207 files changed, 2149 insertions, 930 deletions

diff --git a/Documentation/cachetlb.txt b/Documentation/cachetlb.txt
index 73e794f0ff09..debf6813934a 100644
--- a/Documentation/cachetlb.txt
+++ b/Documentation/cachetlb.txt
@@ -373,14 +373,15 @@ maps this page at its virtual address.
         likely that you will need to flush the instruction cache
         for copy_to_user_page().
 
-  void flush_anon_page(struct page *page, unsigned long vmaddr)
+  void flush_anon_page(struct vm_area_struct *vma, struct page *page,
+                       unsigned long vmaddr)
         When the kernel needs to access the contents of an anonymous
         page, it calls this function (currently only
         get_user_pages()).  Note: flush_dcache_page() deliberately
         doesn't work for an anonymous page.  The default
         implementation is a nop (and should remain so for all coherent
         architectures).  For incoherent architectures, it should flush
-        the cache of the page at vmaddr in the current user process.
+        the cache of the page at vmaddr.
 
   void flush_kernel_dcache_page(struct page *page)
         When the kernel needs to modify a user page is has obtained
diff --git a/Documentation/filesystems/Locking b/Documentation/filesystems/Locking
index 790ef6fbe495..28bfea75bcf2 100644
--- a/Documentation/filesystems/Locking
+++ b/Documentation/filesystems/Locking
@@ -171,6 +171,7 @@ prototypes:
         int (*releasepage) (struct page *, int);
         int (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
                         loff_t offset, unsigned long nr_segs);
+        int (*launder_page) (struct page *);
 
 locking rules:
         All except set_page_dirty may block
@@ -188,6 +189,7 @@ bmap:			yes
 invalidatepage:         no      yes
 releasepage:            no      yes
 direct_IO:              no
+launder_page:           no      yes
 
         ->prepare_write(), ->commit_write(), ->sync_page() and ->readpage()
 may be called from the request handler (/dev/loop).
@@ -281,6 +283,12 @@ buffers from the page in preparation for freeing it.  It returns zero to
 indicate that the buffers are (or may be) freeable.  If ->releasepage is zero,
 the kernel assumes that the fs has no private interest in the buffers.
 
+        ->launder_page() may be called prior to releasing a page if
+it is still found to be dirty. It returns zero if the page was successfully
+cleaned, or an error value if not. Note that in order to prevent the page
+getting mapped back in and redirtied, it needs to be kept locked
+across the entire operation.
+
         Note: currently almost all instances of address_space methods are
 using BKL for internal serialization and that's one of the worst sources
 of contention. Normally they are calling library functions (in fs/buffer.c)
diff --git a/Documentation/kdump/kdump.txt b/Documentation/kdump/kdump.txt
index 99f2d4d4bf7d..5af6676a88f0 100644
--- a/Documentation/kdump/kdump.txt
+++ b/Documentation/kdump/kdump.txt
@@ -17,7 +17,7 @@ You can use common Linux commands, such as cp and scp, to copy the
 memory image to a dump file on the local disk, or across the network to
 a remote system.
 
-Kdump and kexec are currently supported on the x86, x86_64, and ppc64
+Kdump and kexec are currently supported on the x86, x86_64, ppc64 and IA64
 architectures.
 
 When the system kernel boots, it reserves a small section of memory for
@@ -54,59 +54,64 @@ memory," in two ways:
 Setup and Installation
 ======================
 
-Install kexec-tools and the Kdump patch
----------------------------------------
+Install kexec-tools
+-------------------
 
 1) Login as the root user.
 
 2) Download the kexec-tools user-space package from the following URL:
 
-   http://www.xmission.com/~ebiederm/files/kexec/kexec-tools-1.101.tar.gz
+http://www.kernel.org/pub/linux/kernel/people/horms/kexec-tools/kexec-tools-testing-20061214.tar.gz
 
-3) Unpack the tarball with the tar command, as follows:
-
-   tar xvpzf kexec-tools-1.101.tar.gz
-
-4) Download the latest consolidated Kdump patch from the following URL:
-
-   http://lse.sourceforge.net/kdump/
+Note: Latest kexec-tools-testing git tree is available at
 
-   (This location is being used until all the user-space Kdump patches
-   are integrated with the kexec-tools package.)
+git://git.kernel.org/pub/scm/linux/kernel/git/horms/kexec-tools-testing.git
+or
+http://www.kernel.org/git/?p=linux/kernel/git/horms/kexec-tools-testing.git;a=summary
 
-5) Change to the kexec-tools-1.101 directory, as follows:
+3) Unpack the tarball with the tar command, as follows:
 
-   cd kexec-tools-1.101
+   tar xvpzf kexec-tools-testing-20061214.tar.gz
 
-6) Apply the consolidated patch to the kexec-tools-1.101 source tree
-   with the patch command, as follows. (Modify the path to the downloaded
-   patch as necessary.)
+4) Change to the kexec-tools-1.101 directory, as follows:
 
-   patch -p1 < /path-to-kdump-patch/kexec-tools-1.101-kdump.patch
+   cd kexec-tools-testing-20061214
 
-7) Configure the package, as follows:
+5) Configure the package, as follows:
 
    ./configure
 
-8) Compile the package, as follows:
+6) Compile the package, as follows:
 
    make
 
-9) Install the package, as follows:
+7) Install the package, as follows:
 
    make install
 
 
-Download and build the system and dump-capture kernels
-------------------------------------------------------
+Build the system and dump-capture kernels
+-----------------------------------------
+There are two possible methods of using Kdump.
+
+1) Build a separate custom dump-capture kernel for capturing the
+   kernel core dump.
+
+2) Or use the system kernel binary itself as dump-capture kernel and there is
+   no need to build a separate dump-capture kernel. This is possible
+   only with the architecutres which support a relocatable kernel. As
+   of today i386 and ia64 architectures support relocatable kernel.
+
+Building a relocatable kernel is advantageous from the point of view that
+one does not have to build a second kernel for capturing the dump. But
+at the same time one might want to build a custom dump capture kernel
+suitable to his needs.
 
-Download the mainline (vanilla) kernel source code (2.6.13-rc1 or newer)
-from http://www.kernel.org. Two kernels must be built: a system kernel
-and a dump-capture kernel. Use the following steps to configure these
-kernels with the necessary kexec and Kdump features:
+Following are the configuration setting required for system and
+dump-capture kernels for enabling kdump support.
 
-System kernel
--------------
+System kernel config options
+----------------------------
 
 1) Enable "kexec system call" in "Processor type and features."
 
@@ -132,88 +137,160 @@ System kernel
    analysis tools require a vmlinux with debug symbols in order to read
    and analyze a dump file.
 
-4) Make and install the kernel and its modules. Update the boot loader
-   (such as grub, yaboot, or lilo) configuration files as necessary.
-
-5) Boot the system kernel with the boot parameter "crashkernel=Y@X",
-   where Y specifies how much memory to reserve for the dump-capture kernel
-   and X specifies the beginning of this reserved memory. For example,
-   "crashkernel=64M@16M" tells the system kernel to reserve 64 MB of memory
-   starting at physical address 0x01000000 for the dump-capture kernel.
-
-   On x86 and x86_64, use "crashkernel=64M@16M".
+Dump-capture kernel config options (Arch Independent)
+-----------------------------------------------------
 
-   On ppc64, use "crashkernel=128M@32M".
+1) Enable "kernel crash dumps" support under "Processor type and
+   features":
 
+   CONFIG_CRASH_DUMP=y
 
-The dump-capture kernel
------------------------
+2) Enable "/proc/vmcore support" under "Filesystems" -> "Pseudo filesystems".
 
-1) Under "General setup," append "-kdump" to the current string in
-   "Local version."
+   CONFIG_PROC_VMCORE=y
+   (CONFIG_PROC_VMCORE is set by default when CONFIG_CRASH_DUMP is selected.)
 
-2) On x86, enable high memory support under "Processor type and
+Dump-capture kernel config options (Arch Dependent, i386)
+--------------------------------------------------------
+1) On x86, enable high memory support under "Processor type and
    features":
 
    CONFIG_HIGHMEM64G=y
    or
    CONFIG_HIGHMEM4G
 
-3) On x86 and x86_64, disable symmetric multi-processing support
+2) On x86 and x86_64, disable symmetric multi-processing support
    under "Processor type and features":
 
    CONFIG_SMP=n
+
    (If CONFIG_SMP=y, then specify maxcpus=1 on the kernel command line
    when loading the dump-capture kernel, see section "Load the Dump-capture
    Kernel".)
 
-4) On ppc64, disable NUMA support and enable EMBEDDED support:
+3) If one wants to build and use a relocatable kernel,
+   Enable "Build a relocatable kernel" support under "Processor type and
+   features"
 
-   CONFIG_NUMA=n
-   CONFIG_EMBEDDED=y
-   CONFIG_EEH=N for the dump-capture kernel
+   CONFIG_RELOCATABLE=y
 
-5) Enable "kernel crash dumps" support under "Processor type and
-   features":
+4) Use a suitable value for "Physical address where the kernel is
+   loaded" (under "Processor type and features"). This only appears when
+   "kernel crash dumps" is enabled. A suitable value depends upon
+   whether kernel is relocatable or not.
+
+   If you are using a relocatable kernel use CONFIG_PHYSICAL_START=0x100000
+   This will compile the kernel for physical address 1MB, but given the fact
+   kernel is relocatable, it can be run from any physical address hence
+   kexec boot loader will load it in memory region reserved for dump-capture
+   kernel.
+
+   Otherwise it should be the start of memory region reserved for
+   second kernel using boot parameter "crashkernel=Y@X". Here X is
+   start of memory region reserved for dump-capture kernel.
+   Generally X is 16MB (0x1000000). So you can set
+   CONFIG_PHYSICAL_START=0x1000000
+
+5) Make and install the kernel and its modules. DO NOT add this kernel
+   to the boot loader configuration files.
 
-   CONFIG_CRASH_DUMP=y
+Dump-capture kernel config options (Arch Dependent, x86_64)
+----------------------------------------------------------
+1) On x86 and x86_64, disable symmetric multi-processing support
+   under "Processor type and features":
+
+   CONFIG_SMP=n
+
+   (If CONFIG_SMP=y, then specify maxcpus=1 on the kernel command line
+   when loading the dump-capture kernel, see section "Load the Dump-capture
+   Kernel".)
 
-6) Use a suitable value for "Physical address where the kernel is
+2) Use a suitable value for "Physical address where the kernel is
    loaded" (under "Processor type and features"). This only appears when
    "kernel crash dumps" is enabled. By default this value is 0x1000000
    (16MB). It should be the same as X in the "crashkernel=Y@X" boot
-   parameter discussed above.
+   parameter.
 
-   On x86 and x86_64, use "CONFIG_PHYSICAL_START=0x1000000".
+   For x86_64, normally "CONFIG_PHYSICAL_START=0x1000000".
 
-   On ppc64 the value is automatically set at 32MB when
-   CONFIG_CRASH_DUMP is set.
-
-6) Optionally enable "/proc/vmcore support" under "Filesystems" ->
-   "Pseudo filesystems".
+3) Make and install the kernel and its modules. DO NOT add this kernel
+   to the boot loader configuration files.
 
-   CONFIG_PROC_VMCORE=y
-   (CONFIG_PROC_VMCORE is set by default when CONFIG_CRASH_DUMP is selected.)
+Dump-capture kernel config options (Arch Dependent, ppc64)
+----------------------------------------------------------
 
-7) Make and install the kernel and its modules. DO NOT add this kernel
+-  Make and install the kernel and its modules. DO NOT add this kernel
    to the boot loader configuration files.
 
+Dump-capture kernel config options (Arch Dependent, ia64)
+----------------------------------------------------------
+(To be filled)
+
+
+Boot into System Kernel
+=======================
+
+1) Make and install the kernel and its modules. Update the boot loader
+   (such as grub, yaboot, or lilo) configuration files as necessary.
+
+2) Boot the system kernel with the boot parameter "crashkernel=Y@X",
+   where Y specifies how much memory to reserve for the dump-capture kernel
+   and X specifies the beginning of this reserved memory. For example,
+   "crashkernel=64M@16M" tells the system kernel to reserve 64 MB of memory
+   starting at physical address 0x01000000 (16MB) for the dump-capture kernel.
+
+   On x86 and x86_64, use "crashkernel=64M@16M".
+
+   On ppc64, use "crashkernel=128M@32M".
 
 Load the Dump-capture Kernel
 ============================
 
-After booting to the system kernel, load the dump-capture kernel using
-the following command:
+After booting to the system kernel, dump-capture kernel needs to be
+loaded.
+
+Based on the architecture and type of image (relocatable or not), one
+can choose to load the uncompressed vmlinux or compressed bzImage/vmlinuz
+of dump-capture kernel. Following is the summary.
+
+For i386:
+        - Use vmlinux if kernel is not relocatable.
+        - Use bzImage/vmlinuz if kernel is relocatable.
+For x86_64:
+        - Use vmlinux
+For ppc64:
+        - Use vmlinux
+For ia64:
+        (To be filled)
+
+If you are using a uncompressed vmlinux image then use following command
+to load dump-capture kernel.
 
-   kexec -p <dump-capture-kernel> \
+   kexec -p <dump-capture-kernel-vmlinux-image> \
    --initrd=<initrd-for-dump-capture-kernel> --args-linux \
-   --append="root=<root-dev> init 1 irqpoll"
+   --append="root=<root-dev> <arch-specific-options>"
 
+If you are using a compressed bzImage/vmlinuz, then use following command
+to load dump-capture kernel.
 
-Notes on loading the dump-capture kernel:
+   kexec -p <dump-capture-kernel-bzImage> \
+   --initrd=<initrd-for-dump-capture-kernel> \
+   --append="root=<root-dev> <arch-specific-options>"
+
+Following are the arch specific command line options to be used while
+loading dump-capture kernel.
+
+For i386 and x86_64:
+        "init 1 irqpoll maxcpus=1"
+
+For ppc64:
+        "init 1 maxcpus=1 noirqdistrib"
 
-* <dump-capture-kernel> must be a vmlinux image (that is, an
-  uncompressed ELF image). bzImage does not work at this time.
+For IA64
+        (To be filled)
+
+
+Notes on loading the dump-capture kernel:
 
 * By default, the ELF headers are stored in ELF64 format to support
   systems with more than 4GB memory. The --elf32-core-headers option can
@@ -231,6 +308,9 @@ Notes on loading the dump-capture kernel:
 * "init 1" boots the dump-capture kernel into single-user mode without
   networking. If you want networking, use "init 3."
 
+* We generally don' have to bring up a SMP kernel just to capture the
+  dump. Hence generally it is useful either to build a UP dump-capture
+  kernel or specify maxcpus=1 option while loading dump-capture kernel.
 
 Kernel Panic
 ============
diff --git a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
index d077d764f82b..7fb3b8a44eb6 100644
--- a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
+++ b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
@@ -157,8 +157,8 @@ rtc@<addr>	rtc		*-rtc		Real time clock
 mscan@<addr>    mscan           *-mscan         CAN bus controller
 pci@<addr>      pci             *-pci           PCI bridge
 serial@<addr>   serial          *-psc-uart      PSC in serial mode
-i2s@<addr>      i2s             *-psc-i2s       PSC in i2s mode
-ac97@<addr>     ac97            *-psc-ac97      PSC in ac97 mode
+i2s@<addr>      sound           *-psc-i2s       PSC in i2s mode
+ac97@<addr>     sound           *-psc-ac97      PSC in ac97 mode
 spi@<addr>      spi             *-psc-spi       PSC in spi mode
 irda@<addr>     irda            *-psc-irda      PSC in IrDA mode
 spi@<addr>      spi             *-spi           MPC52xx spi device
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index dbdcaf68e3ea..5c86ed6f0448 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -52,6 +52,10 @@ APICs
                  apicmaintimer. Useful when your PIT timer is totally
                  broken.
 
+   disable_8254_timer / enable_8254_timer
+                 Enable interrupt 0 timer routing over the 8254 in addition to over
+                 the IO-APIC. The kernel tries to set a sensible default.
+
 Early Console
 
    syntax: earlyprintk=vga
diff --git a/MAINTAINERS b/MAINTAINERS
index 2bd34ef58ffa..49e4f554d211 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -412,20 +412,32 @@ S:      Maintained
 ARM/INTEL IOP32X ARM ARCHITECTURE
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
+
+ARM/INTEL IOP33X ARM ARCHITECTURE
+P:      Dan Williams
+M:      dan.j.williams@intel.com
+L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
+S:      Supported
 
 ARM/INTEL IOP13XX ARM ARCHITECTURE
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
 
 ARM/INTEL IQ81342EX MACHINE SUPPORT
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
 
 ARM/INTEL IXP2000 ARM ARCHITECTURE
 P:      Lennert Buytenhek
@@ -448,8 +460,10 @@ S:	Maintained
 ARM/INTEL XSC3 (MANZANO) ARM CORE
 P:      Lennert Buytenhek
 M:      kernel@wantstofly.org
+P:      Dan Williams
+M:      dan.j.williams@intel.com
 L:      linux-arm-kernel@lists.arm.linux.org.uk (subscribers-only)
-S:      Maintained
+S:      Supported
 
 ARM/IP FABRICS DOUBLE ESPRESSO MACHINE SUPPORT
 P:      Lennert Buytenhek
@@ -2622,6 +2636,12 @@ M:	promise@pnd-pc.demon.co.uk
 W:      http://www.pnd-pc.demon.co.uk/promise/
 S:      Maintained
 
+PROMISE SATA TX2/TX4 CONTROLLER LIBATA DRIVER
+P:      Mikael Pettersson
+M:      mikpe@it.uu.se
+L:      linux-ide@vger.kernel.org
+S:      Maintained
+
 PS3 PLATFORM SUPPORT
 P:      Geoff Levand
 M:      geoffrey.levand@am.sony.com
diff --git a/Makefile b/Makefile
index fb5b3ef9ab11..47669cb6c8fb 100644
--- a/Makefile
+++ b/Makefile
@@ -368,14 +368,10 @@ endif
 # Detect when mixed targets is specified, and make a second invocation
 # of make so .config is not included in this case either (for *config).
 
-PHONY += generated_headers
-
-generated_headers: include/linux/version.h include/linux/compile.h \
-                include/linux/utsrelease.h
-
-no-dot-config-targets := generated_headers clean mrproper distclean \
+no-dot-config-targets := clean mrproper distclean \
                          cscope TAGS tags help %docs check% \
-                         headers_% kernelrelease kernelversion
+                         include/linux/version.h headers_% \
+                         kernelrelease kernelversion
 
 config-targets := 0
 mixed-targets  := 0
@@ -738,16 +734,6 @@ debug_kallsyms: .tmp_map$(last_kallsyms)
 
 endif # ifdef CONFIG_KALLSYMS
 
-# compile.h changes depending on hostname, generation number, etc,
-# so we regenerate it always.
-# mkcompile_h will make sure to only update the
-# actual file if its content has changed.
-
-include/linux/compile.h: FORCE
-        @echo '  CHK     $@'
-        $(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkcompile_h $@ \
-        "$(UTS_MACHINE)" "$(CONFIG_SMP)" "$(CONFIG_PREEMPT)" "$(CC) $(CFLAGS)"
-
 # vmlinux image - including updated kernel symbols
 vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) $(kallsyms.o) FORCE
 ifdef CONFIG_HEADERS_CHECK
@@ -866,8 +852,8 @@ endif
 # prepare2 creates a makefile if using a separate output directory
 prepare2: prepare3 outputmakefile
 
-prepare1: prepare2 generated_headers include/asm include/config/auto.conf
-
+prepare1: prepare2 include/linux/version.h include/linux/utsrelease.h \
+                   include/asm include/config/auto.conf
 ifneq ($(KBUILD_MODULES),)
         $(Q)mkdir -p $(MODVERDIR)
         $(Q)rm -f $(MODVERDIR)/*
@@ -936,14 +922,14 @@ export INSTALL_HDR_PATH
 HDRARCHES=$(filter-out generic,$(patsubst $(srctree)/include/asm-%/Kbuild,%,$(wildcard $(srctree)/include/asm-*/Kbuild)))
 
 PHONY += headers_install_all
-headers_install_all: generated_headers scripts_basic FORCE
+headers_install_all: include/linux/version.h scripts_basic FORCE
         $(Q)$(MAKE) $(build)=scripts scripts/unifdef
         $(Q)for arch in $(HDRARCHES); do \
          $(MAKE) ARCH=$$arch -f $(srctree)/scripts/Makefile.headersinst obj=include BIASMDIR=-bi-$$arch ;\
          done
 
 PHONY += headers_install
-headers_install: generated_headers scripts_basic FORCE
+headers_install: include/linux/version.h scripts_basic FORCE
         @if [ ! -r $(srctree)/include/asm-$(ARCH)/Kbuild ]; then \
           echo '*** Error: Headers not exportable for this architecture ($(ARCH))'; \
           exit 1 ; fi
@@ -1040,7 +1026,8 @@ CLEAN_FILES +=	vmlinux System.map \
 # Directories & files removed with 'make mrproper'
 MRPROPER_DIRS  += include/config include2 usr/include
 MRPROPER_FILES += .config .config.old include/asm .version .old_version \
-                  include/linux/autoconf.h include/linux/utsrelease.h include/linux/version.h \
+                  include/linux/autoconf.h include/linux/version.h      \
+                  include/linux/utsrelease.h                            \
                   Module.symvers tags TAGS cscope*
 
 # clean - Delete most, but leave enough to build external modules
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 2db42b18f53f..8517c3c3eb33 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -436,7 +436,7 @@ __und_usr:
         usr_entry
 
         tst     r3, #PSR_T_BIT                  @ Thumb mode?
-        bne     fpundefinstr                    @ ignore FP
+        bne     __und_usr_unknown               @ ignore FP
         sub     r4, r2, #4
 
         @
@@ -448,7 +448,7 @@ __und_usr:
         @
 1:      ldrt    r0, [r4]
         adr     r9, ret_from_exception
-        adr     lr, fpundefinstr
+        adr     lr, __und_usr_unknown
         @
         @ fallthrough to call_fpe
         @
@@ -476,7 +476,9 @@ __und_usr:
  * Emulators may wish to make use of the following registers:
  *  r0  = instruction opcode.
  *  r2  = PC+4
+ *  r9  = normal "successful" return address
  *  r10 = this threads thread_info structure.
+ *  lr  = unrecognised instruction return address
  */
 call_fpe:
         tst     r0, #0x08000000                 @ only CDP/CPRT/LDC/STC have bit 27
@@ -545,10 +547,12 @@ do_fpe:
 
         .data
 ENTRY(fp_enter)
-        .word   fpundefinstr
+        .word   no_fp
         .text
 
-fpundefinstr:
+no_fp:  mov     pc, lr
+
+__und_usr_unknown:
         mov     r0, sp
         adr     lr, ret_from_exception
         b       do_undefinstr
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index 6ff5e3ff6cb5..3c8cdcfe8d4a 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -29,6 +29,8 @@
 #include <linux/timer.h>
 #include <linux/irq.h>
 
+#include <linux/mc146818rtc.h>
+
 #include <asm/leds.h>
 #include <asm/thread_info.h>
 #include <asm/mach/time.h>
@@ -85,6 +87,17 @@ unsigned long long __attribute__((weak)) sched_clock(void)
         return (unsigned long long)jiffies * (1000000000 / HZ);
 }
 
+/*
+ * An implementation of printk_clock() independent from
+ * sched_clock().  This avoids non-bootable kernels when
+ * printk_clock is enabled.
+ */
+unsigned long long printk_clock(void)
+{
+        return (unsigned long long)(jiffies - INITIAL_JIFFIES) *
+                        (1000000000 / HZ);
+}
+
 static unsigned long next_rtc_update;
 
 /*
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 042a12982e98..908915675edc 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -27,6 +27,7 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include <asm/traps.h>
+#include <asm/io.h>
 
 #include "ptrace.h"
 #include "signal.h"
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 628348c9f6c5..9df507d36e0b 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -202,3 +202,42 @@ void flush_dcache_page(struct page *page)
         }
 }
 EXPORT_SYMBOL(flush_dcache_page);
+
+/*
+ * Flush an anonymous page so that users of get_user_pages()
+ * can safely access the data.  The expected sequence is:
+ *
+ *  get_user_pages()
+ *    -> flush_anon_page
+ *  memcpy() to/from page
+ *  if written to page, flush_dcache_page()
+ */
+void __flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
+{
+        unsigned long pfn;
+
+        /* VIPT non-aliasing caches need do nothing */
+        if (cache_is_vipt_nonaliasing())
+                return;
+
+        /*
+         * Write back and invalidate userspace mapping.
+         */
+        pfn = page_to_pfn(page);
+        if (cache_is_vivt()) {
+                flush_cache_page(vma, vmaddr, pfn);
+        } else {
+                /*
+                 * For aliasing VIPT, we can flush an alias of the
+                 * userspace address only.
+                 */
+                flush_pfn_alias(pfn, vmaddr);
+        }
+
+        /*
+         * Invalidate kernel mapping.  No data should be contained
+         * in this mapping of the page.  FIXME: this is overkill
+         * since we actually ask for a write-back and invalidate.
+         */
+        __cpuc_flush_dcache_page(page_address(page));
+}
diff --git a/arch/cris/arch-v32/kernel/smp.c b/arch/cris/arch-v32/kernel/smp.c
index 2d0023f2d49b..77e655f26560 100644
--- a/arch/cris/arch-v32/kernel/smp.c
+++ b/arch/cris/arch-v32/kernel/smp.c
@@ -195,7 +195,7 @@ int setup_profiling_timer(unsigned int multiplier)
  */
 unsigned long cache_decay_ticks = 1;
 
-int __devinit __cpu_up(unsigned int cpu)
+int __cpuinit __cpu_up(unsigned int cpu)
 {
         smp_boot_one_cpu(cpu);
         return cpu_online(cpu) ? 0 : -ENOSYS;
diff --git a/arch/i386/defconfig b/arch/i386/defconfig
index 88b7c1cf65a2..5d80edfc61b7 100644
--- a/arch/i386/defconfig
+++ b/arch/i386/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-git14
-# Sat Dec  9 21:23:14 2006
+# Linux kernel version: 2.6.20-rc3
+# Fri Jan  5 11:54:46 2007
 #
 CONFIG_X86_32=y
 CONFIG_GENERIC_TIME=y
@@ -1287,6 +1287,11 @@ CONFIG_USB_MON=y
 #
 
 #
+# Virtualization
+#
+# CONFIG_KVM is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1471,6 +1476,8 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_UNUSED_SYMBOLS=y
+# CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_DETECT_SOFTLOCKUP=y
@@ -1489,12 +1496,10 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_HIGHMEM is not set
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_FORCED_INLINING is not set
-# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
 CONFIG_EARLY_PRINTK=y
@@ -1527,6 +1532,7 @@ CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
 CONFIG_PLIST=y
+CONFIG_IOMAP_COPY=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
diff --git a/arch/i386/kernel/cpu/cyrix.c b/arch/i386/kernel/cpu/cyrix.c
index c0c3b59de32c..abcff92f994c 100644
--- a/arch/i386/kernel/cpu/cyrix.c
+++ b/arch/i386/kernel/cpu/cyrix.c
@@ -173,7 +173,7 @@ static void __cpuinit geode_configure(void)
         ccr4 = getCx86(CX86_CCR4);
         ccr4 |= 0x38;           /* FPU fast, DTE cache, Mem bypass */
         
-        setCx86(CX86_CCR3, ccr3);
+        setCx86(CX86_CCR4, ccr4);
         
         set_cx86_memwb();
         set_cx86_reorder();     
diff --git a/arch/i386/kernel/mpparse.c b/arch/i386/kernel/mpparse.c
index 2ce67228dff8..49bff3596bff 100644
--- a/arch/i386/kernel/mpparse.c
+++ b/arch/i386/kernel/mpparse.c
@@ -36,7 +36,7 @@
 
 /* Have we found an MP table */
 int smp_found_config;
-unsigned int __initdata maxcpus = NR_CPUS;
+unsigned int __cpuinitdata maxcpus = NR_CPUS;
 
 /*
  * Various Linux-internal data structures created from the
@@ -102,9 +102,9 @@ static int __init mpf_checksum(unsigned char *mp, int len)
  */
 
 static int mpc_record; 
-static struct mpc_config_translation *translation_table[MAX_MPC_ENTRY] __initdata;
+static struct mpc_config_translation *translation_table[MAX_MPC_ENTRY] __cpuinitdata;
 
-static void __devinit MP_processor_info (struct mpc_config_processor *m)
+static void __cpuinit MP_processor_info (struct mpc_config_processor *m)
 {
         int ver, apicid;
         physid_mask_t phys_cpu;
@@ -822,7 +822,7 @@ void __init mp_register_lapic_address(u64 address)
         Dprintk("Boot CPU = %d\n", boot_cpu_physical_apicid);
 }
 
-void __devinit mp_register_lapic (u8 id, u8 enabled)
+void __cpuinit mp_register_lapic (u8 id, u8 enabled)
 {
         struct mpc_config_processor processor;
         int boot_cpu = 0;
diff --git a/arch/i386/kernel/setup.c b/arch/i386/kernel/setup.c
index 6f6cb7b31d18..4b31ad70c1ac 100644
--- a/arch/i386/kernel/setup.c
+++ b/arch/i386/kernel/setup.c
@@ -77,7 +77,7 @@ extern struct resource code_resource;
 extern struct resource data_resource;
 
 /* cpu data as detected by the assembly code in head.S */
-struct cpuinfo_x86 new_cpu_data __initdata = { 0, 0, 0, 0, -1, 1, 0, 0, -1 };
+struct cpuinfo_x86 new_cpu_data __cpuinitdata = { 0, 0, 0, 0, -1, 1, 0, 0, -1 };
 /* common cpu data for all cpus */
 struct cpuinfo_x86 boot_cpu_data __read_mostly = { 0, 0, 0, 0, -1, 1, 0, 0, -1 };
 EXPORT_SYMBOL(boot_cpu_data);
@@ -495,7 +495,7 @@ static void set_mca_bus(int x) { }
 #endif
 
 /* Overridden in paravirt.c if CONFIG_PARAVIRT */
-char * __attribute__((weak)) memory_setup(void)
+char * __init __attribute__((weak)) memory_setup(void)
 {
         return machine_specific_memory_setup();
 }
diff --git a/arch/i386/kernel/smpboot.c b/arch/i386/kernel/smpboot.c
index 300d9b38d02e..dea7ef9d3e82 100644
--- a/arch/i386/kernel/smpboot.c
+++ b/arch/i386/kernel/smpboot.c
@@ -159,7 +159,7 @@ void __init smp_alloc_memory(void)
  * a given CPU
  */
 
-static void __devinit smp_store_cpu_info(int id)
+static void __cpuinit smp_store_cpu_info(int id)
 {
         struct cpuinfo_x86 *c = cpu_data + id;
 
@@ -364,7 +364,7 @@ extern void calibrate_delay(void);
 
 static atomic_t init_deasserted;
 
-static void __devinit smp_callin(void)
+static void __cpuinit smp_callin(void)
 {
         int cpuid, phys_id;
         unsigned long timeout;
@@ -538,7 +538,7 @@ set_cpu_sibling_map(int cpu)
 /*
  * Activate a secondary processor.
  */
-static void __devinit start_secondary(void *unused)
+static void __cpuinit start_secondary(void *unused)
 {
         /*
          * Don't put *anything* before secondary_cpu_init(), SMP
@@ -931,7 +931,7 @@ static inline struct task_struct * alloc_idle_task(int cpu)
 #define alloc_idle_task(cpu) fork_idle(cpu)
 #endif
 
-static int __devinit do_boot_cpu(int apicid, int cpu)
+static int __cpuinit do_boot_cpu(int apicid, int cpu)
 /*
  * NOTE - on most systems this is a PHYSICAL apic ID, but on multiquad
  * (ie clustered apic addressing mode), this is a LOGICAL apic ID.
@@ -1432,7 +1432,7 @@ void __cpu_die(unsigned int cpu)
 }
 #endif /* CONFIG_HOTPLUG_CPU */
 
-int __devinit __cpu_up(unsigned int cpu)
+int __cpuinit __cpu_up(unsigned int cpu)
 {
 #ifdef CONFIG_HOTPLUG_CPU
         int ret=0;
diff --git a/arch/i386/kernel/tsc.c b/arch/i386/kernel/tsc.c
index 1bbe45dca7a0..2cfc7b09b925 100644
--- a/arch/i386/kernel/tsc.c
+++ b/arch/i386/kernel/tsc.c
@@ -24,7 +24,7 @@
  */
 unsigned int tsc_khz;
 
-int tsc_disable __cpuinitdata = 0;
+int tsc_disable;
 
 #ifdef CONFIG_X86_TSC
 static int __init tsc_setup(char *str)
diff --git a/arch/i386/mach-generic/bigsmp.c b/arch/i386/mach-generic/bigsmp.c
index 33d9f93557ba..8a210fa915b5 100644
--- a/arch/i386/mach-generic/bigsmp.c
+++ b/arch/i386/mach-generic/bigsmp.c
@@ -45,7 +45,7 @@ static struct dmi_system_id __initdata bigsmp_dmi_table[] = {
 };
 
 
-static __init int probe_bigsmp(void)
+static int probe_bigsmp(void)
 { 
         if (def_to_bigsmp)
                 dmi_bigsmp = 1;
diff --git a/arch/i386/mach-generic/default.c b/arch/i386/mach-generic/default.c
index 96c19821e47d..8685208d8512 100644
--- a/arch/i386/mach-generic/default.c
+++ b/arch/i386/mach-generic/default.c
@@ -18,7 +18,7 @@
 #include <asm/mach-default/mach_mpparse.h>
 
 /* should be called last. */
-static __init int probe_default(void)
+static int probe_default(void)
 { 
         return 1;
 } 
diff --git a/arch/i386/mach-generic/es7000.c b/arch/i386/mach-generic/es7000.c
index aa144d82334d..b8963a5a3b25 100644
--- a/arch/i386/mach-generic/es7000.c
+++ b/arch/i386/mach-generic/es7000.c
@@ -19,7 +19,7 @@
 #include <asm/mach-es7000/mach_mpparse.h>
 #include <asm/mach-es7000/mach_wakecpu.h>
 
-static __init int probe_es7000(void)
+static int probe_es7000(void)
 {
         /* probed later in mptable/ACPI hooks */
         return 0;
diff --git a/arch/i386/mach-generic/summit.c b/arch/i386/mach-generic/summit.c
index f7e5d66648dc..74883ccb8f73 100644
--- a/arch/i386/mach-generic/summit.c
+++ b/arch/i386/mach-generic/summit.c
@@ -18,7 +18,7 @@
 #include <asm/mach-summit/mach_ipi.h>
 #include <asm/mach-summit/mach_mpparse.h>
 
-static __init int probe_summit(void)
+static int probe_summit(void)
 { 
         /* probed later in mptable/ACPI hooks */
         return 0;
diff --git a/arch/i386/mm/init.c b/arch/i386/mm/init.c
index 60a7e57af197..c5c5ea700cc7 100644
--- a/arch/i386/mm/init.c
+++ b/arch/i386/mm/init.c
@@ -283,7 +283,7 @@ void __init add_one_highpage_init(struct page *page, int pfn, int bad_ppro)
                 SetPageReserved(page);
 }
 
-static int add_one_highpage_hotplug(struct page *page, unsigned long pfn)
+static int __meminit add_one_highpage_hotplug(struct page *page, unsigned long pfn)
 {
         free_new_highpage(page);
         totalram_pages++;
@@ -300,7 +300,7 @@ static int add_one_highpage_hotplug(struct page *page, unsigned long pfn)
  * has been added dynamically that would be
  * onlined here is in HIGHMEM
  */
-void online_page(struct page *page)
+void __meminit online_page(struct page *page)
 {
         ClearPageReserved(page);
         add_one_highpage_hotplug(page, page_to_pfn(page));
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index 1a3d8a2feb94..1373fae7657f 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -543,7 +543,8 @@ virtual_memmap_init (u64 start, u64 end, void *arg)
 
         if (map_start < map_end)
                 memmap_init_zone((unsigned long)(map_end - map_start),
-                                 args->nid, args->zone, page_to_pfn(map_start));
+                                 args->nid, args->zone, page_to_pfn(map_start),
+                                 MEMMAP_EARLY);
         return 0;
 }
 
@@ -552,7 +553,7 @@ memmap_init (unsigned long size, int nid, unsigned long zone,
              unsigned long start_pfn)
 {
         if (!vmem_map)
-                memmap_init_zone(size, nid, zone, start_pfn);
+                memmap_init_zone(size, nid, zone, start_pfn, MEMMAP_EARLY);
         else {
                 struct page *start;
                 struct memmap_init_callback_data args;
diff --git a/arch/m32r/kernel/smpboot.c b/arch/m32r/kernel/smpboot.c
index fa7865609495..48d376f47e1a 100644
--- a/arch/m32r/kernel/smpboot.c
+++ b/arch/m32r/kernel/smpboot.c
@@ -351,7 +351,7 @@ static void __init do_boot_cpu(int phys_id)
         }
 }
 
-int __devinit __cpu_up(unsigned int cpu_id)
+int __cpuinit __cpu_up(unsigned int cpu_id)
 {
         int timeout;
 
diff --git a/arch/mips/au1000/common/pci.c b/arch/mips/au1000/common/pci.c
index da591f674893..9f8ce08e173b 100644
--- a/arch/mips/au1000/common/pci.c
+++ b/arch/mips/au1000/common/pci.c
@@ -39,15 +39,15 @@
 
 /* TBD */
 static struct resource pci_io_resource = {
-        .start  = PCI_IO_START,
-        .end    = PCI_IO_END,
+        .start  = (resource_size_t)PCI_IO_START,
+        .end    = (resource_size_t)PCI_IO_END,
         .name   = "PCI IO space",
         .flags  = IORESOURCE_IO
 };
 
 static struct resource pci_mem_resource = {
-        .start  = PCI_MEM_START,
-        .end    = PCI_MEM_END,
+        .start  = (resource_size_t)PCI_MEM_START,
+        .end    = (resource_size_t)PCI_MEM_END,
         .name   = "PCI memory space",
         .flags  = IORESOURCE_MEM
 };
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index b061c9aa6302..de3fae260ff8 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -440,14 +440,26 @@ sys32_ipc (u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 }
 
 #ifdef CONFIG_MIPS32_N32
-asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, union semun arg)
+asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
 {
         /* compat_sys_semctl expects a pointer to union semun */
         u32 __user *uptr = compat_alloc_user_space(sizeof(u32));
-        if (put_user(ptr_to_compat(arg.__pad), uptr))
+        if (put_user(arg, uptr))
                 return -EFAULT;
         return compat_sys_semctl(semid, semnum, cmd, uptr);
 }
+
+asmlinkage long sysn32_msgsnd(int msqid, u32 msgp, unsigned msgsz, int msgflg)
+{
+        return compat_sys_msgsnd(msqid, msgsz, msgflg, compat_ptr(msgp));
+}
+
+asmlinkage long sysn32_msgrcv(int msqid, u32 msgp, size_t msgsz, int msgtyp,
+                              int msgflg)
+{
+        return compat_sys_msgrcv(msqid, msgsz, msgtyp, msgflg, IPC_64,
+                                 compat_ptr(msgp));
+}
 #endif
 
 struct sysctl_args32
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index f44a01357ada..2ef857c3ee53 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -46,5 +46,7 @@ EXPORT_SYMBOL(__strnlen_user_nocheck_asm);
 EXPORT_SYMBOL(__strnlen_user_asm);
 
 EXPORT_SYMBOL(csum_partial);
+EXPORT_SYMBOL(csum_partial_copy_nocheck);
+EXPORT_SYMBOL(__csum_partial_copy_user);
 
 EXPORT_SYMBOL(invalid_pte_table);
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 34567d81f940..a7bff2a54723 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -187,8 +187,8 @@ EXPORT(sysn32_call_table)
         PTR     sysn32_semctl
         PTR     sys_shmdt                       /* 6065 */
         PTR     sys_msgget
-        PTR     compat_sys_msgsnd
-        PTR     compat_sys_msgrcv
+        PTR     sysn32_msgsnd
+        PTR     sysn32_msgrcv
         PTR     compat_sys_msgctl
         PTR     compat_sys_fcntl                /* 6070 */
         PTR     sys_flock
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index f2a8701e414d..0555fc554f65 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -271,7 +271,7 @@ void __devinit smp_prepare_boot_cpu(void)
  * and keep control until "cpu_online(cpu)" is set.  Note: cpu is
  * physical, not logical.
  */
-int __devinit __cpu_up(unsigned int cpu)
+int __cpuinit __cpu_up(unsigned int cpu)
 {
         struct task_struct *idle;
 
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index 11aab6d6bfe5..8aa544f73a5e 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -94,10 +94,8 @@ static void c0_timer_ack(void)
 {
         unsigned int count;
 
-#ifndef CONFIG_SOC_PNX8550      /* pnx8550 resets to zero */
         /* Ack this timer interrupt and set the next one.  */
         expirelo += cycles_per_jiffy;
-#endif
         write_c0_compare(expirelo);
 
         /* Check to see if we have missed any timer interrupts.  */
diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile
index 888b61ea12fe..989c900b8b14 100644
--- a/arch/mips/lib/Makefile
+++ b/arch/mips/lib/Makefile
@@ -2,7 +2,7 @@
 # Makefile for MIPS-specific library files..
 #
 
-lib-y   += csum_partial.o csum_partial_copy.o memcpy.o promlib.o \
+lib-y   += csum_partial.o memcpy.o promlib.o \
            strlen_user.o strncpy_user.o strnlen_user.o uncached.o
 
 obj-y   += iomap.o
diff --git a/arch/mips/lib/csum_partial.S b/arch/mips/lib/csum_partial.S
index 9db357294be1..c0a77fe038be 100644
--- a/arch/mips/lib/csum_partial.S
+++ b/arch/mips/lib/csum_partial.S
@@ -8,7 +8,9 @@
  * Copyright (C) 1998, 1999 Ralf Baechle
  * Copyright (C) 1999 Silicon Graphics, Inc.
  */
+#include <linux/errno.h>
 #include <asm/asm.h>
+#include <asm/asm-offsets.h>
 #include <asm/regdef.h>
 
 #ifdef CONFIG_64BIT
@@ -271,3 +273,443 @@ small_csumcpy:
         jr      ra
         .set    noreorder
         END(csum_partial)
+
+
+/*
+ * checksum and copy routines based on memcpy.S
+ *
+ *      csum_partial_copy_nocheck(src, dst, len, sum)
+ *      __csum_partial_copy_user(src, dst, len, sum, errp)
+ *
+ * See "Spec" in memcpy.S for details.  Unlike __copy_user, all
+ * function in this file use the standard calling convention.
+ */
+
+#define src a0
+#define dst a1
+#define len a2
+#define psum a3
+#define sum v0
+#define odd t8
+#define errptr t9
+
+/*
+ * The exception handler for loads requires that:
+ *  1- AT contain the address of the byte just past the end of the source
+ *     of the copy,
+ *  2- src_entry <= src < AT, and
+ *  3- (dst - src) == (dst_entry - src_entry),
+ * The _entry suffix denotes values when __copy_user was called.
+ *
+ * (1) is set up up by __csum_partial_copy_from_user and maintained by
+ *      not writing AT in __csum_partial_copy
+ * (2) is met by incrementing src by the number of bytes copied
+ * (3) is met by not doing loads between a pair of increments of dst and src
+ *
+ * The exception handlers for stores stores -EFAULT to errptr and return.
+ * These handlers do not need to overwrite any data.
+ */
+
+#define EXC(inst_reg,addr,handler)              \
+9:      inst_reg, addr;                         \
+        .section __ex_table,"a";                \
+        PTR     9b, handler;                    \
+        .previous
+
+#ifdef USE_DOUBLE
+
+#define LOAD   ld
+#define LOADL  ldl
+#define LOADR  ldr
+#define STOREL sdl
+#define STORER sdr
+#define STORE  sd
+#define ADD    daddu
+#define SUB    dsubu
+#define SRL    dsrl
+#define SLL    dsll
+#define SLLV   dsllv
+#define SRLV   dsrlv
+#define NBYTES 8
+#define LOG_NBYTES 3
+
+#else
+
+#define LOAD   lw
+#define LOADL  lwl
+#define LOADR  lwr
+#define STOREL swl
+#define STORER swr
+#define STORE  sw
+#define ADD    addu
+#define SUB    subu
+#define SRL    srl
+#define SLL    sll
+#define SLLV   sllv
+#define SRLV   srlv
+#define NBYTES 4
+#define LOG_NBYTES 2
+
+#endif /* USE_DOUBLE */
+
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+#define LDFIRST LOADR
+#define LDREST  LOADL
+#define STFIRST STORER
+#define STREST  STOREL
+#define SHIFT_DISCARD SLLV
+#define SHIFT_DISCARD_REVERT SRLV
+#else
+#define LDFIRST LOADL
+#define LDREST  LOADR
+#define STFIRST STOREL
+#define STREST  STORER
+#define SHIFT_DISCARD SRLV
+#define SHIFT_DISCARD_REVERT SLLV
+#endif
+
+#define FIRST(unit) ((unit)*NBYTES)
+#define REST(unit)  (FIRST(unit)+NBYTES-1)
+
+#define ADDRMASK (NBYTES-1)
+
+        .set    noat
+
+LEAF(__csum_partial_copy_user)
+        PTR_ADDU        AT, src, len    /* See (1) above. */
+#ifdef CONFIG_64BIT
+        move    errptr, a4
+#else
+        lw      errptr, 16(sp)
+#endif
+FEXPORT(csum_partial_copy_nocheck)
+        move    sum, zero
+        move    odd, zero
+        /*
+         * Note: dst & src may be unaligned, len may be 0
+         * Temps
+         */
+        /*
+         * The "issue break"s below are very approximate.
+         * Issue delays for dcache fills will perturb the schedule, as will
+         * load queue full replay traps, etc.
+         *
+         * If len < NBYTES use byte operations.
+         */
+        sltu    t2, len, NBYTES
+        and     t1, dst, ADDRMASK
+        bnez    t2, copy_bytes_checklen
+         and    t0, src, ADDRMASK
+        andi    odd, dst, 0x1                   /* odd buffer? */
+        bnez    t1, dst_unaligned
+         nop
+        bnez    t0, src_unaligned_dst_aligned
+        /*
+         * use delay slot for fall-through
+         * src and dst are aligned; need to compute rem
+         */
+both_aligned:
+         SRL    t0, len, LOG_NBYTES+3    # +3 for 8 units/iter
+        beqz    t0, cleanup_both_aligned # len < 8*NBYTES
+         nop
+        SUB     len, 8*NBYTES           # subtract here for bgez loop
+        .align  4
+1:
+EXC(    LOAD    t0, UNIT(0)(src),       l_exc)
+EXC(    LOAD    t1, UNIT(1)(src),       l_exc_copy)
+EXC(    LOAD    t2, UNIT(2)(src),       l_exc_copy)
+EXC(    LOAD    t3, UNIT(3)(src),       l_exc_copy)
+EXC(    LOAD    t4, UNIT(4)(src),       l_exc_copy)
+EXC(    LOAD    t5, UNIT(5)(src),       l_exc_copy)
+EXC(    LOAD    t6, UNIT(6)(src),       l_exc_copy)
+EXC(    LOAD    t7, UNIT(7)(src),       l_exc_copy)
+        SUB     len, len, 8*NBYTES
+        ADD     src, src, 8*NBYTES
+EXC(    STORE   t0, UNIT(0)(dst),       s_exc)
+        ADDC(sum, t0)
+EXC(    STORE   t1, UNIT(1)(dst),       s_exc)
+        ADDC(sum, t1)
+EXC(    STORE   t2, UNIT(2)(dst),       s_exc)
+        ADDC(sum, t2)
+EXC(    STORE   t3, UNIT(3)(dst),       s_exc)
+        ADDC(sum, t3)
+EXC(    STORE   t4, UNIT(4)(dst),       s_exc)
+        ADDC(sum, t4)
+EXC(    STORE   t5, UNIT(5)(dst),       s_exc)
+        ADDC(sum, t5)
+EXC(    STORE   t6, UNIT(6)(dst),       s_exc)
+        ADDC(sum, t6)
+EXC(    STORE   t7, UNIT(7)(dst),       s_exc)
+        ADDC(sum, t7)
+        bgez    len, 1b
+         ADD    dst, dst, 8*NBYTES
+        ADD     len, 8*NBYTES           # revert len (see above)
+
+        /*
+         * len == the number of bytes left to copy < 8*NBYTES
+         */
+cleanup_both_aligned:
+#define rem t7
+        beqz    len, done
+         sltu   t0, len, 4*NBYTES
+        bnez    t0, less_than_4units
+         and    rem, len, (NBYTES-1)    # rem = len % NBYTES
+        /*
+         * len >= 4*NBYTES
+         */
+EXC(    LOAD    t0, UNIT(0)(src),       l_exc)
+EXC(    LOAD    t1, UNIT(1)(src),       l_exc_copy)
+EXC(    LOAD    t2, UNIT(2)(src),       l_exc_copy)
+EXC(    LOAD    t3, UNIT(3)(src),       l_exc_copy)
+        SUB     len, len, 4*NBYTES
+        ADD     src, src, 4*NBYTES
+EXC(    STORE   t0, UNIT(0)(dst),       s_exc)
+        ADDC(sum, t0)
+EXC(    STORE   t1, UNIT(1)(dst),       s_exc)
+        ADDC(sum, t1)
+EXC(    STORE   t2, UNIT(2)(dst),       s_exc)
+        ADDC(sum, t2)
+EXC(    STORE   t3, UNIT(3)(dst),       s_exc)
+        ADDC(sum, t3)
+        beqz    len, done
+         ADD    dst, dst, 4*NBYTES
+less_than_4units:
+        /*
+         * rem = len % NBYTES
+         */
+        beq     rem, len, copy_bytes
+         nop
+1:
+EXC(    LOAD    t0, 0(src),             l_exc)
+        ADD     src, src, NBYTES
+        SUB     len, len, NBYTES
+EXC(    STORE   t0, 0(dst),             s_exc)
+        ADDC(sum, t0)
+        bne     rem, len, 1b
+         ADD    dst, dst, NBYTES
+
+        /*
+         * src and dst are aligned, need to copy rem bytes (rem < NBYTES)
+         * A loop would do only a byte at a time with possible branch
+         * mispredicts.  Can't do an explicit LOAD dst,mask,or,STORE
+         * because can't assume read-access to dst.  Instead, use
+         * STREST dst, which doesn't require read access to dst.
+         *
+         * This code should perform better than a simple loop on modern,
+         * wide-issue mips processors because the code has fewer branches and
+         * more instruction-level parallelism.
+         */
+#define bits t2
+        beqz    len, done
+         ADD    t1, dst, len    # t1 is just past last byte of dst
+        li      bits, 8*NBYTES
+        SLL     rem, len, 3     # rem = number of bits to keep
+EXC(    LOAD    t0, 0(src),             l_exc)
+        SUB     bits, bits, rem # bits = number of bits to discard
+        SHIFT_DISCARD t0, t0, bits
+EXC(    STREST  t0, -1(t1),             s_exc)
+        SHIFT_DISCARD_REVERT t0, t0, bits
+        .set reorder
+        ADDC(sum, t0)
+        b       done
+        .set noreorder
+dst_unaligned:
+        /*
+         * dst is unaligned
+         * t0 = src & ADDRMASK
+         * t1 = dst & ADDRMASK; T1 > 0
+         * len >= NBYTES
+         *
+         * Copy enough bytes to align dst
+         * Set match = (src and dst have same alignment)
+         */
+#define match rem
+EXC(    LDFIRST t3, FIRST(0)(src),      l_exc)
+        ADD     t2, zero, NBYTES
+EXC(    LDREST  t3, REST(0)(src),       l_exc_copy)
+        SUB     t2, t2, t1      # t2 = number of bytes copied
+        xor     match, t0, t1
+EXC(    STFIRST t3, FIRST(0)(dst),      s_exc)
+        SLL     t4, t1, 3               # t4 = number of bits to discard
+        SHIFT_DISCARD t3, t3, t4
+        /* no SHIFT_DISCARD_REVERT to handle odd buffer properly */
+        ADDC(sum, t3)
+        beq     len, t2, done
+         SUB    len, len, t2
+        ADD     dst, dst, t2
+        beqz    match, both_aligned
+         ADD    src, src, t2
+
+src_unaligned_dst_aligned:
+        SRL     t0, len, LOG_NBYTES+2    # +2 for 4 units/iter
+        beqz    t0, cleanup_src_unaligned
+         and    rem, len, (4*NBYTES-1)   # rem = len % 4*NBYTES
+1:
+/*
+ * Avoid consecutive LD*'s to the same register since some mips
+ * implementations can't issue them in the same cycle.
+ * It's OK to load FIRST(N+1) before REST(N) because the two addresses
+ * are to the same unit (unless src is aligned, but it's not).
+ */
+EXC(    LDFIRST t0, FIRST(0)(src),      l_exc)
+EXC(    LDFIRST t1, FIRST(1)(src),      l_exc_copy)
+        SUB     len, len, 4*NBYTES
+EXC(    LDREST  t0, REST(0)(src),       l_exc_copy)
+EXC(    LDREST  t1, REST(1)(src),       l_exc_copy)
+EXC(    LDFIRST t2, FIRST(2)(src),      l_exc_copy)
+EXC(    LDFIRST t3, FIRST(3)(src),      l_exc_copy)
+EXC(    LDREST  t2, REST(2)(src),       l_exc_copy)
+EXC(    LDREST  t3, REST(3)(src),       l_exc_copy)
+        ADD     src, src, 4*NBYTES
+#ifdef CONFIG_CPU_SB1
+        nop                             # improves slotting
+#endif
+EXC(    STORE   t0, UNIT(0)(dst),       s_exc)
+        ADDC(sum, t0)
+EXC(    STORE   t1, UNIT(1)(dst),       s_exc)
+        ADDC(sum, t1)
+EXC(    STORE   t2, UNIT(2)(dst),       s_exc)
+        ADDC(sum, t2)
+EXC(    STORE   t3, UNIT(3)(dst),       s_exc)
+        ADDC(sum, t3)
+        bne     len, rem, 1b
+         ADD    dst, dst, 4*NBYTES
+
+cleanup_src_unaligned:
+        beqz    len, done
+         and    rem, len, NBYTES-1  # rem = len % NBYTES
+        beq     rem, len, copy_bytes
+         nop
+1:
+EXC(    LDFIRST t0, FIRST(0)(src),      l_exc)
+EXC(    LDREST  t0, REST(0)(src),       l_exc_copy)
+        ADD     src, src, NBYTES
+        SUB     len, len, NBYTES
+EXC(    STORE   t0, 0(dst),             s_exc)
+        ADDC(sum, t0)
+        bne     len, rem, 1b
+         ADD    dst, dst, NBYTES
+
+copy_bytes_checklen:
+        beqz    len, done
+         nop
+copy_bytes:
+        /* 0 < len < NBYTES  */
+#ifdef CONFIG_CPU_LITTLE_ENDIAN
+#define SHIFT_START 0
+#define SHIFT_INC 8
+#else
+#define SHIFT_START 8*(NBYTES-1)
+#define SHIFT_INC -8
+#endif
+        move    t2, zero        # partial word
+        li      t3, SHIFT_START # shift
+/* use l_exc_copy here to return correct sum on fault */
+#define COPY_BYTE(N)                    \
+EXC(    lbu     t0, N(src), l_exc_copy);        \
+        SUB     len, len, 1;            \
+EXC(    sb      t0, N(dst), s_exc);     \
+        SLLV    t0, t0, t3;             \
+        addu    t3, SHIFT_INC;          \
+        beqz    len, copy_bytes_done;   \
+         or     t2, t0
+
+        COPY_BYTE(0)
+        COPY_BYTE(1)
+#ifdef USE_DOUBLE
+        COPY_BYTE(2)
+        COPY_BYTE(3)
+        COPY_BYTE(4)
+        COPY_BYTE(5)
+#endif
+EXC(    lbu     t0, NBYTES-2(src), l_exc_copy)
+        SUB     len, len, 1
+EXC(    sb      t0, NBYTES-2(dst), s_exc)
+        SLLV    t0, t0, t3
+        or      t2, t0
+copy_bytes_done:
+        ADDC(sum, t2)
+done:
+        /* fold checksum */
+#ifdef USE_DOUBLE
+        dsll32  v1, sum, 0
+        daddu   sum, v1
+        sltu    v1, sum, v1
+        dsra32  sum, sum, 0
+        addu    sum, v1
+#endif
+        sll     v1, sum, 16
+        addu    sum, v1
+        sltu    v1, sum, v1
+        srl     sum, sum, 16
+        addu    sum, v1
+
+        /* odd buffer alignment? */
+        beqz    odd, 1f
+         nop
+        sll     v1, sum, 8
+        srl     sum, sum, 8
+        or      sum, v1
+        andi    sum, 0xffff
+1:
+        .set reorder
+        ADDC(sum, psum)
+        jr      ra
+        .set noreorder
+
+l_exc_copy:
+        /*
+         * Copy bytes from src until faulting load address (or until a
+         * lb faults)
+         *
+         * When reached by a faulting LDFIRST/LDREST, THREAD_BUADDR($28)
+         * may be more than a byte beyond the last address.
+         * Hence, the lb below may get an exception.
+         *
+         * Assumes src < THREAD_BUADDR($28)
+         */
+        LOAD    t0, TI_TASK($28)
+         li     t2, SHIFT_START
+        LOAD    t0, THREAD_BUADDR(t0)
+1:
+EXC(    lbu     t1, 0(src),     l_exc)
+        ADD     src, src, 1
+        sb      t1, 0(dst)      # can't fault -- we're copy_from_user
+        SLLV    t1, t1, t2
+        addu    t2, SHIFT_INC
+        ADDC(sum, t1)
+        bne     src, t0, 1b
+         ADD    dst, dst, 1
+l_exc:
+        LOAD    t0, TI_TASK($28)
+         nop
+        LOAD    t0, THREAD_BUADDR(t0)   # t0 is just past last good address
+         nop
+        SUB     len, AT, t0             # len number of uncopied bytes
+        /*
+         * Here's where we rely on src and dst being incremented in tandem,
+         *   See (3) above.
+         * dst += (fault addr - src) to put dst at first byte to clear
+         */
+        ADD     dst, t0                 # compute start address in a1
+        SUB     dst, src
+        /*
+         * Clear len bytes starting at dst.  Can't call __bzero because it
+         * might modify len.  An inefficient loop for these rare times...
+         */
+        beqz    len, done
+         SUB    src, len, 1
+1:      sb      zero, 0(dst)
+        ADD     dst, dst, 1
+        bnez    src, 1b
+         SUB    src, src, 1
+        li      v1, -EFAULT
+        b       done
+         sw     v1, (errptr)
+
+s_exc:
+        li      v0, -1 /* invalid checksum */
+        li      v1, -EFAULT
+        jr      ra
+         sw     v1, (errptr)
+        END(__csum_partial_copy_user)
diff --git a/arch/mips/lib/csum_partial_copy.c b/arch/mips/lib/csum_partial_copy.c
deleted file mode 100644
index 06771040a267..000000000000
--- a/arch/mips/lib/csum_partial_copy.c
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- *
- * Copyright (C) 1994, 1995 Waldorf Electronics GmbH
- * Copyright (C) 1998, 1999 Ralf Baechle
- */
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <asm/byteorder.h>
-#include <asm/string.h>
-#include <asm/uaccess.h>
-#include <net/checksum.h>
-
-/*
- * copy while checksumming, otherwise like csum_partial
- */
-__wsum csum_partial_copy_nocheck(const void *src,
-        void *dst, int len, __wsum sum)
-{
-        /*
-         * It's 2:30 am and I don't feel like doing it real ...
-         * This is lots slower than the real thing (tm)
-         */
-        sum = csum_partial(src, len, sum);
-        memcpy(dst, src, len);
-
-        return sum;
-}
-
-EXPORT_SYMBOL(csum_partial_copy_nocheck);
-
-/*
- * Copy from userspace and compute checksum.  If we catch an exception
- * then zero the rest of the buffer.
- */
-__wsum csum_partial_copy_from_user (const void __user *src,
-        void *dst, int len, __wsum sum, int *err_ptr)
-{
-        int missing;
-
-        might_sleep();
-        missing = copy_from_user(dst, src, len);
-        if (missing) {
-                memset(dst + len - missing, 0, missing);
-                *err_ptr = -EFAULT;
-        }
-
-        return csum_partial(dst, len, sum);
-}
diff --git a/arch/mips/mips-boards/generic/time.c b/arch/mips/mips-boards/generic/time.c
index e4604c73f02e..a3c3a1d462b2 100644
--- a/arch/mips/mips-boards/generic/time.c
+++ b/arch/mips/mips-boards/generic/time.c
@@ -47,6 +47,9 @@
 #ifdef CONFIG_MIPS_MALTA
 #include <asm/mips-boards/maltaint.h>
 #endif
+#ifdef CONFIG_MIPS_SEAD
+#include <asm/mips-boards/seadint.h>
+#endif
 
 unsigned long cpu_khz;
 
@@ -263,11 +266,13 @@ void __init mips_time_init(void)
 
 void __init plat_timer_setup(struct irqaction *irq)
 {
+#ifdef MSC01E_INT_BASE
         if (cpu_has_veic) {
                 set_vi_handler (MSC01E_INT_CPUCTR, mips_timer_dispatch);
                 mips_cpu_timer_irq = MSC01E_INT_BASE + MSC01E_INT_CPUCTR;
-        }
-        else {
+        } else
+#endif
+        {
                 if (cpu_has_vint)
                         set_vi_handler (MIPSCPU_INT_CPUCTR, mips_timer_dispatch);
                 mips_cpu_timer_irq = MIPSCPU_INT_BASE + MIPSCPU_INT_CPUCTR;
diff --git a/arch/mips/mips-boards/malta/malta_mtd.c b/arch/mips/mips-boards/malta/malta_mtd.c
new file mode 100644
index 000000000000..8ad9bdf25dce
--- /dev/null
+++ b/arch/mips/mips-boards/malta/malta_mtd.c
@@ -0,0 +1,63 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2006 MIPS Technologies, Inc.
+ *     written by Ralf Baechle <ralf@linux-mips.org>
+ */
+
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/physmap.h>
+#include <mtd/mtd-abi.h>
+
+static struct mtd_partition malta_mtd_partitions[] = {
+        {
+                .name =         "YAMON",
+                .offset =       0x0,
+                .size =         0x100000,
+                .mask_flags =   MTD_WRITEABLE
+        }, {
+                .name =         "User FS",
+                .offset =       0x100000,
+                .size =         0x2e0000
+        }, {
+                .name =         "Board Config",
+                .offset =       0x3e0000,
+                .size =         0x020000,
+                .mask_flags =   MTD_WRITEABLE
+        }
+};
+
+static struct physmap_flash_data malta_flash_data = {
+        .width          = 4,
+        .nr_parts       = ARRAY_SIZE(malta_mtd_partitions),
+        .parts          = malta_mtd_partitions
+};
+
+static struct resource malta_flash_resource = {
+        .start          = 0x1e000000,
+        .end            = 0x1e3fffff,
+        .flags          = IORESOURCE_MEM
+};
+
+static struct platform_device malta_flash = {
+        .name           = "physmap-flash",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &malta_flash_data,
+        },
+        .num_resources  = 1,
+        .resource       = &malta_flash_resource,
+};
+
+static int __init malta_mtd_init(void)
+{
+        platform_device_register(&malta_flash);
+
+        return 0;
+}
+
+module_init(malta_mtd_init)
diff --git a/arch/mips/mips-boards/sead/sead_int.c b/arch/mips/mips-boards/sead/sead_int.c
index f445fcddfdfd..874ccb0066b8 100644
--- a/arch/mips/mips-boards/sead/sead_int.c
+++ b/arch/mips/mips-boards/sead/sead_int.c
@@ -21,7 +21,7 @@
  * Sead board.
  */
 #include <linux/init.h>
-#include <linux/irq.h>
+#include <linux/interrupt.h>
 
 #include <asm/irq_cpu.h>
 #include <asm/mipsregs.h>
@@ -108,7 +108,7 @@ asmlinkage void plat_irq_dispatch(void)
         if (irq >= 0)
                 do_IRQ(MIPSCPU_INT_BASE + irq);
         else
-                spurious_interrupt(regs);
+                spurious_interrupt();
 }
 
 void __init arch_init_irq(void)
diff --git a/arch/mips/mm/pg-r4k.c b/arch/mips/mm/pg-r4k.c
index d41fc5885e87..dc795be62807 100644
--- a/arch/mips/mm/pg-r4k.c
+++ b/arch/mips/mm/pg-r4k.c
@@ -243,11 +243,10 @@ static void __init __build_store_reg(int reg)
 
 static inline void build_store_reg(int reg)
 {
-        if (cpu_has_prefetch)
-                if (reg)
-                        build_dst_pref(pref_offset_copy);
-                else
-                        build_dst_pref(pref_offset_clear);
+        int pref_off = cpu_has_prefetch ?
+                (reg ? pref_offset_copy : pref_offset_clear) : 0;
+        if (pref_off)
+                build_dst_pref(pref_off);
         else if (cpu_has_cache_cdex_s)
                 build_cdex_s();
         else if (cpu_has_cache_cdex_p)
diff --git a/arch/mips/pci/ops-pnx8550.c b/arch/mips/pci/ops-pnx8550.c
index 454b65cc3354..f556b7a8dccd 100644
--- a/arch/mips/pci/ops-pnx8550.c
+++ b/arch/mips/pci/ops-pnx8550.c
@@ -202,7 +202,7 @@ write_config_byte(struct pci_bus *bus, unsigned int devfn, int where, u8 val)
                 break;
         }
 
-        err = config_access(PCI_CMD_CONFIG_READ, bus, devfn, where, ~(1 << (where & 3)), &data);
+        err = config_access(PCI_CMD_CONFIG_WRITE, bus, devfn, where, ~(1 << (where & 3)), &data);
 
         return err;
 }
diff --git a/arch/mips/philips/pnx8550/common/time.c b/arch/mips/philips/pnx8550/common/time.c
index 65c440e8480b..68def3880a1c 100644
--- a/arch/mips/philips/pnx8550/common/time.c
+++ b/arch/mips/philips/pnx8550/common/time.c
@@ -33,7 +33,17 @@
 #include <int.h>
 #include <cm.h>
 
-extern unsigned int mips_hpt_frequency;
+static unsigned long cpj;
+
+static cycle_t hpt_read(void)
+{
+        return read_c0_count2();
+}
+
+static void timer_ack(void)
+{
+        write_c0_compare(cpj);
+}
 
 /*
  * pnx8550_time_init() - it does the following things:
@@ -68,27 +78,48 @@ void pnx8550_time_init(void)
          * HZ timer interrupts per second.
          */
         mips_hpt_frequency = 27UL * ((1000000UL * n)/(m * pow2p));
+        cpj = (mips_hpt_frequency + HZ / 2) / HZ;
+        write_c0_count(0);
+        timer_ack();
+
+        /* Setup Timer 2 */
+        write_c0_count2(0);
+        write_c0_compare2(0xffffffff);
+
+        clocksource_mips.read = hpt_read;
+        mips_timer_ack = timer_ack;
+}
+
+static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
+{
+        /* Timer 2 clear interrupt */
+        write_c0_compare2(-1);
+        return IRQ_HANDLED;
 }
 
+static struct irqaction monotonic_irqaction = {
+        .handler = monotonic_interrupt,
+        .flags = IRQF_DISABLED,
+        .name = "Monotonic timer",
+};
+
 void __init plat_timer_setup(struct irqaction *irq)
 {
         int configPR;
 
         setup_irq(PNX8550_INT_TIMER1, irq);
+        setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
 
-        /* Start timer1 */
+        /* Timer 1 start */
         configPR = read_c0_config7();
         configPR &= ~0x00000008;
         write_c0_config7(configPR);
 
-        /* Timer 2 stop */
+        /* Timer 2 start */
         configPR = read_c0_config7();
-        configPR |= 0x00000010;
+        configPR &= ~0x00000010;
         write_c0_config7(configPR);
 
-        write_c0_count2(0);
-        write_c0_compare2(0xffffffff);
-
         /* Timer 3 stop */
         configPR = read_c0_config7();
         configPR |= 0x00000020;
diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 4a23a97b06cd..12cc019307ad 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -608,7 +608,7 @@ void smp_cpus_done(unsigned int cpu_max)
 }
 
 
-int __devinit __cpu_up(unsigned int cpu)
+int __cpuinit __cpu_up(unsigned int cpu)
 {
         if (cpu != 0 && cpu < parisc_max_cpus)
                 smp_boot_one_cpu(cpu);
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 8699dadcd096..0855d55c194d 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -436,7 +436,7 @@ config PPC_EFIKA
         select RTAS_PROC
         select PPC_MPC52xx
         select PPC_NATIVE
-        default y
+        default n
 
 config PPC_LITE5200
         bool "Freescale Lite5200 Eval Board"
@@ -471,7 +471,7 @@ config PPC_PREP
         select PPC_INDIRECT_PCI
         select PPC_UDBG_16550
         select PPC_NATIVE
-        default y
+        default n
 
 config PPC_MAPLE
         depends on PPC_MULTIPLATFORM && PPC64
diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts
index 8bc0d259796d..a8efb59f5dd7 100644
--- a/arch/powerpc/boot/dts/lite5200.dts
+++ b/arch/powerpc/boot/dts/lite5200.dts
@@ -238,7 +238,7 @@
 
                 // PSC3 in CODEC mode example
                 i2s@2400 {              // PSC3
-                        device_type = "i2s";
+                        device_type = "sound";
                         compatible = "mpc5200-psc-i2s\0mpc52xx-psc-i2s";
                         reg = <2400 100>;
                         interrupts = <2 3 0>;
@@ -265,7 +265,7 @@
 
                 // PSC6 in AC97 mode example
                 ac97@2c00 {             // PSC6
-                        device_type = "ac97";
+                        device_type = "sound";
                         compatible = "mpc5200-psc-ac97\0mpc52xx-psc-ac97";
                         reg = <2c00 100>;
                         interrupts = <2 4 0>;
diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts
index 81cb76418a78..1aabee432d86 100644
--- a/arch/powerpc/boot/dts/lite5200b.dts
+++ b/arch/powerpc/boot/dts/lite5200b.dts
@@ -243,7 +243,7 @@
 
                 // PSC3 in CODEC mode example
                 i2s@2400 {              // PSC3
-                        device_type = "i2s";
+                        device_type = "sound";
                         compatible = "mpc5200b-psc-i2s\0mpc52xx-psc-i2s";
                         reg = <2400 100>;
                         interrupts = <2 3 0>;
@@ -270,7 +270,7 @@
 
                 // PSC6 in AC97 mode example
                 ac97@2c00 {             // PSC6
-                        device_type = "ac97";
+                        device_type = "sound";
                         compatible = "mpc5200b-psc-ac97\0mpc52xx-psc-ac97";
                         reg = <2c00 100>;
                         interrupts = <2 4 0>;
diff --git a/arch/powerpc/configs/ppc64_defconfig b/arch/powerpc/configs/ppc64_defconfig
index 1c009651f925..340376a47001 100644
--- a/arch/powerpc/configs/ppc64_defconfig
+++ b/arch/powerpc/configs/ppc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc6
-# Sun Sep 10 10:45:11 2006
+# Linux kernel version: 2.6.20-rc3
+# Tue Jan  2 15:32:44 2007
 #
 CONFIG_PPC64=y
 CONFIG_64BIT=y
@@ -10,6 +10,8 @@ CONFIG_MMU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_IRQ_PER_CPU=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_ARCH_HAS_ILOG2_U32=y
+CONFIG_ARCH_HAS_ILOG2_U64=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
@@ -22,6 +24,8 @@ CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_PPC_UDBG_16550=y
 CONFIG_GENERIC_TBSYNC=y
+CONFIG_AUDIT_ARCH=y
+CONFIG_GENERIC_BUG=y
 # CONFIG_DEFAULT_UIMAGE is not set
 
 #
@@ -31,6 +35,10 @@ CONFIG_GENERIC_TBSYNC=y
 CONFIG_POWER3=y
 CONFIG_POWER4=y
 CONFIG_PPC_FPU=y
+# CONFIG_PPC_DCR_NATIVE is not set
+CONFIG_PPC_DCR_MMIO=y
+CONFIG_PPC_DCR=y
+CONFIG_PPC_OF_PLATFORM_PCI=y
 CONFIG_ALTIVEC=y
 CONFIG_PPC_STD_MMU=y
 CONFIG_VIRT_CPU_ACCOUNTING=y
@@ -52,19 +60,24 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
-CONFIG_SYSCTL=y
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_CPUSETS=y
+CONFIG_SYSFS_DEPRECATED=y
 CONFIG_RELAY=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+# CONFIG_TASK_XACCT is not set
+CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
+CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -73,12 +86,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
-CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -97,6 +110,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 CONFIG_BLK_DEV_IO_TRACE=y
 
 #
@@ -116,16 +130,20 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 # Platform support
 #
 CONFIG_PPC_MULTIPLATFORM=y
-# CONFIG_PPC_ISERIES is not set
 # CONFIG_EMBEDDED6xx is not set
 # CONFIG_APUS is not set
 CONFIG_PPC_PSERIES=y
+CONFIG_PPC_ISERIES=y
+# CONFIG_PPC_MPC52xx is not set
 CONFIG_PPC_PMAC=y
 CONFIG_PPC_PMAC64=y
 CONFIG_PPC_MAPLE=y
+# CONFIG_PPC_PASEMI is not set
 CONFIG_PPC_CELL=y
 CONFIG_PPC_CELL_NATIVE=y
 CONFIG_PPC_IBM_CELL_BLADE=y
+# CONFIG_PPC_PS3 is not set
+CONFIG_PPC_NATIVE=y
 CONFIG_UDBG_RTAS_CONSOLE=y
 CONFIG_XICS=y
 CONFIG_U3_DART=y
@@ -139,6 +157,8 @@ CONFIG_IBMVIO=y
 # CONFIG_IBMEBUS is not set
 # CONFIG_PPC_MPC106 is not set
 CONFIG_PPC_970_NAP=y
+CONFIG_PPC_INDIRECT_IO=y
+CONFIG_GENERIC_IOMAP=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_TABLE=y
 # CONFIG_CPU_FREQ_DEBUG is not set
@@ -160,14 +180,16 @@ CONFIG_MPIC=y
 #
 CONFIG_SPU_FS=m
 CONFIG_SPU_BASE=y
-CONFIG_SPUFS_MMAP=y
 CONFIG_CBE_RAS=y
+CONFIG_CBE_THERM=m
+CONFIG_CBE_CPUFREQ=m
 
 #
 # Kernel options
 #
 # CONFIG_HZ_100 is not set
 CONFIG_HZ_250=y
+# CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
 CONFIG_PREEMPT_NONE=y
@@ -192,6 +214,7 @@ CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
+CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
 # CONFIG_FLATMEM_MANUAL is not set
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -201,6 +224,7 @@ CONFIG_HAVE_MEMORY_PRESENT=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_EXTREME=y
 CONFIG_MEMORY_HOTPLUG=y
+CONFIG_MEMORY_HOTPLUG_SPARSE=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_RESOURCES_64BIT=y
 CONFIG_ARCH_MEMORY_PROBE=y
@@ -222,6 +246,7 @@ CONFIG_PPC_I8259=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 # CONFIG_PCIEPORTBUS is not set
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -254,6 +279,7 @@ CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 CONFIG_XFRM_USER=m
+# CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_NET_KEY=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -272,10 +298,13 @@ CONFIG_INET_XFRM_TUNNEL=m
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_TCP_MD5SIG is not set
 
 #
 # IP: Virtual Server Configuration
@@ -294,25 +323,31 @@ CONFIG_NETFILTER=y
 CONFIG_NETFILTER_NETLINK=y
 CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_NETLINK_LOG=m
+CONFIG_NF_CONNTRACK_ENABLED=m
+CONFIG_NF_CONNTRACK_SUPPORT=y
+# CONFIG_IP_NF_CONNTRACK_SUPPORT is not set
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CT_ACCT=y
+CONFIG_NF_CONNTRACK_MARK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CT_PROTO_GRE=m
+CONFIG_NF_CT_PROTO_SCTP=m
+CONFIG_NF_CONNTRACK_AMANDA=m
+CONFIG_NF_CONNTRACK_FTP=m
+CONFIG_NF_CONNTRACK_H323=m
+CONFIG_NF_CONNTRACK_IRC=m
+CONFIG_NF_CONNTRACK_NETBIOS_NS=m
+CONFIG_NF_CONNTRACK_PPTP=m
+CONFIG_NF_CONNTRACK_SIP=m
+CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_CT_NETLINK=m
 # CONFIG_NETFILTER_XTABLES is not set
 
 #
 # IP: Netfilter Configuration
 #
-CONFIG_IP_NF_CONNTRACK=m
-CONFIG_IP_NF_CT_ACCT=y
-CONFIG_IP_NF_CONNTRACK_MARK=y
-CONFIG_IP_NF_CONNTRACK_EVENTS=y
-CONFIG_IP_NF_CONNTRACK_NETLINK=m
-CONFIG_IP_NF_CT_PROTO_SCTP=m
-CONFIG_IP_NF_FTP=m
-CONFIG_IP_NF_IRC=m
-# CONFIG_IP_NF_NETBIOS_NS is not set
-CONFIG_IP_NF_TFTP=m
-CONFIG_IP_NF_AMANDA=m
-# CONFIG_IP_NF_PPTP is not set
-# CONFIG_IP_NF_H323 is not set
-CONFIG_IP_NF_SIP=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_CONNTRACK_PROC_COMPAT=y
 CONFIG_IP_NF_QUEUE=m
 
 #
@@ -339,7 +374,6 @@ CONFIG_LLC=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -412,6 +446,12 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
@@ -438,7 +478,6 @@ CONFIG_IDEPCI_SHARE_IRQ=y
 # CONFIG_BLK_DEV_OFFBOARD is not set
 CONFIG_BLK_DEV_GENERIC=y
 # CONFIG_BLK_DEV_OPTI621 is not set
-CONFIG_BLK_DEV_SL82C105=y
 CONFIG_BLK_DEV_IDEDMA_PCI=y
 # CONFIG_BLK_DEV_IDEDMA_FORCED is not set
 CONFIG_IDEDMA_PCI_AUTO=y
@@ -453,6 +492,7 @@ CONFIG_BLK_DEV_AMD74XX=y
 # CONFIG_BLK_DEV_CS5530 is not set
 # CONFIG_BLK_DEV_HPT34X is not set
 # CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
 # CONFIG_BLK_DEV_IT821X is not set
@@ -461,6 +501,7 @@ CONFIG_BLK_DEV_AMD74XX=y
 # CONFIG_BLK_DEV_PDC202XX_NEW is not set
 # CONFIG_BLK_DEV_SVWKS is not set
 # CONFIG_BLK_DEV_SIIMAGE is not set
+CONFIG_BLK_DEV_SL82C105=y
 # CONFIG_BLK_DEV_SLC90E66 is not set
 # CONFIG_BLK_DEV_TRM290 is not set
 # CONFIG_BLK_DEV_VIA82CXXX is not set
@@ -478,6 +519,8 @@ CONFIG_IDEDMA_AUTO=y
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+# CONFIG_SCSI_TGT is not set
+CONFIG_SCSI_NETLINK=y
 CONFIG_SCSI_PROC_FS=y
 
 #
@@ -497,14 +540,16 @@ CONFIG_CHR_DEV_SG=y
 CONFIG_SCSI_MULTI_LUN=y
 CONFIG_SCSI_CONSTANTS=y
 # CONFIG_SCSI_LOGGING is not set
+# CONFIG_SCSI_SCAN_ASYNC is not set
 
 #
-# SCSI Transport Attributes
+# SCSI Transports
 #
 CONFIG_SCSI_SPI_ATTRS=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
 
 #
 # SCSI low-level drivers
@@ -517,26 +562,12 @@ CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_ARCMSR is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
-CONFIG_ATA=y
-# CONFIG_SATA_AHCI is not set
-CONFIG_SATA_SVW=y
-# CONFIG_SCSI_ATA_PIIX is not set
-# CONFIG_SATA_MV is not set
-# CONFIG_SATA_NV is not set
-# CONFIG_SCSI_PDC_ADMA is not set
 # CONFIG_SCSI_HPTIOP is not set
-# CONFIG_SATA_QSTOR is not set
-# CONFIG_SATA_PROMISE is not set
-# CONFIG_SATA_SX4 is not set
-# CONFIG_SATA_SIL is not set
-# CONFIG_SATA_SIL24 is not set
-# CONFIG_SATA_SIS is not set
-# CONFIG_SATA_ULI is not set
-# CONFIG_SATA_VIA is not set
-# CONFIG_SATA_VITESSE is not set
 # CONFIG_SCSI_BUSLOGIC is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_EATA is not set
@@ -546,6 +577,7 @@ CONFIG_SATA_SVW=y
 CONFIG_SCSI_IBMVSCSI=y
 # CONFIG_SCSI_INITIO is not set
 # CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_STEX is not set
 CONFIG_SCSI_SYM53C8XX_2=y
 CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=0
 CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
@@ -556,10 +588,66 @@ CONFIG_SCSI_IPR_TRACE=y
 CONFIG_SCSI_IPR_DUMP=y
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
 CONFIG_SCSI_DEBUG=m
+# CONFIG_SCSI_SRP is not set
+
+#
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+CONFIG_ATA=y
+# CONFIG_SATA_AHCI is not set
+CONFIG_SATA_SVW=y
+# CONFIG_ATA_PIIX is not set
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_MARVELL is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_PDC2027X is not set
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -575,6 +663,7 @@ CONFIG_MD_RAID5_RESHAPE=y
 CONFIG_MD_MULTIPATH=m
 CONFIG_MD_FAULTY=m
 CONFIG_BLK_DEV_DM=y
+# CONFIG_DM_DEBUG is not set
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
@@ -630,11 +719,13 @@ CONFIG_IEEE1394_RAWIO=y
 CONFIG_ADB_PMU=y
 # CONFIG_ADB_PMU_LED is not set
 CONFIG_PMAC_SMU=y
+# CONFIG_MAC_EMUMOUSEBTN is not set
 CONFIG_THERM_PM72=y
 CONFIG_WINDFARM=y
 CONFIG_WINDFARM_PM81=y
 CONFIG_WINDFARM_PM91=y
 CONFIG_WINDFARM_PM112=y
+# CONFIG_PMAC_RACKMETER is not set
 
 #
 # Network device support
@@ -675,6 +766,7 @@ CONFIG_VORTEX=y
 CONFIG_IBMVETH=m
 CONFIG_NET_PCI=y
 CONFIG_PCNET32=y
+# CONFIG_PCNET32_NAPI is not set
 # CONFIG_AMD8111_ETH is not set
 # CONFIG_ADAPTEC_STARFIRE is not set
 # CONFIG_B44 is not set
@@ -713,7 +805,7 @@ CONFIG_E1000=y
 CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
 CONFIG_SPIDER_NET=m
-# CONFIG_MV643XX_ETH is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
@@ -723,6 +815,7 @@ CONFIG_IXGB=m
 # CONFIG_IXGB_NAPI is not set
 # CONFIG_S2IO is not set
 # CONFIG_MYRI10GE is not set
+# CONFIG_NETXEN_NIC is not set
 
 #
 # Token Ring devices
@@ -741,6 +834,7 @@ CONFIG_IBMOL=y
 # Wan interfaces
 #
 # CONFIG_WAN is not set
+CONFIG_ISERIES_VETH=m
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
 CONFIG_PPP=m
@@ -753,6 +847,7 @@ CONFIG_PPP_BSDCOMP=m
 # CONFIG_PPP_MPPE is not set
 CONFIG_PPPOE=m
 # CONFIG_SLIP is not set
+CONFIG_SLHC=m
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 CONFIG_NETCONSOLE=y
@@ -775,6 +870,7 @@ CONFIG_NET_POLL_CONTROLLER=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -797,6 +893,7 @@ CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_SERIAL is not set
@@ -850,6 +947,7 @@ CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_HVC_DRIVER=y
 CONFIG_HVC_CONSOLE=y
+CONFIG_HVC_ISERIES=y
 CONFIG_HVC_RTAS=y
 CONFIG_HVCS=m
 
@@ -868,10 +966,6 @@ CONFIG_GEN_RTC=y
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
-
-#
-# Ftape, the floppy tape device driver
-#
 # CONFIG_AGP is not set
 # CONFIG_DRM is not set
 CONFIG_RAW_DRIVER=y
@@ -882,7 +976,6 @@ CONFIG_MAX_RAW_DEVS=256
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -947,6 +1040,7 @@ CONFIG_I2C_POWERMAC=y
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -955,14 +1049,9 @@ CONFIG_I2C_POWERMAC=y
 # CONFIG_HWMON_VID is not set
 
 #
-# Misc devices
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -975,6 +1064,7 @@ CONFIG_VIDEO_V4L2=y
 #
 CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
+CONFIG_FB_DDC=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
@@ -1011,6 +1101,7 @@ CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_3DFX is not set
 # CONFIG_FB_VOODOO1 is not set
 # CONFIG_FB_TRIDENT is not set
+CONFIG_FB_IBM_GXT4500=y
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -1159,6 +1250,11 @@ CONFIG_SND_AOA_SOUNDBUS_I2S=m
 # CONFIG_SOUND_PRIME is not set
 
 #
+# HID Devices
+#
+CONFIG_HID=y
+
+#
 # USB support
 #
 CONFIG_USB_ARCH_HAS_HCD=y
@@ -1173,6 +1269,7 @@ CONFIG_USB=y
 CONFIG_USB_DEVICEFS=y
 # CONFIG_USB_BANDWIDTH is not set
 # CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_MULTITHREAD_PROBE is not set
 # CONFIG_USB_OTG is not set
 
 #
@@ -1214,13 +1311,13 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
 # CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
 # CONFIG_USB_LIBUSUAL is not set
 
 #
 # USB Input Devices
 #
 CONFIG_USB_HID=y
-CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_HIDINPUT_POWERBOOK is not set
 # CONFIG_HID_FF is not set
 CONFIG_USB_HIDDEV=y
@@ -1250,6 +1347,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_KAWETH is not set
 # CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_USBNET_MII is not set
 # CONFIG_USB_USBNET is not set
 # CONFIG_USB_MON is not set
 
@@ -1267,6 +1365,7 @@ CONFIG_USB_HIDDEV=y
 #
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
 # CONFIG_USB_AUERSWALD is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
@@ -1274,12 +1373,13 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
-# CONFIG_USB_PHIDGETKIT is not set
-# CONFIG_USB_PHIDGETSERVO is not set
+# CONFIG_USB_PHIDGET is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
 CONFIG_USB_APPLEDISPLAY=m
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1318,6 +1418,7 @@ CONFIG_INFINIBAND=m
 CONFIG_INFINIBAND_ADDR_TRANS=y
 CONFIG_INFINIBAND_MTHCA=m
 CONFIG_INFINIBAND_MTHCA_DEBUG=y
+# CONFIG_INFINIBAND_AMSO1100 is not set
 CONFIG_INFINIBAND_IPOIB=m
 CONFIG_INFINIBAND_IPOIB_DEBUG=y
 # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set
@@ -1347,6 +1448,10 @@ CONFIG_INFINIBAND_ISER=m
 #
 
 #
+# Virtualization
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -1359,6 +1464,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 CONFIG_EXT3_FS_SECURITY=y
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1379,6 +1485,7 @@ CONFIG_XFS_FS=m
 CONFIG_XFS_SECURITY=y
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -1414,8 +1521,10 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
@@ -1540,8 +1649,23 @@ CONFIG_NLS_KOI8_U=m
 CONFIG_NLS_UTF8=m
 
 #
+# Distributed Lock Manager
+#
+# CONFIG_DLM is not set
+
+#
+# iSeries device drivers
+#
+# CONFIG_VIOCONS is not set
+CONFIG_VIODASD=y
+CONFIG_VIOCD=m
+CONFIG_VIOTAPE=m
+CONFIG_VIOPATH=y
+
+#
 # Library routines
 #
+CONFIG_BITREVERSE=y
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
 CONFIG_CRC32=y
@@ -1551,6 +1675,7 @@ CONFIG_ZLIB_DEFLATE=m
 CONFIG_TEXTSEARCH=y
 CONFIG_TEXTSEARCH_KMP=m
 CONFIG_PLIST=y
+CONFIG_IOMAP_COPY=y
 
 #
 # Instrumentation Support
@@ -1563,8 +1688,11 @@ CONFIG_OPROFILE=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
 CONFIG_DETECT_SOFTLOCKUP=y
@@ -1578,16 +1706,19 @@ CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
+CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
-CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
+# CONFIG_HCALL_STATS is not set
 CONFIG_DEBUGGER=y
 CONFIG_XMON=y
 # CONFIG_XMON_DEFAULT is not set
+CONFIG_XMON_DISASSEMBLY=y
 CONFIG_IRQSTACKS=y
 CONFIG_BOOTX_TEXT=y
 # CONFIG_PPC_EARLY_DEBUG is not set
@@ -1602,7 +1733,12 @@ CONFIG_BOOTX_TEXT=y
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_XCBC is not set
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
@@ -1611,9 +1747,14 @@ CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_TGR192=m
+# CONFIG_CRYPTO_GF128MUL is not set
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=y
+# CONFIG_CRYPTO_LRW is not set
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_BLOWFISH=m
 CONFIG_CRYPTO_TWOFISH=m
+CONFIG_CRYPTO_TWOFISH_COMMON=m
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_AES=m
 CONFIG_CRYPTO_CAST5=m
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index e96521530d21..030d300cd71c 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -303,5 +303,8 @@ int main(void)
         DEFINE(NSEC_PER_SEC, NSEC_PER_SEC);
         DEFINE(CLOCK_REALTIME_RES, TICK_NSEC);
 
+#ifdef CONFIG_BUG
+        DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry));
+#endif
         return 0;
 }
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 1a3d4de197d2..2551c0884afc 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -28,6 +28,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/cputable.h>
 #include <asm/firmware.h>
+#include <asm/bug.h>
 
 /*
  * System calls.
@@ -634,19 +635,15 @@ _GLOBAL(enter_rtas)
         li      r0,0
         mtcr    r0
 
+#ifdef CONFIG_BUG       
         /* There is no way it is acceptable to get here with interrupts enabled,
          * check it with the asm equivalent of WARN_ON
          */
         lbz     r0,PACASOFTIRQEN(r13)
 1:      tdnei   r0,0
-.section __bug_table,"a"
-        .llong  1b,__LINE__ + 0x1000000, 1f, 2f
-.previous
-.section .rodata,"a"
-1:      .asciz  __FILE__
-2:      .asciz "enter_rtas"
-.previous
-
+        EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING
+#endif
+        
         /* Hard-disable interrupts */
         mfmsr   r6
         rldicl  r7,r6,48,1
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 9b28c238b6c0..0e8beca460af 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -468,7 +468,7 @@ static int __devinit cpu_enable(unsigned int cpu)
         return -ENOSYS;
 }
 
-int __devinit __cpu_up(unsigned int cpu)
+int __cpuinit __cpu_up(unsigned int cpu)
 {
         int c;
 
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 89c836d54809..1bb20d841080 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -744,7 +744,8 @@ static int htlb_check_hinted_area(unsigned long addr, unsigned long len)
         struct vm_area_struct *vma;
 
         vma = find_vma(current->mm, addr);
-        if (!vma || ((addr + len) <= vma->vm_start))
+        if (TASK_SIZE - len >= addr &&
+            (!vma || ((addr + len) <= vma->vm_start)))
                 return 0;
 
         return -ENOMEM;
@@ -815,6 +816,8 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                 return -EINVAL;
         if (len & ~HPAGE_MASK)
                 return -EINVAL;
+        if (len > TASK_SIZE)
+                return -ENOMEM;
 
         if (!cpu_has_feature(CPU_FTR_16M_PAGE))
                 return -EINVAL;
@@ -823,9 +826,6 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
         BUG_ON((addr + len)  < addr);
 
         if (test_thread_flag(TIF_32BIT)) {
-                /* Paranoia, caller should have dealt with this */
-                BUG_ON((addr + len) > 0x100000000UL);
-
                 curareas = current->mm->context.low_htlb_areas;
 
                 /* First see if we can use the hint address */
diff --git a/arch/powerpc/platforms/52xx/lite5200.c b/arch/powerpc/platforms/52xx/lite5200.c
index eaff71e74fb0..0f21bab33f6c 100644
--- a/arch/powerpc/platforms/52xx/lite5200.c
+++ b/arch/powerpc/platforms/52xx/lite5200.c
@@ -153,6 +153,7 @@ define_machine(lite52xx) {
         .name           = "lite52xx",
         .probe          = lite52xx_probe,
         .setup_arch     = lite52xx_setup_arch,
+        .init           = mpc52xx_declare_of_platform_devices,
         .init_IRQ       = mpc52xx_init_irq,
         .get_irq        = mpc52xx_get_irq,
         .show_cpuinfo   = lite52xx_show_cpuinfo,
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_common.c b/arch/powerpc/platforms/52xx/mpc52xx_common.c
index 8331ff457770..cc40889074bd 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_common.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_common.c
@@ -116,11 +116,12 @@ unmap_regs:
         if (xlb) iounmap(xlb);
 }
 
-static int __init
+void __init
 mpc52xx_declare_of_platform_devices(void)
 {
         /* Find every child of the SOC node and add it to of_platform */
-        return of_platform_bus_probe(NULL, NULL, NULL);
+        if (of_platform_bus_probe(NULL, NULL, NULL))
+                printk(KERN_ERR __FILE__ ": "
+                        "Error while probing of_platform bus\n");
 }
 
-device_initcall(mpc52xx_declare_of_platform_devices);
diff --git a/arch/powerpc/platforms/iseries/lpevents.c b/arch/powerpc/platforms/iseries/lpevents.c
index e3e929e1b460..c1f4502a3c6a 100644
--- a/arch/powerpc/platforms/iseries/lpevents.c
+++ b/arch/powerpc/platforms/iseries/lpevents.c
@@ -17,6 +17,7 @@
 
 #include <asm/system.h>
 #include <asm/paca.h>
+#include <asm/firmware.h>
 #include <asm/iseries/it_lp_queue.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/hv_call_event.h>
@@ -318,6 +319,9 @@ static int __init proc_lpevents_init(void)
 {
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         e = create_proc_entry("iSeries/lpevents", S_IFREG|S_IRUGO, NULL);
         if (e)
                 e->proc_fops = &proc_lpevents_operations;
diff --git a/arch/powerpc/platforms/iseries/mf.c b/arch/powerpc/platforms/iseries/mf.c
index cff15ae24f6b..1ad0e4aaad1a 100644
--- a/arch/powerpc/platforms/iseries/mf.c
+++ b/arch/powerpc/platforms/iseries/mf.c
@@ -38,6 +38,7 @@
 #include <asm/uaccess.h>
 #include <asm/paca.h>
 #include <asm/abs_addr.h>
+#include <asm/firmware.h>
 #include <asm/iseries/vio.h>
 #include <asm/iseries/mf.h>
 #include <asm/iseries/hv_lp_config.h>
@@ -1235,6 +1236,9 @@ static int __init mf_proc_init(void)
         char name[2];
         int i;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         mf_proc_root = proc_mkdir("iSeries/mf", NULL);
         if (!mf_proc_root)
                 return 1;
diff --git a/arch/powerpc/platforms/iseries/proc.c b/arch/powerpc/platforms/iseries/proc.c
index c241413629ac..b54e37101e69 100644
--- a/arch/powerpc/platforms/iseries/proc.c
+++ b/arch/powerpc/platforms/iseries/proc.c
@@ -24,6 +24,7 @@
 #include <asm/processor.h>
 #include <asm/time.h>
 #include <asm/lppaca.h>
+#include <asm/firmware.h>
 #include <asm/iseries/hv_call_xm.h>
 
 #include "processor_vpd.h"
@@ -31,7 +32,12 @@
 
 static int __init iseries_proc_create(void)
 {
-        struct proc_dir_entry *e = proc_mkdir("iSeries", 0);
+        struct proc_dir_entry *e;
+
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
+        e = proc_mkdir("iSeries", 0);
         if (!e)
                 return 1;
 
@@ -106,6 +112,9 @@ static int __init iseries_proc_init(void)
 {
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         e = create_proc_entry("iSeries/titanTod", S_IFREG|S_IRUGO, NULL);
         if (e)
                 e->proc_fops = &proc_titantod_operations;
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index bdf2afbb60c1..cce7e309340c 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -527,7 +527,8 @@ static void __init iSeries_fixup_klimit(void)
 static int __init iSeries_src_init(void)
 {
         /* clear the progress line */
-        ppc_md.progress(" ", 0xffff);
+        if (firmware_has_feature(FW_FEATURE_ISERIES))
+                ppc_md.progress(" ", 0xffff);
         return 0;
 }
 
diff --git a/arch/powerpc/platforms/iseries/viopath.c b/arch/powerpc/platforms/iseries/viopath.c
index 84e7ee2c086f..a6799ed34a66 100644
--- a/arch/powerpc/platforms/iseries/viopath.c
+++ b/arch/powerpc/platforms/iseries/viopath.c
@@ -42,6 +42,7 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 #include <asm/prom.h>
+#include <asm/firmware.h>
 #include <asm/iseries/hv_types.h>
 #include <asm/iseries/hv_lp_event.h>
 #include <asm/iseries/hv_lp_config.h>
@@ -183,6 +184,9 @@ static int __init vio_proc_init(void)
 {
         struct proc_dir_entry *e;
 
+        if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                return 0;
+
         e = create_proc_entry("iSeries/config", 0, NULL);
         if (e)
                 e->proc_fops = &proc_viopath_operations;
diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c
index f12d5c69e74d..50855d4fd5a0 100644
--- a/arch/powerpc/platforms/maple/setup.c
+++ b/arch/powerpc/platforms/maple/setup.c
@@ -254,7 +254,6 @@ static void __init maple_init_IRQ(void)
                 printk(KERN_DEBUG "OpenPIC addr: %lx, has ISUs: %d\n",
                        openpic_addr, has_isus);
         }
-        of_node_put(root);
 
         BUG_ON(openpic_addr == 0);
 
diff --git a/arch/powerpc/platforms/pasemi/setup.c b/arch/powerpc/platforms/pasemi/setup.c
index 89d6e295dbf7..bea7d1bb1a3b 100644
--- a/arch/powerpc/platforms/pasemi/setup.c
+++ b/arch/powerpc/platforms/pasemi/setup.c
@@ -129,7 +129,6 @@ static __init void pas_init_IRQ(void)
         }
         openpic_addr = of_read_number(opprop, naddr);
         printk(KERN_DEBUG "OpenPIC addr: %lx\n", openpic_addr);
-        of_node_put(root);
 
         mpic = mpic_alloc(mpic_node, openpic_addr, MPIC_PRIMARY, 0, 0,
                           " PAS-OPIC  ");
diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
index c00cfed7af2c..5c7e38789897 100644
--- a/arch/powerpc/platforms/pseries/hvCall.S
+++ b/arch/powerpc/platforms/pseries/hvCall.S
@@ -26,7 +26,7 @@
 BEGIN_FTR_SECTION;                                              \
         mfspr   r0,SPRN_PURR;           /* get PURR and */      \
         std     r0,STK_PARM(r6)(r1);    /* save for later */    \
-END_FTR_SECTION_IFCLR(CPU_FTR_PURR);
+END_FTR_SECTION_IFSET(CPU_FTR_PURR);
         
 /*
  * postcall is performed immediately before function return which
@@ -43,7 +43,7 @@ BEGIN_FTR_SECTION;						\
         mfspr   r8,SPRN_PURR;           /* PURR after */        \
         ld      r6,STK_PARM(r6)(r1);    /* PURR before */       \
         subf    r6,r6,r8;               /* delta */             \
-END_FTR_SECTION_IFCLR(CPU_FTR_PURR);                            \
+END_FTR_SECTION_IFSET(CPU_FTR_PURR);                            \
         ld      r5,STK_PARM(r5)(r1);    /* timebase before */   \
         subf    r5,r5,r7;               /* time delta */        \
                                                                 \
@@ -66,7 +66,7 @@ BEGIN_FTR_SECTION;						\
         ld      r7,HCALL_STAT_PURR(r4); /* PURR */              \
         add     r7,r7,r6;                                       \
         std     r7,HCALL_STAT_PURR(r4);                         \
-END_FTR_SECTION_IFCLR(CPU_FTR_PURR);                            \
+END_FTR_SECTION_IFSET(CPU_FTR_PURR);                            \
 1:
 #else
 #define HCALL_INST_PRECALL
@@ -145,6 +145,7 @@ _GLOBAL(plpar_hcall9)
 
         HVSC                            /* invoke the hypervisor */
 
+        mr      r0,r12
         ld      r12,STK_PARM(r4)(r1)
         std     r4,  0(r12)
         std     r5,  8(r12)
@@ -154,7 +155,7 @@ _GLOBAL(plpar_hcall9)
         std     r9, 40(r12)
         std     r10,48(r12)
         std     r11,56(r12)
-        std     r12,64(r12)
+        std     r0, 64(r12)
 
         HCALL_INST_POSTCALL
 
diff --git a/arch/powerpc/platforms/pseries/hvCall_inst.c b/arch/powerpc/platforms/pseries/hvCall_inst.c
index 80181c4c49eb..3ddc04925d50 100644
--- a/arch/powerpc/platforms/pseries/hvCall_inst.c
+++ b/arch/powerpc/platforms/pseries/hvCall_inst.c
@@ -34,7 +34,7 @@ DEFINE_PER_CPU(struct hcall_stats[HCALL_STAT_ARRAY_SIZE], hcall_stats);
  */
 static void *hc_start(struct seq_file *m, loff_t *pos)
 {
-        if ((int)*pos < HCALL_STAT_ARRAY_SIZE)
+        if ((int)*pos < (HCALL_STAT_ARRAY_SIZE-1))
                 return (void *)(unsigned long)(*pos + 1);
 
         return NULL;
@@ -57,7 +57,7 @@ static int hc_show(struct seq_file *m, void *p)
         struct hcall_stats *hs = (struct hcall_stats *)m->private;
 
         if (hs[h_num].num_calls) {
-                if (!cpu_has_feature(CPU_FTR_PURR))
+                if (cpu_has_feature(CPU_FTR_PURR))
                         seq_printf(m, "%lu %lu %lu %lu\n", h_num<<2,
                                    hs[h_num].num_calls,
                                    hs[h_num].tb_total,
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index b5b2b1103de8..81d172d65038 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -224,7 +224,6 @@ static void xics_unmask_irq(unsigned int virq)
 static void xics_mask_real_irq(unsigned int irq)
 {
         int call_status;
-        unsigned int server;
 
         if (irq == XICS_IPI)
                 return;
@@ -236,9 +235,9 @@ static void xics_mask_real_irq(unsigned int irq)
                 return;
         }
 
-        server = get_irq_server(irq);
         /* Have to set XIVE to 0xff to be able to remove a slot */
-        call_status = rtas_call(ibm_set_xive, 3, 1, NULL, irq, server, 0xff);
+        call_status = rtas_call(ibm_set_xive, 3, 1, NULL, irq,
+                                default_server, 0xff);
         if (call_status != 0) {
                 printk(KERN_ERR "xics_disable_irq: irq=%u: ibm_set_xive(0xff)"
                        " returned %d\n", irq, call_status);
diff --git a/arch/powerpc/sysdev/Makefile b/arch/powerpc/sysdev/Makefile
index 04d4917eb303..2621a7e72d2d 100644
--- a/arch/powerpc/sysdev/Makefile
+++ b/arch/powerpc/sysdev/Makefile
@@ -12,7 +12,6 @@ obj-$(CONFIG_MMIO_NVRAM)	+= mmio_nvram.o
 obj-$(CONFIG_FSL_SOC)           += fsl_soc.o
 obj-$(CONFIG_TSI108_BRIDGE)     += tsi108_pci.o tsi108_dev.o
 obj-$(CONFIG_QUICC_ENGINE)      += qe_lib/
-obj-$(CONFIG_MTD)               += rom.o
 
 ifeq ($(CONFIG_PPC_MERGE),y)
 obj-$(CONFIG_PPC_I8259)         += i8259.o
@@ -21,5 +20,6 @@ endif
 
 # Temporary hack until we have migrated to asm-powerpc
 ifeq ($(ARCH),powerpc)
+obj-$(CONFIG_MTD)               += rom.o
 obj-$(CONFIG_CPM2)              += cpm2_common.o cpm2_pic.o
 endif
diff --git a/arch/s390/kernel/head31.S b/arch/s390/kernel/head31.S
index 4388b3309e0c..eca507050e47 100644
--- a/arch/s390/kernel/head31.S
+++ b/arch/s390/kernel/head31.S
@@ -164,11 +164,14 @@ startup_continue:
         srl     %r7,28
         clr     %r6,%r7                 # compare cc with last access code
         be      .Lsame-.LPG1(%r13)
-        b       .Lchkmem-.LPG1(%r13)
+        lhi     %r8,0                   # no program checks
+        b       .Lsavchk-.LPG1(%r13)
 .Lsame:
         ar      %r5,%r1                 # add 128KB to end of chunk
         bno     .Lloop-.LPG1(%r13)      # r1 < 0x80000000 -> loop
 .Lchkmem:                               # > 2GB or tprot got a program check
+        lhi     %r8,1                   # set program check flag
+.Lsavchk:
         clr     %r4,%r5                 # chunk size > 0?
         be      .Lchkloop-.LPG1(%r13)
         st      %r4,0(%r3)              # store start address of chunk
@@ -190,8 +193,15 @@ startup_continue:
         je      .Ldonemem               # if not, leave
         chi     %r10,0                  # do we have chunks left?
         je      .Ldonemem
+        chi     %r8,1                   # program check ?
+        je      .Lpgmchk
+        lr      %r4,%r5                 # potential new chunk
+        alr     %r5,%r1                 # add 128KB to end of chunk
+        j       .Llpcnt
+.Lpgmchk:
         alr     %r5,%r1                 # add 128KB to end of chunk
         lr      %r4,%r5                 # potential new chunk
+.Llpcnt:
         clr     %r5,%r9                 # should we go on?
         jl      .Lloop
 .Ldonemem:
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index c526279e1123..6ba3f4512dd1 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -172,12 +172,15 @@ startup_continue:
         srl     %r7,28
         clr     %r6,%r7                 # compare cc with last access code
         je      .Lsame
-        j       .Lchkmem
+        lghi    %r8,0                   # no program checks
+        j       .Lsavchk
 .Lsame:
         algr    %r5,%r1                 # add 128KB to end of chunk
                                         # no need to check here,
         brc     12,.Lloop               # this is the same chunk
 .Lchkmem:                               # > 16EB or tprot got a program check
+        lghi    %r8,1                   # set program check flag
+.Lsavchk:
         clgr    %r4,%r5                 # chunk size > 0?
         je      .Lchkloop
         stg     %r4,0(%r3)              # store start address of chunk
@@ -204,8 +207,15 @@ startup_continue:
         chi     %r10, 0                 # do we have chunks left?
         je      .Ldonemem
 .Lhsaskip:
+        chi     %r8,1                   # program check ?
+        je      .Lpgmchk
+        lgr     %r4,%r5                 # potential new chunk
+        algr    %r5,%r1                 # add 128KB to end of chunk
+        j       .Llpcnt
+.Lpgmchk:
         algr    %r5,%r1                 # add 128KB to end of chunk
         lgr     %r4,%r5                 # potential new chunk
+.Llpcnt:
         clgr    %r5,%r9                 # should we go on?
         jl      .Lloop
 .Ldonemem:
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 49ef206ec880..5d8ee3baac14 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -476,7 +476,7 @@ static void __init setup_memory_end(void)
         int i;
 
         memory_size = real_size = 0;
-        max_phys = VMALLOC_END - VMALLOC_MIN_SIZE;
+        max_phys = VMALLOC_END_INIT - VMALLOC_MIN_SIZE;
         memory_end &= PAGE_MASK;
 
         max_mem = memory_end ? min(max_phys, memory_end) : max_phys;
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 19090f7d4f51..c0cd255fddbd 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -794,7 +794,10 @@ static int __init topology_init(void)
         int ret;
 
         for_each_possible_cpu(cpu) {
-                ret = register_cpu(&per_cpu(cpu_devices, cpu), cpu);
+                struct cpu *c = &per_cpu(cpu_devices, cpu);
+
+                c->hotpluggable = 1;
+                ret = register_cpu(c, cpu);
                 if (ret)
                         printk(KERN_WARNING "topology_init: register_cpu %d "
                                "failed (%d)\n", cpu, ret);
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 633249c3ba91..49c3e46b4065 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/errno.h>
+#include <linux/hardirq.h>
 #include <linux/mm.h>
 #include <asm/uaccess.h>
 #include <asm/futex.h>
@@ -18,6 +19,8 @@ static inline int __handle_fault(struct mm_struct *mm, unsigned long address,
         struct vm_area_struct *vma;
         int ret = -EFAULT;
 
+        if (in_atomic())
+                return ret;
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if (unlikely(!vma))
diff --git a/arch/s390/lib/uaccess_std.c b/arch/s390/lib/uaccess_std.c
index bbaca66fa293..56a0214e9928 100644
--- a/arch/s390/lib/uaccess_std.c
+++ b/arch/s390/lib/uaccess_std.c
@@ -258,8 +258,6 @@ int futex_atomic_op(int op, int __user *uaddr, int oparg, int *old)
 {
         int oldval = 0, newval, ret;
 
-        pagefault_disable();
-
         switch (op) {
         case FUTEX_OP_SET:
                 __futex_atomic_op("lr %2,%5\n",
@@ -284,7 +282,6 @@ int futex_atomic_op(int op, int __user *uaddr, int oparg, int *old)
         default:
                 ret = -ENOSYS;
         }
-        pagefault_enable();
         *old = oldval;
         return ret;
 }
diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index 7f2944d3ec2a..cd3d93e8c211 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -61,7 +61,8 @@ void memmap_init(unsigned long size, int nid, unsigned long zone,
 
                 if (map_start < map_end)
                         memmap_init_zone((unsigned long)(map_end - map_start),
-                                         nid, zone, page_to_pfn(map_start));
+                                         nid, zone, page_to_pfn(map_start),
+                                         MEMMAP_EARLY);
         }
 }
 
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 0a4958536bcd..fc99f7b8012f 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -1388,7 +1388,7 @@ void __devinit smp_prepare_boot_cpu(void)
 {
 }
 
-int __devinit __cpu_up(unsigned int cpu)
+int __cpuinit __cpu_up(unsigned int cpu)
 {
         int ret = smp_boot_one_cpu(cpu);
 
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 9cc7c21547a2..69584c295305 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-git14
-# Sat Dec  9 21:23:09 2006
+# Linux kernel version: 2.6.20-rc3
+# Fri Jan  5 11:54:41 2007
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -1056,6 +1056,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
 # CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
@@ -1066,6 +1067,7 @@ CONFIG_SENSORS_SMSC47B397=m
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
 # CONFIG_SENSORS_W83L785TS is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
@@ -1311,6 +1313,11 @@ CONFIG_USB_MON=y
 #
 
 #
+# Virtualization
+#
+# CONFIG_KVM is not set
+
+#
 # Firmware Drivers
 #
 # CONFIG_EDD is not set
@@ -1502,6 +1509,8 @@ CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_UNUSED_SYMBOLS=y
+CONFIG_DEBUG_FS=y
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=18
 CONFIG_DETECT_SOFTLOCKUP=y
@@ -1519,12 +1528,10 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
-CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_FORCED_INLINING is not set
-# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
 # CONFIG_DEBUG_RODATA is not set
@@ -1553,3 +1560,4 @@ CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
 CONFIG_PLIST=y
+CONFIG_IOMAP_COPY=y
diff --git a/arch/x86_64/ia32/ia32_aout.c b/arch/x86_64/ia32/ia32_aout.c
index be87df506f39..fe83edb93c10 100644
--- a/arch/x86_64/ia32/ia32_aout.c
+++ b/arch/x86_64/ia32/ia32_aout.c
@@ -241,7 +241,7 @@ static u32 __user *create_aout_tables(char __user *p, struct linux_binprm *bprm)
                         get_user(c,p++);
                 } while (c);
         }
-        put_user(NULL,argv);
+        put_user(0, argv);
         current->mm->arg_end = current->mm->env_start = (unsigned long) p;
         while (envc-->0) {
                 char c;
@@ -250,7 +250,7 @@ static u32 __user *create_aout_tables(char __user *p, struct linux_binprm *bprm)
                         get_user(c,p++);
                 } while (c);
         }
-        put_user(NULL,envp);
+        put_user(0, envp);
         current->mm->env_end = (unsigned long) p;
         return sp;
 }
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 829698f6d049..49802f1bee94 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -69,6 +69,11 @@ static void nvidia_bugs(void)
 
 static void ati_bugs(void)
 {
+        if (timer_over_8254 == 1) {
+                timer_over_8254 = 0;
+                printk(KERN_INFO
+                "ATI board detected. Disabling timer routing over 8254.\n");
+        }
 }
 
 static void intel_bugs(void)
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 2a1dcd5f69c2..d7bad90a5ad8 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -55,6 +55,10 @@ int sis_apic_bug; /* not actually supported, dummy for compile */
 
 static int no_timer_check;
 
+static int disable_timer_pin_1 __initdata;
+
+int timer_over_8254 __initdata = 1;
+
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
@@ -350,6 +354,29 @@ static int __init disable_ioapic_setup(char *str)
 }
 early_param("noapic", disable_ioapic_setup);
 
+/* Actually the next is obsolete, but keep it for paranoid reasons -AK */
+static int __init disable_timer_pin_setup(char *arg)
+{
+        disable_timer_pin_1 = 1;
+        return 1;
+}
+__setup("disable_timer_pin_1", disable_timer_pin_setup);
+
+static int __init setup_disable_8254_timer(char *s)
+{
+        timer_over_8254 = -1;
+        return 1;
+}
+static int __init setup_enable_8254_timer(char *s)
+{
+        timer_over_8254 = 2;
+        return 1;
+}
+
+__setup("disable_8254_timer", setup_disable_8254_timer);
+__setup("enable_8254_timer", setup_enable_8254_timer);
+
+
 /*
  * Find the IRQ entry number of a certain pin.
  */
@@ -1568,33 +1595,10 @@ static inline void unlock_ExtINT_logic(void)
  * a wide range of boards and BIOS bugs.  Fortunately only the timer IRQ
  * is so screwy.  Thanks to Brian Perkins for testing/hacking this beast
  * fanatically on his truly buggy board.
+ *
+ * FIXME: really need to revamp this for modern platforms only.
  */
-
-static int try_apic_pin(int apic, int pin, char *msg)
-{
-        apic_printk(APIC_VERBOSE, KERN_INFO
-                    "..TIMER: trying IO-APIC=%d PIN=%d %s",
-                    apic, pin, msg);
-
-        /*
-         * Ok, does IRQ0 through the IOAPIC work?
-         */
-        if (!no_timer_check && timer_irq_works()) {
-                nmi_watchdog_default();
-                if (nmi_watchdog == NMI_IO_APIC) {
-                        disable_8259A_irq(0);
-                        setup_nmi();
-                        enable_8259A_irq(0);
-                }
-                return 1;
-        }
-        clear_IO_APIC_pin(apic, pin);
-        apic_printk(APIC_QUIET, KERN_ERR " .. failed\n");
-        return 0;
-}
-
-/* The function from hell */
-static void check_timer(void)
+static inline void check_timer(void)
 {
         int apic1, pin1, apic2, pin2;
         int vector;
@@ -1615,43 +1619,61 @@ static void check_timer(void)
          */
         apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
         init_8259A(1);
+        if (timer_over_8254 > 0)
+                enable_8259A_irq(0);
 
         pin1  = find_isa_irq_pin(0, mp_INT);
         apic1 = find_isa_irq_apic(0, mp_INT);
         pin2  = ioapic_i8259.pin;
         apic2 = ioapic_i8259.apic;
 
-        /* Do this first, otherwise we get double interrupts on ATI boards */
-        if ((pin1 != -1) && try_apic_pin(apic1, pin1,"with 8259 IRQ0 disabled"))
-                return;
+        apic_printk(APIC_VERBOSE,KERN_INFO "..TIMER: vector=0x%02X apic1=%d pin1=%d apic2=%d pin2=%d\n",
+                vector, apic1, pin1, apic2, pin2);
 
-        /* Now try again with IRQ0 8259A enabled.
-           Assumes timer is on IO-APIC 0 ?!? */
-        enable_8259A_irq(0);
-        unmask_IO_APIC_irq(0);
-        if (try_apic_pin(apic1, pin1, "with 8259 IRQ0 enabled"))
-                return;
-        disable_8259A_irq(0);
-
-        /* Always try pin0 and pin2 on APIC 0 to handle buggy timer overrides
-           on Nvidia boards */
-        if (!(apic1 == 0 && pin1 == 0) &&
-            try_apic_pin(0, 0, "fallback with 8259 IRQ0 disabled"))
-                return;
-        if (!(apic1 == 0 && pin1 == 2) &&
-            try_apic_pin(0, 2, "fallback with 8259 IRQ0 disabled"))
-                return;
+        if (pin1 != -1) {
+                /*
+                 * Ok, does IRQ0 through the IOAPIC work?
+                 */
+                unmask_IO_APIC_irq(0);
+                if (!no_timer_check && timer_irq_works()) {
+                        nmi_watchdog_default();
+                        if (nmi_watchdog == NMI_IO_APIC) {
+                                disable_8259A_irq(0);
+                                setup_nmi();
+                                enable_8259A_irq(0);
+                        }
+                        if (disable_timer_pin_1 > 0)
+                                clear_IO_APIC_pin(0, pin1);
+                        return;
+                }
+                clear_IO_APIC_pin(apic1, pin1);
+                apic_printk(APIC_QUIET,KERN_ERR "..MP-BIOS bug: 8254 timer not "
+                                "connected to IO-APIC\n");
+        }
 
-        /* Then try pure 8259A routing on the 8259 as reported by BIOS*/
-        enable_8259A_irq(0);
+        apic_printk(APIC_VERBOSE,KERN_INFO "...trying to set up timer (IRQ0) "
+                                "through the 8259A ... ");
         if (pin2 != -1) {
+                apic_printk(APIC_VERBOSE,"\n..... (found apic %d pin %d) ...",
+                        apic2, pin2);
+                /*
+                 * legacy devices should be connected to IO APIC #0
+                 */
                 setup_ExtINT_IRQ0_pin(apic2, pin2, vector);
-                if (try_apic_pin(apic2,pin2,"8259A broadcast ExtINT from BIOS"))
+                if (timer_irq_works()) {
+                        apic_printk(APIC_VERBOSE," works.\n");
+                        nmi_watchdog_default();
+                        if (nmi_watchdog == NMI_IO_APIC) {
+                                setup_nmi();
+                        }
                         return;
+                }
+                /*
+                 * Cleanup, just in case ...
+                 */
+                clear_IO_APIC_pin(apic2, pin2);
         }
-
-        /* Tried all possibilities to go through the IO-APIC. Now come the
-           really cheesy fallbacks. */
+        apic_printk(APIC_VERBOSE," failed.\n");
 
         if (nmi_watchdog == NMI_IO_APIC) {
                 printk(KERN_WARNING "timer doesn't work through the IO-APIC - disabling NMI Watchdog!\n");
diff --git a/arch/x86_64/kernel/pci-calgary.c b/arch/x86_64/kernel/pci-calgary.c
index 87d90cb68a74..3d65b1d4c2b3 100644
--- a/arch/x86_64/kernel/pci-calgary.c
+++ b/arch/x86_64/kernel/pci-calgary.c
@@ -1068,6 +1068,8 @@ void __init detect_calgary(void)
         if (!early_pci_allowed())
                 return;
 
+        printk(KERN_DEBUG "Calgary: detecting Calgary via BIOS EBDA area\n");
+
         ptr = (unsigned long)phys_to_virt(get_bios_ebda());
 
         rio_table_hdr = NULL;
@@ -1088,14 +1090,14 @@ void __init detect_calgary(void)
                 offset = *((unsigned short *)(ptr + offset));
         }
         if (!rio_table_hdr) {
-                printk(KERN_ERR "Calgary: Unable to locate "
-                                "Rio Grande Table in EBDA - bailing!\n");
+                printk(KERN_DEBUG "Calgary: Unable to locate Rio Grande table "
+                       "in EBDA - bailing!\n");
                 return;
         }
 
         ret = build_detail_arrays();
         if (ret) {
-                printk(KERN_ERR "Calgary: build_detail_arrays ret %d\n", ret);
+                printk(KERN_DEBUG "Calgary: build_detail_arrays ret %d\n", ret);
                 return;
         }
 
@@ -1128,6 +1130,9 @@ void __init detect_calgary(void)
                 }
         }
 
+        printk(KERN_DEBUG "Calgary: finished detection, Calgary %s\n",
+               calgary_found ? "found" : "not found");
+
         if (calgary_found) {
                 iommu_detected = 1;
                 calgary_detected = 1;
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 9f05bc9b2dad..5cc76d0d331f 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -656,6 +656,25 @@ core_initcall(cpufreq_tsc);
  */
 
 #define TICK_COUNT 100000000
+#define TICK_MIN   5000
+
+/*
+ * Some platforms take periodic SMI interrupts with 5ms duration. Make sure none
+ * occurs between the reads of the hpet & TSC.
+ */
+static void __init read_hpet_tsc(int *hpet, int *tsc)
+{
+        int tsc1, tsc2, hpet1;
+
+        do {
+                tsc1 = get_cycles_sync();
+                hpet1 = hpet_readl(HPET_COUNTER);
+                tsc2 = get_cycles_sync();
+        } while (tsc2 - tsc1 > TICK_MIN);
+        *hpet = hpet1;
+        *tsc = tsc2;
+}
+
 
 static unsigned int __init hpet_calibrate_tsc(void)
 {
@@ -666,13 +685,11 @@ static unsigned int __init hpet_calibrate_tsc(void)
         local_irq_save(flags);
         local_irq_disable();
 
-        hpet_start = hpet_readl(HPET_COUNTER);
-        rdtscl(tsc_start);
+        read_hpet_tsc(&hpet_start, &tsc_start);
 
         do {
                 local_irq_disable();
-                hpet_now = hpet_readl(HPET_COUNTER);
-                tsc_now = get_cycles_sync();
+                read_hpet_tsc(&hpet_now, &tsc_now);
                 local_irq_restore(flags);
         } while ((tsc_now - tsc_start) < TICK_COUNT &&
                  (hpet_now - hpet_start) < TICK_COUNT);
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index aeefec97fdee..6bdf593081d8 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -117,10 +117,17 @@ static struct usb_device_id blacklist_ids[] = {
 
         /* IBM/Lenovo ThinkPad with Broadcom chip */
         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = HCI_WRONG_SCO_MTU },
+        { USB_DEVICE(0x0a5c, 0x2110), .driver_info = HCI_WRONG_SCO_MTU },
 
         /* ANYCOM Bluetooth USB-200 and USB-250 */
         { USB_DEVICE(0x0a5c, 0x2111), .driver_info = HCI_RESET },
 
+        /* HP laptop with Broadcom chip */
+        { USB_DEVICE(0x03f0, 0x171d), .driver_info = HCI_WRONG_SCO_MTU },
+
+        /* Dell laptop with Broadcom chip */
+        { USB_DEVICE(0x413c, 0x8126), .driver_info = HCI_WRONG_SCO_MTU },
+
         /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
         { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
 
diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c
index 71e4e0f3fd54..556fd81fa815 100644
--- a/drivers/char/hw_random/amd-rng.c
+++ b/drivers/char/hw_random/amd-rng.c
@@ -144,7 +144,7 @@ static void __exit mod_exit(void)
         hwrng_unregister(&amd_rng);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_AUTHOR("The Linux Kernel team");
diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c
index d37ced0d132b..8e8658dcd2e3 100644
--- a/drivers/char/hw_random/geode-rng.c
+++ b/drivers/char/hw_random/geode-rng.c
@@ -125,7 +125,7 @@ static void __exit mod_exit(void)
         iounmap(mem);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_DESCRIPTION("H/W RNG driver for AMD Geode LX CPUs");
diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
index 8efbc9c0e545..f22e78e3c70f 100644
--- a/drivers/char/hw_random/intel-rng.c
+++ b/drivers/char/hw_random/intel-rng.c
@@ -143,6 +143,11 @@ static const struct pci_device_id pci_tbl[] = {
 };
 MODULE_DEVICE_TABLE(pci, pci_tbl);
 
+static __initdata int no_fwh_detect;
+module_param(no_fwh_detect, int, 0);
+MODULE_PARM_DESC(no_fwh_detect, "Skip FWH detection:\n"
+                                " positive value - skip if FWH space locked read-only\n"
+                                " negative value - skip always");
 
 static inline u8 hwstatus_get(void __iomem *mem)
 {
@@ -240,6 +245,11 @@ static int __init mod_init(void)
         if (!dev)
                 goto out; /* Device not found. */
 
+        if (no_fwh_detect < 0) {
+                pci_dev_put(dev);
+                goto fwh_done;
+        }
+
         /* Check for Intel 82802 */
         if (dev->device < 0x2640) {
                 fwh_dec_en1_off = FWH_DEC_EN1_REG_OLD;
@@ -252,6 +262,23 @@ static int __init mod_init(void)
         pci_read_config_byte(dev, fwh_dec_en1_off, &fwh_dec_en1_val);
         pci_read_config_byte(dev, bios_cntl_off, &bios_cntl_val);
 
+        if ((bios_cntl_val &
+             (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK))
+            == BIOS_CNTL_LOCK_ENABLE_MASK) {
+                static __initdata /*const*/ char warning[] =
+                        KERN_WARNING PFX "Firmware space is locked read-only. If you can't or\n"
+                        KERN_WARNING PFX "don't want to disable this in firmware setup, and if\n"
+                        KERN_WARNING PFX "you are certain that your system has a functional\n"
+                        KERN_WARNING PFX "RNG, try using the 'no_fwh_detect' option.\n";
+
+                pci_dev_put(dev);
+                if (no_fwh_detect)
+                        goto fwh_done;
+                printk(warning);
+                err = -EBUSY;
+                goto out;
+        }
+
         mem = ioremap_nocache(INTEL_FWH_ADDR, INTEL_FWH_ADDR_LEN);
         if (mem == NULL) {
                 pci_dev_put(dev);
@@ -280,8 +307,7 @@ static int __init mod_init(void)
                 pci_write_config_byte(dev,
                                       fwh_dec_en1_off,
                                       fwh_dec_en1_val | FWH_F8_EN_MASK);
-        if (!(bios_cntl_val &
-              (BIOS_CNTL_LOCK_ENABLE_MASK|BIOS_CNTL_WRITE_ENABLE_MASK)))
+        if (!(bios_cntl_val & BIOS_CNTL_WRITE_ENABLE_MASK))
                 pci_write_config_byte(dev,
                                       bios_cntl_off,
                                       bios_cntl_val | BIOS_CNTL_WRITE_ENABLE_MASK);
@@ -315,6 +341,8 @@ static int __init mod_init(void)
                 goto out;
         }
 
+fwh_done:
+
         err = -ENOMEM;
         mem = ioremap(INTEL_RNG_ADDR, INTEL_RNG_ADDR_LEN);
         if (!mem)
@@ -350,7 +378,7 @@ static void __exit mod_exit(void)
         iounmap(mem);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_DESCRIPTION("H/W RNG driver for Intel chipsets");
diff --git a/drivers/char/hw_random/ixp4xx-rng.c b/drivers/char/hw_random/ixp4xx-rng.c
index c9caff57db85..bab43ca32ac1 100644
--- a/drivers/char/hw_random/ixp4xx-rng.c
+++ b/drivers/char/hw_random/ixp4xx-rng.c
@@ -64,7 +64,7 @@ static void __exit ixp4xx_rng_exit(void)
         iounmap(rng_base);
 }
 
-subsys_initcall(ixp4xx_rng_init);
+module_init(ixp4xx_rng_init);
 module_exit(ixp4xx_rng_exit);
 
 MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net>");
diff --git a/drivers/char/hw_random/via-rng.c b/drivers/char/hw_random/via-rng.c
index 0e786b617bb8..9ebf84d18655 100644
--- a/drivers/char/hw_random/via-rng.c
+++ b/drivers/char/hw_random/via-rng.c
@@ -176,7 +176,7 @@ static void __exit mod_exit(void)
         hwrng_unregister(&via_rng);
 }
 
-subsys_initcall(mod_init);
+module_init(mod_init);
 module_exit(mod_exit);
 
 MODULE_DESCRIPTION("H/W RNG driver for VIA chipsets");
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 2b5d7ab3adf7..4325aac7733d 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -2020,6 +2020,8 @@ static int sbp2scsi_slave_configure(struct scsi_device *sdev)
         blk_queue_dma_alignment(sdev->request_queue, (512 - 1));
         sdev->use_10_for_rw = 1;
 
+        if (sdev->type == TYPE_ROM)
+                sdev->use_10_for_ms = 1;
         if (sdev->type == TYPE_DISK &&
             lu->workarounds & SBP2_WORKAROUND_MODE_SENSE_8)
                 sdev->skip_ms_page_8 = 1;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 533193d4e5df..9e0ab048c878 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1088,10 +1088,21 @@ static int cma_iw_handler(struct iw_cm_id *iw_id, struct iw_cm_event *iw_event)
                 *sin = iw_event->local_addr;
                 sin = (struct sockaddr_in *) &id_priv->id.route.addr.dst_addr;
                 *sin = iw_event->remote_addr;
-                if (iw_event->status)
-                        event.event = RDMA_CM_EVENT_REJECTED;
-                else
+                switch (iw_event->status) {
+                case 0:
                         event.event = RDMA_CM_EVENT_ESTABLISHED;
+                        break;
+                case -ECONNRESET:
+                case -ECONNREFUSED:
+                        event.event = RDMA_CM_EVENT_REJECTED;
+                        break;
+                case -ETIMEDOUT:
+                        event.event = RDMA_CM_EVENT_UNREACHABLE;
+                        break;
+                default:
+                        event.event = RDMA_CM_EVENT_CONNECT_ERROR;
+                        break;
+                }
                 break;
         case IW_CM_EVENT_ESTABLISHED:
                 event.event = RDMA_CM_EVENT_ESTABLISHED;
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 81a5cdc5733a..e2e8d329b443 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -209,10 +209,21 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
         if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
                 if (!ctx->backlog) {
                         ret = -EDQUOT;
+                        kfree(uevent);
                         goto out;
                 }
                 ctx->backlog--;
+        } else if (!ctx->uid) {
+                /*
+                 * We ignore events for new connections until userspace has set
+                 * their context.  This can only happen if an error occurs on a
+                 * new connection before the user accepts it.  This is okay,
+                 * since the accept will just fail later.
+                 */
+                kfree(uevent);
+                goto out;
         }
+
         list_add_tail(&uevent->list, &ctx->file->event_list);
         wake_up_interruptible(&ctx->file->poll_wait);
 out:
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index e1b618c5f685..b7be950ab47c 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -50,7 +50,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                                               ib_device);
         struct hipz_query_hca *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -110,7 +110,7 @@ int ehca_query_port(struct ib_device *ibdev,
                                               ib_device);
         struct hipz_query_port *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -179,7 +179,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
                 return -EINVAL;
         }
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device,  "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -212,7 +212,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
                 return -EINVAL;
         }
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index c3ea746e9045..e7209afb4250 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -138,7 +138,7 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
         u64 *rblock;
         unsigned long block_count;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_ATOMIC);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Cannot allocate rblock memory.");
                 ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 3720e3032cce..cd7789f0d08e 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -180,10 +180,10 @@ int ehca_mmap_register(u64 physical,void **mapped,
 int ehca_munmap(unsigned long addr, size_t len);
 
 #ifdef CONFIG_PPC_64K_PAGES
-void *ehca_alloc_fw_ctrlblock(void);
+void *ehca_alloc_fw_ctrlblock(gfp_t flags);
 void ehca_free_fw_ctrlblock(void *ptr);
 #else
-#define ehca_alloc_fw_ctrlblock() ((void *) get_zeroed_page(GFP_KERNEL))
+#define ehca_alloc_fw_ctrlblock(flags) ((void *) get_zeroed_page(flags))
 #define ehca_free_fw_ctrlblock(ptr) free_page((unsigned long)(ptr))
 #endif
 
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index cc47e4c13a18..6574fbbaead5 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -106,9 +106,9 @@ static struct timer_list poll_eqs_timer;
 #ifdef CONFIG_PPC_64K_PAGES
 static struct kmem_cache *ctblk_cache = NULL;
 
-void *ehca_alloc_fw_ctrlblock(void)
+void *ehca_alloc_fw_ctrlblock(gfp_t flags)
 {
-        void *ret = kmem_cache_zalloc(ctblk_cache, GFP_KERNEL);
+        void *ret = kmem_cache_zalloc(ctblk_cache, flags);
         if (!ret)
                 ehca_gen_err("Out of memory for ctblk");
         return ret;
@@ -206,7 +206,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
         u64 h_ret;
         struct hipz_query_hca *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_gen_err("Cannot allocate rblock memory.");
                 return -ENOMEM;
@@ -258,7 +258,7 @@ static int init_node_guid(struct ehca_shca *shca)
         int ret = 0;
         struct hipz_query_hca *rblock;
 
-        rblock = ehca_alloc_fw_ctrlblock();
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -469,7 +469,7 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                            \
         shca = dev->driver_data;                                           \
                                                                            \
-        rblock = ehca_alloc_fw_ctrlblock();                                \
+        rblock = ehca_alloc_fw_ctrlblock(GFP_KERNEL);                      \
         if (!rblock) {                                                     \
                 dev_err(dev, "Can't allocate rblock memory.");             \
                 return 0;                                                  \
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 0a5e2214cc5f..cfb362a1029c 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -1013,7 +1013,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
         u32 i;
         u64 *kpage;
 
-        kpage = ehca_alloc_fw_ctrlblock();
+        kpage = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
@@ -1124,7 +1124,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
         ehca_mrmw_map_acl(acl, &hipz_acl);
         ehca_mrmw_set_pgsize_hipz_acl(&hipz_acl);
 
-        kpage = ehca_alloc_fw_ctrlblock();
+        kpage = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index c6c9cef203e3..34b85556d01e 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -807,7 +807,7 @@ static int internal_modify_qp(struct ib_qp *ibqp,
         unsigned long spl_flags = 0;
 
         /* do query_qp to obtain current attr values */
-        mqpcb = ehca_alloc_fw_ctrlblock();
+        mqpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!mqpcb) {
                 ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                          "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
@@ -1273,7 +1273,7 @@ int ehca_query_qp(struct ib_qp *qp,
                 return -EINVAL;
         }
 
-        qpcb = ehca_alloc_fw_ctrlblock();
+        qpcb = ehca_alloc_fw_ctrlblock(GFP_KERNEL);
         if (!qpcb) {
                 ehca_err(qp->device,"Out of memory for qpcb "
                          "ehca_qp=%p qp_num=%x", my_qp, qp->qp_num);
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 283d50b76c3d..1159c8a0f2c5 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -54,6 +54,10 @@ enum {
         MTHCA_CQ_ENTRY_SIZE = 0x20
 };
 
+enum {
+        MTHCA_ATOMIC_BYTE_LEN = 8
+};
+
 /*
  * Must be packed because start is 64 bits but only aligned to 32 bits.
  */
@@ -599,11 +603,11 @@ static inline int mthca_poll_one(struct mthca_dev *dev,
                         break;
                 case MTHCA_OPCODE_ATOMIC_CS:
                         entry->opcode    = IB_WC_COMP_SWAP;
-                        entry->byte_len  = be32_to_cpu(cqe->byte_cnt);
+                        entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
                         break;
                 case MTHCA_OPCODE_ATOMIC_FA:
                         entry->opcode    = IB_WC_FETCH_ADD;
-                        entry->byte_len  = be32_to_cpu(cqe->byte_cnt);
+                        entry->byte_len  = MTHCA_ATOMIC_BYTE_LEN;
                         break;
                 case MTHCA_OPCODE_BIND_MW:
                         entry->opcode    = IB_WC_BIND_MW;
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 15cc2f6eb475..6b19645d946c 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -232,7 +232,7 @@ void *mthca_table_find(struct mthca_icm_table *table, int obj)
 
         list_for_each_entry(chunk, &icm->chunk_list, list) {
                 for (i = 0; i < chunk->npages; ++i) {
-                        if (chunk->mem[i].length >= offset) {
+                        if (chunk->mem[i].length > offset) {
                                 page = chunk->mem[i].page;
                                 goto out;
                         }
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index d844a2569b47..5f5214c0337d 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -429,13 +429,18 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
 {
         struct mthca_dev *dev = to_mdev(ibqp->device);
         struct mthca_qp *qp = to_mqp(ibqp);
-        int err;
-        struct mthca_mailbox *mailbox;
+        int err = 0;
+        struct mthca_mailbox *mailbox = NULL;
         struct mthca_qp_param *qp_param;
         struct mthca_qp_context *context;
         int mthca_state;
         u8 status;
 
+        if (qp->state == IB_QPS_RESET) {
+                qp_attr->qp_state = IB_QPS_RESET;
+                goto done;
+        }
+
         mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
         if (IS_ERR(mailbox))
                 return PTR_ERR(mailbox);
@@ -454,7 +459,6 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
         mthca_state = be32_to_cpu(context->flags) >> 28;
 
         qp_attr->qp_state            = to_ib_qp_state(mthca_state);
-        qp_attr->cur_qp_state        = qp_attr->qp_state;
         qp_attr->path_mtu            = context->mtu_msgmax >> 5;
         qp_attr->path_mig_state      =
                 to_ib_mig_state((be32_to_cpu(context->flags) >> 11) & 0x3);
@@ -464,11 +468,6 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
         qp_attr->dest_qp_num         = be32_to_cpu(context->remote_qpn) & 0xffffff;
         qp_attr->qp_access_flags     =
                 to_ib_qp_access_flags(be32_to_cpu(context->params2));
-        qp_attr->cap.max_send_wr     = qp->sq.max;
-        qp_attr->cap.max_recv_wr     = qp->rq.max;
-        qp_attr->cap.max_send_sge    = qp->sq.max_gs;
-        qp_attr->cap.max_recv_sge    = qp->rq.max_gs;
-        qp_attr->cap.max_inline_data = qp->max_inline_data;
 
         if (qp->transport == RC || qp->transport == UC) {
                 to_ib_ah_attr(dev, &qp_attr->ah_attr, &context->pri_path);
@@ -495,7 +494,16 @@ int mthca_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, int qp_attr_m
         qp_attr->retry_cnt          = (be32_to_cpu(context->params1) >> 16) & 0x7;
         qp_attr->rnr_retry          = context->pri_path.rnr_retry >> 5;
         qp_attr->alt_timeout        = context->alt_path.ackto >> 3;
-        qp_init_attr->cap           = qp_attr->cap;
+
+done:
+        qp_attr->cur_qp_state        = qp_attr->qp_state;
+        qp_attr->cap.max_send_wr     = qp->sq.max;
+        qp_attr->cap.max_recv_wr     = qp->rq.max;
+        qp_attr->cap.max_send_sge    = qp->sq.max_gs;
+        qp_attr->cap.max_recv_sge    = qp->rq.max_gs;
+        qp_attr->cap.max_inline_data = qp->max_inline_data;
+
+        qp_init_attr->cap            = qp_attr->cap;
 
 out:
         mthca_free_mailbox(dev, mailbox);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index 9b2041e25d59..dd221eda3ea6 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -177,7 +177,7 @@ iscsi_iser_mtask_xmit(struct iscsi_conn *conn,
          * - if yes, the mtask is recycled at iscsi_complete_pdu
          * - if no,  the mtask is recycled at iser_snd_completion
          */
-        if (error && error != -EAGAIN)
+        if (error && error != -ENOBUFS)
                 iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
 
         return error;
@@ -241,7 +241,7 @@ iscsi_iser_ctask_xmit(struct iscsi_conn *conn,
                 error = iscsi_iser_ctask_xmit_unsol_data(conn, ctask);
 
  iscsi_iser_ctask_xmit_exit:
-        if (error && error != -EAGAIN)
+        if (error && error != -ENOBUFS)
                 iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
         return error;
 }
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index e73c87b9be43..0a7d1ab60e6d 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -304,18 +304,14 @@ int iser_conn_set_full_featured_mode(struct iscsi_conn *conn)
 static int
 iser_check_xmit(struct iscsi_conn *conn, void *task)
 {
-        int rc = 0;
         struct iscsi_iser_conn *iser_conn = conn->dd_data;
 
-        write_lock_bh(conn->recv_lock);
         if (atomic_read(&iser_conn->ib_conn->post_send_buf_count) ==
             ISER_QP_MAX_REQ_DTOS) {
-                iser_dbg("%ld can't xmit task %p, suspending tx\n",jiffies,task);
-                set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
-                rc = -EAGAIN;
+                iser_dbg("%ld can't xmit task %p\n",jiffies,task);
+                return -ENOBUFS;
         }
-        write_unlock_bh(conn->recv_lock);
-        return rc;
+        return 0;
 }
 
 
@@ -340,7 +336,7 @@ int iser_send_command(struct iscsi_conn     *conn,
                 return -EPERM;
         }
         if (iser_check_xmit(conn, ctask))
-                return -EAGAIN;
+                return -ENOBUFS;
 
         edtl = ntohl(hdr->data_length);
 
@@ -426,7 +422,7 @@ int iser_send_data_out(struct iscsi_conn     *conn,
         }
 
         if (iser_check_xmit(conn, ctask))
-                return -EAGAIN;
+                return -ENOBUFS;
 
         itt = ntohl(hdr->itt);
         data_seg_len = ntoh24(hdr->dlength);
@@ -498,7 +494,7 @@ int iser_send_control(struct iscsi_conn *conn,
         }
 
         if (iser_check_xmit(conn,mtask))
-                return -EAGAIN;
+                return -ENOBUFS;
 
         /* build the tx desc regd header and add it to the tx desc dto */
         mdesc->type = ISCSI_TX_CONTROL;
@@ -605,6 +601,7 @@ void iser_snd_completion(struct iser_desc *tx_desc)
         struct iscsi_iser_conn *iser_conn = ib_conn->iser_conn;
         struct iscsi_conn      *conn = iser_conn->iscsi_conn;
         struct iscsi_mgmt_task *mtask;
+        int resume_tx = 0;
 
         iser_dbg("Initiator, Data sent dto=0x%p\n", dto);
 
@@ -613,15 +610,16 @@ void iser_snd_completion(struct iser_desc *tx_desc)
         if (tx_desc->type == ISCSI_TX_DATAOUT)
                 kmem_cache_free(ig.desc_cache, tx_desc);
 
+        if (atomic_read(&iser_conn->ib_conn->post_send_buf_count) ==
+            ISER_QP_MAX_REQ_DTOS)
+                resume_tx = 1;
+
         atomic_dec(&ib_conn->post_send_buf_count);
 
-        write_lock(conn->recv_lock);
-        if (conn->suspend_tx) {
+        if (resume_tx) {
                 iser_dbg("%ld resuming tx\n",jiffies);
-                clear_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
                 scsi_queue_work(conn->session->host, &conn->xmitwork);
         }
-        write_unlock(conn->recv_lock);
 
         if (tx_desc->type == ISCSI_TX_CONTROL) {
                 /* this arithmetic is legal by libiscsi dd_data allocation */
diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
index ccc06b1b91b5..714f6a7841cd 100644
--- a/drivers/kvm/svm.c
+++ b/drivers/kvm/svm.c
@@ -17,6 +17,7 @@
 #include <linux/module.h>
 #include <linux/vmalloc.h>
 #include <linux/highmem.h>
+#include <linux/profile.h>
 #include <asm/desc.h>
 
 #include "kvm_svm.h"
@@ -1558,6 +1559,13 @@ again:
 
         reload_tss(vcpu);
 
+        /*
+         * Profile KVM exit RIPs:
+         */
+        if (unlikely(prof_on == KVM_PROFILING))
+                profile_hit(KVM_PROFILING,
+                        (void *)(unsigned long)vcpu->svm->vmcb->save.rip);
+
         stgi();
 
         kvm_reput_irq(vcpu);
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index d4701cb4c654..ce219e3f557f 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -21,6 +21,7 @@
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/highmem.h>
+#include <linux/profile.h>
 #include <asm/io.h>
 #include <asm/desc.h>
 
@@ -1859,6 +1860,12 @@ again:
         asm ("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
 #endif
 
+        /*
+         * Profile KVM exit RIPs:
+         */
+        if (unlikely(prof_on == KVM_PROFILING))
+                profile_hit(KVM_PROFILING, (void *)vmcs_readl(GUEST_RIP));
+
         kvm_run->exit_type = 0;
         if (fail) {
                 kvm_run->exit_type = KVM_EXIT_TYPE_FAIL_ENTRY;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index b30f74be3982..164b25dca101 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -775,6 +775,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
         struct bio_list bl;
         struct page **behind_pages = NULL;
         const int rw = bio_data_dir(bio);
+        const int do_sync = bio_sync(bio);
         int do_barriers;
 
         /*
@@ -835,7 +836,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
                 read_bio->bi_sector = r1_bio->sector + mirror->rdev->data_offset;
                 read_bio->bi_bdev = mirror->rdev->bdev;
                 read_bio->bi_end_io = raid1_end_read_request;
-                read_bio->bi_rw = READ;
+                read_bio->bi_rw = READ | do_sync;
                 read_bio->bi_private = r1_bio;
 
                 generic_make_request(read_bio);
@@ -906,7 +907,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
                 mbio->bi_sector = r1_bio->sector + conf->mirrors[i].rdev->data_offset;
                 mbio->bi_bdev = conf->mirrors[i].rdev->bdev;
                 mbio->bi_end_io = raid1_end_write_request;
-                mbio->bi_rw = WRITE | do_barriers;
+                mbio->bi_rw = WRITE | do_barriers | do_sync;
                 mbio->bi_private = r1_bio;
 
                 if (behind_pages) {
@@ -941,6 +942,8 @@ static int make_request(request_queue_t *q, struct bio * bio)
         blk_plug_device(mddev->queue);
         spin_unlock_irqrestore(&conf->device_lock, flags);
 
+        if (do_sync)
+                md_wakeup_thread(mddev->thread);
 #if 0
         while ((bio = bio_list_pop(&bl)) != NULL)
                 generic_make_request(bio);
@@ -1541,6 +1544,7 @@ static void raid1d(mddev_t *mddev)
                          * We already have a nr_pending reference on these rdevs.
                          */
                         int i;
+                        const int do_sync = bio_sync(r1_bio->master_bio);
                         clear_bit(R1BIO_BarrierRetry, &r1_bio->state);
                         clear_bit(R1BIO_Barrier, &r1_bio->state);
                         for (i=0; i < conf->raid_disks; i++)
@@ -1561,7 +1565,7 @@ static void raid1d(mddev_t *mddev)
                                                 conf->mirrors[i].rdev->data_offset;
                                         bio->bi_bdev = conf->mirrors[i].rdev->bdev;
                                         bio->bi_end_io = raid1_end_write_request;
-                                        bio->bi_rw = WRITE;
+                                        bio->bi_rw = WRITE | do_sync;
                                         bio->bi_private = r1_bio;
                                         r1_bio->bios[i] = bio;
                                         generic_make_request(bio);
@@ -1593,6 +1597,7 @@ static void raid1d(mddev_t *mddev)
                                        (unsigned long long)r1_bio->sector);
                                 raid_end_bio_io(r1_bio);
                         } else {
+                                const int do_sync = bio_sync(r1_bio->master_bio);
                                 r1_bio->bios[r1_bio->read_disk] =
                                         mddev->ro ? IO_BLOCKED : NULL;
                                 r1_bio->read_disk = disk;
@@ -1608,7 +1613,7 @@ static void raid1d(mddev_t *mddev)
                                 bio->bi_sector = r1_bio->sector + rdev->data_offset;
                                 bio->bi_bdev = rdev->bdev;
                                 bio->bi_end_io = raid1_end_read_request;
-                                bio->bi_rw = READ;
+                                bio->bi_rw = READ | do_sync;
                                 bio->bi_private = r1_bio;
                                 unplug = 1;
                                 generic_make_request(bio);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index f0141910bb8d..a9401c017e35 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -782,6 +782,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
         int i;
         int chunk_sects = conf->chunk_mask + 1;
         const int rw = bio_data_dir(bio);
+        const int do_sync = bio_sync(bio);
         struct bio_list bl;
         unsigned long flags;
 
@@ -863,7 +864,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
                         mirror->rdev->data_offset;
                 read_bio->bi_bdev = mirror->rdev->bdev;
                 read_bio->bi_end_io = raid10_end_read_request;
-                read_bio->bi_rw = READ;
+                read_bio->bi_rw = READ | do_sync;
                 read_bio->bi_private = r10_bio;
 
                 generic_make_request(read_bio);
@@ -909,7 +910,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
                         conf->mirrors[d].rdev->data_offset;
                 mbio->bi_bdev = conf->mirrors[d].rdev->bdev;
                 mbio->bi_end_io = raid10_end_write_request;
-                mbio->bi_rw = WRITE;
+                mbio->bi_rw = WRITE | do_sync;
                 mbio->bi_private = r10_bio;
 
                 atomic_inc(&r10_bio->remaining);
@@ -922,6 +923,9 @@ static int make_request(request_queue_t *q, struct bio * bio)
         blk_plug_device(mddev->queue);
         spin_unlock_irqrestore(&conf->device_lock, flags);
 
+        if (do_sync)
+                md_wakeup_thread(mddev->thread);
+
         return 0;
 }
 
@@ -1563,6 +1567,7 @@ static void raid10d(mddev_t *mddev)
                                        (unsigned long long)r10_bio->sector);
                                 raid_end_bio_io(r10_bio);
                         } else {
+                                const int do_sync = bio_sync(r10_bio->master_bio);
                                 rdev = conf->mirrors[mirror].rdev;
                                 if (printk_ratelimit())
                                         printk(KERN_ERR "raid10: %s: redirecting sector %llu to"
@@ -1574,7 +1579,7 @@ static void raid10d(mddev_t *mddev)
                                 bio->bi_sector = r10_bio->devs[r10_bio->read_slot].addr
                                         + rdev->data_offset;
                                 bio->bi_bdev = rdev->bdev;
-                                bio->bi_rw = READ;
+                                bio->bi_rw = READ | do_sync;
                                 bio->bi_private = r10_bio;
                                 bio->bi_end_io = raid10_end_read_request;
                                 unplug = 1;
diff --git a/drivers/mmc/at91_mci.c b/drivers/mmc/at91_mci.c
index 08a33c33f6ed..aa152f31851e 100644
--- a/drivers/mmc/at91_mci.c
+++ b/drivers/mmc/at91_mci.c
@@ -768,7 +768,7 @@ static irqreturn_t at91_mmc_det_irq(int irq, void *_host)
         return IRQ_HANDLED;
 }
 
-int at91_mci_get_ro(struct mmc_host *mmc)
+static int at91_mci_get_ro(struct mmc_host *mmc)
 {
         int read_only = 0;
         struct at91mci_host *host = mmc_priv(mmc);
@@ -794,7 +794,7 @@ static const struct mmc_host_ops at91_mci_ops = {
 /*
  * Probe for the device
  */
-static int at91_mci_probe(struct platform_device *pdev)
+static int __init at91_mci_probe(struct platform_device *pdev)
 {
         struct mmc_host *mmc;
         struct at91mci_host *host;
@@ -910,7 +910,7 @@ static int at91_mci_probe(struct platform_device *pdev)
 /*
  * Remove a device
  */
-static int at91_mci_remove(struct platform_device *pdev)
+static int __exit at91_mci_remove(struct platform_device *pdev)
 {
         struct mmc_host *mmc = platform_get_drvdata(pdev);
         struct at91mci_host *host;
@@ -972,8 +972,7 @@ static int at91_mci_resume(struct platform_device *pdev)
 #endif
 
 static struct platform_driver at91_mci_driver = {
-        .probe          = at91_mci_probe,
-        .remove         = at91_mci_remove,
+        .remove         = __exit_p(at91_mci_remove),
         .suspend        = at91_mci_suspend,
         .resume         = at91_mci_resume,
         .driver         = {
@@ -984,7 +983,7 @@ static struct platform_driver at91_mci_driver = {
 
 static int __init at91_mci_init(void)
 {
-        return platform_driver_register(&at91_mci_driver);
+        return platform_driver_probe(&at91_mci_driver, at91_mci_probe);
 }
 
 static void __exit at91_mci_exit(void)
diff --git a/drivers/mmc/mmci.c b/drivers/mmc/mmci.c
index e9b80e920266..ccfe6561be24 100644
--- a/drivers/mmc/mmci.c
+++ b/drivers/mmc/mmci.c
@@ -42,6 +42,8 @@ mmci_request_end(struct mmci_host *host, struct mmc_request *mrq)
 {
         writel(0, host->base + MMCICOMMAND);
 
+        BUG_ON(host->data);
+
         host->mrq = NULL;
         host->cmd = NULL;
 
@@ -198,6 +200,8 @@ mmci_cmd_irq(struct mmci_host *host, struct mmc_command *cmd,
         }
 
         if (!cmd->data || cmd->error != MMC_ERR_NONE) {
+                if (host->data)
+                        mmci_stop_data(host);
                 mmci_request_end(host, cmd->mrq);
         } else if (!(cmd->data->flags & MMC_DATA_READ)) {
                 mmci_start_data(host, cmd->data);
diff --git a/drivers/mmc/omap.c b/drivers/mmc/omap.c
index 435d331e772a..9488408308fb 100644
--- a/drivers/mmc/omap.c
+++ b/drivers/mmc/omap.c
@@ -581,9 +581,9 @@ static void mmc_omap_switch_timer(unsigned long arg)
         schedule_work(&host->switch_work);
 }
 
-static void mmc_omap_switch_handler(void *data)
+static void mmc_omap_switch_handler(struct work_struct *work)
 {
-        struct mmc_omap_host *host = (struct mmc_omap_host *) data;
+        struct mmc_omap_host *host = container_of(work, struct mmc_omap_host, switch_work);
         struct mmc_card *card;
         static int complained = 0;
         int cards = 0, cover_open;
@@ -1116,7 +1116,7 @@ static int __init mmc_omap_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, host);
 
         if (host->switch_pin >= 0) {
-                INIT_WORK(&host->switch_work, mmc_omap_switch_handler, host);
+                INIT_WORK(&host->switch_work, mmc_omap_switch_handler);
                 init_timer(&host->switch_timer);
                 host->switch_timer.function = mmc_omap_switch_timer;
                 host->switch_timer.data = (unsigned long) host;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index ada5e9b9988c..ca5acc4736df 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -57,8 +57,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.2"
-#define DRV_MODULE_RELDATE      "December 13, 2006"
+#define DRV_MODULE_VERSION      "1.5.3"
+#define DRV_MODULE_RELDATE      "January 8, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -1345,8 +1345,6 @@ bnx2_init_copper_phy(struct bnx2 *bp)
 {
         u32 val;
 
-        bp->phy_flags |= PHY_CRC_FIX_FLAG;
-
         if (bp->phy_flags & PHY_CRC_FIX_FLAG) {
                 bnx2_write_phy(bp, 0x18, 0x0c00);
                 bnx2_write_phy(bp, 0x17, 0x000a);
@@ -3085,7 +3083,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 int buf_size)
 {
         u32 written, offset32, len32;
-        u8 *buf, start[4], end[4], *flash_buffer = NULL;
+        u8 *buf, start[4], end[4], *align_buf = NULL, *flash_buffer = NULL;
         int rc = 0;
         int align_start, align_end;
 
@@ -3113,16 +3111,17 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
         }
 
         if (align_start || align_end) {
-                buf = kmalloc(len32, GFP_KERNEL);
-                if (buf == NULL)
+                align_buf = kmalloc(len32, GFP_KERNEL);
+                if (align_buf == NULL)
                         return -ENOMEM;
                 if (align_start) {
-                        memcpy(buf, start, 4);
+                        memcpy(align_buf, start, 4);
                 }
                 if (align_end) {
-                        memcpy(buf + len32 - 4, end, 4);
+                        memcpy(align_buf + len32 - 4, end, 4);
                 }
-                memcpy(buf + align_start, data_buf, buf_size);
+                memcpy(align_buf + align_start, data_buf, buf_size);
+                buf = align_buf;
         }
 
         if (bp->flash_info->buffered == 0) {
@@ -3256,11 +3255,8 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
         }
 
 nvram_write_end:
-        if (bp->flash_info->buffered == 0)
-                kfree(flash_buffer);
-
-        if (align_start || align_end)
-                kfree(buf);
+        kfree(flash_buffer);
+        kfree(align_buf);
         return rc;
 }
 
@@ -5645,6 +5641,44 @@ poll_bnx2(struct net_device *dev)
 }
 #endif
 
+static void __devinit
+bnx2_get_5709_media(struct bnx2 *bp)
+{
+        u32 val = REG_RD(bp, BNX2_MISC_DUAL_MEDIA_CTRL);
+        u32 bond_id = val & BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID;
+        u32 strap;
+
+        if (bond_id == BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID_C)
+                return;
+        else if (bond_id == BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID_S) {
+                bp->phy_flags |= PHY_SERDES_FLAG;
+                return;
+        }
+
+        if (val & BNX2_MISC_DUAL_MEDIA_CTRL_STRAP_OVERRIDE)
+                strap = (val & BNX2_MISC_DUAL_MEDIA_CTRL_PHY_CTRL) >> 21;
+        else
+                strap = (val & BNX2_MISC_DUAL_MEDIA_CTRL_PHY_CTRL_STRAP) >> 8;
+
+        if (PCI_FUNC(bp->pdev->devfn) == 0) {
+                switch (strap) {
+                case 0x4:
+                case 0x5:
+                case 0x6:
+                        bp->phy_flags |= PHY_SERDES_FLAG;
+                        return;
+                }
+        } else {
+                switch (strap) {
+                case 0x1:
+                case 0x2:
+                case 0x4:
+                        bp->phy_flags |= PHY_SERDES_FLAG;
+                        return;
+                }
+        }
+}
+
 static int __devinit
 bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
 {
@@ -5865,10 +5899,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->phy_addr = 1;
 
         /* Disable WOL support if we are running on a SERDES chip. */
-        if (CHIP_NUM(bp) == CHIP_NUM_5709) {
-                if (CHIP_BOND_ID(bp) != BNX2_MISC_DUAL_MEDIA_CTRL_BOND_ID_C)
-                        bp->phy_flags |= PHY_SERDES_FLAG;
-        } else if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT)
+        if (CHIP_NUM(bp) == CHIP_NUM_5709)
+                bnx2_get_5709_media(bp);
+        else if (CHIP_BOND_ID(bp) & CHIP_BOND_ID_SERDES_BIT)
                 bp->phy_flags |= PHY_SERDES_FLAG;
 
         if (bp->phy_flags & PHY_SERDES_FLAG) {
@@ -5880,7 +5913,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                         if (reg & BNX2_SHARED_HW_CFG_PHY_2_5G)
                                 bp->phy_flags |= PHY_2_5G_CAPABLE_FLAG;
                 }
-        }
+        } else if (CHIP_NUM(bp) == CHIP_NUM_5706 ||
+                   CHIP_NUM(bp) == CHIP_NUM_5708)
+                bp->phy_flags |= PHY_CRC_FIX_FLAG;
 
         if ((CHIP_ID(bp) == CHIP_ID_5708_A0) ||
             (CHIP_ID(bp) == CHIP_ID_5708_B0) ||
diff --git a/drivers/net/chelsio/my3126.c b/drivers/net/chelsio/my3126.c
index c7731b6f9de3..82fed1dd5005 100644
--- a/drivers/net/chelsio/my3126.c
+++ b/drivers/net/chelsio/my3126.c
@@ -170,9 +170,10 @@ static struct cphy *my3126_phy_create(adapter_t *adapter,
 {
         struct cphy *cphy = kzalloc(sizeof (*cphy), GFP_KERNEL);
 
-        if (cphy)
-                cphy_init(cphy, adapter, phy_addr, &my3126_ops, mdio_ops);
+        if (!cphy)
+                return NULL;
 
+        cphy_init(cphy, adapter, phy_addr, &my3126_ops, mdio_ops);
         INIT_DELAYED_WORK(&cphy->phy_update, my3216_poll);
         cphy->bmsr = 0;
 
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 4c1ff752048c..c6259c7127f6 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -995,12 +995,6 @@ e1000_probe(struct pci_dev *pdev,
            (adapter->hw.mac_type != e1000_82547))
                 netdev->features |= NETIF_F_TSO;
 
-#ifdef CONFIG_DEBUG_SLAB
-        /* 82544's work arounds do not play nicely with DEBUG SLAB */
-        if (adapter->hw.mac_type == e1000_82544)
-                netdev->features &= ~NETIF_F_TSO;
-#endif
-
 #ifdef NETIF_F_TSO6
         if (adapter->hw.mac_type > e1000_82547_rev_2)
                 netdev->features |= NETIF_F_TSO6;
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 2f48fe9a29a7..93f2b7a22160 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -234,6 +234,7 @@ enum {
 #define NVREG_XMITCTL_HOST_SEMA_MASK    0x0000f000
 #define NVREG_XMITCTL_HOST_SEMA_ACQ     0x0000f000
 #define NVREG_XMITCTL_HOST_LOADED       0x00004000
+#define NVREG_XMITCTL_TX_PATH_EN        0x01000000
         NvRegTransmitterStatus = 0x088,
 #define NVREG_XMITSTAT_BUSY     0x01
 
@@ -249,6 +250,7 @@ enum {
 #define NVREG_OFFLOAD_NORMAL    RX_NIC_BUFSIZE
         NvRegReceiverControl = 0x094,
 #define NVREG_RCVCTL_START      0x01
+#define NVREG_RCVCTL_RX_PATH_EN 0x01000000
         NvRegReceiverStatus = 0x98,
 #define NVREG_RCVSTAT_BUSY      0x01
 
@@ -1169,16 +1171,21 @@ static void nv_start_rx(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 rx_ctrl = readl(base + NvRegReceiverControl);
 
         dprintk(KERN_DEBUG "%s: nv_start_rx\n", dev->name);
         /* Already running? Stop it. */
-        if (readl(base + NvRegReceiverControl) & NVREG_RCVCTL_START) {
-                writel(0, base + NvRegReceiverControl);
+        if ((readl(base + NvRegReceiverControl) & NVREG_RCVCTL_START) && !np->mac_in_use) {
+                rx_ctrl &= ~NVREG_RCVCTL_START;
+                writel(rx_ctrl, base + NvRegReceiverControl);
                 pci_push(base);
         }
         writel(np->linkspeed, base + NvRegLinkSpeed);
         pci_push(base);
-        writel(NVREG_RCVCTL_START, base + NvRegReceiverControl);
+        rx_ctrl |= NVREG_RCVCTL_START;
+        if (np->mac_in_use)
+                rx_ctrl &= ~NVREG_RCVCTL_RX_PATH_EN;
+        writel(rx_ctrl, base + NvRegReceiverControl);
         dprintk(KERN_DEBUG "%s: nv_start_rx to duplex %d, speed 0x%08x.\n",
                                 dev->name, np->duplex, np->linkspeed);
         pci_push(base);
@@ -1186,39 +1193,59 @@ static void nv_start_rx(struct net_device *dev)
 
 static void nv_stop_rx(struct net_device *dev)
 {
+        struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 rx_ctrl = readl(base + NvRegReceiverControl);
 
         dprintk(KERN_DEBUG "%s: nv_stop_rx\n", dev->name);
-        writel(0, base + NvRegReceiverControl);
+        if (!np->mac_in_use)
+                rx_ctrl &= ~NVREG_RCVCTL_START;
+        else
+                rx_ctrl |= NVREG_RCVCTL_RX_PATH_EN;
+        writel(rx_ctrl, base + NvRegReceiverControl);
         reg_delay(dev, NvRegReceiverStatus, NVREG_RCVSTAT_BUSY, 0,
                         NV_RXSTOP_DELAY1, NV_RXSTOP_DELAY1MAX,
                         KERN_INFO "nv_stop_rx: ReceiverStatus remained busy");
 
         udelay(NV_RXSTOP_DELAY2);
-        writel(0, base + NvRegLinkSpeed);
+        if (!np->mac_in_use)
+                writel(0, base + NvRegLinkSpeed);
 }
 
 static void nv_start_tx(struct net_device *dev)
 {
+        struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 tx_ctrl = readl(base + NvRegTransmitterControl);
 
         dprintk(KERN_DEBUG "%s: nv_start_tx\n", dev->name);
-        writel(NVREG_XMITCTL_START, base + NvRegTransmitterControl);
+        tx_ctrl |= NVREG_XMITCTL_START;
+        if (np->mac_in_use)
+                tx_ctrl &= ~NVREG_XMITCTL_TX_PATH_EN;
+        writel(tx_ctrl, base + NvRegTransmitterControl);
         pci_push(base);
 }
 
 static void nv_stop_tx(struct net_device *dev)
 {
+        struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
+        u32 tx_ctrl = readl(base + NvRegTransmitterControl);
 
         dprintk(KERN_DEBUG "%s: nv_stop_tx\n", dev->name);
-        writel(0, base + NvRegTransmitterControl);
+        if (!np->mac_in_use)
+                tx_ctrl &= ~NVREG_XMITCTL_START;
+        else
+                tx_ctrl |= NVREG_XMITCTL_TX_PATH_EN;
+        writel(tx_ctrl, base + NvRegTransmitterControl);
         reg_delay(dev, NvRegTransmitterStatus, NVREG_XMITSTAT_BUSY, 0,
                         NV_TXSTOP_DELAY1, NV_TXSTOP_DELAY1MAX,
                         KERN_INFO "nv_stop_tx: TransmitterStatus remained busy");
 
         udelay(NV_TXSTOP_DELAY2);
-        writel(readl(base + NvRegTransmitPoll) & NVREG_TRANSMITPOLL_MAC_ADDR_REV, base + NvRegTransmitPoll);
+        if (!np->mac_in_use)
+                writel(readl(base + NvRegTransmitPoll) & NVREG_TRANSMITPOLL_MAC_ADDR_REV,
+                       base + NvRegTransmitPoll);
 }
 
 static void nv_txrx_reset(struct net_device *dev)
@@ -4148,20 +4175,6 @@ static int nv_mgmt_acquire_sema(struct net_device *dev)
         return 0;
 }
 
-/* Indicate to mgmt unit whether driver is loaded or not */
-static void nv_mgmt_driver_loaded(struct net_device *dev, int loaded)
-{
-        u8 __iomem *base = get_hwbase(dev);
-        u32 tx_ctrl;
-
-        tx_ctrl = readl(base + NvRegTransmitterControl);
-        if (loaded)
-                tx_ctrl |= NVREG_XMITCTL_HOST_LOADED;
-        else
-                tx_ctrl &= ~NVREG_XMITCTL_HOST_LOADED;
-        writel(tx_ctrl, base + NvRegTransmitterControl);
-}
-
 static int nv_open(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
@@ -4659,33 +4672,24 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         writel(NVREG_MIISTAT_MASK, base + NvRegMIIStatus);
 
         if (id->driver_data & DEV_HAS_MGMT_UNIT) {
-                writel(0x1, base + 0x204); pci_push(base);
-                msleep(500);
                 /* management unit running on the mac? */
-                np->mac_in_use = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_MGMT_ST;
-                if (np->mac_in_use) {
-                        u32 mgmt_sync;
-                        /* management unit setup the phy already? */
-                        mgmt_sync = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK;
-                        if (mgmt_sync == NVREG_XMITCTL_SYNC_NOT_READY) {
-                                if (!nv_mgmt_acquire_sema(dev)) {
-                                        for (i = 0; i < 5000; i++) {
-                                                msleep(1);
-                                                mgmt_sync = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK;
-                                                if (mgmt_sync == NVREG_XMITCTL_SYNC_NOT_READY)
-                                                        continue;
-                                                if (mgmt_sync == NVREG_XMITCTL_SYNC_PHY_INIT)
-                                                        phyinitialized = 1;
-                                                break;
+                if (readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_PHY_INIT) {
+                        np->mac_in_use = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_MGMT_ST;
+                        dprintk(KERN_INFO "%s: mgmt unit is running. mac in use %x.\n", pci_name(pci_dev), np->mac_in_use);
+                        for (i = 0; i < 5000; i++) {
+                                msleep(1);
+                                if (nv_mgmt_acquire_sema(dev)) {
+                                        /* management unit setup the phy already? */
+                                        if ((readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_SYNC_MASK) ==
+                                            NVREG_XMITCTL_SYNC_PHY_INIT) {
+                                                /* phy is inited by mgmt unit */
+                                                phyinitialized = 1;
+                                                dprintk(KERN_INFO "%s: Phy already initialized by mgmt unit.\n", pci_name(pci_dev));
+                                        } else {
+                                                /* we need to init the phy */
                                         }
-                                } else {
-                                        /* we need to init the phy */
+                                        break;
                                 }
-                        } else if (mgmt_sync == NVREG_XMITCTL_SYNC_PHY_INIT) {
-                                /* phy is inited by SMU */
-                                phyinitialized = 1;
-                        } else {
-                                /* we need to init the phy */
                         }
                 }
         }
@@ -4724,10 +4728,12 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         if (!phyinitialized) {
                 /* reset it */
                 phy_init(dev);
-        }
-
-        if (id->driver_data & DEV_HAS_MGMT_UNIT) {
-                nv_mgmt_driver_loaded(dev, 1);
+        } else {
+                /* see if it is a gigabit phy */
+                u32 mii_status = mii_rw(dev, np->phyaddr, MII_BMSR, MII_READ);
+                if (mii_status & PHY_GIGABIT) {
+                        np->gigabit = PHY_GIGABIT;
+                }
         }
 
         /* set default link speed settings */
@@ -4749,8 +4755,6 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 out_error:
         if (phystate_orig)
                 writel(phystate|NVREG_ADAPTCTL_RUNNING, base + NvRegAdapterControl);
-        if (np->mac_in_use)
-                nv_mgmt_driver_loaded(dev, 0);
         pci_set_drvdata(pci_dev, NULL);
 out_freering:
         free_rings(dev);
@@ -4780,9 +4784,6 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
         writel(np->orig_mac[0], base + NvRegMacAddrA);
         writel(np->orig_mac[1], base + NvRegMacAddrB);
 
-        if (np->mac_in_use)
-                nv_mgmt_driver_loaded(dev, 0);
-
         /* free all structures */
         free_rings(dev);
         iounmap(get_hwbase(dev));
diff --git a/drivers/net/ixgb/ixgb.h b/drivers/net/ixgb/ixgb.h
index 50ffe90488ff..f4aba4355b19 100644
--- a/drivers/net/ixgb/ixgb.h
+++ b/drivers/net/ixgb/ixgb.h
@@ -171,6 +171,7 @@ struct ixgb_adapter {
 
         /* TX */
         struct ixgb_desc_ring tx_ring ____cacheline_aligned_in_smp;
+        unsigned int restart_queue;
         unsigned long timeo_start;
         uint32_t tx_cmd_type;
         uint64_t hw_csum_tx_good;
diff --git a/drivers/net/ixgb/ixgb_ethtool.c b/drivers/net/ixgb/ixgb_ethtool.c
index cd22523fb035..82c044d6e08a 100644
--- a/drivers/net/ixgb/ixgb_ethtool.c
+++ b/drivers/net/ixgb/ixgb_ethtool.c
@@ -79,6 +79,7 @@ static struct ixgb_stats ixgb_gstrings_stats[] = {
         {"tx_window_errors", IXGB_STAT(net_stats.tx_window_errors)},
         {"tx_deferred_ok", IXGB_STAT(stats.dc)},
         {"tx_timeout_count", IXGB_STAT(tx_timeout_count) },
+        {"tx_restart_queue", IXGB_STAT(restart_queue) },
         {"rx_long_length_errors", IXGB_STAT(stats.roc)},
         {"rx_short_length_errors", IXGB_STAT(stats.ruc)},
 #ifdef NETIF_F_TSO
diff --git a/drivers/net/ixgb/ixgb_hw.c b/drivers/net/ixgb/ixgb_hw.c
index 02089b64e42c..ecbf45861c68 100644
--- a/drivers/net/ixgb/ixgb_hw.c
+++ b/drivers/net/ixgb/ixgb_hw.c
@@ -399,8 +399,9 @@ ixgb_init_rx_addrs(struct ixgb_hw *hw)
         /* Zero out the other 15 receive addresses. */
         DEBUGOUT("Clearing RAR[1-15]\n");
         for(i = 1; i < IXGB_RAR_ENTRIES; i++) {
-                IXGB_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
+                /* Write high reg first to disable the AV bit first */
                 IXGB_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0);
+                IXGB_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
         }
 
         return;
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index e628126c9c49..a083a9189230 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -36,7 +36,7 @@ static char ixgb_driver_string[] = "Intel(R) PRO/10GbE Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION             "1.0.117-k2"DRIVERNAPI
+#define DRV_VERSION             "1.0.126-k2"DRIVERNAPI
 char ixgb_driver_version[] = DRV_VERSION;
 static char ixgb_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -1287,6 +1287,7 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
         struct ixgb_buffer *buffer_info;
         int len = skb->len;
         unsigned int offset = 0, size, count = 0, i;
+        unsigned int mss = skb_shinfo(skb)->gso_size;
 
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int f;
@@ -1298,6 +1299,11 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
         while(len) {
                 buffer_info = &tx_ring->buffer_info[i];
                 size = min(len, IXGB_MAX_DATA_PER_TXD);
+                /* Workaround for premature desc write-backs
+                 * in TSO mode.  Append 4-byte sentinel desc */
+                if (unlikely(mss && !nr_frags && size == len && size > 8))
+                        size -= 4;
+
                 buffer_info->length = size;
                 WARN_ON(buffer_info->dma != 0);
                 buffer_info->dma =
@@ -1324,6 +1330,13 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
                 while(len) {
                         buffer_info = &tx_ring->buffer_info[i];
                         size = min(len, IXGB_MAX_DATA_PER_TXD);
+
+                        /* Workaround for premature desc write-backs
+                         * in TSO mode.  Append 4-byte sentinel desc */
+                        if (unlikely(mss && !nr_frags && size == len
+                                     && size > 8))
+                                size -= 4;
+
                         buffer_info->length = size;
                         buffer_info->dma =
                                 pci_map_page(adapter->pdev,
@@ -1398,11 +1411,43 @@ ixgb_tx_queue(struct ixgb_adapter *adapter, int count, int vlan_id,int tx_flags)
         IXGB_WRITE_REG(&adapter->hw, TDT, i);
 }
 
+static int __ixgb_maybe_stop_tx(struct net_device *netdev, int size)
+{
+        struct ixgb_adapter *adapter = netdev_priv(netdev);
+        struct ixgb_desc_ring *tx_ring = &adapter->tx_ring;
+
+        netif_stop_queue(netdev);
+        /* Herbert's original patch had:
+         *  smp_mb__after_netif_stop_queue();
+         * but since that doesn't exist yet, just open code it. */
+        smp_mb();
+
+        /* We need to check again in a case another CPU has just
+         * made room available. */
+        if (likely(IXGB_DESC_UNUSED(tx_ring) < size))
+                return -EBUSY;
+
+        /* A reprieve! */
+        netif_start_queue(netdev);
+        ++adapter->restart_queue;
+        return 0;
+}
+
+static int ixgb_maybe_stop_tx(struct net_device *netdev,
+                              struct ixgb_desc_ring *tx_ring, int size)
+{
+        if (likely(IXGB_DESC_UNUSED(tx_ring) >= size))
+                return 0;
+        return __ixgb_maybe_stop_tx(netdev, size);
+}
+
+
 /* Tx Descriptors needed, worst case */
 #define TXD_USE_COUNT(S) (((S) >> IXGB_MAX_TXD_PWR) + \
                          (((S) & (IXGB_MAX_DATA_PER_TXD - 1)) ? 1 : 0))
-#define DESC_NEEDED TXD_USE_COUNT(IXGB_MAX_DATA_PER_TXD) + \
-        MAX_SKB_FRAGS * TXD_USE_COUNT(PAGE_SIZE) + 1
+#define DESC_NEEDED TXD_USE_COUNT(IXGB_MAX_DATA_PER_TXD) /* skb->date */ + \
+        MAX_SKB_FRAGS * TXD_USE_COUNT(PAGE_SIZE) + 1 /* for context */ \
+        + 1 /* one more needed for sentinel TSO workaround */
 
 static int
 ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
@@ -1430,7 +1475,8 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         spin_lock_irqsave(&adapter->tx_lock, flags);
 #endif
 
-        if(unlikely(IXGB_DESC_UNUSED(&adapter->tx_ring) < DESC_NEEDED)) {
+        if (unlikely(ixgb_maybe_stop_tx(netdev, &adapter->tx_ring,
+                     DESC_NEEDED))) {
                 netif_stop_queue(netdev);
                 spin_unlock_irqrestore(&adapter->tx_lock, flags);
                 return NETDEV_TX_BUSY;
@@ -1468,8 +1514,7 @@ ixgb_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
 #ifdef NETIF_F_LLTX
         /* Make sure there is space in the ring for the next send. */
-        if(unlikely(IXGB_DESC_UNUSED(&adapter->tx_ring) < DESC_NEEDED))
-                netif_stop_queue(netdev);
+        ixgb_maybe_stop_tx(netdev, &adapter->tx_ring, DESC_NEEDED);
 
         spin_unlock_irqrestore(&adapter->tx_lock, flags);
 
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 794cc61819dd..448bf4a78016 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -281,7 +281,6 @@ static int tc574_probe(struct pcmcia_device *link)
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.ConfigIndex = 1;
-        link->conf.Present = PRESENT_OPTION;
 
         /* The EL3-specific entries in the device structure. */
         dev->hard_start_xmit = &el3_start_xmit;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 1e73ff7d5d8e..342f4062de0b 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -195,7 +195,6 @@ static int tc589_probe(struct pcmcia_device *link)
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
-    link->conf.Present = PRESENT_OPTION;
 
     /* The EL3-specific entries in the device structure. */
     SET_MODULE_OWNER(dev);
diff --git a/drivers/net/pcmcia/com20020_cs.c b/drivers/net/pcmcia/com20020_cs.c
index 91f65e91cd5f..0d1c7a41c9c6 100644
--- a/drivers/net/pcmcia/com20020_cs.c
+++ b/drivers/net/pcmcia/com20020_cs.c
@@ -173,7 +173,6 @@ static int com20020_probe(struct pcmcia_device *p_dev)
     p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
     p_dev->conf.IntType = INT_MEMORY_AND_IO;
-    p_dev->conf.Present = PRESENT_OPTION;
 
     p_dev->irq.Instance = info->dev = dev;
     p_dev->priv = info;
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 2b1238e2dbdb..d88e9b2e93cf 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1617,6 +1617,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FastEther PCC-TX", 0x5261440f, 0x485e85d9),
         PCMCIA_DEVICE_PROD_ID12("Corega,K.K.", "Ethernet LAN Card", 0x110d26d9, 0x9fd2f0a2),
         PCMCIA_DEVICE_PROD_ID12("corega,K.K.", "Ethernet LAN Card", 0x9791a90e, 0x9fd2f0a2),
+        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "(CG-LAPCCTXD)", 0x5261440f, 0x73ec0d88),
         PCMCIA_DEVICE_PROD_ID12("CouplerlessPCMCIA", "100BASE", 0xee5af0ad, 0x7c2add04),
         PCMCIA_DEVICE_PROD_ID12("CyQ've", "ELA-010", 0x77008979, 0x9d8d445d),
         PCMCIA_DEVICE_PROD_ID12("CyQ've", "ELA-110E 10/100M LAN Card", 0x77008979, 0xfd184814),
@@ -1667,6 +1668,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN100TX", 0x88fcdeda, 0x6d772737),
         PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN100TE", 0x88fcdeda, 0x0e714bee),
         PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN20T", 0x88fcdeda, 0x81090922),
+        PCMCIA_DEVICE_PROD_ID12("Logitec", "LPM-LN10TE", 0x88fcdeda, 0xc1e2521c),
         PCMCIA_DEVICE_PROD_ID12("LONGSHINE", "PCMCIA Ethernet Card", 0xf866b0b0, 0x6f6652e0),
         PCMCIA_DEVICE_PROD_ID12("MACNICA", "ME1-JEIDA", 0x20841b68, 0xaf8a3578),
         PCMCIA_DEVICE_PROD_ID12("Macsense", "MPC-10", 0xd830297f, 0xd265c307),
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index 8478dca3d8d1..5879e7c36988 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -576,7 +576,6 @@ xirc2ps_probe(struct pcmcia_device *link)
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
-    link->conf.Present = PRESENT_OPTION;
     link->irq.Handler = xirc2ps_interrupt;
     link->irq.Instance = dev;
 
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index d79d141a601d..8844c20eac2d 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -208,6 +208,15 @@ static void ql_write_common_reg(struct ql3_adapter *qdev,
         return;
 }
 
+static void ql_write_nvram_reg(struct ql3_adapter *qdev,
+                                u32 __iomem *reg, u32 value)
+{
+        writel(value, reg);
+        readl(reg);
+        udelay(1);
+        return;
+}
+
 static void ql_write_page0_reg(struct ql3_adapter *qdev,
                                u32 __iomem *reg, u32 value)
 {
@@ -336,9 +345,9 @@ static void fm93c56a_select(struct ql3_adapter *qdev)
                         qdev->mem_map_registers;
 
         qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1;
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
 }
 
@@ -355,14 +364,14 @@ static void fm93c56a_cmd(struct ql3_adapter *qdev, u32 cmd, u32 eepromAddr)
                         qdev->mem_map_registers;
 
         /* Clock in a zero, then do the start bit */
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->eeprom_cmd_data |
                             AUBURN_EEPROM_DO_1);
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->
                             eeprom_cmd_data | AUBURN_EEPROM_DO_1 |
                             AUBURN_EEPROM_CLK_RISE);
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->
                             eeprom_cmd_data | AUBURN_EEPROM_DO_1 |
                             AUBURN_EEPROM_CLK_FALL);
@@ -378,20 +387,20 @@ static void fm93c56a_cmd(struct ql3_adapter *qdev, u32 cmd, u32 eepromAddr)
                          * If the bit changed, then change the DO state to
                          * match
                          */
-                        ql_write_common_reg(qdev,
+                        ql_write_nvram_reg(qdev,
                                             &port_regs->CommonRegs.
                                             serialPortInterfaceReg,
                                             ISP_NVRAM_MASK | qdev->
                                             eeprom_cmd_data | dataBit);
                         previousBit = dataBit;
                 }
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
                                     eeprom_cmd_data | dataBit |
                                     AUBURN_EEPROM_CLK_RISE);
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
@@ -412,20 +421,20 @@ static void fm93c56a_cmd(struct ql3_adapter *qdev, u32 cmd, u32 eepromAddr)
                          * If the bit changed, then change the DO state to
                          * match
                          */
-                        ql_write_common_reg(qdev,
+                        ql_write_nvram_reg(qdev,
                                             &port_regs->CommonRegs.
                                             serialPortInterfaceReg,
                                             ISP_NVRAM_MASK | qdev->
                                             eeprom_cmd_data | dataBit);
                         previousBit = dataBit;
                 }
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
                                     eeprom_cmd_data | dataBit |
                                     AUBURN_EEPROM_CLK_RISE);
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->
@@ -443,7 +452,7 @@ static void fm93c56a_deselect(struct ql3_adapter *qdev)
         struct ql3xxx_port_registers __iomem *port_regs =
                         qdev->mem_map_registers;
         qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_0;
-        ql_write_common_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
+        ql_write_nvram_reg(qdev, &port_regs->CommonRegs.serialPortInterfaceReg,
                             ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
 }
 
@@ -461,12 +470,12 @@ static void fm93c56a_datain(struct ql3_adapter *qdev, unsigned short *value)
         /* Read the data bits */
         /* The first bit is a dummy.  Clock right over it. */
         for (i = 0; i < dataBits; i++) {
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->eeprom_cmd_data |
                                     AUBURN_EEPROM_CLK_RISE);
-                ql_write_common_reg(qdev,
+                ql_write_nvram_reg(qdev,
                                     &port_regs->CommonRegs.
                                     serialPortInterfaceReg,
                                     ISP_NVRAM_MASK | qdev->eeprom_cmd_data |
@@ -3370,7 +3379,6 @@ static int __devinit ql3xxx_probe(struct pci_dev *pdev,
         SET_MODULE_OWNER(ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
 
-        ndev->features = NETIF_F_LLTX;
         if (pci_using_dac)
                 ndev->features |= NETIF_F_HIGHDMA;
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 4056ba1ff3c7..f4bf62c2a7a5 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.71"
-#define DRV_MODULE_RELDATE      "December 15, 2006"
+#define DRV_MODULE_VERSION      "3.72"
+#define DRV_MODULE_RELDATE      "January 8, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1015,7 +1015,12 @@ out:
         else if (tp->tg3_flags2 & TG3_FLG2_PHY_JITTER_BUG) {
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0c00);
                 tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
-                tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
+                if (tp->tg3_flags2 & TG3_FLG2_PHY_ADJUST_TRIM) {
+                        tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x110b);
+                        tg3_writephy(tp, MII_TG3_TEST1,
+                                     MII_TG3_TEST1_TRIM_EN | 0x4);
+                } else
+                        tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0400);
         }
         /* Set Extended packet length bit (bit 14) on all chips that */
@@ -10803,9 +10808,11 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
 
         if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755 ||
-                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787)
+                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787) {
                         tp->tg3_flags2 |= TG3_FLG2_PHY_JITTER_BUG;
-                else if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
+                        if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5755M)
+                                tp->tg3_flags2 |= TG3_FLG2_PHY_ADJUST_TRIM;
+                } else if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
                         tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
         }
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index cf78a7e5997b..80f59ac7ec58 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1658,6 +1658,9 @@
 #define MII_TG3_EPHY_TEST               0x1f /* 5906 PHY register */
 #define MII_TG3_EPHY_SHADOW_EN          0x80
 
+#define MII_TG3_TEST1                   0x1e
+#define MII_TG3_TEST1_TRIM_EN           0x0010
+
 /* There are two ways to manage the TX descriptors on the tigon3.
  * Either the descriptors are in host DMA'able memory, or they
  * exist only in the cards on-chip SRAM.  All 16 send bds are under
@@ -2256,6 +2259,7 @@ struct tg3 {
 #define TG3_FLG2_1SHOT_MSI              0x10000000
 #define TG3_FLG2_PHY_JITTER_BUG         0x20000000
 #define TG3_FLG2_NO_FWARE_REPORTED      0x40000000
+#define TG3_FLG2_PHY_ADJUST_TRIM        0x80000000
 
         u32                             split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ         3
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index 0e94fbbf7a94..b85857a84870 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -2664,7 +2664,7 @@ static void __ipw2100_rx_process(struct ipw2100_priv *priv)
                                 break;
                         }
 #endif
-                        if (stats.len < sizeof(u->rx_data.header))
+                        if (stats.len < sizeof(struct ieee80211_hdr_3addr))
                                 break;
                         switch (WLAN_FC_GET_TYPE(u->rx_data.header.frame_ctl)) {
                         case IEEE80211_FTYPE_MGMT:
diff --git a/drivers/net/wireless/netwave_cs.c b/drivers/net/wireless/netwave_cs.c
index 644b4741ef74..a009ab517710 100644
--- a/drivers/net/wireless/netwave_cs.c
+++ b/drivers/net/wireless/netwave_cs.c
@@ -406,7 +406,6 @@ static int netwave_probe(struct pcmcia_device *link)
     link->conf.Attributes = CONF_ENABLE_IRQ;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
-    link->conf.Present = PRESENT_OPTION;
 
     /* Netwave private struct init. link/dev/node already taken care of,
      * other stuff zero'd - Jean II */
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 88e10c9bc4ac..47b2ccb6a633 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -331,7 +331,6 @@ static int ray_probe(struct pcmcia_device *p_dev)
     p_dev->conf.Attributes = CONF_ENABLE_IRQ;
     p_dev->conf.IntType = INT_MEMORY_AND_IO;
     p_dev->conf.ConfigIndex = 1;
-    p_dev->conf.Present = PRESENT_OPTION;
 
     p_dev->priv = dev;
     p_dev->irq.Instance = dev;
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 583e0d655a98..c250f08c8dd5 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -1928,7 +1928,6 @@ static int wl3501_probe(struct pcmcia_device *p_dev)
         p_dev->conf.Attributes  = CONF_ENABLE_IRQ;
         p_dev->conf.IntType     = INT_MEMORY_AND_IO;
         p_dev->conf.ConfigIndex = 1;
-        p_dev->conf.Present     = PRESENT_OPTION;
 
         dev = alloc_etherdev(sizeof(struct wl3501_card));
         if (!dev)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 6bfb942428e4..206c834d263a 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -254,7 +254,8 @@ static int __pci_find_next_ht_cap(struct pci_dev *dev, int pos, int ht_cap)
                 if ((cap & mask) == ht_cap)
                         return pos;
 
-                pos = __pci_find_next_cap_ttl(dev->bus, dev->devfn, pos,
+                pos = __pci_find_next_cap_ttl(dev->bus, dev->devfn,
+                                              pos + PCI_CAP_LIST_NEXT,
                                               PCI_CAP_ID_HT, &ttl);
         }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8f0322d6f3bf..0a70943f8bb6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -955,7 +955,7 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_ho
  * becomes necessary to do this tweak in two steps -- I've chosen the Host
  * bridge as trigger.
  */
-static int __initdata asus_hides_smbus;
+static int asus_hides_smbus;
 
 static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
 {
@@ -1117,10 +1117,11 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_ICH6_1,	asus_h
 static void quirk_sis_96x_smbus(struct pci_dev *dev)
 {
         u8 val = 0;
-        printk(KERN_INFO "Enabling SiS 96x SMBus.\n");
-        pci_read_config_byte(dev, 0x77, &val);
-        pci_write_config_byte(dev, 0x77, val & ~0x10);
         pci_read_config_byte(dev, 0x77, &val);
+        if (val & 0x10) {
+                printk(KERN_INFO "Enabling SiS 96x SMBus.\n");
+                pci_write_config_byte(dev, 0x77, val & ~0x10);
+        }
 }
 
 /*
@@ -1152,11 +1153,12 @@ static void quirk_sis_503(struct pci_dev *dev)
         printk(KERN_WARNING "Uncovering SIS%x that hid as a SIS503 (compatible=%d)\n", devid, sis_96x_compatible);
 
         /*
-         * Ok, it now shows up as a 96x.. The 96x quirks are after
-         * the 503 quirk in the quirk table, so they'll automatically
-         * run and enable things like the SMBus device
+         * Ok, it now shows up as a 96x.. run the 96x quirk by
+         * hand in case it has already been processed.
+         * (depends on link order, which is apparently not guaranteed)
          */
         dev->device = devid;
+        quirk_sis_96x_smbus(dev);
 }
 
 static void __init quirk_sis_96x_compatible(struct pci_dev *dev)
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 72ba1a70f35f..e9e0934380b8 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -264,8 +264,6 @@ static int sh_rtc_proc(struct device *dev, struct seq_file *seq)
         unsigned int tmp;
 
         tmp = readb(rtc->regbase + RCR1);
-        seq_printf(seq, "alarm_IRQ\t: %s\n",
-                   (tmp & RCR1_AIE) ? "yes" : "no");
         seq_printf(seq, "carry_IRQ\t: %s\n",
                    (tmp & RCR1_CIE) ? "yes" : "no");
 
@@ -428,6 +426,8 @@ static int sh_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
                 tm->tm_mon -= 1; /* RTC is 1-12, tm_mon is 0-11 */
         tm->tm_year     = 0xffff;
 
+        wkalrm->enabled = (readb(rtc->regbase + RCR1) & RCR1_AIE) ? 1 : 0;
+
         spin_unlock_irq(&rtc->lock);
 
         return 0;
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 1678b6c757ec..a420cd099041 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -117,7 +117,7 @@ vmcp_write(struct file *file, const char __user * buff, size_t count,
                 return -ENOMEM;
         }
         debug_text_event(vmcp_debug, 1, cmd);
-        session->resp_size = __cpcmd(cmd, session->response,
+        session->resp_size = cpcmd(cmd, session->response,
                                      session->bufsize,
                                      &session->resp_code);
         up(&session->mutex);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index b471ac4a1bf6..ae1bf231d089 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -880,19 +880,15 @@ static void cio_reset_pgm_check_handler(void)
 static int stsch_reset(struct subchannel_id schid, volatile struct schib *addr)
 {
         int rc;
-        register struct subchannel_id reg1 asm ("1") = schid;
 
         pgm_check_occured = 0;
         s390_reset_pgm_handler = cio_reset_pgm_check_handler;
+        rc = stsch(schid, addr);
+        s390_reset_pgm_handler = NULL;
 
-        asm volatile(
-                "       stsch   0(%2)\n"
-                "       ipm     %0\n"
-                "       srl     %0,28"
-                : "=d" (rc)
-                : "d" (reg1), "a" (addr), "m" (*addr) : "memory", "cc");
+        /* The program check handler could have changed pgm_check_occured */
+        barrier();
 
-        s390_reset_pgm_handler = NULL;
         if (pgm_check_occured)
                 return -EIO;
         else
diff --git a/drivers/s390/net/Kconfig b/drivers/s390/net/Kconfig
index 1a93fa684e9f..52625153a4f0 100644
--- a/drivers/s390/net/Kconfig
+++ b/drivers/s390/net/Kconfig
@@ -27,10 +27,7 @@ config IUCV
         help
           Select this option if you want to use inter-user communication
           under VM or VIF. If unsure, say "Y" to enable a fast communication
-          link between VM guests. At boot time the user ID of the guest needs
-          to be passed to the kernel. Note that both kernels need to be
-          compiled with this option and both need to be booted with the user ID
-          of the other VM guest.
+          link between VM guests.
 
 config NETIUCV
         tristate "IUCV network device support (VM only)"
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 53c358c7d368..e95c281f1e36 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -710,7 +710,7 @@ struct qeth_reply {
         int (*callback)(struct qeth_card *,struct qeth_reply *,unsigned long);
         u32 seqno;
         unsigned long offset;
-        int received;
+        atomic_t received;
         int rc;
         void *param;
         struct qeth_card *card;
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 2bde4f1fb9c2..d2efa5ff125d 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -471,7 +471,7 @@ qeth_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
             channel->state == CH_STATE_UP)
                 qeth_issue_next_read(card);
 
-        tasklet_schedule(&channel->irq_tasklet);
+        qeth_irq_tasklet((unsigned long)channel);
         return;
 out:
         wake_up(&card->wait_q);
@@ -951,40 +951,6 @@ qeth_do_run_thread(struct qeth_card *card, unsigned long thread)
 }
 
 static int
-qeth_register_ip_addresses(void *ptr)
-{
-        struct qeth_card *card;
-
-        card = (struct qeth_card *) ptr;
-        daemonize("qeth_reg_ip");
-        QETH_DBF_TEXT(trace,4,"regipth1");
-        if (!qeth_do_run_thread(card, QETH_SET_IP_THREAD))
-                return 0;
-        QETH_DBF_TEXT(trace,4,"regipth2");
-        qeth_set_ip_addr_list(card);
-        qeth_clear_thread_running_bit(card, QETH_SET_IP_THREAD);
-        return 0;
-}
-
-/*
- * Drive the SET_PROMISC_MODE thread
- */
-static int
-qeth_set_promisc_mode(void *ptr)
-{
-        struct qeth_card *card = (struct qeth_card *) ptr;
-
-        daemonize("qeth_setprm");
-        QETH_DBF_TEXT(trace,4,"setprm1");
-        if (!qeth_do_run_thread(card, QETH_SET_PROMISC_MODE_THREAD))
-                return 0;
-        QETH_DBF_TEXT(trace,4,"setprm2");
-        qeth_setadp_promisc_mode(card);
-        qeth_clear_thread_running_bit(card, QETH_SET_PROMISC_MODE_THREAD);
-        return 0;
-}
-
-static int
 qeth_recover(void *ptr)
 {
         struct qeth_card *card;
@@ -1047,11 +1013,6 @@ qeth_start_kernel_thread(struct work_struct *work)
         if (card->read.state != CH_STATE_UP &&
             card->write.state != CH_STATE_UP)
                 return;
-
-        if (qeth_do_start_thread(card, QETH_SET_IP_THREAD))
-                kernel_thread(qeth_register_ip_addresses, (void *)card,SIGCHLD);
-        if (qeth_do_start_thread(card, QETH_SET_PROMISC_MODE_THREAD))
-                kernel_thread(qeth_set_promisc_mode, (void *)card, SIGCHLD);
         if (qeth_do_start_thread(card, QETH_RECOVER_THREAD))
                 kernel_thread(qeth_recover, (void *) card, SIGCHLD);
 }
@@ -1074,7 +1035,7 @@ qeth_set_intial_options(struct qeth_card *card)
                 card->options.layer2 = 1;
         else
                 card->options.layer2 = 0;
-        card->options.performance_stats = 1;
+        card->options.performance_stats = 0;
 }
 
 /**
@@ -1613,8 +1574,6 @@ qeth_issue_next_read(struct qeth_card *card)
                 return -ENOMEM;
         }
         qeth_setup_ccw(&card->read, iob->data, QETH_BUFSIZE);
-        wait_event(card->wait_q,
-                   atomic_cmpxchg(&card->read.irq_pending, 0, 1) == 0);
         QETH_DBF_TEXT(trace, 6, "noirqpnd");
         rc = ccw_device_start(card->read.ccwdev, &card->read.ccw,
                               (addr_t) iob, 0, 0);
@@ -1635,6 +1594,7 @@ qeth_alloc_reply(struct qeth_card *card)
         reply = kzalloc(sizeof(struct qeth_reply), GFP_ATOMIC);
         if (reply){
                 atomic_set(&reply->refcnt, 1);
+                atomic_set(&reply->received, 0);
                 reply->card = card;
         };
         return reply;
@@ -1655,31 +1615,6 @@ qeth_put_reply(struct qeth_reply *reply)
                 kfree(reply);
 }
 
-static void
-qeth_cmd_timeout(unsigned long data)
-{
-        struct qeth_reply *reply, *list_reply, *r;
-        unsigned long flags;
-
-        reply = (struct qeth_reply *) data;
-        spin_lock_irqsave(&reply->card->lock, flags);
-        list_for_each_entry_safe(list_reply, r,
-                                 &reply->card->cmd_waiter_list, list) {
-                if (reply == list_reply){
-                        qeth_get_reply(reply);
-                        list_del_init(&reply->list);
-                        spin_unlock_irqrestore(&reply->card->lock, flags);
-                        reply->rc = -ETIME;
-                        reply->received = 1;
-                        wake_up(&reply->wait_q);
-                        qeth_put_reply(reply);
-                        return;
-                }
-        }
-        spin_unlock_irqrestore(&reply->card->lock, flags);
-}
-
-
 static struct qeth_ipa_cmd *
 qeth_check_ipa_data(struct qeth_card *card, struct qeth_cmd_buffer *iob)
 {
@@ -1745,7 +1680,7 @@ qeth_clear_ipacmd_list(struct qeth_card *card)
         list_for_each_entry_safe(reply, r, &card->cmd_waiter_list, list) {
                 qeth_get_reply(reply);
                 reply->rc = -EIO;
-                reply->received = 1;
+                atomic_inc(&reply->received);
                 list_del_init(&reply->list);
                 wake_up(&reply->wait_q);
                 qeth_put_reply(reply);
@@ -1814,7 +1749,7 @@ qeth_send_control_data_cb(struct qeth_channel *channel,
                                               &card->cmd_waiter_list);
                                 spin_unlock_irqrestore(&card->lock, flags);
                         } else {
-                                reply->received = 1;
+                                atomic_inc(&reply->received);
                                 wake_up(&reply->wait_q);
                         }
                         qeth_put_reply(reply);
@@ -1858,7 +1793,7 @@ qeth_send_control_data(struct qeth_card *card, int len,
         int rc;
         unsigned long flags;
         struct qeth_reply *reply = NULL;
-        struct timer_list timer;
+        unsigned long timeout;
 
         QETH_DBF_TEXT(trace, 2, "sendctl");
 
@@ -1873,21 +1808,20 @@ qeth_send_control_data(struct qeth_card *card, int len,
                 reply->seqno = QETH_IDX_COMMAND_SEQNO;
         else
                 reply->seqno = card->seqno.ipa++;
-        init_timer(&timer);
-        timer.function = qeth_cmd_timeout;
-        timer.data = (unsigned long) reply;
         init_waitqueue_head(&reply->wait_q);
         spin_lock_irqsave(&card->lock, flags);
         list_add_tail(&reply->list, &card->cmd_waiter_list);
         spin_unlock_irqrestore(&card->lock, flags);
         QETH_DBF_HEX(control, 2, iob->data, QETH_DBF_CONTROL_LEN);
-        wait_event(card->wait_q,
-                   atomic_cmpxchg(&card->write.irq_pending, 0, 1) == 0);
+
+        while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ;
         qeth_prepare_control_data(card, len, iob);
+
         if (IS_IPA(iob->data))
-                timer.expires = jiffies + QETH_IPA_TIMEOUT;
+                timeout = jiffies + QETH_IPA_TIMEOUT;
         else
-                timer.expires = jiffies + QETH_TIMEOUT;
+                timeout = jiffies + QETH_TIMEOUT;
+
         QETH_DBF_TEXT(trace, 6, "noirqpnd");
         spin_lock_irqsave(get_ccwdev_lock(card->write.ccwdev), flags);
         rc = ccw_device_start(card->write.ccwdev, &card->write.ccw,
@@ -1906,9 +1840,16 @@ qeth_send_control_data(struct qeth_card *card, int len,
                 wake_up(&card->wait_q);
                 return rc;
         }
-        add_timer(&timer);
-        wait_event(reply->wait_q, reply->received);
-        del_timer_sync(&timer);
+        while (!atomic_read(&reply->received)) {
+                if (time_after(jiffies, timeout)) {
+                        spin_lock_irqsave(&reply->card->lock, flags);
+                        list_del_init(&reply->list);
+                        spin_unlock_irqrestore(&reply->card->lock, flags);
+                        reply->rc = -ETIME;
+                        atomic_inc(&reply->received);
+                        wake_up(&reply->wait_q);
+                }
+        };
         rc = reply->rc;
         qeth_put_reply(reply);
         return rc;
@@ -2466,32 +2407,17 @@ qeth_rebuild_skb_fake_ll(struct qeth_card *card, struct sk_buff *skb,
                 qeth_rebuild_skb_fake_ll_eth(card, skb, hdr);
 }
 
-static inline __u16
+static inline void
 qeth_layer2_rebuild_skb(struct qeth_card *card, struct sk_buff *skb,
                         struct qeth_hdr *hdr)
 {
-        unsigned short vlan_id = 0;
-#ifdef CONFIG_QETH_VLAN
-        struct vlan_hdr *vhdr;
-#endif
-
         skb->pkt_type = PACKET_HOST;
         skb->protocol = qeth_type_trans(skb, skb->dev);
         if (card->options.checksum_type == NO_CHECKSUMMING)
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         else
                 skb->ip_summed = CHECKSUM_NONE;
-#ifdef CONFIG_QETH_VLAN
-        if (hdr->hdr.l2.flags[2] & (QETH_LAYER2_FLAG_VLAN)) {
-                vhdr = (struct vlan_hdr *) skb->data;
-                skb->protocol =
-                        __constant_htons(vhdr->h_vlan_encapsulated_proto);
-                vlan_id = hdr->hdr.l2.vlan_id;
-                skb_pull(skb, VLAN_HLEN);
-        }
-#endif
         *((__u32 *)skb->cb) = ++card->seqno.pkt_seqno;
-        return vlan_id;
 }
 
 static inline __u16
@@ -2560,7 +2486,6 @@ qeth_process_inbound_buffer(struct qeth_card *card,
         int offset;
         int rxrc;
         __u16 vlan_tag = 0;
-        __u16 *vlan_addr;
 
         /* get first element of current buffer */
         element = (struct qdio_buffer_element *)&buf->buffer->element[0];
@@ -2571,7 +2496,7 @@ qeth_process_inbound_buffer(struct qeth_card *card,
                                        &offset, &hdr))) {
                 skb->dev = card->dev;
                 if (hdr->hdr.l2.id == QETH_HEADER_TYPE_LAYER2)
-                        vlan_tag = qeth_layer2_rebuild_skb(card, skb, hdr);
+                        qeth_layer2_rebuild_skb(card, skb, hdr);
                 else if (hdr->hdr.l3.id == QETH_HEADER_TYPE_LAYER3)
                         vlan_tag = qeth_rebuild_skb(card, skb, hdr);
                 else { /*in case of OSN*/
@@ -3968,13 +3893,22 @@ static inline struct sk_buff *
 qeth_prepare_skb(struct qeth_card *card, struct sk_buff *skb,
                  struct qeth_hdr **hdr, int ipv)
 {
-        struct sk_buff *new_skb;
+        struct sk_buff *new_skb, *new_skb2;
         
         QETH_DBF_TEXT(trace, 6, "prepskb");
-
-        new_skb = qeth_realloc_headroom(card, skb, sizeof(struct qeth_hdr));
-        if (new_skb == NULL)
+        new_skb = skb;
+        new_skb = qeth_pskb_unshare(skb, GFP_ATOMIC);
+        if (!new_skb)
+                return NULL;
+        new_skb2 = qeth_realloc_headroom(card, new_skb,
+                                         sizeof(struct qeth_hdr));
+        if (!new_skb2) {
+                __qeth_free_new_skb(skb, new_skb);
                 return NULL;
+        }
+        if (new_skb != skb)
+                __qeth_free_new_skb(new_skb2, new_skb);
+        new_skb = new_skb2;
         *hdr = __qeth_prepare_skb(card, new_skb, ipv);
         if (*hdr == NULL) {
                 __qeth_free_new_skb(skb, new_skb);
@@ -4844,9 +4778,11 @@ qeth_arp_query(struct qeth_card *card, char __user *udata)
                            "(0x%x/%d)\n",
                            QETH_CARD_IFNAME(card), qeth_arp_get_error_cause(&rc),
                            tmp, tmp);
-                copy_to_user(udata, qinfo.udata, 4);
+                if (copy_to_user(udata, qinfo.udata, 4))
+                        rc = -EFAULT;
         } else {
-                copy_to_user(udata, qinfo.udata, qinfo.udata_len);
+                if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
+                        rc = -EFAULT;
         }
         kfree(qinfo.udata);
         return rc;
@@ -4992,8 +4928,10 @@ qeth_snmp_command(struct qeth_card *card, char __user *udata)
         if (rc)
                 PRINT_WARN("SNMP command failed on %s: (0x%x)\n",
                            QETH_CARD_IFNAME(card), rc);
-         else
-                copy_to_user(udata, qinfo.udata, qinfo.udata_len);
+        else {
+                if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
+                        rc = -EFAULT;
+        }
 
         kfree(ureq);
         kfree(qinfo.udata);
@@ -5544,12 +5482,10 @@ qeth_set_multicast_list(struct net_device *dev)
         qeth_add_multicast_ipv6(card);
 #endif
 out:
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
         if (!qeth_adp_supported(card, IPA_SETADP_SET_PROMISC_MODE))
                 return;
-        if (qeth_set_thread_start_bit(card, QETH_SET_PROMISC_MODE_THREAD)==0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_setadp_promisc_mode(card);
 }
 
 static int
@@ -6351,6 +6287,42 @@ static struct ethtool_ops qeth_ethtool_ops = {
 };
 
 static int
+qeth_hard_header_parse(struct sk_buff *skb, unsigned char *haddr)
+{
+        struct qeth_card *card;
+        struct ethhdr *eth;
+
+        card = qeth_get_card_from_dev(skb->dev);
+        if (card->options.layer2)
+                goto haveheader;
+#ifdef CONFIG_QETH_IPV6
+        /* cause of the manipulated arp constructor and the ARP
+           flag for OSAE devices we have some nasty exceptions */
+        if (card->info.type == QETH_CARD_TYPE_OSAE) {
+                if (!card->options.fake_ll) {
+                        if ((skb->pkt_type==PACKET_OUTGOING) &&
+                            (skb->protocol==ETH_P_IPV6))
+                                goto haveheader;
+                        else
+                                return 0;
+                } else {
+                        if ((skb->pkt_type==PACKET_OUTGOING) &&
+                            (skb->protocol==ETH_P_IP))
+                                return 0;
+                        else
+                                goto haveheader;
+                }
+        }
+#endif
+        if (!card->options.fake_ll)
+                return 0;
+haveheader:
+        eth = eth_hdr(skb);
+        memcpy(haddr, eth->h_source, ETH_ALEN);
+        return ETH_ALEN;
+}
+
+static int
 qeth_netdev_init(struct net_device *dev)
 {
         struct qeth_card *card;
@@ -6388,7 +6360,10 @@ qeth_netdev_init(struct net_device *dev)
         if (card->options.fake_ll &&
                 (qeth_get_netdev_flags(card) & IFF_NOARP))
                         dev->hard_header = qeth_fake_header;
-        dev->hard_header_parse = NULL;
+        if (dev->type == ARPHRD_IEEE802_TR)
+                dev->hard_header_parse = NULL;
+        else
+                dev->hard_header_parse = qeth_hard_header_parse;
         dev->set_mac_address = qeth_layer2_set_mac_address;
         dev->flags |= qeth_get_netdev_flags(card);
         if ((card->options.fake_broadcast) ||
@@ -8235,8 +8210,7 @@ qeth_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
         }
         if (!qeth_add_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
         return rc;
 }
 
@@ -8264,8 +8238,7 @@ qeth_del_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
                 return;
         if (!qeth_delete_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 }
 
 /*
@@ -8308,8 +8281,7 @@ qeth_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
         }
         if (!qeth_add_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
         return 0;
 }
 
@@ -8337,8 +8309,7 @@ qeth_del_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
                 return;
         if (!qeth_delete_ip(card, ipaddr))
                 kfree(ipaddr);
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 }
 
 /**
@@ -8380,8 +8351,7 @@ qeth_ip_event(struct notifier_block *this,
         default:
                 break;
         }
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 out:
         return NOTIFY_DONE;
 }
@@ -8433,8 +8403,7 @@ qeth_ip6_event(struct notifier_block *this,
         default:
                 break;
         }
-        if (qeth_set_thread_start_bit(card, QETH_SET_IP_THREAD) == 0)
-                schedule_work(&card->kernel_thread_starter);
+        qeth_set_ip_addr_list(card);
 out:
         return NOTIFY_DONE;
 }
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index d72df5dae4ee..e16fe361436e 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -1629,7 +1629,6 @@ static int nsp_cs_probe(struct pcmcia_device *link)
         /* General socket configuration */
         link->conf.Attributes    = CONF_ENABLE_IRQ;
         link->conf.IntType       = INT_MEMORY_AND_IO;
-        link->conf.Present       = PRESENT_OPTION;
 
         ret = nsp_cs_config(link);
 
diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index fb7acea60286..9fb0ea5c1fb9 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -895,7 +895,6 @@ SYM53C500_probe(struct pcmcia_device *link)
         link->irq.IRQInfo1 = IRQ_LEVEL_ID;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         link->conf.IntType = INT_MEMORY_AND_IO;
-        link->conf.Present = PRESENT_OPTION;
 
         return SYM53C500_config(link);
 } /* SYM53C500_attach */
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 51f3c739f7e1..5261f0af8b10 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2296,7 +2296,7 @@ serial8250_console_write(struct console *co, const char *s, unsigned int count)
         local_irq_restore(flags);
 }
 
-static int serial8250_console_setup(struct console *co, char *options)
+static int __init serial8250_console_setup(struct console *co, char *options)
 {
         struct uart_port *port;
         int baud = 9600;
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 9d11a75663e6..3c4b6c243712 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -789,7 +789,9 @@ static struct console mpc52xx_console = {
 static int __init
 mpc52xx_console_init(void)
 {
+#if defined(CONFIG_PPC_MERGE)
         mpc52xx_uart_of_enumerate();
+#endif
         register_console(&mpc52xx_console);
         return 0;
 }
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index c8999ae58652..2f4d303ee36f 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -170,7 +170,7 @@ config USB_SERIAL_FTDI_SIO
 
 config USB_SERIAL_FUNSOFT
         tristate "USB Fundamental Software Dongle Driver"
-        depends on USB_SERIAL && !(SPARC || SPARC64)
+        depends on USB_SERIAL
         ---help---
           Say Y here if you want to use the Fundamental Software dongle.
 
diff --git a/drivers/usb/serial/funsoft.c b/drivers/usb/serial/funsoft.c
index d3be9214c7c1..31501c9361b9 100644
--- a/drivers/usb/serial/funsoft.c
+++ b/drivers/usb/serial/funsoft.c
@@ -32,7 +32,7 @@ static int funsoft_ioctl(struct usb_serial_port *port, struct file *file,
         dbg("%s - port %d, cmd 0x%04x", __FUNCTION__, port->number, cmd);
 
         if (cmd == TCSETSF) {
-                if (user_termios_to_kernel_termios(&t, (void __user *)arg))
+                if (user_termios_to_kernel_termios(&t, (struct termios __user *)arg))
                         return -EFAULT;
 
                 dbg("%s - iflag:%x oflag:%x cflag:%x lflag:%x", __FUNCTION__,
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 1715d6b5f411..8b18e43b82fe 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -411,7 +411,7 @@ static void init_once(void * foo, struct kmem_cache * cachep, unsigned long flag
         {
                 memset(bdev, 0, sizeof(*bdev));
                 mutex_init(&bdev->bd_mutex);
-                mutex_init(&bdev->bd_mount_mutex);
+                sema_init(&bdev->bd_mount_sem, 1);
                 INIT_LIST_HEAD(&bdev->bd_inodes);
                 INIT_LIST_HEAD(&bdev->bd_list);
 #ifdef CONFIG_SYSFS
diff --git a/fs/buffer.c b/fs/buffer.c
index 263f88e4dffb..3b116078b4c3 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -180,7 +180,7 @@ int fsync_bdev(struct block_device *bdev)
  * freeze_bdev  --  lock a filesystem and force it into a consistent state
  * @bdev:       blockdevice to lock
  *
- * This takes the block device bd_mount_mutex to make sure no new mounts
+ * This takes the block device bd_mount_sem to make sure no new mounts
  * happen on bdev until thaw_bdev() is called.
  * If a superblock is found on this device, we take the s_umount semaphore
  * on it to make sure nobody unmounts until the snapshot creation is done.
@@ -189,7 +189,7 @@ struct super_block *freeze_bdev(struct block_device *bdev)
 {
         struct super_block *sb;
 
-        mutex_lock(&bdev->bd_mount_mutex);
+        down(&bdev->bd_mount_sem);
         sb = get_super(bdev);
         if (sb && !(sb->s_flags & MS_RDONLY)) {
                 sb->s_frozen = SB_FREEZE_WRITE;
@@ -231,7 +231,7 @@ void thaw_bdev(struct block_device *bdev, struct super_block *sb)
                 drop_super(sb);
         }
 
-        mutex_unlock(&bdev->bd_mount_mutex);
+        up(&bdev->bd_mount_sem);
 }
 EXPORT_SYMBOL(thaw_bdev);
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index d14e139d2674..ee80b8a5e7bc 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -867,9 +867,9 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags,
                 error = -EBUSY;
                 goto error;
         }
-        mutex_lock(&sb->s_bdev->bd_mount_mutex);
+        down(&sb->s_bdev->bd_mount_sem);
         new = sget(fs_type, test_bdev_super, set_bdev_super, sb->s_bdev);
-        mutex_unlock(&sb->s_bdev->bd_mount_mutex);
+        up(&sb->s_bdev->bd_mount_sem);
         if (IS_ERR(new)) {
                 error = PTR_ERR(new);
                 goto error;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 0dd6be346aa7..fab20d06d936 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -315,14 +315,13 @@ static void nfs_invalidate_page(struct page *page, unsigned long offset)
 
 static int nfs_release_page(struct page *page, gfp_t gfp)
 {
-        /*
-         * Avoid deadlock on nfs_wait_on_request().
-         */
-        if (!(gfp & __GFP_FS))
-                return 0;
-        /* Hack... Force nfs_wb_page() to write out the page */
-        SetPageDirty(page);
-        return !nfs_wb_page(page->mapping->host, page);
+        /* If PagePrivate() is set, then the page is not freeable */
+        return 0;
+}
+
+static int nfs_launder_page(struct page *page)
+{
+        return nfs_wb_page(page->mapping->host, page);
 }
 
 const struct address_space_operations nfs_file_aops = {
@@ -338,6 +337,7 @@ const struct address_space_operations nfs_file_aops = {
 #ifdef CONFIG_NFS_DIRECTIO
         .direct_IO = nfs_direct_IO,
 #endif
+        .launder_page = nfs_launder_page,
 };
 
 static ssize_t nfs_file_write(struct kiocb *iocb, const struct iovec *iov,
diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
index 92ea7743fe8f..b37ce33f67ea 100644
--- a/fs/proc/proc_misc.c
+++ b/fs/proc/proc_misc.c
@@ -47,7 +47,6 @@
 #include <linux/vmalloc.h>
 #include <linux/crash_dump.h>
 #include <linux/pid_namespace.h>
-#include <linux/compile.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
@@ -254,12 +253,7 @@ static int version_read_proc(char *page, char **start, off_t off,
 {
         int len;
 
-        /* FIXED STRING! Don't touch! */
-        len = snprintf(page, PAGE_SIZE,
-                "%s version %s"
-                " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ")"
-                " (" LINUX_COMPILER ")"
-                " %s\n",
+        len = snprintf(page, PAGE_SIZE, linux_proc_banner,
                 utsname()->sysname,
                 utsname()->release,
                 utsname()->version);
diff --git a/fs/super.c b/fs/super.c
index f961e0307997..3e7458c2bb76 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -753,9 +753,9 @@ int get_sb_bdev(struct file_system_type *fs_type,
          * will protect the lockfs code from trying to start a snapshot
          * while we are mounting
          */
-        mutex_lock(&bdev->bd_mount_mutex);
+        down(&bdev->bd_mount_sem);
         s = sget(fs_type, test_bdev_super, set_bdev_super, bdev);
-        mutex_unlock(&bdev->bd_mount_mutex);
+        up(&bdev->bd_mount_sem);
         if (IS_ERR(s))
                 goto error_s;
 
diff --git a/include/asm-alpha/posix_types.h b/include/asm-alpha/posix_types.h
index c78c04a94f4e..db167413300b 100644
--- a/include/asm-alpha/posix_types.h
+++ b/include/asm-alpha/posix_types.h
@@ -49,7 +49,7 @@ typedef unsigned int	__kernel_old_dev_t;
 #define __FD_CLR(d, set)        ((set)->fds_bits[__FDELT(d)] &= ~__FDMASK(d))
 #define __FD_ISSET(d, set)      (((set)->fds_bits[__FDELT(d)] & __FDMASK(d)) != 0)
 #define __FD_ZERO(set)  \
-  ((void) memset ((__ptr_t) (set), 0, sizeof (__kernel_fd_set)))
+  ((void) memset ((void *) (set), 0, sizeof (__kernel_fd_set)))
 
 #else /* __GNUC__ */
 
diff --git a/include/asm-arm/arch-iop32x/iop32x.h b/include/asm-arm/arch-iop32x/iop32x.h
index 4bbd85f3ed2a..2e9469047eb1 100644
--- a/include/asm-arm/arch-iop32x/iop32x.h
+++ b/include/asm-arm/arch-iop32x/iop32x.h
@@ -19,7 +19,7 @@
  * Peripherals that are shared between the iop32x and iop33x but
  * located at different addresses.
  */
-#define IOP3XX_GPIO_REG(reg)    (IOP3XX_PERIPHERAL_VIRT_BASE + 0x07c0 + (reg))
+#define IOP3XX_GPIO_REG(reg)    (IOP3XX_PERIPHERAL_VIRT_BASE + 0x07c4 + (reg))
 #define IOP3XX_TIMER_REG(reg)   (IOP3XX_PERIPHERAL_VIRT_BASE + 0x07e0 + (reg))
 
 #include <asm/hardware/iop3xx.h>
diff --git a/include/asm-arm/cacheflush.h b/include/asm-arm/cacheflush.h
index d51049522cd0..5f531ea03059 100644
--- a/include/asm-arm/cacheflush.h
+++ b/include/asm-arm/cacheflush.h
@@ -357,6 +357,16 @@ extern void flush_dcache_page(struct page *);
 
 extern void __flush_dcache_page(struct address_space *mapping, struct page *page);
 
+#define ARCH_HAS_FLUSH_ANON_PAGE
+static inline void flush_anon_page(struct vm_area_struct *vma,
+                         struct page *page, unsigned long vmaddr)
+{
+        extern void __flush_anon_page(struct vm_area_struct *vma,
+                                struct page *, unsigned long);
+        if (PageAnon(page))
+                __flush_anon_page(vma, page, vmaddr);
+}
+
 #define flush_dcache_mmap_lock(mapping) \
         write_lock_irq(&(mapping)->tree_lock)
 #define flush_dcache_mmap_unlock(mapping) \
diff --git a/include/asm-arm/hardware/iop3xx.h b/include/asm-arm/hardware/iop3xx.h
index 1018a7486ab7..13ac8a4cd01f 100644
--- a/include/asm-arm/hardware/iop3xx.h
+++ b/include/asm-arm/hardware/iop3xx.h
@@ -168,9 +168,9 @@ extern void gpio_line_set(int line, int value);
 #define IOP3XX_PERCR0           (volatile u32 *)IOP3XX_REG_ADDR(0x0710)
 
 /* General Purpose I/O  */
-#define IOP3XX_GPOE             (volatile u32 *)IOP3XX_GPIO_REG(0x0004)
-#define IOP3XX_GPID             (volatile u32 *)IOP3XX_GPIO_REG(0x0008)
-#define IOP3XX_GPOD             (volatile u32 *)IOP3XX_GPIO_REG(0x000c)
+#define IOP3XX_GPOE             (volatile u32 *)IOP3XX_GPIO_REG(0x0000)
+#define IOP3XX_GPID             (volatile u32 *)IOP3XX_GPIO_REG(0x0004)
+#define IOP3XX_GPOD             (volatile u32 *)IOP3XX_GPIO_REG(0x0008)
 
 /* Timers  */
 #define IOP3XX_TU_TMR0          (volatile u32 *)IOP3XX_TIMER_REG(0x0000)
diff --git a/include/asm-ia64/posix_types.h b/include/asm-ia64/posix_types.h
index adb62272694f..17885567b731 100644
--- a/include/asm-ia64/posix_types.h
+++ b/include/asm-ia64/posix_types.h
@@ -54,7 +54,7 @@ typedef unsigned int	__kernel_old_dev_t;
 #define __FD_CLR(d, set)        ((set)->fds_bits[__FDELT(d)] &= ~__FDMASK(d))
 #define __FD_ISSET(d, set)      (((set)->fds_bits[__FDELT(d)] & __FDMASK(d)) != 0)
 #define __FD_ZERO(set)  \
-  ((void) memset ((__ptr_t) (set), 0, sizeof (__kernel_fd_set)))
+  ((void) memset ((void *) (set), 0, sizeof (__kernel_fd_set)))
 
 #  else /* !__GNUC__ */
 
diff --git a/include/asm-mips/checksum.h b/include/asm-mips/checksum.h
index 9b768c3b96b3..24cdcc6eaab8 100644
--- a/include/asm-mips/checksum.h
+++ b/include/asm-mips/checksum.h
@@ -29,31 +29,38 @@
  */
 __wsum csum_partial(const void *buff, int len, __wsum sum);
 
+__wsum __csum_partial_copy_user(const void *src, void *dst,
+                                int len, __wsum sum, int *err_ptr);
+
 /*
  * this is a new version of the above that records errors it finds in *errp,
  * but continues and zeros the rest of the buffer.
  */
-__wsum csum_partial_copy_from_user(const void __user *src,
-                                         void *dst, int len,
-                                         __wsum sum, int *errp);
+static inline
+__wsum csum_partial_copy_from_user(const void __user *src, void *dst, int len,
+                                   __wsum sum, int *err_ptr)
+{
+        might_sleep();
+        return __csum_partial_copy_user((__force void *)src, dst,
+                                        len, sum, err_ptr);
+}
 
 /*
  * Copy and checksum to user
  */
 #define HAVE_CSUM_COPY_USER
-static inline __wsum csum_and_copy_to_user (const void *src, void __user *dst,
-                                                  int len, __wsum sum,
-                                                  int *err_ptr)
+static inline
+__wsum csum_and_copy_to_user(const void *src, void __user *dst, int len,
+                             __wsum sum, int *err_ptr)
 {
         might_sleep();
-        sum = csum_partial(src, len, sum);
-
-        if (copy_to_user(dst, src, len)) {
+        if (access_ok(VERIFY_WRITE, dst, len))
+                return __csum_partial_copy_user(src, (__force void *)dst,
+                                                len, sum, err_ptr);
+        if (len)
                 *err_ptr = -EFAULT;
-                return (__force __wsum)-1;
-        }
 
-        return sum;
+        return (__force __wsum)-1; /* invalid checksum */
 }
 
 /*
diff --git a/include/asm-mips/irq.h b/include/asm-mips/irq.h
index 67657089efa7..386da82e5774 100644
--- a/include/asm-mips/irq.h
+++ b/include/asm-mips/irq.h
@@ -31,14 +31,14 @@ static inline int irq_canonicalize(int irq)
  * functions will take over re-enabling the low-level mask.
  * Otherwise it will be done on return from exception.
  */
-#define __DO_IRQ_SMTC_HOOK()                                            \
+#define __DO_IRQ_SMTC_HOOK(irq)                                         \
 do {                                                                    \
         if (irq_hwmask[irq] & 0x0000ff00)                               \
                 write_c0_tccontext(read_c0_tccontext() &                \
                                    ~(irq_hwmask[irq] & 0x0000ff00));    \
 } while (0)
 #else
-#define __DO_IRQ_SMTC_HOOK() do { } while (0)
+#define __DO_IRQ_SMTC_HOOK(irq) do { } while (0)
 #endif
 
 /*
@@ -52,7 +52,7 @@ do {									\
 #define do_IRQ(irq)                                                     \
 do {                                                                    \
         irq_enter();                                                    \
-        __DO_IRQ_SMTC_HOOK();                                           \
+        __DO_IRQ_SMTC_HOOK(irq);                                        \
         generic_handle_irq(irq);                                        \
         irq_exit();                                                     \
 } while (0)
diff --git a/include/asm-parisc/cacheflush.h b/include/asm-parisc/cacheflush.h
index aedb0512cb04..a799dd8ef395 100644
--- a/include/asm-parisc/cacheflush.h
+++ b/include/asm-parisc/cacheflush.h
@@ -186,7 +186,7 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long
 }
 
 static inline void
-flush_anon_page(struct page *page, unsigned long vmaddr)
+flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
 {
         if (PageAnon(page))
                 flush_user_dcache_page(vmaddr);
diff --git a/include/asm-powerpc/bug.h b/include/asm-powerpc/bug.h
index 709568879f73..f6fa39474846 100644
--- a/include/asm-powerpc/bug.h
+++ b/include/asm-powerpc/bug.h
@@ -11,10 +11,31 @@
 #define BUG_OPCODE .long 0x00b00b00  /* For asm */
 #define BUG_ILLEGAL_INSTR "0x00b00b00" /* For BUG macro */
 
-#ifndef __ASSEMBLY__
-
 #ifdef CONFIG_BUG
 
+#ifdef __ASSEMBLY__
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+.macro EMIT_BUG_ENTRY addr,file,line,flags
+         .section __bug_table,"a"
+5001:    PPC_LONG \addr, 5002f
+         .short \line, \flags
+         .org 5001b+BUG_ENTRY_SIZE
+         .previous
+         .section .rodata,"a"
+5002:    .asciz "\file"
+         .previous
+.endm
+#else
+ .macro EMIT_BUG_ENTRY addr,file,line,flags
+         .section __bug_table,"a"
+5001:    PPC_LONG \addr
+         .short \flags
+         .org 5001b+BUG_ENTRY_SIZE
+         .previous
+.endm
+#endif /* verbose */
+
+#else /* !__ASSEMBLY__ */
 /* _EMIT_BUG_ENTRY expects args %0,%1,%2,%3 to be FILE, LINE, flags and
    sizeof(struct bug_entry), respectively */
 #ifdef CONFIG_DEBUG_BUGVERBOSE
@@ -91,8 +112,8 @@
 #define HAVE_ARCH_BUG
 #define HAVE_ARCH_BUG_ON
 #define HAVE_ARCH_WARN_ON
-#endif /* CONFIG_BUG */
 #endif /* __ASSEMBLY __ */
+#endif /* CONFIG_BUG */
 
 #include <asm-generic/bug.h>
 
diff --git a/include/asm-powerpc/hvcall.h b/include/asm-powerpc/hvcall.h
index 257d1cecb8c9..7a500732b671 100644
--- a/include/asm-powerpc/hvcall.h
+++ b/include/asm-powerpc/hvcall.h
@@ -252,8 +252,6 @@ struct hcall_stats {
         unsigned long   tb_total;       /* total wall time (mftb) of calls. */
         unsigned long   purr_total;     /* total cpu time (PURR) of calls. */
 };
-void update_hcall_stats(unsigned long opcode, unsigned long tb_delta,
-                        unsigned long purr_delta);
 #define HCALL_STAT_ARRAY_SIZE   ((MAX_HCALL_OPCODE >> 2) + 1)
 
 #endif /* __ASSEMBLY__ */
diff --git a/include/asm-powerpc/mpc52xx.h b/include/asm-powerpc/mpc52xx.h
index 4a28a850998c..4560d72fc758 100644
--- a/include/asm-powerpc/mpc52xx.h
+++ b/include/asm-powerpc/mpc52xx.h
@@ -244,6 +244,7 @@ struct mpc52xx_cdm {
 extern void __iomem * mpc52xx_find_and_map(const char *);
 extern unsigned int mpc52xx_find_ipb_freq(struct device_node *node);
 extern void mpc52xx_setup_cpu(void);
+extern void mpc52xx_declare_of_platform_devices(void);
 
 extern void mpc52xx_init_irq(void);
 extern unsigned int mpc52xx_get_irq(void);
diff --git a/include/asm-powerpc/posix_types.h b/include/asm-powerpc/posix_types.h
index c6391077224f..2f2288f520be 100644
--- a/include/asm-powerpc/posix_types.h
+++ b/include/asm-powerpc/posix_types.h
@@ -60,7 +60,7 @@ typedef struct {
 #define __FD_CLR(d, set)        ((set)->fds_bits[__FDELT(d)] &= ~__FDMASK(d))
 #define __FD_ISSET(d, set)      (((set)->fds_bits[__FDELT(d)] & __FDMASK(d)) != 0)
 #define __FD_ZERO(set)  \
-  ((void) memset ((__ptr_t) (set), 0, sizeof (__kernel_fd_set)))
+  ((void) memset ((void *) (set), 0, sizeof (__kernel_fd_set)))
 
 #else /* __GNUC__ */
 
diff --git a/include/asm-s390/futex.h b/include/asm-s390/futex.h
index 5e261e1de671..5c5d02de49e9 100644
--- a/include/asm-s390/futex.h
+++ b/include/asm-s390/futex.h
@@ -4,8 +4,8 @@
 #ifdef __KERNEL__
 
 #include <linux/futex.h>
+#include <linux/uaccess.h>
 #include <asm/errno.h>
-#include <asm/uaccess.h>
 
 static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
 {
@@ -21,7 +21,9 @@ static inline int futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
         if (! access_ok (VERIFY_WRITE, uaddr, sizeof(int)))
                 return -EFAULT;
 
+        pagefault_disable();
         ret = uaccess.futex_atomic_op(op, uaddr, oparg, &oldval);
+        pagefault_enable();
 
         if (!ret) {
                 switch (cmp) {
diff --git a/include/asm-s390/posix_types.h b/include/asm-s390/posix_types.h
index b94c98856e12..397d93fba3a7 100644
--- a/include/asm-s390/posix_types.h
+++ b/include/asm-s390/posix_types.h
@@ -104,7 +104,7 @@ static inline int __FD_ISSET(unsigned long fd, const __kernel_fd_set *fdsetp)
 
 #undef  __FD_ZERO
 #define __FD_ZERO(fdsetp) \
-        ((void) memset ((__ptr_t) (fdsetp), 0, sizeof (__kernel_fd_set)))
+        ((void) memset ((void *) (fdsetp), 0, sizeof (__kernel_fd_set)))
 
 #endif     /* __KERNEL__ */
 
diff --git a/include/asm-x86_64/bitops.h b/include/asm-x86_64/bitops.h
index 5b535eaf5309..8da9609070f4 100644
--- a/include/asm-x86_64/bitops.h
+++ b/include/asm-x86_64/bitops.h
@@ -7,7 +7,13 @@
 
 #include <asm/alternative.h>
 
-#define ADDR (*(volatile long *) addr)
+#if __GNUC__ < 4 || __GNUC_MINOR__ < 1
+/* Technically wrong, but this avoids compilation errors on some gcc
+   versions. */
+#define ADDR "=m" (*(volatile long *) addr)
+#else
+#define ADDR "+m" (*(volatile long *) addr)
+#endif
 
 /**
  * set_bit - Atomically set a bit in memory
@@ -23,7 +29,7 @@ static __inline__ void set_bit(int nr, volatile void * addr)
 {
         __asm__ __volatile__( LOCK_PREFIX
                 "btsl %1,%0"
-                :"+m" (ADDR)
+                :ADDR
                 :"dIr" (nr) : "memory");
 }
 
@@ -40,7 +46,7 @@ static __inline__ void __set_bit(int nr, volatile void * addr)
 {
         __asm__ volatile(
                 "btsl %1,%0"
-                :"+m" (ADDR)
+                :ADDR
                 :"dIr" (nr) : "memory");
 }
 
@@ -58,7 +64,7 @@ static __inline__ void clear_bit(int nr, volatile void * addr)
 {
         __asm__ __volatile__( LOCK_PREFIX
                 "btrl %1,%0"
-                :"+m" (ADDR)
+                :ADDR
                 :"dIr" (nr));
 }
 
@@ -66,7 +72,7 @@ static __inline__ void __clear_bit(int nr, volatile void * addr)
 {
         __asm__ __volatile__(
                 "btrl %1,%0"
-                :"+m" (ADDR)
+                :ADDR
                 :"dIr" (nr));
 }
 
@@ -86,7 +92,7 @@ static __inline__ void __change_bit(int nr, volatile void * addr)
 {
         __asm__ __volatile__(
                 "btcl %1,%0"
-                :"+m" (ADDR)
+                :ADDR
                 :"dIr" (nr));
 }
 
@@ -103,7 +109,7 @@ static __inline__ void change_bit(int nr, volatile void * addr)
 {
         __asm__ __volatile__( LOCK_PREFIX
                 "btcl %1,%0"
-                :"+m" (ADDR)
+                :ADDR
                 :"dIr" (nr));
 }
 
@@ -121,7 +127,7 @@ static __inline__ int test_and_set_bit(int nr, volatile void * addr)
 
         __asm__ __volatile__( LOCK_PREFIX
                 "btsl %2,%1\n\tsbbl %0,%0"
-                :"=r" (oldbit),"+m" (ADDR)
+                :"=r" (oldbit),ADDR
                 :"dIr" (nr) : "memory");
         return oldbit;
 }
@@ -141,7 +147,7 @@ static __inline__ int __test_and_set_bit(int nr, volatile void * addr)
 
         __asm__(
                 "btsl %2,%1\n\tsbbl %0,%0"
-                :"=r" (oldbit),"+m" (ADDR)
+                :"=r" (oldbit),ADDR
                 :"dIr" (nr));
         return oldbit;
 }
@@ -160,7 +166,7 @@ static __inline__ int test_and_clear_bit(int nr, volatile void * addr)
 
         __asm__ __volatile__( LOCK_PREFIX
                 "btrl %2,%1\n\tsbbl %0,%0"
-                :"=r" (oldbit),"+m" (ADDR)
+                :"=r" (oldbit),ADDR
                 :"dIr" (nr) : "memory");
         return oldbit;
 }
@@ -180,7 +186,7 @@ static __inline__ int __test_and_clear_bit(int nr, volatile void * addr)
 
         __asm__(
                 "btrl %2,%1\n\tsbbl %0,%0"
-                :"=r" (oldbit),"+m" (ADDR)
+                :"=r" (oldbit),ADDR
                 :"dIr" (nr));
         return oldbit;
 }
@@ -192,7 +198,7 @@ static __inline__ int __test_and_change_bit(int nr, volatile void * addr)
 
         __asm__ __volatile__(
                 "btcl %2,%1\n\tsbbl %0,%0"
-                :"=r" (oldbit),"+m" (ADDR)
+                :"=r" (oldbit),ADDR
                 :"dIr" (nr) : "memory");
         return oldbit;
 }
@@ -211,7 +217,7 @@ static __inline__ int test_and_change_bit(int nr, volatile void * addr)
 
         __asm__ __volatile__( LOCK_PREFIX
                 "btcl %2,%1\n\tsbbl %0,%0"
-                :"=r" (oldbit),"+m" (ADDR)
+                :"=r" (oldbit),ADDR
                 :"dIr" (nr) : "memory");
         return oldbit;
 }
@@ -237,7 +243,7 @@ static __inline__ int variable_test_bit(int nr, volatile const void * addr)
         __asm__ __volatile__(
                 "btl %2,%1\n\tsbbl %0,%0"
                 :"=r" (oldbit)
-                :"m" (ADDR),"dIr" (nr));
+                :"m" (*(volatile long *)addr),"dIr" (nr));
         return oldbit;
 }
 
diff --git a/include/asm-xtensa/posix_types.h b/include/asm-xtensa/posix_types.h
index 3470b44c12ce..4ad77dda6d5f 100644
--- a/include/asm-xtensa/posix_types.h
+++ b/include/asm-xtensa/posix_types.h
@@ -60,7 +60,7 @@ typedef struct {
 #define __FD_CLR(d, set)        ((set)->fds_bits[__FDELT(d)] &= ~__FDMASK(d))
 #define __FD_ISSET(d, set)      ((set)->fds_bits[__FDELT(d)] & __FDMASK(d))
 #define __FD_ZERO(set)  \
-  ((void) memset ((__ptr_t) (set), 0, sizeof (__kernel_fd_set)))
+  ((void) memset ((void *) (set), 0, sizeof (__kernel_fd_set)))
 
 #else /* __GNUC__ */
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 186da813541e..1410e5330c8d 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -426,6 +426,7 @@ struct address_space_operations {
         /* migrate the contents of a page to the specified target */
         int (*migratepage) (struct address_space *,
                         struct page *, struct page *);
+        int (*launder_page) (struct page *);
 };
 
 struct backing_dev_info;
@@ -458,7 +459,7 @@ struct block_device {
         struct inode *          bd_inode;       /* will die */
         int                     bd_openers;
         struct mutex            bd_mutex;       /* open/close mutex */
-        struct mutex            bd_mount_mutex; /* mount mutex */
+        struct semaphore        bd_mount_sem;
         struct list_head        bd_inodes;
         void *                  bd_holder;
         int                     bd_holders;
diff --git a/include/linux/highmem.h b/include/linux/highmem.h
index ca9a602cffd7..645d440807c2 100644
--- a/include/linux/highmem.h
+++ b/include/linux/highmem.h
@@ -8,7 +8,7 @@
 #include <asm/cacheflush.h>
 
 #ifndef ARCH_HAS_FLUSH_ANON_PAGE
-static inline void flush_anon_page(struct page *page, unsigned long vmaddr)
+static inline void flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vmaddr)
 {
 }
 #endif
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index b0c4a05a4b0c..63fb18dcac30 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -17,6 +17,9 @@
 #include <asm/byteorder.h>
 #include <asm/bug.h>
 
+extern const char linux_banner[];
+extern const char linux_proc_banner[];
+
 #define INT_MAX         ((int)(~0U>>1))
 #define INT_MIN         (-INT_MAX - 1)
 #define UINT_MAX        (~0U)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index a17b147c61e7..76912231af41 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -978,7 +978,8 @@ extern int early_pfn_to_nid(unsigned long pfn);
 #endif /* CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID */
 #endif /* CONFIG_ARCH_POPULATES_NODE_MAP */
 extern void set_dma_reserve(unsigned long new_dma_reserve);
-extern void memmap_init_zone(unsigned long, int, unsigned long, unsigned long);
+extern void memmap_init_zone(unsigned long, int, unsigned long,
+                                unsigned long, enum memmap_context);
 extern void setup_per_zone_pages_min(void);
 extern void mem_init(void);
 extern void show_mem(void);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index e339a7345f25..b262f47961fb 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -450,9 +450,13 @@ void build_all_zonelists(void);
 void wakeup_kswapd(struct zone *zone, int order);
 int zone_watermark_ok(struct zone *z, int order, unsigned long mark,
                 int classzone_idx, int alloc_flags);
-
+enum memmap_context {
+        MEMMAP_EARLY,
+        MEMMAP_HOTPLUG,
+};
 extern int init_currently_empty_zone(struct zone *zone, unsigned long start_pfn,
-                                     unsigned long size);
+                                     unsigned long size,
+                                     enum memmap_context context);
 
 #ifdef CONFIG_HAVE_MEMORY_PRESENT
 void memory_present(int nid, unsigned long start, unsigned long end);
diff --git a/include/linux/netfilter/nf_conntrack_tcp.h b/include/linux/netfilter/nf_conntrack_tcp.h
index 6b01ba297727..2f4e98b90cc0 100644
--- a/include/linux/netfilter/nf_conntrack_tcp.h
+++ b/include/linux/netfilter/nf_conntrack_tcp.h
@@ -25,7 +25,7 @@ enum tcp_conntrack {
 #define IP_CT_TCP_FLAG_SACK_PERM                0x02
 
 /* This sender sent FIN first */
-#define IP_CT_TCP_FLAG_CLOSE_INIT               0x03
+#define IP_CT_TCP_FLAG_CLOSE_INIT               0x04
 
 #ifdef __KERNEL__
 
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 0be235418a2f..24c8786d12e9 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -190,6 +190,7 @@ struct arpt_replace
 
 /* The argument to ARPT_SO_ADD_COUNTERS. */
 #define arpt_counters_info xt_counters_info
+#define arpt_counters xt_counters
 
 /* The argument to ARPT_SO_GET_ENTRIES. */
 struct arpt_get_entries
diff --git a/include/linux/profile.h b/include/linux/profile.h
index 5670b340c4ef..eec48f5f9348 100644
--- a/include/linux/profile.h
+++ b/include/linux/profile.h
@@ -15,6 +15,7 @@ extern int prof_on __read_mostly;
 #define CPU_PROFILING   1
 #define SCHED_PROFILING 2
 #define SLEEP_PROFILING 3
+#define KVM_PROFILING   4
 
 struct proc_dir_entry;
 struct pt_regs;
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index e6af381e206d..e02d85f56e60 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -218,7 +218,7 @@ struct ieee80211_snap_hdr {
 #define WLAN_FC_GET_STYPE(fc) ((fc) & IEEE80211_FCTL_STYPE)
 
 #define WLAN_GET_SEQ_FRAG(seq) ((seq) & IEEE80211_SCTL_FRAG)
-#define WLAN_GET_SEQ_SEQ(seq)  ((seq) & IEEE80211_SCTL_SEQ)
+#define WLAN_GET_SEQ_SEQ(seq)  (((seq) & IEEE80211_SCTL_SEQ) >> 4)
 
 /* Authentication algorithms */
 #define WLAN_AUTH_OPEN 0
diff --git a/include/sound/version.h b/include/sound/version.h
index 2949b9b991b5..20f7babad514 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
 #define CONFIG_SND_VERSION "1.0.14rc1"
-#define CONFIG_SND_DATE " (Wed Dec 20 08:11:48 2006 UTC)"
+#define CONFIG_SND_DATE " (Tue Jan 09 09:56:17 2007 UTC)"
diff --git a/init/Makefile b/init/Makefile
index 9cd871ce5784..633a268d270d 100644
--- a/init/Makefile
+++ b/init/Makefile
@@ -15,6 +15,14 @@ clean-files := ../include/linux/compile.h
 
 # dependencies on generated files need to be listed explicitly
 
-$(obj)/main.o: include/linux/compile.h
 $(obj)/version.o: include/linux/compile.h
 
+# compile.h changes depending on hostname, generation number, etc,
+# so we regenerate it always.
+# mkcompile_h will make sure to only update the
+# actual file if its content has changed.
+
+include/linux/compile.h: FORCE
+        @echo '  CHK     $@'
+        $(Q)$(CONFIG_SHELL) $(srctree)/scripts/mkcompile_h $@ \
+        "$(UTS_MACHINE)" "$(CONFIG_SMP)" "$(CONFIG_PREEMPT)" "$(CC) $(CFLAGS)"
diff --git a/init/main.c b/init/main.c
index bc27d72bbb19..8b4a7d769162 100644
--- a/init/main.c
+++ b/init/main.c
@@ -50,9 +50,7 @@
 #include <linux/buffer_head.h>
 #include <linux/debug_locks.h>
 #include <linux/lockdep.h>
-#include <linux/utsrelease.h>
 #include <linux/pid_namespace.h>
-#include <linux/compile.h>
 #include <linux/device.h>
 
 #include <asm/io.h>
@@ -482,12 +480,6 @@ void __init __attribute__((weak)) smp_setup_processor_id(void)
 {
 }
 
-static const char linux_banner[] =
-        "Linux version " UTS_RELEASE
-        " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ")"
-        " (" LINUX_COMPILER ")"
-        " " UTS_VERSION "\n";
-
 asmlinkage void __init start_kernel(void)
 {
         char * command_line;
@@ -703,7 +695,7 @@ static void __init do_basic_setup(void)
         do_initcalls();
 }
 
-static void do_pre_smp_initcalls(void)
+static void __init do_pre_smp_initcalls(void)
 {
         extern int spawn_ksoftirqd(void);
 #ifdef CONFIG_SMP
diff --git a/init/version.c b/init/version.c
index 9d96d36501ca..6c01ec1cc48d 100644
--- a/init/version.c
+++ b/init/version.c
@@ -33,3 +33,13 @@ struct uts_namespace init_uts_ns = {
         },
 };
 EXPORT_SYMBOL_GPL(init_uts_ns);
+
+/* FIXED STRINGS! Don't touch! */
+const char linux_banner[] =
+        "Linux version " UTS_RELEASE " (" LINUX_COMPILE_BY "@"
+        LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION "\n";
+
+const char linux_proc_banner[] =
+        "%s version %s"
+        " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ")"
+        " (" LINUX_COMPILER ") %s\n";
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 241064a32241..7406fe6966f9 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -204,7 +204,7 @@ int cpu_down(unsigned int cpu)
 #endif /*CONFIG_HOTPLUG_CPU*/
 
 /* Requires cpu_add_remove_lock to be held */
-static int __devinit _cpu_up(unsigned int cpu)
+static int __cpuinit _cpu_up(unsigned int cpu)
 {
         int ret;
         void *hcpu = (void *)(long)cpu;
@@ -239,7 +239,7 @@ out_notify:
         return ret;
 }
 
-int __devinit cpu_up(unsigned int cpu)
+int __cpuinit cpu_up(unsigned int cpu)
 {
         int err = 0;
 
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 543ea2e5ad93..9d8c79b48823 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -176,7 +176,7 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
 
 int noirqdebug __read_mostly;
 
-int __init noirqdebug_setup(char *str)
+int noirqdebug_setup(char *str)
 {
         noirqdebug = 1;
         printk(KERN_INFO "IRQ lockup detection disabled\n");
diff --git a/kernel/profile.c b/kernel/profile.c
index 11550b2290b6..a6574a18514e 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -40,7 +40,10 @@ int (*timer_hook)(struct pt_regs *) __read_mostly;
 
 static atomic_t *prof_buffer;
 static unsigned long prof_len, prof_shift;
+
 int prof_on __read_mostly;
+EXPORT_SYMBOL_GPL(prof_on);
+
 static cpumask_t prof_cpu_mask = CPU_MASK_ALL;
 #ifdef CONFIG_SMP
 static DEFINE_PER_CPU(struct profile_hit *[2], cpu_profile_hits);
@@ -52,6 +55,7 @@ static int __init profile_setup(char * str)
 {
         static char __initdata schedstr[] = "schedule";
         static char __initdata sleepstr[] = "sleep";
+        static char __initdata kvmstr[] = "kvm";
         int par;
 
         if (!strncmp(str, sleepstr, strlen(sleepstr))) {
@@ -72,6 +76,15 @@ static int __init profile_setup(char * str)
                 printk(KERN_INFO
                         "kernel schedule profiling enabled (shift: %ld)\n",
                         prof_shift);
+        } else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
+                prof_on = KVM_PROFILING;
+                if (str[strlen(kvmstr)] == ',')
+                        str += strlen(kvmstr) + 1;
+                if (get_option(&str, &par))
+                        prof_shift = par;
+                printk(KERN_INFO
+                        "kernel KVM profiling enabled (shift: %ld)\n",
+                        prof_shift);
         } else if (get_option(&str, &par)) {
                 prof_shift = par;
                 prof_on = CPU_PROFILING;
@@ -318,6 +331,7 @@ out:
         local_irq_restore(flags);
         put_cpu();
 }
+EXPORT_SYMBOL_GPL(profile_hits);
 
 static int __devinit profile_cpu_callback(struct notifier_block *info,
                                         unsigned long action, void *__cpu)
diff --git a/kernel/sched.c b/kernel/sched.c
index 3df33da0dafc..cca93cc0dd7d 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -6865,7 +6865,7 @@ void __init sched_init_smp(void)
 
         lock_cpu_hotplug();
         arch_init_sched_domains(&cpu_online_map);
-        cpus_andnot(non_isolated_cpus, cpu_online_map, cpu_isolated_map);
+        cpus_andnot(non_isolated_cpus, cpu_possible_map, cpu_isolated_map);
         if (cpus_empty(non_isolated_cpus))
                 cpu_set(smp_processor_id(), non_isolated_cpus);
         unlock_cpu_hotplug();
diff --git a/mm/memory.c b/mm/memory.c
index 563792f4f687..af227d26e104 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1091,7 +1091,7 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         if (pages) {
                                 pages[i] = page;
 
-                                flush_anon_page(page, start);
+                                flush_anon_page(vma, page, start);
                                 flush_dcache_page(page);
                         }
                         if (vmas)
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 0c055a090f4d..84279127fcd3 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -67,11 +67,13 @@ static int __add_zone(struct zone *zone, unsigned long phys_start_pfn)
         zone_type = zone - pgdat->node_zones;
         if (!populated_zone(zone)) {
                 int ret = 0;
-                ret = init_currently_empty_zone(zone, phys_start_pfn, nr_pages);
+                ret = init_currently_empty_zone(zone, phys_start_pfn,
+                                                nr_pages, MEMMAP_HOTPLUG);
                 if (ret < 0)
                         return ret;
         }
-        memmap_init_zone(nr_pages, nid, zone_type, phys_start_pfn);
+        memmap_init_zone(nr_pages, nid, zone_type,
+                         phys_start_pfn, MEMMAP_HOTPLUG);
         return 0;
 }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a49f96b7ea43..fc5b5442e942 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1956,17 +1956,24 @@ static inline unsigned long wait_table_bits(unsigned long size)
  * done. Non-atomic initialization, single-pass.
  */
 void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
-                unsigned long start_pfn)
+                unsigned long start_pfn, enum memmap_context context)
 {
         struct page *page;
         unsigned long end_pfn = start_pfn + size;
         unsigned long pfn;
 
         for (pfn = start_pfn; pfn < end_pfn; pfn++) {
-                if (!early_pfn_valid(pfn))
-                        continue;
-                if (!early_pfn_in_nid(pfn, nid))
-                        continue;
+                /*
+                 * There can be holes in boot-time mem_map[]s
+                 * handed to this function.  They do not
+                 * exist on hotplugged memory.
+                 */
+                if (context == MEMMAP_EARLY) {
+                        if (!early_pfn_valid(pfn))
+                                continue;
+                        if (!early_pfn_in_nid(pfn, nid))
+                                continue;
+                }
                 page = pfn_to_page(pfn);
                 set_page_links(page, zone, nid, pfn);
                 init_page_count(page);
@@ -1993,7 +2000,7 @@ void zone_init_free_lists(struct pglist_data *pgdat, struct zone *zone,
 
 #ifndef __HAVE_ARCH_MEMMAP_INIT
 #define memmap_init(size, nid, zone, start_pfn) \
-        memmap_init_zone((size), (nid), (zone), (start_pfn))
+        memmap_init_zone((size), (nid), (zone), (start_pfn), MEMMAP_EARLY)
 #endif
 
 static int __cpuinit zone_batchsize(struct zone *zone)
@@ -2239,7 +2246,8 @@ static __meminit void zone_pcp_init(struct zone *zone)
 
 __meminit int init_currently_empty_zone(struct zone *zone,
                                         unsigned long zone_start_pfn,
-                                        unsigned long size)
+                                        unsigned long size,
+                                        enum memmap_context context)
 {
         struct pglist_data *pgdat = zone->zone_pgdat;
         int ret;
@@ -2683,7 +2691,8 @@ static void __meminit free_area_init_core(struct pglist_data *pgdat,
                 if (!size)
                         continue;
 
-                ret = init_currently_empty_zone(zone, zone_start_pfn, size);
+                ret = init_currently_empty_zone(zone, zone_start_pfn,
+                                                size, MEMMAP_EARLY);
                 BUG_ON(ret);
                 zone_start_pfn += size;
         }
diff --git a/mm/truncate.c b/mm/truncate.c
index ecdfdcc50522..6c79ca4a1ca7 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -341,6 +341,15 @@ failed:
         return 0;
 }
 
+static int do_launder_page(struct address_space *mapping, struct page *page)
+{
+        if (!PageDirty(page))
+                return 0;
+        if (page->mapping != mapping || mapping->a_ops->launder_page == NULL)
+                return 0;
+        return mapping->a_ops->launder_page(page);
+}
+
 /**
  * invalidate_inode_pages2_range - remove range of pages from an address_space
  * @mapping: the address_space
@@ -405,7 +414,8 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                                           PAGE_CACHE_SIZE, 0);
                                 }
                         }
-                        if (!invalidate_complete_page2(mapping, page))
+                        ret = do_launder_page(mapping, page);
+                        if (ret == 0 && !invalidate_complete_page2(mapping, page))
                                 ret = -EIO;
                         unlock_page(page);
                 }
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index be04e9fb11f6..ab166b48ce8d 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -196,6 +196,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
 
         switch (CAPIMSG_SUBCOMMAND(skb->data)) {
         case CAPI_CONF:
+                if (skb->len < CAPI_MSG_BASELEN + 10)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 5);
                 info = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 8);
 
@@ -226,6 +229,9 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_PROFILE:
+                        if (skb->len < CAPI_MSG_BASELEN + 11 + sizeof(capi_profile))
+                                break;
+
                         controller = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 11);
                         msgnum = CAPIMSG_MSGID(skb->data);
 
@@ -246,17 +252,26 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_MANUFACTURER:
+                        if (skb->len < CAPI_MSG_BASELEN + 15)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 10);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_MANUFACTURER_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 14]);
+
+                                memset(ctrl->manu, 0, CAPI_MANUFACTURER_LEN);
                                 strncpy(ctrl->manu,
-                                        skb->data + CAPI_MSG_BASELEN + 15,
-                                        skb->data[CAPI_MSG_BASELEN + 14]);
+                                        skb->data + CAPI_MSG_BASELEN + 15, len);
                         }
 
                         break;
 
                 case CAPI_FUNCTION_GET_VERSION:
+                        if (skb->len < CAPI_MSG_BASELEN + 32)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
@@ -269,13 +284,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                         break;
 
                 case CAPI_FUNCTION_GET_SERIAL_NUMBER:
+                        if (skb->len < CAPI_MSG_BASELEN + 17)
+                                break;
+
                         controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
 
                         if (!info && ctrl) {
+                                int len = min_t(uint, CAPI_SERIAL_LEN,
+                                                skb->data[CAPI_MSG_BASELEN + 16]);
+
                                 memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
                                 strncpy(ctrl->serial,
-                                        skb->data + CAPI_MSG_BASELEN + 17,
-                                        skb->data[CAPI_MSG_BASELEN + 16]);
+                                        skb->data + CAPI_MSG_BASELEN + 17, len);
                         }
 
                         break;
@@ -284,14 +304,18 @@ static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *s
                 break;
 
         case CAPI_IND:
+                if (skb->len < CAPI_MSG_BASELEN + 6)
+                        break;
+
                 func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 3);
 
                 if (func == CAPI_FUNCTION_LOOPBACK) {
+                        int len = min_t(uint, skb->len - CAPI_MSG_BASELEN - 6,
+                                                skb->data[CAPI_MSG_BASELEN + 5]);
                         appl = CAPIMSG_APPID(skb->data);
                         msgnum = CAPIMSG_MSGID(skb->data);
                         cmtp_send_interopmsg(session, CAPI_RESP, appl, msgnum, func,
-                                                skb->data + CAPI_MSG_BASELEN + 6,
-                                                skb->data[CAPI_MSG_BASELEN + 5]);
+                                                skb->data + CAPI_MSG_BASELEN + 6, len);
                 }
 
                 break;
@@ -309,6 +333,9 @@ void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
 
         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 
+        if (skb->len < CAPI_MSG_BASELEN)
+                return;
+
         if (CAPIMSG_COMMAND(skb->data) == CAPI_INTEROPERABILITY) {
                 cmtp_recv_interopmsg(session, skb);
                 return;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index d4c935692ccf..801d687ea4ef 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -242,7 +242,7 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work);
         int i;
 
-        if (device_register(&conn->dev) < 0) {
+        if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
         }
@@ -272,6 +272,8 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         dev_set_drvdata(&conn->dev, conn);
 
+        device_initialize(&conn->dev);
+
         INIT_WORK(&conn->work, add_conn);
 
         schedule_work(&conn->work);
@@ -287,6 +289,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
 {
         BT_DBG("conn %p", conn);
 
+        if (!device_is_registered(&conn->dev))
+                return;
+
         INIT_WORK(&conn->work, del_conn);
 
         schedule_work(&conn->work);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 544d65b7baa7..cb7e855f0828 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -557,7 +557,6 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
         struct sock *sk = sock->sk;
         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
         struct sk_buff *skb;
-        int err;
         int sent = 0;
 
         if (msg->msg_flags & MSG_OOB)
@@ -572,6 +571,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         while (len) {
                 size_t size = min_t(size_t, len, d->mtu);
+                int err;
                 
                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
                                 msg->msg_flags & MSG_DONTWAIT, &err);
@@ -582,13 +582,16 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
                 if (err) {
                         kfree_skb(skb);
-                        sent = err;
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
                 err = rfcomm_dlc_send(d, skb);
                 if (err < 0) {
                         kfree_skb(skb);
+                        if (sent == 0)
+                                sent = err;
                         break;
                 }
 
@@ -598,7 +601,7 @@ static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         release_sock(sk);
 
-        return sent ? sent : err;
+        return sent;
 }
 
 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e0e0d09023b2..eb2b52484c70 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -697,9 +697,13 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        if (!dev || !dev->dlc)
+                return 0;
+
         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
         if (room < 0)
                 room = 0;
+
         return room;
 }
 
@@ -915,12 +919,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        struct rfcomm_dlc *dlc = dev->dlc;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
-        if (!skb_queue_empty(&dlc->tx_queue))
-                return dlc->mtu;
+        if (!dev || !dev->dlc)
+                return 0;
+
+        if (!skb_queue_empty(&dev->dlc->tx_queue))
+                return dev->dlc->mtu;
 
         return 0;
 }
@@ -928,11 +934,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev || !dev->dlc)
+                return;
+
         skb_queue_purge(&dev->dlc->tx_queue);
 
         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +959,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-        if (!dev)
-                return;
 
         BT_DBG("tty %p dev %p", tty, dev);
 
+        if (!dev)
+                return;
+
         rfcomm_tty_flush_buffer(tty);
 
         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 1144900d37f6..864009643675 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -305,7 +305,7 @@ lookup_protocol:
                 sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
-        inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
                 inet->num = protocol;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 25c8a42965df..480ace9819f6 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -174,9 +174,10 @@ struct in_device *inetdev_init(struct net_device *dev)
         ip_mc_init_dev(in_dev);
         if (dev->flags & IFF_UP)
                 ip_mc_up(in_dev);
-out:
+
         /* we can receive as soon as ip_ptr is set -- do this last */
         rcu_assign_pointer(dev->ip_ptr, in_dev);
+out:
         return in_dev;
 out_kfree:
         kfree(in_dev);
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 730a7a44c883..00d6dea9f7f3 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -123,7 +123,7 @@ nf_nat_fn(unsigned int hooknum,
 
         nat = nfct_nat(ct);
         if (!nat)
-                return NF_DROP;
+                return NF_ACCEPT;
 
         switch (ctinfo) {
         case IP_CT_RELATED:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index bf7a22412bcb..12de90a5047c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -648,7 +648,7 @@ static void tcp_v4_send_ack(struct tcp_timewait_sock *twsk,
                                    TCPOLEN_TIMESTAMP);
                 rep.opt[1] = htonl(tcp_time_stamp);
                 rep.opt[2] = htonl(ts);
-                arg.iov[0].iov_len = TCPOLEN_TSTAMP_ALIGNED;
+                arg.iov[0].iov_len += TCPOLEN_TSTAMP_ALIGNED;
         }
 
         /* Swap the send and the receive. */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e5cd83b2205d..0e0e4262f4dc 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -171,7 +171,7 @@ lookup_protocol:
                 sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
-        inet->is_icsk = INET_PROTOSW_ICSK & answer_flags;
+        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
                 inet->num = protocol;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 37e5fca923aa..d9c15402ba66 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -835,6 +835,8 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                 s->nfct_reasm = skb;
 
                 s2 = s->next;
+                s->next = NULL;
+
                 NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn,
                                NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
                 s = s2;
diff --git a/net/netfilter/nf_conntrack_netbios_ns.c b/net/netfilter/nf_conntrack_netbios_ns.c
index a5b234e444dc..2a48efdf0d67 100644
--- a/net/netfilter/nf_conntrack_netbios_ns.c
+++ b/net/netfilter/nf_conntrack_netbios_ns.c
@@ -89,6 +89,7 @@ static int help(struct sk_buff **pskb, unsigned int protoff,
 
         exp->expectfn             = NULL;
         exp->flags                = NF_CT_EXPECT_PERMANENT;
+        exp->helper               = NULL;
 
         nf_conntrack_expect_related(exp);
         nf_conntrack_expect_put(exp);
diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4afc75f9e377..73e0ff469bff 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -130,12 +130,12 @@ static int netlbl_cipsov4_add_common(struct genl_info *info,
 
         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
                 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
-                        if (iter > CIPSO_V4_TAG_MAXCNT)
+                        if (iter >= CIPSO_V4_TAG_MAXCNT)
                                 return -EINVAL;
                         doi_def->tags[iter++] = nla_get_u8(nla);
                 }
-        if (iter < CIPSO_V4_TAG_MAXCNT)
-                doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
+        while (iter < CIPSO_V4_TAG_MAXCNT)
+                doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 
         return 0;
 }
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f0bbe36799cf..167d888d1df2 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -124,8 +124,8 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         padlen = len % 4;
         err.length  = htons(len);
         len += padlen;
-        sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
-        chunk->subh.err_hdr = sctp_addto_chunk(chunk, paylen, payload);
+        chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
+        sctp_addto_chunk(chunk, paylen, payload);
 }
 
 /* 3.3.2 Initiation (INIT) (1)
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index 9f42b9c9de37..27f5cc7966f6 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -254,7 +254,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
          *      They want reverse charging, we won't accept it.
          */
         if ((theirs.reverse & 0x01 ) && (ours->reverse & 0x01)) {
-                SOCK_DEBUG(sk, "X.25: rejecting reverse charging request");
+                SOCK_DEBUG(sk, "X.25: rejecting reverse charging request\n");
                 return -1;
         }
 
@@ -262,29 +262,29 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
 
         if (theirs.throughput) {
                 if (theirs.throughput < ours->throughput) {
-                        SOCK_DEBUG(sk, "X.25: throughput negotiated down");
+                        SOCK_DEBUG(sk, "X.25: throughput negotiated down\n");
                         new->throughput = theirs.throughput;
                 }
         }
 
         if (theirs.pacsize_in && theirs.pacsize_out) {
                 if (theirs.pacsize_in < ours->pacsize_in) {
-                        SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: packet size inwards negotiated down\n");
                         new->pacsize_in = theirs.pacsize_in;
                 }
                 if (theirs.pacsize_out < ours->pacsize_out) {
-                        SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: packet size outwards negotiated down\n");
                         new->pacsize_out = theirs.pacsize_out;
                 }
         }
 
         if (theirs.winsize_in && theirs.winsize_out) {
                 if (theirs.winsize_in < ours->winsize_in) {
-                        SOCK_DEBUG(sk, "X.25: window size inwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: window size inwards negotiated down\n");
                         new->winsize_in = theirs.winsize_in;
                 }
                 if (theirs.winsize_out < ours->winsize_out) {
-                        SOCK_DEBUG(sk, "X.25: window size outwards negotiated down");
+                        SOCK_DEBUG(sk, "X.25: window size outwards negotiated down\n");
                         new->winsize_out = theirs.winsize_out;
                 }
         }
diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc
index a8ffc329666a..c0ae0a7ddb42 100644
--- a/scripts/kconfig/qconf.cc
+++ b/scripts/kconfig/qconf.cc
@@ -917,7 +917,7 @@ void ConfigView::updateListAll(void)
 }
 
 ConfigInfoView::ConfigInfoView(QWidget* parent, const char *name)
-        : Parent(parent, name), menu(0)
+        : Parent(parent, name), menu(0), sym(0)
 {
         if (name) {
                 configSettings->beginGroup(name);
@@ -925,8 +925,6 @@ ConfigInfoView::ConfigInfoView(QWidget* parent, const char *name)
                 configSettings->endGroup();
                 connect(configApp, SIGNAL(aboutToQuit()), SLOT(saveSettings()));
         }
-
-        has_dbg_info = 0;
 }
 
 void ConfigInfoView::saveSettings(void)
@@ -955,13 +953,11 @@ void ConfigInfoView::setInfo(struct menu *m)
         if (menu == m)
                 return;
         menu = m;
-        if (!menu) {
-                has_dbg_info = 0;
+        sym = NULL;
+        if (!menu)
                 clear();
-        } else {
-                has_dbg_info = 1;
+        else
                 menuInfo();
-       }
 }
 
 void ConfigInfoView::setSource(const QString& name)
@@ -996,9 +992,6 @@ void ConfigInfoView::symbolInfo(void)
 {
         QString str;
 
-        if (!has_dbg_info)
-                return;
-
         str += "<big>Symbol: <b>";
         str += print_filter(sym->name);
         str += "</b></big><br><br>value: ";
diff --git a/scripts/kconfig/qconf.h b/scripts/kconfig/qconf.h
index a397edb5adcf..6fc1c5f14425 100644
--- a/scripts/kconfig/qconf.h
+++ b/scripts/kconfig/qconf.h
@@ -273,8 +273,6 @@ protected:
         struct symbol *sym;
         struct menu *menu;
         bool _showDebug;
-
-        int has_dbg_info;
 };
 
 class ConfigSearchWindow : public QDialog {
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 15ab5d02e80a..2aa47623f5f8 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -582,9 +582,19 @@ static int strrcmp(const char *s, const char *sub)
  *   tosec   = .init.text | .exit.text | .init.data
  *   fromsec = .data
  *   atsym = *driver, *_template, *_sht, *_ops, *_probe, *probe_one
+ *
+ * Pattern 3:
+ *   Some symbols belong to init section but still it is ok to reference
+ *   these from non-init sections as these symbols don't have any memory
+ *   allocated for them and symbol address and value are same. So even
+ *   if init section is freed, its ok to reference those symbols.
+ *   For ex. symbols marking the init section boundaries.
+ *   This pattern is identified by
+ *   refsymname = __init_begin, _sinittext, _einittext
  **/
 static int secref_whitelist(const char *modname, const char *tosec,
-                            const char *fromsec, const char *atsym)
+                            const char *fromsec, const char *atsym,
+                            const char *refsymname)
 {
         int f1 = 1, f2 = 1;
         const char **s;
@@ -595,6 +605,14 @@ static int secref_whitelist(const char *modname, const char *tosec,
                 "_ops",
                 "_probe",
                 "_probe_one",
+                "_console",
+                NULL
+        };
+
+        const char *pat3refsym[] = {
+                "__init_begin",
+                "_sinittext",
+                "_einittext",
                 NULL
         };
 
@@ -628,6 +646,11 @@ static int secref_whitelist(const char *modname, const char *tosec,
                 if ((strcmp(fromsec, ".pci_fixup") == 0) &&
                     (strcmp(tosec, ".init.text") == 0))
                 return 1;
+
+                /* Check for pattern 3 */
+                for (s = pat3refsym; *s; s++)
+                        if (strcmp(refsymname, *s) == 0)
+                                return 1;
         }
         return 0;
 }
@@ -737,7 +760,7 @@ static void warn_sec_mismatch(const char *modname, const char *fromsec,
         /* check whitelist - we may ignore it */
         if (before &&
             secref_whitelist(modname, secname, fromsec,
-                             elf->strtab + before->st_name))
+                             elf->strtab + before->st_name, refsymname))
                 return;
 
         if (before && after) {
diff --git a/security/selinux/ss/context.h b/security/selinux/ss/context.h
index 0562bacb7b99..2eee0dab524d 100644
--- a/security/selinux/ss/context.h
+++ b/security/selinux/ss/context.h
@@ -55,6 +55,29 @@ out:
         return rc;
 }
 
+/*
+ * Sets both levels in the MLS range of 'dst' to the low level of 'src'.
+ */
+static inline int mls_context_cpy_low(struct context *dst, struct context *src)
+{
+        int rc;
+
+        if (!selinux_mls_enabled)
+                return 0;
+
+        dst->range.level[0].sens = src->range.level[0].sens;
+        rc = ebitmap_cpy(&dst->range.level[0].cat, &src->range.level[0].cat);
+        if (rc)
+                goto out;
+
+        dst->range.level[1].sens = src->range.level[0].sens;
+        rc = ebitmap_cpy(&dst->range.level[1].cat, &src->range.level[0].cat);
+        if (rc)
+                ebitmap_destroy(&dst->range.level[0].cat);
+out:
+        return rc;
+}
+
 static inline int mls_context_cmp(struct context *c1, struct context *c2)
 {
         if (!selinux_mls_enabled)
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index b4f682dc13ff..4a8bab2f3c71 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -270,7 +270,7 @@ int mls_context_to_sid(char oldc,
                 if (!defcon)
                         goto out;
 
-                rc = mls_copy_context(context, defcon);
+                rc = mls_context_cpy(context, defcon);
                 goto out;
         }
 
@@ -401,26 +401,6 @@ int mls_from_string(char *str, struct context *context, gfp_t gfp_mask)
 }
 
 /*
- * Copies the effective MLS range from `src' into `dst'.
- */
-static inline int mls_scopy_context(struct context *dst,
-                                    struct context *src)
-{
-        int l, rc = 0;
-
-        /* Copy the MLS range from the source context */
-        for (l = 0; l < 2; l++) {
-                dst->range.level[l].sens = src->range.level[0].sens;
-                rc = ebitmap_cpy(&dst->range.level[l].cat,
-                                 &src->range.level[0].cat);
-                if (rc)
-                        break;
-        }
-
-        return rc;
-}
-
-/*
  * Copies the MLS range `range' into `context'.
  */
 static inline int mls_range_set(struct context *context,
@@ -552,19 +532,19 @@ int mls_compute_sid(struct context *scontext,
         case AVTAB_CHANGE:
                 if (tclass == SECCLASS_PROCESS)
                         /* Use the process MLS attributes. */
-                        return mls_copy_context(newcontext, scontext);
+                        return mls_context_cpy(newcontext, scontext);
                 else
                         /* Use the process effective MLS attributes. */
-                        return mls_scopy_context(newcontext, scontext);
+                        return mls_context_cpy_low(newcontext, scontext);
         case AVTAB_MEMBER:
                 /* Only polyinstantiate the MLS attributes if
                    the type is being polyinstantiated */
                 if (newcontext->type != tcontext->type) {
                         /* Use the process effective MLS attributes. */
-                        return mls_scopy_context(newcontext, scontext);
+                        return mls_context_cpy_low(newcontext, scontext);
                 } else {
                         /* Use the related object MLS attributes. */
-                        return mls_copy_context(newcontext, tcontext);
+                        return mls_context_cpy(newcontext, tcontext);
                 }
         default:
                 return -EINVAL;
diff --git a/security/selinux/ss/mls.h b/security/selinux/ss/mls.h
index 661d6fc76966..096d1b4ef7fb 100644
--- a/security/selinux/ss/mls.h
+++ b/security/selinux/ss/mls.h
@@ -24,26 +24,6 @@
 #include "context.h"
 #include "policydb.h"
 
-/*
- * Copies the MLS range from `src' into `dst'.
- */
-static inline int mls_copy_context(struct context *dst,
-                                   struct context *src)
-{
-        int l, rc = 0;
-
-        /* Copy the MLS range from the source context */
-        for (l = 0; l < 2; l++) {
-                dst->range.level[l].sens = src->range.level[l].sens;
-                rc = ebitmap_cpy(&dst->range.level[l].cat,
-                                 &src->range.level[l].cat);
-                if (rc)
-                        break;
-        }
-
-        return rc;
-}
-
 int mls_compute_context_len(struct context *context);
 void mls_sid_to_context(struct context *context, char **scontext);
 int mls_context_isvalid(struct policydb *p, struct context *c);
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index ee0581557966..3eb1fa9f0de1 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -1916,11 +1916,10 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
         newcon.user = context1->user;
         newcon.role = context1->role;
         newcon.type = context1->type;
-        rc = mls_copy_context(&newcon, context2);
+        rc = mls_context_cpy(&newcon, context2);
         if (rc)
                 goto out_unlock;
 
-
         /* Check the validity of the new context. */
         if (!policydb_context_isvalid(&policydb, &newcon)) {
                 rc = convert_context_handle_invalid_context(&newcon);
@@ -2492,9 +2491,9 @@ static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid)
 
         rc = netlbl_socket_setattr(sock, &secattr);
         if (rc == 0) {
-                spin_lock(&sksec->nlbl_lock);
+                spin_lock_bh(&sksec->nlbl_lock);
                 sksec->nlbl_state = NLBL_LABELED;
-                spin_unlock(&sksec->nlbl_lock);
+                spin_unlock_bh(&sksec->nlbl_lock);
         }
 
 netlbl_socket_setsid_return:
diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
index 71c58df4af28..70face7e1048 100644
--- a/sound/pci/cmipci.c
+++ b/sound/pci/cmipci.c
@@ -2198,7 +2198,8 @@ static int _snd_cmipci_uswitch_put(struct snd_kcontrol *kcontrol,
                 val = inb(cm->iobase + args->reg);
         else
                 val = snd_cmipci_read(cm, args->reg);
-        change = (val & args->mask) != (ucontrol->value.integer.value[0] ? args->mask : 0);
+        change = (val & args->mask) != (ucontrol->value.integer.value[0] ? 
+                        args->mask_on : (args->mask & ~args->mask_on));
         if (change) {
                 val &= ~args->mask;
                 if (ucontrol->value.integer.value[0])
diff --git a/sound/pci/echoaudio/midi.c b/sound/pci/echoaudio/midi.c
index e31f0f11e3a8..91f5bff66d3f 100644
--- a/sound/pci/echoaudio/midi.c
+++ b/sound/pci/echoaudio/midi.c
@@ -213,7 +213,7 @@ static void snd_echo_midi_output_write(unsigned long data)
         sent = bytes = 0;
         spin_lock_irqsave(&chip->lock, flags);
         chip->midi_full = 0;
-        if (chip->midi_out && !snd_rawmidi_transmit_empty(chip->midi_out)) {
+        if (!snd_rawmidi_transmit_empty(chip->midi_out)) {
                 bytes = snd_rawmidi_transmit_peek(chip->midi_out, buf,
                                                   MIDI_OUT_BUFFER_SIZE - 1);
                 DE_MID(("Try to send %d bytes...\n", bytes));
@@ -264,9 +264,11 @@ static void snd_echo_midi_output_trigger(struct snd_rawmidi_substream *substream
                 }
         } else {
                 if (chip->tinuse) {
-                        del_timer(&chip->timer);
                         chip->tinuse = 0;
+                        spin_unlock_irq(&chip->lock);
+                        del_timer_sync(&chip->timer);
                         DE_MID(("Timer removed\n"));
+                        return;
                 }
         }
         spin_unlock_irq(&chip->lock);
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 97e9af130b71..1589d2f2917f 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -485,8 +485,9 @@ static const char *get_input_type(struct hda_gnode *node, unsigned int *pinctl)
                         return "Front Aux";
                 return "Aux";
         case AC_JACK_MIC_IN:
-                if (node->pin_caps &
-                    (AC_PINCAP_VREF_80 << AC_PINCAP_VREF_SHIFT))
+                if (pinctl &&
+                    (node->pin_caps &
+                     (AC_PINCAP_VREF_80 << AC_PINCAP_VREF_SHIFT)))
                         *pinctl |= AC_PINCTL_VREF_80;
                 if ((location & 0x0f) == AC_JACK_LOC_FRONT)
                         return "Front Mic";
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 9fd34f85cad5..1a7e82104bb9 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -83,6 +83,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{Intel, ICH7},"
                          "{Intel, ESB2},"
                          "{Intel, ICH8},"
+                         "{Intel, ICH9},"
                          "{ATI, SB450},"
                          "{ATI, SB600},"
                          "{ATI, RS600},"
@@ -1711,6 +1712,8 @@ static struct pci_device_id azx_ids[] = {
         { 0x8086, 0x27d8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH7 */
         { 0x8086, 0x269a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ESB2 */
         { 0x8086, 0x284b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH8 */
+        { 0x8086, 0x293e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH9 */
+        { 0x8086, 0x293f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH9 */
         { 0x1002, 0x437b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB450 */
         { 0x1002, 0x4383, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB600 */
         { 0x1002, 0x793b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATIHDMI }, /* ATI RS600 HDMI */
@@ -1718,9 +1721,14 @@ static struct pci_device_id azx_ids[] = {
         { 0x1106, 0x3288, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_VIA }, /* VIA VT8251/VT8237A */
         { 0x1039, 0x7502, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_SIS }, /* SIS966 */
         { 0x10b9, 0x5461, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ULI }, /* ULI M5461 */
-        { 0x10de, 0x026c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA 026c */
-        { 0x10de, 0x0371, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA 0371 */
-        { 0x10de, 0x03f0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA 03f0 */
+        { 0x10de, 0x026c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP51 */
+        { 0x10de, 0x0371, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP55 */
+        { 0x10de, 0x03e4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP61 */
+        { 0x10de, 0x03f0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP61 */
+        { 0x10de, 0x044a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP65 */
+        { 0x10de, 0x044b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP65 */
+        { 0x10de, 0x055c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP67 */
+        { 0x10de, 0x055d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_NVIDIA }, /* NVIDIA MCP67 */
         { 0, }
 };
 MODULE_DEVICE_TABLE(pci, azx_ids);
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index 3d7f36fb4cf0..19bdcc74c96c 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2471,7 +2471,13 @@ static int parse_audio_format_rates(struct snd_usb_audio *chip, struct audioform
                 fp->nr_rates = nr_rates;
                 fp->rate_min = fp->rate_max = combine_triple(&fmt[8]);
                 for (r = 0, idx = offset + 1; r < nr_rates; r++, idx += 3) {
-                        unsigned int rate = fp->rate_table[r] = combine_triple(&fmt[idx]);
+                        unsigned int rate = combine_triple(&fmt[idx]);
+                        /* C-Media CM6501 mislabels its 96 kHz altsetting */
+                        if (rate == 48000 && nr_rates == 1 &&
+                            chip->usb_id == USB_ID(0x0d8c, 0x0201) &&
+                            fp->altsetting == 5 && fp->maxpacksize == 392)
+                                rate = 96000;
+                        fp->rate_table[r] = rate;
                         if (rate < fp->rate_min)
                                 fp->rate_min = rate;
                         else if (rate > fp->rate_max)
@@ -3280,6 +3286,7 @@ static void snd_usb_audio_create_proc(struct snd_usb_audio *chip)
 
 static int snd_usb_audio_free(struct snd_usb_audio *chip)
 {
+        usb_chip[chip->index] = NULL;
         kfree(chip);
         return 0;
 }
@@ -3541,7 +3548,6 @@ static void snd_usb_audio_disconnect(struct usb_device *dev, void *ptr)
                 list_for_each(p, &chip->mixer_list) {
                         snd_usb_mixer_disconnect(p);
                 }
-                usb_chip[chip->index] = NULL;
                 mutex_unlock(&register_mutex);
                 snd_card_free_when_closed(card);
         } else {
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index e74eb1bc8d87..7b3bf3545a3b 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -1526,7 +1526,7 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, unsi
                 namelist[i] = kmalloc(MAX_ITEM_NAME_LEN, GFP_KERNEL);
                 if (! namelist[i]) {
                         snd_printk(KERN_ERR "cannot malloc\n");
-                        while (--i > 0)
+                        while (i--)
                                 kfree(namelist[i]);
                         kfree(namelist);
                         kfree(cval);