ISBLK(i_mode) && !S_ISDIR(i_mode) &&
+                        !S_ISLNK(i_mode))
+                goto out_put;
+
+        ret = do_sync_file_range(file, offset, endbyte, flags);
+out_put:
+        fput_light(file, fput_needed);
+out:
+        return ret;
+}
+
+/*
+ * `endbyte' is inclusive
+ */
+int do_sync_file_range(struct file *file, loff_t offset, loff_t endbyte,
+                        int flags)
+{
+        int ret;
+        struct address_space *mapping;
+
+        mapping = file->f_mapping;
+        if (!mapping) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ret = 0;
+        if (flags & SYNC_FILE_RANGE_WAIT_BEFORE) {
+                ret = wait_on_page_writeback_range(mapping,
+                                        offset >> PAGE_CACHE_SHIFT,
+                                        endbyte >> PAGE_CACHE_SHIFT);
+                if (ret < 0)
+                        goto out;
+        }
+
+        if (flags & SYNC_FILE_RANGE_WRITE) {
+                ret = __filemap_fdatawrite_range(mapping, offset, endbyte,
+                                                WB_SYNC_NONE);
+                if (ret < 0)
+                        goto out;
+        }
+
+        if (flags & SYNC_FILE_RANGE_WAIT_AFTER) {
+                ret = wait_on_page_writeback_range(mapping,
+                                        offset >> PAGE_CACHE_SHIFT,
+                                        endbyte >> PAGE_CACHE_SHIFT);
+        }
+out:
+        return ret;
+}
+EXPORT_SYMBOL_GPL(do_sync_file_range);
diff --git a/fs/vfat/namei.c b/fs/vfat/namei.c
index ef46939c0c1a..a56cec3be5f0 100644
--- a/fs/vfat/namei.c
+++ b/fs/vfat/namei.c
@@ -185,24 +185,6 @@ static int vfat_valid_longname(const unsigned char *name, unsigned int len)
                 return -EINVAL;
         if (len >= 256)
                 return -ENAMETOOLONG;
-
-        /* MS-DOS "device special files" */
-        if (len == 3 || (len > 3 && name[3] == '.')) {  /* basename == 3 */
-                if (!strnicmp(name, "aux", 3) ||
-                    !strnicmp(name, "con", 3) ||
-                    !strnicmp(name, "nul", 3) ||
-                    !strnicmp(name, "prn", 3))
-                        return -EINVAL;
-        }
-        if (len == 4 || (len > 4 && name[4] == '.')) {  /* basename == 4 */
-                /* "com1", "com2", ... */
-                if ('1' <= name[3] && name[3] <= '9') {
-                        if (!strnicmp(name, "com", 3) ||
-                            !strnicmp(name, "lpt", 3))
-                                return -EINVAL;
-                }
-        }
-
         return 0;
 }
 
diff --git a/include/asm-arm/arch-pxa/sharpsl.h b/include/asm-arm/arch-pxa/sharpsl.h
index 0b43495d24b4..94cb4982af82 100644
--- a/include/asm-arm/arch-pxa/sharpsl.h
+++ b/include/asm-arm/arch-pxa/sharpsl.h
@@ -27,6 +27,8 @@ struct corgits_machinfo {
  */
 struct corgibl_machinfo {
         int max_intensity;
+        int default_intensity;
+        int limit_mask;
         void (*set_bl_intensity)(int intensity);
 };
 extern void corgibl_limit_intensity(int limit);
diff --git a/include/asm-generic/local.h b/include/asm-generic/local.h
index de4614840c2c..9291c24f5819 100644
--- a/include/asm-generic/local.h
+++ b/include/asm-generic/local.h
@@ -7,8 +7,15 @@
 #include <asm/atomic.h>
 #include <asm/types.h>
 
-/* An unsigned long type for operations which are atomic for a single
- * CPU.  Usually used in combination with per-cpu variables. */
+/*
+ * A signed long type for operations which are atomic for a single CPU.
+ * Usually used in combination with per-cpu variables.
+ *
+ * This is the default implementation, which uses atomic_long_t.  Which is
+ * rather pointless.  The whole point behind local_t is that some processors
+ * can perform atomic adds and subtracts in a manner which is atomic wrt IRQs
+ * running on this CPU.  local_t allows exploitation of such capabilities.
+ */
 
 /* Implement in terms of atomics. */
 
@@ -20,7 +27,7 @@ typedef struct
 
 #define LOCAL_INIT(i)   { ATOMIC_LONG_INIT(i) }
 
-#define local_read(l)   ((unsigned long)atomic_long_read(&(l)->a))
+#define local_read(l)   atomic_long_read(&(l)->a)
 #define local_set(l,i)  atomic_long_set((&(l)->a),(i))
 #define local_inc(l)    atomic_long_inc(&(l)->a)
 #define local_dec(l)    atomic_long_dec(&(l)->a)
diff --git a/include/asm-generic/mutex-dec.h b/include/asm-generic/mutex-dec.h
index 40c6d1f86598..29c6ac34e236 100644
--- a/include/asm-generic/mutex-dec.h
+++ b/include/asm-generic/mutex-dec.h
@@ -17,13 +17,14 @@
  * it wasn't 1 originally. This function MUST leave the value lower than
  * 1 even when the "1" assertion wasn't true.
  */
-#define __mutex_fastpath_lock(count, fail_fn)                           \
-do {                                                                    \
-        if (unlikely(atomic_dec_return(count) < 0))                     \
-                fail_fn(count);                                         \
-        else                                                            \
-                smp_mb();                                               \
-} while (0)
+static inline void
+__mutex_fastpath_lock(atomic_t *count, fastcall void (*fail_fn)(atomic_t *))
+{
+        if (unlikely(atomic_dec_return(count) < 0))
+                fail_fn(count);
+        else
+                smp_mb();
+}
 
 /**
  *  __mutex_fastpath_lock_retval - try to take the lock by moving the count
@@ -36,7 +37,7 @@ do {									\
  * or anything the slow path function returns.
  */
 static inline int
-__mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
+__mutex_fastpath_lock_retval(atomic_t *count, fastcall int (*fail_fn)(atomic_t *))
 {
         if (unlikely(atomic_dec_return(count) < 0))
                 return fail_fn(count);
@@ -59,12 +60,13 @@ __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
  * __mutex_slowpath_needs_to_unlock() macro needs to return 1, it needs
  * to return 0 otherwise.
  */
-#define __mutex_fastpath_unlock(count, fail_fn)                         \
-do {                                                                    \
-        smp_mb();                                                       \
-        if (unlikely(atomic_inc_return(count) <= 0))                    \
-                fail_fn(count);                                         \
-} while (0)
+static inline void
+__mutex_fastpath_unlock(atomic_t *count, fastcall void (*fail_fn)(atomic_t *))
+{
+        smp_mb();
+        if (unlikely(atomic_inc_return(count) <= 0))
+                fail_fn(count);
+}
 
 #define __mutex_slowpath_needs_to_unlock()              1
 
diff --git a/include/asm-generic/mutex-xchg.h b/include/asm-generic/mutex-xchg.h
index 1d24f47e6c48..32a2100c1aeb 100644
--- a/include/asm-generic/mutex-xchg.h
+++ b/include/asm-generic/mutex-xchg.h
@@ -3,7 +3,7 @@
  *
  * Generic implementation of the mutex fastpath, based on xchg().
  *
- * NOTE: An xchg based implementation is less optimal than an atomic
+ * NOTE: An xchg based implementation might be less optimal than an atomic
  *       decrement/increment based implementation. If your architecture
  *       has a reasonable atomic dec/inc then you should probably use
  *       asm-generic/mutex-dec.h instead, or you could open-code an
@@ -22,14 +22,14 @@
  * wasn't 1 originally. This function MUST leave the value lower than 1
  * even when the "1" assertion wasn't true.
  */
-#define __mutex_fastpath_lock(count, fail_fn)                           \
-do {                                                                    \
-        if (unlikely(atomic_xchg(count, 0) != 1))                       \
-                fail_fn(count);                                         \
-        else                                                            \
-                smp_mb();                                               \
-} while (0)
-
+static inline void
+__mutex_fastpath_lock(atomic_t *count, fastcall void (*fail_fn)(atomic_t *))
+{
+        if (unlikely(atomic_xchg(count, 0) != 1))
+                fail_fn(count);
+        else
+                smp_mb();
+}
 
 /**
  *  __mutex_fastpath_lock_retval - try to take the lock by moving the count
@@ -42,7 +42,7 @@ do {									\
  * or anything the slow path function returns
  */
 static inline int
-__mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
+__mutex_fastpath_lock_retval(atomic_t *count, fastcall int (*fail_fn)(atomic_t *))
 {
         if (unlikely(atomic_xchg(count, 0) != 1))
                 return fail_fn(count);
@@ -64,12 +64,13 @@ __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
  * __mutex_slowpath_needs_to_unlock() macro needs to return 1, it needs
  * to return 0 otherwise.
  */
-#define __mutex_fastpath_unlock(count, fail_fn)                         \
-do {                                                                    \
-        smp_mb();                                                       \
-        if (unlikely(atomic_xchg(count, 1) != 0))                       \
-                fail_fn(count);                                         \
-} while (0)
+static inline void
+__mutex_fastpath_unlock(atomic_t *count, fastcall void (*fail_fn)(atomic_t *))
+{
+        smp_mb();
+        if (unlikely(atomic_xchg(count, 1) != 0))
+                fail_fn(count);
+}
 
 #define __mutex_slowpath_needs_to_unlock()              0
 
diff --git a/include/asm-i386/apicdef.h b/include/asm-i386/apicdef.h
index 03185cef8e0a..5e4a35af2921 100644
--- a/include/asm-i386/apicdef.h
+++ b/include/asm-i386/apicdef.h
@@ -37,6 +37,7 @@
 #define                 APIC_SPIV_FOCUS_DISABLED        (1<<9)
 #define                 APIC_SPIV_APIC_ENABLED          (1<<8)
 #define         APIC_ISR        0x100
+#define         APIC_ISR_NR     0x8     /* Number of 32 bit ISR registers. */
 #define         APIC_TMR        0x180
 #define         APIC_IRR        0x200
 #define         APIC_ESR        0x280
diff --git a/include/asm-i386/floppy.h b/include/asm-i386/floppy.h
index 79727afb94c9..03403045c182 100644
--- a/include/asm-i386/floppy.h
+++ b/include/asm-i386/floppy.h
@@ -56,7 +56,6 @@ static irqreturn_t floppy_hardint(int irq, void *dev_id, struct pt_regs * regs)
         register unsigned char st;
 
 #undef TRACE_FLPY_INT
-#define NO_FLOPPY_ASSEMBLER
 
 #ifdef TRACE_FLPY_INT
         static int calls=0;
@@ -71,38 +70,6 @@ static irqreturn_t floppy_hardint(int irq, void *dev_id, struct pt_regs * regs)
                 bytes = virtual_dma_count;
 #endif
 
-#ifndef NO_FLOPPY_ASSEMBLER
-        __asm__ (
-       "testl %1,%1"
-        "je 3f"
-"1:     inb %w4,%b0"
-        "andb $160,%b0"
-        "cmpb $160,%b0"
-        "jne 2f"
-        "incw %w4"
-        "testl %3,%3"
-        "jne 4f"
-        "inb %w4,%b0"
-        "movb %0,(%2)"
-        "jmp 5f"
-"4:     movb (%2),%0"
-        "outb %b0,%w4"
-"5:     decw %w4"
-        "outb %0,$0x80"
-        "decl %1"
-        "incl %2"
-        "testl %1,%1"
-        "jne 1b"
-"3:     inb %w4,%b0"
-"2:     "
-       : "=a" ((char) st), 
-       "=c" ((long) virtual_dma_count), 
-       "=S" ((long) virtual_dma_addr)
-       : "b" ((long) virtual_dma_mode),
-       "d" ((short) virtual_dma_port+4), 
-       "1" ((long) virtual_dma_count),
-       "2" ((long) virtual_dma_addr));
-#else   
         {
                 register int lcount;
                 register char *lptr;
@@ -122,7 +89,6 @@ static irqreturn_t floppy_hardint(int irq, void *dev_id, struct pt_regs * regs)
                 virtual_dma_addr = lptr;
                 st = inb(virtual_dma_port+4);
         }
-#endif
 
 #ifdef TRACE_FLPY_INT
         calls++;
diff --git a/include/asm-i386/local.h b/include/asm-i386/local.h
index 0177da80dde3..e67fa08260fe 100644
--- a/include/asm-i386/local.h
+++ b/include/asm-i386/local.h
@@ -5,7 +5,7 @@
 
 typedef struct
 {
-        volatile unsigned long counter;
+        volatile long counter;
 } local_t;
 
 #define LOCAL_INIT(i)   { (i) }
@@ -29,7 +29,7 @@ static __inline__ void local_dec(local_t *v)
                 :"m" (v->counter));
 }
 
-static __inline__ void local_add(unsigned long i, local_t *v)
+static __inline__ void local_add(long i, local_t *v)
 {
         __asm__ __volatile__(
                 "addl %1,%0"
@@ -37,7 +37,7 @@ static __inline__ void local_add(unsigned long i, local_t *v)
                 :"ir" (i), "m" (v->counter));
 }
 
-static __inline__ void local_sub(unsigned long i, local_t *v)
+static __inline__ void local_sub(long i, local_t *v)
 {
         __asm__ __volatile__(
                 "subl %1,%0"
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index 789e9bdd0a40..2e7f3e257fdd 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -319,8 +319,9 @@
 #define __NR_set_robust_list    311
 #define __NR_get_robust_list    312
 #define __NR_sys_splice         313
+#define __NR_sys_sync_file_range 314
 
-#define NR_syscalls 314
+#define NR_syscalls 315
 
 /*
  * user-visible error numbers are in the range -1 - -128: see
diff --git a/include/asm-parisc/atomic.h b/include/asm-parisc/atomic.h
index 4dc7253ff5d0..403ea97316cf 100644
--- a/include/asm-parisc/atomic.h
+++ b/include/asm-parisc/atomic.h
@@ -210,6 +210,8 @@ static __inline__ int atomic_read(const atomic_t *v)
 
 #define atomic_dec_and_test(v)  (atomic_dec_return(v) == 0)
 
+#define atomic_sub_and_test(i,v)        (atomic_sub_return((i),(v)) == 0)
+
 #define ATOMIC_INIT(i)  ((atomic_t) { (i) })
 
 #define smp_mb__before_atomic_dec()     smp_mb()
@@ -267,6 +269,7 @@ atomic64_read(const atomic64_t *v)
 
 #define atomic64_inc_and_test(v)        (atomic64_inc_return(v) == 0)
 #define atomic64_dec_and_test(v)        (atomic64_dec_return(v) == 0)
+#define atomic64_sub_and_test(i,v)      (atomic64_sub_return((i),(v)) == 0)
 
 #endif /* __LP64__ */
 
diff --git a/include/asm-parisc/cache.h b/include/asm-parisc/cache.h
index ae50f8e12eed..c831665473cb 100644
--- a/include/asm-parisc/cache.h
+++ b/include/asm-parisc/cache.h
@@ -48,7 +48,7 @@ extern void flush_user_icache_range_asm(unsigned long, unsigned long);
 extern void flush_kernel_icache_range_asm(unsigned long, unsigned long);
 extern void flush_user_dcache_range_asm(unsigned long, unsigned long);
 extern void flush_kernel_dcache_range_asm(unsigned long, unsigned long);
-extern void flush_kernel_dcache_page(void *);
+extern void flush_kernel_dcache_page_asm(void *);
 extern void flush_kernel_icache_page(void *);
 extern void disable_sr_hashing(void);   /* turns off space register hashing */
 extern void disable_sr_hashing_asm(int); /* low level support for above */
diff --git a/include/asm-parisc/cacheflush.h b/include/asm-parisc/cacheflush.h
index c53af9ff41b5..76b6b7d6046a 100644
--- a/include/asm-parisc/cacheflush.h
+++ b/include/asm-parisc/cacheflush.h
@@ -62,7 +62,7 @@ extern void flush_dcache_page(struct page *page);
 #define flush_dcache_mmap_unlock(mapping) \
         write_unlock_irq(&(mapping)->tree_lock)
 
-#define flush_icache_page(vma,page)     do { flush_kernel_dcache_page(page_address(page)); flush_kernel_icache_page(page_address(page)); } while (0)
+#define flush_icache_page(vma,page)     do { flush_kernel_dcache_page(page); flush_kernel_icache_page(page_address(page)); } while (0)
 
 #define flush_icache_range(s,e)         do { flush_kernel_dcache_range_asm(s,e); flush_kernel_icache_range_asm(s,e); } while (0)
 
@@ -184,6 +184,21 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 
 }
 
+static inline void
+flush_anon_page(struct page *page, unsigned long vmaddr)
+{
+        if (PageAnon(page))
+                flush_user_dcache_page(vmaddr);
+}
+#define ARCH_HAS_FLUSH_ANON_PAGE
+
+static inline void
+flush_kernel_dcache_page(struct page *page)
+{
+        flush_kernel_dcache_page_asm(page_address(page));
+}
+#define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
+
 #ifdef CONFIG_DEBUG_RODATA
 void mark_rodata_ro(void);
 #endif
diff --git a/include/asm-parisc/io.h b/include/asm-parisc/io.h
index be0c7234a6da..29da31194b91 100644
--- a/include/asm-parisc/io.h
+++ b/include/asm-parisc/io.h
@@ -25,35 +25,11 @@ extern unsigned long parisc_vmerge_max_size;
  *   eg dev->hpa or 0xfee00000.
  */
 
-#ifdef CONFIG_DEBUG_IOREMAP
-#ifdef CONFIG_64BIT
-#define NYBBLE_SHIFT 60
-#else
-#define NYBBLE_SHIFT 28
-#endif
-extern void gsc_bad_addr(unsigned long addr);
-extern void __raw_bad_addr(const volatile void __iomem *addr);
-#define gsc_check_addr(addr)                                    \
-        if ((addr >> NYBBLE_SHIFT) != 0xf) {                    \
-                gsc_bad_addr(addr);                             \
-                addr |= 0xfUL << NYBBLE_SHIFT;                  \
-        }
-#define __raw_check_addr(addr)                                  \
-        if (((unsigned long)addr >> NYBBLE_SHIFT) != 0xe)       \
-                __raw_bad_addr(addr);                   \
-        addr = (void __iomem *)((unsigned long)addr | (0xfUL << NYBBLE_SHIFT));
-#else
-#define gsc_check_addr(addr)
-#define __raw_check_addr(addr)
-#endif
-
 static inline unsigned char gsc_readb(unsigned long addr)
 {
         long flags;
         unsigned char ret;
 
-        gsc_check_addr(addr);
-
         __asm__ __volatile__(
         "       rsm     2,%0\n"
         "       ldbx    0(%2),%1\n"
@@ -68,8 +44,6 @@ static inline unsigned short gsc_readw(unsigned long addr)
         long flags;
         unsigned short ret;
 
-        gsc_check_addr(addr);
-
         __asm__ __volatile__(
         "       rsm     2,%0\n"
         "       ldhx    0(%2),%1\n"
@@ -83,8 +57,6 @@ static inline unsigned int gsc_readl(unsigned long addr)
 {
         u32 ret;
 
-        gsc_check_addr(addr);
-
         __asm__ __volatile__(
         "       ldwax   0(%1),%0\n"
         : "=r" (ret) : "r" (addr) );
@@ -95,7 +67,6 @@ static inline unsigned int gsc_readl(unsigned long addr)
 static inline unsigned long long gsc_readq(unsigned long addr)
 {
         unsigned long long ret;
-        gsc_check_addr(addr);
 
 #ifdef __LP64__
         __asm__ __volatile__(
@@ -112,8 +83,6 @@ static inline unsigned long long gsc_readq(unsigned long addr)
 static inline void gsc_writeb(unsigned char val, unsigned long addr)
 {
         long flags;
-        gsc_check_addr(addr);
-
         __asm__ __volatile__(
         "       rsm     2,%0\n"
         "       stbs    %1,0(%2)\n"
@@ -124,8 +93,6 @@ static inline void gsc_writeb(unsigned char val, unsigned long addr)
 static inline void gsc_writew(unsigned short val, unsigned long addr)
 {
         long flags;
-        gsc_check_addr(addr);
-
         __asm__ __volatile__(
         "       rsm     2,%0\n"
         "       sths    %1,0(%2)\n"
@@ -135,8 +102,6 @@ static inline void gsc_writew(unsigned short val, unsigned long addr)
 
 static inline void gsc_writel(unsigned int val, unsigned long addr)
 {
-        gsc_check_addr(addr);
-
         __asm__ __volatile__(
         "       stwas   %0,0(%1)\n"
         : :  "r" (val), "r" (addr) );
@@ -144,8 +109,6 @@ static inline void gsc_writel(unsigned int val, unsigned long addr)
 
 static inline void gsc_writeq(unsigned long long val, unsigned long addr)
 {
-        gsc_check_addr(addr);
-
 #ifdef __LP64__
         __asm__ __volatile__(
         "       stda    %0,0(%1)\n"
@@ -180,14 +143,7 @@ extern inline void * ioremap_nocache(unsigned long offset, unsigned long size)
 
 extern void iounmap(void __iomem *addr);
 
-/*
- * USE_HPPA_IOREMAP is the magic flag to enable or disable real ioremap()
- * functionality.  It's currently disabled because it may not work on some
- * machines.
- */
-#define USE_HPPA_IOREMAP 0
 
-#if USE_HPPA_IOREMAP
 static inline unsigned char __raw_readb(const volatile void __iomem *addr)
 {
         return (*(volatile unsigned char __force *) (addr));
@@ -221,57 +177,6 @@ static inline void __raw_writeq(unsigned long long b, volatile void __iomem *add
 {
         *(volatile unsigned long long __force *) addr = b;
 }
-#else /* !USE_HPPA_IOREMAP */
-static inline unsigned char __raw_readb(const volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        return gsc_readb((unsigned long) addr);
-}
-static inline unsigned short __raw_readw(const volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        return gsc_readw((unsigned long) addr);
-}
-static inline unsigned int __raw_readl(const volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        return gsc_readl((unsigned long) addr);
-}
-static inline unsigned long long __raw_readq(const volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        return gsc_readq((unsigned long) addr);
-}
-
-static inline void __raw_writeb(unsigned char b, volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        gsc_writeb(b, (unsigned long) addr);
-}
-static inline void __raw_writew(unsigned short b, volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        gsc_writew(b, (unsigned long) addr);
-}
-static inline void __raw_writel(unsigned int b, volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        gsc_writel(b, (unsigned long) addr);
-}
-static inline void __raw_writeq(unsigned long long b, volatile void __iomem *addr)
-{
-        __raw_check_addr(addr);
-
-        gsc_writeq(b, (unsigned long) addr);
-}
-#endif /* !USE_HPPA_IOREMAP */
 
 /* readb can never be const, so use __fswab instead of le*_to_cpu */
 #define readb(addr) __raw_readb(addr)
diff --git a/include/asm-parisc/local.h b/include/asm-parisc/local.h
index 892b3b2c4962..d0f550912755 100644
--- a/include/asm-parisc/local.h
+++ b/include/asm-parisc/local.h
@@ -4,16 +4,16 @@
 #include <linux/percpu.h>
 #include <asm/atomic.h>
 
-typedef atomic_t local_t;
+typedef atomic_long_t local_t;
 
-#define LOCAL_INIT(i)   ATOMIC_INIT(i)
-#define local_read(v)   atomic_read(v)
-#define local_set(v,i)  atomic_set(v,i)
+#define LOCAL_INIT(i)   ATOMIC_LONG_INIT(i)
+#define local_read(v)   atomic_long_read(v)
+#define local_set(v,i)  atomic_long_set(v,i)
 
-#define local_inc(v)    atomic_inc(v)
-#define local_dec(v)    atomic_dec(v)
-#define local_add(i, v) atomic_add(i, v)
-#define local_sub(i, v) atomic_sub(i, v)
+#define local_inc(v)    atomic_long_inc(v)
+#define local_dec(v)    atomic_long_dec(v)
+#define local_add(i, v) atomic_long_add(i, v)
+#define local_sub(i, v) atomic_long_sub(i, v)
 
 #define __local_inc(v)          ((v)->counter++)
 #define __local_dec(v)          ((v)->counter--)
diff --git a/include/asm-parisc/page.h b/include/asm-parisc/page.h
index 9f303c0c3cd7..45e02aa5bf4b 100644
--- a/include/asm-parisc/page.h
+++ b/include/asm-parisc/page.h
@@ -26,7 +26,7 @@ static inline void
 copy_user_page(void *vto, void *vfrom, unsigned long vaddr, struct page *pg)
 {
         copy_user_page_asm(vto, vfrom);
-        flush_kernel_dcache_page(vto);
+        flush_kernel_dcache_page_asm(vto);
         /* XXX: ppc flushes icache too, should we? */
 }
 
@@ -40,14 +40,19 @@ clear_user_page(void *page, unsigned long vaddr, struct page *pg)
 /*
  * These are used to make use of C type-checking..
  */
-#ifdef __LP64__
-typedef struct { unsigned long pte; } pte_t;
-#else
-typedef struct {
-        unsigned long pte;
-        unsigned long flags;
-} pte_t;
+#define STRICT_MM_TYPECHECKS
+#ifdef STRICT_MM_TYPECHECKS
+typedef struct { unsigned long pte;
+#if !defined(CONFIG_64BIT)
+                 unsigned long future_flags;
+ /* XXX: it's possible to remove future_flags and change BITS_PER_PTE_ENTRY
+         to 2, but then strangely the identical 32bit kernel boots on a
+         c3000(pa20), but not any longer on a 715(pa11).
+         Still investigating... HelgeD.
+  */
 #endif
+} pte_t; /* either 32 or 64bit */
+
 /* NOTE: even on 64 bits, these entries are __u32 because we allocate
  * the pmd and pgd in ZONE_DMA (i.e. under 4GB) */
 typedef struct { __u32 pmd; } pmd_t;
@@ -55,25 +60,44 @@ typedef struct { __u32 pgd; } pgd_t;
 typedef struct { unsigned long pgprot; } pgprot_t;
 
 #define pte_val(x)      ((x).pte)
-#ifdef __LP64__
-#define pte_flags(x)    (*(__u32 *)&((x).pte))
-#else
-#define pte_flags(x)    ((x).flags)
-#endif
-
 /* These do not work lvalues, so make sure we don't use them as such. */
 #define pmd_val(x)      ((x).pmd + 0)
 #define pgd_val(x)      ((x).pgd + 0)
 #define pgprot_val(x)   ((x).pgprot)
 
-#define __pmd_val_set(x,n) (x).pmd = (n)
-#define __pgd_val_set(x,n) (x).pgd = (n)
-
 #define __pte(x)        ((pte_t) { (x) } )
 #define __pmd(x)        ((pmd_t) { (x) } )
 #define __pgd(x)        ((pgd_t) { (x) } )
 #define __pgprot(x)     ((pgprot_t) { (x) } )
 
+#define __pmd_val_set(x,n) (x).pmd = (n)
+#define __pgd_val_set(x,n) (x).pgd = (n)
+
+#else
+/*
+ * .. while these make it easier on the compiler
+ */
+typedef unsigned long pte_t;
+typedef         __u32 pmd_t;
+typedef         __u32 pgd_t;
+typedef unsigned long pgprot_t;
+
+#define pte_val(x)      (x)
+#define pmd_val(x)      (x)
+#define pgd_val(x)      (x)
+#define pgprot_val(x)   (x)
+
+#define __pte(x)        (x)
+#define __pmd(x)        (x)
+#define __pgd(x)        (x)
+#define __pgprot(x)     (x)
+
+#define __pmd_val_set(x,n) (x) = (n)
+#define __pgd_val_set(x,n) (x) = (n)
+
+#endif /* STRICT_MM_TYPECHECKS */
+
+
 typedef struct __physmem_range {
         unsigned long start_pfn;
         unsigned long pages;       /* PAGE_SIZE pages */
diff --git a/include/asm-parisc/pci.h b/include/asm-parisc/pci.h
index fe7f6a2f5aa7..77bbafb7f73e 100644
--- a/include/asm-parisc/pci.h
+++ b/include/asm-parisc/pci.h
@@ -289,4 +289,9 @@ static inline void pcibios_add_platform_entries(struct pci_dev *dev)
 {
 }
 
+static inline void pcibios_penalize_isa_irq(int irq, int active)
+{
+        /* We don't need to penalize isa irq's */
+}
+
 #endif /* __ASM_PARISC_PCI_H */
diff --git a/include/asm-parisc/pdc_chassis.h b/include/asm-parisc/pdc_chassis.h
index adac9ac2743f..a609273dc6bf 100644
--- a/include/asm-parisc/pdc_chassis.h
+++ b/include/asm-parisc/pdc_chassis.h
@@ -6,9 +6,8 @@
  *
  *
  *      This program is free software; you can redistribute it and/or modify
- *      it under the terms of the GNU General Public License as published by
- *      the Free Software Foundation; either version 2, or (at your option)
- *      any later version.
+ *      it under the terms of the GNU General Public License, version 2, as
+ *      published by the Free Software Foundation.
  *      
  *      This program is distributed in the hope that it will be useful,
  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/include/asm-parisc/spinlock.h b/include/asm-parisc/spinlock.h
index 16c2ac075fc5..a93960e232cf 100644
--- a/include/asm-parisc/spinlock.h
+++ b/include/asm-parisc/spinlock.h
@@ -134,14 +134,22 @@ static  __inline__ int __raw_write_trylock(raw_rwlock_t *rw)
         return 1;
 }
 
-static __inline__ int __raw_is_read_locked(raw_rwlock_t *rw)
+/*
+ * read_can_lock - would read_trylock() succeed?
+ * @lock: the rwlock in question.
+ */
+static __inline__ int __raw_read_can_lock(raw_rwlock_t *rw)
 {
-        return rw->counter > 0;
+        return rw->counter >= 0;
 }
 
-static __inline__ int __raw_is_write_locked(raw_rwlock_t *rw)
+/*
+ * write_can_lock - would write_trylock() succeed?
+ * @lock: the rwlock in question.
+ */
+static __inline__ int __raw_write_can_lock(raw_rwlock_t *rw)
 {
-        return rw->counter < 0;
+        return !rw->counter;
 }
 
 #endif /* __ASM_SPINLOCK_H */
diff --git a/include/asm-parisc/thread_info.h b/include/asm-parisc/thread_info.h
index ac32f140b83a..f2f83b04cd8b 100644
--- a/include/asm-parisc/thread_info.h
+++ b/include/asm-parisc/thread_info.h
@@ -49,7 +49,8 @@ struct thread_info {
 
 #endif /* !__ASSEMBLY */
 
-#define PREEMPT_ACTIVE          0x10000000
+#define PREEMPT_ACTIVE_BIT      28
+#define PREEMPT_ACTIVE          (1 << PREEMPT_ACTIVE_BIT)
 
 /*
  * thread information flags
diff --git a/include/asm-powerpc/system.h b/include/asm-powerpc/system.h
index 65f5a7b2646b..d075725bf444 100644
--- a/include/asm-powerpc/system.h
+++ b/include/asm-powerpc/system.h
@@ -365,8 +365,11 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new,
  * powers of 2 writes until it reaches sufficient alignment).
  *
  * Based on this we disable the IP header alignment in network drivers.
+ * We also modify NET_SKB_PAD to be a cacheline in size, thus maintaining
+ * cacheline alignment of buffers.
  */
-#define NET_IP_ALIGN   0
+#define NET_IP_ALIGN    0
+#define NET_SKB_PAD     L1_CACHE_BYTES
 #endif
 
 #define arch_align_stack(x) (x)
diff --git a/include/asm-s390/percpu.h b/include/asm-s390/percpu.h
index e10ed87094f0..436d216601e5 100644
--- a/include/asm-s390/percpu.h
+++ b/include/asm-s390/percpu.h
@@ -46,7 +46,7 @@ extern unsigned long __per_cpu_offset[NR_CPUS];
 #define percpu_modcopy(pcpudst, src, size)                      \
 do {                                                            \
         unsigned int __i;                                       \
-        for_each_cpu(__i)                                       \
+        for_each_possible_cpu(__i)                              \
                 memcpy((pcpudst)+__per_cpu_offset[__i],         \
                        (src), (size));                          \
 } while (0)
diff --git a/include/asm-um/desc.h b/include/asm-um/desc.h
index ac1d2a20d178..4ec34a51b62c 100644
--- a/include/asm-um/desc.h
+++ b/include/asm-um/desc.h
@@ -1,6 +1,16 @@
 #ifndef __UM_DESC_H
 #define __UM_DESC_H
 
-#include "asm/arch/desc.h"
+/* Taken from asm-i386/desc.h, it's the only thing we need. The rest wouldn't
+ * compile, and has never been used. */
+#define LDT_empty(info) (\
+        (info)->base_addr       == 0    && \
+        (info)->limit           == 0    && \
+        (info)->contents        == 0    && \
+        (info)->read_exec_only  == 1    && \
+        (info)->seg_32bit       == 0    && \
+        (info)->limit_in_pages  == 0    && \
+        (info)->seg_not_present == 1    && \
+        (info)->useable         == 0    )
 
 #endif
diff --git a/include/asm-um/host_ldt-i386.h b/include/asm-um/host_ldt-i386.h
new file mode 100644
index 000000000000..b27cb0a9dd30
--- /dev/null
+++ b/include/asm-um/host_ldt-i386.h
@@ -0,0 +1,34 @@
+#ifndef __ASM_HOST_LDT_I386_H
+#define __ASM_HOST_LDT_I386_H
+
+#include "asm/arch/ldt.h"
+
+/*
+ * macros stolen from include/asm-i386/desc.h
+ */
+#define LDT_entry_a(info) \
+        ((((info)->base_addr & 0x0000ffff) << 16) | ((info)->limit & 0x0ffff))
+
+#define LDT_entry_b(info) \
+        (((info)->base_addr & 0xff000000) | \
+        (((info)->base_addr & 0x00ff0000) >> 16) | \
+        ((info)->limit & 0xf0000) | \
+        (((info)->read_exec_only ^ 1) << 9) | \
+        ((info)->contents << 10) | \
+        (((info)->seg_not_present ^ 1) << 15) | \
+        ((info)->seg_32bit << 22) | \
+        ((info)->limit_in_pages << 23) | \
+        ((info)->useable << 20) | \
+        0x7000)
+
+#define LDT_empty(info) (\
+        (info)->base_addr       == 0    && \
+        (info)->limit           == 0    && \
+        (info)->contents        == 0    && \
+        (info)->read_exec_only  == 1    && \
+        (info)->seg_32bit       == 0    && \
+        (info)->limit_in_pages  == 0    && \
+        (info)->seg_not_present == 1    && \
+        (info)->useable         == 0    )
+
+#endif
diff --git a/include/asm-um/ldt-x86_64.h b/include/asm-um/host_ldt-x86_64.h
index 96b35aada79a..74a63f7d9a90 100644
--- a/include/asm-um/ldt-x86_64.h
+++ b/include/asm-um/host_ldt-x86_64.h
@@ -1,43 +1,8 @@
-/*
- * Copyright (C) 2004 Fujitsu Siemens Computers GmbH
- * Licensed under the GPL
- *
- * Author: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
- */
+#ifndef __ASM_HOST_LDT_X86_64_H
+#define __ASM_HOST_LDT_X86_64_H
 
-#ifndef __ASM_LDT_X86_64_H
-#define __ASM_LDT_X86_64_H
-
-#include "asm/semaphore.h"
 #include "asm/arch/ldt.h"
 
-struct mmu_context_skas;
-extern void ldt_host_info(void);
-extern long init_new_ldt(struct mmu_context_skas * to_mm,
-                         struct mmu_context_skas * from_mm);
-extern void free_ldt(struct mmu_context_skas * mm);
-
-#define LDT_PAGES_MAX \
-        ((LDT_ENTRIES * LDT_ENTRY_SIZE)/PAGE_SIZE)
-#define LDT_ENTRIES_PER_PAGE \
-        (PAGE_SIZE/LDT_ENTRY_SIZE)
-#define LDT_DIRECT_ENTRIES \
-        ((LDT_PAGES_MAX*sizeof(void *))/LDT_ENTRY_SIZE)
-
-struct ldt_entry {
-        __u32 a;
-        __u32 b;
-};
-
-typedef struct uml_ldt {
-        int entry_count;
-        struct semaphore semaphore;
-        union {
-                struct ldt_entry * pages[LDT_PAGES_MAX];
-                struct ldt_entry entries[LDT_DIRECT_ENTRIES];
-        } u;
-} uml_ldt_t;
-
 /*
  * macros stolen from include/asm-x86_64/desc.h
  */
diff --git a/include/asm-um/ldt-i386.h b/include/asm-um/ldt-i386.h
deleted file mode 100644
index 175722a91164..000000000000
--- a/include/asm-um/ldt-i386.h
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- * Copyright (C) 2004 Fujitsu Siemens Computers GmbH
- * Licensed under the GPL
- *
- * Author: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
- */
-
-#ifndef __ASM_LDT_I386_H
-#define __ASM_LDT_I386_H
-
-#include "asm/semaphore.h"
-#include "asm/arch/ldt.h"
-
-struct mmu_context_skas;
-extern void ldt_host_info(void);
-extern long init_new_ldt(struct mmu_context_skas * to_mm,
-                         struct mmu_context_skas * from_mm);
-extern void free_ldt(struct mmu_context_skas * mm);
-
-#define LDT_PAGES_MAX \
-        ((LDT_ENTRIES * LDT_ENTRY_SIZE)/PAGE_SIZE)
-#define LDT_ENTRIES_PER_PAGE \
-        (PAGE_SIZE/LDT_ENTRY_SIZE)
-#define LDT_DIRECT_ENTRIES \
-        ((LDT_PAGES_MAX*sizeof(void *))/LDT_ENTRY_SIZE)
-
-struct ldt_entry {
-        __u32 a;
-        __u32 b;
-};
-
-typedef struct uml_ldt {
-        int entry_count;
-        struct semaphore semaphore;
-        union {
-                struct ldt_entry * pages[LDT_PAGES_MAX];
-                struct ldt_entry entries[LDT_DIRECT_ENTRIES];
-        } u;
-} uml_ldt_t;
-
-/*
- * macros stolen from include/asm-i386/desc.h
- */
-#define LDT_entry_a(info) \
-        ((((info)->base_addr & 0x0000ffff) << 16) | ((info)->limit & 0x0ffff))
-
-#define LDT_entry_b(info) \
-        (((info)->base_addr & 0xff000000) | \
-        (((info)->base_addr & 0x00ff0000) >> 16) | \
-        ((info)->limit & 0xf0000) | \
-        (((info)->read_exec_only ^ 1) << 9) | \
-        ((info)->contents << 10) | \
-        (((info)->seg_not_present ^ 1) << 15) | \
-        ((info)->seg_32bit << 22) | \
-        ((info)->limit_in_pages << 23) | \
-        ((info)->useable << 20) | \
-        0x7000)
-
-#define LDT_empty(info) (\
-        (info)->base_addr       == 0    && \
-        (info)->limit           == 0    && \
-        (info)->contents        == 0    && \
-        (info)->read_exec_only  == 1    && \
-        (info)->seg_32bit       == 0    && \
-        (info)->limit_in_pages  == 0    && \
-        (info)->seg_not_present == 1    && \
-        (info)->useable         == 0    )
-
-#endif
diff --git a/include/asm-um/ldt.h b/include/asm-um/ldt.h
new file mode 100644
index 000000000000..96f82a456ce6
--- /dev/null
+++ b/include/asm-um/ldt.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2004 Fujitsu Siemens Computers GmbH
+ * Licensed under the GPL
+ *
+ * Author: Bodo Stroesser <bstroesser@fujitsu-siemens.com>
+ */
+
+#ifndef __ASM_LDT_H
+#define __ASM_LDT_H
+
+#include "asm/semaphore.h"
+#include "asm/host_ldt.h"
+
+struct mmu_context_skas;
+extern void ldt_host_info(void);
+extern long init_new_ldt(struct mmu_context_skas * to_mm,
+                         struct mmu_context_skas * from_mm);
+extern void free_ldt(struct mmu_context_skas * mm);
+
+#define LDT_PAGES_MAX \
+        ((LDT_ENTRIES * LDT_ENTRY_SIZE)/PAGE_SIZE)
+#define LDT_ENTRIES_PER_PAGE \
+        (PAGE_SIZE/LDT_ENTRY_SIZE)
+#define LDT_DIRECT_ENTRIES \
+        ((LDT_PAGES_MAX*sizeof(void *))/LDT_ENTRY_SIZE)
+
+struct ldt_entry {
+        __u32 a;
+        __u32 b;
+};
+
+typedef struct uml_ldt {
+        int entry_count;
+        struct semaphore semaphore;
+        union {
+                struct ldt_entry * pages[LDT_PAGES_MAX];
+                struct ldt_entry entries[LDT_DIRECT_ENTRIES];
+        } u;
+} uml_ldt_t;
+
+#endif
diff --git a/include/asm-um/processor-i386.h b/include/asm-um/processor-i386.h
index 4108a579eb92..595f1c3e1e40 100644
--- a/include/asm-um/processor-i386.h
+++ b/include/asm-um/processor-i386.h
@@ -1,4 +1,4 @@
-/* 
+/*
  * Copyright (C) 2002 Jeff Dike (jdike@karaya.com)
  * Licensed under the GPL
  */
@@ -6,21 +6,48 @@
 #ifndef __UM_PROCESSOR_I386_H
 #define __UM_PROCESSOR_I386_H
 
+#include "linux/string.h"
+#include "asm/host_ldt.h"
+#include "asm/segment.h"
+
 extern int host_has_xmm;
 extern int host_has_cmov;
 
 /* include faultinfo structure */
 #include "sysdep/faultinfo.h"
 
+struct uml_tls_struct {
+        struct user_desc tls;
+        unsigned flushed:1;
+        unsigned present:1;
+};
+
 struct arch_thread {
+        struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
         unsigned long debugregs[8];
         int debugregs_seq;
         struct faultinfo faultinfo;
 };
 
-#define INIT_ARCH_THREAD { .debugregs           = { [ 0 ... 7 ] = 0 }, \
-                           .debugregs_seq       = 0, \
-                           .faultinfo           = { 0, 0, 0 } }
+#define INIT_ARCH_THREAD { \
+        .tls_array              = { [ 0 ... GDT_ENTRY_TLS_ENTRIES - 1 ] = \
+                                    { .present = 0, .flushed = 0 } }, \
+        .debugregs              = { [ 0 ... 7 ] = 0 }, \
+        .debugregs_seq          = 0, \
+        .faultinfo              = { 0, 0, 0 } \
+}
+
+static inline void arch_flush_thread(struct arch_thread *thread)
+{
+        /* Clear any TLS still hanging */
+        memset(&thread->tls_array, 0, sizeof(thread->tls_array));
+}
+
+static inline void arch_copy_thread(struct arch_thread *from,
+                                    struct arch_thread *to)
+{
+        memcpy(&to->tls_array, &from->tls_array, sizeof(from->tls_array));
+}
 
 #include "asm/arch/user.h"
 
diff --git a/include/asm-um/processor-x86_64.h b/include/asm-um/processor-x86_64.h
index e1e1255a1d36..10609af376c0 100644
--- a/include/asm-um/processor-x86_64.h
+++ b/include/asm-um/processor-x86_64.h
@@ -28,6 +28,15 @@ extern inline void rep_nop(void)
                            .debugregs_seq       = 0, \
                            .faultinfo           = { 0, 0, 0 } }
 
+static inline void arch_flush_thread(struct arch_thread *thread)
+{
+}
+
+static inline void arch_copy_thread(struct arch_thread *from,
+                                    struct arch_thread *to)
+{
+}
+
 #include "asm/arch/user.h"
 
 #define current_text_addr() \
diff --git a/include/asm-um/ptrace-generic.h b/include/asm-um/ptrace-generic.h
index 46599ac44037..503484305e67 100644
--- a/include/asm-um/ptrace-generic.h
+++ b/include/asm-um/ptrace-generic.h
@@ -28,7 +28,7 @@ struct pt_regs {
         union uml_pt_regs regs;
 };
 
-#define EMPTY_REGS { regs : EMPTY_UML_PT_REGS }
+#define EMPTY_REGS { .regs = EMPTY_UML_PT_REGS }
 
 #define PT_REGS_IP(r) UPT_IP(&(r)->regs)
 #define PT_REGS_SP(r) UPT_SP(&(r)->regs)
@@ -60,17 +60,9 @@ extern void show_regs(struct pt_regs *regs);
 extern void send_sigtrap(struct task_struct *tsk, union uml_pt_regs *regs,
                          int error_code);
 
-#endif
+extern int arch_copy_tls(struct task_struct *new);
+extern void clear_flushed_tls(struct task_struct *task);
 
 #endif
 
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
+#endif
diff --git a/include/asm-um/ptrace-i386.h b/include/asm-um/ptrace-i386.h
index fe882b9d917e..30656c962d74 100644
--- a/include/asm-um/ptrace-i386.h
+++ b/include/asm-um/ptrace-i386.h
@@ -8,8 +8,11 @@
 
 #define HOST_AUDIT_ARCH AUDIT_ARCH_I386
 
+#include "linux/compiler.h"
 #include "sysdep/ptrace.h"
 #include "asm/ptrace-generic.h"
+#include "asm/host_ldt.h"
+#include "choose-mode.h"
 
 #define PT_REGS_EAX(r) UPT_EAX(&(r)->regs)
 #define PT_REGS_EBX(r) UPT_EBX(&(r)->regs)
@@ -38,15 +41,31 @@
 
 #define user_mode(r) UPT_IS_USER(&(r)->regs)
 
-#endif
+extern int ptrace_get_thread_area(struct task_struct *child, int idx,
+                                  struct user_desc __user *user_desc);
 
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
+extern int ptrace_set_thread_area(struct task_struct *child, int idx,
+                                  struct user_desc __user *user_desc);
+
+extern int do_set_thread_area_skas(struct user_desc *info);
+extern int do_get_thread_area_skas(struct user_desc *info);
+
+extern int do_set_thread_area_tt(struct user_desc *info);
+extern int do_get_thread_area_tt(struct user_desc *info);
+
+extern int arch_switch_tls_skas(struct task_struct *from, struct task_struct *to);
+extern int arch_switch_tls_tt(struct task_struct *from, struct task_struct *to);
+
+static inline int do_get_thread_area(struct user_desc *info)
+{
+        return CHOOSE_MODE_PROC(do_get_thread_area_tt, do_get_thread_area_skas, info);
+}
+
+static inline int do_set_thread_area(struct user_desc *info)
+{
+        return CHOOSE_MODE_PROC(do_set_thread_area_tt, do_set_thread_area_skas, info);
+}
+
+struct task_struct;
+
+#endif
diff --git a/include/asm-um/ptrace-x86_64.h b/include/asm-um/ptrace-x86_64.h
index be51219a8ffe..c894e68b1f96 100644
--- a/include/asm-um/ptrace-x86_64.h
+++ b/include/asm-um/ptrace-x86_64.h
@@ -8,6 +8,8 @@
 #define __UM_PTRACE_X86_64_H
 
 #include "linux/compiler.h"
+#include "asm/errno.h"
+#include "asm/host_ldt.h"
 
 #define signal_fault signal_fault_x86_64
 #define __FRAME_OFFSETS /* Needed to get the R* macros */
@@ -63,15 +65,26 @@ void signal_fault(struct pt_regs_subarch *regs, void *frame, char *where);
 
 #define profile_pc(regs) PT_REGS_IP(regs)
 
-#endif
+static inline int ptrace_get_thread_area(struct task_struct *child, int idx,
+                                         struct user_desc __user *user_desc)
+{
+        return -ENOSYS;
+}
 
-/*
- * Overrides for Emacs so that we follow Linus's tabbing style.
- * Emacs will notice this stuff at the end of the file and automatically
- * adjust the settings for this buffer only.  This must remain at the end
- * of the file.
- * ---------------------------------------------------------------------------
- * Local variables:
- * c-file-style: "linux"
- * End:
- */
+static inline int ptrace_set_thread_area(struct task_struct *child, int idx,
+                                         struct user_desc __user *user_desc)
+{
+        return -ENOSYS;
+}
+
+static inline void arch_switch_to_tt(struct task_struct *from,
+                                     struct task_struct *to)
+{
+}
+
+static inline void arch_switch_to_skas(struct task_struct *from,
+                                       struct task_struct *to)
+{
+}
+
+#endif
diff --git a/include/asm-um/segment.h b/include/asm-um/segment.h
index 55e40301f625..45183fcd10b6 100644
--- a/include/asm-um/segment.h
+++ b/include/asm-um/segment.h
@@ -1,4 +1,10 @@
 #ifndef __UM_SEGMENT_H
 #define __UM_SEGMENT_H
 
+extern int host_gdt_entry_tls_min;
+
+#define GDT_ENTRY_TLS_ENTRIES 3
+#define GDT_ENTRY_TLS_MIN host_gdt_entry_tls_min
+#define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
+
 #endif
diff --git a/include/asm-um/thread_info.h b/include/asm-um/thread_info.h
index 17b6b07c4332..f166b9837c6a 100644
--- a/include/asm-um/thread_info.h
+++ b/include/asm-um/thread_info.h
@@ -27,14 +27,14 @@ struct thread_info {
 
 #define INIT_THREAD_INFO(tsk)                   \
 {                                               \
-        task:           &tsk,                   \
-        exec_domain:    &default_exec_domain,   \
-        flags:          0,                      \
-        cpu:            0,                      \
-        preempt_count:  1,                      \
-        addr_limit:     KERNEL_DS,              \
-        restart_block:  {                       \
-                fn:  do_no_restart_syscall,     \
+        .task =         &tsk,                   \
+        .exec_domain =  &default_exec_domain,   \
+        .flags =                0,              \
+        .cpu =          0,                      \
+        .preempt_count =        1,              \
+        .addr_limit =   KERNEL_DS,              \
+        .restart_block =  {                     \
+                .fn =  do_no_restart_syscall,   \
         },                                      \
 }
 
diff --git a/include/asm-um/uaccess.h b/include/asm-um/uaccess.h
index 4e460d6f5ac8..bea5a015f667 100644
--- a/include/asm-um/uaccess.h
+++ b/include/asm-um/uaccess.h
@@ -57,7 +57,7 @@
 ({ \
         const __typeof__((*(ptr))) __user *private_ptr = (ptr); \
         (access_ok(VERIFY_READ, private_ptr, sizeof(*private_ptr)) ? \
-         __get_user(x, private_ptr) : ((x) = 0, -EFAULT)); \
+         __get_user(x, private_ptr) : ((x) = (__typeof__(*ptr))0, -EFAULT)); \
 })
 
 #define __put_user(x, ptr) \
diff --git a/include/asm-x86_64/local.h b/include/asm-x86_64/local.h
index bf148037d4e5..cd17945bf218 100644
--- a/include/asm-x86_64/local.h
+++ b/include/asm-x86_64/local.h
@@ -5,7 +5,7 @@
 
 typedef struct
 {
-        volatile unsigned long counter;
+        volatile long counter;
 } local_t;
 
 #define LOCAL_INIT(i)   { (i) }
@@ -13,7 +13,7 @@ typedef struct
 #define local_read(v)   ((v)->counter)
 #define local_set(v,i)  (((v)->counter) = (i))
 
-static __inline__ void local_inc(local_t *v)
+static inline void local_inc(local_t *v)
 {
         __asm__ __volatile__(
                 "incq %0"
@@ -21,7 +21,7 @@ static __inline__ void local_inc(local_t *v)
                 :"m" (v->counter));
 }
 
-static __inline__ void local_dec(local_t *v)
+static inline void local_dec(local_t *v)
 {
         __asm__ __volatile__(
                 "decq %0"
@@ -29,7 +29,7 @@ static __inline__ void local_dec(local_t *v)
                 :"m" (v->counter));
 }
 
-static __inline__ void local_add(unsigned int i, local_t *v)
+static inline void local_add(long i, local_t *v)
 {
         __asm__ __volatile__(
                 "addq %1,%0"
@@ -37,7 +37,7 @@ static __inline__ void local_add(unsigned int i, local_t *v)
                 :"ir" (i), "m" (v->counter));
 }
 
-static __inline__ void local_sub(unsigned int i, local_t *v)
+static inline void local_sub(long i, local_t *v)
 {
         __asm__ __volatile__(
                 "subq %1,%0"
diff --git a/include/linux/backlight.h b/include/linux/backlight.h
index bb9e54322322..75e91f5b6a04 100644
--- a/include/linux/backlight.h
+++ b/include/linux/backlight.h
@@ -19,20 +19,25 @@ struct fb_info;
 struct backlight_properties {
         /* Owner module */
         struct module *owner;
-        /* Get the backlight power status (0: full on, 1..3: power saving
-           modes; 4: full off), see FB_BLANK_XXX */
-        int (*get_power)(struct backlight_device *);
-        /* Enable or disable power to the LCD (0: on; 4: off, see FB_BLANK_XXX) */
-        int (*set_power)(struct backlight_device *, int power);
-        /* Maximal value for brightness (read-only) */
-        int max_brightness;
-        /* Get current backlight brightness */
+
+        /* Notify the backlight driver some property has changed */
+        int (*update_status)(struct backlight_device *);
+        /* Return the current backlight brightness (accounting for power,
+           fb_blank etc.) */
         int (*get_brightness)(struct backlight_device *);
-        /* Set backlight brightness (0..max_brightness) */
-        int (*set_brightness)(struct backlight_device *, int brightness);
         /* Check if given framebuffer device is the one bound to this backlight;
            return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
         int (*check_fb)(struct fb_info *);
+
+        /* Current User requested brightness (0 - max_brightness) */
+        int brightness;
+        /* Maximal value for brightness (read-only) */
+        int max_brightness;
+        /* Current FB Power mode (0: full on, 1..3: power saving
+           modes; 4: full off), see FB_BLANK_XXX */
+        int power;
+        /* FB Blanking active? (values as for power) */
+        int fb_blank;
 };
 
 struct backlight_device {
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d10bd30c337e..836325ee0931 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -275,6 +275,7 @@ extern void d_move(struct dentry *, struct dentry *);
 /* appendix may either be NULL or be used for transname suffixes */
 extern struct dentry * d_lookup(struct dentry *, struct qstr *);
 extern struct dentry * __d_lookup(struct dentry *, struct qstr *);
+extern struct dentry * d_hash_and_lookup(struct dentry *, struct qstr *);
 
 /* validate "insecure" dentry pointer */
 extern int d_validate(struct dentry *, struct dentry *);
diff --git a/include/linux/fadvise.h b/include/linux/fadvise.h
index b2913bba35d8..e8e747139b9a 100644
--- a/include/linux/fadvise.h
+++ b/include/linux/fadvise.h
@@ -18,10 +18,4 @@
 #define POSIX_FADV_NOREUSE      5 /* Data will be accessed once.  */
 #endif
 
-/*
- * Linux-specific fadvise() extensions:
- */
-#define LINUX_FADV_ASYNC_WRITE  32      /* Start writeout on range */
-#define LINUX_FADV_WRITE_WAIT   33      /* Wait upon writeout to range */
-
 #endif  /* FADVISE_H_INCLUDED */
diff --git a/include/linux/fb.h b/include/linux/fb.h
index d03fadfcafe3..315d89740ddf 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -839,12 +839,10 @@ struct fb_info {
 #define FB_LEFT_POS(bpp)          (32 - bpp)
 #define FB_SHIFT_HIGH(val, bits)  ((val) >> (bits))
 #define FB_SHIFT_LOW(val, bits)   ((val) << (bits))
-#define FB_BIT_NR(b)              (7 - (b))
 #else
 #define FB_LEFT_POS(bpp)          (0)
 #define FB_SHIFT_HIGH(val, bits)  ((val) << (bits))
 #define FB_SHIFT_LOW(val, bits)   ((val) >> (bits))
-#define FB_BIT_NR(b)              (b)
 #endif
 
     /*
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 20fa5f6d7269..4ed7e602d703 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -757,6 +757,13 @@ extern void send_sigio(struct fown_struct *fown, int fd, int band);
 extern int fcntl_setlease(unsigned int fd, struct file *filp, long arg);
 extern int fcntl_getlease(struct file *filp);
 
+/* fs/sync.c */
+#define SYNC_FILE_RANGE_WAIT_BEFORE     1
+#define SYNC_FILE_RANGE_WRITE           2
+#define SYNC_FILE_RANGE_WAIT_AFTER      4
+extern int do_sync_file_range(struct file *file, loff_t offset, loff_t endbyte,
+                        int flags);
+
 /* fs/locks.c */
 extern void locks_init_lock(struct file_lock *);
 extern void locks_copy_lock(struct file_lock *, struct file_lock *);
@@ -1413,6 +1420,7 @@ extern void bd_release_from_disk(struct block_device *, struct gendisk *);
 #endif
 
 /* fs/char_dev.c */
+#define CHRDEV_MAJOR_HASH_SIZE  255
 extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
 extern int register_chrdev_region(dev_t, unsigned, const char *);
 extern int register_chrdev(unsigned int, const char *,
@@ -1420,25 +1428,17 @@ extern int register_chrdev(unsigned int, const char *,
 extern int unregister_chrdev(unsigned int, const char *);
 extern void unregister_chrdev_region(dev_t, unsigned);
 extern int chrdev_open(struct inode *, struct file *);
-extern int get_chrdev_list(char *);
-extern void *acquire_chrdev_list(void);
-extern int count_chrdev_list(void);
-extern void *get_next_chrdev(void *);
-extern int get_chrdev_info(void *, int *, char **);
-extern void release_chrdev_list(void *);
+extern void chrdev_show(struct seq_file *,off_t);
 
 /* fs/block_dev.c */
+#define BLKDEV_MAJOR_HASH_SIZE  255
 #define BDEVNAME_SIZE   32      /* Largest string for a blockdev identifier */
 extern const char *__bdevname(dev_t, char *buffer);
 extern const char *bdevname(struct block_device *bdev, char *buffer);
 extern struct block_device *lookup_bdev(const char *);
 extern struct block_device *open_bdev_excl(const char *, int, void *);
 extern void close_bdev_excl(struct block_device *);
-extern void *acquire_blkdev_list(void);
-extern int count_blkdev_list(void);
-extern void *get_next_blkdev(void *);
-extern int get_blkdev_info(void *, int *, char **);
-extern void release_blkdev_list(void *);
+extern void blkdev_show(struct seq_file *,off_t);
 
 extern void init_special_inode(struct inode *, umode_t, dev_t);
 
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index 93830158348e..b20939287613 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -58,6 +58,19 @@ struct hrtimer {
 };
 
 /**
+ * struct hrtimer_sleeper - simple sleeper structure
+ *
+ * @timer:      embedded timer structure
+ * @task:       task to wake up
+ *
+ * task is set to NULL, when the timer expires.
+ */
+struct hrtimer_sleeper {
+        struct hrtimer timer;
+        struct task_struct *task;
+};
+
+/**
  * struct hrtimer_base - the timer base for a specific clock
  *
  * @index:              clock type index for per_cpu support when moving a timer
@@ -127,6 +140,9 @@ extern long hrtimer_nanosleep(struct timespec *rqtp,
                               const enum hrtimer_mode mode,
                               const clockid_t clockid);
 
+extern void hrtimer_init_sleeper(struct hrtimer_sleeper *sl,
+                                 struct task_struct *tsk);
+
 /* Soft interrupt function to run the hrtimer queues: */
 extern void hrtimer_run_queues(void);
 
diff --git a/include/linux/ipmi_smi.h b/include/linux/ipmi_smi.h
index 53571288a9fc..6d9c7e4da472 100644
--- a/include/linux/ipmi_smi.h
+++ b/include/linux/ipmi_smi.h
@@ -82,6 +82,13 @@ struct ipmi_smi_handlers
 {
         struct module *owner;
 
+        /* The low-level interface cannot start sending messages to
+           the upper layer until this function is called.  This may
+           not be NULL, the lower layer must take the interface from
+           this call. */
+        int (*start_processing)(void       *send_info,
+                                ipmi_smi_t new_intf);
+
         /* Called to enqueue an SMI message to be sent.  This
            operation is not allowed to fail.  If an error occurs, it
            should report back the error in a received message.  It may
@@ -157,13 +164,16 @@ static inline void ipmi_demangle_device_id(unsigned char *data,
 }
 
 /* Add a low-level interface to the IPMI driver.  Note that if the
-   interface doesn't know its slave address, it should pass in zero. */
+   interface doesn't know its slave address, it should pass in zero.
+   The low-level interface should not deliver any messages to the
+   upper layer until the start_processing() function in the handlers
+   is called, and the lower layer must get the interface from that
+   call. */
 int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
                       void                     *send_info,
                       struct ipmi_device_id    *device_id,
                       struct device            *dev,
-                      unsigned char            slave_addr,
-                      ipmi_smi_t               *intf);
+                      unsigned char            slave_addr);
 
 /*
  * Remove a low-level interface from the IPMI driver.  This will
diff --git a/include/linux/leds.h b/include/linux/leds.h
new file mode 100644
index 000000000000..4617e75903b0
--- /dev/null
+++ b/include/linux/leds.h
@@ -0,0 +1,111 @@
+/*
+ * Driver model for leds and led triggers
+ *
+ * Copyright (C) 2005 John Lenz <lenz@cs.wisc.edu>
+ * Copyright (C) 2005 Richard Purdie <rpurdie@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#ifndef __LINUX_LEDS_H_INCLUDED
+#define __LINUX_LEDS_H_INCLUDED
+
+struct device;
+struct class_device;
+/*
+ * LED Core
+ */
+
+enum led_brightness {
+        LED_OFF = 0,
+        LED_HALF = 127,
+        LED_FULL = 255,
+};
+
+struct led_classdev {
+        const char *name;
+        int brightness;
+        int flags;
+#define LED_SUSPENDED       (1 << 0)
+
+        /* A function to set the brightness of the led */
+        void (*brightness_set)(struct led_classdev *led_cdev,
+                                enum led_brightness brightness);
+
+        struct class_device *class_dev;
+        /* LED Device linked list */
+        struct list_head node;
+
+        /* Trigger data */
+        char *default_trigger;
+#ifdef CONFIG_LEDS_TRIGGERS
+        rwlock_t trigger_lock;
+        /* Protects the trigger data below */
+
+        struct led_trigger *trigger;
+        struct list_head trig_list;
+        void *trigger_data;
+#endif
+};
+
+extern int led_classdev_register(struct device *parent,
+                                struct led_classdev *led_cdev);
+extern void led_classdev_unregister(struct led_classdev *led_cdev);
+extern void led_classdev_suspend(struct led_classdev *led_cdev);
+extern void led_classdev_resume(struct led_classdev *led_cdev);
+
+/*
+ * LED Triggers
+ */
+#ifdef CONFIG_LEDS_TRIGGERS
+
+#define TRIG_NAME_MAX 50
+
+struct led_trigger {
+        /* Trigger Properties */
+        const char *name;
+        void (*activate)(struct led_classdev *led_cdev);
+        void (*deactivate)(struct led_classdev *led_cdev);
+
+        /* LEDs under control by this trigger (for simple triggers) */
+        rwlock_t leddev_list_lock;
+        struct list_head led_cdevs;
+
+        /* Link to next registered trigger */
+        struct list_head next_trig;
+};
+
+/* Registration functions for complex triggers */
+extern int led_trigger_register(struct led_trigger *trigger);
+extern void led_trigger_unregister(struct led_trigger *trigger);
+
+/* Registration functions for simple triggers */
+#define DEFINE_LED_TRIGGER(x)           static struct led_trigger *x;
+#define DEFINE_LED_TRIGGER_GLOBAL(x)    struct led_trigger *x;
+extern void led_trigger_register_simple(const char *name,
+                                struct led_trigger **trigger);
+extern void led_trigger_unregister_simple(struct led_trigger *trigger);
+extern void led_trigger_event(struct led_trigger *trigger,
+                                enum led_brightness event);
+
+#else
+
+/* Triggers aren't active - null macros */
+#define DEFINE_LED_TRIGGER(x)
+#define DEFINE_LED_TRIGGER_GLOBAL(x)
+#define led_trigger_register_simple(x, y) do {} while(0)
+#define led_trigger_unregister_simple(x) do {} while(0)
+#define led_trigger_event(x, y) do {} while(0)
+
+#endif
+
+/* Trigger specific functions */
+#ifdef CONFIG_LEDS_TRIGGER_IDE_DISK
+extern void ledtrig_ide_activity(void);
+#else
+#define ledtrig_ide_activity() do {} while(0)
+#endif
+
+#endif          /* __LINUX_LEDS_H_INCLUDED */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 047192253c3a..0d61357604d5 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -160,8 +160,10 @@ enum {
         ATA_QCFLAG_DMAMAP       = ATA_QCFLAG_SG | ATA_QCFLAG_SINGLE,
         ATA_QCFLAG_EH_SCHEDULED = (1 << 5), /* EH scheduled */
 
+        /* host set flags */
+        ATA_HOST_SIMPLEX        = (1 << 0),     /* Host is simplex, one DMA channel per host_set only */
+        
         /* various lengths of time */
-        ATA_TMOUT_EDD           = 5 * HZ,       /* heuristic */
         ATA_TMOUT_PIO           = 30 * HZ,
         ATA_TMOUT_BOOT          = 30 * HZ,      /* heuristic */
         ATA_TMOUT_BOOT_QUICK    = 7 * HZ,       /* heuristic */
@@ -279,6 +281,7 @@ struct ata_probe_ent {
         unsigned long           irq;
         unsigned int            irq_flags;
         unsigned long           host_flags;
+        unsigned long           host_set_flags;
         void __iomem            *mmio_base;
         void                    *private_data;
 };
@@ -291,6 +294,9 @@ struct ata_host_set {
         unsigned int            n_ports;
         void                    *private_data;
         const struct ata_port_operations *ops;
+        unsigned long           flags;
+        int                     simplex_claimed;        /* Keep seperate in case we
+                                                           ever need to do this locked */
         struct ata_port *       ports[0];
 };
 
@@ -420,6 +426,7 @@ struct ata_port_operations {
 
         void (*set_piomode) (struct ata_port *, struct ata_device *);
         void (*set_dmamode) (struct ata_port *, struct ata_device *);
+        unsigned long (*mode_filter) (const struct ata_port *, struct ata_device *, unsigned long);
 
         void (*tf_load) (struct ata_port *ap, const struct ata_taskfile *tf);
         void (*tf_read) (struct ata_port *ap, struct ata_taskfile *tf);
@@ -430,6 +437,7 @@ struct ata_port_operations {
         void (*dev_select)(struct ata_port *ap, unsigned int device);
 
         void (*phy_reset) (struct ata_port *ap); /* obsolete */
+        void (*set_mode) (struct ata_port *ap);
         int (*probe_reset) (struct ata_port *ap, unsigned int *classes);
 
         void (*post_set_mode) (struct ata_port *ap);
diff --git a/include/linux/migrate.h b/include/linux/migrate.h
index 7d09962c3c0b..ff0a64073ebc 100644
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -12,7 +12,7 @@ extern void migrate_page_copy(struct page *, struct page *);
 extern int migrate_page_remove_references(struct page *, struct page *, int);
 extern int migrate_pages(struct list_head *l, struct list_head *t,
                 struct list_head *moved, struct list_head *failed);
-int migrate_pages_to(struct list_head *pagelist,
+extern int migrate_pages_to(struct list_head *pagelist,
                         struct vm_area_struct *vma, int dest);
 extern int fail_migrate_page(struct page *, struct page *);
 
@@ -26,6 +26,9 @@ static inline int putback_lru_pages(struct list_head *l) { return 0; }
 static inline int migrate_pages(struct list_head *l, struct list_head *t,
         struct list_head *moved, struct list_head *failed) { return -ENOSYS; }
 
+static inline int migrate_pages_to(struct list_head *pagelist,
+                        struct vm_area_struct *vma, int dest) { return 0; }
+
 static inline int migrate_prep(void) { return -ENOSYS; }
 
 /* Possible settings for the migrate_page() method in address_operations */
diff --git a/include/linux/mtd/blktrans.h b/include/linux/mtd/blktrans.h
index f46afec6fbf8..72fc68c5ee96 100644
--- a/include/linux/mtd/blktrans.h
+++ b/include/linux/mtd/blktrans.h
@@ -10,7 +10,7 @@
 #ifndef __MTD_TRANS_H__
 #define __MTD_TRANS_H__
 
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 struct hd_geometry;
 struct mtd_info;
@@ -22,7 +22,7 @@ struct mtd_blktrans_dev {
         struct mtd_blktrans_ops *tr;
         struct list_head list;
         struct mtd_info *mtd;
-        struct semaphore sem;
+        struct mutex lock;
         int devnum;
         int blksize;
         unsigned long size;
diff --git a/include/linux/mtd/doc2000.h b/include/linux/mtd/doc2000.h
index 386a52cf8b1b..9addd073bf15 100644
--- a/include/linux/mtd/doc2000.h
+++ b/include/linux/mtd/doc2000.h
@@ -15,7 +15,7 @@
 #define __MTD_DOC2000_H__
 
 #include <linux/mtd/mtd.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 #define DoC_Sig1 0
 #define DoC_Sig2 1
@@ -187,7 +187,7 @@ struct DiskOnChip {
         int numchips;
         struct Nand *chips;
         struct mtd_info *nextdoc;
-        struct semaphore lock;
+        struct mutex lock;
 };
 
 int doc_decode_ecc(unsigned char sector[512], unsigned char ecc1[6]);
diff --git a/include/linux/mtd/inftl.h b/include/linux/mtd/inftl.h
index 0268125a6271..d7eaa40e5ab0 100644
--- a/include/linux/mtd/inftl.h
+++ b/include/linux/mtd/inftl.h
@@ -52,6 +52,11 @@ struct INFTLrecord {
 int INFTL_mount(struct INFTLrecord *s);
 int INFTL_formatblock(struct INFTLrecord *s, int block);
 
+extern char inftlmountrev[];
+
+void INFTL_dumptables(struct INFTLrecord *s);
+void INFTL_dumpVUchains(struct INFTLrecord *s);
+
 #endif /* __KERNEL__ */
 
 #endif /* __MTD_INFTL_H__ */
diff --git a/include/linux/namei.h b/include/linux/namei.h
index e6698013e4d0..58cb3d3d44b4 100644
--- a/include/linux/namei.h
+++ b/include/linux/namei.h
@@ -75,7 +75,6 @@ extern struct file *nameidata_to_filp(struct nameidata *nd, int flags);
 extern void release_open_intent(struct nameidata *);
 
 extern struct dentry * lookup_one_len(const char *, struct dentry *, int);
-extern __deprecated_for_modules struct dentry * lookup_hash(struct nameidata *);
 
 extern int follow_down(struct vfsmount **, struct dentry **);
 extern int follow_up(struct vfsmount **, struct dentry **);
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 950dc55e5192..40ccf8cc4239 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -598,20 +598,7 @@ DECLARE_PER_CPU(struct softnet_data,softnet_data);
 
 #define HAVE_NETIF_QUEUE
 
-static inline void __netif_schedule(struct net_device *dev)
-{
-        if (!test_and_set_bit(__LINK_STATE_SCHED, &dev->state)) {
-                unsigned long flags;
-                struct softnet_data *sd;
-
-                local_irq_save(flags);
-                sd = &__get_cpu_var(softnet_data);
-                dev->next_sched = sd->output_queue;
-                sd->output_queue = dev;
-                raise_softirq_irqoff(NET_TX_SOFTIRQ);
-                local_irq_restore(flags);
-        }
-}
+extern void __netif_schedule(struct net_device *dev);
 
 static inline void netif_schedule(struct net_device *dev)
 {
@@ -675,13 +662,7 @@ static inline void dev_kfree_skb_irq(struct sk_buff *skb)
 /* Use this variant in places where it could be invoked
  * either from interrupt or non-interrupt context.
  */
-static inline void dev_kfree_skb_any(struct sk_buff *skb)
-{
-        if (in_irq() || irqs_disabled())
-                dev_kfree_skb_irq(skb);
-        else
-                dev_kfree_skb(skb);
-}
+extern void dev_kfree_skb_any(struct sk_buff *skb);
 
 #define HAVE_NETIF_RX 1
 extern int              netif_rx(struct sk_buff *skb);
@@ -768,22 +749,9 @@ static inline int netif_device_present(struct net_device *dev)
         return test_bit(__LINK_STATE_PRESENT, &dev->state);
 }
 
-static inline void netif_device_detach(struct net_device *dev)
-{
-        if (test_and_clear_bit(__LINK_STATE_PRESENT, &dev->state) &&
-            netif_running(dev)) {
-                netif_stop_queue(dev);
-        }
-}
+extern void netif_device_detach(struct net_device *dev);
 
-static inline void netif_device_attach(struct net_device *dev)
-{
-        if (!test_and_set_bit(__LINK_STATE_PRESENT, &dev->state) &&
-            netif_running(dev)) {
-                netif_wake_queue(dev);
-                __netdev_watchdog_up(dev);
-        }
-}
+extern void netif_device_attach(struct net_device *dev);
 
 /*
  * Network interface message level settings
@@ -851,20 +819,7 @@ static inline int netif_rx_schedule_prep(struct net_device *dev)
  * already been called and returned 1.
  */
 
-static inline void __netif_rx_schedule(struct net_device *dev)
-{
-        unsigned long flags;
-
-        local_irq_save(flags);
-        dev_hold(dev);
-        list_add_tail(&dev->poll_list, &__get_cpu_var(softnet_data).poll_list);
-        if (dev->quota < 0)
-                dev->quota += dev->weight;
-        else
-                dev->quota = dev->weight;
-        __raise_softirq_irqoff(NET_RX_SOFTIRQ);
-        local_irq_restore(flags);
-}
+extern void __netif_rx_schedule(struct net_device *dev);
 
 /* Try to reschedule poll. Called by irq handler. */
 
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 839f0b3c23aa..9539efd4f7e6 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -72,8 +72,8 @@ extern struct page * find_get_page(struct address_space *mapping,
                                 unsigned long index);
 extern struct page * find_lock_page(struct address_space *mapping,
                                 unsigned long index);
-extern struct page * find_trylock_page(struct address_space *mapping,
-                                unsigned long index);
+extern __deprecated_for_modules struct page * find_trylock_page(
+                        struct address_space *mapping, unsigned long index);
 extern struct page * find_or_create_page(struct address_space *mapping,
                                 unsigned long index, gfp_t gfp_mask);
 unsigned find_get_pages(struct address_space *mapping, pgoff_t start,
diff --git a/include/linux/pid.h b/include/linux/pid.h
index 5b9082cc600f..29960b03bef7 100644
--- a/include/linux/pid.h
+++ b/include/linux/pid.h
@@ -1,6 +1,8 @@
 #ifndef _LINUX_PID_H
 #define _LINUX_PID_H
 
+#include <linux/rcupdate.h>
+
 enum pid_type
 {
         PIDTYPE_PID,
@@ -9,45 +11,109 @@ enum pid_type
         PIDTYPE_MAX
 };
 
+/*
+ * What is struct pid?
+ *
+ * A struct pid is the kernel's internal notion of a process identifier.
+ * It refers to individual tasks, process groups, and sessions.  While
+ * there are processes attached to it the struct pid lives in a hash
+ * table, so it and then the processes that it refers to can be found
+ * quickly from the numeric pid value.  The attached processes may be
+ * quickly accessed by following pointers from struct pid.
+ *
+ * Storing pid_t values in the kernel and refering to them later has a
+ * problem.  The process originally with that pid may have exited and the
+ * pid allocator wrapped, and another process could have come along
+ * and been assigned that pid.
+ *
+ * Referring to user space processes by holding a reference to struct
+ * task_struct has a problem.  When the user space process exits
+ * the now useless task_struct is still kept.  A task_struct plus a
+ * stack consumes around 10K of low kernel memory.  More precisely
+ * this is THREAD_SIZE + sizeof(struct task_struct).  By comparison
+ * a struct pid is about 64 bytes.
+ *
+ * Holding a reference to struct pid solves both of these problems.
+ * It is small so holding a reference does not consume a lot of
+ * resources, and since a new struct pid is allocated when the numeric
+ * pid value is reused we don't mistakenly refer to new processes.
+ */
+
 struct pid
 {
+        atomic_t count;
         /* Try to keep pid_chain in the same cacheline as nr for find_pid */
         int nr;
         struct hlist_node pid_chain;
-        /* list of pids with the same nr, only one of them is in the hash */
-        struct list_head pid_list;
+        /* lists of tasks that use this pid */
+        struct hlist_head tasks[PIDTYPE_MAX];
+        struct rcu_head rcu;
 };
 
-#define pid_task(elem, type) \
-        list_entry(elem, struct task_struct, pids[type].pid_list)
+struct pid_link
+{
+        struct hlist_node node;
+        struct pid *pid;
+};
+
+static inline struct pid *get_pid(struct pid *pid)
+{
+        if (pid)
+                atomic_inc(&pid->count);
+        return pid;
+}
+
+extern void FASTCALL(put_pid(struct pid *pid));
+extern struct task_struct *FASTCALL(pid_task(struct pid *pid, enum pid_type));
+extern struct task_struct *FASTCALL(get_pid_task(struct pid *pid,
+                                                enum pid_type));
 
 /*
  * attach_pid() and detach_pid() must be called with the tasklist_lock
  * write-held.
  */
-extern int FASTCALL(attach_pid(struct task_struct *task, enum pid_type type, int nr));
+extern int FASTCALL(attach_pid(struct task_struct *task,
+                                enum pid_type type, int nr));
 
 extern void FASTCALL(detach_pid(struct task_struct *task, enum pid_type));
 
 /*
  * look up a PID in the hash table. Must be called with the tasklist_lock
- * held.
+ * or rcu_read_lock() held.
+ */
+extern struct pid *FASTCALL(find_pid(int nr));
+
+/*
+ * Lookup a PID in the hash table, and return with it's count elevated.
  */
-extern struct pid *FASTCALL(find_pid(enum pid_type, int));
+extern struct pid *find_get_pid(int nr);
 
-extern int alloc_pidmap(void);
-extern void FASTCALL(free_pidmap(int));
+extern struct pid *alloc_pid(void);
+extern void FASTCALL(free_pid(struct pid *pid));
 
+#define pid_next(task, type)                                    \
+        ((task)->pids[(type)].node.next)
+
+#define pid_next_task(task, type)                               \
+        hlist_entry(pid_next(task, type), struct task_struct,   \
+                        pids[(type)].node)
+
+
+/* We could use hlist_for_each_entry_rcu here but it takes more arguments
+ * than the do_each_task_pid/while_each_task_pid.  So we roll our own
+ * to preserve the existing interface.
+ */
 #define do_each_task_pid(who, type, task)                               \
         if ((task = find_task_by_pid_type(type, who))) {                \
-                prefetch((task)->pids[type].pid_list.next);             \
+                prefetch(pid_next(task, type));                         \
                 do {
 
 #define while_each_task_pid(who, type, task)                            \
-                } while (task = pid_task((task)->pids[type].pid_list.next,\
-                                                type),                  \
-                        prefetch((task)->pids[type].pid_list.next),     \
-                        hlist_unhashed(&(task)->pids[type].pid_chain)); \
-        }                                                               \
+                } while (pid_next(task, type) &&  ({                    \
+                                task = pid_next_task(task, type);       \
+                                rcu_dereference(task);                  \
+                                prefetch(pid_next(task, type));         \
+                                1; }) );                                \
+        }
 
 #endif /* _LINUX_PID_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index d04186d8cc68..541f4828f5e7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -100,6 +100,7 @@ DECLARE_PER_CPU(unsigned long, process_counts);
 extern int nr_processes(void);
 extern unsigned long nr_running(void);
 extern unsigned long nr_uninterruptible(void);
+extern unsigned long nr_active(void);
 extern unsigned long nr_iowait(void);
 
 #include <linux/time.h>
@@ -483,6 +484,7 @@ struct signal_struct {
 #define MAX_PRIO                (MAX_RT_PRIO + 40)
 
 #define rt_task(p)              (unlikely((p)->prio < MAX_RT_PRIO))
+#define batch_task(p)           (unlikely((p)->policy == SCHED_BATCH))
 
 /*
  * Some day this will be a full-fledged user tracking system..
@@ -683,6 +685,13 @@ static inline void prefetch_stack(struct task_struct *t) { }
 struct audit_context;           /* See audit.c */
 struct mempolicy;
 
+enum sleep_type {
+        SLEEP_NORMAL,
+        SLEEP_NONINTERACTIVE,
+        SLEEP_INTERACTIVE,
+        SLEEP_INTERRUPTED,
+};
+
 struct task_struct {
         volatile long state;    /* -1 unrunnable, 0 runnable, >0 stopped */
         struct thread_info *thread_info;
@@ -705,7 +714,7 @@ struct task_struct {
         unsigned long sleep_avg;
         unsigned long long timestamp, last_ran;
         unsigned long long sched_time; /* sched_clock time spent running */
-        int activated;
+        enum sleep_type sleep_type;
 
         unsigned long policy;
         cpumask_t cpus_allowed;
@@ -751,7 +760,7 @@ struct task_struct {
         struct task_struct *group_leader;       /* threadgroup leader */
 
         /* PID/PID hash table linkage. */
-        struct pid pids[PIDTYPE_MAX];
+        struct pid_link pids[PIDTYPE_MAX];
         struct list_head thread_group;
 
         struct completion *vfork_done;          /* for vfork() */
@@ -890,18 +899,19 @@ static inline pid_t process_group(struct task_struct *tsk)
  */
 static inline int pid_alive(struct task_struct *p)
 {
-        return p->pids[PIDTYPE_PID].nr != 0;
+        return p->pids[PIDTYPE_PID].pid != NULL;
 }
 
 extern void free_task(struct task_struct *tsk);
 #define get_task_struct(tsk) do { atomic_inc(&(tsk)->usage); } while(0)
 
 extern void __put_task_struct_cb(struct rcu_head *rhp);
+extern void __put_task_struct(struct task_struct *t);
 
 static inline void put_task_struct(struct task_struct *t)
 {
         if (atomic_dec_and_test(&t->usage))
-                call_rcu(&t->rcu, __put_task_struct_cb);
+                __put_task_struct(t);
 }
 
 /*
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 613b9513f8b9..c4619a428d9b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -941,6 +941,25 @@ static inline void skb_reserve(struct sk_buff *skb, int len)
 #define NET_IP_ALIGN    2
 #endif
 
+/*
+ * The networking layer reserves some headroom in skb data (via
+ * dev_alloc_skb). This is used to avoid having to reallocate skb data when
+ * the header has to grow. In the default case, if the header has to grow
+ * 16 bytes or less we avoid the reallocation.
+ *
+ * Unfortunately this headroom changes the DMA alignment of the resulting
+ * network packet. As for NET_IP_ALIGN, this unaligned DMA is expensive
+ * on some architectures. An architecture can override this value,
+ * perhaps setting it to a cacheline in size (since that will maintain
+ * cacheline alignment of the DMA). It must be a power of 2.
+ *
+ * Various parts of the networking layer expect at least 16 bytes of
+ * headroom, you should not reduce this.
+ */
+#ifndef NET_SKB_PAD
+#define NET_SKB_PAD     16
+#endif
+
 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len, int realloc);
 
 static inline void __skb_trim(struct sk_buff *skb, unsigned int len)
@@ -1030,9 +1049,9 @@ static inline void __skb_queue_purge(struct sk_buff_head *list)
 static inline struct sk_buff *__dev_alloc_skb(unsigned int length,
                                               gfp_t gfp_mask)
 {
-        struct sk_buff *skb = alloc_skb(length + 16, gfp_mask);
+        struct sk_buff *skb = alloc_skb(length + NET_SKB_PAD, gfp_mask);
         if (likely(skb))
-                skb_reserve(skb, 16);
+                skb_reserve(skb, NET_SKB_PAD);
         return skb;
 }
 #else
@@ -1070,13 +1089,15 @@ static inline struct sk_buff *dev_alloc_skb(unsigned int length)
  */
 static inline int skb_cow(struct sk_buff *skb, unsigned int headroom)
 {
-        int delta = (headroom > 16 ? headroom : 16) - skb_headroom(skb);
+        int delta = (headroom > NET_SKB_PAD ? headroom : NET_SKB_PAD) -
+                        skb_headroom(skb);
 
         if (delta < 0)
                 delta = 0;
 
         if (delta || skb_cloned(skb))
-                return pskb_expand_head(skb, (delta + 15) & ~15, 0, GFP_ATOMIC);
+                return pskb_expand_head(skb, (delta + (NET_SKB_PAD-1)) &
+                                ~(NET_SKB_PAD-1), 0, GFP_ATOMIC);
         return 0;
 }
 
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index e78ffc7d5b56..5717147596b6 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -571,5 +571,7 @@ asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
 asmlinkage long sys_unshare(unsigned long unshare_flags);
 asmlinkage long sys_splice(int fdin, int fdout, size_t len,
                                 unsigned int flags);
+asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
+                                        int flags);
 
 #endif
diff --git a/include/linux/timer.h b/include/linux/timer.h
index b5caabca553c..0a485beba9f5 100644
--- a/include/linux/timer.h
+++ b/include/linux/timer.h
@@ -6,7 +6,7 @@
 #include <linux/spinlock.h>
 #include <linux/stddef.h>
 
-struct timer_base_s;
+struct tvec_t_base_s;
 
 struct timer_list {
         struct list_head entry;
@@ -15,16 +15,16 @@ struct timer_list {
         void (*function)(unsigned long);
         unsigned long data;
 
-        struct timer_base_s *base;
+        struct tvec_t_base_s *base;
 };
 
-extern struct timer_base_s __init_timer_base;
+extern struct tvec_t_base_s boot_tvec_bases;
 
 #define TIMER_INITIALIZER(_function, _expires, _data) {         \
                 .function = (_function),                        \
                 .expires = (_expires),                          \
                 .data = (_data),                                \
-                .base = &__init_timer_base,                     \
+                .base = &boot_tvec_bases,                       \
         }
 
 #define DEFINE_TIMER(_name, _function, _expires, _data)         \
diff --git a/include/linux/tiocl.h b/include/linux/tiocl.h
index 2c9e847f6ed1..4756862c4ed4 100644
--- a/include/linux/tiocl.h
+++ b/include/linux/tiocl.h
@@ -34,5 +34,6 @@ struct tiocl_selection {
 #define TIOCL_SCROLLCONSOLE     13      /* scroll console */
 #define TIOCL_BLANKSCREEN       14      /* keep screen blank even if a key is pressed */
 #define TIOCL_BLANKEDSCREEN     15      /* return which vt was blanked */
+#define TIOCL_GETKMSGREDIRECT   17      /* get the vt the kernel messages are restricted to */
 
 #endif /* _LINUX_TIOCL_H */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 9418f4d1afbb..3c989db8a7aa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -405,9 +405,6 @@ extern int			tcp_disconnect(struct sock *sk, int flags);
 
 extern void                     tcp_unhash(struct sock *sk);
 
-extern int                      tcp_v4_hash_connecting(struct sock *sk);
-
-
 /* From syncookies.c */
 extern struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, 
                                     struct ip_options *opt);
diff --git a/include/rdma/ib_mad.h b/include/rdma/ib_mad.h
index 51ab8eddb295..5ff77558013b 100644
--- a/include/rdma/ib_mad.h
+++ b/include/rdma/ib_mad.h
@@ -3,7 +3,7 @@
  * Copyright (c) 2004 Infinicon Corporation.  All rights reserved.
  * Copyright (c) 2004 Intel Corporation.  All rights reserved.
  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
- * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2004-2006 Voltaire Corporation.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -55,6 +55,10 @@
 #define IB_MGMT_CLASS_DEVICE_MGMT               0x06
 #define IB_MGMT_CLASS_CM                        0x07
 #define IB_MGMT_CLASS_SNMP                      0x08
+#define IB_MGMT_CLASS_DEVICE_ADM                0x10
+#define IB_MGMT_CLASS_BOOT_MGMT                 0x11
+#define IB_MGMT_CLASS_BIS                       0x12
+#define IB_MGMT_CLASS_CONG_MGMT                 0x21
 #define IB_MGMT_CLASS_VENDOR_RANGE2_START       0x30
 #define IB_MGMT_CLASS_VENDOR_RANGE2_END         0x4F
 
@@ -117,6 +121,8 @@ enum {
         IB_MGMT_VENDOR_DATA = 216,
         IB_MGMT_SA_HDR = 56,
         IB_MGMT_SA_DATA = 200,
+        IB_MGMT_DEVICE_HDR = 64,
+        IB_MGMT_DEVICE_DATA = 192,
 };
 
 struct ib_mad_hdr {
@@ -603,6 +609,25 @@ struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
                                             gfp_t gfp_mask);
 
 /**
+ * ib_is_mad_class_rmpp - returns whether given management class
+ * supports RMPP.
+ * @mgmt_class: management class
+ *
+ * This routine returns whether the management class supports RMPP.
+ */
+int ib_is_mad_class_rmpp(u8 mgmt_class);
+
+/**
+ * ib_get_mad_data_offset - returns the data offset for a given
+ * management class.
+ * @mgmt_class: management class
+ *
+ * This routine returns the data offset in the MAD for the management
+ * class requested.
+ */
+int ib_get_mad_data_offset(u8 mgmt_class);
+
+/**
  * ib_get_rmpp_segment - returns the data buffer for a given RMPP segment.
  * @send_buf: Previously allocated send data buffer.
  * @seg_num: number of segment to return
diff --git a/kernel/acct.c b/kernel/acct.c
index 065d8b4e51ef..b327f4d20104 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -449,8 +449,8 @@ static void do_acct_process(long exitcode, struct file *file)
         /* calculate run_time in nsec*/
         do_posix_clock_monotonic_gettime(&uptime);
         run_time = (u64)uptime.tv_sec*NSEC_PER_SEC + uptime.tv_nsec;
-        run_time -= (u64)current->start_time.tv_sec*NSEC_PER_SEC
-                                        + current->start_time.tv_nsec;
+        run_time -= (u64)current->group_leader->start_time.tv_sec * NSEC_PER_SEC
+                       + current->group_leader->start_time.tv_nsec;
         /* convert nsec -> AHZ */
         elapsed = nsec_to_AHZ(run_time);
 #if ACCT_VERSION==3
@@ -469,10 +469,10 @@ static void do_acct_process(long exitcode, struct file *file)
 #endif
         do_div(elapsed, AHZ);
         ac.ac_btime = xtime.tv_sec - elapsed;
-        jiffies = cputime_to_jiffies(cputime_add(current->group_leader->utime,
+        jiffies = cputime_to_jiffies(cputime_add(current->utime,
                                                  current->signal->utime));
         ac.ac_utime = encode_comp_t(jiffies_to_AHZ(jiffies));
-        jiffies = cputime_to_jiffies(cputime_add(current->group_leader->stime,
+        jiffies = cputime_to_jiffies(cputime_add(current->stime,
                                                  current->signal->stime));
         ac.ac_stime = encode_comp_t(jiffies_to_AHZ(jiffies));
         /* we really need to bite the bullet and change layout */
@@ -522,9 +522,9 @@ static void do_acct_process(long exitcode, struct file *file)
         ac.ac_io = encode_comp_t(0 /* current->io_usage */);    /* %% */
         ac.ac_rw = encode_comp_t(ac.ac_io / 1024);
         ac.ac_minflt = encode_comp_t(current->signal->min_flt +
-                                     current->group_leader->min_flt);
+                                     current->min_flt);
         ac.ac_majflt = encode_comp_t(current->signal->maj_flt +
-                                     current->group_leader->maj_flt);
+                                     current->maj_flt);
         ac.ac_swaps = encode_comp_t(0);
         ac.ac_exitcode = exitcode;
 
diff --git a/kernel/audit.c b/kernel/audit.c
index 04fe2e301b61..c8ccbd09048f 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -578,7 +578,7 @@ static int __init audit_enable(char *str)
                audit_initialized ? "" : " (after initialization)");
         if (audit_initialized)
                 audit_enabled = audit_default;
-        return 0;
+        return 1;
 }
 
 __setup("audit=", audit_enable);
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 18aea1bd1284..72248d1b9e3f 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -616,12 +616,10 @@ static void guarantee_online_mems(const struct cpuset *cs, nodemask_t *pmask)
  * current->cpuset if a task has its memory placement changed.
  * Do not call this routine if in_interrupt().
  *
- * Call without callback_mutex or task_lock() held.  May be called
- * with or without manage_mutex held.  Doesn't need task_lock to guard
- * against another task changing a non-NULL cpuset pointer to NULL,
- * as that is only done by a task on itself, and if the current task
- * is here, it is not simultaneously in the exit code NULL'ing its
- * cpuset pointer.  This routine also might acquire callback_mutex and
+ * Call without callback_mutex or task_lock() held.  May be
+ * called with or without manage_mutex held.  Thanks in part to
+ * 'the_top_cpuset_hack', the tasks cpuset pointer will never
+ * be NULL.  This routine also might acquire callback_mutex and
  * current->mm->mmap_sem during call.
  *
  * Reading current->cpuset->mems_generation doesn't need task_lock
@@ -836,6 +834,55 @@ static int update_cpumask(struct cpuset *cs, char *buf)
 }
 
 /*
+ * cpuset_migrate_mm
+ *
+ *    Migrate memory region from one set of nodes to another.
+ *
+ *    Temporarilly set tasks mems_allowed to target nodes of migration,
+ *    so that the migration code can allocate pages on these nodes.
+ *
+ *    Call holding manage_mutex, so our current->cpuset won't change
+ *    during this call, as manage_mutex holds off any attach_task()
+ *    calls.  Therefore we don't need to take task_lock around the
+ *    call to guarantee_online_mems(), as we know no one is changing
+ *    our tasks cpuset.
+ *
+ *    Hold callback_mutex around the two modifications of our tasks
+ *    mems_allowed to synchronize with cpuset_mems_allowed().
+ *
+ *    While the mm_struct we are migrating is typically from some
+ *    other task, the task_struct mems_allowed that we are hacking
+ *    is for our current task, which must allocate new pages for that
+ *    migrating memory region.
+ *
+ *    We call cpuset_update_task_memory_state() before hacking
+ *    our tasks mems_allowed, so that we are assured of being in
+ *    sync with our tasks cpuset, and in particular, callbacks to
+ *    cpuset_update_task_memory_state() from nested page allocations
+ *    won't see any mismatch of our cpuset and task mems_generation
+ *    values, so won't overwrite our hacked tasks mems_allowed
+ *    nodemask.
+ */
+
+static void cpuset_migrate_mm(struct mm_struct *mm, const nodemask_t *from,
+                                                        const nodemask_t *to)
+{
+        struct task_struct *tsk = current;
+
+        cpuset_update_task_memory_state();
+
+        mutex_lock(&callback_mutex);
+        tsk->mems_allowed = *to;
+        mutex_unlock(&callback_mutex);
+
+        do_migrate_pages(mm, from, to, MPOL_MF_MOVE_ALL);
+
+        mutex_lock(&callback_mutex);
+        guarantee_online_mems(tsk->cpuset, &tsk->mems_allowed);
+        mutex_unlock(&callback_mutex);
+}
+
+/*
  * Handle user request to change the 'mems' memory placement
  * of a cpuset.  Needs to validate the request, update the
  * cpusets mems_allowed and mems_generation, and for each
@@ -947,10 +994,8 @@ static int update_nodemask(struct cpuset *cs, char *buf)
                 struct mm_struct *mm = mmarray[i];
 
                 mpol_rebind_mm(mm, &cs->mems_allowed);
-                if (migrate) {
-                        do_migrate_pages(mm, &oldmem, &cs->mems_allowed,
-                                                        MPOL_MF_MOVE_ALL);
-                }
+                if (migrate)
+                        cpuset_migrate_mm(mm, &oldmem, &cs->mems_allowed);
                 mmput(mm);
         }
 
@@ -1185,11 +1230,11 @@ static int attach_task(struct cpuset *cs, char *pidbuf, char **ppathbuf)
         mm = get_task_mm(tsk);
         if (mm) {
                 mpol_rebind_mm(mm, &to);
+                if (is_memory_migrate(cs))
+                        cpuset_migrate_mm(mm, &from, &to);
                 mmput(mm);
         }
 
-        if (is_memory_migrate(cs))
-                do_migrate_pages(tsk->mm, &from, &to, MPOL_MF_MOVE_ALL);
         put_task_struct(tsk);
         synchronize_rcu();
         if (atomic_dec_and_test(&oldcs->count))
diff --git a/kernel/exit.c b/kernel/exit.c
index bc0ec674d3f4..6c2eeb8f6390 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -127,6 +127,11 @@ static void __exit_signal(struct task_struct *tsk)
         }
 }
 
+static void delayed_put_task_struct(struct rcu_head *rhp)
+{
+        put_task_struct(container_of(rhp, struct task_struct, rcu));
+}
+
 void release_task(struct task_struct * p)
 {
         int zap_leader;
@@ -168,7 +173,7 @@ repeat:
         spin_unlock(&p->proc_lock);
         proc_pid_flush(proc_dentry);
         release_thread(p);
-        put_task_struct(p);
+        call_rcu(&p->rcu, delayed_put_task_struct);
 
         p = leader;
         if (unlikely(zap_leader))
diff --git a/kernel/fork.c b/kernel/fork.c
index b3f7a1bb5e55..3384eb89cb1c 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -108,10 +108,8 @@ void free_task(struct task_struct *tsk)
 }
 EXPORT_SYMBOL(free_task);
 
-void __put_task_struct_cb(struct rcu_head *rhp)
+void __put_task_struct(struct task_struct *tsk)
 {
-        struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
-
         WARN_ON(!(tsk->exit_state & (EXIT_DEAD | EXIT_ZOMBIE)));
         WARN_ON(atomic_read(&tsk->usage));
         WARN_ON(tsk == current);
@@ -126,6 +124,12 @@ void __put_task_struct_cb(struct rcu_head *rhp)
                 free_task(tsk);
 }
 
+void __put_task_struct_cb(struct rcu_head *rhp)
+{
+        struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
+        __put_task_struct(tsk);
+}
+
 void __init fork_init(unsigned long mempages)
 {
 #ifndef __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
@@ -721,7 +725,7 @@ out_release:
         free_fdset (new_fdt->open_fds, new_fdt->max_fdset);
         free_fd_array(new_fdt->fd, new_fdt->max_fds);
         kmem_cache_free(files_cachep, newf);
-        goto out;
+        return NULL;
 }
 
 static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
@@ -1311,17 +1315,19 @@ long do_fork(unsigned long clone_flags,
 {
         struct task_struct *p;
         int trace = 0;
-        long pid = alloc_pidmap();
+        struct pid *pid = alloc_pid();
+        long nr;
 
-        if (pid < 0)
+        if (!pid)
                 return -EAGAIN;
+        nr = pid->nr;
         if (unlikely(current->ptrace)) {
                 trace = fork_traceflag (clone_flags);
                 if (trace)
                         clone_flags |= CLONE_PTRACE;
         }
 
-        p = copy_process(clone_flags, stack_start, regs, stack_size, parent_tidptr, child_tidptr, pid);
+        p = copy_process(clone_flags, stack_start, regs, stack_size, parent_tidptr, child_tidptr, nr);
         /*
          * Do this prior waking up the new thread - the thread pointer
          * might get invalid after that point, if the thread exits quickly.
@@ -1348,7 +1354,7 @@ long do_fork(unsigned long clone_flags,
                         p->state = TASK_STOPPED;
 
                 if (unlikely (trace)) {
-                        current->ptrace_message = pid;
+                        current->ptrace_message = nr;
                         ptrace_notify ((trace << 8) | SIGTRAP);
                 }
 
@@ -1358,10 +1364,10 @@ long do_fork(unsigned long clone_flags,
                                 ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP);
                 }
         } else {
-                free_pidmap(pid);
-                pid = PTR_ERR(p);
+                free_pid(pid);
+                nr = PTR_ERR(p);
         }
-        return pid;
+        return nr;
 }
 
 #ifndef ARCH_MIN_MMSTRUCT_ALIGN
diff --git a/kernel/futex.c b/kernel/futex.c
index 9c9b2b6b22dd..5699c512057b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1039,9 +1039,11 @@ asmlinkage long sys_futex(u32 __user *uaddr, int op, int val,
         unsigned long timeout = MAX_SCHEDULE_TIMEOUT;
         int val2 = 0;
 
-        if ((op == FUTEX_WAIT) && utime) {
+        if (utime && (op == FUTEX_WAIT)) {
                 if (copy_from_user(&t, utime, sizeof(t)) != 0)
                         return -EFAULT;
+                if (!timespec_valid(&t))
+                        return -EINVAL;
                 timeout = timespec_to_jiffies(&t) + 1;
         }
         /*
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index 54274fc85321..1ab6a0ea3d14 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -129,9 +129,11 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
         unsigned long timeout = MAX_SCHEDULE_TIMEOUT;
         int val2 = 0;
 
-        if ((op == FUTEX_WAIT) && utime) {
+        if (utime && (op == FUTEX_WAIT)) {
                 if (get_compat_timespec(&t, utime))
                         return -EFAULT;
+                if (!timespec_valid(&t))
+                        return -EINVAL;
                 timeout = timespec_to_jiffies(&t) + 1;
         }
         if (op >= FUTEX_REQUEUE)
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 0237a556eb1f..f181ff4dd32e 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -606,6 +606,9 @@ static inline void run_hrtimer_queue(struct hrtimer_base *base)
 {
         struct rb_node *node;
 
+        if (!base->first)
+                return;
+
         if (base->get_softirq_time)
                 base->softirq_time = base->get_softirq_time();
 
@@ -655,29 +658,28 @@ void hrtimer_run_queues(void)
 /*
  * Sleep related functions:
  */
-
-struct sleep_hrtimer {
-        struct hrtimer timer;
-        struct task_struct *task;
-        int expired;
-};
-
-static int nanosleep_wakeup(struct hrtimer *timer)
+static int hrtimer_wakeup(struct hrtimer *timer)
 {
-        struct sleep_hrtimer *t =
-                container_of(timer, struct sleep_hrtimer, timer);
+        struct hrtimer_sleeper *t =
+                container_of(timer, struct hrtimer_sleeper, timer);
+        struct task_struct *task = t->task;
 
-        t->expired = 1;
-        wake_up_process(t->task);
+        t->task = NULL;
+        if (task)
+                wake_up_process(task);
 
         return HRTIMER_NORESTART;
 }
 
-static int __sched do_nanosleep(struct sleep_hrtimer *t, enum hrtimer_mode mode)
+void hrtimer_init_sleeper(struct hrtimer_sleeper *sl, task_t *task)
 {
-        t->timer.function = nanosleep_wakeup;
-        t->task = current;
-        t->expired = 0;
+        sl->timer.function = hrtimer_wakeup;
+        sl->task = task;
+}
+
+static int __sched do_nanosleep(struct hrtimer_sleeper *t, enum hrtimer_mode mode)
+{
+        hrtimer_init_sleeper(t, current);
 
         do {
                 set_current_state(TASK_INTERRUPTIBLE);
@@ -685,18 +687,17 @@ static int __sched do_nanosleep(struct sleep_hrtimer *t, enum hrtimer_mode mode)
 
                 schedule();
 
-                if (unlikely(!t->expired)) {
-                        hrtimer_cancel(&t->timer);
-                        mode = HRTIMER_ABS;
-                }
-        } while (!t->expired && !signal_pending(current));
+                hrtimer_cancel(&t->timer);
+                mode = HRTIMER_ABS;
+
+        } while (t->task && !signal_pending(current));
 
-        return t->expired;
+        return t->task == NULL;
 }
 
 static long __sched nanosleep_restart(struct restart_block *restart)
 {
-        struct sleep_hrtimer t;
+        struct hrtimer_sleeper t;
         struct timespec __user *rmtp;
         struct timespec tu;
         ktime_t time;
@@ -729,7 +730,7 @@ long hrtimer_nanosleep(struct timespec *rqtp, struct timespec __user *rmtp,
                        const enum hrtimer_mode mode, const clockid_t clockid)
 {
         struct restart_block *restart;
-        struct sleep_hrtimer t;
+        struct hrtimer_sleeper t;
         struct timespec tu;
         ktime_t rem;
 
diff --git a/kernel/module.c b/kernel/module.c
index bd088a7c1499..d24deb0dbbc9 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1254,6 +1254,7 @@ static inline int license_is_gpl_compatible(const char *license)
                 || strcmp(license, "GPL v2") == 0
                 || strcmp(license, "GPL and additional rights") == 0
                 || strcmp(license, "Dual BSD/GPL") == 0
+                || strcmp(license, "Dual MIT/GPL") == 0
                 || strcmp(license, "Dual MPL/GPL") == 0);
 }
 
diff --git a/kernel/pid.c b/kernel/pid.c
index a9f2dfd006d2..eeb836b65ca4 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -28,8 +28,9 @@
 #include <linux/hash.h>
 
 #define pid_hashfn(nr) hash_long((unsigned long)nr, pidhash_shift)
-static struct hlist_head *pid_hash[PIDTYPE_MAX];
+static struct hlist_head *pid_hash;
 static int pidhash_shift;
+static kmem_cache_t *pid_cachep;
 
 int pid_max = PID_MAX_DEFAULT;
 int last_pid;
@@ -60,9 +61,22 @@ typedef struct pidmap {
 static pidmap_t pidmap_array[PIDMAP_ENTRIES] =
          { [ 0 ... PIDMAP_ENTRIES-1 ] = { ATOMIC_INIT(BITS_PER_PAGE), NULL } };
 
+/*
+ * Note: disable interrupts while the pidmap_lock is held as an
+ * interrupt might come in and do read_lock(&tasklist_lock).
+ *
+ * If we don't disable interrupts there is a nasty deadlock between
+ * detach_pid()->free_pid() and another cpu that does
+ * spin_lock(&pidmap_lock) followed by an interrupt routine that does
+ * read_lock(&tasklist_lock);
+ *
+ * After we clean up the tasklist_lock and know there are no
+ * irq handlers that take it we can leave the interrupts enabled.
+ * For now it is easier to be safe than to prove it can't happen.
+ */
 static  __cacheline_aligned_in_smp DEFINE_SPINLOCK(pidmap_lock);
 
-fastcall void free_pidmap(int pid)
+static fastcall void free_pidmap(int pid)
 {
         pidmap_t *map = pidmap_array + pid / BITS_PER_PAGE;
         int offset = pid & BITS_PER_PAGE_MASK;
@@ -71,7 +85,7 @@ fastcall void free_pidmap(int pid)
         atomic_inc(&map->nr_free);
 }
 
-int alloc_pidmap(void)
+static int alloc_pidmap(void)
 {
         int i, offset, max_scan, pid, last = last_pid;
         pidmap_t *map;
@@ -89,12 +103,12 @@ int alloc_pidmap(void)
                          * Free the page if someone raced with us
                          * installing it:
                          */
-                        spin_lock(&pidmap_lock);
+                        spin_lock_irq(&pidmap_lock);
                         if (map->page)
                                 free_page(page);
                         else
                                 map->page = (void *)page;
-                        spin_unlock(&pidmap_lock);
+                        spin_unlock_irq(&pidmap_lock);
                         if (unlikely(!map->page))
                                 break;
                 }
@@ -131,13 +145,73 @@ int alloc_pidmap(void)
         return -1;
 }
 
-struct pid * fastcall find_pid(enum pid_type type, int nr)
+fastcall void put_pid(struct pid *pid)
+{
+        if (!pid)
+                return;
+        if ((atomic_read(&pid->count) == 1) ||
+             atomic_dec_and_test(&pid->count))
+                kmem_cache_free(pid_cachep, pid);
+}
+
+static void delayed_put_pid(struct rcu_head *rhp)
+{
+        struct pid *pid = container_of(rhp, struct pid, rcu);
+        put_pid(pid);
+}
+
+fastcall void free_pid(struct pid *pid)
+{
+        /* We can be called with write_lock_irq(&tasklist_lock) held */
+        unsigned long flags;
+
+        spin_lock_irqsave(&pidmap_lock, flags);
+        hlist_del_rcu(&pid->pid_chain);
+        spin_unlock_irqrestore(&pidmap_lock, flags);
+
+        free_pidmap(pid->nr);
+        call_rcu(&pid->rcu, delayed_put_pid);
+}
+
+struct pid *alloc_pid(void)
+{
+        struct pid *pid;
+        enum pid_type type;
+        int nr = -1;
+
+        pid = kmem_cache_alloc(pid_cachep, GFP_KERNEL);
+        if (!pid)
+                goto out;
+
+        nr = alloc_pidmap();
+        if (nr < 0)
+                goto out_free;
+
+        atomic_set(&pid->count, 1);
+        pid->nr = nr;
+        for (type = 0; type < PIDTYPE_MAX; ++type)
+                INIT_HLIST_HEAD(&pid->tasks[type]);
+
+        spin_lock_irq(&pidmap_lock);
+        hlist_add_head_rcu(&pid->pid_chain, &pid_hash[pid_hashfn(pid->nr)]);
+        spin_unlock_irq(&pidmap_lock);
+
+out:
+        return pid;
+
+out_free:
+        kmem_cache_free(pid_cachep, pid);
+        pid = NULL;
+        goto out;
+}
+
+struct pid * fastcall find_pid(int nr)
 {
         struct hlist_node *elem;
         struct pid *pid;
 
         hlist_for_each_entry_rcu(pid, elem,
-                        &pid_hash[type][pid_hashfn(nr)], pid_chain) {
+                        &pid_hash[pid_hashfn(nr)], pid_chain) {
                 if (pid->nr == nr)
                         return pid;
         }
@@ -146,77 +220,82 @@ struct pid * fastcall find_pid(enum pid_type type, int nr)
 
 int fastcall attach_pid(task_t *task, enum pid_type type, int nr)
 {
-        struct pid *pid, *task_pid;
-
-        task_pid = &task->pids[type];
-        pid = find_pid(type, nr);
-        task_pid->nr = nr;
-        if (pid == NULL) {
-                INIT_LIST_HEAD(&task_pid->pid_list);
-                hlist_add_head_rcu(&task_pid->pid_chain,
-                                   &pid_hash[type][pid_hashfn(nr)]);
-        } else {
-                INIT_HLIST_NODE(&task_pid->pid_chain);
-                list_add_tail_rcu(&task_pid->pid_list, &pid->pid_list);
-        }
+        struct pid_link *link;
+        struct pid *pid;
+
+        WARN_ON(!task->pid); /* to be removed soon */
+        WARN_ON(!nr); /* to be removed soon */
+
+        link = &task->pids[type];
+        link->pid = pid = find_pid(nr);
+        hlist_add_head_rcu(&link->node, &pid->tasks[type]);
 
         return 0;
 }
 
-static fastcall int __detach_pid(task_t *task, enum pid_type type)
+void fastcall detach_pid(task_t *task, enum pid_type type)
 {
-        struct pid *pid, *pid_next;
-        int nr = 0;
+        struct pid_link *link;
+        struct pid *pid;
+        int tmp;
 
-        pid = &task->pids[type];
-        if (!hlist_unhashed(&pid->pid_chain)) {
+        link = &task->pids[type];
+        pid = link->pid;
 
-                if (list_empty(&pid->pid_list)) {
-                        nr = pid->nr;
-                        hlist_del_rcu(&pid->pid_chain);
-                } else {
-                        pid_next = list_entry(pid->pid_list.next,
-                                                struct pid, pid_list);
-                        /* insert next pid from pid_list to hash */
-                        hlist_replace_rcu(&pid->pid_chain,
-                                          &pid_next->pid_chain);
-                }
-        }
+        hlist_del_rcu(&link->node);
+        link->pid = NULL;
 
-        list_del_rcu(&pid->pid_list);
-        pid->nr = 0;
+        for (tmp = PIDTYPE_MAX; --tmp >= 0; )
+                if (!hlist_empty(&pid->tasks[tmp]))
+                        return;
 
-        return nr;
+        free_pid(pid);
 }
 
-void fastcall detach_pid(task_t *task, enum pid_type type)
+struct task_struct * fastcall pid_task(struct pid *pid, enum pid_type type)
 {
-        int tmp, nr;
+        struct task_struct *result = NULL;
+        if (pid) {
+                struct hlist_node *first;
+                first = rcu_dereference(pid->tasks[type].first);
+                if (first)
+                        result = hlist_entry(first, struct task_struct, pids[(type)].node);
+        }
+        return result;
+}
 
-        nr = __detach_pid(task, type);
-        if (!nr)
-                return;
+/*
+ * Must be called under rcu_read_lock() or with tasklist_lock read-held.
+ */
+task_t *find_task_by_pid_type(int type, int nr)
+{
+        return pid_task(find_pid(nr), type);
+}
 
-        for (tmp = PIDTYPE_MAX; --tmp >= 0; )
-                if (tmp != type && find_pid(tmp, nr))
-                        return;
+EXPORT_SYMBOL(find_task_by_pid_type);
 
-        free_pidmap(nr);
+struct task_struct *fastcall get_pid_task(struct pid *pid, enum pid_type type)
+{
+        struct task_struct *result;
+        rcu_read_lock();
+        result = pid_task(pid, type);
+        if (result)
+                get_task_struct(result);
+        rcu_read_unlock();
+        return result;
 }
 
-task_t *find_task_by_pid_type(int type, int nr)
+struct pid *find_get_pid(pid_t nr)
 {
         struct pid *pid;
 
-        pid = find_pid(type, nr);
-        if (!pid)
-                return NULL;
+        rcu_read_lock();
+        pid = get_pid(find_pid(nr));
+        rcu_read_unlock();
 
-        return pid_task(&pid->pid_list, type);
+        return pid;
 }
 
-EXPORT_SYMBOL(find_task_by_pid_type);
-
 /*
  * The pid hash table is scaled according to the amount of memory in the
  * machine.  From a minimum of 16 slots up to 4096 slots at one gigabyte or
@@ -224,7 +303,7 @@ EXPORT_SYMBOL(find_task_by_pid_type);
  */
 void __init pidhash_init(void)
 {
-        int i, j, pidhash_size;
+        int i, pidhash_size;
         unsigned long megabytes = nr_kernel_pages >> (20 - PAGE_SHIFT);
 
         pidhash_shift = max(4, fls(megabytes * 4));
@@ -233,16 +312,13 @@ void __init pidhash_init(void)
 
         printk("PID hash table entries: %d (order: %d, %Zd bytes)\n",
                 pidhash_size, pidhash_shift,
-                PIDTYPE_MAX * pidhash_size * sizeof(struct hlist_head));
-
-        for (i = 0; i < PIDTYPE_MAX; i++) {
-                pid_hash[i] = alloc_bootmem(pidhash_size *
-                                        sizeof(*(pid_hash[i])));
-                if (!pid_hash[i])
-                        panic("Could not alloc pidhash!\n");
-                for (j = 0; j < pidhash_size; j++)
-                        INIT_HLIST_HEAD(&pid_hash[i][j]);
-        }
+                pidhash_size * sizeof(struct hlist_head));
+
+        pid_hash = alloc_bootmem(pidhash_size * sizeof(*(pid_hash)));
+        if (!pid_hash)
+                panic("Could not alloc pidhash!\n");
+        for (i = 0; i < pidhash_size; i++)
+                INIT_HLIST_HEAD(&pid_hash[i]);
 }
 
 void __init pidmap_init(void)
@@ -251,4 +327,8 @@ void __init pidmap_init(void)
         /* Reserve PID 0. We never call free_pidmap(0) */
         set_bit(0, pidmap_array->page);
         atomic_dec(&pidmap_array->nr_free);
+
+        pid_cachep = kmem_cache_create("pid", sizeof(struct pid),
+                                        __alignof__(struct pid),
+                                        SLAB_PANIC, NULL, NULL);
 }
diff --git a/kernel/power/process.c b/kernel/power/process.c
index 8ac7c35fad77..b2a5f671d6cd 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -26,8 +26,7 @@ static inline int freezeable(struct task_struct * p)
             (p->flags & PF_NOFREEZE) ||
             (p->exit_state == EXIT_ZOMBIE) ||
             (p->exit_state == EXIT_DEAD) ||
-            (p->state == TASK_STOPPED) ||
-            (p->state == TASK_TRACED))
+            (p->state == TASK_STOPPED))
                 return 0;
         return 1;
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index a9ecac398bb9..dd153d6f8a04 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -667,9 +667,13 @@ static int effective_prio(task_t *p)
 /*
  * __activate_task - move a task to the runqueue.
  */
-static inline void __activate_task(task_t *p, runqueue_t *rq)
+static void __activate_task(task_t *p, runqueue_t *rq)
 {
-        enqueue_task(p, rq->active);
+        prio_array_t *target = rq->active;
+
+        if (batch_task(p))
+                target = rq->expired;
+        enqueue_task(p, target);
         rq->nr_running++;
 }
 
@@ -688,7 +692,7 @@ static int recalc_task_prio(task_t *p, unsigned long long now)
         unsigned long long __sleep_time = now - p->timestamp;
         unsigned long sleep_time;
 
-        if (unlikely(p->policy == SCHED_BATCH))
+        if (batch_task(p))
                 sleep_time = 0;
         else {
                 if (__sleep_time > NS_MAX_SLEEP_AVG)
@@ -700,21 +704,25 @@ static int recalc_task_prio(task_t *p, unsigned long long now)
         if (likely(sleep_time > 0)) {
                 /*
                  * User tasks that sleep a long time are categorised as
-                 * idle and will get just interactive status to stay active &
-                 * prevent them suddenly becoming cpu hogs and starving
-                 * other processes.
+                 * idle. They will only have their sleep_avg increased to a
+                 * level that makes them just interactive priority to stay
+                 * active yet prevent them suddenly becoming cpu hogs and
+                 * starving other processes.
                  */
-                if (p->mm && p->activated != -1 &&
-                        sleep_time > INTERACTIVE_SLEEP(p)) {
-                                p->sleep_avg = JIFFIES_TO_NS(MAX_SLEEP_AVG -
-                                                DEF_TIMESLICE);
+                if (p->mm && sleep_time > INTERACTIVE_SLEEP(p)) {
+                                unsigned long ceiling;
+
+                                ceiling = JIFFIES_TO_NS(MAX_SLEEP_AVG -
+                                        DEF_TIMESLICE);
+                                if (p->sleep_avg < ceiling)
+                                        p->sleep_avg = ceiling;
                 } else {
                         /*
                          * Tasks waking from uninterruptible sleep are
                          * limited in their sleep_avg rise as they
                          * are likely to be waiting on I/O
                          */
-                        if (p->activated == -1 && p->mm) {
+                        if (p->sleep_type == SLEEP_NONINTERACTIVE && p->mm) {
                                 if (p->sleep_avg >= INTERACTIVE_SLEEP(p))
                                         sleep_time = 0;
                                 else if (p->sleep_avg + sleep_time >=
@@ -769,7 +777,7 @@ static void activate_task(task_t *p, runqueue_t *rq, int local)
          * This checks to make sure it's not an uninterruptible task
          * that is now waking up.
          */
-        if (!p->activated) {
+        if (p->sleep_type == SLEEP_NORMAL) {
                 /*
                  * Tasks which were woken up by interrupts (ie. hw events)
                  * are most likely of interactive nature. So we give them
@@ -778,13 +786,13 @@ static void activate_task(task_t *p, runqueue_t *rq, int local)
                  * on a CPU, first time around:
                  */
                 if (in_interrupt())
-                        p->activated = 2;
+                        p->sleep_type = SLEEP_INTERRUPTED;
                 else {
                         /*
                          * Normal first-time wakeups get a credit too for
                          * on-runqueue time, but it will be weighted down:
                          */
-                        p->activated = 1;
+                        p->sleep_type = SLEEP_INTERACTIVE;
                 }
         }
         p->timestamp = now;
@@ -1272,19 +1280,19 @@ out_activate:
                  * Tasks on involuntary sleep don't earn
                  * sleep_avg beyond just interactive state.
                  */
-                p->activated = -1;
-        }
+                p->sleep_type = SLEEP_NONINTERACTIVE;
+        } else
 
         /*
          * Tasks that have marked their sleep as noninteractive get
-         * woken up without updating their sleep average. (i.e. their
-         * sleep is handled in a priority-neutral manner, no priority
-         * boost and no penalty.)
+         * woken up with their sleep average not weighted in an
+         * interactive way.
          */
-        if (old_state & TASK_NONINTERACTIVE)
-                __activate_task(p, rq);
-        else
-                activate_task(p, rq, cpu == this_cpu);
+                if (old_state & TASK_NONINTERACTIVE)
+                        p->sleep_type = SLEEP_NONINTERACTIVE;
+
+
+        activate_task(p, rq, cpu == this_cpu);
         /*
          * Sync wakeups (i.e. those types of wakeups where the waker
          * has indicated that it will leave the CPU in short order)
@@ -1658,6 +1666,21 @@ unsigned long nr_iowait(void)
         return sum;
 }
 
+unsigned long nr_active(void)
+{
+        unsigned long i, running = 0, uninterruptible = 0;
+
+        for_each_online_cpu(i) {
+                running += cpu_rq(i)->nr_running;
+                uninterruptible += cpu_rq(i)->nr_uninterruptible;
+        }
+
+        if (unlikely((long)uninterruptible < 0))
+                uninterruptible = 0;
+
+        return running + uninterruptible;
+}
+
 #ifdef CONFIG_SMP
 
 /*
@@ -2860,6 +2883,12 @@ EXPORT_SYMBOL(sub_preempt_count);
 
 #endif
 
+static inline int interactive_sleep(enum sleep_type sleep_type)
+{
+        return (sleep_type == SLEEP_INTERACTIVE ||
+                sleep_type == SLEEP_INTERRUPTED);
+}
+
 /*
  * schedule() is the main scheduler function.
  */
@@ -2983,12 +3012,12 @@ go_idle:
         queue = array->queue + idx;
         next = list_entry(queue->next, task_t, run_list);
 
-        if (!rt_task(next) && next->activated > 0) {
+        if (!rt_task(next) && interactive_sleep(next->sleep_type)) {
                 unsigned long long delta = now - next->timestamp;
                 if (unlikely((long long)(now - next->timestamp) < 0))
                         delta = 0;
 
-                if (next->activated == 1)
+                if (next->sleep_type == SLEEP_INTERACTIVE)
                         delta = delta * (ON_RUNQUEUE_WEIGHT * 128 / 100) / 128;
 
                 array = next->array;
@@ -2998,10 +3027,9 @@ go_idle:
                         dequeue_task(next, array);
                         next->prio = new_prio;
                         enqueue_task(next, array);
-                } else
-                        requeue_task(next, array);
+                }
         }
-        next->activated = 0;
+        next->sleep_type = SLEEP_NORMAL;
 switch_tasks:
         if (next == rq->idle)
                 schedstat_inc(rq, sched_goidle);
diff --git a/kernel/signal.c b/kernel/signal.c
index 4922928d91f6..92025b108791 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1560,6 +1560,7 @@ static void ptrace_stop(int exit_code, int nostop_code, siginfo_t *info)
         /* Let the debugger run.  */
         set_current_state(TASK_TRACED);
         spin_unlock_irq(&current->sighand->siglock);
+        try_to_freeze();
         read_lock(&tasklist_lock);
         if (likely(current->ptrace & PT_PTRACED) &&
             likely(current->parent != current->real_parent ||
diff --git a/kernel/sys.c b/kernel/sys.c
index 7ef7f6054c28..0b6ec0e7936f 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1372,18 +1372,29 @@ asmlinkage long sys_getsid(pid_t pid)
 asmlinkage long sys_setsid(void)
 {
         struct task_struct *group_leader = current->group_leader;
-        struct pid *pid;
+        pid_t session;
         int err = -EPERM;
 
         mutex_lock(&tty_mutex);
         write_lock_irq(&tasklist_lock);
 
-        pid = find_pid(PIDTYPE_PGID, group_leader->pid);
-        if (pid)
+        /* Fail if I am already a session leader */
+        if (group_leader->signal->leader)
+                goto out;
+
+        session = group_leader->pid;
+        /* Fail if a process group id already exists that equals the
+         * proposed session id.
+         *
+         * Don't check if session id == 1 because kernel threads use this
+         * session id and so the check will always fail and make it so
+         * init cannot successfully call setsid.
+         */
+        if (session > 1 && find_task_by_pid_type(PIDTYPE_PGID, session))
                 goto out;
 
         group_leader->signal->leader = 1;
-        __set_special_pids(group_leader->pid, group_leader->pid);
+        __set_special_pids(session, session);
         group_leader->signal->tty = NULL;
         group_leader->signal->tty_old_pgrp = 0;
         err = process_group(group_leader);
diff --git a/kernel/timer.c b/kernel/timer.c
index ab189dd187cb..6b812c04737b 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -54,7 +54,6 @@ EXPORT_SYMBOL(jiffies_64);
 /*
  * per-CPU timer vector definitions:
  */
-
 #define TVN_BITS (CONFIG_BASE_SMALL ? 4 : 6)
 #define TVR_BITS (CONFIG_BASE_SMALL ? 6 : 8)
 #define TVN_SIZE (1 << TVN_BITS)
@@ -62,11 +61,6 @@ EXPORT_SYMBOL(jiffies_64);
 #define TVN_MASK (TVN_SIZE - 1)
 #define TVR_MASK (TVR_SIZE - 1)
 
-struct timer_base_s {
-        spinlock_t lock;
-        struct timer_list *running_timer;
-};
-
 typedef struct tvec_s {
         struct list_head vec[TVN_SIZE];
 } tvec_t;
@@ -76,7 +70,8 @@ typedef struct tvec_root_s {
 } tvec_root_t;
 
 struct tvec_t_base_s {
-        struct timer_base_s t_base;
+        spinlock_t lock;
+        struct timer_list *running_timer;
         unsigned long timer_jiffies;
         tvec_root_t tv1;
         tvec_t tv2;
@@ -87,13 +82,14 @@ struct tvec_t_base_s {
 
 typedef struct tvec_t_base_s tvec_base_t;
 static DEFINE_PER_CPU(tvec_base_t *, tvec_bases);
-static tvec_base_t boot_tvec_bases;
+tvec_base_t boot_tvec_bases;
+EXPORT_SYMBOL(boot_tvec_bases);
 
 static inline void set_running_timer(tvec_base_t *base,
                                         struct timer_list *timer)
 {
 #ifdef CONFIG_SMP
-        base->t_base.running_timer = timer;
+        base->running_timer = timer;
 #endif
 }
 
@@ -139,15 +135,6 @@ static void internal_add_timer(tvec_base_t *base, struct timer_list *timer)
         list_add_tail(&timer->entry, vec);
 }
 
-typedef struct timer_base_s timer_base_t;
-/*
- * Used by TIMER_INITIALIZER, we can't use per_cpu(tvec_bases)
- * at compile time, and we need timer->base to lock the timer.
- */
-timer_base_t __init_timer_base
-        ____cacheline_aligned_in_smp = { .lock = SPIN_LOCK_UNLOCKED };
-EXPORT_SYMBOL(__init_timer_base);
-
 /***
  * init_timer - initialize a timer.
  * @timer: the timer to be initialized
@@ -158,7 +145,7 @@ EXPORT_SYMBOL(__init_timer_base);
 void fastcall init_timer(struct timer_list *timer)
 {
         timer->entry.next = NULL;
-        timer->base = &per_cpu(tvec_bases, raw_smp_processor_id())->t_base;
+        timer->base = per_cpu(tvec_bases, raw_smp_processor_id());
 }
 EXPORT_SYMBOL(init_timer);
 
@@ -174,7 +161,7 @@ static inline void detach_timer(struct timer_list *timer,
 }
 
 /*
- * We are using hashed locking: holding per_cpu(tvec_bases).t_base.lock
+ * We are using hashed locking: holding per_cpu(tvec_bases).lock
  * means that all timers which are tied to this base via timer->base are
  * locked, and the base itself is locked too.
  *
@@ -185,10 +172,10 @@ static inline void detach_timer(struct timer_list *timer,
  * possible to set timer->base = NULL and drop the lock: the timer remains
  * locked.
  */
-static timer_base_t *lock_timer_base(struct timer_list *timer,
+static tvec_base_t *lock_timer_base(struct timer_list *timer,
                                         unsigned long *flags)
 {
-        timer_base_t *base;
+        tvec_base_t *base;
 
         for (;;) {
                 base = timer->base;
@@ -205,8 +192,7 @@ static timer_base_t *lock_timer_base(struct timer_list *timer,
 
 int __mod_timer(struct timer_list *timer, unsigned long expires)
 {
-        timer_base_t *base;
-        tvec_base_t *new_base;
+        tvec_base_t *base, *new_base;
         unsigned long flags;
         int ret = 0;
 
@@ -221,7 +207,7 @@ int __mod_timer(struct timer_list *timer, unsigned long expires)
 
         new_base = __get_cpu_var(tvec_bases);
 
-        if (base != &new_base->t_base) {
+        if (base != new_base) {
                 /*
                  * We are trying to schedule the timer on the local CPU.
                  * However we can't change timer's base while it is running,
@@ -229,21 +215,19 @@ int __mod_timer(struct timer_list *timer, unsigned long expires)
                  * handler yet has not finished. This also guarantees that
                  * the timer is serialized wrt itself.
                  */
-                if (unlikely(base->running_timer == timer)) {
-                        /* The timer remains on a former base */
-                        new_base = container_of(base, tvec_base_t, t_base);
-                } else {
+                if (likely(base->running_timer != timer)) {
                         /* See the comment in lock_timer_base() */
                         timer->base = NULL;
                         spin_unlock(&base->lock);
-                        spin_lock(&new_base->t_base.lock);
-                        timer->base = &new_base->t_base;
+                        base = new_base;
+                        spin_lock(&base->lock);
+                        timer->base = base;
                 }
         }
 
         timer->expires = expires;
-        internal_add_timer(new_base, timer);
-        spin_unlock_irqrestore(&new_base->t_base.lock, flags);
+        internal_add_timer(base, timer);
+        spin_unlock_irqrestore(&base->lock, flags);
 
         return ret;
 }
@@ -263,10 +247,10 @@ void add_timer_on(struct timer_list *timer, int cpu)
         unsigned long flags;
 
         BUG_ON(timer_pending(timer) || !timer->function);
-        spin_lock_irqsave(&base->t_base.lock, flags);
-        timer->base = &base->t_base;
+        spin_lock_irqsave(&base->lock, flags);
+        timer->base = base;
         internal_add_timer(base, timer);
-        spin_unlock_irqrestore(&base->t_base.lock, flags);
+        spin_unlock_irqrestore(&base->lock, flags);
 }
 
 
@@ -319,7 +303,7 @@ EXPORT_SYMBOL(mod_timer);
  */
 int del_timer(struct timer_list *timer)
 {
-        timer_base_t *base;
+        tvec_base_t *base;
         unsigned long flags;
         int ret = 0;
 
@@ -346,7 +330,7 @@ EXPORT_SYMBOL(del_timer);
  */
 int try_to_del_timer_sync(struct timer_list *timer)
 {
-        timer_base_t *base;
+        tvec_base_t *base;
         unsigned long flags;
         int ret = -1;
 
@@ -410,7 +394,7 @@ static int cascade(tvec_base_t *base, tvec_t *tv, int index)
                 struct timer_list *tmp;
 
                 tmp = list_entry(curr, struct timer_list, entry);
-                BUG_ON(tmp->base != &base->t_base);
+                BUG_ON(tmp->base != base);
                 curr = curr->next;
                 internal_add_timer(base, tmp);
         }
@@ -432,7 +416,7 @@ static inline void __run_timers(tvec_base_t *base)
 {
         struct timer_list *timer;
 
-        spin_lock_irq(&base->t_base.lock);
+        spin_lock_irq(&base->lock);
         while (time_after_eq(jiffies, base->timer_jiffies)) {
                 struct list_head work_list = LIST_HEAD_INIT(work_list);
                 struct list_head *head = &work_list;
@@ -458,7 +442,7 @@ static inline void __run_timers(tvec_base_t *base)
 
                         set_running_timer(base, timer);
                         detach_timer(timer, 1);
-                        spin_unlock_irq(&base->t_base.lock);
+                        spin_unlock_irq(&base->lock);
                         {
                                 int preempt_count = preempt_count();
                                 fn(data);
@@ -471,11 +455,11 @@ static inline void __run_timers(tvec_base_t *base)
                                         BUG();
                                 }
                         }
-                        spin_lock_irq(&base->t_base.lock);
+                        spin_lock_irq(&base->lock);
                 }
         }
         set_running_timer(base, NULL);
-        spin_unlock_irq(&base->t_base.lock);
+        spin_unlock_irq(&base->lock);
 }
 
 #ifdef CONFIG_NO_IDLE_HZ
@@ -506,7 +490,7 @@ unsigned long next_timer_interrupt(void)
         hr_expires += jiffies;
 
         base = __get_cpu_var(tvec_bases);
-        spin_lock(&base->t_base.lock);
+        spin_lock(&base->lock);
         expires = base->timer_jiffies + (LONG_MAX >> 1);
         list = NULL;
 
@@ -554,7 +538,7 @@ found:
                                 expires = nte->expires;
                 }
         }
-        spin_unlock(&base->t_base.lock);
+        spin_unlock(&base->lock);
 
         if (time_before(hr_expires, expires))
                 return hr_expires;
@@ -841,7 +825,7 @@ void update_process_times(int user_tick)
  */
 static unsigned long count_active_tasks(void)
 {
-        return (nr_running() + nr_uninterruptible()) * FIXED_1;
+        return nr_active() * FIXED_1;
 }
 
 /*
@@ -1262,7 +1246,7 @@ static int __devinit init_timers_cpu(int cpu)
                 }
                 per_cpu(tvec_bases, cpu) = base;
         }
-        spin_lock_init(&base->t_base.lock);
+        spin_lock_init(&base->lock);
         for (j = 0; j < TVN_SIZE; j++) {
                 INIT_LIST_HEAD(base->tv5.vec + j);
                 INIT_LIST_HEAD(base->tv4.vec + j);
@@ -1284,7 +1268,7 @@ static void migrate_timer_list(tvec_base_t *new_base, struct list_head *head)
         while (!list_empty(head)) {
                 timer = list_entry(head->next, struct timer_list, entry);
                 detach_timer(timer, 0);
-                timer->base = &new_base->t_base;
+                timer->base = new_base;
                 internal_add_timer(new_base, timer);
         }
 }
@@ -1300,11 +1284,11 @@ static void __devinit migrate_timers(int cpu)
         new_base = get_cpu_var(tvec_bases);
 
         local_irq_disable();
-        spin_lock(&new_base->t_base.lock);
-        spin_lock(&old_base->t_base.lock);
+        spin_lock(&new_base->lock);
+        spin_lock(&old_base->lock);
+
+        BUG_ON(old_base->running_timer);
 
-        if (old_base->t_base.running_timer)
-                BUG();
         for (i = 0; i < TVR_SIZE; i++)
                 migrate_timer_list(new_base, old_base->tv1.vec + i);
         for (i = 0; i < TVN_SIZE; i++) {
@@ -1314,8 +1298,8 @@ static void __devinit migrate_timers(int cpu)
                 migrate_timer_list(new_base, old_base->tv5.vec + i);
         }
 
-        spin_unlock(&old_base->t_base.lock);
-        spin_unlock(&new_base->t_base.lock);
+        spin_unlock(&old_base->lock);
+        spin_unlock(&new_base->lock);
         local_irq_enable();
         put_cpu_var(tvec_bases);
 }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 6e8a60f67c7a..d57fd9181b18 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -157,19 +157,6 @@ config DEBUG_INFO
 
           If unsure, say N.
 
-config DEBUG_IOREMAP
-        bool "Enable ioremap() debugging"
-        depends on DEBUG_KERNEL && PARISC
-        help
-          Enabling this option will cause the kernel to distinguish between
-          ioremapped and physical addresses.  It will print a backtrace (at
-          most one every 10 seconds), hopefully allowing you to see which
-          drivers need work.  Fixing all these problems is a prerequisite
-          for turning on USE_HPPA_IOREMAP.  The warnings are harmless;
-          the kernel has enough information to fix the broken drivers
-          automatically, but we'd like to make it more efficient by not
-          having to do that.
-
 config DEBUG_FS
         bool "Debug Filesystem"
         depends on SYSFS
diff --git a/mm/fadvise.c b/mm/fadvise.c
index 907c39257ca0..0a03357a1f8e 100644
--- a/mm/fadvise.c
+++ b/mm/fadvise.c
@@ -35,17 +35,6 @@
  *
  * LINUX_FADV_ASYNC_WRITE: push some or all of the dirty pages at the disk.
  *
- * LINUX_FADV_WRITE_WAIT, LINUX_FADV_ASYNC_WRITE: push all of the currently
- * dirty pages at the disk.
- *
- * LINUX_FADV_WRITE_WAIT, LINUX_FADV_ASYNC_WRITE, LINUX_FADV_WRITE_WAIT: push
- * all of the currently dirty pages at the disk, wait until they have been
- * written.
- *
- * It should be noted that none of these operations write out the file's
- * metadata.  So unless the application is strictly performing overwrites of
- * already-instantiated disk blocks, there are no guarantees here that the data
- * will be available after a crash.
  */
 asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
 {
@@ -129,15 +118,6 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
                         invalidate_mapping_pages(mapping, start_index,
                                                 end_index);
                 break;
-        case LINUX_FADV_ASYNC_WRITE:
-                ret = __filemap_fdatawrite_range(mapping, offset, endbyte,
-                                                WB_SYNC_NONE);
-                break;
-        case LINUX_FADV_WRITE_WAIT:
-                ret = wait_on_page_writeback_range(mapping,
-                                        offset >> PAGE_CACHE_SHIFT,
-                                        endbyte >> PAGE_CACHE_SHIFT);
-                break;
         default:
                 ret = -EINVAL;
         }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ebad6bbb3501..832f676ca038 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -334,6 +334,7 @@ static unsigned long set_max_huge_pages(unsigned long count)
                 return nr_huge_pages;
 
         spin_lock(&hugetlb_lock);
+        count = max(count, reserved_huge_pages);
         try_to_free_low(count);
         while (count < nr_huge_pages) {
                 struct page *page = dequeue_huge_page(NULL, 0);
@@ -697,9 +698,10 @@ int follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
                 pfn_offset = (vaddr & ~HPAGE_MASK) >> PAGE_SHIFT;
                 page = pte_page(*pte);
 same_page:
-                get_page(page);
-                if (pages)
+                if (pages) {
+                        get_page(page);
                         pages[i] = page + pfn_offset;
+                }
 
                 if (vmas)
                         vmas[i] = vma;
diff --git a/mm/memory.c b/mm/memory.c
index 8d8f52569f32..0ec7bc644271 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -87,7 +87,7 @@ int randomize_va_space __read_mostly = 1;
 static int __init disable_randmaps(char *s)
 {
         randomize_va_space = 0;
-        return 0;
+        return 1;
 }
 __setup("norandmaps", disable_randmaps);
 
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 39aa9d129612..e5fd5385f0cc 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -397,18 +397,24 @@ void free_swap_and_cache(swp_entry_t entry)
 
         p = swap_info_get(entry);
         if (p) {
-                if (swap_entry_free(p, swp_offset(entry)) == 1)
-                        page = find_trylock_page(&swapper_space, entry.val);
+                if (swap_entry_free(p, swp_offset(entry)) == 1) {
+                        page = find_get_page(&swapper_space, entry.val);
+                        if (page && unlikely(TestSetPageLocked(page))) {
+                                page_cache_release(page);
+                                page = NULL;
+                        }
+                }
                 spin_unlock(&swap_lock);
         }
         if (page) {
                 int one_user;
 
                 BUG_ON(PagePrivate(page));
-                page_cache_get(page);
                 one_user = (page_count(page) == 2);
                 /* Only cache user (+us), or swap space full? Free it! */
-                if (!PageWriteback(page) && (one_user || vm_swap_full())) {
+                /* Also recheck PageSwapCache after page is locked (above) */
+                if (PageSwapCache(page) && !PageWriteback(page) &&
+                                        (one_user || vm_swap_full())) {
                         delete_from_swap_cache(page);
                         SetPageDirty(page);
                 }
diff --git a/net/core/dev.c b/net/core/dev.c
index a3ab11f34153..434220d093aa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1080,6 +1080,70 @@ void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
         rcu_read_unlock();
 }
 
+
+void __netif_schedule(struct net_device *dev)
+{
+        if (!test_and_set_bit(__LINK_STATE_SCHED, &dev->state)) {
+                unsigned long flags;
+                struct softnet_data *sd;
+
+                local_irq_save(flags);
+                sd = &__get_cpu_var(softnet_data);
+                dev->next_sched = sd->output_queue;
+                sd->output_queue = dev;
+                raise_softirq_irqoff(NET_TX_SOFTIRQ);
+                local_irq_restore(flags);
+        }
+}
+EXPORT_SYMBOL(__netif_schedule);
+
+void __netif_rx_schedule(struct net_device *dev)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+        dev_hold(dev);
+        list_add_tail(&dev->poll_list, &__get_cpu_var(softnet_data).poll_list);
+        if (dev->quota < 0)
+                dev->quota += dev->weight;
+        else
+                dev->quota = dev->weight;
+        __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+        local_irq_restore(flags);
+}
+EXPORT_SYMBOL(__netif_rx_schedule);
+
+void dev_kfree_skb_any(struct sk_buff *skb)
+{
+        if (in_irq() || irqs_disabled())
+                dev_kfree_skb_irq(skb);
+        else
+                dev_kfree_skb(skb);
+}
+EXPORT_SYMBOL(dev_kfree_skb_any);
+
+
+/* Hot-plugging. */
+void netif_device_detach(struct net_device *dev)
+{
+        if (test_and_clear_bit(__LINK_STATE_PRESENT, &dev->state) &&
+            netif_running(dev)) {
+                netif_stop_queue(dev);
+        }
+}
+EXPORT_SYMBOL(netif_device_detach);
+
+void netif_device_attach(struct net_device *dev)
+{
+        if (!test_and_set_bit(__LINK_STATE_PRESENT, &dev->state) &&
+            netif_running(dev)) {
+                netif_wake_queue(dev);
+                __netdev_watchdog_up(dev);
+        }
+}
+EXPORT_SYMBOL(netif_device_attach);
+
+
 /*
  * Invalidate hardware checksum when packet is to be mangled, and
  * complete checksum manually on outgoing path.
diff --git a/net/core/sock.c b/net/core/sock.c
index a96ea7dd0fc1..ed2afdb9ea2d 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -385,7 +385,21 @@ set_sndbuf:
                                 val = sysctl_rmem_max;
 set_rcvbuf:
                         sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
-                        /* FIXME: is this lower bound the right one? */
+                        /*
+                         * We double it on the way in to account for
+                         * "struct sk_buff" etc. overhead.   Applications
+                         * assume that the SO_RCVBUF setting they make will
+                         * allow that much actual data to be received on that
+                         * socket.
+                         *
+                         * Applications are unaware that "struct sk_buff" and
+                         * other overheads allocate from the receive buffer
+                         * during socket buffer allocation.
+                         *
+                         * And after considering the possible alternatives,
+                         * returning the value we actually used in getsockopt
+                         * is the most desirable behavior.
+                         */
                         if ((val * 2) < SOCK_MIN_RCVBUF)
                                 sk->sk_rcvbuf = SOCK_MIN_RCVBUF;
                         else
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index e3dd30d36c8a..b39e2a597889 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -204,7 +204,7 @@ static int dccp_feat_reconcile(struct sock *sk, struct dccp_opt_pend *opt,
         if (rc) {
                 kfree(opt->dccpop_sc->dccpoc_val);
                 kfree(opt->dccpop_sc);
-                opt->dccpop_sc = 0;
+                opt->dccpop_sc = NULL;
                 return rc;
         }
 
@@ -322,7 +322,7 @@ static void dccp_feat_empty_confirm(struct dccp_minisock *dmsk,
         opt->dccpop_type = type == DCCPO_CHANGE_L ? DCCPO_CONFIRM_R :
                                                     DCCPO_CONFIRM_L;
         opt->dccpop_feat = feature;
-        opt->dccpop_val  = 0;
+        opt->dccpop_val  = NULL;
         opt->dccpop_len  = 0;
 
         /* change feature */
@@ -523,7 +523,7 @@ int dccp_feat_clone(struct sock *oldsk, struct sock *newsk)
                  * once...
                  */
                 /* the master socket no longer needs to worry about confirms */
-                opt->dccpop_sc = 0; /* it's not a memleak---new socket has it */
+                opt->dccpop_sc = NULL; /* it's not a memleak---new socket has it */
 
                 /* reset state for a new socket */
                 opt->dccpop_conf = 0;
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index d2ae9893ca17..a26ff9f44576 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -620,7 +620,7 @@ int dn_dev_set_default(struct net_device *dev, int force)
         }
         write_unlock(&dndev_lock);
         if (old)
-                dev_put(dev);
+                dev_put(old);
         return rv;
 }